Test DS and CNAME in cache.

git-svn-id: file:///svn/unbound/trunk@2336 be551aaa-1e26-0410-a405-d3ace91eadb9
- do not synthesize a CNAME message from cache for qtype DS.
2026-08-17 21:25:50 +02:00 · 2010-11-05 15:45:53 +00:00 · 2010-11-05 15:29:50 +00:00 · 2010-11-04 15:20:11 +00:00 · 2010-11-04 15:16:13 +00:00 · 2010-11-04 12:35:39 +00:00
113 changed files with 7261 additions and 1218 deletions
@@ -110,6 +110,8 @@ CONTROL_SRC=smallapp/unbound-control.c smallapp/worker_cb.c $(COMMON_SRC)
 CONTROL_OBJ=$(addprefix $(BUILD),$(CONTROL_SRC:.c=.lo)) $(COMPAT_OBJ)
 HOST_SRC=smallapp/unbound-host.c
 HOST_OBJ=$(addprefix $(BUILD),$(HOST_SRC:.c=.lo)) $(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
+UBANCHOR_SRC=smallapp/unbound-anchor.c
+UBANCHOR_OBJ=$(addprefix $(BUILD),$(UBANCHOR_SRC:.c=.lo)) $(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
 TESTBOUND_SRC=testcode/testbound.c testcode/ldns-testpkts.c \
 	daemon/worker.c daemon/acl_list.c daemon/daemon.c daemon/stats.c \
 	testcode/replay.c testcode/fake_event.c $(filter-out util/netevent.c \
@@ -117,6 +119,8 @@ TESTBOUND_SRC=testcode/testbound.c testcode/ldns-testpkts.c \
 TESTBOUND_OBJ=$(addprefix $(BUILD),$(TESTBOUND_SRC:.c=.lo)) $(COMPAT_OBJ)
 LOCKVERIFY_SRC=testcode/lock_verify.c smallapp/worker_cb.c $(COMMON_SRC)
 LOCKVERIFY_OBJ=$(addprefix $(BUILD),$(LOCKVERIFY_SRC:.c=.lo)) $(COMPAT_OBJ)
+PETAL_SRC=testcode/petal.c
+PETAL_OBJ=$(addprefix $(BUILD),$(PETAL_SRC:.c=.lo)) $(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
 PKTVIEW_SRC=testcode/pktview.c testcode/readhex.c smallapp/worker_cb.c \
 	$(COMMON_SRC)
 PKTVIEW_OBJ=$(addprefix $(BUILD),$(PKTVIEW_SRC:.c=.lo)) $(COMPAT_OBJ)
@@ -141,7 +145,7 @@ ALL_SRC=$(sort $(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
 	$(TESTBOUND_SRC) $(LOCKVERIFY_SRC) $(PKTVIEW_SRC) $(SIGNIT_SRC) \
 	$(MEMSTATS_SRC) $(CHECKCONF_SRC) $(LIBUNBOUND_SRC) $(HOST_SRC) \
 	$(ASYNCLOOK_SRC) $(STREAMTCP_SRC) $(PERF_SRC) $(DELAYER_SRC) \
-	$(HARVEST_SRC) $(CONTROL_SRC))
+	$(HARVEST_SRC) $(CONTROL_SRC) $(UBANCHOR_SRC) $(PETAL_SRC))
 ALL_OBJ=$(addprefix $(BUILD),$(ALL_SRC:.c=.lo) \
 	$(addprefix compat/,$(LIBOBJS:.o=.lo))) $(COMPAT_OBJ)

@@ -149,6 +153,7 @@ ifeq "$(UB_ON_WINDOWS)" "yes"
  DAEMON_SRC+=winrc/win_svc.c winrc/w_inst.c
  DAEMON_OBJ+=$(BUILD)winrc/rsrc_unbound.o $(BUILD)winrc/win_svc.lo
  HOST_OBJ+=$(BUILD)winrc/rsrc_unbound_host.o
+  UBANCHOR_OBJ+=$(BUILD)winrc/rsrc_unbound_anchor.o
  CONTROL_OBJ+=$(BUILD)winrc/rsrc_unbound_control.o
  CHECKCONF_OBJ+=$(BUILD)winrc/rsrc_unbound_checkconf.o

