for 0.7.2: fixup building in subdir.

git-svn-id: file:///svn/unbound/branches/beta-0.7@797 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -1,17 +1,9 @@
 # Copyright 2007 NLnet Labs
 # See the file LICENSE for the license
+# 
+# Standard installation pathnames
 
-debug_enabled=@debug_enabled@
-ifeq "$(QUIET)" ""
-ifeq ($(debug_enabled),yes)
-  QUIET=yes
-  LIBTOOLQUIET=yes
-else
-  QUIET=no
-  LIBTOOLQUIET=yes
-endif
-endif
-
+QUIET=yes
 ifeq "$(QUIET)" "yes"
   Q=@
   INFO=@echo
@@ -26,7 +18,6 @@ srcdir=@srcdir@
 prefix=@prefix@
 exec_prefix=@exec_prefix@
 bindir=@bindir@
-sbindir=@sbindir@
 mandir=@mandir@
 libdir=@libdir@
 # datarootdir is here to please some checkers, use datadir.
@@ -37,317 +28,164 @@ doxygen=@doxygen@
 libtool=@libtool@
 ldnsdir=@ldnsdir@
 staticexe=@staticexe@
-EXEEXT=@EXEEXT@
 configfile=@ub_conf_file@
-UNBOUND_RUN_DIR=@UNBOUND_RUN_DIR@
-CHECKLOCK_SRC=@CHECKLOCK_SRC@
-UB_ON_WINDOWS=@UB_ON_WINDOWS@
-WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
-WITH_PYUNBOUND=@WITH_PYUNBOUND@
-PYTHON_SITE_PKG=@PYTHON_SITE_PKG@
 
-SWIG=@SWIG@
 YACC=@YACC@
 LEX=@LEX@
-STRIP=@STRIP@
 CC=@CC@
-CPPFLAGS=-I. @CPPFLAGS@
-ifneq "$(srcdir)" "."
-  CPPFLAGS:=-I$(srcdir) $(CPPFLAGS)
-endif
-CPPFLAGS:=$(strip $(CPPFLAGS))
+CPPFLAGS=-I$(srcdir) -I. @CPPFLAGS@ @DEFS@
 CFLAGS=@CFLAGS@
 LDFLAGS=@LDFLAGS@
-LIBS=$(strip @LIBS@)
+LIBS=@LIBS@
 LIBOBJS=@LIBOBJS@
 RUNTIME_PATH=@RUNTIME_PATH@
-DEPFLAG=@DEPFLAG@
 DATE=$(shell date +%Y%m%d)
 LIBTOOL=$(libtool)
-ifeq "$(LIBTOOLQUIET)" "yes"
+ifeq "$(QUIET)" "yes"
   LIBTOOL+=--quiet
 endif
 BUILD=build/
 
-WINDRES=@WINDRES@
 LINT=splint
-LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -Dglob64=glob -Dglobfree64=globfree
+LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list
 # compat with openssl linux edition.
-LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray -D"ENGINE=unsigned" -D"RSA=unsigned" -D"DSA=unsigned" -D"EVP_PKEY=unsigned" -D"EVP_MD=unsigned" -D"SSL=unsigned" -D"SSL_CTX=unsigned" -D"X509=unsigned" -D"RC4_KEY=unsigned" -D"EVP_MD_CTX=unsigned"
-# compat with NetBSD
-ifeq "$(shell uname)" "NetBSD"
-LINTFLAGS+="-D__RENAME(x)=" -D_NETINET_IN_H_
-endif
-# compat with OpenBSD
-LINTFLAGS+="-Dsigset_t=long"
-# FreeBSD8
-LINTFLAGS+="-D__uint16_t=uint16_t"
+LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned
 
 INSTALL=$(srcdir)/install-sh
-ifeq "$(WITH_PYTHONMODULE)" "yes"
-PYTHONMOD_SRC=$(srcdir)/pythonmod/*.c
-endif
 
 COMMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/services/*.c \
 	$(srcdir)/services/cache/*.c $(srcdir)/util/*.c \
 	$(srcdir)/util/data/*.c $(srcdir)/util/storage/*.c \
-	$(srcdir)/iterator/*.c $(srcdir)/validator/*.c $(PYTHONMOD_SRC))) \
-	util/configparser.c util/configlexer.c $(CHECKLOCK_SRC)
-COMMON_OBJ=$(addprefix $(BUILD),$(COMMON_SRC:.c=.lo))
-COMPAT_SRC=$(addprefix compat/,$(LIBOBJS:.o=.c))
-COMPAT_OBJ=$(addprefix $(BUILD)compat/,$(LIBOBJS:.o=.lo))
+	$(srcdir)/iterator/*.c $(srcdir)/validator/*.c)) \
+	util/configparser.c util/configlexer.c testcode/checklocks.c
+COMMON_OBJ=$(addprefix $(BUILD),$(COMMON_SRC:.c=.o))
+COMPAT_OBJ=$(addprefix $(BUILD)compat/,$(LIBOBJS))
 UNITTEST_SRC=$(patsubst $(srcdir)/%,%, \
 	$(wildcard $(srcdir)/testcode/unit*.c)) \
-	testcode/readhex.c testcode/ldns-testpkts.c smallapp/worker_cb.c \
+	testcode/readhex.c testcode/ldns-testpkts.c checkconf/worker_cb.c \
 	$(COMMON_SRC)
-UNITTEST_OBJ=$(addprefix $(BUILD),$(UNITTEST_SRC:.c=.lo)) $(COMPAT_OBJ)
+UNITTEST_OBJ=$(addprefix $(BUILD),$(UNITTEST_SRC:.c=.o)) $(COMPAT_OBJ)
 DAEMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/daemon/*.c)) \
 	$(COMMON_SRC)
-DAEMON_OBJ=$(addprefix $(BUILD),$(DAEMON_SRC:.c=.lo)) $(COMPAT_OBJ)
-CHECKCONF_SRC=smallapp/unbound-checkconf.c smallapp/worker_cb.c $(COMMON_SRC)
-CHECKCONF_OBJ=$(addprefix $(BUILD),$(CHECKCONF_SRC:.c=.lo)) $(COMPAT_OBJ)
-CONTROL_SRC=smallapp/unbound-control.c smallapp/worker_cb.c $(COMMON_SRC)
-CONTROL_OBJ=$(addprefix $(BUILD),$(CONTROL_SRC:.c=.lo)) $(COMPAT_OBJ)
-HOST_SRC=smallapp/unbound-host.c
-HOST_OBJ=$(addprefix $(BUILD),$(HOST_SRC:.c=.lo)) $(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
+DAEMON_OBJ=$(addprefix $(BUILD),$(DAEMON_SRC:.c=.o)) $(COMPAT_OBJ)
+CHECKCONF_SRC=checkconf/unbound-checkconf.c checkconf/worker_cb.c $(COMMON_SRC)
+CHECKCONF_OBJ=$(addprefix $(BUILD),$(CHECKCONF_SRC:.c=.o)) $(COMPAT_OBJ)
 TESTBOUND_SRC=testcode/testbound.c testcode/ldns-testpkts.c \
-	daemon/worker.c daemon/acl_list.c daemon/daemon.c daemon/stats.c \
-	testcode/replay.c testcode/fake_event.c $(filter-out util/netevent.c \
+	daemon/worker.c daemon/daemon.c daemon/stats.c testcode/replay.c \
+	testcode/fake_event.c $(filter-out util/netevent.c \
 	services/listen_dnsport.c services/outside_network.c, $(COMMON_SRC))
-TESTBOUND_OBJ=$(addprefix $(BUILD),$(TESTBOUND_SRC:.c=.lo)) $(COMPAT_OBJ)
-LOCKVERIFY_SRC=testcode/lock_verify.c smallapp/worker_cb.c $(COMMON_SRC)
-LOCKVERIFY_OBJ=$(addprefix $(BUILD),$(LOCKVERIFY_SRC:.c=.lo)) $(COMPAT_OBJ)
-PKTVIEW_SRC=testcode/pktview.c testcode/readhex.c smallapp/worker_cb.c \
+TESTBOUND_OBJ=$(addprefix $(BUILD),$(TESTBOUND_SRC:.c=.o)) $(COMPAT_OBJ)
+LOCKVERIFY_SRC=testcode/lock_verify.c checkconf/worker_cb.c $(COMMON_SRC)
+LOCKVERIFY_OBJ=$(addprefix $(BUILD),$(LOCKVERIFY_SRC:.c=.o)) $(COMPAT_OBJ)
+PKTVIEW_SRC=testcode/pktview.c testcode/readhex.c checkconf/worker_cb.c \
 	$(COMMON_SRC)
-PKTVIEW_OBJ=$(addprefix $(BUILD),$(PKTVIEW_SRC:.c=.lo)) $(COMPAT_OBJ)
-SIGNIT_SRC=testcode/signit.c smallapp/worker_cb.c $(COMMON_SRC)
-SIGNIT_OBJ=$(addprefix $(BUILD),$(SIGNIT_SRC:.c=.lo)) $(COMPAT_OBJ)
-MEMSTATS_SRC=testcode/memstats.c smallapp/worker_cb.c $(COMMON_SRC)
-MEMSTATS_OBJ=$(addprefix $(BUILD),$(MEMSTATS_SRC:.c=.lo)) $(COMPAT_OBJ)
-ASYNCLOOK_SRC=testcode/asynclook.c util/log.c util/locks.c
-ASYNCLOOK_OBJ=$(addprefix $(BUILD),$(ASYNCLOOK_SRC:.c=.lo)) $(COMPAT_OBJ)
-STREAMTCP_SRC=testcode/streamtcp.c smallapp/worker_cb.c $(COMMON_SRC)
-STREAMTCP_OBJ=$(addprefix $(BUILD),$(STREAMTCP_SRC:.c=.lo)) $(COMPAT_OBJ)
-PERF_SRC=testcode/perf.c smallapp/worker_cb.c $(COMMON_SRC)
-PERF_OBJ=$(addprefix $(BUILD),$(PERF_SRC:.c=.lo)) $(COMPAT_OBJ)
-DELAYER_SRC=testcode/delayer.c smallapp/worker_cb.c $(COMMON_SRC)
-DELAYER_OBJ=$(addprefix $(BUILD),$(DELAYER_SRC:.c=.lo)) $(COMPAT_OBJ)
-HARVEST_SRC=testcode/harvest.c
-HARVEST_OBJ=$(addprefix $(BUILD),$(HARVEST_SRC:.c=.lo)) $(COMPAT_OBJ)
-LIBUNBOUND_SRC=$(patsubst $(srcdir)/%,%, \
-	$(wildcard $(srcdir)/libunbound/*.c) $(COMMON_SRC))
-LIBUNBOUND_OBJ=$(addprefix $(BUILD),$(LIBUNBOUND_SRC:.c=.lo)) $(COMPAT_OBJ)
-ALL_SRC=$(sort $(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
+PKTVIEW_OBJ=$(addprefix $(BUILD),$(PKTVIEW_SRC:.c=.o)) $(COMPAT_OBJ)
+SIGNIT_SRC=testcode/signit.c checkconf/worker_cb.c $(COMMON_SRC)
+SIGNIT_OBJ=$(addprefix $(BUILD),$(SIGNIT_SRC:.c=.o)) $(COMPAT_OBJ)
+MEMSTATS_SRC=testcode/memstats.c checkconf/worker_cb.c $(COMMON_SRC)
+MEMSTATS_OBJ=$(addprefix $(BUILD),$(MEMSTATS_SRC:.c=.o)) $(COMPAT_OBJ)
+ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
 	$(TESTBOUND_SRC) $(LOCKVERIFY_SRC) $(PKTVIEW_SRC) $(SIGNIT_SRC) \
-	$(MEMSTATS_SRC) $(CHECKCONF_SRC) $(LIBUNBOUND_SRC) $(HOST_SRC) \
-	$(ASYNCLOOK_SRC) $(STREAMTCP_SRC) $(PERF_SRC) $(DELAYER_SRC) \
-	$(HARVEST_SRC) $(CONTROL_SRC))
-ALL_OBJ=$(addprefix $(BUILD),$(ALL_SRC:.c=.lo) \
-	$(addprefix compat/,$(LIBOBJS:.o=.lo))) $(COMPAT_OBJ)
-
-ifeq "$(UB_ON_WINDOWS)" "yes"
-  DAEMON_SRC+=winrc/win_svc.c winrc/w_inst.c
-  DAEMON_OBJ+=$(BUILD)winrc/rsrc_unbound.o $(BUILD)winrc/win_svc.lo
-  HOST_OBJ+=$(BUILD)winrc/rsrc_unbound_host.o
-  CONTROL_OBJ+=$(BUILD)winrc/rsrc_unbound_control.o
-  CHECKCONF_OBJ+=$(BUILD)winrc/rsrc_unbound_checkconf.o
-
-  WINAPPS=$(addsuffix $(EXEEXT), unbound-service-install \
-  	unbound-service-remove anchor-update)
-  COMPAT_WINAPP=$(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
-  SVCINST_SRC=winrc/unbound-service-install.c winrc/w_inst.c
-  SVCINST_OBJ=$(addprefix $(BUILD),$(SVCINST_SRC:.c=.lo)) $(COMPAT_WINAPP) \
-	$(BUILD)winrc/rsrc_svcinst.o
-  SVCUNINST_SRC=winrc/unbound-service-remove.c winrc/w_inst.c
-  SVCUNINST_OBJ=$(addprefix $(BUILD),$(SVCUNINST_SRC:.c=.lo)) $(COMPAT_WINAPP) \
-	$(BUILD)winrc/rsrc_svcuninst.o
-  ANCHORUPD_SRC=winrc/anchor-update.c
-  ANCHORUPD_OBJ=$(addprefix $(BUILD),$(ANCHORUPD_SRC:.c=.lo)) $(COMPAT_WINAPP) \
-        $(BUILD)winrc/rsrc_anchorupd.o
-  ALL_SRC:=$(sort $(ALL_SRC) $(SVCINST_SRC) $(SVCUNINST_SRC) $(ANCHORUPD_SRC))
-  ALL_OBJ:=$(sort $(ALL_OBJ) $(SVCINST_OBJ) $(SVCUNINST_OBJ) $(ANCHORUPD_OBJ))
-
-$(BUILD)%.o:      $(srcdir)/%.rc $(srcdir)/config.h
-	$(INFO) Resource $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
-	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
-	$Q$(WINDRES) $(CPPFLAGS) $< $@
-endif
+	$(MEMSTATS_SRC) $(CHECKCONF_SRC)
+ALL_OBJ=$(addprefix $(BUILD),$(ALL_SRC:.c=.o) \
+	$(addprefix compat/,$(LIBOBJS))) $(COMPAT_OBJ)
 
 COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS)
-LINK=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(staticexe) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS))
-LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS) $(staticexe) -version-number @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined)
+LINK=$(LIBTOOL) --tag=CC --mode=link $(CC) $(staticexe) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS)
+LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(CFLAGS) $(LDFLAGS) -release $(VERSION)
 
-.PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip lib
+.PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip
 
-$(BUILD)%.lo:    $(srcdir)/%.c 
+$(BUILD)%.o:    $(srcdir)/%.c 
 	$(INFO) Build $<
 	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
 		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
-	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
-	$Q$(COMPILE) -o $@ -c $<
+	@if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
+	$Q$(COMPILE) -c $< -o $@
 
-all:	$(COMMON_OBJ) unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-control-setup $(WINAPPS)
+all:	$(COMMON_OBJ) unbound unbound-checkconf
 
-TEST_BIN=$(addsuffix $(EXEEXT),asynclook delayer harvest lock-verify \
-	memstats perf pktview signit streamtcp testbound unittest)
-tests:	all $(TEST_BIN)
+tests:	all unittest testbound lock-verify pktview signit memstats
 
 test:	tests
-	if test -x "`which bash`"; then bash testcode/do-tests.sh; else sh testcode/do-tests.sh; fi
-
-lib:	libunbound.la
+	bash testcode/do-tests.sh
 
 ifeq ($(patsubst ldns-src%,ldns-src,$(ldnsdir)),ldns-src)
 ldnslib=$(ldnsdir)/lib/libldns.a
-$(ldnslib):	$(ldnsdir)/lib
-$(ldnsdir)/lib:
+$(ldnslib):
 	@if test ! -z "$(ldnsdir)"; \
 	then (cd $(ldnsdir) && $(MAKE)); fi
 else
 ldnslib=
 endif
 
-libunbound.la:	$(LIBUNBOUND_OBJ) $(ldnslib)
+unbound:	$(DAEMON_OBJ) $(ldnslib)
 	$(INFO) Link $@
-	$Q$(LINK_LIB) -export-symbols $(srcdir)/libunbound/ubsyms.def -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
+	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) $(LIBS)
 
-unbound$(EXEEXT):	$(DAEMON_OBJ) $(ldnslib)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) -lssl $(LIBS)
-
-unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ) $(ldnslib)
+unbound-checkconf:	$(CHECKCONF_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(CHECKCONF_OBJ)) $(LIBS)
 
-unbound-control$(EXEEXT):	$(CONTROL_OBJ) $(ldnslib)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(CONTROL_OBJ)) -lssl $(LIBS)
-
-unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la $(ldnslib)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) -L. -L.libs -lunbound $(LIBS)
-
-unbound-service-install$(EXEEXT):	$(SVCINST_OBJ)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(SVCINST_OBJ)) $(LIBS)
-
-unbound-service-remove$(EXEEXT):	$(SVCUNINST_OBJ)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(SVCUNINST_OBJ)) $(LIBS)
-
-anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ) libunbound.la $(ldnslib)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(ANCHORUPD_OBJ)) -L. -L.libs -lunbound $(LIBS)
-
-unittest$(EXEEXT):	$(UNITTEST_OBJ) $(ldnslib)
+unittest:	$(UNITTEST_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UNITTEST_OBJ)) $(LIBS)
 
-testbound$(EXEEXT):	$(TESTBOUND_OBJ) $(ldnslib)
+testbound:	$(TESTBOUND_OBJ) $(ldnslib)
 	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(TESTBOUND_OBJ)) -lssl $(LIBS)
+	$Q$(LINK) -o $@ $(sort $(TESTBOUND_OBJ)) $(LIBS)
 
-lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ) $(ldnslib)
+lock-verify:	$(LOCKVERIFY_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(LOCKVERIFY_OBJ)) $(LIBS)
 
-pktview$(EXEEXT):	$(PKTVIEW_OBJ) $(ldnslib)
+pktview:	$(PKTVIEW_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PKTVIEW_OBJ)) $(LIBS)
 
-signit$(EXEEXT):	$(SIGNIT_OBJ) $(ldnslib)
+signit:	$(SIGNIT_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SIGNIT_OBJ)) $(LIBS)
 
-memstats$(EXEEXT):	$(MEMSTATS_OBJ) $(ldnslib)
+memstats:	$(MEMSTATS_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(MEMSTATS_OBJ)) $(LIBS)
 
-asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ) $(ldnslib) libunbound.la
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(ASYNCLOOK_OBJ)) $(LIBS) -L. -L.libs -lunbound
-
-streamtcp$(EXEEXT):	$(STREAMTCP_OBJ) $(ldnslib)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(STREAMTCP_OBJ)) $(LIBS)
-
-perf$(EXEEXT):	$(PERF_OBJ) $(ldnslib)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(PERF_OBJ)) $(LIBS)
-
-delayer$(EXEEXT):	$(DELAYER_OBJ) $(ldnslib)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(DELAYER_OBJ)) $(LIBS)
-
-harvest$(EXEEXT):	$(HARVEST_OBJ) $(ldnslib) libunbound.la
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(HARVEST_OBJ)) $(LIBS) -L. -L.libs -lunbound
-
-unbound-control-setup:	$(srcdir)/smallapp/unbound-control-setup.sh
-	$(INFO) Sed $@
-	$Qsed -e 's:^DESTDIR=.*$$:DESTDIR=$(UNBOUND_RUN_DIR):' < $< > $@
-	$Q-chmod +x $@
-
 #testcode/ldns-testpkts.c:	$(ldnsdir)/examples/ldns-testpkts.c \
 #			$(ldnsdir)/examples/ldns-testpkts.h
 #	cp $(ldnsdir)/examples/ldns-testpkts.c testcode/ldns-testpkts.c
 #	cp $(ldnsdir)/examples/ldns-testpkts.h testcode/ldns-testpkts.h
 
-ifeq "$(WITH_PYTHONMODULE)" "yes"
-$(srcdir)/pythonmod/pythonmod.c:	pythonmod/interface.h
-%.h:	$(srcdir)/%.i $(srcdir)/config.h
-	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
-	$(INFO) Swig $<
-	$Q$(SWIG) $(CPPFLAGS) -o $@ -python $<
-endif
-
-ifeq "$(WITH_PYUNBOUND)" "yes"
-libunbound/python/libunbound_wrap.c:	$(srcdir)/libunbound/python/libunbound.i $(srcdir)/libunbound/unbound.h
-	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
-	$(INFO) Swig $<
-	$Q$(SWIG) -python -o $@ $(CPPFLAGS) $<
-
-all:	_unbound.la
-_unbound.la:	$(BUILD)libunbound/python/libunbound_wrap.lo libunbound.la
-	$(INFO) Link $@
-	$Q$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS) -module -version-number @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined) -o $@ $< -rpath $(PYTHON_SITE_PKG) L. -L.libs -lunbound $(LIBS)
-endif
-
 util/config_file.c:	util/configparser.h
 util/configlexer.c:  $(srcdir)/util/configlexer.lex util/configparser.h
 	$(INFO) Lex $<
 ifeq "$(strip $(LEX))" ":"
 	$Qecho "rebuild lexer, but no lex program, skipped"
 else
-	@-if test ! -d util; then $(INSTALL) -d util; fi
-	$Qecho "#include \"config.h\"" > $@
-	$Qecho "#include \"util/configyyrename.h\"" >> $@
+	@if test ! -d util; then $(INSTALL) -d util; fi
+	$Qecho "#include \"util/configyyrename.h\"" > $@
 	$Q$(LEX) -t $< >> $@
 endif
 
 util/configparser.c util/configparser.h:  $(srcdir)/util/configparser.y
 	$(INFO) Yacc $<
-	@-if test ! -d util; then $(INSTALL) -d util; fi
+	@if test ! -d util; then $(INSTALL) -d util; fi
 	$Q$(YACC) -d -o util/configparser.c $<
 
 clean:
 	rm -f *.o *.d *.lo *~ tags
-	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-control-setup libunbound.la
-	rm -rf autom4te.cache .libs build doc/html doc/xml
+	rm -rf autom4te.cache .libs build doc/html
 
 realclean: clean
 	rm -f config.status config.log config.h.in config.h
 	rm -f configure config.sub config.guess ltmain.sh aclocal.m4 libtool
 	rm -f util/configlexer.c util/configparser.c util/configparser.h
-	rm -f $(TEST_BIN)
 	if test -d ldns-src; then rm -rf ldns-src; fi
 	rm -f Makefile 
 
 $(BUILD)%.lint:    $(srcdir)/%.c 
 	$(INFO) Lint $<
-	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
+	@if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(LINT) $(LINTFLAGS) -I. -I$(srcdir) -I$(ldnsdir)/include $<
 	$Qtouch $@
 
@@ -357,96 +195,50 @@ tags:	$(srcdir)/*.[ch] $(srcdir)/*/*.[ch]
 	ctags  -f $(srcdir)/tags $(srcdir)/*.[ch] $(srcdir)/*/*.[ch]
 
 doc:
-	if test -n "$(doxygen)"; then \
-		$(doxygen) $(srcdir)/doc/unbound.doxygen; fi
-ifeq "$(findstring yes,$(WITH_PYUNBOUND)$(WITH_PYTHONMODULE))" "yes"
-	if test -x "`which sphinx-build 2>&1`"; then \
-		sphinx-build -b html pythonmod/doc doc/html/pythonmod; \
-		sphinx-build -b html libunbound/python/doc doc/html/pyunbound;\
-	fi
+ifdef doxygen
+	$(doxygen) $(srcdir)/doc/unbound.doxygen
 endif
 
 strip:
-	$(STRIP) unbound$(EXEEXT)
-	$(STRIP) unbound-checkconf$(EXEEXT)
-	$(STRIP) unbound-control$(EXEEXT)
-	$(STRIP) unbound-host$(EXEEXT)
+	strip unbound
+	strip unbound-checkconf
 
-install:	all
-	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
-	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)
-	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man8
-	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man5
-	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man3
-	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man1
-	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)
-	$(INSTALL) -m 755 -d $(DESTDIR)$(includedir)
-	$(LIBTOOL) --mode=install cp unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT)
-ifeq "$(WITH_PYTHONMODULE)" "yes"
-	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
-	$(INSTALL) -c -m 644 pythonmod/unboundmodule.py $(DESTDIR)$(PYTHON_SITE_PKG)/unboundmodule.py
-endif
-ifeq "$(WITH_PYUNBOUND)" "yes"
-	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
-	$(INSTALL) -c -m 644 libunbound/python/unbound.py $(DESTDIR)$(PYTHON_SITE_PKG)/unbound.py
-	$(LIBTOOL) --mode=install cp _unbound.la $(DESTDIR)$(PYTHON_SITE_PKG)
-	$(LIBTOOL) --mode=finish $(DESTDIR)$(PYTHON_SITE_PKG)
-endif
-	$(INSTALL) -c -m 644 doc/unbound.8 $(DESTDIR)$(mandir)/man8
-	$(INSTALL) -c -m 644 doc/unbound-checkconf.8 $(DESTDIR)$(mandir)/man8
-	$(INSTALL) -c -m 644 doc/unbound-control.8 $(DESTDIR)$(mandir)/man8
-	$(INSTALL) -c -m 644 doc/unbound.conf.5 $(DESTDIR)$(mandir)/man5
-	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-host.1 $(DESTDIR)$(mandir)/man1
-	$(INSTALL) -c -m 644 doc/libunbound.3 $(DESTDIR)$(mandir)/man3
-	$(INSTALL) -c -m 755 unbound-control-setup $(DESTDIR)$(sbindir)/unbound-control-setup
-	if test ! -e $(DESTDIR)$(configfile); then $(INSTALL) -d `dirname $(DESTDIR)$(configfile)`; $(INSTALL) -c -m 644 doc/example.conf $(DESTDIR)$(configfile); fi
-	$(LIBTOOL) --mode=install cp $(srcdir)/libunbound/unbound.h $(DESTDIR)$(includedir)/unbound.h
-	$(LIBTOOL) --mode=install cp libunbound.la $(DESTDIR)$(libdir)
-	$(LIBTOOL) --mode=finish $(DESTDIR)$(libdir)
+install:
+	$(INSTALL) -d $(bindir)
+	$(INSTALL) -d $(mandir)
+	$(INSTALL) -d $(mandir)/man8
+	$(INSTALL) -d $(mandir)/man5
+	$(LIBTOOL) --mode=install cp unbound $(bindir)/unbound
+	$(LIBTOOL) --mode=install cp unbound-checkconf $(bindir)/unbound-checkconf
+	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.8 $(mandir)/man8
+	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-checkconf.8 $(mandir)/man8
+	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.conf.5 $(mandir)/man5
+	if test ! -e $(configfile); then $(INSTALL) -d `dirname $(configfile)`; $(INSTALL) -c -m 644 $(srcdir)/doc/example.conf $(configfile); fi
 
 uninstall:
-	rm -f -- $(DESTDIR)$(sbindir)/unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control-setup
-	rm -f -- $(DESTDIR)$(mandir)/man8/unbound.8 $(DESTDIR)$(mandir)/man8/unbound-checkconf.8 $(DESTDIR)$(mandir)/man5/unbound.conf.5 $(DESTDIR)$(mandir)/man8/unbound-control.8
-	rm -f -- $(DESTDIR)$(mandir)/man1/unbound-host.1 $(DESTDIR)$(mandir)/man3/libunbound.3
-	rm -f -- $(DESTDIR)$(includedir)/unbound.h
-	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(libdir)/libunbound.la
-ifeq "$(WITH_PYTHONMODULE)" "yes"
-	rm -f -- $(DESTDIR)$(PYTHON_SITE_PKG)/unboundmodule.py
-endif
-ifeq "$(WITH_PYUNBOUND)" "yes"
-	rm -f -- $(DESTDIR)$(PYTHON_SITE_PKG)/unbound.py
-	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(PYTHON_SITE_PKG)/_unbound.la
-endif
+	rm -f -- $(bindir)/unbound $(bindir)/unbound-checkconf
+	rm -f -- $(mandir)/man8/unbound.8 $(mandir)/man8/unbound-checkconf.8 $(mandir)/man5/unbound.conf.5
 	@echo
-	@echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand"
+	@echo "You still need to remove `dirname $(configfile)` , $(configfile) by hand"
 
 download_ldns:
-	svn export https://www.nlnetlabs.nl/svn/ldns/trunk/makedist.sh ldns_makedist.sh
-	./ldns_makedist.sh -s -d https://www.nlnetlabs.nl/svn/ldns/trunk
-	mv ldns-[0-9]*.tar.gz ldns-src.tar.gz
-	rm ldns-*.tar.gz.sha1 ldns_makedist.sh
-
-iana_update:
-	curl -o port-numbers.tmp http://www.iana.org/assignments/port-numbers
-	awk '/Unassigned|Reserved/ {next;} { match($$0, "[0-9]+/udp"); if (RLENGTH > 0) print substr($$0, RSTART, RLENGTH - 4) ","}' port-numbers.tmp | sort -nu > portslist.tmp
-	cat portslist.tmp > util/iana_ports.inc
-	rm -f port-numbers.tmp portslist.tmp
+	svn export https://www.nlnetlabs.nl/ldns/svn/trunk/makedist.sh ldns_makedist.sh
+	./ldns_makedist.sh -s -d https://www.nlnetlabs.nl/ldns/svn/trunk
+	mv ldns-*_pre_*.tar.gz ldns-src.tar.gz
+	rm ldns-*_pre_*.tar.gz.sha1 ldns_makedist.sh
 
 # Automatic dependencies.
 $(BUILD)%.d: $(srcdir)/%.c
 	$(INFO) Depend $<
 	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
 		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
-	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
-	$Q$(SHELL) -ec '$(CC) $(DEPFLAG) $(CPPFLAGS) $(CFLAGS) $< | sed '\''s!\(.*\)\.o[ :]*!$(dir $@)\1.lo $@ : !g'\'' > $@; [ -s $@ ] || rm -f $@'
+	@if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
+	$Q$(SHELL) -ec '$(CC) -MM $(CPPFLAGS) $(CFLAGS) $< \
+	              | sed '\''s!\(.*\)\.o[ :]*!$(dir $@)\1.o $@ : !g'\'' > $@; \
+	              [ -s $@ ] || rm -f $@'
 
 ifneq ($(MAKECMDGOALS),clean)
 ifneq ($(MAKECMDGOALS),realclean)
-ifeq ($(debug_enabled),yes)
--include $(addprefix $(BUILD),$(ALL_SRC:.c=.d) $(COMPAT_SRC:.c=.d))
-endif
+-include $(addprefix $(BUILD),$(ALL_SRC:.c=.d))
 endif
 endif

README

@@ -1,10 +1,9 @@
 Unbound README
 * ./configure && make && make install
 * on BSDs and Solaris use gmake (GNU make).
-* You can use libevent if you want. libevent is useful when using 
-  many (10000) outgoing ports. By default max 256 ports are opened at
-  the same time and the builtin alternative is equally capable and a 
-  little faster.
+* If it complains that no libevent can be found; libevent is useful when
+  using many (10000) outgoing ports. By default 16 ports are used and the
+  builtin alternative is equally capable.
 * More detailed README, README.svn, README.tests in doc directory
 * manual pages can be found in doc directory, and are installed, unbound(8).
 * example configuration file doc/example.conf

ac_pkg_swig.m4

@@ -1,122 +0,0 @@
-# ===========================================================================
-#              http://autoconf-archive.cryp.to/ac_pkg_swig.html
-# ===========================================================================
-#
-# SYNOPSIS
-#
-#   AC_PROG_SWIG([major.minor.micro])
-#
-# DESCRIPTION
-#
-#   This macro searches for a SWIG installation on your system. If found you
-#   should call SWIG via $(SWIG). You can use the optional first argument to
-#   check if the version of the available SWIG is greater than or equal to
-#   the value of the argument. It should have the format: N[.N[.N]] (N is a
-#   number between 0 and 999. Only the first N is mandatory.)
-#
-#   If the version argument is given (e.g. 1.3.17), AC_PROG_SWIG checks that
-#   the swig package is this version number or higher.
-#
-#   In configure.in, use as:
-#
-#     AC_PROG_SWIG(1.3.17)
-#     SWIG_ENABLE_CXX
-#     SWIG_MULTI_MODULE_SUPPORT
-#     SWIG_PYTHON
-#
-# LAST MODIFICATION
-#
-#   2008-04-12
-#
-# COPYLEFT
-#
-#   Copyright (c) 2008 Sebastian Huber <sebastian-huber@web.de>
-#   Copyright (c) 2008 Alan W. Irwin <irwin@beluga.phys.uvic.ca>
-#   Copyright (c) 2008 Rafael Laboissiere <rafael@laboissiere.net>
-#   Copyright (c) 2008 Andrew Collier <colliera@ukzn.ac.za>
-#
-#   This program is free software; you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation; either version 2 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Macro Archive. When you make and
-#   distribute a modified version of the Autoconf Macro, you may extend this
-#   special exception to the GPL to apply to your modified version as well.
-
-AC_DEFUN([AC_PROG_SWIG],[
-        AC_PATH_PROG([SWIG],[swig])
-        if test -z "$SWIG" ; then
-                AC_MSG_WARN([cannot find 'swig' program. You should look at http://www.swig.org])
-                SWIG='echo "Error: SWIG is not installed. You should look at http://www.swig.org" ; false'
-        elif test -n "$1" ; then
-                AC_MSG_CHECKING([for SWIG version])
-                [swig_version=`$SWIG -version 2>&1 | grep 'SWIG Version' | sed 's/.*\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*/\1/g'`]
-                AC_MSG_RESULT([$swig_version])
-                if test -n "$swig_version" ; then
-                        # Calculate the required version number components
-                        [required=$1]
-                        [required_major=`echo $required | sed 's/[^0-9].*//'`]
-                        if test -z "$required_major" ; then
-                                [required_major=0]
-                        fi
-                        [required=`echo $required | sed 's/[0-9]*[^0-9]//'`]
-                        [required_minor=`echo $required | sed 's/[^0-9].*//'`]
-                        if test -z "$required_minor" ; then
-                                [required_minor=0]
-                        fi
-                        [required=`echo $required | sed 's/[0-9]*[^0-9]//'`]
-                        [required_patch=`echo $required | sed 's/[^0-9].*//'`]
-                        if test -z "$required_patch" ; then
-                                [required_patch=0]
-                        fi
-                        # Calculate the available version number components
-                        [available=$swig_version]
-                        [available_major=`echo $available | sed 's/[^0-9].*//'`]
-                        if test -z "$available_major" ; then
-                                [available_major=0]
-                        fi
-                        [available=`echo $available | sed 's/[0-9]*[^0-9]//'`]
-                        [available_minor=`echo $available | sed 's/[^0-9].*//'`]
-                        if test -z "$available_minor" ; then
-                                [available_minor=0]
-                        fi
-                        [available=`echo $available | sed 's/[0-9]*[^0-9]//'`]
-                        [available_patch=`echo $available | sed 's/[^0-9].*//'`]
-                        if test -z "$available_patch" ; then
-                                [available_patch=0]
-                        fi
-                        if test $available_major -ne $required_major \
-                                -o $available_minor -ne $required_minor \
-                                -o $available_patch -lt $required_patch ; then
-                                AC_MSG_WARN([SWIG version >= $1 is required.  You have $swig_version.  You should look at http://www.swig.org])
-                                SWIG='echo "Error: SWIG version >= $1 is required.  You have '"$swig_version"'.  You should look at http://www.swig.org" ; false'
-                        else
-                                AC_MSG_NOTICE([SWIG executable is '$SWIG'])
-                                SWIG_LIB=`$SWIG -swiglib`
-                                AC_MSG_NOTICE([SWIG library directory is '$SWIG_LIB'])
-                        fi
-                else
-                        AC_MSG_WARN([cannot determine SWIG version])
-                        SWIG='echo "Error: Cannot determine SWIG version.  You should look at http://www.swig.org" ; false'
-                fi
-        fi
-        AC_SUBST([SWIG_LIB])
-])

acx_python.m4

@@ -1,200 +0,0 @@
-AC_DEFUN([AC_PYTHON_DEVEL],[
-        #
-        # Allow the use of a (user set) custom python version
-        #
-        AC_ARG_VAR([PYTHON_VERSION],[The installed Python
-                version to use, for example '2.3'. This string
-                will be appended to the Python interpreter
-                canonical name.])
-
-        AC_PATH_PROG([PYTHON],[python[$PYTHON_VERSION]])
-        if test -z "$PYTHON"; then
-           AC_MSG_ERROR([Cannot find python$PYTHON_VERSION in your system path])
-           PYTHON_VERSION=""
-        fi
-
-        if test -z "$PYTHON_VERSION"; then
-		PYTHON_VERSION=`$PYTHON -c "import sys, string; \
-			print string.split(sys.version)[[0]]"`
-	fi
-
-        #
-        # Check for a version of Python >= 2.1.0
-        #
-        AC_MSG_CHECKING([for a version of Python >= '2.1.0'])
-        ac_supports_python_ver=`$PYTHON -c "import sys, string; \
-                ver = string.split(sys.version)[[0]]; \
-                print ver >= '2.1.0'"`
-        if test "$ac_supports_python_ver" != "True"; then
-                if test -z "$PYTHON_NOVERSIONCHECK"; then
-                        AC_MSG_RESULT([no])
-                        AC_MSG_FAILURE([
-This version of the AC@&t@_PYTHON_DEVEL macro
-doesn't work properly with versions of Python before
-2.1.0. You may need to re-run configure, setting the
-variables PYTHON_CPPFLAGS, PYTHON_LDFLAGS, PYTHON_SITE_PKG,
-PYTHON_EXTRA_LIBS and PYTHON_EXTRA_LDFLAGS by hand.
-Moreover, to disable this check, set PYTHON_NOVERSIONCHECK
-to something else than an empty string.
-])
-                else
-                        AC_MSG_RESULT([skip at user request])
-                fi
-        else
-                AC_MSG_RESULT([yes])
-        fi
-
-        #
-        # if the macro parameter ``version'' is set, honour it
-        #
-        if test -n "$1"; then
-                AC_MSG_CHECKING([for a version of Python $1])
-                ac_supports_python_ver=`$PYTHON -c "import sys, string; \
-                        ver = string.split(sys.version)[[0]]; \
-                        print ver $1"`
-                if test "$ac_supports_python_ver" = "True"; then
-                   AC_MSG_RESULT([yes])
-                else
-                        AC_MSG_RESULT([no])
-                        AC_MSG_ERROR([this package requires Python $1.
-If you have it installed, but it isn't the default Python
-interpreter in your system path, please pass the PYTHON_VERSION
-variable to configure. See ``configure --help'' for reference.
-])
-                        PYTHON_VERSION=""
-                fi
-        fi
-
-        #
-        # Check if you have distutils, else fail
-        #
-        AC_MSG_CHECKING([for the distutils Python package])
-        ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`
-        if test -z "$ac_distutils_result"; then
-                AC_MSG_RESULT([yes])
-        else
-                AC_MSG_RESULT([no])
-                AC_MSG_ERROR([cannot import Python module "distutils".
-Please check your Python installation. The error was:
-$ac_distutils_result])
-                PYTHON_VERSION=""
-        fi
-
-        #
-        # Check for Python include path
-        #
-        AC_MSG_CHECKING([for Python include path])
-        if test -z "$PYTHON_CPPFLAGS"; then
-                python_path=`$PYTHON -c "import distutils.sysconfig; \
-                        print distutils.sysconfig.get_python_inc();"`
-                if test -n "${python_path}"; then
-                        python_path="-I$python_path"
-                fi
-                PYTHON_CPPFLAGS=$python_path
-        fi
-        AC_MSG_RESULT([$PYTHON_CPPFLAGS])
-        AC_SUBST([PYTHON_CPPFLAGS])
-
-        #
-        # Check for Python library path
-        #
-        AC_MSG_CHECKING([for Python library path])
-        if test -z "$PYTHON_LDFLAGS"; then
-                # (makes two attempts to ensure we've got a version number
-                # from the interpreter)
-                py_version=`$PYTHON -c "from distutils.sysconfig import *; \
-                        from string import join; \
-                        print join(get_config_vars('VERSION'))"`
-                if test "$py_version" = "[None]"; then
-                        if test -n "$PYTHON_VERSION"; then
-                                py_version=$PYTHON_VERSION
-                        else
-                                py_version=`$PYTHON -c "import sys; \
-                                        print sys.version[[:3]]"`
-                        fi
-                fi
-
-                PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
-                        from string import join; \
-                        print '-L' + get_python_lib(0,1), \
-                        '-L' + os.path.dirname(get_python_lib(0,1)), \
-                        '-lpython';"`$py_version
-        fi
-        AC_MSG_RESULT([$PYTHON_LDFLAGS])
-        AC_SUBST([PYTHON_LDFLAGS])
-
-        #
-        # Check for site packages
-        #
-        AC_MSG_CHECKING([for Python site-packages path])
-        if test -z "$PYTHON_SITE_PKG"; then
-                PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
-                        print distutils.sysconfig.get_python_lib(0,0);"`
-        fi
-        AC_MSG_RESULT([$PYTHON_SITE_PKG])
-        AC_SUBST([PYTHON_SITE_PKG])
-
-        #
-        # libraries which must be linked in when embedding
-        #
-        AC_MSG_CHECKING(python extra libraries)
-        if test -z "$PYTHON_EXTRA_LIBS"; then
-           PYTHON_EXTRA_LIBS=`$PYTHON -c "import distutils.sysconfig; \
-                conf = distutils.sysconfig.get_config_var; \
-                print conf('LOCALMODLIBS'), conf('LIBS')"`
-        fi
-        AC_MSG_RESULT([$PYTHON_EXTRA_LIBS])
-        AC_SUBST(PYTHON_EXTRA_LIBS)
-
-        #
-        # linking flags needed when embedding
-        #
-        AC_MSG_CHECKING(python extra linking flags)
-        if test -z "$PYTHON_EXTRA_LDFLAGS"; then
-                PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import distutils.sysconfig; \
-                        conf = distutils.sysconfig.get_config_var; \
-                        print conf('LINKFORSHARED')"`
-        fi
-        AC_MSG_RESULT([$PYTHON_EXTRA_LDFLAGS])
-        AC_SUBST(PYTHON_EXTRA_LDFLAGS)
-
-        #
-        # final check to see if everything compiles alright
-        #
-        AC_MSG_CHECKING([consistency of all components of python development environment])
-        AC_LANG_PUSH([C])
-        # save current global flags
-        LIBS="$ac_save_LIBS $PYTHON_LDFLAGS"
-        CPPFLAGS="$ac_save_CPPFLAGS $PYTHON_CPPFLAGS"
-        AC_TRY_LINK([
-                #include <Python.h>
-        ],[
-                Py_Initialize();
-        ],[pythonexists=yes],[pythonexists=no])
-
-        AC_MSG_RESULT([$pythonexists])
-
-        if test ! "$pythonexists" = "yes"; then
-           AC_MSG_ERROR([
-  Could not link test program to Python. Maybe the main Python library has been
-  installed in some non-standard library path. If so, pass it to configure,
-  via the LDFLAGS environment variable.
-  Example: ./configure LDFLAGS="-L/usr/non-standard-path/python/lib"
-  ============================================================================
-   ERROR!
-   You probably have to install the development version of the Python package
-   for your distribution.  The exact name of this package varies among them.
-  ============================================================================
-           ])
-          PYTHON_VERSION=""
-        fi
-        AC_LANG_POP
-        # turn back to default flags
-        CPPFLAGS="$ac_save_CPPFLAGS"
-        LIBS="$ac_save_LIBS"
-
-        #
-        # all done!
-        #
-])
-

checkconf/unbound-checkconf.c

@@ -0,0 +1,198 @@
+/*
+ * checkconf/unbound-checkconf.c - config file checker for unbound.conf file.
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * The config checker checks for syntax and other errors in the unbound.conf
+ * file, and can be used to check for errors before the server is started
+ * or sigHUPped.
+ * Exit status 1 means an error.
+ */
+
+#include "config.h"
+#include "util/log.h"
+#include "util/config_file.h"
+#include "util/module.h"
+#include "util/net_help.h"
+#include "util/regional.h"
+#include "iterator/iterator.h"
+#include "validator/validator.h"
+#include <pwd.h>
+
+/** Give checkconf usage, and exit (1). */
+static void
+usage()
+{
+	printf("Usage:	unbound-checkconf [file]\n");
+	printf("	Checks unbound configuration file for errors.\n");
+	printf("file	if omitted %s is used.\n", CONFIGFILE);
+	printf("-h	show this usage help.\n");
+	printf("Version %s\n", PACKAGE_VERSION);
+	printf("BSD licensed, see LICENSE in source package for details.\n");
+	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+	exit(1);
+}
+
+/** check if module works with config */
+static void
+check_mod(struct config_file* cfg, struct module_func_block* fb)
+{
+	struct module_env env;
+	memset(&env, 0, sizeof(env));
+	env.cfg = cfg;
+	env.scratch = regional_create();
+	env.scratch_buffer = ldns_buffer_new(BUFSIZ);
+	if(!env.scratch || !env.scratch_buffer)
+		fatal_exit("out of memory");
+	if(!(*fb->init)(&env, 0)) {
+		fatal_exit("bad config for %s module", fb->name);
+	}
+	(*fb->deinit)(&env, 0);
+	ldns_buffer_free(env.scratch_buffer);
+	regional_destroy(env.scratch);
+}
+
+/** check configuration for errors */
+static void
+morechecks(struct config_file* cfg)
+{
+	int i;
+	struct sockaddr_storage a;
+	socklen_t alen;
+	for(i=0; i<cfg->num_ifs; i++) {
+		if(!ipstrtoaddr(cfg->ifs[i], UNBOUND_DNS_PORT, &a, &alen)) {
+			fatal_exit("cannot parse interface specified as '%s'",
+				cfg->ifs[i]);
+		}
+	}
+	for(i=0; i<cfg->num_out_ifs; i++) {
+		if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, 
+			&a, &alen)) {
+			fatal_exit("cannot parse outgoing-interface "
+				"specified as '%s'", cfg->out_ifs[i]);
+		}
+	}
+
+	if(cfg->verbosity < 0)
+		fatal_exit("verbosity value < 0");
+	if(cfg->num_threads < 0 || cfg->num_threads > 10000)
+		fatal_exit("num_threads value weird");
+	if(!cfg->do_ip4 && !cfg->do_ip6)
+		fatal_exit("ip4 and ip6 are both disabled, pointless");
+	if(!cfg->do_udp && !cfg->do_tcp)
+		fatal_exit("udp and tcp are both disabled, pointless");
+
+	if(cfg->chrootdir && strncmp(cfg->chrootdir, cfg->directory,
+		strlen(cfg->chrootdir)) != 0)
+		fatal_exit("working directory %s not in chrootdir %s",
+			cfg->directory, cfg->chrootdir);
+	if(cfg->chrootdir && cfg->pidfile && cfg->pidfile[0] &&
+		strncmp(cfg->chrootdir, cfg->pidfile,
+			strlen(cfg->chrootdir)) != 0)
+		fatal_exit("pid file %s not in chrootdir %s",
+			cfg->pidfile, cfg->chrootdir);
+	if(cfg->chrootdir && cfg->logfile && cfg->logfile[0] &&
+		strncmp(cfg->chrootdir, cfg->logfile,
+			strlen(cfg->chrootdir)) != 0)
+		fatal_exit("log file %s not in chrootdir %s",
+			cfg->logfile, cfg->chrootdir);
+	
+	if(strcmp(cfg->module_conf, "iterator") != 0 &&
+		strcmp(cfg->module_conf, "validator iterator") != 0) {
+		fatal_exit("module conf %s is not known to work",
+			cfg->module_conf);
+	}
+
+	if(cfg->username && cfg->username[0]) {
+		struct passwd *pwd;
+		if((pwd = getpwnam(cfg->username)) == NULL)
+			fatal_exit("user '%s' does not exist.", cfg->username);
+		endpwent();
+	}
+}
+
+/** check config file */
+static void
+checkconf(char* cfgfile)
+{
+	struct config_file* cfg = config_create();
+	if(!cfg)
+		fatal_exit("out of memory");
+	if(!config_read(cfg, cfgfile)) {
+		/* config_read prints messages to stderr */
+		config_delete(cfg);
+		exit(1);
+	}
+	morechecks(cfg);
+	check_mod(cfg, iter_get_funcblock());
+	check_mod(cfg, val_get_funcblock());
+	config_delete(cfg);
+	printf("unbound-checkconf: no errors in %s\n", cfgfile);
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** Main routine for checkconf */
+int main(int argc, char* argv[])
+{
+	int c;
+	char* f;
+	log_ident_set("unbound-checkconf");
+	log_init(NULL, 0, NULL);
+	checklock_start();
+	/* parse the options */
+	while( (c=getopt(argc, argv, "h")) != -1) {
+		switch(c) {
+		case '?':
+		case 'h':
+		default:
+			usage();
+		}
+	}
+	argc -= optind;
+	argv += optind;
+	if(argc != 0 && argc != 1)
+		usage();
+	if(argc == 1)
+		f = argv[0];
+	else	f = CONFIGFILE;
+	checkconf(f);
+	checklock_stop();
+	return 0;
+}

checkconf/worker_cb.c

@@ -0,0 +1,109 @@
+/*
+ * checkconf/worker_cb.c - fake callback routines to make fptr_wlist work
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains fake callback functions, so that the symbols exist
+ * and the fptr_wlist continues to work even if the daemon/worker is not
+ * linked into the resulting program.
+ */
+#include "config.h"
+#include "util/log.h"
+struct comm_reply;
+struct comm_point;
+struct module_qstate;
+
+int worker_handle_control_cmd(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+int worker_handle_request(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(repinfo))
+{
+	log_assert(0);
+	return 0;
+}
+
+int worker_handle_reply(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
+{
+	log_assert(0);
+}
+
+int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
+	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
+	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
+{
+	log_assert(0);
+	return 0;
+}
+
+struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
+	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
+	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
+	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
+{
+	log_assert(0);
+	return 0;
+}
+
+void 
+worker_alloc_cleanup(void* ATTR_UNUSED(arg))
+{
+	log_assert(0);
+}

compat/ctime_r.c

@@ -1,39 +0,0 @@
-/* taken from ldns 1.6.1 */
-#include "config.h"
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-#include "util/locks.h"
-
-/** the lock for ctime buffer */
-static lock_basic_t ctime_lock;
-/** has it been inited */
-static int ctime_r_init = 0;
-
-/** cleanup ctime_r on exit */
-static void
-ctime_r_cleanup(void)
-{
-	if(ctime_r_init) {
-		ctime_r_init = 0;
-		lock_basic_destroy(&ctime_lock);
-	}
-}
-
-char *ctime_r(const time_t *timep, char *buf)
-{
-	char* result;
-	if(!ctime_r_init) {
-		/* still small race where this init can be done twice,
-		 * which is mostly harmless */
-		ctime_r_init = 1;
-		lock_basic_init(&ctime_lock);
-		atexit(&ctime_r_cleanup);
-	}
-	lock_basic_lock(&ctime_lock);
-	result = ctime(timep);
-	if(buf && result)
-		strcpy(buf, result);
-	lock_basic_unlock(&ctime_lock);
-	return result;
-}

compat/fake-rfc2553.h

@@ -149,23 +149,23 @@ struct addrinfo {
 #ifdef getaddrinfo
 # undef getaddrinfo
 #endif
-#define getaddrinfo(a,b,c,d)	(getaddrinfo_unbound(a,b,c,d))
+#define getaddrinfo(a,b,c,d)	(ssh_getaddrinfo(a,b,c,d))
 int getaddrinfo(const char *, const char *, 
     const struct addrinfo *, struct addrinfo **);
 #endif /* !HAVE_GETADDRINFO */
 
 #if !defined(HAVE_GAI_STRERROR) && !defined(HAVE_CONST_GAI_STRERROR_PROTO)
-#define gai_strerror(a)		(gai_strerror_unbound(a))
+#define gai_strerror(a)		(ssh_gai_strerror(a))
 char *gai_strerror(int);
 #endif /* !HAVE_GAI_STRERROR */
 
 #ifndef HAVE_FREEADDRINFO
-#define freeaddrinfo(a)		(freeaddrinfo_unbound(a))
+#define freeaddrinfo(a)		(ssh_freeaddrinfo(a))
 void freeaddrinfo(struct addrinfo *);
 #endif /* !HAVE_FREEADDRINFO */
 
 #ifndef HAVE_GETNAMEINFO
-#define getnameinfo(a,b,c,d,e,f,g) (getnameinfo_unbound(a,b,c,d,e,f,g))
+#define getnameinfo(a,b,c,d,e,f,g) (ssh_getnameinfo(a,b,c,d,e,f,g))
 int getnameinfo(const struct sockaddr *, size_t, char *, size_t, 
     char *, size_t, int);
 #endif /* !HAVE_GETNAMEINFO */

compat/gmtime_r.c

@@ -1,107 +0,0 @@
-/*
- * Taken from FreeBSD src / lib / libc / stdtime / localtime.c 1.43 revision.
- * localtime.c 7.78.
- * tzfile.h 1.8
- * adapted to be replacement gmtime_r.
- */
-#include "config.h"
-
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-
-#define MONSPERYEAR 12
-#define DAYSPERNYEAR 365
-#define DAYSPERLYEAR 366
-#define SECSPERMIN 60
-#define SECSPERHOUR (60*60)
-#define SECSPERDAY (24*60*60)
-#define DAYSPERWEEK 7
-#define TM_SUNDAY	0
-#define TM_MONDAY	1
-#define TM_TUESDAY	2
-#define TM_WEDNESDAY	3
-#define TM_THURSDAY	4
-#define TM_FRIDAY	5
-#define TM_SATURDAY	6
-
-#define TM_YEAR_BASE	1900
-
-#define EPOCH_YEAR	1970
-#define EPOCH_WDAY	TM_THURSDAY
-
-#define isleap(y) (((y) % 4) == 0 && (((y) % 100) != 0 || ((y) % 400) == 0))
-
-static const int	mon_lengths[2][MONSPERYEAR] = {
-	{ 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 },
-	{ 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }
-};
-
-static const int	year_lengths[2] = {
-	DAYSPERNYEAR, DAYSPERLYEAR
-};
-
-static void
-timesub(timep, offset, tmp)
-const time_t * const			timep;
-const long				offset;
-struct tm * const		tmp;
-{
-	long			days;
-	long			rem;
-	long			y;
-	int			yleap;
-	const int *		ip;
-
-	days = *timep / SECSPERDAY;
-	rem = *timep % SECSPERDAY;
-	rem += (offset);
-	while (rem < 0) {
-		rem += SECSPERDAY;
-		--days;
-	}
-	while (rem >= SECSPERDAY) {
-		rem -= SECSPERDAY;
-		++days;
-	}
-	tmp->tm_hour = (int) (rem / SECSPERHOUR);
-	rem = rem % SECSPERHOUR;
-	tmp->tm_min = (int) (rem / SECSPERMIN);
-	/*
-	** A positive leap second requires a special
-	** representation.  This uses "... ??:59:60" et seq.
-	*/
-	tmp->tm_sec = (int) (rem % SECSPERMIN) ;
-	tmp->tm_wday = (int) ((EPOCH_WDAY + days) % DAYSPERWEEK);
-	if (tmp->tm_wday < 0)
-		tmp->tm_wday += DAYSPERWEEK;
-	y = EPOCH_YEAR;
-#define LEAPS_THRU_END_OF(y)	((y) / 4 - (y) / 100 + (y) / 400)
-	while (days < 0 || days >= (long) year_lengths[yleap = isleap(y)]) {
-		long	newy;
-
-		newy = y + days / DAYSPERNYEAR;
-		if (days < 0)
-			--newy;
-		days -= (newy - y) * DAYSPERNYEAR +
-			LEAPS_THRU_END_OF(newy - 1) -
-			LEAPS_THRU_END_OF(y - 1);
-		y = newy;
-	}
-	tmp->tm_year = y - TM_YEAR_BASE;
-	tmp->tm_yday = (int) days;
-	ip = mon_lengths[yleap];
-	for (tmp->tm_mon = 0; days >= (long) ip[tmp->tm_mon]; ++(tmp->tm_mon))
-		days = days - (long) ip[tmp->tm_mon];
-	tmp->tm_mday = (int) (days + 1);
-	tmp->tm_isdst = 0;
-}
-
-/*
-* Re-entrant version of gmtime.
-*/
-struct tm * gmtime_r(const time_t* timep, struct tm *tm)
-{
-	timesub(timep, 0L, tm);
-	return tm;
-}

compat/inet_aton.c

@@ -56,12 +56,8 @@
 
 #include <sys/types.h>
 #include <sys/param.h>
-#ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
-#endif
 #include <ctype.h>
 
 #if 0

compat/inet_ntop.c

@@ -23,12 +23,8 @@
 
 #include <sys/param.h>
 #include <sys/types.h>
-#ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
-#endif
 #include <string.h>
 #include <errno.h>
 #include <stdio.h>
@@ -66,11 +62,7 @@ inet_ntop(int af, const void *src, char *dst, size_t size)
 	case AF_INET6:
 		return (inet_ntop6(src, dst, size));
 	default:
-#ifdef EAFNOSUPPORT
 		errno = EAFNOSUPPORT;
-#else
-		errno = ENOSYS;
-#endif
 		return (NULL);
 	}
 	/* NOTREACHED */

compat/inet_pton.c

@@ -70,11 +70,7 @@ inet_pton(af, src, dst)
 	case AF_INET6:
 		return (inet_pton6(src, dst));
 	default:
-#ifdef EAFNOSUPPORT
 		errno = EAFNOSUPPORT;
-#else
-		errno = ENOSYS;
-#endif
 		return (-1);
 	}
 	/* NOTREACHED */

compat/malloc.c

@@ -1,8 +1,11 @@
 /* Just a replacement, if the original malloc is not
    GNU-compliant. See autoconf documentation. */
 
-#include "config.h"
+#if HAVE_CONFIG_H
+#include <config.h>
+#endif
 #undef malloc
+
 #include <sys/types.h>
 
 void *malloc ();
@@ -11,7 +14,7 @@ void *malloc ();
    If N is zero, allocate a 1-byte block.  */
 
 void *
-rpl_malloc_unbound (size_t n)
+rpl_malloc (size_t n)
 {
   if (n == 0)
     n = 1;

compat/memcmp.c

@@ -1,25 +0,0 @@
-/*
- *	memcmp.c: memcmp compat implementation.
- *
- *	Copyright (c) 2010, NLnet Labs. All rights reserved.
- *
- * See LICENSE for the license.
-*/
-
-#include <config.h>
-
-int memcmp(const void *x, const void *y, size_t n);
-
-int memcmp(const void *x, const void *y, size_t n)
-{
-	const uint8_t* x8 = (const uint8_t*)x;
-	const uint8_t* y8 = (const uint8_t*)y;
-	size_t i;
-	for(i=0; i<n; i++) {
-		if(x8[i] < y8[i])
-			return -1;
-		else if(x8[i] > y8[i])
-			return 1;
-	}
-	return 0;
-}

compat/snprintf.c

@@ -40,9 +40,6 @@
  *           gcc -DTEST_SNPRINTF -o snprintf snprintf.c -lm
  *    and run snprintf for results.
  *
- *  Wouter Wijngaards(wouter@nlnetlabs.nl) 2/09/2010 for unbound.
- *    Limited support for %g.  Does not do the exponents for the before-dot.
- *
  **************************************************************/
 
 
@@ -78,7 +75,7 @@ static void fmtstr (char *buffer, size_t *currlen, size_t maxlen,
 static void fmtint (char *buffer, size_t *currlen, size_t maxlen,
 		    long value, int base, int min, int max, int flags);
 static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
-		   long double fvalue, int min, int max, int flags, int conv);
+		   long double fvalue, int min, int max, int flags);
 static void dopr_outch (char *buffer, size_t *currlen, size_t maxlen, char c );
 
 int vsnprintf (char *str, size_t count, const char *fmt, va_list args)
@@ -316,7 +313,7 @@ static void dopr (char *buffer, size_t maxlen, const char *format, va_list args)
 	else
 	  fvalue = va_arg (args, double);
 	/* um, floating point? */
-	fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags, 'f');
+	fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags);
 	break;
       case 'E':
 	flags |= DP_F_UP;
@@ -333,7 +330,6 @@ static void dopr (char *buffer, size_t maxlen, const char *format, va_list args)
 	  fvalue = va_arg (args, long double);
 	else
 	  fvalue = va_arg (args, double);
-	fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags, 'g');
 	break;
       case 'c':
 	dopr_outch (buffer, &currlen, maxlen, va_arg (args, int));
@@ -532,7 +528,7 @@ static long double abs_val (long double value)
   return result;
 }
 
-static long double compat_pow10 (int exp)
+static long double pow10 (int exp)
 {
   long double result = 1;
 
@@ -545,7 +541,7 @@ static long double compat_pow10 (int exp)
   return result;
 }
 
-static long compat_round (long double value)
+static long round (long double value)
 {
   long intpart;
 
@@ -558,7 +554,7 @@ static long compat_round (long double value)
 }
 
 static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
-		   long double fvalue, int min, int max, int flags, int conv)
+		   long double fvalue, int min, int max, int flags)
 {
   int signvalue = 0;
   long double ufvalue;
@@ -606,12 +602,12 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
   /* We "cheat" by converting the fractional part to integer by
    * multiplying by a factor of 10
    */
-  fracpart = compat_round ((compat_pow10 (max)) * (ufvalue - intpart));
+  fracpart = round ((pow10 (max)) * (ufvalue - intpart));
 
-  if (fracpart >= compat_pow10 (max))
+  if (fracpart >= pow10 (max))
   {
     intpart++;
-    fracpart -= compat_pow10 (max);
+    fracpart -= pow10 (max);
   }
 
 #ifdef DEBUG_SNPRINTF
@@ -632,26 +628,13 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
     fconvert[fplace++] =
       (caps? "0123456789ABCDEF":"0123456789abcdef")[fracpart % 10];
     fracpart = (fracpart / 10);
-    if(conv == 'g' && fplace == 1 && fconvert[0] == '0') {
-      fplace = 0; /* skip trailing zeroes for %g */
-      zpadlen ++;
-    }
   } while(fracpart && (fplace < 20));
   if (fplace == 20) fplace--;
   fconvert[fplace] = 0;
 
-  if(conv == 'f') {
-    /* -1 for decimal point, another -1 if we are printing a sign */
-    padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0); 
-    zpadlen = max - fplace;
-  } else if(conv == 'g') {
-    /* zpadlen contains number of trailing zeroes removed */
-    padlen = min - iplace - (max-zpadlen) - 1 - ((signvalue) ? 1 : 0); 
-    if(fplace == 0) {
-      padlen += 1; /* add the decimal dot suppressed */
-      zpadlen = 0;
-    } else zpadlen = (max-zpadlen) - fplace;
-  }
+  /* -1 for decimal point, another -1 if we are printing a sign */
+  padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0); 
+  zpadlen = max - fplace;
   if (zpadlen < 0)
     zpadlen = 0;
   if (padlen < 0) 
@@ -684,14 +667,14 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
   while (iplace > 0) 
     dopr_outch (buffer, currlen, maxlen, iconvert[--iplace]);
 
-  /* for %g do not output decimal point if no fraction is present */
-  if(conv == 'f' || (conv == 'g' && fplace > 0)) {
-    /*
-     * Decimal point.  This should probably use locale to find the correct
-     * char to print out.
-     */
-    dopr_outch (buffer, currlen, maxlen, '.');
-  }
+  /*
+   * Decimal point.  This should probably use locale to find the correct
+   * char to print out.
+   */
+  dopr_outch (buffer, currlen, maxlen, '.');
+
+  while (fplace > 0) 
+    dopr_outch (buffer, currlen, maxlen, fconvert[--fplace]);
 
   while (zpadlen > 0)
   {
@@ -699,9 +682,6 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
     --zpadlen;
   }
 
-  while (fplace > 0) 
-    dopr_outch (buffer, currlen, maxlen, fconvert[--fplace]);
-
   while (padlen < 0) 
   {
     dopr_outch (buffer, currlen, maxlen, ' ');

config.guess

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
-#   Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
+#   Inc.
 
-timestamp='2009-11-20'
+timestamp='2006-07-02'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -27,16 +27,16 @@ timestamp='2009-11-20'
 # the same distribution terms that you use for the rest of that program.
 
 
-# Originally written by Per Bothner.  Please send patches (context
-# diff format) to <config-patches@gnu.org> and include a ChangeLog
-# entry.
+# Originally written by Per Bothner <per@bothner.com>.
+# Please send patches to <config-patches@gnu.org>.  Submit a context
+# diff and a properly formatted ChangeLog entry.
 #
 # This script attempts to guess a canonical system name similar to
 # config.sub.  If it succeeds, it prints the system name on stdout, and
 # exits with 0.  Otherwise, it exits with 1.
 #
-# You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+# The plan is that this can be called by configure scripts if you
+# don't specify an explicit build system type.
 
 me=`echo "$0" | sed -e 's,.*/,,'`
 
@@ -56,8 +56,8 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
-2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
+Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -161,7 +161,6 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	    arm*) machine=arm-unknown ;;
 	    sh3el) machine=shl-unknown ;;
 	    sh3eb) machine=sh-unknown ;;
-	    sh5el) machine=sh5le-unknown ;;
 	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
@@ -170,7 +169,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
 		eval $set_cc_for_build
 		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
-			| grep -q __ELF__
+			| grep __ELF__ >/dev/null
 		then
 		    # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
 		    # Return netbsd for either.  FIX?
@@ -324,33 +323,14 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	case `/usr/bin/uname -p` in
 	    sparc) echo sparc-icl-nx7; exit ;;
 	esac ;;
-    s390x:SunOS:*:*)
-	echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit ;;
     sun4H:SunOS:5.*:*)
 	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
 	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
-    i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*)
-	echo i386-pc-auroraux${UNAME_RELEASE}
-	exit ;;
-    i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
-	eval $set_cc_for_build
-	SUN_ARCH="i386"
-	# If there is a compiler, see if it is configured for 64-bit objects.
-	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
-	# This test works for both compilers.
-	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
-	    if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
-		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
-		grep IS_64BIT_ARCH >/dev/null
-	    then
-		SUN_ARCH="x86_64"
-	    fi
-	fi
-	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
+    i86pc:SunOS:5.*:*)
+	echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
     sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
@@ -551,7 +531,7 @@ EOF
 		echo rs6000-ibm-aix3.2
 	fi
 	exit ;;
-    *:AIX:*:[456])
+    *:AIX:*:[45])
 	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
 	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
@@ -659,7 +639,7 @@ EOF
 	    # => hppa64-hp-hpux11.23
 
 	    if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
-		grep -q __LP64__
+		grep __LP64__ >/dev/null
 	    then
 		HP_ARCH="hppa2.0w"
 	    else
@@ -800,7 +780,7 @@ EOF
     i*:CYGWIN*:*)
 	echo ${UNAME_MACHINE}-pc-cygwin
 	exit ;;
-    *:MINGW*:*)
+    i*:MINGW*:*)
 	echo ${UNAME_MACHINE}-pc-mingw32
 	exit ;;
     i*:windows32*:*)
@@ -810,24 +790,15 @@ EOF
     i*:PW*:*)
 	echo ${UNAME_MACHINE}-pc-pw32
 	exit ;;
-    *:Interix*:*)
-    	case ${UNAME_MACHINE} in
-	    x86)
-		echo i586-pc-interix${UNAME_RELEASE}
-		exit ;;
-	    authenticamd | genuineintel | EM64T)
-		echo x86_64-unknown-interix${UNAME_RELEASE}
-		exit ;;
-	    IA64)
-		echo ia64-unknown-interix${UNAME_RELEASE}
-		exit ;;
-	esac ;;
+    x86:Interix*:[3456]*)
+	echo i586-pc-interix${UNAME_RELEASE}
+	exit ;;
+    EM64T:Interix*:[3456]*)
+	echo x86_64-unknown-interix${UNAME_RELEASE}
+	exit ;;
     [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
 	echo i${UNAME_MACHINE}-pc-mks
 	exit ;;
-    8664:Windows_NT:*)
-	echo x86_64-pc-mks
-	exit ;;
     i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
@@ -857,29 +828,8 @@ EOF
     i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
 	exit ;;
-    alpha:Linux:*:*)
-	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
-	  EV5)   UNAME_MACHINE=alphaev5 ;;
-	  EV56)  UNAME_MACHINE=alphaev56 ;;
-	  PCA56) UNAME_MACHINE=alphapca56 ;;
-	  PCA57) UNAME_MACHINE=alphapca56 ;;
-	  EV6)   UNAME_MACHINE=alphaev6 ;;
-	  EV67)  UNAME_MACHINE=alphaev67 ;;
-	  EV68*) UNAME_MACHINE=alphaev68 ;;
-        esac
-	objdump --private-headers /bin/sh | grep -q ld.so.1
-	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
-	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
-	exit ;;
     arm*:Linux:*:*)
-	eval $set_cc_for_build
-	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
-	    | grep -q __ARM_EABI__
-	then
-	    echo ${UNAME_MACHINE}-unknown-linux-gnu
-	else
-	    echo ${UNAME_MACHINE}-unknown-linux-gnueabi
-	fi
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
     avr32*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
@@ -893,17 +843,6 @@ EOF
     frv:Linux:*:*)
     	echo frv-unknown-linux-gnu
 	exit ;;
-    i*86:Linux:*:*)
-	LIBC=gnu
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#ifdef __dietlibc__
-	LIBC=dietlibc
-	#endif
-EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
-	echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
-	exit ;;
     ia64:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
@@ -913,33 +852,74 @@ EOF
     m68*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
-    mips:Linux:*:* | mips64:Linux:*:*)
+    mips:Linux:*:*)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
 	#undef CPU
-	#undef ${UNAME_MACHINE}
-	#undef ${UNAME_MACHINE}el
+	#undef mips
+	#undef mipsel
 	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
-	CPU=${UNAME_MACHINE}el
+	CPU=mipsel
 	#else
 	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
-	CPU=${UNAME_MACHINE}
+	CPU=mips
 	#else
 	CPU=
 	#endif
 	#endif
 EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
+	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
+	    /^CPU/{
+		s: ::g
+		p
+	    }'`"
+	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
+	;;
+    mips64:Linux:*:*)
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
+	#undef CPU
+	#undef mips64
+	#undef mips64el
+	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
+	CPU=mips64el
+	#else
+	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
+	CPU=mips64
+	#else
+	CPU=
+	#endif
+	#endif
+EOF
+	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
+	    /^CPU/{
+		s: ::g
+		p
+	    }'`"
 	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
 	;;
     or32:Linux:*:*)
 	echo or32-unknown-linux-gnu
 	exit ;;
-    padre:Linux:*:*)
-	echo sparc-unknown-linux-gnu
+    ppc:Linux:*:*)
+	echo powerpc-unknown-linux-gnu
 	exit ;;
-    parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-gnu
+    ppc64:Linux:*:*)
+	echo powerpc64-unknown-linux-gnu
+	exit ;;
+    alpha:Linux:*:*)
+	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
+	  EV5)   UNAME_MACHINE=alphaev5 ;;
+	  EV56)  UNAME_MACHINE=alphaev56 ;;
+	  PCA56) UNAME_MACHINE=alphapca56 ;;
+	  PCA57) UNAME_MACHINE=alphapca56 ;;
+	  EV6)   UNAME_MACHINE=alphaev6 ;;
+	  EV67)  UNAME_MACHINE=alphaev67 ;;
+	  EV68*) UNAME_MACHINE=alphaev68 ;;
+        esac
+	objdump --private-headers /bin/sh | grep ld.so.1 >/dev/null
+	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
+	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
 	exit ;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
@@ -949,11 +929,8 @@ EOF
 	  *)    echo hppa-unknown-linux-gnu ;;
 	esac
 	exit ;;
-    ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-gnu
-	exit ;;
-    ppc:Linux:*:*)
-	echo powerpc-unknown-linux-gnu
+    parisc64:Linux:*:* | hppa64:Linux:*:*)
+	echo hppa64-unknown-linux-gnu
 	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
 	echo ${UNAME_MACHINE}-ibm-linux
@@ -973,9 +950,69 @@ EOF
     x86_64:Linux:*:*)
 	echo x86_64-unknown-linux-gnu
 	exit ;;
-    xtensa*:Linux:*:*)
-    	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit ;;
+    i*86:Linux:*:*)
+	# The BFD linker knows what the default object file format is, so
+	# first see if it will tell us. cd to the root directory to prevent
+	# problems with other programs or directories called `ld' in the path.
+	# Set LC_ALL=C to ensure ld outputs messages in English.
+	ld_supported_targets=`cd /; LC_ALL=C ld --help 2>&1 \
+			 | sed -ne '/supported targets:/!d
+				    s/[ 	][ 	]*/ /g
+				    s/.*supported targets: *//
+				    s/ .*//
+				    p'`
+        case "$ld_supported_targets" in
+	  elf32-i386)
+		TENTATIVE="${UNAME_MACHINE}-pc-linux-gnu"
+		;;
+	  a.out-i386-linux)
+		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
+		exit ;;
+	  coff-i386)
+		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
+		exit ;;
+	  "")
+		# Either a pre-BFD a.out linker (linux-gnuoldld) or
+		# one that does not give us useful --help.
+		echo "${UNAME_MACHINE}-pc-linux-gnuoldld"
+		exit ;;
+	esac
+	# Determine whether the default compiler is a.out or elf
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
+	#include <features.h>
+	#ifdef __ELF__
+	# ifdef __GLIBC__
+	#  if __GLIBC__ >= 2
+	LIBC=gnu
+	#  else
+	LIBC=gnulibc1
+	#  endif
+	# else
+	LIBC=gnulibc1
+	# endif
+	#else
+	#if defined(__INTEL_COMPILER) || defined(__PGI) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)
+	LIBC=gnu
+	#else
+	LIBC=gnuaout
+	#endif
+	#endif
+	#ifdef __dietlibc__
+	LIBC=dietlibc
+	#endif
+EOF
+	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
+	    /^LIBC/{
+		s: ::g
+		p
+	    }'`"
+	test x"${LIBC}" != x && {
+		echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
+		exit
+	}
+	test x"${TENTATIVE}" != x && { echo "${TENTATIVE}"; exit; }
+	;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
 	# earlier versions are messed up and put the nodename in both
@@ -1004,7 +1041,7 @@ EOF
     i*86:syllable:*:*)
 	echo ${UNAME_MACHINE}-pc-syllable
 	exit ;;
-    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*)
+    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
 	echo i386-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
     i*86:*DOS:*:*)
@@ -1048,11 +1085,8 @@ EOF
     pc:*:*:*)
 	# Left here for compatibility:
         # uname -m prints for DJGPP always 'pc', but it prints nothing about
-        # the processor, so we play safe by assuming i586.
-	# Note: whatever this is, it MUST be the same as what config.sub
-	# prints for the "djgpp" host, or else GDB configury will decide that
-	# this is a cross-build.
-	echo i586-pc-msdosdjgpp
+        # the processor, so we play safe by assuming i386.
+	echo i386-pc-msdosdjgpp
         exit ;;
     Intel:Mach:3*:*)
 	echo i386-pc-mach3
@@ -1090,16 +1124,6 @@ EOF
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
         /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
           && { echo i486-ncr-sysv4; exit; } ;;
-    NCR*:*:4.2:* | MPRAS*:*:4.2:*)
-	OS_REL='.3'
-	test -r /etc/.relid \
-	    && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
-	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	    && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
-	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; }
-	/bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \
-	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
 	echo m68k-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
@@ -1112,7 +1136,7 @@ EOF
     rs6000:LynxOS:2.*:*)
 	echo rs6000-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
-    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*)
+    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
 	echo powerpc-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
     SM[BE]S:UNIX_SV:*:*)
@@ -1175,9 +1199,6 @@ EOF
     BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
 	echo i586-pc-beos
 	exit ;;
-    BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
-	echo i586-pc-haiku
-	exit ;;
     SX-4:SUPER-UX:*:*)
 	echo sx4-nec-superux${UNAME_RELEASE}
 	exit ;;
@@ -1187,15 +1208,6 @@ EOF
     SX-6:SUPER-UX:*:*)
 	echo sx6-nec-superux${UNAME_RELEASE}
 	exit ;;
-    SX-7:SUPER-UX:*:*)
-	echo sx7-nec-superux${UNAME_RELEASE}
-	exit ;;
-    SX-8:SUPER-UX:*:*)
-	echo sx8-nec-superux${UNAME_RELEASE}
-	exit ;;
-    SX-8R:SUPER-UX:*:*)
-	echo sx8r-nec-superux${UNAME_RELEASE}
-	exit ;;
     Power*:Rhapsody:*:*)
 	echo powerpc-apple-rhapsody${UNAME_RELEASE}
 	exit ;;
@@ -1205,16 +1217,6 @@ EOF
     *:Darwin:*:*)
 	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
 	case $UNAME_PROCESSOR in
-	    i386)
-		eval $set_cc_for_build
-		if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
-		  if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
-		      (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
-		      grep IS_64BIT_ARCH >/dev/null
-		  then
-		      UNAME_PROCESSOR="x86_64"
-		  fi
-		fi ;;
 	    unknown) UNAME_PROCESSOR=powerpc ;;
 	esac
 	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
@@ -1296,9 +1298,6 @@ EOF
     i*86:rdos:*:*)
 	echo ${UNAME_MACHINE}-pc-rdos
 	exit ;;
-    i*86:AROS:*:*)
-	echo ${UNAME_MACHINE}-pc-aros
-	exit ;;
 esac
 
 #echo '(No uname command or uname output not recognized.)' 1>&2
@@ -1459,9 +1458,9 @@ This script, last modified $timestamp, has failed to recognize
 the operating system you are using. It is advised that you
 download the most up to date version of the config scripts from
 
-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.guess
 and
-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.sub
 
 If the version you run ($0) is already up to date, please
 send the following data and any information you think might be

config.h.in

@@ -1,18 +1,8 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
-/* Directory to chroot to */
-#undef CHROOT_DIR
-
 /* Pathname to the Unbound configuration file */
 #undef CONFIGFILE
 
-/* Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work
-   */
-#undef DARWIN_BROKEN_SETREUID
-
-/* Whether daemon is deprecated */
-#undef DEPRECATED_DAEMON
-
 /* Define if you want to use debug lock checking (slow). */
 #undef ENABLE_LOCK_CHECKS
 
@@ -28,85 +18,30 @@
 /* Define to 1 if your system has a working `chown' function. */
 #undef HAVE_CHOWN
 
-/* Define to 1 if you have the `chroot' function. */
-#undef HAVE_CHROOT
-
-/* Define to 1 if you have the `ctime_r' function. */
-#undef HAVE_CTIME_R
-
-/* Define to 1 if you have the `daemon' function. */
-#undef HAVE_DAEMON
-
-/* Define to 1 if you have the declaration of
-   `SSL_COMP_get_compression_methods', and to 0 if you don't. */
-#undef HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
-
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
 /* Define to 1 if you have the `event_base_free' function. */
 #undef HAVE_EVENT_BASE_FREE
 
-/* Define to 1 if you have the `event_base_get_method' function. */
-#undef HAVE_EVENT_BASE_GET_METHOD
-
-/* Define to 1 if you have the `event_base_new' function. */
-#undef HAVE_EVENT_BASE_NEW
-
 /* Define to 1 if you have the `event_base_once' function. */
 #undef HAVE_EVENT_BASE_ONCE
 
