- Fix for VU#209659 CVE-2011-4528: Unbound denial of service

vulnerabilities from nonstandard redirection and denial of existence
http://www.unbound.net/downloads/CVE-2011-4528.txt
- robust checks for next-closer NSEC3s.
- tag 1.4.14 created.


git-svn-id: file:///svn/unbound/trunk@2574 be551aaa-1e26-0410-a405-d3ace91eadb9

acx_nlnetlabs.m4

@@ -2,7 +2,17 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 9
+# Version 19
+# 2011-12-05 Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc.
+# 	     Fix ACX_MALLOC for redefined malloc error.
+# 	     Fix GETADDRINFO_WITH_INCLUDES to add -lws2_32
+# 2011-11-10 Fix FLTO test to not drop a.out in current directory.
+# 2011-11-01 Fix FLTO test for llvm on Lion.
+# 2011-08-01 Fix nonblock test (broken at v13).
+# 2011-08-01 Fix autoconf 2.68 warnings
+# 2011-06-23 Add ACX_CHECK_FLTO to check -flto.
+# 2010-08-16 Fix FLAG_OMITTED for AS_TR_CPP changes in autoconf-2.66.
+# 2010-07-02 Add check for ss_family (for minix).
 # 2010-04-26 Fix to use CPPFLAGS for CHECK_COMPILER_FLAGS.
 # 2010-03-01 Fix RPATH using CONFIG_COMMANDS to run at the very end.
 # 2010-02-18 WITH_SSL outputs the LIBSSL_LDFLAGS, LIBS, CPPFLAGS seperate, -ldl
@@ -30,6 +40,7 @@
 # ACX_DETERMINE_EXT_FLAGS_UNBOUND - find out which flags enable BSD and POSIX.
 # ACX_CHECK_FORMAT_ATTRIBUTE	- find cc printf format syntax.
 # ACX_CHECK_UNUSED_ATTRIBUTE	- find cc variable unused syntax.
+# ACX_CHECK_FLTO		- see if cc supports -flto and use it if so.
 # ACX_LIBTOOL_C_ONLY		- create libtool for C only, improved.
 # ACX_TYPE_U_CHAR		- u_char type.
 # ACX_TYPE_RLIM_T		- rlim_t type.
@@ -74,6 +85,7 @@
 # AHX_CONFIG_EXT_FLAGS		- define the stripped extension flags
 # ACX_CHECK_MEMCMP_SIGNED	- check if memcmp uses signed characters.
 # AHX_MEMCMP_BROKEN		- replace memcmp func for CHECK_MEMCMP_SIGNED.
+# ACX_CHECK_SS_FAMILY           - check for sockaddr_storage.ss_family
 #
 
 dnl Escape backslashes as \\, for C:\ paths, for the C preprocessor defines.
@@ -380,6 +392,24 @@ int test() {
 
 ])dnl End of ACX_DETERMINE_EXT_FLAGS_UNBOUND
 
+dnl Check if CC supports -flto.
+dnl in a way that supports clang and suncc (that flag does something else,
+dnl but fails to link).  It sets it in CFLAGS if it works.
+AC_DEFUN([ACX_CHECK_FLTO],
+[AC_MSG_CHECKING([if $CC supports -flto])
+BAKCFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -flto"
+AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], [
+    if $CC $CFLAGS -o conftest conftest.c 2>&1 | grep "warning: no debug symbols in executable" >/dev/null; then
+	CFLAGS="$BAKCFLAGS"
+	AC_MSG_RESULT(no)
+    else
+	AC_MSG_RESULT(yes)
+    fi
+    rm -f conftest conftest.c conftest.o
+], [CFLAGS="$BAKCFLAGS" ; AC_MSG_RESULT(no)])
+])
+
 dnl Check the printf-format attribute (if any)
 dnl result in HAVE_ATTR_FORMAT.  
 dnl Make sure you also include the AHX_CONFIG_FORMAT_ATTRIBUTE.
@@ -751,7 +781,7 @@ AC_DEFUN([ACX_CHECK_GETADDRINFO_WITH_INCLUDES],
 AC_MSG_CHECKING(for getaddrinfo)
 ac_cv_func_getaddrinfo=no
 AC_LINK_IFELSE(
-[
+[AC_LANG_SOURCE([[
 #ifdef __cplusplus
 extern "C"
 {
@@ -765,14 +795,21 @@ int main() {
         ;
         return 0;
 }
-],
+]])],
 dnl this case on linux, solaris, bsd
-[ac_cv_func_getaddrinfo="yes"],
+[ac_cv_func_getaddrinfo="yes"
+dnl see if on windows
+if test "$ac_cv_header_windows_h" = "yes"; then
+	AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used])
+	USE_WINSOCK="1"
+	LIBS="$LIBS -lws2_32"
+fi
+],
 dnl no quick getaddrinfo, try mingw32 and winsock2 library.
 ORIGLIBS="$LIBS"
 LIBS="$LIBS -lws2_32"
 AC_LINK_IFELSE(
-AC_LANG_PROGRAM(
+[AC_LANG_PROGRAM(
 [
 #ifdef HAVE_WS2TCPIP_H
 #include <ws2tcpip.h>
@@ -781,7 +818,7 @@ AC_LANG_PROGRAM(
 [
         (void)getaddrinfo(NULL, NULL, NULL, NULL);
 ]
-),
+)],
 [
 ac_cv_func_getaddrinfo="yes"
 dnl already: LIBS="$LIBS -lws2_32"
@@ -845,7 +882,8 @@ if echo $target | grep mingw32 >/dev/null; then
 	AC_MSG_RESULT([no (windows)])
 	AC_DEFINE([NONBLOCKING_IS_BROKEN], 1, [Define if the network stack does not fully support nonblocking io (causes lower performance).])
 else
-AC_RUN_IFELSE(AC_LANG_PROGRAM([
+AC_RUN_IFELSE([
+AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -869,7 +907,9 @@ AC_RUN_IFELSE(AC_LANG_PROGRAM([
 #ifdef HAVE_TIME_H
 #include <time.h>
 #endif
-],[[
+
+int main(void)
+{
 	int port;
 	int sfd, cfd;
 	int num = 10;
@@ -962,7 +1002,9 @@ AC_RUN_IFELSE(AC_LANG_PROGRAM([
 
 	close(sfd);
 	close(cfd);
-]]), [
+	return 0;
+}
+]])], [
 	AC_MSG_RESULT([yes])
 ], [
 	AC_MSG_RESULT([no])
@@ -1002,13 +1044,13 @@ AC_DEFUN([ACX_FUNC_IOCTLSOCKET],
 [
 # check ioctlsocket
 AC_MSG_CHECKING(for ioctlsocket)
-AC_LINK_IFELSE(AC_LANG_PROGRAM([
+AC_LINK_IFELSE([AC_LANG_PROGRAM([
 #ifdef HAVE_WINSOCK2_H
 #include <winsock2.h>
 #endif
 ], [
 	(void)ioctlsocket(0, 0, NULL);
-]), [
+])], [
 AC_MSG_RESULT(yes)
 AC_DEFINE(HAVE_IOCTLSOCKET, 1, [if the function 'ioctlsocket' is available])
 ],[AC_MSG_RESULT(no)])
@@ -1018,10 +1060,23 @@ dnl detect malloc and provide malloc compat prototype.
 dnl $1: unique name for compat code
 AC_DEFUN([ACX_FUNC_MALLOC],
 [
-	AC_FUNC_MALLOC
-	if test "$ac_cv_func_malloc_0_nonnull" = no; then
-		AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])
-	fi
+	AC_MSG_CHECKING([for GNU libc compatible malloc])
+	AC_RUN_IFELSE([AC_LANG_PROGRAM(
+[[#if defined STDC_HEADERS || defined HAVE_STDLIB_H
+#include <stdlib.h>
+#else
+char *malloc ();
+#endif
+]], [ if(malloc(0) != 0) return 1;])
+],
+	[AC_MSG_RESULT([no])
+	AC_LIBOBJ(malloc)
+	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] ,
+	[AC_MSG_RESULT([yes])
+	AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
+	[AC_MSG_RESULT([no (crosscompile)])
+	AC_LIBOBJ(malloc)
+	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] )
 ])
 
 dnl Define fallback for fseeko and ftello if needed.
@@ -1190,7 +1245,7 @@ AC_DEFUN([ACX_CFLAGS_STRIP],
 [
   if echo $CFLAGS | grep " $1" >/dev/null 2>&1; then
     CFLAGS="`echo $CFLAGS | sed -e 's/ $1//g'`"
-    AC_DEFINE(AS_TR_CPP(OMITTED_$1), 1, Put $1 define in config.h)
+    AC_DEFINE(m4_bpatsubst(OMITTED_$1,[[-=]],_), 1, Put $1 define in config.h)
   fi
 ])
 
@@ -1221,7 +1276,7 @@ AC_DEFUN([AHX_CONFIG_FLAG_OMITTED],
 dnl Wrapper for AHX_CONFIG_FLAG_OMITTED for -D style flags
 dnl $1: the -DNAME or -DNAME=value string.
 AC_DEFUN([AHX_CONFIG_FLAG_EXT],
-[AHX_CONFIG_FLAG_OMITTED(AS_TR_CPP(OMITTED_$1),m4_bpatsubst(m4_bpatsubst($1,-D,),=.*$,),m4_if(m4_bregexp($1,=),-1,1,m4_bpatsubst($1,^.*=,)))
+[AHX_CONFIG_FLAG_OMITTED(m4_bpatsubst(OMITTED_$1,[[-=]],_),m4_bpatsubst(m4_bpatsubst($1,-D,),=.*$,),m4_if(m4_bregexp($1,=),-1,1,m4_bpatsubst($1,^.*=,)))
 ])
 
 dnl config.h part to define omitted cflags, use with ACX_STRIP_EXT_FLAGS.
@@ -1270,4 +1325,38 @@ int memcmp(const void *x, const void *y, size_t n);
 #endif
 ])
 
+dnl ACX_CHECK_SS_FAMILY           - check for sockaddr_storage.ss_family
+AC_DEFUN([ACX_CHECK_SS_FAMILY],
+[AC_CHECK_MEMBER([struct sockaddr_storage.ss_family], [], [
+        AC_CHECK_MEMBER([struct sockaddr_storage.__ss_family], [
+                AC_DEFINE([ss_family], [__ss_family], [Fallback member name for socket family in struct sockaddr_storage])
+        ],, [AC_INCLUDES_DEFAULT
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+    ])
+], [AC_INCLUDES_DEFAULT
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+]) ])
+
 dnl End of file

acx_python.m4

@@ -129,7 +129,7 @@ $ac_distutils_result])
         AC_MSG_CHECKING([for Python site-packages path])
         if test -z "$PYTHON_SITE_PKG"; then
                 PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
-                        print distutils.sysconfig.get_python_lib(0,0);"`
+                        print distutils.sysconfig.get_python_lib(1,0);"`
         fi
         AC_MSG_RESULT([$PYTHON_SITE_PKG])
         AC_SUBST([PYTHON_SITE_PKG])

compat/ctime_r.c

@@ -32,8 +32,11 @@ char *ctime_r(const time_t *timep, char *buf)
 	}
 	lock_basic_lock(&ctime_lock);
 	result = ctime(timep);
-	if(buf && result)
+	if(buf && result) {
+		if(strlen(result) > 10 && result[7]==' ' && result[8]=='0')
+			result[8]=' '; /* fix error in windows ctime */
 		strcpy(buf, result);
+	}
 	lock_basic_unlock(&ctime_lock);
 	return result;
 }

compat/inet_ntop.c

@@ -135,7 +135,9 @@ inet_ntop6(const u_char *src, char *dst, size_t size)
 	for (i = 0; i < IN6ADDRSZ; i++)
 		words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3));
 	best.base = -1;
+	best.len = 0;
 	cur.base = -1;
+	cur.len = 0;
 	for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
 		if (words[i] == 0) {
 			if (cur.base == -1)

compat/strptime.c

@@ -0,0 +1,345 @@
+/** strptime workaround (for oa macos leopard)
+  * This strptime follows the man strptime (2001-11-12)
+  *		conforming to SUSv2, POSIX.1-2001
+  *
+  * This very simple version of strptime has no:
+  * - E alternatives
+  * - O alternatives
+  * - Glibc additions
+  * - Does not process week numbers
+  * - Does not properly processes year day
+  *
+  * LICENSE
+  * Copyright (c) 2008, NLnet Labs, Matthijs Mekking
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions are met:
+  * * Redistributions of source code must retain the above copyright notice,
+  *     this list of conditions and the following disclaimer.
+  * * Redistributions in binary form must reproduce the above copyright
+  *   notice, this list of conditions and the following disclaimer in the
+  *   documentation and/or other materials provided with the distribution.
+  * * Neither the name of NLnetLabs nor the names of its
+  *   contributors may be used to endorse or promote products derived from this
+  *   software without specific prior written permission.
+  *
+  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+  * POSSIBILITY OF SUCH DAMAGE.
+ **/
+
+#include "config.h"
+
+#ifndef HAVE_CONFIG_H
+#include <time.h>
+#endif
+
+#ifndef STRPTIME_WORKS
+
+#define TM_YEAR_BASE 1900
+
+#include <ctype.h>
+#include <string.h>
+
+static const char *abb_weekdays[] = {
+	"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", NULL
+};
+static const char *full_weekdays[] = {
+	"Sunday", "Monday", "Tuesday", "Wednesday",
+	"Thursday", "Friday", "Saturday", NULL
+};
+static const char *abb_months[] = {
+	"Jan", "Feb", "Mar", "Apr", "May", "Jun",
+	"Jul", "Aug", "Sep", "Oct", "Nov", "Dec", NULL
+};
+static const char *full_months[] = {
+	"January", "February", "March", "April", "May", "June",
+	"July", "August", "September", "October", "November", "December", NULL
+};
+static const char *ampm[] = {
+    "am", "pm", NULL
+};
+
+static int
+match_string(const char **buf, const char **strs)
+{
+	int i = 0;
+
+	for (i = 0; strs[i] != NULL; i++) {
+		int len = strlen(strs[i]);
+		if (strncasecmp (*buf, strs[i], len) == 0) {
+			*buf += len;
+			return i;
+		}
+	}
+	return -1;
+}
+
+static int
+str2int(const char **buf, int max)
+{
+	int ret=0, count=0;
+
+	while (*buf[0] != '\0' && isdigit(*buf[0]) && count<max) {
+		ret = ret*10 + (*buf[0] - '0');
+		(*buf)++;
+		count++;
+	}
+
+	if (!count)
+		return -1;
+	return ret;
+}
+
+/** Converts the character string s to values which are stored in tm
+  * using the format specified by format
+ **/
+char *
+unbound_strptime(const char *s, const char *format, struct tm *tm)
+{
+	int c, ret;
+	int split_year = 0;
+
+	while ((c = *format) != '\0') {
+		/* whitespace, literal or format */
+		if (isspace(c)) { /* whitespace */
+			/** whitespace matches zero or more whitespace characters in the
+			  * input string.
+			 **/
+			while (isspace(*s))
+				s++;
+		}
+		else if (c == '%') { /* format */
+			format++;
+			c = *format;
+			switch (c) {
+				case '%': /* %% is converted to % */
+					if (*s != c) {
+						return NULL;
+					}
+					s++;
+					break;
+				case 'a': /* weekday name, abbreviated or full */
+				case 'A':
+					ret = match_string(&s, full_weekdays);
+					if (ret < 0)
+						ret = match_string(&s, abb_weekdays);
+					if (ret < 0) {
+						return NULL;
+					}
+					tm->tm_wday = ret;
+					break;
+				case 'b': /* month name, abbreviated or full */
+				case 'B':
+				case 'h':
+					ret = match_string(&s, full_months);
+					if (ret < 0)
+						ret = match_string(&s, abb_months);
+					if (ret < 0) {
+						return NULL;
+					}
+					tm->tm_mon = ret;
+					break;
+				case 'c': /* date and time representation */
+					if (!(s = unbound_strptime(s, "%x %X", tm))) {
+						return NULL;
+					}
+					break;
+				case 'C': /* century number */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 99) { /* must be in [00,99] */
+						return NULL;
+					}
+
+					if (split_year)	{
+						tm->tm_year = ret*100 + (tm->tm_year%100);
+					}
+					else {
+						tm->tm_year = ret*100 - TM_YEAR_BASE;
+						split_year = 1;
+					}
+					break;
+				case 'd': /* day of month */
+				case 'e':
+					ret = str2int(&s, 2);
+					if (ret < 1 || ret > 31) { /* must be in [01,31] */
+						return NULL;
+					}
+					tm->tm_mday = ret;
+					break;
+				case 'D': /* equivalent to %m/%d/%y */
+					if (!(s = unbound_strptime(s, "%m/%d/%y", tm))) {
+						return NULL;
+					}
+					break;
+				case 'H': /* hour */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 23) { /* must be in [00,23] */
+						return NULL;
+					}
+					tm->tm_hour = ret;
+					break;
+				case 'I': /* 12hr clock hour */
+					ret = str2int(&s, 2);
+					if (ret < 1 || ret > 12) { /* must be in [01,12] */
+						return NULL;
+					}
+					if (ret == 12) /* actually [0,11] */
+						ret = 0;
+					tm->tm_hour = ret;
+					break;
+				case 'j': /* day of year */
+					ret = str2int(&s, 2);
+					if (ret < 1 || ret > 366) { /* must be in [001,366] */
+						return NULL;
+					}
+					tm->tm_yday = ret;
+					break;
+				case 'm': /* month */
+					ret = str2int(&s, 2);
+					if (ret < 1 || ret > 12) { /* must be in [01,12] */
+						return NULL;
+					}
+					/* months go from 0-11 */
+					tm->tm_mon = (ret-1);
+					break;
+				case 'M': /* minute */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 59) { /* must be in [00,59] */
+						return NULL;
+					}
+					tm->tm_min = ret;
+					break;
+				case 'n': /* arbitrary whitespace */
+				case 't':
+					while (isspace(*s))
+						s++;
+					break;
+				case 'p': /* am pm */
+					ret = match_string(&s, ampm);
+					if (ret < 0) {
+						return NULL;
+					}
+					if (tm->tm_hour < 0 || tm->tm_hour > 11) { /* %I */
+						return NULL;
+					}
+
+					if (ret == 1) /* pm */
+						tm->tm_hour += 12;
+					break;
+				case 'r': /* equivalent of %I:%M:%S %p */
+					if (!(s = unbound_strptime(s, "%I:%M:%S %p", tm))) {
+						return NULL;
+					}
+					break;
+				case 'R': /* equivalent of %H:%M */
+					if (!(s = unbound_strptime(s, "%H:%M", tm))) {
+						return NULL;
+					}
+					break;
+				case 'S': /* seconds */
+					ret = str2int(&s, 2);
+					/* 60 may occur for leap seconds */
+					/* earlier 61 was also allowed */
+					if (ret < 0 || ret > 60) { /* must be in [00,60] */
+						return NULL;
+					}
+					tm->tm_sec = ret;
+					break;
+				case 'T': /* equivalent of %H:%M:%S */
+					if (!(s = unbound_strptime(s, "%H:%M:%S", tm))) {
+						return NULL;
+					}
+					break;
+				case 'U': /* week number, with the first Sun of Jan being w1 */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 53) { /* must be in [00,53] */
+						return NULL;
+					}
+					/** it is hard (and not necessary for nsd) to determine time
+					  * data from week number.
+					 **/
+					break;
+				case 'w': /* day of week */
+					ret = str2int(&s, 1);
+					if (ret < 0 || ret > 6) { /* must be in [0,6] */
+						return NULL;
+					}
+					tm->tm_wday = ret;
+					break;
+				case 'W': /* week number, with the first Mon of Jan being w1 */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 53) { /* must be in [00,53] */
+						return NULL;
+					}
+					/** it is hard (and not necessary for nsd) to determine time
+					  * data from week number.
+					 **/
+					break;
+				case 'x': /* date format */
+					if (!(s = unbound_strptime(s, "%m/%d/%y", tm))) {
+						return NULL;
+					}
+					break;
+				case 'X': /* time format */
+					if (!(s = unbound_strptime(s, "%H:%M:%S", tm))) {
+						return NULL;
+					}
+					break;
+				case 'y': /* last two digits of a year */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 99) { /* must be in [00,99] */
+						return NULL;
+					}
+					if (split_year) {
+						tm->tm_year = ((tm->tm_year/100) * 100) + ret;
+					}
+					else {
+						split_year = 1;
+
+						/** currently:
+						  * if in [0,68] we are in 21th century,
+						  * if in [69,99] we are in 20th century.
+						 **/
+						if (ret < 69) /* 2000 */
+							ret += 100;
+						tm->tm_year = ret;
+					}
+					break;
+				case 'Y': /* year */
+					ret = str2int(&s, 4);
+					if (ret < 0 || ret > 9999) {
+						return NULL;
+					}
+					tm->tm_year = ret - TM_YEAR_BASE;
+					break;
+				case '\0':
+				default: /* unsupported, cannot match format */
+					return NULL;
+					break;
+			}
+		}
+		else { /* literal */
+			/* if input cannot match format, return NULL */
+			if (*s != c)
+				return NULL;
+			s++;
+		}
+
+		format++;
+	}
+
+	/* return pointer to remainder of s */
+	return (char*) s;
+}
+
+#endif /* STRPTIME_WORKS */

config.h.in

@@ -6,6 +6,15 @@
 /* Pathname to the Unbound configuration file */
 #undef CONFIGFILE
 
+/* configure flags */
+#undef CONFIGURE_BUILD_WITH
+
+/* configure date */
+#undef CONFIGURE_DATE
+
+/* configure target system */
+#undef CONFIGURE_TARGET
+
 /* Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work
    */
 #undef DARWIN_BROKEN_SETREUID
@@ -16,6 +25,11 @@
 /* Define if you want to use debug lock checking (slow). */
 #undef ENABLE_LOCK_CHECKS
 
+/* Define this if you enabled-allsymbols from libunbound to link binaries to
+   it for smaller install size, but the libunbound export table is polluted by
+   internal symbols */
+#undef EXPORT_ALL_SYMBOLS
+
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H
 
@@ -37,6 +51,10 @@
 /* Define to 1 if you have the `daemon' function. */
 #undef HAVE_DAEMON
 
+/* Define to 1 if you have the declaration of `sk_SSL_COMP_pop_free', and to 0
+   if you don't. */
+#undef HAVE_DECL_SK_SSL_COMP_POP_FREE
+
 /* Define to 1 if you have the declaration of
    `SSL_COMP_get_compression_methods', and to 0 if you don't. */
 #undef HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
@@ -68,9 +86,15 @@
 /* Define to 1 if you have the `EVP_sha512' function. */
 #undef HAVE_EVP_SHA512
 
+/* Define to 1 if you have the `ev_default_loop' function. */
+#undef HAVE_EV_DEFAULT_LOOP
+
 /* Define to 1 if you have the `ev_loop' function. */
 #undef HAVE_EV_LOOP
 
+/* Define to 1 if you have the <expat.h> header file. */
+#undef HAVE_EXPAT_H
+
 /* Define to 1 if you have the `fcntl' function. */
 #undef HAVE_FCNTL
 
@@ -131,6 +155,9 @@
 /* Define to 1 if you have the `kill' function. */
 #undef HAVE_KILL
 
+/* Define to 1 if you have the `ldns_key_EVP_unload_gost' function. */
+#undef HAVE_LDNS_KEY_EVP_UNLOAD_GOST
+
 /* Define to 1 if you have the <ldns/ldns.h> header file. */
 #undef HAVE_LDNS_LDNS_H
 
@@ -143,8 +170,7 @@
 /* Define to 1 if you have the <login_cap.h> header file. */
 #undef HAVE_LOGIN_CAP_H
 
-/* Define to 1 if your system has a GNU libc compatible `malloc' function, and
-   to 0 otherwise. */
+/* If have GNU libc compatible malloc */
 #undef HAVE_MALLOC
 
 /* Define to 1 if you have the `memmove' function. */
@@ -216,6 +242,9 @@
 /* Define to 1 if you have the `setreuid' function. */
 #undef HAVE_SETREUID
 
+/* Define to 1 if you have the `setrlimit' function. */
+#undef HAVE_SETRLIMIT
+
 /* Define to 1 if you have the `setsid' function. */
 #undef HAVE_SETSID
 
@@ -231,6 +260,9 @@
 /* Define to 1 if you have the `snprintf' function. */
 #undef HAVE_SNPRINTF
 
+/* Define to 1 if you have the `socketpair' function. */
+#undef HAVE_SOCKETPAIR
+
 /* Using Solaris threads */
 #undef HAVE_SOLARIS_THREADS
 
@@ -264,6 +296,9 @@
 /* Define to 1 if you have the `strlcpy' function. */
 #undef HAVE_STRLCPY
 
+/* Define to 1 if you have the `strptime' function. */
+#undef HAVE_STRPTIME
+
 /* Define if you have Swig libraries and header files. */
 #undef HAVE_SWIG
 
@@ -405,6 +440,12 @@
 /* Define as the return type of signal handlers (`int' or `void'). */
 #undef RETSIGTYPE
 
+/* default rootkey location */
+#undef ROOT_ANCHOR_FILE
+
+/* default rootcert location */
+#undef ROOT_CERT_FILE
+
 /* version number for resource files */
 #undef RSRC_PACKAGE_VERSION
 
@@ -417,6 +458,9 @@
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 
+/* use default strptime. */
+#undef STRPTIME_WORKS
+
 /* Use win32 resources and API */
 #undef UB_ON_WINDOWS
 
@@ -781,7 +825,13 @@ int memcmp(const void *x, const void *y, size_t n);
 char *ctime_r(const time_t *timep, char *buf);
 #endif
 
-#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
+#if !defined(HAVE_STRPTIME) || !defined(STRPTIME_WORKS)
+#define strptime unbound_strptime
+struct tm;
+char *strptime(const char *s, const char *format, struct tm *tm);
+#endif
+
+#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
    /* using version of libevent that is not threadsafe. */
 #  define LIBEVENT_SIGNAL_PROBLEM 1
 #endif
@@ -825,4 +875,10 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
+/** default port for unbound control traffic, registered port with IANA,
+    ub-dns-control  8953/tcp    unbound dns nameserver control */
+#define UNBOUND_CONTROL_PORT 8953
+/** the version of unbound-control that this software implements */
+#define UNBOUND_CONTROL_VERSION 1
+
 

configure.ac

@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 
-AC_INIT(unbound, 1.4.5, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.14, unbound-bugs@nlnetlabs.nl, unbound)
 
 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=5
+LIBUNBOUND_REVISION=14
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -30,6 +30,15 @@ LIBUNBOUND_AGE=0
 # 1.4.3 had 2:3:0
 # 1.4.4 had 2:4:0
 # 1.4.5 had 2:5:0
+# 1.4.6 had 2:6:0
+# 1.4.7 had 2:7:0
+# 1.4.8 had 2:8:0
+# 1.4.9 had 2:9:0
+# 1.4.10 had 2:10:0
+# 1.4.11 had 2:11:0
+# 1.4.12 had 2:12:0
+# 1.4.13 had 2:13:0
+# 1.4.14 had 2:14:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -53,6 +62,19 @@ AC_SUBST(LIBUNBOUND_CURRENT)
 AC_SUBST(LIBUNBOUND_REVISION)
 AC_SUBST(LIBUNBOUND_AGE)
 
+pretty_cmdline() {
+	cmdline=""
+	while test -n "$1"; do
+		cmdline="$cmdline '"`echo $1 | sed -e 's/\\\\/\\\\\\\\/g' | sed -e 's/"/\\\\"/g' `"'"
+		shift
+	done
+}
+pretty_cmdline $@
+AC_DEFINE_UNQUOTED(CONFIGURE_BUILD_WITH, ["$cmdline"], [configure flags])
+AC_CANONICAL_TARGET
+AC_DEFINE_UNQUOTED(CONFIGURE_TARGET, ["$target"], [configure target system])
+AC_DEFINE_UNQUOTED(CONFIGURE_DATE, ["`date`"], [configure date])
+
 CFLAGS="$CFLAGS"
 AC_AIX
 
@@ -139,6 +161,34 @@ AC_SUBST(UNBOUND_PIDFILE)
 ACX_ESCAPE_BACKSLASH($UNBOUND_PIDFILE, hdr_pid)
 AC_DEFINE_UNQUOTED(PIDFILE, ["$hdr_pid"], [default pidfile location])
 
+AC_ARG_WITH(rootkey-file, 
+    AC_HELP_STRING([--with-rootkey-file=filename], 
+    [set default pathname to root key file (default run-dir/root.key). This file is read and written.]), 
+    UNBOUND_ROOTKEY_FILE="$withval", 
+if test $on_mingw = no; then
+    UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
+else
+    UNBOUND_ROOTKEY_FILE="C:\\Program Files\\Unbound\\root.key"
+fi
+)
+AC_SUBST(UNBOUND_ROOTKEY_FILE)
+ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTKEY_FILE, hdr_rkey)
+AC_DEFINE_UNQUOTED(ROOT_ANCHOR_FILE, ["$hdr_rkey"], [default rootkey location])
+
+AC_ARG_WITH(rootcert-file, 
+    AC_HELP_STRING([--with-rootcert-file=filename], 
+    [set default pathname to root update certificate file (default run-dir/icannbundle.pem).  This file need not exist if you are content with the builtin.]), 
+    UNBOUND_ROOTCERT_FILE="$withval", 
+if test $on_mingw = no; then
+    UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
+else
+    UNBOUND_ROOTCERT_FILE="C:\\Program Files\\Unbound\\icannbundle.pem"
+fi
+)
+AC_SUBST(UNBOUND_ROOTCERT_FILE)
+ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTCERT_FILE, hdr_rpem)
+AC_DEFINE_UNQUOTED(ROOT_CERT_FILE, ["$hdr_rpem"], [default rootcert location])
+
 AC_ARG_WITH(username, 
     AC_HELP_STRING([--with-username=user], 
     [set default user that unbound changes to (default user is unbound)]), 
@@ -160,10 +210,6 @@ AC_PROG_CC
 ACX_DEPFLAG
 ACX_DETERMINE_EXT_FLAGS_UNBOUND
 
-# for Sun studio 11.
-ACX_CHECK_COMPILER_FLAG(xO4, [CFLAGS="$CFLAGS -xO4"])
-ACX_CHECK_COMPILER_FLAG(xtarget=generic, [CFLAGS="$CFLAGS -xtarget=generic"])
-
 # debug mode flags warnings
 AC_ARG_ENABLE(checking, AC_HELP_STRING([--enable-checking], [Enable warnings, asserts, makefile-dependencies]))
 AC_ARG_ENABLE(debug, AC_HELP_STRING([--enable-debug], [same as enable-checking]))
@@ -182,6 +228,7 @@ case "$debug_enabled" in
 		# nothing to do.
 		;;
 esac
+ACX_CHECK_FLTO
 
 AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
@@ -239,6 +286,31 @@ AC_SUBST(RUNTIME_PATH)
 AC_SEARCH_LIBS([inet_pton], [nsl])
 AC_SEARCH_LIBS([socket], [socket])
 
+# check wether strptime also works
+AC_DEFUN([AC_CHECK_STRPTIME_WORKS],
+[AC_REQUIRE([AC_PROG_CC])
+AC_MSG_CHECKING(whether strptime works)
+if test c${cross_compiling} = cno; then
+AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#define _XOPEN_SOURCE
+#include <time.h>
+int main(void) { struct tm tm; char *res;
+res = strptime("2010-07-15T00:00:00+00:00", "%t%Y%t-%t%m%t-%t%d%tT%t%H%t:%t%M%t:%t%S%t", &tm);
+if (!res) return 2;
+res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm);
+if (!res) return 1; return 0; }
+]])] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"])
+else
+eval "ac_cv_c_strptime_works=maybe"
+fi
+AC_MSG_RESULT($ac_cv_c_strptime_works)
+if test $ac_cv_c_strptime_works = no; then
+AC_LIBOBJ(strptime)
+else
+AC_DEFINE_UNQUOTED([STRPTIME_WORKS], 1, [use default strptime.])
+fi
+])dnl
+
 # check some functions of the OS before linking libs (while still runnable).
 AC_FUNC_CHOWN
 AC_FUNC_FORK
@@ -247,19 +319,43 @@ AC_FUNC_FSEEKO
 ACX_SYS_LARGEFILE
 ACX_CHECK_NONBLOCKING_BROKEN
 ACX_MKDIR_ONE_ARG
+AC_CHECK_FUNCS([strptime],[AC_CHECK_STRPTIME_WORKS],[AC_LIBOBJ([strptime])])
+
+# set memory allocation checking if requested
+AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
+	[ enable to memory allocation statistics, for debug purposes ]), 
+	, )
+AC_ARG_ENABLE(alloc-lite, AC_HELP_STRING([--enable-alloc-lite],
+	[ enable for lightweight alloc assertions, for debug purposes ]), 
+	, )
+AC_ARG_ENABLE(alloc-nonregional, AC_HELP_STRING([--enable-alloc-nonregional],
+	[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]), 
+	, )
+if test x_$enable_alloc_nonregional = x_yes; then
+	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
+fi
+if test x_$enable_alloc_checks = x_yes; then
+	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
+else
+	if test x_$enable_alloc_lite = x_yes; then
+		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
+	else
+		ACX_FUNC_MALLOC([unbound])
+	fi
+fi
 
 # check windows threads (we use them, not pthreads, on windows).
 if test "$on_mingw" = "yes"; then
 # check windows threads
 	AC_CHECK_HEADERS([windows.h],,, [AC_INCLUDES_DEFAULT])
 	AC_MSG_CHECKING([for CreateThread])
-	AC_TRY_COMPILE([
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([
 #ifdef HAVE_WINDOWS_H
 #include <windows.h>
 #endif
 ], [
 	HANDLE t = CreateThread(NULL, 0, NULL, NULL, 0, NULL);
-],
+])],
 	AC_MSG_RESULT(yes)
 	AC_DEFINE(HAVE_WINDOWS_THREADS, 1, [Using Windows threads])
 ,	
@@ -371,6 +467,12 @@ if test x_$ub_test_python != x_no; then
             AC_DEFINE(WITH_PYTHONMODULE, 1, [Define if you want Python module.])
             WITH_PYTHONMODULE=yes
             AC_SUBST(WITH_PYTHONMODULE)
+	    PYTHONMOD_OBJ="pythonmod.lo pythonmod_utils.lo"
+	    AC_SUBST(PYTHONMOD_OBJ)
+	    PYTHONMOD_INSTALL=pythonmod-install
+	    AC_SUBST(PYTHONMOD_INSTALL)
+	    PYTHONMOD_UNINSTALL=pythonmod-uninstall
+	    AC_SUBST(PYTHONMOD_UNINSTALL)
          fi
 
          # Declare PyUnbound
@@ -378,6 +480,14 @@ if test x_$ub_test_python != x_no; then
             AC_DEFINE(WITH_PYUNBOUND, 1, [Define if you want PyUnbound.])
             WITH_PYUNBOUND=yes
             AC_SUBST(WITH_PYUNBOUND)
+	    PYUNBOUND_OBJ="libunbound_wrap.lo"
+	    AC_SUBST(PYUNBOUND_OBJ)
+	    PYUNBOUND_TARGET="_unbound.la"
+	    AC_SUBST(PYUNBOUND_TARGET)
+	    PYUNBOUND_INSTALL=pyunbound-install
+	    AC_SUBST(PYUNBOUND_INSTALL)
+	    PYUNBOUND_UNINSTALL=pyunbound-uninstall
+	    AC_SUBST(PYUNBOUND_UNINSTALL)
          fi
       fi
    else
@@ -387,13 +497,20 @@ if test x_$ub_test_python != x_no; then
    fi
 fi
 
+if test "`uname`" = "NetBSD"; then
+	NETBSD_LINTFLAGS='"-D__RENAME(x)=" -D_NETINET_IN_H_'
+	AC_SUBST(NETBSD_LINTFLAGS)
+fi
+CONFIG_DATE=`date +%Y%m%d`
+AC_SUBST(CONFIG_DATE)
+
 # Checks for libraries.
 ACX_WITH_SSL
 ACX_LIB_SSL
 AC_CHECK_HEADERS([openssl/conf.h],,, [AC_INCLUDES_DEFAULT])
 AC_CHECK_HEADERS([openssl/engine.h],,, [AC_INCLUDES_DEFAULT])
 AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512])
-AC_CHECK_DECLS([SSL_COMP_get_compression_methods], [], [], [
+AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free], [], [], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
@@ -423,21 +540,117 @@ case "$enable_sha2" in
 	;;
 esac
 
-AC_ARG_ENABLE(gost, AC_HELP_STRING([--enable-gost], [Enable GOST support, experimental]))
+# check wether gost also works
+AC_DEFUN([AC_CHECK_GOST_WORKS],
+[AC_REQUIRE([AC_PROG_CC])
+AC_MSG_CHECKING([if GOST works])
+if test c${cross_compiling} = cno; then
+BAKCFLAGS="$CFLAGS"
+if test -n "$ssldir"; then
+	CFLAGS="$CFLAGS -Wl,-rpath,$ssldir/lib"
+fi
+AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#include <string.h>
+#include <openssl/ssl.h>
+#include <openssl/evp.h>
+#include <openssl/engine.h>
+#include <openssl/conf.h>
+/* routine to load gost from ldns */
+int load_gost_id(void)
+{
+	static int gost_id = 0;
+	const EVP_PKEY_ASN1_METHOD* meth;
+	ENGINE* e;
+
+	if(gost_id) return gost_id;
+
+	/* see if configuration loaded gost implementation from other engine*/
+	meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
+	if(meth) {
+		EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
+		return gost_id;
+	}
+
+	/* see if engine can be loaded already */
+	e = ENGINE_by_id("gost");
+	if(!e) {
+		/* load it ourself, in case statically linked */
+		ENGINE_load_builtin_engines();
+		ENGINE_load_dynamic();
+		e = ENGINE_by_id("gost");
+	}
+	if(!e) {
+		/* no gost engine in openssl */
+		return 0;
+	}
+	if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
+		ENGINE_finish(e);
+		ENGINE_free(e);
+		return 0;
+	}
+
+	meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
+	if(!meth) {
+		/* algo not found */
+		ENGINE_finish(e);
+		ENGINE_free(e);
+		return 0;
+	}
+	EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
+	return gost_id;
+}
+int main(void) { 
+	EVP_MD_CTX* ctx;
+	const EVP_MD* md;
+	unsigned char digest[64]; /* its a 256-bit digest, so uses 32 bytes */
+	const char* str = "Hello world";
+	const unsigned char check[] = {
+		0x40 , 0xed , 0xf8 , 0x56 , 0x5a , 0xc5 , 0x36 , 0xe1 ,
+		0x33 , 0x7c , 0x7e , 0x87 , 0x62 , 0x1c , 0x42 , 0xe0 ,
+		0x17 , 0x1b , 0x5e , 0xce , 0xa8 , 0x46 , 0x65 , 0x4d ,
+		0x8d , 0x3e , 0x22 , 0x9b , 0xe1 , 0x30 , 0x19 , 0x9d
+	};
+	OPENSSL_config(NULL);
+	(void)load_gost_id();
+	md = EVP_get_digestbyname("md_gost94");
+	if(!md) return 1;
+	memset(digest, 0, sizeof(digest));
+	ctx = EVP_MD_CTX_create();
+	if(!ctx) return 2;
+	if(!EVP_DigestInit_ex(ctx, md, NULL)) return 3;
+	if(!EVP_DigestUpdate(ctx, str, 10)) return 4;
+	if(!EVP_DigestFinal_ex(ctx, digest, NULL)) return 5;
+	/* uncomment to see the hash calculated.
+		{int i;
+		for(i=0; i<32; i++)
+			printf(" %2.2x", (int)digest[i]);
+		printf("\n");}
+	*/
+	if(memcmp(digest, check, sizeof(check)) != 0)
+		return 6;
+	return 0;
+}
+]])] , [eval "ac_cv_c_gost_works=yes"], [eval "ac_cv_c_gost_works=no"])
+CFLAGS="$BAKCFLAGS"
+else
+eval "ac_cv_c_gost_works=maybe"
+fi
+AC_MSG_RESULT($ac_cv_c_gost_works)
+])dnl
+
+AC_ARG_ENABLE(gost, AC_HELP_STRING([--disable-gost], [Disable GOST support]))
 use_gost="no"
 case "$enable_gost" in
-	yes)
-	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL 1.0.0 is needed for GOST support])])
-	use_gost="yes"
-	AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
-	;;
 	no)
 	;;
-	*) dnl default
-dnl   Disabled-by-default, RFC not ready.
-dnl	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [
-dnl	  use_gost="yes"
-dnl	  AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])])
+	*)
+	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL 1.0.0 is needed for GOST support])])
+        AC_CHECK_FUNC(EC_KEY_new, [], [AC_MSG_ERROR([OpenSSL does not support ECC, needed for GOST support])])
+	AC_CHECK_GOST_WORKS
+	if test $ac_cv_c_gost_works != no; then
+		use_gost="yes"
+		AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
+	fi
 	;;
 esac
 
@@ -511,6 +724,7 @@ large outgoing port ranges.  ])
 	AC_CHECK_FUNCS([event_base_new]) # only in libevent 1.4.1 and later
 	AC_CHECK_FUNCS([event_base_get_method]) # only in libevent 1.4.3 and later
 	AC_CHECK_FUNCS([ev_loop]) # only in libev. (tested on 3.51)
+	AC_CHECK_FUNCS([ev_default_loop]) # only in libev. (tested on 4.00)
 	if test -n "$BAK_LDFLAGS_SET"; then
 		LDFLAGS="$BAK_LDFLAGS"
 	fi
@@ -518,10 +732,33 @@ else
 	AC_DEFINE(USE_MINI_EVENT, 1, [Define if you want to use internal select based events])
 fi
 
+# check for libexpat
+AC_ARG_WITH(libexpat, AC_HELP_STRING([--with-libexpat=path],
+    [specify explicit path for libexpat.]),
+    [ ],[ withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr" ])
+AC_MSG_CHECKING(for libexpat)
+found_libexpat="no"
+for dir in $withval ; do
+            if test -f "$dir/include/expat.h"; then
+		found_libexpat="yes"
+		dnl assume /usr is in default path.
+		if test "$dir" != "/usr"; then
+                    CPPFLAGS="$CPPFLAGS -I$dir/include"
+		    LDFLAGS="$LDFLAGS -L$dir/lib"
+		fi
+            	AC_MSG_RESULT(found in $dir)
+                break;
+            fi
+done
+if test x_$found_libexpat != x_yes; then
+	AC_ERROR([Could not find libexpat, expat.h])
+fi
+AC_CHECK_HEADERS([expat.h],,, [AC_INCLUDES_DEFAULT])
+
 # set static linking if requested
 AC_SUBST(staticexe)
 staticexe=""
-AC_ARG_ENABLE(staticexe, AC_HELP_STRING([--enable-static-exe],
+AC_ARG_ENABLE(static-exe, AC_HELP_STRING([--enable-static-exe],
 	[ enable to compile executables statically against event, ldns libs, for debug purposes ]), 
 	, )
 if test x_$enable_static_exe = x_yes; then
@@ -541,43 +778,34 @@ AC_ARG_ENABLE(lock_checks, AC_HELP_STRING([--enable-lock-checks],
 	, )
 if test x_$enable_lock_checks = x_yes; then
 	AC_DEFINE(ENABLE_LOCK_CHECKS, 1, [Define if you want to use debug lock checking (slow).])
-	CHECKLOCK_SRC="testcode/checklocks.c"
-	AC_SUBST(CHECKLOCK_SRC)
-fi
-
-# set memory allocation checking if requested
-AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
-	[ enable to memory allocation statistics, for debug purposes ]), 
-	, )
-AC_ARG_ENABLE(alloc-lite, AC_HELP_STRING([--enable-alloc-lite],
-	[ enable for lightweight alloc assertions, for debug purposes ]), 
-	, )
-AC_ARG_ENABLE(alloc-nonregional, AC_HELP_STRING([--enable-alloc-nonregional],
-	[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]), 
-	, )
-if test x_$enable_alloc_nonregional = x_yes; then
-	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
-fi
-if test x_$enable_alloc_checks = x_yes; then
-	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
-else
-	if test x_$enable_alloc_lite = x_yes; then
-		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
-	else
-		ACX_FUNC_MALLOC([unbound])
-	fi
+	CHECKLOCK_OBJ="checklocks.lo"
+	AC_SUBST(CHECKLOCK_OBJ)
 fi
 
 ACX_CHECK_GETADDRINFO_WITH_INCLUDES
 if test "$USE_WINSOCK" = 1; then
 	AC_DEFINE(UB_ON_WINDOWS, 1, [Use win32 resources and API])
-	UB_ON_WINDOWS=yes
-	AC_SUBST(UB_ON_WINDOWS)
 	AC_CHECK_HEADERS([iphlpapi.h],,, [AC_INCLUDES_DEFAULT
 #include <windows.h>
 	])
 	AC_CHECK_TOOL(WINDRES, windres)
 	LIBS="$LIBS -liphlpapi"
+	WINAPPS="unbound-service-install.exe unbound-service-remove.exe anchor-update.exe"
+	AC_SUBST(WINAPPS)
+	WIN_DAEMON_SRC="winrc/win_svc.c winrc/w_inst.c"
+	AC_SUBST(WIN_DAEMON_SRC)
+	WIN_DAEMON_OBJ="win_svc.lo w_inst.lo"
+	AC_SUBST(WIN_DAEMON_OBJ)
+	WIN_DAEMON_OBJ_LINK="rsrc_unbound.o"
+	AC_SUBST(WIN_DAEMON_OBJ_LINK)
+	WIN_HOST_OBJ_LINK="rsrc_unbound_host.o"
+	AC_SUBST(WIN_HOST_OBJ_LINK)
+	WIN_UBANCHOR_OBJ_LINK="rsrc_unbound_anchor.o log.lo locks.lo"
+	AC_SUBST(WIN_UBANCHOR_OBJ_LINK)
+	WIN_CONTROL_OBJ_LINK="rsrc_unbound_control.o"
+	AC_SUBST(WIN_CONTROL_OBJ_LINK)
+	WIN_CHECKCONF_OBJ_LINK="rsrc_unbound_checkconf.o"
+	AC_SUBST(WIN_CHECKCONF_OBJ_LINK)
 fi
 if test $ac_cv_func_getaddrinfo = no; then
 	AC_LIBOBJ([fake-rfc2553])
@@ -594,7 +822,7 @@ if test $ac_cv_func_daemon = yes; then
 fi
 
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev glob initgroups strftime localtime_r setusercontext _beginthreadex])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
 AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
@@ -609,70 +837,141 @@ AC_REPLACE_FUNCS(snprintf)
 AC_REPLACE_FUNCS(strlcpy)
 AC_REPLACE_FUNCS(memmove)
 AC_REPLACE_FUNCS(gmtime_r)
+LIBOBJ_WITHOUT_CTIME="$LIBOBJS"
+AC_SUBST(LIBOBJ_WITHOUT_CTIME)
 AC_REPLACE_FUNCS(ctime_r)
 
+AC_ARG_ENABLE(allsymbols, AC_HELP_STRING([--enable-allsymbols], [export all symbols from libunbound and link binaries to it, smaller install size but libunbound export table is polluted by internal symbols]))
+case "$enable_allsymbols" in
+	yes)
+	COMMON_OBJ_ALL_SYMBOLS=""
+	UBSYMS=""
+	EXTRALINK="-L. -L.libs -lunbound"
+	AC_DEFINE(EXPORT_ALL_SYMBOLS, 1, [Define this if you enabled-allsymbols from libunbound to link binaries to it for smaller install size, but the libunbound export table is polluted by internal symbols])
+	;;
+	no|*)
+	COMMON_OBJ_ALL_SYMBOLS='$(COMMON_OBJ)'
+	UBSYMS='-export-symbols $(srcdir)/libunbound/ubsyms.def'
+	EXTRALINK=""
+	;;
+esac
+AC_SUBST(COMMON_OBJ_ALL_SYMBOLS)
+AC_SUBST(EXTRALINK)
+AC_SUBST(UBSYMS)
+if test x_$enable_lock_checks = x_yes; then
+	UBSYMS="-export-symbols clubsyms.def"
+	cp ${srcdir}/libunbound/ubsyms.def clubsyms.def
+	echo lock_protect >> clubsyms.def
+	echo lock_unprotect >> clubsyms.def
+	echo lock_get_mem >> clubsyms.def
+	echo checklock_start >> clubsyms.def
+	echo checklock_stop >> clubsyms.def
+	echo checklock_lock >> clubsyms.def
+	echo checklock_unlock >> clubsyms.def
+	echo checklock_init >> clubsyms.def
+	echo checklock_thrcreate >> clubsyms.def
+	echo checklock_thrjoin >> clubsyms.def
+fi
+
+AC_MSG_CHECKING([if ${MAKE:-make} supports $< with implicit rule in scope])
+# on openBSD, the implicit rule make $< work.
+# on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
+# gmake works.
+cat >conftest.make <<EOF
+all:	conftest.lo
+
+conftest.lo foo.lo bla.lo:
+	if test -f "\$<"; then touch \$@; fi
+
+.SUFFIXES: .lo
+.c.lo:
+	if test -f "\$<"; then touch \$@; fi
+
+conftest.lo:        conftest.dir/conftest.c
+EOF
+mkdir conftest.dir
+touch conftest.dir/conftest.c
+rm -f conftest.lo conftest.c
+${MAKE:-make} -f conftest.make >/dev/null
+rm -f conftest.make conftest.c conftest.dir/conftest.c
+rm -rf conftest.dir
+if test ! -f conftest.lo; then
+	AC_MSG_RESULT(no)
+	SOURCEDETERMINE='echo "$^" | awk "-F " "{print \$$1;}" > .source'
+	SOURCEFILE='`cat .source`'
+else
+	AC_MSG_RESULT(yes)
+	SOURCEDETERMINE=':'
+	SOURCEFILE='$<'
+fi
+rm -f conftest.lo
+AC_SUBST(SOURCEDETERMINE)
+AC_SUBST(SOURCEFILE)
+
 # check this after all other compilation checks, since the linking of the lib
 # may break checks after this.
-use_ldns_builtin="no"
 AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH], 
 	[specify prefix of path of ldns library to use]), 
-	[ specialldnsdir="$withval"
-	if test "$withval" != ""; then
-		CPPFLAGS="-I$withval/include $CPPFLAGS"
-		LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
-		ACX_RUNTIME_PATH_ADD([$withval/lib])
+	[
+	if test "$withval" != "yes"; then
+		if test "$withval" != "/usr" -a "$withval" != ""; then
+			CPPFLAGS="-I$withval/include $CPPFLAGS"
+			LDFLAGS="-L$withval/lib $LDFLAGS"
+			ACX_RUNTIME_PATH_ADD([$withval/lib])
+		fi
+		ldnsdir="$withval"
+		AC_SUBST(ldnsdir)
 	fi
-	ldnsdir="$withval"
-	AC_SUBST(ldnsdir)
-])
-
-AC_ARG_WITH(ldns-builtin, AC_HELP_STRING([--with-ldns-builtin], 
-	[forces use of package included with this one]), [ 
-	use_ldns_builtin="yes"
 ])
 