@@ -179,7 +184,7 @@ COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS)
 LINK=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(staticexe) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS))
 LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS) $(staticexe) -version-number @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined)

-.PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip lib
+.PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip lib longtest longcheck check

 $(BUILD)%.lo:    $(srcdir)/%.c 
 	$(INFO) Build $<
@@ -188,13 +193,22 @@ $(BUILD)%.lo:    $(srcdir)/%.c
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(COMPILE) -o $@ -c $<

-all:	$(COMMON_OBJ) unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-control-setup $(WINAPPS)
+all:	$(COMMON_OBJ) unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup $(WINAPPS)

 TEST_BIN=$(addsuffix $(EXEEXT),asynclook delayer harvest lock-verify \
-	memstats perf pktview signit streamtcp testbound unittest)
+	memstats perf petal pktview signit streamtcp testbound unittest)
 tests:	all $(TEST_BIN)

-test:	tests
+check: test
+longcheck: longtest
+
+test:	unittest$(EXEEXT) testbound$(EXEEXT)
+	./unittest$(EXEEXT)
+	./testbound$(EXEEXT) -s
+	for x in testdata/*.rpl; do if ./testbound$(EXEEXT) -p $$x >/dev/null 2>&1; then echo $$x OK; else echo $$x failed; exit 1; fi done
+	@echo test OK
+
+longtest:	tests
 	if test -x "`which bash`"; then bash testcode/do-tests.sh; else sh testcode/do-tests.sh; fi

 lib:	libunbound.la
@@ -229,6 +243,10 @@ unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) -L. -L.libs -lunbound $(LIBS)

+unbound-anchor$(EXEEXT):	$(UBANCHOR_OBJ) libunbound.la $(ldnslib)
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(UBANCHOR_OBJ)) -L. -L.libs -lunbound -lexpat -lssl $(LIBS)
+
 unbound-service-install$(EXEEXT):	$(SVCINST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SVCINST_OBJ)) $(LIBS)
@@ -253,6 +271,10 @@ lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(LOCKVERIFY_OBJ)) $(LIBS)

+petal$(EXEEXT):	$(PETAL_OBJ)
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(PETAL_OBJ)) -lssl $(LIBS)
+
 pktview$(EXEEXT):	$(PKTVIEW_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PKTVIEW_OBJ)) $(LIBS)
@@ -334,7 +356,7 @@ util/configparser.c util/configparser.h:  $(srcdir)/util/configparser.y

 clean:
 	rm -f *.o *.d *.lo *~ tags
-	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-control-setup libunbound.la
+	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la
 	rm -rf autom4te.cache .libs build doc/html doc/xml

 realclean: clean
@@ -371,6 +393,7 @@ strip:
 	$(STRIP) unbound-checkconf$(EXEEXT)
 	$(STRIP) unbound-control$(EXEEXT)
 	$(STRIP) unbound-host$(EXEEXT)
+	$(STRIP) unbound-anchor$(EXEEXT)

 install:	all
 	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
@@ -385,6 +408,7 @@ install:	all
 	$(LIBTOOL) --mode=install cp unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
 	$(LIBTOOL) --mode=install cp unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
 	$(LIBTOOL) --mode=install cp unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT)
+	$(LIBTOOL) --mode=install cp unbound-anchor$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-anchor$(EXEEXT)
 ifeq "$(WITH_PYTHONMODULE)" "yes"
 	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
 	$(INSTALL) -c -m 644 pythonmod/unboundmodule.py $(DESTDIR)$(PYTHON_SITE_PKG)/unboundmodule.py
@@ -398,6 +422,7 @@ endif
 	$(INSTALL) -c -m 644 doc/unbound.8 $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -c -m 644 doc/unbound-checkconf.8 $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -c -m 644 doc/unbound-control.8 $(DESTDIR)$(mandir)/man8
+	$(INSTALL) -c -m 644 doc/unbound-anchor.8 $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -c -m 644 doc/unbound.conf.5 $(DESTDIR)$(mandir)/man5
 	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-host.1 $(DESTDIR)$(mandir)/man1
 	$(INSTALL) -c -m 644 doc/libunbound.3 $(DESTDIR)$(mandir)/man3
@@ -408,8 +433,8 @@ endif
 	$(LIBTOOL) --mode=finish $(DESTDIR)$(libdir)