 /* Define to 1 if you have the <event.h> header file. */
 #undef HAVE_EVENT_H
 
-/* Define to 1 if you have the `EVP_sha1' function. */
-#undef HAVE_EVP_SHA1
-
-/* Define to 1 if you have the `EVP_sha256' function. */
-#undef HAVE_EVP_SHA256
-
-/* Define to 1 if you have the `EVP_sha512' function. */
-#undef HAVE_EVP_SHA512
-
-/* Define to 1 if you have the `ev_loop' function. */
-#undef HAVE_EV_LOOP
-
-/* Define to 1 if you have the `fcntl' function. */
-#undef HAVE_FCNTL
-
 /* Define to 1 if you have the `fork' function. */
 #undef HAVE_FORK
 
 /* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
 #undef HAVE_FSEEKO
 
-/* Whether getaddrinfo is available */
+/* Define to 1 if you have the `getaddrinfo' function. */
 #undef HAVE_GETADDRINFO
 
 /* Define to 1 if you have the <getopt.h> header file. */
 #undef HAVE_GETOPT_H
 
-/* Define to 1 if you have the `getpwnam' function. */
-#undef HAVE_GETPWNAM
-
-/* Define to 1 if you have the `getrlimit' function. */
-#undef HAVE_GETRLIMIT
-
-/* Define to 1 if you have the `glob' function. */
-#undef HAVE_GLOB
-
-/* Define to 1 if you have the <glob.h> header file. */
-#undef HAVE_GLOB_H
-
-/* Define to 1 if you have the `gmtime_r' function. */
-#undef HAVE_GMTIME_R
-
-/* Define to 1 if you have the <grp.h> header file. */
-#undef HAVE_GRP_H
-
-/* If you have HMAC_CTX_init */
-#undef HAVE_HMAC_CTX_INIT
-
 /* Define to 1 if you have the `inet_aton' function. */
 #undef HAVE_INET_ATON
 
@@ -116,32 +51,20 @@
 /* Define to 1 if you have the `inet_pton' function. */
 #undef HAVE_INET_PTON
 
-/* Define to 1 if you have the `initgroups' function. */
-#undef HAVE_INITGROUPS
-
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
-/* if the function 'ioctlsocket' is available */
-#undef HAVE_IOCTLSOCKET
+/* Define to 1 if you have the `crypto' library (-lcrypto). */
+#undef HAVE_LIBCRYPTO
 
-/* Define to 1 if you have the <iphlpapi.h> header file. */
-#undef HAVE_IPHLPAPI_H
+/* Define to 1 if you have the `nsl' library (-lnsl). */
+#undef HAVE_LIBNSL
 
-/* Define to 1 if you have the `kill' function. */
-#undef HAVE_KILL
+/* Define to 1 if you have the `rt' library (-lrt). */
+#undef HAVE_LIBRT
 
-/* Define to 1 if you have the <ldns/ldns.h> header file. */
-#undef HAVE_LDNS_LDNS_H
-
-/* Define to 1 if you have the `ldns' library (-lldns). */
-#undef HAVE_LIBLDNS
-
-/* Define to 1 if you have the `localtime_r' function. */
-#undef HAVE_LOCALTIME_R
-
-/* Define to 1 if you have the <login_cap.h> header file. */
-#undef HAVE_LOGIN_CAP_H
+/* Define to 1 if you have the `socket' library (-lsocket). */
+#undef HAVE_LIBSOCKET
 
 /* Define to 1 if your system has a GNU libc compatible `malloc' function, and
    to 0 otherwise. */
@@ -153,27 +76,12 @@
 /* Define to 1 if you have the <memory.h> header file. */
 #undef HAVE_MEMORY_H
 
-/* Define to 1 if you have the <netdb.h> header file. */
-#undef HAVE_NETDB_H
-
 /* Define to 1 if you have the <netinet/in.h> header file. */
 #undef HAVE_NETINET_IN_H
 
-/* Define to 1 if you have the `OPENSSL_config' function. */
-#undef HAVE_OPENSSL_CONFIG
-
-/* Define to 1 if you have the <openssl/conf.h> header file. */
-#undef HAVE_OPENSSL_CONF_H
-
-/* Define to 1 if you have the <openssl/engine.h> header file. */
-#undef HAVE_OPENSSL_ENGINE_H
-
 /* Define to 1 if you have the <openssl/err.h> header file. */
 #undef HAVE_OPENSSL_ERR_H
 
-/* Define to 1 if you have the <openssl/rand.h> header file. */
-#undef HAVE_OPENSSL_RAND_H
-
 /* Define to 1 if you have the <openssl/ssl.h> header file. */
 #undef HAVE_OPENSSL_SSL_H
 
@@ -186,57 +94,12 @@
 /* Define to 1 if the system has the type `pthread_spinlock_t'. */
 #undef HAVE_PTHREAD_SPINLOCK_T
 
-/* Define to 1 if you have the <pwd.h> header file. */
-#undef HAVE_PWD_H
-
-/* Define if you have Python libraries and header files. */
-#undef HAVE_PYTHON
-
-/* Define to 1 if you have the `random' function. */
-#undef HAVE_RANDOM
-
-/* Define to 1 if you have the `recvmsg' function. */
-#undef HAVE_RECVMSG
-
-/* Define to 1 if you have the `sbrk' function. */
-#undef HAVE_SBRK
-
-/* Define to 1 if you have the `sendmsg' function. */
-#undef HAVE_SENDMSG
-
-/* Define to 1 if you have the `setregid' function. */
-#undef HAVE_SETREGID
-
-/* Define to 1 if you have the `setresgid' function. */
-#undef HAVE_SETRESGID
-
-/* Define to 1 if you have the `setresuid' function. */
-#undef HAVE_SETRESUID
-
-/* Define to 1 if you have the `setreuid' function. */
-#undef HAVE_SETREUID
-
-/* Define to 1 if you have the `setsid' function. */
-#undef HAVE_SETSID
-
-/* Define to 1 if you have the `setusercontext' function. */
-#undef HAVE_SETUSERCONTEXT
-
-/* Define to 1 if you have the `sigprocmask' function. */
-#undef HAVE_SIGPROCMASK
-
-/* Define to 1 if you have the `sleep' function. */
-#undef HAVE_SLEEP
-
 /* Define to 1 if you have the `snprintf' function. */
 #undef HAVE_SNPRINTF
 
 /* Using Solaris threads */
 #undef HAVE_SOLARIS_THREADS
 
-/* Define to 1 if you have the `srandom' function. */
-#undef HAVE_SRANDOM
-
 /* Define if you have the SSL libraries installed. */
 #undef HAVE_SSL
 
@@ -252,9 +115,6 @@
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H
 
-/* Define to 1 if you have the `strftime' function. */
-#undef HAVE_STRFTIME
-
 /* Define to 1 if you have the <strings.h> header file. */
 #undef HAVE_STRINGS_H
 
@@ -264,18 +124,12 @@
 /* Define to 1 if you have the `strlcpy' function. */
 #undef HAVE_STRLCPY
 
-/* Define if you have Swig libraries and header files. */
-#undef HAVE_SWIG
-
 /* Define to 1 if you have the <syslog.h> header file. */
 #undef HAVE_SYSLOG_H
 
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H
 
-/* Define to 1 if you have the <sys/resource.h> header file. */
-#undef HAVE_SYS_RESOURCE_H
-
 /* Define to 1 if you have the <sys/socket.h> header file. */
 #undef HAVE_SYS_SOCKET_H
 
@@ -288,95 +142,27 @@
 /* Define to 1 if you have the <sys/uio.h> header file. */
 #undef HAVE_SYS_UIO_H
 
-/* Define to 1 if you have the <sys/wait.h> header file. */
-#undef HAVE_SYS_WAIT_H
-
 /* Define to 1 if you have the <time.h> header file. */
 #undef HAVE_TIME_H
 
-/* Define to 1 if you have the `tzset' function. */
-#undef HAVE_TZSET
-
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 
-/* Define to 1 if you have the `usleep' function. */
-#undef HAVE_USLEEP
-
 /* Define to 1 if you have the `vfork' function. */
 #undef HAVE_VFORK
 
 /* Define to 1 if you have the <vfork.h> header file. */
 #undef HAVE_VFORK_H
 
-/* Define to 1 if you have the <windows.h> header file. */
-#undef HAVE_WINDOWS_H
-
-/* Using Windows threads */
-#undef HAVE_WINDOWS_THREADS
-
-/* Define to 1 if you have the <winsock2.h> header file. */
-#undef HAVE_WINSOCK2_H
-
 /* Define to 1 if `fork' works. */
 #undef HAVE_WORKING_FORK
 
 /* Define to 1 if `vfork' works. */
 #undef HAVE_WORKING_VFORK
 
-/* Define to 1 if you have the `writev' function. */
-#undef HAVE_WRITEV
-
-/* Define to 1 if you have the <ws2tcpip.h> header file. */
-#undef HAVE_WS2TCPIP_H
-
-/* Define to 1 if you have the `_beginthreadex' function. */
-#undef HAVE__BEGINTHREADEX
-
-/* if lex has yylex_destroy */
-#undef LEX_HAS_YYLEX_DESTROY
-
-/* Define to the sub-directory in which libtool stores uninstalled libraries.
-   */
-#undef LT_OBJDIR
-
 /* Define to the maximum message length to pass to syslog. */
 #undef MAXSYSLOGMSGLEN
 
-/* Define if memcmp() does not compare unsigned bytes */
-#undef MEMCMP_IS_BROKEN
-
-/* Define if mkdir has one argument. */
-#undef MKDIR_HAS_ONE_ARG
-
-/* Define if the network stack does not fully support nonblocking io (causes
-   lower performance). */
-#undef NONBLOCKING_IS_BROKEN
-
-/* Put -D_ALL_SOURCE define in config.h */
-#undef OMITTED__D_ALL_SOURCE
-
-/* Put -D_BSD_SOURCE define in config.h */
-#undef OMITTED__D_BSD_SOURCE
-
-/* Put -D_GNU_SOURCE define in config.h */
-#undef OMITTED__D_GNU_SOURCE
-
-/* Put -D_LARGEFILE_SOURCE=1 define in config.h */
-#undef OMITTED__D_LARGEFILE_SOURCE_1
-
-/* Put -D_POSIX_C_SOURCE=200112 define in config.h */
-#undef OMITTED__D_POSIX_C_SOURCE_200112
-
-/* Put -D_XOPEN_SOURCE=600 define in config.h */
-#undef OMITTED__D_XOPEN_SOURCE_600
-
-/* Put -D_XOPEN_SOURCE_EXTENDED=1 define in config.h */
-#undef OMITTED__D_XOPEN_SOURCE_EXTENDED_1
-
-/* Put -D__EXTENSIONS__ define in config.h */
-#undef OMITTED__D__EXTENSIONS__
-
 /* Define to the address where bug reports for this package should be sent. */
 #undef PACKAGE_BUGREPORT
 
@@ -389,15 +175,9 @@
 /* Define to the one symbol short name of this package. */
 #undef PACKAGE_TARNAME
 
-/* Define to the home page for this package. */
-#undef PACKAGE_URL
-
 /* Define to the version of this package. */
 #undef PACKAGE_VERSION
 
-/* default pidfile location */
-#undef PIDFILE
-
 /* Define to necessary symbol if this constant uses a non-standard name on
    your system. */
 #undef PTHREAD_CREATE_JOINABLE
@@ -405,83 +185,29 @@
 /* Define as the return type of signal handlers (`int' or `void'). */
 #undef RETSIGTYPE
 
-/* version number for resource files */
-#undef RSRC_PACKAGE_VERSION
-
-/* Directory to chdir to */
-#undef RUN_DIR
-
-/* Shared data */
-#undef SHARE_DIR
-
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 
-/* Use win32 resources and API */
-#undef UB_ON_WINDOWS
-
-/* default username */
-#undef UB_USERNAME
-
-/* use to enable lightweight alloc assertions, for debug use */
-#undef UNBOUND_ALLOC_LITE
-
-/* use malloc not regions, for debug use */
-#undef UNBOUND_ALLOC_NONREGIONAL
+/* Define to 'int' or type of struct msghdr.msg_iovlen. */
+#undef TYPE_MSGIOVLEN
 
 /* use statistics for allocs and frees, for debug use */
 #undef UNBOUND_ALLOC_STATS
 
-/* define this to enable debug checks. */
-#undef UNBOUND_DEBUG
-
-/* Define this to enable GOST support. */
-#undef USE_GOST
-
 /* Define if you want to use internal select based events */
 #undef USE_MINI_EVENT
 
-/* Define this to enable SHA256 and SHA512 support. */
-#undef USE_SHA2
-
-/* Enable extensions on AIX 3, Interix.  */
-#ifndef _ALL_SOURCE
-# undef _ALL_SOURCE
-#endif
-/* Enable GNU extensions on systems that have them.  */
-#ifndef _GNU_SOURCE
-# undef _GNU_SOURCE
-#endif
-/* Enable threading extensions on Solaris.  */
-#ifndef _POSIX_PTHREAD_SEMANTICS
-# undef _POSIX_PTHREAD_SEMANTICS
-#endif
-/* Enable extensions on HP NonStop.  */
-#ifndef _TANDEM_SOURCE
-# undef _TANDEM_SOURCE
-#endif
-/* Enable general extensions on Solaris.  */
-#ifndef __EXTENSIONS__
-# undef __EXTENSIONS__
-#endif
-
-
-/* Whether the windows socket API is used */
-#undef USE_WINSOCK
-
-/* the version of the windows API enabled */
-#undef WINVER
-
-/* Define if you want Python module. */
-#undef WITH_PYTHONMODULE
-
-/* Define if you want PyUnbound. */
-#undef WITH_PYUNBOUND
-
 /* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
    `char[]'. */
 #undef YYTEXT_POINTER
 
+/* Define to 1 if on AIX 3.
+   System headers sometimes define this.
+   We just want to avoid a redefinition error message.  */
+#ifndef _ALL_SOURCE
+# undef _ALL_SOURCE
+#endif
+
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS
 
@@ -491,16 +217,6 @@
 /* Define for large files, on AIX-style hosts. */
 #undef _LARGE_FILES
 
-/* Define to 1 if on MINIX. */
-#undef _MINIX
-
-/* Define to 2 if the system does not provide POSIX.1 features except with
-   this defined. */
-#undef _POSIX_1_SOURCE
-
-/* Define to 1 if you need to in order for `stat' and other things to work. */
-#undef _POSIX_SOURCE
-
 /* Define to empty if `const' does not conform to ANSI C. */
 #undef const
 
@@ -528,10 +244,10 @@
 /* Define to `long long' if <sys/types.h> does not define. */
 #undef int64_t
 
-/* Define to `signed char' if <sys/types.h> does not define. */
+/* Define to `char' if <sys/types.h> does not define. */
 #undef int8_t
 
-/* Define if replacement function should be used. */
+/* Define to rpl_malloc if the replacement function should be used. */
 #undef malloc
 
 /* Define to `long int' if <sys/types.h> does not define. */
@@ -540,9 +256,6 @@
 /* Define to `int' if <sys/types.h> does not define. */
 #undef pid_t
 
-/* Define to 'int' if not defined */
-#undef rlim_t
-
 /* Define to `unsigned int' if <sys/types.h> does not define. */
 #undef size_t
 
@@ -552,7 +265,7 @@
 /* Define to `int' if <sys/types.h> does not define. */
 #undef ssize_t
 
-/* Define to 'unsigned char if not defined */
+/* Define to `unsigned char' if <sys/types.h> does not define. */
 #undef u_char
 
 /* Define to `int' if <sys/types.h> doesn't define. */
@@ -573,44 +286,6 @@
 /* Define as `fork' if `vfork' does not work. */
 #undef vfork
 
-#if defined(OMITTED__D_GNU_SOURCE) && !defined(_GNU_SOURCE)
-#define _GNU_SOURCE 1
-#endif 
-
-#if defined(OMITTED__D_BSD_SOURCE) && !defined(_BSD_SOURCE)
-#define _BSD_SOURCE 1
-#endif 
-
-#if defined(OMITTED__D__EXTENSIONS__) && !defined(__EXTENSIONS__)
-#define __EXTENSIONS__ 1
-#endif 
-
-#if defined(OMITTED__D_POSIX_C_SOURCE_200112) && !defined(_POSIX_C_SOURCE)
-#define _POSIX_C_SOURCE 200112
-#endif 
-
-#if defined(OMITTED__D_XOPEN_SOURCE_600) && !defined(_XOPEN_SOURCE)
-#define _XOPEN_SOURCE 600
-#endif 
-
-#if defined(OMITTED__D_XOPEN_SOURCE_EXTENDED_1) && !defined(_XOPEN_SOURCE_EXTENDED)
-#define _XOPEN_SOURCE_EXTENDED 1
-#endif 
-
-#if defined(OMITTED__D_ALL_SOURCE) && !defined(_ALL_SOURCE)
-#define _ALL_SOURCE 1
-#endif 
-
-#if defined(OMITTED__D_LARGEFILE_SOURCE_1) && !defined(_LARGEFILE_SOURCE)
-#define _LARGEFILE_SOURCE 1
-#endif 
-
-
-
-
-#ifndef UNBOUND_DEBUG
-#  define NDEBUG
-#endif
 
 #include <stdio.h>
 #include <string.h>
@@ -648,24 +323,20 @@
 #include <arpa/inet.h>
 #endif
 
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
 #endif
 
-#ifdef HAVE_WS2TCPIP_H
-#include <ws2tcpip.h>
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
 #endif
 
-
- 
 #ifdef HAVE_ATTR_FORMAT
 #  define ATTR_FORMAT(archetype, string_index, first_to_check) \
     __attribute__ ((format (archetype, string_index, first_to_check)))
 #else /* !HAVE_ATTR_FORMAT */
 #  define ATTR_FORMAT(archetype, string_index, first_to_check) /* empty */
 #endif /* !HAVE_ATTR_FORMAT */
-
-
 #if defined(DOXYGEN)
 #  define ATTR_UNUSED(x)  x
 #elif defined(__cplusplus)
@@ -675,117 +346,23 @@
 #else /* !HAVE_ATTR_UNUSED */
 #  define ATTR_UNUSED(x)  x
 #endif /* !HAVE_ATTR_UNUSED */
-
-
 #ifndef HAVE_FSEEKO
 #define fseeko fseek
 #define ftello ftell
 #endif /* HAVE_FSEEKO */
-
-
-#ifndef MAXHOSTNAMELEN
-#define MAXHOSTNAMELEN 256
-#endif
-
-
-#ifndef HAVE_SNPRINTF
-#define snprintf snprintf_unbound
-#define vsnprintf vsnprintf_unbound
-#include <stdarg.h>
-int snprintf (char *str, size_t count, const char *fmt, ...);
-int vsnprintf (char *str, size_t count, const char *fmt, va_list arg);
-#endif /* HAVE_SNPRINTF */
-
-
-#ifndef HAVE_INET_PTON
-#define inet_pton inet_pton_unbound
-int inet_pton(int af, const char* src, void* dst);
-#endif /* HAVE_INET_PTON */
-
-
-#ifndef HAVE_INET_NTOP
-#define inet_ntop inet_ntop_unbound
-const char *inet_ntop(int af, const void *src, char *dst, size_t size);
-#endif
-
-
-#ifndef HAVE_INET_ATON
-#define inet_aton inet_aton_unbound
-int inet_aton(const char *cp, struct in_addr *addr);
-#endif
-
-
-#ifndef HAVE_MEMMOVE
-#define memmove memmove_unbound
-void *memmove(void *dest, const void *src, size_t n);
-#endif
-
-
-#ifndef HAVE_STRLCPY
-#define strlcpy strlcpy_unbound
-size_t strlcpy(char *dst, const char *src, size_t siz);
-#endif
-
-
-#ifndef HAVE_GMTIME_R
-#define gmtime_r gmtime_r_unbound
-struct tm *gmtime_r(const time_t *timep, struct tm *result);
-#endif
-
-
-#ifndef HAVE_SLEEP
-#define sleep(x) Sleep((x)*1000) /* on win32 */
-#endif /* HAVE_SLEEP */
-
-
-#ifndef HAVE_USLEEP
-#define usleep(x) Sleep((x)/1000 + 1) /* on win32 */
-#endif /* HAVE_USLEEP */
-
-
-#ifndef HAVE_RANDOM
-#define random rand /* on win32, for tests only (bad random) */
-#endif /* HAVE_RANDOM */
-
-
-#ifndef HAVE_SRANDOM
-#define srandom(x) srand(x) /* on win32, for tests only (bad random) */
-#endif /* HAVE_SRANDOM */
-
-
-/* detect if we need to cast to unsigned int for FD_SET to avoid warnings */
-#ifdef HAVE_WINSOCK2_H
-#define FD_SET_T (u_int)
-#else
-#define FD_SET_T 
-#endif
-
-
-#ifndef IPV6_MIN_MTU
-#define IPV6_MIN_MTU 1280
-#endif /* IPV6_MIN_MTU */
-
-
-#ifdef MEMCMP_IS_BROKEN
-#  ifdef memcmp
-#  undef memcmp
-#  endif
-#define memcmp memcmp_unbound
-int memcmp(const void *x, const void *y, size_t n);
-#endif
-
-
-
-#ifndef HAVE_CTIME_R
-#define ctime_r unbound_ctime_r
-char *ctime_r(const time_t *timep, char *buf);
-#endif
-
 #if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
    /* using version of libevent that is not threadsafe. */
 #  define LIBEVENT_SIGNAL_PROBLEM 1
 #endif
 
+#ifndef RAND_MAX
+#define RAND_MAX	2147483647
+#endif
+
+#ifndef IPV6_MIN_MTU
+#define IPV6_MIN_MTU 1280
+#endif /* IPV6_MIN_MTU */
+
 #ifndef CHECKED_INET6
 #  define CHECKED_INET6
 #  ifdef AF_INET6
@@ -797,11 +374,34 @@ char *ctime_r(const time_t *timep, char *buf);
 
 /* maximum nesting of included files */
 #define MAXINCLUDES 10
+
+#ifndef HAVE_SNPRINTF
+#include <stdarg.h>
+int snprintf (char *str, size_t count, const char *fmt, ...);
+int vsnprintf (char *str, size_t count, const char *fmt, va_list arg);
+#endif /* HAVE_SNPRINTF */
+#ifndef HAVE_INET_PTON
+int inet_pton(int af, const char* src, void* dst);
+#endif /* HAVE_INET_PTON */
+#ifndef HAVE_INET_NTOP
+const char *inet_ntop(int af, const void *src, char *dst, size_t size);
+#endif
+#ifndef HAVE_INET_ATON
+int inet_aton(const char *cp, struct in_addr *addr);
+#endif
+#ifndef HAVE_MEMMOVE
+void *memmove(void *dest, const void *src, size_t n);
+#endif
+#ifndef HAVE_STRLCPY
+size_t strlcpy(char *dst, const char *src, size_t siz);
+#endif
 #ifndef HAVE_GETADDRINFO
 struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif
 
+#include "ldns/ldns.h"
+
 #ifdef UNBOUND_ALLOC_STATS
 #  define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
@@ -819,9 +419,7 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-#elif defined(UNBOUND_ALLOC_LITE)
-#  include "util/alloc.h"
-#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
+#endif /* UNBOUND_ALLOC_STATS */
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53

config.sub

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
-#   Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
+#   Inc.
 
-timestamp='2009-11-20'
+timestamp='2006-09-20'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -32,16 +32,13 @@ timestamp='2009-11-20'
 
 
 # Please send patches to <config-patches@gnu.org>.  Submit a context
-# diff and a properly formatted GNU ChangeLog entry.
+# diff and a properly formatted ChangeLog entry.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
 # Supply the specified configuration type as an argument.
 # If it is invalid, we print an error message on stderr and exit with code 1.
 # Otherwise, we print the canonical config type on stdout and succeed.
 
-# You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
-
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
 # that are meaningful with *any* GNU software.
@@ -75,8 +72,8 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
-2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
+Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -125,7 +122,6 @@ maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
   nto-qnx* | linux-gnu* | linux-dietlibc | linux-newlib* | linux-uclibc* | \
   uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* | \
-  kopensolaris*-gnu* | \
   storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
@@ -152,13 +148,10 @@ case $os in
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis | -knuth | -cray | -microblaze)
+	-apple | -axis | -knuth | -cray)
 		os=
 		basic_machine=$1
 		;;
-        -bluegene*)
-	        os=-cnk
-		;;
 	-sim | -cisco | -oki | -wec | -winbond)
 		os=
 		basic_machine=$1
@@ -252,20 +245,17 @@ case $basic_machine in
 	| bfin \
 	| c4x | clipper \
 	| d10v | d30v | dlx | dsp16xx \
-	| fido | fr30 | frv \
+	| fr30 | frv \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| i370 | i860 | i960 | ia64 \
 	| ip2k | iq2000 \
-	| lm32 \
 	| m32c | m32r | m32rle | m68000 | m68k | m88k \
-	| maxq | mb | microblaze | mcore | mep | metag \
+	| maxq | mb | microblaze | mcore \
 	| mips | mipsbe | mipseb | mipsel | mipsle \
 	| mips16 \
 	| mips64 | mips64el \
-	| mips64octeon | mips64octeonel \
-	| mips64orion | mips64orionel \
-	| mips64r5900 | mips64r5900el \
 	| mips64vr | mips64vrel \
+	| mips64orion | mips64orionel \
 	| mips64vr4100 | mips64vr4100el \
 	| mips64vr4300 | mips64vr4300el \
 	| mips64vr5000 | mips64vr5000el \
@@ -278,7 +268,6 @@ case $basic_machine in
 	| mipsisa64sr71k | mipsisa64sr71kel \
 	| mipstx39 | mipstx39el \
 	| mn10200 | mn10300 \
-	| moxie \
 	| mt \
 	| msp430 \
 	| nios | nios2 \
@@ -287,22 +276,20 @@ case $basic_machine in
 	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
 	| pyramid \
-	| rx \
 	| score \
-	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
+	| sh | sh[1234] | sh[24]a | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
 	| sh64 | sh64le \
 	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
 	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
 	| spu | strongarm \
 	| tahoe | thumb | tic4x | tic80 | tron \
-	| ubicom32 \
 	| v850 | v850e \
 	| we32k \
 	| x86 | xc16x | xscale | xscalee[bl] | xstormy16 | xtensa \
-	| z8k | z80)
+	| z8k)
 		basic_machine=$basic_machine-unknown
 		;;
-	m6811 | m68hc11 | m6812 | m68hc12 | picochip)
+	m6811 | m68hc11 | m6812 | m68hc12)
 		# Motorola 68HC11/12.
 		basic_machine=$basic_machine-unknown
 		os=-none
@@ -337,22 +324,19 @@ case $basic_machine in
 	| clipper-* | craynv-* | cydra-* \
 	| d10v-* | d30v-* | dlx-* \
 	| elxsi-* \
-	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
+	| f30[01]-* | f700-* | fr30-* | frv-* | fx80-* \
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
 	| i*86-* | i860-* | i960-* | ia64-* \
 	| ip2k-* | iq2000-* \
-	| lm32-* \
 	| m32c-* | m32r-* | m32rle-* \
 	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* | microblaze-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* \
 	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
 	| mips16-* \
 	| mips64-* | mips64el-* \
-	| mips64octeon-* | mips64octeonel-* \
-	| mips64orion-* | mips64orionel-* \
-	| mips64r5900-* | mips64r5900el-* \
 	| mips64vr-* | mips64vrel-* \
+	| mips64orion-* | mips64orionel-* \
 	| mips64vr4100-* | mips64vr4100el-* \
 	| mips64vr4300-* | mips64vr4300el-* \
 	| mips64vr5000-* | mips64vr5000el-* \
@@ -373,26 +357,21 @@ case $basic_machine in
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
 	| pyramid-* \
-	| romp-* | rs6000-* | rx-* \
-	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
+	| romp-* | rs6000-* \
+	| sh-* | sh[1234]-* | sh[24]a-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
 	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
 	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
 	| sparclite-* \
 	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | strongarm-* | sv1-* | sx?-* \
 	| tahoe-* | thumb-* \
-	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* | tile-* \
+	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
 	| tron-* \
-	| ubicom32-* \
 	| v850-* | v850e-* | vax-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* | xscale-* | xscalee[bl]-* \
-	| xstormy16-* | xtensa*-* \
+	| xstormy16-* | xtensa-* \
 	| ymp-* \
-	| z8k-* | z80-*)
-		;;
-	# Recognize the basic CPU types without company name, with glob match.
-	xtensa*)
-		basic_machine=$basic_machine-unknown
+	| z8k-*)
 		;;
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
@@ -456,10 +435,6 @@ case $basic_machine in
 		basic_machine=m68k-apollo
 		os=-bsd
 		;;
-	aros)
-		basic_machine=i386-pc
-		os=-aros
-		;;
 	aux)
 		basic_machine=m68k-apple
 		os=-aux
@@ -468,26 +443,10 @@ case $basic_machine in
 		basic_machine=ns32k-sequent
 		os=-dynix
 		;;
-	blackfin)
-		basic_machine=bfin-unknown
-		os=-linux
-		;;
-	blackfin-*)
-		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
-	bluegene*)
-		basic_machine=powerpc-ibm
-		os=-cnk
-		;;
 	c90)
 		basic_machine=c90-cray
 		os=-unicos
 		;;
-        cegcc)
-		basic_machine=arm-unknown
-		os=-cegcc
-		;;
 	convex-c1)
 		basic_machine=c1-convex
 		os=-bsd
@@ -516,8 +475,8 @@ case $basic_machine in
 		basic_machine=craynv-cray
 		os=-unicosmp
 		;;
-	cr16)
-		basic_machine=cr16-unknown
+	cr16c)
+		basic_machine=cr16c-unknown
 		os=-elf
 		;;
 	crds | unos)
@@ -555,10 +514,6 @@ case $basic_machine in
 		basic_machine=m88k-motorola
 		os=-sysv3
 		;;
-	dicos)
-		basic_machine=i686-pc
-		os=-dicos
-		;;
 	djgpp)
 		basic_machine=i586-pc
 		os=-msdosdjgpp
@@ -713,14 +668,6 @@ case $basic_machine in
 		basic_machine=m68k-isi
 		os=-sysv
 		;;
-	m68knommu)
-		basic_machine=m68k-unknown
-		os=-linux
-		;;
-	m68knommu-*)
-		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
 	m88k-omron*)
 		basic_machine=m88k-omron
 		;;
@@ -732,17 +679,10 @@ case $basic_machine in
 		basic_machine=ns32k-utek
 		os=-sysv
 		;;
-        microblaze)
-		basic_machine=microblaze-xilinx
-		;;
 	mingw32)
 		basic_machine=i386-pc
 		os=-mingw32
 		;;
-	mingw32ce)
-		basic_machine=arm-unknown
-		os=-mingw32ce
-		;;
 	miniframe)
 		basic_machine=m68000-convergent
 		;;
@@ -869,14 +809,6 @@ case $basic_machine in
 		basic_machine=i860-intel
 		os=-osf
 		;;
-	parisc)
-		basic_machine=hppa-unknown
-		os=-linux
-		;;
-	parisc-*)
-		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
 	pbd)
 		basic_machine=sparc-tti
 		;;
@@ -993,9 +925,6 @@ case $basic_machine in
 		basic_machine=sh-hitachi
 		os=-hms
 		;;
-	sh5el)
-		basic_machine=sh5le-unknown
-		;;
 	sh64)
 		basic_machine=sh64-unknown
 		;;
@@ -1085,10 +1014,6 @@ case $basic_machine in
 		basic_machine=tic6x-unknown
 		os=-coff
 		;;
-	tile*)
-		basic_machine=tile-unknown
-		os=-linux-gnu
-		;;
 	tx39)
 		basic_machine=mipstx39-unknown
 		;;
@@ -1164,10 +1089,6 @@ case $basic_machine in
 		basic_machine=z8k-unknown
 		os=-sim
 		;;
-	z80-*-coff)
-		basic_machine=z80-unknown
-		os=-sim
-		;;
 	none)
 		basic_machine=none-none
 		os=-none
@@ -1206,7 +1127,7 @@ case $basic_machine in
 	we32k)
 		basic_machine=we32k-att
 		;;
-	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
+	sh[1234] | sh[24]a | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
 	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
@@ -1256,9 +1177,6 @@ case $os in
         # First match some system type aliases
         # that might get confused with valid system types.
 	# -solaris* is a basic system type, with this one exception.
-        -auroraux)
-	        os=-auroraux
-		;;
 	-solaris1 | -solaris1.*)
 		os=`echo $os | sed -e 's|solaris1|sunos4|'`
 		;;
@@ -1279,11 +1197,10 @@ case $os in
 	# Each alternative MUST END IN A *, to match a version number.
 	# -sysv* is not here because it comes later, after sysvr4.
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
-	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
-	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
-	      | -sym* | -kopensolaris* \
+	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\
+	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* | -aros* \
+	      | -aos* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
 	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
@@ -1292,7 +1209,7 @@ case $os in
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* | -cegcc* \
+	      | -chorusos* | -chorusrdb* \
 	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
 	      | -mingw32* | -linux-gnu* | -linux-newlib* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* \
@@ -1302,7 +1219,7 @@ case $os in
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
 	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*)
+	      | -skyos* | -haiku* | -rdos* | -toppers*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1432,9 +1349,6 @@ case $os in
 	-zvmoe)
 		os=-zvmoe
 		;;
-	-dicos*)
-		os=-dicos
-		;;
 	-none)
 		;;
 	*)
@@ -1500,9 +1414,6 @@ case $basic_machine in
 	m68*-cisco)
 		os=-aout
 		;;
-        mep-*)
-		os=-elf
-		;;
 	mips*-cisco)
 		os=-elf
 		;;
@@ -1632,7 +1543,7 @@ case $basic_machine in
 			-sunos*)
 				vendor=sun
 				;;
-			-cnk*|-aix*)
+			-aix*)
 				vendor=ibm
 				;;
 			-beos*)

contrib/README

@@ -1,20 +0,0 @@
-These files are contributed to unbound, and are not part of the official
-distribution but may be helpful.
-
-* rc_d_unbound: FreeBSD compatible /etc/rc.d script.
-* parseunbound.pl: perl script to run from cron that parses statistics from
-	the log file and stores them.
-* unbound.spec and unbound.init: RPM specfile and Linux rc.d initfile.
-* update-anchor.sh: shell script that uses unbound-host to update a set
-	of trust anchor files. Run from cron twice a month.
-* update-itar.sh: shell script that updates from itar.iana.org. Run from cron.
-* split-itar.sh: shell script to split anchors.mf from itar.iana.org into
-	multiple key files so it can be used with auto-trust-anchor-file.
-* unbound_munin_ : plugin for munin statistics report
-* unbound_cacti.tar.gz : setup files for cacti statistics report
-* selinux: the .fc and .te files for SElinux protection of the unbound daemon
-* unbound.plist: launchd configuration file for MacOSX.
-* build-unbound-localzone-from-hosts.pl: perl script to turn /etc/hosts into
-	a local-zone and local-data include file for unbound.conf.
-* unbound-host.nagios.patch: makes unbound-host return status that fits right
-	in with the nagios monitoring framework.  Contributed by Migiel de Vos.

contrib/build-unbound-localzone-from-hosts.pl

@@ -1,67 +0,0 @@
-#!/usr/bin/perl -WT
-
-use strict;
-use warnings;
-
-my $hostsfile = '/etc/hosts';
-my $localzonefile = '/etc/unbound/localzone.conf.new';
-
-my $localzone = 'example.com';
-
-open( HOSTS,"<${hostsfile}" ) or die( "Could not open ${hostsfile}: $!" );
-open( ZONE,">${localzonefile}" ) or die( "Could not open ${localzonefile}: $!" );
-
-print ZONE "server:\n\n";
-print ZONE "local-zone: \"${localzone}\" transparent\n\n";
-
-my %ptrhash;
-
-while ( my $hostline = <HOSTS> ) {
-
-	# Skip comments
-	if ( $hostline !~ "^#" and $hostline !~ '^\s+$' ) {
-
-		my @entries = split( /\s+/, $hostline );
-
-		my $ip;
-
-		my $count = 0;
-		foreach my $entry ( @entries ) {
-			if ( $count == 0 ) {
-				$ip = $entry;
-			} else {
-
-				if ( $count == 1) {
-
-					# Only return localhost for 127.0.0.1 and ::1
-					if ( ($ip ne '127.0.0.1' and $ip ne '::1') or $entry =~ 'localhost' ) {
-						if ( ! defined $ptrhash{$ip} ) {
-							$ptrhash{$ip} = $entry;
-							print ZONE "local-data-ptr: \"$ip $entry\"\n";
-						}
-					}
-
-				}
-
-				# Use AAAA for IPv6 addresses
-				my $a = 'A';
-				if ( $ip =~ ':' ) {
-					$a = 'AAAA';
-				}
-
-				print ZONE "local-data: \"$entry ${a} $ip\"\n";
-
-			}
-			$count++;
-		}
-		print ZONE "\n";
-
-
-	}
-}
-
-
-
-
-__END__
-

contrib/parseunbound.pl

@@ -1,140 +0,0 @@
-#!/usr/local/bin/perl -w
-#
-# Script to parse the output from the unbound namedaemon.
-# Unbound supports a threading model, and outputs a multiline log-blob for
-# every thread.
-#
-# This script should parse all threads of the once, and store it
-# in a local cached file for speedy results when queried lots.
-#
-use strict;
-use POSIX qw(SEEK_END);
-use Storable;
-use FileHandle;
-use Carp qw(croak carp);
-use constant UNBOUND_CACHE => "/var/tmp/unbound-cache.stor";
-
-my $run_from_cron = @ARGV && $ARGV[0] eq "--cron" && shift;
-my $DEBUG = -t STDERR;
-
-# NB. VERY IMPORTANTES: set this when running this script.
-my $numthreads = 4;
-
-### if cache exists, read it in. and is newer than 3 minutes
-if ( -r UNBOUND_CACHE ) {
-    my $result = retrieve(UNBOUND_CACHE);
-    if (-M _ < 3/24/60 && !$run_from_cron ) {
-        print STDERR "Cached results:\n" if $DEBUG;
-        print join("\n", @$result), "\n";
-        exit;
-    }
-}
-my $logfile = shift or die "Usage: parseunbound.pl --cron unboundlogfile";
-my $in = new FileHandle $logfile or die "Cannot open $logfile: $!\n";
-
-# there is a special key 'thread' that indicates the thread. its not used, but returned anyway.
-my @records = ('thread', 'queries', 'cachehits', 'recursions', 'recursionavg',
-        'outstandingmax', 'outstandingavg', 'outstandingexc',
-        'median25', 'median50', 'median75',
-        'us_0', 'us_1', 'us_2', 'us_4', 'us_8', 'us_16', 'us_32',
-        'us_64', 'us_128', 'us_256', 'us_512', 'us_1024', 'us_2048',
-        'us_4096', 'us_8192', 'us_16384', 'us_32768', 'us_65536',
-        'us_131072', 'us_262144', 'us_524288', 's_1', 's_2', 's_4',
-        's_8', 's_16', 's_32', 's_64', 's_128', 's_256', 's_512');
-# Stats hash containing one or more keys. for every thread, 1 key.
-my %allstats = (); # key="$threadid", stats={key => value}
-my %startstats = (); # when we got a queries entry for this thread
-my %donestats = (); # same, but only when we got a histogram entry for it
-# stats hash contains name/value pairs of the actual numbers for that thread.
-my $offset = 0;
-my $inthread=0;
-my $inpid;
-
-# We should continue looping untill we meet these conditions:
-# a) more total queries than the previous run (which defaults to 0) AND
-# b) parsed all $numthreads threads in the log.
-my $numqueries = $previousresult ? $previousresult->[1] : 0;
-
-# Main loop
-while ( scalar keys %startstats < $numthreads || scalar keys %donestats < $numthreads) {
-    $offset += 10000;
-    if ( $offset > -s $logfile or $offset > 10_000_000 ) {
-        die "Cannot find stats in $logfile\n";
-    }
-    $in->seek(-$offset, SEEK_END) or croak "cannot seek $logfile: $!\n";
-
-    for my $line ( <$in> ) {
-        chomp($line);
-
-        #[1208777234] unbound[6705:0] 
-        if ($line =~ m/^\[\d+\] unbound\[\d+:(\d+)\]/) {
-            $inthread = $1;
-            if ($inthread + 1 > $numthreads) {
-                die "Hey. lazy. change \$numthreads in this script to ($inthread)\n";
-            }
-        }
-        # this line doesn't contain a pid:thread. skip.
-        else {
-            next;
-        }
-
-        if ( $line =~ m/info: server stats for thread \d+: (\d+) queries, (\d+) answers from cache, (\d+) recursions/ ) {
-            $startstats{$inthread} = 1;
-            $allstats{$inthread}->{thread} = $inthread;
-            $allstats{$inthread}->{queries} = $1;
-            $allstats{$inthread}->{cachehits} = $2;
-            $allstats{$inthread}->{recursions} = $3;
-        }
-        elsif ( $line =~ m/info: server stats for thread (\d+): requestlist max (\d+) avg ([0-9\.]+) exceeded (\d+)/ ) {
-            $allstats{$inthread}->{outstandingmax} = $2;
-            $allstats{$inthread}->{outstandingavg} = int($3); # This is a float; rrdtool only handles ints.
-            $allstats{$inthread}->{outstandingexc} = $4;
-        }
-        elsif ( $line =~ m/info: average recursion processing time ([0-9\.]+) sec/ ) {
-            $allstats{$inthread}->{recursionavg} = int($1 * 1000); # change sec to milisec.
-        }
-        elsif ( $line =~ m/info: histogram of recursion processing times/ ) {
-            next;
-        }
-        elsif ( $line =~ m/info: \[25%\]=([0-9\.]+) median\[50%\]=([0-9\.]+) \[75%\]=([0-9\.]+)/ ) {
-            $allstats{$inthread}->{median25} = int($1 * 1000000); # change seconds to usec
-            $allstats{$inthread}->{median50} = int($2 * 1000000);
-            $allstats{$inthread}->{median75} = int($3 * 1000000);
-        }
-        elsif ( $line =~ m/info: lower\(secs\) upper\(secs\) recursions/ ) {
-            # since after this line we're unsure if we get these numbers
-            # at all, we sould consider this marker as the end of the
-            # block. Chances that we're parsing a file halfway written
-            # at this stage are small. Bold statement.
-            $donestats{$inthread} = 1;
-            next;
-        }
-        elsif ( $line =~ m/info:\s+(\d+)\.(\d+)\s+(\d+)\.(\d+)\s+(\d+)/ ) {
-            my ($froms, $fromus, $toms, $tous, $counter) = ($1, $2, $3, $4, $5);
-            my $prefix = '';
-            if ($froms > 0) {
-                $allstats{$inthread}->{'s_' . int($froms)} = $counter;
-            } else {
-                $allstats{$inthread}->{'us_' . int($fromus)} = $counter;
-            }
-        }
-    }
-}
-
-my @result;
-# loop on the records we want to store
-for my $key ( @records ) {
-    my $sum = 0;
-    # these are the different threads parsed
-    foreach my $thread ( 0 .. $numthreads - 1 ) {
-        $sum += ($allstats{$thread}->{$key} || 0);
-    }
-    print STDERR "$key = " . $sum . "\n" if $DEBUG;
-    push @result, $sum;
-}
-print join("\n", @result), "\n";
-store \@result, UNBOUND_CACHE;
-
-if ($DEBUG) {
-    print STDERR "Threads: " . (scalar keys %allstats) . "\n";
-}

contrib/rc_d_unbound

@@ -1,25 +0,0 @@
-#!/bin/sh
-#
-# unbound freebsd startup rc.d script, modified from the named script.
-# uses the default unbound installation path and pidfile location.
-# copy this to /etc/rc.d/unbound
-# and put unbound_enable="YES" into rc.conf
-#
-
-# PROVIDE: unbound
-# REQUIRE: SERVERS cleanvar
-# KEYWORD: shutdown
-
-. /etc/rc.subr
-
-name="unbound"
-rcvar=`set_rcvar`
-
-load_rc_config $name
-
-command="/usr/local/sbin/unbound"
-pidfile=${unbound_pidfile:-"/usr/local/etc/unbound/unbound.pid"}
-command_args=${unbound_flags:-"-c /usr/local/etc/unbound/unbound.conf"}
-extra_commands="reload"
-
-run_rc_command "$1"

contrib/selinux/unbound.fc

@@ -1,4 +0,0 @@
-/etc/unbound(/.*)?			system_u:object_r:unbound_conf_t:s0
-/etc/rc\.d/init\.d/unbound	--	system_u:object_r:unbound_initrc_exec_t:s0
-/usr/sbin/unbound		--	system_u:object_r:unbound_exec_t:s0
-/var/run/unbound(/.*)?			system_u:object_r:unbound_var_run_t:s0

contrib/selinux/unbound.te

@@ -1,42 +0,0 @@
-policy_module(unbound, 0.1.0)
-
-type unbound_t;
-type unbound_conf_t;
-type unbound_exec_t;
-type unbound_initrc_exec_t;
-type unbound_var_run_t;
-
-init_daemon_domain(unbound_t, unbound_exec_t)
-init_script_file(unbound_initrc_exec_t)
-
-role system_r types unbound_t;
-
-# XXX
-# unbound-{checkconf,control} are not protected. Do we need protect them?
-
-# Unbound daemon
-
-auth_use_nsswitch(unbound_t)
-dev_read_urand(unbound_t)
-corenet_all_recvfrom_unlabeled(unbound_t)
-corenet_tcp_bind_all_nodes(unbound_t)
-corenet_tcp_bind_dns_port(unbound_t)
-corenet_tcp_bind_rndc_port(unbound_t)
-corenet_udp_bind_all_nodes(unbound_t)
-corenet_udp_bind_all_unreserved_ports(unbound_t)
-corenet_udp_bind_dns_port(unbound_t)
-files_read_etc_files(unbound_t)
-files_pid_file(unbound_var_run_t)
-files_type(unbound_conf_t)
-libs_use_ld_so(unbound_t)
-libs_use_shared_libs(unbound_t)
-logging_send_syslog_msg(unbound_t)
-manage_files_pattern(unbound_t, unbound_var_run_t, unbound_var_run_t)
-miscfiles_read_localization(unbound_t)
-read_files_pattern(unbound_t, unbound_conf_t, unbound_conf_t)
-
-allow unbound_t self:capability { setuid chown net_bind_service setgid dac_override };
-allow unbound_t self:tcp_socket create_stream_socket_perms;
-allow unbound_t self:udp_socket create_socket_perms;
-
-###################################################

contrib/split-itar.sh

@@ -1,46 +0,0 @@
-#/usr/bin/env bash
-# Contributed by Tom Hendrikx <tom@whyscream.net>
-
-PROGNAME=$(basename $0)
-
-usage() {
-	echo "$PROGNAME: split the anchors.mf file from IANA into separate files." >&2
-	echo "" >&2
-	echo "$PROGNAME uses 2 arguments:" >&2
-	echo "  - the path to the anchors.mf, available at: https://itar.iana.org/" >&2
-	echo "  - the directory to leave the files, defaults to '.' (current working dir)" >&2
-	exit 1
-}
-
-if [ -n "$1" ] && [ -r "$1" ]; then
-	itar="$1"
-	echo "Reading from: $itar"
-else 
-	echo "Error: no anchors file given" >&2
-	usage
-fi
-
-if [ -n "$2" ]; then
-	dir="$2"
-else 
-	dir=$(pwd)
-fi
-
-if [ ! -d "$dir" ]; then
-	echo "Error: $dir is not a directory" >&2
-	usage
-fi
-
-while read cn line; do
-	if [ $(expr match "$cn" '[a-zA-Z0-9-]*\.') -gt 0 ]; then
-		# first line of key
-		out="$dir/$cn"anchor
-		echo "writing key for $cn to: $out"
-		echo "$cn	$line" > $out
-	elif [ "$cn" == "DS" ]; then
-		# second or later line of earlier defined key
-		echo "	$cn	$line" >> $out
-	fi
-done < "$itar"
-
-echo "Done."

contrib/unbound-host.nagios.patch

@@ -1,134 +0,0 @@
-Index: smallapp/unbound-host.c
-===================================================================
---- smallapp/unbound-host.c	(revision 2115)
-+++ smallapp/unbound-host.c	(working copy)
-@@ -62,9 +62,18 @@
- #include "libunbound/unbound.h"
- #include <ldns/ldns.h>
- 
-+/** status variable ala nagios */
-+#define FINAL_STATUS_OK		0
-+#define FINAL_STATUS_WARNING	1
-+#define FINAL_STATUS_CRITICAL	2
-+#define FINAL_STATUS_UNKNOWN	3
-+
- /** verbosity for unbound-host app */
- static int verb = 0;
- 
-+/** variable to determine final output */
-+static int final_status = FINAL_STATUS_UNKNOWN;
-+
- /** Give unbound-host usage, and exit (1). */
- static void
- usage()
-@@ -93,7 +102,7 @@
- 	printf("Version %s\n", PACKAGE_VERSION);
- 	printf("BSD licensed, see LICENSE in source package for details.\n");
- 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
--	exit(1);
-+	exit(FINAL_STATUS_UNKNOWN);
- }
- 
- /** determine if str is ip4 and put into reverse lookup format */
-@@ -138,7 +147,7 @@
- 	*res = strdup(buf);
- 	if(!*res) {
- 		fprintf(stderr, "error: out of memory\n");
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- 	return 1;
- }
-@@ -158,7 +167,7 @@
- 	}
- 	if(!res) {
- 		fprintf(stderr, "error: out of memory\n");
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- 	return res;
- }
-@@ -172,7 +181,7 @@
- 		if(r == 0 && strcasecmp(t, "TYPE0") != 0 && 
- 			strcmp(t, "") != 0) {
- 			fprintf(stderr, "error unknown type %s\n", t);
--			exit(1);
-+			exit(FINAL_STATUS_UNKNOWN);
- 		}
- 		return r;
- 	}
-@@ -191,7 +200,7 @@
- 		if(r == 0 && strcasecmp(c, "CLASS0") != 0 && 
- 			strcmp(c, "") != 0) {
- 			fprintf(stderr, "error unknown class %s\n", c);
--			exit(1);
-+			exit(FINAL_STATUS_UNKNOWN);
- 		}
- 		return r;
- 	}
-@@ -207,6 +216,19 @@
- 	return "(insecure)";
- }
- 
-+/** update the final status for the exit code */
-+void
-+update_final_status(struct ub_result* result)
-+{
-+	if (final_status == FINAL_STATUS_UNKNOWN || final_status == FINAL_STATUS_OK) {
-+		if (result->secure) final_status = FINAL_STATUS_OK;
-+		else if (result->bogus) final_status = FINAL_STATUS_CRITICAL;
-+		else final_status = FINAL_STATUS_WARNING;
-+	}
-+	else if (final_status == FINAL_STATUS_WARNING && result->bogus)
-+		final_status = FINAL_STATUS_CRITICAL;
-+}
-+
- /** nice string for type */
- static void
- pretty_type(char* s, size_t len, int t)
-@@ -353,7 +375,7 @@
- 				} else {
- 					fprintf(stderr, "could not parse "
- 						"reply packet to ANY query\n");
--					exit(1);
-+					exit(FINAL_STATUS_UNKNOWN);
- 				}
- 				ldns_pkt_free(p);
- 
-@@ -388,9 +410,10 @@
- 	ret = ub_resolve(ctx, q, t, c, &result);
- 	if(ret != 0) {
- 		fprintf(stderr, "resolve error: %s\n", ub_strerror(ret));
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- 	pretty_output(q, t, c, result, docname);
-+	update_final_status(result);
- 	ret = result->nxdomain;
- 	ub_resolve_free(result);
- 	return ret;
-@@ -427,7 +450,7 @@
- {
- 	if(r != 0) {
- 		fprintf(stderr, "error: %s\n", ub_strerror(r));
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- }
- 
-@@ -448,7 +471,7 @@
- 	ctx = ub_ctx_create();
- 	if(!ctx) {
- 		fprintf(stderr, "error: out of memory\n");
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- 
- 	/* parse the options */
-@@ -509,5 +532,5 @@
- 		usage();
- 
- 	lookup(ctx, argv[0], qtype, qclass);
--	return 0;
-+	return final_status;
- }

contrib/unbound.init

@@ -1,139 +0,0 @@
-#!/bin/sh
-#
-# unbound	This shell script takes care of starting and stopping
-#		unbound (DNS server).
-#
-# chkconfig:   - 14 86
-# description:	unbound is a Domain Name Server (DNS) \
-#		that is used to resolve host names to IP addresses.
-
-### BEGIN INIT INFO
-# Provides: $named unbound
-# Required-Start: $network $local_fs
-# Required-Stop: $network $local_fs
-# Should-Start: $syslog
-# Should-Stop: $syslog
-# Short-Description: unbound recursive Domain Name Server.
-# Description:  unbound is a Domain Name Server (DNS) 
-#		that is used to resolve host names to IP addresses.
-### END INIT INFO
-
-# Source function library.
-. /etc/rc.d/init.d/functions
-
-exec="/usr/sbin/unbound"
-prog="unbound"
-config="/var/unbound/unbound.conf"
-pidfile="/var/unbound/unbound.pid"
-rootdir="/var/unbound"
-
-[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
-
-lockfile=/var/lock/subsys/$prog
-
-start() {
-    [ -x $exec ] || exit 5
-    [ -f $config ] || exit 6
-    echo -n $"Starting $prog: "
-
-    # setup root jail
-    if [ -s /etc/localtime ]; then 
-	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
-	if [ ! -e ${rootdir}/etc/localtime ] || /usr/bin/cmp -s /etc/localtime ${rootdir}/etc/localtime; then
-	    cp -fp /etc/localtime ${rootdir}/etc/localtime
-	fi;
-    fi;
-    if [ -s /etc/resolv.conf ]; then
-	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
-	if [ ! -e ${rootdir}/etc/resolv.conf ] || /usr/bin/cmp -s /etc/resolv.conf ${rootdir}/etc/resolv.conf; then
-	    cp -fp /etc/resolv.conf ${rootdir}/etc/resolv.conf
-	fi;
-    fi;
-    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
-	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
-	[ -e ${rootdir}/dev/log ] || touch ${rootdir}/dev/log
-	mount --bind -n /dev/log ${rootdir}/dev/log >/dev/null 2>&1;
-    fi;
-    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
-	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
-	[ -e ${rootdir}/dev/random ] || touch ${rootdir}/dev/random
-	mount --bind -n /dev/random ${rootdir}/dev/random >/dev/null 2>&1;
-    fi;
-
-    # if not running, start it up here
-    daemon $exec
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && touch $lockfile
-    return $retval
-}
-
-stop() {
-    echo -n $"Stopping $prog: "
-    # stop it here, often "killproc $prog"
-    killproc -p $pidfile $prog
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && rm -f $lockfile
-    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
-	umount ${rootdir}/dev/log >/dev/null 2>&1
-    fi;
-    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
-	umount ${rootdir}/dev/random >/dev/null 2>&1
-    fi;
-    return $retval
-}
-
-restart() {
-    stop
-    start
-}
-
-reload() {
-    kill -HUP `cat $pidfile`
-}
-
-force_reload() {
-    restart
-}
-
-rh_status() {
-    # run checks to determine if the service is running or use generic status
-    status -p $pidfile $prog
-}
-
-rh_status_q() {
-    rh_status -p $pidfile >/dev/null 2>&1
-}
-
-case "$1" in
-    start)
-        rh_status_q && exit 0
-        $1
-        ;;
-    stop)
-        rh_status_q || exit 0
-        $1
-        ;;
-    restart)
-        $1
-        ;;
-    reload)
-        rh_status_q || exit 7
-        $1
-        ;;
-    force-reload)
-        force_reload
-        ;;
-    status)
-        rh_status
-        ;;
-    condrestart|try-restart)
-        rh_status_q || exit 0
-        restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
-        exit 2
-esac
-exit $?

contrib/unbound.init_fedora

@@ -1,119 +0,0 @@
-#!/bin/sh
-#
-# unbound	This shell script takes care of starting and stopping
-#		unbound (DNS server).
-#
-# chkconfig:   - 14 86
-# description:	unbound is a Domain Name Server (DNS) \
-#		that is used to resolve host names to IP addresses.
-
-### BEGIN INIT INFO
-# Provides: unbound
-# Required-Start: $network $local_fs
-# Required-Stop: $network $local_fs
-# Should-Start: $syslog
-# Should-Stop: $syslog
-# Short-Description: unbound recursive Domain Name Server.
-# Description:  unbound is a Domain Name Server (DNS) 
-#		that is used to resolve host names to IP addresses.
-### END INIT INFO
-
-# Source function library.
-. /etc/rc.d/init.d/functions
-
-exec="/usr/sbin/unbound"
-config="/var/lib/unbound/unbound.conf"
-rootdir="/var/lib/unbound"
-pidfile="/var/run/unbound/unbound.pid"
-
-[ -e /etc/sysconfig/unbound ] && . /etc/sysconfig/unbound
-
-lockfile=/var/lock/subsys/unbound
-
-start() {
-    [ -x $exec ] || exit 5
-    [ -f $config ] || exit 6
-    echo -n $"Starting unbound: "
-
-	if [ ! -e ${rootdir}/etc/resolv.conf ] || /usr/bin/cmp -s /etc/resolv.conf ${rootdir}/etc/resolv.conf; then
-	    cp -fp /etc/resolv.conf ${rootdir}/etc/resolv.conf
-	fi;
-	if [ ! -e ${rootdir}/etc/localtime ] || /usr/bin/cmp -s /etc/localtime ${rootdir}/etc/localtime; then
-	    cp -fp /etc/localtime ${rootdir}/etc/localtime
-	fi;
-	mount --bind -n /dev/log ${rootdir}/dev/log >/dev/null 2>&1;
-	mount --bind -n /dev/random ${rootdir}/dev/random >/dev/null 2>&1;
-	mount --bind -n /var/run/unbound ${rootdir}/var/run/unbound >/dev/null 2>&1;
-
-    # if not running, start it up here
-    daemon $exec
-    retval=$?
-    [ $retval -eq 0 ] && touch $lockfile
-    echo
-}
-
-stop() {
-    echo -n $"Stopping unbound: "
-    # stop it here, often "killproc unbound"
-    killproc -p $pidfile unbound
-    retval=$?
-    [ $retval -eq 0 ] && rm -f $lockfile
-    for mountfile in /dev/log /dev/random /etc/localtime /etc/resolv.conf /var/run/unbound
-    do
-    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}''${mountfile}'' /proc/mounts; then
-	umount ${rootdir}$mountfile >/dev/null 2>&1
-    fi;
-    done
-    echo
-}
-
-restart() {
-    stop
-    start
-}
-
-reload() {
-    kill -HUP `cat $pidfile`
-}
-
-force_reload() {
-    restart
-}
-
-rh_status() {
-    # run checks to determine if the service is running or use generic status
-    status -p $pidfile unbound
-}
-
-rh_status_q() {
-    rh_status -p $pidfile >/dev/null 2>&1
-}
-
-case "$1" in
-    start)
-        start
-        ;;
-    stop)
-        stop
-        ;;
-    restart)
-        restart
-        ;;
-    reload)
-        reload
-        ;;
-    force-reload)
-        force_reload
-        ;;
-    status)
-        rh_status
-        ;;
-    condrestart|try-restart)
-        rh_status_q || exit 0
-        restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
-        exit 2
-esac
-exit $?

contrib/unbound.plist

@@ -1,42 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd >
-<plist version="1.0">
-<!-- 
-Unbound plist file for use by MacOSX launchd(8) using launchctl(1).
-Copy this file to /Library/LaunchDaemons.  Launchd keeps unbound running.
-
-Setup your unbound.conf with the following additional settings.
-server:
-	do-daemonize: no
-	username: ""
-	chroot: ""
-	directory: ""
-These actions are performed by launchd (for the option values, see below).
-
--->
-<dict>
-	<key>Label</key>
-	<string>unbound</string>
-
-	<key>ProgramArguments</key>
-	<array>
-		<string>unbound</string>
-	</array>
-
-	<key>UserName</key>
-	<string>unbound</string>
-
-	<key>RootDirectory</key>
-	<string>/usr/local/etc/unbound</string>
-
-	<key>WorkingDirectory</key>
-	<string>/usr/local/etc/unbound</string>
-
-	<key>KeepAlive</key>
-	<true/>
-
-	<key>RunAtLoad</key>
-	<true/>
-
-</dict>
-</plist>

contrib/unbound.spec

@@ -1,103 +0,0 @@
-Summary: Validating, recursive, and caching DNS resolver
-Name: unbound
-Version: 1.4.4
-Release: 1%{?dist}
-License: BSD
-Url: http://www.nlnetlabs.nl/unbound/
-Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
-#Source1: unbound.init
-Group: System Environment/Daemons
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel
-
-%description
-Unbound is a validating, recursive, and caching DNS resolver.
-
-The C implementation of Unbound is developed and maintained by NLnet
-Labs. It is based on ideas and algorithms taken from a java prototype
-developed by Verisign labs, Nominet, Kirei and ep.net.
-
-Unbound is designed as a set of modular components, so that also
-DNSSEC (secure DNS) validation and stub-resolvers (that do not run
-as a server, but are linked into an application) are easily possible.
-
-The source code is under a BSD License.
-
-%prep
-%setup -q
-
-# configure with /var/unbound/unbound.conf so that all default chroot, 
-# pidfile and config file are in /var/unbound, ready for chroot jail set up.
-#
-# This is a build using libldns builtin version, the resulting binaries
-# do not require libldns and this package does not have version dependencies.
-# Could be smaller using a dependency on libldns (use --with-ldns=).
-%configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath
-
-%build
-#%{__make} %{?_smp_mflags}
-make
-
-%install
-rm -rf %{buildroot}
-%{__make} DESTDIR=%{buildroot} install
-install -d 0700 %{buildroot}%{_localstatedir}/%{name}
-install -d 0755 %{buildroot}%{_initrddir}
-install -m 0755 contrib/unbound.init %{buildroot}%{_initrddir}/unbound
-# add symbolic link from /etc/unbound.conf -> /var/unbound/unbound.conf
-ln -s %{_localstatedir}/unbound/unbound.conf %{buildroot}%{_sysconfdir}/unbound.conf 
-# remove static library from install (fedora packaging guidelines)
-rm -f %{buildroot}%{_libdir}/libunbound.a %{buildroot}%{_libdir}/libunbound.la
-
-%clean
-rm -rf ${RPM_BUILD_ROOT}
-
-%files
-%defattr(-,root,root,-)
-%doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
-%attr(0755,root,root) %{_initrddir}/%{name}
-%attr(0700,%{name},%{name}) %dir %{_localstatedir}/%{name}
-%attr(0644,%{name},%{name}) %config(noreplace) %{_localstatedir}/%{name}/unbound.conf
-%attr(0644,%{name},%{name}) %config(noreplace) %{_sysconfdir}/unbound.conf
-%{_sbindir}/*
-%{_mandir}/*/*
-%{_includedir}/*
-%{_libdir}/libunbound*
-
-%pre
-getent group unbound >/dev/null || groupadd -r unbound
-getent passwd unbound >/dev/null || \
-useradd -r -g unbound -d /var/unbound -s /sbin/nologin \
-    -c "unbound name daemon" unbound
-exit 0
-
-%post
-# This adds the proper /etc/rc*.d links for the script
-/sbin/chkconfig --add %{name}
-
-%preun
-if [ $1 -eq 0 ]; then
-	/sbin/service %{name} stop >/dev/null 2>&1
-	/sbin/chkconfig --del %{name}
-	# remove root jail 
-	rm -f /var/unbound/dev/log /var/unbound/dev/random /var/unbound/etc/localtime /var/unbound/etc/resolv.conf >/dev/null 2>&1
-	rmdir /var/unbound/dev >/dev/null 2>&1 || :
-	rmdir /var/unbound/etc >/dev/null 2>&1 || :
-	rmdir /var/unbound >/dev/null 2>&1 || :
-fi
-
-%postun
-if [ "$1" -ge "1" ]; then
-	/sbin/service %{name} condrestart >/dev/null 2>&1 || :
-fi
-
-%changelog
-* Thu May 22 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.0.0
-- contrib changes from Patrick Vande Walle.
-
-* Thu Apr 25 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.12
-- Using parts from ports collection entry by Jaap Akkerhuis.
-- Using Fedoraproject wiki guidelines.
-
-* Wed Apr 23 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.11
-- Initial version.

contrib/unbound.spec_fedora

@@ -1,346 +0,0 @@
-# not ready yet
-%{?!with_python:      %global with_python      1}
-
-%if %{with_python}
-%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
-%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
-%endif
-
-Summary: Validating, recursive, and caching DNS(SEC) resolver
-Name: unbound
-Version: 1.4.2
-Release: 1%{?dist}
-License: BSD
-Url: http://www.nlnetlabs.nl/unbound/
-Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
-Source1: unbound.init
-Source2: unbound.conf
-Source3: unbound.munin
-Source4: dlv.isc.org.key
-Patch1: unbound-1.2-glob.patch
-
-Group: System Environment/Daemons
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel , ldns-devel >= 1.5.0, 
-BuildRequires: libevent-devel 
-%if %{with_python}
-BuildRequires:  python-devel
-%endif
-
-Requires(post): chkconfig
-Requires(preun): chkconfig
-Requires(preun): initscripts
-Requires(postun): initscripts
-Requires: ldns >= 1.5.0
-Requires(pre): shadow-utils
-
-%description
-Unbound is a validating, recursive, and caching DNS(SEC) resolver.
-
-The C implementation of Unbound is developed and maintained by NLnet
-Labs. It is based on ideas and algorithms taken from a java prototype
-developed by Verisign labs, Nominet, Kirei and ep.net.
-
-Unbound is designed as a set of modular components, so that also
-DNSSEC (secure DNS) validation and stub-resolvers (that do not run
-as a server, but are linked into an application) are easily possible.
-
-%package munin
-Summary: Plugin for the munin / munin-node monitoring package
-Group:     System Environment/Daemons
-Requires: munin-node
-Requires: %{name} = %{version}-%{release}, bc
-
-%description munin
-Plugin for the munin / munin-node monitoring package
-
-%package devel
-Summary: Development package that includes the unbound header files
-Group: Development/Libraries
-Requires: %{name}-libs = %{version}-%{release}, openssl-devel, ldns-devel
-
-%description devel
-The devel package contains the unbound library and the include files
-
-%package libs
-Summary: Libraries used by the unbound server and client applications
-Group: Applications/System
-Requires(post): /sbin/ldconfig
-Requires(postun): /sbin/ldconfig
-Requires: openssl >= 0.9.8g-12
-
-%description libs
-Contains libraries used by the unbound server and client applications
-
-%if %{with_python}
-%package python
-Summary: Python modules and extensions for unbound
-Group: Applications/System
-Requires: %{name}-libs = %{version}-%{release}
-
-%description python
-Python modules and extensions for unbound
-%endif
-
-%prep
-%setup -q 
-%patch1 -p1
-
-%build
-%configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
-            --disable-rpath --enable-debug --disable-static \
-            --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \
-            --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \
-%if %{with_python}
-            --with-pythonmodule --with-pyunbound \
-%endif
-            --enable-sha2 
-%{__make} 
-
-%install
-rm -rf %{buildroot}
-%{__make} DESTDIR=%{buildroot} install
-install -d 0755 %{buildroot}%{_initrddir}
-install -m 0755 %{SOURCE1} %{buildroot}%{_initrddir}/unbound
-install -m 0755 %{SOURCE2} %{buildroot}%{_sysconfdir}/unbound
-# Install munin plugin and its softlinks
-install -d 0755 %{buildroot}%{_sysconfdir}/munin/plugin-conf.d
-install -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/munin/plugin-conf.d/unbound
-install -d 0755 %{buildroot}%{_datadir}/munin/plugins/
-install -m 0755 contrib/unbound_munin_ %{buildroot}%{_datadir}/munin/plugins/unbound
-for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unbound_munin_by_type unbound_munin_by_class unbound_munin_by_opcode unbound_munin_by_rcode unbound_munin_by_flags unbound_munin_histogram; do
-    ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin
-done 
-
-# install DLV key
-install -m 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/unbound/
-
-# remove static library from install (fedora packaging guidelines)
-rm -rf %{buildroot}%{_libdir}/*.la
-
-mkdir -p %{buildroot}%{_localstatedir}/run/unbound
-
-%clean
-rm -rf ${RPM_BUILD_ROOT}
-
-%files 
-%defattr(-,root,root,-)
-%doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
-%attr(0755,root,root) %{_initrddir}/%{name}
-%attr(0755,root,root) %dir %{_sysconfdir}/%{name}
-%attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key
-%{_sbindir}/*
-%{_mandir}/*/*
-
-%if %{with_python}
-%files python
-%{python_sitelib}/*
-%endif
-
-%files munin
-%defattr(-,root,root,-)
-%config(noreplace) %{_sysconfdir}/munin/plugin-conf.d/unbound
-%{_datadir}/munin/plugins/unbound*
-
-%files devel
-%defattr(-,root,root,-)
-%{_libdir}/libunbound.so
-%{_includedir}/unbound.h
-%doc README
-
-%files libs
-%defattr(-,root,root,-)
-%{_libdir}/libunbound.so.*
-%doc doc/README doc/LICENSE
-
-%pre
-getent group unbound >/dev/null || groupadd -r unbound
-getent passwd unbound >/dev/null || \
-useradd -r -g unbound -d %{_sysconfdir}/unbound -s /sbin/nologin \
--c "Unbound DNS resolver" unbound
-exit 0
-
-%post
-/sbin/chkconfig --add %{name}
-# dnssec-conf used to contain our DLV key, but now we include it via unbound
-# If unbound had previously been configured with dnssec-configure, we need
-# to migrate the location of the DLV key file (to keep DLV enabled, and because
-# unbound won't start with a bad location for a DLV key file.
-sed -i "s:/etc/pki/dnssec-keys[/]*dlv:/etc/unbound:" %{_sysconfdir}/unbound/unbound.conf
-
-%post libs -p /sbin/ldconfig
-
-%preun
-if [ "$1" -eq 0 ]; then
-        /sbin/service %{name} stop >/dev/null 2>&1
-        /sbin/chkconfig --del %{name} 
-fi
-
-%postun 
-if [ "$1" -ge "1" ]; then
-  /sbin/service %{name} condrestart >/dev/null 2>&1 || :
-fi
-
-%postun libs -p /sbin/ldconfig
-
-%changelog
-* Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
-- Removed dependancy for dnssec-conf
-- Added ISC DLV key (formerly in dnssec-conf)
-- Fixup old DLV locations in unbound.conf file via %%post
-
-* Tue Jan 05 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-1
-- Updated to 1.4.1
-- Changed %%define to %%global
-
-* Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-2
-- Bump version
-
-* Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-1
-- Upgraded to 1.3.4. Security fix with validating NSEC3 records
-
-* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.3.3-2
-- rebuilt with new openssl
-
-* Mon Aug 17 2009 Paul Wouters <paul@xelerance.com> - 1.3.3-1
-- Updated to 1.3.3
-
-* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.0-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
-
-* Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-2
-- Added missing glob patch to cvs
-- Place python macros within the %%with_python check
-
-* Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-1
-- Updated to 1.3.0
-- Added unbound-python sub package. disabled for now
-- Patch from svn to fix DLV lookups
-- Patches from svn to detect wrong truncated response from BIND 9.6.1 with
-  minimal-responses)
-- Added Default-Start and Default-Stop to unbound.init
-- Re-enabled --enable-sha2
-- Re-enabled glob.patch
-
-* Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-7
-- unbound-iterator.patch was not commited
-
-* Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-6
-- Fix for https://bugzilla.redhat.com/show_bug.cgi?id=499793
-
-* Tue Mar 17 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-5
-- Use --nocheck to avoid giving an error on missing unbound-remote certs/keys
-
-* Tue Mar 10 2009 Adam Tkac <atkac redhat com> - 1.2.1-4
-- enable DNSSEC only if it is enabled in sysconfig/dnssec
-
-* Mon Mar 09 2009 Adam Tkac <atkac redhat com> - 1.2.1-3
-- add DNSSEC support to initscript and enabled it per default
-- add requires dnssec-conf
-
-* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
-
-* Tue Feb 10 2009 Paul Wouters <paul@xelerance.com - 1.2.1-1
-- updated to 1.2.1
-
-* Sun Jan 18 2009 Tomas Mraz <tmraz@redhat.com> - 1.2.0-2
-- rebuild with new openssl
-
-* Wed Jan 14 2009 Paul Wouters <paul@xelerance.com - 1.2.0-1
-- Updated to 1.2.0
-- Added dependancy on minimum SSL for CVE-2008-5077
-- Added dependancy on bc for unbound-munin
-- Added minimum requirement of libevent 1.4.5. Crashes with older versions
-  (note: libevent is stale in EL-4 and not in EL-5, needs fixing there)
-- Removed dependancy on selinux-policy (will get used when available)
-- Enable options as per draft-wijngaards-dnsext-resolver-side-mitigation-00.txt
-- Enable unwanted-reply-threshold to mitigate against a Kaminsky attack
-- Enable val-clean-additional to drop addition unsigned data from signed
-  response.
-- Removed patches (got merged into upstream)
-
-* Mon Jan  5 2009 Paul Wouters <paul@xelerance.com> - 1.1.1-7
-- Modified scandir patch to silently fail when wildcard matches nothing
-- Patch to allow unbound-checkconf to find empty wildcard matches
-
-* Mon Jan  5 2009 Paul Wouters <paul@xelerance.com> - 1.1.1-6
-- Added scandir patch for trusted-keys-file: option, which
-  is used to load multiple dnssec keys in bind file format
-
-* Mon Dec  8 2008 Paul Wouters <paul@xelerance.com> - 1.1.1-4
-- Added Requires: for selinux-policy >= 3.5.13-33 for proper SElinux rules.
-
-* Mon Dec  1 2008 Paul Wouters <paul@xelerance.com> - 1.1.1-3
-- We did not own the /etc/unbound directory (#474020)
-- Fixed cvs anomalies
-
-* Fri Nov 28 2008 Adam Tkac <atkac redhat com> - 1.1.1-2
-- removed all obsolete chroot related stuff
-- label control certs after generation correctly
-
-* Thu Nov 20 2008 Paul Wouters <paul@xelerance.com> - 1.1.1-1
-- Updated to unbound 1.1.1 which fixes a crasher and
-  addresses nlnetlabs bug #219
-
-* Wed Nov 19 2008 Paul Wouters <paul@xelerance.com> - 1.1.0-3
-- Remove the chroot, obsoleted by SElinux
-- Add additional munin plugin links supported by unbound plugin
-- Move configuration directory from /var/lib/unbound to /etc/unbound
-- Modified unbound.init and unbound.conf to account for chroot changes
-- Updated unbound.conf with new available options
-- Enabled dns-0x20 protection per default
-
-* Wed Nov 19 2008 Adam Tkac <atkac redhat com> - 1.1.0-2
-- unbound-1.1.0-log_open.patch
-  - make sure log is opened before chroot call
-  - tracked as http://www.nlnetlabs.nl/bugs/show_bug.cgi?id=219
-- removed /dev/log and /var/run/unbound and /etc/resolv.conf from
-  chroot, not needed
-- don't mount files in chroot, it causes problems during updates
-- fixed typo in default config file
-
-* Fri Nov 14 2008 Paul Wouters <paul@xelerance.com> - 1.1.0-1
-- Updated to version 1.1.0
-- Updated unbound.conf's statistics options and remote-control
-  to work properly for munin
-- Added unbound-munin package
-- Generate unbound remote-control  key/certs on first startup
-- Required ldns is now 1.4.0
-
-* Wed Oct 22 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-5
-- Only call ldconfig in -libs package
-- Move configure into build section
-- devel subpackage should only depend on libs subpackage
-
-* Tue Oct 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-4
-- Fix CFLAGS getting lost in build
-- Don't enable interface-automatic:yes because that
-  causes unbound to listen on 0.0.0.0 instead of 127.0.0.1
-
-* Sun Oct 19 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-3
-- Split off unbound-libs, make build verbose 
-
-* Thu Oct  9 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-2
-- FSB compliance, chroot fixes, initscript fixes
-
-* Thu Sep 11 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-1
-- Upgraded to 1.0.2
-
-* Wed Jul 16 2008 Paul Wouters <paul@xelerance.com> - 1.0.1-1
-- upgraded to new release
-
-* Wed May 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.0-2
-- Build against ldns-1.3.0
-
-* Wed May 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.0-1
-- Split of -devel package, fixed dependancies, make rpmlint happy
-
-* Thu Apr 25 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.12
-- Using parts from ports collection entry by Jaap Akkerhuis.
-- Using Fedoraproject wiki guidelines.
-
-* Wed Apr 23 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.11
-- Initial version.