 # check if ldns is good enough
-if test "$use_ldns_builtin" = "no"; then
-	AC_CHECK_LIB(ldns, ldns_buffer_copy)
-	AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
-	AC_CHECK_FUNC(ldns_b32_ntop_extended_hex)
-	if test x$use_gost = xyes; then
-	    AC_CHECK_FUNC(ldns_key_EVP_load_gost_id)
-	else
-	    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
-	fi
-	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT])
-	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
-	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
-	    -a $ac_cv_header_ldns_ldns_h = yes \
-	    -a $ac_cv_func_ldns_b32_ntop_extended_hex = yes \
-	    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
-	    dnl ldns was found
-	    :
-	else
-	    use_ldns_builtin="yes"
-	fi
+AC_CHECK_LIB(ldns, ldns_rr_new,,[
+	AC_MSG_ERROR([No ldns library found, install the ldns library into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Install the package ldns or download source http://www.nlnetlabs.nl/projects/ldns])
+])
+AC_CHECK_FUNC(ldns_buffer_copy)
+AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
+AC_CHECK_FUNC(ldns_get_random)
+AC_CHECK_FUNC(ldns_b32_ntop_extended_hex)
+if test x$use_gost = xyes; then
+    AC_CHECK_FUNC(ldns_key_EVP_load_gost_id)
+    AC_CHECK_FUNCS([ldns_key_EVP_unload_gost])
+else
+    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
 fi
+AC_CHECK_HEADERS([ldns/ldns.h],,[
+	AC_MSG_ERROR([No ldns include file found, install the ldns library development files.  Install package ldns-dev or ldns-devel or download source http://www.nlnetlabs.nl/projects/ldns])
+	], [AC_INCLUDES_DEFAULT
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
 
-if test "$use_ldns_builtin" = "yes"; then
-dnl use the builtin ldns-src.tar.gz file to build ldns.
-if test ! -f $srcdir/ldns-src.tar.gz; then
-	AC_MSG_ERROR([No ldns library found and no ldns-src.tar.gz, use --with-ldns=path.])
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+#ifdef HAVE_WINSOCK2_H
+#include <winsock2.h>
+#endif
+
+#ifdef HAVE_WS2TCPIP_H
+#include <ws2tcpip.h>
+#endif
+])
+if test $ac_cv_func_ldns_buffer_copy = yes \
+    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
+    -a $ac_cv_func_ldns_get_random = yes \
+    -a $ac_cv_header_ldns_ldns_h = yes \
+    -a $ac_cv_func_ldns_b32_ntop_extended_hex = yes \
+    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
+    dnl ldns was found
+    :
+else
+    AC_MSG_ERROR([ldns library is not recent, update the ldns library, install it into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Package libldns or download source http://www.nlnetlabs.nl/projects/ldns])
 fi
-echo "****************************************************************"
-echo "***                                                          ***"
-echo "*** Building ldns library from package included in this one. ***"
-echo "***                                                          ***"
-echo "****************************************************************"
-if test -d $srcdir/ldns-src; then rm -rf $srcdir/ldns-src; fi
-mkdir $srcdir/ldns-src; cp $srcdir/ldns-src.tar.gz $srcdir/ldns-src/ldns-src.tar.gz; (cd $srcdir/ldns-src; gzip -cd ldns-src.tar.gz | tar xf -); rm -f $srcdir/ldns-src/ldns-src.tar.gz; mv $srcdir/ldns-src $srcdir/ldns-srcb; mv $srcdir/ldns-srcb/ldns* $srcdir/ldns-src; rmdir $srcdir/ldns-srcb
-ldnsdir="ldns-src"
-AC_MSG_NOTICE([Configure $ldnsdir scheduled after config.status])
-AC_CONFIG_SUBDIRS([ldns-src])
-CPPFLAGS="-I$ldnsdir/include $CPPFLAGS"
-LDFLAGS="$LDFLAGS $ldnsdir/*.lo"
-AC_SUBST(ldnsdir)
-fi  dnl end of use_ldns_builtin == yes
 
 ACX_STRIP_EXT_FLAGS
 LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
@@ -759,7 +1058,13 @@ AHX_MEMCMP_BROKEN(unbound)
 char *ctime_r(const time_t *timep, char *buf);
 #endif
 
-#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
+#if !defined(HAVE_STRPTIME) || !defined(STRPTIME_WORKS)
+#define strptime unbound_strptime
+struct tm;
+char *strptime(const char *s, const char *format, struct tm *tm);
+#endif
+
+#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
    /* using version of libevent that is not threadsafe. */
 #  define LIBEVENT_SIGNAL_PROBLEM 1
 #endif
@@ -803,8 +1108,14 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
+/** default port for unbound control traffic, registered port with IANA,
+    ub-dns-control  8953/tcp    unbound dns nameserver control */
+#define UNBOUND_CONTROL_PORT 8953
+/** the version of unbound-control that this software implements */
+#define UNBOUND_CONTROL_VERSION 1
+
 ])
 
-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8])
 AC_CONFIG_HEADER([config.h])
 AC_OUTPUT

contrib/README

@@ -7,9 +7,6 @@ distribution but may be helpful.
 * unbound.spec and unbound.init: RPM specfile and Linux rc.d initfile.
 * update-anchor.sh: shell script that uses unbound-host to update a set
 	of trust anchor files. Run from cron twice a month.
-* update-itar.sh: shell script that updates from itar.iana.org. Run from cron.
-* split-itar.sh: shell script to split anchors.mf from itar.iana.org into
-	multiple key files so it can be used with auto-trust-anchor-file.
 * unbound_munin_ : plugin for munin statistics report
 * unbound_cacti.tar.gz : setup files for cacti statistics report
 * selinux: the .fc and .te files for SElinux protection of the unbound daemon

contrib/split-itar.sh

@@ -1,46 +0,0 @@
-#/usr/bin/env bash
-# Contributed by Tom Hendrikx <tom@whyscream.net>
-
-PROGNAME=$(basename $0)
-
-usage() {
-	echo "$PROGNAME: split the anchors.mf file from IANA into separate files." >&2
-	echo "" >&2
-	echo "$PROGNAME uses 2 arguments:" >&2
-	echo "  - the path to the anchors.mf, available at: https://itar.iana.org/" >&2
-	echo "  - the directory to leave the files, defaults to '.' (current working dir)" >&2
-	exit 1
-}
-
-if [ -n "$1" ] && [ -r "$1" ]; then
-	itar="$1"
-	echo "Reading from: $itar"
-else 
-	echo "Error: no anchors file given" >&2
-	usage
-fi
-
-if [ -n "$2" ]; then
-	dir="$2"
-else 
-	dir=$(pwd)
-fi
-
-if [ ! -d "$dir" ]; then
-	echo "Error: $dir is not a directory" >&2
-	usage
-fi
-
-while read cn line; do
-	if [ $(expr match "$cn" '[a-zA-Z0-9-]*\.') -gt 0 ]; then
-		# first line of key
-		out="$dir/$cn"anchor
-		echo "writing key for $cn to: $out"
-		echo "$cn	$line" > $out
-	elif [ "$cn" == "DS" ]; then
-		# second or later line of earlier defined key
-		echo "	$cn	$line" >> $out
-	fi
-done < "$itar"
-
-echo "Done."

contrib/unbound.spec

@@ -1,14 +1,15 @@
 Summary: Validating, recursive, and caching DNS resolver
 Name: unbound
-Version: 1.4.4
+Version: 1.4.8
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
 Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 #Source1: unbound.init
 Group: System Environment/Daemons
+Requires: ldns
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel
+BuildRequires: flex, openssl-devel, expat-devel, ldns-devel
 
 %description
 Unbound is a validating, recursive, and caching DNS resolver.
@@ -28,10 +29,6 @@ The source code is under a BSD License.
 
 # configure with /var/unbound/unbound.conf so that all default chroot, 
 # pidfile and config file are in /var/unbound, ready for chroot jail set up.
-#
-# This is a build using libldns builtin version, the resulting binaries
-# do not require libldns and this package does not have version dependencies.
-# Could be smaller using a dependency on libldns (use --with-ldns=).
 %configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath
 
 %build
@@ -92,6 +89,18 @@ if [ "$1" -ge "1" ]; then
 fi
 
 %changelog
+* Thu Jul 13 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
+- ldns required and ldns-devel required for build, no more ldns-builtin.
+
+* Thu Mar 17 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
+- removed --disable-gost, assume recent openssl on the destination platform.
+
+* Wed Mar 16 2011 Harold Jones <hajones@verisign.com> - 1.4.8
+- Bump version number to latest
+- Add expat-devel to BuildRequires
+- Added --disable-gost for building on CentOS 5.x
+- Added --with-ldns-builtin for CentOS 5.x
+
 * Thu May 22 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.0.0
 - contrib changes from Patrick Vande Walle.
 

contrib/unbound.spec_fedora

@@ -8,7 +8,7 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.4.2
+Version: 1.4.13
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -16,16 +16,20 @@ Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 Source1: unbound.init
 Source2: unbound.conf
 Source3: unbound.munin
-Source4: dlv.isc.org.key
+Source4: unbound_munin_
+Source5: root.key
+Source6: dlv.isc.org.key
 Patch1: unbound-1.2-glob.patch
 
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: flex, openssl-devel , ldns-devel >= 1.5.0, 
-BuildRequires: libevent-devel 
+BuildRequires: libevent-devel expat-devel
 %if %{with_python}
-BuildRequires:  python-devel
+BuildRequires:  python-devel swig
 %endif
+# Required for SVN versions
+# BuildRequires: bison
 
 Requires(post): chkconfig
 Requires(preun): chkconfig
@@ -34,6 +38,9 @@ Requires(postun): initscripts
 Requires: ldns >= 1.5.0
 Requires(pre): shadow-utils
 
+Obsoletes:      dnssec-conf < 1.27-2
+Provides:       dnssec-conf = 1.27-1
+
 %description
 Unbound is a validating, recursive, and caching DNS(SEC) resolver.
 
@@ -67,7 +74,7 @@ Summary: Libraries used by the unbound server and client applications
 Group: Applications/System
 Requires(post): /sbin/ldconfig
 Requires(postun): /sbin/ldconfig
-Requires: openssl >= 0.9.8g-12
+Requires: openssl 
 
 %description libs
 Contains libraries used by the unbound server and client applications
@@ -88,14 +95,14 @@ Python modules and extensions for unbound
 
 %build
 %configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
-            --disable-rpath --enable-debug --disable-static \
+            --disable-rpath --disable-static \
             --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \
             --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \
 %if %{with_python}
             --with-pythonmodule --with-pyunbound \
 %endif
-            --enable-sha2 
-%{__make} 
+            --enable-sha2 --disable-gost
+%{__make} %{?_smp_mflags}
 
 %install
 rm -rf %{buildroot}
@@ -107,16 +114,19 @@ install -m 0755 %{SOURCE2} %{buildroot}%{_sysconfdir}/unbound
 install -d 0755 %{buildroot}%{_sysconfdir}/munin/plugin-conf.d
 install -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/munin/plugin-conf.d/unbound
 install -d 0755 %{buildroot}%{_datadir}/munin/plugins/
-install -m 0755 contrib/unbound_munin_ %{buildroot}%{_datadir}/munin/plugins/unbound
+install -m 0755 %{SOURCE4} %{buildroot}%{_datadir}/munin/plugins/unbound
 for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unbound_munin_by_type unbound_munin_by_class unbound_munin_by_opcode unbound_munin_by_rcode unbound_munin_by_flags unbound_munin_histogram; do
     ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin
 done 
 
-# install DLV key
-install -m 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/unbound/
+# install root and DLV key
+install -m 0644 %{SOURCE5} %{SOURCE6} %{buildroot}%{_sysconfdir}/unbound/
 
 # remove static library from install (fedora packaging guidelines)
-rm -rf %{buildroot}%{_libdir}/*.la
+rm %{buildroot}%{_libdir}/*.la
+%if %{with_python}
+rm %{buildroot}%{python_sitearch}/*.la
+%endif
 
 mkdir -p %{buildroot}%{_localstatedir}/run/unbound
 
@@ -128,15 +138,19 @@ rm -rf ${RPM_BUILD_ROOT}
 %doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
 %attr(0755,root,root) %{_initrddir}/%{name}
 %attr(0755,root,root) %dir %{_sysconfdir}/%{name}
-%attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
+%ghost %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/root.key
 %{_sbindir}/*
 %{_mandir}/*/*
 
 %if %{with_python}
 %files python
-%{python_sitelib}/*
+%defattr(-,root,root,-)
+%{python_sitearch}/*
+%doc libunbound/python/examples/*
+%doc pythonmod/examples/*
 %endif
 
 %files munin
@@ -186,10 +200,90 @@ fi
 %postun libs -p /sbin/ldconfig
 
 %changelog
+* Tue Sep 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.13-1
+- Updated to 1.4.13
+- Fix install location of pythonmod from sitelib to sitearch
+- Removed patches merged in by upstream
+- Removed versioned openssl dep, it differs per branch
+ 
+* Mon Aug 08 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-3
+- Added pythonmod docs and examples
+- Fix for python module load in the server (Tom Hendrikx)
+- No longer enable --enable-debug as it causes degraded  performance
+  under load.
+
+* Mon Jul 18 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-1
+- Updated to 1.4.12
+
+* Sun Jul 03 2011 Paul Wouters <paul@xelerance.com> - 1.4.11-1
+- Updated to 1.4.11
+- removed integrated CVE patch
+- updated stock unbound.conf for new options introduced
+
+* Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.10-1
+- Added ghost for /var/run/unbound (bz#656710)
+
+* Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-3
+- rebuilt
+
+* Wed May 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-2
+- Applied patch for CVE-2011-1922 DoS vulnerability
+
+* Sun Mar 27 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-1
+- Updated to 1.4.9
+
+* Sat Feb 12 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-2
+- rebuilt
+
+* Tue Jan 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-1
+- Updated to 1.4.8
+- Enable root key for DNSSEC
+- Fix unbound-munin to use proper file (could cause excessive logging)
+- Build unbound-python per default
+- Disable gost as Fedora/EPEL does not allow ECC and has mangled openssl
+
+* Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-4
+- Revert last build - it was on the wrong branch
+
+* Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-3
+- Disable do-ipv6 per default - causes severe degradation on non-ipv6 machines
+  (see comments in inbound.conf)
+
+* Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-2
+- Bump release - forgot to upload the new tar ball.
+
+* Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-1
+- Upgraded to 1.4.5
+
+* Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-2
+- Added accidentally omitted svn patches to cvs 
+
+* Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-1
+- Upgraded to 1.4.4 with svn patches
+- Obsolete dnssec-conf to ensure it is de-installed
+
+* Thu Mar 11 2010 Paul Wouters <paul@xelerance.com> - 1.4.3-1
+- Update to 1.4.3 that fixes 64bit crasher
+
+* Tue Mar 09 2010 Paul Wouters <paul@xelerance.com> - 1.4.2-1
+- Updated to 1.4.2 
+- Updated unbound.conf with new options
+- Enabled pre-fetching DNSKEY records (DNSSEC speedup)
+- Enabled re-fetching popular records before they expire
+- Enabled logging of DNSSEC validation errors
+
+* Mon Mar 01 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-5
+- Overriding -D_GNU_SOURCE is no longer needed. This fixes DSO issues
+  with pthreads
+
+* Wed Feb 24 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-3
+- Change make/configure lines to attempt to fix -lphtread linking issue
+
 * Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
 - Removed dependancy for dnssec-conf
 - Added ISC DLV key (formerly in dnssec-conf)
 - Fixup old DLV locations in unbound.conf file via %%post
+- Fix parent child disagreement handling and no-ipv6 present [svn r1953]
 
 * Tue Jan 05 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-1
 - Updated to 1.4.1

contrib/unbound_munin_

@@ -1,6 +1,8 @@
 #!/bin/sh
 #
 # plugin for munin to monitor usage of unbound servers.
+# To install copy this to /usr/local/share/munin/plugins/unbound_munin_
+# and use munin-node-configure (--suggest, --shell).
 #
 # (C) 2008 W.C.A. Wijngaards.  BSD Licensed.
 #
@@ -45,9 +47,9 @@
 #	unbound_munin_histogram	- histogram of query resolving times
 #
 # Magic markers - optional - used by installation scripts and
-# munin-config:
+# munin-config:  (originally contrib family but munin-node-configure ignores it)
 #
-#%# family=contrib
+#%# family=auto
 #%# capabilities=autoconf suggest
 
 # POD documentation
@@ -175,7 +177,7 @@ if test "$1" = "autoconf" ; then
 		exit 1
 	fi
 	if test ! -d `dirname $state`; then
-		echo no "($state directory does not exist)"
+		echo no "(`dirname $state` directory does not exist)"
 		exit 1
 	fi
 	echo yes

contrib/update-itar.sh

@@ -1,128 +0,0 @@
-#!/bin/sh
-# update-itar.sh - update from the interim trust anchor repository
-# Copyright 2009, W.C.A. Wijngaards
-# This file is BSD licensed, see doc/LICENSE.
-
-# --- Some settings
-
-# directory where unbound works
-thedir="."
-# where is the file that unbound is going to read
-ub_ta_file="$thedir/anchors.mf"
-# where is the itar master file format
-itar_url="ftp://ftp.iana.org/itar/anchors.mf"
-# where is the itar PGP signature
-itar_sig="ftp://ftp.iana.org/itar/anchors.mf.sig"
-
-# which command to fetch urls, cmd $dest $url. "wget -O" "curl -o"
-fetch_cmd="wget -O"
-# file with pgp public key
-pgp_pub_key_file="$thedir/update-itar.key"
-# our pgp keyring (goes into .gnupg directory)
-pgp_keyring_file="update-itar.ring"
-# pgp command to use
-pgp_cmd="gpg"
-
-
-# --- The script is below
-usage ( )
-{
-	echo "usage: update-itar"
-	echo "    Updates the trust anchors from the interim trust"
-	echo "    anchor repository, https://itar.iana.org, and checks PGP sig."
-	echo
-	echo "    Updates $ub_ta_file with the latest keys."
-	echo "    Read that file from the unbound config with"
-	echo "    trust-anchor-file: "'"'"$ub_ta_file"'"'
-	echo
-	echo "    Exit code 0 means anchors updated, 1 no changes, "
-	echo "    others are errors. So, in a cronjob you can do:"
-	echo "    cd /usr/local/etc/unbound    # your unbound work dir"
-	echo "    ./update-itar.sh && unbound-control reload"
-	exit 2
-}
-
-if test $# -ne 0; then
-	usage
-fi
-tmpf="/tmp/update-itar.$$"
-
-# one argument: explanation string
-error_exit ( )
-{
-	if test -f $tmpf.log; then cat $tmpf.log; fi
-	rm -f $tmpf $tmpf.sig $tmpf.log
-	echo "Error updating trust anchors: $1"
-	exit 2
-}
-
-if test ! -f $pgp_pub_key_file || test ! -f $HOME/.gnupg/$pgp_keyring_file || \
-	test "$pgp_pub_key_file" -nt $HOME/.gnupg/$pgp_keyring_file; then
-	# default key contents right here
-	if test ! -f $pgp_pub_key_file; then
-		echo "creating default IANA ITAR pgp key file"
-		cat >$pgp_pub_key_file <<EOF
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.5
-
-mQGiBElr2DcRBAC+6YK6eSP7rzstvnMPQXMrpvVfuIR5FeTpGuwae9JP78V/iOXr
-N0yW8Dn6kdAztCMuRizL1Ij9IgaD7pjn8h09VgR4cN4LDv75rcQeWLzNxKy4UNRF
-aStL77RcIoTblBeCgHAK9FLzd0XfTGZCNaLNy9BYVSLyADOVDIqgBcrvBwCglz03
-QhOMIgaSx/XuRh6kYtynZ6kD/2GXx6pFs57b7rww8yOpdurCSOMB1wuEXiIXznTI
-06ARiib0G5VDvOdpy0LDU2526Q9f/WAERlhcExTgnTFigG4mRksUiDrrai4GIr+6
-JaivcGFVYdZZ4mZ088jcwujS/UY3C0ryGR9ufYUDAnfx6frhSl6o6j5is+jeGndF
-JYRAA/9B/1OXNVwFSiIxnP2aPUwsT1li1vaW8dhA/5PcuPLOVvEjPc1Pc16HGLhE
-8CRmMn66LqB1ccInE5hLKGGvV3pctjan+IOhaq3OHt/a+buDtTPgykchMZ2k1AzT
-RYk+gksxpIl6yTZsBH4hoRt8auxEJW8AiYbNtXXkNuWcoQL40bQsSUFOQSBUcnVz
-dCBBbmNob3IgUmVwb3NpdG9yeSA8aXRhckBpYW5hLm9yZz6IYAQTEQIAIAUCSWvY
-NwIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEPR9+zCB1GT0GUAAn29/TacF
-Teh87dls8pmkjxS4pKf1AKCJS/MvzR54AblO4DNMyc9q0G4frrkCDQRJa9g3EAgA
-ywoLxF4HVb9o926UIXw8JxNIzDPkt8galAcKRUmHQMNa/QA80WMl9Ia6DIxavGlV
-I5O1fvms297RV2KSSBjKWn6G+0me80A7aw0eHNg7habM5VtzDz5DhJbQFdJV9aYV
-DoTSnY6uR6iSSRrdZNaYdlCwDS8lBCnOKoGMArHzVCa2EdCBeCUY/eObOXtu8Gm3
-nDkuWeLPv08/0lvtr6d6VoDUEVPEsJAPONEYtpz/D+EZddUraF+3JscWqfRApBOz
-/8WHaeTNdzIH+h1ntktiizA6eH40EM6coQQxtIRsxg1DPTxofdovreMkcMI0EUUP
-awDn8gDtgG3g6Ud5zCdknwAEDQf/W3rxrEN6OZxJvWti8Iu6KOgxtuINiAsimPPX
-qy9KHowyEE9EMPzgADjWC9Reyusr4CwcootjWw7ryUwU0fXvVULKhg32NzLsx/Ci
-WtgCPSR58WZ1KKhnoB05+PTrwzhU+u64Cd/vJtFqGxSrANl2FAkPswHJMr8dMwAz
-uni7zzLJ+homW1T5AaixwmN3jeDHWshJH9E9JIhr5Y/8AzMl1V10r2u1c2ej0lBJ
-Y4GegI5cYAEBerS9d+mrbPlvbJ8AfuAuEf0y/PWJh0z1+Kck5qIbXMn/rpMBYvLJ
-Uj5CfqWlh8+hxqSYJDXtLm8hBiQFiMEew0jOc2Tw4F91OZ+jyYhJBBgRAgAJBQJJ
-a9g3AhsMAAoJEPR9+zCB1GT0AUwAn2ZtBwAyVxppdeTqilXufUvAkvjbAJ9dUpR1
-9a17/5BvDDJcIxSEKTJmDw==
-=zCNZ
------END PGP PUBLIC KEY BLOCK-----
-EOF
-	fi
-	# import the new key
-	$pgp_cmd --no-default-keyring --keyring $pgp_keyring_file \
-		--primary-keyring $pgp_keyring_file \
-		--import $pgp_pub_key_file >$tmpf.log 2>&1 \
-		|| error_exit "could not import pgp public key into keyring"
-fi
-
-$fetch_cmd $tmpf $itar_url >$tmpf.log 2>&1 \
-	|| error_exit "fetching $itar_url failed"
-tail -2 $tmpf | grep "; End of file" >/dev/null 2>&1 || \
-	error_exit "The file fetched from $itar_url was partial"
-$fetch_cmd $tmpf.sig $itar_sig >$tmpf.log 2>&1 \
-	|| error_exit "fetching $itar_sig failed"
-
-# check the file with pgp
-$pgp_cmd --no-default-keyring --keyring $pgp_keyring_file \
-	--verify $tmpf.sig $tmpf >$tmpf.log 2>&1 \
-	|| error_exit "the PGP signature failed!"
-
-# check for differences
-val=1
-if diff "$ub_ta_file" $tmpf 2>/dev/null ; then
-	# echo "The interim trust anchor repository did not change."
-	:
-else
-	echo "Updating $ub_ta_file"
-	cp $tmpf $ub_ta_file
-	val=0
-fi
-
-rm -f $tmpf $tmpf.sig $tmpf.log
-exit $val 

contrib/validation-reporter.sh

@@ -0,0 +1,117 @@
+#!/bin/sh
+# validation reporter - reports validation failures to a collection server.
+# Copyright NLnet Labs, 2010
+# BSD license.
+
+
+###
+# Here is the configuration for the validation reporter
+# it greps the failure lines out of the log and sends them to a server.
+
+# The pidfile for the reporter daemon.
+pidfile="/var/run/validation-reporter.pid"
+
+# The logfile to watch for logged validation failures.
+logfile="/var/log/unbound.log"
+
+# how to notify the upstream 
+# nc is netcat, it sends tcp to given host port.  It makes a tcp connection
+# and writes one log-line to it (grepped from the logfile).
+# the notify command can be: "nc the.server.name.org 1234"
+# the listening daemon could be:  nc -lk 127.0.0.1 1234 >> outputfile &
+notify_cmd="nc localhost 1234"
+
+
+###
+# Below this line is the code for the validation reporter,
+# first the daemon itself, then the controller for the daemon.
+reporter_daemon() {
+	trap "rm -f \"$pidfile\"" EXIT
+	tail -f $logfile | grep "unbound.*info: validation failure" | \
+	while read x; do
+		echo "$x" | $notify_cmd
+	done
+}
+
+
+###
+# controller for daemon.
+start_daemon() {
+	echo "starting reporter"
+	nohup $0 rundaemon </dev/null >/dev/null 2>&1 &
+	echo $! > "$pidfile"
+}
+
+kill_daemon() {
+	echo "stopping reporter"
+	if test -s "$pidfile"; then
+		kill `cat "$pidfile"`
+		# check it is really dead
+		if kill -0 `cat "$pidfile"` >/dev/null 2>&1; then
+			sleep 1
+			while kill -0 `cat "$pidfile"` >/dev/null 2>&1; do
+				kill `cat "$pidfile"` >/dev/null 2>&1
+				echo "waiting for reporter to stop"
+				sleep 1
+			done
+		fi
+	fi
+}
+
+get_status_daemon() {
+	if test -s "$pidfile"; then
+		if kill -0 `cat "$pidfile"`; then
+			return 0;
+		fi
+	fi
+	return 1;
+}
+
+restart_daemon() {
+	kill_daemon
+	start_daemon
+}
+
+condrestart_daemon() {
+	if get_status_daemon; then
+		echo "reporter ("`cat "$pidfile"`") is running"
+		exit 0
+	fi
+	start_daemon
+	exit 0
+}
+
+status_daemon() {
+	if get_status_daemon; then
+		echo "reporter ("`cat "$pidfile"`") is running"
+		exit 0
+	fi
+	echo "reporter is not running"
+	exit 1
+}
+
+case "$1" in
+	rundaemon)
+		reporter_daemon
+	;;
+	start)
+		start_daemon
+	;;
+	stop)
+		kill_daemon
+	;;
+	restart)
+		restart_daemon
+	;;
+	condrestart)
+		condrestart_daemon
+	;;
+	status)
+		status_daemon
+	;;
+	*)
+		echo "Usage: $0 {start|stop|restart|condrestart|status}"
+		exit 2
+	;;
+esac
+exit $?

daemon/acl_list.c

@@ -47,7 +47,7 @@
 #include "util/net_help.h"
 
 struct acl_list* 
-acl_list_create()
+acl_list_create(void)
 {
 	struct acl_list* acl = (struct acl_list*)calloc(1,
 		sizeof(struct acl_list));

daemon/acl_list.h

@@ -89,7 +89,7 @@ struct acl_addr {
  * Create acl structure 
  * @return new structure or NULL on error.
  */
-struct acl_list* acl_list_create();
+struct acl_list* acl_list_create(void);
 
 /**
  * Delete acl structure.

daemon/cachedump.c

@@ -40,7 +40,7 @@
  * to text format.
  */
 #include "config.h"
-#include "ldns/ldns.h"
+#include <ldns/ldns.h>
 #include "daemon/cachedump.h"
 #include "daemon/remote.h"
 #include "daemon/worker.h"
@@ -802,7 +802,8 @@ print_dp_details(SSL* ssl, struct worker* worker, struct delegpt* dp)
 {
 	char buf[257];
 	struct delegpt_addr* a;
-	int lame, dlame, rlame, rtt, edns_vs, to, lost;
+	int lame, dlame, rlame, rto, edns_vs, to, delay, entry_ttl;
+	struct rtt_info ri;
 	uint8_t edns_lame_known;
 	for(a = dp->target_list; a; a = a->next_target) {
 		addr_to_str(&a->addr, a->addrlen, buf, sizeof(buf));
@@ -813,30 +814,51 @@ print_dp_details(SSL* ssl, struct worker* worker, struct delegpt* dp)
 				return;
 		}
 		/* lookup in infra cache */
+		delay=0;
+		entry_ttl = infra_get_host_rto(worker->env.infra_cache,
+			&a->addr, a->addrlen, dp->name, dp->namelen,
+			&ri, &delay, *worker->env.now);
+		if(entry_ttl == -2 && ri.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
+			if(!ssl_printf(ssl, "expired, rto %d msec.\n", ri.rto))
+				return;
+			continue;
+		}
+		if(entry_ttl == -1 || entry_ttl == -2) {
+			if(!ssl_printf(ssl, "not in infra cache.\n"))
+				return;
+			continue; /* skip stuff not in infra cache */
+		}
+
 		/* uses type_A because most often looked up, but other
 		 * lameness won't be reported then */
 		if(!infra_get_lame_rtt(worker->env.infra_cache, 
 			&a->addr, a->addrlen, dp->name, dp->namelen,
-			LDNS_RR_TYPE_A, &lame, &dlame, &rlame, &rtt, &lost,
+			LDNS_RR_TYPE_A, &lame, &dlame, &rlame, &rto,
 			*worker->env.now)) {
 			if(!ssl_printf(ssl, "not in infra cache.\n"))
 				return;
 			continue; /* skip stuff not in infra cache */
 		}
-		if(!ssl_printf(ssl, "%s%s%s%srtt %d msec, %d lost. ",
+		if(!ssl_printf(ssl, "%s%s%s%srto %d msec, ttl %d, ping %d "
+			"var %d rtt %d",
 			lame?"LAME ":"", dlame?"NoDNSSEC ":"",
 			a->lame?"AddrWasParentSide ":"",
-			rlame?"NoAuthButRecursive ":"", rtt, lost))
+			rlame?"NoAuthButRecursive ":"", rto, entry_ttl,
+			ri.srtt, ri.rttvar, rtt_notimeout(&ri)))
 			return;
+		if(delay)
+			if(!ssl_printf(ssl, ", probedelay %d", delay))
+				return;
 		if(infra_host(worker->env.infra_cache, &a->addr, a->addrlen,
-			*worker->env.now, &edns_vs, &edns_lame_known, &to)) {
+			dp->name, dp->namelen, *worker->env.now, &edns_vs,
+			&edns_lame_known, &to)) {
 			if(edns_vs == -1) {
-				if(!ssl_printf(ssl, "noEDNS%s.",
-					edns_lame_known?" probed":""))
+				if(!ssl_printf(ssl, ", noEDNS%s.",
+					edns_lame_known?" probed":" assumed"))
 					return;
 			} else {
-				if(!ssl_printf(ssl, "EDNS %d%s.",
-					edns_vs, edns_lame_known?" probed":""))
+				if(!ssl_printf(ssl, ", EDNS %d%s.", edns_vs,
+					edns_lame_known?" probed":" assumed"))
 					return;
 			}
 		}

daemon/daemon.c

@@ -55,7 +55,7 @@
 #ifdef HAVE_OPENSSL_ENGINE_H
 #include <openssl/engine.h>
 #endif
-#include "ldns/ldns.h"
+#include <ldns/ldns.h>
 #include "daemon/daemon.h"
 #include "daemon/worker.h"
 #include "daemon/remote.h"
@@ -131,7 +131,7 @@ static RETSIGTYPE record_sigh(int sig)
  * Stores signals to replay later.
  */
 static void
-signal_handling_record()
+signal_handling_record(void)
 {
 	if( signal(SIGTERM, record_sigh) == SIG_ERR ||
 #ifdef SIGQUIT
@@ -169,7 +169,7 @@ signal_handling_playback(struct worker* wrk)
 }
 
 struct daemon* 
-daemon_init()
+daemon_init(void)
 {
 	struct daemon* daemon = (struct daemon*)calloc(1, 
 		sizeof(struct daemon));
@@ -276,7 +276,7 @@ static void daemon_setup_modules(struct daemon* daemon)
  * @param shufport: the portlist output.
  * @return number of ports available.
  */
-int daemon_get_shufport(struct daemon* daemon, int* shufport)
+static int daemon_get_shufport(struct daemon* daemon, int* shufport)
 {
 	int i, n, k, temp;
 	int avail = 0;
@@ -326,7 +326,7 @@ daemon_create_workers(struct daemon* daemon)
 	numport = daemon_get_shufport(daemon, shufport);
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
 	
-	daemon->num = daemon->cfg->num_threads;
+	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
 	for(i=0; i<daemon->num; i++) {
@@ -339,12 +339,13 @@ daemon_create_workers(struct daemon* daemon)
 	free(shufport);
 }
 
+#ifdef THREADS_DISABLED
 /**
  * Close all pipes except for the numbered thread.
  * @param daemon: daemon to close pipes in.
  * @param thr: thread number 0..num-1 of thread to skip.
  */
-void close_other_pipes(struct daemon* daemon, int thr)
+static void close_other_pipes(struct daemon* daemon, int thr)
 {
 	int i;
 	for(i=0; i<daemon->num; i++)
@@ -359,6 +360,7 @@ void close_other_pipes(struct daemon* daemon, int thr)
 			}
 		}
 }
+#endif /* THREADS_DISABLED */
 
 /**
  * Function to start one thread. 
@@ -447,7 +449,7 @@ daemon_fork(struct daemon* daemon)
 	 */
 	daemon_create_workers(daemon);
 
-#ifdef HAVE_EV_LOOP
+#if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* in libev the first inited base gets signals */
 	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports, 1))
 		fatal_exit("Could not initialize main thread");
@@ -461,7 +463,7 @@ daemon_fork(struct daemon* daemon)
 	/* Special handling for the main thread. This is the thread
 	 * that handles signals and remote control.
 	 */
-#ifndef HAVE_EV_LOOP
+#if !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
 	/* libevent has the last inited base get signals (or any base) */
 	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports, 1))
 		fatal_exit("Could not initialize main thread");
@@ -526,14 +528,21 @@ daemon_delete(struct daemon* daemon)
 	free(daemon->chroot);
 	free(daemon->pidfile);
 	free(daemon->env);
+	SSL_CTX_free((SSL_CTX*)daemon->listen_sslctx);
+	SSL_CTX_free((SSL_CTX*)daemon->connect_sslctx);
 	free(daemon);
 #ifdef LEX_HAS_YYLEX_DESTROY
 	/* lex cleanup */
 	ub_c_lex_destroy();
 #endif
 	/* libcrypto cleanup */
-#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
-	sk_SSL_COMP_free(comp_meth);
+#if defined(USE_GOST) && defined(HAVE_LDNS_KEY_EVP_UNLOAD_GOST)
+	ldns_key_EVP_unload_gost();
+#endif
+#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
+#ifndef S_SPLINT_S
+	sk_SSL_COMP_pop_free(comp_meth, (void(*)())CRYPTO_free);
+#endif
 #endif
 #ifdef HAVE_OPENSSL_CONFIG
 	EVP_cleanup();

daemon/daemon.h

@@ -80,6 +80,8 @@ struct daemon {
 	struct listen_port* rc_ports;
 	/** remote control connections management (for first worker) */
 	struct daemon_remote* rc;
+	/** ssl context for listening to dnstcp over ssl, and connecting ssl */
+	void* listen_sslctx, *connect_sslctx;
 	/** num threads allocated */
 	int num;
 	/** the worker entries */
@@ -108,7 +110,7 @@ struct daemon {
  * Initialize daemon structure.
  * @return: The daemon structure, or NULL on error.
  */
-struct daemon* daemon_init();
+struct daemon* daemon_init(void);
 
 /**
  * Open shared listening ports (if needed).

daemon/remote.c

@@ -47,7 +47,7 @@
 #include <openssl/err.h>
 #endif
 #include <ctype.h>
-#include "ldns/ldns.h"
+#include <ldns/ldns.h>
 #include "daemon/remote.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
@@ -59,6 +59,7 @@
 #include "util/module.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
+#include "services/cache/infra.h"
 #include "services/mesh.h"
 #include "services/localzone.h"
 #include "util/storage/slabhash.h"
@@ -91,21 +92,6 @@
 /** if true, inhibits a lot of =0 lines from the stats output */
 static const int inhibit_zero = 1;
 
-/** log ssl crypto err */
-static void
-log_crypto_err(const char* str)
-{
-	/* error:[error code]:[library name]:[function name]:[reason string] */
-	char buf[128];
-	unsigned long e;
-	ERR_error_string_n(ERR_get_error(), buf, sizeof(buf));
-	log_err("%s crypto %s", str, buf);
-	while( (e=ERR_get_error()) ) {
-		ERR_error_string_n(e, buf, sizeof(buf));
-		log_err("and additionally crypto %s", buf);
-	}
-}
-
 /** subtract timers and the values do not overflow or become negative */
 static void
 timeval_subtract(struct timeval* d, const struct timeval* end, 
@@ -394,7 +380,6 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	/* create new commpoint unless we are servicing already */
 	if(rc->active >= rc->max_active) {
 		log_warn("drop incoming remote control: too many connections");
-		comm_point_stop_listening(c);
 	close_exit:
 #ifndef USE_WINSOCK
 		close(newfd);
@@ -428,6 +413,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	n->ssl = SSL_new(rc->ctx);
 	if(!n->ssl) {
 		log_crypto_err("could not SSL_new");
+		comm_point_delete(n->c);
 		free(n);
 		goto close_exit;
 	}
@@ -436,6 +422,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	if(!SSL_set_fd(n->ssl, newfd)) {
 		log_crypto_err("could not SSL_set_fd");
 		SSL_free(n->ssl);
+		comm_point_delete(n->c);
 		free(n);
 		goto close_exit;
 	}
@@ -701,13 +688,14 @@ print_mem(SSL* ssl, struct worker* worker, struct daemon* daemon)
 
 /** print uptime stats */
 static int
-print_uptime(SSL* ssl, struct worker* worker)
+print_uptime(SSL* ssl, struct worker* worker, int reset)
 {
 	struct timeval now = *worker->env.now_tv;
 	struct timeval up, dt;
 	timeval_subtract(&up, &now, &worker->daemon->time_boot);
 	timeval_subtract(&dt, &now, &worker->daemon->time_last_stat);
-	worker->daemon->time_last_stat = now;
+	if(reset)
+		worker->daemon->time_last_stat = now;
 	if(!ssl_printf(ssl, "time.now"SQ"%d.%6.6d\n", 
 		(unsigned)now.tv_sec, (unsigned)now.tv_usec)) return 0;
 	if(!ssl_printf(ssl, "time.up"SQ"%d.%6.6d\n", 
@@ -891,7 +879,7 @@ do_stats(SSL* ssl, struct daemon_remote* rc, int reset)
 	total.mesh_time_median /= (double)daemon->num;
 	if(!print_stats(ssl, "total", &total)) 
 		return;
-	if(!print_uptime(ssl, rc->worker))
+	if(!print_uptime(ssl, rc->worker, reset))
 		return;
 	if(daemon->cfg->stat_extended) {
 		if(!print_mem(ssl, rc->worker, daemon)) 
@@ -1061,6 +1049,9 @@ do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
 	hashvalue_t h;
 	struct query_info k;
 	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c, 0);
+	if(t == LDNS_RR_TYPE_SOA)
+		rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c,
+			PACKED_RRSET_SOA_NEG);
 	k.qname = nm;
 	k.qname_len = nmlen;
 	k.qtype = t;
@@ -1097,14 +1088,6 @@ do_flush_stats(SSL* ssl, struct worker* worker)
 	send_ok(ssl);
 }
 
-/** flush requestlist */
-static void
-do_flush_requestlist(SSL* ssl, struct worker* worker)
-{
-	mesh_delete_all(worker->env.mesh);
-	send_ok(ssl);
-}
-
 /**
  * Local info for deletion functions
  */
@@ -1127,8 +1110,71 @@ struct del_info {
 	size_t num_msgs;
 	/** number of key entries removed */
 	size_t num_keys;
+	/** length of addr */
+	socklen_t addrlen;
+	/** socket address for host deletion */
+	struct sockaddr_storage addr;
 };
 
+/** callback to delete hosts in infra cache */
+static void
+infra_del_host(struct lruhash_entry* e, void* arg)
+{
+	/* entry is locked */
+	struct del_info* inf = (struct del_info*)arg;
+	struct infra_key* k = (struct infra_key*)e->key;
+	if(sockaddr_cmp(&inf->addr, inf->addrlen, &k->addr, k->addrlen) == 0) {
+		struct infra_data* d = (struct infra_data*)e->data;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_keys++;
+		}
+	}
+}
+
+/** flush infra cache */
+static void
+do_flush_infra(SSL* ssl, struct worker* worker, char* arg)
+{
+	struct sockaddr_storage addr;
+	socklen_t len;
+	struct del_info inf;
+	if(strcmp(arg, "all") == 0) {
+		slabhash_clear(worker->env.infra_cache->hosts);
+		send_ok(ssl);
+		return;
+	}
+	if(!ipstrtoaddr(arg, UNBOUND_DNS_PORT, &addr, &len)) {
+		(void)ssl_printf(ssl, "error parsing ip addr: '%s'\n", arg);
+		return;
+	}
+	/* delete all entries from cache */
+	/* what we do is to set them all expired */
+	inf.worker = worker;
+	inf.name = 0;
+	inf.len = 0;
+	inf.labs = 0;
+	inf.now = *worker->env.now;
+	inf.expired = *worker->env.now;
+	inf.expired -= 3; /* handle 3 seconds skew between threads */
+	inf.num_rrsets = 0;
+	inf.num_msgs = 0;
+	inf.num_keys = 0;
+	inf.addrlen = len;
+	memmove(&inf.addr, &addr, len);
+	slabhash_traverse(worker->env.infra_cache->hosts, 1, &infra_del_host,
+		&inf);
+	send_ok(ssl);
+}
+
+/** flush requestlist */
+static void
+do_flush_requestlist(SSL* ssl, struct worker* worker)
+{
+	mesh_delete_all(worker->env.mesh);
+	send_ok(ssl);
+}
+
 /** callback to delete rrsets in a zone */
 static void
 zone_del_rrset(struct lruhash_entry* e, void* arg)
@@ -1317,7 +1363,7 @@ parse_delegpt(SSL* ssl, struct regional* region, char* args, uint8_t* root)
 			return NULL;
 		}
 		/* add address */
-		if(!delegpt_add_addr(dp, region, &addr, addrlen, 0, 0, 1)) {
+		if(!delegpt_add_addr(dp, region, &addr, addrlen, 0, 0)) {
 			(void)ssl_printf(ssl, "error out of memory\n");
 			return NULL;
 		}
@@ -1494,6 +1540,57 @@ do_dump_requestlist(SSL* ssl, struct worker* worker)
 	}
 }
 
+/** structure for argument data for dump infra host */
+struct infra_arg {
+	/** the infra cache */
+	struct infra_cache* infra;
+	/** the SSL connection */
+	SSL* ssl;
+	/** the time now */
+	uint32_t now;
+};
+
+/** callback for every host element in the infra cache */
+static void
+dump_infra_host(struct lruhash_entry* e, void* arg)
+{
+	struct infra_arg* a = (struct infra_arg*)arg;
+	struct infra_key* k = (struct infra_key*)e->key;
+	struct infra_data* d = (struct infra_data*)e->data;
+	char ip_str[1024];
+	char name[257];
+	addr_to_str(&k->addr, k->addrlen, ip_str, sizeof(ip_str));
+	dname_str(k->zonename, name);
+	/* skip expired stuff (only backed off) */
+	if(d->ttl < a->now) {
+		if(d->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
+			if(!ssl_printf(a->ssl, "%s %s expired rto %d\n", ip_str,
+				name, d->rtt.rto)) return;
+		}
+		return;
+	}
+	if(!ssl_printf(a->ssl, "%s %s ttl %d ping %d var %d rtt %d rto %d "
+		"ednsknown %d edns %d delay %d lame dnssec %d rec %d A %d "
+		"other %d\n", ip_str, name, (int)(d->ttl - a->now),
+		d->rtt.srtt, d->rtt.rttvar, rtt_notimeout(&d->rtt), d->rtt.rto,
+		(int)d->edns_lame_known, (int)d->edns_version,
+		(int)(a->now<d->probedelay?d->probedelay-a->now:0),
+		(int)d->isdnsseclame, (int)d->rec_lame, (int)d->lame_type_A,
+		(int)d->lame_other))
+		return;
+}
+
+/** do the dump_infra command */
+static void
+do_dump_infra(SSL* ssl, struct worker* worker)
+{
+	struct infra_arg arg;
+	arg.infra = worker->env.infra_cache;
+	arg.ssl = ssl;
+	arg.now = *worker->env.now;
+	slabhash_traverse(arg.infra->hosts, 0, &dump_infra_host, (void*)&arg);
+}
+
 /** do the log_reopen command */
 static void
 do_log_reopen(SSL* ssl, struct worker* worker)
@@ -1618,7 +1715,7 @@ do_list_local_data(SSL* ssl, struct worker* worker)
 }
 
 /** tell other processes to execute the command */
-void
+static void
 distribute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd)
 {
 	int i;
@@ -1636,62 +1733,69 @@ distribute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd)
 	}
 }
 