 uninstall:
-	rm -f -- $(DESTDIR)$(sbindir)/unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control-setup
-	rm -f -- $(DESTDIR)$(mandir)/man8/unbound.8 $(DESTDIR)$(mandir)/man8/unbound-checkconf.8 $(DESTDIR)$(mandir)/man5/unbound.conf.5 $(DESTDIR)$(mandir)/man8/unbound-control.8
+	rm -f -- $(DESTDIR)$(sbindir)/unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-anchor$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control-setup
+	rm -f -- $(DESTDIR)$(mandir)/man8/unbound.8 $(DESTDIR)$(mandir)/man8/unbound-checkconf.8 $(DESTDIR)$(mandir)/man5/unbound.conf.5 $(DESTDIR)$(mandir)/man8/unbound-control.8 $(DESTDIR)$(mandir)/man8/unbound-anchor.8
 	rm -f -- $(DESTDIR)$(mandir)/man1/unbound-host.1 $(DESTDIR)$(mandir)/man3/libunbound.3
 	rm -f -- $(DESTDIR)$(includedir)/unbound.h
 	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(libdir)/libunbound.la
@@ -2,7 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 10
+# Version 11
+# 2010-08-16 Fix FLAG_OMITTED for AS_TR_CPP changes in autoconf-2.66.
 # 2010-07-02 Add check for ss_family (for minix).
 # 2010-04-26 Fix to use CPPFLAGS for CHECK_COMPILER_FLAGS.
 # 2010-03-01 Fix RPATH using CONFIG_COMMANDS to run at the very end.
@@ -1192,7 +1193,7 @@ AC_DEFUN([ACX_CFLAGS_STRIP],
 [
  if echo $CFLAGS | grep " $1" >/dev/null 2>&1; then
    CFLAGS="`echo $CFLAGS | sed -e 's/ $1//g'`"
-    AC_DEFINE(AS_TR_CPP(OMITTED_$1), 1, Put $1 define in config.h)
+    AC_DEFINE(m4_bpatsubst(OMITTED_$1,[[-=]],_), 1, Put $1 define in config.h)
  fi
 ])

@@ -1223,7 +1224,7 @@ AC_DEFUN([AHX_CONFIG_FLAG_OMITTED],
 dnl Wrapper for AHX_CONFIG_FLAG_OMITTED for -D style flags
 dnl $1: the -DNAME or -DNAME=value string.
 AC_DEFUN([AHX_CONFIG_FLAG_EXT],
-[AHX_CONFIG_FLAG_OMITTED(AS_TR_CPP(OMITTED_$1),m4_bpatsubst(m4_bpatsubst($1,-D,),=.*$,),m4_if(m4_bregexp($1,=),-1,1,m4_bpatsubst($1,^.*=,)))
+[AHX_CONFIG_FLAG_OMITTED(m4_bpatsubst(OMITTED_$1,[[-=]],_),m4_bpatsubst(m4_bpatsubst($1,-D,),=.*$,),m4_if(m4_bregexp($1,=),-1,1,m4_bpatsubst($1,^.*=,)))
 ])