contrib/unbound_munin_

@@ -1,553 +0,0 @@
-#!/bin/sh
-#
-# plugin for munin to monitor usage of unbound servers.
-#
-# (C) 2008 W.C.A. Wijngaards.  BSD Licensed.
-#
-# To install; enable statistics and unbound-control in unbound.conf
-#	server:		extended-statistics: yes
-#			statistics-cumulative: no
-#			statistics-interval: 0
-#	remote-control:	control-enable: yes
-# Run the command unbound-control-setup to generate the key files.
-#
-# Environment variables for this script
-#	statefile	- where to put temporary statefile.
-#	unbound_conf	- where the unbound.conf file is located.
-#	unbound_control	- where to find unbound-control executable.
-#	spoof_warn	- what level to warn about spoofing
-#	spoof_crit	- what level to crit about spoofing
-#
-# You can set them in your munin/plugin-conf.d/plugins.conf file
-# with:
-# [unbound*]
-# user root
-# env.statefile /usr/local/var/munin/plugin-state/unbound-state
-# env.unbound_conf /usr/local/etc/unbound/unbound.conf
-# env.unbound_control /usr/local/sbin/unbound-control
-# env.spoof_warn 1000
-# env.spoof_crit 100000
-#
-# This plugin can create different graphs depending on what name
-# you link it as (with ln -s) into the plugins directory
-# You can link it multiple times.
-# If you are only a casual user, the _hits and _by_type are most interesting,
-# possibly followed by _by_rcode.
-#
-#	unbound_munin_hits	- base volume, cache hits, unwanted traffic
-#	unbound_munin_queue	- to monitor the internal requestlist
-#	unbound_munin_memory	- memory usage
-#	unbound_munin_by_type	- incoming queries by type
-#	unbound_munin_by_class	- incoming queries by class
-#	unbound_munin_by_opcode	- incoming queries by opcode
-#	unbound_munin_by_rcode	- answers by rcode, validation status
-#	unbound_munin_by_flags	- incoming queries by flags
-#	unbound_munin_histogram	- histogram of query resolving times
-#
-# Magic markers - optional - used by installation scripts and
-# munin-config:
-#
-#%# family=contrib
-#%# capabilities=autoconf suggest
-
-# POD documentation
-: <<=cut
-=head1 NAME
-
-unbound_munin_ - Munin plugin to monitor the Unbound DNS resolver.
-
-=head1 APPLICABLE SYSTEMS
-
-System with unbound daemon.
-
-=head1 CONFIGURATION
-
-  [unbound*]
-  user root
-  env.statefile /usr/local/var/munin/plugin-state/unbound-state
-  env.unbound_conf /usr/local/etc/unbound/unbound.conf
-  env.unbound_control /usr/local/sbin/unbound-control
-  env.spoof_warn 1000
-  env.spoof_crit 100000
-
-Use the .env settings to override the defaults.
-
-=head1 USAGE
-
-Can be used to present different graphs. Use ln -s for that name in
-the plugins directory to enable the graph.
-unbound_munin_hits	- base volume, cache hits, unwanted traffic
-unbound_munin_queue	- to monitor the internal requestlist
-unbound_munin_memory	- memory usage
-unbound_munin_by_type	- incoming queries by type
-unbound_munin_by_class	- incoming queries by class
-unbound_munin_by_opcode	- incoming queries by opcode
-unbound_munin_by_rcode	- answers by rcode, validation status
-unbound_munin_by_flags	- incoming queries by flags
-unbound_munin_histogram - histogram of query resolving times
-
-=head1 AUTHOR
-
-Copyright 2008 W.C.A. Wijngaards
-
-=head1 LICENSE
-
-BSD
-
-=cut
-
-state=${statefile:-/usr/local/var/munin/plugin-state/unbound-state}
-conf=${unbound_conf:-/usr/local/etc/unbound/unbound.conf}
-ctrl=${unbound_control:-/usr/local/sbin/unbound-control}
-warn=${spoof_warn:-1000}
-crit=${spoof_crit:-100000}
-lock=$state.lock
-
-# number of seconds between polling attempts.
-# makes the statefile hang around for at least this many seconds,
-# so that multiple links of this script can share the results.
-lee=55
-
-# to keep things within 19 characters
-ABBREV="-e s/total/t/ -e s/thread/t/ -e s/num/n/ -e s/query/q/ -e s/answer/a/ -e s/unwanted/u/ -e s/requestlist/ql/ -e s/type/t/ -e s/class/c/ -e s/opcode/o/ -e s/rcode/r/ -e s/edns/e/ -e s/mem/m/ -e s/cache/c/ -e s/mod/m/"
-
-# get value from $1 into return variable $value
-get_value ( ) {
-	value="`grep '^'$1'=' $state | sed -e 's/^.*=//'`"
-	if test "$value"x = ""x; then
-		value="0"
-	fi
-}
-
-# download the state from the unbound server.
-get_state ( ) {
-	# obtain lock for fetching the state
-	# because there is a race condition in fetching and writing to file
-
-	# see if the lock is stale, if so, take it 
-	if test -f $lock ; then
-		pid="`cat $lock 2>&1`"
-		kill -0 "$pid" >/dev/null 2>&1
-		if test $? -ne 0 -a "$pid" != $$ ; then
-			echo $$ >$lock
-		fi
-	fi
-
-	i=0
-	while test ! -f $lock || test "`cat $lock 2>&1`" != $$; do
-		while test -f $lock; do
-			# wait
-			i=`expr $i + 1`
-			if test $i -gt 1000; then
-				sleep 1;
-			fi
-			if test $i -gt 1500; then
-				echo "error locking $lock" "=" `cat $lock`
-				rm -f $lock
-				exit 1
-			fi
-		done
-		# try to get it
-		echo $$ >$lock
-	done
-	# do not refetch if the file exists and only LEE seconds old
-	if test -f $state; then
-		now=`date +%s`
-		get_value "time.now"
-		value="`echo $value | sed -e 's/\..*$//'`"
-		if test $now -lt `expr $value + $lee`; then
-			rm -f $lock
-			return
-		fi
-	fi
-	$ctrl -c $conf stats > $state
-	if test $? -ne 0; then
-		echo "error retrieving data from unbound server"
-		rm -f $lock
-		exit 1
-	fi
-	rm -f $lock
-}
-
-if test "$1" = "autoconf" ; then
-	if test ! -f $conf; then
-		echo no "($conf does not exist)"
-		exit 1
-	fi
-	if test ! -d `dirname $state`; then
-		echo no "($state directory does not exist)"
-		exit 1
-	fi
-	echo yes
-	exit 0
-fi
-
-if test "$1" = "suggest" ; then
-	echo "hits"
-	echo "queue"
-	echo "memory"
-	echo "by_type"
-	echo "by_class"
-	echo "by_opcode"
-	echo "by_rcode"
-	echo "by_flags"
-	echo "histogram"
-	exit 0
-fi
-
-# determine my type, by name
-id=`echo $0 | sed -e 's/^.*unbound_munin_//'`
-if test "$id"x = ""x; then
-	# some default to keep people sane.
-	id="hits"
-fi
-
-# if $1 exists in statefile, config is echoed with label $2
-exist_config ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	if grep '^'$1'=' $state >/dev/null 2>&1; then
-		echo "$mn.label $2"
-		echo "$mn.min 0"
-	fi
-}
-
-# print label and min 0 for a name $1 in unbound format
-p_config ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	echo $mn.label "$2"
-	echo $mn.min 0
-}
-
-if test "$1" = "config" ; then
-	if test ! -f $state; then
-		get_state
-	fi
-	case $id in
-	hits)
-		echo "graph_title Unbound DNS traffic and cache hits"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
-		echo "graph_category DNS"
-		for x in thread0.num.queries thread1.num.queries \
-		thread2.num.queries thread3.num.queries thread4.num.queries \
-		thread5.num.queries thread6.num.queries thread7.num.queries; do
-			exist_config $x "queries handled by `basename $x .num.queries`"
-		done
-		p_config "total.num.queries" "total queries from clients"
-		p_config "total.num.cachehits" "cache hits"
-		p_config "total.num.prefetch" "cache prefetch"
-		p_config "num.query.tcp" "TCP queries"
-		p_config "num.query.ipv6" "IPv6 queries"
-		p_config "unwanted.queries" "queries that failed acl"
-		p_config "unwanted.replies" "unwanted or unsolicited replies"
-		echo "u_replies.warning $warn"
-		echo "u_replies.critical $crit"
-		echo "graph_info DNS queries to the recursive resolver. The unwanted replies could be innocent duplicate packets, late replies, or spoof threats."
-		;;
-	queue)
-		echo "graph_title Unbound requestlist size"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel number of queries"
-		echo "graph_category DNS"
-		p_config "total.requestlist.avg" "Average size of queue on insert"
-		p_config "total.requestlist.max" "Max size of queue (in 5 min)"
-		p_config "total.requestlist.overwritten" "Number of queries replaced by new ones"
-		p_config "total.requestlist.exceeded" "Number of queries dropped due to lack of space"
-		echo "graph_info The queries that did not hit the cache and need recursion service take up space in the requestlist. If there are too many queries, first queries get overwritten, and at last resort dropped."
-		;;
-	memory)
-		echo "graph_title Unbound memory usage"
-		echo "graph_args --base 1024 -l 0"
-		echo "graph_vlabel memory used in bytes"
-		echo "graph_category DNS"
-		p_config "mem.total.sbrk" "Total memory"
-		p_config "mem.cache.rrset" "RRset cache memory"
-		p_config "mem.cache.message" "Message cache memory"
-		p_config "mem.mod.iterator" "Iterator module memory"
-		p_config "mem.mod.validator" "Validator module and key cache memory"
-		echo "graph_info The memory used by unbound."
-		;;
-	by_type)
-		echo "graph_title Unbound DNS queries by type"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
-		echo "graph_category DNS"
-		for x in `grep "^num.query.type" $state`; do
-			nm=`echo $x | sed -e 's/=.*$//'`
-			tp=`echo $nm | sed -e s/num.query.type.//`
-			p_config "$nm" "$tp"
-		done
-		echo "graph_info queries by DNS RR type queried for"
-		;;
-	by_class)
-		echo "graph_title Unbound DNS queries by class"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
-		echo "graph_category DNS"
-		for x in `grep "^num.query.class" $state`; do
-			nm=`echo $x | sed -e 's/=.*$//'`
-			tp=`echo $nm | sed -e s/num.query.class.//`
-			p_config "$nm" "$tp"
-		done
-		echo "graph_info queries by DNS RR class queried for."
-		;;
-	by_opcode)
-		echo "graph_title Unbound DNS queries by opcode"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
-		echo "graph_category DNS"
-		for x in `grep "^num.query.opcode" $state`; do
-			nm=`echo $x | sed -e 's/=.*$//'`
-			tp=`echo $nm | sed -e s/num.query.opcode.//`
-			p_config "$nm" "$tp"
-		done
-		echo "graph_info queries by opcode in the query packet."
-		;;
-	by_rcode)
-		echo "graph_title Unbound DNS answers by return code"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel answer packets / second"
-		echo "graph_category DNS"
-		for x in `grep "^num.answer.rcode" $state`; do
-			nm=`echo $x | sed -e 's/=.*$//'`
-			tp=`echo $nm | sed -e s/num.answer.rcode.//`
-			p_config "$nm" "$tp"
-		done
-		p_config "num.answer.secure" "answer secure"
-		p_config "num.answer.bogus" "answer bogus"
-		p_config "num.rrset.bogus" "num rrsets marked bogus"
-		echo "graph_info answers sorted by return value. rrsets bogus is the number of rrsets marked bogus per second by the validator"
-		;;
-	by_flags)
-		echo "graph_title Unbound DNS incoming queries by flags"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
-		echo "graph_category DNS"
-		p_config "num.query.flags.QR" "QR (query reply) flag"
-		p_config "num.query.flags.AA" "AA (auth answer) flag"
-		p_config "num.query.flags.TC" "TC (truncated) flag"
-		p_config "num.query.flags.RD" "RD (recursion desired) flag"
-		p_config "num.query.flags.RA" "RA (rec avail) flag"
-		p_config "num.query.flags.Z" "Z (zero) flag"
-		p_config "num.query.flags.AD" "AD (auth data) flag"
-		p_config "num.query.flags.CD" "CD (check disabled) flag"
-		p_config "num.query.edns.present" "EDNS OPT present"
-		p_config "num.query.edns.DO" "DO (DNSSEC OK) flag"
-		echo "graph_info This graphs plots the flags inside incoming queries. For example, if QR, AA, TC, RA, Z flags are set, the query can be rejected. RD, AD, CD and DO are legitimately set by some software."
-		;;
-	histogram)
-		echo "graph_title Unbound DNS histogram of reply time"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
-		echo "graph_category DNS"
-		echo hcache.label "cache hits"
-		echo hcache.min 0
-		echo hcache.draw AREA
-		echo hcache.colour 999999
-		echo h64ms.label "0 msec - 66 msec"
-		echo h64ms.min 0
-		echo h64ms.draw STACK
-		echo h64ms.colour 0000FF
-		echo h128ms.label "66 msec - 131 msec"
-		echo h128ms.min 0
-		echo h128ms.colour 1F00DF
-		echo h128ms.draw STACK
-		echo h256ms.label "131 msec - 262 msec"
-		echo h256ms.min 0
-		echo h256ms.draw STACK
-		echo h256ms.colour 3F00BF
-		echo h512ms.label "262 msec - 524 msec"
-		echo h512ms.min 0
-		echo h512ms.draw STACK
-		echo h512ms.colour 5F009F
-		echo h1s.label "524 msec - 1 sec"
-		echo h1s.min 0
-		echo h1s.draw STACK
-		echo h1s.colour 7F007F
-		echo h2s.label "1 sec - 2 sec"
-		echo h2s.min 0
-		echo h2s.draw STACK
-		echo h2s.colour 9F005F
-		echo h4s.label "2 sec - 4 sec"
-		echo h4s.min 0
-		echo h4s.draw STACK
-		echo h4s.colour BF003F
-		echo h8s.label "4 sec - 8 sec"
-		echo h8s.min 0
-		echo h8s.draw STACK
-		echo h8s.colour DF001F
-		echo h16s.label "8 sec - ..."
-		echo h16s.min 0
-		echo h16s.draw STACK
-		echo h16s.colour FF0000
-		echo "graph_info Histogram of the reply times for queries."
-		;;
-	esac
-
-	exit 0
-fi
-
-# do the stats itself
-get_state
-
-# get the time elapsed
-get_value "time.elapsed"
-if test $value = 0 || test $value = "0.000000"; then
-	echo "error: time elapsed 0 or could not retrieve data"
-	exit 1
-fi
-elapsed="$value"
-
-# print value for $1 / elapsed
-print_qps ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	get_value $1
-	echo "$mn.value" `echo scale=6';' $value / $elapsed | bc `
-}
-
-# print qps if line already found in $2
-print_qps_line ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	value="`echo $2 | sed -e 's/^.*=//'`"
-	echo "$mn.value" `echo scale=6';' $value / $elapsed | bc `
-}
-
-# print value for $1
-print_value ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	get_value $1
-	echo "$mn.value" $value
-}
-
-case $id in
-hits)
-	for x in thread0.num.queries thread1.num.queries thread2.num.queries \
-		thread3.num.queries thread4.num.queries thread5.num.queries \
-		thread6.num.queries thread7.num.queries total.num.queries \
-		total.num.cachehits total.num.prefetch num.query.tcp \
-		num.query.ipv6 unwanted.queries unwanted.replies; do
-		if grep "^"$x"=" $state >/dev/null 2>&1; then
-			print_qps $x
-		fi
-	done
-	;;
-queue)
-	for x in total.requestlist.avg total.requestlist.max \
-		total.requestlist.overwritten total.requestlist.exceeded; do
-		print_value $x
-	done
-	;;
-memory)
-	mn=`echo mem.total.sbrk | sed $ABBREV | tr . _`
-	get_value 'mem.total.sbrk'
-	if test $value -eq 0; then
-		chk=`echo $ctrl | sed -e 's/-control$/-checkconf/'`
-		pidf=`$chk -o pidfile $conf 2>&1`
-		pid=`cat $pidf 2>&1`
-		value=`ps -p "$pid" -o rss= 2>&1`
-		if test "`expr $value + 1 - 1 2>&1`" -eq "$value" 2>&1; then
-			value=`expr $value \* 1024` 
-		else
-			value=0
-		fi
-	fi
-	echo "$mn.value" $value
-	for x in mem.cache.rrset mem.cache.message \
-		mem.mod.iterator mem.mod.validator; do
-		print_value $x
-	done
-	;;
-by_type)
-	for x in `grep "^num.query.type" $state`; do
-		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
-	done
-	;;
-by_class)
-	for x in `grep "^num.query.class" $state`; do
-		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
-	done
-	;;
-by_opcode)
-	for x in `grep "^num.query.opcode" $state`; do
-		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
-	done
-	;;
-by_rcode)
-	for x in `grep "^num.answer.rcode" $state`; do
-		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
-	done
-	print_qps "num.answer.secure"
-	print_qps "num.answer.bogus"
-	print_qps "num.rrset.bogus"
-	;;
-by_flags)
-	for x in num.query.flags.QR num.query.flags.AA num.query.flags.TC num.query.flags.RD num.query.flags.RA num.query.flags.Z num.query.flags.AD num.query.flags.CD num.query.edns.present num.query.edns.DO; do
-		print_qps $x
-	done
-	;;
-histogram)
-	get_value total.num.cachehits
-	echo hcache.value `echo scale=6';' $value / $elapsed | bc `
-	r=0
-	for x in histogram.000000.000000.to.000000.000001 \
-		histogram.000000.000001.to.000000.000002 \
-		histogram.000000.000002.to.000000.000004 \
-		histogram.000000.000004.to.000000.000008 \
-		histogram.000000.000008.to.000000.000016 \
-		histogram.000000.000016.to.000000.000032 \
-		histogram.000000.000032.to.000000.000064 \
-		histogram.000000.000064.to.000000.000128 \
-		histogram.000000.000128.to.000000.000256 \
-		histogram.000000.000256.to.000000.000512 \
-		histogram.000000.000512.to.000000.001024 \
-		histogram.000000.001024.to.000000.002048 \
-		histogram.000000.002048.to.000000.004096 \
-		histogram.000000.004096.to.000000.008192 \
-		histogram.000000.008192.to.000000.016384 \
-		histogram.000000.016384.to.000000.032768 \
-		histogram.000000.032768.to.000000.065536; do
-		get_value $x
-		r=`expr $r + $value`
-	done
-	echo h64ms.value `echo scale=6';' $r / $elapsed | bc `
-	get_value histogram.000000.065536.to.000000.131072
-	echo h128ms.value `echo scale=6';' $value / $elapsed | bc `
-	get_value histogram.000000.131072.to.000000.262144
-	echo h256ms.value `echo scale=6';' $value / $elapsed | bc `
-	get_value histogram.000000.262144.to.000000.524288
-	echo h512ms.value `echo scale=6';' $value / $elapsed | bc `
-	get_value histogram.000000.524288.to.000001.000000
-	echo h1s.value `echo scale=6';' $value / $elapsed | bc `
-	get_value histogram.000001.000000.to.000002.000000
-	echo h2s.value `echo scale=6';' $value / $elapsed | bc `
-	get_value histogram.000002.000000.to.000004.000000
-	echo h4s.value `echo scale=6';' $value / $elapsed | bc `
-	get_value histogram.000004.000000.to.000008.000000
-	echo h8s.value `echo scale=6';' $value / $elapsed | bc `
-	r=0
-	for x in histogram.000008.000000.to.000016.000000 \
-		histogram.000016.000000.to.000032.000000 \
-		histogram.000032.000000.to.000064.000000 \
-		histogram.000064.000000.to.000128.000000 \
-		histogram.000128.000000.to.000256.000000 \
-		histogram.000256.000000.to.000512.000000 \
-		histogram.000512.000000.to.001024.000000 \
-		histogram.001024.000000.to.002048.000000 \
-		histogram.002048.000000.to.004096.000000 \
-		histogram.004096.000000.to.008192.000000 \
-		histogram.008192.000000.to.016384.000000 \
-		histogram.016384.000000.to.032768.000000 \
-		histogram.032768.000000.to.065536.000000 \
-		histogram.065536.000000.to.131072.000000 \
-		histogram.131072.000000.to.262144.000000 \
-		histogram.262144.000000.to.524288.000000; do
-		get_value $x
-		r=`expr $r + $value`
-	done
-	echo h16s.value `echo scale=6';' $r / $elapsed | bc `
-	;;
-esac

contrib/update-anchor.sh

@@ -1,158 +0,0 @@
-#!/bin/sh
-# update-anchor.sh, update a trust anchor.
-# Copyright 2008, W.C.A. Wijngaards
-# This file is BSD licensed, see doc/LICENSE.
-
-# which validating lookup to use.
-ubhost=unbound-host
-
-usage ( )
-{
-	echo "usage: update-anchor [-r hs] [-b] <zone name> <trust anchor file>"
-	echo "    performs an update of trust anchor file"
-	echo "    the trust anchor file is overwritten with the latest keys"
-	echo "    the trust anchor file should contain only keys for one zone"
-	echo "    -b causes keyfile to be made in bind format."
-	echo "       without -b the file is made in unbound format."
-	echo "    "
-	echo "alternate:"
-	echo "    update-anchor [-r hints] [-b] -d directory"
-	echo "    update all <zone>.anchor files in the directory."
-	echo "    "
-	echo "    name the files br.anchor se.anchor ..., and include them in"
-	echo "    the validating resolver config file."
-	echo "    put keys for the root in a file with the name root.anchor."
-	echo ""
-	echo "-r root.hints	use different root hints. Strict option order."
-	echo ""
-	echo "Exit code 0 means anchors updated, 1 no changes, others are errors."
-	exit 2
-}
-
-if test $# -eq 0; then
-	usage
-fi
-bindformat="no"
-filearg='-f'
-roothints=""
-if test X"$1" = "X-r"; then
-	shift
-	roothints="$1"
-	shift
-fi
-if test X"$1" = "X-b"; then
-	shift
-	bindformat="yes"
-	filearg='-F'
-fi
-if test $# -ne 2; then
-	echo "arguments wrong."
-	usage
-fi
-
-do_update ( ) {
-	# arguments: <zonename> <keyfile>
-	zonename="$1"
-	keyfile="$2"
-	tmpfile="/tmp/update-anchor.$$"
-	tmp2=$tmpfile.2
-	tmp3=$tmpfile.3
-	rh=""
-	if test -n "$roothints"; then
-		echo "server: root-hints: '$roothints'" > $tmp3
-		rh="-C $tmp3"
-	fi
-	$ubhost -v $rh $filearg "$keyfile" -t DNSKEY "$zonename" >$tmpfile
-	if test $? -ne 0; then
-		rm -f $tmpfile
-		echo "Error: Could not update zone $zonename anchor file $keyfile"
-		echo "Cause: $ubhost lookup failed" 
-		echo "    (Is the domain decommissioned? Is connectivity lost?)"
-		return 2
-	fi
-
-	# has the lookup been DNSSEC validated?
-	if grep '(secure)$' $tmpfile >/dev/null 2>&1; then
-		:
-	else
-		rm -f $tmpfile
-		echo "Error: Could not update zone $zonename anchor file $keyfile"
-		echo "Cause: result of lookup was not secure" 
-		echo "    (keys too far out of date? domain changed ownership? need root hints?)"
-		return 3
-	fi
-
-	if test $bindformat = "yes"; then
-		# are there any KSK keys on board?
-		echo 'trusted-keys {' > "$tmp2"
-		if grep ' has DNSKEY record 257' $tmpfile >/dev/null 2>&1; then
-			# store KSK keys in anchor file
-			grep '(secure)$' $tmpfile | \
-			grep ' has DNSKEY record 257' | \
-			sed -e 's/ (secure)$/";/' | \
-			sed -e 's/ has DNSKEY record \([0-9]*\) \([0-9]*\) \([0-9]*\) /. \1 \2 \3 "/' | \
-			sed -e 's/^\.\././' | sort >> "$tmp2"
-		else
-			# store all keys in the anchor file
-			grep '(secure)$' $tmpfile | \
-			sed -e 's/ (secure)$/";/' | \
-			sed -e 's/ has DNSKEY record \([0-9]*\) \([0-9]*\) \([0-9]*\) /. \1 \2 \3 "/' | \
-			sed -e 's/^\.\././' | sort >> "$tmp2"
-		fi
-		echo '};' >> "$tmp2"
-	else #not bindformat
-		# are there any KSK keys on board?
-		if grep ' has DNSKEY record 257' $tmpfile >/dev/null 2>&1; then
-			# store KSK keys in anchor file
-			grep '(secure)$' $tmpfile | \
-			grep ' has DNSKEY record 257' | \
-			sed -e 's/ (secure)$//' | \
-			sed -e 's/ has DNSKEY record /. IN DNSKEY /' | \
-			sed -e 's/^\.\././' | sort > "$tmp2"
-		else
-			# store all keys in the anchor file
-			grep '(secure)$' $tmpfile | \
-			sed -e 's/ (secure)$//' | \
-			sed -e 's/ has DNSKEY record /. IN DNSKEY /' | \
-			sed -e 's/^\.\././' | sort > "$tmp2"
-		fi
-	fi # endif-bindformat
-
-	# copy over if changed
-	diff $tmp2 $keyfile >/dev/null 2>&1
-	if test $? -eq 1; then   # 0 means no change, 2 means trouble.
-		cat $tmp2 > $keyfile
-		no_updated=0
-		echo "$zonename key file $keyfile updated."
-	else
-		echo "$zonename key file $keyfile unchanged."
-	fi
-
-	rm -f $tmpfile $tmp2 $tmp3
-}
-
-no_updated=1
-if test X"$1" = "X-d"; then
-	tdir="$2"
-	echo "start updating in $2"
-	for x in $tdir/*.anchor; do
-		if test `basename "$x"` = "root.anchor"; then
-			zname="."
-		else
-			zname=`basename "$x" .anchor`
-		fi
-		do_update "$zname" "$x"
-	done
-	echo "done updating in $2"
-else
-	# regular invocation
-	if test X"$1" = "X."; then
-		zname="$1"
-	else
-		# strip trailing dot from zone name
-		zname="`echo $1 | sed -e 's/\.$//'`"
-	fi
-	kfile="$2"
-	do_update $zname $kfile
-fi
-exit $no_updated

contrib/update-itar.sh

@@ -1,128 +0,0 @@
-#!/bin/sh
-# update-itar.sh - update from the interim trust anchor repository
-# Copyright 2009, W.C.A. Wijngaards
-# This file is BSD licensed, see doc/LICENSE.
-
-# --- Some settings
-
-# directory where unbound works
-thedir="."
-# where is the file that unbound is going to read
-ub_ta_file="$thedir/anchors.mf"
-# where is the itar master file format
-itar_url="ftp://ftp.iana.org/itar/anchors.mf"
-# where is the itar PGP signature
-itar_sig="ftp://ftp.iana.org/itar/anchors.mf.sig"
-
-# which command to fetch urls, cmd $dest $url. "wget -O" "curl -o"
-fetch_cmd="wget -O"
-# file with pgp public key
-pgp_pub_key_file="$thedir/update-itar.key"
-# our pgp keyring (goes into .gnupg directory)
-pgp_keyring_file="update-itar.ring"
-# pgp command to use
-pgp_cmd="gpg"
-
-
-# --- The script is below
-usage ( )
-{
-	echo "usage: update-itar"
-	echo "    Updates the trust anchors from the interim trust"
-	echo "    anchor repository, https://itar.iana.org, and checks PGP sig."
-	echo
-	echo "    Updates $ub_ta_file with the latest keys."
-	echo "    Read that file from the unbound config with"
-	echo "    trust-anchor-file: "'"'"$ub_ta_file"'"'
-	echo
-	echo "    Exit code 0 means anchors updated, 1 no changes, "
-	echo "    others are errors. So, in a cronjob you can do:"
-	echo "    cd /usr/local/etc/unbound    # your unbound work dir"
-	echo "    ./update-itar.sh && unbound-control reload"
-	exit 2
-}
-
-if test $# -ne 0; then
-	usage
-fi
-tmpf="/tmp/update-itar.$$"
-
-# one argument: explanation string
-error_exit ( )
-{
-	if test -f $tmpf.log; then cat $tmpf.log; fi
-	rm -f $tmpf $tmpf.sig $tmpf.log
-	echo "Error updating trust anchors: $1"
-	exit 2
-}
-
-if test ! -f $pgp_pub_key_file || test ! -f $HOME/.gnupg/$pgp_keyring_file || \
-	test "$pgp_pub_key_file" -nt $HOME/.gnupg/$pgp_keyring_file; then
-	# default key contents right here
-	if test ! -f $pgp_pub_key_file; then
-		echo "creating default IANA ITAR pgp key file"
-		cat >$pgp_pub_key_file <<EOF
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.5
-
-mQGiBElr2DcRBAC+6YK6eSP7rzstvnMPQXMrpvVfuIR5FeTpGuwae9JP78V/iOXr
-N0yW8Dn6kdAztCMuRizL1Ij9IgaD7pjn8h09VgR4cN4LDv75rcQeWLzNxKy4UNRF
-aStL77RcIoTblBeCgHAK9FLzd0XfTGZCNaLNy9BYVSLyADOVDIqgBcrvBwCglz03
-QhOMIgaSx/XuRh6kYtynZ6kD/2GXx6pFs57b7rww8yOpdurCSOMB1wuEXiIXznTI
-06ARiib0G5VDvOdpy0LDU2526Q9f/WAERlhcExTgnTFigG4mRksUiDrrai4GIr+6
-JaivcGFVYdZZ4mZ088jcwujS/UY3C0ryGR9ufYUDAnfx6frhSl6o6j5is+jeGndF
-JYRAA/9B/1OXNVwFSiIxnP2aPUwsT1li1vaW8dhA/5PcuPLOVvEjPc1Pc16HGLhE
-8CRmMn66LqB1ccInE5hLKGGvV3pctjan+IOhaq3OHt/a+buDtTPgykchMZ2k1AzT
-RYk+gksxpIl6yTZsBH4hoRt8auxEJW8AiYbNtXXkNuWcoQL40bQsSUFOQSBUcnVz
-dCBBbmNob3IgUmVwb3NpdG9yeSA8aXRhckBpYW5hLm9yZz6IYAQTEQIAIAUCSWvY
-NwIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEPR9+zCB1GT0GUAAn29/TacF
-Teh87dls8pmkjxS4pKf1AKCJS/MvzR54AblO4DNMyc9q0G4frrkCDQRJa9g3EAgA
-ywoLxF4HVb9o926UIXw8JxNIzDPkt8galAcKRUmHQMNa/QA80WMl9Ia6DIxavGlV
-I5O1fvms297RV2KSSBjKWn6G+0me80A7aw0eHNg7habM5VtzDz5DhJbQFdJV9aYV
-DoTSnY6uR6iSSRrdZNaYdlCwDS8lBCnOKoGMArHzVCa2EdCBeCUY/eObOXtu8Gm3
-nDkuWeLPv08/0lvtr6d6VoDUEVPEsJAPONEYtpz/D+EZddUraF+3JscWqfRApBOz
-/8WHaeTNdzIH+h1ntktiizA6eH40EM6coQQxtIRsxg1DPTxofdovreMkcMI0EUUP
-awDn8gDtgG3g6Ud5zCdknwAEDQf/W3rxrEN6OZxJvWti8Iu6KOgxtuINiAsimPPX
-qy9KHowyEE9EMPzgADjWC9Reyusr4CwcootjWw7ryUwU0fXvVULKhg32NzLsx/Ci
-WtgCPSR58WZ1KKhnoB05+PTrwzhU+u64Cd/vJtFqGxSrANl2FAkPswHJMr8dMwAz
-uni7zzLJ+homW1T5AaixwmN3jeDHWshJH9E9JIhr5Y/8AzMl1V10r2u1c2ej0lBJ
-Y4GegI5cYAEBerS9d+mrbPlvbJ8AfuAuEf0y/PWJh0z1+Kck5qIbXMn/rpMBYvLJ
-Uj5CfqWlh8+hxqSYJDXtLm8hBiQFiMEew0jOc2Tw4F91OZ+jyYhJBBgRAgAJBQJJ
-a9g3AhsMAAoJEPR9+zCB1GT0AUwAn2ZtBwAyVxppdeTqilXufUvAkvjbAJ9dUpR1
-9a17/5BvDDJcIxSEKTJmDw==
-=zCNZ
------END PGP PUBLIC KEY BLOCK-----
-EOF
-	fi
-	# import the new key
-	$pgp_cmd --no-default-keyring --keyring $pgp_keyring_file \
-		--primary-keyring $pgp_keyring_file \
-		--import $pgp_pub_key_file >$tmpf.log 2>&1 \
-		|| error_exit "could not import pgp public key into keyring"
-fi
-
-$fetch_cmd $tmpf $itar_url >$tmpf.log 2>&1 \
-	|| error_exit "fetching $itar_url failed"
-tail -2 $tmpf | grep "; End of file" >/dev/null 2>&1 || \
-	error_exit "The file fetched from $itar_url was partial"
-$fetch_cmd $tmpf.sig $itar_sig >$tmpf.log 2>&1 \
-	|| error_exit "fetching $itar_sig failed"
-
-# check the file with pgp
-$pgp_cmd --no-default-keyring --keyring $pgp_keyring_file \
-	--verify $tmpf.sig $tmpf >$tmpf.log 2>&1 \
-	|| error_exit "the PGP signature failed!"
-
-# check for differences
-val=1
-if diff "$ub_ta_file" $tmpf 2>/dev/null ; then
-	# echo "The interim trust anchor repository did not change."
-	:
-else
-	echo "Updating $ub_ta_file"
-	cp $tmpf $ub_ta_file
-	val=0
-fi
-
-rm -f $tmpf $tmpf.sig $tmpf.log
-exit $val 

daemon/acl_list.c

@@ -1,176 +0,0 @@
-/*
- * daemon/acl_list.h - client access control storage for the server.
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file helps the server keep out queries from outside sources, that
- * should not be answered.
- */
-#include "config.h"
-#include "daemon/acl_list.h"
-#include "util/regional.h"
-#include "util/log.h"
-#include "util/config_file.h"
-#include "util/net_help.h"
-
-struct acl_list* 
-acl_list_create()
-{
-	struct acl_list* acl = (struct acl_list*)calloc(1,
-		sizeof(struct acl_list));
-	if(!acl)
-		return NULL;
-	acl->region = regional_create();
-	if(!acl->region) {
-		acl_list_delete(acl);
-		return NULL;
-	}
-	return acl;
-}
-
-void 
-acl_list_delete(struct acl_list* acl)
-{
-	if(!acl) 
-		return;
-	regional_destroy(acl->region);
-	free(acl);
-}
-
-/** insert new address into acl_list structure */
-static int
-acl_list_insert(struct acl_list* acl, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int net, enum acl_access control, 
-	int complain_duplicates)
-{
-	struct acl_addr* node = regional_alloc(acl->region,
-		sizeof(struct acl_addr));
-	if(!node)
-		return 0;
-	node->control = control;
-	if(!addr_tree_insert(&acl->tree, &node->node, addr, addrlen, net)) {
-		if(complain_duplicates)
-			verbose(VERB_QUERY, "duplicate acl address ignored.");
-	}
-	return 1;
-}
-
-/** apply acl_list string */
-static int
-acl_list_str_cfg(struct acl_list* acl, const char* str, const char* s2,
-	int complain_duplicates)
-{
-	struct sockaddr_storage addr;
-	int net;
-	socklen_t addrlen;
-	enum acl_access control;
-	if(strcmp(s2, "allow") == 0)
-		control = acl_allow;
-	else if(strcmp(s2, "deny") == 0)
-		control = acl_deny;
-	else if(strcmp(s2, "refuse") == 0)
-		control = acl_refuse;
-	else if(strcmp(s2, "allow_snoop") == 0)
-		control = acl_allow_snoop;
-	else {
-		log_err("access control type %s unknown", str);
-		return 0;
-	}
-	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
-		log_err("cannot parse access control: %s %s", str, s2);
-		return 0;
-	}
-	if(!acl_list_insert(acl, &addr, addrlen, net, control, 
-		complain_duplicates)) {
-		log_err("out of memory");
-		return 0;
-	}
-	return 1;
-}
-
-/** read acl_list config */
-static int 
-read_acl_list(struct acl_list* acl, struct config_file* cfg)
-{
-	struct config_str2list* p;
-	for(p = cfg->acls; p; p = p->next) {
-		log_assert(p->str && p->str2);
-		if(!acl_list_str_cfg(acl, p->str, p->str2, 1))
-			return 0;
-	}
-	return 1;
-}
-
-int 
-acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
-{
-	regional_free_all(acl->region);
-	addr_tree_init(&acl->tree);
-	if(!read_acl_list(acl, cfg))
-		return 0;
-	/* insert defaults, with '0' to ignore them if they are duplicates */
-	if(!acl_list_str_cfg(acl, "0.0.0.0/0", "refuse", 0))
-		return 0;
-	if(!acl_list_str_cfg(acl, "127.0.0.0/8", "allow", 0))
-		return 0;
-	if(cfg->do_ip6) {
-		if(!acl_list_str_cfg(acl, "::0/0", "refuse", 0))
-			return 0;
-		if(!acl_list_str_cfg(acl, "::1", "allow", 0))
-			return 0;
-		if(!acl_list_str_cfg(acl, "::ffff:127.0.0.1", "allow", 0))
-			return 0;
-	}
-	addr_tree_init_parents(&acl->tree);
-	return 1;
-}
-
-enum acl_access 
-acl_list_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
-        socklen_t addrlen)
-{
-	struct acl_addr* r = (struct acl_addr*)addr_tree_lookup(&acl->tree,
-		addr, addrlen);
-	if(r) return r->control;
-	return acl_deny;
-}
-
-size_t 
-acl_list_get_mem(struct acl_list* acl)
-{
-	if(!acl) return 0;
-	return sizeof(*acl) + regional_get_mem(acl->region);
-}

daemon/acl_list.h

@@ -1,125 +0,0 @@
-/*
- * daemon/acl_list.h - client access control storage for the server.
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file keeps track of the list of clients that are allowed to 
- * access the server.
- */
-
-#ifndef DAEMON_ACL_LIST_H
-#define DAEMON_ACL_LIST_H
-#include "util/storage/dnstree.h"
-struct config_file;
-struct regional;
-
-/**
- * Enumeration of access control options for an address range.
- * Allow or deny access.
- */
-enum acl_access {
-	/** disallow any access whatsoever, drop it */
-	acl_deny = 0,
-	/** disallow access, send a polite 'REFUSED' reply */
-	acl_refuse,
-	/** allow full access for recursion (+RD) queries */
-	acl_allow,
-	/** allow full access for all queries, recursion and cache snooping */
-	acl_allow_snoop
-};
-
-/**
- * Access control storage structure
- */
-struct acl_list {
-	/** regional for allocation */
-	struct regional* region;
-	/** 
-	 * Tree of the addresses that are allowed/blocked.
-	 * contents of type acl_addr.
-	 */
-	rbtree_t tree;
-};
-
-/**
- *
- * An address span with access control information
- */
-struct acl_addr {
-	/** node in address tree */
-	struct addr_tree_node node;
-	/** access control on this netblock */
-	enum acl_access control;
-};
-
-/**
- * Create acl structure 
- * @return new structure or NULL on error.
- */
-struct acl_list* acl_list_create();
-
-/**
- * Delete acl structure.
- * @param acl: to delete.
- */
-void acl_list_delete(struct acl_list* acl);
-
-/**
- * Process access control config.
- * @param acl: where to store.
- * @param cfg: config options.
- * @return 0 on error.
- */
-int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg);
-
-/**
- * Lookup address to see its access control status.
- * @param acl: structure for address storage.
- * @param addr: address to check
- * @param addrlen: length of addr.
- * @return: what to do with message from this address.
- */
-enum acl_access acl_list_lookup(struct acl_list* acl, 
-	struct sockaddr_storage* addr, socklen_t addrlen);
-
-/**
- * Get memory used by acl structure.
- * @param acl: structure for address storage.
- * @return bytes in use.
- */
-size_t acl_list_get_mem(struct acl_list* acl);
-
-#endif /* DAEMON_ACL_LIST_H */

daemon/cachedump.c

@@ -1,966 +0,0 @@
-/*
- * daemon/cachedump.c - dump the cache to text format.
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains functions to read and write the cache(s)
- * to text format.
- */
-#include "config.h"
-#include "ldns/ldns.h"
-#include "daemon/cachedump.h"
-#include "daemon/remote.h"
-#include "daemon/worker.h"
-#include "daemon/daemon.h"
-#include "services/cache/rrset.h"
-#include "services/cache/dns.h"
-#include "services/cache/infra.h"
-#include "services/modstack.h"
-#include "util/data/msgreply.h"
-#include "util/regional.h"
-#include "util/net_help.h"
-#include "util/data/dname.h"
-#include "iterator/iterator.h"
-#include "iterator/iter_delegpt.h"
-#include "iterator/iter_utils.h"
-#include "iterator/iter_fwd.h"
-#include "iterator/iter_hints.h"
-
-/** convert to ldns rr */
-static ldns_rr*
-to_rr(struct ub_packed_rrset_key* k, struct packed_rrset_data* d, 
-	uint32_t now, size_t i, uint16_t type)
-{
-	ldns_rr* rr = ldns_rr_new();
-	ldns_rdf* rdf;
-	ldns_status status;
-	size_t pos;
-	log_assert(i < d->count + d->rrsig_count);
-	if(!rr) {
-		return NULL;
-	}
-	ldns_rr_set_type(rr, type);
-	ldns_rr_set_class(rr, ntohs(k->rk.rrset_class));
-	if(d->rr_ttl[i] < now)
-		ldns_rr_set_ttl(rr, 0);
-	else	ldns_rr_set_ttl(rr, d->rr_ttl[i] - now);
-	pos = 0;
-	status = ldns_wire2dname(&rdf, k->rk.dname, k->rk.dname_len, &pos);
-	if(status != LDNS_STATUS_OK) {
-		/* we drop detailed error in status */
-		ldns_rr_free(rr);
-		return NULL;
-	}
-	ldns_rr_set_owner(rr, rdf);
-	pos = 0;
-	status = ldns_wire2rdf(rr, d->rr_data[i], d->rr_len[i], &pos);
-	if(status != LDNS_STATUS_OK) {
-		/* we drop detailed error in status */
-		ldns_rr_free(rr);
-		return NULL;
-	}
-	return rr;
-}
-
-/** dump one rrset zonefile line */
-static int
-dump_rrset_line(SSL* ssl, struct ub_packed_rrset_key* k,
-        struct packed_rrset_data* d, uint32_t now, size_t i, uint16_t type)
-{
-	char* s;
-	ldns_rr* rr = to_rr(k, d, now, i, type);
-	if(!rr) {
-		return ssl_printf(ssl, "BADRR\n");
-	}
-	s = ldns_rr2str(rr);
-	ldns_rr_free(rr);
-	if(!s) {
-		return ssl_printf(ssl, "BADRR\n");
-	}
-	if(!ssl_printf(ssl, "%s", s)) {
-		free(s);
-		return 0;
-	}
-	free(s);
-	return 1;
-}
-
-/** dump rrset key and data info */
-static int
-dump_rrset(SSL* ssl, struct ub_packed_rrset_key* k, 
-	struct packed_rrset_data* d, uint32_t now)
-{
-	size_t i;
-	/* rd lock held by caller */
-	if(!k || !d) return 1;
-	if(d->ttl < now) return 1; /* expired */
-
-	/* meta line */
-	if(!ssl_printf(ssl, ";rrset%s %u %u %u %d %d\n",
-		(k->rk.flags & PACKED_RRSET_NSEC_AT_APEX)?" nsec_apex":"",
-		(unsigned)(d->ttl - now),
-		(unsigned)d->count, (unsigned)d->rrsig_count,
-		(int)d->trust, (int)d->security
-		)) 
-		return 0;
-	for(i=0; i<d->count; i++) {
-		if(!dump_rrset_line(ssl, k, d, now, i, ntohs(k->rk.type)))
-			return 0;
-	}
-	for(i=0; i<d->rrsig_count; i++) {
-		if(!dump_rrset_line(ssl, k, d, now, i+d->count, 
-			LDNS_RR_TYPE_RRSIG))
-			return 0;
-	}
-	
-	return 1;
-}
-
-/** dump lruhash rrset cache */
-static int
-dump_rrset_lruhash(SSL* ssl, struct lruhash* h, uint32_t now)
-{
-	struct lruhash_entry* e;
-	/* lruhash already locked by caller */
-	/* walk in order of lru; best first */
-	for(e=h->lru_start; e; e = e->lru_next) {
-		lock_rw_rdlock(&e->lock);
-		if(!dump_rrset(ssl, (struct ub_packed_rrset_key*)e->key,
-			(struct packed_rrset_data*)e->data, now)) {
-			lock_rw_unlock(&e->lock);
-			return 0;
-		}
-		lock_rw_unlock(&e->lock);
-	}
-	return 1;
-}
-
-/** dump rrset cache */
-static int
-dump_rrset_cache(SSL* ssl, struct worker* worker)
-{
-	struct rrset_cache* r = worker->env.rrset_cache;
-	size_t slab;
-	if(!ssl_printf(ssl, "START_RRSET_CACHE\n")) return 0;
-	for(slab=0; slab<r->table.size; slab++) {
-		lock_quick_lock(&r->table.array[slab]->lock);
-		if(!dump_rrset_lruhash(ssl, r->table.array[slab],
-			*worker->env.now)) {
-			lock_quick_unlock(&r->table.array[slab]->lock);
-			return 0;
-		}
-		lock_quick_unlock(&r->table.array[slab]->lock);
-	}
-	return ssl_printf(ssl, "END_RRSET_CACHE\n");
-}
-
-/** dump message to rrset reference */
-static int
-dump_msg_ref(SSL* ssl, struct ub_packed_rrset_key* k)
-{
-	ldns_rdf* rdf;
-	ldns_status status;
-	size_t pos;
-	char* nm, *tp, *cl;
-
-	pos = 0;
-	status = ldns_wire2dname(&rdf, k->rk.dname, k->rk.dname_len, &pos);
-	if(status != LDNS_STATUS_OK) {
-		return ssl_printf(ssl, "BADREF\n");
-	}
-	nm = ldns_rdf2str(rdf);
-	ldns_rdf_deep_free(rdf);
-	tp = ldns_rr_type2str(ntohs(k->rk.type));
-	cl = ldns_rr_class2str(ntohs(k->rk.rrset_class));
-	if(!nm || !cl || !tp) {
-		free(nm);
-		free(tp);
-		free(cl);
-		return ssl_printf(ssl, "BADREF\n");
-	}
-	if(!ssl_printf(ssl, "%s %s %s %d\n", nm, cl, tp, (int)k->rk.flags)) {
-		free(nm);
-		free(tp);
-		free(cl);
-		return 0;
-	}
-	free(nm);
-	free(tp);
-	free(cl);
-
-	return 1;
-}
-
-/** dump message entry */
-static int
-dump_msg(SSL* ssl, struct query_info* k, struct reply_info* d, 
-	uint32_t now)
-{
-	size_t i;
-	char* nm, *tp, *cl;
-	ldns_rdf* rdf;
-	ldns_status status;
-	size_t pos;
-	if(!k || !d) return 1;
-	if(d->ttl < now) return 1; /* expired */
-	
-	pos = 0;
-	status = ldns_wire2dname(&rdf, k->qname, k->qname_len, &pos);
-	if(status != LDNS_STATUS_OK) {
-		return 1; /* skip this entry */
-	}
-	nm = ldns_rdf2str(rdf);
-	ldns_rdf_deep_free(rdf);
-	tp = ldns_rr_type2str(k->qtype);
-	cl = ldns_rr_class2str(k->qclass);
-	if(!nm || !tp || !cl) {
-		free(nm);
-		free(tp);
-		free(cl);
-		return 1; /* skip this entry */
-	}
-	if(!rrset_array_lock(d->ref, d->rrset_count, now)) {
-		/* rrsets have timed out or do not exist */
-		free(nm);
-		free(tp);
-		free(cl);
-		return 1; /* skip this entry */
-	}
-	
-	/* meta line */
-	if(!ssl_printf(ssl, "msg %s %s %s %d %d %u %d %u %u %u\n",
-			nm, cl, tp,
-			(int)d->flags, (int)d->qdcount, 
-			(unsigned)(d->ttl-now), (int)d->security,
-			(unsigned)d->an_numrrsets, 
-			(unsigned)d->ns_numrrsets,
-			(unsigned)d->ar_numrrsets)) {
-		free(nm);
-		free(tp);
-		free(cl);
-		rrset_array_unlock(d->ref, d->rrset_count);
-		return 0;
-	}
-	free(nm);
-	free(tp);
-	free(cl);
-	
-	for(i=0; i<d->rrset_count; i++) {
-		if(!dump_msg_ref(ssl, d->rrsets[i])) {
-			rrset_array_unlock(d->ref, d->rrset_count);
-			return 0;
-		}
-	}
-	rrset_array_unlock(d->ref, d->rrset_count);
-
-	return 1;
-}
-
-/** copy msg to worker pad */
-static int
-copy_msg(struct regional* region, struct lruhash_entry* e, 
-	struct query_info** k, struct reply_info** d)
-{
-	struct reply_info* rep = (struct reply_info*)e->data;
-	*d = (struct reply_info*)regional_alloc_init(region, e->data,
-		sizeof(struct reply_info) + 
-		sizeof(struct rrset_ref) * (rep->rrset_count-1) +
-		sizeof(struct ub_packed_rrset_key*) * rep->rrset_count);
-	if(!*d)
-		return 0;
-	(*d)->rrsets = (struct ub_packed_rrset_key**)(
-		(uint8_t*)(&((*d)->ref[0])) + 
-		sizeof(struct rrset_ref) * rep->rrset_count);
-	*k = (struct query_info*)regional_alloc_init(region, 
-		e->key, sizeof(struct query_info));
-	if(!*k)
-		return 0;
-	(*k)->qname = regional_alloc_init(region, 
-		(*k)->qname, (*k)->qname_len);
-	return (*k)->qname != NULL;
-}
-
-/** dump lruhash msg cache */
-static int
-dump_msg_lruhash(SSL* ssl, struct worker* worker, struct lruhash* h)
-{
-	struct lruhash_entry* e;
-	struct query_info* k;
-	struct reply_info* d;
-
-	/* lruhash already locked by caller */
-	/* walk in order of lru; best first */
-	for(e=h->lru_start; e; e = e->lru_next) {
-		regional_free_all(worker->scratchpad);
-		lock_rw_rdlock(&e->lock);
-		/* make copy of rrset in worker buffer */
-		if(!copy_msg(worker->scratchpad, e, &k, &d)) {
-			lock_rw_unlock(&e->lock);
-			return 0;
-		}
-		lock_rw_unlock(&e->lock);
-		/* release lock so we can lookup the rrset references 
-		 * in the rrset cache */
-		if(!dump_msg(ssl, k, d, *worker->env.now)) {
-			return 0;
-		}
-	}
-	return 1;
-}
-
-/** dump msg cache */
-static int
-dump_msg_cache(SSL* ssl, struct worker* worker)
-{
-	struct slabhash* sh = worker->env.msg_cache;
-	size_t slab;
-	if(!ssl_printf(ssl, "START_MSG_CACHE\n")) return 0;
-	for(slab=0; slab<sh->size; slab++) {
-		lock_quick_lock(&sh->array[slab]->lock);
-		if(!dump_msg_lruhash(ssl, worker, sh->array[slab])) {
-			lock_quick_unlock(&sh->array[slab]->lock);
-			return 0;
-		}
-		lock_quick_unlock(&sh->array[slab]->lock);
-	}
-	return ssl_printf(ssl, "END_MSG_CACHE\n");
-}
-
-int
-dump_cache(SSL* ssl, struct worker* worker)
-{
-	if(!dump_rrset_cache(ssl, worker))
-		return 0;
-	if(!dump_msg_cache(ssl, worker))
-		return 0;
-	return ssl_printf(ssl, "EOF\n");
-}
-
-/** read a line from ssl into buffer */
-static int
-ssl_read_buf(SSL* ssl, ldns_buffer* buf)
-{
-	return ssl_read_line(ssl, (char*)ldns_buffer_begin(buf), 
-		ldns_buffer_capacity(buf));
-}
-
-/** check fixed text on line */
-static int
-read_fixed(SSL* ssl, ldns_buffer* buf, const char* str)
-{
-	if(!ssl_read_buf(ssl, buf)) return 0;
-	return (strcmp((char*)ldns_buffer_begin(buf), str) == 0);
-}
-
-/** load an RR into rrset */
-static int
-load_rr(SSL* ssl, ldns_buffer* buf, struct regional* region,
-	struct ub_packed_rrset_key* rk, struct packed_rrset_data* d,
-	unsigned int i, int is_rrsig, int* go_on, uint32_t now)
-{
-	ldns_rr* rr;
-	ldns_status status;
-
-	/* read the line */
-	if(!ssl_read_buf(ssl, buf))
-		return 0;
-	if(strncmp((char*)ldns_buffer_begin(buf), "BADRR\n", 6) == 0) {
-		*go_on = 0;
-		return 1;
-	}
-	status = ldns_rr_new_frm_str(&rr, (char*)ldns_buffer_begin(buf),
-		LDNS_DEFAULT_TTL, NULL, NULL);
-	if(status != LDNS_STATUS_OK) {
-		log_warn("error cannot parse rr: %s: %s",
-			ldns_get_errorstr_by_id(status),
-			(char*)ldns_buffer_begin(buf));
-		return 0;
-	}
-	if(is_rrsig && ldns_rr_get_type(rr) != LDNS_RR_TYPE_RRSIG) {
-		log_warn("error expected rrsig but got %s",
-			(char*)ldns_buffer_begin(buf));
-		return 0;
-	}
-
-	/* convert ldns rr into packed_rr */
-	d->rr_ttl[i] = ldns_rr_ttl(rr) + now;
-	ldns_buffer_clear(buf);
-	ldns_buffer_skip(buf, 2);
-	status = ldns_rr_rdata2buffer_wire(buf, rr);
-	if(status != LDNS_STATUS_OK) {
-		log_warn("error cannot rr2wire: %s",
-			ldns_get_errorstr_by_id(status));
-		ldns_rr_free(rr);
-		return 0;
-	}
-	ldns_buffer_flip(buf);
-	ldns_buffer_write_u16_at(buf, 0, ldns_buffer_limit(buf) - 2);
-
-	d->rr_len[i] = ldns_buffer_limit(buf);
-	d->rr_data[i] = (uint8_t*)regional_alloc_init(region, 
-		ldns_buffer_begin(buf), ldns_buffer_limit(buf));
-	if(!d->rr_data[i]) {
-		ldns_rr_free(rr);
-		log_warn("error out of memory");
-		return 0;
-	}
-
-	/* if first entry, fill the key structure */
-	if(i==0) {
-		rk->rk.type = htons(ldns_rr_get_type(rr));
-		rk->rk.rrset_class = htons(ldns_rr_get_class(rr));
-		ldns_buffer_clear(buf);
-		status = ldns_dname2buffer_wire(buf, ldns_rr_owner(rr));
-		if(status != LDNS_STATUS_OK) {
-			log_warn("error cannot dname2buffer: %s",
-				ldns_get_errorstr_by_id(status));
-			ldns_rr_free(rr);
-			return 0;
-		}
-		ldns_buffer_flip(buf);
-		rk->rk.dname_len = ldns_buffer_limit(buf);
-		rk->rk.dname = regional_alloc_init(region, 
-			ldns_buffer_begin(buf), ldns_buffer_limit(buf));
-		if(!rk->rk.dname) {
-			log_warn("error out of memory");
-			ldns_rr_free(rr);
-			return 0;
-		}
-	}
-	ldns_rr_free(rr);
-
-	return 1;
-}
-
-/** move entry into cache */
-static int
-move_into_cache(struct ub_packed_rrset_key* k, 
-	struct packed_rrset_data* d, struct worker* worker)
-{
-	struct ub_packed_rrset_key* ak;
-	struct packed_rrset_data* ad;
-	size_t s, i, num = d->count + d->rrsig_count;
-	struct rrset_ref ref;
-	uint8_t* p;
-
-	ak = alloc_special_obtain(&worker->alloc);
-	if(!ak) {
-		log_warn("error out of memory");
-		return 0;
-	}
-	ak->entry.data = NULL;
-	ak->rk = k->rk;
-	ak->entry.hash = rrset_key_hash(&k->rk);
-	ak->rk.dname = (uint8_t*)memdup(k->rk.dname, k->rk.dname_len);
-	if(!ak->rk.dname) {
-		log_warn("error out of memory");
-		ub_packed_rrset_parsedelete(ak, &worker->alloc);
-		return 0;
-	}
-	s = sizeof(*ad) + (sizeof(size_t) + sizeof(uint8_t*) + 
-		sizeof(uint32_t))* num;
-	for(i=0; i<num; i++)
-		s += d->rr_len[i];
-	ad = (struct packed_rrset_data*)malloc(s);
-	if(!ad) {
-		log_warn("error out of memory");
-		ub_packed_rrset_parsedelete(ak, &worker->alloc);
-		return 0;
-	}
-	p = (uint8_t*)ad;
-	memmove(p, d, sizeof(*ad));
-	p += sizeof(*ad);
-	memmove(p, &d->rr_len[0], sizeof(size_t)*num);
-	p += sizeof(size_t)*num;
-	memmove(p, &d->rr_data[0], sizeof(uint8_t*)*num);
-	p += sizeof(uint8_t*)*num;
-	memmove(p, &d->rr_ttl[0], sizeof(uint32_t)*num);
-	p += sizeof(uint32_t)*num;
-	for(i=0; i<num; i++) {
-		memmove(p, d->rr_data[i], d->rr_len[i]);
-		p += d->rr_len[i];
-	}
-	packed_rrset_ptr_fixup(ad);
-
-	ak->entry.data = ad;
-
-	ref.key = ak;
-	ref.id = ak->id;
-	(void)rrset_cache_update(worker->env.rrset_cache, &ref,
-		&worker->alloc, *worker->env.now);
-	return 1;
-}
-
-/** load an rrset entry */
-static int
-load_rrset(SSL* ssl, ldns_buffer* buf, struct worker* worker)
-{
-	char* s = (char*)ldns_buffer_begin(buf);
-	struct regional* region = worker->scratchpad;
-	struct ub_packed_rrset_key* rk;
-	struct packed_rrset_data* d;
-	unsigned int ttl, rr_count, rrsig_count, trust, security;
-	unsigned int i;
-	int go_on = 1;
-	regional_free_all(region);
-
-	rk = (struct ub_packed_rrset_key*)regional_alloc_zero(region, 
-		sizeof(*rk));
-	d = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*d));
-	if(!rk || !d) {
-		log_warn("error out of memory");
-		return 0;
-	}
-
-	if(strncmp(s, ";rrset", 6) != 0) {
-		log_warn("error expected ';rrset' but got %s", s);
-		return 0;
-	}
-	s += 6;
-	if(strncmp(s, " nsec_apex", 10) == 0) {
-		s += 10;
-		rk->rk.flags |= PACKED_RRSET_NSEC_AT_APEX;
-	}
-	if(sscanf(s, " %u %u %u %u %u", &ttl, &rr_count, &rrsig_count,
-		&trust, &security) != 5) {
-		log_warn("error bad rrset spec %s", s);
-		return 0;
-	}
-	if(rr_count == 0 && rrsig_count == 0) {
-		log_warn("bad rrset without contents");
-		return 0;
-	}
-	d->count = (size_t)rr_count;
-	d->rrsig_count = (size_t)rrsig_count;
-	d->security = (enum sec_status)security;
-	d->trust = (enum rrset_trust)trust;
-	d->ttl = (uint32_t)ttl + *worker->env.now;
-
-	d->rr_len = regional_alloc_zero(region, 
-		sizeof(size_t)*(d->count+d->rrsig_count));
-	d->rr_ttl = regional_alloc_zero(region, 
-		sizeof(uint32_t)*(d->count+d->rrsig_count));
-	d->rr_data = regional_alloc_zero(region, 
-		sizeof(uint8_t*)*(d->count+d->rrsig_count));
-	if(!d->rr_len || !d->rr_ttl || !d->rr_data) {
-		log_warn("error out of memory");
-		return 0;
-	}
-	
-	/* read the rr's themselves */
-	for(i=0; i<rr_count; i++) {
-		if(!load_rr(ssl, buf, region, rk, d, i, 0, 
-			&go_on, *worker->env.now)) {
-			log_warn("could not read rr %u", i);
-			return 0;
-		}
-	}
-	for(i=0; i<rrsig_count; i++) {
-		if(!load_rr(ssl, buf, region, rk, d, i+rr_count, 1, 
-			&go_on, *worker->env.now)) {
-			log_warn("could not read rrsig %u", i);
-			return 0;
-		}
-	}
-	if(!go_on) {
-		/* skip this entry */
-		return 1;
-	}
-
-	return move_into_cache(rk, d, worker);
-}
-
-/** load rrset cache */
-static int
-load_rrset_cache(SSL* ssl, struct worker* worker)
-{
-	ldns_buffer* buf = worker->env.scratch_buffer;
-	if(!read_fixed(ssl, buf, "START_RRSET_CACHE")) return 0;
-	while(ssl_read_buf(ssl, buf) && 
-		strcmp((char*)ldns_buffer_begin(buf), "END_RRSET_CACHE")!=0) {
-		if(!load_rrset(ssl, buf, worker))
-			return 0;
-	}
-	return 1;
-}
-
-/** read qinfo from next three words */
-static char*
-load_qinfo(char* str, struct query_info* qinfo, ldns_buffer* buf, 
-	struct regional* region)
-{
-	/* s is part of the buf */
-	char* s = str;
-	ldns_rr* rr;
-	ldns_status status;
-
-	/* skip three words */
-	s = strchr(str, ' ');
-	if(s) s = strchr(s+1, ' ');
-	if(s) s = strchr(s+1, ' ');
-	if(!s) {
-		log_warn("error line too short, %s", str);
-		return NULL;
-	}
-	s[0] = 0;
-	s++;
-
-	/* parse them */
-	status = ldns_rr_new_question_frm_str(&rr, str, NULL, NULL);
-	if(status != LDNS_STATUS_OK) {
-		log_warn("error cannot parse: %s %s",
-			ldns_get_errorstr_by_id(status), str);
-		return NULL;
-	}
-	qinfo->qtype = ldns_rr_get_type(rr);
-	qinfo->qclass = ldns_rr_get_class(rr);
-	ldns_buffer_clear(buf);
-	status = ldns_dname2buffer_wire(buf, ldns_rr_owner(rr));
-	ldns_rr_free(rr);
-	if(status != LDNS_STATUS_OK) {
-		log_warn("error cannot dname2wire: %s", 
-			ldns_get_errorstr_by_id(status));
-		return NULL;
-	}
-	ldns_buffer_flip(buf);
-	qinfo->qname_len = ldns_buffer_limit(buf);
-	qinfo->qname = (uint8_t*)regional_alloc_init(region, 
-		ldns_buffer_begin(buf), ldns_buffer_limit(buf));
-	if(!qinfo->qname) {
-		log_warn("error out of memory");
-		return NULL;
-	}
-
-	return s;
-}
-
-/** load a msg rrset reference */
-static int
-load_ref(SSL* ssl, ldns_buffer* buf, struct worker* worker, 
-	struct regional *region, struct ub_packed_rrset_key** rrset, 
-	int* go_on)
-{
-	char* s = (char*)ldns_buffer_begin(buf);
-	struct query_info qinfo;
-	unsigned int flags;
-	struct ub_packed_rrset_key* k;
-
-	/* read line */
-	if(!ssl_read_buf(ssl, buf))
-		return 0;
-	if(strncmp(s, "BADREF", 6) == 0) {
-		*go_on = 0; /* its bad, skip it and skip message */
-		return 1;
-	}
-
-	s = load_qinfo(s, &qinfo, buf, region);
-	if(!s) {
-		return 0;
-	}
-	if(sscanf(s, " %u", &flags) != 1) {
-		log_warn("error cannot parse flags: %s", s);
-		return 0;
-	}
-
-	/* lookup in cache */
-	k = rrset_cache_lookup(worker->env.rrset_cache, qinfo.qname,
-		qinfo.qname_len, qinfo.qtype, qinfo.qclass,
-		(uint32_t)flags, *worker->env.now, 0);
-	if(!k) {
-		/* not found or expired */
-		*go_on = 0;
-		return 1;
-	}
-
-	/* store in result */
-	*rrset = packed_rrset_copy_region(k, region, *worker->env.now);
-	lock_rw_unlock(&k->entry.lock);
-
-	return (*rrset != NULL);
-}
-
-/** load a msg entry */
-static int
-load_msg(SSL* ssl, ldns_buffer* buf, struct worker* worker)
-{
-	struct regional* region = worker->scratchpad;
-	struct query_info qinf;
-	struct reply_info rep;
-	char* s = (char*)ldns_buffer_begin(buf);
-	unsigned int flags, qdcount, ttl, security, an, ns, ar;
-	size_t i;
-	int go_on = 1;
-
-	regional_free_all(region);
-
-	if(strncmp(s, "msg ", 4) != 0) {
-		log_warn("error expected msg but got %s", s);
-		return 0;
-	}
-	s += 4;
-	s = load_qinfo(s, &qinf, buf, region);
-	if(!s) {
-		return 0;
-	}
-
-	/* read remainder of line */
-	if(sscanf(s, " %u %u %u %u %u %u %u", &flags, &qdcount, &ttl, 
-		&security, &an, &ns, &ar) != 7) {
-		log_warn("error cannot parse numbers: %s", s);
-		return 0;
-	}
-	rep.flags = (uint16_t)flags;
-	rep.qdcount = (uint16_t)qdcount;
-	rep.ttl = (uint32_t)ttl;
-	rep.prefetch_ttl = PREFETCH_TTL_CALC(rep.ttl);
-	rep.security = (enum sec_status)security;
-	rep.an_numrrsets = (size_t)an;
-	rep.ns_numrrsets = (size_t)ns;
-	rep.ar_numrrsets = (size_t)ar;
-	rep.rrset_count = (size_t)an+(size_t)ns+(size_t)ar;
-	rep.rrsets = (struct ub_packed_rrset_key**)regional_alloc_zero(
-		region, sizeof(struct ub_packed_rrset_key*)*rep.rrset_count);
-
-	/* fill repinfo with references */
-	for(i=0; i<rep.rrset_count; i++) {
-		if(!load_ref(ssl, buf, worker, region, &rep.rrsets[i], 
-			&go_on)) {
-			return 0;
-		}
-	}
-
-	if(!go_on) 
-		return 1; /* skip this one, not all references satisfied */
-
-	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0)) {
-		log_warn("error out of memory");
-		return 0;
-	}
-	return 1;
-}
-
-/** load msg cache */
-static int
-load_msg_cache(SSL* ssl, struct worker* worker)
-{
-	ldns_buffer* buf = worker->env.scratch_buffer;
-	if(!read_fixed(ssl, buf, "START_MSG_CACHE")) return 0;
-	while(ssl_read_buf(ssl, buf) && 
-		strcmp((char*)ldns_buffer_begin(buf), "END_MSG_CACHE")!=0) {
-		if(!load_msg(ssl, buf, worker))
-			return 0;
-	}
-	return 1;
-}
-
-int
-load_cache(SSL* ssl, struct worker* worker)
-{
-	if(!load_rrset_cache(ssl, worker))
-		return 0;
-	if(!load_msg_cache(ssl, worker))
-		return 0;
-	return read_fixed(ssl, worker->env.scratch_buffer, "EOF");
-}
-
-/** print details on a delegation point */
-static void
-print_dp_details(SSL* ssl, struct worker* worker, struct delegpt* dp)
-{
-	char buf[257];
-	struct delegpt_addr* a;
-	int lame, dlame, rlame, rtt, edns_vs, to, lost;
-	uint8_t edns_lame_known;
-	for(a = dp->target_list; a; a = a->next_target) {
-		addr_to_str(&a->addr, a->addrlen, buf, sizeof(buf));
-		if(!ssl_printf(ssl, "%-16s\t", buf))
-			return;
-		if(a->bogus) {
-			if(!ssl_printf(ssl, "Address is BOGUS. ")) 
-				return;
-		}
-		/* lookup in infra cache */
-		/* uses type_A because most often looked up, but other
-		 * lameness won't be reported then */
-		if(!infra_get_lame_rtt(worker->env.infra_cache, 
-			&a->addr, a->addrlen, dp->name, dp->namelen,
-			LDNS_RR_TYPE_A, &lame, &dlame, &rlame, &rtt, &lost,
-			*worker->env.now)) {
-			if(!ssl_printf(ssl, "not in infra cache.\n"))
-				return;
-			continue; /* skip stuff not in infra cache */
-		}
-		if(!ssl_printf(ssl, "%s%s%s%srtt %d msec, %d lost. ",
-			lame?"LAME ":"", dlame?"NoDNSSEC ":"",
-			a->lame?"AddrWasParentSide ":"",
-			rlame?"NoAuthButRecursive ":"", rtt, lost))
-			return;
-		if(infra_host(worker->env.infra_cache, &a->addr, a->addrlen,
-			*worker->env.now, &edns_vs, &edns_lame_known, &to)) {
-			if(edns_vs == -1) {
-				if(!ssl_printf(ssl, "noEDNS%s.",
-					edns_lame_known?" probed":""))
-					return;
-			} else {
-				if(!ssl_printf(ssl, "EDNS %d%s.",
-					edns_vs, edns_lame_known?" probed":""))
-					return;
-			}
-		}
-		if(!ssl_printf(ssl, "\n"))
-			return;
-	}
-}
-
-/** print main dp info */
-static void
-print_dp_main(SSL* ssl, struct delegpt* dp, struct dns_msg* msg)
-{
-	size_t i, n_ns, n_miss, n_addr, n_res, n_avail;
-
-	/* print the dp */
-	if(msg)
-	    for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
-		struct packed_rrset_data* d = 
-			(struct packed_rrset_data*)k->entry.data;
-		if(d->security == sec_status_bogus) {
-			if(!ssl_printf(ssl, "Address is BOGUS:\n"))
-				return;
-		}
-		if(!dump_rrset(ssl, k, d, 0))
-			return;
-	    }
-	delegpt_count_ns(dp, &n_ns, &n_miss);
-	delegpt_count_addr(dp, &n_addr, &n_res, &n_avail);
-	/* since dp has not been used by iterator, all are available*/
-	if(!ssl_printf(ssl, "Delegation with %d names, of which %d "
-		"can be examined to query further addresses.\n"
-		"%sIt provides %d IP addresses.\n", 
-		(int)n_ns, (int)n_miss, (dp->bogus?"It is BOGUS. ":""),
-		(int)n_addr))
-		return;
-}
-
-int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
-	size_t nmlen, int ATTR_UNUSED(nmlabs))
-{
-	/* deep links into the iterator module */
-	struct delegpt* dp;
-	struct dns_msg* msg;
-	struct regional* region = worker->scratchpad;
-	char b[260];
-	struct query_info qinfo;
-	struct iter_hints_stub* stub;
-	struct iter_env* ie;
-	regional_free_all(region);
-	qinfo.qname = nm;
-	qinfo.qname_len = nmlen;
-	qinfo.qtype = LDNS_RR_TYPE_A;
-	qinfo.qclass = LDNS_RR_CLASS_IN;
-
-	if(modstack_find(&worker->daemon->mods, "iterator") == -1) {
-		return ssl_printf(ssl, "error: no iterator module\n");
-	}
-	ie = (struct iter_env*)worker->env.modinfo[modstack_find(&worker->
-		daemon->mods, "iterator")];
-
-	dname_str(nm, b);
-	if(!ssl_printf(ssl, "The following name servers are used for lookup "
-		"of %s\n", b)) 
-		return 0;
-	
-	dp = forwards_lookup(worker->env.fwds, nm, qinfo.qclass);
-	if(dp) {
-		if(!ssl_printf(ssl, "forwarding request:\n"))
-			return 0;
-		print_dp_main(ssl, dp, NULL);
-		print_dp_details(ssl, worker, dp);
-		return 1;
-	}
-	
-	while(1) {
-		dp = dns_cache_find_delegation(&worker->env, nm, nmlen, 
-			qinfo.qtype, qinfo.qclass, region, &msg, 
-			*worker->env.now);
-		if(!dp) {
-			return ssl_printf(ssl, "no delegation from "
-				"cache; goes to configured roots\n");
-		}
-		/* go up? */
-		if(iter_dp_is_useless(&qinfo, BIT_RD, dp)) {
-			print_dp_main(ssl, dp, msg);
-			print_dp_details(ssl, worker, dp);
-			if(!ssl_printf(ssl, "cache delegation was "
-				"useless (no IP addresses)\n"))
-				return 0;
-			if(dname_is_root(nm)) {
-				/* goes to root config */
-				return ssl_printf(ssl, "no delegation from "
-					"cache; goes to configured roots\n");
-			} else {
-				/* useless, goes up */
-				nm = dp->name;
-				nmlen = dp->namelen;
-				dname_remove_label(&nm, &nmlen);
-				dname_str(nm, b);
-				if(!ssl_printf(ssl, "going up, lookup %s\n", b))
-					return 0;
-				continue;
-			}
-		} 
-		stub = hints_lookup_stub(ie->hints, nm, qinfo.qclass, dp);
-		if(stub) {
-			if(stub->noprime) {
-				if(!ssl_printf(ssl, "The noprime stub servers "
-					"are used:\n"))
-					return 0;
-			} else {
-				if(!ssl_printf(ssl, "The stub is primed "
-						"with servers:\n"))
-					return 0;
-			}
-			print_dp_main(ssl, stub->dp, NULL);
-			print_dp_details(ssl, worker, stub->dp);
-		} else {
-			print_dp_main(ssl, dp, msg);
-			print_dp_details(ssl, worker, dp);
-		}
-		break;
-	}
-
-	return 1;
-}

daemon/cachedump.h

@@ -1,107 +0,0 @@
-/*
- * daemon/cachedump.h - dump the cache to text format.
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains functions to read and write the cache(s)
- * to text format.
- *
- * The format of the file is as follows:
- * [RRset cache]
- * [Message cache]
- * EOF		-- fixed string "EOF" before end of the file.
- *
- * The RRset cache is:
- * START_RRSET_CACHE
- * [rrset]*
- * END_RRSET_CACHE
- *
- * rrset is:
- * ;rrset [nsec_apex] TTL rr_count rrsig_count trust security
- * resource records, one per line, in zonefile format
- * rrsig records, one per line, in zonefile format
- * If the text conversion fails, BADRR is printed on the line.
- *
- * The Message cache is:
- * START_MSG_CACHE
- * [msg]*
- * END_MSG_CACHE
- *
- * msg is:
- * msg name class type flags qdcount ttl security an ns ar
- * list of rrset references, one per line. If conversion fails, BADREF
- * reference is:
- * name class type flags
- *
- * Expired cache entries are not printed.
- */
-
-#ifndef DAEMON_DUMPCACHE_H
-#define DAEMON_DUMPCACHE_H
-struct worker;
-
-/**
- * Dump cache(s) to text
- * @param ssl: to print to
- * @param worker: worker that is available (buffers, etc) and has 
- * 	ptrs to the caches.
- * @return false on ssl print error.
- */
-int dump_cache(SSL* ssl, struct worker* worker);
-
-/**
- * Load cache(s) from text 
- * @param ssl: to read from 
- * @param worker: worker that is available (buffers, etc) and has 
- * 	ptrs to the caches.
- * @return false on ssl error.
- */
-int load_cache(SSL* ssl, struct worker* worker);
-
-/**
- * Print the delegation used to lookup for this name.
- * @param ssl: to read from 
- * @param worker: worker that is available (buffers, etc) and has 
- * 	ptrs to the caches.
- * @param nm: name to lookup
- * @param nmlen: length of name.
- * @param nmlabs: labels in name.
- * @return false on ssl error.
- */
-int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
-	size_t nmlen, int nmlabs);
-
-#endif /* DAEMON_DUMPCACHE_H */

daemon/daemon.c

@@ -40,26 +40,8 @@
  */
 
 #include "config.h"
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
-
-#ifdef HAVE_OPENSSL_CONF_H
-#include <openssl/conf.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
-#include "ldns/ldns.h"
 #include "daemon/daemon.h"
 #include "daemon/worker.h"
-#include "daemon/remote.h"
-#include "daemon/acl_list.h"
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/data/msgreply.h"
@@ -67,11 +49,10 @@
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
-#include "services/localzone.h"
-#include "services/modstack.h"
 #include "util/module.h"
-#include "util/random.h"
-#include "util/tube.h"
+#include "iterator/iterator.h"
+#include "validator/validator.h"
+#include "util/fptr_wlist.h"
 #include <signal.h>
 
 /** How many quit requests happened. */
@@ -79,15 +60,6 @@ static int sig_record_quit = 0;
 /** How many reload requests happened. */
 static int sig_record_reload = 0;
 
-#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
-/** cleaner ssl memory freeup */
-static void* comp_meth = NULL;
-#endif
-#ifdef LEX_HAS_YYLEX_DESTROY
-/** remove buffers for parsing and init */
-int ub_c_lex_destroy(void);
-#endif
-
 /** used when no other sighandling happens, so we don't die
   * when multiple signals in quick succession are sent to us. 
   * @param sig: signal number.
@@ -103,24 +75,13 @@ static RETSIGTYPE record_sigh(int sig)
 	switch(sig)
 	{
 		case SIGTERM:
-#ifdef SIGQUIT
 		case SIGQUIT:
-#endif
-#ifdef SIGBREAK
-		case SIGBREAK:
-#endif
 		case SIGINT:
 			sig_record_quit++;
 			break;
-#ifdef SIGHUP
 		case SIGHUP:
 			sig_record_reload++;
 			break;
-#endif
-#ifdef SIGPIPE
-		case SIGPIPE:
-			break;
-#endif
 		default:
 			log_err("ignoring signal %d", sig);
 	}
@@ -134,20 +95,9 @@ static void
 signal_handling_record()
 {
 	if( signal(SIGTERM, record_sigh) == SIG_ERR ||
-#ifdef SIGQUIT
 		signal(SIGQUIT, record_sigh) == SIG_ERR ||
-#endif
-#ifdef SIGBREAK
-		signal(SIGBREAK, record_sigh) == SIG_ERR ||
-#endif
-#ifdef SIGHUP
-		signal(SIGHUP, record_sigh) == SIG_ERR ||
-#endif
-#ifdef SIGPIPE
-		signal(SIGPIPE, SIG_IGN) == SIG_ERR ||
-#endif
-		signal(SIGINT, record_sigh) == SIG_ERR
-		)
+		signal(SIGINT, record_sigh) == SIG_ERR ||
+		signal(SIGHUP, record_sigh) == SIG_ERR)
 		log_err("install sighandler: %s", strerror(errno));
 }
 
@@ -158,10 +108,8 @@ signal_handling_record()
 static void
 signal_handling_playback(struct worker* wrk)
 {
-#ifdef SIGHUP
 	if(sig_record_reload)
 		worker_sighandler(SIGHUP, wrk);
-#endif
 	if(sig_record_quit)
 		worker_sighandler(SIGTERM, wrk);
 	sig_record_quit = 0;
@@ -173,58 +121,19 @@ daemon_init()
 {
 	struct daemon* daemon = (struct daemon*)calloc(1, 
 		sizeof(struct daemon));
-#ifdef USE_WINSOCK
-	int r;
-	WSADATA wsa_data;
-#endif
 	if(!daemon)
 		return NULL;
-#ifdef USE_WINSOCK
-	r = WSAStartup(MAKEWORD(2,2), &wsa_data);
-	if(r != 0) {
-		fatal_exit("could not init winsock. WSAStartup: %s",
-			wsa_strerror(r));
-	}
-#endif /* USE_WINSOCK */
 	signal_handling_record();
 	checklock_start();
 	ERR_load_crypto_strings();
-	ERR_load_SSL_strings();
-#ifdef HAVE_OPENSSL_CONFIG
-	OPENSSL_config("unbound");
-#endif
-#ifdef USE_GOST
-	(void)ldns_key_EVP_load_gost_id();
-#endif
-	OpenSSL_add_all_algorithms();
-#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
-	/* grab the COMP method ptr because openssl leaks it */
-	comp_meth = (void*)SSL_COMP_get_compression_methods();
-#endif
-	(void)SSL_library_init();
-#ifdef HAVE_TZSET
-	/* init timezone info while we are not chrooted yet */
-	tzset();
-#endif
-	/* open /dev/random if needed */
-	ub_systemseed((unsigned)time(NULL)^(unsigned)getpid()^0xe67);
 	daemon->need_to_exit = 0;
-	modstack_init(&daemon->mods);
+	daemon->num_modules = 0;
 	if(!(daemon->env = (struct module_env*)calloc(1, 
 		sizeof(*daemon->env)))) {
 		free(daemon);
 		return NULL;
 	}
 	alloc_init(&daemon->superalloc, NULL, 0);
-	daemon->acl = acl_list_create();
-	if(!daemon->acl) {
-		free(daemon->env);
-		free(daemon);
-		return NULL;
-	}
-	if(gettimeofday(&daemon->time_boot, NULL) < 0)
-		log_err("gettimeofday: %s", strerror(errno));
-	daemon->time_last_stat = daemon->time_boot;
 	return daemon;	
 }
 
@@ -232,111 +141,164 @@ int
 daemon_open_shared_ports(struct daemon* daemon)
 {
 	log_assert(daemon);
-	if(daemon->cfg->port != daemon->listening_port) {
-		listening_ports_free(daemon->ports);
-		if(!(daemon->ports=listening_ports_open(daemon->cfg)))
-			return 0;
-		daemon->listening_port = daemon->cfg->port;
+	if(daemon->cfg->port == daemon->listening_port)
+		return 1;
+	listening_ports_free(daemon->ports);
+	if(!(daemon->ports=listening_ports_open(daemon->cfg)))
+		return 0;
+	daemon->listening_port = daemon->cfg->port;
+	return 1;
+}
+
+/** count number of modules (words) in the string */
+static int
+count_modules(const char* s)
+{
+	int num = 0;
+	if(!s)
+		return 0;
+	while(*s) {
+		/* skip whitespace */
+		while(*s && isspace((int)*s))
+			s++;
+		if(*s && !isspace((int)*s)) {
+			/* skip identifier */
+			num++;
+			while(*s && !isspace((int)*s))
+				s++;
+		}
 	}
-	if(!daemon->cfg->remote_control_enable && daemon->rc_port) {
-		listening_ports_free(daemon->rc_ports);
-		daemon->rc_ports = NULL;
-		daemon->rc_port = 0;
+	return num;
+}
+
+/**
+ * Get funcblock for module name
+ * @param str: string with module name. Advanced to next value on success.
+ * @return funcblock or NULL on error.
+ */
+static struct module_func_block*
+daemon_module_factory(const char** str)
+{
+	/* these are the modules available */
+	int num = 2;
+	const char* names[] = {"iterator", "validator", NULL};
+	struct module_func_block* (*fb[])(void) = 
+		{&iter_get_funcblock, &val_get_funcblock, NULL};
+
+	int i;
+	const char* s = *str;
+	while(*s && isspace((int)*s))
+		s++;
+	for(i=0; i<num; i++) {
+		if(strncmp(names[i], s, strlen(names[i])) == 0) {
+			s += strlen(names[i]);
+			*str = s;
+			return (*fb[i])();
+		}
 	}
-	if(daemon->cfg->remote_control_enable && 
-		daemon->cfg->control_port != daemon->rc_port) {
-		listening_ports_free(daemon->rc_ports);
-		if(!(daemon->rc_ports=daemon_remote_open_ports(daemon->cfg)))
+	return NULL;
+}
+
+/**
+ * Read config file module settings and set up the modfunc block
+ * @param daemon: the daemon.
+ * @return false on error
+ */
+static int
+daemon_config_modules(struct daemon* daemon)
+{
+	const char* str = daemon->cfg->module_conf;
+	int i;
+	verbose(VERB_DETAIL, "module config: \"%s\"", str);
+	daemon->num_modules = count_modules(str);
+	if(daemon->num_modules == 0) {
+		log_err("error: no modules specified");
+		return 0;
+	}
+	if(daemon->num_modules > MAX_MODULE) {
+		log_err("error: too many modules (%d max %d)",
+			daemon->num_modules, MAX_MODULE);
+		return 0;
+	}
+	daemon->modfunc = (struct module_func_block**)calloc((size_t)
+		daemon->num_modules, sizeof(struct module_func_block*));
+	if(!daemon->modfunc) {
+		log_err("out of memory");
+		return 0;
+	}
+	for(i=0; i<daemon->num_modules; i++) {
+		daemon->modfunc[i] = daemon_module_factory(&str);
+		if(!daemon->modfunc[i]) {
+			log_err("Unknown value for first module in: '%s'",
+				str);
 			return 0;
-		daemon->rc_port = daemon->cfg->control_port;
+		}
 	}
 	return 1;
 }
 