+/** check for name with end-of-string, space or tab after it */
+static int
+cmdcmp(char* p, const char* cmd, size_t len)
+{
+	return strncmp(p,cmd,len)==0 && (p[len]==0||p[len]==' '||p[len]=='\t');
+}
+
 /** execute a remote control command */
 static void
 execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd, 
 	struct worker* worker)
 {
 	char* p = skipwhite(cmd);
-	/* compare command - check longer strings first in case of substrings*/
-	if(strncmp(p, "stop", 4) == 0) {
+	/* compare command */
+	if(cmdcmp(p, "stop", 4)) {
 		do_stop(ssl, rc);
 		return;
-	} else if(strncmp(p, "reload", 6) == 0) {
+	} else if(cmdcmp(p, "reload", 6)) {
 		do_reload(ssl, rc);
 		return;
-	} else if(strncmp(p, "stats_noreset", 13) == 0) {
+	} else if(cmdcmp(p, "stats_noreset", 13)) {
 		do_stats(ssl, rc, 0);
 		return;
-	} else if(strncmp(p, "stats", 5) == 0) {
+	} else if(cmdcmp(p, "stats", 5)) {
 		do_stats(ssl, rc, 1);
 		return;
-	} else if(strncmp(p, "status", 6) == 0) {
+	} else if(cmdcmp(p, "status", 6)) {
 		do_status(ssl, worker);
 		return;
-	} else if(strncmp(p, "dump_cache", 10) == 0) {
+	} else if(cmdcmp(p, "dump_cache", 10)) {
 		(void)dump_cache(ssl, worker);
 		return;
-	} else if(strncmp(p, "load_cache", 10) == 0) {
+	} else if(cmdcmp(p, "load_cache", 10)) {
 		if(load_cache(ssl, worker)) send_ok(ssl);
 		return;
-	} else if(strncmp(p, "list_forwards", 13) == 0) {
+	} else if(cmdcmp(p, "list_forwards", 13)) {
 		do_list_forwards(ssl, worker);
 		return;
-	} else if(strncmp(p, "list_stubs", 10) == 0) {
+	} else if(cmdcmp(p, "list_stubs", 10)) {
 		do_list_stubs(ssl, worker);
 		return;
-	} else if(strncmp(p, "list_local_zones", 16) == 0) {
+	} else if(cmdcmp(p, "list_local_zones", 16)) {
 		do_list_local_zones(ssl, worker);
 		return;
-	} else if(strncmp(p, "list_local_data", 15) == 0) {
+	} else if(cmdcmp(p, "list_local_data", 15)) {
 		do_list_local_data(ssl, worker);
 		return;
-	} else if(strncmp(p, "forward", 7) == 0) {
+	} else if(cmdcmp(p, "forward", 7)) {
 		/* must always distribute this cmd */
 		if(rc) distribute_cmd(rc, ssl, cmd);
 		do_forward(ssl, worker, skipwhite(p+7));
 		return;
-	} else if(strncmp(p, "flush_stats", 11) == 0) {
+	} else if(cmdcmp(p, "flush_stats", 11)) {
 		/* must always distribute this cmd */
 		if(rc) distribute_cmd(rc, ssl, cmd);
 		do_flush_stats(ssl, worker);
 		return;
-	} else if(strncmp(p, "flush_requestlist", 17) == 0) {
+	} else if(cmdcmp(p, "flush_requestlist", 17)) {
 		/* must always distribute this cmd */
 		if(rc) distribute_cmd(rc, ssl, cmd);
 		do_flush_requestlist(ssl, worker);
 		return;
-	} else if(strncmp(p, "lookup", 6) == 0) {
+	} else if(cmdcmp(p, "lookup", 6)) {
 		do_lookup(ssl, worker, skipwhite(p+6));
 		return;
 	}
@@ -1704,29 +1808,33 @@ execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd,
 		distribute_cmd(rc, ssl, cmd);
 	}
 #endif
-	if(strncmp(p, "verbosity", 9) == 0) {
+	if(cmdcmp(p, "verbosity", 9)) {
 		do_verbosity(ssl, skipwhite(p+9));
-	} else if(strncmp(p, "local_zone_remove", 17) == 0) {
+	} else if(cmdcmp(p, "local_zone_remove", 17)) {
 		do_zone_remove(ssl, worker, skipwhite(p+17));
-	} else if(strncmp(p, "local_zone", 10) == 0) {
+	} else if(cmdcmp(p, "local_zone", 10)) {
 		do_zone_add(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "local_data_remove", 17) == 0) {
+	} else if(cmdcmp(p, "local_data_remove", 17)) {
 		do_data_remove(ssl, worker, skipwhite(p+17));
-	} else if(strncmp(p, "local_data", 10) == 0) {
+	} else if(cmdcmp(p, "local_data", 10)) {
 		do_data_add(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "flush_zone", 10) == 0) {
+	} else if(cmdcmp(p, "flush_zone", 10)) {
 		do_flush_zone(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "flush_type", 10) == 0) {
+	} else if(cmdcmp(p, "flush_type", 10)) {
 		do_flush_type(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "flush", 5) == 0) {
+	} else if(cmdcmp(p, "flush_infra", 11)) {
+		do_flush_infra(ssl, worker, skipwhite(p+11));
+	} else if(cmdcmp(p, "flush", 5)) {
 		do_flush_name(ssl, worker, skipwhite(p+5));
-	} else if(strncmp(p, "dump_requestlist", 16) == 0) {
+	} else if(cmdcmp(p, "dump_requestlist", 16)) {
 		do_dump_requestlist(ssl, worker);
-	} else if(strncmp(p, "log_reopen", 10) == 0) {
+	} else if(cmdcmp(p, "dump_infra", 10)) {
+		do_dump_infra(ssl, worker);
+	} else if(cmdcmp(p, "log_reopen", 10)) {
 		do_log_reopen(ssl, worker);
-	} else if(strncmp(p, "set_option", 10) == 0) {
+	} else if(cmdcmp(p, "set_option", 10)) {
 		do_set_option(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "get_option", 10) == 0) {
+	} else if(cmdcmp(p, "get_option", 10)) {
 		do_get_option(ssl, worker, skipwhite(p+10));
 	} else {
 		(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
@@ -1753,7 +1861,8 @@ static void
 handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 {
 	int r;
-	char magic[5];
+	char pre[10];
+	char magic[7];
 	char buf[1024];
 #ifdef USE_WINSOCK
 	/* makes it possible to set the socket blocking again. */
@@ -1762,7 +1871,7 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 #endif
 	fd_set_block(s->c->fd);
 
-	/* try to read magic UBCT string */
+	/* try to read magic UBCT[version]_space_ string */
 	ERR_clear_error();
 	if((r=SSL_read(ssl, magic, (int)sizeof(magic)-1)) <= 0) {
 		if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN)
@@ -1770,9 +1879,10 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 		log_crypto_err("could not SSL_read");
 		return;
 	}
-	magic[4] = 0;
-	if( r != 4 || strcmp(magic, "UBCT") != 0) {
+	magic[6] = 0;
+	if( r != 6 || strncmp(magic, "UBCT", 4) != 0) {
 		verbose(VERB_QUERY, "control connection has bad magic string");
+		/* probably wrong tool connected, ignore it completely */
 		return;
 	}
 
@@ -1780,6 +1890,13 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 	if(!ssl_read_line(ssl, buf, sizeof(buf))) {
 		return;
 	}
+	snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
+	if(strcmp(magic, pre) != 0) {
+		verbose(VERB_QUERY, "control connection had bad "
+			"version %s, cmd: %s", magic, buf);
+		ssl_printf(ssl, "error version mismatch\n");
+		return;
+	}
 	verbose(VERB_DETAIL, "control cmd: %s", buf);
 
 	/* figure out what to do */
@@ -1802,8 +1919,8 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
 	ERR_clear_error();
 	r = SSL_do_handshake(s->ssl);
 	if(r != 1) {
-		r = SSL_get_error(s->ssl, r);
-		if(r == SSL_ERROR_WANT_READ) {
+		int r2 = SSL_get_error(s->ssl, r);
+		if(r2 == SSL_ERROR_WANT_READ) {
 			if(s->shake_state == rc_hs_read) {
 				/* try again later */
 				return 0;
@@ -1811,7 +1928,7 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
 			s->shake_state = rc_hs_read;
 			comm_point_listen_for_rw(c, 1, 0);
 			return 0;
-		} else if(r == SSL_ERROR_WANT_WRITE) {
+		} else if(r2 == SSL_ERROR_WANT_WRITE) {
 			if(s->shake_state == rc_hs_write) {
 				/* try again later */
 				return 0;
@@ -1820,6 +1937,10 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
 			comm_point_listen_for_rw(c, 0, 1);
 			return 0;
 		} else {
+			if(r == 0)
+				log_err("remote control connection closed prematurely");
+			log_addr(1, "failed connection from",
+				&s->c->repinfo.addr, s->c->repinfo.addrlen);
 			log_crypto_err("remote control failed ssl");
 			clean_point(rc, s);
 			return 0;

daemon/stats.c

@@ -40,7 +40,7 @@
  * numbers. These 'statistics' may be of interest to the operator.
  */
 #include "config.h"
-#include "ldns/wire2host.h"
+#include <ldns/wire2host.h>
 #include "daemon/stats.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
@@ -100,12 +100,14 @@ void server_stats_log(struct server_stats* stats, struct worker* worker,
 		(unsigned)stats->num_queries_missed_cache,
 		(unsigned)stats->num_queries_prefetch);
 	log_info("server stats for thread %d: requestlist max %u avg %g "
-		"exceeded %u", threadnum, (unsigned)stats->max_query_list_size,
+		"exceeded %u jostled %u", threadnum,
+		(unsigned)stats->max_query_list_size,
 		(stats->num_queries_missed_cache+stats->num_queries_prefetch)?
 			(double)stats->sum_query_list_size/
 			(stats->num_queries_missed_cache+
 			stats->num_queries_prefetch) : 0.0,
-		(unsigned)worker->env.mesh->stats_dropped);
+		(unsigned)worker->env.mesh->stats_dropped,
+		(unsigned)worker->env.mesh->stats_jostled);
 }
 
 /** get rrsets bogus number from validator */

daemon/stats.h

@@ -43,7 +43,7 @@
 #ifndef DAEMON_STATS_H
 #define DAEMON_STATS_H
 #include "util/timehist.h"
-#include "ldns/buffer.h"
+#include <ldns/buffer.h>
 struct worker;
 struct config_file;
 struct comm_point;

daemon/unbound.c

@@ -44,6 +44,7 @@
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
+#include <sys/time.h>
 #include "util/log.h"
 #include "daemon/daemon.h"
 #include "daemon/remote.h"
@@ -54,6 +55,7 @@
 #include "services/cache/infra.h"
 #include "util/data/msgreply.h"
 #include "util/module.h"
+#include "util/net_help.h"
 #include <signal.h>
 #include <fcntl.h>
 #include <openssl/crypto.h>
@@ -88,10 +90,59 @@
 /** global debug value to keep track of heap memory allocation */
 void* unbound_start_brk = 0;
 
+#if !defined(HAVE_EVENT_BASE_GET_METHOD) && (defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
+static const char* ev_backend2str(int b)
+{
+	switch(b) {
+	case EVBACKEND_SELECT:	return "select";
+	case EVBACKEND_POLL:	return "poll";
+	case EVBACKEND_EPOLL:	return "epoll";
+	case EVBACKEND_KQUEUE:	return "kqueue";
+	case EVBACKEND_DEVPOLL: return "devpoll";
+	case EVBACKEND_PORT:	return "evport";
+	}
+	return "unknown";
+}
+#endif
+
+/** get the event system in use */
+static void get_event_sys(const char** n, const char** s, const char** m)
+{
+#ifdef USE_WINSOCK
+	*n = "event";
+	*s = "winsock";
+	*m = "WSAWaitForMultipleEvents";
+#elif defined(USE_MINI_EVENT)
+	*n = "mini-event";
+	*s = "internal";
+	*m = "select";
+#else
+	struct event_base* b;
+	*s = event_get_version();
+#  ifdef HAVE_EVENT_BASE_GET_METHOD
+	*n = "libevent";
+	b = event_base_new();
+	*m = event_base_get_method(b);
+#  elif defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
+	*n = "libev";
+	b = (struct event_base*)ev_default_loop(EVFLAG_AUTO);
+	*m = ev_backend2str(ev_backend((struct ev_loop*)b));
+#  else
+	*n = "unknown";
+	*m = "not obtainable";
+	b = NULL;
+#  endif
+#  ifdef HAVE_EVENT_BASE_FREE
+	event_base_free(b);
+#  endif
+#endif
+}
+
 /** print usage. */
 static void usage()
 {
 	const char** m;
+	const char *evnm="event", *evsys="", *evmethod="";
 	printf("usage:  unbound [options]\n");
 	printf("	start unbound daemon DNS resolver.\n");
 	printf("-h	this help\n");
@@ -105,20 +156,16 @@ static void usage()
 	printf("   	service - used to start from services control panel\n");
 #endif
 	printf("Version %s\n", PACKAGE_VERSION);
-	printf("linked libs: event %s, ldns %s, %s\n", 
-#ifdef USE_WINSOCK
-		"winsock",
-#elif defined(USE_MINI_EVENT)
-		"internal",
-#else
-		event_get_version(), 
-#endif
-		ldns_version(), 
+	get_event_sys(&evnm, &evsys, &evmethod);
+	printf("linked libs: %s %s (it uses %s), ldns %s, %s\n", 
+		evnm, evsys, evmethod, ldns_version(), 
 		SSLeay_version(SSLEAY_VERSION));
 	printf("linked modules:");
 	for(m = module_list_avail(); *m; m++)
 		printf(" %s", *m);
 	printf("\n");
+	printf("configured for %s on %s with options:%s\n",
+		CONFIGURE_TARGET, CONFIGURE_DATE, CONFIGURE_BUILD_WITH);
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
 }
@@ -153,12 +200,41 @@ checkrlimits(struct config_file* cfg)
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	int numthread = 1; /* it forks */
 #else
-	int numthread = cfg->num_threads;
+	int numthread = (cfg->num_threads?cfg->num_threads:1);
 #endif
 	size_t total = numthread * perthread + misc;
 	size_t avail;
 	struct rlimit rlim;
 
+	if(total > 1024 && 
+		strncmp(event_get_version(), "mini-event", 10) == 0) {
+		log_warn("too many file descriptors requested. The builtin"
+			"mini-event cannot handle more than 1024. Config "
+			"for less fds or compile with libevent");
+		if(numthread*perthread_noudp+15 > 1024)
+			fatal_exit("too much tcp. not enough fds.");
+		cfg->outgoing_num_ports = (int)((1024 
+			- numthread*perthread_noudp 
+			- 10 /* safety margin */) /numthread);
+		log_warn("continuing with less udp ports: %u",
+			cfg->outgoing_num_ports);
+		total = 1024;
+	}
+	if(perthread > 64 && 
+		strncmp(event_get_version(), "winsock-event", 13) == 0) {
+		log_err("too many file descriptors requested. The winsock"
+			" event handler cannot handle more than 64 per "
+			" thread. Config for less fds");
+		if(perthread_noudp+2 > 64)
+			fatal_exit("too much tcp. not enough fds.");
+		cfg->outgoing_num_ports = (int)((64 
+			- perthread_noudp 
+			- 2/* safety margin */));
+		log_warn("continuing with less udp ports: %u",
+			cfg->outgoing_num_ports);
+		total = numthread*(perthread_noudp+
+			(size_t)cfg->outgoing_num_ports)+misc;
+	}
 	if(getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
 		log_warn("getrlimit: %s", strerror(errno));
 		return;
@@ -169,8 +245,12 @@ checkrlimits(struct config_file* cfg)
 		avail = (size_t)rlim.rlim_cur;
 		rlim.rlim_cur = (rlim_t)(total + 10);
 		rlim.rlim_max = (rlim_t)(total + 10);
+#ifdef HAVE_SETRLIMIT
 		if(setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
 			log_warn("setrlimit: %s", strerror(errno));
+#else
+		if(1) {
+#endif
 			log_warn("cannot increase max open fds from %u to %u",
 				(unsigned)avail, (unsigned)total+10);
 			/* check that calculation below does not underflow,
@@ -182,27 +262,13 @@ checkrlimits(struct config_file* cfg)
 				- 10 /* safety margin */) /numthread);
 			log_warn("continuing with less udp ports: %u",
 				cfg->outgoing_num_ports);
-			log_warn("increase ulimit or decrease threads, ports in config to remove this warning");
+			log_warn("increase ulimit or decrease threads, "
+				"ports in config to remove this warning");
 			return;
 		}
 		log_warn("increased limit(open files) from %u to %u",
 			(unsigned)avail, (unsigned)total+10);
 	}
-	if(total > 1024 && 
-		strncmp(event_get_version(), "mini-event", 10) == 0) {
-		log_err("too many file descriptors requested. The builtin"
-			"mini-event cannot handle more than 1024. Config "
-			"for less fds or compile with libevent");
-		fatal_exit("configuration needs too many file descriptors");
-	}
-	if(perthread > 64 && 
-		strncmp(event_get_version(), "winsock-event", 13) == 0) {
-		log_err("too many file descriptors requested. The winsock"
-			" event handler cannot handle more than 64 per "
-			" thread. Config for less fds or compile with "
-			" libevent");
-		fatal_exit("configuration needs too many file descriptors");
-	}
 #else	
 	(void)cfg;
 #endif /* HAVE_GETRLIMIT */
@@ -381,6 +447,13 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	/* read ssl keys while superuser and outside chroot */
 	if(!(daemon->rc = daemon_remote_create(cfg)))
 		fatal_exit("could not set up remote-control");
+	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
+		if(!(daemon->listen_sslctx = listen_sslctx_create(
+			cfg->ssl_service_key, cfg->ssl_service_pem, NULL)))
+			fatal_exit("could not set up listen SSL_CTX");
+	}
+	if(!(daemon->connect_sslctx = connect_sslctx_create(NULL, NULL, NULL)))
+		fatal_exit("could not set up connect SSL_CTX");
 
 #ifdef HAVE_KILL
 	/* check old pid file before forking */
@@ -418,7 +491,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 			 * chown to get permissions */
 			if(cfg->username && cfg->username[0]) {
 			  if(chown(daemon->pidfile, uid, gid) == -1) {
-				fatal_exit("cannot chown %u.%u %s: %s",
+				log_err("cannot chown %u.%u %s: %s",
 					(unsigned)uid, (unsigned)gid,
 					daemon->pidfile, strerror(errno));
 			  }

daemon/worker.c

@@ -40,7 +40,7 @@
  * pending requests.
  */
 #include "config.h"
-#include "ldns/wire2host.h"
+#include <ldns/wire2host.h>
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/random.h"
@@ -141,7 +141,7 @@ debug_total_mem(size_t calctotal)
 #endif /* UNBOUND_ALLOC_STATS */
 
 /** Report on memory usage by this thread and global */
-void
+static void
 worker_mem_report(struct worker* ATTR_UNUSED(worker), 
 	struct serviced_query* ATTR_UNUSED(cur_serv))
 {
@@ -178,6 +178,8 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 		+ sizeof(*worker->env.scratch_buffer) 
 		+ ldns_buffer_capacity(worker->env.scratch_buffer)
 		+ forwards_get_mem(worker->env.fwds);
+	if(worker->thread_num == 0)
+		me += acl_list_get_mem(worker->daemon->acl);
 	if(cur_serv) {
 		me += serviced_get_mem(cur_serv);
 	}
@@ -283,9 +285,10 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 	return 0;
 }
 
-/** check request sanity. Returns error code, 0 OK, or -1 discard. 
+/** check request sanity.
  * @param pkt: the wire packet to examine for sanity.
  * @param worker: parameters for checking.
+ * @return error code, 0 OK, or -1 discard.
 */
 static int 
 worker_check_request(ldns_buffer* pkt, struct worker* worker)
@@ -443,7 +446,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	uint16_t udpsize = edns->udp_size;
 	int secure = 0;
 	uint32_t timenow = *worker->env.now;
-	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
+	int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd)
+		&& worker->env.need_to_validate;
 	struct dns_msg *msg = NULL;
 	struct delegpt *dp;
 
@@ -519,7 +523,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	uint32_t timenow = *worker->env.now;
 	uint16_t udpsize = edns->udp_size;
 	int secure;
-	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
+	int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd)
+		&& worker->env.need_to_validate;
 	/* see if it is possible */
 	if(rep->ttl < timenow) {
 		/* the rrsets may have been updated in the meantime.
@@ -734,17 +739,21 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			worker->stats.unwanted_queries++;
 		return 0;
 	} else if(acl == acl_refuse) {
+		log_addr(VERB_ALGO, "refused query from",
+			&repinfo->addr, repinfo->addrlen);
+		log_buf(VERB_ALGO, "refuse", c->buffer);
+		if(worker->stats.extended)
+			worker->stats.unwanted_queries++;
+		if(worker_check_request(c->buffer, worker) == -1) {
+			comm_point_drop_reply(repinfo);
+			return 0; /* discard this */
+		}
 		ldns_buffer_set_limit(c->buffer, LDNS_HEADER_SIZE);
 		ldns_buffer_write_at(c->buffer, 4, 
 			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
 		LDNS_QR_SET(ldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(ldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
-		log_addr(VERB_ALGO, "refused query from",
-			&repinfo->addr, repinfo->addrlen);
-		log_buf(VERB_ALGO, "refuse", c->buffer);
-		if(worker->stats.extended)
-			worker->stats.unwanted_queries++;
 		return 1;
 	}
 	if((ret=worker_check_request(c->buffer, worker)) != 0) {
@@ -770,10 +779,16 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		server_stats_insrcode(&worker->stats, c->buffer);
 		return 1;
 	}
+	if(worker->env.cfg->log_queries) {
+		char ip[128];
+		addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
+		log_nametypeclass(0, ip, qinfo.qname, qinfo.qtype, qinfo.qclass);
+	}
 	if(qinfo.qtype == LDNS_RR_TYPE_AXFR || 
 		qinfo.qtype == LDNS_RR_TYPE_IXFR) {
 		verbose(VERB_ALGO, "worker request: refused zone transfer.");
 		log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
+		ldns_buffer_rewind(c->buffer);
 		LDNS_QR_SET(ldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(ldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
@@ -906,14 +921,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 
 	/* grab a work request structure for this new request */
-	if(worker->env.mesh->num_reply_addrs>worker->request_size*16) {
-		/* protect our memory usage from storing reply addresses */
-		verbose(VERB_ALGO, "Too many requests queued. "
-			"dropping incoming query.");
-		worker->env.mesh->stats_dropped++;
-		comm_point_drop_reply(repinfo);
-		return 0;
-	}
 	mesh_new_client(worker->env.mesh, &qinfo, 
 		ldns_buffer_read_u16_at(c->buffer, 2),
 		&edns, repinfo, *(uint16_t*)ldns_buffer_begin(c->buffer));
@@ -1001,6 +1008,7 @@ void worker_probe_timer_cb(void* arg)
 struct worker* 
 worker_create(struct daemon* daemon, int id, int* ports, int n)
 {
+	unsigned int seed;
 	struct worker* worker = (struct worker*)calloc(1, 
 		sizeof(struct worker));
 	if(!worker) 
@@ -1018,6 +1026,19 @@ worker_create(struct daemon* daemon, int id, int* ports, int n)
 		free(worker);
 		return NULL;
 	}
+	/* create random state here to avoid locking trouble in RAND_bytes */
+	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
+		(((unsigned int)worker->thread_num)<<17);
+		/* shift thread_num so it does not match out pid bits */
+	if(!(worker->rndstate = ub_initstate(seed, daemon->rand))) {
+		seed = 0;
+		log_err("could not init random numbers.");
+		tube_delete(worker->cmd);
+		free(worker->ports);
+		free(worker);
+		return NULL;
+	}
+	seed = 0;
 	return worker;
 }
 
@@ -1025,7 +1046,6 @@ int
 worker_init(struct worker* worker, struct config_file *cfg, 
 	struct listen_port* ports, int do_sigs)
 {
-	unsigned int seed;
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create(do_sigs);
 	if(!worker->base) {
@@ -1070,19 +1090,9 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	} else { /* !do_sigs */
 		worker->comsig = NULL;
 	}
-	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
-		(((unsigned int)worker->thread_num)<<17);
-		/* shift thread_num so it does not match out pid bits */
-	if(!(worker->rndstate = ub_initstate(seed, NULL))) {
-		seed = 0;
-		log_err("could not init random numbers.");
-		worker_delete(worker);
-		return 0;
-	}
-	seed = 0;
 	worker->front = listen_create(worker->base, ports,
 		cfg->msg_buffer_size, (int)cfg->incoming_num_tcp, 
-		worker_handle_request, worker);
+		worker->daemon->listen_sslctx, worker_handle_request, worker);
 	if(!worker->front) {
 		log_err("could not create listening sockets");
 		worker_delete(worker);
@@ -1095,7 +1105,7 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker->daemon->env->infra_cache, worker->rndstate,
 		cfg->use_caps_bits_for_id, worker->ports, worker->numports,
 		cfg->unwanted_threshold, &worker_alloc_cleanup, worker,
-		cfg->do_udp);
+		cfg->do_udp, worker->daemon->connect_sslctx);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -1122,7 +1132,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker_delete(worker);
 		return 0;
 	}
-	worker->request_size = cfg->num_queries_per_thread;
 
 	server_stats_init(&worker->stats, cfg);
 	alloc_init(&worker->alloc, &worker->daemon->superalloc, 
@@ -1133,7 +1142,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	if(worker->thread_num == 0)
 		log_set_time(worker->env.now);
 	worker->env.worker = worker;
-	worker->env.send_packet = &worker_send_packet;
 	worker->env.send_query = &worker_send_query;
 	worker->env.alloc = &worker->alloc;
 	worker->env.rnd = worker->rndstate;
@@ -1222,19 +1230,6 @@ worker_delete(struct worker* worker)
 	free(worker);
 }
 
-int 
-worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-        socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp)
-{
-	struct worker* worker = q->env->worker;
-	if(use_tcp) {
-		return pending_tcp_query(worker->back, pkt, addr, addrlen, 
-			timeout, worker_handle_reply, q) != 0;
-	}
-	return pending_udp_query(worker->back, pkt, addr, addrlen, 
-		timeout*1000, worker_handle_reply, q) != 0;
-}
-
 /** compare outbound entry qstates */
 static int
 outbound_entry_compare(void* a, void* b)
@@ -1249,8 +1244,8 @@ outbound_entry_compare(void* a, void* b)
 struct outbound_entry*
 worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	uint16_t qclass, uint16_t flags, int dnssec, int want_dnssec,
-	struct sockaddr_storage* addr, socklen_t addrlen,
-	struct module_qstate* q)
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
+	size_t zonelen, struct module_qstate* q)
 {
 	struct worker* worker = q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -1260,7 +1255,8 @@ worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(worker->back, qname,
 		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
-		addr, addrlen, worker_handle_service_reply, e, 
+		q->env->cfg->tcp_upstream, q->env->cfg->ssl_upstream, addr,
+		addrlen, zone, zonelen, worker_handle_service_reply, e,
 		worker->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
@@ -1284,15 +1280,6 @@ void worker_stats_clear(struct worker* worker)
 }
 
 /* --- fake callbacks for fptr_wlist to work --- */
-int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
-	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
-{
-	log_assert(0);
-	return 0;
-}
-
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 

daemon/worker.h

@@ -102,9 +102,6 @@ struct worker {
 	/** timer for statistics */
 	struct comm_timer* stat_timer;
 
-	/** number of requests that can be handled by this worker */
-	size_t request_size;
-
 	/** random() table for this worker. */
 	struct ub_randstate* rndstate;
 	/** do we need to restart or quit (on signal) */
@@ -167,20 +164,6 @@ void worker_send_cmd(struct worker* worker, enum worker_commands cmd);
  */
 void worker_sighandler(int sig, void* arg);
 
-/**
- * Worker service routine to send udp messages for modules.
- * @param pkt: packet to send.
- * @param addr: where to.
- * @param addrlen: length of addr.
- * @param timeout: seconds to wait until timeout.
- * @param q: wich query state to reactivate upon return.
- * @param use_tcp: true to use TCP, false for UDP.
- * @return: false on failure (memory or socket related). no query was
- *      sent.
- */
-int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-	socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp);
-
 /**
  * Worker service routine to send serviced queries to authoritative servers.
  * @param qname: query name. (host order)
@@ -192,6 +175,8 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  * @param want_dnssec: signatures needed.
  * @param addr: where to.
  * @param addrlen: length of addr.
+ * @param zone: wireformat dname of the zone.
+ * @param zonelen: length of zone name.
  * @param q: wich query state to reactivate upon return.
  * @return: false on failure (memory or socket related). no query was
  *      sent.
@@ -199,7 +184,7 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 struct outbound_entry* worker_send_query(uint8_t* qname, size_t qnamelen, 
 	uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
 	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
-	struct module_qstate* q);
+	uint8_t* zone, size_t zonelen, struct module_qstate* q);
 
 /** 
  * process control messages from the main thread. Frees the control 

doc/Changelog

@@ -1,3 +1,703 @@
+19 December 2011: Wouter
+	- Fix for VU#209659 CVE-2011-4528: Unbound denial of service
+	  vulnerabilities from nonstandard redirection and denial of existence
+	  http://www.unbound.net/downloads/CVE-2011-4528.txt
+	- robust checks for next-closer NSEC3s.
+	- tag 1.4.14 created.
+
+15 December 2011: Wouter
+	- remove uninit warning from cachedump code.
+	- Fix parse error on negative SOA RRSIGs if badly ordered in the packet.
+
+13 December 2011: Wouter
+	- iana portlist updated.
+	- svn tag 1.4.14rc1
+	- fix infra cache comparison.
+	- Fix to constrain signer_name to be a parent of the lookupname.
+
+5 December 2011: Wouter
+	- Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc.
+	- Fix warnings with gcc 4.6 in compat/inet_ntop.c.
+	- Fix warning unused in compat/strptime.c.
+	- Fix malloc detection and double defintion.
+
+2 December 2011: Wouter
+	- configure generated with autoconf 2.68.
+
+30 November 2011: Wouter
+	- Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes
+	  SERVFAILs.  Also fixed for UDP (but less likely).
+
+28 November 2011: Wouter
+	- Fix quartile time estimate, it was too low, (thanks Jan Komissar).
+	- iana ports updated.
+
+11 November 2011: Wouter
+	- Makefile compat with SunOS make, BSD make and GNU make.
+	- iana ports updated.
+
+10 November 2011: Wouter
+	- Makefile changed for BSD make compatibility.
+
+9 November 2011: Wouter
+	- added unit test for SSL service and SSL-upstream.
+
+8 November 2011: Wouter
+	- can configure ssl service to one port number, and not on others.
+	- fixup windows compile with ssl support.
+	- Fix double free in unbound-host, reported by Steve Grubb.
+	- iana portlist updated.
+
+1 November 2011: Wouter
+	- dns over ssl support as a client, ssl-upstream yes turns it on.
+	  It performs an SSL transaction for every DNS query (250 msec).
+	- documentation for new options: ssl-upstream, ssl-service-key and
+	  ssl-service.pem.
+	- iana portlist updated.
+	- fix -flto detection on Lion for llvm-gcc.
+
+31 October 2011: Wouter
+	- dns over ssl support, ssl-service-pem and ssl-service-key files
+	  can be given and then TCP queries are serviced wrapped in SSL.
+
+27 October 2011: Wouter
+	- lame-ttl and lame-size options no longer exist, it is integrated
+	  with the host info.  They are ignored (with verbose warning) if
+	  encountered to keep the config file backwards compatible.
+	- fix iana-update for changing gzip compression of results.
+	- fix export-all-symbols on OSX.
+
+26 October 2011: Wouter
+	- iana portlist updated.
+	- Infra cache stores information about ping and lameness per IP, zone.
+	  This fixes bug #416.
+	- fix iana_update target for gzipped file on iana site.
+
+24 October 2011: Wouter
+	- Fix resolve of partners.extranet.microsoft.com with a fix for the
+	  server selection for choosing out of a (particular) list of bad
+	  choices. (bug#415)
+	- Fix make_new_space function so that the incoming query is not
+	  overwritten if a jostled out query causes a waiting query to be
+	  resumed that then fails and sends an error message.  (Thanks to
+	  Matthew Lee).
+
+21 October 2011: Wouter
+	- fix --enable-allsymbols, fptr wlist is disabled on windows with this 
+	  option enabled because of memory layout exe vs dll.
+
+19 October 2011: Wouter
+	- fix unbound-anchor for broken strptime on OSX lion, detected
+	  in configure.
+	- Detect if GOST really works, openssl1.0 on OSX fails.
+	- Implement ipv6%interface notation for scope_id usage.
+
+17 October 2011: Wouter
+	- better documentation for inform_super (Thanks Yang Zhe).
+
+14 October 2011: Wouter
+	- Fix for out-of-memory condition in libunbound (thanks
+	  Robert Fleischman).
+
+13 October 2011: Wouter
+	- Fix --enable-allsymbols, it depended on link specifics of the
+	  target platform, or fptr_wlist assertion failures could occur.
+
+12 October 2011: Wouter
+	- updated contrib/unbound_munin_ to family=auto so that it works with
+	  munin-node-configure automatically (if installed as
+	  /usr/local/share/munin/plugins/unbound_munin_ ).
+
+27 September 2011: Wouter
+	- unbound.exe -w windows option for start and stop service.
+
+23 September 2011: Wouter
+	- TCP-upstream calculates tcp-ping so server selection works if there
+	  are alternatives.
+
+20 September 2011: Wouter
+	- Fix classification of NS set in answer section, where there is a
+	  parent-child server, and the answer has the AA flag for dir.slb.com.
+	  Thanks to Amanda Constant from Secure64.
+
+16 September 2011: Wouter
+	- fix bug #408: accept patch from Steve Snyder that comments out
+	  unused functions in lookup3.c.
+	- iana portlist updated.
+	- fix EDNS1480 change memleak and TCP fallback.
+	- fix various compiler warnings (reported by Paul Wouters).
+	- max sent count.  EDNS1480 only for rtt < 5000.  No promiscuous
+	  fetch if sentcount > 3, stop query if sentcount > 16.  Count is
+	  reset when referral or CNAME happens.  This makes unbound better
+	  at managing large NS sets, they are explored when there is continued
+	  interest (in the form of queries).
+
+15 September 2011: Wouter
+	- release 1.4.13.
+	- trunk contains 1.4.14 in development.
+	- Unbound probes at EDNS1480 if there an EDNS0 timeout.
+
+12 September 2011: Wouter
+	- Reverted dns EDNS backoff fix, it did not help and needs
+	  fragmentation fixes instead.
+	- tag 1.4.13rc2
+
+7 September 2011: Wouter
+	- Fix operation in ipv6 only (do-ip4: no) mode.
+
+6 September 2011: Wouter
+	- fedora specfile updated.
+
+5 September 2011: Wouter
+	- tag 1.4.13rc1
+
+2 September 2011: Wouter
+	- iana portlist updated.
+
+26 August 2011: Wouter
+	- Fix num-threads 0 does not segfault, reported by Simon Deziel.
+	- Fix validation failures due to EDNS backoff retries, the retry
+	  for fetch of data has want_dnssec because the iter_indicate_dnssec
+	  function returns true when validation failure retry happens, and
+	  then the serviced query code does not fallback to noEDNS, even if
+	  the cache says it has this.  This helps for DLV deployment when
+	  the DNSSEC status is not known for sure before the lookup concludes.
+
+24 August 2011: Wouter
+	- Applied patch from Karel Slany that fixes a memory leak in the
+	  unbound python module, in string conversions.
+
+22 August 2011: Wouter
+	- Fix validation of qtype ANY responses with CNAMEs (thanks Cathy
+	  Zhang and Luo Ce).  Unbound responds with the RR types that are
+	  available at the name for qtype ANY and validates those RR types.
+	  It does not test for completeness (i.e. with NSEC or NSEC3 query),
+	  and it does not follow the CNAME or DNAME to another name (with
+	  even more data for the already large response).
+	- Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
+	- Documented the options that work with control set_option command.
+	- tcp-upstream yes/no option (works with set_option) for tunnels.
+
+18 August 2011: Wouter
+	- fix autoconf call in makedist crosscompile to RC or snapshot.
+
+17 August 2011: Wouter
+	- Fix validation of . DS query.
+	- new xml format at IANA, new awk for iana_update.
+	- iana portlist updated.
+
+10 August 2011: Wouter
+	- Fix python site-packages path to /usr/lib64.
+	- updated patch from Tom.
+	- fix memory and fd leak after out-of-memory condition.
+
+9 August 2011: Wouter
+	- patch from Tom Hendrikx fixes load of python modules.
+
+8 August 2011: Wouter
+	- make clean had ldns-src reference, removed.
+
+1 August 2011: Wouter
+	- Fix autoconf 2.68 warnings
+
+14 July 2011: Wouter
+	- Unbound implements RFC6303 (since version 1.4.7).
+	- tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the
+	  meantime, those are for 1.4.13).
+	- iana portlist updated.
+
+13 July 2011: Wouter
+	- Quick fix for contrib/unbound.spec example, no ldns-builtin any more.
+
+11 July 2011: Wouter
+	- Fix wildcard expansion no-data reply under an optout NSEC3 zone is
+	  validated as insecure, reported by Jia Li (lijia@cnnic.cn).
+
+4 July 2011: Wouter
+	- 1.4.12rc1 tag created.
+
+1 July 2011: Wouter
+	- version number in example config file.
+	- fix that --enable-static-exe does not complain about it unknown.
+
+30 June 2011: Wouter
+	- tag relase 1.4.11, trunk is 1.4.12 development.
+	- iana portlist updated.
+	- fix bug#395: id bits of other query may leak out under conditions
+	- fix replyaddr count wrong after jostled queries, which leads to
+	  eventual starvation where the daemon has no replyaddrs left to use.
+	- fix comment about rndc port, that referred to the old port number.
+	- fix that the listening socket is not closed when too many remote
+	  control connections are made at the same time.
+	- removed ldns-src tarball inside the unbound tarball.
+
+23 June 2011: Wouter
+	- Changed -flto check to support clang compiler.
+	- tag 1.4.11rc3 created.
+
+17 June 2011: Wouter
+	- tag 1.4.11rc1 created.
+	- remove warning about signed/unsigned from flex (other flex version).
+	- updated aclocal.m4 and libtool to match.
+	- tag 1.4.11rc2 created.
+
+16 June 2011: Wouter
+	- log-queries: yesno option, default is no, prints querylog.
+	- version is 1.4.11.
+
+14 June 2011: Wouter
+	- Use -flto compiler flag for link time optimization, if supported.
+	- iana portlist updated.
+
+12 June 2011: Wouter
+	- IPv6 service address for d.root-servers.net (2001:500:2D::D).
+
+10 June 2011: Wouter
+	- unbound-control has version number in the header,
+	  UBCT[version]_space_ is the header sent by the client now.
+	- Unbound control port number is registered with IANA:
+	  ub-dns-control  8953/tcp    unbound dns nameserver control
+	  This is the new default for the control-port config setting.
+	- statistics-interval prints the number of jostled queries to log.
+
+30 May 2011: Wouter
+	- Fix Makefile for U in environment, since wrong U is more common than
+	  deansification necessity.
+	- iana portlist updated.
+	- updated ldns tarball to 1.6.10rc2 snapshot of today.
+
+25 May 2011: Wouter
+	- Fix assertion failure when unbound generates an empty error reply
+	  in response to a query, CVE-2011-1922 VU#531342.
+	- This fix is in tag 1.4.10.
+	- defense in depth against the above bug, an error is printed to log
+	  instead of an assertion failure.
+
+10 May 2011: Wouter
+	- bug#386: --enable-allsymbols option links all binaries to libunbound
+	  and reduces install size significantly.
+	- feature, ignore-cd-flag: yesno to provide dnssec to legacy servers.
+	- iana portlist updated.
+	- Fix TTL of SOA so negative TTL is separately cached from normal TTL.
+
+14 April 2011: Wouter
+	- configure created with newer autoconf 2.66.
+
+12 April 2011: Wouter
+	- bug#378: Fix that configure checks for ldns_get_random presence.
+
+8 April 2011: Wouter
+	- iana portlist updated.
+	- queries with CD flag set cause DNSSEC validation, but the answer is
+	  not withheld if it is bogus.  Thus, unbound will retry if it is bad
+	  and curb the TTL if it is bad, thus protecting the cache for use by
+	  downstream validators.
+	- val-override-date: -1 ignores dates entirely, for NTP usage.
+
+29 March 2011: Wouter
+	- harden-below-nxdomain: changed so that it activates when the
+	  cached nxdomain is dnssec secure.  This avoids backwards
+	  incompatibility because those old servers do not have dnssec.
+
+24 March 2011: Wouter
+	- iana portlist updated.
+	- release 1.4.9.
+	- trunk is 1.5.0
+
+17 March 2011: Wouter
+	- bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
+	  Applied but did not do the --disable-gost.
+
+10 March 2011: Wouter
+	- tag 1.4.9 release candidate 1 created.
+
+3 March 2011: Wouter
+	- updated ldns to today.
+
+1 March 2011: Wouter
+	- Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
+	- give config parse error for multiple names on a stub or forward zone.
+	- updated ldns tarball to 1.6.9(todays snapshot).
+
+24 February 2011: Wouter
+	- bug #361: Fix, time.elapsed variable not reset with stats_noreset.
+
+23 February 2011: Wouter
+	- iana portlist updated.
+	- common.sh to version 3.
+
+18 February 2011: Wouter
+	- common.sh in testdata updated to version 2.
+
+15 February 2011: Wouter
+	- Added explicit note on unbound-anchor usage:
+	  Please note usage of unbound-anchor root anchor is at your own risk
+	  and under the terms of our LICENSE (see that file in the source).
+
+11 February 2011: Wouter
+	- iana portlist updated.
+	- tpkg updated with common.sh for common functionality.
+
+7 February 2011: Wouter
+	- Added regression test for addition of a .net DS to the root, and
+	  cache effects with different TTL for glue and DNSKEY.
+	- iana portlist updated.
+
+28 January 2011: Wouter
+	- Fix remove private address does not throw away entire response.
+
+24 January 2011: Wouter
+	- release 1.4.8
+
+19 January 2011: Wouter
+	- fix bug#349: no -L/usr for ldns.
+
+18 January 2011: Wouter
+	- ldns 1.6.8 tarball included.
+	- release 1.4.8rc1.
+
+17 January 2011: Wouter
+	- add get and set option for harden-below-nxdomain feature.
+	- iana portlist updated.
+
+14 January 2011: Wouter
+	- Fix so a changed NS RRset does not get moved name stuck on old
+	  server, for type NS the TTL is not increased.
+
+13 January 2011: Wouter
+	- Fix prefetch so it does not get stuck on old server for moved names.
+
+12 January 2011: Wouter
+	- iana portlist updated.
+
+11 January 2011: Wouter
+	- Fix insecure CNAME sequence marked as secure, reported by Bert
+	  Hubert.
+
+10 January 2011: Wouter
+	- faster lruhash get_mem routine.
+
+4 January 2011: Wouter
+	- bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root.
+	- iana portlist updated.
+
+23 December 2010: Wouter
+	- Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
+
+21 December 2010: Wouter
+	- algorithm compromise protection using the algorithms signalled in
+	  the DS record.  Also, trust anchors, DLV, and RFC5011 receive this,
+	  and thus, if you have multiple algorithms in your trust-anchor-file
+	  then it will now behave different than before.  Also, 5011 rollover
+	  for algorithms needs to be double-signature until the old algorithm
+	  is revoked.
+	  It is not an option, because I see no use to turn the security off.
+	- iana portlist updated.
+
+17 December 2010: Wouter
+	- squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them).
+	- fix validation in this case: CNAME to nodata for co-hosted opt-in
+	  NSEC3 insecure delegation, was bogus, fixed to be insecure.
+
+16 December 2010: Wouter
+	- Fix our 'BDS' license (typo reported by Xavier Belanger).
+
+10 December 2010: Wouter
+	- iana portlist updated.
+	- review changes for unbound-anchor.
+
+2 December 2010: Wouter
+	- feature typetransparent localzone, does not block other RR types.
+
+1 December 2010: Wouter
+	- Fix bug#338: print address when socket creation fails.
+
+30 November 2010: Wouter
+	- Fix storage of EDNS failures in the infra cache.
+	- iana portlist updated.
+
+18 November 2010: Wouter
+	- harden-below-nxdomain option, default off (because very old
+	  software may be incompatible).  We could enable it by default in
+	  the future.
+
+17 November 2010: Wouter
+	- implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.
+	- make test output nicer.
+
+15 November 2010: Wouter
+	- silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
+	- iana portlist updated.
+	- so-sndbuf option for very busy servers, a bit like so-rcvbuf.
+
+9 November 2010: Wouter
+	- unbound-anchor compiles with openssl 0.9.7.
+
+8 November 2010: Wouter
+	- release tag 1.4.7.
+	- trunk is version 1.4.8.
+	- Be lenient and accept imgw.pl malformed packet (like BIND).
+
+5 November 2010: Wouter
+	- do not synthesize a CNAME message from cache for qtype DS.
+
+4 November 2010: Wouter
+	- Use central entropy to seed threads.
+
+3 November 2010: Wouter
+	- Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
+
+2 November 2010: Wouter
+	- tag 1.4.7rc1.
+	- code review.
+
+1 November 2010: Wouter
+	- GOST code enabled by default (RFC 5933).
+
+27 October 2010: Wouter
+	- Fix uninit value in dump_infra print.
+	- Fix validation failure for parent and child on same server with an
+	  insecure childzone and a CNAME from parent to child.
+	- Configure detects libev-4.00.
+
+26 October 2010: Wouter
+	- dump_infra and flush_infra commands for unbound-control.
+	- no timeout backoff if meanwhile a query succeeded.
+	- Change of timeout code.  No more lost and backoff in blockage.
+	  At 12sec timeout (and at least 2x lost before) one probe per IP
+	  is allowed only.  At 120sec, the IP is blocked.  After 15min, a
+	  120sec entry has a single retry packet.
+
+25 October 2010: Wouter
+	- Configure errors if ldns is not found.
+
+22 October 2010: Wouter
+	- Windows 7 fix for the installer.
+
+21 October 2010: Wouter
+	- Fix bug where fallback_tcp causes wrong roundtrip and edns
+	  observation to be noted in cache.  Fix bug where EDNSprobe halted
+	  exponential backoff if EDNS status unknown.
+	- new unresponsive host method, exponentially increasing block backoff.
+	- iana portlist updated.
+
+20 October 2010: Wouter
+	- interface automatic works for some people with ip6 disabled.
+	  Therefore the error check is removed, so they can use the option.
+
+19 October 2010: Wouter
+	- Fix for request list growth, if a server has long timeout but the
+	  lost counter is low, then its effective rtt is the one without
+	  exponential backoff applied.  Because the backoff is not working.
+	  The lost counter can then increase and the server is blacklisted,
+	  or the lost counter does not increase and the server is working
+	  for some queries.
+
+18 October 2010: Wouter
+	- iana portlist updated.
+
+13 October 2010: Wouter
+	- Fix TCP so it uses a random outgoing-interface.
+	- unbound-anchor handles ADDPEND keystate.
+
+11 October 2010: Wouter
+	- Fix bug when DLV below a trust-anchor that uses NSEC3 optout where
+	  the zone has a secure delegation hosted on the same server did not
+	  verify as secure (it was insecure by mistake).
+	- iana portlist updated.
+	- ldns tarball updated (for reading cachedumps with bad RR data).
+
+1 October 2010: Wouter
+	- test for unbound-anchor. fix for reading certs.
+	- Fix alloc_reg_release for longer uptime in out of memory conditions.
+
+28 September 2010: Wouter
+	- unbound-anchor working, it creates or updates a root.key file.
+	  Use it before you start the validator (e.g. at system boot time).
+
+27 September 2010: Wouter
+	- iana portlist updated.
+
+24 September 2010: Wouter
+	- bug#329: in example.conf show correct ipv4 link-local 169.254/16.
+
+23 September 2010: Wouter
+	- unbound-anchor app, unbound requires libexpat (xml parser library).
+
+22 September 2010: Wouter
+	- compliance with draft-ietf-dnsop-default-local-zones-14, removed
+	  reverse ipv6 orchid prefix from builtin list.
+	- iana portlist updated.
+
+17 September 2010: Wouter
+	- DLV has downgrade protection again, because the RFC says so.
+	- iana portlist updated.
+
+16 September 2010: Wouter
+	- Algorithm rollover operational reality intrudes, for trust-anchor,
+	  5011-store, and DLV-anchor if one key matches it's good enough.
+	- iana portlist updated.
+	- Fix reported validation error in out of memory condition.
+
+15 September 2010: Wouter
+	- Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
+
+14 September 2010: Wouter
+	- increased mesh-max-activation from 1000 to 3000 for crazy domains
+	  like _tcp.slb.com with 262 servers.
+	- iana portlist updated.
+
+13 September 2010: Wouter
+	- bug#327: Fix for cannot access stub zones until the root is primed.
+
+9 September 2010: Wouter
+	- unresponsive servers are not completely blacklisted (because of
+	  firewalls), but also not probed all the time (because of the request
+	  list size it generates).  The probe rate is 1%.
+	- iana portlist updated.
+
+20 August 2010: Wouter
+	- openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled.
+	  iterator get_mem includes priv_get_mem.  delegpt nodup removed.
+	  listen_pushback, query_info_allocqname, write_socket, send_packet,
+	  comm_point_set_cb_arg and listen_resume removed.
+
+19 August 2010: Wouter
+	- Fix bug#321: resolution of rs.ripe.net artifacts with 0x20.
+	  Delegpt structures checked for duplicates always.
+	  No more nameserver lookups generated when depth is full anyway.
+	- example.conf notes how to do DNSSEC validation and track the root.
+	- iana portlist updated.
+
+18 August 2010: Wouter
+	- Fix bug#322: configure does not respect CFLAGS on Solaris.
+	  Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line
+	  if use sun-cc, but some systems need different flags.
+
+16 August 2010: Wouter
+	- Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP
+	  changes, uses m4_bpatsubst now.
+	- make test (or make check) should be more portable and run the unit 
+	  test and testbound scripts. (make longtest has special requirements).
+
+13 August 2010: Wouter
+	- More pleasant remote control command parsing.
+	- documentation added for return values reported by doxygen 1.7.1.
+	- iana portlist updated.
+
+9 August 2010: Wouter
+	- Fix name of rrset printed that failed validation.
+
+5 August 2010: Wouter
+	- Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
+
+4 August 2010: Wouter
+	- Fix validation in case a trust anchor enters into a zone with
+	  unsupported algorithms.
+
+3 August 2010: Wouter
+	- updated ldns tarball with bugfixes.
+	- release tag 1.4.6.
+	- trunk becomes 1.4.7 develop.
+	- iana portlist updated.
+
+22 July 2010: Wouter
+	- more error details on failed remote control connection.
+
+15 July 2010: Wouter
+	- rlimit adjustments for select and ulimit can happen at the same time.
+
+14 July 2010: Wouter
+	- Donation text added to README.
+	- Fix integer underflow in prefetch ttl creation from cache.  This
+	  fixes a potential negative prefetch ttl.
+
+12 July 2010: Wouter
+	- Changed the defaults for num-queries-per-thread/outgoing-range.
+	  For builtin-select: 512/960, for libevent 1024/4096 and for
+	  windows 24/48 (because of win api).  This makes the ratio this way
+	  to improve resilience under heavy load.  For high performance, use
+	  libevent and possibly higher numbers.
+
+10 July 2010: Wouter
+	- GOST enabled if SSL is recent and ldns has GOST enabled too.
+	- ldns tarball updated.
+
+9 July 2010: Wouter
+	- iana portlist updated.
+	- Fix validation of qtype DNSKEY when a key-cache entry exists but
+	  no rr-cache entry is used (it expired or prefetch), it then goes
+	  back up to the DS or trust-anchor to validate the DNSKEY.
+
+7 July 2010: Wouter
+	- Neat function prototypes, unshadowed local declarations.
+
+6 July 2010: Wouter
+	- failure to chown the pidfile is not fatal any more.
+	- testbound uses UTC timezone.
+	- ldns tarball updated (ports and works on Minix 3.1.7).  On Minix, add
+	  /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake.
+
+5 July 2010: Wouter
+	- log if a server is skipped because it is on the donotquery list,
+	  at verbosity 4, to enable diagnosis why no queries to 127.0.0.1.
+	- added feature to print configure date, target and options with -h.
+	- added feature to print event backend system details with -h.
+	- wdiff is not actually required by make test, updated requirements.
+
+1 July 2010: Wouter
+	- Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex
+	  must be signed with all algorithms from the DS rrset at the parent.
+	  This is now checked and becomes bogus if not.
+
+28 June 2010: Wouter
+	- Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps
+	  in overload situations to be about 5 qps for the class of shortly
+	  serviced queries.
+	  The capacity of the resolver is then about (numqueriesperthread / 2)
+	  / (average time for such long queries) qps for long queries.
+	  And about (numqueriesperthread / 2)/(jostletimeout in whole seconds)
+	  qps for short queries, per thread.
+	- Fix the max number of reply-address count to be applied for duplicate
+	  queries, and not for new query list entries.  This raises the memory
+	  usage to a max of (16+1)*numqueriesperthread reply addresses.
+
+25 June 2010: Wouter
+	- Fix handling of corner case reply from lame server, follows rfc2308.
+	  It could lead to a nodata reply getting into the cache if the search
+	  for a non-lame server turned up other misconfigured servers.
+	- unbound.h has extern "C" statement for easier include in c++.
+
+23 June 2010: Wouter
+	- iana portlist updated.
+	- makedist upgraded cross compile openssl option, like this: 
+	  ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost
+
+22 June 2010: Wouter
+	- Unbound reports libev or libevent correctly in logs in verbose mode.
+	- Fix to unload gost dynamic library module for leak testing.
+
+18 June 2010: Wouter
+	- iana portlist updated.
+
+17 June 2010: Wouter
+	- Add AAAA to root hints for I.ROOT-SERVERS.NET.
+
+16 June 2010: Wouter
+	- Fix assertion failure reported by Kai Storbeck from XS4ALL, the
+	  assertion was wrong.
+	- updated ldns tarball.
+
+15 June 2010: Wouter
+	- tag 1.4.5 created.
+	- trunk contains 1.4.6 in development.
+	- Fix TCPreply on systems with no writev, if just 1 byte could be sent.
+	- Fix to use one pointer less for iterator query state store_parent_NS.
+	- makedist crosscompile to windows uses builtin ldns not host ldns.
+	- Max referral count from 30 to 130, because 128 one character domains
+	  is valid DNS.
+	- added documentation for the histogram printout to syslog.
+
 11 June 2010: Wouter
 	- When retry to parent the retrycount is not wiped, so failed 
 	  nameservers are not tried again.

doc/README

@@ -11,16 +11,14 @@ This software is under BSD license, see LICENSE for details.
 