 dnl config.h part to define omitted cflags, use with ACX_STRIP_EXT_FLAGS.
@@ -32,8 +32,11 @@ char *ctime_r(const time_t *timep, char *buf)
 	}
 	lock_basic_lock(&ctime_lock);
 	result = ctime(timep);
-	if(buf && result)
+	if(buf && result) {
+		if(strlen(result) > 10 && result[7]==' ' && result[8]=='0')
+			result[8]=' '; /* fix error in windows ctime */
 		strcpy(buf, result);
+	}
 	lock_basic_unlock(&ctime_lock);
 	return result;
 }
@@ -0,0 +1,347 @@
+/** strptime workaround (for oa macos leopard)
+  * This strptime follows the man strptime (2001-11-12)
+  *		conforming to SUSv2, POSIX.1-2001
+  *
+  * This very simple version of strptime has no:
+  * - E alternatives
+  * - O alternatives
+  * - Glibc additions
+  * - Does not process week numbers
+  * - Does not properly processes year day
+  *
+  * LICENSE
+  * Copyright (c) 2008, NLnet Labs, Matthijs Mekking
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions are met:
+  * * Redistributions of source code must retain the above copyright notice,
+  *     this list of conditions and the following disclaimer.
+  * * Redistributions in binary form must reproduce the above copyright
+  *   notice, this list of conditions and the following disclaimer in the
+  *   documentation and/or other materials provided with the distribution.
+  * * Neither the name of NLnetLabs nor the names of its
+  *   contributors may be used to endorse or promote products derived from this
+  *   software without specific prior written permission.
+  *
+  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+  * POSSIBILITY OF SUCH DAMAGE.
+ **/
+
+#include "config.h"
+
+#ifndef HAVE_CONFIG_H
+#include <time.h>
+#endif
+
+#ifndef STRPTIME_WORKS
+
+#define TM_YEAR_BASE 1900
+
+#include <ctype.h>
+#include <string.h>
+
+static const char *abb_weekdays[] = {
+	"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", NULL
+};
+static const char *full_weekdays[] = {
+	"Sunday", "Monday", "Tuesday", "Wednesday",
+	"Thursday", "Friday", "Saturday", NULL
+};
+static const char *abb_months[] = {
+	"Jan", "Feb", "Mar", "Apr", "May", "Jun",
+	"Jul", "Aug", "Sep", "Oct", "Nov", "Dec", NULL
+};
+static const char *full_months[] = {
+	"January", "February", "March", "April", "May", "June",
+	"July", "August", "September", "October", "November", "December", NULL
+};
+static const char *ampm[] = {
+    "am", "pm", NULL
+};
+
+static int
+match_string(const char **buf, const char **strs)
+{
+	int i = 0;
+
+	for (i = 0; strs[i] != NULL; i++) {
+		int len = strlen(strs[i]);
+		if (strncasecmp (*buf, strs[i], len) == 0) {
+			*buf += len;
+			return i;
+		}
+	}
+	return -1;
+}
+
+static int
+str2int(const char **buf, int max)
+{
+	int ret=0, count=0;
+
+	while (*buf[0] != '\0' && isdigit(*buf[0]) && count<max) {
+		ret = ret*10 + (*buf[0] - '0');
+		(*buf)++;
+		count++;
+	}
+
+	if (!count)
+		return -1;
+	return ret;
+}
+
+/** Converts the character string s to values which are stored in tm
+  * using the format specified by format
+ **/
+char *
+unbound_strptime(const char *s, const char *format, struct tm *tm)
+{
+	int c, alt_format, ret;
+	int split_year = 0;
+
+	while ((c = *format) != '\0') {
+		alt_format = 0;
+
+		/* whitespace, literal or format */
+		if (isspace(c)) { /* whitespace */
+			/** whitespace matches zero or more whitespace characters in the
+			  * input string.
+			 **/
+			while (isspace(*s))
+				s++;
+		}
+		else if (c == '%') { /* format */
+			format++;
+			c = *format;
+			switch (c) {
+				case '%': /* %% is converted to % */
+					if (*s != c) {
+						return NULL;
+					}
+					s++;
+					break;
+				case 'a': /* weekday name, abbreviated or full */
+				case 'A':
+					ret = match_string(&s, full_weekdays);
+					if (ret < 0)
+						ret = match_string(&s, abb_weekdays);
+					if (ret < 0) {
+						return NULL;
+					}
+					tm->tm_wday = ret;
+					break;
+				case 'b': /* month name, abbreviated or full */
+				case 'B':
+				case 'h':
+					ret = match_string(&s, full_months);
+					if (ret < 0)
+						ret = match_string(&s, abb_months);
+					if (ret < 0) {
+						return NULL;
+					}
+					tm->tm_mon = ret;
+					break;
+				case 'c': /* date and time representation */
+					if (!(s = unbound_strptime(s, "%x %X", tm))) {
+						return NULL;
+					}
+					break;
+				case 'C': /* century number */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 99) { /* must be in [00,99] */
+						return NULL;
+					}
+
+					if (split_year)	{
+						tm->tm_year = ret*100 + (tm->tm_year%100);
+					}
+					else {
+						tm->tm_year = ret*100 - TM_YEAR_BASE;
+						split_year = 1;
+					}