 /**
- * Setup modules. setup module stack.
+ * Desetup the modules, deinit, delete.
+ * @param daemon: the daemon.
+ */
+static void
+daemon_desetup_modules(struct daemon* daemon)
+{
+	int i;
+	for(i=0; i<daemon->num_modules; i++) {
+		log_assert(fptr_whitelist_mod_deinit(
+			daemon->modfunc[i]->deinit));
+		(*daemon->modfunc[i]->deinit)(daemon->env, i);
+	}
+	daemon->num_modules = 0;
+	free(daemon->modfunc);
+	daemon->modfunc = 0;
+}
+
+/**
+ * Setup modules. Assigns ids and calls module_init.
  * @param daemon: the daemon
  */
 static void daemon_setup_modules(struct daemon* daemon)
 {
+	int i;
+	if(daemon->num_modules != 0)
+		daemon_desetup_modules(daemon);
+	/* fixed setup of the modules */
+	if(!daemon_config_modules(daemon)) {
+		fatal_exit("failed to setup modules");
+	}
 	daemon->env->cfg = daemon->cfg;
 	daemon->env->alloc = &daemon->superalloc;
 	daemon->env->worker = NULL;
 	daemon->env->need_to_validate = 0; /* set by module init below */
-	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf, 
-		daemon->env)) {
-		fatal_exit("failed to setup modules");
-	}
-}
-
-/**
- * Obtain allowed port numbers, concatenate the list, and shuffle them
- * (ready to be handed out to threads).
- * @param daemon: the daemon. Uses rand and cfg.
- * @param shufport: the portlist output.
- * @return number of ports available.
- */
-int daemon_get_shufport(struct daemon* daemon, int* shufport)
-{
-	int i, n, k, temp;
-	int avail = 0;
-	for(i=0; i<65536; i++) {
-		if(daemon->cfg->outgoing_avail_ports[i]) {
-			shufport[avail++] = daemon->cfg->
-				outgoing_avail_ports[i];
+	for(i=0; i<daemon->num_modules; i++) {
+		log_info("init module %d: %s", i, daemon->modfunc[i]->name);
+		log_assert(fptr_whitelist_mod_init(daemon->modfunc[i]->init));
+		if(!(*daemon->modfunc[i]->init)(daemon->env, i)) {
+			fatal_exit("module init for module %s failed",
+				daemon->modfunc[i]->name);
 		}
 	}
-	if(avail == 0)
-		fatal_exit("no ports are permitted for UDP, add "
-			"with outgoing-port-permit");
-        /* Knuth shuffle */
-	n = avail;
-	while(--n > 0) {
-		k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */
-		temp = shufport[k];
-		shufport[k] = shufport[n];
-		shufport[n] = temp;
-	}
-	return avail;
 }
 
 /**
  * Allocate empty worker structures. With backptr and thread-number,
  * from 0..numthread initialised. Used as user arguments to new threads.
- * Creates the daemon random generator if it does not exist yet.
- * The random generator stays existing between reloads with a unique state.
  * @param daemon: the daemon with (new) config settings.
  */
 static void 
 daemon_create_workers(struct daemon* daemon)
 {
-	int i, numport;
-	int* shufport;
+	int i;
 	log_assert(daemon && daemon->cfg);
-	if(!daemon->rand) {
-		unsigned int seed = (unsigned int)time(NULL) ^ 
-			(unsigned int)getpid() ^ 0x438;
-		daemon->rand = ub_initstate(seed, NULL);
-		if(!daemon->rand)
-			fatal_exit("could not init random generator");
-	}
-	shufport = (int*)calloc(65536, sizeof(int));
-	if(!shufport)
-		fatal_exit("out of memory during daemon init");
-	numport = daemon_get_shufport(daemon, shufport);
-	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
-	
 	daemon->num = daemon->cfg->num_threads;
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
 	for(i=0; i<daemon->num; i++) {
-		if(!(daemon->workers[i] = worker_create(daemon, i,
-			shufport+numport*i/daemon->num, 
-			numport*(i+1)/daemon->num - numport*i/daemon->num)))
-			/* the above is not ports/numthr, due to rounding */
+		if(!(daemon->workers[i] = worker_create(daemon, i)))
 			fatal_exit("could not create worker");
 	}
-	free(shufport);
 }
 
 /**
@@ -349,13 +311,13 @@ void close_other_pipes(struct daemon* daemon, int thr)
 	int i;
 	for(i=0; i<daemon->num; i++)
 		if(i!=thr) {
-			if(i==0) {
-				/* only close read part, need to write stats */
-				tube_close_read(daemon->workers[i]->cmd);
-			} else {
-				/* complete close channel to others */
-				tube_delete(daemon->workers[i]->cmd);
-				daemon->workers[i]->cmd = NULL;
+			if(daemon->workers[i]->cmd_send_fd != -1) {
+				close(daemon->workers[i]->cmd_send_fd);
+				daemon->workers[i]->cmd_send_fd = -1;
+			}
+			if(daemon->workers[i]->cmd_recv_fd != -1) {
+				close(daemon->workers[i]->cmd_recv_fd);
+				daemon->workers[i]->cmd_recv_fd = -1;
 			}
 		}
 }
@@ -371,9 +333,10 @@ thread_start(void* arg)
 	struct worker* worker = (struct worker*)arg;
 	log_thread_set(&worker->thread_num);
 	ub_thread_blocksigs();
-#ifdef THREADS_DISABLED
+#if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	/* close pipe ends used by main */
-	tube_close_write(worker->cmd);
+	close(worker->cmd_send_fd);
+	worker->cmd_send_fd = -1;
 	close_other_pipes(worker->daemon, worker->thread_num);
 #endif
 	if(!worker_init(worker, worker->daemon->cfg, worker->daemon->ports, 0))
@@ -397,9 +360,10 @@ daemon_start_others(struct daemon* daemon)
 	for(i=1; i<daemon->num; i++) {
 		ub_thread_create(&daemon->workers[i]->thr_id,
 			thread_start, daemon->workers[i]);
-#ifdef THREADS_DISABLED
+#if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 		/* close pipe end of child */
-		tube_close_read(daemon->workers[i]->cmd);
+		close(daemon->workers[i]->cmd_recv_fd);
+		daemon->workers[i]->cmd_recv_fd = -1;
 #endif /* no threads */
 	}
 }
@@ -417,7 +381,8 @@ daemon_stop_others(struct daemon* daemon)
 	/* skip i=0, is this thread */
 	/* use i=0 buffer for sending cmds; because we are #0 */
 	for(i=1; i<daemon->num; i++) {
-		worker_send_cmd(daemon->workers[i], worker_cmd_quit);
+		worker_send_cmd(daemon->workers[i], 
+			daemon->workers[0]->front->udp_buff, worker_cmd_quit);
 	}
 	/* wait for them to quit */
 	for(i=1; i<daemon->num; i++) {
@@ -432,12 +397,6 @@ void
 daemon_fork(struct daemon* daemon)
 {
 	log_assert(daemon);
-	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg))
-		fatal_exit("Could not setup access control list");
-	if(!(daemon->local_zones = local_zones_create()))
-		fatal_exit("Could not create local zones: out of memory");
-	if(!local_zones_apply_cfg(daemon->local_zones, daemon->cfg))
-		fatal_exit("Could not set up local zones");
 
 	/* setup modules */
 	daemon_setup_modules(daemon);
@@ -446,12 +405,6 @@ daemon_fork(struct daemon* daemon)
 	 * them to the newly created threads. 
 	 */
 	daemon_create_workers(daemon);
-
-#ifdef HAVE_EV_LOOP
-	/* in libev the first inited base gets signals */
-	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports, 1))
-		fatal_exit("Could not initialize main thread");
-#endif
 	
 	/* Now create the threads and init the workers.
 	 * By the way, this is thread #0 (the main thread).
@@ -459,19 +412,15 @@ daemon_fork(struct daemon* daemon)
 	daemon_start_others(daemon);
 
 	/* Special handling for the main thread. This is the thread
-	 * that handles signals and remote control.
+	 * that handles signals.
 	 */
-#ifndef HAVE_EV_LOOP
-	/* libevent has the last inited base get signals (or any base) */
 	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports, 1))
 		fatal_exit("Could not initialize main thread");
-#endif
 	signal_handling_playback(daemon->workers[0]);
 
 	/* Start resolver service on main thread. */
 	log_info("start of service (%s).", PACKAGE_STRING);
 	worker_work(daemon->workers[0]);
-	log_info("service stopped (%s).", PACKAGE_STRING);
 
 	/* we exited! a signal happened! Stop other threads */
 	daemon_stop_others(daemon);
@@ -494,10 +443,7 @@ daemon_cleanup(struct daemon* daemon)
 	 * The infra cache is kept, the timing and edns info is still valid */
 	slabhash_clear(&daemon->env->rrset_cache->table);
 	slabhash_clear(daemon->env->msg_cache);
-	local_zones_delete(daemon->local_zones);
-	daemon->local_zones = NULL;
 	/* key cache is cleared by module desetup during next daemon_init() */
-	daemon_remote_clear(daemon->rc);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
 	free(daemon->workers);
@@ -511,68 +457,23 @@ daemon_delete(struct daemon* daemon)
 {
 	if(!daemon)
 		return;
-	modstack_desetup(&daemon->mods, daemon->env);
-	daemon_remote_delete(daemon->rc);
+	daemon_desetup_modules(daemon);
 	listening_ports_free(daemon->ports);
-	listening_ports_free(daemon->rc_ports);
 	if(daemon->env) {
 		slabhash_delete(daemon->env->msg_cache);
 		rrset_cache_delete(daemon->env->rrset_cache);
 		infra_delete(daemon->env->infra_cache);
 	}
-	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
-	acl_list_delete(daemon->acl);
-	free(daemon->chroot);
 	free(daemon->pidfile);
 	free(daemon->env);
 	free(daemon);
-#ifdef LEX_HAS_YYLEX_DESTROY
-	/* lex cleanup */
-	ub_c_lex_destroy();
-#endif
 	/* libcrypto cleanup */
-#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
-	sk_SSL_COMP_free(comp_meth);
-#endif
-#ifdef HAVE_OPENSSL_CONFIG
+	/* CONF_modules_unload(1); */
 	EVP_cleanup();
-	ENGINE_cleanup();
-	CONF_modules_free();
-#endif
+	/* ENGINE_cleanup(); */
 	CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
 	ERR_remove_state(0);
 	ERR_free_strings();
-	RAND_cleanup();
 	checklock_stop();
-#ifdef USE_WINSOCK
-	if(WSACleanup() != 0) {
-		log_err("Could not WSACleanup: %s", 
-			wsa_strerror(WSAGetLastError()));
-	}
-#endif
-}
-
-void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg)
-{
-        daemon->cfg = cfg;
-	config_apply(cfg);
-	if(!daemon->env->msg_cache ||
-	   cfg->msg_cache_size != slabhash_get_size(daemon->env->msg_cache) ||
-	   cfg->msg_cache_slabs != daemon->env->msg_cache->size) {
-		slabhash_delete(daemon->env->msg_cache);
-		daemon->env->msg_cache = slabhash_create(cfg->msg_cache_slabs,
-			HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size,
-			msgreply_sizefunc, query_info_compare,
-			query_entry_delete, reply_info_delete, NULL);
-		if(!daemon->env->msg_cache) {
-			fatal_exit("malloc failure updating config settings");
-		}
-	}
-	if((daemon->env->rrset_cache = rrset_cache_adjust(
-		daemon->env->rrset_cache, cfg, &daemon->superalloc)) == 0)
-		fatal_exit("malloc failure updating config settings");
-	if((daemon->env->infra_cache = infra_adjust(daemon->env->infra_cache,
-		cfg))==0)
-		fatal_exit("malloc failure updating config settings");
 }

daemon/daemon.h

@@ -44,20 +44,12 @@
 
 #include "util/locks.h"
 #include "util/alloc.h"
-#include "services/modstack.h"
-#ifdef UB_ON_WINDOWS
-#  include "util/winsock_event.h"
-#endif
 struct config_file;
 struct worker;
 struct listen_port;
 struct slabhash;
 struct module_env;
 struct rrset_cache;
-struct acl_list;
-struct local_zones;
-struct ub_randstate;
-struct daemon_remote;
 
 /**
  * Structure holding worker list.
@@ -66,42 +58,26 @@ struct daemon_remote;
 struct daemon {
 	/** The config settings */
 	struct config_file* cfg;
-	/** the chroot dir in use, NULL if none */
-	char* chroot;
 	/** pidfile that is used */
 	char* pidfile;
 	/** port number that has ports opened. */
 	int listening_port;
 	/** listening ports, opened, to be shared by threads */
 	struct listen_port* ports;
-	/** port number for remote that has ports opened. */
-	int rc_port;
-	/** listening ports for remote control */
-	struct listen_port* rc_ports;
-	/** remote control connections management (for first worker) */
-	struct daemon_remote* rc;
 	/** num threads allocated */
 	int num;
 	/** the worker entries */
 	struct worker** workers;
 	/** do we need to exit unbound (or is it only a reload?) */
 	int need_to_exit;
-	/** master random table ; used for port div between threads on reload*/
-	struct ub_randstate* rand;
 	/** master allocation cache */
 	struct alloc_cache superalloc;
 	/** the module environment master value, copied and changed by threads*/
 	struct module_env* env;
-	/** stack of module callbacks */
-	struct module_stack mods;
-	/** access control, which client IPs are allowed to connect */
-	struct acl_list* acl;
-	/** local authority zones */
-	struct local_zones* local_zones;
-	/** last time of statistics printout */
-	struct timeval time_last_stat;
-	/** time when daemon started */
-	struct timeval time_boot;
+	/** number of modules active, ids from 0 to num-1. */
+	int num_modules;
+	/** the module callbacks, array of num_modules length */
+	struct module_func_block** modfunc;
 };
 
 /**
@@ -138,11 +114,4 @@ void daemon_cleanup(struct daemon* daemon);
  */
 void daemon_delete(struct daemon* daemon);
 
-/**
- * Apply config settings.
- * @param daemon: the daemon.
- * @param cfg: new config settings.
- */
-void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg);
-
 #endif /* DAEMON_H */

daemon/remote.h

@@ -1,180 +0,0 @@
-/*
- * daemon/remote.h - remote control for the unbound daemon.
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains the remote control functionality for the daemon.
- * The remote control can be performed using either the commandline
- * unbound-control tool, or a SSLv3/TLS capable web browser. 
- * The channel is secured using SSLv3 or TLSv1, and certificates.
- * Both the server and the client(control tool) have their own keys.
- */
-
-#ifndef DAEMON_REMOTE_H
-#define DAEMON_REMOTE_H
-#ifdef HAVE_OPENSSL_SSL_H
-#include "openssl/ssl.h"
-#endif
-struct config_file;
-struct listen_list;
-struct listen_port;
-struct worker;
-struct comm_reply;
-struct comm_point;
-struct daemon_remote;
-
-/** number of seconds timeout on incoming remote control handshake */
-#define REMOTE_CONTROL_TCP_TIMEOUT 120
-
-/**
- * a busy control command connection, SSL state
- */
-struct rc_state {
-	/** the next item in list */
-	struct rc_state* next;
-	/** the commpoint */
-	struct comm_point* c;
-	/** in the handshake part */
-	enum { rc_none, rc_hs_read, rc_hs_write } shake_state;
-	/** the ssl state */
-	SSL* ssl;
-	/** the rc this is part of */
-	struct daemon_remote* rc;
-};
-
-/**
- * The remote control tool state.
- * The state is only created for the first thread, other threads
- * are called from this thread.  Only the first threads listens to
- * the control port.  The other threads do not, but are called on the
- * command channel(pipe) from the first thread.
- */
-struct daemon_remote {
-	/** the worker for this remote control */
-	struct worker* worker;
-	/** commpoints for accepting remote control connections */
-	struct listen_list* accept_list;
-	/** number of active commpoints that are handling remote control */
-	int active;
-	/** max active commpoints */
-	int max_active;
-	/** current commpoints busy; should be a short list, malloced */
-	struct rc_state* busy_list;
-	/** the SSL context for creating new SSL streams */
-	SSL_CTX* ctx;
-};
-
-/**
- * Create new remote control state for the daemon.
- * @param cfg: config file with key file settings.
- * @return new state, or NULL on failure.
- */
-struct daemon_remote* daemon_remote_create(struct config_file* cfg);
-
-/**
- * remote control state to delete.
- * @param rc: state to delete.
- */
-void daemon_remote_delete(struct daemon_remote* rc);
-
-/**
- * remote control state to clear up. Busy and accept points are closed.
- * Does not delete the rc itself, or the ssl context (with its keys).
- * @param rc: state to clear.
- */
-void daemon_remote_clear(struct daemon_remote* rc);
-
-/**
- * Open and create listening ports for remote control.
- * @param cfg: config options.
- * @return list of ports or NULL on failure.
- *	can be freed with listening_ports_free().
- */
-struct listen_port* daemon_remote_open_ports(struct config_file* cfg);
-
-/**
- * Setup comm points for accepting remote control connections.
- * @param rc: state
- * @param ports: already opened ports.
- * @param worker: worker with communication base. and links to command channels.
- * @return false on error.
- */
-int daemon_remote_open_accept(struct daemon_remote* rc, 
-	struct listen_port* ports, struct worker* worker);
-
-/**
- * Handle nonthreaded remote cmd execution.
- * @param worker: this worker (the remote worker).
- */
-void daemon_remote_exec(struct worker* worker);
-
-/** handle remote control accept callbacks */
-int remote_accept_callback(struct comm_point*, void*, int, struct comm_reply*);
-
-/** handle remote control data callbacks */
-int remote_control_callback(struct comm_point*, void*, int, struct comm_reply*);
-
-/** 
- * Print fixed line of text over ssl connection in blocking mode
- * @param ssl: print to
- * @param text: the text.
- * @return false on connection failure.
- */
-int ssl_print_text(SSL* ssl, const char* text);
-
-/** 
- * printf style printing to the ssl connection
- * @param ssl: the SSL connection to print to. Blocking.
- * @param format: printf style format string.
- * @return success or false on a network failure.
- */
-int ssl_printf(SSL* ssl, const char* format, ...)
-        ATTR_FORMAT(printf, 2, 3);
-
-/**
- * Read until \n is encountered
- * If SSL signals EOF, the string up to then is returned (without \n).
- * @param ssl: the SSL connection to read from. blocking.
- * @param buf: buffer to read to.
- * @param max: size of buffer.
- * @return false on connection failure.
- */
-int ssl_read_line(SSL* ssl, char* buf, size_t max);
-
-/** routine to printout option values over SSL */
-void remote_get_opt_ssl(char* line, void* arg);
-
-#endif /* DAEMON_REMOTE_H */

daemon/stats.c

@@ -40,36 +40,13 @@
  * numbers. These 'statistics' may be of interest to the operator.
  */
 #include "config.h"
-#include "ldns/wire2host.h"
 #include "daemon/stats.h"
 #include "daemon/worker.h"
-#include "daemon/daemon.h"
 #include "services/mesh.h"
-#include "services/outside_network.h"
-#include "util/config_file.h"
-#include "util/tube.h"
-#include "util/timehist.h"
-#include "util/net_help.h"
-#include "validator/validator.h"
 
-/** add timers and the values do not overflow or become negative */
-static void
-timeval_add(struct timeval* d, const struct timeval* add)
+void server_stats_init(struct server_stats* stats)
 {
-#ifndef S_SPLINT_S
-	d->tv_sec += add->tv_sec;
-	d->tv_usec += add->tv_usec;
-	if(d->tv_usec > 1000000) {
-		d->tv_usec -= 1000000;
-		d->tv_sec++;
-	}
-#endif
-}
-
-void server_stats_init(struct server_stats* stats, struct config_file* cfg)
-{
-	memset(stats, 0, sizeof(*stats));
-	stats->extended = cfg->stat_extended;
+	memset(stats, 0, sizeof(stats));
 }
 
 void server_stats_querymiss(struct server_stats* stats, struct worker* worker)
@@ -80,222 +57,16 @@ void server_stats_querymiss(struct server_stats* stats, struct worker* worker)
 		stats->max_query_list_size = worker->env.mesh->all.count;
 }
 
-void server_stats_prefetch(struct server_stats* stats, struct worker* worker)
+void server_stats_log(struct server_stats* stats, int threadnum)
 {
-	stats->num_queries_prefetch++;
-	/* changes the query list size so account that, like a querymiss */
-	stats->sum_query_list_size += worker->env.mesh->all.count;
-	if(worker->env.mesh->all.count > stats->max_query_list_size)
-		stats->max_query_list_size = worker->env.mesh->all.count;
-}
-
-void server_stats_log(struct server_stats* stats, struct worker* worker,
-	int threadnum)
-{
-	log_info("server stats for thread %d: %u queries, "
-		"%u answers from cache, %u recursions, %u prefetch", 
+	log_info("server stats for thread %d: %u queries, %u from cache", 
 		threadnum, (unsigned)stats->num_queries, 
 		(unsigned)(stats->num_queries - 
-			stats->num_queries_missed_cache),
-		(unsigned)stats->num_queries_missed_cache,
-		(unsigned)stats->num_queries_prefetch);
+			stats->num_queries_missed_cache));
 	log_info("server stats for thread %d: requestlist max %u avg %g "
 		"exceeded %u", threadnum, (unsigned)stats->max_query_list_size,
-		(stats->num_queries_missed_cache+stats->num_queries_prefetch)?
+		stats->num_queries_missed_cache?
 			(double)stats->sum_query_list_size/
-			(stats->num_queries_missed_cache+
-			stats->num_queries_prefetch) : 0.0,
-		(unsigned)worker->env.mesh->stats_dropped);
-}
-
-/** get rrsets bogus number from validator */
-static size_t
-get_rrset_bogus(struct worker* worker)
-{
-	int m = modstack_find(&worker->env.mesh->mods, "validator");
-	struct val_env* ve;
-	size_t r;
-	if(m == -1)
-		return 0;
-	ve = (struct val_env*)worker->env.modinfo[m];
-	lock_basic_lock(&ve->bogus_lock);
-	r = ve->num_rrset_bogus;
-	if(!worker->env.cfg->stat_cumulative)
-		ve->num_rrset_bogus = 0;
-	lock_basic_unlock(&ve->bogus_lock);
-	return r;
-}
-
-void
-server_stats_compile(struct worker* worker, struct stats_info* s, int reset)
-{
-	int i;
-
-	s->svr = worker->stats;
-	s->mesh_num_states = worker->env.mesh->all.count;
-	s->mesh_num_reply_states = worker->env.mesh->num_reply_states;
-	s->mesh_jostled = worker->env.mesh->stats_jostled;
-	s->mesh_dropped = worker->env.mesh->stats_dropped;
-	s->mesh_replies_sent = worker->env.mesh->replies_sent;
-	s->mesh_replies_sum_wait = worker->env.mesh->replies_sum_wait;
-	s->mesh_time_median = timehist_quartile(worker->env.mesh->histogram,
-		0.50);
-
-	/* add in the values from the mesh */
-	s->svr.ans_secure += worker->env.mesh->ans_secure;
-	s->svr.ans_bogus += worker->env.mesh->ans_bogus;
-	s->svr.ans_rcode_nodata += worker->env.mesh->ans_nodata;
-	for(i=0; i<16; i++)
-		s->svr.ans_rcode[i] += worker->env.mesh->ans_rcode[i];
-	timehist_export(worker->env.mesh->histogram, s->svr.hist, 
-		NUM_BUCKETS_HIST);
-	/* values from outside network */
-	s->svr.unwanted_replies = worker->back->unwanted_replies;
-
-	/* get and reset validator rrset bogus number */
-	s->svr.rrset_bogus = get_rrset_bogus(worker);
-
-	if(reset && !worker->env.cfg->stat_cumulative) {
-		worker_stats_clear(worker);
-	}
-}
-
-void server_stats_obtain(struct worker* worker, struct worker* who,
-	struct stats_info* s, int reset)
-{
-	uint8_t *reply = NULL;
-	uint32_t len = 0;
-	if(worker == who) {
-		/* just fill it in */
-		server_stats_compile(worker, s, reset);
-		return;
-	}
-	/* communicate over tube */
-	verbose(VERB_ALGO, "write stats cmd");
-	if(reset)
-		worker_send_cmd(who, worker_cmd_stats);
-	else 	worker_send_cmd(who, worker_cmd_stats_noreset);
-	verbose(VERB_ALGO, "wait for stats reply");
-	if(!tube_read_msg(worker->cmd, &reply, &len, 0))
-		fatal_exit("failed to read stats over cmd channel");
-	if(len != (uint32_t)sizeof(*s))
-		fatal_exit("stats on cmd channel wrong length %d %d",
-			(int)len, (int)sizeof(*s));
-	memcpy(s, reply, (size_t)len);
-	free(reply);
-}
-
-void server_stats_reply(struct worker* worker, int reset)
-{
-	struct stats_info s;
-	server_stats_compile(worker, &s, reset);
-	verbose(VERB_ALGO, "write stats replymsg");
-	if(!tube_write_msg(worker->daemon->workers[0]->cmd, 
-		(uint8_t*)&s, sizeof(s), 0))
-		fatal_exit("could not write stat values over cmd channel");
-}
-
-void server_stats_add(struct stats_info* total, struct stats_info* a)
-{
-	total->svr.num_queries += a->svr.num_queries;
-	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
-	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
-	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
-	/* the max size reached is upped to higher of both */
-	if(a->svr.max_query_list_size > total->svr.max_query_list_size)
-		total->svr.max_query_list_size = a->svr.max_query_list_size;
-
-	if(a->svr.extended) {
-		int i;
-		total->svr.qtype_big += a->svr.qtype_big;
-		total->svr.qclass_big += a->svr.qclass_big;
-		total->svr.qtcp += a->svr.qtcp;
-		total->svr.qipv6 += a->svr.qipv6;
-		total->svr.qbit_QR += a->svr.qbit_QR;
-		total->svr.qbit_AA += a->svr.qbit_AA;
-		total->svr.qbit_TC += a->svr.qbit_TC;
-		total->svr.qbit_RD += a->svr.qbit_RD;
-		total->svr.qbit_RA += a->svr.qbit_RA;
-		total->svr.qbit_Z += a->svr.qbit_Z;
-		total->svr.qbit_AD += a->svr.qbit_AD;
-		total->svr.qbit_CD += a->svr.qbit_CD;
-		total->svr.qEDNS += a->svr.qEDNS;
-		total->svr.qEDNS_DO += a->svr.qEDNS_DO;
-		total->svr.ans_rcode_nodata += a->svr.ans_rcode_nodata;
-		total->svr.ans_secure += a->svr.ans_secure;
-		total->svr.ans_bogus += a->svr.ans_bogus;
-		total->svr.rrset_bogus += a->svr.rrset_bogus;
-		total->svr.unwanted_replies += a->svr.unwanted_replies;
-		total->svr.unwanted_queries += a->svr.unwanted_queries;
-		for(i=0; i<STATS_QTYPE_NUM; i++)
-			total->svr.qtype[i] += a->svr.qtype[i];
-		for(i=0; i<STATS_QCLASS_NUM; i++)
-			total->svr.qclass[i] += a->svr.qclass[i];
-		for(i=0; i<STATS_OPCODE_NUM; i++)
-			total->svr.qopcode[i] += a->svr.qopcode[i];
-		for(i=0; i<STATS_RCODE_NUM; i++)
-			total->svr.ans_rcode[i] += a->svr.ans_rcode[i];
-		for(i=0; i<NUM_BUCKETS_HIST; i++)
-			total->svr.hist[i] += a->svr.hist[i];
-	}
-
-	total->mesh_num_states += a->mesh_num_states;
-	total->mesh_num_reply_states += a->mesh_num_reply_states;
-	total->mesh_jostled += a->mesh_jostled;
-	total->mesh_dropped += a->mesh_dropped;
-	total->mesh_replies_sent += a->mesh_replies_sent;
-	timeval_add(&total->mesh_replies_sum_wait, &a->mesh_replies_sum_wait);
-	/* the medians are averaged together, this is not as accurate as
-	 * taking the median over all of the data, but is good and fast
-	 * added up here, division later*/
-	total->mesh_time_median += a->mesh_time_median;
-}
-
-void server_stats_insquery(struct server_stats* stats, struct comm_point* c,
-	uint16_t qtype, uint16_t qclass, struct edns_data* edns,
-	struct comm_reply* repinfo)
-{
-	uint16_t flags = ldns_buffer_read_u16_at(c->buffer, 2);
-	if(qtype < STATS_QTYPE_NUM)
-		stats->qtype[qtype]++;
-	else	stats->qtype_big++;
-	if(qclass < STATS_QCLASS_NUM)
-		stats->qclass[qclass]++;
-	else	stats->qclass_big++;
-	stats->qopcode[ LDNS_OPCODE_WIRE(ldns_buffer_begin(c->buffer)) ]++;
-	if(c->type != comm_udp)
-		stats->qtcp++;
-	if(repinfo && addr_is_ip6(&repinfo->addr, repinfo->addrlen))
-		stats->qipv6++;
-	if( (flags&BIT_QR) )
-		stats->qbit_QR++;
-	if( (flags&BIT_AA) )
-		stats->qbit_AA++;
-	if( (flags&BIT_TC) )
-		stats->qbit_TC++;
-	if( (flags&BIT_RD) )
-		stats->qbit_RD++;
-	if( (flags&BIT_RA) )
-		stats->qbit_RA++;
-	if( (flags&BIT_Z) )
-		stats->qbit_Z++;
-	if( (flags&BIT_AD) )
-		stats->qbit_AD++;
-	if( (flags&BIT_CD) )
-		stats->qbit_CD++;
-	if(edns->edns_present) {
-		stats->qEDNS++;
-		if( (edns->bits & EDNS_DO) )
-			stats->qEDNS_DO++;
-	}
-}
-
-void server_stats_insrcode(struct server_stats* stats, ldns_buffer* buf)
-{
-	if(stats->extended && ldns_buffer_limit(buf) != 0) {
-		int r = (int)LDNS_RCODE_WIRE( ldns_buffer_begin(buf) );
-		stats->ans_rcode[r] ++;
-		if(r == 0 && LDNS_ANCOUNT( ldns_buffer_begin(buf) ) == 0)
-			stats->ans_rcode_nodata ++;
-	}
+			stats->num_queries_missed_cache : 0.0,
+		(unsigned)stats->num_query_list_exceeded);
 }

daemon/stats.h

@@ -42,22 +42,7 @@
 
 #ifndef DAEMON_STATS_H
 #define DAEMON_STATS_H
-#include "util/timehist.h"
-#include "ldns/buffer.h"
 struct worker;
-struct config_file;
-struct comm_point;
-struct comm_reply;
-struct edns_data;
-
-/** number of qtype that is stored for in array */
-#define STATS_QTYPE_NUM 256
-/** number of qclass that is stored for in array */
-#define STATS_QCLASS_NUM 256
-/** number of rcodes in stats */
-#define STATS_RCODE_NUM 16
-/** number of opcodes in stats */
-#define STATS_OPCODE_NUM 16
 
 /** per worker statistics */
 struct server_stats {
@@ -65,8 +50,6 @@ struct server_stats {
 	size_t num_queries;
 	/** number of queries that had a cache-miss. */
 	size_t num_queries_missed_cache;
-	/** number of prefetch queries - cachehits with prefetch */
-	size_t num_queries_prefetch;
 
 	/**
 	 * Sum of the querylistsize of the worker for 
@@ -75,161 +58,20 @@ struct server_stats {
 	size_t sum_query_list_size;
 	/** max value of query list size reached. */
 	size_t max_query_list_size;
-
-	/** Extended stats below (bool) */
-	int extended;
-
-	/** qtype stats */
-	size_t qtype[STATS_QTYPE_NUM];
-	/** bigger qtype values not in array */
-	size_t qtype_big;
-	/** qclass stats */
-	size_t qclass[STATS_QCLASS_NUM];
-	/** bigger qclass values not in array */
-	size_t qclass_big;
-	/** query opcodes */
-	size_t qopcode[STATS_OPCODE_NUM];
-	/** number of queries over TCP */
-	size_t qtcp;
-	/** number of queries over IPv6 */
-	size_t qipv6;
-	/** number of queries with QR bit */
-	size_t qbit_QR;
-	/** number of queries with AA bit */
-	size_t qbit_AA;
-	/** number of queries with TC bit */
-	size_t qbit_TC;
-	/** number of queries with RD bit */
-	size_t qbit_RD;
-	/** number of queries with RA bit */
-	size_t qbit_RA;
-	/** number of queries with Z bit */
-	size_t qbit_Z;
-	/** number of queries with AD bit */
-	size_t qbit_AD;
-	/** number of queries with CD bit */
-	size_t qbit_CD;
-	/** number of queries with EDNS OPT record */
-	size_t qEDNS;
-	/** number of queries with EDNS with DO flag */
-	size_t qEDNS_DO;
-	/** answer rcodes */
-	size_t ans_rcode[STATS_RCODE_NUM];
-	/** answers with pseudo rcode 'nodata' */
-	size_t ans_rcode_nodata;
-	/** answers that were secure (AD) */
-	size_t ans_secure;
-	/** answers that were bogus (withheld as SERVFAIL) */
-	size_t ans_bogus;
-	/** rrsets marked bogus by validator */
-	size_t rrset_bogus;
-	/** unwanted traffic received on server-facing ports */
-	size_t unwanted_replies;
-	/** unwanted traffic received on client-facing ports */
-	size_t unwanted_queries;
-
-	/** histogram data exported to array 
-	 * if the array is the same size, no data is lost, and
-	 * if all histograms are same size (is so by default) then
-	 * adding up works well. */
-	size_t hist[NUM_BUCKETS_HIST];
-};
-
-/** 
- * Statistics to send over the control pipe when asked
- * This struct is made to be memcpied, sent in binary.
- */
-struct stats_info {
-	/** the thread stats */
-	struct server_stats svr;
-
-	/** mesh stats: current number of states */
-	size_t mesh_num_states;
-	/** mesh stats: current number of reply (user) states */
-	size_t mesh_num_reply_states;
-	/** mesh stats: number of reply states overwritten with a new one */
-	size_t mesh_jostled;
-	/** mesh stats: number of incoming queries dropped */
-	size_t mesh_dropped;
-	/** mesh stats: replies sent */
-	size_t mesh_replies_sent;
-	/** mesh stats: sum of waiting times for the replies */
-	struct timeval mesh_replies_sum_wait;
-	/** mesh stats: median of waiting times for replies (in sec) */
-	double mesh_time_median;
+	/** number of times that the query_list_size was insufficient */
+	size_t num_query_list_exceeded;
 };
 
 /** 
  * Initialize server stats to 0.
  * @param stats: what to init (this is alloced by the caller).
- * @param cfg: with extended statistics option.
  */
-void server_stats_init(struct server_stats* stats, struct config_file* cfg);
+void server_stats_init(struct server_stats* stats);
 
 /** add query if it missed the cache */
 void server_stats_querymiss(struct server_stats* stats, struct worker* worker);
 
-/** add query if was cached and also resulted in a prefetch */
-void server_stats_prefetch(struct server_stats* stats, struct worker* worker);
-
 /** display the stats to the log */
-void server_stats_log(struct server_stats* stats, struct worker* worker,
-	int threadnum);
-
-/**
- * Obtain the stats info for a given thread. Uses pipe to communicate.
- * @param worker: the worker that is executing (the first worker).
- * @param who: on who to get the statistics info.
- * @param s: the stats block to fill in.
- * @param reset: if stats can be reset.
- */
-void server_stats_obtain(struct worker* worker, struct worker* who,
-	struct stats_info* s, int reset);
-
-/**
- * Compile stats into structure for this thread worker.
- * Also clears the statistics counters (if that is set by config file).
- * @param worker: the worker to compile stats for, also the executing worker.
- * @param s: stats block.
- * @param reset: if true, depending on config stats are reset.
- * 	if false, statistics are not reset.
- */
-void server_stats_compile(struct worker* worker, struct stats_info* s, 
-	int reset);
-
-/**
- * Send stats over comm tube in reply to query cmd
- * @param worker: this worker.
- * @param reset: if true, depending on config stats are reset.
- * 	if false, statistics are not reset.
- */
-void server_stats_reply(struct worker* worker, int reset);
-
-/**
- * Addup stat blocks.
- * @param total: sum of the two entries.
- * @param a: to add to it.
- */
-void server_stats_add(struct stats_info* total, struct stats_info* a);
-
-/**
- * Add stats for this query
- * @param stats: the stats
- * @param c: commpoint with type and buffer.
- * @param qtype: query type
- * @param qclass: query class
- * @param edns: edns record
- * @param repinfo: reply info with remote address
- */
-void server_stats_insquery(struct server_stats* stats, struct comm_point* c,
-	uint16_t qtype, uint16_t qclass, struct edns_data* edns, 
-	struct comm_reply* repinfo);
-
-/**
- * Add rcode for this query.
- * @param stats: the stats
- * @param buf: buffer with rcode. If buffer is length0: not counted.
- */
-void server_stats_insrcode(struct server_stats* stats, ldns_buffer* buf);
+void server_stats_log(struct server_stats* stats, int threadnum);
 
 #endif /* DAEMON_STATS_H */

daemon/unbound.c

@@ -41,12 +41,8 @@
  */
 
 #include "config.h"
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
 #include "util/log.h"
 #include "daemon/daemon.h"
-#include "daemon/remote.h"
 #include "util/config_file.h"
 #include "util/storage/slabhash.h"
 #include "services/listen_dnsport.h"
@@ -56,34 +52,8 @@
 #include "util/module.h"
 #include <signal.h>
 #include <fcntl.h>
-#include <openssl/crypto.h>
-#ifdef HAVE_PWD_H
 #include <pwd.h>
-#endif
-#ifdef HAVE_GRP_H
-#include <grp.h>
-#endif
-
-#ifdef HAVE_SYS_RESOURCE_H
 #include <sys/resource.h>
-#endif
-#ifdef HAVE_LOGIN_CAP_H
-#include <login_cap.h>
-#endif
-
-#ifdef USE_MINI_EVENT
-#  ifdef USE_WINSOCK
-#    include "util/winsock_event.h"
-#  else
-#    include "util/mini_event.h"
-#  endif
-#else
-#  include <event.h>
-#endif
-
-#ifdef UB_ON_WINDOWS
-#  include "winrc/win_svc.h"
-#endif
 
 /** global debug value to keep track of heap memory allocation */
 void* unbound_start_brk = 0;
@@ -91,7 +61,6 @@ void* unbound_start_brk = 0;
 /** print usage. */
 static void usage()
 {
-	const char** m;
 	printf("usage:  unbound [options]\n");
 	printf("	start unbound daemon DNS resolver.\n");
 	printf("-h	this help\n");
@@ -99,66 +68,32 @@ static void usage()
 	printf("	file format is described in unbound.conf(5).\n");
 	printf("-d	do not fork into the background.\n");
 	printf("-v	verbose (more times to increase verbosity)\n");
-#ifdef UB_ON_WINDOWS
-	printf("-w opt	windows option: \n");
-	printf("   	install, remove - manage the services entry\n");
-	printf("   	service - used to start from services control panel\n");
-#endif
 	printf("Version %s\n", PACKAGE_VERSION);
-	printf("linked libs: event %s, ldns %s, %s\n", 
-#ifdef USE_WINSOCK
-		"winsock",
-#elif defined(USE_MINI_EVENT)
-		"internal",
-#else
-		event_get_version(), 
-#endif
-		ldns_version(), 
-		SSLeay_version(SSLEAY_VERSION));
-	printf("linked modules:");
-	for(m = module_list_avail(); *m; m++)
-		printf(" %s", *m);
-	printf("\n");
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
 }
 
-#ifndef unbound_testbound
-int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
-{
-        log_assert(0);
-        return 0;
-}
-#endif
-
 /** check file descriptor count */
 static void
 checkrlimits(struct config_file* cfg)
 {
-#ifdef HAVE_GETRLIMIT
-	/* list has number of ports to listen to, ifs number addresses */
-	int list = ((cfg->do_udp?1:0) + (cfg->do_tcp?1 + 
+	int list = ((cfg->do_ip4?1:0) + (cfg->do_ip6?1:0)) * 
+		((cfg->do_udp?1:0) + (cfg->do_tcp?1 + 
 			(int)cfg->incoming_num_tcp:0));
-	size_t listen_ifs = (size_t)(cfg->num_ifs==0?
-		((cfg->do_ip4 && !cfg->if_automatic?1:0) + 
-		 (cfg->do_ip6?1:0)):cfg->num_ifs);
-	size_t listen_num = list*listen_ifs;
-	size_t outudpnum = (size_t)cfg->outgoing_num_ports;
-	size_t outtcpnum = cfg->outgoing_num_tcp;
+	size_t ifs = (size_t)(cfg->num_ifs==0?1:cfg->num_ifs);
+	size_t listen_num = list*ifs;
+	size_t out_ifs = (size_t)(cfg->num_out_ifs==0?1:cfg->num_out_ifs);
+	size_t outnum = cfg->outgoing_num_ports*out_ifs + cfg->outgoing_num_tcp;
 	size_t misc = 4; /* logfile, pidfile, stdout... */
-	size_t perthread_noudp = listen_num + outtcpnum + 
-		2/*cmdpipe*/ + 2/*libevent*/ + misc; 
-	size_t perthread = perthread_noudp + outudpnum;
-
+	size_t perthread = listen_num + outnum + 2/*cmdpipe*/ + 2/*libevent*/
+		+ misc; 
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	int numthread = 1; /* it forks */
 #else
 	int numthread = cfg->num_threads;
 #endif
 	size_t total = numthread * perthread + misc;
-	size_t avail;
 	struct rlimit rlim;
-
 	if(getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
 		log_warn("getrlimit: %s", strerror(errno));
 		return;
@@ -166,46 +101,14 @@ checkrlimits(struct config_file* cfg)
 	if(rlim.rlim_cur == (rlim_t)RLIM_INFINITY)
 		return;
 	if((size_t)rlim.rlim_cur < total) {
-		avail = (size_t)rlim.rlim_cur;
-		rlim.rlim_cur = (rlim_t)(total + 10);
-		rlim.rlim_max = (rlim_t)(total + 10);
-		if(setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
-			log_warn("setrlimit: %s", strerror(errno));
-			log_warn("cannot increase max open fds from %u to %u",
-				(unsigned)avail, (unsigned)total+10);
-			/* check that calculation below does not underflow,
-			 * with 15 as margin */
-			if(numthread*perthread_noudp+15 > avail)
-				fatal_exit("too much tcp. not enough fds.");
-			cfg->outgoing_num_ports = (int)((avail 
-				- numthread*perthread_noudp 
-				- 10 /* safety margin */) /numthread);
-			log_warn("continuing with less udp ports: %u",
-				cfg->outgoing_num_ports);
-			log_warn("increase ulimit or decrease threads, ports in config to remove this warning");
-			return;
-		}
-		log_warn("increased limit(open files) from %u to %u",
-			(unsigned)avail, (unsigned)total+10);
+		log_err("Not enough sockets available. Increase "
+			"ulimit(open files).");
+		log_err("or decrease number of threads, outgoing num ports, "
+			"outgoing num tcp or number of interfaces");
+		log_err("estimate %u fds high mark, %u available", 
+			(unsigned)total, (unsigned)rlim.rlim_cur);
+		fatal_exit("Not enough file descriptors available");
 	}
-	if(total > 1024 && 
-		strncmp(event_get_version(), "mini-event", 10) == 0) {
-		log_err("too many file descriptors requested. The builtin"
-			"mini-event cannot handle more than 1024. Config "
-			"for less fds or compile with libevent");
-		fatal_exit("configuration needs too many file descriptors");
-	}
-	if(perthread > 64 && 
-		strncmp(event_get_version(), "winsock-event", 13) == 0) {
-		log_err("too many file descriptors requested. The winsock"
-			" event handler cannot handle more than 64 per "
-			" thread. Config for less fds or compile with "
-			" libevent");
-		fatal_exit("configuration needs too many file descriptors");
-	}
-#else	
-	(void)cfg;
-#endif /* HAVE_GETRLIMIT */
 }
 
 /** set verbosity, check rlimits, cache settings */
@@ -214,12 +117,30 @@ apply_settings(struct daemon* daemon, struct config_file* cfg,
 	int cmdline_verbose)
 {
 	/* apply if they have changed */
+	daemon->cfg = cfg;
 	verbosity = cmdline_verbose + cfg->verbosity;
-	daemon_apply_cfg(daemon, cfg);
+	config_apply(cfg);
+	if(!daemon->env->msg_cache ||
+	   cfg->msg_cache_size != slabhash_get_size(daemon->env->msg_cache) ||
+	   cfg->msg_cache_slabs != daemon->env->msg_cache->size) {
+		slabhash_delete(daemon->env->msg_cache);
+		daemon->env->msg_cache = slabhash_create(cfg->msg_cache_slabs, 
+			HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size, 
+			msgreply_sizefunc, query_info_compare,
+			query_entry_delete, reply_info_delete, NULL);
+		if(!daemon->env->msg_cache) {
+			fatal_exit("malloc failure updating config settings");
+		}
+	}
+	if((daemon->env->rrset_cache = rrset_cache_adjust(
+		daemon->env->rrset_cache, cfg, &daemon->superalloc)) == 0)
+		fatal_exit("malloc failure updating config settings");
+	if((daemon->env->infra_cache = infra_adjust(daemon->env->infra_cache, 
+		cfg))==0)
+		fatal_exit("malloc failure updating config settings");
 	checkrlimits(cfg);
 }
 
-#ifdef HAVE_KILL
 /** Read existing pid from pidfile. 
  * @param file: file name of pid file.
  * @return: the pid from the file or -1 if none.
@@ -287,52 +208,46 @@ writepid (const char* pidfile, pid_t pid)
 
 /**
  * check old pid file.
- * @param pidfile: the file name of the pid file.
- * @param inchroot: if pidfile is inchroot and we can thus expect to
- *	be able to delete it.
+ * @param cfg: the config settings
  */
 static void
-checkoldpid(char* pidfile, int inchroot)
+checkoldpid(struct config_file* cfg)
 {
 	pid_t old;
-	if((old = readpid(pidfile)) != -1) {
+	char* file = cfg->pidfile;
+	if(cfg->chrootdir && cfg->chrootdir[0] &&
+		strncmp(file, cfg->chrootdir, strlen(cfg->chrootdir))==0) {
+		file += strlen(cfg->chrootdir);
+	}
+	if((old = readpid(file)) != -1) {
 		/* see if it is still alive */
 		if(kill(old, 0) == 0 || errno == EPERM)
 			log_warn("unbound is already running as pid %u.", 
 				(unsigned)old);
-		else	if(inchroot)
-			log_warn("did not exit gracefully last time (%u)", 
+		else	log_warn("did not exit gracefully last time (%u)", 
 				(unsigned)old);
 	}
 }
-#endif /* HAVE_KILL */
 
 /** detach from command line */
 static void
-detach(void)
+detach(struct config_file* cfg)
 {
-#if defined(HAVE_DAEMON) && !defined(DEPRECATED_DAEMON)
-	/* use POSIX daemon(3) function */
-	if(daemon(1, 0) != 0)
-		fatal_exit("daemon failed: %s", strerror(errno));
-#else /* no HAVE_DAEMON */
-#ifdef HAVE_FORK
 	int fd;
 	/* Take off... */
 	switch (fork()) {
 		case 0:
 			break;
 		case -1:
+			unlink(cfg->pidfile);
 			fatal_exit("fork failed: %s", strerror(errno));
 		default:
 			/* exit interactive session */
 			exit(0);
 	}
 	/* detach */
-#ifdef HAVE_SETSID
 	if(setsid() == -1)
 		fatal_exit("setsid() failed: %s", strerror(errno));
-#endif
 	if ((fd = open("/dev/null", O_RDWR, 0)) != -1) {
 		(void)dup2(fd, STDIN_FILENO);
 		(void)dup2(fd, STDOUT_FILENO);
@@ -340,189 +255,70 @@ detach(void)
 		if (fd > 2)
 			(void)close(fd);
 	}
-#endif /* HAVE_FORK */
-#endif /* HAVE_DAEMON */
 }
 
 /** daemonize, drop user priviliges and chroot if needed */
 static void
-perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
-	const char** cfgfile)
+do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
 {
-#ifdef HAVE_GETPWNAM
-	struct passwd *pwd = NULL;
 	uid_t uid;
 	gid_t gid;
 	/* initialize, but not to 0 (root) */
-	memset(&uid, 112, sizeof(uid));
-	memset(&gid, 112, sizeof(gid));
+	memset(&uid, -12, sizeof(uid));
+	memset(&gid, -12, sizeof(gid));
 	log_assert(cfg);
 
+	/* daemonize last to be able to print error to user */
+	if(cfg->directory && cfg->directory[0]) {
+		if(chdir(cfg->directory)) {
+			fatal_exit("Could not chdir to %s: %s",
+				cfg->directory, strerror(errno));
+		}
+		verbose(VERB_DETAIL, "chdir to %s", cfg->directory);
+	}
 	if(cfg->username && cfg->username[0]) {
+		struct passwd *pwd;
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
 		uid = pwd->pw_uid;
 		gid = pwd->pw_gid;
-		/* endpwent below, in case we need pwd for setusercontext */
+		endpwent();
 	}
-#endif
-
-	/* init syslog (as root) if needed, before daemonize, otherwise
-	 * a fork error could not be printed since daemonize closed stderr.*/
-	if(cfg->use_syslog) {
-		log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
-	}
-	/* if using a logfile, we cannot open it because the logfile would
-	 * be created with the wrong permissions, we cannot chown it because
-	 * we cannot chown system logfiles, so we do not open at all.
-	 * So, using a logfile, the user does not see errors unless -d is
-	 * given to unbound on the commandline. */
-
-	/* read ssl keys while superuser and outside chroot */
-	if(!(daemon->rc = daemon_remote_create(cfg)))
-		fatal_exit("could not set up remote-control");
-
-#ifdef HAVE_KILL
-	/* check old pid file before forking */
-	if(cfg->pidfile && cfg->pidfile[0]) {
-		/* calculate position of pidfile */
-		if(cfg->pidfile[0] == '/')
-			daemon->pidfile = strdup(cfg->pidfile);
-		else	daemon->pidfile = fname_after_chroot(cfg->pidfile, 
-				cfg, 1);
-		if(!daemon->pidfile)
-			fatal_exit("pidfile alloc: out of memory");
-		checkoldpid(daemon->pidfile,
-			/* true if pidfile is inside chrootdir, or nochroot */
-			!(cfg->chrootdir && cfg->chrootdir[0]) ||
-			(cfg->chrootdir && cfg->chrootdir[0] &&
-			strncmp(daemon->pidfile, cfg->chrootdir,
-				strlen(cfg->chrootdir))==0));
-	}
-#endif
-
-	/* daemonize because pid is needed by the writepid func */
-	if(!debug_mode && cfg->do_daemonize) {
-		detach();
-	}
-
-	/* write new pidfile (while still root, so can be outside chroot) */
-#ifdef HAVE_KILL
-	if(cfg->pidfile && cfg->pidfile[0]) {
-		writepid(daemon->pidfile, getpid());
-		if(!(cfg->chrootdir && cfg->chrootdir[0]) || 
-			(cfg->chrootdir && cfg->chrootdir[0] && 
-			strncmp(daemon->pidfile, cfg->chrootdir, 
-			strlen(cfg->chrootdir))==0)) {
-			/* delete of pidfile could potentially work,
-			 * chown to get permissions */
-			if(cfg->username && cfg->username[0]) {
-			  if(chown(daemon->pidfile, uid, gid) == -1) {
-				fatal_exit("cannot chown %u.%u %s: %s",
-					(unsigned)uid, (unsigned)gid,
-					daemon->pidfile, strerror(errno));
-			  }
-			}
-		}
-	}
-#else
-	(void)daemon;
-#endif
-
-	/* box into the chroot */
-#ifdef HAVE_CHROOT
 	if(cfg->chrootdir && cfg->chrootdir[0]) {
-		if(chdir(cfg->chrootdir)) {
-			fatal_exit("unable to chdir to chroot %s: %s",
-				cfg->chrootdir, strerror(errno));
-		}
-		verbose(VERB_QUERY, "chdir to %s", cfg->chrootdir);
 		if(chroot(cfg->chrootdir))
 			fatal_exit("unable to chroot to %s: %s", 
 				cfg->chrootdir, strerror(errno));
-		verbose(VERB_QUERY, "chroot to %s", cfg->chrootdir);
-		if(strncmp(*cfgfile, cfg->chrootdir, 
-			strlen(cfg->chrootdir)) == 0) 
-			(*cfgfile) += strlen(cfg->chrootdir);
-
-		/* adjust stored pidfile for chroot */
-		if(daemon->pidfile && daemon->pidfile[0] && 
-			strncmp(daemon->pidfile, cfg->chrootdir,
-			strlen(cfg->chrootdir))==0) {
-			char* old = daemon->pidfile;
-			daemon->pidfile = strdup(old+strlen(cfg->chrootdir));
-			free(old);
-			if(!daemon->pidfile)
-				log_err("out of memory in pidfile adjust");
-		}
-		daemon->chroot = strdup(cfg->chrootdir);
-		if(!daemon->chroot)
-			log_err("out of memory in daemon chroot dir storage");
+		verbose(VERB_DETAIL, "chroot to %s", cfg->chrootdir);
 	}
-#else
-	(void)cfgfile;
-#endif
-	/* change to working directory inside chroot */
-	if(cfg->directory && cfg->directory[0]) {
-		char* dir = cfg->directory;
-		if(cfg->chrootdir && cfg->chrootdir[0] &&
-			strncmp(dir, cfg->chrootdir, 
-			strlen(cfg->chrootdir)) == 0)
-			dir += strlen(cfg->chrootdir);
-		if(dir[0]) {
-			if(chdir(dir)) {
-				fatal_exit("Could not chdir to %s: %s",
-					dir, strerror(errno));
-			}
-			verbose(VERB_QUERY, "chdir to %s", dir);
-		}
-	}
-
-	/* drop permissions after chroot, getpwnam, pidfile, syslog done*/
-#ifdef HAVE_GETPWNAM
 	if(cfg->username && cfg->username[0]) {
-#ifdef HAVE_SETUSERCONTEXT
-		/* setusercontext does initgroups, setuid, setgid, and
-		 * also resource limits from login config, but we
-		 * still call setresuid, setresgid to be sure to set all uid*/
-		if(setusercontext(NULL, pwd, uid, LOGIN_SETALL) != 0)
-			log_warn("unable to setusercontext %s: %s",
-				cfg->username, strerror(errno));
-#else /* !HAVE_SETUSERCONTEXT */
-#  ifdef HAVE_INITGROUPS
-		if(initgroups(cfg->username, gid) != 0)
-			log_warn("unable to initgroups %s: %s",
-				cfg->username, strerror(errno));
-#  endif /* HAVE_INITGROUPS */
-#endif /* HAVE_SETUSERCONTEXT */
-		endpwent();
-
-#ifdef HAVE_SETRESGID
-		if(setresgid(gid,gid,gid) != 0)
-#elif defined(HAVE_SETREGID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setregid(gid,gid) != 0)
-#else /* use setgid */
 		if(setgid(gid) != 0)
-#endif /* HAVE_SETRESGID */
 			fatal_exit("unable to set group id of %s: %s", 
 				cfg->username, strerror(errno));
-#ifdef HAVE_SETRESUID
-		if(setresuid(uid,uid,uid) != 0)
-#elif defined(HAVE_SETREUID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setreuid(uid,uid) != 0)
-#else /* use setuid */
 		if(setuid(uid) != 0)
-#endif /* HAVE_SETRESUID */
 			fatal_exit("unable to set user id of %s: %s", 
 				cfg->username, strerror(errno));
-		verbose(VERB_QUERY, "drop user privileges, run as %s", 
+		verbose(VERB_DETAIL, "drop user privileges, run as %s", 
 			cfg->username);
 	}
-#endif /* HAVE_GETPWNAM */
-	/* file logging inited after chroot,chdir,setuid is done so that 
-	 * it would succeed on SIGHUP as well */
-	if(!cfg->use_syslog)
-		log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
+	/* check old pid file before forking */
+	if(cfg->pidfile && cfg->pidfile[0]) {
+		checkoldpid(cfg);
+	}
+
+	/* init logfile just before fork */
+	log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
+	if(!debug_mode && cfg->do_daemonize) {
+		detach(cfg);
+	}
+	if(cfg->pidfile && cfg->pidfile[0]) {
+		char* pf = cfg->pidfile;
+		if(cfg->chrootdir && cfg->chrootdir[0] &&
+			strncmp(pf, cfg->chrootdir, strlen(cfg->chrootdir))==0)
+			pf += strlen(cfg->chrootdir);
+		writepid(pf, getpid());
+		if(!(daemon->pidfile = strdup(pf)))
+			log_err("pidf: malloc failed");
+	}
 }
 
 /**
@@ -533,41 +329,33 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
  * @param debug_mode: if set, do not daemonize.
  */
 static void 
-run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
+run_daemon(char* cfgfile, int cmdline_verbose, int debug_mode)
 {
 	struct config_file* cfg = NULL;
 	struct daemon* daemon = NULL;
-	int done_setup = 0;
+	int done_chroot = 0;
 
 	if(!(daemon = daemon_init()))
 		fatal_exit("alloc failure");
 	while(!daemon->need_to_exit) {
-		if(done_setup)
-			verbose(VERB_OPS, "Restart of %s.", PACKAGE_STRING);
-		else	verbose(VERB_OPS, "Start of %s.", PACKAGE_STRING);
+		if(done_chroot)
+			log_info("Restart of %s.", PACKAGE_STRING);
+		else	log_info("Start of %s.", PACKAGE_STRING);
 
 		/* config stuff */
 		if(!(cfg = config_create()))
 			fatal_exit("Could not alloc config defaults");
-		if(!config_read(cfg, cfgfile, daemon->chroot)) {
-			if(errno != ENOENT)
-				fatal_exit("Could not read config file: %s",
-					cfgfile);
-			log_warn("Continuing with default config settings");
-		}
+		if(!config_read(cfg, cfgfile))
+			fatal_exit("Could not read config file: %s", cfgfile);
 		apply_settings(daemon, cfg, cmdline_verbose);
 	
 		/* prepare */
 		if(!daemon_open_shared_ports(daemon))
 			fatal_exit("could not open ports");
-		if(!done_setup) { 
-			perform_setup(daemon, cfg, debug_mode, &cfgfile); 
-			done_setup = 1; 
-		} else {
-			/* reopen log after HUP to facilitate log rotation */
-			if(!cfg->use_syslog)
-				log_init(cfg->logfile, 0, cfg->chrootdir);
-		}
+		if(!done_chroot) { 
+			do_chroot(daemon, cfg, debug_mode); 
+			done_chroot = 1; 
+		} else log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
 		/* work */
 		daemon_fork(daemon);
 
@@ -577,17 +365,8 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
 		config_delete(cfg);
 	}
 	verbose(VERB_ALGO, "Exit cleanup.");
-	/* this unlink may not work if the pidfile is located outside
-	 * of the chroot/workdir or we no longer have permissions */
-	if(daemon->pidfile) {
-		int fd;
-		/* truncate pidfile */
-		fd = open(daemon->pidfile, O_WRONLY | O_TRUNC, 0644);
-		if(fd != -1)
-			close(fd);
-		/* delete pidfile */
+	if(daemon->pidfile)
 		unlink(daemon->pidfile);
-	}
 	daemon_delete(daemon);
 }
 
@@ -606,28 +385,19 @@ int
 main(int argc, char* argv[])
 {
 	int c;
-	const char* cfgfile = CONFIGFILE;
-	const char* winopt = NULL;
+	char* cfgfile = CONFIGFILE;
 	int cmdline_verbose = 0;
 	int debug_mode = 0;
-#ifdef UB_ON_WINDOWS
-	int cmdline_cfg = 0;
-#endif
 
-#ifdef HAVE_SBRK
 	/* take debug snapshot of heap */
 	unbound_start_brk = sbrk(0);
-#endif
 
 	log_init(NULL, 0, NULL);
 	/* parse the options */
-	while( (c=getopt(argc, argv, "c:dhvw:")) != -1) {
+	while( (c=getopt(argc, argv, "c:dhv")) != -1) {
 		switch(c) {
 		case 'c':
 			cfgfile = optarg;
-#ifdef UB_ON_WINDOWS
-			cmdline_cfg = 1;
-#endif
 			break;
 		case 'v':
 			cmdline_verbose ++;
@@ -636,9 +406,6 @@ main(int argc, char* argv[])
 		case 'd':
 			debug_mode = 1;
 			break;
-		case 'w':
-			winopt = optarg;
-			break;
 		case '?':
 		case 'h':
 		default:
@@ -649,15 +416,6 @@ main(int argc, char* argv[])
 	argc -= optind;
 	argv += optind;
 
-	if(winopt) {
-#ifdef UB_ON_WINDOWS
-		wsvc_command_option(winopt, cfgfile, cmdline_verbose, 
-			cmdline_cfg);
-#else
-		fatal_exit("option not supported");
-#endif
-	}
-
 	if(argc != 0) {
 		usage();
 		return 1;

daemon/worker.h

@@ -43,6 +43,7 @@
 #ifndef DAEMON_WORKER_H
 #define DAEMON_WORKER_H
 
+#include "config.h"
 #include "util/netevent.h"
 #include "util/locks.h"
 #include "util/alloc.h"
@@ -57,19 +58,14 @@ struct daemon;
 struct listen_port;
 struct ub_randstate;
 struct regional;
-struct tube;
-struct daemon_remote;
+
+/** size of table used for random numbers. large to be more secure. */
+#define RND_STATE_SIZE 256
 
 /** worker commands */
 enum worker_commands {
 	/** make the worker quit */
-	worker_cmd_quit,
-	/** obtain statistics */
-	worker_cmd_stats,
-	/** obtain statistics without statsclear */
-	worker_cmd_stats_noreset,
-	/** execute remote control command */
-	worker_cmd_remote
+	worker_cmd_quit
 };
 
 /**
@@ -83,24 +79,20 @@ struct worker {
 	struct daemon* daemon;
 	/** thread id */
 	ub_thread_t thr_id;
-	/** pipe, for commands for this worker */
-	struct tube* cmd;
+	/** fd 0 of socketpair, write commands for worker to this one */
+	int cmd_send_fd;
+	/** fd 1 of socketpair, worker listens on this one */
+	int cmd_recv_fd;
 	/** the event base this worker works with */
 	struct comm_base* base;
 	/** the frontside listening interface where request events come in */
 	struct listen_dnsport* front;
 	/** the backside outside network interface to the auth servers */
 	struct outside_network* back;
-	/** ports to be used by this worker. */
-	int* ports;
-	/** number of ports for this worker */
-	int numports;
 	/** the signal handler */
 	struct comm_signal* comsig;
 	/** commpoint to listen to commands. */
 	struct comm_point* cmd_com;
-	/** timer for statistics */
-	struct comm_timer* stat_timer;
 
 	/** number of requests that can be handled by this worker */
 	size_t request_size;
@@ -125,11 +117,9 @@ struct worker {
  * with backpointers only. Use worker_init on it later.
  * @param daemon: the daemon that this worker thread is part of.
  * @param id: the thread number from 0.. numthreads-1.
- * @param ports: the ports it is allowed to use, array.
- * @param n: the number of ports.
  * @return: the new worker or NULL on alloc failure.
  */
-struct worker* worker_create(struct daemon* daemon, int id, int* ports, int n);
+struct worker* worker_create(struct daemon* daemon, int id);
 
 /**
  * Initialize worker.
@@ -156,9 +146,11 @@ void worker_delete(struct worker* worker);
 /**
  * Send a command to a worker. Uses blocking writes.
  * @param worker: worker to send command to.
+ * @param buffer: an empty buffer to use.
  * @param cmd: command to send.
  */
-void worker_send_cmd(struct worker* worker, enum worker_commands cmd);
+void worker_send_cmd(struct worker* worker, ldns_buffer* buffer,
+        enum worker_commands cmd);
 
 /**
  * Worker signal handler function. User argument is the worker itself.
@@ -189,7 +181,6 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  * @param qclass: query class. (host order)
  * @param flags: host order flags word, with opcode and CD bit.
  * @param dnssec: if set, EDNS record will have DO bit set.
- * @param want_dnssec: signatures needed.
  * @param addr: where to.
  * @param addrlen: length of addr.
  * @param q: wich query state to reactivate upon return.
@@ -198,20 +189,18 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  */
 struct outbound_entry* worker_send_query(uint8_t* qname, size_t qnamelen, 
 	uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
-	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
+	struct sockaddr_storage* addr, socklen_t addrlen,
 	struct module_qstate* q);
 
 /** 
- * process control messages from the main thread. Frees the control 
- * command message.
- * @param tube: tube control message came on.
- * @param msg: message contents.  Is freed.
- * @param len: length of message.
- * @param error: if error (NETEVENT_*) happened.
- * @param arg: user argument
+ * process control messages from the main thread. 
+ * @param c: comm point to read from.
+ * @param arg: worker.
+ * @param error: error status of comm point.
+ * @param reply_info: not used.
  */
-void worker_handle_control_cmd(struct tube* tube, uint8_t* msg, size_t len,
-	int error, void* arg);
+int worker_handle_control_cmd(struct comm_point* c, void* arg, int error, 
+	struct comm_reply* reply_info);
 
 /** handles callbacks from listening event interface */
 int worker_handle_request(struct comm_point* c, void* arg, int error,
@@ -228,16 +217,4 @@ int worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 /** cleanup the cache to remove all rrset IDs from it, arg is worker */
 void worker_alloc_cleanup(void* arg);
 
-/**
- * Init worker stats - includes server_stats_init, outside network and mesh.
- * @param worker: the worker to init
- */
-void worker_stats_clear(struct worker* worker);
-
-/** statistics timer callback handler */
-void worker_stat_timer_cb(void* arg);
-
-/** probe timer callback handler */
-void worker_probe_timer_cb(void* arg);
-
 #endif /* DAEMON_WORKER_H */

doc/CREDITS

@@ -1,20 +1,9 @@
 Unbound was developed at NLnet Labs by Wouter Wijngaards.
 
-Unbound was architected in January of 2004 by Jakob Schlyter of Kirei 
-and Roy Arends of Nominet. VeriSign and EP.Net funded development of 
-the prototype, which was built by David Blacka and Matt Larson of VeriSign. 
-Late in 2006, NLnet Labs joined the effort, writing an implementation in C 
-based on the existing prototype and using experience NLnet Labs gained
-during the development of NSD, an authoritative DNS server.
+Unbound was devised by Bill Manning, David Blacka, and Matt Larson 
+from the University of California and from Verisign. The Java prototype
+was made in further cooperation with Geoff Sisson and Roy Arends from Nominet.
 
-At NLnet Labs, Jelte Jansen, Mark Santcroos and Matthijs Mekking 
-reviewed the unbound C sources.
+At NLnet Labs, Jelte Jansen and Mark Santcroos reviewed the unbound C sources.
 
 Jakob Schlyter - for advice on secure settings, random numbers and blacklists.
-Ondřej Surý - running coverity analysis tool on 0.9 dev version.
-Alexander Gall - multihomed, anycast testing of unbound resolver server.
-Zdenek Vasicek and Marek Vavrusa - python module.
-cz.nic - sponsoring 'summer of code' development by Zdenek and Marek.
-Brett Carr - windows beta testing.
-Luca Bruno - patch for windows support in libunbound hosts and resolvconf().
-Tom Hendrikx - contributed split-itar.sh a useful script to 5011-track ITAR.

doc/FEATURES

@@ -1,91 +0,0 @@
-Unbound Features
-
-(C) Copyright 2008, Wouter Wijngaards, NLnet Labs.
-
-
-This document describes the features and RFCs that unbound 
-adheres to, and which ones are decided to be out of scope.
-
-
-Big Features
-------------
-Recursive service.
-Caching service.
-Forwarding and stub zones.
-No authoritative service.
-DNSSEC Validation options.
-EDNS0, NSEC3, Unknown-RR-types.
-
-
-Details
--------
-Processing support
-RFC 1034-1035: as a recursive, caching server. Not authoritative.
-  including CNAMEs, referrals, wildcards, classes, ...
-RFC 4033-4035: as a validating caching server (unbound daemon). 
-  as a validating stub (libunbound).
-RFC 1918.
-RFC 2181: completely, including the trust model, keeping rrsets together.
-RFC 2672: DNAME support.
-RFC 3597: Unknown RR type support.
-RFC 2671: EDNS0 support, default advertisement 4Kb size. 
-RFC 5155: NSEC3, NSEC3PARAM types
-AAAA type. and IP6 dual stack support.
-type ANY queries are supported.
-RFC 2308: TTL directive, and the rest of the RFC too.
-RFC 4592: wildcards.
-
-RFC 1995, 1996, 2136: not authoritative, so no AXFR, IXFR, NOTIFY or
-  dynamic update services are appropriate.
-
-chroot and drop-root-privileges support, default enabled in config file.
-
-AD bit in query can be used to request AD bit in response (w/o using DO bit).
-CD bit in query can be used to request bogus data.
-UDP and TCP service is provided downstream.
-UDP and TCP are used to request from upstream servers.
-Multiple queries can be made over a TCP stream.
-
-No TSIG support at this time.
-No SIG0 support at this time.
-No dTLS support at this time.
-This is not a DNS statistics package, but some operationally useful
-values are provided.
-TXT RRs from the Chaos class (id.server, hostname.bind, ...) supported.
-
-draft-forgery-resilience: all recommendations followed.
-draft-0x20: experimental implementation (incomplete).
-  implements bitwise echo of the query to support downstream 0x20.
-draft-ietf-dnsop-default-local-zones is fully supported (-04).
-  It is possible to block zones or return an address for localhost.
-  This is a very limited authoritative service. Defaults as in draft.
-draft-ietf-dnsop-resolver-priming(-00): can prime and can fallback to 
-  a safety belt list.
-draft-ietf-dnsop-dnssec-trust-anchor(-01): DS records can be configured 
-  as trust anchors. Also DNSKEYs are allowed, by the way.
-draft-ietf-dnsop-reflectors-are-evil: access control list for recursive
-  service. In fact for all DNS service so cache snooping is halted.
-
-Record type syntax support, extensive, from lib ldns.
-For these types only syntax and parsing support is needed.
-RFC 1034-1035: basic RR types.
-RFC 1183: RP, AFSDB, X25, ISDN, RT
-RFC 1706: NSAP
-RFC 2535: KEY, SIG, NXT: treated as unknown data, syntax is parsed (obsolete).
-2163: PX
-AAAA type
-1876: LOC type
-2782: SRV type
-2915: NAPTR type.
-2230: KX type.
-2538: CERT type.
-2672: DNAME type.
-OPT type
-3123: APL
-SSHFP type
-4025: IPSECKEY
-4033-4035: DS, RRSIG, NSEC, DNSKEY
-4701: DHCID
-5155: NSEC3, NSEC3PARAM
-4408: SPF
-

doc/README

@@ -4,16 +4,18 @@ http://unbound.net
 
 This software is under BSD license, see LICENSE for details.
 
-* Download the latest release version of this software from 
+* Download the latest version of this software from 
   	http://unbound.net 
   or get a beta version from the svn repository at 
   	http://unbound.net/svn/
 
 * Uses the following libraries; 
   * ldns	http://www.nlnetlabs.nl/ldns/			(BSD license)
-    (required) can use tarball from source directory.
   * libevent	http://www.monkey.org/~provos/libevent/		(BSD license)
-    (optional) can use builtin alternative instead.
+
+* Create build environment 
+  * run libtoolize -c if config.sub is missing, or run glibtoolize.
+  * autoreconf (autoheader && autoconf), if ./configure is missing.
 
 * Make and install: ./configure; make; make install
   * Use GNU make; default on linux, often called 'gmake' on BSD and Solaris.
@@ -23,19 +25,13 @@ This software is under BSD license, see LICENSE for details.
 	If detected on the system, it will dynamically link against it.
   * --with-libevent=/path/to/libevent
   	Can be set to either the system install or the build directory.
-	--with-libevent=no (default) gives a builtin alternative 
-	implementation. libevent is useful when having many (thousands) 
-	of outgoing ports. This improves randomization and spoof 
-	resistance. For the default of 16 ports the builtin alternative 
-	works well and is a little faster.
+	--with-libevent=no gives a builtin alternative implementation.
+	libevent is useful when having many (thousands) of outgoing ports.
+	This improves randomization and spoof resistance. For the default 
+	of 16 ports the builtin alternative works well.
   * --without-pthreads 
-	This disables pthreads. Without this option the pthreads library 
-	is detected automatically. Use this option to disable threading
-	altogether, or, on Solaris, also use --with(out)-solaris-threads.
-  * --enable-checking
-  	This enables assertions in the code that guard against a variety of
-	programming errors, among which buffer overflows.  The program exits
-	with an error if an assertion fails (but the buffer did not overflow).
+	This disables pthreads, and uses Solaris thr library or no threading. 
+	Without this option the pthreads library is detected automatically.
   * --enable-static-exe
 	This enables a debug option to statically link, against ldns and 
 	libevent libraries.
@@ -47,67 +43,19 @@ This software is under BSD license, see LICENSE for details.
 	The server periodically checks if the amount of memory used fits with
 	the amount of memory it thinks it should be using, and reports 
 	memory usage in detail.
-  * --with-conf-file=filename
-  	Set default location of config file, 
-	the default is /usr/local/etc/unbound/unbound.conf.
-  * --with-pidfile=filename
-  	Set default location of pidfile,
-	the default is /usr/local/etc/unbound/unbound.pid.
-  * --with-run-dir=path
-  	Set default working directory,
-	the default is /usr/local/etc/unbound.
-  * --with-chroot-dir=path
-  	Set default chroot directory,
-	the default is /usr/local/etc/unbound.
-  * --with-username=user
-  	Set default user name to change to,
-	the default is the "unbound" user.
-  * --with-pyunbound
-  	Create libunbound wrapper usable from python.
-	Needs python-devel and swig development tools.
-  * --with-pythonmodule
-  	Compile the python module that processes responses in the server.
-  * --disable-sha2
-  	Disable support for RSASHA256 and RSASHA512 crypto.
-  * --enable-gost
-  	Enable draft support for GOST crypto.
 
 * 'make test' attempts to run a series of tests, depending on the support
   programs that are installed.
 
 Known issues
 ------------
-o If there are no replies for a forward or stub zone, for a reverse zone,
-  you may need to add a local-zone: name transparent or nodefault to the
-  server: section of the config file to unblock the reverse zone.
-  Only happens for (sub)zones that are blocked by default; e.g. 10.in-addr.arpa
 o If libevent is older (before 1.3c), unbound will exit instead of reload
   on sighup. On a restart 'did not exit gracefully last time' warning is 
   printed. Perform ./configure --with-libevent=no or update libevent, rerun 
   configure and recompile unbound to make sighup work correctly.
-  It is strongly suggested to use a recent version of libevent.
-o If you are not receiving the correct source IP address on replies (e.g.
-  you are running a multihomed, anycast server), the interface-automatic
-  option can be enabled to set socket options to achieve the correct
-  source IP address on UDP replies. Listing all IP addresses explicitly in
-  the config file is an alternative. The interface-automatic option uses
-  non portable socket options, Linux and FreeBSD should work fine.
-o The warning 'openssl has no entropy, seeding with time', with chroot 
-  enabled, may be solved with a symbolic link to /dev/random from <chrootdir>.
-o On Solaris 5.10 some libtool packages from repositories do not work with
-  gcc, showing errors gcc: unrecognized option `-KPIC'
-  To solve this do ./configure libtool=./libtool [your options...].
-o If unbound-control (or munin graphs) do not work, this can often be because
-  the unbound-control-setup script creates the keys with restricted 
-  permissions, and the files need to be made readable or ownered by both the
-  unbound daemon and unbound-control.
-o Crosscompile seems to hang.  You tried to install unbound under wine.
-  wine regedit and remove all the unbound entries from the registry or
-  delete .wine/drive_c.
 
 Acknowledgements
 ----------------
-o Unbound was written in portable C by Wouter Wijngaards (NLnet Labs).
 o Thanks to David Blacka and Matt Larson (Verisign) for the unbound-java
   prototype. Design and code from that prototype has been used to create
   this program. Such as the iterator state machine and the cache design.

doc/README.svn

@@ -1,13 +1,11 @@
 README.svn
 
 For a svn checkout
-* configure script, aclocal.m4, as well as yacc/lex output files are
-  committed to the repository.
-* use --enable-debug flag for configure to enable dependency tracking and
-  assertions, otherwise, use make clean; make after svn update.
+* Create build environment - see README.
+  * possibly copy aclocal.m4 from your autoconf/libtool setup.
 