 * Uses the following libraries; 
   * ldns	http://www.nlnetlabs.nl/ldns/			(BSD license)
-    (required) can use tarball from source directory.
+    (required) can use ldns build directory directly with --with-ldns=path.
   * libevent	http://www.monkey.org/~provos/libevent/		(BSD license)
     (optional) can use builtin alternative instead.
 
 * Make and install: ./configure; make; make install
   * Use GNU make; default on linux, often called 'gmake' on BSD and Solaris.
   * --with-ldns=/path/to/ldns
-  	If ldns is not detected on the system, a prepackaged tarball
-	of the ldns library is used to compile and statically link against.
-	If detected on the system, it will dynamically link against it.
+	It will dynamically link against it.
   * --with-libevent=/path/to/libevent
   	Can be set to either the system install or the build directory.
 	--with-libevent=no (default) gives a builtin alternative 
@@ -28,6 +26,8 @@ This software is under BSD license, see LICENSE for details.
 	of outgoing ports. This improves randomization and spoof 
 	resistance. For the default of 16 ports the builtin alternative 
 	works well and is a little faster.
+  * --with-libexpat=/path/to/libexpat
+  	Can be set to the install directory of libexpat.
   * --without-pthreads 
 	This disables pthreads. Without this option the pthreads library 
 	is detected automatically. Use this option to disable threading
@@ -59,6 +59,13 @@ This software is under BSD license, see LICENSE for details.
   * --with-chroot-dir=path
   	Set default chroot directory,
 	the default is /usr/local/etc/unbound.
+  * --with-rootkey-file=path
+  	Set the default root.key path.  This file is read and written.
+	the default is /usr/local/etc/unbound/root.key
+  * --with-rootcert-file=path
+  	Set the default root update certificate path.  A builtin certificate
+	is used if this file is empty or does not exist.
+	the default is /usr/local/etc/unbound/icannbundle.pem
   * --with-username=user
   	Set default user name to change to,
 	the default is the "unbound" user.
@@ -69,11 +76,10 @@ This software is under BSD license, see LICENSE for details.
   	Compile the python module that processes responses in the server.
   * --disable-sha2
   	Disable support for RSASHA256 and RSASHA512 crypto.
-  * --enable-gost
-  	Enable draft support for GOST crypto.
+  * --disable-gost
+  	Disable support for GOST crypto, RFC 5933.
 
-* 'make test' attempts to run a series of tests, depending on the support
-  programs that are installed.
+* 'make test' runs a series of self checks.
 
 Known issues
 ------------
@@ -97,6 +103,7 @@ o The warning 'openssl has no entropy, seeding with time', with chroot
 o On Solaris 5.10 some libtool packages from repositories do not work with
   gcc, showing errors gcc: unrecognized option `-KPIC'
   To solve this do ./configure libtool=./libtool [your options...].
+  On Solaris you may pass CFLAGS="-xO4 -xtarget=generic" if you use sun-cc.
 o If unbound-control (or munin graphs) do not work, this can often be because
   the unbound-control-setup script creates the keys with restricted 
   permissions, and the files need to be made readable or ownered by both the
@@ -115,4 +122,30 @@ o Other code origins are from the NSD (NLnet Labs) and LDNS (NLnet Labs)
   projects. Such as buffer, region-allocator and red-black tree code.
 o See Credits file for contributors.
 
+
+Your Support
+------------
+NLnet Labs offers all of its software products as open source, most are
+published under a BSD license. You can download them, not only from the
+NLnet Labs website but also through the various OS distributions for
+which NSD, ldns, and Unbound are packaged. We therefore have little idea
+who uses our software in production environments and have no direct ties
+with 'our customers'.
+
+Therefore, we ask you to contact us at users@NLnetLabs.nl and tell us
+whether you use one of our products in your production environment,
+what that environment looks like, and maybe even share some praise.
+We would like to refer to the fact that your organization is using our
+products. We will only do that if you explicitly allow us. In all other
+cases we will keep the information you share with us to ourselves.
+
+In addition to the moral support you can also support us
+financially. NLnet Labs is a recognized not-for-profit charity foundation
+that is chartered to develop open-source software and open-standards
+for the Internet. If you use our software to satisfaction please express
+that by giving us a donation. For small donations PayPal can be used. For
+larger and regular donations please contact us at users@NLnetLabs.nl. Also
+see http://www.nlnetlabs.nl/labs/contributors/.
+
+
 * mailto:unbound-bugs@nlnetlabs.nl

doc/README.tests

@@ -1,22 +1,20 @@
 README unbound tests
 
-There is a test setup for unbound. Use
+For a quick test that runs unit tests and state machine tests, use
 	make test
-To make and run the tests. The results are summarized at the end.
+
+There is a long test setup for unbound that needs tools installed. Use
+	make longtest
+To make and run the long tests. The results are summarized at the end.
 
 You need to have the following programs installed and in your PATH.
 * dig - from the bind-tools package. Used to send DNS queries.
-* wdiff - used for word-by-word comparisons.
 * splint (optional) - for lint test
 * doxygen (optional) - for doc completeness test
-* ldns-testns (optional) - from ldns examples. Used as DNS auth server.
+* ldns-testns - from ldns examples. Used as DNS auth server.
 * xxd and nc (optional) - for (malformed) packet transmission.
 The optional programs are detected and can be omitted.
 
-Without any support programs, unittest and testbound can still be used.
-	(cd testdata; ../testcode/mini_tpkg.sh exe 02-unittest.tpkg)
-	(cd testdata; ../testcode/mini_tpkg.sh exe 03-testbound.tpkg)
-
 testdata/ contains the data for tests. 
 testcode/ contains scripts and c code for the tests.
 

doc/control_proto_spec.txt

@@ -1,16 +1,21 @@
 
 Specification for the unbound-control protocol.
 
-Server listens on 953 TCP (localhost by default). Client connects,
+Server listens on 8953 TCP (localhost by default). Client connects,
 SSLv3 or TLSv1 connection setup (server selfsigned certificate, 
 client has cert signed by server certificate).
 
+Port 8953 is registered with IANA as:
+ub-dns-control  8953/tcp    unbound dns nameserver control
+# Wouter Wijngaards <wouter&nlnetlabs.nl> 10 May 2011
+On may 11 2011, ticket [IANA #442315].
+
 Query and Response
 ------------------
 Client sends 
-	UBCT [commandline] \n
-	fixed string UBCT, then an ascii text line, with a command, 
-	some whitespace allowed. Line ends with '\n'.
+	UBCT[version] [commandline] \n
+	fixed string UBCT1 (for version 1), then an ascii text line,
+	with a command, some whitespace allowed. Line ends with '\n'.
 
 Server executes command. And sends reply in ascii text over channel, 
 closes the channel when done.

doc/example.conf.in

@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page.
+# See unbound.conf(5) man page, version @version@.
 #
 # this is a comment.
 
@@ -54,8 +54,9 @@ server:
 	# outgoing-interface: 2001:DB8::6
 
 	# number of ports to allocate per thread, determines the size of the
-	# port range that can be open simultaneously. 
-	# outgoing-range: 256
+	# port range that can be open simultaneously.  About double the
+	# num-queries-per-thread, or, use as many as the OS will allow you.
+	# outgoing-range: 4096
 
 	# permit unbound to use this port number or port range for
 	# making outgoing queries, using an outgoing interface.
@@ -78,6 +79,10 @@ server:
 	# 0 is system default.  Use 4m to catch query spikes for busy servers.
 	# so-rcvbuf: 0
 
+	# buffer size for UDP port 53 outgoing (SO_SNDBUF socket option).
+	# 0 is system default.  Use 4m to handle spikes on very busy servers.
+	# so-sndbuf: 0
+
 	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
 	# is set with msg-buffer-size). 1480 can solve fragmentation (timeouts).
 	# edns-buffer-size: 4096
@@ -118,24 +123,18 @@ server:
 	# cache. Items are not cached for longer. In seconds.
 	# cache-max-ttl: 86400
 
-	# the time to live (TTL) value for cached roundtrip times and
+	# the time to live (TTL) value for cached roundtrip times, lameness and
 	# EDNS version information for hosts. In seconds.
 	# infra-host-ttl: 900
 
-	# the time to live (TTL) value for cached lame delegations. In sec.
-	# infra-lame-ttl: 900
-
 	# the number of slabs to use for the Infrastructure cache.
 	# the number of slabs must be a power of 2.
 	# more slabs reduce lock contention, but fragment memory usage.
 	# infra-cache-slabs: 4
 
-	# the maximum number of hosts that are cached (roundtrip times, EDNS).
+	# the maximum number of hosts that are cached (roundtrip, EDNS, lame).
 	# infra-cache-numhosts: 10000
 
-	# the maximum size of the lame zones cached per host. in bytes.
-	# infra-cache-lame-size: 10k
-
 	# Enable IPv4, "yes" or "no".
 	# do-ip4: yes
 
@@ -148,6 +147,10 @@ server:
 	# Enable TCP, "yes" or "no".
 	# do-tcp: yes
 
+	# upstream connections use TCP only (and no UDP), "yes" or "no"
+	# useful for tunneling scenarios, default no.
+	# tcp-upstream: no
+
 	# Detach from the terminal, run in background, "yes" or "no".
 	# do-daemonize: yes
 
@@ -207,6 +210,9 @@ server:
 
 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	# log-time-ascii: no
+	
+	# print one line with time, IP, name, type, class for every query.
+	# log-queries: no
 
 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"
@@ -252,6 +258,9 @@ server:
 	# Default on, which insists on dnssec data for trust-anchored zones.
 	# harden-dnssec-stripped: yes
 
+	# Harden against queries that fall under dnssec-signed nxdomain names.
+	# harden-below-nxdomain: no
+
         # Harden the referral path by performing additional queries for
 	# infrastructure data.  Validates the replies (if possible).
 	# Default off, because the lookups burden the server.  Experimental 
@@ -270,7 +279,7 @@ server:
 	# private-address: 10.0.0.0/8
 	# private-address: 172.16.0.0/12
 	# private-address: 192.168.0.0/16
-	# private-address: 192.254.0.0/16
+	# private-address: 169.254.0.0/16
 	# private-address: fd00::/8
 	# private-address: fe80::/10
 
@@ -304,6 +313,16 @@ server:
 	# separated by spaces. "iterator" or "validator iterator"
 	# module-config: "validator iterator"
 
+	# File with trusted keys, kept uptodate using RFC5011 probes,
+	# initial file like trust-anchor-file, then it stores metadata.
+	# Use several entries, one per domain name, to track multiple zones.
+	#
+	# If you want to perform DNSSEC validation, run unbound-anchor before
+	# you start unbound (i.e. in the system boot scripts).  And enable:
+	# Please note usage of unbound-anchor root anchor is at your own risk
+	# and under the terms of our LICENSE (see that file in the source).
+	# auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
+
 	# File with DLV trusted keys. Same format as trust-anchor-file.
 	# There can be only one DLV configured, it is trusted from root down.
 	# Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
@@ -312,15 +331,12 @@ server:
 	# File with trusted keys for validation. Specify more than one file
 	# with several entries, one file per entry.
 	# Zone file format, with DS and DNSKEY entries.
+	# Note this gets out of date, use auto-trust-anchor-file please.
 	# trust-anchor-file: ""
 	
-	# File with trusted keys, kept uptodate using RFC5011 probes,
-	# initial file like trust-anchor-file, then it stores metadata.
-	# Use several entries, one per domain name, to track multiple zones.
-	# auto-trust-anchor-file: ""
-
 	# Trusted key for validation. DS or DNSKEY. specify the RR on a
 	# single line, surrounded by "". TTL is ignored. class is IN default.
+	# Note this gets out of date, use auto-trust-anchor-file please.
 	# (These examples are from August 2007 and may not be valid anymore).
 	# trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ=="
 	# trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"
@@ -329,6 +345,7 @@ server:
 	# with several entries, one file per entry. Like trust-anchor-file
 	# but has a different file format. Format is BIND-9 style format, 
 	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
+	# you need external update procedures to track changes in keys.
 	# trusted-keys-file: ""
 
 	# Ignore chain of trust. Domain is treated as insecure.
@@ -336,7 +353,7 @@ server:
 
 	# Override the date for validation with a specific fixed date.
 	# Do not set this unless you are debugging signature inception
-	# and expiration. "" or "0" turns the feature off. 
+	# and expiration. "" or "0" turns the feature off. -1 ignores date.
 	# val-override-date: ""
 
 	# The time to live for bogus data, rrsets and messages. This avoids
@@ -362,6 +379,11 @@ server:
 	# replies if the message is found secure. The default is off.
 	# val-permissive-mode: no
 
+	# Ignore the CD flag in incoming queries and refuse them bogus data.
+	# Enable it if the only clients of unbound are legacy servers (w2008)
+	# that set CD but cannot validate themselves.
+	# ignore-cd-flag: no
+
 	# Have the validator log failed validations for your diagnosis.
 	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
 	# val-log-level: 0
@@ -404,6 +426,7 @@ server:
 	# o transparent gives local data, but resolves normally for other names
 	# o redirect serves the zone data for any subdomain in the zone.
 	# o nodefault can be used to normally resolve AS112 zones.
+	# o typetransparent resolves normally for other types and other names
 	#
 	# defaults are localhost address, reverse for 127.0.0.1 and ::1
 	# and nxdomain for AS112 zones. If you configure one of these zones
@@ -430,6 +453,17 @@ server:
 	# you need to do the reverse notation yourself.
 	# local-data-ptr: "192.0.2.3 www.example.com"
 
+	# service clients over SSL (on the TCP sockets), with plain DNS inside
+	# the SSL stream.  Give the certificate to use and private key.
+	# default is "" (disabled).  requires restart to take effect.
+	# ssl-service-key: "path/to/privatekeyfile.key"
+	# ssl-service-pem: "path/to/publiccertfile.pem"
+	# ssl-port: 443
+
+	# request upstream over SSL (with plain DNS inside the SSL stream).
+	# Default is no.  Can be turned on and off with unbound-control.
+	# ssl-upstream: no
+
 # Python config section. To enable:
 # o use --with-pythonmodule to configure before compiling.
 # o list python in the module-config string (above) to enable.
@@ -450,7 +484,7 @@ remote-control:
 	# control-interface: ::1
 
 	# port number for remote control operations.
-	# control-port: 953
+	# control-port: 8953
 
 	# unbound server key file.
 	# server-key-file: "@UNBOUND_RUN_DIR@/unbound_server.key"

doc/unbound-anchor.8.in

@@ -0,0 +1,174 @@
+.TH "unbound-anchor" "8" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound-anchor.8 -- unbound anchor maintenance utility manual
+.\"
+.\" Copyright (c) 2008, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.LP
+.B unbound\-anchor
+\- Unbound anchor utility.
+.SH "SYNOPSIS"
+.B unbound\-anchor
+.RB [ opts ]
+.SH "DESCRIPTION"
+.B Unbound\-anchor
+performs setup or update of the root trust anchor for DNSSEC validation.
+It can be run (as root) from the commandline, or run as part of startup
+scripts.  Before you start the \fIunbound\fR(8) DNS server.
+.P
+Suggested usage:
+.P
+.nf
+	# in the init scripts.
+	# provide or update the root anchor (if necessary)
+	unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
+	# Please note usage of this root anchor is at your own risk
+	# and under the terms of our LICENSE (see source).
+	#
+	# start validating resolver
+	# the unbound.conf contains:
+	#   auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
+	unbound -c unbound.conf
+.fi
+.P
+This tool provides builtin default contents for the root anchor and root
+update certificate files.
+.P
+It tests if the root anchor file works, and if not, and an update is possible,
+attempts to update the root anchor using the root update certificate.
+It performs a https fetch of root-anchors.xml and checks the results, if
+all checks are successful, it updates the root anchor file.  Otherwise
+the root anchor file is unchanged.  It performs RFC5011 tracking if the
+DNSSEC information available via the DNS makes that possible.
+.P
+If does not perform an update if the certificate is expired, if the network
+is down or other errors occur.
+.P
+The available options are:
+.TP
+.B \-a \fIfile
+The root anchor key file, that is read in and written out.
+Default is @UNBOUND_ROOTKEY_FILE@.
+If the file does not exist, or is empty, a builtin root key is written to it.
+.TP
+.B \-c \fIfile
+The root update certificate file, that is read in.
+Default is @UNBOUND_ROOTCERT_FILE@.
+If the file does not exist, or is empty, a builtin certificate is used.
+.TP
+.B \-l
+List the builtin root key and builtin root update certificate on stdout.
+.TP
+.B \-u \fIname
+The server name, it connects to https://name.  Specify without https:// prefix.
+The default is "data.iana.org".  It connects to the port specified with \-P.
+You can pass an IPv4 addres or IPv6 address (no brackets) if you want.
+.TP
+.B \-x \fIpath
+The pathname to the root\-anchors.xml file on the server. (forms URL with \-u).
+The default is /root\-anchors/root\-anchors.xml.
+.TP
+.B \-s \fIpath
+The pathname to the root\-anchors.p7s file on the server. (forms URL with \-u).
+The default is /root\-anchors/root\-anchors.p7s.  This file has to be a PKCS7
+signature over the xml file, using the pem file (\-c) as trust anchor.
+.TP
+.B \-4
+Use IPv4 for domain resolution and contacting the server on https.  Default is
+to use IPv4 and IPv6 where appropriate.
+.TP
+.B \-6
+Use IPv6 for domain resolution and contacting the server on https.  Default is
+to use IPv4 and IPv6 where appropriate.
+.TP
+.B \-f \fIresolv.conf
+Use the given resolv.conf file.  Not enabled by default, but you could try to
+pass /etc/resolv.conf on some systems.  It contains the IP addresses of the
+recursive nameservers to use.  However, since this tool could be used to
+bootstrap that very recursive nameserver, it would not be useful (since
+that server is not up yet, since we are bootstrapping it).  It could be
+useful in a situation where you know an upstream cache is deployed (and
+running) and in captive portal situations.
+.TP
+.B \-r \fIroot.hints
+Use the given root.hints file (same syntax as the BIND and Unbound root hints
+file) to bootstrap domain resolution.  By default a list of builtin root
+hints is used.  Unbound\-anchor goes to the network itself for these roots,
+to resolve the server (\-u option) and to check the root DNSKEY records.
+It does so, because the tool when used for bootstrapping the recursive
+resolver, cannot use that recursive resolver itself because it is bootstrapping
+that server.
+.TP
+.B \-v
+More verbose. Once prints informational messages, multiple times may enable
+large debug amounts (such as full certificates or byte\-dumps of downloaded
+files).  By default it prints almost nothing.  It also prints nothing on
+errors by default; in that case the original root anchor file is simply
+left undisturbed, so that a recursive server can start right after it.
+.TP
+.B \-C \fIunbound.conf
+Debug option to read unbound.conf into the resolver process used.
+.TP
+.B \-P \fIport
+Set the port number to use for the https connection.  The default is 443.
+.TP
+.B \-F
+Debug option to force update of the root anchor through downloading the xml
+file and verifying it with the certificate.  By default it first tries to
+update by contacting the DNS, which uses much less bandwidth, is much
+faster (200 msec not 2 sec), and is nicer to the deployed infrastructure.
+With this option, it still attempts to do so (and may verbosely tell you),
+but then ignores the result and goes on to use the xml fallback method.
+.TP
+.B \-h
+Show the version and commandline option help.
+.TP
+.B \-v
+More verbose.  Prints output detailing what happens.
+.SH "EXIT CODE"
+This tool exits with value 1 if the root anchor was updated using the
+certificate or if the builtin root-anchor was used.  It exits with code
+0 if no update was necessary, if the update was possible with RFC5011
+tracking, or if an error occurred.
+.P
+You can check the exit value in this manner:
+.nf
+	unbound-anchor -a "root.key" || logger "Please check root.key"
+.fi
+Or something more suitable for your operational environment.
+.SH "TRUST"
+The root keys and update certificate included in this tool
+are provided for convenience and under the terms of our
+license (see the LICENSE file in the source distribution or
+http://unbound.nlnetlabs.nl/svn/trunk/LICENSE) and might be stale or
+not suitable to your purpose.
+.P
+By running "unbound\-anchor \-l" the  keys and certificate that are
+configured in the code are printed for your convenience.
+.P
+The build\-in configuration can be overridden by providing a root\-cert
+file and a rootkey file.
+.SH "FILES"
+.TP
+.I @UNBOUND_ROOTKEY_FILE@
+The root anchor file, updated with 5011 tracking, and read and written to.
+The file is created if it does not exist.
+.TP
+.I @UNBOUND_ROOTCERT_FILE@
+The trusted self\-signed certificate that is used to verify the downloaded
+DNSSEC root trust anchor.  You can update it by fetching it from
+https://data.iana.org/root\-anchors/icannbundle.pem (and validate it).
+If the file does not exist or is empty, a builtin version is used.
+.TP
+.I https://data.iana.org/root\-anchors/root\-anchors.xml
+Source for the root key information.
+.TP
+.I https://data.iana.org/root\-anchors/root\-anchors.p7s
+Signature on the root key information.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5), 
+\fIunbound\fR(8).

doc/unbound-control.8.in

@@ -142,18 +142,40 @@ Show what is worked on.  Prints all queries that the server is currently
 working on.  Prints the time that users have been waiting.  For internal
 requests, no time is printed.  And then prints out the module status.
 .TP
+.B flush_infra \fIall|IP
+If all then entire infra cache is emptied.  If a specific IP address, the
+entry for that address is removed from the cache.  It contains EDNS, ping
+and lameness data.
+.TP
+.B dump_infra
+Show the contents of the infra cache.
+.TP
 .B set_option \fIopt: val
-Set the option to the given value without a reload.  The cache is therefore
-not flushed.  The option must end with a ':' and whitespace must be between the
-option and the value.  Some values may not have an effect if set this way,
-the new values are not written to the config file, not all options are supported.
+Set the option to the given value without a reload.  The cache is
+therefore not flushed.  The option must end with a ':' and whitespace
+must be between the option and the value.  Some values may not have an
+effect if set this way, the new values are not written to the config file,
+not all options are supported.  This is different from the set_option call
+in libunbound, where all values work because unbound has not been inited.
+.IP
+The values that work are: statistics\-interval, statistics\-cumulative,
+do\-not\-query\-localhost, harden\-short\-bufsize, harden\-large\-queries,
+harden\-glue, harden\-dnssec\-stripped, harden\-below\-nxdomain,
+harden\-referral\-path, prefetch, prefetch\-key, log\-queries,
+hide\-identity, hide\-version, identity, version, val\-log\-level,
+val\-log\-squelch, ignore\-cd\-flag, add\-holddown, del\-holddown,
+keep\-missing, tcp\-upstream, ssl\-upstream.
 .TP
 .B get_option \fIopt
 Get the value of the option.  Give the option name without a trailing ':'.
-The value is printed.  If the value is "", nothing is printed and the
-connection closes.  On error 'error ...' is printed (it gives a syntax
-error on unknown option).  For some options a list of values, one on
-each line, is printed.  Not all options are supported.
+The value is printed.  If the value is "", nothing is printed
+and the connection closes.  On error 'error ...' is printed (it gives
+a syntax error on unknown option).  For some options a list of values,
+one on each line, is printed.  The options are shown from the config file
+as modified with set_option.  For some options an override may have been
+taken that does not show up with this command, not results from e.g. the
+verbosity and forward control commands.  Not all options work, see list_stubs,
+list_forwards, list_local_zones and list_local_data for those.
 .TP
 .B list_stubs
 List the stub zones in use.  These are printed one by one to the output.

doc/unbound.conf.5.in

@@ -92,7 +92,10 @@ The verbosity can also be increased from the commandline, see \fIunbound\fR(8).
 .TP
 .B statistics\-interval: \fI<seconds>
 The number of seconds between printing statistics to the log for every thread.
-Disable with value 0 or "". Default is disabled. 
+Disable with value 0 or "". Default is disabled.  The histogram statistics
+are only printed if replies were sent during the statistics interval, 
+requestlist statistics are printed for every interval (but can be 0).
+This is because the median calculation requires data to be present.
 .TP
 .B statistics\-cumulative: \fI<yes or no>
 If enabled, statistics are cumulative since starting unbound, without clearing
@@ -121,9 +124,8 @@ interface and port number), if not specified the default port (from
 .TP
 .B interface\-automatic: \fI<yes or no>
 Detect source interface on UDP queries and copy them to replies.  This 
-feature is experimental, and needs support in your OS for IPv6 
-(and its socket options) and IPv4 (and have source\-interface socket options). 
-Default value is no.
+feature is experimental, and needs support in your OS for particular socket
+options.  Default value is no.
 .TP
 .B outgoing\-interface: \fI<ip address>
 Interface to use to connect to the network. This interface is used to send
@@ -138,8 +140,9 @@ sent via a random outgoing interface to counter spoofing.
 .TP
 .B outgoing\-range: \fI<number>
 Number of ports to open. This number of file descriptors can be opened per 
-thread. Must be at least 1. Default is 256. Larger numbers need extra 
-resources from the operating system.
+thread. Must be at least 1. Default depends on compile options. Larger 
+numbers need extra resources from the operating system.  For performance a
+a very large value is best, use libevent to make this possible.
 .TP
 .B outgoing\-port\-permit: \fI<port number or range>
 Permit unbound to open this port or range of ports for use to send queries.
@@ -202,7 +205,7 @@ The number of queries that every thread will service simultaneously.
 If more queries arrive that need servicing, and no queries can be jostled out
 (see \fIjostle\-timeout\fR), then the queries are dropped. This forces
 the client to resend after a timeout; allowing the server time to work on
-the existing queries. Default 1024.
+the existing queries. Default depends on compile options, 512 or 1024.
 .TP
 .B jostle\-timeout: \fI<msec>
 Timeout used when the server is very busy.  Set to a value that usually
@@ -211,6 +214,11 @@ arrive, then 50% of the queries are allowed to run to completion, and
 the other 50% are replaced with the new incoming query if they have already 
 spent more than their allowed time.  This protects against denial of 
 service by slow queries or high query rates.  Default 200 milliseconds.
+The effect is that the qps for long-lasting queries is about 
+(numqueriesperthread / 2) / (average time for such long queries) qps.
+The qps for short queries can be about (numqueriesperthread / 2)
+/ (jostletimeout in whole seconds) qps per thread, about (1024/2)*5 = 2560
+qps by default.
 .TP
 .B so\-rcvbuf: \fI<number>
 If not 0, then set the SO_RCVBUF socket option to get more buffer
@@ -223,6 +231,17 @@ net.core.rmem_max.  On BSD change kern.ipc.maxsockbuf in /etc/sysctl.conf.
 On OpenBSD change header and recompile kernel. On Solaris ndd \-set
 /dev/udp udp_max_buf 8388608.
 .TP
+.B so\-sndbuf: \fI<number>
+If not 0, then set the SO_SNDBUF socket option to get more buffer space on
+UDP port 53 outgoing queries.  This for very busy servers handles spikes
+in answer traffic, otherwise 'send: resource temporarily unavailable'
+can get logged, the buffer overrun is also visible by netstat \-su.
+Default is 0 (use system value).  Specify the number of bytes to ask
+for, try "4m" on a very busy server.  The OS caps it at a maximum, on
+linux unbound needs root permission to bypass the limit, or the admin
+can use sysctl net.core.wmem_max.  On BSD, Solaris changes are similar
+to so\-rcvbuf.
+.TP
 .B rrset\-cache\-size: \fI<number>
 Number of bytes size of the RRset cache. Default is 4 megabytes.
 A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
@@ -250,10 +269,7 @@ the data in the cache does not match up with the actual data any more.
 .TP
 .B infra\-host\-ttl: \fI<seconds>
 Time to live for entries in the host cache. The host cache contains 
-roundtrip timing and EDNS support information. Default is 900.
-.TP
-.B infra\-lame\-ttl: \fI<seconds>
-The time to live when a delegation is discovered to be lame. Default is 900.
+roundtrip timing, lameness and EDNS support information. Default is 900.
 .TP
 .B infra\-cache\-slabs: \fI<number>
 Number of slabs in the infrastructure cache. Slabs reduce lock contention 
@@ -262,11 +278,6 @@ by threads. Must be set to a power of 2.
 .B infra\-cache\-numhosts: \fI<number>
 Number of hosts for which information is cached. Default is 10000.
 .TP
-.B infra\-cache\-lame\-size: \fI<number>
-Number of bytes that the lameness cache per host is allowed to use. Default
-is 10 kb, which gives maximum storage for a couple score zones, depending on 
-the lame zone name lengths.
-.TP
 .B do\-ip4: \fI<yes or no>
 Enable or disable whether ip4 queries are answered or issued. Default is yes.
 .TP
@@ -281,6 +292,33 @@ Enable or disable whether UDP queries are answered or issued. Default is yes.
 .B do\-tcp: \fI<yes or no>
 Enable or disable whether TCP queries are answered or issued. Default is yes.
 .TP
+.B tcp\-upstream: \fI<yes or no>
+Enable or disable whether the upstream queries use TCP only for transport.
+Default is no.  Useful in tunneling scenarios.
+.TP
+.B ssl\-upstream: \fI<yes or no>
+Enabled or disable whether the upstream queries use SSL only for transport.
+Default is no.  Useful in tunneling scenarios.  The SSL contains plain DNS in
+TCP wireformat.  The other server must support this (see \fBssl\-service\-key\fR).
+.TP
+.B ssl\-service-key: \fI<file>
+If enabled, the server provider SSL service on its TCP sockets.  The clients
+have to use ssl\-upstream: yes.  The file is the private key for the TLS
+session.  The public certificate is in the ssl\-service\-pem file.  Default
+is "", turned off.  Requires a restart (a reload is not enough) if changed,
+because the private key is read while root permissions are held and before
+chroot (if any).  Normal DNS TCP service is not provided and gives errors,
+this service is best run with a different \fBport:\fR config or \fI@port\fR
+suffixes in the \fBinterface\fR config.
+.TP
+.B ssl\-service\-pem: \fI<file>
+The public key certificate pem file for the ssl service.  Default is "",
+turned off.
+.TP
+.B ssl\-port: \fI<number>
+The port number on which to provide TCP SSL service, default 443, only
+interfaces configured with that port number as @number get the SSL service.
+.TP
 .B do\-daemonize: \fI<yes or no>
 Enable or disable whether the unbound server forks into the background as
 a daemon. Default is yes.
@@ -376,6 +414,12 @@ Sets logfile lines to use a timestamp in UTC ascii. Default is no, which
 prints the seconds since 1970 in brackets. No effect if using syslog, in
 that case syslog formats the timestamp printed into the log files.
 .TP
+.B log\-queries: \fI<yes or no>
+Prints one line per query to the log, with the log timestamp and IP address,
+name, type and class.  Default is no.  Note that it takes time to print these
+lines which makes the server (significantly) slower.  Odd (nonprintable)
+characters in names are printed as '?'.
+.TP
 .B pidfile: \fI<filename>
 The process id is written to the file. Default is "@UNBOUND_PIDFILE@". 
 So,
@@ -447,6 +491,15 @@ removes DNSSEC data from packets, or a zone changes from signed to
 unsigned to badly signed often. If turned off you run the risk of a 
 downgrade attack that disables security for a zone. Default is on.
 .TP
+.B harden\-below\-nxdomain: \fI<yes or no>
+From draft-vixie-dnsext-resimprove, returns nxdomain to queries for a name
+below another name that is already known to be nxdomain.  DNSSEC mandates
+noerror for empty nonterminals, hence this is possible.  Very old software
+might return nxdomain for empty nonterminals (that usually happen for reverse
+IP address lookups), and thus may be incompatible with this.  To try to avoid
+this only DNSSEC-secure nxdomains are used, because the old software does not
+have DNSSEC.  Default is off.
+.TP
 .B harden\-referral\-path: \fI<yes or no>
 Harden the referral path by performing additional queries for
 infrastructure data.  Validates the replies if trust anchors are configured
@@ -479,7 +532,7 @@ that you configured is allowed to, and you can specify additional
 names using \fBprivate\-domain\fR.  No private addresses are enabled
 by default.  We consider to enable this for the RFC1918 private IP
 address space by default in later releases. That would enable private 
-addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 192.254.0.0/16 
+addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 
 fd00::/8 and fe80::/10, since the RFC standards say these addresses 
 should not be visible on the public internet.  Turning on 127.0.0.0/8 
 would hinder many spamblocklists as they use that.
@@ -580,7 +633,8 @@ externally can create validation failures for that internal domain.
 Default is "" or "0", which disables this debugging feature. If enabled by
 giving a RRSIG style date, that date is used for verifying RRSIG inception
 and expiration dates, instead of the current date. Do not set this unless 
-you are debugging signature inception and expiration.
+you are debugging signature inception and expiration. The value \-1 ignores
+the date altogether, useful for some special applications.
 .TP
 .B val\-sig\-skew\-min: \fI<seconds>
 Minimum number of seconds of clock skew to apply to validated signatures.
@@ -628,6 +682,14 @@ receives the bogus data. For messages that are found to be secure the AD bit
 is set in replies. Also logging is performed as for full validation.
 The default value is "no". 
 .TP
+.B ignore\-cd\-flag: \fI<yes or no>
+Instruct unbound to ignore the CD flag from clients and refuse to
+return bogus answers to them.  Thus, the CD (Checking Disabled) flag
+does not disable checking any more.  This is useful if legacy (w2008)
+servers that set the CD flag but cannot validate DNSSEC themselves are
+the clients, and then unbound provides them with DNSSEC protection.
+The default value is "no".
+.TP
 .B val\-nsec3\-keysize\-iterations: \fI<"list of values">
 List of keysize and iteration count values, separated by spaces, surrounded
 by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
@@ -673,11 +735,12 @@ A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
 or gigabytes (1024*1024 bytes in a megabyte).
 .TP
 .B local\-zone: \fI<zone> <type>
-Configure a local zone. The type determines the answer to give if there is
-no match from local\-data. The types are deny, refuse, static, transparent, 
-redirect, nodefault, and are explained below. After that the default settings
-are listed. Use local\-data: to enter data into the local zone. Answers for
-local zones are authoritative DNS answers. By default the zones are class IN.
+Configure a local zone. The type determines the answer to give if
+there is no match from local\-data. The types are deny, refuse, static,
+transparent, redirect, nodefault, typetransparent, and are explained
+below. After that the default settings are listed. Use local\-data: to
+enter data into the local zone. Answers for local zones are authoritative
+DNS answers. By default the zones are class IN.
 .IP
 If you need more complicated authoritative data, with referrals, wildcards,
 CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
@@ -705,6 +768,13 @@ given in localdata, then a noerror nodata answer is returned.
 If no local\-zone is given local\-data causes a transparent zone
 to be created by default.
 .TP 10
+\h'5'\fItypetransparent\fR 
+If there is a match from local data, the query is answered.  If the query
+is for a different name, or for the same name but for a different type,
+the query is resolved normally.  So, similar to transparent but types
+that are not listed in local data are resolved normally, so if an A record
+is in the local data that does not cause a nodata reply for AAAA queries.
+.TP 10
 \h'5'\fIredirect\fR 
 The query is answered from the local data for the zone name.
 There may be no local data beneath the zone name.
@@ -794,9 +864,6 @@ Reverse data for zone D.F.ip6.arpa.
 \h'5'\fIreverse RFC4291 IPv6 Link Local Addresses\fR
 Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa.
 .TP 10
-\h'5'\fIreverse RFC4843 Orchid Prefix\fR
-Reverse data for zone 0.1.1.0.0.2.ip6.arpa.
-.TP 10
 \h'5'\fIreverse IPv6 Example Prefix\fR
 Reverse data for zone 8.B.D.0.1.0.0.2.ip6.arpa. This zone is used for
 tutorials and examples. You can remove the block on this zone with:
@@ -846,10 +913,9 @@ By default localhost (127.0.0.1 and ::1) is listened to.
 Use 0.0.0.0 and ::0 to listen to all interfaces.
 .TP 5
 .B control\-port: <port number>
-The port number to listen on for control commands, default is 953
-(that is the same port number named uses to listen to rndc).
-If you change this port number, and permissions have been dropped, a
-reload is not sufficient to open the port again, you must then restart.
+The port number to listen on for control commands, default is 8953.
+If you change this port number, and permissions have been dropped,
+a reload is not sufficient to open the port again, you must then restart.
 .TP 5
 .B server\-key\-file: "<private key file>"
 Path to the server private key, by default unbound_server.key.
@@ -964,7 +1030,7 @@ server:
 	num\-threads: 1
 	outgoing\-num\-tcp: 1	# this limits TCP service, uses less buffers.
 	incoming\-num\-tcp: 1
-	outgoing\-range: 16	# uses less memory, but less performance.
+	outgoing\-range: 60	# uses less memory, but less performance.
 	msg\-buffer\-size: 8192   # note this limits service, 'no huge stuff'.
 	msg\-cache\-size: 100k
 	msg\-cache\-slabs: 1
@@ -972,7 +1038,6 @@ server:
 	rrset\-cache\-slabs: 1
 	infra\-cache\-numhosts: 200
 	infra\-cache\-slabs: 1
-	infra\-cache\-lame\-size: 1k
 	key\-cache\-size: 100k
 	key\-cache\-slabs: 1
 	neg\-cache\-size: 10k

iterator/iter_delegpt.c

@@ -81,7 +81,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
 		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, 
-			a->bogus, a->lame, 0))
+			a->bogus, a->lame))
 			return NULL;
 	}
 	return copy;
@@ -154,7 +154,7 @@ delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr,
 int 
 delegpt_add_target(struct delegpt* dp, struct regional* region, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int lame, int nodup)
+	socklen_t addrlen, int bogus, int lame)
 {
 	struct delegpt_ns* ns = delegpt_find_ns(dp, name, namelen);
 	if(!ns) {
@@ -168,23 +168,22 @@ delegpt_add_target(struct delegpt* dp, struct regional* region,
 		if(ns->got4 && ns->got6)
 			ns->resolved = 1;
 	}
-	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, nodup);
+	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame);
 }
 
 int 
 delegpt_add_addr(struct delegpt* dp, struct regional* region, 
 	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
-	int lame, int nodup)
+	int lame)
 {
 	struct delegpt_addr* a;
-	if(nodup) {
-		if((a = delegpt_find_addr(dp, addr, addrlen))) {
-			if(bogus)
-				a->bogus = bogus;
-			if(!lame)
-				a->lame = 0;
-			return 1;
-		}
+	/* check for duplicates */
+	if((a = delegpt_find_addr(dp, addr, addrlen))) {
+		if(bogus)
+			a->bogus = bogus;
+		if(!lame)
+			a->lame = 0;
+		return 1;
 	}
 
 	a = (struct delegpt_addr*)regional_alloc(region,
@@ -361,10 +360,10 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 			continue;
 
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_A) {
-			if(!delegpt_add_rrset_A(dp, region, s, 0, 0))
+			if(!delegpt_add_rrset_A(dp, region, s, 0))
 				return NULL;
 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_AAAA) {
-			if(!delegpt_add_rrset_AAAA(dp, region, s, 0, 0))
+			if(!delegpt_add_rrset_AAAA(dp, region, s, 0))
 				return NULL;
 		}
 	}
@@ -394,7 +393,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int lame, int nodup)
+	struct ub_packed_rrset_key* ak, int lame)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -409,7 +408,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin_addr, d->rr_data[i]+2, INET_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), lame, nodup))
+                        len, (d->security==sec_status_bogus), lame))
                         return 0;
         }
         return 1;
@@ -417,7 +416,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int lame, int nodup)
+	struct ub_packed_rrset_key* ak, int lame)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -432,7 +431,7 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin6_addr, d->rr_data[i]+2, INET6_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), lame, nodup))
+                        len, (d->security==sec_status_bogus), lame))
                         return 0;
         }
         return 1;
@@ -447,9 +446,9 @@ delegpt_add_rrset(struct delegpt* dp, struct regional* region,
 	if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS)
 		return delegpt_rrset_add_ns(dp, region, rrset, lame);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A)
-		return delegpt_add_rrset_A(dp, region, rrset, lame, 1);
+		return delegpt_add_rrset_A(dp, region, rrset, lame);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA)
-		return delegpt_add_rrset_AAAA(dp, region, rrset, lame, 1);
+		return delegpt_add_rrset_AAAA(dp, region, rrset, lame);
 	log_warn("Unknown rrset type added to delegpt");
 	return 1;
 }
@@ -483,3 +482,13 @@ void delegpt_no_ipv6(struct delegpt* dp)
 			ns->resolved = 1;
 	}
 }
+
+void delegpt_no_ipv4(struct delegpt* dp)
+{
+	struct delegpt_ns* ns;
+	for(ns = dp->nslist; ns; ns = ns->next) {
+		/* no ipv4, so only ipv6 is enough to resolve a nameserver */
+		if(ns->got6)
+			ns->resolved = 1;
+	}
+}

iterator/iter_delegpt.h

@@ -185,7 +185,7 @@ int delegpt_add_ns(struct delegpt* dp, struct regional* regional,
  * @param regional: where to allocate the info.
  * @param ns_rrset: NS rrset.
  * @param lame: rrset is lame, disprefer it.
- * return 0 on alloc error.
+ * @return 0 on alloc error.
  */
 int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
 	struct ub_packed_rrset_key* ns_rrset, int lame);
@@ -201,13 +201,11 @@ int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
  * @param addrlen: the length of addr.
  * @param bogus: security status for the address, pass true if bogus.
  * @param lame: address is lame.
- * @param nodup: if true, no address duplicates are made by this add. 
- *	name duplicates are always filtered.
  * @return false on error.
  */
 int delegpt_add_target(struct delegpt* dp, struct regional* regional, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int lame, int nodup);
+	socklen_t addrlen, int bogus, int lame);
 
 /**
  * Add A RRset to delegpt.
@@ -215,11 +213,10 @@ int delegpt_add_target(struct delegpt* dp, struct regional* regional,
  * @param regional: where to allocate the info.
  * @param rrset: RRset A to add.
  * @param lame: rrset is lame, disprefer it.
- * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int lame, int nodup);
+	struct ub_packed_rrset_key* rrset, int lame);
 
 /**
  * Add AAAA RRset to delegpt.
@@ -227,11 +224,10 @@ int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional,
  * @param regional: where to allocate the info.
  * @param rrset: RRset AAAA to add.
  * @param lame: rrset is lame, disprefer it.
- * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int lame, int nodup);
+	struct ub_packed_rrset_key* rrset, int lame);
 
 /**
  * Add any RRset to delegpt.
@@ -253,12 +249,10 @@ int delegpt_add_rrset(struct delegpt* dp, struct regional* regional,
  * @param addrlen: the length of addr.
  * @param bogus: if address is bogus.
  * @param lame: if address is lame.
- * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return false on error.
  */
 int delegpt_add_addr(struct delegpt* dp, struct regional* regional, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
-	int lame, int nodup);
+	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, int lame);
 
 /** 
  * Find NS record in name list of delegation point.
@@ -345,4 +339,11 @@ void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg);
  */
 void delegpt_no_ipv6(struct delegpt* dp);
 
+/**
+ * Register the fact that there is no ipv4 and thus As are not going 
+ * to be queried for or be useful.
+ * @param dp: the delegation point. Updated to reflect no ipv4.
+ */
+void delegpt_no_ipv4(struct delegpt* dp);
+
 #endif /* ITERATOR_ITER_DELEGPT_H */

iterator/iter_donotq.c

@@ -49,7 +49,7 @@
 #include "util/net_help.h"
 
 struct iter_donotq* 
-donotq_create()
+donotq_create(void)
 {
 	struct iter_donotq* dq = (struct iter_donotq*)calloc(1,
 		sizeof(struct iter_donotq));

iterator/iter_donotq.h

@@ -65,7 +65,7 @@ struct iter_donotq {
  * Create donotqueryaddresses structure 
  * @return new structure or NULL on error.
  */
-struct iter_donotq* donotq_create();
+struct iter_donotq* donotq_create(void);
 
 /**
  * Delete donotqueryaddresses structure.

iterator/iter_fwd.c

@@ -40,9 +40,9 @@
  * Keep track of forward zones and config settings.
  */
 #include "config.h"
-#include "ldns/rdata.h"
-#include "ldns/dname.h"
-#include "ldns/rr.h"
+#include <ldns/rdata.h>
+#include <ldns/dname.h>
+#include <ldns/rr.h>
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -67,7 +67,7 @@ fwd_cmp(const void* k1, const void* k2)
 }
 
 struct iter_forwards* 
-forwards_create()
+forwards_create(void)
 {
 	struct iter_forwards* fwd = (struct iter_forwards*)calloc(1,
 		sizeof(struct iter_forwards));
@@ -215,8 +215,7 @@ read_fwds_addr(struct iter_forwards* fwd, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen, 
-			0, 0, 1)) {
+		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen, 0, 0)) {
 			log_err("out of memory");
 			return 0;
 		}

iterator/iter_fwd.h

@@ -89,7 +89,7 @@ struct iter_forward_zone {
  * Create forwards 
  * @return new forwards or NULL on error.
  */
-struct iter_forwards* forwards_create();
+struct iter_forwards* forwards_create(void);
 
 /**
  * Delete forwards.