+					break;
+				case 'd': /* day of month */
+				case 'e':
+					ret = str2int(&s, 2);
+					if (ret < 1 || ret > 31) { /* must be in [01,31] */
+						return NULL;
+					}
+					tm->tm_mday = ret;
+					break;
+				case 'D': /* equivalent to %m/%d/%y */
+					if (!(s = unbound_strptime(s, "%m/%d/%y", tm))) {
+						return NULL;
+					}
+					break;
+				case 'H': /* hour */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 23) { /* must be in [00,23] */
+						return NULL;
+					}
+					tm->tm_hour = ret;
+					break;
+				case 'I': /* 12hr clock hour */
+					ret = str2int(&s, 2);
+					if (ret < 1 || ret > 12) { /* must be in [01,12] */
+						return NULL;
+					}
+					if (ret == 12) /* actually [0,11] */
+						ret = 0;
+					tm->tm_hour = ret;
+					break;
+				case 'j': /* day of year */
+					ret = str2int(&s, 2);
+					if (ret < 1 || ret > 366) { /* must be in [001,366] */
+						return NULL;
+					}
+					tm->tm_yday = ret;
+					break;
+				case 'm': /* month */
+					ret = str2int(&s, 2);
+					if (ret < 1 || ret > 12) { /* must be in [01,12] */
+						return NULL;
+					}
+					/* months go from 0-11 */
+					tm->tm_mon = (ret-1);
+					break;
+				case 'M': /* minute */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 59) { /* must be in [00,59] */
+						return NULL;
+					}
+					tm->tm_min = ret;
+					break;
+				case 'n': /* arbitrary whitespace */
+				case 't':
+					while (isspace(*s))
+						s++;
+					break;
+				case 'p': /* am pm */
+					ret = match_string(&s, ampm);
+					if (ret < 0) {
+						return NULL;
+					}
+					if (tm->tm_hour < 0 || tm->tm_hour > 11) { /* %I */
+						return NULL;
+					}
+
+					if (ret == 1) /* pm */
+						tm->tm_hour += 12;
+					break;
+				case 'r': /* equivalent of %I:%M:%S %p */
+					if (!(s = unbound_strptime(s, "%I:%M:%S %p", tm))) {
+						return NULL;
+					}
+					break;
+				case 'R': /* equivalent of %H:%M */
+					if (!(s = unbound_strptime(s, "%H:%M", tm))) {
+						return NULL;
+					}
+					break;
+				case 'S': /* seconds */
+					ret = str2int(&s, 2);
+					/* 60 may occur for leap seconds */
+					/* earlier 61 was also allowed */
+					if (ret < 0 || ret > 60) { /* must be in [00,60] */
+						return NULL;
+					}
+					tm->tm_sec = ret;
+					break;
+				case 'T': /* equivalent of %H:%M:%S */
+					if (!(s = unbound_strptime(s, "%H:%M:%S", tm))) {
+						return NULL;
+					}
+					break;
+				case 'U': /* week number, with the first Sun of Jan being w1 */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 53) { /* must be in [00,53] */
+						return NULL;
+					}
+					/** it is hard (and not necessary for nsd) to determine time
+					  * data from week number.
+					 **/
+					break;
+				case 'w': /* day of week */
+					ret = str2int(&s, 1);
+					if (ret < 0 || ret > 6) { /* must be in [0,6] */
+						return NULL;
+					}
+					tm->tm_wday = ret;
+					break;
+				case 'W': /* week number, with the first Mon of Jan being w1 */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 53) { /* must be in [00,53] */
+						return NULL;
+					}
+					/** it is hard (and not necessary for nsd) to determine time
+					  * data from week number.
+					 **/
+					break;
+				case 'x': /* date format */
+					if (!(s = unbound_strptime(s, "%m/%d/%y", tm))) {
+						return NULL;
+					}
+					break;
+				case 'X': /* time format */
+					if (!(s = unbound_strptime(s, "%H:%M:%S", tm))) {
+						return NULL;
+					}
+					break;
+				case 'y': /* last two digits of a year */
+					ret = str2int(&s, 2);
+					if (ret < 0 || ret > 99) { /* must be in [00,99] */
+						return NULL;
+					}
+					if (split_year) {
+						tm->tm_year = ((tm->tm_year/100) * 100) + ret;
+					}
+					else {
+						split_year = 1;
+
+						/** currently:
+						  * if in [0,68] we are in 21th century,
+						  * if in [69,99] we are in 20th century.
+						 **/
+						if (ret < 69) /* 2000 */
+							ret += 100;
+						tm->tm_year = ret;
+					}
+					break;
+				case 'Y': /* year */
+					ret = str2int(&s, 4);
+					if (ret < 0 || ret > 9999) {
+						return NULL;
+					}
+					tm->tm_year = ret - TM_YEAR_BASE;
+					break;
+				case '\0':
+				default: /* unsupported, cannot match format */
+					return NULL;
+					break;
+			}
+		}
+		else { /* literal */
+			/* if input cannot match format, return NULL */
+			if (*s != c)
+				return NULL;
+			s++;
+		}
+
+		format++;
+	}
+
+	/* return pointer to remainder of s */
+	return (char*) s;
+}
+
+#endif /* STRPTIME_WORKS */
@@ -81,9 +81,15 @@
 /* Define to 1 if you have the `EVP_sha512' function. */
 #undef HAVE_EVP_SHA512