 * Note changes in the Changelog.
-* Every check-in a postcommit hook is run
+* Every checking a postcommit hook is run
 	(the postcommit hook is in the svn/unbound/hooks directory).
 	* generates commit email with your changes and comment.
 	* compiles and runs the tests (with testcode/do-tests.sh).

doc/README.tests

@@ -3,19 +3,7 @@ README unbound tests
 There is a test setup for unbound. Use
 	make test
 To make and run the tests. The results are summarized at the end.
-
-You need to have the following programs installed and in your PATH.
-* dig - from the bind-tools package. Used to send DNS queries.
-* wdiff - used for word-by-word comparisons.
-* splint (optional) - for lint test
-* doxygen (optional) - for doc completeness test
-* ldns-testns (optional) - from ldns examples. Used as DNS auth server.
-* xxd and nc (optional) - for (malformed) packet transmission.
-The optional programs are detected and can be omitted.
-
-Without any support programs, unittest and testbound can still be used.
-	(cd testdata; ../testcode/mini_tpkg.sh exe 02-unittest.tpkg)
-	(cd testdata; ../testcode/mini_tpkg.sh exe 03-testbound.tpkg)
+You can also run ./unittest by hand, if the system lacks other debug tools.
 
 testdata/ contains the data for tests. 
 testcode/ contains scripts and c code for the tests.

doc/TODO

@@ -1,76 +1,58 @@
-TODO items. These are interesting todo items.
+TODO items.
+o use real entropy to make random (ID, port) numbers more random.
+o in production mode, do not free memory on exit. In debug mode, test leaks.
+o profile memory allocation, and if performance issues, use special memory
+  allocator. For example, with caches per thread.
+o #define BIT_... different on bigendian and smallendian systems so that
+  the htons on flags is not needed to send a message from the cache.
+o speed up pkt domain name decompression loop detection using counter perhaps.
+o detect OS/400 pthreads implementation that allows upgrading to writelock
+  on pthreads rwlocks and use it to examine-rd before storing-wr rrset cache.
 o understand synthesized DNAMEs, so those TTL=0 packets are cached properly.
-o NSEC/NSEC3 aggressive negative caching, so that updates to NSEC/NSEC3 
-  will result in proper negative responses.
-o (option) where port 53 is used for send and receive, no other ports are used.
+o understand NSEC/NSEC3, aggressive negative caching, so that updates to
+  NSEC/NSEC3 will result in proper negative responses.
+o fallback without EDNS if result is NOTIMPL, now only on FORMERR like in java.
+o scrubber has slow pkt_subdomain and pkt_strict_subdomain functions.
+o get serverselection algorithm out of local optimum.
+  make subtargets to get rtt info for a couple of targets, like fetch-policy.
+  or send out multiple queries to multiple servers.
+o donotqueryaddresses allow specification of subnets, use trie to store.
+  extend default list to contain illegal ip4 and ip6 addresses.
+o memory profile; and if needed put serviced queries under qstate->region
+  and special purpose region code, reuse blocks, shrink if too big.
+o check query, option to enforce presence of qdsection in noerror answers.
+o configuration option where port 53 is used for send and receive, no other
+  ports are used.
 o (option) to not send replies to clients after a timeout of (say 5 secs) has
   passed, but keep task active for later retries by client.
-o (option) private TTL feature (always report TTL x in answers).
-o (option) pretend-dnssec-unaware, and pretend-edns-unaware modes for workshops.
+o private TTL feature
+o pretend-dnssec-unaware, and pretend-edns-unaware modes for debug/workshops.
 o delegpt use rbtree for ns-list, to avoid slowdown for very large NS sets.
-o (option) reprime and refresh oft used data before timeout.
-o (option) retain prime results in a overlaid roothints file.
-o (option) store primed key data in a overlaid keyhints file (sort of like drafttimers).
+o be able to have different listen and query-to addresses to bind to,
+  so you can listen to localhost and query-to to the internet.
+o reprime and refresh oft used data before timeout.
+o retain prime results in a overlaid roothints file.
+o store primed key data in a overlaid keyhints file (sort of like drafttimers).
 o windows version, auto update feature, a query to check for the version.
+o autoreport of problems
+o logrotation, syslog
 o command the server with TSIG inband. get-config, clearcache, 
 	get stats, get memstats, get ..., reload, clear one zone from cache
+o watch for spoof nearmisses.
+o improve compression of DNS packets by first puttig uncompressible rrs, then
+  compress to their rdata.
+o if one server is not responsive do not spend 75 secs on that server, but
+  try other servers with lower rtt.
 o NSID rfc 5001 support.
 o timers rfc 5011 support.
 o Treat YXDOMAIN from a DNAME properly, in iterator (not throwaway), validator.
+o grab ports nonconsequtive and change the set after a while (change within
+  a given range). Could be bad for OS if wrong port. unsure if it helps secure.
 o make timeout backoffs randomized (a couple percent random) to spread traffic.
 o inspect date on executable, then warn user in log if its more than 1 year.
-o (option) proactively prime root, stubs and trust anchors, feature.
+o proactively prime root, stubs and trust anchors, feature.
   early failure, faster on first query, but more traffic.
-o library add convenience functions for A, AAAA, PTR, getaddrinfo, libresolve.
-o library add function to validate input from app that is signed.
-o add dynamic-update requests (making a dynupd request) to libunbound api.
-o SIG(0) and TSIG.
-o support OPT record placement on recv anywhere in the additional section. 
-o add local-file: config with authority features.
-o (option) to make local-data answers be secure for libunbound (default=no)
-o (option) to make chroot: copy all needed files into jail (or make jail)
-	perhaps also print reminder to link /dev/random and sysloghack.
-o overhaul outside-network servicedquery to merge with udpwait and tcpwait,
-  to make timers in servicedquery independent of udpwait queues.
-o check into rebinding ports for efficiency, configure time test.
-o EVP hardware crypto support.
-o option to ignore all inception and expiration dates for rrsigs.
-o cleaner code; return and func statements on newline.
-o memcached module that sits before validator module; checks for memcached
-  data (on local lan), stores recursion lookup.  Provides one cache for multiple resolver machines, coherent reply content in anycast setup.
-o no openssl_add_all_algorithms, but only the ones necessary, less space.
-o listen to NOTIFY messages for zones and flush the cache for that zone
-  if received.  Useful when also having a stub to that auth server.
-  Needs proper protection, TSIG, in place.
-o winevent - do not go more than 64 fds (by polling with select one by
-  one), win95/98 have 100fd limit in the kernel, so this ruins w9x portability.
-
-*** Features features, for later
-* dTLS, TLS, look to need special port numbers, cert storage, recent libssl.
-* aggressive negative caching for NSEC, NSEC3.
-* multiple queries per question, server exploration, server selection.
-* support TSIG on queries, for validating resolver deployment.
-* retry-mode, where a bogus result triggers a retry-mode query, where a list
-  of responses over a time interval is collected, and each is validated.
-  or try in TCP mode. Do not 'try all servers several times', since we must
-  not create packet storms with operator errors.
-o on windows version, implement that OS ancillary data capabilities for
-  interface-automatic. IPPKTINFO, IP6PKTINFO for WSARecvMsg, WSASendMsg.
-o local-zone directive with authority service, full authority server 
-  is a non-goal.
-o infra and lame cache: easier size config (in Mb), show usage in graphs.
-- store time of dump in cachedumps, so that on a load the ttls can be
-  compared to the absolute time, and now-expired items can be dealt with.
-
-later
-- selective verbosity; ubcontrol trace example.com
-- cache fork-dump, pre-load
-- for fwds, send queries to N servers in fwd-list, use first reply.
-  document high scalable, high available unbound setup onepager.
-- prefetch DNSKEY when DS in delegation seen (nonCD, underTA).
-- use libevent if available on system by default(?), default outgoing 256to1024
-
-[1] BIND-like query logging to see who's looking up what and when
-[2] more logging about stuff like SERVFAIL and REFUSED responses
-[3] a Makefile that works without gnumake
-
+o use privilege separation, to change privilege options during reload securely
+  not needed.
+o check if for PowerDNS(2.9.21) CNAME in Answer section & rcode=NXDOMAIN needs
+  to be fixed up to be rcode=NOERROR?

doc/control_proto_spec.txt

@@ -1,65 +0,0 @@
-
-Specification for the unbound-control protocol.
-
-Server listens on 953 TCP (localhost by default). Client connects,
-SSLv3 or TLSv1 connection setup (server selfsigned certificate, 
-client has cert signed by server certificate).
-
-Query and Response
-------------------
-Client sends 
-	UBCT [commandline] \n
-	fixed string UBCT, then an ascii text line, with a command, 
-	some whitespace allowed. Line ends with '\n'.
-
-Server executes command. And sends reply in ascii text over channel, 
-closes the channel when done.
-	in case of error the first line of the response is:
-		error <descriptive text possible> \n
-	or the remainder is data of the response, for many commands the 
-	response is 'ok\n'.
-
-Queries and responses
----------------------
-stop
-	stops the server.
-reload
-	reloads the config file, and flushes the cache.
-verbosity <new value>
-	Change logging verbosity to new value.
-stats
-	output is a list of [name]=[value] lines.
-	clears the counters.
-dump_cache
-	output is a text representation of the cache contents.
-	data ends with a line 'EOF' before connection close.
-load_cache
-	client sends cache contents (like from dump_cache), which is stored 
-	in the cache. end of data indicated with a line with 'EOF' on it.
-	The data is sent after the query line.
-flush <name>
-	flushes some information regarding the name from the cache.
-	removes the A, AAAA, NS, SOA, CNAME, DNAME, MX, PTR, SRV, NAPTR types.
-	Does not remove other types.
-flush_type <name> <RR type>
-	removes rrtype entry from the cache.
-flush_zone <name>
-	removes name and everything below that name from the cache.
-	has to search through the cache item by item, so this is slow.
-lookup <name>
-	see what servers would be queried for a lookup of the given name.
-local_zone_remove <name of local-zone entry>
-	the local-zone entry is removed.
-	All data from the local zone is also deleted.
-	If it did not exist, nothing happens.
-local_zone <name of local zone> <type>
-	As the config file entry. Adds new local zone or updates
-	existing zone type.
-local_data_remove <name>
-	Removes local-data (all types) name.
-local_data <resource record string>
-	Add new local data record (on the rest of the line).
-	local_data_add www.example.com. IN A 192.0.2.2
-	if no local_zone exists for it; a transparent zone with the same
-	name as the data is created.
-Other commands in the unbound-control manual page.

doc/example.conf

@@ -0,0 +1,272 @@
+#
+# Example configuration file.
+#
+# See unbound.conf(5) man page.
+#
+# this is a comment.
+
+#Use this to include other text into the file.
+#include: "otherfile.conf"
+
+# The server clause sets the main parameters. 
+server:
+	# whitespace is not necessary, but looks cleaner.
+
+	# verbosity number, 0 is least verbose. 1 is default.
+	verbosity: 1
+
+	# number of threads to create. 1 disables threading.
+	# num-threads: 1
+
+	# specify the interfaces to answer queries from by ip-address.
+	# The default is to listen to localhost (127.0.0.1 and ::1).
+	# specify 0.0.0.0 and ::0 to bind to all available interfaces.
+	# specify every interface on a new 'interface:' labelled line.
+	# The listen interfaces are not changed on reload, only on restart.
+	# interface: 192.0.2.153
+	# interface: 192.0.2.154
+	# interface: 2001:DB8::5
+
+	# port to answer queries from
+	# port: 53
+
+	# specify the interfaces to send outgoing queries to authoritative
+	# server from by ip-address. If none, the default (all) interface
+	# is used. Specify every interface on a 'outgoing-interface:' line.
+	# outgoing-interface: 192.0.2.153
+	# outgoing-interface: 2001:DB8::5
+	# outgoing-interface: 2001:DB8::6
+
+	# unbound needs to send packets to authoritative nameservers.
+	# it uses a range of ports for that.
+	# the start number of the port range
+	# outgoing-port: 1053
+
+	# number of port to allocate per thread, determines the size of the
+	# port range. A larger port range gives more resistance to certain
+	# spoof attacks, as it gets harder to guess which port is used. 
+	# But also takes more system resources (for open sockets).
+	# outgoing-range: 16
+
+	# number of outgoing simultaneous tcp buffers to hold per thread.
+	# outgoing-num-tcp: 10
+
+	# number of incoming simultaneous tcp buffers to hold per thread.
+	# incoming-num-tcp: 10
+	
+	# buffer size for handling DNS data. No messages larger than this
+	# size can be sent or received, by UDP or TCP. In bytes.
+	# msg-buffer-size: 65552
+
+	# the amount of memory to use for the message cache.
+	# in bytes. default is 4 Mb
+	# msg-cache-size: 4194304
+
+	# the number of slabs to use for the message cache.
+	# the number of slabs must be a power of 2.
+	# more slabs reduce lock contention, but fragment memory usage.
+	# msg-cache-slabs: 4
+
+	# the number of queries that a thread gets to service.
+	# num-queries-per-thread: 1024
+
+	# the amount of memory to use for the RRset cache.
+	# in bytes. default is 4 Mb
+	# rrset-cache-size: 4194304
+
+	# the number of slabs to use for the RRset cache.
+	# the number of slabs must be a power of 2.
+	# more slabs reduce lock contention, but fragment memory usage.
+	# rrset-cache-slabs: 4
+	
+	# the time to live (TTL) value cap for RRsets and messages in the
+	# cache. Items are not cached for longer. In seconds.
+	# cache-max-ttl: 864000
+
+	# the time to live (TTL) value for cached roundtrip times and
+	# EDNS version information for hosts. In seconds.
+	# infra-host-ttl: 900
+
+	# the time to live (TTL) value for cached lame delegations. In sec.
+	# infra-lame-ttl: 900
+
+	# the number of slabs to use for the Infrastructure cache.
+	# the number of slabs must be a power of 2.
+	# more slabs reduce lock contention, but fragment memory usage.
+	# infra-cache-slabs: 4
+
+	# the maximum number of hosts that are cached (roundtrip times, EDNS).
+	# infra-cache-numhosts: 10000
+
+	# the maximum size of the lame zones cached per host. in bytes.
+	# infra-cache-lame-size: 10240
+
+	# Enable IPv4, "yes" or "no".
+	# do-ip4: yes
+
+	# Enable IPv6, "yes" or "no".
+	# do-ip6: yes
+
+	# Enable UDP, "yes" or "no".
+	# do-udp: yes
+
+	# Enable TCP, "yes" or "no".
+	# do-tcp: yes
+
+	# if given, a chroot(2) is done to the given directory.
+	# i.e. you can chroot to the working directory, for example,
+	# for extra security, but make sure all files are in that directory.
+	# If you give "" no chroot is performed.
+	# chroot: "/etc/unbound"
+
+	# if given, user privileges are dropped (after binding port),
+	# and the given username is assumed. Default is user "unbound".
+	# If you give "" no priviliges are dropped.
+	# username: "unbound"
+
+	# the working directory.
+	# directory: "/etc/unbound"
+
+	# the log file, "" means log to stderr. 
+	# Use of this option sets use-syslog to "no".
+	# logfile: ""
+	
+	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to 
+	# log to, with identity "unbound". If yes, it overrides the logfile.
+	# use-syslog: yes 
+
+	# the pid file.
+	# pidfile: "/etc/unbound/unbound.pid"
+	
+	# file to read root hints from.
+	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
+	# root-hints: ""
+	
+	# enable to not answer id.server and hostname.bind queries.
+	# hide-identity: no
+	
+	# enable to not answer version.server and version.bind queries.
+	# hide-version: no
+	
+	# the identity to report. Leave "" or default to return hostname.
+	# identity: ""
+	
+	# the version to report. Leave "" or default to return package version.
+	# version: ""
+	
+	# the target fetch policy.
+	# series of integers describing the policy per dependency depth. 
+	# The number of values in the list determines the maximum dependency 
+	# depth the recursor will pursue before giving up. Each integer means:
+	# 	-1 : fetch all targets opportunistically,
+	# 	0: fetch on demand,
+	#	positive value: fetch that many targets opportunistically.
+	# Enclose the list of numbers between quotes ("").
+	# target-fetch-policy: "3 2 1 0 0"
+	
+	# Harden against very small EDNS buffer sizes. 
+	# harden-short-bufsize: no
+	
+	# Harden against unseemly large queries.
+	# harden-large-queries: no
+	
+	# Harden against out of zone rrsets, to avoid spoofing attempts. 
+	# harden-glue: yes
+	
+	# Harden against receiving dnssec-stripped data. If you turn it
+	# off, failing to validate dnskey data for a trustanchor will 
+	# trigger insecure mode for that zone (like without a trustanchor).
+	# Default on, which insists on dnssec data for trust-anchored zones.
+	# harden-dnssec-stripped: yes
+	
+	# Do not query the following addresses. No DNS queries are sent there.
+	# List one address per entry. List classless netblocks with /size,
+	# do-not-query-address: 127.0.0.1/8
+	# do-not-query-address: ::1
+	
+	# if yes, the above default do-not-query-address entries are present.
+	# if no, localhost can be queried (for testing and debugging).
+	# do-not-query-localhost: yes
+	
+	# module configuration of the server. A string with identifiers
+	# separated by spaces. "iterator" or "validator iterator"
+	# module-config: "validator iterator"
+	
+	# File with trusted keys for validation. Specify more than one file
+	# with several entries, one file per entry.
+	# Zone file format, with DS and DNSKEY entries.
+	# trust-anchor-file: ""
+	
+	# Trusted key for validation. DS or DNSKEY. specify the RR on a
+	# single line, surrounded by "". TTL is ignored. class is IN default.
+	# (These examples are from August 2007 and may not be valid anymore).
+	# trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ=="
+	# trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"
+
+	# File with trusted keys for validation. Specify more than one file
+	# with several entries, one file per entry. Like trust-anchor-file
+	# but has a different file format. Format is BIND-9 style format, 
+	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
+	# trusted-keys-file: ""
+
+	# Override the date for validation with a specific fixed date.
+	# Do not set this unless you are debugging signature inception
+	# and expiration. "" or "0" turns the feature off. 
+	# val-override-date: ""
+	
+	# The time to live for bogus data, rrsets and messages. This avoids
+	# some of the revalidation, until the time interval expires. in secs.
+	# val-bogus-ttl: 900
+	
+	# Should additional section of secure message also be kept clean of
+	# unsecure data. Useful to shield the users of this validator from
+	# potential bogus data in the additional section. All unsigned data 
+	# in the additional section is removed from secure messages.
+	# val-clean-additional: yes
+	
+	# Turn permissive mode on to permit bogus messages. Thus, messages
+	# for which security checks failed will be returned to clients,
+	# instead of SERVFAIL. It still performs the security checks, which
+	# result in interesting log files and possibly the AD bit in
+	# replies if the message is found secure. The default is off.
+	# val-permissive-mode: no
+	
+	# It is possible to configure NSEC3 maximum iteration counts per
+	# keysize. Keep this table very short, as linear search is done.
+	# A message with an NSEC3 with larger count is marked insecure.
+	# List in ascending order the keysize and count values.
+	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
+
+	# the amount of memory to use for the key cache.
+	# in bytes. default is 4 Mb
+	# key-cache-size: 4194304
+
+	# the number of slabs to use for the key cache.
+	# the number of slabs must be a power of 2.
+	# more slabs reduce lock contention, but fragment memory usage.
+	# key-cache-slabs: 4
+
+
+# Stub zones.
+# Create entries like below, to make all queries for 'example.com' and 
+# 'example.org' go to the given list of nameservers. list zero or more 
+# nameservers by hostname or by ipaddress.
+# stub-zone:
+#	name: "example.com"
+#	stub-addr: 192.0.2.68
+# stub-zone:
+#	name: "example.org"
+#	stub-host: ns.example.com.
+
+# Forward zones
+# Create entries like below, to make all queries for 'example.com' and
+# 'example.org' go to the given list of servers. These servers have to handle
+# recursion to other nameservers. List zero or more nameservers by hostname
+# or by ipaddress. Use an entry with name "." to forward all queries.
+# forward-zone:
+# 	name: "example.com"
+# 	forward-addr: 192.0.2.68
+# 	forward-addr: 192.0.2.73@5355  # forward to port 5355.
+# forward-zone:
+# 	name: "example.org"
+# 	forward-host: fwd.example.com

doc/example.conf.in

@@ -1,491 +0,0 @@
-#
-# Example configuration file.
-#
-# See unbound.conf(5) man page.
-#
-# this is a comment.
-
-#Use this to include other text into the file.
-#include: "otherfile.conf"
-
-# The server clause sets the main parameters. 
-server:
-	# whitespace is not necessary, but looks cleaner.
-
-	# verbosity number, 0 is least verbose. 1 is default.
-	verbosity: 1
-
-	# print statistics to the log (for every thread) every N seconds.
-	# Set to "" or 0 to disable. Default is disabled.
-	# statistics-interval: 0
-
-	# enable cumulative statistics, without clearing them after printing.
-	# statistics-cumulative: no
-
-	# enable extended statistics (query types, answer codes, status)
-	# printed from unbound-control. default off, because of speed.
-	# extended-statistics: no
-
-	# number of threads to create. 1 disables threading.
-	# num-threads: 1
-
-	# specify the interfaces to answer queries from by ip-address.
-	# The default is to listen to localhost (127.0.0.1 and ::1).
-	# specify 0.0.0.0 and ::0 to bind to all available interfaces.
-	# specify every interface[@port] on a new 'interface:' labelled line.
-	# The listen interfaces are not changed on reload, only on restart.
-	# interface: 192.0.2.153
-	# interface: 192.0.2.154
-	# interface: 192.0.2.154@5003
-	# interface: 2001:DB8::5
-
-	# enable this feature to copy the source address of queries to reply.
-	# Socket options are not supported on all platforms. experimental. 
-	# interface-automatic: no
-
-	# port to answer queries from
-	# port: 53
-
-	# specify the interfaces to send outgoing queries to authoritative
-	# server from by ip-address. If none, the default (all) interface
-	# is used. Specify every interface on a 'outgoing-interface:' line.
-	# outgoing-interface: 192.0.2.153
-	# outgoing-interface: 2001:DB8::5
-	# outgoing-interface: 2001:DB8::6
-
-	# number of ports to allocate per thread, determines the size of the
-	# port range that can be open simultaneously. 
-	# outgoing-range: 256
-
-	# permit unbound to use this port number or port range for
-	# making outgoing queries, using an outgoing interface.
-	# outgoing-port-permit: 32768
-
-	# deny unbound the use this of port number or port range for
-	# making outgoing queries, using an outgoing interface.
-	# Use this to make sure unbound does not grab a UDP port that some
-	# other server on this computer needs. The default is to avoid
-	# IANA-assigned port numbers.
-	# outgoing-port-avoid: "3200-3208"
-
-	# number of outgoing simultaneous tcp buffers to hold per thread.
-	# outgoing-num-tcp: 10
-
-	# number of incoming simultaneous tcp buffers to hold per thread.
-	# incoming-num-tcp: 10
-
-	# buffer size for UDP port 53 incoming (SO_RCVBUF socket option).
-	# 0 is system default.  Use 4m to catch query spikes for busy servers.
-	# so-rcvbuf: 0
-
-	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
-	# is set with msg-buffer-size). 1480 can solve fragmentation (timeouts).
-	# edns-buffer-size: 4096
-
-	# buffer size for handling DNS data. No messages larger than this
-	# size can be sent or received, by UDP or TCP. In bytes.
-	# msg-buffer-size: 65552
-
-	# the amount of memory to use for the message cache.
-	# plain value in bytes or you can append k, m or G. default is "4Mb". 
-	# msg-cache-size: 4m
-
-	# the number of slabs to use for the message cache.
-	# the number of slabs must be a power of 2.
-	# more slabs reduce lock contention, but fragment memory usage.
-	# msg-cache-slabs: 4
-
-	# the number of queries that a thread gets to service.
-	# num-queries-per-thread: 1024
-
-	# if very busy, 50% queries run to completion, 50% get timeout in msec
-	# jostle-timeout: 200
-
-	# the amount of memory to use for the RRset cache.
-	# plain value in bytes or you can append k, m or G. default is "4Mb". 
-	# rrset-cache-size: 4m
-
-	# the number of slabs to use for the RRset cache.
-	# the number of slabs must be a power of 2.
-	# more slabs reduce lock contention, but fragment memory usage.
-	# rrset-cache-slabs: 4
-
-	# the time to live (TTL) value lower bound, in seconds. Default 0.
-	# If more than an hour could easily give trouble due to stale data.
-	# cache-min-ttl: 0
-
-	# the time to live (TTL) value cap for RRsets and messages in the
-	# cache. Items are not cached for longer. In seconds.
-	# cache-max-ttl: 86400
-
-	# the time to live (TTL) value for cached roundtrip times and
-	# EDNS version information for hosts. In seconds.
-	# infra-host-ttl: 900
-
-	# the time to live (TTL) value for cached lame delegations. In sec.
-	# infra-lame-ttl: 900
-
-	# the number of slabs to use for the Infrastructure cache.
-	# the number of slabs must be a power of 2.
-	# more slabs reduce lock contention, but fragment memory usage.
-	# infra-cache-slabs: 4
-
-	# the maximum number of hosts that are cached (roundtrip times, EDNS).
-	# infra-cache-numhosts: 10000
-
-	# the maximum size of the lame zones cached per host. in bytes.
-	# infra-cache-lame-size: 10k
-
-	# Enable IPv4, "yes" or "no".
-	# do-ip4: yes
-
-	# Enable IPv6, "yes" or "no".
-	# do-ip6: yes
-
-	# Enable UDP, "yes" or "no".
-	# do-udp: yes
-
-	# Enable TCP, "yes" or "no".
-	# do-tcp: yes
-
-	# Detach from the terminal, run in background, "yes" or "no".
-	# do-daemonize: yes
-
-	# control which clients are allowed to make (recursive) queries
-	# to this server. Specify classless netblocks with /size and action.
-	# By default everything is refused, except for localhost.
-	# Choose deny (drop message), refuse (polite error reply),
-	# allow (recursive ok), allow_snoop (recursive and nonrecursive ok)
-	# access-control: 0.0.0.0/0 refuse
-	# access-control: 127.0.0.0/8 allow
-	# access-control: ::0/0 refuse
-	# access-control: ::1 allow
-	# access-control: ::ffff:127.0.0.1 allow
-
-	# if given, a chroot(2) is done to the given directory.
-	# i.e. you can chroot to the working directory, for example,
-	# for extra security, but make sure all files are in that directory.
-	#
-	# If chroot is enabled, you should pass the configfile (from the
-	# commandline) as a full path from the original root. After the
-	# chroot has been performed the now defunct portion of the config 
-	# file path is removed to be able to reread the config after a reload. 
-	#
-	# All other file paths (working dir, logfile, roothints, and
-	# key files) can be specified in several ways:
-	# 	o as an absolute path relative to the new root.
-	# 	o as a relative path to the working directory.
-	# 	o as an absolute path relative to the original root.
-	# In the last case the path is adjusted to remove the unused portion.
-	#
-	# The pid file can be absolute and outside of the chroot, it is 
-	# written just prior to performing the chroot and dropping permissions.
-	#
-	# Additionally, unbound may need to access /dev/random (for entropy).
-	# How to do this is specific to your OS.
-	#
-	# If you give "" no chroot is performed. The path must not end in a /.
-	# chroot: "@UNBOUND_CHROOT_DIR@"
-
-	# if given, user privileges are dropped (after binding port),
-	# and the given username is assumed. Default is user "unbound".
-	# If you give "" no privileges are dropped.
-	# username: "@UNBOUND_USERNAME@"
-
-	# the working directory. The relative files in this config are 
-	# relative to this directory. If you give "" the working directory
-	# is not changed.
-	# directory: "@UNBOUND_RUN_DIR@"
-
-	# the log file, "" means log to stderr. 
-	# Use of this option sets use-syslog to "no".
-	# logfile: ""
-
-	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to 
-	# log to, with identity "unbound". If yes, it overrides the logfile.
-	# use-syslog: yes 
-
-	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
-	# log-time-ascii: no
-
-	# the pid file. Can be an absolute path outside of chroot/work dir.
-	# pidfile: "@UNBOUND_PIDFILE@"
-
-	# file to read root hints from.
-	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
-	# root-hints: ""
-
-	# enable to not answer id.server and hostname.bind queries.
-	# hide-identity: no
-
-	# enable to not answer version.server and version.bind queries.
-	# hide-version: no
-
-	# the identity to report. Leave "" or default to return hostname.
-	# identity: ""
-
-	# the version to report. Leave "" or default to return package version.
-	# version: ""
-
-	# the target fetch policy.
-	# series of integers describing the policy per dependency depth. 
-	# The number of values in the list determines the maximum dependency 
-	# depth the recursor will pursue before giving up. Each integer means:
-	# 	-1 : fetch all targets opportunistically,
-	# 	0: fetch on demand,
-	#	positive value: fetch that many targets opportunistically.
-	# Enclose the list of numbers between quotes ("").
-	# target-fetch-policy: "3 2 1 0 0"
-
-	# Harden against very small EDNS buffer sizes. 
-	# harden-short-bufsize: no
-
-	# Harden against unseemly large queries.
-	# harden-large-queries: no
-
-	# Harden against out of zone rrsets, to avoid spoofing attempts. 
-	# harden-glue: yes
-
-	# Harden against receiving dnssec-stripped data. If you turn it
-	# off, failing to validate dnskey data for a trustanchor will 
-	# trigger insecure mode for that zone (like without a trustanchor).
-	# Default on, which insists on dnssec data for trust-anchored zones.
-	# harden-dnssec-stripped: yes
-
-        # Harden the referral path by performing additional queries for
-	# infrastructure data.  Validates the replies (if possible).
-	# Default off, because the lookups burden the server.  Experimental 
-	# implementation of draft-wijngaards-dnsext-resolver-side-mitigation.
-	# harden-referral-path: no
-
-	# Use 0x20-encoded random bits in the query to foil spoof attempts.
-	# This feature is an experimental implementation of draft dns-0x20.
-	# use-caps-for-id: no
-
-	# Enforce privacy of these addresses. Strips them away from answers. 
-	# It may cause DNSSEC validation to additionally mark it as bogus. 
-	# Protects against 'DNS Rebinding' (uses browser as network proxy). 
-	# Only 'private-domain' and 'local-data' names are allowed to have 
-	# these private addresses. No default.
-	# private-address: 10.0.0.0/8
-	# private-address: 172.16.0.0/12
-	# private-address: 192.168.0.0/16
-	# private-address: 192.254.0.0/16
-	# private-address: fd00::/8
-	# private-address: fe80::/10
-
-	# Allow the domain (and its subdomains) to contain private addresses.
-	# local-data statements are allowed to contain private addresses too.
-	# private-domain: "example.com"
-
-	# If nonzero, unwanted replies are not only reported in statistics,
-	# but also a running total is kept per thread. If it reaches the
-	# threshold, a warning is printed and a defensive action is taken,
-	# the cache is cleared to flush potential poison out of it.
-	# A suggested value is 10000000, the default is 0 (turned off).
-	# unwanted-reply-threshold: 0
-
-	# Do not query the following addresses. No DNS queries are sent there.
-	# List one address per entry. List classless netblocks with /size,
-	# do-not-query-address: 127.0.0.1/8
-	# do-not-query-address: ::1
-
-	# if yes, the above default do-not-query-address entries are present.
-	# if no, localhost can be queried (for testing and debugging).
-	# do-not-query-localhost: yes
-
-	# if yes, perform prefetching of almost expired message cache entries.
-	# prefetch: no
-
-	# if yes, perform key lookups adjacent to normal lookups.
-	# prefetch-key: no
-
-	# module configuration of the server. A string with identifiers
-	# separated by spaces. "iterator" or "validator iterator"
-	# module-config: "validator iterator"
-
-	# File with DLV trusted keys. Same format as trust-anchor-file.
-	# There can be only one DLV configured, it is trusted from root down.
-	# Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
-	# dlv-anchor-file: "dlv.isc.org.key"
-
-	# File with trusted keys for validation. Specify more than one file
-	# with several entries, one file per entry.
-	# Zone file format, with DS and DNSKEY entries.
-	# trust-anchor-file: ""
-	
-	# File with trusted keys, kept uptodate using RFC5011 probes,
-	# initial file like trust-anchor-file, then it stores metadata.
-	# Use several entries, one per domain name, to track multiple zones.
-	# auto-trust-anchor-file: ""
-
-	# Trusted key for validation. DS or DNSKEY. specify the RR on a
-	# single line, surrounded by "". TTL is ignored. class is IN default.
-	# (These examples are from August 2007 and may not be valid anymore).
-	# trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ=="
-	# trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"
-
-	# File with trusted keys for validation. Specify more than one file
-	# with several entries, one file per entry. Like trust-anchor-file
-	# but has a different file format. Format is BIND-9 style format, 
-	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
-	# trusted-keys-file: ""
-
-	# Ignore chain of trust. Domain is treated as insecure.
-	# domain-insecure: "example.com"
-
-	# Override the date for validation with a specific fixed date.
-	# Do not set this unless you are debugging signature inception
-	# and expiration. "" or "0" turns the feature off. 
-	# val-override-date: ""
-
-	# The time to live for bogus data, rrsets and messages. This avoids
-	# some of the revalidation, until the time interval expires. in secs.
-	# val-bogus-ttl: 60
-
-	# The signature inception and expiration dates are allowed to be off
-	# by 10% of the signature lifetime (expir-incep) from our local clock.
-	# This leeway is capped with a minimum and a maximum.  In seconds.
-	# val-sig-skew-min: 3600
-	# val-sig-skew-max: 86400
-
-	# Should additional section of secure message also be kept clean of
-	# unsecure data. Useful to shield the users of this validator from
-	# potential bogus data in the additional section. All unsigned data 
-	# in the additional section is removed from secure messages.
-	# val-clean-additional: yes
-
-	# Turn permissive mode on to permit bogus messages. Thus, messages
-	# for which security checks failed will be returned to clients,
-	# instead of SERVFAIL. It still performs the security checks, which
-	# result in interesting log files and possibly the AD bit in
-	# replies if the message is found secure. The default is off.
-	# val-permissive-mode: no
-
-	# Have the validator log failed validations for your diagnosis.
-	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
-	# val-log-level: 0
-
-	# It is possible to configure NSEC3 maximum iteration counts per
-	# keysize. Keep this table very short, as linear search is done.
-	# A message with an NSEC3 with larger count is marked insecure.
-	# List in ascending order the keysize and count values.
-	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
-	
-	# instruct the auto-trust-anchor-file probing to add anchors after ttl.
-	# add-holddown: 2592000 # 30 days
-
-	# instruct the auto-trust-anchor-file probing to del anchors after ttl.
-	# del-holddown: 2592000 # 30 days
-
-	# auto-trust-anchor-file probing removes missing anchors after ttl.
-	# If the value 0 is given, missing anchors are not removed.
-	# keep-missing: 31622400 # 366 days
-
-	# the amount of memory to use for the key cache.
-	# plain value in bytes or you can append k, m or G. default is "4Mb". 
-	# key-cache-size: 4m
-
-	# the number of slabs to use for the key cache.
-	# the number of slabs must be a power of 2.
-	# more slabs reduce lock contention, but fragment memory usage.
-	# key-cache-slabs: 4
-
-	# the amount of memory to use for the negative cache (used for DLV).
-	# plain value in bytes or you can append k, m or G. default is "1Mb". 
-	# neg-cache-size: 1m
-
-	# a number of locally served zones can be configured.
-	# 	local-zone: <zone> <type>
-	# 	local-data: "<resource record string>"
-	# o deny serves local data (if any), else, drops queries. 
-	# o refuse serves local data (if any), else, replies with error.
-	# o static serves local data, else, nxdomain or nodata answer.
-	# o transparent gives local data, but resolves normally for other names
-	# o redirect serves the zone data for any subdomain in the zone.
-	# o nodefault can be used to normally resolve AS112 zones.
-	#
-	# defaults are localhost address, reverse for 127.0.0.1 and ::1
-	# and nxdomain for AS112 zones. If you configure one of these zones
-	# the default content is omitted, or you can omit it with 'nodefault'.
-	# 
-	# If you configure local-data without specifying local-zone, by
-	# default a transparent local-zone is created for the data.
-	#
-	# You can add locally served data with
-	# local-zone: "local." static
-	# local-data: "mycomputer.local. IN A 192.0.2.51"
-	# local-data: 'mytext.local TXT "content of text record"'
-	#
-	# You can override certain queries with
-	# local-data: "adserver.example.com A 127.0.0.1"
-	#
-	# You can redirect a domain to a fixed address with
-	# (this makes example.com, www.example.com, etc, all go to 192.0.2.3)
-	# local-zone: "example.com" redirect
-	# local-data: "example.com A 192.0.2.3"
-	#
-	# Shorthand to make PTR records, "IPv4 name" or "IPv6 name".
-	# You can also add PTR records using local-data directly, but then
-	# you need to do the reverse notation yourself.
-	# local-data-ptr: "192.0.2.3 www.example.com"
-
-# Python config section. To enable:
-# o use --with-pythonmodule to configure before compiling.
-# o list python in the module-config string (above) to enable.
-# o and give a python-script to run.
-python:
-	# Script file to load
-	# python-script: "@UNBOUND_SHARE_DIR@/ubmodule-tst.py"
-
-# Remote control config section. 
-remote-control:
-	# Enable remote control with unbound-control(8) here.
-	# set up the keys and certificates with unbound-control-setup.
-	# control-enable: no
-
-	# what interfaces are listened to for remote control.
-	# give 0.0.0.0 and ::0 to listen to all interfaces.
-	# control-interface: 127.0.0.1
-	# control-interface: ::1
-
-	# port number for remote control operations.
-	# control-port: 953
-
-	# unbound server key file.
-	# server-key-file: "@UNBOUND_RUN_DIR@/unbound_server.key"
-
-	# unbound server certificate file.
-	# server-cert-file: "@UNBOUND_RUN_DIR@/unbound_server.pem"
-
-	# unbound-control key file.
-	# control-key-file: "@UNBOUND_RUN_DIR@/unbound_control.key"
-
-	# unbound-control certificate file.
-	# control-cert-file: "@UNBOUND_RUN_DIR@/unbound_control.pem"
-
-# Stub zones.
-# Create entries like below, to make all queries for 'example.com' and 
-# 'example.org' go to the given list of nameservers. list zero or more 
-# nameservers by hostname or by ipaddress. If you set stub-prime to yes, 
-# the list is treated as priming hints (default is no).
-# stub-zone:
-#	name: "example.com"
-#	stub-addr: 192.0.2.68
-#	stub-prime: no
-# stub-zone:
-#	name: "example.org"
-#	stub-host: ns.example.com.
-
-# Forward zones
-# Create entries like below, to make all queries for 'example.com' and
-# 'example.org' go to the given list of servers. These servers have to handle
-# recursion to other nameservers. List zero or more nameservers by hostname
-# or by ipaddress. Use an entry with name "." to forward all queries.
-# forward-zone:
-# 	name: "example.com"
-# 	forward-addr: 192.0.2.68
-# 	forward-addr: 192.0.2.73@5355  # forward to port 5355.
-# forward-zone:
-# 	name: "example.org"
-# 	forward-host: fwd.example.com

doc/libunbound.3.in

@@ -1,383 +0,0 @@
-.TH "libunbound" "3" "@date@" "NLnet Labs" "unbound @version@"
-.\"
-.\" libunbound.3 -- unbound library functions manual
-.\"
-.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
-.\"
-.\" See LICENSE for the license.
-.\"
-.\"
-.SH "NAME"
-.LP
-.B libunbound,
-.B unbound.h,
-.B ub_ctx,
-.B ub_result,
-.B ub_callback_t,
-.B ub_ctx_create,
-.B ub_ctx_delete,
-.B ub_ctx_set_option,
-.B ub_ctx_get_option,
-.B ub_ctx_config,
-.B ub_ctx_set_fwd,
-.B ub_ctx_resolvconf,
-.B ub_ctx_hosts,
-.B ub_ctx_add_ta,
-.B ub_ctx_add_ta_file,
-.B ub_ctx_trustedkeys,
-.B ub_ctx_debugout,
-.B ub_ctx_debuglevel,
-.B ub_ctx_async,
-.B ub_poll,
-.B ub_wait,
-.B ub_fd,
-.B ub_process,
-.B ub_resolve,
-.B ub_resolve_async,
-.B ub_cancel,
-.B ub_resolve_free,
-.B ub_strerror,
-.B ub_ctx_print_local_zones,
-.B ub_ctx_zone_add,
-.B ub_ctx_zone_remove,
-.B ub_ctx_data_add,
-.B ub_ctx_data_remove
-\- Unbound DNS validating resolver @version@ functions.
-.SH "SYNOPSIS"
-.LP
-.B #include <unbound.h>
-.LP
-\fIstruct ub_ctx *\fR
-\fBub_ctx_create\fR(\fIvoid\fR);
-.LP
-\fIvoid\fR
-\fBub_ctx_delete\fR(\fIstruct ub_ctx*\fR ctx);
-.LP
-\fIint\fR
-\fBub_ctx_set_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar*\fR val);
-.LP
-\fIint\fR
-\fBub_ctx_get_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar**\fR val);
-.LP
-\fIint\fR
-\fBub_ctx_config\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
-.LP
-\fIint\fR
-\fBub_ctx_set_fwd\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR addr);
-.LP
-\fIint\fR
-\fBub_ctx_resolvconf\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
-.LP
-\fIint\fR
-\fBub_ctx_hosts\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
-.LP
-\fIint\fR
-\fBub_ctx_add_ta\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR ta);
-.LP
-\fIint\fR
-\fBub_ctx_add_ta_file\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
-.LP
-\fIint\fR
-\fBub_ctx_trustedkeys\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
-.LP
-\fIint\fR
-\fBub_ctx_debugout\fR(\fIstruct ub_ctx*\fR ctx, \fIFILE*\fR out);
-.LP
-\fIint\fR
-\fBub_ctx_debuglevel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR d);
-.LP
-\fIint\fR
-\fBub_ctx_async\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR dothread);
-.LP
-\fIint\fR
-\fBub_poll\fR(\fIstruct ub_ctx*\fR ctx);
-.LP
-\fIint\fR
-\fBub_wait\fR(\fIstruct ub_ctx*\fR ctx);
-.LP
-\fIint\fR
-\fBub_fd\fR(\fIstruct ub_ctx*\fR ctx);
-.LP
-\fIint\fR
-\fBub_process\fR(\fIstruct ub_ctx*\fR ctx);
-.LP
-\fIint\fR
-\fBub_resolve\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
-.br
-           \fIint\fR rrtype, \fIint\fR rrclass, \fIstruct ub_result**\fR result);
-.LP
-\fIint\fR
-\fBub_resolve_async\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
-.br
-                 \fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata, 
-.br
-                 \fIub_callback_t\fR callback, \fIint*\fR async_id);
-.LP
-\fIint\fR
-\fBub_cancel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR async_id);
-.LP
-\fIvoid\fR
-\fBub_resolve_free\fR(\fIstruct ub_result*\fR result);
-.LP
-\fIconst char *\fR
-\fBub_strerror\fR(\fIint\fR err);
-.LP
-\fIint\fR
-\fBub_ctx_print_local_zones\fR(\fIstruct ub_ctx*\fR ctx);
-.LP
-\fIint\fR
-\fBub_ctx_zone_add\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone_name, \fIchar*\fR zone_type);
-.LP
-\fIint\fR
-\fBub_ctx_zone_remove\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone_name);
-.LP
-\fIint\fR
-\fBub_ctx_data_add\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR data);
-.LP
-\fIint\fR
-\fBub_ctx_data_remove\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR data);
-.SH "DESCRIPTION"
-.LP
-.B Unbound 
-is an implementation of a DNS resolver, that does caching and 
-DNSSEC validation. This is the library API, for using the \-lunbound library.
-The server daemon is described in \fIunbound\fR(8).
-The library can be used to convert hostnames to ip addresses, and back,
-and obtain other information from the DNS. The library performs public\-key
-validation of results with DNSSEC.
-.P
-The library uses a variable of type \fIstruct ub_ctx\fR to keep context
-between calls. The user must maintain it, creating it with
-.B ub_ctx_create
-and deleting it with
-.B ub_ctx_delete\fR.
-It can be created and deleted at any time. Creating it anew removes any 
-previous configuration (such as trusted keys) and clears any cached results.
-.P
-The functions are thread\-safe, and a context an be used in a threaded (as 
-well as in a non\-threaded) environment. Also resolution (and validation) 
-can be performed blocking and non\-blocking (also called asynchronous). 
-The async method returns from the call immediately, so that processing 
-can go on, while the results become available later. 
-.P
-The functions are discussed in turn below.
-.SH "FUNCTIONS"
-.TP 
-.B ub_ctx_create
-Create a new context, initialised with defaults.
-The information from /etc/resolv.conf and /etc/hosts is not utilised 
-by default. Use 
-.B ub_ctx_resolvconf
-and
-.B ub_ctx_hosts
-to read them.
-.TP
-.B ub_ctx_delete
-Delete validation context and free associated resources.
-Outstanding async queries are killed and callbacks are not called for them.
-.TP
-.B ub_ctx_set_option
-A power\-user interface that lets you specify one of the options from the
-config file format, see \fIunbound.conf\fR(5). Not all options are
-relevant. For some specific options, such as adding trust anchors, special
-routines exist. Pass the option name with the trailing ':'.
-.TP
-.B ub_ctx_get_option
-A power\-user interface that gets an option value.  Some options cannot be
-gotten, and others return a newline separated list.  Pass the option name
-without trailing ':'.  The returned value must be free(2)d by the caller.
-.TP
-.B ub_ctx_config
-A power\-user interface that lets you specify an unbound config file, see
-\fIunbound.conf\fR(5), which is read for configuration. Not all options are
-relevant. For some specific options, such as adding trust anchors, special
-routines exist.
-.TP
-.B ub_ctx_set_fwd
-Set machine to forward DNS queries to, the caching resolver to use. 
-IP4 or IP6 address. Forwards all DNS requests to that machine, which 
-is expected to run a recursive resolver. If the proxy is not 
-DNSSEC capable, validation may fail. Can be called several times, in 
-that case the addresses are used as backup servers.
-At this time it is only possible to set configuration before the
-first resolve is done.
-.TP
-.B ub_ctx_resolvconf
-Read list of nameservers to use from the filename given.
-Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
-If they do not support DNSSEC, validation may fail.
-Only nameservers are picked up, the searchdomain, ndots and other
-settings from \fIresolv.conf\fR(5) are ignored.
-If fname NULL is passed, "/etc/resolv.conf" is used (if on Windows, 
-the system\-wide configured nameserver is picked instead).
-At this time it is only possible to set configuration before the
-first resolve is done.
-.TP
-.B ub_ctx_hosts
-Read list of hosts from the filename given.
-Usually "/etc/hosts". When queried for, these addresses are not marked 
-DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used 
-(if on Windows, etc/hosts from WINDIR is picked instead).
-At this time it is only possible to set configuration before the
-first resolve is done.
-.TP
-.B
-ub_ctx_add_ta
-Add a trust anchor to the given context.
-At this time it is only possible to add trusted keys before the
-first resolve is done.
-The format is a string, similar to the zone\-file format,
-[domainname] [type] [rdata contents]. Both DS and DNSKEY records are accepted.
-.TP
-.B ub_ctx_add_ta_file
-Add trust anchors to the given context.
-Pass name of a file with DS and DNSKEY records in zone file format.
-At this time it is only possible to add trusted keys before the
-first resolve is done.
-.TP
-.B ub_ctx_trustedkeys
-Add trust anchors to the given context.
-Pass the name of a bind\-style config file with trusted\-keys{}.
-At this time it is only possible to add trusted keys before the
-first resolve is done.
-.TP
-.B ub_ctx_debugout
-Set debug and error log output to the given stream. Pass NULL to disable
-output. Default is stderr. File\-names or using syslog can be enabled
-using config options, this routine is for using your own stream.
-.TP
-.B ub_ctx_debuglevel
-Set debug verbosity for the context. Output is directed to stderr.
-Higher debug level gives more output.
-.TP
-.B ub_ctx_async
-Set a context behaviour for asynchronous action.
-if set to true, enables threading and a call to 
-.B ub_resolve_async 
-creates a thread to handle work in the background.
-If false, a process is forked to handle work in the background.
-Changes to this setting after 
-.B ub_resolve_async 
-calls have been made have no effect (delete and re\-create the context 
-to change).
-.TP
-.B ub_poll
-Poll a context to see if it has any new results.
-Do not poll in a loop, instead extract the fd below to poll for readiness,
-and then check, or wait using the wait routine.
-Returns 0 if nothing to read, or nonzero if a result is available.
-If nonzero, call 
-.B ub_process 
-to do callbacks.
-.TP
-.B ub_wait
-Wait for a context to finish with results. Calls 
-.B ub_process 
-after the wait for you. After the wait, there are no more outstanding 
-asynchronous queries.
-.TP
-.B ub_fd
-Get file descriptor. Wait for it to become readable, at this point
-answers are returned from the asynchronous validating resolver.
-Then call the \fBub_process\fR to continue processing.
-.TP
-.B ub_process
-Call this routine to continue processing results from the validating
-resolver (when the fd becomes readable).
-Will perform necessary callbacks.
-.TP
-.B ub_resolve
-Perform resolution and validation of the target name.
-The name is a domain name in a zero terminated text string.
-The rrtype and rrclass are DNS type and class codes.
-The result structure is newly allocated with the resulting data.
-.TP
-.B ub_resolve_async
-Perform asynchronous resolution and validation of the target name.
-Arguments mean the same as for \fBub_resolve\fR except no
-data is returned immediately, instead a callback is called later.
-The callback receives a copy of the mydata pointer, that you can use to pass
-information to the callback. The callback type is a function pointer to
-a function declared as
-.IP
-void my_callback_function(void* my_arg, int err, 
-.br
-                  struct ub_result* result);
-.IP
-The async_id is returned so you can (at your option) decide to track it
-and cancel the request if needed.  If you pass a NULL pointer the async_id
-is not returned. 
-.TP
-.B ub_cancel
-Cancel an async query in progress.  This may return an error if the query
-does not exist, or the query is already being delivered, in that case you 
-may still get a callback for the query.
-.TP
-.B ub_resolve_free
-Free struct ub_result contents after use.
-.TP
-.B ub_strerror
-Convert error value from one of the unbound library functions 
-to a human readable string.
-.TP
-.B ub_ctx_print_local_zones
-Debug printout the local authority information to debug output.
-.TP
-.B ub_ctx_zone_add
-Add new zone to local authority info, like local\-zone \fIunbound.conf\fR(5) 
-statement.
-.TP
-.B ub_ctx_zone_remove
-Delete zone from local authority info.
-.TP
-.B ub_ctx_data_add
-Add resource record data to local authority info, like local\-data
-\fIunbound.conf\fR(5) statement.
-.TP
-.B ub_ctx_data_remove
-Delete local authority data from the name given.
-.SH "RESULT DATA STRUCTURE"
-.LP
-The result of the DNS resolution and validation is returned as 
-\fIstruct ub_result\fR. The result structure contains the following entries.
-.P
-.nf
-	struct ub_result {
-		char* qname; /* text string, original question */
-		int qtype;   /* type code asked for */
-		int qclass;  /* class code asked for */
-		char** data; /* array of rdata items, NULL terminated*/
-		int* len;    /* array with lengths of rdata items */
-		char* canonname; /* canonical name of result */
-		int rcode;   /* additional error code in case of no data */
-		void* answer_packet; /* full network format answer packet */
-		int answer_len; /* length of packet in octets */
-		int havedata; /* true if there is data */
-		int nxdomain; /* true if nodata because name does not exist */
-		int secure;  /* true if result is secure */
-		int bogus;   /* true if a security failure happened */
-		char* why_bogus; /* string with error if bogus */
-	};
-.fi
-.P
-If both secure and bogus are false, security was not enabled for the 
-domain of the query.
-.SH "RETURN VALUES"
-Many routines return an error code. The value 0 (zero) denotes no error
-happened. Other values can be passed to
-.B ub_strerror
-to obtain a readable error string.
-.B ub_strerror
-returns a zero terminated string.
-.B ub_ctx_create
-returns NULL on an error (a malloc failure).
-.B ub_poll
-returns true if some information may be available, false otherwise.
-.B ub_fd
-returns a file descriptor or \-1 on error.
-.SH "SEE ALSO"
-\fIunbound.conf\fR(5), 
-\fIunbound\fR(8).
-.SH "AUTHORS"
-.B Unbound
-developers are mentioned in the CREDITS file in the distribution.

doc/plan

@@ -0,0 +1,320 @@
+Plan for Unbound.
+
+Split into a set of boxes.  Every box will take about 3 weeks to a month
+to complete.  The first set of of boxes (approx 5 months) will need coding
+by a limited set of people.  But after every box, a 0.x release is done, 
+which is then tested and code review is done.  
+
+Every box:
+ * implement the features
+ * documentation of those features
+ * test-framework for the new features
+ * tests for the new features
+ * speed test of this stage
+ * release of 0.x version (0.x for development only)
+ * a teleconference(jabber) held to discuss.
+ * code review internal couple of days, external a week or so,
+   while we continue the next box. 
+
+Roughly the boxes are as follows:
+0.0 initial setup - results in network code that forwards queries
+    and returns the reply (no cache), but also testbed, svn, maillist.
+    One query at a time (nonblocking IO though).
+0.1 threads - results in threaded forwarder
+0.2 LRU hashtable, results in basic caching forwarder (no DNS parse)
+0.3 First functionality - results in caching forwarder (with DNS parse,
+    query compare, RR specific updates).
+0.4 Basic resolver - module layout, iterator module, scrubber module,
+    results in resolver that can service multiple queries per thread.
+    This stage takes longer, due to complexity in the iterator module.
+    Twice as long; one box for module layout, one box for iterator module.
+0.5 Validator - validator module.
+0.6 Bigger and better - Operational useful features (config, log, memory)
+0.7 Put to a limited audience.
+    gamma/alpha core functionality test release, to a small audience.
+    partial functionality. For more extensive use and testing.
+0.8 Local zones feature - localzones stubzones fwdzones, no leak rfc1918.
+    views support; for selective recursive service.
+0.9 Library use - resolver validator lib (and test apps)
+0.10 Corner cases - be able to resolve in the wild. Run fuzzers.
+    Run as many tests as we can think of.
+    Go through logs and check for long, unresolved cases
+    Use profiler.
+0.11 Beta release. Run shadow for a resolver in production for several
+    weeks.
+0.12 Features features
+    aggressive negative caching for NSEC, NSEC3.
+    multiple queries per question, server exploration, server selection.
+    option to use real entropy for randomness (mix it in once in a while).
+    check query, option to enforce qdsection checking (forgery-resilience).
+    NSID support.
+    Be able to prime roots using several queries (only NS on first).
+
+For boxes 0.5-1.0 the planning is to be revised, at the 0.5 stage external
+coders are welcome.  Since the project is bigger, there is room for them.
+
+This is a summary of the items.  Below more detailed work items are spelled
+out with a (tentative) directory structure for the project.
+
+
+Styleguide:
+* write working stuff. (it starts to work with no features)
+* write tests immediately for every function, every feature.
+* document as you go. (doxygen comments, manpages and readme).
+* copyright every file BSD. comments every file. clean coding in C.
+* every day discuss state of the nation for 10 minutes.
+
+*** Initial setup
+* setup svn repo. Makefile with automatic dependencies and configure script.
+	* link with ldns.
+* listen_dnsport and outside_network services, (unit) tests for them.
+	* use libevent to listen on fds.
+* setup test infrastructure (tpkg on checkin; testbed on labs test machines).
+* daemon version that forwards queries. (listen, send) Tests for it.
+	* test by having the outside_net service grab answers from a
+	  file instead of network, file of id priority answerpacket.
+	  and what query to give this answer to, highprio matches first.
+
+*** Threads
+* first simple config file reading/writing and tests on config file.
+  (config option is forwarder: yes/no. Cache size. That sort of thing.)
+  (very simple format)
+* First simple logging (to a file).
+* Threads
+	* check if pthread lib is the one to use (sys specific is faster?).
+	* make config option to have threads.
+	* alloc threadable.
+	* locks.c
+	* Tests with and without threads.
+* alloc_service. Tests for alloc service (unit tests in internal structs).
+* threading for the network services.
+* Make sure threading/libevent starts working on all test machines.
+  Use configure to turn off threading/libevent/...
+  -- use libevent packaged together if not in system.
+  -- maybe also for pthreads/...
+* threaded forwarder version.
+	* speed test of threaded version.
+
+*** LRU hashtable.
+* mini msg/reply structure for LRU hashtable test, simple replay format. 
+* hashtable+LRU structure. Tests on structure.
+	* tests on enter/remove, finding items.
+	* tests on LRU movements.
+	* Test on speed of finding items.
+* slabbed hashtable+LRU structure. 
+	* Test locking; perhaps by having sleeps in some threads to force
+	  locks to contend. helgrind.
+* daemon upgraded to be a caching forwarder. So it stores all in cache. 
+  Replies from cache. Tests on fake-caching forwarder functionality.
+	* timeout of data test
+	* finding data in cache.
+	* finding data not in cache.
+	* lru falloff of data.
+* Speed test of fake-caching forwarder.
+
+*** First functionality
+* implement dname type and unit tests on it. (all corner cases, random cases)
+* implement rrset type and tests. (all corner cases, random cases).
+* msg-reply structure. unit tests of structure.
+	* Test of those rrset pointers
+* daemon upgraded to be a caching forwarder. So it stores all in cache. 
+  Replies from cache. Tests on caching forwarder functionality.
+	* timeout of data test
+	* finding data in cache.
+	* finding data not in cache.
+	* lru falloff of data.
+* Test update of one rrset in cached packet.
+* Speed test of caching forwarder.
+
+*** Basic Resolver
+* Create module interface and module caller algorithm.
+* Daemon config to use modules. Test the module caller.
+* Create basic iterator and scrubber modules.
+	* Test every state of the iterator by passing test data into
+	  it.
+	* And scrubber.
+* Daemon config as cache(iterator).
+	* Test daemon
+	* Speed test.
+
+*** Validator
+* Create validator 
+* Test validator on various conditions. By having stored set of
+  domains and RRs in those domains to return to validator.
+* Validating resolver.
+	* Test resolver.
+	* Speed test.
+
+*** Put to a limited audience
+* The alpha/gamma core functionality, svn access to limited audience.
+* Support features and requests as they arise.
+* Provide real-world experiences.
+
+*** Bigger and Better
+* Config file syntax checker program. Tests on checker.
+* Logging first class feature with config options.
+	X with logfile turnover to avoid Gbs of logs.
+	* use syslog optional.
+* donotqueryaddresses with trie for blocking entire netblocks.
+* Memory overhaul, special allocators for hashtable caches, and mesh qstates.
+	* keep a preallocated list of region-chunks per worker thread.
+	* allocate region struct and cleanup list in region itself; use
+	  linked list cleanup list. unit test on this. do not call region
+	  to avoid name-collision with nsd regions, 'regional'.
+* read root hints from file.
+* failover to next server in 1 second, instead of 100 seconds on one server.
+X failure to return answer, w. reason (donotq, noanswer servers, cannot
+  find servers, validationfail w.classification, error), 
+  with threadno, starttime and endtime and qname/type/class, prime/qflags, 
+  from-clients, from-internal, has-subrequests, a nice error report,
+  so that an excerpt from those times can be made from the logs.
+  logfileparsing tool that makes these excerpts and emails them.
+  Not done; user can change verbosity and kill -HUP.
+* clear cache as a callback from the new-rrset-id routine.
+X make overload mode work; phase 0 all ok, phase 1 some threads close ports,
+  to let other threads pick up work. phase 2, all threads closed, so all open
+  the ports again and drop all non-cache-reply queries.
+  Keep mutexed num-overloaded-threads counter. thread incs it when it hits
+  max number of user queries serviced in mesh. threads decs it when it
+  falls below 90% of the max. if incs, and not all threads closed, phase 1,
+  else, phase 2 start is broadcast over command pipes. if decs, open ports
+  if phase 1, start servicing, phase is 0 again. Make robust against delays.
+  readme: max about 1 second worth of incoming queries, 10k perhaps,
+	or 1/number of seconds it takes start up of 10k.
+  Not done. Implement drop when full. 
+* the source includes a copy of the ldns lib for ease of building by 
+  new users. Detect system installed ldns, if installed ldns is OK; use 
+  dynamic linking against it, otherwise static linking against packaged ldns.
+* no greedy TTL algo (and test). 
+* maximum TTL, cap incoming values, and config option.
+
+*** Local zones feature.
+* Build in local zone features. First the total stop for1912.
+* Then 'local content' for minimal serving of localhost.localdomain,
+  and so on. 
+* Remember jakob's diagram. views support, selective recursive service:
+	* acl for allowed recursion (RD=1), then drop or refused query.
+	  like 10.0.0.0/8 allow, 0.0.0.0/0 refuse, ... in-order.
+	  perhaps also, same list to disallow RD=0 access, like;
+	  allow_recursion, drop_recursion, refuse_recursion, drop_all
+	* static answers for queries, fixed RRs from cfg, option
+	  query for that RR returns answer with that RR.
+	* blacklist (return fixed nxdomain for domain and below), option
+	  can be used to block AS112 traffic, option to unblock a zone.
+	* after checking acl, do iter: static, blacklist, forwards, recurse.
+* Forward-local-zone to NSD.
+	- include in package, autoforkexec on localhost to do so.
+* forward local zone to remote server.
+* stub zones - send queries for a zone to configged nameserver.
+* test local zones
+	* for speed
+	* for correctness on corner cases
+	* for validation
+	* in case you get data on localzone in an answer (from rootserver).
+
+*** Library use
+* Create library that can do:
+	* resolver
+	* validator
+	* validating resolver.
+* Test application that links the library. (Like /usr/bin/host+validating).
+	* Test it.
+
+*** Corner cases
+* Try to setup corner cases of (mis)configured DNS service/websites.
+* Resolve msoft, google, yahoo, etc weird websites.
+* Try to resolve many many different queries, perhaps compared with bind.
+* create module testers, specific for the modules
+	* read a file with cache contents and settings, provide fake
+	  environment for module-handle-state-X functions, then check
+	  resulting module state structure to correct answer.
+* speed test cache responses.
+* using two servers, compare answer differences between bind and unbound.
+  this gives false differences due to changes in the rest of internet.
+
+*** Beta release. 
+* Run shadow for a resolver in production for several weeks.
+* Check logs for errors, long queries.
+* Run in valgrind, speed profiling (as production shadow).
+
+*** Features features
+* aggressive negative caching for NSEC, NSEC3.
+* multiple queries per question, server exploration, server selection.
+* option to use real entropy for randomness (mix it in once in a while).
+* check query, enforce qdsection, checking for forgery-resilience.
+* NSID support.
+* support TSIG on queries, for validating resolver deployment.
+* Nicer statistics
+* private TTL, dTLS features.
+* retry-mode, where a bogus result triggers a retry-mode query, where a list
+  of responses over a time interval is collected, and each is validated.
+* draft-timers, DLV features.
+
+treeshrew/
+	validator/ *.c *.h
+		module takes qname, qtype, asks next module for answer
+		and validates that answer.
+	iterator/ *.c *.h
+		module takes qname, qtype, iterative DNS queries
+		never asks next module.
+	services/
+		- Routines that provide the callback services for modules.
+
+		alloc_service: L1, L2 alloc service
+		outside_network: pending queries helpers.
+			pending query structure
+		listen_dnsport: listen port53 service.
+			request structure
+		type_caches/
+			rrset_cache
+			msg_cache
+				rrset and msg cache check local zones.
+			infra_cache
+			trusted_key_cache
+	util/
+		- Various components from which to build the rest.
+
+		storage/
+		rbtree: redblack tree, for L1 use.
+			- copy from NSD.
+		hashtable and hashfunc: for L1 use.
+		locked_hashtable: for L2 use. -- not needed.
+		fragment_hashtable: for L2 use.
+		fragment_rbtree: for L2 use.
+		slab_allocator: perhaps to support alloc service.
+
+		(in util/ itself)
+		locks: selected lock,unlock (spinlock/mutex).
+		config: reads, stores config file
+		netio: register callbacks to select().
+			- use libevent (!)
+			- copy from NSD.
+		log: error and log handling.
+		module.h: module interface
+		misc: time() wrapper for speed.
+
+		data/
+		msg_reply: qname/qtype/CD/qclass/reply store.
+		packed_rrset: main datatype
+		dname: compare, printf, parse
+
+	testcode/
+		main programs that do unit tests, using testdata
+	testdata/
+	daemon/
+		unbound.c for validating caching recursive dns server.
+		scheduler.c for the modules.
+
+	libunbound/
+		app linkable. Can be configged to do whatever,
+		validator, iterator, validating iterator, forwarding stub.
+	libforwardbound/
+		app linkable forwarding stub. Small lib.
+
+	ask_cachor/ *.c *.h
+		module takes qname, qtype, returns answer from msgcache.
+		could ask cached for answer (and wait for network, 10 ms).
+		if not in cache, asks next module.
+	cachord/
+		main.c, simple udp proto, query or store msg in cache.
+		supports option to save cache to disk (absolute time ttls).

doc/requirements.txt

@@ -34,7 +34,7 @@ then interface with the modules to perform the necessary processing.
 
 In Section 2 the origins of the Unbound project are documented. Section
 3 lists the goals, while Section 4 lists the explicit non-goals of the
-project. Section 5 discusses choices made during development.
+project.
 
 
 2. History
@@ -138,7 +138,7 @@ o The method by which dnssec-lameness is detected is not secure. DNSSEC lame
   before the validator will properly verify the messages.
 
   Also for zones for which no chain of trust exists, but a DS is given by the
-  parent, dnssec-lameness detection enables. This delivers dnssec to our 
+  parent, dnssec-lameness detection enables. This delivers dnnsec to our 
   clients when possible (for client validators).
 
   The following issue needs to be resolved:
@@ -175,120 +175,3 @@ o authority features.
   You can put authority data on a separate server, and set the server in 
   unbound.conf as stub for those zones, this allows clients to access data 
   from the server without making unbound authoritative for the zones.
-
-o the access control denies queries before any other processing.
-  This denies queries that are not authoritative, or version.bind, or any.
-  And thus prevents cache-snooping (denied hosts cannot make non-recursive
-  queries and get answers from the cache).
-
-o If a client makes a query without RD bit, in the case of a returned 
-  message from cache which is:
-	answer section: empty
-	auth section: NS record present, no SOA record, no DS record, 
-		maybe NSEC or NSEC3 records present.
-	additional: A records or other relevant records.
-  A SOA record would indicate that this was a NODATA answer.
-  A DS records would indicate a referral.
-  Absence of NS record would indicate a NODATA answer as well.
-
-  Then the receiver does not know whether this was a referral
-  with attempt at no-DS proof) or a nodata answer with attempt
-  at no-data proof. It could be determined by attempting to prove
-  either condition; and looking if only one is valid, but both 
-  proofs could be valid, or neither could be valid, which creates
-  doubt. This case is validated by unbound as a 'referral' which
-  ascertains that RRSIGs are OK (and not omitted), but does not
-  check NSEC/NSEC3. 
-
-o Case preservation
-  Unbound preserves the casing received from authority servers as best 
-  as possible. It compresses without case, so case can get lost there.
-  The casing from the query name is used in preference to the casing
-  of the authority server. This is the same as BIND. RFC4343 allows either 
-  behaviour.
- 
-o Denial of service protection
-  If many queries are made, and they are made to names for which the
-  authority servers do not respond, then the requestlist for unbound
-  fills up fast.  This results in denial of service for new queries.
-  To combat this the first 50% of the requestlist can run to completion.
-  The last 50% of the requestlist get (200 msec) at least and are replaced
-  by newer queries when older (LIFO).
-  When a new query comes in, and a place in the first 50% is available, this
-  is preferred.  Otherwise, it can replace older queries out of the last 50%.
-  Thus, even long queries get a 50% chance to be resolved.  And many 'short'
-  one or two round-trip resolves can be done in the last 50% of the list.
-  The timeout can be configured.
-
-o EDNS fallback. Is done according to the EDNS RFC (and update draft-00).
-  Unbound assumes EDNS 0 support for the first query.  Then it can detect
-  support (if the servers replies) or non-support (on a NOTIMPL or FORMERR).
-  Some middleboxes drop EDNS 0 queries, mainly when forwarding, not when
-  routing packets.  To detect this, when timeouts keep happening, as the
-  timeout approached 5-10 seconds, and EDNS status has not been detected yet,
-  a single probe query is sent.  This probe has a sub-second timeout, and
-  if the server responds (quickly) without EDNS, this is cached for 15 min.
-  This works very well when detecting an address that you use much - like
-  a forwarder address - which is where the middleboxes need to be detected.
-  Otherwise, it results in a 5 second wait time before EDNS timeout is 
-  detected, which is slow but it works at least. 
-  It minimizes the chances of a dropped query making a (DNSSEC) EDNS server
-  falsely EDNS-nonsupporting, and thus DNSSEC-bogus, works well with 
-  middleboxes, and can detect the occasional authority that drops EDNS.
-  For some boxes it is necessary to probe for every failing query, a
-  reassurance that the DNS server does EDNS does not mean that path can
-  take large DNS answers.
-
-o 0x20 backoff.
-  The draft describes to back off to the next server, and go through all
-  servers several times.  Unbound goes on get the full list of nameserver
-  addresses, and then makes 3 * number of addresses queries.
-  They are sent to a random server, but no one address more than 4 times.
-  It succeeds if one has 0x20 intact, or else all are equal.
-  Otherwise, servfail is returned to the client.
-
-o NXDOMAIN and SOA serial numbers.
-  Unbound keeps TTL values for message formats, and thus rcodes, such
-  as NXDOMAIN.  Also it keeps the latest rrsets in the rrset cache.
-  So it will faithfully negative cache for the exact TTL as originally
-  specified for an NXDOMAIN message, but send a newer SOA record if
-  this has been found in the mean time.  In point, this could lead to a
-  negative cached NXDOMAIN reply with a SOA RR where the serial number
-  indicates a zone version where this domain is not any longer NXDOMAIN.
-  These situations become consistent once the original TTL expires.
-  If the domain is DNSSEC signed, by the way, then NSEC records are
-  updated more carefully.  If one of the NSEC records in an NXDOMAIN is
-  updated from another query, the NXDOMAIN is dropped from the cache,
-  and queried for again, so that its proof can be checked again.
-
-o SOA records in negative cached answers for DS queries.
-  The current unbound code uses a negative cache for queries for type DS.
-  This speeds up building chains of trust, and uses NSEC and NSEC3
-  (optout) information to speed up lookups.  When used internally,
-  the bare NSEC(3) information is sufficient, probably picked up from
-  a referral.  When answering to clients, a SOA record is needed for
-  the correct message format, a SOA record is picked from the cache
-  (and may not actually match the serial number of the SOA for which the
-  NSEC and NSEC3 records were obtained) if available otherwise network
-  queries are performed to get the data.
-
-o Parent and child with different nameserver information.
-  A misconfiguration that sometimes happens is where the parent and child
-  have different NS, glue information.  The child is authoritative, and
-  unbound will not trust information from the parent nameservers as the
-  final answer.  To help lookups, unbound will however use the parent-side
-  version of the glue as a last resort lookup.  This resolves lookups for
-  those misconfigured domains where the servers reported by the parent
-  are the only ones working, and servers reported by the child do not.
-
-o Failure of validation and probing.
-  Retries on a validation failure are now 5x to a different nameserver IP
-  (if possible), and then it gives up, for one name, type, class entry in
-  the message cache.  If a DNSKEY or DS fails in the chain of trust in the
-  key cache additionally, after the probing, a bad key entry is created that
-  makes the entire zone bogus for 900 seconds.  This is a fixed value at
-  this time and is conservative in sending probes.  It makes the compound
-  effect of many resolvers less and easier to handle, but penalizes
-  individual resolvers by having less probes and a longer time before fixes
-  are picked up.
-

doc/unbound-checkconf.8

@@ -0,0 +1,45 @@
+.\"
+.\" unbound-checkconf.8 -- unbound configuration checker manual
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.Dd @date@
+.Dt unbound-checkconf 8
+.Sh NAME
+unbound-checkconf
+.Nd Check unbound configuration file for errors.
+.Sh SYNOPSIS
+.Nm unbound-checkconf
+.Op Fl h
+.Op cfgfile
+.Sh DESCRIPTION
+.Ic Unbound-checkconf
+checks the configuration file for the
+.Xr unbound 8
+DNS resolver for syntax and other errors. 
+The config file syntax is
+described in 
+.Xr unbound.conf 5 .
+.Pp
+The available options are:
+.Bl -tag -width indent
+.It Fl h
+Show the version and commandline option help.
+.It cfgfile
+The config file to read with settings for unbound. It is checked.
+If omitted, the config file at the default location is checked.
+.Sh EXIT CODE
+The unbound-checkconf program exits with status code 1 on error, 
+0 for a correct config file.
+.El
+.Sh FILES
+.Bl -tag -width indent
+.It Pa /etc/unbound/unbound.conf
+unbound configuration file.
+.El
+.Sh SEE ALSO
+.Xr unbound.conf 5 , 
+.Xr unbound 8 .

doc/unbound-checkconf.8.in

@@ -1,49 +0,0 @@
-.TH "unbound-checkconf" "8" "@date@" "NLnet Labs" "unbound @version@"
-.\"
-.\" unbound-checkconf.8 -- unbound configuration checker manual
-.\"
-.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
-.\"
-.\" See LICENSE for the license.
-.\"
-.\"
-.SH "NAME"
-.LP
-unbound\-checkconf
-\- Check unbound configuration file for errors.
-.SH "SYNOPSIS"
-.B unbound\-checkconf
-.RB [ \-h ]
-.RB [ \-o
-.IR option ]
-.RI [ cfgfile ]
-.SH "DESCRIPTION"
-.B Unbound\-checkconf
-checks the configuration file for the
-\fIunbound\fR(8)
-DNS resolver for syntax and other errors. 
-The config file syntax is described in 
-\fIunbound.conf\fR(5).
-.P
-The available options are:
-.TP
-.B \-h
-Show the version and commandline option help.
-.TP
-.B \-o\fI option
-If given, after checking the config file the value of this option is 
-printed to stdout.  For "" (disabled) options an empty line is printed.
-.TP
-.I cfgfile
-The config file to read with settings for unbound. It is checked.
-If omitted, the config file at the default location is checked.
-.SH "EXIT CODE"
-The unbound\-checkconf program exits with status code 1 on error, 
-0 for a correct config file.
-.SH "FILES"
-.TP
-.I @ub_conf_file@
-unbound configuration file.
-.SH "SEE ALSO"
-\fIunbound.conf\fR(5), 
-\fIunbound\fR(8).