iterator/iter_hints.c

@@ -40,8 +40,8 @@
  * Keep track of stub and root hints, and read those from config.
  */
 #include "config.h"
-#include "ldns/dname.h"
-#include "ldns/rr.h"
+#include <ldns/dname.h>
+#include <ldns/rr.h>
 #include "iterator/iter_hints.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -51,7 +51,7 @@
 #include "util/data/dname.h"
 
 struct iter_hints* 
-hints_create()
+hints_create(void)
 {
 	struct iter_hints* hints = (struct iter_hints*)calloc(1,
 		sizeof(struct iter_hints));
@@ -88,7 +88,7 @@ ah(struct delegpt* dp, struct regional* r, const char* sv, const char* ip)
 	if(!delegpt_add_ns(dp, r, ldns_rdf_data(rdf), 0) ||
 	   !extstrtoaddr(ip, &addr, &addrlen) ||
 	   !delegpt_add_target(dp, r, ldns_rdf_data(rdf), ldns_rdf_size(rdf),
-		&addr, addrlen, 0, 0, 1)) {
+		&addr, addrlen, 0, 0)) {
 		ldns_rdf_deep_free(rdf);
 		return 0;
 	}
@@ -107,7 +107,7 @@ compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
 	 ;           on server           FTP.INTERNIC.NET
 	 ;       -OR-                    RS.INTERNIC.NET
 	 ;
-	 ;       related version of root zone:   2008051300
+	 ;       related version of root zone:   2010061700
 	 */
 	struct delegpt* dp = delegpt_create(r);
 	if(!dp)
@@ -132,8 +132,10 @@ compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
       }
       if(do_ip6) {
 	if(!ah(dp, r, "A.ROOT-SERVERS.NET.", "2001:503:ba3e::2:30")) return 0;
+	if(!ah(dp, r, "D.ROOT-SERVERS.NET.", "2001:500:2d::d")) return 0;
 	if(!ah(dp, r, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) return 0;
 	if(!ah(dp, r, "H.ROOT-SERVERS.NET.", "2001:500:1::803f:235")) return 0;
+	if(!ah(dp, r, "I.ROOT-SERVERS.NET.", "2001:7fe::53")) return 0;
 	if(!ah(dp, r, "J.ROOT-SERVERS.NET.", "2001:503:c27::2:30")) return 0;
 	if(!ah(dp, r, "K.ROOT-SERVERS.NET.", "2001:7fd::1")) return 0;
 	if(!ah(dp, r, "L.ROOT-SERVERS.NET.", "2001:500:3::42")) return 0;
@@ -228,8 +230,7 @@ read_stubs_addr(struct iter_hints* hints, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen, 
-			0, 0, 1)) {
+		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen, 0, 0)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -324,7 +325,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len, 
-					0, 0, 1)) {
+					0, 0)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}
@@ -340,7 +341,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len,
-					0, 0, 1)) {
+					0, 0)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}
@@ -451,6 +452,13 @@ hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,
 		len, labs, qclass);
 	if(!r) return NULL;
 
+	/* If there is no cache (root prime situation) */
+	if(cache_dp == NULL) {
+		if(r->dp->namelabs != 1)
+			return r; /* no cache dp, use any non-root stub */
+		return NULL;
+	}
+
 	/*
 	 * If the stub is same as the delegation we got
 	 * And has noprime set, we need to 'prime' to use this stub instead.

iterator/iter_hints.h

@@ -81,7 +81,7 @@ struct iter_hints_stub {
  * Create hints 
  * @return new hints or NULL on error.
  */
-struct iter_hints* hints_create();
+struct iter_hints* hints_create(void);
 
 /**
  * Delete hints.

iterator/iter_priv.c

@@ -41,7 +41,7 @@
  */
 
 #include "config.h"
-#include "ldns/dname.h"
+#include <ldns/dname.h>
 #include "iterator/iter_priv.h"
 #include "util/regional.h"
 #include "util/log.h"
@@ -51,7 +51,7 @@
 #include "util/net_help.h"
 #include "util/storage/dnstree.h"
 
-struct iter_priv* priv_create()
+struct iter_priv* priv_create(void)
 {
 	struct iter_priv* priv = (struct iter_priv*)calloc(1, sizeof(*priv));
 	if(!priv)

iterator/iter_priv.h

@@ -43,7 +43,7 @@
 #ifndef ITERATOR_ITER_PRIV_H
 #define ITERATOR_ITER_PRIV_H
 #include "util/rbtree.h"
-#include "ldns/buffer.h"
+#include <ldns/buffer.h>
 struct iter_env;
 struct config_file;
 struct regional;
@@ -74,7 +74,7 @@ struct iter_priv {
  * Create priv structure 
  * @return new structure or NULL on error.
  */
-struct iter_priv* priv_create();
+struct iter_priv* priv_create(void);
 
 /**
  * Delete priv structure.

iterator/iter_resptype.c

@@ -40,7 +40,7 @@
  * one of the response types.
  */
 #include "config.h"
-#include "ldns/packet.h"
+#include <ldns/packet.h>
 #include "iterator/iter_resptype.h"
 #include "iterator/iter_delegpt.h"
 #include "services/cache/dns.h"
@@ -54,6 +54,8 @@ response_type_from_cache(struct dns_msg* msg,
 	/* If the message is NXDOMAIN, then it is an ANSWER. */
 	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NXDOMAIN)
 		return RESPONSE_TYPE_ANSWER;
+	if(request->qtype == LDNS_RR_TYPE_ANY)
+		return RESPONSE_TYPE_ANSWER;
 	
 	/* First we look at the answer section. This can tell us if this is
 	 * CNAME or positive ANSWER. */
@@ -117,6 +119,15 @@ response_type_from_server(int rdset,
 		if( (msg->rep->flags&BIT_RA) &&
 			!(msg->rep->flags&BIT_AA) && !rdset)
 				return RESPONSE_TYPE_REC_LAME;
+		/* it could be a CNAME with NXDOMAIN rcode */
+		for(i=0; i<msg->rep->an_numrrsets; i++) {
+			s = msg->rep->rrsets[i];
+			if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME &&
+				query_dname_compare(request->qname,
+				s->rk.dname) == 0) {
+				return RESPONSE_TYPE_CNAME;
+			}
+		}
 		return RESPONSE_TYPE_ANSWER;
 	}
 	
@@ -141,7 +152,7 @@ response_type_from_server(int rdset,
 		 * answer is there directly, our answer is there after 
 		 * a cname, or there is just a cname. */
 		for(i=0; i<msg->rep->an_numrrsets; i++) {
-			struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
+			s = msg->rep->rrsets[i];
 			
 			/* if the answer section has NS rrset, and qtype ANY 
 		 	 * and the delegation is lower, and no CNAMEs followed,
@@ -152,6 +163,8 @@ response_type_from_server(int rdset,
 				ntohs(s->rk.rrset_class) == request->qclass &&
 				dname_strict_subdomain_c(s->rk.dname, 
 				origzone)) {
+				if((msg->rep->flags&BIT_AA))
+					return RESPONSE_TYPE_ANSWER;
 				return RESPONSE_TYPE_REFERRAL;
 			}
 
@@ -179,6 +192,9 @@ response_type_from_server(int rdset,
 				get_cname_target(s, &mname, &mname_len);
 			}
 		}
+		/* not a referral, and qtype any, thus an answer */
+		if(request->qtype == LDNS_RR_TYPE_ANY)
+			return RESPONSE_TYPE_ANSWER;
 		/* if we encountered a CNAME (or a bunch of CNAMEs), and 
 		 * still got to here, then it is a CNAME response. 
 		 * (This is regardless of the AA bit at this point) */
@@ -225,9 +241,14 @@ response_type_from_server(int rdset,
 				/* Or if a lame server is deployed,
 				 * which gives ns==zone delegation from cache 
 				 * without AA bit as well, with nodata nosoa*/
+				/* real answer must be +AA and SOA RFC(2308),
+				 * so this is wrong, and we SERVFAIL it if
+				 * this is the only possible reply, if it
+				 * is misdeployed the THROWAWAY makes us pick
+				 * the next server from the selection */
 				if(msg->rep->an_numrrsets==0 &&
 					!(msg->rep->flags&BIT_AA) && !rdset)
-					return RESPONSE_TYPE_REC_LAME;
+					return RESPONSE_TYPE_THROWAWAY;
 				return RESPONSE_TYPE_ANSWER;
 			}
 			/* If we are getting a referral upwards (or to 

iterator/iter_scrub.c

@@ -187,11 +187,14 @@ parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
 	size_t* snamelen)
 {
 	if(rrset->rr_count != 1) {
+		struct rr_parse* sig;
 		verbose(VERB_ALGO, "Found CNAME rrset with "
 			"size > 1: %u", (unsigned)rrset->rr_count);
 		/* use the first CNAME! */
 		rrset->rr_count = 1;
 		rrset->size = rrset->rr_first->size;
+		for(sig=rrset->rrsig_first; sig; sig=sig->next)
+			rrset->size += sig->size;
 		rrset->rr_last = rrset->rr_first;
 		rrset->rr_first->next = NULL;
 	}
@@ -363,10 +366,6 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 					"too long");
 				return 0;
 			}
-			/* internally we have CNAME'd/DNAME'd chains ending
-			 * in nxdomain with NOERROR rcode, change rcode
-			 * to reflect this (if needed) */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_NOERROR);
 			if(nx && nx->type == LDNS_RR_TYPE_CNAME && 
 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 				/* check next cname */
@@ -405,14 +404,21 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 
 		/* Follow the CNAME chain. */
 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
+			uint8_t* oldsname = sname;
 			if(!parse_get_cname_target(rrset, &sname, &snamelen))
 				return 0;
 			prev = rrset;
 			rrset = rrset->rrset_all_next;
-			/* internally we have CNAME'd/DNAME'd chains ending
-			 * in nxdomain with NOERROR rcode, change rcode
-			 * to reflect this (if needed) */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_NOERROR);
+			/* in CNAME ANY response, can have data after CNAME */
+			if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
+				while(rrset && rrset->section ==
+					LDNS_SECTION_ANSWER &&
+					dname_pkt_compare(pkt, oldsname,
+					rrset->dname) == 0) {
+					prev = rrset;
+					rrset = rrset->rrset_all_next;
+				}
+			}
 			continue;
 		}
 
@@ -643,9 +649,9 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 		if( (rrset->type == LDNS_RR_TYPE_A || 
 			rrset->type == LDNS_RR_TYPE_AAAA) &&
 			priv_rrset_bad(ie->priv, pkt, rrset)) {
-			/* set servfail, so the classification becomes
-			 * THROWAWAY, instead of LAME or other unwanted */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_SERVFAIL);
+
+			/* do not set servfail since this leads to too
+			 * many drops of other people using rfc1918 space */
 			remove_rrset("sanitize: removing public name with "
 				"private address", pkt, msg, prev, &rrset);
 			continue;

iterator/iter_scrub.h

@@ -42,7 +42,7 @@
 
 #ifndef ITERATOR_ITER_SCRUB_H
 #define ITERATOR_ITER_SCRUB_H
-#include "ldns/buffer.h"
+#include <ldns/buffer.h>
 struct msg_parse;
 struct query_info;
 struct regional;

iterator/iter_utils.c

@@ -132,6 +132,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 		return 0;
 	}
 	iter_env->supports_ipv6 = cfg->do_ip6;
+	iter_env->supports_ipv4 = cfg->do_ip4;
 	return 1;
 }
 
@@ -150,6 +151,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
  *		o The address is bogus (DNSSEC validation failure).
  *		o Listed as donotquery
  *		o is ipv6 but no ipv6 support (in operating system).
+ *		o is ipv4 but no ipv4 support (in operating system).
  *		o is lame
  *	Otherwise, an rtt in milliseconds.
  *	0 .. USEFUL_SERVER_TOP_TIMEOUT-1
@@ -183,31 +185,40 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
 	struct delegpt_addr* a)
 {
-	int rtt, lame, reclame, dnsseclame, lost;
+	int rtt, lame, reclame, dnsseclame;
 	if(a->bogus)
 		return -1; /* address of server is bogus */
 	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
+		log_addr(VERB_ALGO, "skip addr on the donotquery list",
+			&a->addr, a->addrlen);
 		return -1; /* server is on the donotquery list */
 	}
 	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip6 available */
 	}
+	if(!iter_env->supports_ipv4 && !addr_is_ip6(&a->addr, a->addrlen)) {
+		return -1; /* there is no ip4 available */
+	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, 
 		name, namelen, qtype, &lame, &dnsseclame, &reclame, 
-		&rtt, &lost, now)) {
+		&rtt, now)) {
 		log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen);
-		verbose(VERB_ALGO, "   rtt=%d lost=%d%s%s%s%s", rtt, lost,
+		verbose(VERB_ALGO, "   rtt=%d%s%s%s%s", rtt,
 			lame?" LAME":"",
 			dnsseclame?" DNSSEC_LAME":"",
 			reclame?" REC_LAME":"",
 			a->lame?" ADDR_LAME":"");
 		if(lame)
 			return -1; /* server is lame */
-		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT && 
-			lost >= USEFUL_SERVER_MAX_LOST)
-			/* server is unresponsive, but keep trying slowly */
-			return USEFUL_SERVER_TOP_TIMEOUT+1;
+		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT)
+			/* server is unresponsive,
+			 * we used to return TOP_TIMOUT, but fairly useless,
+			 * because if == TOP_TIMEOUT is dropped because
+			 * blacklisted later, instead, remove it here, so
+			 * other choices (that are not blacklisted) can be
+			 * tried */
+			return -1;
 		/* select remainder from worst to best */
 		else if(reclame)
 			return rtt+USEFUL_SERVER_TOP_TIMEOUT*3; /* nonpref */
@@ -215,8 +226,6 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 			return rtt+USEFUL_SERVER_TOP_TIMEOUT*2; /* nonpref */
 		else if(a->lame)
 			return rtt+USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
-		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT) /* not blacklisted*/
-			return USEFUL_SERVER_TOP_TIMEOUT+1;
 		else	return rtt;
 	}
 	/* no server information present */
@@ -850,7 +859,7 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env,
 			log_rrset_key(VERB_ALGO, "found parent-side", akey);
 			ns->done_pside4 = 1;
 			/* a negative-cache-element has no addresses it adds */
-			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1))
+			if(!delegpt_add_rrset_A(dp, region, akey, 1))
 				log_err("malloc failure in lookup_parent_glue");
 			lock_rw_unlock(&akey->entry.lock);
 		}
@@ -862,7 +871,7 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env,
 			log_rrset_key(VERB_ALGO, "found parent-side", akey);
 			ns->done_pside6 = 1;
 			/* a negative-cache-element has no addresses it adds */
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1))
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1))
 				log_err("malloc failure in lookup_parent_glue");
 			lock_rw_unlock(&akey->entry.lock);
 		}

iterator/iter_utils.h

@@ -43,7 +43,7 @@
 #ifndef ITERATOR_ITER_UTILS_H
 #define ITERATOR_ITER_UTILS_H
 #include "iterator/iter_resptype.h"
-#include "ldns/buffer.h"
+#include <ldns/buffer.h>
 struct iter_env;
 struct iter_hints;
 struct iter_forwards;
@@ -159,6 +159,7 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
  * @param qinfo: query name and type
  * @param qflags: query flags with RD flag
  * @param dp: delegpt to check.
+ * @return true if dp is useless.
  */
 int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
 	struct delegpt* dp);

iterator/iterator.c

@@ -41,7 +41,7 @@
  */
 
 #include "config.h"
-#include "ldns/ldns.h"
+#include <ldns/ldns.h>
 #include "iterator/iterator.h"
 #include "iterator/iter_utils.h"
 #include "iterator/iter_hints.h"
@@ -117,6 +117,7 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->num_current_queries = 0;
 	iq->query_restart_count = 0;
 	iq->referral_count = 0;
+	iq->sent_count = 0;
 	iq->wait_priming_stub = 0;
 	iq->refetch_glue = 0;
 	iq->dnssec_expected = 0;
@@ -323,11 +324,8 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 		(msg->rep->ns_numrrsets + msg->rep->ar_numrrsets) *
 		sizeof(struct ub_packed_rrset_key*));
 
-	/* if the rcode was NXDOMAIN, and we prepended DNAME/CNAMEs, then
-	 * it should now be NOERROR. */
-	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NXDOMAIN) {
-		FLAGS_SET_RCODE(msg->rep->flags, LDNS_RCODE_NOERROR);
-	}
+	/* NXDOMAIN rcode can stay if we prepended DNAME/CNAMEs, because
+	 * this is what recursors should give. */
 	msg->rep->rrset_count += num_an + num_ns;
 	msg->rep->an_numrrsets += num_an;
 	msg->rep->ns_numrrsets += num_ns;
@@ -463,8 +461,7 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
  * @param initial_state The initial response state (normally this
  *          is QUERY_RESP_STATE, unless it is known that the request won't
  *          need iterative processing
- * @param final_state The final state for the response to this
- *          request.
+ * @param finalstate The final state for the response to this request.
  * @param subq_ret: if newly allocated, the subquerystate, or NULL if it does
  * 	not need initialisation.
  * @param v: if true, validation is done on the subquery.
@@ -474,13 +471,13 @@ static int
 generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype, 
 	uint16_t qclass, struct module_qstate* qstate, int id,
 	struct iter_qstate* iq, enum iter_state initial_state, 
-	enum iter_state final_state, struct module_qstate** subq_ret, int v)
+	enum iter_state finalstate, struct module_qstate** subq_ret, int v)
 {
 	struct module_qstate* subq = NULL;
 	struct iter_qstate* subiq = NULL;
 	uint16_t qflags = 0; /* OPCODE QUERY, no flags */
 	struct query_info qinf;
-	int prime = (final_state == PRIME_RESP_STATE)?1:0;
+	int prime = (finalstate == PRIME_RESP_STATE)?1:0;
 	qinf.qname = qname;
 	qinf.qname_len = qnamelen;
 	qinf.qtype = qtype;
@@ -523,7 +520,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq->depth = iq->depth+1;
 		outbound_list_init(&subiq->outlist);
 		subiq->state = initial_state;
-		subiq->final_state = final_state;
+		subiq->final_state = finalstate;
 		subiq->qchase = subq->qinfo;
 		subiq->chase_flags = subq->query_flags;
 		subiq->refetch_glue = 0;
@@ -538,6 +535,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
  * @param ie: iterator global state.
  * @param id: module id.
  * @param qclass: the class to prime.
+ * @return 0 on failure
  */
 static int
 prime_root(struct module_qstate* qstate, struct iter_qstate* iq, 
@@ -597,6 +595,8 @@ prime_root(struct module_qstate* qstate, struct iter_qstate* iq,
  * @param q: request name.
  * @return true if a priming subrequest was made, false if not. The will only
  *         issue a priming request if it detects an unprimed stub.
+ *         Uses value of 2 to signal during stub-prime in root-prime situation
+ *         that a noprime-stub is available and resolution can continue.
  */
 static int
 prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, 
@@ -622,6 +622,8 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* is it a noprime stub (always use) */
 	if(stub->noprime) {
+		int r = 0;
+		if(iq->dp == NULL) r = 2;
 		/* copy the dp out of the fixed hints structure, so that
 		 * it can be changed when servicing this query */
 		iq->dp = delegpt_copy(stub_dp, qstate->region);
@@ -632,7 +634,7 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 		log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name, 
 			LDNS_RR_TYPE_NS, q->qclass);
-		return 0;
+		return r;
 	}
 
 	/* Otherwise, we need to (re)prime the stub. */
@@ -937,8 +939,13 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
 				qstate->region, qstate->env->rrset_cache,
 				qstate->env->scratch_buffer, 
-				*qstate->env->now, 1/*add SOA*/);
+				*qstate->env->now, 1/*add SOA*/, NULL);
 		}
+		/* item taken from cache does not match our query name, thus
+		 * security needs to be re-examined later */
+		if(msg && query_dname_compare(qstate->qinfo.qname,
+			iq->qchase.qname) != 0)
+			msg->rep->security = sec_status_unchecked;
 	}
 	if(msg) {
 		/* handle positive cache response */
@@ -968,6 +975,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->dp = NULL;
 			iq->refetch_glue = 0;
 			iq->query_restart_count++;
+			iq->sent_count = 0;
 			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
 			return next_state(iq, INIT_REQUEST_STATE);
 		}
@@ -1012,10 +1020,16 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		delname = iq->qchase.qname;
 		delnamelen = iq->qchase.qname_len;
 	}
-	if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue) {
+	if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue ||
+	   (iq->qchase.qtype == LDNS_RR_TYPE_NS && qstate->prefetch_leeway)) {
 		/* remove first label from delname, root goes to hints,
 		 * but only to fetch glue, not for qtype=DS. */
-		if(dname_is_root(delname) && iq->refetch_glue)
+		/* also when prefetching an NS record, fetch it again from
+		 * its parent, just as if it expired, so that you do not
+		 * get stuck on an older nameserver that gives old NSrecords */
+		if(dname_is_root(delname) && (iq->refetch_glue ||
+			(iq->qchase.qtype == LDNS_RR_TYPE_NS &&
+			qstate->prefetch_leeway)))
 			delname = NULL; /* go to root priming */
 		else 	dname_remove_label(&delname, &delnamelen);
 		iq->refetch_glue = 0; /* if CNAME causes restart, no refetch */
@@ -1034,6 +1048,12 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* If the cache has returned nothing, then we have a 
 		 * root priming situation. */
 		if(iq->dp == NULL) {
+			/* if there is a stub, then no root prime needed */
+			int r = prime_stub(qstate, iq, ie, id, &iq->qchase);
+			if(r == 2)
+				break; /* got noprime-stub-zone, continue */
+			else if(r)
+				return 0; /* stub prime request made */
 			if(forwards_lookup_root(qstate->env->fwds, 
 				iq->qchase.qclass)) {
 				/* forward zone root, no root prime needed */
@@ -1303,6 +1323,9 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 	int missing;
 	int toget = 0;
 
+	if(iq->depth == ie->max_dependency_depth)
+		return 0;
+
 	iter_mark_cycle_targets(qstate, iq->dp);
 	missing = (int)delegpt_count_missing_targets(iq->dp);
 	log_assert(maxtargets != 0); /* that would not be useful */
@@ -1346,7 +1369,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			query_count++;
 		}
 		/* Send the A request. */
-		if(!ns->got4) {
+		if(ie->supports_ipv4 && !ns->got4) {
 			if(!generate_target_query(qstate, iq, id, 
 				ns->name, ns->namelen, 
 				LDNS_RR_TYPE_A, iq->qchase.qclass)) {
@@ -1400,11 +1423,11 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* if: malloc failure in lookup go up to try */
 			/* if: no parent NS in cache - go up one level */
 			verbose(VERB_ALGO, "try to grab parent NS");
-			iq->store_parent_NS = 1;
-			iq->parent_NS_old_dp = iq->dp;
+			iq->store_parent_NS = iq->dp;
 			iq->deleg_msg = NULL;
 			iq->refetch_glue = 1;
 			iq->query_restart_count++;
+			iq->sent_count = 0;
 			return next_state(iq, INIT_REQUEST_STATE);
 		}
 	}
@@ -1436,6 +1459,10 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			return 0; /* and wait for them */
 		}
 	}
+	if(iq->depth == ie->max_dependency_depth) {
+		verbose(VERB_QUERY, "maxdepth and need more nameservers, fail");
+		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
+	}
 	/* mark cycle targets for parent-side lookups */
 	iter_mark_pside_cycle_targets(qstate, iq->dp);
 	/* see if we can issue queries to get nameserver addresses */
@@ -1452,7 +1479,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			ns->done_pside6 = 1;
 			query_count++;
 		}
-		if(!ns->done_pside4) {
+		if(ie->supports_ipv4 && !ns->done_pside4) {
 			/* Send the A request. */
 			if(!generate_parentside_target_query(qstate, iq, id, 
 				ns->name, ns->namelen, 
@@ -1513,8 +1540,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo);
 	verbose(VERB_ALGO, "processQueryTargets: targetqueries %d, "
-		"currentqueries %d", iq->num_target_queries, 
-		iq->num_current_queries);
+		"currentqueries %d sentcount %d", iq->num_target_queries, 
+		iq->num_current_queries, iq->sent_count);
 
 	/* Make sure that we haven't run away */
 	/* FIXME: is this check even necessary? */
@@ -1523,6 +1550,11 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			"number of referrrals with %d", iq->referral_count);
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
+	if(iq->sent_count > MAX_SENT_COUNT) {
+		verbose(VERB_QUERY, "request has exceeded the maximum "
+			"number of sends with %d", iq->sent_count);
+		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+	}
 	
 	/* Make sure we have a delegation point, otherwise priming failed
 	 * or another failure occurred */
@@ -1532,6 +1564,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	if(!ie->supports_ipv6)
 		delegpt_no_ipv6(iq->dp);
+	if(!ie->supports_ipv4)
+		delegpt_no_ipv4(iq->dp);
 	delegpt_log(VERB_ALGO, iq->dp);
 
 	if(iq->num_current_queries>0) {
@@ -1547,7 +1581,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* < not <=, because although the array is large enough for <=, the
 	 * generated query will immediately be discarded due to depth and
 	 * that servfail is cached, which is not good as opportunism goes. */
-	if(iq->depth < ie->max_dependency_depth) {
+	if(iq->depth < ie->max_dependency_depth
+		&& iq->sent_count < TARGET_FETCH_STOP) {
 		tf_policy = ie->target_fetch_policy[iq->depth];
 	}
 
@@ -1570,7 +1605,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* the current caps_server is the number of fallbacks sent.
 		 * the original query is one that matched too, so we have
 		 * caps_server+1 number of matching queries now */
-		if(iq->caps_server+1 >= naddr*3) {
+		if(iq->caps_server+1 >= naddr*3 ||
+			iq->caps_server+1 >= MAX_SENT_COUNT) {
 			/* we're done, process the response */
 			verbose(VERB_ALGO, "0x20 fallback had %d responses "
 				"match for %d wanted, done.", 
@@ -1579,6 +1615,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iter_dec_attempts(iq->dp, 3); /* space for fallback */
 			iq->num_current_queries++; /* RespState decrements it*/
 			iq->referral_count++; /* make sure we don't loop */
+			iq->sent_count = 0;
 			iq->state = QUERY_RESP_STATE;
 			return 1;
 		}
@@ -1686,7 +1723,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->qchase.qname, iq->qchase.qname_len, 
 		iq->qchase.qtype, iq->qchase.qclass, 
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), EDNS_DO|BIT_CD, 
-		iq->dnssec_expected, &target->addr, target->addrlen, qstate);
+		iq->dnssec_expected, &target->addr, target->addrlen,
+		iq->dp->name, iq->dp->namelen, qstate);
 	if(!outq) {
 		log_addr(VERB_DETAIL, "error sending query to auth server", 
 			&target->addr, target->addrlen);
@@ -1694,6 +1732,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	outbound_list_insert(&iq->outlist, outq);
 	iq->num_current_queries++;
+	iq->sent_count++;
 	qstate->ext_state[id] = module_wait_reply;
 
 	return 0;
@@ -1865,11 +1904,12 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			qstate->region, iq->dp))
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		if(iq->store_parent_NS && query_dname_compare(iq->dp->name,
-			iq->parent_NS_old_dp->name) == 0)
-			iter_merge_retry_counts(iq->dp, iq->parent_NS_old_dp);
+			iq->store_parent_NS->name) == 0)
+			iter_merge_retry_counts(iq->dp, iq->store_parent_NS);
 		delegpt_log(VERB_ALGO, iq->dp);
 		/* Count this as a referral. */
 		iq->referral_count++;
+		iq->sent_count = 0;
 		/* see if the next dp is a trust anchor, or a DS was sent
 		 * along, indicating dnssec is expected for next zone */
 		iq->dnssec_expected = iter_indicates_dnssec(qstate->env, 
@@ -1927,6 +1967,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->dp = NULL;
 		/* Note the query restart. */
 		iq->query_restart_count++;
+		iq->sent_count = 0;
 
 		/* stop current outstanding queries. 
 		 * FIXME: should the outstanding queries be waited for and
@@ -2385,6 +2426,8 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 		/* reset the query name back */
 		iq->response->qinfo = qstate->qinfo;
+		/* the security state depends on the combination */
+		iq->response->rep->security = sec_status_unchecked;
 		/* store message with the finished prepended items,
 		 * but only if we did recursion. The nonrecursion referral
 		 * from cache does not need to be stored in the msg cache. */
@@ -2660,7 +2703,8 @@ iter_get_mem(struct module_env* env, int id)
 	if(!ie)
 		return 0;
 	return sizeof(*ie) + sizeof(int)*((size_t)ie->max_dependency_depth+1)
-		+ hints_get_mem(ie->hints) + donotq_get_mem(ie->donotq);
+		+ hints_get_mem(ie->hints) + donotq_get_mem(ie->donotq)
+		+ priv_get_mem(ie->priv);
 }
 
 /**
@@ -2673,7 +2717,7 @@ static struct module_func_block iter_block = {
 };
 
 struct module_func_block* 
-iter_get_funcblock()
+iter_get_funcblock(void)
 {
 	return &iter_block;
 }

iterator/iterator.h

@@ -55,7 +55,11 @@ struct iter_priv;
 /** max number of query restarts. Determines max number of CNAME chain. */
 #define MAX_RESTART_COUNT       8
 /** max number of referrals. Makes sure resolver does not run away */
-#define MAX_REFERRAL_COUNT	30
+#define MAX_REFERRAL_COUNT	130
+/** max number of queries-sent-out.  Make sure large NS set does not loop */
+#define MAX_SENT_COUNT		16
+/** at what query-sent-count to stop target fetch policy */
+#define TARGET_FETCH_STOP	3
 /** how nice is a server without further information, in msec 
  * Equals rtt initial timeout value.
  */
@@ -75,6 +79,8 @@ struct iter_priv;
  * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
  * fast server, this causes server exploration as a side benefit. msec. */
 #define RTT_BAND 400
+/** Start value for blacklisting a host, 2*USEFUL_SERVER_TOP_TIMEOUT in sec */
+#define INFRA_BACKOFF_INITIAL 240
 
 /**
  * Global state for the iterator. 
@@ -91,6 +97,9 @@ struct iter_env {
 	/** A flag to indicate whether or not we have an IPv6 route */
 	int supports_ipv6;
 
+	/** A flag to indicate whether or not we have an IPv4 route */
+	int supports_ipv4;
+
 	/** A set of inetaddrs that should never be queried. */
 	struct iter_donotq* donotq;
 
@@ -247,13 +256,16 @@ struct iter_qstate {
 	/** the number of times this query as followed a referral. */
 	int referral_count;
 
+	/** number of queries fired off */
+	int sent_count;
+
 	/**
 	 * The query must store NS records from referrals as parentside RRs
 	 * Enabled once it hits resolution problems, to throttle retries.
+	 * If enabled it is the pointer to the old delegation point with
+	 * the old retry counts for bad-nameserver-addresses.
 	 */
-	int store_parent_NS;
-	/** the old delegation point with retry counts */
-	struct delegpt* parent_NS_old_dp;
+	struct delegpt* store_parent_NS;
 
 	/**
 	 * The query is for parent-side glue(A or AAAA) for a nameserver.
@@ -314,7 +326,7 @@ struct iter_prep_list {
  * Get the iterator function block.
  * @return: function block with function pointers to iterator methods.
  */
-struct module_func_block* iter_get_funcblock();
+struct module_func_block* iter_get_funcblock(void);
 
 /**
  * Get iterator state as a string

libunbound/libunbound.c

@@ -67,7 +67,7 @@
 #endif /* UB_ON_WINDOWS */
 
 struct ub_ctx* 
-ub_ctx_create()
+ub_ctx_create(void)
 {
 	struct ub_ctx* ctx;
 	unsigned int seed;

libunbound/libworker.c

@@ -44,6 +44,7 @@
 #include "config.h"
 #include <ldns/dname.h>
 #include <ldns/wire2host.h>
+#include <openssl/ssl.h>
 #include "libunbound/libworker.h"
 #include "libunbound/context.h"
 #include "libunbound/unbound.h"
@@ -84,6 +85,7 @@ libworker_delete(struct libworker* w)
 		ub_randfree(w->env->rnd);
 		free(w->env);
 	}
+	SSL_CTX_free(w->sslctx);
 	outside_network_delete(w->back);
 	comm_base_delete(w->base);
 	free(w);
@@ -124,6 +126,13 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 		forwards_delete(w->env->fwds);
 		w->env->fwds = NULL;
 	}
+	if(cfg->ssl_upstream) {
+		w->sslctx = connect_sslctx_create(NULL, NULL, NULL);
+		if(!w->sslctx) {
+			libworker_delete(w);
+			return NULL;
+		}
+	}
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
 	}
@@ -171,7 +180,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 		cfg->do_tcp?cfg->outgoing_num_tcp:0,
 		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
 		ports, numports, cfg->unwanted_threshold,
-		&libworker_alloc_cleanup, w, cfg->do_udp);
+		&libworker_alloc_cleanup, w, cfg->do_udp, w->sslctx);
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
 	}
@@ -185,7 +194,6 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 		libworker_delete(w);
 		return NULL;
 	}
-	w->env->send_packet = &libworker_send_packet;
 	w->env->send_query = &libworker_send_query;
 	w->env->detach_subs = &mesh_detach_subs;
 	w->env->attach_sub = &mesh_attach_sub;
@@ -262,7 +270,12 @@ libworker_dobg(void* arg)
 	/* setup */
 	uint32_t m;
 	struct libworker* w = (struct libworker*)arg;
-	struct ub_ctx* ctx = w->ctx;
+	struct ub_ctx* ctx;
+	if(!w) {
+		log_err("libunbound bg worker init failed, nomem");
+		return NULL;
+	}
+	ctx = w->ctx;
 	log_thread_set(&w->thread_num);
 #ifdef THREADS_DISABLED
 	/* we are forked */
@@ -271,10 +284,6 @@ libworker_dobg(void* arg)
 	tube_close_write(ctx->qq_pipe);
 	tube_close_read(ctx->rr_pipe);
 #endif
-	if(!w) {
-		log_err("libunbound bg worker init failed, nomem");
-		return NULL;
-	}
 	if(!tube_setup_bg_listen(ctx->qq_pipe, w->base, 
 		libworker_handle_control_cmd, w)) {
 		log_err("libunbound bg worker init failed, no bglisten");
@@ -311,11 +320,11 @@ int libworker_bg(struct ub_ctx* ctx)
 	if(ctx->dothread) {
 		lock_basic_unlock(&ctx->cfglock);
 		w = libworker_setup(ctx, 1);
+		if(!w) return UB_NOMEM;
 		w->is_bg_thread = 1;
 #ifdef ENABLE_LOCK_CHECKS
 		w->thread_num = 1; /* for nicer DEBUG checklocks */
 #endif
-		if(!w) return UB_NOMEM;
 		ub_thread_create(&ctx->bg_tid, libworker_dobg, w);
 	} else {
 		lock_basic_unlock(&ctx->cfglock);
@@ -671,18 +680,6 @@ void libworker_alloc_cleanup(void* arg)
         slabhash_clear(w->env->msg_cache);
 }
 
-int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-        socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp)
-{
-	struct libworker* w = (struct libworker*)q->env->worker;
-	if(use_tcp) {
-		return pending_tcp_query(w->back, pkt, addr, addrlen,
-			timeout, libworker_handle_reply, q) != 0;
-	}
-	return pending_udp_query(w->back, pkt, addr, addrlen,
-		timeout*1000, libworker_handle_reply, q) != 0;
-}
-
 /** compare outbound entry qstates */
 static int
 outbound_entry_compare(void* a, void* b)
@@ -697,7 +694,7 @@ outbound_entry_compare(void* a, void* b)
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
         uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
 	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
-        struct module_qstate* q)
+	uint8_t* zone, size_t zonelen, struct module_qstate* q)
 {
 	struct libworker* w = (struct libworker*)q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -707,7 +704,8 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(w->back, qname,
 		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
-		addr, addrlen, libworker_handle_service_reply, e, 
+		q->env->cfg->tcp_upstream, q->env->cfg->ssl_upstream, addr,
+		addrlen, zone, zonelen, libworker_handle_service_reply, e,
 		w->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
@@ -823,15 +821,6 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 	log_assert(0);
 }
 
-int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
-	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
-{
-	log_assert(0);
-	return 0;
-}
-
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 

libunbound/libworker.h

@@ -81,6 +81,8 @@ struct libworker {
 	struct outside_network* back;
 	/** random() table for this worker. */
 	struct ub_randstate* rndstate;
+	/** sslcontext for SSL wrapped DNS over TCP queries */
+	void* sslctx;
 };
 
 /**
@@ -107,20 +109,6 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q);
 /** cleanup the cache to remove all rrset IDs from it, arg is libworker */
 void libworker_alloc_cleanup(void* arg);
 
-/**
- * Worker service routine to send udp messages for modules.
- * @param pkt: packet to send.
- * @param addr: where to.
- * @param addrlen: length of addr.
- * @param timeout: seconds to wait until timeout.
- * @param q: wich query state to reactivate upon return.
- * @param use_tcp: true to use TCP, false for UDP.
- * @return: false on failure (memory or socket related). no query was
- *      sent.
- */
-int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-        socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp);
-
 /**
  * Worker service routine to send serviced queries to authoritative servers.
  * @param qname: query name. (host order)
@@ -132,6 +120,8 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  * @param want_dnssec: signatures needed.
  * @param addr: where to.
  * @param addrlen: length of addr.
+ * @param zone: delegation point name.
+ * @param zonelen: length of zone name wireformat dname.
  * @param q: wich query state to reactivate upon return.
  * @return: false on failure (memory or socket related). no query was
  *      sent.
@@ -139,7 +129,7 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
         uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
 	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
-        struct module_qstate* q);
+	uint8_t* zone, size_t zonelen, struct module_qstate* q);
 
 /** process incoming replies from the network */
 int libworker_handle_reply(struct comm_point* c, void* arg, int error,

libunbound/unbound.h

@@ -93,6 +93,10 @@
 #ifndef _UB_UNBOUND_H
 #define _UB_UNBOUND_H
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * The validation context is created to hold the resolver status,
  * validation keys and a small cache (containing messages, rrsets,
@@ -539,4 +543,8 @@ int ub_ctx_data_add(struct ub_ctx* ctx, char *data);
  */
 int ub_ctx_data_remove(struct ub_ctx* ctx, char *data);
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif /* _UB_UNBOUND_H */

makedist.sh

@@ -54,6 +54,9 @@ Generate a distribution tar file for unbound.
     -d SVN_root  Retrieve the unbound source from the specified repository.
                  Detected from svn working copy if not specified.
     -l ldnsdir   Directory where ldns resides. Detected from Makefile.
+    -wssl openssl.xx.tar.gz Also build openssl from tarball for windows dist.
+    -wxp expat.xx.tar.gz Also build expat from tarball for windows dist.
+    -wldns ldns.xx.tar.gz Also build libldns from tarball for windows dist.
     -w ...       Build windows binary dist. last args passed to configure.
 EOF
     exit 1
@@ -133,6 +136,9 @@ SNAPSHOT="no"
 RC="no"
 LDNSDIR=""
 DOWIN="no"
+WINSSL=""
+WINEXPAT=""
+WINLDNS=""
 
 # Parse the command line arguments.
 while [ "$1" ]; do
@@ -147,6 +153,18 @@ while [ "$1" ]; do
         "-s")
             SNAPSHOT="yes"
             ;;
+        "-wldns")
+	    WINLDNS="$2"
+	    shift
+	    ;;
+        "-wssl")
+	    WINSSL="$2"
+	    shift
+	    ;;
+        "-wxp")
+	    WINEXPAT="$2"
+	    shift
+	    ;;
         "-w")
             DOWIN="yes"
 	    shift
@@ -168,16 +186,71 @@ while [ "$1" ]; do
 done
 
 if [ "$DOWIN" = "yes" ]; then
-    # detect crosscompile, from Fedora11 at this point.
+    # detect crosscompile, from Fedora13 at this point.
     if test "`uname`" = "Linux"; then 
 	info "Crosscompile windows dist"
         cross="yes"
 	configure="mingw32-configure"
 	strip="i686-pc-mingw32-strip"
 	makensis="makensis"	# from mingw32-nsis package
+	# flags for crosscompiled dependency libraries
+	cross_flag=""
 
 	check_svn_root
 	create_temp_dir
+
+	# crosscompile openssl for windows.
+	if test -n "$WINSSL"; then
+		info "Cross compile $WINSSL"
+		info "winssl tar unpack"
+		(cd ..; gzip -cd $WINSSL) | tar xf - || error_cleanup "tar unpack of $WINSSL failed"
+		sslinstall="`pwd`/sslinstall"
+		cd openssl-* || error_cleanup "no openssl-X dir in tarball"
+		# configure for crosscompile, without CAPI because it fails
+		# cross-compilation and it is not used anyway
+		sslflags="no-asm --cross-compile-prefix=i686-pc-mingw32- -DOPENSSL_NO_CAPIENG mingw"
+		info "winssl: Configure $sslflags"
+		./Configure --prefix="$sslinstall" $sslflags || error_cleanup "OpenSSL Configure failed"
+		info "winssl: make"
+		make || error_cleanup "OpenSSL crosscompile failed"
+		# only install sw not docs, which take a long time.
+		info "winssl: make install_sw"
+		make install_sw || error_cleanup "OpenSSL install failed"
+		cross_flag="$cross_flag --with-ssl=$sslinstall"
+		cd ..
+	fi
+
+	if test -n "$WINLDNS"; then
+		info "Cross compile $WINLDNS"
+		info "ldns tar unpack"
+		(cd ..; gzip -cd $WINLDNS) | tar xf - || error_cleanup "tar unpack of $WINLDNS failed"
+		cd ldns-* || error_cleanup "no ldns-X dir in tarball"
+		# we can use the cross_flag with openssl in it
+		info "ldns: Configure $cross_flag"
+		mingw32-configure  $cross_flag || error_cleanup "ldns configure failed"
+		info "ldns: make"
+		make || error_cleanup "ldns crosscompile failed"
+		# use from the build directory.
+		cross_flag="$cross_flag --with-ldns=`pwd`"
+		cd ..
+	fi
+
+	if test -n "$WINEXPAT"; then
+		info "Cross compile $WINEXPAT"
+		info "wxp: tar unpack"
+		(cd ..; gzip -cd $WINEXPAT) | tar xf - || error_cleanup "tar unpack of $WINEXPAT failed"
+		wxpinstall="`pwd`/wxpinstall"
+		cd expat-* || error_cleanup "no expat-X dir in tarball"
+		info "wxp: configure"
+		mingw32-configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib"  || error_cleanup "libexpat configure failed"
+		#info "wxp: make"
+		#make || error_cleanup "libexpat crosscompile failed"
+		info "wxp: make installlib"
+		make installlib || error_cleanup "libexpat install failed"
+		cross_flag="$cross_flag --with-libexpat=$wxpinstall"
+		cd ..
+	fi
+
 	info "Exporting source from SVN."
 	svn export "$SVNROOT" unbound || error_cleanup "SVN command failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from SVN"
@@ -186,6 +259,7 @@ if [ "$DOWIN" = "yes" ]; then
 	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
     else 
 	cross="no"	# mingw and msys
+	cross_flag=""
 	configure="./configure"
 	strip="strip"
 	makensis="c:/Program Files/NSIS/makensis.exe" # http://nsis.sf.net
@@ -206,15 +280,16 @@ if [ "$DOWIN" = "yes" ]; then
     	replace_text "configure.ac" "AC_INIT(unbound, $version" "AC_INIT(unbound, $version2"
     	version="$version2"
     	info "Rebuilding configure script (autoconf) snapshot."
-    	autoconf || autoheader || error_cleanup "Autoconf failed."
+    	autoconf || error_cleanup "Autoconf failed."
+    	autoheader || error_cleanup "Autoheader failed."
     	rm -r autom4te* || echo "ignored"
     fi
 
     # procedure for making unbound installer on mingw. 
     info "Creating windows dist unbound $version"
     info "Calling configure"
-    echo "$configure"' --enable-debug --enable-static-exe '"$*"
-    $configure --enable-debug --enable-static-exe $* \
+    echo "$configure"' --enable-debug --enable-static-exe '"$* $cross_flag"
+    $configure --enable-debug --enable-static-exe $* $cross_flag \
 	|| error_cleanup "Could not configure"
     info "Calling make"
     make || error_cleanup "Could not make"
@@ -229,14 +304,15 @@ if [ "$DOWIN" = "yes" ]; then
     $strip anchor-update.exe
     $strip unbound-control.exe
     $strip unbound-host.exe
+    $strip unbound-anchor.exe
     $strip unbound-checkconf.exe
     $strip unbound-service-install.exe
     $strip unbound-service-remove.exe
     cd tmp.$$
     cp ../doc/example.conf example.conf
-    cp ../unbound.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt .
+    cp ../unbound.exe ../unbound-anchor.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt .
     # zipfile
-    zip ../$file LICENSE README.txt unbound.exe unbound-host.exe unbound-control.exe unbound-checkconf.exe unbound-service-install.exe unbound-service-remove.exe example.conf service.conf unbound-website.url
+    zip ../$file LICENSE README.txt unbound.exe unbound-anchor.exe unbound-host.exe unbound-control.exe unbound-checkconf.exe unbound-service-install.exe unbound-service-remove.exe example.conf service.conf unbound-website.url
     info "Testing $file"
     (cd .. ; zip -T $file )
     # installer
@@ -354,7 +430,9 @@ replace_all doc/unbound.8.in
 replace_all doc/unbound.conf.5.in
 replace_all doc/unbound-checkconf.8.in
 replace_all doc/unbound-control.8.in
+replace_all doc/unbound-anchor.8.in
 replace_all doc/unbound-host.1
+replace_all doc/example.conf.in
 replace_all doc/libunbound.3.in
 
 info "Renaming Unbound directory to unbound-$version."

pythonmod/interface.i

@@ -606,10 +606,8 @@ struct config_file {
    size_t rrset_cache_size;
    size_t rrset_cache_slabs;
    int host_ttl;
-   int lame_ttl;
    size_t infra_cache_slabs;
    size_t infra_cache_numhosts;
-   size_t infra_cache_lame_size;
    char* target_fetch_policy;
    int if_automatic;
    int num_ifs;
@@ -868,6 +866,15 @@ void log_dns_msg(const char* str, struct query_info* qinfo, struct reply_info* r
 void log_query_info(enum verbosity_value v, const char* str, struct query_info* qinf);
 void regional_log_stats(struct regional *r);
 
+// Free allocated memory from marked sources returning corresponding types
+%typemap(newfree, noblock = 1) char * {
+  free($1);
+}
+
+// Mark as source returning newly allocated memory
+%newobject ldns_rr_type2str;
+%newobject ldns_rr_class2str;
+
 // LDNS functions
 char *ldns_rr_type2str(const uint16_t atype);
 char *ldns_rr_class2str(const uint16_t aclass);

pythonmod/pythonmod.c

@@ -44,7 +44,7 @@
 #endif
 
 #include "config.h"
-#include "ldns/ldns.h"
+#include <ldns/ldns.h>
 
 #undef _POSIX_C_SOURCE
 #undef _XOPEN_SOURCE
@@ -153,6 +153,8 @@ int pythonmod_init(struct module_env* env, int id)
    }
    PyRun_SimpleString("sys.path.append('"RUN_DIR"') \n");
    PyRun_SimpleString("sys.path.append('"SHARE_DIR"') \n");
+   PyRun_SimpleString("import distutils.sysconfig \n");
+   PyRun_SimpleString("sys.path.append(distutils.sysconfig.get_python_lib(1,0)) \n");
    if (PyRun_SimpleString("from unboundmodule import *\n") < 0)
    {
       log_err("pythonmod: cannot initialize core module: unboundmodule.py"); 
@@ -375,7 +377,7 @@ static struct module_func_block pythonmod_block = {
    &pythonmod_clear, &pythonmod_get_mem
 };
 
-struct module_func_block* pythonmod_get_funcblock()
+struct module_func_block* pythonmod_get_funcblock(void)
 {
    return &pythonmod_block;
 }

pythonmod/pythonmod.h

@@ -46,7 +46,7 @@
  * Get the module function block.
  * @return: function block with function pointers to module methods.
  */
-struct module_func_block* pythonmod_get_funcblock();
+struct module_func_block* pythonmod_get_funcblock(void);
 
 /** python module init */
 int pythonmod_init(struct module_env* env, int id);

pythonmod/pythonmod_utils.h

@@ -74,6 +74,7 @@ void invalidateQueryInCache(struct module_qstate* qstate, struct query_info* qin
  * 
  * @param qstate: module environment
  * @param pkt: a ldns_buffer which contains ldns_packet data
+ * @return 0 on failure, out of memory or parse error.
  */
 int createResponse(struct module_qstate* qstate, ldns_buffer* pkt);
 

services/cache/dns.c

@@ -49,6 +49,7 @@
 #include "util/module.h"
 #include "util/net_help.h"
 #include "util/regional.h"
+#include "util/config_file.h"
 
 /** store rrsets in the rrset cache. 
  * @param env: module environment with caches.
@@ -180,7 +181,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 0, 0)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 0)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -198,7 +199,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, 0)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -230,7 +231,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, (int)ns->lame, 1)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, (int)ns->lame)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -248,7 +249,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, (int)ns->lame, 1)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, (int)ns->lame)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -417,22 +418,22 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 
 /** generate dns_msg from cached message */
 static struct dns_msg*
-tomsg(struct module_env* env, struct msgreply_entry* e, struct reply_info* r, 
+tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, 
 	struct regional* region, uint32_t now, struct regional* scratch)
 {
 	struct dns_msg* msg;
 	size_t i;
 	if(now > r->ttl)
 		return NULL;
-	msg = gen_dns_msg(region, &e->key, r->rrset_count);
+	msg = gen_dns_msg(region, q, r->rrset_count);
 	if(!msg)
 		return NULL;
 	msg->rep->flags = r->flags;
 	msg->rep->qdcount = r->qdcount;
 	msg->rep->ttl = r->ttl - now;
-	if(r->prefetch_ttl - now > 0)
+	if(r->prefetch_ttl > now)
 		msg->rep->prefetch_ttl = r->prefetch_ttl - now;
-	else	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(r->prefetch_ttl);
+	else	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->security = r->security;
 	msg->rep->an_numrrsets = r->an_numrrsets;
 	msg->rep->ns_numrrsets = r->ns_numrrsets;
@@ -606,7 +607,7 @@ dns_cache_lookup(struct module_env* env,
 	if(e) {
 		struct msgreply_entry* key = (struct msgreply_entry*)e->key;
 		struct reply_info* data = (struct reply_info*)e->data;
-		struct dns_msg* msg = tomsg(env, key, data, region, now, 
+		struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 
 			scratch);
 		if(msg) {
 			lock_rw_unlock(&e->lock);
@@ -630,8 +631,10 @@ dns_cache_lookup(struct module_env* env,
 		lock_rw_unlock(&rrset->entry.lock);
 	}
 