+/* Define to 1 if you have the `ev_default_loop' function. */
+#undef HAVE_EV_DEFAULT_LOOP
+
 /* Define to 1 if you have the `ev_loop' function. */
 #undef HAVE_EV_LOOP

+/* Define to 1 if you have the <expat.h> header file. */
+#undef HAVE_EXPAT_H
+
 /* Define to 1 if you have the `fcntl' function. */
 #undef HAVE_FCNTL

@@ -286,6 +292,9 @@
 /* Define to 1 if you have the `strlcpy' function. */
 #undef HAVE_STRLCPY

+/* Define to 1 if you have the `strptime' function. */
+#undef HAVE_STRPTIME
+
 /* Define if you have Swig libraries and header files. */
 #undef HAVE_SWIG

@@ -427,6 +436,12 @@
 /* Define as the return type of signal handlers (`int' or `void'). */
 #undef RETSIGTYPE

+/* default rootkey location */
+#undef ROOT_ANCHOR_FILE
+
+/* default rootcert location */
+#undef ROOT_CERT_FILE
+
 /* version number for resource files */
 #undef RSRC_PACKAGE_VERSION

@@ -439,6 +454,9 @@
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS

+/* use default strptime. */
+#undef STRPTIME_WORKS
+
 /* Use win32 resources and API */
 #undef UB_ON_WINDOWS

@@ -803,7 +821,13 @@ int memcmp(const void *x, const void *y, size_t n);
 char *ctime_r(const time_t *timep, char *buf);
 #endif

-#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
+#if !defined(HAVE_STRPTIME) || !defined(STRPTIME_WORKS)
+#define strptime unbound_strptime
+struct tm;
+char *strptime(const char *s, const char *format, struct tm *tm);
+#endif
+
+#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
   /* using version of libevent that is not threadsafe. */
 #  define LIBEVENT_SIGNAL_PROBLEM 1
 #endif
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.65 for unbound 1.4.6.
+# Generated by GNU Autoconf 2.65 for unbound 1.4.7.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -701,8 +701,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.4.6'
-PACKAGE_STRING='unbound 1.4.6'
+PACKAGE_VERSION='1.4.7'
+PACKAGE_STRING='unbound 1.4.7'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''