doc/unbound-control.8.in

@@ -1,407 +0,0 @@
-.TH "unbound-control" "8" "@date@" "NLnet Labs" "unbound @version@"
-.\"
-.\" unbound-control.8 -- unbound remote control manual
-.\"
-.\" Copyright (c) 2008, NLnet Labs. All rights reserved.
-.\"
-.\" See LICENSE for the license.
-.\"
-.\"
-.SH "NAME"
-.LP
-.B unbound\-control,
-.B unbound\-control\-setup
-\- Unbound remote server control utility.
-.SH "SYNOPSIS"
-.B unbound\-control
-.RB [ \-h ]
-.RB [ \-c 
-.IR cfgfile ]
-.RB [ \-s 
-.IR server ]
-.IR command
-.SH "DESCRIPTION"
-.B Unbound\-control
-performs remote administration on the \fIunbound\fR(8) DNS server.
-It reads the configuration file, contacts the unbound server over SSL
-sends the command and displays the result.
-.P
-The available options are:
-.TP
-.B \-h
-Show the version and commandline option help.
-.TP
-.B \-c \fIcfgfile
-The config file to read with settings.  If not given the default
-config file @ub_conf_file@ is used.
-.TP
-.B \-s \fIserver[@port]
-IPv4 or IPv6 address of the server to contact.  If not given, the
-address is read from the config file.
-.SH "COMMANDS"
-There are several commands that the server understands.
-.TP
-.B start
-Start the server. Simply execs \fIunbound\fR(8).  The unbound executable 
-is searched for in the \fBPATH\fR set in the environment.  It is started 
-with the config file specified using \fI\-c\fR or the default config file.
-.TP
-.B stop
-Stop the server. The server daemon exits.
-.TP
-.B reload
-Reload the server. This flushes the cache and reads the config file fresh.
-.TP
-.B verbosity \fInumber
-Change verbosity value for logging. Same values as \fBverbosity\fR keyword in
-\fIunbound.conf\fR(5).  This new setting lasts until the server is issued
-a reload (taken from config file again), or the next verbosity control command.
-.TP
-.B log_reopen
-Reopen the logfile, close and open it.  Useful for logrotation to make the
-daemon release the file it is logging to.  If you are using syslog it will
-attempt to close and open the syslog (which may not work if chrooted).
-.TP
-.B stats
-Print statistics. Resets the internal counters to zero, this can be 
-controlled using the \fBstatistics\-cumulative\fR config statement. 
-Statistics are printed with one [name]: [value] per line.
-.TP
-.B stats_noreset
-Peek at statistics. Prints them like the \fBstats\fR command does, but does not
-reset the internal counters to zero.
-.TP
-.B status
-Display server status. Exit code 3 if not running (the connection to the 
-port is refused), 1 on error, 0 if running.
-.TP
-.B local_zone \fIname\fR \fItype
-Add new local zone with name and type. Like \fBlocal\-zone\fR config statement.
-If the zone already exists, the type is changed to the given argument.
-.TP
-.B local_zone_remove \fIname
-Remove the local zone with the given name.  Removes all local data inside
-it.  If the zone does not exist, the command succeeds.
-.TP
-.B local_data \fIRR data...
-Add new local data, the given resource record. Like \fBlocal\-data\fR
-config statement, except for when no covering zone exists.  In that case
-this remote control command creates a transparent zone with the same 
-name as this record.  This command is not good at returning detailed syntax 
-errors.
-.TP
-.B local_data_remove \fIname
-Remove all RR data from local name.  If the name already has no items,
-nothing happens.  Often results in NXDOMAIN for the name (in a static zone),
-but if the name has become an empty nonterminal (there is still data in 
-domain names below the removed name), NOERROR nodata answers are the 
-result for that name.
-.TP
-.B dump_cache
-The contents of the cache is printed in a text format to stdout. You can
-redirect it to a file to store the cache in a file.
-.TP
-.B load_cache
-The contents of the cache is loaded from stdin.  Uses the same format as
-dump_cache uses.  Loading the cache with old, or wrong data can result
-in old or wrong data returned to clients.  Loading data into the cache
-in this way is supported in order to aid with debugging.
-.TP
-.B lookup \fIname
-Print to stdout the name servers that would be used to look up the 
-name specified.
-.TP
-.B flush \fIname
-Remove the name from the cache. Removes the types
-A, AAAA, NS, SOA, CNAME, DNAME, MX, PTR, SRV and NAPTR.
-Because that is fast to do. Other record types can be removed using 
-.B flush_type 
-or 
-.B flush_zone\fR.
-.TP
-.B flush_type \fIname\fR \fItype
-Remove the name, type information from the cache.
-.TP
-.B flush_zone \fIname
-Remove all information at or below the name from the cache. 
-The rrsets and key entries are removed so that new lookups will be performed.
-This needs to walk and inspect the entire cache, and is a slow operation.
-.TP
-.B flush_stats
-Reset statistics to zero.
-.TP
-.B flush_requestlist
-Drop the queries that are worked on.  Stops working on the queries that the
-server is working on now.  The cache is unaffected.  No reply is sent for
-those queries, probably making those users request again later.
-Useful to make the server restart working on queries with new settings,
-such as a higher verbosity level.
-.TP
-.B dump_requestlist
-Show what is worked on.  Prints all queries that the server is currently
-working on.  Prints the time that users have been waiting.  For internal
-requests, no time is printed.  And then prints out the module status.
-.TP
-.B set_option \fIopt: val
-Set the option to the given value without a reload.  The cache is therefore
-not flushed.  The option must end with a ':' and whitespace must be between the
-option and the value.  Some values may not have an effect if set this way,
-the new values are not written to the config file, not all options are supported.
-.TP
-.B get_option \fIopt
-Get the value of the option.  Give the option name without a trailing ':'.
-The value is printed.  If the value is "", nothing is printed and the
-connection closes.  On error 'error ...' is printed (it gives a syntax
-error on unknown option).  For some options a list of values, one on
-each line, is printed.  Not all options are supported.
-.TP
-.B list_stubs
-List the stub zones in use.  These are printed one by one to the output.
-This includes the root hints in use.
-.TP
-.B list_forwards
-List the forward zones in use.  These are printed zone by zone to the output.
-.TP
-.B list_local_zones
-List the local zones in use.  These are printed one per line with zone type.
-.TP
-.B list_local_data
-List the local data RRs in use.  The resource records are printed.
-.TP
-.B forward \fR[\fIoff\fR | \fIaddr ...\fR ]
-Setup forwarding mode.  Configures if the server should ask other upstream
-nameservers, should go to the internet root nameservers itself, or show 
-the current config.  You could pass the nameservers after a DHCP update.
-.IP
-Without arguments the current list of addresses used to forward all queries
-to is printed.  On startup this is from the forward\-zone "." configuration.
-Afterwards it shows the status.  It prints off when no forwarding is used.
-.IP
-If \fIoff\fR is passed, forwarding is disabled and the root nameservers
-are used.  This can be used to avoid to avoid buggy or non\-DNSSEC supporting
-nameservers returned from DHCP.  But may not work in hotels or hotspots.
-.IP
-If one or more IPv4 or IPv6 addresses are given, those are then used to forward
-queries to.  The addresses must be separated with spaces.  With '@port' the
-port number can be set explicitly (default port is 53 (DNS)).
-.IP
-By default the forwarder information from the config file for the root "." is
-used.  The config file is not changed, so after a reload these changes are
-gone.  Other forward zones from the config file are not affected by this command.
-.SH "EXIT CODE"
-The unbound\-control program exits with status code 1 on error, 0 on success.
-.SH "SET UP"
-The setup requires a self\-signed certificate and private keys for both 
-the server and client.  The script \fIunbound\-control\-setup\fR generates
-these in the default run directory, or with \-d in another directory.
-If you change the access control permissions on the key files you can decide
-who can use unbound\-control, by default owner and group but not all users.
-Run the script under the same username as you have configured in unbound.conf
-or as root, so that the daemon is permitted to read the files, for example with:
-.nf
-    sudo \-u unbound unbound\-control\-setup
-.fi
-If you have not configured
-a username in unbound.conf, the keys need read permission for the user
-credentials under which the daemon is started.
-The script preserves private keys present in the directory.
-After running the script as root, turn on \fBcontrol\-enable\fR in 
-\fIunbound.conf\fR.
-.SH "STATISTIC COUNTERS"
-The \fIstats\fR command shows a number of statistic counters.
-.TP
-.I threadX.num.queries
-number of queries received by thread
-.TP
-.I threadX.num.cachehits
-number of queries that were successfully answered using a cache lookup
-.TP
-.I threadX.num.cachemiss
-number of queries that needed recursive processing
-.TP
-.I threadX.num.prefetch
-number of cache prefetches performed.  This number is included in
-cachehits, as the original query had the unprefetched answer from cache,
-and resulted in recursive processing, taking a slot in the requestlist.
-Not part of the recursivereplies (or the histogram thereof) or cachemiss,
-as a cache response was sent.
-.TP
-.I threadX.num.recursivereplies
-The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
-.TP
-.I threadX.requestlist.avg
-The average number of requests in the internal recursive processing request list on insert of a new incoming recursive processing query.
-.TP
-.I threadX.requestlist.max
-Maximum size attained by the internal recursive processing request list.
-.TP
-.I threadX.requestlist.overwritten
-Number of requests in the request list that were overwritten by newer entries. This happens if there is a flood of queries that recursive processing and the server has a hard time.
-.TP
-.I threadX.requestlist.exceeded
-Queries that were dropped because the request list was full. This happens if a flood of queries need recursive processing, and the server can not keep up.
-.TP
-.I threadX.requestlist.current.all
-Current size of the request list, includes internally generated queries (such
-as priming queries and glue lookups).
-.TP
-.I threadX.requestlist.current.user
-Current size of the request list, only the requests from client queries.
-.TP
-.I threadX.recursion.time.avg
-Average time it took to answer queries that needed recursive processing. Note that queries that were answered from the cache are not in this average.
-.TP
-.I threadX.recursion.time.median
-The median of the time it took to answer queries that needed recursive
-processing.  The median means that 50% of the user queries were answered in 
-less than this time.  Because of big outliers (usually queries to non 
-responsive servers), the average can be bigger than the median.  This median
-has been calculated by interpolation from a histogram.
-.TP
-.I total.num.queries
-summed over threads.
-.TP
-.I total.num.cachehits
-summed over threads.
-.TP
-.I total.num.cachemiss
-summed over threads.
-.TP
-.I total.num.prefetch
-summed over threads.
-.TP
-.I total.num.recursivereplies
-summed over threads.
-.TP
-.I total.requestlist.avg
-averaged over threads.
-.TP
-.I total.requestlist.max
-the maximum of the thread requestlist.max values.
-.TP
-.I total.requestlist.overwritten
-summed over threads.
-.TP
-.I total.requestlist.exceeded
-summed over threads.
-.TP
-.I total.requestlist.current.all
-summed over threads.
-.TP
-.I total.recursion.time.median
-averaged over threads.
-.TP
-.I time.now
-current time in seconds since 1970.
-.TP
-.I time.up
-uptime since server boot in seconds.
-.TP
-.I time.elapsed
-time since last statistics printout, in seconds.
-.SH EXTENDED STATISTICS
-.TP
-.I mem.total.sbrk
-If sbrk(2) is available, an estimate of the heap size of the program in number of bytes. Close to the total memory used by the program, as reported by top and ps.  Could be wrong if the OS allocates memory non\-contiguously.
-.TP
-.I mem.cache.rrset
-Memory in bytes in use by the RRset cache.
-.TP
-.I mem.cache.message
-Memory in bytes in use by the message cache.
-.TP
-.I mem.mod.iterator
-Memory in bytes in use by the iterator module.
-.TP
-.I mem.mod.validator
-Memory in bytes in use by the validator module. Includes the key cache and
-negative cache.
-.TP
-.I histogram.<sec>.<usec>.to.<sec>.<usec>
-Shows a histogram, summed over all threads. Every element counts the
-recursive queries whose reply time fit between the lower and upper bound.
-Times larger or equal to the lowerbound, and smaller than the upper bound.
-There are 40 buckets, with bucket sizes doubling.
-.TP
-.I num.query.type.A
-The total number of queries over all threads with query type A.
-Printed for the other query types as well, but only for the types for which
-queries were received, thus =0 entries are omitted for brevity.
-.TP
-.I num.query.type.other
-Number of queries with query types 256\-65535.
-.TP
-.I num.query.class.IN
-The total number of queries over all threads with query class IN (internet).
-Also printed for other classes (such as CH (CHAOS) sometimes used for
-debugging), or NONE, ANY, used by dynamic update.
-num.query.class.other is printed for classes 256\-65535.
-.TP
-.I num.query.opcode.QUERY
-The total number of queries over all threads with query opcode QUERY.
-Also printed for other opcodes, UPDATE, ...
-.TP
-.I num.query.tcp
-Number of queries that were made using TCP towards the unbound server.
-.TP
-.I num.query.ipv6
-Number of queries that were made using IPv6 towards the unbound server.
-.TP
-.I num.query.flags.RD
-The number of queries that had the RD flag set in the header.
-Also printed for flags QR, AA, TC, RA, Z, AD, CD.
-Note that queries with flags QR, AA or TC may have been rejected 
-because of that.
-.TP
-.I num.query.edns.present
-number of queries that had an EDNS OPT record present.
-.TP
-.I num.query.edns.DO
-number of queries that had an EDNS OPT record with the DO (DNSSEC OK) bit set.
-These queries are also included in the num.query.edns.present number.
-.TP
-.I num.answer.rcode.NXDOMAIN
-The number of answers to queries, from cache or from recursion, that had the
-return code NXDOMAIN. Also printed for the other return codes.
-.TP
-.I num.answer.rcode.nodata
-The number of answers to queries that had the pseudo return code nodata.
-This means the actual return code was NOERROR, but additionally, no data was
-carried in the answer (making what is called a NOERROR/NODATA answer).
-These queries are also included in the num.answer.rcode.NOERROR number.
-Common for AAAA lookups when an A record exists, and no AAAA.
-.TP
-.I num.answer.secure
-Number of answers that were secure.  The answer validated correctly. 
-The AD bit might have been set in some of these answers, where the client
-signalled (with DO or AD bit in the query) that they were ready to accept
-the AD bit in the answer.
-.TP
-.I num.answer.bogus
-Number of answers that were bogus.  These answers resulted in SERVFAIL
-to the client because the answer failed validation.
-.TP
-.I num.rrset.bogus
-The number of rrsets marked bogus by the validator.  Increased for every
-RRset inspection that fails.
-.TP
-.I unwanted.queries
-Number of queries that were refused or dropped because they failed the
-access control settings.
-.TP
-.I unwanted.replies
-Replies that were unwanted or unsolicited.  Could have been random traffic,
-delayed duplicates, very late answers, or could be spoofing attempts.
-Some low level of late answers and delayed duplicates are to be expected
-with the UDP protocol.  Very high values could indicate a threat (spoofing).
-.SH "FILES"
-.TP
-.I @ub_conf_file@
-unbound configuration file.
-.TP
-.I @UNBOUND_RUN_DIR@
-directory with private keys (unbound_server.key and unbound_control.key) and
-self\-signed certificates (unbound_server.pem and unbound_control.pem).
-.SH "SEE ALSO"
-\fIunbound.conf\fR(5), 
-\fIunbound\fR(8).

doc/unbound-host.1

@@ -1,116 +0,0 @@
-.TH "unbound\-host" "1" "@date@" "NLnet Labs" "unbound @version@"
-.\"
-.\" unbound-host.1 -- unbound DNS lookup utility
-.\"
-.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
-.\"
-.\" See LICENSE for the license.
-.\"
-.\"
-.SH "NAME"
-.LP
-.B unbound\-host
-\- unbound DNS lookup utility
-.SH "SYNOPSIS"
-.LP
-.B unbound\-host
-.RB [ \-vdhr46 ]
-.RB [ \-c 
-.IR class ]
-.RB [ \-t
-.IR type ]
-.I hostname
-.RB [ \-y
-.IR key ]
-.RB [ \-f
-.IR keyfile ]
-.RB [ \-F
-.IR namedkeyfile ]
-.RB [ \-C
-.IR configfile ]
-.SH "DESCRIPTION"
-.LP
-.B Unbound\-host
-uses the unbound validating resolver to query for the hostname and display
-results. With the \fB\-v\fR option it displays validation 
-status: secure, insecure, bogus (security failure).
-.P
-By default it reads no configuration file whatsoever.  It attempts to reach
-the internet root servers.  With \fB\-C\fR an unbound config file and with
-\fB\-r\fR resolv.conf can be read.
-.P
-The available options are:
-.TP
-.I hostname
-This name is resolved (looked up in the DNS).
-If a IPv4 or IPv6 address is given, a reverse lookup is performed.
-.TP
-.B \-h
-Show the version and commandline option help.
-.TP
-.B \-v
-Enable verbose output and it shows validation results, on every line.
-Secure means that the NXDOMAIN (no such domain name), nodata (no such data)
-or positive data response validated correctly with one of the keys.
-Insecure means that that domain name has no security set up for it.
-Bogus (security failure) means that the response failed one or more checks,
-it is likely wrong, outdated, tampered with, or broken.
-.TP
-.B \-d
-Enable debug output to stderr. One \-d shows what the resolver and validator
-are doing and may tell you what is going on. More times, \-d \-d, gives a
-lot of output, with every packet sent and received.
-.TP
-.B \-c \fIclass
-Specify the class to lookup for, the default is IN the internet class.
-.TP
-.B \-t \fItype
-Specify the type of data to lookup. The default looks for IPv4, IPv6 and
-mail handler data, or domain name pointers for reverse queries.
-.TP
-.B \-y \fIkey
-Specify a public key to use as trust anchor. This is the base for a chain
-of trust that is built up from the trust anchor to the response, in order
-to validate the response message. Can be given as a DS or DNSKEY record.
-For example \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD".
-.TP
-.B \-f \fIkeyfile
-Reads keys from a file. Every line has a DS or DNSKEY record, in the format
-as for \-y. The zone file format, the same as dig and drill produce.
-.TP
-.B \-F \fInamedkeyfile
-Reads keys from a BIND\-style named.conf file. Only the trusted\-key {}; entries
-are read.
-.TP
-.B \-C \fIconfigfile
-Uses the specified unbound.conf to prime
-.IR libunbound (3).
-.TP
-.B \-r
-Read /etc/resolv.conf, and use the forward DNS servers from there (those could
-have been set by DHCP).  More info in
-.IR resolv.conf (5).
-Breaks validation if those servers do not support DNSSEC.
-.TP
-.B \-4
-Use solely the IPv4 network for sending packets.
-.TP
-.B \-6
-Use solely the IPv6 network for sending packets.
-.SH "EXAMPLES"
-.LP
-Some examples of use. The keys shown below are fakes, thus a security failure
-is encountered.
-.P
-$ unbound\-host www.example.com
-.P
-$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
-.P
-$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153
-.SH "EXIT CODE"
-The unbound\-host program exits with status code 1 on error, 
-0 on no error. The data may not be available on exit code 0, exit code 1
-means the lookup encountered a fatal error.
-.SH "SEE ALSO"
-\fIunbound.conf\fR(5), 
-\fIunbound\fR(8).

doc/unbound.8

@@ -1,4 +1,3 @@
-.TH "unbound" "8" "@date@" "NLnet Labs" "unbound @version@"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -7,45 +6,42 @@
 .\" See LICENSE for the license.
 .\"
 .\"
-.SH "NAME"
-.LP
-.B unbound
-\- Unbound DNS validating resolver @version@.
-.SH "SYNOPSIS"
-.LP
-.B unbound
-.RB [ \-h ]
-.RB [ \-d ]
-.RB [ \-v ]
-.RB [ \-c 
-.IR cfgfile ]
-.SH "DESCRIPTION"
-.LP
-.B Unbound 
+.Dd @date@
+.Dt unbound 8
+.Sh NAME
+unbound
+.Nd Unbound DNS validating resolver @version@.
+.Sh SYNOPSIS
+.Nm unbound
+.Op Fl h
+.Op Fl d
+.Op Fl v
+.Op Fl c Ar cfgfile
+.Sh DESCRIPTION
+.Ic Unbound 
 is an implementation of a DNS resolver, that does caching and 
 DNSSEC validation.
-.P
+.Pp
 The available options are:
-.TP
-.B \-h
+.Bl -tag -width indent
+.It Fl h
 Show the version and commandline option help.
-.TP
-.B \-c\fI cfgfile
-Set the config file with settings for unbound to read instead of reading the 
-file at the default location, @ub_conf_file@. The syntax is
-described in \fIunbound.conf\fR(5).
-.TP
-.B \-d
+.It Fl c Ar cfgfile
+Set the config file with settings for unbound to read instead of the 
+file at default location /etc/unbound/unbound.conf. The syntax is
+described in 
+.Xr unbound.conf 5 .
+.It Fl d
 Debug flag, do not fork into the background, but stay attached to the
 console. This flag will also delay writing to the logfile until the
-thread\-spawn time. So that most config and setup errors appear on stderr.
-.TP
-.B \-v
+thread-spawn time. So that most config and setup errors appear on stderr.
+.It Fl v
 Increase verbosity. If given multiple times, more information is logged.
 This is in addition to the verbosity (if any) from the config file.
-.SH "SEE ALSO"
-\fIunbound.conf\fR(5), 
-\fIunbound\-checkconf\fR(8).
-.SH "AUTHORS"
-.B Unbound
+.El
+.Sh SEE ALSO
+.Xr unbound.conf 5 , 
+.Xr unbound-checkconf 8 .
+.Sh AUTHORS
+.Ic Unbound
 developers are mentioned in the CREDITS file in the distribution.

doc/unbound.conf.5

@@ -0,0 +1,393 @@
+.\"
+.\" unbound.conf.5 -- unbound.conf manual
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.Dd @date@
+.Os FreeBSD
+.Dt unbound.conf 5
+.Sh NAME
+.Nm unbound.conf
+.Nd Unbound configuration file.
+.Sh SYNOPSIS
+.Nm unbound.conf
+.Sh DESCRIPTION
+.Ic unbound.conf
+is used to configure
+.Xr unbound 8 .
+The file format has attributes and values. Some attributes have attributes inside them.
+The notation is: attribute: value.
+.Pp
+Comments start with # and last to the end of line. Empty lines are
+ignored as is whitespace at the beginning of a line.
+.Pp
+The utility 
+.Xr unbound-checkconf 8
+can be used to check unbound.conf prior to usage.
+.Sh EXAMPLE
+An example config file is shown below. Copy this to /etc/unbound/unbound.conf
+and start the server with:
+.nf
+	$ unbound -c /etc/unbound/unbound.conf 
+.fi
+Most settings are the defaults. Stop the server with:
+.nf
+	$ kill `cat /etc/unbound/unbound.pid`
+.fi
+Below is a minimal config file. The source distribution contains an extensive
+example.conf file with all the options.
+.nf
+# unbound.conf(5) config file for unbound(8).
+server:
+	directory: "/etc/unbound"
+	username: unbound 	# make sure it can write to pidfile.
+	chroot: "/etc/unbound"
+	# logfile: "/etc/unbound/unbound.log"  #uncomment to use logfile.
+	pidfile: "/etc/unbound/unbound.pid"
+	# verbosity: 1		# uncomment and increase to get more logging.
+.fi
+.Sh FILE FORMAT
+There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute
+is followed by its containing attributes, or a value.
+.Pp
+Files can be included using the
+.Ic include:
+directive. It can appear anywhere, and takes a single filename as an argument.
+Processing continues as if the text from the included file was copied into
+the config file at that point.
+.Ss Server Options
+These options are part of the
+.Ic server:
+clause.
+.Bl -tag -width indent
+.It \fBverbosity:\fR <number>
+The verbosity number, level 0 means no verbosity, only errors. Level 1 
+gives operational information. Level 2 gives query level information, 
+output per query. Level 3 gives algorithm level information.  
+Default is level 1. The verbosity can also be increased from the commandline,
+see
+.Xr unbound 8 .
+.It \fBnum-threads:\fR <number>
+The number of threads to create to serve clients. Use 1 for no threading.
+.It \fBport:\fR <port number>
+The port number, default 53, on which the server responds to queries.
+.It \fBinterface:\fR <ip address>
+Interface to use to connect to the network. This interface is listened to
+for queries from clients, and answers to clients are given from it.
+Can be given multiple times to work on several interfaces. If none are 
+given the default is to listen to localhost.
+The interfaces are not changed on a reload (kill -HUP) but only on restart.
+.It \fBoutgoing-interface:\fR <ip address>
+Interface to use to connect to the network. This interface is used to send
+queries to authoritative servers and receive their replies. Can be given 
+multiple times to work on several interfaces. If none are given the 
+default (all) is used. You can specify the same interfaces in 
+.Ic interface:
+and
+.Ic outgoing-interface:
+lines, the interfaces are then used for both purposes. Outgoing queries are 
+sent via a random outgoing interface to counter spoofing.
+.It \fBoutgoing-port:\fR <port number>
+The starting port number where the outgoing query port range is allocated.
+Default is 1053.
+.It \fBoutgoing-range:\fR <number>
+Number of ports to open. This number is opened per thread for every outgoing
+query interface. Must be at least 1. Default is 16.
+Larger numbers give more protection against spoofing attempts, but need
+extra resources from the operating system.
+.It \fBoutgoing-num-tcp:\fR <number>
+Number of outgoing TCP buffers to allocate per thread. Default is 10. If set
+to 0, or if do_tcp is "no", no TCP queries to authoritative servers are done.
+.It \fBincoming-num-tcp:\fR <number>
+Number of incoming TCP buffers to allocate per thread. Default is 10. If set
+to 0, or if do_tcp is "no", no TCP queries from clients are accepted.
+.It \fBmsg-buffer-size:\fR <number>
+Number of bytes size of the message buffers. Default is 65552 bytes, enough
+for 64 Kb packets, the maximum DNS message size. No message larger than this
+can be sent or received. Can be reduced to use less memory, but some requests
+for DNS data, such as for huge resource records, will result in a SERVFAIL 
+reply to the client.
+.It \fBmsg-cache-size:\fR <number>
+Number of bytes size of the message cache. Default is 4 megabytes.
+.It \fBmsg-cache-slabs:\fR <number>
+Number of slabs in the message cache. Slabs reduce lock contention by threads.
+Must be set to a power of 2. Setting (close) to the number of cpus is a 
+reasonable guess.
+.It \fBnum-queries-per-thread:\fR <number>
+The number of queries that every thread will service simultaneously.
+If more queries arrive that need servicing, they are dropped. This forces
+the client to resend after a timeout; allowing the server time to work on
+the existing queries. Default 1024.
+.It \fBrrset-cache-size:\fR <number>
+Number of bytes size of the RRset cache. Default is 4 megabytes.
+.It \fBrrset-cache-slabs:\fR <number>
+Number of slabs in the RRset cache. Slabs reduce lock contention by threads.
+Must be set to a power of 2. 
+.It \fBcache-max-ttl:\fR <seconds>
+Time to live maximum for RRsets and messages in the cache. Default is 
+864000 seconds (10 days). If the maximum kicks in, responses to clients 
+still get decrementing TTLs based on the original (larger) values. 
+When the internal TTL expires, the cache item has expired.
+Can be set lower to force the resolver to query for data often, and not
+trust (very large) TTL values.
+.It \fBinfra-host-ttl:\fR <seconds>
+Time to live for entries in the host cache. The host cache contains 
+roundtrip timing and EDNS support information. Default is 900.
+.It \fBinfra-lame-ttl:\fR <seconds>
+The time to live when a delegation is discovered to be lame. Default is 900.
+.It \fBinfra-cache-slabs:\fR <number>
+Number of slabs in the infrastructure cache. Slabs reduce lock contention 
+by threads. Must be set to a power of 2. 
+.It \fBinfra-cache-numhosts:\fR <number>
+Number of hosts for which information is cached. Default is 10000.
+.It \fBinfra-cache-lame-size:\fR <number>
+Number of bytes that the lameness cache per host is allowed to use. Default
+is 10 kb, which gives maximum storage for a couple score zones, depending on 
+the lame zone name lengths.
+.It \fBdo-ip4:\fR <yes or no>
+Enable or disable whether ip4 queries are answered. Default is yes.
+.It \fBdo-ip6:\fR <yes or no>
+Enable or disable whether ip6 queries are answered. Default is yes.
+.It \fBdo-udp:\fR <yes or no>
+Enable or disable whether UDP queries are answered. Default is yes.
+.It \fBdo-tcp:\fR <yes or no>
+Enable or disable whether TCP queries are answered. Default is yes.
+.It \fBchroot:\fR <directory>
+If given a chroot is done to the given directory. The default is 
+"/etc/unbound". If you give "" no chroot is performed.
+.It \fBusername:\fR <name>
+If given, after binding the port the user privileges are dropped. Default is
+"unbound". If you give username: "" no user change is performed. 
+.Pp
+If this user is not capable of binding the
+port, reloads (by signal HUP) will still retain the opened ports.
+If you change the port number in the config file, and that new port number 
+requires privileges, then a reload will fail; a restart is needed.
+.It \fBdirectory:\fR <directory>
+Sets the working directory for the program.
+.It \fBlogfile:\fR <filename>
+If "" is given, logging goes to stderr, or nowhere once daemonized.
+The logfile is appended to, in the following format: 
+[seconds since 1970] unbound[pid:tid]: type: message. 
+If this option is given, the use-syslog is option is set to "no".
+The logfile is reopened (for append) when the config file is reread, on 
+SIGHUP.
+.It \fBuse-syslog:\fR <yes or no>
+Sets unbound to send log messages to the syslogd, using 
+.Xr syslog 3 .
+The log facility LOG_DAEMON is used, with identity "unbound".
+The logfile setting is overridden when use-syslog is turned on.
+The default is to log to syslog.
+.It \fBpidfile:\fR <filename>
+The process id is written to the file. Default is "/etc/unbound/unbound.pid". 
+So,
+.nf
+kill -HUP `cat /etc/unbound/unbound.pid` 
+.fi
+triggers a reload,
+.nf
+kill -QUIT `cat /etc/unbound/unbound.pid` 
+.fi
+gracefully terminates.
+.It \fBroot-hints:\fR <filename>
+Read the root hints from this file. Default is nothing, using builtin hints
+for the IN class. The file has the format of zone files, with root 
+nameserver names and addresses only. The default may become outdated,
+when servers change, therefore it is good practice to use a root-hints file.
+.It \fBhide-identity:\fR <yes or no>
+If enabled id.server and hostname.bind queries are refused.
+.It \fBidentity:\fR <string>
+Set the identity to report. If set to "", the default, then the hostname
+of the server is returned.
+.It \fBhide-version:\fR <yes or no>
+If enabled version.server and version.bind queries are refused.
+.It \fBversion:\fR <string>
+Set the version to report. If set to "", the default, then the package
+version is returned.
+.It \fBtarget-fetch-policy:\fR <"list of numbers">
+Set the target fetch policy used by unbound to determine if it should fetch
+nameserver target addresses opportunistically. The policy is described per
+dependency depth. 
+.Pp
+The number of values determines the maximum dependency depth
+that unbound will pursue in answering a query.  
+A value of -1 means to fetch all targets opportunistically for that dependency
+depth. A value of 0 means to fetch on demand only. A positive value fetches
+that many targets opportunistically. 
+.Pp
+Enclose the list between quotes ("") and put spaces between numbers.
+The default is "3 2 1 0 0". Setting all zeroes, "0 0 0 0 0" gives behaviour
+closer to that of BIND 9, while setting "-1 -1 -1 -1 -1" gives behaviour 
+rumoured to be closer to that of BIND 8.
+.It \fBharden-short-bufsize:\fR <yes or no>
+Very small EDNS buffer sizes from queries are ignored. Default is off, since
+it is legal protocol wise to send these, and unbound tries to give very 
+small answers to these queries, where possible.
+.It \fBharden-large-queries:\fR <yes or no>
+Very large queries are ignored. Default is off, since it is legal protocol
+wise to send these, and could be necessary for operation if TSIG or EDNS
+payload is very large.
+.It \fBharden-glue:\fR <yes or no>
+Will trust glue only if it is within the servers authority. Default is on.
+.It \fBharden-dnssec-stripped:\fR <yes or no>
+Require DNSSEC data for trust-anchored zones, if such data is absent,
+the zone becomes bogus. If turned off, and no DNSSEC data is received
+(or the DNSKEY data fails to validate), then the zone is made insecure, 
+this behaves like there is no trust anchor. You could turn this off if 
+you are sometimes behind an intrusive firewall (of some sort) that 
+removes DNSSEC data from packets, or a zone changes from signed to 
+unsigned to badly signed often. If turned off you run the risk of a 
+downgrade attack that disables security for a zone. Default is on.
+.It \fBdo-not-query-address:\fR <IP address>
+Do not query the given IP address. Can be IP4 or IP6. Append /num to 
+indicate a classless delegation netblock, for example like
+10.2.3.4/24 or 2001::11/64.
+.It \fBdo-not-query-localhost:\fR <yes or no>
+If yes, localhost is added to the do-not-query-address entries, both
+IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send
+queries to. Default is yes.
+.It \fBmodule-config:\fR <"module names">
+Module configuration, a list of module names separated by spaces, surround
+the string with quotes (""). The modules can be validator, iterator.
+Setting this to "iterator" will result in a non-validating server.
+Setting this to "validator iterator" will turn on DNSSEC validation.
+You must also set trust-anchors for validation to be useful.
+.It \fBtrust-anchor-file:\fR <filename>
+File with trusted keys for validation. Both DS and DNSKEY entries can appear
+in the file. The format of the file is the standard DNS Zone file format.
+Default is "", or no trust anchor file.
+.It \fBtrust-anchor:\fR <"Resource Record">
+A DS or DNSKEY RR for a key to use for validation. Multiple entries can be
+given to specify multiple trusted keys, in addition to the trust-anchor-files.
+The resource record is entered in the same format as 'dig' or 'drill' prints
+them, the same format as in the zone file. Has to be on a single line, with
+"" around it. A TTL can be specified for ease of cut and paste, but is ignored. 
+A class can be specified, but class IN is default.
+.It \fBtrusted-keys-file:\fR <filename>
+File with trusted keys for validation. Specify more than one file
+with several entries, one file per entry. Like \fBtrust-anchor-file\fR
+but has a different file format. Format is BIND-9 style format, 
+the trusted-keys { name flag proto algo "key"; }; clauses are read.
+.It \fBval-override-date:\fR <rrsig-style date spec>
+Default is "" or "0", which disables this debugging feature. If enabled by
+giving a RRSIG style date, that date is used for verifying RRSIG inception
+and expiration dates, instead of the current date. Do not set this unless 
+you are debugging signature inception and expiration.
+.It \fBval-bogus-ttl:\fR <number>
+The time to live for bogus data. This is data that has failed validation;
+due to invalid signatures or other checks. The TTL from that data cannot be
+trusted, and this value is used instead. The value is in seconds, default 900.
+The time interval prevents repeated revalidation of bogus data.
+.It \fBval-clean-additional:\fR <yes or no>
+Instruct the validator to remove data from the additional section of secure
+messages that are not signed properly. Messages that are insecure, bogus,
+indeterminate or unchecked are not affected. Default is yes. Use this setting
+to protect the users that rely on this validator for authentication from 
+protentially bad data in the additional section.
+.It \fBval-permissive-mode:\fR <yes or no>
+Instruct the validator to mark bogus messages as indeterminate. The security
+checks are performed, but if the result is bogus (failed security), the
+reply is not withheld from the client with SERVFAIL as usual. The client 
+receives the bogus data. For messages that are found to be secure the AD bit 
+is set in replies. Also logging is performed as for full validation.
+The default value is "no". 
+.It \fBval-nsec3-keysize-iterations:\fR <"list of values">
+List of keysize and iteration count values, separated by spaces, surrounded
+by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
+maximum allowed NSEC3 iteration count before a message is simply marked
+insecure instead of performing the many hashing iterations. The list must
+be in ascending order and have at least one entry. If you set it to 
+"1024 65535" there is no restriction to NSEC3 iteration values.
+This table must be kept short; a very long list could cause slower operation.
+.It \fBkey-cache-size:\fR <number>
+Number of bytes size of the key cache. Default is 4 megabytes.
+.It \fBkey-cache-slabs:\fR <number>
+Number of slabs in the key cache. Slabs reduce lock contention by threads.
+Must be set to a power of 2. Setting (close) to the number of cpus is a 
+reasonable guess.
+.El
+.Ss Stub Zone Options
+There may be multiple
+.Ic stub-zone:
+clauses. Each with a name: and zero or more hostnames or IP addresses.
+For the stub zone this list of nameservers is used. Class IN is assumed.
+.Bl -tag -width indent
+.It \fBname:\fR <domain name>
+Name of the stub zone.
+.It \fBstub-host:\fR <domain name>
+Name of stub zone nameserver. Is itself resolved before it is used.
+.It \fBstub-addr:\fR <IP address>
+IP address of stub zone nameserver. Can be IP 4 or IP 6.
+To use a nondefault port for DNS communication append '@' with the port number.
+.El
+.Ss Forward Zone Options
+There may be multiple
+.Ic forward-zone:
+clauses. Each with a name: and zero or more hostnames or IP addresses.
+For the forward zone this list of nameservers is used to forward the queries
+to. The servers have to handle further recursion for the query. Class IN is 
+assumed. A forward-zone entry with name "." and a forward-addr target will 
+forward all queries to that other server (unless it can answer from the cache).
+.Bl -tag -width indent
+.It \fBname:\fR <domain name>
+Name of the forward zone.
+.It \fBforward-host:\fR <domain name>
+Name of server to forward to. Is itself resolved before it is used.
+.It \fBforward-addr:\fR <IP address>
+IP address of server to forward to. Can be IP 4 or IP 6.
+To use a nondefault port for DNS communication append '@' with the port number.
+.El
+.Sh MEMORY CONTROL EXAMPLE
+In the example config settings below memory usage is reduced. Some service
+levels are lower, notable very large data and a high TCP load are no longer
+supported. Very large data and high TCP loads are exceptional for the DNS.
+DNSSEC validation is enabled, just add trust anchors.
+If you do not have to worry about programs using more than 1 meg of memory,
+the below example is not for you. Use the defaults to receive full service.
+.Pp
+.nf
+# example settings that reduce memory usage
+server:
+	num-threads: 1
+	outgoing-num-tcp: 1	# this limits TCP service, uses less buffers.
+	incoming-num-tcp: 1
+	outgoing-range: 1	# uses less memory, but less port randomness.
+	msg-buffer-size: 8192   # note this limits service, 'no huge stuff'.
+	msg-cache-size: 102400  # 100 Kb.
+	msg-cache-slabs: 1
+	rrset-cache-size: 102400  # 100 Kb.
+	rrset-cache-slabs: 1
+	infra-cache-numhosts: 200
+	infra-cache-numlame: 10
+	key-cache-size: 102400  # 100 Kb.
+	key-cache-slabs: 1
+	num-queries-per-thread: 30
+	target-fetch-policy: "2 1 0 0 0 0"
+	harden-large-queries: "yes"
+	harden-short-bufsize: "yes"
+	do-ip6: no	# save a bit of memory if not used.
+.fi
+.Sh FILES
+.Bl -tag -width indent
+.It Pa /etc/unbound
+default unbound working directory and default 
+.Xr chroot 2 
+location.
+.It Pa unbound.conf
+unbound configuration file.
+.It Pa unbound.pid
+default unbound pidfile with process ID of the running daemon.
+.It Pa unbound.log
+unbound log file. default is to log to 
+.Xr syslog 3 .
+.El
+.Sh SEE ALSO
+.Xr unbound 8 , 
+.Xr unbound-checkconf 8 .
+.Sh AUTHORS
+.Ic Unbound 
+was written by NLnet Labs. Please see CREDITS file
+in the distribution for further details.

doc/unbound.doxygen

@@ -150,7 +150,8 @@ MULTILINE_CPP_IS_BRIEF = NO
 # will output the detailed description near the top, like JavaDoc.
 # If set to NO, the detailed description appears after the member 
 # documentation.
-#DETAILS_AT_TOP         = NO
+
+DETAILS_AT_TOP         = NO
 
 # If the INHERIT_DOCS tag is set to YES (the default) then an undocumented 
 # member inherits the documentation from any documented member that it 
@@ -495,13 +496,6 @@ EXCLUDE                = ./build \
                          util/configparser.h \
                          util/configlexer.c \
                          util/locks.h \
-			 pythonmod/unboundmodule.py \
-			 pythonmod/interface.h \
-			 pythonmod/examples/resgen.py \
-			 pythonmod/examples/resmod.py \
-			 pythonmod/examples/resip.py \
-			 libunbound/python/unbound.py \
-			 libunbound/python/libunbound_wrap.c \
 			 ./ldns-src
 
 # The EXCLUDE_SYMLINKS tag can be used select whether or not files or 
@@ -920,7 +914,7 @@ MAN_LINKS              = NO
 # generate an XML file that captures the structure of 
 # the code including all documentation.
 
-GENERATE_XML           = YES
+GENERATE_XML           = NO
 
 # The XML_OUTPUT tag is used to specify where the XML pages will be put. 
 # If a relative path is entered the value of OUTPUT_DIRECTORY will be 

install-sh

@@ -1,520 +1,251 @@
 #!/bin/sh
+#
 # install - install a program, script, or datafile
-
-scriptversion=2009-04-28.21; # UTC
-
-# This originates from X11R5 (mit/util/scripts/install.sh), which was
-# later released in X11R6 (xc/config/util/install.sh) with the
-# following copyright and license.
+# This comes from X11R5 (mit/util/scripts/install.sh).
 #
-# Copyright (C) 1994 X Consortium
+# Copyright 1991 by the Massachusetts Institute of Technology
 #
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to
-# deal in the Software without restriction, including without limitation the
-# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-# sell copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
-# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
-# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-#
-# Except as contained in this notice, the name of the X Consortium shall not
-# be used in advertising or otherwise to promote the sale, use or other deal-
-# ings in this Software without prior written authorization from the X Consor-
-# tium.
-#
-#
-# FSF changes to this file are in the public domain.
+# Permission to use, copy, modify, distribute, and sell this software and its
+# documentation for any purpose is hereby granted without fee, provided that
+# the above copyright notice appear in all copies and that both that
+# copyright notice and this permission notice appear in supporting
+# documentation, and that the name of M.I.T. not be used in advertising or
+# publicity pertaining to distribution of the software without specific,
+# written prior permission.  M.I.T. makes no representations about the
+# suitability of this software for any purpose.  It is provided "as is"
+# without express or implied warranty.
 #
 # Calling this script install-sh is preferred over install.sh, to prevent
 # `make' implicit rules from creating a file called install from it
 # when there is no Makefile.
 #
 # This script is compatible with the BSD install script, but was written
-# from scratch.
+# from scratch.  It can only install one file at a time, a restriction
+# shared with many OS's install programs.
 
-nl='
-'
-IFS=" ""	$nl"
 
 # set DOITPROG to echo to test this script
 
 # Don't use :- since 4.3BSD and earlier shells don't like it.
-doit=${DOITPROG-}
-if test -z "$doit"; then
-  doit_exec=exec
-else
-  doit_exec=$doit
-fi
+doit="${DOITPROG-}"
 
-# Put in absolute file names if you don't have them in your path;
-# or use environment vars.
 
-chgrpprog=${CHGRPPROG-chgrp}
-chmodprog=${CHMODPROG-chmod}
-chownprog=${CHOWNPROG-chown}
-cmpprog=${CMPPROG-cmp}
-cpprog=${CPPROG-cp}
-mkdirprog=${MKDIRPROG-mkdir}
-mvprog=${MVPROG-mv}
-rmprog=${RMPROG-rm}
-stripprog=${STRIPPROG-strip}
+# put in absolute paths if you don't have them in your path; or use env. vars.
 
-posix_glob='?'
-initialize_posix_glob='
-  test "$posix_glob" != "?" || {
-    if (set -f) 2>/dev/null; then
-      posix_glob=
-    else
-      posix_glob=:
-    fi
-  }
-'
+mvprog="${MVPROG-mv}"
+cpprog="${CPPROG-cp}"
+chmodprog="${CHMODPROG-chmod}"
+chownprog="${CHOWNPROG-chown}"
+chgrpprog="${CHGRPPROG-chgrp}"
+stripprog="${STRIPPROG-strip}"
+rmprog="${RMPROG-rm}"
+mkdirprog="${MKDIRPROG-mkdir}"
 
-posix_mkdir=
-
-# Desired mode of installed file.
-mode=0755
-
-chgrpcmd=
-chmodcmd=$chmodprog
-chowncmd=
-mvcmd=$mvprog
+transformbasename=""
+transform_arg=""
+instcmd="$mvprog"
+chmodcmd="$chmodprog 0755"
+chowncmd=""
+chgrpcmd=""
+stripcmd=""
 rmcmd="$rmprog -f"
-stripcmd=
+mvcmd="$mvprog"
+src=""
+dst=""
+dir_arg=""
 
-src=
-dst=
-dir_arg=
-dst_arg=
+while [ x"$1" != x ]; do
+    case $1 in
+	-c) instcmd="$cpprog"
+	    shift
+	    continue;;
 
-copy_on_change=false
-no_target_directory=
+	-d) dir_arg=true
+	    shift
+	    continue;;
 
-usage="\
-Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
-   or: $0 [OPTION]... SRCFILES... DIRECTORY
-   or: $0 [OPTION]... -t DIRECTORY SRCFILES...
-   or: $0 [OPTION]... -d DIRECTORIES...
+	-m) chmodcmd="$chmodprog $2"
+	    shift
+	    shift
+	    continue;;
 
-In the 1st form, copy SRCFILE to DSTFILE.
-In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
-In the 4th, create DIRECTORIES.
+	-o) chowncmd="$chownprog $2"
+	    shift
+	    shift
+	    continue;;
 
-Options:
-     --help     display this help and exit.
-     --version  display version info and exit.
+	-g) chgrpcmd="$chgrpprog $2"
+	    shift
+	    shift
+	    continue;;
 
-  -c            (ignored)
-  -C            install only if different (preserve the last data modification time)
-  -d            create directories instead of installing files.
-  -g GROUP      $chgrpprog installed files to GROUP.
-  -m MODE       $chmodprog installed files to MODE.
-  -o USER       $chownprog installed files to USER.
-  -s            $stripprog installed files.
-  -t DIRECTORY  install into DIRECTORY.
-  -T            report an error if DSTFILE is a directory.
+	-s) stripcmd="$stripprog"
+	    shift
+	    continue;;
 
-Environment variables override the default commands:
-  CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
-  RMPROG STRIPPROG
-"
+	-t=*) transformarg=`echo $1 | sed 's/-t=//'`
+	    shift
+	    continue;;
 
-while test $# -ne 0; do
-  case $1 in
-    -c) ;;
+	-b=*) transformbasename=`echo $1 | sed 's/-b=//'`
+	    shift
+	    continue;;
 
-    -C) copy_on_change=true;;
-
-    -d) dir_arg=true;;
-
-    -g) chgrpcmd="$chgrpprog $2"
-	shift;;
-
-    --help) echo "$usage"; exit $?;;
-
-    -m) mode=$2
-	case $mode in
-	  *' '* | *'	'* | *'
-'*	  | *'*'* | *'?'* | *'['*)
-	    echo "$0: invalid mode: $mode" >&2
-	    exit 1;;
-	esac
-	shift;;
-
-    -o) chowncmd="$chownprog $2"
-	shift;;
-
-    -s) stripcmd=$stripprog;;
-
-    -t) dst_arg=$2
-	shift;;
-
-    -T) no_target_directory=true;;
-
-    --version) echo "$0 $scriptversion"; exit $?;;
-
-    --)	shift
-	break;;
-
-    -*)	echo "$0: invalid option: $1" >&2
-	exit 1;;
-
-    *)  break;;
-  esac
-  shift
-done
-
-if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
-  # When -d is used, all remaining arguments are directories to create.
-  # When -t is used, the destination is already specified.
-  # Otherwise, the last argument is the destination.  Remove it from $@.
-  for arg
-  do
-    if test -n "$dst_arg"; then
-      # $@ is not empty: it contains at least $arg.
-      set fnord "$@" "$dst_arg"
-      shift # fnord
-    fi
-    shift # arg
-    dst_arg=$arg
-  done
-fi
-
-if test $# -eq 0; then
-  if test -z "$dir_arg"; then
-    echo "$0: no input file specified." >&2
-    exit 1
-  fi
-  # It's OK to call `install-sh -d' without argument.
-  # This can happen when creating conditional directories.
-  exit 0
-fi
-
-if test -z "$dir_arg"; then
-  trap '(exit $?); exit' 1 2 13 15
-
-  # Set umask so as not to create temps with too-generous modes.
-  # However, 'strip' requires both read and write access to temps.
-  case $mode in
-    # Optimize common cases.
-    *644) cp_umask=133;;
-    *755) cp_umask=22;;
-
-    *[0-7])
-      if test -z "$stripcmd"; then
-	u_plus_rw=
-      else
-	u_plus_rw='% 200'
-      fi
-      cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
-    *)
-      if test -z "$stripcmd"; then
-	u_plus_rw=
-      else
-	u_plus_rw=,u+rw
-      fi
-      cp_umask=$mode$u_plus_rw;;
-  esac
-fi
-
-for src
-do
-  # Protect names starting with `-'.
-  case $src in
-    -*) src=./$src;;
-  esac
-
-  if test -n "$dir_arg"; then
-    dst=$src
-    dstdir=$dst
-    test -d "$dstdir"
-    dstdir_status=$?
-  else
-
-    # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
-    # might cause directories to be created, which would be especially bad
-    # if $src (and thus $dsttmp) contains '*'.
-    if test ! -f "$src" && test ! -d "$src"; then
-      echo "$0: $src does not exist." >&2
-      exit 1
-    fi
-
-    if test -z "$dst_arg"; then
-      echo "$0: no destination specified." >&2
-      exit 1
-    fi
-
-    dst=$dst_arg
-    # Protect names starting with `-'.
-    case $dst in
-      -*) dst=./$dst;;
-    esac
-
-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
-    if test -d "$dst"; then
-      if test -n "$no_target_directory"; then
-	echo "$0: $dst_arg: Is a directory" >&2
-	exit 1
-      fi
-      dstdir=$dst
-      dst=$dstdir/`basename "$src"`
-      dstdir_status=0
-    else
-      # Prefer dirname, but fall back on a substitute if dirname fails.
-      dstdir=`
-	(dirname "$dst") 2>/dev/null ||
-	expr X"$dst" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
-	     X"$dst" : 'X\(//\)[^/]' \| \
-	     X"$dst" : 'X\(//\)$' \| \
-	     X"$dst" : 'X\(/\)' \| . 2>/dev/null ||
-	echo X"$dst" |
-	    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)[^/].*/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\).*/{
-		   s//\1/
-		   q
-		 }
-		 s/.*/./; q'
-      `
-
-      test -d "$dstdir"
-      dstdir_status=$?
-    fi
-  fi
-
-  obsolete_mkdir_used=false
-
-  if test $dstdir_status != 0; then
-    case $posix_mkdir in
-      '')
-	# Create intermediate dirs using mode 755 as modified by the umask.
-	# This is like FreeBSD 'install' as of 1997-10-28.
-	umask=`umask`
-	case $stripcmd.$umask in
-	  # Optimize common cases.
-	  *[2367][2367]) mkdir_umask=$umask;;
-	  .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
-
-	  *[0-7])
-	    mkdir_umask=`expr $umask + 22 \
-	      - $umask % 100 % 40 + $umask % 20 \
-	      - $umask % 10 % 4 + $umask % 2
-	    `;;
-	  *) mkdir_umask=$umask,go-w;;
-	esac
-
-	# With -d, create the new directory with the user-specified mode.
-	# Otherwise, rely on $mkdir_umask.
-	if test -n "$dir_arg"; then
-	  mkdir_mode=-m$mode
-	else
-	  mkdir_mode=
-	fi
-
-	posix_mkdir=false
-	case $umask in
-	  *[123567][0-7][0-7])
-	    # POSIX mkdir -p sets u+wx bits regardless of umask, which
-	    # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-	    ;;
-	  *)
-	    tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-	    trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
-
-	    if (umask $mkdir_umask &&
-		exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+	*)  if [ x"$src" = x ]
 	    then
-	      if test -z "$dir_arg" || {
-		   # Check for POSIX incompatibilities with -m.
-		   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-		   # other-writeable bit of parent directory when it shouldn't.
-		   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-		   ls_ld_tmpdir=`ls -ld "$tmpdir"`
-		   case $ls_ld_tmpdir in
-		     d????-?r-*) different_mode=700;;
-		     d????-?--*) different_mode=755;;
-		     *) false;;
-		   esac &&
-		   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
-		     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
-		     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-		   }
-		 }
-	      then posix_mkdir=:
-	      fi
-	      rmdir "$tmpdir/d" "$tmpdir"
+		src=$1
 	    else
-	      # Remove any dirs left behind by ancient mkdir implementations.
-	      rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+		# this colon is to work around a 386BSD /bin/sh bug
+		:
+		dst=$1
 	    fi
-	    trap '' 0;;
-	esac;;
+	    shift
+	    continue;;
     esac
-
-    if
-      $posix_mkdir && (
-	umask $mkdir_umask &&
-	$doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
-      )
-    then :
-    else
-
-      # The umask is ridiculous, or mkdir does not conform to POSIX,
-      # or it failed possibly due to a race condition.  Create the
-      # directory the slow way, step by step, checking for races as we go.
-
-      case $dstdir in
-	/*) prefix='/';;
-	-*) prefix='./';;
-	*)  prefix='';;
-      esac
-
-      eval "$initialize_posix_glob"
-
-      oIFS=$IFS
-      IFS=/
-      $posix_glob set -f
-      set fnord $dstdir
-      shift
-      $posix_glob set +f
-      IFS=$oIFS
-
-      prefixes=
-
-      for d
-      do
-	test -z "$d" && continue
-
-	prefix=$prefix$d
-	if test -d "$prefix"; then
-	  prefixes=
-	else
-	  if $posix_mkdir; then
-	    (umask=$mkdir_umask &&
-	     $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
-	    # Don't fail if two instances are running concurrently.
-	    test -d "$prefix" || exit 1
-	  else
-	    case $prefix in
-	      *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
-	      *) qprefix=$prefix;;
-	    esac
-	    prefixes="$prefixes '$qprefix'"
-	  fi
-	fi
-	prefix=$prefix/
-      done
-
-      if test -n "$prefixes"; then
-	# Don't fail if two instances are running concurrently.
-	(umask $mkdir_umask &&
-	 eval "\$doit_exec \$mkdirprog $prefixes") ||
-	  test -d "$dstdir" || exit 1
-	obsolete_mkdir_used=true
-      fi
-    fi
-  fi
-
-  if test -n "$dir_arg"; then
-    { test -z "$chowncmd" || $doit $chowncmd "$dst"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } &&
-    { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false ||
-      test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1
-  else
-
-    # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
-
-    # Trap to clean up those temp files at exit.
-    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
-
-    # Copy the file name to the temp name.
-    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
-
-    # and set any options; do chmod last to preserve setuid bits.
-    #
-    # If any of these fail, we abort the whole thing.  If we want to
-    # ignore errors from any of these, just make sure not to ignore
-    # errors from the above "$doit $cpprog $src $dsttmp" command.
-    #
-    { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } &&
-    { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } &&
-    { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } &&
-
-    # If -C, don't bother to copy if it wouldn't change the file.
-    if $copy_on_change &&
-       old=`LC_ALL=C ls -dlL "$dst"	2>/dev/null` &&
-       new=`LC_ALL=C ls -dlL "$dsttmp"	2>/dev/null` &&
-
-       eval "$initialize_posix_glob" &&
-       $posix_glob set -f &&
-       set X $old && old=:$2:$4:$5:$6 &&
-       set X $new && new=:$2:$4:$5:$6 &&
-       $posix_glob set +f &&
-
-       test "$old" = "$new" &&
-       $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
-    then
-      rm -f "$dsttmp"
-    else
-      # Rename the file to the real destination.
-      $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
-
-      # The rename failed, perhaps because mv can't rename something else
-      # to itself, or perhaps because mv is so ancient that it does not
-      # support -f.
-      {
-	# Now remove or move aside any old file at destination location.
-	# We try this two ways since rm can't unlink itself on some
-	# systems and the destination file might be busy for other
-	# reasons.  In this case, the final cleanup might fail but the new
-	# file should still install successfully.
-	{
-	  test ! -f "$dst" ||
-	  $doit $rmcmd -f "$dst" 2>/dev/null ||
-	  { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-	    { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
-	  } ||
-	  { echo "$0: cannot unlink or rename $dst" >&2
-	    (exit 1); exit 1
-	  }
-	} &&
-
-	# Now rename the file to the real destination.
-	$doit $mvcmd "$dsttmp" "$dst"
-      }
-    fi || exit 1
-
-    trap '' 0
-  fi
 done
 
-# Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
-# time-stamp-end: "; # UTC"
-# End:
+if [ x"$src" = x ]
+then
+	echo "install:	no input file specified"
+	exit 1
+else
+	true
+fi
+
+if [ x"$dir_arg" != x ]; then
+	dst=$src
+	src=""
+	
+	if [ -d $dst ]; then
+		instcmd=:
+		chmodcmd=""
+	else
+		instcmd=mkdir
+	fi
+else
+
+# Waiting for this to be detected by the "$instcmd $src $dsttmp" command
+# might cause directories to be created, which would be especially bad 
+# if $src (and thus $dsttmp) contains '*'.
+
+	if [ -f $src -o -d $src ]
+	then
+		true
+	else
+		echo "install:  $src does not exist"
+		exit 1
+	fi
+	
+	if [ x"$dst" = x ]
+	then
+		echo "install:	no destination specified"
+		exit 1
+	else
+		true
+	fi
+
+# If destination is a directory, append the input filename; if your system
+# does not like double slashes in filenames, you may need to add some logic
+
+	if [ -d $dst ]
+	then
+		dst="$dst"/`basename $src`
+	else
+		true
+	fi
+fi
+
+## this sed command emulates the dirname command
+dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'`
+
+# Make sure that the destination directory exists.
+#  this part is taken from Noah Friedman's mkinstalldirs script
+
+# Skip lots of stat calls in the usual case.
+if [ ! -d "$dstdir" ]; then
+defaultIFS='	
+'
+IFS="${IFS-${defaultIFS}}"
+
+oIFS="${IFS}"
+# Some sh's can't handle IFS=/ for some reason.
+IFS='%'
+set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'`
+IFS="${oIFS}"
+
+pathcomp=''
+
+while [ $# -ne 0 ] ; do
+	pathcomp="${pathcomp}${1}"
+	shift
+
+	if [ ! -d "${pathcomp}" ] ;
+        then
+		$mkdirprog "${pathcomp}"
+	else
+		true
+	fi
+
+	pathcomp="${pathcomp}/"
+done
+fi
+
+if [ x"$dir_arg" != x ]
+then
+	$doit $instcmd $dst &&
+
+	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else true ; fi &&
+	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else true ; fi &&
+	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else true ; fi &&
+	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else true ; fi
+else
+
+# If we're going to rename the final executable, determine the name now.
+
+	if [ x"$transformarg" = x ] 
+	then
+		dstfile=`basename $dst`
+	else
+		dstfile=`basename $dst $transformbasename | 
+			sed $transformarg`$transformbasename
+	fi
+
+# don't allow the sed command to completely eliminate the filename
+
+	if [ x"$dstfile" = x ] 
+	then
+		dstfile=`basename $dst`
+	else
+		true
+	fi
+
+# Make a temp file name in the proper directory.
+
+	dsttmp=$dstdir/#inst.$$#
+
+# Move or copy the file name to the temp name
+
+	$doit $instcmd $src $dsttmp &&
+
+	trap "rm -f ${dsttmp}" 0 &&
+
+# and set any options; do chmod last to preserve setuid bits
+
+# If any of these fail, we abort the whole thing.  If we want to
+# ignore errors from any of these, just make sure not to ignore
+# errors from the above "$doit $instcmd $src $dsttmp" command.
+
+	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else true;fi &&
+	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else true;fi &&
+	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else true;fi &&
+	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else true;fi &&
+
+# Now rename the file to the real destination.
+
+	$doit $rmcmd -f $dstdir/$dstfile &&
+	$doit $mvcmd $dsttmp $dstdir/$dstfile 
+
+fi &&
+
+
+exit 0

iterator/iter_delegpt.c

@@ -68,20 +68,13 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 		return NULL;
 	if(!delegpt_set_name(copy, region, dp->name))
 		return NULL;
-	copy->bogus = dp->bogus;
-	copy->has_parent_side_NS = dp->has_parent_side_NS;
 	for(ns = dp->nslist; ns; ns = ns->next) {
-		if(!delegpt_add_ns(copy, region, ns->name, (int)ns->lame))
+		if(!delegpt_add_ns(copy, region, ns->name))
 			return NULL;
 		copy->nslist->resolved = ns->resolved;
-		copy->nslist->got4 = ns->got4;
-		copy->nslist->got6 = ns->got6;
-		copy->nslist->done_pside4 = ns->done_pside4;
-		copy->nslist->done_pside6 = ns->done_pside6;
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
-		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, 
-			a->bogus, a->lame, 0))
+		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen))
 			return NULL;
 	}
 	return copy;
@@ -96,8 +89,7 @@ delegpt_set_name(struct delegpt* dp, struct regional* region, uint8_t* name)
 }
 
 int 
-delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
-	int lame)
+delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name)
 {
 	struct delegpt_ns* ns;
 	size_t len;
@@ -115,11 +107,6 @@ delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
 	dp->nslist = ns;
 	ns->name = regional_alloc_init(region, name, ns->namelen);
 	ns->resolved = 0;
-	ns->got4 = 0;
-	ns->got6 = 0;
-	ns->lame = (uint8_t)lame;
-	ns->done_pside4 = 0;
-	ns->done_pside6 = 0;
 	return 1;
 }
 
@@ -137,57 +124,25 @@ delegpt_find_ns(struct delegpt* dp, uint8_t* name, size_t namelen)
 	return NULL;
 }
 
-struct delegpt_addr*
-delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr, 
-	socklen_t addrlen)
-{
-	struct delegpt_addr* p = dp->target_list;
-	while(p) {
-		if(sockaddr_cmp_addr(addr, addrlen, &p->addr, p->addrlen)==0) {
-			return p;
-		}
-		p = p->next_target;
-	}
-	return NULL;
-}
-
 int 
 delegpt_add_target(struct delegpt* dp, struct regional* region, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int lame, int nodup)
+	socklen_t addrlen)
 {
 	struct delegpt_ns* ns = delegpt_find_ns(dp, name, namelen);
 	if(!ns) {
 		/* ignore it */
 		return 1;
 	}
-	if(!lame) {
-		if(addr_is_ip6(addr, addrlen))
-			ns->got6 = 1;
-		else	ns->got4 = 1;
-		if(ns->got4 && ns->got6)
-			ns->resolved = 1;
-	}
-	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, nodup);
+	ns->resolved = 1;
+	return delegpt_add_addr(dp, region, addr, addrlen);
 }
 
 int 
 delegpt_add_addr(struct delegpt* dp, struct regional* region, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
-	int lame, int nodup)
+	struct sockaddr_storage* addr, socklen_t addrlen)
 {
-	struct delegpt_addr* a;
-	if(nodup) {
-		if((a = delegpt_find_addr(dp, addr, addrlen))) {
-			if(bogus)
-				a->bogus = bogus;
-			if(!lame)
-				a->lame = 0;
-			return 1;
-		}
-	}
-
-	a = (struct delegpt_addr*)regional_alloc(region,
+	struct delegpt_addr* a = (struct delegpt_addr*)regional_alloc(region,
 		sizeof(struct delegpt_addr));
 	if(!a)
 		return 0;
@@ -199,12 +154,11 @@ delegpt_add_addr(struct delegpt* dp, struct regional* region,
 	memcpy(&a->addr, addr, addrlen);
 	a->addrlen = addrlen;
 	a->attempts = 0;
-	a->bogus = bogus;
-	a->lame = lame;
 	return 1;
 }
 
-void
+/** count NS and number missing */
+static void
 delegpt_count_ns(struct delegpt* dp, size_t* numns, size_t* missing)
 {
 	struct delegpt_ns* ns;
@@ -217,7 +171,8 @@ delegpt_count_ns(struct delegpt* dp, size_t* numns, size_t* missing)
 	}
 }
 
-void
+/** count addresses, and number in result and available lists */
+static void
 delegpt_count_addr(struct delegpt* dp, size_t* numaddr, size_t* numres, 
 	size_t* numavail)
 {
@@ -252,26 +207,16 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 	delegpt_count_ns(dp, &numns, &missing);
 	delegpt_count_addr(dp, &numaddr, &numres, &numavail);
 	log_info("DelegationPoint<%s>: %u names (%u missing), "
-		"%u addrs (%u result, %u avail)%s", 
+		"%u addrs (%u result, %u avail)", 
 		buf, (unsigned)numns, (unsigned)missing, 
-		(unsigned)numaddr, (unsigned)numres, (unsigned)numavail,
-		(dp->has_parent_side_NS?" parentNS":" cacheNS"));
+		(unsigned)numaddr, (unsigned)numres, (unsigned)numavail);
 	if(verbosity >= VERB_ALGO) {
 		for(ns = dp->nslist; ns; ns = ns->next) {
 			dname_str(ns->name, buf);
-			log_info("  %s %s%s%s%s%s%s%s", buf, 
-			(ns->resolved?"*":""),
-			(ns->got4?" A":""), (ns->got6?" AAAA":""),
-			(dp->bogus?" BOGUS":""), (ns->lame?" PARENTSIDE":""),
-			(ns->done_pside4?" PSIDE_A":""),
-			(ns->done_pside6?" PSIDE_AAAA":""));
+			log_info("  %s%s", buf, (ns->resolved?"*":""));
 		}
 		for(a = dp->target_list; a; a = a->next_target) {
-			const char* str = "  ";
-			if(a->bogus && a->lame) str = "  BOGUS ADDR_LAME ";
-			else if(a->bogus) str = "  BOGUS ";
-			else if(a->lame) str = "  ADDR_LAME ";
-			log_addr(VERB_ALGO, str, &a->addr, a->addrlen);
+			log_addr(VERB_ALGO, "  ", &a->addr, a->addrlen);
 		}
 	}
 }
@@ -288,16 +233,6 @@ delegpt_add_unused_targets(struct delegpt* dp)
 	}
 }
 
-size_t
-delegpt_count_targets(struct delegpt* dp)
-{
-	struct delegpt_addr* a;
-	size_t n = 0;
-	for(a = dp->target_list; a; a = a->next_target)
-		n++;
-	return n;
-}
-
 size_t 
 delegpt_count_missing_targets(struct delegpt* dp)
 {
@@ -346,10 +281,9 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 	dp = delegpt_create(region);
 	if(!dp)
 		return NULL;
-	dp->has_parent_side_NS = 1; /* created from message */
 	if(!delegpt_set_name(dp, region, ns_rrset->rk.dname))
 		return NULL;
-	if(!delegpt_rrset_add_ns(dp, region, ns_rrset, 0))
+	if(!delegpt_rrset_add_ns(dp, region, ns_rrset))
 		return NULL;
 
 	/* add glue, A and AAAA in answer and additional section */
@@ -361,10 +295,10 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 			continue;
 
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_A) {
-			if(!delegpt_add_rrset_A(dp, region, s, 0, 0))
+			if(!delegpt_add_rrset_A(dp, region, s))
 				return NULL;
 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_AAAA) {
-			if(!delegpt_add_rrset_AAAA(dp, region, s, 0, 0))
+			if(!delegpt_add_rrset_AAAA(dp, region, s))
 				return NULL;
 		}
 	}
@@ -373,20 +307,18 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 
 int 
 delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
-        struct ub_packed_rrset_key* ns_rrset, int lame)
+        struct ub_packed_rrset_key* ns_rrset)
 {
 	struct packed_rrset_data* nsdata = (struct packed_rrset_data*)
 		ns_rrset->entry.data;
 	size_t i;
-	if(nsdata->security == sec_status_bogus)
-		dp->bogus = 1;
 	for(i=0; i<nsdata->count; i++) {
 		if(nsdata->rr_len[i] < 2+1) continue; /* len + root label */
 		if(dname_valid(nsdata->rr_data[i]+2, nsdata->rr_len[i]-2) !=
 			(size_t)ldns_read_uint16(nsdata->rr_data[i]))
 			continue; /* bad format */
 		/* add rdata of NS (= wirefmt dname), skip rdatalen bytes */
-		if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame))
+		if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2))
 			return 0;
 	}
 	return 1;
@@ -394,7 +326,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int lame, int nodup)
+	struct ub_packed_rrset_key* ak)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -409,7 +341,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin_addr, d->rr_data[i]+2, INET_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), lame, nodup))
+                        len))
                         return 0;
         }
         return 1;
@@ -417,7 +349,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int lame, int nodup)
+	struct ub_packed_rrset_key* ak)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -432,7 +364,7 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin6_addr, d->rr_data[i]+2, INET6_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), lame, nodup))
+                        len))
                         return 0;
         }
         return 1;
@@ -440,46 +372,16 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset(struct delegpt* dp, struct regional* region,
-        struct ub_packed_rrset_key* rrset, int lame)
+        struct ub_packed_rrset_key* rrset)
 {
 	if(!rrset)
 		return 1;
 	if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS)
-		return delegpt_rrset_add_ns(dp, region, rrset, lame);
+		return delegpt_rrset_add_ns(dp, region, rrset);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A)
-		return delegpt_add_rrset_A(dp, region, rrset, lame, 1);
+		return delegpt_add_rrset_A(dp, region, rrset);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA)
-		return delegpt_add_rrset_AAAA(dp, region, rrset, lame, 1);
+		return delegpt_add_rrset_AAAA(dp, region, rrset);
 	log_warn("Unknown rrset type added to delegpt");
 	return 1;
 }
-
-void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg)
-{
-	struct reply_info* rep = (struct reply_info*)msg->entry.data;
-	if(!rep) return;
-
-	/* if error or no answers */
-	if(FLAGS_GET_RCODE(rep->flags) != 0 || rep->an_numrrsets == 0) {
-		struct delegpt_ns* ns = delegpt_find_ns(dp, msg->key.qname, 
-			msg->key.qname_len);
-		if(ns) {
-			if(msg->key.qtype == LDNS_RR_TYPE_A)
-				ns->got4 = 1;
-			else if(msg->key.qtype == LDNS_RR_TYPE_AAAA)
-				ns->got6 = 1;
-			if(ns->got4 && ns->got6)
-				ns->resolved = 1;
-		}
-	}
-}
-
-void delegpt_no_ipv6(struct delegpt* dp)
-{
-	struct delegpt_ns* ns;
-	for(ns = dp->nslist; ns; ns = ns->next) {
-		/* no ipv6, so only ipv4 is enough to resolve a nameserver */
-		if(ns->got4)
-			ns->resolved = 1;
-	}
-}

iterator/iter_delegpt.h

@@ -48,7 +48,6 @@ struct delegpt_ns;
 struct delegpt_addr;
 struct dns_msg;
 struct ub_packed_rrset_key;
-struct msgreply_entry;
 
 /**
  * Delegation Point.
@@ -71,14 +70,6 @@ struct delegpt {
 	struct delegpt_addr* usable_list;
 	/** the list of returned targets; subset of target_list */
 	struct delegpt_addr* result_list;
-
-	/** if true, the NS RRset was bogus. All info is bad. */
-	int bogus;
-	/** if true, the parent-side NS record has been applied:
-	 * its names have been added and their addresses can follow later.
-	 * Also true if the delegationpoint was created from a delegation
-	 * message and thus contains the parent-side-info already. */
-	uint8_t has_parent_side_NS;
 };
 
 /**
@@ -93,28 +84,9 @@ struct delegpt_ns {
 	size_t namelen;
 	/** 
 	 * If the name has been resolved. false if not queried for yet.
-	 * true if the A, AAAA queries have been generated.
-	 * marked true if those queries fail.
-	 * and marked true if got4 and got6 are both true.
+	 * true if the address is known, or marked true if failed.
 	 */
 	int resolved;
-	/** if the ipv4 address is in the delegpt */
-	uint8_t got4;
-	/** if the ipv6 address is in the delegpt */
-	uint8_t got6;
-	/**
-	 * If the name is parent-side only and thus dispreferred.
-	 * Its addresses become dispreferred as well
-	 */
-	uint8_t lame;
-	/** if the parent-side ipv4 address has been looked up (last resort).
-	 * Also enabled if a parent-side cache entry exists, or a parent-side
-	 * negative-cache entry exists. */
-	uint8_t done_pside4;
-	/** if the parent-side ipv6 address has been looked up (last resort).
-	 * Also enabled if a parent-side cache entry exists, or a parent-side
-	 * negative-cache entry exists. */
-	uint8_t done_pside6;
 };
 
 /**
@@ -134,13 +106,6 @@ struct delegpt_addr {
 	socklen_t addrlen;
 	/** number of attempts for this addr */
 	int attempts;
-	/** rtt stored here in the selection algorithm */
-	int sel_rtt;
-	/** if true, the A or AAAA RR was bogus, so this address is bad.
-	 * Also check the dp->bogus to see if everything is bogus. */
-	int bogus;
-	/** if true, this address is dispreferred: it is a lame IP address */
-	int lame;
 };
 
 /**
@@ -173,22 +138,20 @@ int delegpt_set_name(struct delegpt* dp, struct regional* regional,
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param name: domain name in wire format.
- * @param lame: name is lame, disprefer it.
  * @return false on error.
  */
 int delegpt_add_ns(struct delegpt* dp, struct regional* regional, 
-	uint8_t* name, int lame);
+	uint8_t* name);
 
 /**
  * Add NS rrset; calls add_ns repeatedly.
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param ns_rrset: NS rrset.
- * @param lame: rrset is lame, disprefer it.
  * return 0 on alloc error.
  */
 int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
-	struct ub_packed_rrset_key* ns_rrset, int lame);
+	struct ub_packed_rrset_key* ns_rrset);
 
 /**
  * Add target address to the delegation point.
@@ -199,51 +162,41 @@ int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
  * @param namelen: length of name.
  * @param addr: the address.
  * @param addrlen: the length of addr.
- * @param bogus: security status for the address, pass true if bogus.
- * @param lame: address is lame.
- * @param nodup: if true, no address duplicates are made by this add. 
- *	name duplicates are always filtered.
  * @return false on error.
  */
 int delegpt_add_target(struct delegpt* dp, struct regional* regional, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int lame, int nodup);
+	socklen_t addrlen);
 
 /**
  * Add A RRset to delegpt.
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param rrset: RRset A to add.
- * @param lame: rrset is lame, disprefer it.
- * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int lame, int nodup);
+	struct ub_packed_rrset_key* rrset);
 
 /**
  * Add AAAA RRset to delegpt.
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param rrset: RRset AAAA to add.
- * @param lame: rrset is lame, disprefer it.
- * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int lame, int nodup);
+	struct ub_packed_rrset_key* rrset);
 
 /**
  * Add any RRset to delegpt.
- * Does not check for duplicates added.
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param rrset: RRset to add, NS, A, AAAA.
- * @param lame: rrset is lame, disprefer it.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int lame);
+	struct ub_packed_rrset_key* rrset);
 
 /**
  * Add address to the delegation point. No servername is associated or checked.
@@ -251,14 +204,10 @@ int delegpt_add_rrset(struct delegpt* dp, struct regional* regional,
  * @param regional: where to allocate the info.
  * @param addr: the address.
  * @param addrlen: the length of addr.
- * @param bogus: if address is bogus.
- * @param lame: if address is lame.
- * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return false on error.
  */
 int delegpt_add_addr(struct delegpt* dp, struct regional* regional, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
-	int lame, int nodup);
+	struct sockaddr_storage* addr, socklen_t addrlen);
 
 /** 
  * Find NS record in name list of delegation point.
@@ -270,16 +219,6 @@ int delegpt_add_addr(struct delegpt* dp, struct regional* regional,
 struct delegpt_ns* delegpt_find_ns(struct delegpt* dp, uint8_t* name, 
 	size_t namelen);
 
-/** 
- * Find address record in total list of delegation point.
- * @param dp: delegation point.
- * @param addr: address
- * @param addrlen: length of addr
- * @return the addr structure or NULL if not found.
- */
-struct delegpt_addr* delegpt_find_addr(struct delegpt* dp, 
-	struct sockaddr_storage* addr, socklen_t addrlen);
-
 /**
  * Print the delegation point to the log. For debugging.
  * @param v: verbosity value that is needed to emit to log.
@@ -287,13 +226,6 @@ struct delegpt_addr* delegpt_find_addr(struct delegpt* dp,
  */
 void delegpt_log(enum verbosity_value v, struct delegpt* dp);
 
-/** count NS and number missing for logging */
-void delegpt_count_ns(struct delegpt* dp, size_t* numns, size_t* missing);
-
-/** count addresses, and number in result and available lists, for logging */
-void delegpt_count_addr(struct delegpt* dp, size_t* numaddr, size_t* numres, 
-	size_t* numavail);
-
 /**
  * Add all usable targets to the result list.
  * @param dp: delegation point.
@@ -307,9 +239,6 @@ void delegpt_add_unused_targets(struct delegpt* dp);
  */
 size_t delegpt_count_missing_targets(struct delegpt* dp);
 
-/** count total number of targets in dp */
-size_t delegpt_count_targets(struct delegpt* dp);
-
 /**
  * Create new delegation point from a dns message
  *
@@ -331,18 +260,4 @@ size_t delegpt_count_targets(struct delegpt* dp);
 struct delegpt* delegpt_from_message(struct dns_msg* msg, 
 	struct regional* regional);
 
-/**
- * Add negative message to delegation point.
- * @param dp: delegation point.
- * @param msg: the message added, marks off A or AAAA from an NS entry.
- */
-void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg);
-
-/**
- * Register the fact that there is no ipv6 and thus AAAAs are not going 
- * to be queried for or be useful.
- * @param dp: the delegation point. Updated to reflect no ipv6.
- */
-void delegpt_no_ipv6(struct delegpt* dp);
-
 #endif /* ITERATOR_ITER_DELEGPT_H */

iterator/iter_donotq.c

@@ -48,6 +48,21 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 
+int
+donotq_cmp(const void* k1, const void* k2)
+{
+	struct iter_donotq_addr* n1 = (struct iter_donotq_addr*)k1;
+	struct iter_donotq_addr* n2 = (struct iter_donotq_addr*)k2;
+	int r = sockaddr_cmp_addr(&n1->addr, n1->addrlen, &n2->addr, 
+		n2->addrlen);
+	if(r != 0) return r;
+	if(n1->net < n2->net)
+		return -1;
+	if(n1->net > n2->net)
+		return 1;
+	return 0;
+}
+
 struct iter_donotq* 
 donotq_create()
 {
@@ -69,6 +84,7 @@ donotq_delete(struct iter_donotq* dq)
 	if(!dq) 
 		return;
 	regional_destroy(dq->region);
+	free(dq->tree);
 	free(dq);
 }
 
@@ -77,28 +93,78 @@ static int
 donotq_insert(struct iter_donotq* dq, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int net)
 {
-	struct addr_tree_node* node = (struct addr_tree_node*)regional_alloc(
-		dq->region, sizeof(*node));
+	struct iter_donotq_addr* node = regional_alloc(dq->region,
+		sizeof(struct iter_donotq_addr));
 	if(!node)
 		return 0;
-	if(!addr_tree_insert(&dq->tree, node, addr, addrlen, net)) {
-		verbose(VERB_QUERY, "duplicate donotquery address ignored.");
+	node->node.key = node;
+	memcpy(&node->addr, addr, addrlen);
+	node->addrlen = addrlen;
+	node->net = net;
+	node->parent = NULL;
+	if(!rbtree_insert(dq->tree, &node->node)) {
+		verbose(VERB_DETAIL, "duplicate donotquery address ignored.");
 	}
 	return 1;
 }
 
+/** make sure the netblock ends in zeroes for compare in tree */
+static void
+mask_block(int ip6, struct sockaddr_storage* addr, int net)
+{
+	uint8_t mask[8] = {0x0, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe};
+	int i, max;
+	uint8_t* s;
+	if(ip6) {
+		s = (uint8_t*)&((struct sockaddr_in6*)addr)->sin6_addr;
+		max = 128;
+	} else {
+		s = (uint8_t*)&((struct sockaddr_in*)addr)->sin_addr;
+		max = 32;
+	}
+	if(net >= max)
+		return;
+	for(i=net/8+1; i<max/8; i++) {
+		s[i] = 0;
+	}
+	s[net/8] &= mask[net&0x7];
+}
+
 /** apply donotq string */
 static int
 donotq_str_cfg(struct iter_donotq* dq, const char* str)
 {
 	struct sockaddr_storage addr;
 	int net;
+	char* s = NULL;
 	socklen_t addrlen;
-	verbose(VERB_ALGO, "donotq: %s", str);
-	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
-		log_err("cannot parse donotquery netblock: %s", str);
+	net = (str_is_ip6(str)?128:32);
+	if((s=strchr(str, '/'))) {
+		if(atoi(s+1) > net) {
+			log_err("netblock too large: %s", str);
+			return 0;
+		}
+		net = atoi(s+1);
+		if(net == 0 && strcmp(s+1, "0") != 0) {
+			log_err("cannot parse donotquery netblock:"
+				" '%s'", str);
+			return 0;
+		}
+		if(!(s = strdup(str))) {
+			log_err("out of memory");
+			return 0;
+		}
+		*strchr(s, '/') = '\0';
+	}
+	if(!ipstrtoaddr(s?s:str, UNBOUND_DNS_PORT, &addr, &addrlen)) {
+		free(s);
+		log_err("cannot parse donotquery ip address: '%s'", str);
 		return 0;
 	}
+	if(s) {
+		free(s);
+		mask_block(str_is_ip6(str), &addr, net);
+	}
 	if(!donotq_insert(dq, &addr, addrlen, net)) {
 		log_err("out of memory");
 		return 0;
@@ -119,22 +185,86 @@ read_donotq(struct iter_donotq* dq, struct config_file* cfg)
 	return 1;
 }
 
+/** number of bits that two addrs share (are equal) */
+static int
+addr_in_common(struct sockaddr_storage* addr1, int net1, 
+	struct sockaddr_storage* addr2, int net2, socklen_t addrlen)
+{
+	int min = (net1<net2)?net1:net2;
+	int i, to;
+	int match = 0;
+	uint8_t* s1, *s2;
+	if(addr_is_ip6(addr1, addrlen)) {
+		s1 = (uint8_t*)&((struct sockaddr_in6*)addr1)->sin6_addr;
+		s2 = (uint8_t*)&((struct sockaddr_in6*)addr2)->sin6_addr;
+		to = 16;
+	} else {
+		s1 = (uint8_t*)&((struct sockaddr_in*)addr1)->sin_addr;
+		s2 = (uint8_t*)&((struct sockaddr_in*)addr2)->sin_addr;
+		to = 4;
+	}
+	/* match = bits_in_common(s1, s2, to); */
+	for(i=0; i<to; i++) {
+		if(s1[i] == s2[i]) {
+			match += 8;
+		} else {
+			uint8_t z = s1[i]^s2[i];
+			log_assert(z);
+			while(!(z&0x80)) {
+				match++;
+				z<<=1;
+			}
+			break;
+		}
+	}
+	if(match > min) match = min;
+	return match;
+}
+
+/** initialise parent pointers in the tree */
+static void
+donotq_init_parents(struct iter_donotq* donotq)
+{
+	struct iter_donotq_addr* node, *prev = NULL, *p;
+	int m;
+	RBTREE_FOR(node, struct iter_donotq_addr*, donotq->tree) {
+		node->parent = NULL;
+		if(!prev || prev->addrlen != node->addrlen) {
+			prev = node;
+			continue;
+		}
+		m = addr_in_common(&prev->addr, prev->net, &node->addr, 
+			node->net, node->addrlen);
+		/* sort order like: ::/0, 1::/2, 1::/4, ... 2::/2 */
+		/* find the previous, or parent-parent-parent */
+		for(p = prev; p; p = p->parent)
+			if(p->net <= m) {
+				/* ==: since prev matched m, this is closest*/
+				/* <: prev matches more, but is not a parent,
+				* this one is a (grand)parent */
+				node->parent = p;
+				break;
+			}
+		prev = node;
+	}
+}
+
 int 
 donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
 {
-	regional_free_all(dq->region);
-	addr_tree_init(&dq->tree);
+	free(dq->tree);
+	dq->tree = rbtree_create(donotq_cmp);
+	if(!dq->tree)
+		return 0;
 	if(!read_donotq(dq, cfg))
 		return 0;
 	if(cfg->donotquery_localhost) {
 		if(!donotq_str_cfg(dq, "127.0.0.0/8"))
 			return 0;
-		if(cfg->do_ip6) {
-			if(!donotq_str_cfg(dq, "::1"))
-				return 0;
-		}
+		if(!donotq_str_cfg(dq, "::1"))
+			return 0;
 	}
-	addr_tree_init_parents(&dq->tree);
+	donotq_init_parents(dq);
 	return 1;
 }
 
@@ -142,7 +272,33 @@ int
 donotq_lookup(struct iter_donotq* donotq, struct sockaddr_storage* addr,
         socklen_t addrlen)
 {
-	return addr_tree_lookup(&donotq->tree, addr, addrlen) != NULL;
+	/* lookup in the tree */
+	rbnode_t* res = NULL;
+	struct iter_donotq_addr* result;
+	struct iter_donotq_addr key;
+	key.node.key = &key;
+	memcpy(&key.addr, addr, addrlen);
+	key.addrlen = addrlen;
+	key.net = (addr_is_ip6(addr, addrlen)?128:32);
+	if(rbtree_find_less_equal(donotq->tree, &key, &res)) {
+		/* exact */
+		return 1;
+	} else {
+		/* smaller element (or no element) */
+		int m;
+		result = (struct iter_donotq_addr*)res;
+		if(!result || result->addrlen != addrlen)
+			return 0;
+		/* count number of bits matched */
+		m = addr_in_common(&result->addr, result->net, addr, 
+			key.net, addrlen);
+		while(result) { /* go up until addr is inside netblock */
+			if(result->net <= m)
+				return 1;
+			result = result->parent;
+		}
+	}
+	return 0;
 }
 
 size_t 

iterator/iter_donotq.h

@@ -42,7 +42,7 @@
 
 #ifndef ITERATOR_ITER_DONOTQ_H
 #define ITERATOR_ITER_DONOTQ_H
-#include "util/storage/dnstree.h"
+#include "util/rbtree.h"
 struct iter_env;
 struct config_file;
 struct regional;
@@ -54,11 +54,27 @@ struct iter_donotq {
 	/** regional for allocation */
 	struct regional* region;
 	/** 
-	 * Tree of the address spans that are blocked.
-	 * contents of type addr_tree_node. Each node is an address span 
-	 * that must not be used to send queries to.
+	 * Tree of the single addresses that are blocked.
+	 * contents of type iter_donotq_addr.
 	 */
-	rbtree_t tree;
+	rbtree_t* tree;
+};
+
+/**
+ * Iterator donotquery address.
+ * A single address that must not be used to send queries to.
+ */
+struct iter_donotq_addr {
+	/** redblacktree node, key is this structure: addr and addrlen */
+	rbnode_t node;
+	/** address */
+	struct sockaddr_storage addr;
+	/** length of addr */
+	socklen_t addrlen;
+	/** netblock size */
+	int net;
+	/** parent node in donotq tree that encompasses this entry */
+	struct iter_donotq_addr* parent;
 };
 