-	/* see if we have CNAME for this domain */
-	if( (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 
+	/* see if we have CNAME for this domain,
+	 * but not for DS records (which are part of the parent) */
+	if( qtype != LDNS_RR_TYPE_DS &&
+	   (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 
 		LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
 		struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 		if(msg) {
@@ -668,6 +671,33 @@ dns_cache_lookup(struct module_env* env,
 		}
 		lock_rw_unlock(&rrset->entry.lock);
 	}
+
+	/* stop downwards cache search on NXDOMAIN.
+	 * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
+	 * means bla.foo also does not exist.  The DNSSEC proofs are
+	 * the same.  We search upwards for NXDOMAINs. */
+	if(env->cfg->harden_below_nxdomain)
+	    while(!dname_is_root(k.qname)) {
+		dname_remove_label(&k.qname, &k.qname_len);
+		h = query_info_hash(&k);
+		e = slabhash_lookup(env->msg_cache, h, &k, 0);
+		if(e) {
+			struct reply_info* data = (struct reply_info*)e->data;
+			struct dns_msg* msg;
+			if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
+			  && data->security == sec_status_secure
+			  && (msg=tomsg(env, &k, data, region, now, scratch))){
+				lock_rw_unlock(&e->lock);
+				msg->qinfo.qname=qname;
+				msg->qinfo.qname_len=qnamelen;
+				/* check that DNSSEC really works out */
+				msg->rep->security = sec_status_unchecked;
+				return msg;
+			}
+			lock_rw_unlock(&e->lock);
+		}
+	}
+
 	return NULL;
 }
 

services/cache/infra.c

@@ -39,7 +39,7 @@
  * This file contains the infrastructure cache.
  */
 #include "config.h"
-#include "ldns/rr.h"
+#include <ldns/rr.h>
 #include "services/cache/infra.h"
 #include "util/storage/slabhash.h"
 #include "util/storage/lookup3.h"
@@ -47,38 +47,50 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/config_file.h"
+#include "iterator/iterator.h"
+
+/** Timeout when only a single probe query per IP is allowed. */
+#define PROBE_MAXRTO 12000 /* in msec */
 
 size_t 
-infra_host_sizefunc(void* k, void* ATTR_UNUSED(d))
+infra_sizefunc(void* k, void* ATTR_UNUSED(d))
 {
-	struct infra_host_key* key = (struct infra_host_key*)k;
-	return sizeof(*key) + sizeof(struct infra_host_data) 
+	struct infra_key* key = (struct infra_key*)k;
+	return sizeof(*key) + sizeof(struct infra_data) + key->namelen
 		+ lock_get_mem(&key->entry.lock);
 }
 
 int 
-infra_host_compfunc(void* key1, void* key2)
+infra_compfunc(void* key1, void* key2)
 {
-	struct infra_host_key* k1 = (struct infra_host_key*)key1;
-	struct infra_host_key* k2 = (struct infra_host_key*)key2;
-	return sockaddr_cmp(&k1->addr, k1->addrlen, &k2->addr, k2->addrlen);
+	struct infra_key* k1 = (struct infra_key*)key1;
+	struct infra_key* k2 = (struct infra_key*)key2;
+	int r = sockaddr_cmp(&k1->addr, k1->addrlen, &k2->addr, k2->addrlen);
+	if(r != 0)
+		return r;
+	if(k1->namelen != k2->namelen) {
+		if(k1->namelen < k2->namelen)
+			return -1;
+		return 1;
+	}
+	return query_dname_compare(k1->zonename, k2->zonename);
 }
 
 void 
-infra_host_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
+infra_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
 {
-	struct infra_host_key* key = (struct infra_host_key*)k;
+	struct infra_key* key = (struct infra_key*)k;
 	if(!key)
 		return;
 	lock_rw_destroy(&key->entry.lock);
+	free(key->zonename);
 	free(key);
 }
 
 void 
-infra_host_deldatafunc(void* d, void* ATTR_UNUSED(arg))
+infra_deldatafunc(void* d, void* ATTR_UNUSED(arg))
 {
-	struct infra_host_data* data = (struct infra_host_data*)d;
-	lruhash_delete(data->lameness);
+	struct infra_data* data = (struct infra_data*)d;
 	free(data);
 }
 
@@ -87,20 +99,16 @@ infra_create(struct config_file* cfg)
 {
 	struct infra_cache* infra = (struct infra_cache*)calloc(1, 
 		sizeof(struct infra_cache));
-	/* the size of the lameness tables are not counted */
-	size_t maxmem = cfg->infra_cache_numhosts * 
-		(sizeof(struct infra_host_key)+sizeof(struct infra_host_data));
+	size_t maxmem = cfg->infra_cache_numhosts * (sizeof(struct infra_key)+
+		sizeof(struct infra_data)+INFRA_BYTES_NAME);
 	infra->hosts = slabhash_create(cfg->infra_cache_slabs,
-		INFRA_HOST_STARTSIZE, maxmem, &infra_host_sizefunc,
-		&infra_host_compfunc, &infra_host_delkeyfunc,
-		&infra_host_deldatafunc, NULL);
+		INFRA_HOST_STARTSIZE, maxmem, &infra_sizefunc, &infra_compfunc,
+		&infra_delkeyfunc, &infra_deldatafunc, NULL);
 	if(!infra->hosts) {
 		free(infra);
 		return NULL;
 	}
 	infra->host_ttl = cfg->host_ttl;
-	infra->lame_ttl = cfg->lame_ttl;
-	infra->max_lame_size = cfg->infra_cache_lame_size;
 	return infra;
 }
 
@@ -120,10 +128,8 @@ infra_adjust(struct infra_cache* infra, struct config_file* cfg)
 	if(!infra)
 		return infra_create(cfg);
 	infra->host_ttl = cfg->host_ttl;
-	infra->lame_ttl = cfg->lame_ttl;
-	infra->max_lame_size = cfg->infra_cache_lame_size;
-	maxmem = cfg->infra_cache_numhosts * 
-		(sizeof(struct infra_host_key)+sizeof(struct infra_host_data));
+	maxmem = cfg->infra_cache_numhosts * (sizeof(struct infra_key)+
+		sizeof(struct infra_data)+INFRA_BYTES_NAME);
 	if(maxmem != slabhash_get_size(infra->hosts) ||
 		cfg->infra_cache_slabs != infra->hosts->size) {
 		infra_delete(infra);
@@ -152,52 +158,44 @@ hash_addr(struct sockaddr_storage* addr, socklen_t addrlen)
 	return h;
 }
 
-/** lookup version that does not check host ttl (you check it) */
-static struct lruhash_entry* 
-infra_lookup_host_nottl(struct infra_cache* infra,
-        struct sockaddr_storage* addr, socklen_t addrlen, int wr)
+/** calculate infra hash for a key */
+static hashvalue_t
+hash_infra(struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* name)
 {
-	struct infra_host_key k;
+	return dname_query_hash(name, hash_addr(addr, addrlen));
+}
+
+/** lookup version that does not check host ttl (you check it) */
+struct lruhash_entry* 
+infra_lookup_nottl(struct infra_cache* infra, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* name, size_t namelen, int wr)
+{
+	struct infra_key k;
 	k.addrlen = addrlen;
 	memcpy(&k.addr, addr, addrlen);
-	k.entry.hash = hash_addr(addr, addrlen);
+	k.namelen = namelen;
+	k.zonename = name;
+	k.entry.hash = hash_infra(addr, addrlen, name);
 	k.entry.key = (void*)&k;
 	k.entry.data = NULL;
 	return slabhash_lookup(infra->hosts, k.entry.hash, &k, wr);
 }
 
-struct infra_host_data* 
-infra_lookup_host(struct infra_cache* infra,
-        struct sockaddr_storage* addr, socklen_t addrlen, int wr,
-        uint32_t timenow, struct infra_host_key** key)
-{
-	struct infra_host_data* data;
-	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
-		addrlen, wr);
-	*key = NULL;
-	if(!e)
-		return NULL;
-	/* check TTL */
-	data = (struct infra_host_data*)e->data;
-	if(data->ttl < timenow) {
-		lock_rw_unlock(&e->lock);
-		return NULL;
-	}
-	*key = (struct infra_host_key*)e->key;
-	return data;
-}
-
-/** init the host elements (not lame elems) */
+/** init the data elements */
 static void
-host_entry_init(struct infra_cache* infra, struct lruhash_entry* e, 
+data_entry_init(struct infra_cache* infra, struct lruhash_entry* e, 
 	uint32_t timenow)
 {
-	struct infra_host_data* data = (struct infra_host_data*)e->data;
+	struct infra_data* data = (struct infra_data*)e->data;
 	data->ttl = timenow + infra->host_ttl;
 	rtt_init(&data->rtt);
 	data->edns_version = 0;
 	data->edns_lame_known = 0;
-	data->num_timeouts = 0;
+	data->probedelay = 0;
+	data->isdnsseclame = 0;
+	data->rec_lame = 0;
+	data->lame_type_A = 0;
+	data->lame_other = 0;
 }
 
 /** 
@@ -205,238 +203,135 @@ host_entry_init(struct infra_cache* infra, struct lruhash_entry* e,
  * @param infra: infra structure with config parameters.
  * @param addr: host address.
  * @param addrlen: length of addr.
+ * @param name: name of zone
+ * @param namelen: length of name.
  * @param tm: time now.
  * @return: the new entry or NULL on malloc failure.
  */
 static struct lruhash_entry*
-new_host_entry(struct infra_cache* infra, struct sockaddr_storage* addr, 
-	socklen_t addrlen, uint32_t tm)
+new_entry(struct infra_cache* infra, struct sockaddr_storage* addr, 
+	socklen_t addrlen, uint8_t* name, size_t namelen, uint32_t tm)
 {
-	struct infra_host_data* data;
-	struct infra_host_key* key = (struct infra_host_key*)malloc(
-		sizeof(struct infra_host_key));
+	struct infra_data* data;
+	struct infra_key* key = (struct infra_key*)malloc(sizeof(*key));
 	if(!key)
 		return NULL;
-	data = (struct infra_host_data*)malloc(
-		sizeof(struct infra_host_data));
+	data = (struct infra_data*)malloc(sizeof(struct infra_data));
 	if(!data) {
 		free(key);
 		return NULL;
 	}
+	key->zonename = memdup(name, namelen);
+	if(!key->zonename) {
+		free(key);
+		free(data);
+		return NULL;
+	}
+	key->namelen = namelen;
 	lock_rw_init(&key->entry.lock);
-	key->entry.hash = hash_addr(addr, addrlen);
+	key->entry.hash = hash_infra(addr, addrlen, name);
 	key->entry.key = (void*)key;
 	key->entry.data = (void*)data;
 	key->addrlen = addrlen;
 	memcpy(&key->addr, addr, addrlen);
-	data->lameness = NULL;
-	host_entry_init(infra, &key->entry, tm);
+	data_entry_init(infra, &key->entry, tm);
 	return &key->entry;
 }
 
 int 
 infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
-        socklen_t addrlen, uint32_t timenow, int* edns_vs, 
-	uint8_t* edns_lame_known, int* to)
+        socklen_t addrlen, uint8_t* nm, size_t nmlen, uint32_t timenow,
+	int* edns_vs, uint8_t* edns_lame_known, int* to)
 {
-	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
-		addrlen, 0);
-	struct infra_host_data* data;
-	if(e && ((struct infra_host_data*)e->data)->ttl < timenow) {
+	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
+		nm, nmlen, 0);
+	struct infra_data* data;
+	int wr = 0;
+	if(e && ((struct infra_data*)e->data)->ttl < timenow) {
 		/* it expired, try to reuse existing entry */
+		int old = ((struct infra_data*)e->data)->rtt.rto;
 		lock_rw_unlock(&e->lock);
-		e = infra_lookup_host_nottl(infra, addr, addrlen, 1);
+		e = infra_lookup_nottl(infra, addr, addrlen, nm, nmlen, 1);
 		if(e) {
 			/* if its still there we have a writelock, init */
 			/* re-initialise */
 			/* do not touch lameness, it may be valid still */
-			host_entry_init(infra, e, timenow);
+			data_entry_init(infra, e, timenow);
+			wr = 1;
+			/* TOP_TIMEOUT remains on reuse */
+			if(old >= USEFUL_SERVER_TOP_TIMEOUT)
+				((struct infra_data*)e->data)->rtt.rto
+					= USEFUL_SERVER_TOP_TIMEOUT;
 		}
 	}
 	if(!e) {
 		/* insert new entry */
-		if(!(e = new_host_entry(infra, addr, addrlen, timenow)))
+		if(!(e = new_entry(infra, addr, addrlen, nm, nmlen, timenow)))
 			return 0;
-		data = (struct infra_host_data*)e->data;
-		*to = rtt_timeout(&data->rtt);
+		data = (struct infra_data*)e->data;
 		*edns_vs = data->edns_version;
 		*edns_lame_known = data->edns_lame_known;
+		*to = rtt_timeout(&data->rtt);
 		slabhash_insert(infra->hosts, e->hash, e, data, NULL);
 		return 1;
 	}
 	/* use existing entry */
-	data = (struct infra_host_data*)e->data;
-	*to = rtt_timeout(&data->rtt);
+	data = (struct infra_data*)e->data;
 	*edns_vs = data->edns_version;
 	*edns_lame_known = data->edns_lame_known;
+	*to = rtt_timeout(&data->rtt);
+	if(*to >= PROBE_MAXRTO && rtt_notimeout(&data->rtt)*4 <= *to) {
+		/* delay other queries, this is the probe query */
+		if(!wr) {
+			lock_rw_unlock(&e->lock);
+			e = infra_lookup_nottl(infra, addr,addrlen,nm,nmlen, 1);
+			if(!e) { /* flushed from cache real fast, no use to
+				allocate just for the probedelay */
+				return 1;
+			}
+			data = (struct infra_data*)e->data;
+		}
+		/* add 999 to round up the timeout value from msec to sec,
+		 * then add a whole second so it is certain that this probe
+		 * has timed out before the next is allowed */
+		data->probedelay = timenow + ((*to)+1999)/1000;
+	}
 	lock_rw_unlock(&e->lock);
 	return 1;
 }
 
-/** hash lameness key */
-static hashvalue_t
-hash_lameness(uint8_t* name)
-{
-	return dname_query_hash(name, 0xab);
-}
-
 int 
-infra_lookup_lame(struct infra_host_data* host,
-        uint8_t* name, size_t namelen, uint32_t timenow,
-	int* dlame, int* rlame, int* alame, int* olame)
+infra_set_lame(struct infra_cache* infra, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* nm, size_t nmlen, uint32_t timenow,
+	int dnsseclame, int reclame, uint16_t qtype)
 {
-	struct lruhash_entry* e;
-	struct infra_lame_key k;
-	struct infra_lame_data *d;
-	if(!host->lameness)
-		return 0;
-	k.entry.hash = hash_lameness(name);
-	k.zonename = name;
-	k.namelen = namelen;
-	k.entry.key = (void*)&k;
-	k.entry.data = NULL;
-	e = lruhash_lookup(host->lameness, k.entry.hash, &k, 0);
-	if(!e)
-		return 0;
-	d = (struct infra_lame_data*)e->data;
-	if(d->ttl < timenow) {
-		lock_rw_unlock(&e->lock);
-		return 0;
-	}
-	*dlame = d->isdnsseclame;
-	*rlame = d->rec_lame;
-	*alame = d->lame_type_A;
-	*olame = d->lame_other;
-	lock_rw_unlock(&e->lock);
-	return *dlame || *rlame || *alame || *olame;
-}
-
-size_t 
-infra_lame_sizefunc(void* k, void* ATTR_UNUSED(d))
-{
-	struct infra_lame_key* key = (struct infra_lame_key*)k;
-	return sizeof(*key) + sizeof(struct infra_lame_data)
-		+ key->namelen + lock_get_mem(&key->entry.lock);
-}
-
-int 
-infra_lame_compfunc(void* key1, void* key2) 
-{
-	struct infra_lame_key* k1 = (struct infra_lame_key*)key1;
-	struct infra_lame_key* k2 = (struct infra_lame_key*)key2;
-	if(k1->namelen != k2->namelen) {
-		if(k1->namelen < k2->namelen)
-			return -1;
-		return 1;
-	}
-	return query_dname_compare(k1->zonename, k2->zonename);
-}
-
-void 
-infra_lame_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
-{
-	struct infra_lame_key* key = (struct infra_lame_key*)k;
-	if(!key) 
-		return;
-	lock_rw_destroy(&key->entry.lock);
-	free(key->zonename);
-	free(key);
-}
-
-void 
-infra_lame_deldatafunc(void* d, void* ATTR_UNUSED(arg))
-{
-	if(!d) 
-		return;
-	free(d);
-}
-
-int 
-infra_set_lame(struct infra_cache* infra,
-        struct sockaddr_storage* addr, socklen_t addrlen,
-        uint8_t* name, size_t namelen, uint32_t timenow, int dnsseclame,
-	int reclame, uint16_t qtype)
-{
-	struct infra_host_data* data;
+	struct infra_data* data;
 	struct lruhash_entry* e;
 	int needtoinsert = 0;
-	struct infra_lame_key* k;
-	struct infra_lame_data* d;
-	/* allocate at start, easier cleanup (no locks held) */
-	k = (struct infra_lame_key*)malloc(sizeof(*k));
-	if(!k) {
-		log_err("set_lame: malloc failure");
-		return 0;
-	}
-	d = (struct infra_lame_data*)malloc(sizeof(*d));
-	if(!d) {
-		free(k);
-		log_err("set_lame: malloc failure");
-		return 0;
-	}
-	k->zonename = memdup(name, namelen);
-	if(!k->zonename) {
-		free(d);
-		free(k);
-		log_err("set_lame: malloc failure");
-		return 0;
-	}
-	lock_rw_init(&k->entry.lock);
-	k->entry.hash = hash_lameness(name);
-	k->entry.key = (void*)k;
-	k->entry.data = (void*)d;
-	d->ttl = timenow + infra->lame_ttl;
-	d->isdnsseclame = dnsseclame;
-	d->rec_lame = reclame;
-	d->lame_type_A = (!dnsseclame && !reclame && qtype == LDNS_RR_TYPE_A);
-	d->lame_other = (!dnsseclame  && !reclame && qtype != LDNS_RR_TYPE_A);
-	k->namelen = namelen;
-	e = infra_lookup_host_nottl(infra, addr, addrlen, 1);
+	e = infra_lookup_nottl(infra, addr, addrlen, nm, nmlen, 1);
 	if(!e) {
 		/* insert it */
-		if(!(e = new_host_entry(infra, addr, addrlen, timenow))) {
-			free(k->zonename);
-			free(k);
-			free(d);
+		if(!(e = new_entry(infra, addr, addrlen, nm, nmlen, timenow))) {
 			log_err("set_lame: malloc failure");
 			return 0;
 		}
 		needtoinsert = 1;
+	} else if( ((struct infra_data*)e->data)->ttl < timenow) {
+		/* expired, reuse existing entry */
+		data_entry_init(infra, e, timenow);
 	}
 	/* got an entry, now set the zone lame */
-	data = (struct infra_host_data*)e->data;
-	if(!data->lameness) {
-		/* create hash table if not there already */
-		data->lameness = lruhash_create(INFRA_LAME_STARTSIZE,
-			infra->max_lame_size, infra_lame_sizefunc, 
-			infra_lame_compfunc, infra_lame_delkeyfunc,
-			infra_lame_deldatafunc, NULL);
-		if(!data->lameness) {
-			log_err("set_lame: malloc failure");
-			if(needtoinsert) slabhash_insert(infra->hosts, 
-				e->hash, e, e->data, NULL);
-			else 	{ lock_rw_unlock(&e->lock); }
-			free(k->zonename);
-			free(k);
-			free(d);
-			return 0;
-		}
-	} else {
-		/* lookup existing lameness entry (if any) and merge data */
-		int dlame, rlame, alame, olame; 
-		if(infra_lookup_lame(data, name, namelen, timenow,
-			&dlame, &rlame, &alame, &olame)) { 
-			/* merge data into new structure */
-			if(dlame) d->isdnsseclame = 1;
-			if(rlame) d->rec_lame = 1;
-			if(alame) d->lame_type_A = 1;
-			if(olame) d->lame_other = 1;
-		}
-	}
-
-	/* inserts new entry, or updates TTL of older entry */
-	lruhash_insert(data->lameness, k->entry.hash, &k->entry, d, NULL);
-	
+	data = (struct infra_data*)e->data;
+	/* merge data (if any) */
+	if(dnsseclame)
+		data->isdnsseclame = 1;
+	if(reclame)
+		data->rec_lame = 1;
+	if(!dnsseclame && !reclame && qtype == LDNS_RR_TYPE_A)
+		data->lame_type_A = 1;
+	if(!dnsseclame  && !reclame && qtype != LDNS_RR_TYPE_A)
+		data->lame_other = 1;
+	/* done */
 	if(needtoinsert)
 		slabhash_insert(infra->hosts, e->hash, e, e->data, NULL);
 	else 	{ lock_rw_unlock(&e->lock); }
@@ -445,47 +340,46 @@ infra_set_lame(struct infra_cache* infra,
 
 void 
 infra_update_tcp_works(struct infra_cache* infra,
-        struct sockaddr_storage* addr, socklen_t addrlen)
+        struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* nm,
+	size_t nmlen)
 {
-	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
-		addrlen, 1);
-	struct infra_host_data* data;
+	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
+		nm, nmlen, 1);
+	struct infra_data* data;
 	if(!e)
 		return; /* doesn't exist */
-	data = (struct infra_host_data*)e->data;
+	data = (struct infra_data*)e->data;
 	if(data->rtt.rto >= RTT_MAX_TIMEOUT)
 		/* do not disqualify this server altogether, it is better
 		 * than nothing */
-		data->rtt.rto = RTT_MAX_TIMEOUT-1;
+		data->rtt.rto = RTT_MAX_TIMEOUT-1000;
 	lock_rw_unlock(&e->lock);
 }
 
 int 
-infra_rtt_update(struct infra_cache* infra,
-        struct sockaddr_storage* addr, socklen_t addrlen,
-        int roundtrip, int orig_rtt, uint32_t timenow)
+infra_rtt_update(struct infra_cache* infra, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* nm, size_t nmlen, int roundtrip,
+	int orig_rtt, uint32_t timenow)
 {
-	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
-		addrlen, 1);
-	struct infra_host_data* data;
+	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
+		nm, nmlen, 1);
+	struct infra_data* data;
 	int needtoinsert = 0;
 	int rto = 1;
 	if(!e) {
-		if(!(e = new_host_entry(infra, addr, addrlen, timenow)))
+		if(!(e = new_entry(infra, addr, addrlen, nm, nmlen, timenow)))
 			return 0;
 		needtoinsert = 1;
-	} else if(((struct infra_host_data*)e->data)->ttl < timenow) {
-		host_entry_init(infra, e, timenow);
-	} 
+	} else if(((struct infra_data*)e->data)->ttl < timenow) {
+		data_entry_init(infra, e, timenow);
+	}
 	/* have an entry, update the rtt */
-	data = (struct infra_host_data*)e->data;
+	data = (struct infra_data*)e->data;
 	if(roundtrip == -1) {
 		rtt_lost(&data->rtt, orig_rtt);
-		if(data->num_timeouts<255)
-			data->num_timeouts++; 
 	} else {
 		rtt_update(&data->rtt, roundtrip);
-		data->num_timeouts = 0;
+		data->probedelay = 0;
 	}
 	if(data->rtt.rto > 0)
 		rto = data->rtt.rto;
@@ -496,26 +390,48 @@ infra_rtt_update(struct infra_cache* infra,
 	return rto;
 }
 
-int 
-infra_edns_update(struct infra_cache* infra,
-        struct sockaddr_storage* addr, socklen_t addrlen,
-        int edns_version, uint32_t timenow)
+int infra_get_host_rto(struct infra_cache* infra,
+        struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* nm,
+	size_t nmlen, struct rtt_info* rtt, int* delay, uint32_t timenow)
 {
-	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
-		addrlen, 1);
-	struct infra_host_data* data;
+	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
+		nm, nmlen, 0);
+	struct infra_data* data;
+	int ttl = -2;
+	if(!e) return -1;
+	data = (struct infra_data*)e->data;
+	if(data->ttl >= timenow) {
+		ttl = (int)(data->ttl - timenow);
+		memmove(rtt, &data->rtt, sizeof(*rtt));
+		if(timenow < data->probedelay)
+			*delay = (int)(data->probedelay - timenow);
+		else	*delay = 0;
+	}
+	lock_rw_unlock(&e->lock);
+	return ttl;
+}
+
+int 
+infra_edns_update(struct infra_cache* infra, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* nm, size_t nmlen, int edns_version,
+	uint32_t timenow)
+{
+	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
+		nm, nmlen, 1);
+	struct infra_data* data;
 	int needtoinsert = 0;
 	if(!e) {
-		if(!(e = new_host_entry(infra, addr, addrlen, timenow)))
+		if(!(e = new_entry(infra, addr, addrlen, nm, nmlen, timenow)))
 			return 0;
 		needtoinsert = 1;
-	} else if(((struct infra_host_data*)e->data)->ttl < timenow) {
-		host_entry_init(infra, e, timenow);
-	} 
+	} else if(((struct infra_data*)e->data)->ttl < timenow) {
+		data_entry_init(infra, e, timenow);
+	}
 	/* have an entry, update the rtt, and the ttl */
-	data = (struct infra_host_data*)e->data;
+	data = (struct infra_data*)e->data;
 	/* do not update if noEDNS and stored is yesEDNS */
-	if(!(edns_version == -1 && data->edns_version != -1)) {
+	if(!(edns_version == -1 && (data->edns_version != -1 &&
+		data->edns_lame_known))) {
 		data->edns_version = edns_version;
 		data->edns_lame_known = 1;
 	}
@@ -526,96 +442,72 @@ infra_edns_update(struct infra_cache* infra,
 	return 1;
 }
 
-int 
+int
 infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
         uint8_t* name, size_t namelen, uint16_t qtype, 
-	int* lame, int* dnsseclame, int* reclame, int* rtt, int* lost,
-	uint32_t timenow)
+	int* lame, int* dnsseclame, int* reclame, int* rtt, uint32_t timenow)
 {
-	struct infra_host_data* host;
-	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
-		addrlen, 0);
-	int dlm, rlm, alm, olm;
+	struct infra_data* host;
+	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
+		name, namelen, 0);
 	if(!e) 
 		return 0;
-	host = (struct infra_host_data*)e->data;
+	host = (struct infra_data*)e->data;
 	*rtt = rtt_unclamped(&host->rtt);
-	*lost = (int)host->num_timeouts;
-	/* check lameness first, if so, ttl on host does not matter anymore */
-	if(infra_lookup_lame(host, name, namelen, timenow, 
-		&dlm, &rlm, &alm, &olm)) {
-		if(alm && qtype == LDNS_RR_TYPE_A) {
+	if(host->rtt.rto >= PROBE_MAXRTO && timenow < host->probedelay
+		&& rtt_notimeout(&host->rtt)*4 <= host->rtt.rto)
+		/* single probe for this domain, and we are not probing */
+		*rtt = USEFUL_SERVER_TOP_TIMEOUT;
+	if(timenow > host->ttl) {
+		/* expired entry */
+		/* see if this can be a re-probe of an unresponsive server */
+		/* minus 1000 because that is outside of the RTTBAND, so
+		 * blacklisted servers stay blacklisted if this is chosen */
+		if(host->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
+			*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
 			lock_rw_unlock(&e->lock);
-			*lame = 1;
-			*dnsseclame = 0;
-			*reclame = 0;
-			return 1;
-		} else if(olm && qtype != LDNS_RR_TYPE_A) {
-			lock_rw_unlock(&e->lock);
-			*lame = 1;
-			*dnsseclame = 0;
-			*reclame = 0;
-			return 1;
-		} else if(dlm) {
-			lock_rw_unlock(&e->lock);
-			*lame = 0;
-			*dnsseclame = 1;
-			*reclame = 0;
-			return 1;
-		} else if(rlm) {
-			lock_rw_unlock(&e->lock);
-			*lame = 0;
-			*dnsseclame = 0;
-			*reclame = 1;
 			return 1;
 		}
-		/* no lameness for this type of query */
-	}
-	*lame = 0;
-	*dnsseclame = 0;
-	*reclame = 0;
-	if(timenow > host->ttl) {
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
+	/* check lameness first */
+	if(host->lame_type_A && qtype == LDNS_RR_TYPE_A) {
+		lock_rw_unlock(&e->lock);
+		*lame = 1;
+		*dnsseclame = 0;
+		*reclame = 0;
+		return 1;
+	} else if(host->lame_other && qtype != LDNS_RR_TYPE_A) {
+		lock_rw_unlock(&e->lock);
+		*lame = 1;
+		*dnsseclame = 0;
+		*reclame = 0;
+		return 1;
+	} else if(host->isdnsseclame) {
+		lock_rw_unlock(&e->lock);
+		*lame = 0;
+		*dnsseclame = 1;
+		*reclame = 0;
+		return 1;
+	} else if(host->rec_lame) {
+		lock_rw_unlock(&e->lock);
+		*lame = 0;
+		*dnsseclame = 0;
+		*reclame = 1;
+		return 1;
+	}
+	/* no lameness for this type of query */
 	lock_rw_unlock(&e->lock);
+	*lame = 0;
+	*dnsseclame = 0;
+	*reclame = 0;
 	return 1;
 }
 
-/** helper memory count for a host lame cache */
-static size_t
-count_host_lame(struct lruhash_entry* e)
-{
-	struct infra_host_data* host_data = (struct infra_host_data*)e->data;
-	if(!host_data->lameness)
-		return 0;
-	return lruhash_get_mem(host_data->lameness);
-}
-
 size_t 
 infra_get_mem(struct infra_cache* infra)
 {
-	size_t i, bin;
-	size_t s = sizeof(*infra) +
-		slabhash_get_mem(infra->hosts);
-	struct lruhash_entry* e;
-	for(i=0; i<infra->hosts->size; i++) {
-		lock_quick_lock(&infra->hosts->array[i]->lock);
-		for(bin=0; bin<infra->hosts->array[i]->size; bin++) {
-			lock_quick_lock(&infra->hosts->array[i]->
-				array[bin].lock);
-			/* count data size in bin items. */
-			for(e = infra->hosts->array[i]->array[bin].
-				overflow_list; e; e = e->overflow_next) {
-				lock_rw_rdlock(&e->lock);
-				s += count_host_lame(e);
-				lock_rw_unlock(&e->lock);
-			}
-			lock_quick_unlock(&infra->hosts->array[i]->
-				array[bin].lock);
-		}
-		lock_quick_unlock(&infra->hosts->array[i]->lock);
-	}
-	return s;
+	return sizeof(*infra) + slabhash_get_mem(infra->hosts);
 }

services/cache/infra.h

@@ -47,65 +47,50 @@ struct slabhash;
 struct config_file;
 
 /**
- * Host information kept for every server.
+ * Host information kept for every server, per zone.
  */
-struct infra_host_key {
+struct infra_key {
 	/** the host address. */
 	struct sockaddr_storage addr;
 	/** length of addr. */
 	socklen_t addrlen;
-	/** hash table entry, data of type infra_host_data. */
+	/** zone name in wireformat */
+	uint8_t* zonename;
+	/** length of zonename */
+	size_t namelen;
+	/** hash table entry, data of type infra_data. */
 	struct lruhash_entry entry;
 };
 
 /**
  * Host information encompasses host capabilities and retransmission timeouts.
+ * And lameness information (notAuthoritative, noEDNS, Recursive)
  */
-struct infra_host_data {
+struct infra_data {
 	/** TTL value for this entry. absolute time. */
 	uint32_t ttl;
+
+	/** time in seconds (absolute) when probing re-commences, 0 disabled */
+	uint32_t probedelay;
 	/** round trip times for timeout calculation */
 	struct rtt_info rtt;
-	/** Names of the zones that are lame. NULL=no lame zones. */
-	struct lruhash* lameness;
+
 	/** edns version that the host supports, -1 means no EDNS */
 	int edns_version;
 	/** if the EDNS lameness is already known or not.
 	 * EDNS lame is when EDNS queries or replies are dropped, 
 	 * and cause a timeout */
 	uint8_t edns_lame_known;
-	/** Number of consequtive timeouts; reset when reply arrives OK. */
-	uint8_t num_timeouts;
-};
 
-/**
- * Lameness information, per host, per zone. 
- */
-struct infra_lame_key {
-	/** key is zone name in wireformat */
-	uint8_t* zonename;
-	/** length of zonename */
-	size_t namelen;
-	/** lruhash entry */
-	struct lruhash_entry entry;
-};
-
-/**
- * Lameness information. Expires.
- * This host is lame because it is in the cache.
- */
-struct infra_lame_data {
-	/** TTL of this entry. absolute time. */
-	uint32_t ttl;
 	/** is the host lame (does not serve the zone authoritatively),
 	 * or is the host dnssec lame (does not serve DNSSEC data) */
-	int isdnsseclame;
+	uint8_t isdnsseclame;
 	/** is the host recursion lame (not AA, but RA) */
-	int rec_lame;
+	uint8_t rec_lame;
 	/** the host is lame (not authoritative) for A records */
-	int lame_type_A;
+	uint8_t lame_type_A;
 	/** the host is lame (not authoritative) for other query types */
-	int lame_other;
+	uint8_t lame_other;
 };
 
 /**
@@ -116,16 +101,12 @@ struct infra_cache {
 	struct slabhash* hosts;
 	/** TTL value for host information, in seconds */
 	int host_ttl;
-	/** TTL for Lameness information, in seconds */
-	int lame_ttl;
-	/** infra lame cache max memory per host, in bytes */
-	size_t max_lame_size;
 };
 
 /** infra host cache default hash lookup size */
 #define INFRA_HOST_STARTSIZE 32
-/** infra lame cache default hash lookup size */
-#define INFRA_LAME_STARTSIZE 2
+/** bytes per zonename reserved in the hostcache, dnamelen(zonename.com.) */
+#define INFRA_BYTES_NAME 14
 
 /**
  * Create infra cache.
@@ -152,26 +133,30 @@ struct infra_cache* infra_adjust(struct infra_cache* infra,
 	struct config_file* cfg);
 
 /**
- * Lookup host data
+ * Plain find infra data function (used by the the other functions)
  * @param infra: infrastructure cache.
  * @param addr: host address.
  * @param addrlen: length of addr.
- * @param wr: set to true to get a writelock on the entry.
- * @param timenow: what time it is now.
- * @param key: the key for the host, returned so caller can unlock when done.
- * @return: host data or NULL if not found or expired.
+ * @param name: domain name of zone.
+ * @param namelen: length of domain name.
+ * @param wr: if true, writelock, else readlock.
+ * @return the entry, could be expired (this is not checked) or NULL.
  */
-struct infra_host_data* infra_lookup_host(struct infra_cache* infra, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int wr, 
-	uint32_t timenow, struct infra_host_key** key);
+struct lruhash_entry* infra_lookup_nottl(struct infra_cache* infra,
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* name,
+	size_t namelen, int wr);
 
 /**
  * Find host information to send a packet. Creates new entry if not found.
  * Lameness is empty. EDNS is 0 (try with first), and rtt is returned for 
  * the first message to it.
+ * Use this to send a packet only, because it also locks out others when
+ * probing is restricted.
  * @param infra: infrastructure cache.
  * @param addr: host address.
  * @param addrlen: length of addr.
+ * @param name: domain name of zone.
+ * @param namelen: length of domain name.
  * @param timenow: what time it is now.
  * @param edns_vs: edns version it supports, is returned.
  * @param edns_lame_known: if EDNS lame (EDNS is dropped in transit) has
@@ -180,25 +165,8 @@ struct infra_host_data* infra_lookup_host(struct infra_cache* infra,
  * @return: 0 on error.
  */
 int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr, 
-	socklen_t addrlen, uint32_t timenow, int* edns_vs, 
-	uint8_t* edns_lame_known, int* to);
-
-/**
- * Check for lameness of this server for a particular zone.
- * You must have a lock on the host structure.
- * @param host: infrastructure cache data for the host. Caller holds lock.
- * @param name: domain name of zone apex.
- * @param namelen: length of domain name.
- * @param timenow: what time it is now.
- * @param dlame: if the function returns true, is set true if dnssec lame.
- * @param rlame: if the function returns true, is set true if recursion lame.
- * @param alame: if the function returns true, is set true if qtype A lame.
- * @param olame: if the function returns true, is set true if qtype other lame.
- * @return: 0 if not lame or unknown or timed out, 1 if lame
- */
-int infra_lookup_lame(struct infra_host_data* host,
-	uint8_t* name, size_t namelen, uint32_t timenow,
-	int* dlame, int* rlame, int* alame, int* olame);
+	socklen_t addrlen, uint8_t* name, size_t namelen,
+	uint32_t timenow, int* edns_vs, uint8_t* edns_lame_known, int* to);
 
 /**
  * Set a host to be lame for the given zone.
@@ -225,6 +193,8 @@ int infra_set_lame(struct infra_cache* infra,
  * @param infra: infrastructure cache.
  * @param addr: host address.
  * @param addrlen: length of addr.
+ * @param name: zone name
+ * @param namelen: zone name length
  * @param roundtrip: estimate of roundtrip time in milliseconds or -1 for 
  * 	timeout.
  * @param orig_rtt: original rtt for the query that timed out (roundtrip==-1).
@@ -232,8 +202,8 @@ int infra_set_lame(struct infra_cache* infra,
  * @param timenow: what time it is now.
  * @return: 0 on error. new rto otherwise.
  */
-int infra_rtt_update(struct infra_cache* infra,
-        struct sockaddr_storage* addr, socklen_t addrlen,
+int infra_rtt_update(struct infra_cache* infra, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* name, size_t namelen,
 	int roundtrip, int orig_rtt, uint32_t timenow);
 
 /**
@@ -241,15 +211,20 @@ int infra_rtt_update(struct infra_cache* infra,
  * @param infra: infrastructure cache.
  * @param addr: host address.
  * @param addrlen: length of addr.
+ * @param name: name of zone
+ * @param namelen: length of name
  */
 void infra_update_tcp_works(struct infra_cache* infra,
-        struct sockaddr_storage* addr, socklen_t addrlen);
+        struct sockaddr_storage* addr, socklen_t addrlen,
+	uint8_t* name, size_t namelen);
 
 /**
  * Update edns information for the host.
  * @param infra: infrastructure cache.
  * @param addr: host address.
  * @param addrlen: length of addr.
+ * @param name: name of zone
+ * @param namelen: length of name
  * @param edns_version: the version that it publishes.
  * 	If it is known to support EDNS then no-EDNS is not stored over it.
  * @param timenow: what time it is now.
@@ -257,10 +232,11 @@ void infra_update_tcp_works(struct infra_cache* infra,
  */
 int infra_edns_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-	int edns_version, uint32_t timenow);
+	uint8_t* name, size_t namelen, int edns_version, uint32_t timenow);
 
 /**
  * Get Lameness information and average RTT if host is in the cache.
+ * This information is to be used for server selection.
  * @param infra: infrastructure cache.
  * @param addr: host address.
  * @param addrlen: length of addr.
@@ -273,16 +249,30 @@ int infra_edns_update(struct infra_cache* infra,
  * @param reclame: if function returns true, this is if it is recursion lame.
  * @param rtt: if function returns true, this returns avg rtt of the server.
  * 	The rtt value is unclamped and reflects recent timeouts.
- * @param lost: number of queries lost in a row.  Reset to 0 when an answer
- * 	gets back.  Gives a connectivity number.
  * @param timenow: what time it is now.
  * @return if found in cache, or false if not (or TTL bad).
  */
 int infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen, 
 	uint8_t* name, size_t namelen, uint16_t qtype, 
-	int* lame, int* dnsseclame, int* reclame, int* rtt, int* lost,
-	uint32_t timenow);
+	int* lame, int* dnsseclame, int* reclame, int* rtt, uint32_t timenow);
+
+/**
+ * Get additional (debug) info on timing.
+ * @param infra: infra cache.
+ * @param addr: host address.
+ * @param addrlen: length of addr.
+ * @param name: zone name
+ * @param namelen: zone name length
+ * @param rtt: the rtt_info is copied into here (caller alloced return struct).
+ * @param delay: probe delay (if any).
+ * @param timenow: what time it is now.
+ * @return TTL the infra host element is valid for. If -1: not found in cache.
+ *	TTL -2: found but expired.
+ */
+int infra_get_host_rto(struct infra_cache* infra,
+        struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* name,
+	size_t namelen, struct rtt_info* rtt, int* delay, uint32_t timenow);
 
 /**
  * Get memory used by the infra cache.
@@ -293,28 +283,15 @@ size_t infra_get_mem(struct infra_cache* infra);
 
 /** calculate size for the hashtable, does not count size of lameness,
  * so the hashtable is a fixed number of items */
-size_t infra_host_sizefunc(void* k, void* d);
+size_t infra_sizefunc(void* k, void* d);
 
 /** compare two addresses, returns -1, 0, or +1 */
-int infra_host_compfunc(void* key1, void* key2);
+int infra_compfunc(void* key1, void* key2);
 
 /** delete key, and destroy the lock */
-void infra_host_delkeyfunc(void* k, void* arg);
+void infra_delkeyfunc(void* k, void* arg);
 
 /** delete data and destroy the lameness hashtable */
-void infra_host_deldatafunc(void* d, void* arg);
-
-/** calculate size, which is fixed, zonename does not count so that
- * a fixed number of items is stored */
-size_t infra_lame_sizefunc(void* k, void* d);
-
-/** compare zone names, returns -1, 0, +1 */
-int infra_lame_compfunc(void* key1, void* key2);
-
-/** free key, lock and zonename */
-void infra_lame_delkeyfunc(void* k, void* arg);
-
-/** free the lameness data */
-void infra_lame_deldatafunc(void* d, void* arg);
+void infra_deldatafunc(void* d, void* arg);
 
 #endif /* SERVICES_CACHE_INFRA_H */

services/cache/rrset.c

@@ -120,7 +120,7 @@ rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key,
 
 /** see if rrset needs to be updated in the cache */
 static int
-need_to_update_rrset(void* nd, void* cd, uint32_t timenow, int equal)
+need_to_update_rrset(void* nd, void* cd, uint32_t timenow, int equal, int ns)
 {
 	struct packed_rrset_data* newd = (struct packed_rrset_data*)nd;
 	struct packed_rrset_data* cached = (struct packed_rrset_data*)cd;
@@ -145,10 +145,22 @@ need_to_update_rrset(void* nd, void* cd, uint32_t timenow, int equal)
 	/*	o item in cache has expired */
 	if( cached->ttl < timenow )
 		return 1;
-        /*      o same trust, but different in data - insert it */
-        if( newd->trust == cached->trust && !equal )
-                return 1;
-        return 0;
+	/*  o same trust, but different in data - insert it */
+	if( newd->trust == cached->trust && !equal ) {
+		/* if this is type NS, do not 'stick' to owner that changes
+		 * the NS RRset, but use the old TTL for the new data, and
+		 * update to fetch the latest data. ttl is not expired, because
+		 * that check was before this one. */
+		if(ns) {
+			size_t i;
+			newd->ttl = cached->ttl;
+			for(i=0; i<(newd->count+newd->rrsig_count); i++)
+				if(newd->rr_ttl[i] > newd->ttl)
+					newd->rr_ttl[i] = newd->ttl;
+		}
+		return 1;
+	}
+	return 0;
 }
 
 /** Update RRSet special key ID */
@@ -191,7 +203,7 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 		equal = rrsetdata_equal((struct packed_rrset_data*)k->entry.
 			data, (struct packed_rrset_data*)e->data);
 		if(!need_to_update_rrset(k->entry.data, e->data, timenow,
-			equal)) {
+			equal, (rrset_type==LDNS_RR_TYPE_NS))) {
 			/* cache is superior, return that value */
 			lock_rw_unlock(&e->lock);
 			ub_packed_rrset_parsedelete(k, alloc);
@@ -338,9 +350,15 @@ rrset_update_sec_status(struct rrset_cache* r,
 		if(updata->trust > cachedata->trust)
 			cachedata->trust = updata->trust;
 		cachedata->security = updata->security;
-		cachedata->ttl = updata->ttl + now;
-		for(i=0; i<cachedata->count+cachedata->rrsig_count; i++)
-			cachedata->rr_ttl[i] = updata->rr_ttl[i]+now;
+		/* for NS records only shorter TTLs, other types: update it */
+		if(ntohs(rrset->rk.type) != LDNS_RR_TYPE_NS ||
+			updata->ttl+now < cachedata->ttl ||
+			cachedata->ttl < now ||
+			updata->security == sec_status_bogus) {
+			cachedata->ttl = updata->ttl + now;
+			for(i=0; i<cachedata->count+cachedata->rrsig_count; i++)
+				cachedata->rr_ttl[i] = updata->rr_ttl[i]+now;
+		}
 	}
 	lock_rw_unlock(&e->lock);
 }

services/listen_dnsport.c

@@ -90,7 +90,8 @@ verbose_print_addr(struct addrinfo *addr)
 
 int
 create_udp_sock(int family, int socktype, struct sockaddr* addr,
-        socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv)
+        socklen_t addrlen, int v6only, int* inuse, int* noproto,
+	int rcv, int snd)
 {
 	int s;
 #if defined(IPV6_USE_MIN_MTU)
@@ -102,6 +103,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #if !defined(SO_RCVBUFFORCE) && !defined(SO_RCVBUF)
 	(void)rcv;
 #endif
+#if !defined(SO_SNDBUFFORCE) && !defined(SO_SNDBUF)
+	(void)snd;
+#endif
 #ifndef IPV6_V6ONLY
 	(void)v6only;
 #endif
@@ -182,6 +186,65 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		}
 #  endif
 #endif /* SO_RCVBUF */
+	}
+	/* first do RCVBUF as the receive buffer is more important */
+	if(snd) {
+#ifdef SO_SNDBUF
+		int got;
+		socklen_t slen = (socklen_t)sizeof(got);
+#  ifdef SO_SNDBUFFORCE
+		/* Linux specific: try to use root permission to override
+		 * system limits on sndbuf. The limit is stored in 
+		 * /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */
+		if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd, 
+			(socklen_t)sizeof(snd)) < 0) {
+			if(errno != EPERM) {
+#    ifndef USE_WINSOCK
+				log_err("setsockopt(..., SO_SNDBUFFORCE, "
+					"...) failed: %s", strerror(errno));
+				close(s);
+#    else
+				log_err("setsockopt(..., SO_SNDBUFFORCE, "
+					"...) failed: %s", 
+					wsa_strerror(WSAGetLastError()));
+				closesocket(s);
+#    endif
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
+#  endif /* SO_SNDBUFFORCE */
+			if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd, 
+				(socklen_t)sizeof(snd)) < 0) {
+#  ifndef USE_WINSOCK
+				log_err("setsockopt(..., SO_SNDBUF, "
+					"...) failed: %s", strerror(errno));
+				close(s);
+#  else
+				log_err("setsockopt(..., SO_SNDBUF, "
+					"...) failed: %s", 
+					wsa_strerror(WSAGetLastError()));
+				closesocket(s);
+#  endif
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
+			/* check if we got the right thing or if system
+			 * reduced to some system max.  Warn if so */
+			if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got, 
+				&slen) >= 0 && got < snd/2) {
+				log_warn("so-sndbuf %u was not granted. "
+					"Got %u. To fix: start with "
+					"root permissions(linux) or sysctl "
+					"bigger net.core.wmem_max(linux) or "
+					"kern.ipc.maxsockbuf(bsd) values.",
+					(unsigned)snd, (unsigned)got);
+			}
+#  ifdef SO_SNDBUFFORCE
+		}
+#  endif
+#endif /* SO_SNDBUF */
 	}
 	if(family == AF_INET6) {
 # if defined(IPV6_V6ONLY)
@@ -280,15 +343,21 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		/* detect freebsd jail with no ipv6 permission */
 		if(family==AF_INET6 && errno==EINVAL)
 			*noproto = 1;
-		else if(errno != EADDRINUSE)
+		else if(errno != EADDRINUSE) {
 			log_err("can't bind socket: %s", strerror(errno));
+			log_addr(0, "failed address",
+				(struct sockaddr_storage*)addr, addrlen);
+		}
 #endif /* EADDRINUSE */
 		close(s);
 #else /* USE_WINSOCK */
 		if(WSAGetLastError() != WSAEADDRINUSE &&
-			WSAGetLastError() != WSAEADDRNOTAVAIL)
+			WSAGetLastError() != WSAEADDRNOTAVAIL) {
 			log_err("can't bind socket: %s", 
 				wsa_strerror(WSAGetLastError()));
+			log_addr(0, "failed address",
+				(struct sockaddr_storage*)addr, addrlen);
+		}
 		closesocket(s);
 #endif
 		return -1;
@@ -368,10 +437,18 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto)
 		/* detect freebsd jail with no ipv6 permission */
 		if(addr->ai_family==AF_INET6 && errno==EINVAL)
 			*noproto = 1;
-		else log_err("can't bind socket: %s", strerror(errno));
+		else {
+			log_err("can't bind socket: %s", strerror(errno));
+			log_addr(0, "failed address",
+				(struct sockaddr_storage*)addr->ai_addr,
+				addr->ai_addrlen);
+		}
 #else
 		log_err("can't bind socket: %s", 
 			wsa_strerror(WSAGetLastError()));
+		log_addr(0, "failed address",
+			(struct sockaddr_storage*)addr->ai_addr,
+			addr->ai_addrlen);
 #endif
 		return -1;
 	}
@@ -394,7 +471,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto)
  */
 static int
 make_sock(int stype, const char* ifname, const char* port, 
-	struct addrinfo *hints, int v6only, int* noip6, size_t rcv)
+	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd)
 {
 	struct addrinfo *res = NULL;
 	int r, s, inuse, noproto;
@@ -420,8 +497,8 @@ make_sock(int stype, const char* ifname, const char* port,
 	if(stype == SOCK_DGRAM) {
 		verbose_print_addr(res);
 		s = create_udp_sock(res->ai_family, res->ai_socktype,
-			(struct sockaddr*)res->ai_addr,
-			res->ai_addrlen, v6only, &inuse, &noproto, (int)rcv);
+			(struct sockaddr*)res->ai_addr, res->ai_addrlen,
+			v6only, &inuse, &noproto, (int)rcv, (int)snd);
 		if(s == -1 && inuse) {
 			log_err("bind: address already in use");
 		} else if(s == -1 && noproto && hints->ai_family == AF_INET6){
@@ -440,7 +517,7 @@ make_sock(int stype, const char* ifname, const char* port,
 /** make socket and first see if ifname contains port override info */
 static int
 make_sock_port(int stype, const char* ifname, const char* port, 
-	struct addrinfo *hints, int v6only, int* noip6, size_t rcv)
+	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd)
 {
 	char* s = strchr(ifname, '@');
 	if(s) {
@@ -461,9 +538,10 @@ make_sock_port(int stype, const char* ifname, const char* port,
 		newif[s-ifname] = 0;
 		strncpy(p, s+1, sizeof(p));
 		p[strlen(s+1)]=0;
-		return make_sock(stype, newif, p, hints, v6only, noip6, rcv);
+		return make_sock(stype, newif, p, hints, v6only, noip6,
+			rcv, snd);
 	}
-	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv);
+	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv, snd);
 }
 