@@ -797,6 +797,8 @@ LEX
 debug_enabled
 DEPFLAG
 UNBOUND_USERNAME
+UNBOUND_ROOTCERT_FILE
+UNBOUND_ROOTKEY_FILE
 UNBOUND_PIDFILE
 UNBOUND_SHARE_DIR
 UNBOUND_CHROOT_DIR
@@ -873,6 +875,8 @@ with_run_dir
 with_chroot_dir
 with_share_dir
 with_pidfile
+with_rootkey_file
+with_rootcert_file
 with_username
 enable_checking
 enable_debug
@@ -892,6 +896,7 @@ with_ssl
 enable_sha2
 enable_gost
 with_libevent
+with_libexpat
 enable_staticexe
 enable_lock_checks
 enable_alloc_checks
@@ -1453,7 +1458,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures unbound 1.4.6 to adapt to many kinds of systems.
+\`configure' configures unbound 1.4.7 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1519,7 +1524,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.4.6:";;
+     short | recursive ) echo "Configuration of unbound 1.4.7:";;
   esac
  cat <<\_ACEOF

@@ -1537,7 +1542,7 @@ Optional Features:
  --disable-rpath         disable hardcoded rpath (default=enabled)
  --disable-largefile     omit support for large files
  --disable-sha2          Disable SHA256 and SHA512 RRSIG support
-  --enable-gost           Enable GOST support, experimental
+  --disable-gost          Disable GOST support
  --enable-static-exe     enable to compile executables statically against
                          event, ldns libs, for debug purposes
  --enable-lock-checks    enable to check lock and unlock calls, for debug
@@ -1563,6 +1568,13 @@ Optional Packages:
                          same as share/unbound)
  --with-pidfile=filename set default pathname to unbound pidfile (default
                          run-dir/unbound.pid)
+  --with-rootkey-file=filename
+                          set default pathname to root key file (default
+                          run-dir/root.key). This file is read and written.
+  --with-rootcert-file=filename
+                          set default pathname to root update certificate file
+                          (default run-dir/icannbundle.pem). This file need
+                          not exist if you are content with the builtin.
  --with-username=user    set default user that unbound changes to (default
                          user is unbound)
  --with-pic              try to use only PIC/non-PIC objects [default=use
@@ -1583,6 +1595,7 @@ Optional Packages:
                          /usr/lib /usr/pkg /usr/sfw /usr or you can specify
                          an explicit path). Slower, but allows use of large
                          outgoing port ranges.
+  --with-libexpat=path    specify explicit path for libexpat.
  --with-ldns=PATH        specify prefix of path of ldns library to use
  --with-ldns-builtin     forces use of package included with this one

@@ -1671,7 +1684,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-unbound configure 1.4.6
+unbound configure 1.4.7
 generated by GNU Autoconf 2.65

 Copyright (C) 2009 Free Software Foundation, Inc.
@@ -2135,7 +2148,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by unbound $as_me 1.4.6, which was
+It was created by unbound $as_me 1.4.7, which was
 generated by GNU Autoconf 2.65.  Invocation command line was

  $ $0 $@
@@ -2484,7 +2497,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu


 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=6
+LIBUNBOUND_REVISION=7
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2506,6 +2519,7 @@ LIBUNBOUND_AGE=0
 # 1.4.4 had 2:4:0
 # 1.4.5 had 2:5:0
 # 1.4.6 had 2:6:0
+# 1.4.7 had 2:7:0