 /**
@@ -98,4 +114,7 @@ int donotq_lookup(struct iter_donotq* donotq, struct sockaddr_storage* addr,
  */
 size_t donotq_get_mem(struct iter_donotq* donotq);
 
+/** compare two donotq entries */
+int donotq_cmp(const void* k1, const void* k2);
+
 #endif /* ITERATOR_ITER_DONOTQ_H */

iterator/iter_fwd.c

@@ -40,9 +40,6 @@
  * Keep track of forward zones and config settings.
  */
 #include "config.h"
-#include "ldns/rdata.h"
-#include "ldns/dname.h"
-#include "ldns/rr.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -91,10 +88,9 @@ forwards_delete(struct iter_forwards* fwd)
 	free(fwd);
 }
 
-/** insert info into forward structure */
+/** insert new info into forward structure */
 static int
-forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm, 
-	size_t nmlen, int nmlabs, struct delegpt* dp)
+forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
 {
 	struct iter_forward_zone* node = regional_alloc(fwd->region,
 		sizeof(struct iter_forward_zone));
@@ -102,11 +98,11 @@ forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 		return 0;
 	node->node.key = node;
 	node->dclass = c;
-	node->name = regional_alloc_init(fwd->region, nm, nmlen);
+	node->name = regional_alloc_init(fwd->region, dp->name, dp->namelen);
 	if(!node->name)
 		return 0;
-	node->namelen = nmlen;
-	node->namelabs = nmlabs;
+	node->namelen = dp->namelen;
+	node->namelabs = dp->namelabs;
 	node->dp = dp;
 	if(!rbtree_insert(fwd->tree, &node->node)) {
 		log_err("duplicate forward zone ignored.");
@@ -114,14 +110,6 @@ forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 	return 1;
 }
 
-/** insert new info into forward structure given dp */
-static int
-forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
-{
-	return forwards_insert_data(fwd, c, dp->name, dp->namelen,
-		dp->namelabs, dp);
-}
-
 /** initialise parent pointers in the tree */
 static void
 fwd_init_parents(struct iter_forwards* fwd)
@@ -190,7 +178,7 @@ read_fwds_host(struct iter_forwards* fwd, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_ns(dp, fwd->region, ldns_rdf_data(rdf), 0)) {
+		if(!delegpt_add_ns(dp, fwd->region, ldns_rdf_data(rdf))) {
 			ldns_rdf_deep_free(rdf);
 			log_err("out of memory");
 			return 0;
@@ -215,8 +203,7 @@ read_fwds_addr(struct iter_forwards* fwd, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen, 
-			0, 0, 1)) {
+		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -235,67 +222,14 @@ read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
 			log_err("out of memory");
 			return 0;
 		}
-		/* set flag that parent side NS information is included.
-		 * Asking a (higher up) server on the internet is not useful */
-		dp->has_parent_side_NS = 1;
 		if(!read_fwds_name(fwd, s, dp) ||
 			!read_fwds_host(fwd, s, dp) ||
 			!read_fwds_addr(fwd, s, dp))
 			return 0;
 		if(!forwards_insert(fwd, LDNS_RR_CLASS_IN, dp))
 			return 0;
-		verbose(VERB_QUERY, "Forward zone server list:");
-		delegpt_log(VERB_QUERY, dp);
-	}
-	return 1;
-}
-
-/** see if zone needs to have a hole inserted */
-static int
-need_hole_insert(rbtree_t* tree, struct iter_forward_zone* zone)
-{
-	struct iter_forward_zone k;
-	if(rbtree_search(tree, zone))
-		return 0; /* exact match exists */
-	k = *zone;
-	k.node.key = &k;
-	/* search up the tree */
-	do {
-		dname_remove_label(&k.name, &k.namelen);
-		k.namelabs --;
-		if(rbtree_search(tree, &k))
-			return 1; /* found an upper forward zone, need hole */
-	} while(k.namelabs > 1);
-	return 0; /* no forwards above, no holes needed */
-}
-
-/** make NULL entries for stubs */
-static int
-make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
-{
-	struct config_stub* s;
-	struct iter_forward_zone key;
-	key.node.key = &key;
-	key.dclass = LDNS_RR_CLASS_IN;
-	for(s = cfg->stubs; s; s = s->next) {
-		ldns_rdf* rdf = ldns_dname_new_frm_str(s->name);
-		if(!rdf) {
-			log_err("cannot parse stub name '%s'", s->name);
-			return 0;
-		}
-		key.name = ldns_rdf_data(rdf);
-		key.namelabs = dname_count_size_labels(key.name, &key.namelen);
-		if(!need_hole_insert(fwd->tree, &key)) {
-			ldns_rdf_deep_free(rdf);
-			continue;
-		}
-		if(!forwards_insert_data(fwd, key.dclass, key.name, 
-			key.namelen, key.namelabs, NULL)) {
-			ldns_rdf_deep_free(rdf);
-			log_err("out of memory");
-			return 0;
-		}
-		ldns_rdf_deep_free(rdf);
+		verbose(VERB_DETAIL, "Forward zone server list:");
+		delegpt_log(VERB_DETAIL, dp);
 	}
 	return 1;
 }
@@ -304,7 +238,6 @@ int
 forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 {
 	free(fwd->tree);
-	regional_free_all(fwd->region);
 	fwd->tree = rbtree_create(fwd_cmp);
 	if(!fwd->tree)
 		return 0;
@@ -312,8 +245,6 @@ forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 	/* read forward zones */
 	if(!read_forwards(fwd, cfg))
 		return 0;
-	if(!make_stub_holes(fwd, cfg))
-		return 0;
 	fwd_init_parents(fwd);
 	return 1;
 }
@@ -352,92 +283,10 @@ forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 	return NULL;
 }
 
-struct delegpt* 
-forwards_lookup_root(struct iter_forwards* fwd, uint16_t qclass)
-{
-	uint8_t root = 0;
-	return forwards_lookup(fwd, &root, qclass);
-}
-
-int
-forwards_next_root(struct iter_forwards* fwd, uint16_t* dclass)
-{
-	struct iter_forward_zone key;
-	rbnode_t* n;
-	struct iter_forward_zone* p;
-	if(*dclass == 0) {
-		/* first root item is first item in tree */
-		n = rbtree_first(fwd->tree);
-		if(n == RBTREE_NULL)
-			return 0;
-		p = (struct iter_forward_zone*)n;
-		if(dname_is_root(p->name)) {
-			*dclass = p->dclass;
-			return 1;
-		}
-		/* root not first item? search for higher items */
-		*dclass = p->dclass + 1;
-		return forwards_next_root(fwd, dclass);
-	}
-	/* find class n in tree, we may get a direct hit, or if we don't
-	 * this is the last item of the previous class so rbtree_next() takes
-	 * us to the next root (if any) */
-	key.node.key = &key;
-	key.name = (uint8_t*)"\000";
-	key.namelen = 1;
-	key.namelabs = 0;
-	key.dclass = *dclass;
-	n = NULL;
-	if(rbtree_find_less_equal(fwd->tree, &key, &n)) {
-		/* exact */
-		return 1;
-	} else {
-		/* smaller element */
-		if(!n || n == RBTREE_NULL)
-			return 0; /* nothing found */
-		n = rbtree_next(n);
-		if(n == RBTREE_NULL)
-			return 0; /* no higher */
-		p = (struct iter_forward_zone*)n;
-		if(dname_is_root(p->name)) {
-			*dclass = p->dclass;
-			return 1;
-		}
-		/* not a root node, return next higher item */
-		*dclass = p->dclass+1;
-		return forwards_next_root(fwd, dclass);
-	}
-}
-
 size_t 
 forwards_get_mem(struct iter_forwards* fwd)
 {
 	if(!fwd)
 		return 0;
-	return sizeof(*fwd) + sizeof(*fwd->tree) + 
-		regional_get_mem(fwd->region);
+	return sizeof(*fwd) + regional_get_mem(fwd->region);
 }
-
-int 
-forwards_add_zone(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
-{
-	if(!forwards_insert(fwd, c, dp))
-		return 0;
-	fwd_init_parents(fwd);
-	return 1;
-}
-
-void 
-forwards_delete_zone(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
-{
-	struct iter_forward_zone key;
-	key.node.key = &key;
-	key.dclass = c;
-	key.name = nm;
-	key.namelabs = dname_count_size_labels(nm, &key.namelen);
-	if(!rbtree_search(fwd->tree, &key))
-		return; /* nothing to do */
-	(void)rbtree_delete(fwd->tree, &key);
-	fwd_init_parents(fwd);
-}
-

iterator/iter_fwd.h

@@ -43,6 +43,7 @@
 #ifndef ITERATOR_ITER_FWD_H
 #define ITERATOR_ITER_FWD_H
 #include "util/rbtree.h"
+struct iter_env;
 struct config_file;
 struct delegpt;
 struct regional;
@@ -55,7 +56,7 @@ struct iter_forwards {
 	struct regional* region;
 	/** 
 	 * Zones are stored in this tree. Sort order is specially chosen.
-	 * first sorted on qclass. Then on dname in nsec-like order, so that
+	 * first sorted on qtype. Then on dname in nsec-like order, so that
 	 * a lookup on class, name will return an exact match or the closest
 	 * match which gives the ancestor needed.
 	 * contents of type iter_forward_zone.
@@ -75,9 +76,7 @@ struct iter_forward_zone {
 	size_t namelen;
 	/** number of labels in name */
 	int namelabs;
-	/** delegation point with forward server information for this zone. 
-	 * If NULL then this forward entry is used to indicate that a
-	 * stub-zone with the same name exists, and should be used. */
+	/** delegation point with forward server information for this zone. */
 	struct delegpt* dp;
 	/** pointer to parent in tree (or NULL if none) */
 	struct iter_forward_zone* parent;
@@ -119,23 +118,6 @@ int forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg);
 struct delegpt* forwards_lookup(struct iter_forwards* fwd, 
 	uint8_t* qname, uint16_t qclass);
 
-/**
- * Same as forwards_lookup, but for the root only
- * @param fwd: forward storage.
- * @param qclass: The qclass of the query.
- * @return: A delegation point if root forward exists, otherwise null.
- */
-struct delegpt* forwards_lookup_root(struct iter_forwards* fwd, 
-	uint16_t qclass);
-
-/**
- * Find next root item in forwards lookup tree.
- * @param fwd: the forward storage
- * @param qclass: class to look at next, or higher.
- * @return false if none found, or if true stored in qclass.
- */
-int forwards_next_root(struct iter_forwards* fwd, uint16_t* qclass);
-
 /**
  * Get memory in use by forward storage
  * @param fwd: forward storage.
@@ -146,28 +128,4 @@ size_t forwards_get_mem(struct iter_forwards* fwd);
 /** compare two fwd entries */
 int fwd_cmp(const void* k1, const void* k2);
 
-/**
- * Add zone to forward structure. For external use since it recalcs 
- * the tree parents.
- * @param fwd: the forward data structure
- * @param c: class of zone
- * @param dp: delegation point with name and target nameservers for new
- *	forward zone. This delegation point and all its data must be
- *	malloced in the fwd->region. (then it is freed when the fwd is
- *	deleted).
- * @return false on failure (out of memory);
- */
-int forwards_add_zone(struct iter_forwards* fwd, uint16_t c, 
-	struct delegpt* dp);
-
-/**
- * Remove zone from forward structure. For external use since it 
- * recalcs the tree parents. Does not actually release any memory, the region 
- * is unchanged.
- * @param fwd: the forward data structure
- * @param c: class of zone
- * @param nm: name of zone (in uncompressed wireformat).
- */
-void forwards_delete_zone(struct iter_forwards* fwd, uint16_t c, uint8_t* nm);
-
 #endif /* ITERATOR_ITER_FWD_H */

iterator/iter_hints.c

@@ -40,8 +40,6 @@
  * Keep track of stub and root hints, and read those from config.
  */
 #include "config.h"
-#include "ldns/dname.h"
-#include "ldns/rr.h"
 #include "iterator/iter_hints.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -50,6 +48,21 @@
 #include "util/net_help.h"
 #include "util/data/dname.h"
 
+int
+stub_cmp(const void* k1, const void* k2)
+{
+	int m;
+	struct iter_hints_stub* n1 = (struct iter_hints_stub*)k1;
+	struct iter_hints_stub* n2 = (struct iter_hints_stub*)k2;
+	if(n1->hint_class != n2->hint_class) {
+		if(n1->hint_class < n2->hint_class)
+			return -1;
+		return 1;
+	}
+	return dname_lab_cmp(n1->name, n1->namelabs, n2->name, n2->namelabs, 
+		&m);
+}
+
 struct iter_hints* 
 hints_create()
 {
@@ -71,6 +84,7 @@ hints_delete(struct iter_hints* hints)
 	if(!hints) 
 		return;
 	regional_destroy(hints->region);
+	free(hints->tree);
 	free(hints);
 }
 
@@ -85,10 +99,10 @@ ah(struct delegpt* dp, struct regional* r, const char* sv, const char* ip)
 		log_err("could not parse %s", sv);
 		return 0;
 	}
-	if(!delegpt_add_ns(dp, r, ldns_rdf_data(rdf), 0) ||
+	if(!delegpt_add_ns(dp, r, ldns_rdf_data(rdf)) ||
 	   !extstrtoaddr(ip, &addr, &addrlen) ||
 	   !delegpt_add_target(dp, r, ldns_rdf_data(rdf), ldns_rdf_size(rdf),
-		&addr, addrlen, 0, 0, 1)) {
+		&addr, addrlen)) {
 		ldns_rdf_deep_free(rdf);
 		return 0;
 	}
@@ -98,7 +112,7 @@ ah(struct delegpt* dp, struct regional* r, const char* sv, const char* ip)
 
 /** obtain compiletime provided root hints */
 static struct delegpt* 
-compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
+compile_time_root_prime(struct regional* r)
 {
 	/* from:
 	 ;       This file is made available by InterNIC
@@ -107,15 +121,14 @@ compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
 	 ;           on server           FTP.INTERNIC.NET
 	 ;       -OR-                    RS.INTERNIC.NET
 	 ;
-	 ;       related version of root zone:   2008051300
+	 ;       last update:    Jan 29, 2004
+	 ;       related version of root zone:   2004012900
 	 */
 	struct delegpt* dp = delegpt_create(r);
 	if(!dp)
 		return NULL;
-	dp->has_parent_side_NS = 1;
 	if(!delegpt_set_name(dp, r, (uint8_t*)"\000"))
 		return NULL;
-      if(do_ip4) {
 	if(!ah(dp, r, "A.ROOT-SERVERS.NET.", "198.41.0.4"))	return 0;
 	if(!ah(dp, r, "B.ROOT-SERVERS.NET.", "192.228.79.201")) return 0;
 	if(!ah(dp, r, "C.ROOT-SERVERS.NET.", "192.33.4.12"))	return 0;
@@ -129,41 +142,60 @@ compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
 	if(!ah(dp, r, "K.ROOT-SERVERS.NET.", "193.0.14.129"))	return 0;
 	if(!ah(dp, r, "L.ROOT-SERVERS.NET.", "199.7.83.42"))	return 0;
 	if(!ah(dp, r, "M.ROOT-SERVERS.NET.", "202.12.27.33"))	return 0;
-      }
-      if(do_ip6) {
-	if(!ah(dp, r, "A.ROOT-SERVERS.NET.", "2001:503:ba3e::2:30")) return 0;
-	if(!ah(dp, r, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) return 0;
-	if(!ah(dp, r, "H.ROOT-SERVERS.NET.", "2001:500:1::803f:235")) return 0;
-	if(!ah(dp, r, "J.ROOT-SERVERS.NET.", "2001:503:c27::2:30")) return 0;
-	if(!ah(dp, r, "K.ROOT-SERVERS.NET.", "2001:7fd::1")) return 0;
-	if(!ah(dp, r, "L.ROOT-SERVERS.NET.", "2001:500:3::42")) return 0;
-	if(!ah(dp, r, "M.ROOT-SERVERS.NET.", "2001:dc3::35")) return 0;
-      }
 	return dp;
 }
 
 /** insert new hint info into hint structure */
 static int
-hints_insert(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
-	int noprime)
+hints_insert(struct iter_hints* hints, uint16_t c, struct delegpt* dp)
 {
 	struct iter_hints_stub* node = regional_alloc(hints->region,
 		sizeof(struct iter_hints_stub));
-	uint8_t* nm;
 	if(!node)
 		return 0;
-	nm = regional_alloc_init(hints->region, dp->name, dp->namelen);
-	if(!nm)
+	node->node.key = node;
+	node->hint_class = c;
+	node->name = regional_alloc_init(hints->region, dp->name, dp->namelen);
+	if(!node->name)
 		return 0;
+	node->namelen = dp->namelen;
+	node->namelabs = dp->namelabs;
 	node->dp = dp;
-	node->noprime = (uint8_t)noprime;
-	if(!name_tree_insert(&hints->tree, &node->node, nm, dp->namelen,
-		dp->namelabs, c)) {
+	if(!rbtree_insert(hints->tree, &node->node)) {
 		log_err("second hints ignored.");
 	}
 	return 1;
 }
 
+/** initialise parent pointers in the tree */
+static void
+init_parents(struct iter_hints* hints)
+{
+	struct iter_hints_stub* node, *prev = NULL, *p;
+	int m;
+	RBTREE_FOR(node, struct iter_hints_stub*, hints->tree) {
+		node->parent = NULL;
+		if(!prev || prev->hint_class != node->hint_class) {
+			prev = node;
+			continue;
+		}
+		(void)dname_lab_cmp(prev->name, prev->namelabs, node->name,
+			node->namelabs, &m); /* we know prev is smaller */
+		/* sort order like: . com. bla.com. zwb.com. net. */
+		/* find the previous, or parent-parent-parent */
+		for(p = prev; p; p = p->parent)
+			/* looking for name with few labels, a parent */
+			if(p->namelabs <= m) {
+				/* ==: since prev matched m, this is closest*/
+				/* <: prev matches more, but is not a parent,
+				 * this one is a (grand)parent */
+				node->parent = p;
+				break;
+			}
+		prev = node;
+	}
+}
+
 /** set stub name */
 static int 
 read_stubs_name(struct iter_hints* hints, struct config_stub* s, 
@@ -203,7 +235,7 @@ read_stubs_host(struct iter_hints* hints, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_ns(dp, hints->region, ldns_rdf_data(rdf), 0)) {
+		if(!delegpt_add_ns(dp, hints->region, ldns_rdf_data(rdf))) {
 			ldns_rdf_deep_free(rdf);
 			log_err("out of memory");
 			return 0;
@@ -228,8 +260,7 @@ read_stubs_addr(struct iter_hints* hints, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen, 
-			0, 0, 1)) {
+		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -248,14 +279,13 @@ read_stubs(struct iter_hints* hints, struct config_file* cfg)
 			log_err("out of memory");
 			return 0;
 		}
-		dp->has_parent_side_NS = 1;
 		if(!read_stubs_name(hints, s, dp) ||
 			!read_stubs_host(hints, s, dp) ||
 			!read_stubs_addr(hints, s, dp))
 			return 0;
-		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, !s->isprime))
+		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp))
 			return 0;
-		delegpt_log(VERB_QUERY, dp);
+		delegpt_log(VERB_DETAIL, dp);
 	}
 	return 1;
 }
@@ -284,8 +314,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 		fclose(f);
 		return 0;
 	}
-	verbose(VERB_QUERY, "Reading root hints from %s", fname);
-	dp->has_parent_side_NS = 1;
+	verbose(VERB_DETAIL, "Reading root hints from %s", fname);
 	while(!feof(f)) {
 		status = ldns_rr_new_frm_fp_l(&rr, f, 
 			&default_ttl, &origin, &prev_rr, &lineno);
@@ -296,20 +325,23 @@ read_root_hints(struct iter_hints* hints, char* fname)
 		if(status != LDNS_STATUS_OK) {
 			log_err("reading root hints %s %d: %s", fname,
 				lineno, ldns_get_errorstr_by_id(status));
-			goto stop_read;
+			fclose(f);
+			return 0;
 		}
 		if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NS) {
 			if(!delegpt_add_ns(dp, hints->region,
-				ldns_rdf_data(ldns_rr_rdf(rr, 0)), 0)) {
+				ldns_rdf_data(ldns_rr_rdf(rr, 0)))) {
 				log_err("out of memory reading root hints");
-				goto stop_read;
+				fclose(f);
+				return 0;
 			}
 			c = ldns_rr_get_class(rr);
 			if(!dp->name) {
 				if(!delegpt_set_name(dp, hints->region, 
 					ldns_rdf_data(ldns_rr_owner(rr)))){
 					log_err("out of memory.");
-					goto stop_read;
+					fclose(f);
+					return 0;
 				}
 			}
 		} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_A) {
@@ -323,10 +355,10 @@ read_root_hints(struct iter_hints* hints, char* fname)
 			if(!delegpt_add_target(dp, hints->region,
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
-					(struct sockaddr_storage*)&sa, len, 
-					0, 0, 1)) {
+					(struct sockaddr_storage*)&sa, len)) {
 				log_err("out of memory reading root hints");
-				goto stop_read;
+				fclose(f);
+				return 0;
 			}
 		} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_AAAA) {
 			struct sockaddr_in6 sa;
@@ -339,10 +371,10 @@ read_root_hints(struct iter_hints* hints, char* fname)
 			if(!delegpt_add_target(dp, hints->region,
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
-					(struct sockaddr_storage*)&sa, len,
-					0, 0, 1)) {
+					(struct sockaddr_storage*)&sa, len)) {
 				log_err("out of memory reading root hints");
-				goto stop_read;
+				fclose(f);
+				return 0;
 			}
 		} else {
 			log_warn("root hints %s:%d skipping type %d",
@@ -351,29 +383,16 @@ read_root_hints(struct iter_hints* hints, char* fname)
 
 		ldns_rr_free(rr);
 	}
-
-	if (origin)
-		ldns_rdf_deep_free(origin);
-	if (prev_rr)
-		ldns_rdf_deep_free(prev_rr);
 	fclose(f);
 	if(!dp->name) {
 		log_warn("root hints %s: no NS content", fname);
 		return 1;
 	}
-	if(!hints_insert(hints, c, dp, 0)) {
+	if(!hints_insert(hints, c, dp)) {
 		return 0;
 	}
-	delegpt_log(VERB_QUERY, dp);
+	delegpt_log(VERB_DETAIL, dp);
 	return 1;
-
-stop_read:
-	if (origin)
-		ldns_rdf_deep_free(origin);
-	if (prev_rr)
-		ldns_rdf_deep_free(prev_rr);
-	fclose(f);
-	return 0;
 }
 
 /** read root hints list */
@@ -384,12 +403,7 @@ read_root_hints_list(struct iter_hints* hints, struct config_file* cfg)
 	for(p = cfg->root_hints; p; p = p->next) {
 		log_assert(p->str);
 		if(p->str && p->str[0]) {
-			char* f = p->str;
-			if(cfg->chrootdir && cfg->chrootdir[0] &&
-				strncmp(p->str, cfg->chrootdir, 
-				strlen(cfg->chrootdir)) == 0)
-				f += strlen(cfg->chrootdir);
-			if(!read_root_hints(hints, f))
+			if(!read_root_hints(hints, p->str))
 				return 0;
 		}
 	}
@@ -399,8 +413,10 @@ read_root_hints_list(struct iter_hints* hints, struct config_file* cfg)
 int 
 hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg)
 {
-	regional_free_all(hints->region);
-	name_tree_init(&hints->tree);
+	free(hints->tree);
+	hints->tree = rbtree_create(stub_cmp);
+	if(!hints->tree)
+		return 0;
 	
 	/* read root hints */
 	if(!read_root_hints_list(hints, cfg))
@@ -412,16 +428,16 @@ hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg)
 
 	/* use fallback compiletime root hints */
 	if(!hints_lookup_root(hints, LDNS_RR_CLASS_IN)) {
-		struct delegpt* dp = compile_time_root_prime(hints->region,
-			cfg->do_ip4, cfg->do_ip6);
+		struct delegpt* dp = compile_time_root_prime(hints->region);
 		verbose(VERB_ALGO, "no config, using builtin root hints.");
 		if(!dp) 
 			return 0;
-		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, 0))
+		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp))
 			return 0;
+		delegpt_log(VERB_DETAIL, dp);
 	}
 
-	name_tree_init_parents(&hints->tree);
+	init_parents(hints);
 	return 1;
 }
 
@@ -429,49 +445,59 @@ struct delegpt*
 hints_lookup_root(struct iter_hints* hints, uint16_t qclass)
 {
 	uint8_t rootlab = 0;
-	struct iter_hints_stub *stub;
-	stub = (struct iter_hints_stub*)name_tree_find(&hints->tree,
-		&rootlab, 1, 1, qclass);
+	struct iter_hints_stub key, *stub;
+	key.node.key = &key;
+	key.hint_class = qclass;
+	key.name = &rootlab;
+	key.namelen = 1;
+	key.namelabs = 1;
+	stub = (struct iter_hints_stub*)rbtree_search(hints->tree, &key);
 	if(!stub)
 		return NULL;
 	return stub->dp;
 }
 
-struct iter_hints_stub* 
+struct delegpt* 
 hints_lookup_stub(struct iter_hints* hints, uint8_t* qname, 
 	uint16_t qclass, struct delegpt* cache_dp)
 {
-	size_t len;
-	int labs;
-	struct iter_hints_stub *r;
-
 	/* first lookup the stub */
-	labs = dname_count_size_labels(qname, &len);
-	r = (struct iter_hints_stub*)name_tree_lookup(&hints->tree, qname,
-		len, labs, qclass);
-	if(!r) return NULL;
-
-	/*
-	 * If the stub is same as the delegation we got
-	 * And has noprime set, we need to 'prime' to use this stub instead.
-	 */
-	if(r->noprime && query_dname_compare(cache_dp->name, r->dp->name)==0)
-		return r; /* use this stub instead of cached dp */
-	
+	rbnode_t* res = NULL;
+	struct iter_hints_stub *result;
+	struct iter_hints_stub key;
+	key.node.key = &key;
+	key.hint_class = qclass;
+	key.name = qname;
+	key.namelabs = dname_count_size_labels(qname, &key.namelen);
+	if(rbtree_find_less_equal(hints->tree, &key, &res)) {
+		/* exact */
+		result = (struct iter_hints_stub*)res;
+	} else {
+		/* smaller element (or no element) */
+		int m;
+		result = (struct iter_hints_stub*)res;
+		if(!result || result->hint_class != qclass)
+			return NULL;
+		/* count number of labels matched */
+		(void)dname_lab_cmp(result->name, result->namelabs, key.name,
+			key.namelabs, &m);
+		while(result) { /* go up until qname is subdomain of stub */
+			if(result->namelabs <= m)
+				break;
+			result = result->parent;
+		}
+		if(!result)
+			return NULL;
+	}
 	/* 
 	 * If our cached delegation point is above the hint, we need to prime.
 	 */
-	if(dname_strict_subdomain(r->dp->name, r->dp->namelabs,
+	if(dname_strict_subdomain(result->dp->name, result->dp->namelabs,
 		cache_dp->name, cache_dp->namelabs))
-		return r; /* need to prime this stub */
+		return result->dp; /* need to prime this stub */
 	return NULL;
 }
 
-int hints_next_root(struct iter_hints* hints, uint16_t* qclass)
-{
-	return name_tree_next_root(&hints->tree, qclass);
-}
-
 size_t 
 hints_get_mem(struct iter_hints* hints)
 {

iterator/iter_hints.h

@@ -42,7 +42,7 @@
 
 #ifndef ITERATOR_ITER_HINTS_H
 #define ITERATOR_ITER_HINTS_H
-#include "util/storage/dnstree.h"
+#include "util/rbtree.h"
 struct iter_env;
 struct config_file;
 struct delegpt;
@@ -56,25 +56,32 @@ struct iter_hints {
 	struct regional* region;
 	/** 
 	 * Hints are stored in this tree. Sort order is specially chosen.
-	 * first sorted on qclass. Then on dname in nsec-like order, so that
+	 * first sorted on qtype. Then on dname in nsec-like order, so that
 	 * a lookup on class, name will return an exact match or the closest
 	 * match which gives the ancestor needed.
 	 * contents of type iter_hints_stub. The class IN root is in here.
-	 * uses name_tree_node from dnstree.h.
 	 */
-	rbtree_t tree;
+	rbtree_t* tree;
 };
 
 /**
  * Iterator hints for a particular stub.
  */
 struct iter_hints_stub {
-	/** tree sorted by name, class */
-	struct name_tree_node node;
+	/** redblacktree node, key is this structure: class and name */
+	rbnode_t node;
+	/** name */
+	uint8_t* name;
+	/** length of name */
+	size_t namelen;
+	/** number of labels in name */
+	int namelabs;
 	/** delegation point with hint information for this stub. */
 	struct delegpt* dp;
-	/** does the stub need to forego priming (like on other ports) */
-	uint8_t noprime;
+	/** pointer to parent in stub hint tree (or NULL if none) */
+	struct iter_hints_stub* parent;
+	/** class of hints. host order. */
+	uint16_t hint_class;
 };
 
 /**
@@ -105,18 +112,6 @@ int hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg);
  */
 struct delegpt* hints_lookup_root(struct iter_hints* hints, uint16_t qclass);
 
-/**
- * Find next root hints (to cycle through all root hints).
- * @param hints: hint storage
- * @param qclass: class for which root hints are sought.
- * 	0 means give the first available root hints class.
- * 	x means, give class x or a higher class if any.
- * 	returns the found class in this variable.
- * @return true if a root hint class is found.
- * 	false if not root hint class is found (qclass may have been changed).
- */
-int hints_next_root(struct iter_hints* hints, uint16_t* qclass);
-
 /**
  * Given a qname/qclass combination, and the delegation point from the cache
  * for this qname/qclass, determine if this combination indicates that a
@@ -129,7 +124,7 @@ int hints_next_root(struct iter_hints* hints, uint16_t* qclass);
  * @return: A priming delegation point if there is a stub hint that must
  *         be primed, otherwise null.
  */
-struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints, 
+struct delegpt* hints_lookup_stub(struct iter_hints* hints, 
 	uint8_t* qname, uint16_t qclass, struct delegpt* dp);
 
 /**
@@ -139,4 +134,7 @@ struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints,
  */
 size_t hints_get_mem(struct iter_hints* hints);
 
+/** compare two hint entries */
+int stub_cmp(const void* k1, const void* k2);
+
 #endif /* ITERATOR_ITER_HINTS_H */

iterator/iter_priv.c

@@ -1,263 +0,0 @@
-/*
- * iterator/iter_priv.c - iterative resolver private address and domain store
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains functions to assist the iterator module.
- * Keep track of the private addresses and lookup fast.
- */
-
-#include "config.h"
-#include "ldns/dname.h"
-#include "iterator/iter_priv.h"
-#include "util/regional.h"
-#include "util/log.h"
-#include "util/config_file.h"
-#include "util/data/dname.h"
-#include "util/data/msgparse.h"
-#include "util/net_help.h"
-#include "util/storage/dnstree.h"
-
-struct iter_priv* priv_create()
-{
-	struct iter_priv* priv = (struct iter_priv*)calloc(1, sizeof(*priv));
-	if(!priv)
-		return NULL;
-	priv->region = regional_create();
-	if(!priv->region) {
-		priv_delete(priv);
-		return NULL;
-	}
-	addr_tree_init(&priv->a);
-	name_tree_init(&priv->n);
-	return priv;
-}
-
-void priv_delete(struct iter_priv* priv)
-{
-	if(!priv) return;
-	regional_destroy(priv->region);
-	free(priv);
-}
-
-/** Read private-addr declarations from config */
-static int read_addrs(struct iter_priv* priv, struct config_file* cfg)
-{
-	/* parse addresses, report errors, insert into tree */
-	struct config_strlist* p;
-	struct addr_tree_node* n;
-	struct sockaddr_storage addr;
-	int net;
-	socklen_t addrlen;
-
-	for(p = cfg->private_address; p; p = p->next) {
-		log_assert(p->str);
-		if(!netblockstrtoaddr(p->str, UNBOUND_DNS_PORT, &addr, 
-			&addrlen, &net)) {
-			log_err("cannot parse private-address: %s", p->str);
-			return 0;
-		}
-		n = (struct addr_tree_node*)regional_alloc(priv->region,
-			sizeof(*n));
-		if(!n) {
-			log_err("out of memory");
-			return 0;
-		}
-		if(!addr_tree_insert(&priv->a, n, &addr, addrlen, net)) {
-			verbose(VERB_QUERY, "ignoring duplicate "
-				"private-address: %s", p->str);
-		}
-	}
-	return 1;
-}
-
-/** Read private-domain declarations from config */
-static int read_names(struct iter_priv* priv, struct config_file* cfg)
-{
-	/* parse names, report errors, insert into tree */
-	struct config_strlist* p;
-	struct name_tree_node* n;
-	uint8_t* nm;
-	size_t nm_len;
-	int nm_labs;
-	ldns_rdf* rdf;
-
-	for(p = cfg->private_domain; p; p = p->next) {
-		log_assert(p->str);
-		rdf = ldns_dname_new_frm_str(p->str);
-		if(!rdf) {
-			log_err("cannot parse private-domain: %s", p->str);
-			return 0;
-		}
-		nm = ldns_rdf_data(rdf);
-		nm_labs = dname_count_size_labels(nm, &nm_len);
-		nm = (uint8_t*)regional_alloc_init(priv->region, nm, nm_len);
-		ldns_rdf_deep_free(rdf);
-		if(!nm) {
-			log_err("out of memory");
-			return 0;
-		}
-		n = (struct name_tree_node*)regional_alloc(priv->region,
-			sizeof(*n));
-		if(!n) {
-			log_err("out of memory");
-			return 0;
-		}
-		if(!name_tree_insert(&priv->n, n, nm, nm_len, nm_labs,
-			LDNS_RR_CLASS_IN)) {
-			verbose(VERB_QUERY, "ignoring duplicate "
-				"private-domain: %s", p->str);
-		}
-	}
-	return 1;
-}
-
-int priv_apply_cfg(struct iter_priv* priv, struct config_file* cfg)
-{
-	/* empty the current contents */
-	regional_free_all(priv->region);
-	addr_tree_init(&priv->a);
-	name_tree_init(&priv->n);
-
-	/* read new contents */
-	if(!read_addrs(priv, cfg))
-		return 0;
-	if(!read_names(priv, cfg))
-		return 0;
-
-	/* prepare for lookups */
-	addr_tree_init_parents(&priv->a);
-	name_tree_init_parents(&priv->n);
-	return 1;
-}
-
-/**
- * See if an address is blocked.
- * @param priv: structure for address storage.
- * @param addr: address to check
- * @param addrlen: length of addr.
- * @return: true if the address must not be queried. false if unlisted.
- */
-static int 
-priv_lookup_addr(struct iter_priv* priv, struct sockaddr_storage* addr,
-	socklen_t addrlen)
-{
-	return addr_tree_lookup(&priv->a, addr, addrlen) != NULL;
-}
-
-/**
- * See if a name is whitelisted.
- * @param priv: structure for address storage.
- * @param pkt: the packet (for compression ptrs).
- * @param name: name to check.
- * @param name_len: uncompressed length of the name to check.
- * @param dclass: class to check.
- * @return: true if the name is OK. false if unlisted.
- */
-static int 
-priv_lookup_name(struct iter_priv* priv, ldns_buffer* pkt,
-	uint8_t* name, size_t name_len, uint16_t dclass)
-{
-	size_t len;
-	uint8_t decomp[256];
-	int labs;
-	if(name_len >= sizeof(decomp))
-		return 0;
-	dname_pkt_copy(pkt, decomp, name);
-	labs = dname_count_size_labels(decomp, &len);
-	log_assert(name_len == len);
-	return name_tree_lookup(&priv->n, decomp, len, labs, dclass) != NULL;
-}
-
-size_t priv_get_mem(struct iter_priv* priv)
-{
-	if(!priv) return 0;
-	return sizeof(*priv) + regional_get_mem(priv->region);
-}
-
-int priv_rrset_bad(struct iter_priv* priv, ldns_buffer* pkt,
-	struct rrset_parse* rrset)
-{
-	if(priv->a.count == 0) 
-		return 0; /* there are no blocked addresses */
-
-	/* see if it is a private name, that is allowed to have any */
-	if(priv_lookup_name(priv, pkt, rrset->dname, rrset->dname_len,
-		ntohs(rrset->rrset_class))) {
-		return 0;
-	} else {
-		/* so its a public name, check the address */
-		socklen_t len;
-		struct rr_parse* rr;
-		if(rrset->type == LDNS_RR_TYPE_A) {
-			struct sockaddr_storage addr;
-			struct sockaddr_in sa;
-
-			len = (socklen_t)sizeof(sa);
-			memset(&sa, 0, len);
-			sa.sin_family = AF_INET;
-			sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-			for(rr = rrset->rr_first; rr; rr = rr->next) {
-				if(ldns_read_uint16(rr->ttl_data+4) 
-					!= INET_SIZE)
-					continue;
-				memmove(&sa.sin_addr, rr->ttl_data+4+2, 
-					INET_SIZE);
-				memmove(&addr, &sa, len);
-				if(priv_lookup_addr(priv, &addr, len))
-					return 1;
-			}
-		} else if(rrset->type == LDNS_RR_TYPE_AAAA) {
-			struct sockaddr_storage addr;
-			struct sockaddr_in6 sa;
-			len = (socklen_t)sizeof(sa);
-			memset(&sa, 0, len);
-			sa.sin6_family = AF_INET6;
-			sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-			for(rr = rrset->rr_first; rr; rr = rr->next) {
-				if(ldns_read_uint16(rr->ttl_data+4) 
-					!= INET6_SIZE)
-					continue;
-				memmove(&sa.sin6_addr, rr->ttl_data+4+2, 
-					INET6_SIZE);
-				memmove(&addr, &sa, len);
-				if(priv_lookup_addr(priv, &addr, len)) 
-					return 1;
-			}
-		} 
-	}
-	return 0;
-}

iterator/iter_priv.h

@@ -1,110 +0,0 @@
-/*
- * iterator/iter_priv.h - iterative resolver private address and domain store
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains functions to assist the iterator module.
- * Keep track of the private addresses and lookup fast.
- */
-
-#ifndef ITERATOR_ITER_PRIV_H
-#define ITERATOR_ITER_PRIV_H
-#include "util/rbtree.h"
-#include "ldns/buffer.h"
-struct iter_env;
-struct config_file;
-struct regional;
-struct rrset_parse;
-
-/**
- * Iterator priv structure
- */
-struct iter_priv {
-	/** regional for allocation */
-	struct regional* region;
-	/** 
-	 * Tree of the address spans that are blocked.
-	 * contents of type addr_tree_node.
-	 * No further data need, only presence or absence.
-	 */
-	rbtree_t a;
-	/** 
-	 * Tree of the domains spans that are allowed to contain
-	 * the blocked address spans.
-	 * contents of type name_tree_node.
-	 * No further data need, only presence or absence.
-	 */
-	rbtree_t n;
-};
-
-/**
- * Create priv structure 
- * @return new structure or NULL on error.
- */
-struct iter_priv* priv_create();
-
-/**
- * Delete priv structure.
- * @param priv: to delete.
- */
-void priv_delete(struct iter_priv* priv);
-
-/**
- * Process priv config.
- * @param priv: where to store.
- * @param cfg: config options.
- * @return 0 on error.
- */
-int priv_apply_cfg(struct iter_priv* priv, struct config_file* cfg);
-
-/**
- * See if rrset is bad.
- * @param priv: structure for private address storage.
- * @param pkt: packet to decompress rrset name in.
- * @param rrset: the rrset to examine, A or AAAA.
- * @return true if the rrset is bad and should be removed.
- */
-int priv_rrset_bad(struct iter_priv* priv, ldns_buffer* pkt, 
-	struct rrset_parse* rrset);
-
-/**
- * Get memory used by priv structure.
- * @param priv: structure for address storage.
- * @return bytes in use.
- */
-size_t priv_get_mem(struct iter_priv* priv);
-
-#endif /* ITERATOR_ITER_PRIV_H */

iterator/iter_resptype.c

@@ -40,7 +40,6 @@
  * one of the response types.
  */
 #include "config.h"
-#include "ldns/packet.h"
 #include "iterator/iter_resptype.h"
 #include "iterator/iter_delegpt.h"
 #include "services/cache/dns.h"
@@ -105,7 +104,7 @@ response_type_from_server(int rdset,
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp)
 {
 	uint8_t* origzone = (uint8_t*)"\000"; /* the default */
-	struct ub_packed_rrset_key* s;
+	size_t origzonelen = 1;
 	size_t i;
 
 	if(!msg || !request)
@@ -116,7 +115,7 @@ response_type_from_server(int rdset,
 		/* make sure its not recursive when we don't want it to */
 		if( (msg->rep->flags&BIT_RA) &&
 			!(msg->rep->flags&BIT_AA) && !rdset)
-				return RESPONSE_TYPE_REC_LAME;
+				return RESPONSE_TYPE_LAME;
 		return RESPONSE_TYPE_ANSWER;
 	}
 	
@@ -129,6 +128,7 @@ response_type_from_server(int rdset,
 
 	if(dp) {
 		origzone = dp->name;
+		origzonelen = dp->namelen;
 	}
 
 	/* First we look at the answer section. This can tell us if this is a
@@ -188,10 +188,12 @@ response_type_from_server(int rdset,
 	}
 
 	/* Looking at the authority section, we just look and see if 
-	 * there is a SOA record, that means a NOERROR/NODATA */
+	 * there is a delegation NS set, turning it into a delegation. 
+	 * Otherwise, we will have to conclude ANSWER (either it is 
+	 * NOERROR/NODATA, or an non-authoritative answer). */
 	for(i = msg->rep->an_numrrsets; i < (msg->rep->an_numrrsets +
 		msg->rep->ns_numrrsets); i++) {
-		s = msg->rep->rrsets[i];
+		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
 
 		/* The normal way of detecting NOERROR/NODATA. */
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_SOA &&
@@ -199,42 +201,27 @@ response_type_from_server(int rdset,
 			/* we do our own recursion, thank you */
 			if( (msg->rep->flags&BIT_RA) &&
 				!(msg->rep->flags&BIT_AA) && !rdset)
-				return RESPONSE_TYPE_REC_LAME;
+				return RESPONSE_TYPE_LAME;
 			return RESPONSE_TYPE_ANSWER;
 		}
-	}
-	/* Looking at the authority section, we just look and see if 
-	 * there is a delegation NS set, turning it into a delegation. 
-	 * Otherwise, we will have to conclude ANSWER (either it is 
-	 * NOERROR/NODATA, or an non-authoritative answer). */
-	for(i = msg->rep->an_numrrsets; i < (msg->rep->an_numrrsets +
-		msg->rep->ns_numrrsets); i++) {
-		s = msg->rep->rrsets[i];
 
 		/* Detect REFERRAL/LAME/ANSWER based on the relationship 
 		 * of the NS set to the originating zone name. */
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS) {
 			/* If we are getting an NS set for the zone we 
 			 * thought we were contacting, then it is an answer.*/
+			/* FIXME: is this correct? */
 			if(query_dname_compare(s->rk.dname, origzone) == 0) {
 				/* see if mistakenly a recursive server was
 				 * deployed and is responding nonAA */
 				if( (msg->rep->flags&BIT_RA) &&
 					!(msg->rep->flags&BIT_AA) && !rdset)
-					return RESPONSE_TYPE_REC_LAME;
-				/* Or if a lame server is deployed,
-				 * which gives ns==zone delegation from cache 
-				 * without AA bit as well, with nodata nosoa*/
-				if(msg->rep->an_numrrsets==0 &&
-					!(msg->rep->flags&BIT_AA) && !rdset)
-					return RESPONSE_TYPE_REC_LAME;
+					return RESPONSE_TYPE_LAME;
 				return RESPONSE_TYPE_ANSWER;
 			}
 			/* If we are getting a referral upwards (or to 
 			 * the same zone), then the server is 'lame'. */
 			if(dname_subdomain_c(origzone, s->rk.dname)) {
-				if(rdset) /* forward or reclame not LAME */
-					return RESPONSE_TYPE_THROWAWAY;
 				return RESPONSE_TYPE_LAME;
 			}
 			/* If the NS set is below the delegation point we 
@@ -260,6 +247,6 @@ response_type_from_server(int rdset,
 	 * be an entirely empty message) */
 	/* check if recursive answer; saying it has empty cache */
 	if( (msg->rep->flags&BIT_RA) && !(msg->rep->flags&BIT_AA) && !rdset)
-		return RESPONSE_TYPE_REC_LAME;
+		return RESPONSE_TYPE_LAME;
 	return RESPONSE_TYPE_ANSWER;
 }

iterator/iter_resptype.h

@@ -81,14 +81,7 @@ enum response_type {
 	 * 'lame' means that this particular response indicates that 
 	 * the nameserver knew nothing about the question.
 	 */
-	RESPONSE_TYPE_LAME,
-
-	/**
-	 * Recursion lame means that the nameserver is some sort of
-	 * open recursor, and not authoritative for the question.
-	 * It may know something, but not authoritatively.
-	 */
-	RESPONSE_TYPE_REC_LAME
+	RESPONSE_TYPE_LAME
 };
 
 /**

iterator/iter_scrub.c

@@ -41,8 +41,6 @@
  */
 #include "config.h"
 #include "iterator/iter_scrub.h"
-#include "iterator/iterator.h"
-#include "iterator/iter_priv.h"
 #include "services/cache/rrset.h"
 #include "util/log.h"
 #include "util/net_help.h"
@@ -62,11 +60,11 @@ static void
 remove_rrset(const char* str, ldns_buffer* pkt, struct msg_parse* msg, 
 	struct rrset_parse* prev, struct rrset_parse** rrset)
 {
-	if(verbosity >= VERB_QUERY 
+	if(verbosity >= VERB_DETAIL 
 		&& (*rrset)->dname_len <= LDNS_MAX_DOMAINLEN) {
 		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
 		dname_pkt_copy(pkt, buf, (*rrset)->dname);
-		log_nametypeclass(VERB_QUERY, str, buf, 
+		log_nametypeclass(VERB_DETAIL, str, buf, 
 			(*rrset)->type, ntohs((*rrset)->rrset_class));
 	}
 	if(prev)
@@ -101,6 +99,8 @@ has_additional(uint16_t t)
 		case LDNS_RR_TYPE_NAPTR:
 			/* TODO: NAPTR not supported, glue stripped off */
 			return 0;
+		default:
+			return 0;
 	}
 	return 0;
 }
@@ -189,11 +189,7 @@ parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
 	if(rrset->rr_count != 1) {
 		verbose(VERB_ALGO, "Found CNAME rrset with "
 			"size > 1: %u", (unsigned)rrset->rr_count);
-		/* use the first CNAME! */
-		rrset->rr_count = 1;
-		rrset->size = rrset->rr_first->size;
-		rrset->rr_last = rrset->rr_first;
-		rrset->rr_first->next = NULL;
+		return 0;
 	}
 	if(rrset->rr_first->size < sizeof(uint16_t)+1)
 		return 0; /* CNAME rdata too small */
@@ -303,15 +299,6 @@ pkt_sub(ldns_buffer* pkt, uint8_t* comprname, uint8_t* zone)
 	return dname_subdomain_c(buf, zone);
 }
 
-/** check subdomain with decompression, compressed is parent */
-static int
-sub_of_pkt(ldns_buffer* pkt, uint8_t* zone, uint8_t* comprname)
-{
-	uint8_t buf[LDNS_MAX_DOMAINLEN+1];
-	dname_pkt_copy(pkt, buf, comprname);
-	return dname_subdomain_c(zone, buf);
-}
-
 /**
  * This routine normalizes a response. This includes removing "irrelevant"
  * records from the answer and additional sections and (re)synthesizing
@@ -329,7 +316,7 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 {
 	uint8_t* sname = qinfo->qname;
 	size_t snamelen = qinfo->qname_len;
-	struct rrset_parse* rrset, *prev, *nsset=NULL;
+	struct rrset_parse* rrset, *prev;
 
 	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
 		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
@@ -363,10 +350,6 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 					"too long");
 				return 0;
 			}
-			/* internally we have CNAME'd/DNAME'd chains ending
-			 * in nxdomain with NOERROR rcode, change rcode
-			 * to reflect this (if needed) */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_NOERROR);
 			if(nx && nx->type == LDNS_RR_TYPE_CNAME && 
 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 				/* check next cname */
@@ -409,10 +392,6 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 				return 0;
 			prev = rrset;
 			rrset = rrset->rrset_all_next;
-			/* internally we have CNAME'd/DNAME'd chains ending
-			 * in nxdomain with NOERROR rcode, change rcode
-			 * to reflect this (if needed) */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_NOERROR);
 			continue;
 		}
 
@@ -425,10 +404,7 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 		}
 
 		/* Mark the additional names from relevant rrset as OK. */
-		/* only for RRsets that match the query name, other ones
-		 * will be removed by sanitize, so no additional for them */
-		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
-			mark_additional_rrset(pkt, msg, rrset);
+		mark_additional_rrset(pkt, msg, rrset);
 		
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
@@ -436,30 +412,6 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 
 	/* Mark additional names from AUTHORITY */
 	while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
-		if(rrset->type==LDNS_RR_TYPE_DNAME ||
-			rrset->type==LDNS_RR_TYPE_CNAME ||
-			rrset->type==LDNS_RR_TYPE_A ||
-			rrset->type==LDNS_RR_TYPE_AAAA) {
-			remove_rrset("normalize: removing irrelevant "
-				"RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
-		/* only one NS set allowed in authority section */
-		if(rrset->type==LDNS_RR_TYPE_NS) {
-			/* NS set must be pertinent to the query */
-			if(!sub_of_pkt(pkt, qinfo->qname, rrset->dname)) {
-				remove_rrset("normalize: removing irrelevant "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-			if(nsset == NULL) {
-				nsset = rrset;
-			} else {
-				remove_rrset("normalize: removing irrelevant "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-		}
 		mark_additional_rrset(pkt, msg, rrset);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
@@ -483,13 +435,6 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 				continue;
 			}
 		}
-		if(rrset->type==LDNS_RR_TYPE_DNAME || 
-			rrset->type==LDNS_RR_TYPE_CNAME ||
-			rrset->type==LDNS_RR_TYPE_NS) {
-			remove_rrset("normalize: removing irrelevant "
-				"RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -514,7 +459,7 @@ store_rrset(ldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 	struct ub_packed_rrset_key* k;
 	struct packed_rrset_data* d;
 	struct rrset_ref ref;
-	uint32_t now = *env->now;
+	uint32_t now = time(NULL);
 
 	k = alloc_special_obtain(env->alloc);
 	if(!k)
@@ -533,47 +478,6 @@ store_rrset(ldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 		env->alloc, now);
 }
 
-/** Check if there are SOA records in the authority section (negative) */
-static int
-soa_in_auth(struct msg_parse* msg)
-{
-	struct rrset_parse* rrset;
-	for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
-		if(rrset->type == LDNS_RR_TYPE_SOA &&
-			rrset->section == LDNS_SECTION_AUTHORITY) 
-			return 1;
-	return 0;
-}
- 
-/**
- * Check if right hand name in NSEC is within zone
- * @param rrset: the NSEC rrset
- * @param zonename: the zone name.
- * @return true if BAD.
- */
-static int sanitize_nsec_is_overreach(struct rrset_parse* rrset, 
-	uint8_t* zonename)
-{
-	struct rr_parse* rr;
-	uint8_t* rhs;
-	size_t len;
-	log_assert(rrset->type == LDNS_RR_TYPE_NSEC);
-	for(rr = rrset->rr_first; rr; rr = rr->next) {
-		rhs = rr->ttl_data+4+2;
-		len = ldns_read_uint16(rr->ttl_data+4);
-		if(!dname_valid(rhs, len)) {
-			/* malformed domain name in rdata */
-			return 1;
-		}
-		if(!dname_subdomain_c(rhs, zonename)) {
-			/* overreaching */
-			return 1;
-		}
-	}
-	/* all NSEC RRs OK */
-	return 0;
-}
-
 /**
  * Given a response event, remove suspect RRsets from the response.
  * "Suspect" rrsets are potentially poison. Note that this routine expects
@@ -582,52 +486,18 @@ static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
  *
  * @param pkt: packet.
  * @param msg: msg to normalize.
- * @param qinfo: the question originally asked.
  * @param zonename: name of server zone.
  * @param env: module environment with config and cache.
- * @param ie: iterator environment with private address data.
  * @return 0 on error.
  */
 static int
-scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg, 
-	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
-	struct iter_env* ie)
+scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg, uint8_t* zonename,
+	struct module_env* env)
 {
-	int del_addi = 0; /* if additional-holding rrsets are deleted, we
-		do not trust the normalized additional-A-AAAA any more */
 	struct rrset_parse* rrset, *prev;
 	prev = NULL;
 	rrset = msg->rrset_first;
 
-	/* the first DNAME is allowed to stay. It needs checking before
-	 * it can be used from the cache. After normalization, an initial 
-	 * DNAME will have a correctly synthesized CNAME after it. */
-	if(rrset && rrset->type == LDNS_RR_TYPE_DNAME && 
-		rrset->section == LDNS_SECTION_ANSWER &&
-		pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
-		pkt_sub(pkt, rrset->dname, zonename)) {
-		prev = rrset; /* DNAME allowed to stay in answer section */
-		rrset = rrset->rrset_all_next;
-	}
-	
-	/* remove all records from the answer section that are 
-	 * not the same domain name as the query domain name.
-	 * The answer section should contain rrsets with the same name
-	 * as the question. For DNAMEs a CNAME has been synthesized.
-	 * Wildcards have the query name in answer section.
-	 * ANY queries get query name in answer section.
-	 * Remainders of CNAME chains are cut off and resolved by iterator. */
-	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
-			if(has_additional(rrset->type)) del_addi = 1;
-			remove_rrset("sanitize: removing extraneous answer "
-				"RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
-		prev = rrset;
-		rrset = rrset->rrset_all_next;
-	}
-
 	/* At this point, we brutally remove ALL rrsets that aren't 
 	 * children of the originating zone. The idea here is that, 
 	 * as far as we know, the server that we contacted is ONLY 
@@ -635,21 +505,7 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 	 * be authoriative for any other zones, and of course, MAY 
 	 * NOT be authoritative for some subdomains of the originating 
 	 * zone. */
-	prev = NULL;
-	rrset = msg->rrset_first;
 	while(rrset) {
-
-		/* remove private addresses */
-		if( (rrset->type == LDNS_RR_TYPE_A || 
-			rrset->type == LDNS_RR_TYPE_AAAA) &&
-			priv_rrset_bad(ie->priv, pkt, rrset)) {
-			/* set servfail, so the classification becomes
-			 * THROWAWAY, instead of LAME or other unwanted */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_SERVFAIL);
-			remove_rrset("sanitize: removing public name with "
-				"private address", pkt, msg, prev, &rrset);
-			continue;
-		}
 		
 		/* skip DNAME records -- they will always be followed by a 
 		 * synthesized CNAME, which will be relevant.
@@ -663,15 +519,10 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 				rrset->type == LDNS_RR_TYPE_NS && 
 				rrset->section == LDNS_SECTION_AUTHORITY &&
 				FLAGS_GET_RCODE(msg->flags) == 
-				LDNS_RCODE_NOERROR && !soa_in_auth(msg) &&
-				sub_of_pkt(pkt, zonename, rrset->dname)) {
+				LDNS_RCODE_NOERROR) {
 				/* noerror, nodata and this NS rrset is above
 				 * the zone. This is LAME! 
 				 * Leave in the NS for lame classification. */
-				/* remove everything from the additional
-				 * (we dont want its glue that was approved
-				 * during the normalize action) */
-				del_addi = 1;
 			} else if(!env->cfg->harden_glue) {
 				/* store in cache! Since it is relevant
 				 * (from normalize) it will be picked up 
@@ -681,24 +532,11 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 				"poison RRset:", pkt, msg, prev, &rrset);
 				continue;
 			} else {
-				if(has_additional(rrset->type)) del_addi = 1;
 				remove_rrset("sanitize: removing potential "
 				"poison RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
 		}
-		if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
-			remove_rrset("sanitize: removing potential "
-			"poison reference RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
-		/* check if right hand side of NSEC is within zone */
-		if(rrset->type == LDNS_RR_TYPE_NSEC &&
-			sanitize_nsec_is_overreach(rrset, zonename)) {
-			remove_rrset("sanitize: removing overreaching NSEC "
-				"RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -708,7 +546,7 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 int 
 scrub_message(ldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, uint8_t* zonename, struct regional* region,
-	struct module_env* env, struct iter_env* ie)
+	struct module_env* env)
 {
 	/* basic sanity checks */
 	log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS, 
@@ -717,16 +555,7 @@ scrub_message(ldns_buffer* pkt, struct msg_parse* msg,
 		return 0;
 	if( !(msg->flags&BIT_QR) )
 		return 0;
-	msg->flags &= ~(BIT_AD|BIT_Z); /* force off bit AD and Z */
 	
-	/* make sure that a query is echoed back when NOERROR or NXDOMAIN */
-	/* this is not required for basic operation but is a forgery 
-	 * resistance (security) feature */
-	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
-		msg->qdcount == 0)
-		return 0;
-
 	/* if a query is echoed back, make sure it is correct. Otherwise,
 	 * this may be not a reply to our query. */
 	if(msg->qdcount == 1) {
@@ -740,7 +569,7 @@ scrub_message(ldns_buffer* pkt, struct msg_parse* msg,
 	if(!scrub_normalize(pkt, msg, qinfo, region))
 		return 0;
 	/* delete all out-of-zone information */
-	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie))
+	if(!scrub_sanitize(pkt, msg, zonename, env))
 		return 0;
 	return 1;
 }

iterator/iter_scrub.h

@@ -42,12 +42,10 @@
 
 #ifndef ITERATOR_ITER_SCRUB_H
 #define ITERATOR_ITER_SCRUB_H
-#include "ldns/buffer.h"
 struct msg_parse;
 struct query_info;
 struct regional;
 struct module_env;
-struct iter_env;
 
 /**
  * Cleanup the passed dns message.
@@ -59,11 +57,10 @@ struct iter_env;
  *	Used to determine out of bailiwick information.
  * @param regional: where to allocate (new) parts of the message.
  * @param env: module environment with config settings and cache. 
- * @param ie: iterator module environment data.
  * @return: false if the message is total waste. true if scrubbed with success.
  */
 int scrub_message(ldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, uint8_t* zonename, struct regional* regional,
-	struct module_env* env, struct iter_env* ie);
+	struct module_env* env);
 
 #endif /* ITERATOR_ITER_SCRUB_H */

iterator/iter_utils.c

@@ -46,7 +46,6 @@
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_donotq.h"
 #include "iterator/iter_delegpt.h"
-#include "iterator/iter_priv.h"
 #include "services/cache/infra.h"
 #include "services/cache/dns.h"
 #include "services/cache/rrset.h"
@@ -60,13 +59,6 @@
 #include "util/random.h"
 #include "util/fptr_wlist.h"
 #include "validator/val_anchor.h"
-#include "validator/val_kcache.h"
-#include "validator/val_kentry.h"
-
-/** time when nameserver glue is said to be 'recent' */
-#define SUSPICION_RECENT_EXPIRY 86400
-/** penalty to validation failed blacklisted IPs */
-#define BLACKLIST_PENALTY (USEFUL_SERVER_TOP_TIMEOUT*4)
 
 /** fillup fetch policy array */
 static void
@@ -110,7 +102,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	if(!read_fetch_policy(iter_env, cfg->target_fetch_policy))
 		return 0;
 	for(i=0; i<iter_env->max_dependency_depth+1; i++)
-		verbose(VERB_QUERY, "target fetch policy for level %d is %d",
+		verbose(VERB_DETAIL, "target fetch policy for level %d is %d",
 			i, iter_env->target_fetch_policy[i]);
 	
 	if(!iter_env->hints)
@@ -119,73 +111,30 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 		log_err("Could not set root or stub hints");
 		return 0;
 	}
+	if(!iter_env->fwds)
+		iter_env->fwds = forwards_create();
+	if(!iter_env->fwds || !forwards_apply_cfg(iter_env->fwds, cfg)) {
+		log_err("Could not set forward zones");
+		return 0;
+	}
 	if(!iter_env->donotq)
 		iter_env->donotq = donotq_create();
 	if(!iter_env->donotq || !donotq_apply_cfg(iter_env->donotq, cfg)) {
 		log_err("Could not set donotqueryaddresses");
 		return 0;
 	}
-	if(!iter_env->priv)
-		iter_env->priv = priv_create();
-	if(!iter_env->priv || !priv_apply_cfg(iter_env->priv, cfg)) {
-		log_err("Could not set private addresses");
-		return 0;
-	}
 	iter_env->supports_ipv6 = cfg->do_ip6;
 	return 1;
 }
 
-/** filter out unsuitable targets
- * @param iter_env: iterator environment with ipv6-support flag.
- * @param env: module environment with infra cache.
- * @param name: zone name
- * @param namelen: length of name
- * @param qtype: query type (host order).
- * @param now: current time
- * @param a: address in delegation point we are examining.
- * @return an integer that signals the target suitability.
- *	as follows:
- *	-1: The address should be omitted from the list.
- *	    Because:
- *		o The address is bogus (DNSSEC validation failure).
- *		o Listed as donotquery
- *		o is ipv6 but no ipv6 support (in operating system).
- *		o is lame
- *	Otherwise, an rtt in milliseconds.
- *	0 .. USEFUL_SERVER_TOP_TIMEOUT-1
- *		The roundtrip time timeout estimate. less than 2 minutes.
- *		Note that util/rtt.c has a MIN_TIMEOUT of 50 msec, thus
- *		values 0 .. 49 are not used, unless that is changed.
- *	USEFUL_SERVER_TOP_TIMEOUT
- *		This value exactly is given for unresponsive blacklisted.
- *	USEFUL_SERVER_TOP_TIMEOUT+1
- *		For non-blacklisted servers: huge timeout, but has traffic.
- *	USEFUL_SERVER_TOP_TIMEOUT*1 ..
- *		parent-side lame servers get this penalty. A dispreferential
- *		server. (lame in delegpt).
- *	USEFUL_SERVER_TOP_TIMEOUT*2 ..
- *		dnsseclame servers get penalty
- *	USEFUL_SERVER_TOP_TIMEOUT*3 ..
- *		recursion lame servers get penalty
- *	UNKNOWN_SERVER_NICENESS 
- *		If no information is known about the server, this is
- *		returned. 376 msec or so.
- *	+BLACKLIST_PENALTY (of USEFUL_TOP_TIMEOUT*4) for dnssec failed IPs.
- *
- * When a final value is chosen that is dnsseclame ; dnsseclameness checking
- * is turned off (so we do not discard the reply).
- * When a final value is chosen that is recursionlame; RD bit is set on query.
- * Because of the numbers this means recursionlame also have dnssec lameness
- * checking turned off. 
- */
+/** filter out unsuitable targets, return rtt or -1 */
 static int
 iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
-	struct delegpt_addr* a)
+	uint8_t* name, size_t namelen, time_t now, struct delegpt_addr* a)
 {
-	int rtt, lame, reclame, dnsseclame, lost;
-	if(a->bogus)
-		return -1; /* address of server is bogus */
+	int rtt;
+	int lame;
+	int dnsseclame;
 	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
 		return -1; /* server is on the donotquery list */
 	}
@@ -194,104 +143,51 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, 
-		name, namelen, qtype, &lame, &dnsseclame, &reclame, 
-		&rtt, &lost, now)) {
-		log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen);
-		verbose(VERB_ALGO, "   rtt=%d lost=%d%s%s%s%s", rtt, lost,
-			lame?" LAME":"",
-			dnsseclame?" DNSSEC_LAME":"",
-			reclame?" REC_LAME":"",
-			a->lame?" ADDR_LAME":"");
+		name, namelen, &lame, &dnsseclame, &rtt, now)) {
 		if(lame)
 			return -1; /* server is lame */
-		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT && 
-			lost >= USEFUL_SERVER_MAX_LOST)
-			/* server is unresponsive, but keep trying slowly */
-			return USEFUL_SERVER_TOP_TIMEOUT+1;
-		/* select remainder from worst to best */
-		else if(reclame)
-			return rtt+USEFUL_SERVER_TOP_TIMEOUT*3; /* nonpref */
-		else if(dnsseclame )
-			return rtt+USEFUL_SERVER_TOP_TIMEOUT*2; /* nonpref */
-		else if(a->lame)
-			return rtt+USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
-		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT) /* not blacklisted*/
-			return USEFUL_SERVER_TOP_TIMEOUT+1;
+		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT)
+			return -1; /* server is unresponsive */
+		else if(dnsseclame)
+			return rtt+USEFUL_SERVER_TOP_TIMEOUT; /* nonpref */
 		else	return rtt;
 	}
 	/* no server information present */
-	if(a->lame)
-		return USEFUL_SERVER_TOP_TIMEOUT+1+UNKNOWN_SERVER_NICENESS; /* nonpref */
 	return UNKNOWN_SERVER_NICENESS;
 }
 
-/** lookup RTT information, and also store fastest rtt (if any) */
-static int
-iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
-	struct delegpt* dp, int* best_rtt, struct sock_list* blacklist)
-{
-	int got_it = 0;
-	struct delegpt_addr* a;
-	if(dp->bogus)
-		return 0; /* NS bogus, all bogus, nothing found */
-	for(a=dp->result_list; a; a = a->next_result) {
-		a->sel_rtt = iter_filter_unsuitable(iter_env, env, 
-			name, namelen, qtype, now, a);
-		if(a->sel_rtt != -1) {
-			if(sock_list_find(blacklist, &a->addr, a->addrlen))
-				a->sel_rtt += BLACKLIST_PENALTY;
-
-			if(!got_it) {
-				*best_rtt = a->sel_rtt;
-				got_it = 1;
-			} else if(a->sel_rtt < *best_rtt) {
-				*best_rtt = a->sel_rtt;
-			}
-		}
-	}
-	return got_it;
-}
-
 /** filter the addres list, putting best targets at front,
  * returns number of best targets (or 0, no suitable targets) */
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
-	struct delegpt* dp, int* selected_rtt, int open_target, 
-	struct sock_list* blacklist)
+	uint8_t* name, size_t namelen, time_t now, struct delegpt* dp,
+	int* best_rtt)
 {
-	int got_num = 0, low_rtt = 0, swap_to_front;
+	int got_num = 0, got_rtt = 0, thisrtt, swap_to_front;
 	struct delegpt_addr* a, *n, *prev=NULL;
 
-	/* fillup sel_rtt and find best rtt in the bunch */
-	got_num = iter_fill_rtt(iter_env, env, name, namelen, qtype, now, dp, 
-		&low_rtt, blacklist);
-	if(got_num == 0) 
-		return 0;
-	if(low_rtt >= USEFUL_SERVER_TOP_TIMEOUT &&
-		(delegpt_count_missing_targets(dp) > 0 || open_target > 0)) {
-		verbose(VERB_ALGO, "Bad choices, trying to get more choice");
-		return 0; /* we want more choice. The best choice is a bad one.
-			     return 0 to force the caller to fetch more */
-	}
-
-	got_num = 0;
 	a = dp->result_list;
 	while(a) {
-		/* skip unsuitable targets */
-		if(a->sel_rtt == -1) {
+		/* filter out unsuitable targets */
+		thisrtt = iter_filter_unsuitable(iter_env, env, name, namelen, 
+			now, a);
+		if(thisrtt == -1) {
 			prev = a;
 			a = a->next_result;
 			continue;
 		}
 		/* classify the server address and determine what to do */
 		swap_to_front = 0;
-		if(a->sel_rtt >= low_rtt && a->sel_rtt - low_rtt <= RTT_BAND) {
+		if(got_num == 0) {
+			got_rtt = thisrtt;
+			got_num = 1;
+			swap_to_front = 1;
+		} else if(thisrtt == got_rtt) {
 			got_num++;
 			swap_to_front = 1;
-		} else if(a->sel_rtt<low_rtt && low_rtt-a->sel_rtt<=RTT_BAND) {
-			got_num++;
+		} else if(thisrtt < got_rtt) {
+			got_rtt = thisrtt;
+			got_num = 1; /* start back at count of 1 */
 			swap_to_front = 1;
 		}
 		/* swap to front if necessary, or move to next result */
@@ -306,51 +202,26 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 			a = a->next_result;
 		}
 	}
-	*selected_rtt = low_rtt;
+	*best_rtt = got_rtt;
 	return got_num;
 }
 
 struct delegpt_addr* 
 iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, 
-	uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_lame,
-	int* chase_to_rd, int open_target, struct sock_list* blacklist)
+	uint8_t* name, size_t namelen, int* dnssec_expected)
 {
+	time_t now = time(NULL);
 	int sel;
 	int selrtt;
 	struct delegpt_addr* a, *prev;
-	int num = iter_filter_order(iter_env, env, name, namelen, qtype,
-		*env->now, dp, &selrtt, open_target, blacklist);
+	int num = iter_filter_order(iter_env, env, name, namelen, now, dp,
+		&selrtt);
 
 	if(num == 0)
 		return NULL;
-	verbose(VERB_ALGO, "selrtt %d", selrtt);
-	if(selrtt > BLACKLIST_PENALTY) {
-		if(selrtt-BLACKLIST_PENALTY > USEFUL_SERVER_TOP_TIMEOUT*3) {
-			verbose(VERB_ALGO, "chase to "
-				"blacklisted recursion lame server");
-			*chase_to_rd = 1;
-		}
-		if(selrtt-BLACKLIST_PENALTY > USEFUL_SERVER_TOP_TIMEOUT*2) {
-			verbose(VERB_ALGO, "chase to "
-				"blacklisted dnssec lame server");
-			*dnssec_lame = 1;
-		}
-	} else {
-		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*3) {
-			verbose(VERB_ALGO, "chase to recursion lame server");
-			*chase_to_rd = 1;
-		}
-		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*2) {
-			verbose(VERB_ALGO, "chase to dnssec lame server");
-			*dnssec_lame = 1;
-		}
-		if(selrtt == USEFUL_SERVER_TOP_TIMEOUT) {
-			verbose(VERB_ALGO, "chase to blacklisted lame server");
-			return NULL;
-		}
-	}
-
+	if(selrtt >= USEFUL_SERVER_TOP_TIMEOUT)
+		*dnssec_expected = 0;
 	if(num == 1) {
 		a = dp->result_list;
 		if(++a->attempts < OUTBOUND_MSG_RETRY)
@@ -358,12 +229,11 @@ iter_server_selection(struct iter_env* iter_env,
 		dp->result_list = a->next_result;
 		return a;
 	}
-
 	/* randomly select a target from the list */
 	log_assert(num > 1);
-	/* grab secure random number, to pick unexpected server.
-	 * also we need it to be threadsafe. */
-	sel = ub_random_max(env->rnd, num); 
+	/* we do not need secure random numbers here, but
+	 * we do need it to be threadsafe, so we use this */
+	sel = ub_random(env->rnd) % num; 
 	a = dp->result_list;
 	prev = NULL;
 	while(sel > 0 && a) {
@@ -416,9 +286,9 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
 
 int 
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
-	struct reply_info* msgrep, int is_referral, uint32_t leeway)
+	struct reply_info* msgrep, int is_referral)
 {
-	return dns_cache_store(env, msgqinf, msgrep, is_referral, leeway);
+	return dns_cache_store(env, msgqinf, msgrep, is_referral);
 }
 
 int 
@@ -429,7 +299,7 @@ iter_ns_probability(struct ub_randstate* rnd, int n, int m)
 		return 1;
 	/* we do not need secure random numbers here, but
 	 * we do need it to be threadsafe, so we use this */
-	sel = ub_random_max(rnd, m); 
+	sel = ub_random(rnd) % m; 
 	return (sel < n);
 }
 
@@ -443,7 +313,7 @@ causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
 	qinf.qname_len = namelen;
 	qinf.qtype = t;
 	qinf.qclass = c;
-	fptr_ok(fptr_whitelist_modenv_detect_cycle(
+	log_assert(fptr_whitelist_modenv_detect_cycle(
 		qstate->env->detect_cycle));
 	return (*qstate->env->detect_cycle)(qstate, &qinf, 
 		(uint16_t)(BIT_RD|BIT_CD), qstate->is_priming);
@@ -461,7 +331,7 @@ iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
 			LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass) ||
 		   causes_cycle(qstate, ns->name, ns->namelen, 
 			LDNS_RR_TYPE_A, qstate->qinfo.qclass)) {
-			log_nametypeclass(VERB_QUERY, "skipping target due "
+			log_nametypeclass(VERB_DETAIL, "skipping target due "
 			 	"to dependency cycle (harden-glue: no may "
 				"fix some of the cycles)", 
 				ns->name, LDNS_RR_TYPE_A, 
@@ -471,57 +341,32 @@ iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
 	}
 }
 
-void 
-iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
-{
-	struct delegpt_ns* ns;
-	for(ns = dp->nslist; ns; ns = ns->next) {
-		if(ns->done_pside4 && ns->done_pside6)
-			continue;
-		/* see if this ns as target causes dependency cycle */
-		if(causes_cycle(qstate, ns->name, ns->namelen, 
-			LDNS_RR_TYPE_A, qstate->qinfo.qclass)) {
-			log_nametypeclass(VERB_QUERY, "skipping target due "
-			 	"to dependency cycle", ns->name,
-				LDNS_RR_TYPE_A, qstate->qinfo.qclass);
-			ns->done_pside4 = 1;
-		}
-		if(causes_cycle(qstate, ns->name, ns->namelen, 
-			LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass)) {
-			log_nametypeclass(VERB_QUERY, "skipping target due "
-			 	"to dependency cycle", ns->name,
-				LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass);
-			ns->done_pside6 = 1;
-		}
-	}
-}
-
 int 
-iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
-	struct delegpt* dp)
+iter_dp_is_useless(struct module_qstate* qstate, struct delegpt* dp)
 {
 	struct delegpt_ns* ns;
 	/* check:
-	 *      o RD qflag is on.
-	 *      o no addresses are provided.
 	 *      o all NS items are required glue.
-	 * OR
-	 *      o RD qflag is on.
 	 *      o no addresses are provided.
+	 *      o RD qflag is on.
+	 * OR
+	 *      o no addresses are provided.
+	 *      o RD qflag is on.
 	 *      o the query is for one of the nameservers in dp,
 	 *        and that nameserver is a glue-name for this dp.
 	 */
-	if(!(qflags&BIT_RD))
+	if(!(qstate->query_flags&BIT_RD))
 		return 0;
 	/* either available or unused targets */
-	if(dp->usable_list || dp->result_list)
+	if(dp->usable_list || dp->result_list) 
 		return 0;
 	
 	/* see if query is for one of the nameservers, which is glue */
-	if( (qinfo->qtype == LDNS_RR_TYPE_A ||
-		qinfo->qtype == LDNS_RR_TYPE_AAAA) &&
-		dname_subdomain_c(qinfo->qname, dp->name) &&
-		delegpt_find_ns(dp, qinfo->qname, qinfo->qname_len))
+	if( (qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
+		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) &&
+		dname_subdomain_c(qstate->qinfo.qname, dp->name) &&
+		delegpt_find_ns(dp, qstate->qinfo.qname, 
+			qstate->qinfo.qname_len))
 		return 1;
 	
 	for(ns = dp->nslist; ns; ns = ns->next) {
@@ -537,38 +382,17 @@ int
 iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
         struct dns_msg* msg, uint16_t dclass)
 {
-	struct trust_anchor* a;
 	/* information not available, !env->anchors can be common */
-	if(!env || !env->anchors || !dp || !dp->name)
+	if(!env || !env->anchors || !dp || !dp->name || !msg || !msg->rep)
 		return 0;
 	/* a trust anchor exists with this name, RRSIGs expected */
-	if((a=anchor_find(env->anchors, dp->name, dp->namelabs, dp->namelen,
-		dclass))) {
-		lock_basic_unlock(&a->lock);
+	if(anchor_find(env->anchors, dp->name, dp->namelabs, dp->namelen,
+		dclass))
 		return 1;
-	}
 	/* see if DS rrset was given, in AUTH section */
-	if(msg && msg->rep &&
-		reply_find_rrset_section_ns(msg->rep, dp->name, dp->namelen,
+	if(reply_find_rrset_section_ns(msg->rep, dp->name, dp->namelen,
 		LDNS_RR_TYPE_DS, dclass))
 		return 1;
-	/* look in key cache */
-	if(env->key_cache) {
-		struct key_entry_key* kk = key_cache_obtain(env->key_cache,
-			dp->name, dp->namelen, dclass, env->scratch, *env->now);
-		if(kk) {
-			if(query_dname_compare(kk->name, dp->name) == 0) {
-			  if(key_entry_isgood(kk) || key_entry_isbad(kk)) {
-				regional_free_all(env->scratch);
-				return 1;
-			  } else if(key_entry_isnull(kk)) {
-				regional_free_all(env->scratch);
-				return 0;
-			  }
-			}
-			regional_free_all(env->scratch);
-		}
-	}
 	return 0;
 }
 