 /**
@@ -553,19 +631,21 @@ set_recvpktinfo(int s, int family)
  * @param port: Port number to use (as string).
  * @param list: list of open ports, appended to, changed to point to list head.
  * @param rcv: receive buffer size for UDP
+ * @param snd: send buffer size for UDP
+ * @param ssl_port: ssl service port number
  * @return: returns false on error.
  */
 static int
 ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, 
 	struct addrinfo *hints, const char* port, struct listen_port** list,
-	size_t rcv)
+	size_t rcv, size_t snd, int ssl_port)
 {
 	int s, noip6=0;
 	if(!do_udp && !do_tcp)
 		return 0;
 	if(do_auto) {
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv)) == -1) {
+			&noip6, rcv, snd)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -586,7 +666,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	} else if(do_udp) {
 		/* regular udp socket */
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv)) == -1) {
+			&noip6, rcv, snd)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -603,15 +683,21 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		}
 	}
 	if(do_tcp) {
+		int is_ssl = ((strchr(ifname, '@') && 
+			atoi(strchr(ifname, '@')+1) == ssl_port) ||
+			(!strchr(ifname, '@') && atoi(port) == ssl_port));
 		if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, 
-			&noip6, 0)) == -1) {
+			&noip6, 0, 0)) == -1) {
 			if(noip6) {
 				/*log_warn("IPv6 protocol not available");*/
 				return 1;
 			}
 			return 0;
 		}
-		if(!port_insert(list, s, listen_type_tcp)) {
+		if(is_ssl)
+			verbose(VERB_ALGO, "setup TCP for SSL service");
+		if(!port_insert(list, s, is_ssl?listen_type_ssl:
+			listen_type_tcp)) {
 #ifndef USE_WINSOCK
 			close(s);
 #else
@@ -644,7 +730,7 @@ listen_cp_insert(struct comm_point* c, struct listen_dnsport* front)
 
 struct listen_dnsport* 
 listen_create(struct comm_base* base, struct listen_port* ports,
-	size_t bufsize, int tcp_accept_count,
+	size_t bufsize, int tcp_accept_count, void* sslctx,
 	comm_point_callback_t* cb, void *cb_arg)
 {
 	struct listen_dnsport* front = (struct listen_dnsport*)
@@ -657,7 +743,7 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 		free(front);
 		return NULL;
 	}
-	
+
 	/* create comm points as needed */
 	while(ports) {
 		struct comm_point* cp = NULL;
@@ -667,7 +753,11 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 		else if(ports->ftype == listen_type_tcp)
 			cp = comm_point_create_tcp(base, ports->fd, 
 				tcp_accept_count, bufsize, cb, cb_arg);
-		else if(ports->ftype == listen_type_udpancil) 
+		else if(ports->ftype == listen_type_ssl) {
+			cp = comm_point_create_tcp(base, ports->fd, 
+				tcp_accept_count, bufsize, cb, cb_arg);
+			cp->ssl = sslctx;
+		} else if(ports->ftype == listen_type_udpancil) 
 			cp = comm_point_create_udp_ancil(base, ports->fd, 
 				front->udp_buff, cb, cb_arg);
 		if(!cp) {
@@ -715,32 +805,6 @@ listen_delete(struct listen_dnsport* front)
 	free(front);
 }
 
-void listen_pushback(struct listen_dnsport* listen)
-{
-	struct listen_list *p;
-	log_assert(listen);
-	for(p = listen->cps; p; p = p->next)
-	{
-		if(p->com->type != comm_udp &&
-			p->com->type != comm_tcp_accept)
-			continue;
-		comm_point_stop_listening(p->com);
-	}
-}
-
-void listen_resume(struct listen_dnsport* listen)
-{
-	struct listen_list *p;
-	log_assert(listen);
-	for(p = listen->cps; p; p = p->next)
-	{
-		if(p->com->type != comm_udp &&
-			p->com->type != comm_tcp_accept)
-			continue;
-		comm_point_start_listening(p->com, -1, -1);
-	}
-}
-
 struct listen_port* 
 listening_ports_open(struct config_file* cfg)
 {
@@ -770,17 +834,15 @@ listening_ports_open(struct config_file* cfg)
 	if(!do_ip4 && !do_ip6) {
 		return NULL;
 	}
-	if(do_auto && (!do_ip4 || !do_ip6)) {
-		log_warn("interface_automatic option does not work when either do-ip4 or do-ip6 is not enabled. Disabling option.");
-		do_auto = 0;
-	}
 	/* create ip4 and ip6 ports so that return addresses are nice. */
 	if(do_auto || cfg->num_ifs == 0) {
 		if(do_ip6) {
 			hints.ai_family = AF_INET6;
 			if(!ports_create_if(do_auto?"::0":"::1", 
 				do_auto, cfg->do_udp, do_tcp, 
-				&hints, portbuf, &list, cfg->socket_rcvbuf)) {
+				&hints, portbuf, &list,
+				cfg->so_rcvbuf, cfg->so_sndbuf,
+				cfg->ssl_port)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -789,7 +851,9 @@ listening_ports_open(struct config_file* cfg)
 			hints.ai_family = AF_INET;
 			if(!ports_create_if(do_auto?"0.0.0.0":"127.0.0.1", 
 				do_auto, cfg->do_udp, do_tcp, 
-				&hints, portbuf, &list, cfg->socket_rcvbuf)) {
+				&hints, portbuf, &list,
+				cfg->so_rcvbuf, cfg->so_sndbuf,
+				cfg->ssl_port)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -801,7 +865,8 @@ listening_ports_open(struct config_file* cfg)
 			hints.ai_family = AF_INET6;
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list, 
-				cfg->socket_rcvbuf)) {
+				cfg->so_rcvbuf, cfg->so_sndbuf,
+				cfg->ssl_port)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -811,7 +876,8 @@ listening_ports_open(struct config_file* cfg)
 			hints.ai_family = AF_INET;
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list, 
-				cfg->socket_rcvbuf)) {
+				cfg->so_rcvbuf, cfg->so_sndbuf,
+				cfg->ssl_port)) {
 				listening_ports_free(list);
 				return NULL;
 			}

services/listen_dnsport.h

@@ -82,7 +82,9 @@ enum listen_type {
 	/** tcp type */
 	listen_type_tcp,
 	/** udp ipv6 (v4mapped) for use with ancillary data */
-	listen_type_udpancil
+	listen_type_udpancil,
+	/** ssl over tcp type */
+	listen_type_ssl
 };
 
 /**
@@ -121,6 +123,7 @@ void listening_ports_free(struct listen_port* list);
  * @param bufsize: size of datagram buffer.
  * @param tcp_accept_count: max number of simultaneous TCP connections 
  * 	from clients.
+ * @param sslctx: nonNULL if ssl context.
  * @param cb: callback function when a request arrives. It is passed
  *	  the packet and user argument. Return true to send a reply.
  * @param cb_arg: user data argument for callback function.
@@ -128,26 +131,7 @@ void listening_ports_free(struct listen_port* list);
  */
 struct listen_dnsport* listen_create(struct comm_base* base,
 	struct listen_port* ports, size_t bufsize, int tcp_accept_count,
-	comm_point_callback_t* cb, void* cb_arg);
-
-/**
- * Stop listening to the dnsports. Ports are still open but not checked
- * for readability - performs pushback of the load.
- * @param listen: the listening structs to stop listening on. Note that
- *    udp and tcp-accept handlers stop, but ongoing tcp-handlers are kept
- *    going, since its rude to 'reset connection by peer' them, instead,
- *    we keep them and the callback will be called when its ready. It can
- *    be dropped at that time. New tcp and udp queries can be served by 
- *    other threads.
- */
-void listen_pushback(struct listen_dnsport* listen);
-
-/**
- * Start listening again to the dnsports.
- * Call after the listen_pushback has been called.
- * @param listen: the listening structs to stop listening on.
- */
-void listen_resume(struct listen_dnsport* listen);
+	void* sslctx, comm_point_callback_t* cb, void* cb_arg);
 
 /**
  * delete the listening structure
@@ -181,10 +165,12 @@ size_t listen_get_mem(struct listen_dnsport* listen);
  * @param noproto: on error, this is set true if cause is that the
 	IPv6 proto (family) is not available.
  * @param rcv: set size on rcvbuf with socket option, if 0 it is not set.
+ * @param snd: set size on sndbuf with socket option, if 0 it is not set.
  * @return: the socket. -1 on error.
  */
 int create_udp_sock(int family, int socktype, struct sockaddr* addr, 
-	socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv);
+	socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv,
+	int snd);
 
 /**
  * Create and bind TCP listening socket

services/localzone.c

@@ -39,8 +39,8 @@
  * This file contains functions to enable local zone authority service.
  */
 #include "config.h"
-#include "ldns/dname.h"
-#include "ldns/host2wire.h"
+#include <ldns/dname.h>
+#include <ldns/host2wire.h>
 #include "services/localzone.h"
 #include "util/regional.h"
 #include "util/config_file.h"
@@ -52,7 +52,7 @@
 #include "util/data/msgparse.h"
 
 struct local_zones* 
-local_zones_create()
+local_zones_create(void)
 {
 	struct local_zones* zones = (struct local_zones*)calloc(1, 
 		sizeof(*zones));
@@ -290,7 +290,7 @@ get_rr_nameclass(const char* str, uint8_t** nm, uint16_t* dclass)
  * @param type: type to look for (host order).
  * @return rrset pointer or NULL if not found.
  */
-struct local_rrset*
+static struct local_rrset*
 local_data_find_type(struct local_data* data, uint16_t type)
 {
 	struct local_rrset* p;
@@ -612,6 +612,8 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg,
 {
 	struct local_zone* z;
 
+	/* this list of zones is from RFC 6303 */
+
 	/* localhost. zone */
 	if(!lz_exists(zones, "localhost.") &&
 		!lz_nodefault(cfg, "localhost.")) {
@@ -698,7 +700,6 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg,
 		!add_as112_default(zones, cfg, buf, "9.e.f.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "a.e.f.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "b.e.f.ip6.arpa.") ||
-		!add_as112_default(zones, cfg, buf, "0.1.1.0.0.2.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "8.b.d.0.1.0.0.2.ip6.arpa.")) {
 		log_err("out of memory adding default zone");
 		return 0;
@@ -968,6 +969,10 @@ void local_zones_print(struct local_zones* zones)
 			log_nametypeclass(0, "transparent zone", 
 				z->name, 0, z->dclass);
 			break;
+		case local_zone_typetransparent:
+			log_nametypeclass(0, "typetransparent zone", 
+				z->name, 0, z->dclass);
+			break;
 		case local_zone_static:
 			log_nametypeclass(0, "static zone", 
 				z->name, 0, z->dclass);
@@ -1096,7 +1101,10 @@ lz_zone_answer(struct local_zone* z, struct query_info* qinfo,
 			*(uint16_t*)ldns_buffer_begin(buf), 
 			ldns_buffer_read_u16_at(buf, 2), edns);
 		return 1;
-	} 
+	} else if(z->type == local_zone_typetransparent) {
+		/* no NODATA or NXDOMAINS for this zone type */
+		return 0;
+	}
 	/* else z->type == local_zone_transparent */
 
 	/* if the zone is transparent and the name exists, but the type
@@ -1153,6 +1161,7 @@ const char* local_zone_type2str(enum localzone_type t)
 		case local_zone_refuse: return "refuse";
 		case local_zone_redirect: return "redirect";
 		case local_zone_transparent: return "transparent";
+		case local_zone_typetransparent: return "typetransparent";
 		case local_zone_static: return "static";
 		case local_zone_nodefault: return "nodefault";
 	}
@@ -1169,6 +1178,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
 		*t = local_zone_static;
 	else if(strcmp(type, "transparent") == 0)
 		*t = local_zone_transparent;
+	else if(strcmp(type, "typetransparent") == 0)
+		*t = local_zone_typetransparent;
 	else if(strcmp(type, "redirect") == 0)
 		*t = local_zone_redirect;
 	else return 0;

services/localzone.h

@@ -63,6 +63,8 @@ enum localzone_type {
 	local_zone_static,
 	/** resolve normally */
 	local_zone_transparent,
+	/** do not block types at localdata names */
+	local_zone_typetransparent,
 	/** answer with data at zone apex */
 	local_zone_redirect,
 	/** remove default AS112 blocking contents for zone
@@ -149,7 +151,7 @@ struct local_rrset {
  * Create local zones storage
  * @return new struct or NULL on error.
  */
-struct local_zones* local_zones_create();
+struct local_zones* local_zones_create(void);
 
 /**
  * Delete local zones storage

services/mesh.c

@@ -43,7 +43,7 @@
  * send back to clients.
  */
 #include "config.h"
-#include "ldns/wire2host.h"
+#include <ldns/wire2host.h>
 #include "services/mesh.h"
 #include "services/outbound_list.h"
 #include "services/cache/dns.h"
@@ -162,7 +162,8 @@ mesh_create(struct module_stack* stack, struct module_env* env)
 		return NULL;
 	}
 	mesh->histogram = timehist_setup();
-	if(!mesh->histogram) {
+	mesh->qbuf_bak = ldns_buffer_new(env->cfg->msg_buffer_size);
+	if(!mesh->histogram || !mesh->qbuf_bak) {
 		free(mesh);
 		log_err("mesh area alloc: out of memory");
 		return NULL;
@@ -209,6 +210,7 @@ mesh_delete(struct mesh_area* mesh)
 	while(mesh->all.count)
 		mesh_delete_helper(mesh->all.root);
 	timehist_delete(mesh->histogram);
+	ldns_buffer_free(mesh->qbuf_bak);
 	free(mesh);
 }
 
@@ -232,9 +234,9 @@ mesh_delete_all(struct mesh_area* mesh)
 	mesh->jostle_last = NULL;
 }
 
-int mesh_make_new_space(struct mesh_area* mesh)
+int mesh_make_new_space(struct mesh_area* mesh, ldns_buffer* qbuf)
 {
-	struct mesh_state* m = mesh->jostle_last;
+	struct mesh_state* m = mesh->jostle_first;
 	/* free space is available */
 	if(mesh->num_reply_states < mesh->max_reply_states)
 		return 1;
@@ -250,6 +252,8 @@ int mesh_make_new_space(struct mesh_area* mesh)
 				"make space for a new one",
 				m->s.qinfo.qname, m->s.qinfo.qtype,
 				m->s.qinfo.qclass);
+			/* backup the query */
+			if(qbuf) ldns_buffer_copy(mesh->qbuf_bak, qbuf);
 			/* notify supers */
 			if(m->super_set.count > 0) {
 				verbose(VERB_ALGO, "notify supers of failure");
@@ -259,6 +263,9 @@ int mesh_make_new_space(struct mesh_area* mesh)
 			}
 			mesh->stats_jostled ++;
 			mesh_state_delete(&m->s);
+			/* restore the query - note that the qinfo ptr to
+			 * the querybuffer is then correct again. */
+			if(qbuf) ldns_buffer_copy(qbuf, mesh->qbuf_bak);
 			return 1;
 		}
 	}
@@ -270,24 +277,41 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
         uint16_t qflags, struct edns_data* edns, struct comm_reply* rep,
         uint16_t qid)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	/* do not use CD flag from user for mesh state, we want the CD-query
+	 * to receive validation anyway, to protect out cache contents and
+	 * avoid bad-data in this cache that a downstream validator cannot
+	 * remove from this cache */
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
 	/* does this create a new reply state? */
 	if(!s || s->list_select == mesh_no_list) {
-		if(!mesh_make_new_space(mesh)) {
+		if(!mesh_make_new_space(mesh, rep->c->buffer)) {
 			verbose(VERB_ALGO, "Too many queries. dropping "
 				"incoming query.");
 			comm_point_drop_reply(rep);
 			mesh->stats_dropped ++;
 			return;
 		}
+		/* for this new reply state, the reply address is free,
+		 * so the limit of reply addresses does not stop reply states*/
+	} else {
+		/* protect our memory usage from storing reply addresses */
+		if(mesh->num_reply_addrs > mesh->max_reply_states*16) {
+			verbose(VERB_ALGO, "Too many requests queued. "
+				"dropping incoming query.");
+			mesh->stats_dropped++;
+			comm_point_drop_reply(rep);
+			return;
+		}
 	}
 	/* see if it already exists, if not, create one */
 	if(!s) {
+#ifdef UNBOUND_DEBUG
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+#endif
+		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
@@ -295,7 +319,10 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 			comm_point_send_reply(rep);
 			return;
 		}
-		n = rbtree_insert(&mesh->all, &s->node);
+#ifdef UNBOUND_DEBUG
+		n =
+#endif
+		rbtree_insert(&mesh->all, &s->node);
 		log_assert(n != NULL);
 		/* set detached (it is now) */
 		mesh->num_detached_states++;
@@ -346,7 +373,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, ldns_buffer* buf, 
 	uint16_t qid, mesh_cb_func_t cb, void* cb_arg)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -354,12 +381,17 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 
 	/* see if it already exists, if not, create one */
 	if(!s) {
+#ifdef UNBOUND_DEBUG
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+#endif
+		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
 		if(!s) {
 			return 0;
 		}
-		n = rbtree_insert(&mesh->all, &s->node);
+#ifdef UNBOUND_DEBUG
+		n =
+#endif
+		rbtree_insert(&mesh->all, &s->node);
 		log_assert(n != NULL);
 		/* set detached (it is now) */
 		mesh->num_detached_states++;
@@ -392,8 +424,10 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
         uint16_t qflags, uint32_t leeway)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
+#ifdef UNBOUND_DEBUG
 	struct rbnode_t* n;
+#endif
 	/* already exists, and for a different purpose perhaps.
 	 * if mesh_no_list, keep it that way. */
 	if(s) {
@@ -404,17 +438,20 @@ void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
 			s->s.prefetch_leeway = leeway;
 		return;
 	}
-	if(!mesh_make_new_space(mesh)) {
+	if(!mesh_make_new_space(mesh, NULL)) {
 		verbose(VERB_ALGO, "Too many queries. dropped prefetch.");
 		mesh->stats_dropped ++;
 		return;
 	}
-	s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+	s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
 	if(!s) {
 		log_err("prefetch mesh_state_create: out of memory");
 		return;
 	}
-	n = rbtree_insert(&mesh->all, &s->node);
+#ifdef UNBOUND_DEBUG
+	n =
+#endif
+	rbtree_insert(&mesh->all, &s->node);
 	log_assert(n != NULL);
 	/* set detached (it is now) */
 	mesh->num_detached_states++;
@@ -513,22 +550,24 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	int i;
 	if(!mstate)
 		return;
+	mesh = mstate->s.env->mesh;
 	/* drop unsent replies */
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep;
 		struct mesh_cb* cb;
 		for(rep=mstate->reply_list; rep; rep=rep->next) {
 			comm_point_drop_reply(&rep->query_reply);
+			mesh->num_reply_addrs--;
 		}
 		for(cb=mstate->cb_list; cb; cb=cb->next) {
 			fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
 			(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
 				sec_status_unchecked, NULL);
+			mesh->num_reply_addrs--;
 		}
 	}
 
 	/* de-init modules */
-	mesh = mstate->s.env->mesh;
 	for(i=0; i<mesh->mods.num; i++) {
 		fptr_ok(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
 		(*mesh->mods.mod[i]->clear)(&mstate->s, i);
@@ -610,11 +649,16 @@ void mesh_detach_subs(struct module_qstate* qstate)
 {
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct mesh_state_ref* ref, lookup;
+#ifdef UNBOUND_DEBUG
 	struct rbnode_t* n;
+#endif
 	lookup.node.key = &lookup;
 	lookup.s = qstate->mesh_info;
 	RBTREE_FOR(ref, struct mesh_state_ref*, &qstate->mesh_info->sub_set) {
-		n = rbtree_delete(&ref->s->super_set, &lookup);
+#ifdef UNBOUND_DEBUG
+		n =
+#endif
+		rbtree_delete(&ref->s->super_set, &lookup);
 		log_assert(n != NULL); /* must have been present */
 		if(!ref->s->reply_list && !ref->s->cb_list
 			&& ref->s->super_set.count == 0) {
@@ -637,19 +681,27 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
 		return 0;
 	}
 	if(!sub) {
+#ifdef UNBOUND_DEBUG
 		struct rbnode_t* n;
+#endif
 		/* create a new one */
 		sub = mesh_state_create(qstate->env, qinfo, qflags, prime);
 		if(!sub) {
 			log_err("mesh_attach_sub: out of memory");
 			return 0;
 		}
-		n = rbtree_insert(&mesh->all, &sub->node);
+#ifdef UNBOUND_DEBUG
+		n =
+#endif
+		rbtree_insert(&mesh->all, &sub->node);
 		log_assert(n != NULL);
 		/* set detached (it is now) */
 		mesh->num_detached_states++;
 		/* set new query state to run */
-		n = rbtree_insert(&mesh->run, &sub->run_node);
+#ifdef UNBOUND_DEBUG
+		n =
+#endif
+		rbtree_insert(&mesh->run, &sub->run_node);
 		log_assert(n != NULL);
 		*newq = &sub->s;
 	} else
@@ -667,7 +719,9 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
 
 int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub)
 {
+#ifdef UNBOUND_DEBUG
 	struct rbnode_t* n;
+#endif
 	struct mesh_state_ref* subref; /* points to sub, inserted in super */
 	struct mesh_state_ref* superref; /* points to super, inserted in sub */
 	if( !(subref = regional_alloc(super->s.region,
@@ -681,9 +735,15 @@ int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub)
 	superref->s = super;
 	subref->node.key = subref;
 	subref->s = sub;
-	n = rbtree_insert(&sub->super_set, &superref->node);
+#ifdef UNBOUND_DEBUG
+	n =
+#endif
+	rbtree_insert(&sub->super_set, &superref->node);
 	log_assert(n != NULL);
-	n = rbtree_insert(&super->sub_set, &subref->node);
+#ifdef UNBOUND_DEBUG
+	n =
+#endif
+	rbtree_insert(&super->sub_set, &subref->node);
 	log_assert(n != NULL);
 	return 1;
 }
@@ -757,7 +817,8 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	struct timeval duration;
 	int secure;
 	/* examine security status */
-	if(m->s.env->need_to_validate && !(r->qflags&BIT_CD) && rep && 
+	if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
+		m->s.env->cfg->ignore_cd) && rep && 
 		rep->security <= sec_status_bogus) {
 		rcode = LDNS_RCODE_SERVFAIL;
 		if(m->s.env->cfg->stat_extended) 
@@ -1083,7 +1144,8 @@ mesh_get_mem(struct mesh_area* mesh)
 {
 	struct mesh_state* m;
 	size_t s = sizeof(*mesh) + sizeof(struct timehist) +
-		sizeof(struct th_buck)*mesh->histogram->num;
+		sizeof(struct th_buck)*mesh->histogram->num +
+		sizeof(ldns_buffer) + ldns_buffer_capacity(mesh->qbuf_bak);
 	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
 		/* all, including m itself allocated in qstate region */
 		s += regional_get_mem(m->s.region);

services/mesh.h

@@ -63,7 +63,7 @@ struct timehist;
  * Maximum number of mesh state activations. Any more is likely an
  * infinite loop in the module. It is then terminated.
  */
-#define MESH_MAX_ACTIVATION 1000
+#define MESH_MAX_ACTIVATION 3000
 
 /**
  * Max number of references-to-references-to-references.. search size.
@@ -123,6 +123,10 @@ struct mesh_area {
 	/** (extended stats) rcode nodata in replies */
 	size_t ans_nodata;
 
+	/** backup of query if other operations recurse and need the
+	 * network buffers */
+	ldns_buffer* qbuf_bak;
+
 	/** double linked list of the run-to-completion query states.
 	 * These are query states with a reply */
 	struct mesh_state* forever_first;
@@ -377,7 +381,8 @@ void mesh_query_done(struct mesh_state* mstate);
  * results from this query state. These can then be changed for error 
  * or results.
  * Called when a module is module_finished or returns module_error.
- * The super query states become runnable with event module_event_pass.
+ * The super query states become runnable with event module_event_pass,
+ * it calls the current module for the super with the inform_super event.
  *
  * @param mesh: mesh area to add newly runnable modules to.
  * @param mstate: the state that has results, used to find mesh state.
@@ -534,9 +539,16 @@ int mesh_state_ref_compare(const void* ap, const void* bp);
 /**
  * Make space for another recursion state for a reply in the mesh
  * @param mesh: mesh area
+ * @param qbuf: query buffer to save if recursion is invoked to make space.
+ *    This buffer is necessary, because the following sequence in calls
+ *    can result in an overwrite of the incoming query:
+ *    delete_other_mesh_query - iter_clean - serviced_delete - waiting
+ *    udp query is sent - on error callback - callback sends SERVFAIL reply
+ *    over the same network channel, and shared UDP buffer is overwritten.
+ *    You can pass NULL if there is no buffer that must be backed up.
  * @return false if no space is available.
  */
-int mesh_make_new_space(struct mesh_area* mesh);
+int mesh_make_new_space(struct mesh_area* mesh, ldns_buffer* qbuf);
 
 /**
  * Insert mesh state into a double linked list.  Inserted at end.

services/outside_network.c

@@ -45,7 +45,7 @@
 #  include <sys/types.h>
 #endif
 #include <sys/time.h>
-#include "ldns/wire2host.h"
+#include <ldns/wire2host.h>
 #include "services/outside_network.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/infra.h"
@@ -58,6 +58,7 @@
 #include "util/net_help.h"
 #include "util/random.h"
 #include "util/fptr_wlist.h"
+#include <openssl/ssl.h>
 
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
@@ -130,6 +131,65 @@ waiting_tcp_delete(struct waiting_tcp* w)
 	free(w);
 }
 
+/** 
+ * Pick random outgoing-interface of that family, and bind it.
+ * port set to 0 so OS picks a port number for us.
+ * if it is the ANY address, do not bind.
+ * @param w: tcp structure with destination address.
+ * @param s: socket fd.
+ * @return false on error, socket closed.
+ */
+static int
+pick_outgoing_tcp(struct waiting_tcp* w, int s)
+{
+	struct port_if* pi = NULL;
+	int num;
+#ifdef INET6
+	if(addr_is_ip6(&w->addr, w->addrlen))
+		num = w->outnet->num_ip6;
+	else
+#endif
+		num = w->outnet->num_ip4;
+	if(num == 0) {
+		log_err("no TCP outgoing interfaces of family");
+		log_addr(VERB_OPS, "for addr", &w->addr, w->addrlen);
+#ifndef USE_WINSOCK
+		close(s);
+#else
+		closesocket(s);
+#endif
+		return 0;
+	}
+#ifdef INET6
+	if(addr_is_ip6(&w->addr, w->addrlen))
+		pi = &w->outnet->ip6_ifs[ub_random_max(w->outnet->rnd, num)];
+	else
+#endif
+		pi = &w->outnet->ip4_ifs[ub_random_max(w->outnet->rnd, num)];
+	log_assert(pi);
+	if(addr_is_any(&pi->addr, pi->addrlen)) {
+		/* binding to the ANY interface is for listening sockets */
+		return 1;
+	}
+	/* set port to 0 */
+	if(addr_is_ip6(&pi->addr, pi->addrlen))
+		((struct sockaddr_in6*)&pi->addr)->sin6_port = 0;
+	else	((struct sockaddr_in*)&pi->addr)->sin_port = 0;
+	if(bind(s, (struct sockaddr*)&pi->addr, pi->addrlen) != 0) {
+#ifndef USE_WINSOCK
+		log_err("outgoing tcp: bind: %s", strerror(errno));
+		close(s);
+#else
+		log_err("outgoing tcp: bind: %s", 
+			wsa_strerror(WSAGetLastError()));
+		closesocket(s);
+#endif
+		return 0;
+	}
+	log_addr(VERB_ALGO, "tcp bound to src", &pi->addr, pi->addrlen);
+	return 1;
+}
+
 /** use next free buffer to service a tcp query */
 static int
 outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
@@ -156,6 +216,9 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
 		log_addr(0, "failed address", &w->addr, w->addrlen);
 		return 0;
 	}
+	if(!pick_outgoing_tcp(w, s))
+		return 0;
+
 	fd_set_nonblock(s);
 	if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
 #ifndef USE_WINSOCK
@@ -175,6 +238,18 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
 			return 0;
 		}
 	}
+	if(w->outnet->sslctx && w->ssl_upstream) {
+		pend->c->ssl = outgoing_ssl_fd(w->outnet->sslctx, s);
+		if(!pend->c->ssl) {
+			pend->c->fd = s;
+			comm_point_close(pend->c);
+			return 0;
+		}
+#ifdef USE_WINSOCK
+		comm_point_tcp_win_bio_cb(pend->c, pend->c->ssl);
+#endif
+		pend->c->ssl_shake_state = comm_ssl_shake_write;
+	}
 	w->pkt = NULL;
 	w->next_waiting = (void*)pend;
 	pend->id = LDNS_ID_WIRE(pkt);
@@ -218,6 +293,11 @@ static void
 decomission_pending_tcp(struct outside_network* outnet, 
 	struct pending_tcp* pend)
 {
+	if(pend->c->ssl) {
+		SSL_shutdown(pend->c->ssl);
+		SSL_free(pend->c->ssl);
+		pend->c->ssl = NULL;
+	}
 	comm_point_close(pend->c);
 	pend->next_free = outnet->tcp_free;
 	outnet->tcp_free = pend;
@@ -473,7 +553,8 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	int do_ip6, size_t num_tcp, struct infra_cache* infra,
 	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
 	int numavailports, size_t unwanted_threshold,
-	void (*unwanted_action)(void*), void* unwanted_param, int do_udp)
+	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
+	void* sslctx)
 {
 	struct outside_network* outnet = (struct outside_network*)
 		calloc(1, sizeof(struct outside_network));
@@ -487,6 +568,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	outnet->num_tcp = num_tcp;
 	outnet->infra = infra;
 	outnet->rnd = rnd;
+	outnet->sslctx = sslctx;
 	outnet->svcd_overhead = 0;
 	outnet->want_to_quit = 0;
 	outnet->unwanted_threshold = unwanted_threshold;
@@ -607,6 +689,7 @@ serviced_node_del(rbnode_t* node, void* ATTR_UNUSED(arg))
 	struct serviced_query* sq = (struct serviced_query*)node;
 	struct service_callback* p = sq->cblist, *np;
 	free(sq->qbuf);
+	free(sq->zone);
 	while(p) {
 		np = p->next;
 		free(p);
@@ -758,12 +841,14 @@ udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int port,
 		struct sockaddr_in6* sa = (struct sockaddr_in6*)addr;
 		sa->sin6_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET6, SOCK_DGRAM, 
-			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto, 0);
+			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
+			0, 0);
 	} else {
 		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
 		sa->sin_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET, SOCK_DGRAM, 
-			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto, 0);
+			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
+			0, 0);
 	}
 	return fd;
 }
@@ -990,7 +1075,7 @@ outnet_tcptimer(void* arg)
 struct waiting_tcp* 
 pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet, 
 	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* callback, void* callback_arg)
+	comm_point_callback_t* callback, void* callback_arg, int ssl_upstream)
 {
 	struct pending_tcp* pend = outnet->tcp_free;
 	struct waiting_tcp* w;
@@ -1015,6 +1100,7 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 	w->outnet = outnet;
 	w->cb = callback;
 	w->cb_arg = callback_arg;
+	w->ssl_upstream = ssl_upstream;
 #ifndef S_SPLINT_S
 	tv.tv_sec = timeout;
 	tv.tv_usec = 0;
@@ -1078,10 +1164,14 @@ lookup_serviced(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 /** Create new serviced entry */
 static struct serviced_query*
 serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
-	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen)
+	int want_dnssec, int tcp_upstream, int ssl_upstream,
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
+	size_t zonelen)
 {
 	struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
+#ifdef UNBOUND_DEBUG
 	rbnode_t* ins;
+#endif
 	if(!sq) 
 		return NULL;
 	sq->node.key = sq;
@@ -1091,8 +1181,17 @@ serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 		return NULL;
 	}
 	sq->qbuflen = ldns_buffer_limit(buff);
+	sq->zone = memdup(zone, zonelen);
+	if(!sq->zone) {
+		free(sq->qbuf);
+		free(sq);
+		return NULL;
+	}
+	sq->zonelen = zonelen;
 	sq->dnssec = dnssec;
 	sq->want_dnssec = want_dnssec;
+	sq->tcp_upstream = tcp_upstream;
+	sq->ssl_upstream = ssl_upstream;
 	memcpy(&sq->addr, addr, addrlen);
 	sq->addrlen = addrlen;
 	sq->outnet = outnet;
@@ -1101,7 +1200,10 @@ serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 	sq->status = serviced_initial;
 	sq->retry = 0;
 	sq->to_be_deleted = 0;
-	ins = rbtree_insert(outnet->serviced, &sq->node);
+#ifdef UNBOUND_DEBUG
+	ins = 
+#endif
+	rbtree_insert(outnet->serviced, &sq->node);
 	log_assert(ins != NULL); /* must not be already present */
 	return sq;
 }
@@ -1135,6 +1237,7 @@ serviced_delete(struct serviced_query* sq)
 		if(sq->status == serviced_query_UDP_EDNS ||
 			sq->status == serviced_query_UDP ||
 			sq->status == serviced_query_PROBE_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_FRAG ||
 			sq->status == serviced_query_UDP_EDNS_fallback) {
 			struct pending* p = (struct pending*)sq->pending;
 			if(p->pc)
@@ -1216,7 +1319,19 @@ serviced_encode(struct serviced_query* sq, ldns_buffer* buff, int with_edns)
 		edns.edns_present = 1;
 		edns.ext_rcode = 0;
 		edns.edns_version = EDNS_ADVERTISED_VERSION;
-		edns.udp_size = EDNS_ADVERTISED_SIZE;
+		if(sq->status == serviced_query_UDP_EDNS_FRAG) {
+			if(addr_is_ip6(&sq->addr, sq->addrlen)) {
+				if(EDNS_FRAG_SIZE_IP6 < EDNS_ADVERTISED_SIZE)
+					edns.udp_size = EDNS_FRAG_SIZE_IP6;
+				else	edns.udp_size = EDNS_ADVERTISED_SIZE;
+			} else {
+				if(EDNS_FRAG_SIZE_IP4 < EDNS_ADVERTISED_SIZE)
+					edns.udp_size = EDNS_FRAG_SIZE_IP4;
+				else	edns.udp_size = EDNS_ADVERTISED_SIZE;
+			}
+		} else {
+			edns.udp_size = EDNS_ADVERTISED_SIZE;
+		}
 		edns.bits = 0;
 		if(sq->dnssec & EDNS_DO)
 			edns.bits = EDNS_DO;
@@ -1240,16 +1355,19 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 	uint8_t edns_lame_known;
 	uint32_t now = *sq->outnet->now_secs;
 
-	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, now, &vs,
-		&edns_lame_known, &rtt))
+	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, sq->zone,
+		sq->zonelen, now, &vs, &edns_lame_known, &rtt))
 		return 0;
+	sq->last_rtt = rtt;
+	verbose(VERB_ALGO, "EDNS lookup known=%d vs=%d", edns_lame_known, vs);
 	if(sq->status == serviced_initial) {
 		if(edns_lame_known == 0 && rtt > 5000 && rtt < 10001) {
 			/* perform EDNS lame probe - check if server is
 			 * EDNS lame (EDNS queries to it are dropped) */
 			verbose(VERB_ALGO, "serviced query: send probe to see "
 				" if use of EDNS causes timeouts");
-			rtt /= 10;
+			/* even 700 msec may be too small */
+			rtt = 1000;
 			sq->status = serviced_query_PROBE_EDNS;
 		} else if(vs != -1) {
 			sq->status = serviced_query_UDP_EDNS;
@@ -1257,9 +1375,9 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 			sq->status = serviced_query_UDP; 
 		}
 	}
-	serviced_encode(sq, buff, sq->status == serviced_query_UDP_EDNS);
+	serviced_encode(sq, buff, (sq->status == serviced_query_UDP_EDNS) ||
+		(sq->status == serviced_query_UDP_EDNS_FRAG));
 	sq->last_sent_time = *sq->outnet->now_tv;
-	sq->last_rtt = rtt;
 	sq->edns_lame_known = (int)edns_lame_known;
 	verbose(VERB_ALGO, "serviced query UDP timeout=%d msec", rtt);
 	sq->pending = pending_udp_query(sq->outnet, buff, &sq->addr, 
@@ -1321,11 +1439,13 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 	int dobackup = (sq->cblist && sq->cblist->next); /* >1 cb*/
 	uint8_t *backup_p = NULL;
 	size_t backlen = 0;
-	rbnode_t* rem;
+#ifdef UNBOUND_DEBUG
+	rbnode_t* rem =
+#endif
 	/* remove from tree, and schedule for deletion, so that callbacks
 	 * can safely deregister themselves and even create new serviced
 	 * queries that are identical to this one. */
-	rem = rbtree_delete(sq->outnet->serviced, sq);
+	rbtree_delete(sq->outnet->serviced, sq);
 	log_assert(rem); /* should have been present */
 	sq->to_be_deleted = 1; 
 	verbose(VERB_ALGO, "svcd callbacks start");
@@ -1406,7 +1526,7 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 			&sq->addr, sq->addrlen);
 	if(error==NETEVENT_NOERROR)
 		infra_update_tcp_works(sq->outnet->infra, &sq->addr,
-			sq->addrlen);
+			sq->addrlen, sq->zone, sq->zonelen);
 	if(error==NETEVENT_NOERROR && sq->status == serviced_query_TCP_EDNS &&
 		(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
 		LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(ldns_buffer_begin(
@@ -1427,10 +1547,31 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 		/* only store noEDNS in cache if domain is noDNSSEC */
 		if(!sq->want_dnssec)
 		  if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
-			sq->addrlen, -1, *sq->outnet->now_secs))
+			sq->addrlen, sq->zone, sq->zonelen, -1,
+			*sq->outnet->now_secs))
 			log_err("Out of memory caching no edns for host");
 		sq->status = serviced_query_TCP;
 	}
+	if(sq->tcp_upstream || sq->ssl_upstream) {
+	    struct timeval now = *sq->outnet->now_tv;
+	    if(now.tv_sec > sq->last_sent_time.tv_sec ||
+		(now.tv_sec == sq->last_sent_time.tv_sec &&
+		now.tv_usec > sq->last_sent_time.tv_usec)) {
+		/* convert from microseconds to milliseconds */
+		int roundtime = ((int)now.tv_sec - (int)sq->last_sent_time.tv_sec)*1000
+		  + ((int)now.tv_usec - (int)sq->last_sent_time.tv_usec)/1000;
+		verbose(VERB_ALGO, "measured TCP-time at %d msec", roundtime);
+		log_assert(roundtime >= 0);
+		/* only store if less then AUTH_TIMEOUT seconds, it could be
+		 * huge due to system-hibernated and we woke up */
+		if(roundtime < TCP_AUTH_QUERY_TIMEOUT*1000) {
+		    if(!infra_rtt_update(sq->outnet->infra, &sq->addr,
+			sq->addrlen, sq->zone, sq->zonelen, roundtime,
+			sq->last_rtt, (uint32_t)now.tv_sec))
+			log_err("out of memory noting rtt.");
+		}
+	    }
+	}
 	/* insert address into reply info */
 	if(!rep) {
 		/* create one if there isn't (on errors) */
@@ -1450,9 +1591,10 @@ serviced_tcp_initiate(struct outside_network* outnet,
 	verbose(VERB_ALGO, "initiate TCP query %s", 
 		sq->status==serviced_query_TCP_EDNS?"EDNS":"");
 	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
+	sq->last_sent_time = *sq->outnet->now_tv;
 	sq->pending = pending_tcp_query(outnet, buff, &sq->addr,
 		sq->addrlen, TCP_AUTH_QUERY_TIMEOUT, serviced_tcp_callback, 
-		sq);
+		sq, sq->ssl_upstream);
 	if(!sq->pending) {
 		/* delete from tree so that a retry by above layer does not
 		 * clash with this entry */
@@ -1467,16 +1609,18 @@ serviced_tcp_send(struct serviced_query* sq, ldns_buffer* buff)
 {
 	int vs, rtt;
 	uint8_t edns_lame_known;
-	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, 
-		*sq->outnet->now_secs, &vs, &edns_lame_known, &rtt))
+	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, sq->zone,
+		sq->zonelen, *sq->outnet->now_secs, &vs, &edns_lame_known,
+		&rtt))
 		return 0;
 	if(vs != -1)
 		sq->status = serviced_query_TCP_EDNS;
 	else 	sq->status = serviced_query_TCP;
 	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
+	sq->last_sent_time = *sq->outnet->now_tv;
 	sq->pending = pending_tcp_query(sq->outnet, buff, &sq->addr,
 		sq->addrlen, TCP_AUTH_QUERY_TIMEOUT, serviced_tcp_callback, 
-		sq);
+		sq, sq->ssl_upstream);
 	return sq->pending != NULL;
 }
 
@@ -1498,9 +1642,24 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			 * by EDNS. */
 			sq->status = serviced_query_UDP_EDNS;
 		}
+		if(sq->status == serviced_query_UDP_EDNS && sq->last_rtt < 5000) {
+			/* fallback to 1480/1280 */
+			sq->status = serviced_query_UDP_EDNS_FRAG;
+			log_name_addr(VERB_ALGO, "try edns1xx0", sq->qbuf+10,
+				&sq->addr, sq->addrlen);
+			if(!serviced_udp_send(sq, c->buffer)) {
+				serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
+			}
+			return 0;
+		}
+		if(sq->status == serviced_query_UDP_EDNS_FRAG) {
+			/* fragmentation size did not fix it */
+			sq->status = serviced_query_UDP_EDNS;
+		}
 		sq->retry++;
 		if(!(rto=infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen,
-			-1, sq->last_rtt, (uint32_t)now.tv_sec)))
+			sq->zone, sq->zonelen, -1, sq->last_rtt,
+			(uint32_t)now.tv_sec)))
 			log_err("out of memory in UDP exponential backoff");
 		if(sq->retry < OUTBOUND_UDP_RETRY) {
 			log_name_addr(VERB_ALGO, "retry query", sq->qbuf+10,
@@ -1522,18 +1681,21 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		serviced_callbacks(sq, error, c, rep);
 		return 0;
 	}
-	if(sq->status == serviced_query_UDP_EDNS 
+	if(!fallback_tcp) {
+	    if( (sq->status == serviced_query_UDP_EDNS 
+	        ||sq->status == serviced_query_UDP_EDNS_FRAG)
 		&& (LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
 			== LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(
 			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL)) {
 		/* try to get an answer by falling back without EDNS */
+		verbose(VERB_ALGO, "serviced query: attempt without EDNS");
 		sq->status = serviced_query_UDP_EDNS_fallback;
 		sq->retry = 0;
 		if(!serviced_udp_send(sq, c->buffer)) {
 			serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
 		}
 		return 0;
-	} else if(sq->status == serviced_query_PROBE_EDNS) {
+	    } else if(sq->status == serviced_query_PROBE_EDNS) {
 		/* probe without EDNS succeeds, so we conclude that this
 		 * host likely has EDNS packets dropped */
 		log_addr(VERB_DETAIL, "timeouts, concluded that connection to "
@@ -1541,19 +1703,21 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		/* only store noEDNS in cache if domain is noDNSSEC */
 		if(!sq->want_dnssec)
 		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
-			-1, (uint32_t)now.tv_sec)) {
+			sq->zone, sq->zonelen, -1, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching no edns for host");
 		  }
 		sq->status = serviced_query_UDP;
-	} else if(sq->status == serviced_query_UDP_EDNS && 
+	    } else if(sq->status == serviced_query_UDP_EDNS && 
 		!sq->edns_lame_known) {
 		/* now we know that edns queries received answers store that */
+		log_addr(VERB_ALGO, "serviced query: EDNS works for",
+			&sq->addr, sq->addrlen);
 		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen, 
-			0, (uint32_t)now.tv_sec)) {
+			sq->zone, sq->zonelen, 0, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching edns works");
 		}
 		sq->edns_lame_known = 1;
-	} else if(sq->status == serviced_query_UDP_EDNS_fallback &&
+	    } else if(sq->status == serviced_query_UDP_EDNS_fallback &&
 		!sq->edns_lame_known && (LDNS_RCODE_WIRE(
 		ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR || 
 		LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
@@ -1562,14 +1726,21 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		/* the fallback produced a result that looks promising, note
 		 * that this server should be approached without EDNS */
 		/* only store noEDNS in cache if domain is noDNSSEC */
-		if(!sq->want_dnssec)
+		if(!sq->want_dnssec) {
+		  log_addr(VERB_ALGO, "serviced query: EDNS fails for",
+			&sq->addr, sq->addrlen);
 		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
-			-1, (uint32_t)now.tv_sec)) {
+			sq->zone, sq->zonelen, -1, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching no edns for host");
 		  }
+		} else {
+		  log_addr(VERB_ALGO, "serviced query: EDNS fails, but "
+		  	"not stored because need DNSSEC for", &sq->addr,
+			sq->addrlen);
+		}
 		sq->status = serviced_query_UDP;
-	}
-	if(now.tv_sec > sq->last_sent_time.tv_sec ||
+	    }
+	    if(now.tv_sec > sq->last_sent_time.tv_sec ||
 		(now.tv_sec == sq->last_sent_time.tv_sec &&
 		now.tv_usec > sq->last_sent_time.tv_usec)) {
 		/* convert from microseconds to milliseconds */
@@ -1577,16 +1748,23 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		  + ((int)now.tv_usec - (int)sq->last_sent_time.tv_usec)/1000;
 		verbose(VERB_ALGO, "measured roundtrip at %d msec", roundtime);
 		log_assert(roundtime >= 0);
-		if(!infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen, 
-			roundtime, sq->last_rtt, (uint32_t)now.tv_sec))
+		/* in case the system hibernated, do not enter a huge value,
+		 * above this value gives trouble with server selection */
+		if(roundtime < 60000) {
+		    if(!infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen, 
+			sq->zone, sq->zonelen, roundtime, sq->last_rtt,
+			(uint32_t)now.tv_sec))
 			log_err("out of memory noting rtt.");
-	}
+		}
+	    }
+	} /* end of if_!fallback_tcp */
 	/* perform TC flag check and TCP fallback after updating our
 	 * cache entries for EDNS status and RTT times */
 	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) || fallback_tcp) {
 		/* fallback to TCP */
 		/* this discards partial UDP contents */
 		if(sq->status == serviced_query_UDP_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_FRAG ||
 			sq->status == serviced_query_UDP_EDNS_fallback)
 			/* if we have unfinished EDNS_fallback, start again */
 			sq->status = serviced_query_TCP_EDNS;
@@ -1615,10 +1793,10 @@ callback_list_find(struct serviced_query* sq, void* cb_arg,
 struct serviced_query* 
 outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, int want_dnssec,
-	struct sockaddr_storage* addr, socklen_t addrlen, 
-	comm_point_callback_t* callback, void* callback_arg, 
-	ldns_buffer* buff, int (*arg_compare)(void*,void*))
+	uint16_t flags, int dnssec, int want_dnssec, int tcp_upstream,
+	int ssl_upstream, struct sockaddr_storage* addr, socklen_t addrlen,
+	uint8_t* zone, size_t zonelen, comm_point_callback_t* callback,
+	void* callback_arg, ldns_buffer* buff, int (*arg_compare)(void*,void*))
 {
 	struct serviced_query* sq;
 	struct service_callback* cb;
@@ -1635,13 +1813,14 @@ outnet_serviced_query(struct outside_network* outnet,
 	if(!sq) {
 		/* make new serviced query entry */
 		sq = serviced_create(outnet, buff, dnssec, want_dnssec,
-			addr, addrlen);
+			tcp_upstream, ssl_upstream, addr, addrlen, zone,
+			zonelen);
 		if(!sq) {
 			free(cb);
 			return NULL;
 		}
 		/* perform first network action */
-		if(outnet->do_udp) {
+		if(outnet->do_udp && !(tcp_upstream || ssl_upstream)) {
 			if(!serviced_udp_send(sq, buff)) {
 				(void)rbtree_delete(outnet->serviced, sq);
 				free(sq->qbuf);
@@ -1690,8 +1869,10 @@ void outnet_serviced_query_stop(struct serviced_query* sq, void* cb_arg)
 	callback_list_remove(sq, cb_arg);
 	/* if callbacks() routine scheduled deletion, let it do that */
 	if(!sq->cblist && !sq->to_be_deleted) {
-		rbnode_t* rem;
-		rem = rbtree_delete(sq->outnet->serviced, sq);
+#ifdef UNBOUND_DEBUG
+		rbnode_t* rem =
+#endif
+		rbtree_delete(sq->outnet->serviced, sq);
 		log_assert(rem); /* should be present */
 		serviced_delete(sq); 
 	}
@@ -1788,6 +1969,7 @@ serviced_get_mem(struct serviced_query* sq)
 	if(sq->status == serviced_query_UDP_EDNS ||
 		sq->status == serviced_query_UDP ||
 		sq->status == serviced_query_PROBE_EDNS ||
+		sq->status == serviced_query_UDP_EDNS_FRAG ||
 		sq->status == serviced_query_UDP_EDNS_fallback) {
 		s += sizeof(struct pending);
 		s += comm_timer_get_mem(NULL);

services/outside_network.h

@@ -118,6 +118,8 @@ struct outside_network {
 	struct infra_cache* infra;
 	/** where to get random numbers */
 	struct ub_randstate* rnd;
+	/** ssl context to create ssl wrapped TCP with DNS connections */
+	void* sslctx;
 
 	/**
 	 * Array of tcp pending used for outgoing TCP connections.
@@ -260,6 +262,8 @@ struct waiting_tcp {
 	comm_point_callback_t* cb;
 	/** callback user argument */
 	void* cb_arg;
+	/** if it uses ssl upstream */
+	int ssl_upstream;
 };
 
 /**
@@ -274,6 +278,11 @@ struct service_callback {
 	void* cb_arg;
 };
 
+/** fallback size for fragmentation for EDNS in IPv4 */
+#define EDNS_FRAG_SIZE_IP4 1480
+/** fallback size for EDNS in IPv6, fits one fragment with ip6-tunnel-ids */
+#define EDNS_FRAG_SIZE_IP6 1260
+
 /**
  * Query service record.
  * Contains query and destination. UDP, TCP, EDNS are all tried.
@@ -293,10 +302,16 @@ struct serviced_query {
 	int dnssec;
 	/** We want signatures, or else the answer is likely useless */
 	int want_dnssec;
+	/** tcp upstream used, use tcp, or ssl_upstream for SSL */
+	int tcp_upstream, ssl_upstream;
 	/** where to send it */
 	struct sockaddr_storage addr;
 	/** length of addr field in use. */
 	socklen_t addrlen;
+	/** zone name, uncompressed domain name in wireformat */
+	uint8_t* zone;
+	/** length of zone name */
+	size_t zonelen;
 	/** current status */
 	enum serviced_query_status {
 		/** initial status */
@@ -314,7 +329,9 @@ struct serviced_query {
 		/** probe to test noEDNS0 (EDNS gives FORMERRorNOTIMP) */
 		serviced_query_UDP_EDNS_fallback,
 		/** probe to test TCP noEDNS0 (EDNS gives FORMERRorNOTIMP) */
-		serviced_query_TCP_EDNS_fallback
+		serviced_query_TCP_EDNS_fallback,
+		/** send UDP query with EDNS1480 (or 1280) */
+		serviced_query_UDP_EDNS_FRAG
 	} 	
 		/** variable with current status */ 
 		status;
@@ -356,6 +373,7 @@ struct serviced_query {
  * @param unwanted_action: the action to take.
  * @param unwanted_param: user parameter to action.
  * @param do_udp: if udp is done.
+ * @param sslctx: context to create outgoing connections with (if enabled).
  * @return: the new structure (with no pending answers) or NULL on error.
  */
 struct outside_network* outside_network_create(struct comm_base* base,
@@ -363,7 +381,8 @@ struct outside_network* outside_network_create(struct comm_base* base,
 	int do_ip4, int do_ip6, size_t num_tcp, struct infra_cache* infra, 
 	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
 	int numavailports, size_t unwanted_threshold,
-	void (*unwanted_action)(void*), void* unwanted_param, int do_udp);
+	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
+	void* sslctx);
 
 /**
  * Delete outside_network structure.
@@ -406,12 +425,13 @@ struct pending* pending_udp_query(struct outside_network* outnet,
  *    without any query been sent to the server yet.
  * @param callback: function to call on error, timeout or reply.
  * @param callback_arg: user argument for callback function.
+ * @param ssl_upstream: if the tcp connection must use SSL.
  * @return: false on error for malloc or socket. Else the pending TCP object.
  */
 struct waiting_tcp* pending_tcp_query(struct outside_network* outnet, 
 	ldns_buffer* packet, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int timeout, comm_point_callback_t* callback, 
-	void* callback_arg);
+	void* callback_arg, int ssl_upstream);
 
 /**
  * Delete pending answer.
@@ -435,10 +455,16 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  *	If the value includes BIT_DO, DO bit is set when in EDNS queries.
  * @param want_dnssec: signatures are needed, without EDNS the answer is
  * 	likely to be useless.
+ * @param tcp_upstream: use TCP for upstream queries.
+ * @param ssl_upstream: use SSL for upstream queries.
  * @param callback: callback function.
  * @param callback_arg: user argument to callback function.
  * @param addr: to which server to send the query.
  * @param addrlen: length of addr.
+ * @param zone: name of the zone of the delegation point. wireformat dname.
+	This is the delegation point name for which the server is deemed
+	authoritative.
+ * @param zonelen: length of zone.
  * @param buff: scratch buffer to create query contents in. Empty on exit.
  * @param arg_compare: function to compare callback args, return true if 
  * 	identical. It is given the callback_arg and args that are listed.
@@ -447,10 +473,11 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  */
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, int want_dnssec,
-	struct sockaddr_storage* addr, socklen_t addrlen, 
-	comm_point_callback_t* callback, void* callback_arg, 
-	ldns_buffer* buff, int (*arg_compare)(void*,void*));
+	uint16_t flags, int dnssec, int want_dnssec, int tcp_upstream,
+	int ssl_upstream, struct sockaddr_storage* addr, socklen_t addrlen,
+	uint8_t* zone, size_t zonelen, comm_point_callback_t* callback,
+	void* callback_arg, ldns_buffer* buff,
+	int (*arg_compare)(void*,void*));
 
 /**
  * Remove service query callback.

smallapp/unbound-checkconf.c

@@ -318,7 +318,7 @@ morechecks(struct config_file* cfg, const char* fname)
 
 	if(cfg->verbosity < 0)
 		fatal_exit("verbosity value < 0");
-	if(cfg->num_threads < 0 || cfg->num_threads > 10000)
+	if(cfg->num_threads <= 0 || cfg->num_threads > 10000)
 		fatal_exit("num_threads value weird");
 	if(!cfg->do_ip4 && !cfg->do_ip6)
 		fatal_exit("ip4 and ip6 are both disabled, pointless");

smallapp/unbound-control-setup.sh

@@ -81,7 +81,7 @@ while test $# -ne 0; do
 	echo "	-d dir	use directory to store keys and certificates."
 	echo "		default: $DESTDIR"
 	echo "please run this command using the same user id that the "
-	echo "unboun daemon uses, it needs read privileges."
+	echo "unbound daemon uses, it needs read privileges."
 	exit 1
 	;;
 	esac

smallapp/unbound-control.c

@@ -96,6 +96,8 @@ usage()
 	printf("  flush_stats 			flush statistics, make zero\n");
 	printf("  flush_requestlist 		drop queries that are worked on\n");
 	printf("  dump_requestlist		show what is worked on\n");
+	printf("  flush_infra [all | ip] 	remove ping, edns for one IP or all\n");
+	printf("  dump_infra			show ping and edns entries\n");
 	printf("  set_option opt: val		set option to value, no reload\n");
 	printf("  get_option opt		get option value\n");
 	printf("  list_stubs			list stub-zones and root hints in use\n");
@@ -256,12 +258,13 @@ send_file(SSL* ssl, FILE* in, char* buf, size_t sz)
 static int
 go_cmd(SSL* ssl, int argc, char* argv[])
 {
-	const char* pre="UBCT";
+	char pre[10];
 	const char* space=" ";
 	const char* newline="\n";
 	int was_error = 0, first_line = 1;
 	int r, i;
 	char buf[1024];
+	snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
 	if(SSL_write(ssl, pre, (int)strlen(pre)) <= 0)
 		ssl_err("could not SSL_write");
 	for(i=0; i<argc; i++) {

smallapp/unbound-host.c

@@ -255,9 +255,10 @@ print_rd(int t, char* data, size_t len)
 	ldns_rr_set_owner(rr, NULL);
 	status = ldns_wire2rdf(rr, rd, len+2, &pos);
 	if(status != LDNS_STATUS_OK) {
-	
 		free(rd);
+		ldns_rr_free(rr);
 		printf("error_printing_data");
+		return;
 	}
 	for(i=0; i<ldns_rr_rd_count(rr); i++) {
 		printf(" ");

smallapp/worker_cb.c

@@ -100,15 +100,6 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 	log_assert(0);
 }
 
-int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
-	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
-{
-	log_assert(0);
-	return 0;
-}
-
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
@@ -140,15 +131,6 @@ worker_alloc_cleanup(void* ATTR_UNUSED(arg))
 	log_assert(0);
 }
 
-int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
-	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
-{
-	log_assert(0);
-	return 0;
-}
-
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 

testcode/asynclook.c

@@ -84,7 +84,7 @@ struct lookinfo {
 static int num_wait = 0;
 
 /** usage information for asynclook */
-void usage(char* argv[])
+static void usage(char* argv[])
 {
 	printf("usage: %s [options] name ...\n", argv[0]);
 	printf("names are looked up at the same time, asynchronously.\n");

testcode/checklocks.c

@@ -52,7 +52,7 @@
 #ifdef USE_THREAD_DEBUG
 
 /** How long to wait before lock attempt is a failure. */
-#define CHECK_LOCK_TIMEOUT 30 /* seconds */
+#define CHECK_LOCK_TIMEOUT 120 /* seconds */
 /** How long to wait before join attempt is a failure. */
 #define CHECK_JOIN_TIMEOUT 120 /* seconds */
 
@@ -68,7 +68,7 @@ int check_locking_order = 1;
 static pid_t check_lock_pid;
 
 /** print all possible debug info on the state of the system */
-static void total_debug_info();
+static void total_debug_info(void);
 
 /** print pretty lock error and exit */
 static void lock_error(struct checked_lock* lock, 
@@ -674,7 +674,7 @@ static void* checklock_main(void* arg)
 }
 
 /** init the main thread */
-void checklock_start()
+void checklock_start(void)
 {
 	if(!key_created) {
 		struct thr_check* thisthr = (struct thr_check*)calloc(1, 
@@ -692,7 +692,7 @@ void checklock_start()
 }
 
 /** stop checklocks */
-void checklock_stop()
+void checklock_stop(void)
 {
 	if(key_created) {
 		int i;
@@ -726,7 +726,7 @@ checklock_thrcreate(pthread_t* id, void* (*func)(void*), void* arg)
 
 /** count number of thread infos */
 static int
-count_thread_infos()
+count_thread_infos(void)
 {
 	int cnt = 0;
 	int i;
@@ -795,7 +795,7 @@ thread_debug_info(struct thr_check* thr)
 }
 
 static void
-total_debug_info()
+total_debug_info(void)
 {
 	int i;
 	log_info("checklocks: supervising %d threads.",

testcode/checklocks.h

@@ -206,12 +206,12 @@ size_t lock_get_mem(void* lock);
 /**
  * Initialise checklock. Sets up internal debug structures.
  */
-void checklock_start();
+void checklock_start(void);
 
 /**
  * Cleanup internal debug state.
  */
-void checklock_stop();
+void checklock_stop(void);
 
 /**
  * Init locks.

testcode/delayer.c

@@ -139,7 +139,7 @@ struct tcp_proxy {
 };
 
 /** usage information for delayer */
-void usage(char* argv[])
+static void usage(char* argv[])
 {
 	printf("usage: %s [options]\n", argv[0]);
 	printf("	-f addr : use addr, forward to that server, @port.\n");

testcode/do-tests.sh

@@ -1,19 +1,18 @@
 #!/usr/bin/env bash
+. testdata/common.sh
 
 NEED_SPLINT='00-lint.tpkg'
 NEED_DOXYGEN='01-doc.tpkg'
-NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg fwd_oneport.tpkg fwd_udptmout.tpkg fwd_waitudp.tpkg tcp_sigpipe.tpkg hostsfileosx.tpkg local_nodefault.tpkg fwd_zero.tpkg'
 NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
-NEED_CURL='06-ianaports.tpkg'
+NEED_CURL='06-ianaports.tpkg root_anchor.tpkg'
 NEED_WHOAMI='07-confroot.tpkg'
-NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg'
+NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg edns_cache.tpkg'
 NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
 
-# test if dig, wdiff and ldns-testns are available.
-if test ! -x "`which dig 2>&1`"; then echo No 'dig' in path; exit 1; fi
-if test ! -x "`which wdiff 2>&1`"; then echo No 'wdiff' in path; exit 1; fi
-if test ! -x "`which ldns-testns 2>&1`"; then echo No 'ldns-testns' in path; exit 1; fi
+# test if dig and ldns-testns are available.
+test_tool_avail "dig"
+test_tool_avail "ldns-testns"
 
 # test for ipv6, uses streamptcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
@@ -34,41 +33,13 @@ sh ../testcode/mini_tpkg.sh clean
 rm -f .perfstats.txt
 for test in `ls *.tpkg`; do
 	SKIP=0
-	if echo $NEED_SPLINT | grep $test >/dev/null; then
-		if test ! -x "`which splint`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_DOXYGEN | grep $test >/dev/null; then
-		if test ! -x "`which doxygen`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_CURL | grep $test >/dev/null; then
-		if test ! -x "`which curl`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_LDNS_TESTNS | grep $test >/dev/null; then
-		if test ! -x "`which ldns-testns`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_XXD | grep $test >/dev/null; then
-		if test ! -x "`which xxd`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_NC | grep $test >/dev/null; then
-		if test ! -x "`which nc`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_WHOAMI | grep $test >/dev/null; then
-		if test ! -x "`which whoami`"; then
-			SKIP=1;
-		fi
-	fi
+	skip_if_in_list $test "$NEED_SPLINT" "splint"
+	skip_if_in_list $test "$NEED_DOXYGEN" "doxygen"
+	skip_if_in_list $test "$NEED_CURL" "curl"
+	skip_if_in_list $test "$NEED_XXD" "xxd"
+	skip_if_in_list $test "$NEED_NC" "nc"
+	skip_if_in_list $test "$NEED_WHOAMI" "whoami"
+
 	if echo $NEED_IPV6 | grep $test >/dev/null; then
 		if test "$HAVE_IPV6" = no; then
 			SKIP=1;

testcode/fake_event.c

@@ -51,9 +51,11 @@
 #include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgencode.h"
+#include "util/data/dname.h"
 #include "util/config_file.h"
 #include "services/listen_dnsport.h"
 #include "services/outside_network.h"
+#include "services/cache/infra.h"
 #include "testcode/replay.h"
 #include "testcode/ldns-testpkts.h"
 #include "util/log.h"
@@ -97,7 +99,7 @@ fake_event_init(struct replay_scenario* scen)
 }
 
 void 
-fake_event_cleanup()
+fake_event_cleanup(void)
 {
 	replay_scenario_delete(saved_scenario);
 	saved_scenario = NULL;
@@ -134,6 +136,7 @@ repevt_string(enum replay_event_type t)
 	case repevt_error:	 return "ERROR";
 	case repevt_assign:	 return "ASSIGN";
 	case repevt_traffic:	 return "TRAFFIC";
+	case repevt_infra_rtt:	 return "INFRA_RTT";
 	default:		 return "UNKNOWN";
 	}
 }
@@ -226,7 +229,7 @@ pending_find_match(struct replay_runtime* runtime, struct entry** entry,
  * @param runtime: runtime.
  * @param entry: if true, the entry that matches is returned.
  * @param pend: if true, the outgoing message that matches is returned.
- * return: true if pending query matches the now event.
+ * @return: true if pending query matches the now event.
  */
 static int 
 pending_matches_range(struct replay_runtime* runtime, 
@@ -541,6 +544,24 @@ autotrust_check(struct replay_runtime* runtime, struct replay_moment* mom)
 	log_info("autotrust %s is OK", mom->autotrust_id);
 }
 
+/** Store RTT in infra cache */
+static void
+do_infra_rtt(struct replay_runtime* runtime)
+{
+	struct replay_moment* now = runtime->now;
+	int rto;
+	ldns_rdf* dp = ldns_dname_new_frm_str(now->variable);
+	if(!dp) fatal_exit("cannot parse %s", now->variable);
+	rto = infra_rtt_update(runtime->infra, &now->addr,
+		now->addrlen, ldns_rdf_data(dp), ldns_rdf_size(dp),
+		atoi(now->string), -1, runtime->now_secs);
+	log_addr(0, "INFRA_RTT for", &now->addr, now->addrlen);
+	log_info("INFRA_RTT(%s roundtrip %d): rto of %d", now->variable,
+		atoi(now->string), rto);
+	if(rto == 0) fatal_exit("infra_rtt_update failed");
+	ldns_rdf_deep_free(dp);
+}
+
 /**
  * Advance to the next moment.
  */
@@ -619,6 +640,10 @@ do_moment_and_advance(struct replay_runtime* runtime)
 	case repevt_traffic:
 		advance_moment(runtime);
 		break;
+	case repevt_infra_rtt:
+		do_infra_rtt(runtime);
+		advance_moment(runtime);
+		break;
 	default:
 		fatal_exit("testbound: unknown event type %d", 
 			runtime->now->evt_type);
@@ -683,7 +708,7 @@ run_scenario(struct replay_runtime* runtime)
 struct listen_dnsport* 
 listen_create(struct comm_base* base, struct listen_port* ATTR_UNUSED(ports),
 	size_t bufsize, int ATTR_UNUSED(tcp_accept_count),
-	comm_point_callback_t* cb, void* cb_arg)
+	void* ATTR_UNUSED(sslctx), comm_point_callback_t* cb, void* cb_arg)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)base;
 	struct listen_dnsport* l= calloc(1, sizeof(struct listen_dnsport));
@@ -847,18 +872,20 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	size_t ATTR_UNUSED(num_ports), char** ATTR_UNUSED(ifs), 
 	int ATTR_UNUSED(num_ifs), int ATTR_UNUSED(do_ip4), 
 	int ATTR_UNUSED(do_ip6), size_t ATTR_UNUSED(num_tcp), 
-	struct infra_cache* ATTR_UNUSED(infra),
+	struct infra_cache* infra,
 	struct ub_randstate* ATTR_UNUSED(rnd), 
 	int ATTR_UNUSED(use_caps_for_id), int* ATTR_UNUSED(availports),
 	int ATTR_UNUSED(numavailports), size_t ATTR_UNUSED(unwanted_threshold),
 	void (*unwanted_action)(void*), void* ATTR_UNUSED(unwanted_param),
-	int ATTR_UNUSED(do_udp))
+	int ATTR_UNUSED(do_udp), void* ATTR_UNUSED(sslctx))
 {
+	struct replay_runtime* runtime = (struct replay_runtime*)base;
 	struct outside_network* outnet =  calloc(1, 
 		sizeof(struct outside_network));
 	(void)unwanted_action;
 	if(!outnet)
 		return NULL;
+	runtime->infra = infra;
 	outnet->base = base;
 	outnet->udp_buff = ldns_buffer_new(bufsize);
 	if(!outnet->udp_buff)
@@ -935,7 +962,8 @@ pending_udp_query(struct outside_network* outnet, ldns_buffer* packet,
 struct waiting_tcp* 
 pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* callback, void* callback_arg)
+	comm_point_callback_t* callback, void* callback_arg,
+	int ATTR_UNUSED(ssl_upstream))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -987,20 +1015,24 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 	uint16_t flags, int dnssec, int ATTR_UNUSED(want_dnssec),
-	struct sockaddr_storage* addr, socklen_t addrlen, 
-	comm_point_callback_t* callback, void* callback_arg, 
-	ldns_buffer* ATTR_UNUSED(buff), int (*arg_compare)(void*,void*))
+	int ATTR_UNUSED(tcp_upstream), int ATTR_UNUSED(ssl_upstream),
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
+	size_t ATTR_UNUSED(zonelen), comm_point_callback_t* callback,
+	void* callback_arg, ldns_buffer* ATTR_UNUSED(buff),
+	int (*arg_compare)(void*,void*))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
 		sizeof(struct fake_pending));
+	char z[256];
 	ldns_status status;
 	(void)arg_compare;
 	log_assert(pend);
 	log_nametypeclass(VERB_OPS, "pending serviced query", 
 		qname, qtype, qclass);
-	verbose(VERB_OPS, "pending serviced query flags%s%s%s%s", 
-		(flags&BIT_RD)?" RD":"", (flags&BIT_CD)?" CD":"",
+	dname_str(zone, z);
+	verbose(VERB_OPS, "pending serviced query zone %s flags%s%s%s%s", 
+		z, (flags&BIT_RD)?" RD":"", (flags&BIT_CD)?" CD":"",
 		(flags&~(BIT_RD|BIT_CD))?" MORE":"", (dnssec)?" DO":"");
 
 	/* create packet with EDNS */
@@ -1099,14 +1131,6 @@ void listening_ports_free(struct listen_port* list)
 	free(list);
 }
 
-void listen_pushback(struct listen_dnsport* ATTR_UNUSED(listen))
-{
-}
-
-void listen_resume(struct listen_dnsport* ATTR_UNUSED(listen))
-{
-}
-
 struct comm_point* comm_point_create_local(struct comm_base* ATTR_UNUSED(base),
         int ATTR_UNUSED(fd), size_t ATTR_UNUSED(bufsize),
         comm_point_callback_t* ATTR_UNUSED(callback), 

testcode/fake_event.h

@@ -61,7 +61,7 @@ void fake_event_init(struct replay_scenario* scen);
 /**
  * Deinit fake event services.
  */
-void fake_event_cleanup();
+void fake_event_cleanup(void);
 
 /**
  * Get filename to store temporary config stuff. The pid is added. in /tmp.

testcode/harvest.c

@@ -72,7 +72,7 @@
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
-#include "ldns/ldns.h"
+#include <ldns/ldns.h>
 #include <signal.h>
 #include "libunbound/unbound.h"
 #ifdef HAVE_SYS_STAT_H

testcode/ldns-testpkts.c

@@ -258,8 +258,7 @@ static struct entry* new_entry()
  * @param buf: is the buffer to store the result in
  * @param offset: is the starting position in the result buffer
  * @param buf_len: is the length of buf.
- *
- * This function returns the length of the result
+ * @return This function returns the length of the result
  */
 static size_t
 hexstr2bin(char *hexstr, int len, uint8_t *buf, size_t offset, size_t buf_len)

testcode/mini_tpkg.sh

@@ -80,8 +80,9 @@ cd $dir
 mv $name.dir/* .
 
 # EXE
-echo "minitpkg exe $name"
 echo "minitpkg exe $name" > $result
+grep "Description:" $name.dsc >> $result 2>&1
+echo "DateRunStart: "`date "+%s" 2>/dev/null` >> $result
 if test -f $name.pre; then
 	echo "minitpkg exe $name.pre"
 	echo "minitpkg exe $name.pre" >> $result
@@ -113,6 +114,7 @@ if test -f $name.post; then
 		echo "Warning: $name.post did not exit successfully"
 	fi
 fi
+echo "DateRunEnd: "`date "+%s" 2>/dev/null` >> $result
 
 mv $result ..
 cd ..

testcode/perf.c

@@ -43,7 +43,7 @@
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
-#include "ldns/ldns.h"
+#include <ldns/ldns.h>
 #include <signal.h>
 #include "util/log.h"
 #include "util/locks.h"
@@ -492,13 +492,13 @@ qlist_parse_line(ldns_buffer* buf, char* p)
 	ldns_buffer_write_u16_at(buf, 0, 0); /* zero ID */
 	if(rec) LDNS_RD_SET(ldns_buffer_begin(buf));
 	if(edns) {
-		struct edns_data edns;
-		memset(&edns, 0, sizeof(edns));
-		edns.edns_present = 1;
-		edns.udp_size = EDNS_ADVERTISED_SIZE;
+		struct edns_data ed;
+		memset(&ed, 0, sizeof(ed));
+		ed.edns_present = 1;
+		ed.udp_size = EDNS_ADVERTISED_SIZE;
 		/* Set DO bit in all EDNS datagrams ... */
-		edns.bits = EDNS_DO;
-		attach_edns_record(buf, &edns);
+		ed.bits = EDNS_DO;
+		attach_edns_record(buf, &ed);
 	}
 	ldns_rdf_deep_free(rdf);
 	return 1;

testcode/petal.c

@@ -0,0 +1,618 @@
+/*
+ * petal.c - https daemon that is small and beautiful.
+ *
+ * Copyright (c) 2010, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * HTTP1.1/SSL server.
+ */
+
+#include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_OPENSSL_SSL_H
+#include <openssl/ssl.h>
+#endif
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <ctype.h>
+#include <signal.h>
+#if defined(UNBOUND_ALLOC_LITE) || defined(UNBOUND_ALLOC_STATS)
+#ifdef malloc
+#undef malloc
+#endif
+#ifdef free
+#undef free
+#endif
+#endif /* alloc lite or alloc stats */
+
+/** verbosity for this application */
+static int verb = 0;
+
+/** Give petal usage, and exit (1). */
+static void
+usage()
+{
+	printf("Usage:	petal [opts]\n");
+	printf("	https daemon serves files from ./'host'/filename\n");
+	printf("	(no hostname: from the 'default' directory)\n");
+	printf("-a addr		bind to this address, 127.0.0.1\n");
+	printf("-p port		port number, default 443\n");
+	printf("-k keyfile	SSL private key file (PEM), petal.key\n");
+	printf("-c certfile	SSL certificate file (PEM), petal.pem\n");
+	printf("-v		more verbose\n");
+	printf("-h		show this usage help\n");
+	printf("Version %s\n", PACKAGE_VERSION);
+	printf("BSD licensed, see LICENSE in source package for details.\n");
+	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+	exit(1);
+}
+
+/** fatal exit */
+static void print_exit(const char* str) {printf("error %s\n", str); exit(1);}
+/** print errno */
+static void log_errno(const char* str)
+{printf("error %s: %s\n", str, strerror(errno));}
+
+/** parse a text IP address into a sockaddr */
+static int
+parse_ip_addr(char* str, int port, struct sockaddr_storage* ret, socklen_t* l)
+{
+	socklen_t len = 0;
+	struct sockaddr_storage* addr = NULL;
+	struct sockaddr_in6 a6;
+	struct sockaddr_in a;
+	uint16_t p = (uint16_t)port;
+	int fam = 0;
+	memset(&a6, 0, sizeof(a6));
+	memset(&a, 0, sizeof(a));
+
+	if(inet_pton(AF_INET6, str, &a6.sin6_addr) > 0) {
+		/* it is an IPv6 */
+		fam = AF_INET6;
+		a6.sin6_family = AF_INET6;
+		a6.sin6_port = (in_port_t)htons(p);
+		addr = (struct sockaddr_storage*)&a6;
+		len = (socklen_t)sizeof(struct sockaddr_in6);
+	}
+	if(inet_pton(AF_INET, str, &a.sin_addr) > 0) {
+		/* it is an IPv4 */
+		fam = AF_INET;
+		a.sin_family = AF_INET;
+		a.sin_port = (in_port_t)htons(p);
+		addr = (struct sockaddr_storage*)&a;
+		len = (socklen_t)sizeof(struct sockaddr_in);
+	}
+	if(!len) print_exit("cannot parse addr");
+	*l = len;
+	memmove(ret, addr, len);
+	return fam;
+}
+
+/** close the fd */
+static void
+fd_close(int fd)
+{
+#ifndef USE_WINSOCK
+	close(fd);
+#else
+	closesocket(fd);
+#endif
+}
+
+/** 
+ * Read one line from SSL
+ * zero terminates.
+ * skips "\r\n" (but not copied to buf).
+ * @param ssl: the SSL connection to read from (blocking).
+ * @param buf: buffer to return line in.
+ * @param len: size of the buffer.
+ * @return 0 on error, 1 on success.
+ */
+static int
+read_ssl_line(SSL* ssl, char* buf, size_t len)
+{
+	size_t n = 0;
+	int r;
+	int endnl = 0;
+	while(1) {
+		if(n >= len) {
+			if(verb) printf("line too long\n");
+			return 0;
+		}
+		if((r = SSL_read(ssl, buf+n, 1)) <= 0) {
+			if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) {
+				/* EOF */
+				break;
+			}
+			if(verb) printf("could not SSL_read\n");
+			return 0;
+		}
+		if(endnl && buf[n] == '\n') {
+			break;
+		} else if(endnl) {
+			/* bad data */
+			if(verb) printf("error: stray linefeeds\n");
+			return 0;
+		} else if(buf[n] == '\r') {
+			/* skip \r, and also \n on the wire */
+			endnl = 1;
+			continue;
+		} else if(buf[n] == '\n') {
+			/* skip the \n, we are done */
+			break;
+		} else n++;
+	}
+	buf[n] = 0;
+	return 1;
+}
+
+/** process one http header */
+static int
+process_one_header(char* buf, char* file, size_t flen, char* host, size_t hlen,
+	int* vs)
+{
+	if(strncasecmp(buf, "GET ", 4) == 0) {
+		char* e = strstr(buf, " HTTP/1.1");
+		if(!e) e = strstr(buf, " http/1.1");
+		if(!e) {
+			e = strstr(buf, " HTTP/1.0");
+			if(!e) e = strstr(buf, " http/1.0");
+			if(!e) e = strrchr(buf, ' ');
+			if(!e) e = strrchr(buf, '\t');
+			if(e) *vs = 10;
+		}
+		if(e) *e = 0;
+		if(strlen(buf) < 4) return 0;
+		(void)strlcpy(file, buf+4, flen);
+	} else if(strncasecmp(buf, "Host: ", 6) == 0) {
+		(void)strlcpy(host, buf+6, hlen);
+	}
+	return 1;
+}
+
+/** read http headers and process them */
+static int
+read_http_headers(SSL* ssl, char* file, size_t flen, char* host, size_t hlen,
+	int* vs)
+{
+	char buf[1024];
+	file[0] = 0;
+	host[0] = 0;
+	while(read_ssl_line(ssl, buf, sizeof(buf))) {
+		if(verb>=2) printf("read: %s\n", buf);
+		if(buf[0] == 0)
+			return 1;
+		if(!process_one_header(buf, file, flen, host, hlen, vs))
+			return 0;
+	}
+	return 0;
+}
+
+/** setup SSL context */
+static SSL_CTX*
+setup_ctx(char* key, char* cert)
+{
+	SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method());
+	if(!ctx) print_exit("out of memory");
+	(void)SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
+	if(!SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM))
+		print_exit("cannot read cert");
+	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM))
+		print_exit("cannot read key");
+	if(!SSL_CTX_check_private_key(ctx))
+		print_exit("private key is not correct");
+	if(!SSL_CTX_load_verify_locations(ctx, cert, NULL))
+		print_exit("cannot load cert verify locations");
+	return ctx;
+}
+
+/** setup listening TCP */
+static int
+setup_fd(char* addr, int port)
+{
+	struct sockaddr_storage ad;
+	socklen_t len;
+	int fd;
+	int c = 1;
+	int fam = parse_ip_addr(addr, port, &ad, &len);
+	fd = socket(fam, SOCK_STREAM, 0);
+	if(fd == -1) {
+		log_errno("socket");
+		return -1;
+	}
+	if(setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
+		(void*)&c, (socklen_t) sizeof(int)) < 0) {
+		log_errno("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
+	}
+	if(bind(fd, (struct sockaddr*)&ad, len) == -1) {
+		log_errno("bind");
+		fd_close(fd);
+		return -1;
+	}
+	if(listen(fd, 5) == -1) {
+		log_errno("listen");
+		fd_close(fd);
+		return -1;
+	}
+	return fd;
+}
+
+/** setup SSL connection to the client */
+static SSL*
+setup_ssl(int s, SSL_CTX* ctx)
+{
+	SSL* ssl = SSL_new(ctx);
+	if(!ssl) return NULL;
+	SSL_set_accept_state(ssl);
+	(void)SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
+	if(!SSL_set_fd(ssl, s)) {
+		SSL_free(ssl);
+		return NULL;
+	}
+	return ssl;
+}
+
+/** check a file name for safety */
+static int
+file_name_is_safe(char* s)
+{
+	size_t l = strlen(s);
+	if(s[0] != '/')
+		return 0; /* must start with / */
+	if(strstr(s, "/../"))
+		return 0; /* no updirs in URL */
+	if(l>=3 && s[l-1]=='.' && s[l-2]=='.' && s[l-3]=='/')
+		return 0; /* ends with /.. */
+	return 1;
+}
+
+/** adjust host and filename */
+static void
+adjust_host_file(char* host, char* file)
+{
+	size_t i, len;
+	/* remove a port number if present */
+	if(strrchr(host, ':'))
+		*strrchr(host, ':') = 0;
+	/* lowercase */
+	len = strlen(host);
+	for(i=0; i<len; i++)
+		host[i] = tolower((unsigned char)host[i]);
+	len = strlen(file);
+	for(i=0; i<len; i++)
+		file[i] = tolower((unsigned char)file[i]);
+}
+
+/** check a host name for safety */
+static int
+host_name_is_safe(char* s)
+{
+	if(strchr(s, '/'))
+		return 0;
+	if(strcmp(s, "..") == 0)
+		return 0;
+	if(strcmp(s, ".") == 0)
+		return 0;
+	return 1;
+}
+
+/** provide file in whole transfer */
+static void
+provide_file_10(SSL* ssl, char* fname)
+{
+	char* buf, *at;
+	size_t len, avail, header_reserve=1024;
+	FILE* in = fopen(fname, 
+#ifndef USE_WINSOCK
+		"r"
+#else
+		"rb"
+#endif
+		);
+	int r;
+	const char* rcode = "200 OK";
+	if(!in) {
+		char hdr[1024];
+		rcode = "404 File not found";
+		r = snprintf(hdr, sizeof(hdr), "HTTP/1.1 %s\r\n\r\n", rcode);
+		if(SSL_write(ssl, hdr, r) <= 0) {
+			/* write failure */
+		}
+		return;
+	}
+	fseek(in, 0, SEEK_END);
+	len = (size_t)ftell(in);
+	fseek(in, 0, SEEK_SET);
+	/* plus some space for the header */
+	buf = (char*)malloc(len+header_reserve);
+	if(!buf) {
+		fclose(in);
+		return;
+	}
+	avail = len+header_reserve;
+	at = buf;
+	r = snprintf(at, avail, "HTTP/1.1 %s\r\n", rcode);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Server: petal/%s\r\n", PACKAGE_VERSION);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Content-Length: %u\r\n", (unsigned)len);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "\r\n");
+	at += r;
+	avail -= r;
+	if(avail < len) { /* robust */
+		free(buf);
+		fclose(in);
+		return;
+	}
+	if(fread(at, 1, len, in) != len) {
+		free(buf);
+		fclose(in);
+		return;
+	}
+	fclose(in);
+	at += len;
+	avail -= len;
+	if(SSL_write(ssl, buf, at-buf) <= 0) {
+		/* write failure */
+	}
+	free(buf);
+}
+
+/** provide file over SSL, chunked encoding */
+static void
+provide_file_chunked(SSL* ssl, char* fname)
+{
+	char buf[16384];
+	char* at = buf;
+	size_t avail = sizeof(buf);
+	int r;
+	FILE* in = fopen(fname, 
+#ifndef USE_WINSOCK
+		"r"
+#else
+		"rb"
+#endif
+		);
+	const char* rcode = "200 OK";
+	if(!in) {
+		rcode = "404 File not found";
+	}
+
+	/* print headers */
+	r = snprintf(at, avail, "HTTP/1.1 %s\r\n", rcode);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Server: petal/%s\r\n", PACKAGE_VERSION);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Transfer-Encoding: chunked\r\n");
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Connection: close\r\n");
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "\r\n");
+	at += r;
+	avail -= r;
+	if(avail < 16) { /* robust */
+		if(in) fclose(in);
+		return;
+	}
+
+	do {
+		char tmpbuf[sizeof(buf)];
+		/* read chunk; space-16 for xxxxCRLF..CRLF0CRLFCRLF (3 spare)*/
+		size_t red = in?fread(tmpbuf, 1, avail-16, in):0;
+		/* prepare chunk */
+		r = snprintf(at, avail, "%x\r\n", (unsigned)red);
+		if(verb >= 3)
+		{printf("chunk len %x\n", (unsigned)red); fflush(stdout);}
+		at += r;
+		avail -= r;
+		if(red != 0) {
+			if(red > avail) break; /* robust */
+			memmove(at, tmpbuf, red);
+			at += red;
+			avail -= red;
+			r = snprintf(at, avail, "\r\n");
+			at += r;
+			avail -= r;
+		}
+		if(in && feof(in) && red != 0) {
+			r = snprintf(at, avail, "0\r\n");
+			at += r;
+			avail -= r;
+		}
+		if(!in || feof(in)) {
+			r = snprintf(at, avail, "\r\n");
+			at += r;
+			avail -= r;
+		}
+		/* send chunk */
+		if(SSL_write(ssl, buf, at-buf) <= 0) {
+			/* SSL error */
+			break;
+		}
+
+		/* setup for next chunk */
+		at = buf;
+		avail = sizeof(buf);
+	} while(in && !feof(in) && !ferror(in));
+
+	if(in) fclose(in);
+}
+
+/** provide service to the ssl descriptor */
+static void
+service_ssl(SSL* ssl, struct sockaddr_storage* from, socklen_t falen)
+{
+	char file[1024];
+	char host[1024];
+	char combined[2048];
+	int vs = 11;
+	if(!read_http_headers(ssl, file, sizeof(file), host, sizeof(host),
+		&vs))
+		return;
+	adjust_host_file(host, file);
+	if(host[0] == 0 || !host_name_is_safe(host))
+		(void)strlcpy(host, "default", sizeof(host));
+	if(!file_name_is_safe(file)) {
+		return;
+	}
+	snprintf(combined, sizeof(combined), "%s%s", host, file);
+	if(verb) {
+		char out[100];
+		void* a = &((struct sockaddr_in*)from)->sin_addr;
+		if(falen != (socklen_t)sizeof(struct sockaddr_in))
+			a = &((struct sockaddr_in6*)from)->sin6_addr;
+		out[0]=0;
+		(void)inet_ntop((int)((struct sockaddr_in*)from)->sin_family,
+			a, out, (socklen_t)sizeof(out));
+		printf("%s requests %s\n", out, combined);
+		fflush(stdout);
+	}
+	if(vs == 10)
+		provide_file_10(ssl, combined);
+	else	provide_file_chunked(ssl, combined);
+}
+
+/** provide ssl service */
+static void
+do_service(char* addr, int port, char* key, char* cert)
+{
+	SSL_CTX* sslctx = setup_ctx(key, cert);
+	int fd = setup_fd(addr, port);
+	int go = 1;
+	if(fd == -1) print_exit("could not setup sockets");
+	if(verb) {printf("petal start\n"); fflush(stdout);}
+	while(go) {
+		struct sockaddr_storage from;
+		socklen_t flen = (socklen_t)sizeof(from);
+		int s = accept(fd, (struct sockaddr*)&from, &flen);
+		if(verb) fflush(stdout);
+		if(s != -1) {
+			SSL* ssl = setup_ssl(s, sslctx);
+			if(verb) fflush(stdout);
+			if(ssl) {
+				service_ssl(ssl, &from, flen);
+				if(verb) fflush(stdout);
+				SSL_shutdown(ssl);
+				SSL_free(ssl);
+			}
+			fd_close(s);
+		} else if (verb >=2) log_errno("accept");
+		if(verb) fflush(stdout);
+	}
+	/* if we get a kill signal, the process dies and the OS reaps us */
+	if(verb) printf("petal end\n");
+	fd_close(fd);
+	SSL_CTX_free(sslctx);
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** Main routine for petal */
+int main(int argc, char* argv[])
+{
+	int c;
+	int port = 443;
+	char* addr = "127.0.0.1", *key = "petal.key", *cert = "petal.pem";
+#ifdef USE_WINSOCK
+	WSADATA wsa_data;
+	if((c=WSAStartup(MAKEWORD(2,2), &wsa_data)) != 0)
+	{	printf("WSAStartup failed\n"); exit(1); }
+	atexit((void (*)(void))WSACleanup);
+#endif
+
+	/* parse the options */
+	while( (c=getopt(argc, argv, "a:c:k:hp:v")) != -1) {
+		switch(c) {
+		case 'a':
+			addr = optarg;
+			break;
+		case 'c':
+			cert = optarg;
+			break;
+		case 'k':
+			key = optarg;
+			break;
+		case 'p':
+			port = atoi(optarg);
+			break;
+		case 'v':
+			verb++;
+			break;
+		case '?':
+		case 'h':
+		default:
+			usage();
+		}
+	}
+	argc -= optind;
+	argv += optind;
+	if(argc != 0)
+		usage();
+
+#ifdef SIGPIPE
+	(void)signal(SIGPIPE, SIG_IGN);
+#endif
+	ERR_load_crypto_strings();
+	ERR_load_SSL_strings();
+	OpenSSL_add_all_algorithms();
+	(void)SSL_library_init();
+
+	do_service(addr, port, key, cert);
+
+	CRYPTO_cleanup_all_ex_data();
+	ERR_remove_state(0);
+	ERR_free_strings();
+	RAND_cleanup();
+	return 0;
+}

testcode/pktview.c

@@ -40,7 +40,7 @@
  */
 
 #include "config.h"
-#include "ldns/ldns.h"
+#include <ldns/ldns.h>
 #include "util/log.h"
 #include "util/data/dname.h"
 #include "util/data/msgparse.h"
@@ -48,7 +48,7 @@
 #include "testcode/readhex.h"
 
 /** usage information for pktview */
-void usage(char* argv[])
+static void usage(char* argv[])
 {
 	printf("usage: %s\n", argv[0]);
 	printf("present hex packet on stdin.\n");
@@ -56,7 +56,7 @@ void usage(char* argv[])
 }
 
 /** read hex input */
-void read_input(ldns_buffer* pkt, FILE* in)
+static void read_input(ldns_buffer* pkt, FILE* in)
 {
 	char buf[102400];
 	char* np = buf;
@@ -69,7 +69,7 @@ void read_input(ldns_buffer* pkt, FILE* in)
 }
 
 /** analyze domain name in packet, possibly compressed */
-void analyze_dname(ldns_buffer* pkt)
+static void analyze_dname(ldns_buffer* pkt)
 {
 	size_t oldpos = ldns_buffer_position(pkt);
 	size_t len;
@@ -84,7 +84,7 @@ void analyze_dname(ldns_buffer* pkt)
 }
 
 /** analyze rdata in packet */
-void analyze_rdata(ldns_buffer*pkt, const ldns_rr_descriptor* desc, 
+static void analyze_rdata(ldns_buffer*pkt, const ldns_rr_descriptor* desc, 
 	uint16_t rdlen)
 {
 	int rdf = 0;
@@ -124,7 +124,7 @@ void analyze_rdata(ldns_buffer*pkt, const ldns_rr_descriptor* desc,
 }
 
 /** analyze rr in packet */
-void analyze_rr(ldns_buffer* pkt, int q)
+static void analyze_rr(ldns_buffer* pkt, int q)
 {
 	uint16_t type, dclass, len;
 	uint32_t ttl;
@@ -150,7 +150,7 @@ void analyze_rr(ldns_buffer* pkt, int q)
 }
 
 /** analyse pkt */
-void analyze(ldns_buffer* pkt)
+static void analyze(ldns_buffer* pkt)
 {
 	uint16_t i, f, qd, an, ns, ar;
 	int rrnum = 0;

testcode/readhex.h

@@ -40,7 +40,7 @@
 
 #ifndef TESTCODE_READHEX_H
 #define TESTCODE_READHEX_H
-#include "ldns/buffer.h"
+#include <ldns/buffer.h>
 
 /** 
  * Helper to convert hex string to packet buffer.

testcode/replay.c

@@ -330,6 +330,32 @@ replay_moment_read(char* remain, FILE* in, const char* name, int* lineno,
 	} else if(parse_keyword(&remain, "ASSIGN")) {
 		mom->evt_type = repevt_assign;
 		read_assign_step(remain, mom);
+	} else if(parse_keyword(&remain, "INFRA_RTT")) {
+		char *s, *m;
+		mom->evt_type = repevt_infra_rtt;
+		while(isspace((int)*remain))
+			remain++;
+		s = remain;
+		remain = strchr(s, ' ');
+		if(!remain) fatal_exit("expected three args for INFRA_RTT");
+		remain[0] = 0;
+		remain++;
+		while(isspace((int)*remain))
+			remain++;
+		m = strchr(remain, ' ');
+		if(!m) fatal_exit("expected three args for INFRA_RTT");
+		m[0] = 0;
+		m++;
+		while(isspace((int)*m))
+			m++;
+		if(!extstrtoaddr(s, &mom->addr, &mom->addrlen))
+			fatal_exit("bad infra_rtt address %s", s);
+		if(strlen(m)>0 && m[strlen(m)-1]=='\n')
+			m[strlen(m)-1] = 0;
+		mom->variable = strdup(remain);
+		mom->string = strdup(m);
+		if(!mom->string) fatal_exit("out of memory");
+		if(!mom->variable) fatal_exit("out of memory");
 	} else {
 		log_err("%d: unknown event type %s", *lineno, remain);
 		free(mom);
@@ -606,7 +632,7 @@ do_macro_recursion(rbtree_t* store, struct replay_runtime* runtime,
 }
 
 /** get var from store */
-struct replay_var*
+static struct replay_var*
 macro_getvar(rbtree_t* store, char* name)
 {
 	struct replay_var k;
@@ -950,17 +976,17 @@ void testbound_selftest(void)
 	free(v);
 
 	v = macro_process(store, NULL, "it is ${ctime 123456}");
-	log_assert( v && strcmp(v, "it is Fri Jan  2 11:17:36 1970") == 0);
+	log_assert( v && strcmp(v, "it is Fri Jan  2 10:17:36 1970") == 0);
 	free(v);
 
 	r = macro_assign(store, "t1", "123456");
 	log_assert(r);
 	v = macro_process(store, NULL, "it is ${ctime ${$t1}}");
-	log_assert( v && strcmp(v, "it is Fri Jan  2 11:17:36 1970") == 0);
+	log_assert( v && strcmp(v, "it is Fri Jan  2 10:17:36 1970") == 0);
 	free(v);
 
 	v = macro_process(store, NULL, "it is ${ctime $t1}");
-	log_assert( v && strcmp(v, "it is Fri Jan  2 11:17:36 1970") == 0);
+	log_assert( v && strcmp(v, "it is Fri Jan  2 10:17:36 1970") == 0);
 	free(v);
 
 	r = macro_assign(store, "x", "1");

testcode/replay.h

@@ -75,6 +75,7 @@
  *		the step waits for traffic to stop.
  *      o CHECK_AUTOTRUST [id] - followed by FILE_BEGIN [to match] FILE_END.
  *      	The file contents is macro expanded before match.
+ *      o INFRA_RTT [ip] [dp] [rtt] - update infra cache entry with rtt.
  *      o ERROR
  * ; following entry starts on the next line, ENTRY_BEGIN.
  * ; more STEP items
@@ -136,6 +137,7 @@ struct replay_range;
 struct fake_pending;
 struct fake_timer;
 struct replay_var;
+struct infra_cache;
 
 /**
  * A replay scenario.
@@ -196,9 +198,11 @@ struct replay_moment {
 		repevt_error,
 		/** assignment to a variable */
 		repevt_assign,
+		/** store infra rtt cache entry: addr and string (int) */
+		repevt_infra_rtt,
 		/** cause traffic to flow */
 		repevt_traffic
-	} 
+	}
 		/** variable with what is to happen this moment */
 		evt_type;
 
@@ -285,6 +289,9 @@ struct replay_runtime {
 	/** user argument for incoming query callback */
 	void *cb_arg;
 
+	/** ref the infra cache (was passed to outside_network_create) */
+	struct infra_cache* infra;
+
 	/** the current time in seconds */
 	uint32_t now_secs;
 	/** the current time in microseconds */

testcode/signit.c

@@ -40,7 +40,7 @@
  * construct input to test the validator with.
  */
 #include "config.h"
-#include "ldns/ldns.h"
+#include <ldns/ldns.h>
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/net_help.h"