@@ -627,339 +451,5 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
 	   reply_find_rrset_section_ns(msg->rep, dp->name, dp->namelen,
 		LDNS_RR_TYPE_NS, dclass))
 		return 1;
-	/* a DNSKEY set is expected at the zone apex as well */
-	/* this is for 'minimal responses' for DNSKEYs */
-	if(reply_find_rrset_section_an(msg->rep, dp->name, dp->namelen,
-		LDNS_RR_TYPE_DNSKEY, dclass))
-		return 1;
 	return 0;
 }
-
-/**
- * check equality of two rrsets 
- * @param k1: rrset
- * @param k2: rrset
- * @return true if equal
- */
-static int
-rrset_equal(struct ub_packed_rrset_key* k1, struct ub_packed_rrset_key* k2)
-{
-	struct packed_rrset_data* d1 = (struct packed_rrset_data*)
-		k1->entry.data;
-	struct packed_rrset_data* d2 = (struct packed_rrset_data*)
-		k2->entry.data;
-	size_t i, t;
-	if(k1->rk.dname_len != k2->rk.dname_len ||
-		k1->rk.flags != k2->rk.flags ||
-		k1->rk.type != k2->rk.type ||
-		k1->rk.rrset_class != k2->rk.rrset_class ||
-		query_dname_compare(k1->rk.dname, k2->rk.dname) != 0)
-		return 0;
-	if(d1->ttl != d2->ttl ||
-		d1->count != d2->count ||
-		d1->rrsig_count != d2->rrsig_count ||
-		d1->trust != d2->trust ||
-		d1->security != d2->security)
-		return 0;
-	t = d1->count + d1->rrsig_count;
-	for(i=0; i<t; i++) {
-		if(d1->rr_len[i] != d2->rr_len[i] ||
-			d1->rr_ttl[i] != d2->rr_ttl[i] ||
-			memcmp(d1->rr_data[i], d2->rr_data[i], 
-				d1->rr_len[i]) != 0)
-			return 0;
-	}
-	return 1;
-}
-
-int 
-reply_equal(struct reply_info* p, struct reply_info* q, ldns_buffer* scratch)
-{
-	size_t i;
-	if(p->flags != q->flags ||
-		p->qdcount != q->qdcount ||
-		p->ttl != q->ttl ||
-		p->prefetch_ttl != q->prefetch_ttl ||
-		p->security != q->security ||
-		p->an_numrrsets != q->an_numrrsets ||
-		p->ns_numrrsets != q->ns_numrrsets ||
-		p->ar_numrrsets != q->ar_numrrsets ||
-		p->rrset_count != q->rrset_count)
-		return 0;
-	for(i=0; i<p->rrset_count; i++) {
-		if(!rrset_equal(p->rrsets[i], q->rrsets[i])) {
-			/* fallback procedure: try to sort and canonicalize */
-			ldns_rr_list* pl, *ql;
-			pl = packed_rrset_to_rr_list(p->rrsets[i], scratch);
-			ql = packed_rrset_to_rr_list(q->rrsets[i], scratch);
-			if(!pl || !ql) {
-				ldns_rr_list_deep_free(pl);
-				ldns_rr_list_deep_free(ql);
-				return 0;
-			}
-			ldns_rr_list2canonical(pl);
-			ldns_rr_list2canonical(ql);
-			ldns_rr_list_sort(pl);
-			ldns_rr_list_sort(ql);
-			if(ldns_rr_list_compare(pl, ql) != 0) {
-				ldns_rr_list_deep_free(pl);
-				ldns_rr_list_deep_free(ql);
-				return 0;
-			}
-			ldns_rr_list_deep_free(pl);
-			ldns_rr_list_deep_free(ql);
-			continue;
-		}
-	}
-	return 1;
-}
-
-void 
-iter_store_parentside_rrset(struct module_env* env, 
-	struct ub_packed_rrset_key* rrset)
-{
-	struct rrset_ref ref;
-	rrset = packed_rrset_copy_alloc(rrset, env->alloc, *env->now);
-	if(!rrset) {
-		log_err("malloc failure in store_parentside_rrset");
-		return;
-	}
-	rrset->rk.flags |= PACKED_RRSET_PARENT_SIDE;
-	rrset->entry.hash = rrset_key_hash(&rrset->rk);
-	ref.key = rrset;
-	ref.id = rrset->id;
-	/* ignore ret: if it was in the cache, ref updated */
-	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, *env->now);
-}
-
-/** fetch NS record from reply, if any */
-static struct ub_packed_rrset_key*
-reply_get_NS_rrset(struct reply_info* rep)
-{
-	size_t i;
-	for(i=0; i<rep->rrset_count; i++) {
-		if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NS)) {
-			return rep->rrsets[i];
-		}
-	}
-	return NULL;
-}
-
-void
-iter_store_parentside_NS(struct module_env* env, struct reply_info* rep)
-{
-	struct ub_packed_rrset_key* rrset = reply_get_NS_rrset(rep);
-	if(rrset) {
-		log_rrset_key(VERB_ALGO, "store parent-side NS", rrset);
-		iter_store_parentside_rrset(env, rrset);
-	}
-}
-
-void iter_store_parentside_neg(struct module_env* env, 
-        struct query_info* qinfo, struct reply_info* rep)
-{
-	/* TTL: NS from referral in iq->deleg_msg,
-	 *      or first RR from iq->response,
-	 *      or servfail5secs if !iq->response */ 
-	uint32_t ttl = NORR_TTL;
-	struct ub_packed_rrset_key* neg;
-	struct packed_rrset_data* newd;
-	if(rep) {
-		struct ub_packed_rrset_key* rrset = reply_get_NS_rrset(rep);
-		if(!rrset && rep->rrset_count != 0) rrset = rep->rrsets[0];
-		if(rrset) ttl = ub_packed_rrset_ttl(rrset);
-	}
-	/* create empty rrset to store */
-	neg = (struct ub_packed_rrset_key*)regional_alloc(env->scratch,
-	                sizeof(struct ub_packed_rrset_key));
-	if(!neg) {
-		log_err("out of memory in store_parentside_neg");
-		return;
-	}
-	memset(&neg->entry, 0, sizeof(neg->entry));
-	neg->entry.key = neg;
-	neg->rk.type = htons(qinfo->qtype);
-	neg->rk.rrset_class = htons(qinfo->qclass);
-	neg->rk.flags = 0;
-	neg->rk.dname = regional_alloc_init(env->scratch, qinfo->qname, 
-		qinfo->qname_len);
-	if(!neg->rk.dname) {
-		log_err("out of memory in store_parentside_neg");
-		return;
-	}
-	neg->rk.dname_len = qinfo->qname_len;
-	neg->entry.hash = rrset_key_hash(&neg->rk);
-	newd = (struct packed_rrset_data*)regional_alloc_zero(env->scratch, 
-		sizeof(struct packed_rrset_data) + sizeof(size_t) +
-		sizeof(uint8_t*) + sizeof(uint32_t) + sizeof(uint16_t));
-	if(!newd) {
-		log_err("out of memory in store_parentside_neg");
-		return;
-	}
-	neg->entry.data = newd;
-	newd->ttl = ttl;
-	/* entry must have one RR, otherwise not valid in cache.
-	 * put in one RR with empty rdata: those are ignored as nameserver */
-	newd->count = 1;
-	newd->rrsig_count = 0;
-	newd->trust = rrset_trust_ans_noAA;
-	newd->rr_len = (size_t*)((uint8_t*)newd +
-		sizeof(struct packed_rrset_data));
-	newd->rr_len[0] = 0 /* zero len rdata */ + sizeof(uint16_t);
-	packed_rrset_ptr_fixup(newd);
-	newd->rr_ttl[0] = newd->ttl;
-	ldns_write_uint16(newd->rr_data[0], 0 /* zero len rdata */);
-	/* store it */
-	log_rrset_key(VERB_ALGO, "store parent-side negative", neg);
-	iter_store_parentside_rrset(env, neg);
-}
-
-int 
-iter_lookup_parent_NS_from_cache(struct module_env* env, struct delegpt* dp,
-	struct regional* region, struct query_info* qinfo)
-{
-	struct ub_packed_rrset_key* akey;
-	akey = rrset_cache_lookup(env->rrset_cache, dp->name, 
-		dp->namelen, LDNS_RR_TYPE_NS, qinfo->qclass, 
-		PACKED_RRSET_PARENT_SIDE, *env->now, 0);
-	if(akey) {
-		log_rrset_key(VERB_ALGO, "found parent-side NS in cache", akey);
-		dp->has_parent_side_NS = 1;
-		/* and mark the new names as lame */
-		if(!delegpt_rrset_add_ns(dp, region, akey, 1)) {
-			lock_rw_unlock(&akey->entry.lock);
-			return 0;
-		}
-		lock_rw_unlock(&akey->entry.lock);
-	}
-	return 1;
-}
-
-int iter_lookup_parent_glue_from_cache(struct module_env* env,
-        struct delegpt* dp, struct regional* region, struct query_info* qinfo)
-{
-	struct ub_packed_rrset_key* akey;
-	struct delegpt_ns* ns;
-	size_t num = delegpt_count_targets(dp);
-	for(ns = dp->nslist; ns; ns = ns->next) {
-		/* get cached parentside A */
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
-			ns->namelen, LDNS_RR_TYPE_A, qinfo->qclass, 
-			PACKED_RRSET_PARENT_SIDE, *env->now, 0);
-		if(akey) {
-			log_rrset_key(VERB_ALGO, "found parent-side", akey);
-			ns->done_pside4 = 1;
-			/* a negative-cache-element has no addresses it adds */
-			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1))
-				log_err("malloc failure in lookup_parent_glue");
-			lock_rw_unlock(&akey->entry.lock);
-		}
-		/* get cached parentside AAAA */
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
-			ns->namelen, LDNS_RR_TYPE_AAAA, qinfo->qclass, 
-			PACKED_RRSET_PARENT_SIDE, *env->now, 0);
-		if(akey) {
-			log_rrset_key(VERB_ALGO, "found parent-side", akey);
-			ns->done_pside6 = 1;
-			/* a negative-cache-element has no addresses it adds */
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1))
-				log_err("malloc failure in lookup_parent_glue");
-			lock_rw_unlock(&akey->entry.lock);
-		}
-	}
-	/* see if new (but lame) addresses have become available */
-	return delegpt_count_targets(dp) != num;
-}
-
-int 
-iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd, 
-	uint16_t* c)
-{
-	uint16_t c1 = *c, c2 = *c;
-	int r1 = hints_next_root(hints, &c1);
-	int r2 = forwards_next_root(fwd, &c2);
-	if(!r1 && !r2) /* got none, end of list */
-		return 0;
-	else if(!r1) /* got one, return that */
-		*c = c2;
-	else if(!r2)
-		*c = c1;
-	else if(c1 < c2) /* got both take smallest */
-		*c = c1;
-	else	*c = c2;
-	return 1;
-}
-
-void
-iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, uint8_t* z)
-{
-	/* Only the DS record for the delegation itself is expected.
-	 * We allow DS for everything between the bailiwick and the 
-	 * zonecut, thus DS records must be at or above the zonecut.
-	 * And the DS records must be below the server authority zone.
-	 * The answer section is already scrubbed. */
-	size_t i = msg->rep->an_numrrsets;
-	while(i < (msg->rep->an_numrrsets + msg->rep->ns_numrrsets)) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_DS &&
-			(!ns || !dname_subdomain_c(ns->rk.dname, s->rk.dname)
-			|| query_dname_compare(z, s->rk.dname) == 0)) {
-			log_nametypeclass(VERB_ALGO, "removing irrelevant DS",
-				s->rk.dname, ntohs(s->rk.type),
-				ntohs(s->rk.rrset_class));
-			memmove(msg->rep->rrsets+i, msg->rep->rrsets+i+1,
-				sizeof(struct ub_packed_rrset_key*) * 
-				(msg->rep->rrset_count-i-1));
-			msg->rep->ns_numrrsets--;
-			msg->rep->rrset_count--;
-			/* stay at same i, but new record */
-			continue;
-		}
-		i++;
-	}
-}
-
-void iter_dec_attempts(struct delegpt* dp, int d)
-{
-	struct delegpt_addr* a;
-	for(a=dp->target_list; a; a = a->next_target) {
-		if(a->attempts >= OUTBOUND_MSG_RETRY) {
-			/* add back to result list */
-			a->next_result = dp->result_list;
-			dp->result_list = a;
-		}
-		if(a->attempts > d)
-			a->attempts -= d;
-		else a->attempts = 0;
-	}
-}
-
-void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old)
-{
-	struct delegpt_addr* a, *o, *prev;
-	for(a=dp->target_list; a; a = a->next_target) {
-		o = delegpt_find_addr(old, &a->addr, a->addrlen);
-		if(o) {
-			log_addr(VERB_ALGO, "copy attempt count previous dp",
-				&a->addr, a->addrlen);
-			a->attempts = o->attempts;
-		}
-	}
-	prev = NULL;
-	a = dp->usable_list;
-	while(a) {
-		if(a->attempts >= OUTBOUND_MSG_RETRY) {
-			log_addr(VERB_ALGO, "remove from usable list dp",
-				&a->addr, a->addrlen);
-			/* remove from result list */
-			if(prev)
-				prev->next_usable = a->next_usable;
-			else	dp->usable_list = a->next_usable;
-			/* prev stays the same */
-			a = a->next_usable;
-			continue;
-		}
-		prev = a;
-		a = a->next_usable;
-	}
-}

iterator/iter_utils.h

@@ -43,10 +43,7 @@
 #ifndef ITERATOR_ITER_UTILS_H
 #define ITERATOR_ITER_UTILS_H
 #include "iterator/iter_resptype.h"
-#include "ldns/buffer.h"
 struct iter_env;
-struct iter_hints;
-struct iter_forwards;
 struct config_file;
 struct module_env;
 struct delegpt_addr;
@@ -57,8 +54,6 @@ struct ub_randstate;
 struct query_info;
 struct reply_info;
 struct module_qstate;
-struct sock_list;
-struct ub_packed_rrset_key;
 
 /**
  * Process config options and set iterator module state.
@@ -79,21 +74,14 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
  * @param dp: delegation point with result list.
  * @param name: zone name (for lameness check).
  * @param namelen: length of name.
- * @param qtype: query type that we want to send.
- * @param dnssec_lame: set to 1, if a known dnssec-lame server is selected
+ * @param dnssec_expected: set to 0, if a known dnssec-lame server is selected
  *	these are not preferred, but are used as a last resort.
- * @param chase_to_rd: set to 1 if a known recursion lame server is selected
- * 	these are not preferred, but are used as a last resort.
- * @param open_target: number of currently outstanding target queries.
- * 	If we wait for these, perhaps more server addresses become available.
- * @param blacklist: the IP blacklist to use.
  * @return best target or NULL if no target.
  *	if not null, that target is removed from the result list in the dp.
  */
 struct delegpt_addr* iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, uint8_t* name, 
-	size_t namelen, uint16_t qtype, int* dnssec_lame,
-	int* chase_to_rd, int open_target, struct sock_list* blacklist);
+	size_t namelen, int* dnssec_expected);
 
 /**
  * Allocate dns_msg from parsed msg, in regional.
@@ -120,11 +108,10 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
  * @param rep: reply in dns_msg from dns_alloc_msg for example.
  * @param is_referral: If true, then the given message to be stored is a
  *	referral. The cache implementation may use this as a hint.
- * @param leeway: prefetch TTL leeway to expire old rrsets quicker.
  * @return 0 on alloc error (out of memory).
  */
 int iter_dns_store(struct module_env* env, struct query_info* qinf,
-	struct reply_info* rep, int is_referral, uint32_t leeway);
+	struct reply_info* rep, int is_referral);
 
 /**
  * Select randomly with n/m probability.
@@ -144,24 +131,13 @@ int iter_ns_probability(struct ub_randstate* rnd, int n, int m);
  */
 void iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp);
 
-/**
- * Mark targets that result in a dependency cycle as done, so they
- * will not get selected as targets.  For the parent-side lookups.
- * @param qstate: query state.
- * @param dp: delegpt to mark ns in.
- */
-void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
-	struct delegpt* dp);
-
 /**
  * See if delegation is useful or offers immediately no targets for 
  * further recursion.
- * @param qinfo: query name and type
- * @param qflags: query flags with RD flag
+ * @param qstate: query state with RD flag and query name.
  * @param dp: delegpt to check.
  */
-int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
-	struct delegpt* dp);
+int iter_dp_is_useless(struct module_qstate* qstate, struct delegpt* dp);
 
 /**
  * See if delegation is expected to have DNSSEC information (RRSIGs) in 
@@ -201,109 +177,4 @@ int iter_msg_has_dnssec(struct dns_msg* msg);
 int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp, 
 	enum response_type type, uint16_t dclass);
 
-/**
- * Check if two replies are equal
- * For fallback procedures
- * @param p: reply one. The reply has rrset data pointers in region.
- * 	Does not check rrset-IDs
- * @param q: reply two
- * @param buf: scratch buffer.
- * @return if one and two are equal.
- */
-int reply_equal(struct reply_info* p, struct reply_info* q, ldns_buffer* buf);
-
-/**
- * Store parent-side rrset in seperate rrset cache entries for later 
- * last-resort * lookups in case the child-side versions of this information 
- * fails.
- * @param env: environment with cache, time, ...
- * @param rrset: the rrset to store (copied).
- * Failure to store is logged, but otherwise ignored.
- */
-void iter_store_parentside_rrset(struct module_env* env, 
-	struct ub_packed_rrset_key* rrset);
-
-/**
- * Store parent-side NS records from a referral message
- * @param env: environment with cache, time, ...
- * @param rep: response with NS rrset.
- * Failure to store is logged, but otherwise ignored.
- */
-void iter_store_parentside_NS(struct module_env* env, struct reply_info* rep);
-
-/**
- * Store parent-side negative element, the parentside rrset does not exist,
- * creates an rrset with empty rdata in the rrset cache with PARENTSIDE flag.
- * @param env: environment with cache, time, ...
- * @param qinfo: the identity of the rrset that is missing.
- * @param rep: delegation response or answer response, to glean TTL from.
- * (malloc) failure is logged but otherwise ignored.
- */
-void iter_store_parentside_neg(struct module_env* env, 
-	struct query_info* qinfo, struct reply_info* rep);
-
-/**
- * Add parent NS record if that exists in the cache.  This is both new
- * information and acts like a timeout throttle on retries.
- * @param env: query env with rrset cache and time.
- * @param dp: delegation point to store result in.  Also this dp is used to
- *	see which NS name is needed.
- * @param region: region to alloc result in.
- * @param qinfo: pertinent information, the qclass.
- * @return false on malloc failure.
- *	if true, the routine worked and if such cached information 
- *	existed dp->has_parent_side_NS is set true.
- */
-int iter_lookup_parent_NS_from_cache(struct module_env* env,
-	struct delegpt* dp, struct regional* region, struct query_info* qinfo);
-
-/**
- * Add parent-side glue if that exists in the cache.  This is both new
- * information and acts like a timeout throttle on retries to fetch them.
- * @param env: query env with rrset cache and time.
- * @param dp: delegation point to store result in.  Also this dp is used to
- *	see which NS name is needed.
- * @param region: region to alloc result in.
- * @param qinfo: pertinent information, the qclass.
- * @return: true, it worked, no malloc failures, and new addresses (lame)
- *	have been added, giving extra options as query targets.
- */
-int iter_lookup_parent_glue_from_cache(struct module_env* env,
-	struct delegpt* dp, struct regional* region, struct query_info* qinfo);
-
-/**
- * Lookup next root-hint or root-forward entry.
- * @param hints: the hints.
- * @param fwd: the forwards.
- * @param c: the class to start searching at. 0 means find first one.
- * @return false if no classes found, true if found and returned in c.
- */
-int iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd,
-	uint16_t* c);
-
-/**
- * Remove DS records that are inappropriate before they are cached.
- * @param msg: the response to scrub.
- * @param ns: RRSET that is the NS record for the referral.
- * 	if NULL, then all DS records are removed from the authority section.
- * @param z: zone name that the response is from.
- */
-void iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns,
-	uint8_t* z);
-
-/**
- * Remove query attempts from all available ips. For 0x20.
- * @param dp: delegpt.
- * @param d: decrease.
- */
-void iter_dec_attempts(struct delegpt* dp, int d);
-
-/**
- * Add retry counts from older delegpt to newer delegpt.
- * Does not waste time on timeout'd (or other failing) addresses.
- * @param dp: new delegationpoint.
- * @param old: old delegationpoint.
- */
-void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old);
-
 #endif /* ITERATOR_ITER_UTILS_H */

iterator/iterator.h

@@ -50,7 +50,6 @@ struct iter_hints;
 struct iter_forwards;
 struct iter_donotq;
 struct iter_prep_list;
-struct iter_priv;
 
 /** max number of query restarts. Determines max number of CNAME chain. */
 #define MAX_RESTART_COUNT       8
@@ -65,16 +64,8 @@ struct iter_priv;
  * Equals RTT_MAX_TIMEOUT
  */
 #define USEFUL_SERVER_TOP_TIMEOUT	120000
-/** Number of lost messages in a row that get a host blacklisted.
- * With 16, a couple different queries have to time out and no working
- * queries are happening */
-#define USEFUL_SERVER_MAX_LOST	16
 /** number of retries on outgoing queries */
-#define OUTBOUND_MSG_RETRY 5
-/** RTT band, within this amount from the best, servers are chosen randomly.
- * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
- * fast server, this causes server exploration as a side benefit. msec. */
-#define RTT_BAND 400
+#define OUTBOUND_MSG_RETRY 4
 
 /**
  * Global state for the iterator. 
@@ -91,12 +82,12 @@ struct iter_env {
 	/** A flag to indicate whether or not we have an IPv6 route */
 	int supports_ipv6;
 
+	/** Mapping of forwarding zones to targets. */
+	struct iter_forwards* fwds;
+
 	/** A set of inetaddrs that should never be queried. */
 	struct iter_donotq* donotq;
 
-	/** private address space and private domains */
-	struct iter_priv* priv;
-
 	/** The maximum dependency depth that this resolver will pursue. */
 	int max_dependency_depth;
 
@@ -150,10 +141,6 @@ enum iter_state {
 	/** Responses to priming queries finish at this state. */
 	PRIME_RESP_STATE,
 
-	/** Collecting query class information, for qclass=ANY, when
-	 * it spawns off queries for every class, it returns here. */
-	COLLECT_CLASS_STATE,
-
 	/** Responses that are to be returned upstream end at this state. 
 	 * As well as responses to target queries. */
 	FINISHED_STATE
@@ -215,8 +202,6 @@ struct iter_qstate {
 	struct query_info qchase;
 	/** query flags to use when chasing the answer (i.e. RD flag) */
 	uint16_t chase_flags;
-	/** true if we set RD bit because of last resort recursion lame query*/
-	int chase_to_rd;
 
 	/** 
 	 * This is the current delegation point for an in-progress query. This
@@ -225,13 +210,6 @@ struct iter_qstate {
 	 */
 	struct delegpt* dp;
 
-	/** state for 0x20 fallback when capsfail happens, 0 not a fallback */
-	int caps_fallback;
-	/** state for capsfail: current server number to try */
-	size_t caps_server;
-	/** state for capsfail: stored query for comparisons */
-	struct reply_info* caps_reply;
-
 	/** Current delegation message - returned for non-RD queries */
 	struct dns_msg* deleg_msg;
 
@@ -247,26 +225,6 @@ struct iter_qstate {
 	/** the number of times this query as followed a referral. */
 	int referral_count;
 
-	/**
-	 * The query must store NS records from referrals as parentside RRs
-	 * Enabled once it hits resolution problems, to throttle retries.
-	 */
-	int store_parent_NS;
-	/** the old delegation point with retry counts */
-	struct delegpt* parent_NS_old_dp;
-
-	/**
-	 * The query is for parent-side glue(A or AAAA) for a nameserver.
-	 * If the item is seen as glue in a referral, and pside_glue is NULL,
-	 * then it is stored in pside_glue for later.
-	 * If it was never seen, at the end, then a negative caching element 
-	 * must be created.  
-	 * The (data or negative) RR cache element then throttles retries.
-	 */
-	int query_for_pside_glue;
-	/** the parent-side-glue element (NULL if none, its first match) */
-	struct ub_packed_rrset_key* pside_glue;
-
 	/** 
 	 * expected dnssec information for this iteration step. 
 	 * If dnssec rrsigs are expected and not given, the server is marked
@@ -274,12 +232,6 @@ struct iter_qstate {
 	 */
 	int dnssec_expected;
 
-	/**
-	 * We are expecting dnssec information, but we also know the server
-	 * is DNSSEC lame.  The response need not be marked dnssec-lame again.
-	 */
-	int dnssec_lame_query;
-
 	/**
 	 * This is flag that, if true, means that this event is 
 	 * waiting for a stub priming query. 

libunbound/context.c

@@ -1,400 +0,0 @@
-/*
- * libunbound/context.c - validating context for unbound internal use
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains the validator context structure.
- */
-#include "config.h"
-#include "libunbound/context.h"
-#include "util/module.h"
-#include "util/config_file.h"
-#include "util/net_help.h"
-#include "services/modstack.h"
-#include "services/localzone.h"
-#include "services/cache/rrset.h"
-#include "services/cache/infra.h"
-#include "util/data/msgreply.h"
-#include "util/storage/slabhash.h"
-
-int 
-context_finalize(struct ub_ctx* ctx)
-{
-	struct config_file* cfg = ctx->env->cfg;
-	verbosity = cfg->verbosity;
-	if(ctx->logfile_override)
-		log_file(ctx->log_out);
-	else	log_init(cfg->logfile, cfg->use_syslog, NULL);
-	config_apply(cfg);
-	if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
-		return UB_INITFAIL;
-	ctx->local_zones = local_zones_create();
-	if(!ctx->local_zones)
-		return UB_NOMEM;
-	if(!local_zones_apply_cfg(ctx->local_zones, cfg))
-		return UB_INITFAIL;
-	if(!ctx->env->msg_cache ||
-	   cfg->msg_cache_size != slabhash_get_size(ctx->env->msg_cache) || 
-	   cfg->msg_cache_slabs != ctx->env->msg_cache->size) {
-		slabhash_delete(ctx->env->msg_cache);
-		ctx->env->msg_cache = slabhash_create(cfg->msg_cache_slabs,
-			HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size,
-			msgreply_sizefunc, query_info_compare,
-			query_entry_delete, reply_info_delete, NULL);
-		if(!ctx->env->msg_cache)
-			return UB_NOMEM;
-	}
-	ctx->env->rrset_cache = rrset_cache_adjust(ctx->env->rrset_cache,
-		ctx->env->cfg, ctx->env->alloc);
-	if(!ctx->env->rrset_cache)
-		return UB_NOMEM;
-	ctx->env->infra_cache = infra_adjust(ctx->env->infra_cache, cfg);
-	if(!ctx->env->infra_cache)
-		return UB_NOMEM;
-	ctx->finalized = 1;
-	return UB_NOERROR;
-}
-
-int context_query_cmp(const void* a, const void* b)
-{
-	if( *(int*)a < *(int*)b )
-		return -1;
-	if( *(int*)a > *(int*)b )
-		return 1;
-	return 0;
-}
-
-void
-context_query_delete(struct ctx_query* q) 
-{
-	if(!q) return;
-	ub_resolve_free(q->res);
-	free(q->msg);
-	free(q);
-}
-
-/** How many times to try to find an unused query-id-number for async */
-#define NUM_ID_TRIES 100000
-/** find next useful id number of 0 on error */
-static int
-find_id(struct ub_ctx* ctx, int* id)
-{
-	size_t tries = 0;
-	ctx->next_querynum++;
-	while(rbtree_search(&ctx->queries, &ctx->next_querynum)) {
-		ctx->next_querynum++; /* numerical wraparound is fine */
-		if(tries++ > NUM_ID_TRIES)
-			return 0;
-	}
-	*id = ctx->next_querynum;
-	return 1;
-}
-
-struct ctx_query* 
-context_new(struct ub_ctx* ctx, char* name, int rrtype, int rrclass, 
-	ub_callback_t cb, void* cbarg)
-{
-	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
-	if(!q) return NULL;
-	lock_basic_lock(&ctx->cfglock);
-	if(!find_id(ctx, &q->querynum)) {
-		lock_basic_unlock(&ctx->cfglock);
-		free(q);
-		return NULL;
-	}
-	lock_basic_unlock(&ctx->cfglock);
-	q->node.key = &q->querynum;
-	q->async = (cb != NULL);
-	q->cb = cb;
-	q->cb_arg = cbarg;
-	q->res = (struct ub_result*)calloc(1, sizeof(*q->res));
-	if(!q->res) {
-		free(q);
-		return NULL;
-	}
-	q->res->qname = strdup(name);
-	if(!q->res->qname) {
-		free(q->res);
-		free(q);
-		return NULL;
-	}
-	q->res->qtype = rrtype;
-	q->res->qclass = rrclass;
-
-	/* add to query list */
-	lock_basic_lock(&ctx->cfglock);
-	if(q->async)
-		ctx->num_async ++;
-	(void)rbtree_insert(&ctx->queries, &q->node);
-	lock_basic_unlock(&ctx->cfglock);
-	return q;
-}
-
-struct alloc_cache* 
-context_obtain_alloc(struct ub_ctx* ctx, int locking)
-{
-	struct alloc_cache* a;
-	int tnum = 0;
-	if(locking) {
-		lock_basic_lock(&ctx->cfglock);
-	}
-	a = ctx->alloc_list;
-	if(a)
-		ctx->alloc_list = a->super; /* snip off list */
-	else	tnum = ctx->thr_next_num++;
-	if(locking) {
-		lock_basic_unlock(&ctx->cfglock);
-	}
-	if(a) {
-		a->super = &ctx->superalloc;
-		return a;
-	}
-	a = (struct alloc_cache*)calloc(1, sizeof(*a));
-	if(!a)
-		return NULL;
-	alloc_init(a, &ctx->superalloc, tnum);
-	return a;
-}
-
-void 
-context_release_alloc(struct ub_ctx* ctx, struct alloc_cache* alloc,
-	int locking)
-{
-	if(!ctx || !alloc)
-		return;
-	if(locking) {
-		lock_basic_lock(&ctx->cfglock);
-	}
-	alloc->super = ctx->alloc_list;
-	ctx->alloc_list = alloc;
-	if(locking) {
-		lock_basic_unlock(&ctx->cfglock);
-	}
-}
-
-uint8_t* 
-context_serialize_new_query(struct ctx_query* q, uint32_t* len)
-{
-	/* format for new query is
-	 * 	o uint32 cmd
-	 * 	o uint32 id
-	 * 	o uint32 type
-	 * 	o uint32 class
-	 * 	o rest queryname (string)
-	 */
-	uint8_t* p;
-	size_t slen = strlen(q->res->qname) + 1/*end of string*/;
-	*len = sizeof(uint32_t)*4 + slen;
-	p = (uint8_t*)malloc(*len);
-	if(!p) return NULL;
-	ldns_write_uint32(p, UB_LIBCMD_NEWQUERY);
-	ldns_write_uint32(p+sizeof(uint32_t), (uint32_t)q->querynum);
-	ldns_write_uint32(p+2*sizeof(uint32_t), (uint32_t)q->res->qtype);
-	ldns_write_uint32(p+3*sizeof(uint32_t), (uint32_t)q->res->qclass);
-	memmove(p+4*sizeof(uint32_t), q->res->qname, slen);
-	return p;
-}
-
-struct ctx_query* 
-context_deserialize_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
-{
-	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
-	if(!q) return NULL;
-	if(len < 4*sizeof(uint32_t)+1) {
-		free(q);
-		return NULL;
-	}
-	log_assert( ldns_read_uint32(p) == UB_LIBCMD_NEWQUERY);
-	q->querynum = (int)ldns_read_uint32(p+sizeof(uint32_t));
-	q->node.key = &q->querynum;
-	q->async = 1;
-	q->res = (struct ub_result*)calloc(1, sizeof(*q->res));
-	if(!q->res) {
-		free(q);
-		return NULL;
-	}
-	q->res->qtype = (int)ldns_read_uint32(p+2*sizeof(uint32_t));
-	q->res->qclass = (int)ldns_read_uint32(p+3*sizeof(uint32_t));
-	q->res->qname = strdup((char*)(p+4*sizeof(uint32_t)));
-	if(!q->res->qname) {
-		free(q->res);
-		free(q);
-		return NULL;
-	}
-
-	/** add to query list */
-	ctx->num_async++;
-	(void)rbtree_insert(&ctx->queries, &q->node);
-	return q;
-}
-
-struct ctx_query* 
-context_lookup_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
-{
-	struct ctx_query* q;
-	int querynum;
-	if(len < 4*sizeof(uint32_t)+1) {
-		return NULL;
-	}
-	log_assert( ldns_read_uint32(p) == UB_LIBCMD_NEWQUERY);
-	querynum = (int)ldns_read_uint32(p+sizeof(uint32_t));
-	q = (struct ctx_query*)rbtree_search(&ctx->queries, &querynum);
-	if(!q) {
-		return NULL;
-	}
-	log_assert(q->async);
-	return q;
-}
-
-uint8_t* 
-context_serialize_answer(struct ctx_query* q, int err, ldns_buffer* pkt,
-	uint32_t* len)
-{
-	/* answer format
-	 * 	o uint32 cmd
-	 * 	o uint32 id
-	 * 	o uint32 error_code
-	 * 	o uint32 msg_security
-	 * 	o uint32 length of why_bogus string (+1 for eos); 0 absent.
-	 * 	o why_bogus_string
-	 * 	o the remainder is the answer msg from resolver lookup.
-	 * 	  remainder can be length 0.
-	 */
-	size_t pkt_len = pkt?ldns_buffer_remaining(pkt):0;
-	size_t wlen = (pkt&&q->res->why_bogus)?strlen(q->res->why_bogus)+1:0;
-	uint8_t* p;
-	*len = sizeof(uint32_t)*5 + pkt_len + wlen;
-	p = (uint8_t*)malloc(*len);
-	if(!p) return NULL;
-	ldns_write_uint32(p, UB_LIBCMD_ANSWER);
-	ldns_write_uint32(p+sizeof(uint32_t), (uint32_t)q->querynum);
-	ldns_write_uint32(p+2*sizeof(uint32_t), (uint32_t)err);
-	ldns_write_uint32(p+3*sizeof(uint32_t), (uint32_t)q->msg_security);
-	ldns_write_uint32(p+4*sizeof(uint32_t), (uint32_t)wlen);
-	if(wlen > 0)
-		memmove(p+5*sizeof(uint32_t), q->res->why_bogus, wlen);
-	if(pkt_len > 0)
-		memmove(p+5*sizeof(uint32_t)+wlen, 
-			ldns_buffer_begin(pkt), pkt_len);
-	return p;
-}
-
-struct ctx_query* 
-context_deserialize_answer(struct ub_ctx* ctx,
-        uint8_t* p, uint32_t len, int* err)
-{
-	struct ctx_query* q = NULL ;
-	int id;
-	size_t wlen;
-	if(len < 5*sizeof(uint32_t)) return NULL;
-	log_assert( ldns_read_uint32(p) == UB_LIBCMD_ANSWER);
-	id = (int)ldns_read_uint32(p+sizeof(uint32_t));
-	q = (struct ctx_query*)rbtree_search(&ctx->queries, &id);
-	if(!q) return NULL; 
-	*err = (int)ldns_read_uint32(p+2*sizeof(uint32_t));
-	q->msg_security = ldns_read_uint32(p+3*sizeof(uint32_t));
-	wlen = (size_t)ldns_read_uint32(p+4*sizeof(uint32_t));
-	if(len > 5*sizeof(uint32_t) && wlen > 0) {
-		if(len >= 5*sizeof(uint32_t)+wlen)
-			q->res->why_bogus = (char*)memdup(
-				p+5*sizeof(uint32_t), wlen);
-		if(!q->res->why_bogus) {
-			/* pass malloc failure to the user callback */
-			q->msg_len = 0;
-			*err = UB_NOMEM;
-			return q;
-		}
-		q->res->why_bogus[wlen-1] = 0; /* zero terminated for sure */
-	}
-	if(len > 5*sizeof(uint32_t)+wlen) {
-		q->msg_len = len - 5*sizeof(uint32_t) - wlen;
-		q->msg = (uint8_t*)memdup(p+5*sizeof(uint32_t)+wlen, 
-			q->msg_len);
-		if(!q->msg) {
-			/* pass malloc failure to the user callback */
-			q->msg_len = 0;
-			*err = UB_NOMEM;
-			return q;
-		}
-	} 
-	return q;
-}
-
-uint8_t* 
-context_serialize_cancel(struct ctx_query* q, uint32_t* len)
-{
-	/* format of cancel:
-	 * 	o uint32 cmd
-	 * 	o uint32 async-id */
-	uint8_t* p = (uint8_t*)malloc(2*sizeof(uint32_t));
-	if(!p) return NULL;
-	*len = 2*sizeof(uint32_t);
-	ldns_write_uint32(p, UB_LIBCMD_CANCEL);
-	ldns_write_uint32(p+sizeof(uint32_t), (uint32_t)q->querynum);
-	return p;
-}
-
-struct ctx_query* context_deserialize_cancel(struct ub_ctx* ctx,
-        uint8_t* p, uint32_t len)
-{
-	struct ctx_query* q;
-	int id;
-	if(len != 2*sizeof(uint32_t)) return NULL;
-	log_assert( ldns_read_uint32(p) == UB_LIBCMD_CANCEL);
-	id = (int)ldns_read_uint32(p+sizeof(uint32_t));
-	q = (struct ctx_query*)rbtree_search(&ctx->queries, &id);
-	return q;
-}
-
-uint8_t* 
-context_serialize_quit(uint32_t* len)
-{
-	uint8_t* p = (uint8_t*)malloc(sizeof(uint32_t));
-	if(!p)
-		return NULL;
-	*len = sizeof(uint32_t);
-	ldns_write_uint32(p, UB_LIBCMD_QUIT);
-	return p;
-}
-
-enum ub_ctx_cmd context_serial_getcmd(uint8_t* p, uint32_t len)
-{
-	uint32_t v;
-	if((size_t)len < sizeof(v))
-		return UB_LIBCMD_QUIT;
-	v = ldns_read_uint32(p);
-	return v;
-}

libunbound/context.h

@@ -1,345 +0,0 @@
-/*
- * libunbound/context.h - validating context for unbound internal use
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains the validator context structure.
- */
-#ifndef LIBUNBOUND_CONTEXT_H
-#define LIBUNBOUND_CONTEXT_H
-#include "util/locks.h"
-#include "util/alloc.h"
-#include "util/rbtree.h"
-#include "services/modstack.h"
-#include "libunbound/unbound.h"
-#include "util/data/packed_rrset.h"
-struct libworker;
-struct tube;
-
-/**
- * The context structure
- *
- * Contains two pipes for async service
- *	qq : write queries to the async service pid/tid.
- *	rr : read results from the async service pid/tid.
- */
-struct ub_ctx {
-	/* --- pipes --- */
-	/** mutex on query write pipe */
-	lock_basic_t qqpipe_lock;
-	/** the query write pipe */
-	struct tube* qq_pipe;
-	/** mutex on result read pipe */
-	lock_basic_t rrpipe_lock;
-	/** the result read pipe */
-	struct tube* rr_pipe;
-
-	/* --- shared data --- */
-	/** mutex for access to env.cfg, finalized and dothread */
-	lock_basic_t cfglock;
-	/** 
-	 * The context has been finalized 
-	 * This is after config when the first resolve is done.
-	 * The modules are inited (module-init()) and shared caches created.
-	 */
-	int finalized;
-
-	/** is bg worker created yet ? */
-	int created_bg;
-	/** pid of bg worker process */
-	pid_t bg_pid;
-	/** tid of bg worker thread */
-	ub_thread_t bg_tid;
-
-	/** do threading (instead of forking) for async resolution */
-	int dothread;
-	/** next thread number for new threads */
-	int thr_next_num;
-	/** if logfile is overriden */
-	int logfile_override;
-	/** what logfile to use instead */
-	FILE* log_out;
-	/** 
-	 * List of alloc-cache-id points per threadnum for notinuse threads.
-	 * Simply the entire struct alloc_cache with the 'super' member used
-	 * to link a simply linked list. Reset super member to the superalloc
-	 * before use.
-	 */
-	struct alloc_cache* alloc_list;
-
-	/** shared caches, and so on */
-	struct alloc_cache superalloc;
-	/** module env master value */
-	struct module_env* env;
-	/** module stack */
-	struct module_stack mods;
-	/** local authority zones */
-	struct local_zones* local_zones;
-	/** random state used to seed new random state structures */
-	struct ub_randstate* seed_rnd;
-
-	/** next query number (to try) to use */
-	int next_querynum;
-	/** number of async queries outstanding */
-	size_t num_async;
-	/** 
-	 * Tree of outstanding queries. Indexed by querynum 
-	 * Used when results come in for async to lookup.
-	 * Used when cancel is done for lookup (and delete).
-	 * Used to see if querynum is free for use.
-	 * Content of type ctx_query.
-	 */ 
-	rbtree_t queries;
-};
-
-/**
- * The queries outstanding for the libunbound resolver.
- * These are outstanding for async resolution.
- * But also, outstanding for sync resolution by one of the threads that
- * has joined the threadpool.
- */
-struct ctx_query {
-	/** node in rbtree, must be first entry, key is ptr to the querynum */
-	struct rbnode_t node;
-	/** query id number, key for node */
-	int querynum;
-	/** was this an async query? */
-	int async;
-	/** was this query cancelled (for bg worker) */
-	int cancelled;
-
-	/** for async query, the callback function */
-	ub_callback_t cb;
-	/** for async query, the callback user arg */
-	void* cb_arg;
-
-	/** answer message, result from resolver lookup. */
-	uint8_t* msg;
-	/** resulting message length. */
-	size_t msg_len;
-	/** validation status on security */
-	enum sec_status msg_security;
-	/** store libworker that is handling this query */
-	struct libworker* w;
-
-	/** result structure, also contains original query, type, class.
-	 * malloced ptr ready to hand to the client. */
-	struct ub_result* res;
-};
-
-/**
- * The error constants
- */
-enum ub_ctx_err {
-	/** no error */
-	UB_NOERROR = 0,
-	/** socket operation. Set to -1, so that if an error from _fd() is
-	 * passed (-1) it gives a socket error. */
-	UB_SOCKET = -1,
-	/** alloc failure */
-	UB_NOMEM = -2,
-	/** syntax error */
-	UB_SYNTAX = -3,
-	/** DNS service failed */
-	UB_SERVFAIL = -4,
-	/** fork() failed */
-	UB_FORKFAIL = -5,
-	/** cfg change after finalize() */
-	UB_AFTERFINAL = -6,
-	/** initialization failed (bad settings) */
-	UB_INITFAIL = -7,
-	/** error in pipe communication with async bg worker */
-	UB_PIPE = -8,
-	/** error reading from file (resolv.conf) */
-	UB_READFILE = -9,
-	/** error async_id does not exist or result already been delivered */
-	UB_NOID = -10
-};
-
-/**
- * Command codes for libunbound pipe.
- *
- * Serialization looks like this:
- * 	o length (of remainder) uint32.
- * 	o uint32 command code.
- * 	o per command format.
- */
-enum ub_ctx_cmd {
-	/** QUIT */
-	UB_LIBCMD_QUIT = 0,
-	/** New query, sent to bg worker */
-	UB_LIBCMD_NEWQUERY,
-	/** Cancel query, sent to bg worker */
-	UB_LIBCMD_CANCEL,
-	/** Query result, originates from bg worker */
-	UB_LIBCMD_ANSWER
-};
-
-/** 
- * finalize a context.
- * @param ctx: context to finalize. creates shared data.
- * @return 0 if OK, or errcode.
- */
-int context_finalize(struct ub_ctx* ctx);
-
-/** compare two ctx_query elements */
-int context_query_cmp(const void* a, const void* b);
-
-/** 
- * delete context query
- * @param q: query to delete, including message packet and prealloc result
- */
-void context_query_delete(struct ctx_query* q);
-
-/**
- * Create new query in context, add to querynum list.
- * @param ctx: context
- * @param name: query name
- * @param rrtype: type
- * @param rrclass: class
- * @param cb: callback for async, or NULL for sync.
- * @param cbarg: user arg for async queries.
- * @return new ctx_query or NULL for malloc failure.
- */
-struct ctx_query* context_new(struct ub_ctx* ctx, char* name, int rrtype,
-        int rrclass, ub_callback_t cb, void* cbarg);
-
-/**
- * Get a new alloc. Creates a new one or uses a cached one.
- * @param ctx: context
- * @param locking: if true, cfglock is locked while getting alloc.
- * @return an alloc, or NULL on mem error.
- */
-struct alloc_cache* context_obtain_alloc(struct ub_ctx* ctx, int locking);
-
-/**
- * Release an alloc. Puts it into the cache.
- * @param ctx: context
- * @param locking: if true, cfglock is locked while releasing alloc.
- * @param alloc: alloc to relinquish.
- */
-void context_release_alloc(struct ub_ctx* ctx, struct alloc_cache* alloc,
-	int locking);
-
-/**
- * Serialize a context query that questions data.
- * This serializes the query name, type, ...
- * As well as command code 'new_query'.
- * @param q: context query
- * @param len: the length of the allocation is returned.
- * @return: an alloc, or NULL on mem error.
- */
-uint8_t* context_serialize_new_query(struct ctx_query* q, uint32_t* len);
-
-/**
- * Serialize a context_query result to hand back to user.
- * This serializes the query name, type, ..., and result.
- * As well as command code 'answer'.
- * @param q: context query
- * @param err: error code to pass to client.
- * @param pkt: the packet to add, can be NULL.
- * @param len: the length of the allocation is returned.
- * @return: an alloc, or NULL on mem error.
- */
-uint8_t* context_serialize_answer(struct ctx_query* q, int err, 
-	ldns_buffer* pkt, uint32_t* len);
-
-/**
- * Serialize a query cancellation. Serializes query async id
- * as well as command code 'cancel'
- * @param q: context query
- * @param len: the length of the allocation is returned.
- * @return: an alloc, or NULL on mem error.
- */
-uint8_t* context_serialize_cancel(struct ctx_query* q, uint32_t* len);
-
-/**
- * Serialize a 'quit' command.
- * @param len: the length of the allocation is returned.
- * @return: an alloc, or NULL on mem error.
- */
-uint8_t* context_serialize_quit(uint32_t* len);
-
-/**
- * Obtain command code from serialized buffer
- * @param p: buffer serialized.
- * @param len: length of buffer.
- * @return command code or QUIT on error.
- */
-enum ub_ctx_cmd context_serial_getcmd(uint8_t* p, uint32_t len);
-
-/**
- * Lookup query from new_query buffer.
- * @param ctx: context
- * @param p: buffer serialized.
- * @param len: length of buffer.
- * @return looked up ctx_query or NULL for malloc failure.
- */
-struct ctx_query* context_lookup_new_query(struct ub_ctx* ctx, 
-	uint8_t* p, uint32_t len);
-
-/**
- * Deserialize a new_query buffer.
- * @param ctx: context
- * @param p: buffer serialized.
- * @param len: length of buffer.
- * @return new ctx_query or NULL for malloc failure.
- */
-struct ctx_query* context_deserialize_new_query(struct ub_ctx* ctx, 
-	uint8_t* p, uint32_t len);
-
-/**
- * Deserialize an answer buffer.
- * @param ctx: context
- * @param p: buffer serialized.
- * @param len: length of buffer.
- * @param err: error code to be returned to client is passed.
- * @return ctx_query with answer added or NULL for malloc failure.
- */
-struct ctx_query* context_deserialize_answer(struct ub_ctx* ctx, 
-	uint8_t* p, uint32_t len, int* err);
-
-/**
- * Deserialize a cancel buffer.
- * @param ctx: context
- * @param p: buffer serialized.
- * @param len: length of buffer.
- * @return ctx_query to cancel or NULL for failure.
- */
-struct ctx_query* context_deserialize_cancel(struct ub_ctx* ctx, 
-	uint8_t* p, uint32_t len);
-
-#endif /* LIBUNBOUND_CONTEXT_H */

libunbound/libworker.c

@@ -1,898 +0,0 @@
-/*
- * libunbound/worker.c - worker thread or process that resolves
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains the worker process or thread that performs
- * the DNS resolving and validation. The worker is called by a procedure
- * and if in the background continues until exit, if in the foreground
- * returns from the procedure when done.
- */
-#include "config.h"
-#include <ldns/dname.h>
-#include <ldns/wire2host.h>
-#include "libunbound/libworker.h"
-#include "libunbound/context.h"
-#include "libunbound/unbound.h"
-#include "services/outside_network.h"
-#include "services/mesh.h"
-#include "services/localzone.h"
-#include "services/cache/rrset.h"
-#include "services/outbound_list.h"
-#include "util/module.h"
-#include "util/regional.h"
-#include "util/random.h"
-#include "util/config_file.h"
-#include "util/netevent.h"
-#include "util/storage/slabhash.h"
-#include "util/net_help.h"
-#include "util/data/dname.h"
-#include "util/data/msgreply.h"
-#include "util/data/msgencode.h"
-#include "util/tube.h"
-#include "iterator/iter_fwd.h"
-
-/** handle new query command for bg worker */
-static void handle_newq(struct libworker* w, uint8_t* buf, uint32_t len);
-
-/** delete libworker struct */
-static void
-libworker_delete(struct libworker* w)
-{
-	if(!w) return;
-	if(w->env) {
-		outside_network_quit_prepare(w->back);
-		mesh_delete(w->env->mesh);
-		context_release_alloc(w->ctx, w->env->alloc, 
-			!w->is_bg || w->is_bg_thread);
-		ldns_buffer_free(w->env->scratch_buffer);
-		regional_destroy(w->env->scratch);
-		forwards_delete(w->env->fwds);
-		ub_randfree(w->env->rnd);
-		free(w->env);
-	}
-	outside_network_delete(w->back);
-	comm_base_delete(w->base);
-	free(w);
-}
-
-/** setup fresh libworker struct */
-static struct libworker*
-libworker_setup(struct ub_ctx* ctx, int is_bg)
-{
-	unsigned int seed;
-	struct libworker* w = (struct libworker*)calloc(1, sizeof(*w));
-	struct config_file* cfg = ctx->env->cfg;
-	int* ports;
-	int numports;
-	if(!w) return NULL;
-	w->is_bg = is_bg;
-	w->ctx = ctx;
-	w->env = (struct module_env*)malloc(sizeof(*w->env));
-	if(!w->env) {
-		free(w);
-		return NULL;
-	}
-	*w->env = *ctx->env;
-	w->env->alloc = context_obtain_alloc(ctx, !w->is_bg || w->is_bg_thread);
-	if(!w->env->alloc) {
-		libworker_delete(w);
-		return NULL;
-	}
-	w->thread_num = w->env->alloc->thread_num;
-	alloc_set_id_cleanup(w->env->alloc, &libworker_alloc_cleanup, w);
-	if(!w->is_bg || w->is_bg_thread) {
-		lock_basic_lock(&ctx->cfglock);
-	}
-	w->env->scratch = regional_create_custom(cfg->msg_buffer_size);
-	w->env->scratch_buffer = ldns_buffer_new(cfg->msg_buffer_size);
-	w->env->fwds = forwards_create();
-	if(w->env->fwds && !forwards_apply_cfg(w->env->fwds, cfg)) { 
-		forwards_delete(w->env->fwds);
-		w->env->fwds = NULL;
-	}
-	if(!w->is_bg || w->is_bg_thread) {
-		lock_basic_unlock(&ctx->cfglock);
-	}
-	if(!w->env->scratch || !w->env->scratch_buffer || !w->env->fwds) {
-		libworker_delete(w);
-		return NULL;
-	}
-	w->env->worker = (struct worker*)w;
-	w->env->probe_timer = NULL;
-	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
-		(((unsigned int)w->thread_num)<<17);
-	seed ^= (unsigned int)w->env->alloc->next_id;
-	if(!w->is_bg || w->is_bg_thread) {
-		lock_basic_lock(&ctx->cfglock);
-	}
-	if(!(w->env->rnd = ub_initstate(seed, ctx->seed_rnd))) {
-		if(!w->is_bg || w->is_bg_thread) {
-			lock_basic_unlock(&ctx->cfglock);
-		}
-		seed = 0;
-		libworker_delete(w);
-		return NULL;
-	}
-	if(!w->is_bg || w->is_bg_thread) {
-		lock_basic_unlock(&ctx->cfglock);
-	}
-	seed = 0;
-
-	w->base = comm_base_create(0);
-	if(!w->base) {
-		libworker_delete(w);
-		return NULL;
-	}
-	if(!w->is_bg || w->is_bg_thread) {
-		lock_basic_lock(&ctx->cfglock);
-	}
-	numports = cfg_condense_ports(cfg, &ports);
-	if(numports == 0) {
-		libworker_delete(w);
-		return NULL;
-	}
-	w->back = outside_network_create(w->base, cfg->msg_buffer_size,
-		(size_t)cfg->outgoing_num_ports, cfg->out_ifs,
-		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
-		cfg->do_tcp?cfg->outgoing_num_tcp:0,
-		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
-		ports, numports, cfg->unwanted_threshold,
-		&libworker_alloc_cleanup, w, cfg->do_udp);
-	if(!w->is_bg || w->is_bg_thread) {
-		lock_basic_unlock(&ctx->cfglock);
-	}
-	free(ports);
-	if(!w->back) {
-		libworker_delete(w);
-		return NULL;
-	}
-	w->env->mesh = mesh_create(&ctx->mods, w->env);
-	if(!w->env->mesh) {
-		libworker_delete(w);
-		return NULL;
-	}
-	w->env->send_packet = &libworker_send_packet;
-	w->env->send_query = &libworker_send_query;
-	w->env->detach_subs = &mesh_detach_subs;
-	w->env->attach_sub = &mesh_attach_sub;
-	w->env->kill_sub = &mesh_state_delete;
-	w->env->detect_cycle = &mesh_detect_cycle;
-	comm_base_timept(w->base, &w->env->now, &w->env->now_tv);
-	return w;
-}
-
-/** handle cancel command for bg worker */
-static void
-handle_cancel(struct libworker* w, uint8_t* buf, uint32_t len)
-{
-	struct ctx_query* q;
-	if(w->is_bg_thread) {
-		lock_basic_lock(&w->ctx->cfglock);
-		q = context_deserialize_cancel(w->ctx, buf, len);
-		lock_basic_unlock(&w->ctx->cfglock);
-	} else {
-		q = context_deserialize_cancel(w->ctx, buf, len);
-	}
-	if(!q) {
-		/* probably simply lookup failed, i.e. the message had been
-		 * processed and answered before the cancel arrived */
-		return;
-	}
-	q->cancelled = 1;
-	free(buf);
-}
-
-/** do control command coming into bg server */
-static void
-libworker_do_cmd(struct libworker* w, uint8_t* msg, uint32_t len)
-{
-	switch(context_serial_getcmd(msg, len)) {
-		default:
-		case UB_LIBCMD_ANSWER:
-			log_err("unknown command for bg worker %d", 
-				(int)context_serial_getcmd(msg, len));
-			/* and fall through to quit */
-		case UB_LIBCMD_QUIT:
-			free(msg);
-			comm_base_exit(w->base);
-			break;
-		case UB_LIBCMD_NEWQUERY:
-			handle_newq(w, msg, len);
-			break;
-		case UB_LIBCMD_CANCEL:
-			handle_cancel(w, msg, len);
-			break;
-	}
-}
-
-/** handle control command coming into server */
-void 
-libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), 
-	uint8_t* msg, size_t len, int err, void* arg)
-{
-	struct libworker* w = (struct libworker*)arg;
-
-	if(err != 0) {
-		free(msg);
-		/* it is of no use to go on, exit */
-		comm_base_exit(w->base);
-		return;
-	}
-	libworker_do_cmd(w, msg, len); /* also frees the buf */
-}
-
-/** the background thread func */
-static void*
-libworker_dobg(void* arg)
-{
-	/* setup */
-	uint32_t m;
-	struct libworker* w = (struct libworker*)arg;
-	struct ub_ctx* ctx = w->ctx;
-	log_thread_set(&w->thread_num);
-#ifdef THREADS_DISABLED
-	/* we are forked */
-	w->is_bg_thread = 0;
-	/* close non-used parts of the pipes */
-	tube_close_write(ctx->qq_pipe);
-	tube_close_read(ctx->rr_pipe);
-#endif
-	if(!w) {
-		log_err("libunbound bg worker init failed, nomem");
-		return NULL;
-	}
-	if(!tube_setup_bg_listen(ctx->qq_pipe, w->base, 
-		libworker_handle_control_cmd, w)) {
-		log_err("libunbound bg worker init failed, no bglisten");
-		return NULL;
-	}
-	if(!tube_setup_bg_write(ctx->rr_pipe, w->base)) {
-		log_err("libunbound bg worker init failed, no bgwrite");
-		return NULL;
-	}
-
-	/* do the work */
-	comm_base_dispatch(w->base);
-
-	/* cleanup */
-	m = UB_LIBCMD_QUIT;
-	tube_remove_bg_listen(w->ctx->qq_pipe);
-	tube_remove_bg_write(w->ctx->rr_pipe);
-	libworker_delete(w);
-	(void)tube_write_msg(ctx->rr_pipe, (uint8_t*)&m, 
-		(uint32_t)sizeof(m), 0);
-#ifdef THREADS_DISABLED
-	/* close pipes from forked process before exit */
-	tube_close_read(ctx->qq_pipe);
-	tube_close_write(ctx->rr_pipe);
-#endif
-	return NULL;
-}
-
-int libworker_bg(struct ub_ctx* ctx)
-{
-	struct libworker* w;
-	/* fork or threadcreate */
-	lock_basic_lock(&ctx->cfglock);
-	if(ctx->dothread) {
-		lock_basic_unlock(&ctx->cfglock);
-		w = libworker_setup(ctx, 1);
-		w->is_bg_thread = 1;
-#ifdef ENABLE_LOCK_CHECKS
-		w->thread_num = 1; /* for nicer DEBUG checklocks */
-#endif
-		if(!w) return UB_NOMEM;
-		ub_thread_create(&ctx->bg_tid, libworker_dobg, w);
-	} else {
-		lock_basic_unlock(&ctx->cfglock);
-#ifndef HAVE_FORK
-		/* no fork on windows */
-		return UB_FORKFAIL;
-#else /* HAVE_FORK */
-		switch((ctx->bg_pid=fork())) {
-			case 0:
-				w = libworker_setup(ctx, 1);
-				if(!w) fatal_exit("out of memory");
-				/* close non-used parts of the pipes */
-				tube_close_write(ctx->qq_pipe);
-				tube_close_read(ctx->rr_pipe);
-				(void)libworker_dobg(w);
-				exit(0);
-				break;
-			case -1:
-				return UB_FORKFAIL;
-			default:
-				break;
-		}
-#endif /* HAVE_FORK */ 
-	}
-	return UB_NOERROR;
-}
-
-/** get msg reply struct (in temp region) */
-static struct reply_info*
-parse_reply(ldns_buffer* pkt, struct regional* region, struct query_info* qi)
-{
-	struct reply_info* rep;
-	struct msg_parse* msg;
-	if(!(msg = regional_alloc(region, sizeof(*msg)))) {
-		return NULL;
-	}
-	memset(msg, 0, sizeof(*msg));
-	ldns_buffer_set_position(pkt, 0);
-	if(parse_packet(pkt, msg, region) != 0)
-		return 0;
-	if(!parse_create_msg(pkt, msg, NULL, qi, &rep, region)) {
-		return 0;
-	}
-	return rep;
-}
-
-/** insert canonname */
-static int
-fill_canon(struct ub_result* res, uint8_t* s)
-{
-	char buf[255+2];
-	dname_str(s, buf);
-	res->canonname = strdup(buf);
-	return res->canonname != 0;
-}
-
-/** fill data into result */
-static int
-fill_res(struct ub_result* res, struct ub_packed_rrset_key* answer,
-	uint8_t* finalcname, struct query_info* rq)
-{
-	size_t i;
-	struct packed_rrset_data* data;
-	if(!answer) {
-		if(finalcname) {
-			if(!fill_canon(res, finalcname))
-				return 0; /* out of memory */
-		}
-		res->data = (char**)calloc(1, sizeof(char*));
-		res->len = (int*)calloc(1, sizeof(int));
-		return (res->data && res->len);
-	}
-	data = (struct packed_rrset_data*)answer->entry.data;
-	if(query_dname_compare(rq->qname, answer->rk.dname) != 0) {
-		if(!fill_canon(res, answer->rk.dname))
-			return 0; /* out of memory */
-	} else	res->canonname = NULL;
-	res->data = (char**)calloc(data->count+1, sizeof(char*));
-	res->len = (int*)calloc(data->count+1, sizeof(int));
-	if(!res->data || !res->len)
-		return 0; /* out of memory */
-	for(i=0; i<data->count; i++) {
-		/* remove rdlength from rdata */
-		res->len[i] = (int)(data->rr_len[i] - 2);
-		res->data[i] = memdup(data->rr_data[i]+2, (size_t)res->len[i]);
-		if(!res->data[i])
-			return 0; /* out of memory */
-	}
-	res->data[data->count] = NULL;
-	res->len[data->count] = 0;
-	return 1;
-}
-
-/** fill result from parsed message, on error fills servfail */
-void
-libworker_enter_result(struct ub_result* res, ldns_buffer* buf,
-	struct regional* temp, enum sec_status msg_security)
-{
-	struct query_info rq;
-	struct reply_info* rep;
-	res->rcode = LDNS_RCODE_SERVFAIL;
-	rep = parse_reply(buf, temp, &rq);
-	if(!rep) {
-		log_err("cannot parse buf");
-		return; /* error parsing buf, or out of memory */
-	}
-	if(!fill_res(res, reply_find_answer_rrset(&rq, rep), 
-		reply_find_final_cname_target(&rq, rep), &rq))
-		return; /* out of memory */
-	/* rcode, havedata, nxdomain, secure, bogus */
-	res->rcode = (int)FLAGS_GET_RCODE(rep->flags);
-	if(res->data && res->data[0])
-		res->havedata = 1;
-	if(res->rcode == LDNS_RCODE_NXDOMAIN)
-		res->nxdomain = 1;
-	if(msg_security == sec_status_secure)
-		res->secure = 1;
-	if(msg_security == sec_status_bogus)
-		res->bogus = 1;
-}
-
-/** fillup fg results */
-static void
-libworker_fillup_fg(struct ctx_query* q, int rcode, ldns_buffer* buf, 
-	enum sec_status s, char* why_bogus)
-{
-	if(why_bogus)
-		q->res->why_bogus = strdup(why_bogus);
-	if(rcode != 0) {
-		q->res->rcode = rcode;
-		q->msg_security = s;
-		return;
-	}
-
-	q->res->rcode = LDNS_RCODE_SERVFAIL;
-	q->msg_security = 0;
-	q->msg = memdup(ldns_buffer_begin(buf), ldns_buffer_limit(buf));
-	q->msg_len = ldns_buffer_limit(buf);
-	if(!q->msg) {
-		return; /* the error is in the rcode */
-	}
-
-	/* canonname and results */
-	q->msg_security = s;
-	libworker_enter_result(q->res, buf, q->w->env->scratch, s);
-}
-
-void
-libworker_fg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s,
-	char* why_bogus)
-{
-	struct ctx_query* q = (struct ctx_query*)arg;
-	/* fg query is done; exit comm base */
-	comm_base_exit(q->w->base);
-
-	libworker_fillup_fg(q, rcode, buf, s, why_bogus);
-}
-
-/** setup qinfo and edns */
-static int
-setup_qinfo_edns(struct libworker* w, struct ctx_query* q, 
-	struct query_info* qinfo, struct edns_data* edns)
-{
-	ldns_rdf* rdf;
-	qinfo->qtype = (uint16_t)q->res->qtype;
-	qinfo->qclass = (uint16_t)q->res->qclass;
-	rdf = ldns_dname_new_frm_str(q->res->qname);
-	if(!rdf) {
-		return 0;
-	}
-#ifdef UNBOUND_ALLOC_LITE
-	qinfo->qname = memdup(ldns_rdf_data(rdf), ldns_rdf_size(rdf));
-	qinfo->qname_len = ldns_rdf_size(rdf);
-	ldns_rdf_deep_free(rdf);
-	rdf = 0;
-#else
-	qinfo->qname = ldns_rdf_data(rdf);
-	qinfo->qname_len = ldns_rdf_size(rdf);
-#endif
-	edns->edns_present = 1;
-	edns->ext_rcode = 0;
-	edns->edns_version = 0;
-	edns->bits = EDNS_DO;
-	if(ldns_buffer_capacity(w->back->udp_buff) < 65535)
-		edns->udp_size = (uint16_t)ldns_buffer_capacity(
-			w->back->udp_buff);
-	else	edns->udp_size = 65535;
-	ldns_rdf_free(rdf);
-	return 1;
-}
-
-int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
-{
-	struct libworker* w = libworker_setup(ctx, 0);
-	uint16_t qflags, qid;
-	struct query_info qinfo;
-	struct edns_data edns;
-	if(!w)
-		return UB_INITFAIL;
-	if(!setup_qinfo_edns(w, q, &qinfo, &edns)) {
-		libworker_delete(w);
-		return UB_SYNTAX;
-	}
-	qid = 0;
-	qflags = BIT_RD;
-	q->w = w;
-	/* see if there is a fixed answer */
-	ldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
-	ldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
-		regional_free_all(w->env->scratch);
-		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
-			w->back->udp_buff, sec_status_insecure, NULL);
-		libworker_delete(w);
-		free(qinfo.qname);
-		return UB_NOERROR;
-	}
-	/* process new query */
-	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns, 
-		w->back->udp_buff, qid, libworker_fg_done_cb, q)) {
-		free(qinfo.qname);
-		return UB_NOMEM;
-	}
-	free(qinfo.qname);
-
-	/* wait for reply */
-	comm_base_dispatch(w->base);
-
-	libworker_delete(w);
-	return UB_NOERROR;
-}
-
-/** add result to the bg worker result queue */
-static void
-add_bg_result(struct libworker* w, struct ctx_query* q, ldns_buffer* pkt, 
-	int err, char* reason)
-{
-	uint8_t* msg = NULL;
-	uint32_t len = 0;
-
-	/* serialize and delete unneeded q */
-	if(w->is_bg_thread) {
-		lock_basic_lock(&w->ctx->cfglock);
-		if(reason)
-			q->res->why_bogus = strdup(reason);
-		if(pkt) {
-			q->msg_len = ldns_buffer_remaining(pkt);
-			q->msg = memdup(ldns_buffer_begin(pkt), q->msg_len);
-			if(!q->msg)
-				msg = context_serialize_answer(q, UB_NOMEM, 
-				NULL, &len);
-			else	msg = context_serialize_answer(q, err, 
-				NULL, &len);
-		} else msg = context_serialize_answer(q, err, NULL, &len);
-		lock_basic_unlock(&w->ctx->cfglock);
-	} else {
-		if(reason)
-			q->res->why_bogus = strdup(reason);
-		msg = context_serialize_answer(q, err, pkt, &len);
-		(void)rbtree_delete(&w->ctx->queries, q->node.key);
-		w->ctx->num_async--;
-		context_query_delete(q);
-	}
-
-	if(!msg) {
-		log_err("out of memory for async answer");
-		return;
-	}
-	if(!tube_queue_item(w->ctx->rr_pipe, msg, len)) {
-		log_err("out of memory for async answer");
-		return;
-	}
-}
-
-void
-libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s,
-	char* why_bogus)
-{
-	struct ctx_query* q = (struct ctx_query*)arg;
-
-	if(q->cancelled) {
-		if(q->w->is_bg_thread) {
-			/* delete it now */
-			struct ub_ctx* ctx = q->w->ctx;
-			lock_basic_lock(&ctx->cfglock);
-			(void)rbtree_delete(&ctx->queries, q->node.key);
-			ctx->num_async--;
-			context_query_delete(q);
-			lock_basic_unlock(&ctx->cfglock);
-		}
-		/* cancelled, do not give answer */
-		return;
-	}
-	q->msg_security = s;
-	if(rcode != 0) {
-		error_encode(buf, rcode, NULL, 0, BIT_RD, NULL);
-	}
-	add_bg_result(q->w, q, buf, UB_NOERROR, why_bogus);
-}
-
-
-/** handle new query command for bg worker */
-static void
-handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
-{
-	uint16_t qflags, qid;
-	struct query_info qinfo;
-	struct edns_data edns;
-	struct ctx_query* q;
-	if(w->is_bg_thread) {
-		lock_basic_lock(&w->ctx->cfglock);
-		q = context_lookup_new_query(w->ctx, buf, len);
-		lock_basic_unlock(&w->ctx->cfglock);
-	} else {
-		q = context_deserialize_new_query(w->ctx, buf, len);
-	}
-	free(buf);
-	if(!q) {
-		log_err("failed to deserialize newq");
-		return;
-	}
-	if(!setup_qinfo_edns(w, q, &qinfo, &edns)) {
-		add_bg_result(w, q, NULL, UB_SYNTAX, NULL);
-		return;
-	}
-	qid = 0;
-	qflags = BIT_RD;
-	/* see if there is a fixed answer */
-	ldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
-	ldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(w->ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
-		regional_free_all(w->env->scratch);
-		q->msg_security = sec_status_insecure;
-		add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL);
-		free(qinfo.qname);
-		return;
-	}
-	q->w = w;
-	/* process new query */
-	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns, 
-		w->back->udp_buff, qid, libworker_bg_done_cb, q)) {
-		add_bg_result(w, q, NULL, UB_NOMEM, NULL);
-	}
-	free(qinfo.qname);
-}
-
-void libworker_alloc_cleanup(void* arg)
-{
-	struct libworker* w = (struct libworker*)arg;
-	slabhash_clear(&w->env->rrset_cache->table);
-        slabhash_clear(w->env->msg_cache);
-}
-
-int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-        socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp)
-{
-	struct libworker* w = (struct libworker*)q->env->worker;
-	if(use_tcp) {
-		return pending_tcp_query(w->back, pkt, addr, addrlen,
-			timeout, libworker_handle_reply, q) != 0;
-	}
-	return pending_udp_query(w->back, pkt, addr, addrlen,
-		timeout*1000, libworker_handle_reply, q) != 0;
-}
-
-/** compare outbound entry qstates */
-static int
-outbound_entry_compare(void* a, void* b)
-{
-        struct outbound_entry* e1 = (struct outbound_entry*)a;
-        struct outbound_entry* e2 = (struct outbound_entry*)b;
-        if(e1->qstate == e2->qstate)
-                return 1;
-        return 0;
-}
-
-struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
-        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
-        struct module_qstate* q)
-{
-	struct libworker* w = (struct libworker*)q->env->worker;
-	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
-		q->region, sizeof(*e));
-	if(!e)
-		return NULL;
-	e->qstate = q;
-	e->qsent = outnet_serviced_query(w->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
-		addr, addrlen, libworker_handle_service_reply, e, 
-		w->back->udp_buff, &outbound_entry_compare);
-	if(!e->qsent) {
-		return NULL;
-	}
-	return e;
-}
-
-int 
-libworker_handle_reply(struct comm_point* c, void* arg, int error,
-        struct comm_reply* reply_info)
-{
-	struct module_qstate* q = (struct module_qstate*)arg;
-	struct libworker* lw = (struct libworker*)q->env->worker;
-	struct outbound_entry e;
-	e.qstate = q;
-	e.qsent = NULL;
-
-	if(error != 0) {
-		mesh_report_reply(lw->env->mesh, &e, reply_info, error);
-		return 0;
-	}
-	/* sanity check. */
-	if(!LDNS_QR_WIRE(ldns_buffer_begin(c->buffer))
-		|| LDNS_OPCODE_WIRE(ldns_buffer_begin(c->buffer)) !=
-			LDNS_PACKET_QUERY
-		|| LDNS_QDCOUNT(ldns_buffer_begin(c->buffer)) > 1) {
-		/* error becomes timeout for the module as if this reply
-		 * never arrived. */
-		mesh_report_reply(lw->env->mesh, &e, reply_info, 
-			NETEVENT_TIMEOUT);
-		return 0;
-	}
-	mesh_report_reply(lw->env->mesh, &e, reply_info, NETEVENT_NOERROR);
-	return 0;
-}
-
-int 
-libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
-        struct comm_reply* reply_info)
-{
-	struct outbound_entry* e = (struct outbound_entry*)arg;
-	struct libworker* lw = (struct libworker*)e->qstate->env->worker;
-
-	if(error != 0) {
-		mesh_report_reply(lw->env->mesh, e, reply_info, error);
-		return 0;
-	}
-	/* sanity check. */
-	if(!LDNS_QR_WIRE(ldns_buffer_begin(c->buffer))
-		|| LDNS_OPCODE_WIRE(ldns_buffer_begin(c->buffer)) !=
-			LDNS_PACKET_QUERY
-		|| LDNS_QDCOUNT(ldns_buffer_begin(c->buffer)) > 1) {
-		/* error becomes timeout for the module as if this reply
-		 * never arrived. */
-		mesh_report_reply(lw->env->mesh, e, reply_info, 
-			NETEVENT_TIMEOUT);
-		return 0;
-	}
-	mesh_report_reply(lw->env->mesh,  e, reply_info, NETEVENT_NOERROR);
-	return 0;
-}
-
-/* --- fake callbacks for fptr_wlist to work --- */
-void worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), 
-	uint8_t* ATTR_UNUSED(buffer), size_t ATTR_UNUSED(len),
-	int ATTR_UNUSED(error), void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-int worker_handle_request(struct comm_point* ATTR_UNUSED(c), 
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(repinfo))
-{
-	log_assert(0);
-	return 0;
-}
-
-int worker_handle_reply(struct comm_point* ATTR_UNUSED(c), 
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(reply_info))
-{
-	log_assert(0);
-	return 0;
-}
-
-int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(reply_info))
-{
-	log_assert(0);
-	return 0;
-}
-
-int remote_accept_callback(struct comm_point* ATTR_UNUSED(c), 
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(repinfo))
-{
-	log_assert(0);
-	return 0;
-}
-
-int remote_control_callback(struct comm_point* ATTR_UNUSED(c), 
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(repinfo))
-{
-	log_assert(0);
-	return 0;
-}
-
-void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
-	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
-{
-	log_assert(0);
-	return 0;
-}
-
-struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
-	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
-	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
-{
-	log_assert(0);
-	return 0;
-}
-
-void 
-worker_alloc_cleanup(void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-void worker_stat_timer_cb(void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-void worker_probe_timer_cb(void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-int order_lock_cmp(const void* ATTR_UNUSED(e1), const void* ATTR_UNUSED(e2))
-{
-	log_assert(0);
-	return 0;
-}
-
-int
-codeline_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
-{
-	log_assert(0);
-	return 0;
-}
-
-int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
-{
-        log_assert(0);
-        return 0;
-}
-
-void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
-{
-        log_assert(0);
-}
-
-#ifdef UB_ON_WINDOWS
-void
-worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void* 
-        ATTR_UNUSED(arg)) {
-        log_assert(0);
-}
-
-void
-wsvc_cron_cb(void* ATTR_UNUSED(arg))
-{
-        log_assert(0);
-}
-#endif /* UB_ON_WINDOWS */

libunbound/libworker.h

@@ -1,180 +0,0 @@
-/*
- * libunbound/worker.h - worker thread or process that resolves
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains the worker process or thread that performs
- * the DNS resolving and validation. The worker is called by a procedure
- * and if in the background continues until exit, if in the foreground
- * returns from the procedure when done.
- */
-#ifndef LIBUNBOUND_WORKER_H
-#define LIBUNBOUND_WORKER_H
-#include "util/data/packed_rrset.h"
-struct ub_ctx;
-struct ub_result;
-struct module_env;
-struct comm_base;
-struct outside_network;
-struct ub_randstate;
-struct ctx_query;
-struct outbound_entry;
-struct module_qstate;
-struct comm_point;
-struct comm_reply;
-struct regional;
-struct tube;
-
-/** 
- * The library-worker status structure
- * Internal to the worker.
- */
-struct libworker {
-	/** every worker has a unique thread_num. (first in struct) */
-	int thread_num;
-	/** context we are operating under */
-	struct ub_ctx* ctx;
-
-	/** is this the bg worker? */
-	int is_bg;
-	/** is this a bg worker that is threaded (not forked)? */
-	int is_bg_thread;
-
-	/** copy of the module environment with worker local entries. */
-	struct module_env* env;
-	/** the event base this worker works with */
-	struct comm_base* base;
-	/** the backside outside network interface to the auth servers */
-	struct outside_network* back;
-	/** random() table for this worker. */
-	struct ub_randstate* rndstate;
-};
-
-/**
- * Create a background worker
- * @param ctx: is updated with pid/tid of the background worker.
- *	a new allocation cache is obtained from ctx. It contains the
- *	threadnumber and unique id for further (shared) cache insertions.
- * @return 0 if OK, else error.
- *	Further communication is done via the pipes in ctx. 
- */
-int libworker_bg(struct ub_ctx* ctx);
-
-/**
- * Create a foreground worker.
- * This worker will join the threadpool of resolver threads.
- * It exits when the query answer has been obtained (or error).
- * This routine blocks until the worker is finished.
- * @param ctx: new allocation cache obtained and returned to it.
- * @param q: query (result is stored in here).
- * @return 0 if finished OK, else error.
- */
-int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q);
-
-/** cleanup the cache to remove all rrset IDs from it, arg is libworker */
-void libworker_alloc_cleanup(void* arg);
-
-/**
- * Worker service routine to send udp messages for modules.
- * @param pkt: packet to send.
- * @param addr: where to.
- * @param addrlen: length of addr.
- * @param timeout: seconds to wait until timeout.
- * @param q: wich query state to reactivate upon return.
- * @param use_tcp: true to use TCP, false for UDP.
- * @return: false on failure (memory or socket related). no query was
- *      sent.
- */
-int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-        socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp);
-
-/**
- * Worker service routine to send serviced queries to authoritative servers.
- * @param qname: query name. (host order)
- * @param qnamelen: length in bytes of qname, including trailing 0.
- * @param qtype: query type. (host order)
- * @param qclass: query class. (host order)
- * @param flags: host order flags word, with opcode and CD bit.
- * @param dnssec: if set, EDNS record will have DO bit set.
- * @param want_dnssec: signatures needed.
- * @param addr: where to.
- * @param addrlen: length of addr.
- * @param q: wich query state to reactivate upon return.
- * @return: false on failure (memory or socket related). no query was
- *      sent.
- */
-struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
-        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
-        struct module_qstate* q);
-
-/** process incoming replies from the network */
-int libworker_handle_reply(struct comm_point* c, void* arg, int error,
-        struct comm_reply* reply_info);
-
-/** process incoming serviced query replies from the network */
-int libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
-        struct comm_reply* reply_info);
-
-/** handle control command coming into server */
-void libworker_handle_control_cmd(struct tube* tube, uint8_t* msg, size_t len,
-	int err, void* arg);
-
-/** handle opportunity to write result back */
-void libworker_handle_result_write(struct tube* tube, uint8_t* msg, size_t len,
-	int err, void* arg);
-
-/** mesh callback with fg results */
-void libworker_fg_done_cb(void* arg, int rcode, ldns_buffer* buf, 
-	enum sec_status s, char* why_bogus);
-
-/** mesh callback with bg results */
-void libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, 
-	enum sec_status s, char* why_bogus);
-
-/** 
- * fill result from parsed message, on error fills servfail 
- * @param res: is clear at start, filled in at end.
- * @param buf: contains DNS message.
- * @param temp: temporary buffer for parse.
- * @param msg_security: security status of the DNS message.
- *   On error, the res may contain a different status 
- *   (out of memory is not secure, not bogus).
- */
-void libworker_enter_result(struct ub_result* res, ldns_buffer* buf,
-	struct regional* temp, enum sec_status msg_security);
-
-#endif /* LIBUNBOUND_WORKER_H */

libunbound/python/LICENSE

@@ -1,28 +0,0 @@
-Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
-                    Marek Vavrusa  (xvavru00 AT stud.fit.vutbr.cz)
-
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-    * Neither the name of the organization nor the names of its
-      contributors may be used to endorse or promote products derived from this
-      software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.

libunbound/python/Makefile

@@ -1,75 +0,0 @@
-#
-# Makefile: compilation of pyUnbound and documentation, testing
-#
-# Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
-#                     Marek Vavrusa  (xvavru00 AT stud.fit.vutbr.cz)
-#
-# This software is open source.
-# 
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-# 
-#    * Redistributions of source code must retain the above copyright notice,
-#      this list of conditions and the following disclaimer.
-# 
-#    * Redistributions in binary form must reproduce the above copyright notice,
-#      this list of conditions and the following disclaimer in the documentation
-#      and/or other materials provided with the distribution.
-# 
-#    * Neither the name of the organization nor the names of its
-#      contributors may be used to endorse or promote products derived from this
-#      software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
-# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
-# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-# POSSIBILITY OF SUCH DAMAGE.
-
-help:
-	@echo "Please use \`make <target>' where <target> is one of"
-	@echo "  testenv   to make test environment and run bash "
-	@echo "            usefull in case you don't want to install unbound but want to test examples"
-	@echo "  doc       to make documentation"
-	@echo "  clean     clean all"
-
-.PHONY: testenv clean doc swig
-
-#_unbound.so:	../../Makefile
-	#$(MAKE) -C ../..
-
-#../../.libs/libunbound.so.0:	../../Makefile
-	#$(MAKE) -C ../..
-
-#../../ldns-src/lib/libldns.so:	../../ldns-src/Makefile
-	#$(MAKE) -C ../../ldns-src
-
-clean:
-	rm -rdf examples/unbound
-	rm -f _unbound.so libunbound_wrap.o
-	$(MAKE) -C ../.. clean
-
-testenv: ../../.libs/libunbound.so.2 ../../ldns-src/lib/libldns.so ../../.libs/_unbound.so
-	rm -rdf examples/unbound
-	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.2 unbound/libunbound.so.2 && ln -s ../../../../ldns-src/lib/libldns.so.1 unbound/libldns.so.1 && ls -la
-	cd examples && if test -f ../../../.libs/_unbound.so; then cp ../../../.libs/_unbound.so . ; fi
-	@echo "Run a script by typing ./script_name.py"
-	cd examples && LD_LIBRARY_PATH=unbound bash
-	rm -rdf examples/unbound examples/_unbound.so
-
-doc: ../../.libs/libunbound.so.0 _unbound.so
-	$(MAKE) -C docs html
-
-#for development only
-swig: libunbound.i 
-	swig -python -o libunbound_wrap.c -I../.. libunbound.i
-	gcc -c libunbound_wrap.c -O9 -fPIC -I../.. -I/usr/include/python2.5 -I. -o libunbound_wrap.o
-	gcc -shared libunbound_wrap.o -L../../.libs -lunbound -o _unbound.so 
-