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -4059,6 +4073,50 @@ _ACEOF



+# Check whether --with-rootkey-file was given.
+if test "${with_rootkey_file+set}" = set; then :
+  withval=$with_rootkey_file; UNBOUND_ROOTKEY_FILE="$withval"
+else
+  if test $on_mingw = no; then
+    UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
+else
+    UNBOUND_ROOTKEY_FILE="C:\\Program Files\\Unbound\\root.key"
+fi
+
+fi
+
+
+hdr_rkey="`echo $UNBOUND_ROOTKEY_FILE | sed -e 's/\\\\/\\\\\\\\/g'`"
+
+
+cat >>confdefs.h <<_ACEOF
+#define ROOT_ANCHOR_FILE "$hdr_rkey"
+_ACEOF
+
+
+
+# Check whether --with-rootcert-file was given.
+if test "${with_rootcert_file+set}" = set; then :
+  withval=$with_rootcert_file; UNBOUND_ROOTCERT_FILE="$withval"
+else
+  if test $on_mingw = no; then
+    UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
+else
+    UNBOUND_ROOTCERT_FILE="C:\\Program Files\\Unbound\\icannbundle.pem"
+fi
+
+fi
+
+
+hdr_rpem="`echo $UNBOUND_ROOTCERT_FILE | sed -e 's/\\\\/\\\\\\\\/g'`"
+
+
+cat >>confdefs.h <<_ACEOF
+#define ROOT_CERT_FILE "$hdr_rpem"
+_ACEOF
+
+
+
 # Check whether --with-username was given.
 if test "${with_username+set}" = set; then :
  withval=$with_username; UNBOUND_USERNAME="$withval"
@@ -5531,70 +5589,6 @@ fi



-# for Sun studio 11.
-
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -xO4" >&5
-$as_echo_n "checking whether $CC supports -xO4... " >&6; }
-cache=`echo xO4 | sed 'y%.=/+-%___p_%'`
-if { as_var=cv_prog_cc_flag_$cache; eval "test \"\${$as_var+set}\" = set"; }; then :
-  $as_echo_n "(cached) " >&6
-else
-
-echo 'void f(){}' >conftest.c
-if test -z "`$CC $CPPFLAGS $CFLAGS -xO4 -c conftest.c 2>&1`"; then
-eval "cv_prog_cc_flag_$cache=yes"
-else
-eval "cv_prog_cc_flag_$cache=no"
-fi
-rm -f conftest conftest.o conftest.c
-
-fi
-
-if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-:
-CFLAGS="$CFLAGS -xO4"
-else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-:
-
-fi
-
-
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -xtarget=generic" >&5
-$as_echo_n "checking whether $CC supports -xtarget=generic... " >&6; }
-cache=`echo xtarget=generic | sed 'y%.=/+-%___p_%'`
-if { as_var=cv_prog_cc_flag_$cache; eval "test \"\${$as_var+set}\" = set"; }; then :
-  $as_echo_n "(cached) " >&6
-else
-
-echo 'void f(){}' >conftest.c
-if test -z "`$CC $CPPFLAGS $CFLAGS -xtarget=generic -c conftest.c 2>&1`"; then
-eval "cv_prog_cc_flag_$cache=yes"
-else
-eval "cv_prog_cc_flag_$cache=no"
-fi
-rm -f conftest conftest.o conftest.c
-
-fi
-
-if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-:
-CFLAGS="$CFLAGS -xtarget=generic"
-else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-:
-
-fi
-
-
 # debug mode flags warnings
 # Check whether --enable-checking was given.
 if test "${enable_checking+set}" = set; then :
@@ -6818,13 +6812,13 @@ if test "${lt_cv_nm_interface+set}" = set; then :
 else
  lt_cv_nm_interface="BSD nm"
  echo "int some_variable = 0;" > conftest.$ac_ext
-  (eval echo "\"\$as_me:6821: $ac_compile\"" >&5)
+  (eval echo "\"\$as_me:6815: $ac_compile\"" >&5)
  (eval "$ac_compile" 2>conftest.err)
  cat conftest.err >&5
-  (eval echo "\"\$as_me:6824: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
+  (eval echo "\"\$as_me:6818: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
  (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out)
  cat conftest.err >&5
-  (eval echo "\"\$as_me:6827: output\"" >&5)
+  (eval echo "\"\$as_me:6821: output\"" >&5)
  cat conftest.out >&5
  if $GREP 'External.*some_variable' conftest.out > /dev/null; then
    lt_cv_nm_interface="MS dumpbin"
@@ -8029,7 +8023,7 @@ ia64-*-hpux*)
  ;;
 *-*-irix6*)
  # Find out which ABI we are using.
-  echo '#line 8032 "configure"' > conftest.$ac_ext
+  echo '#line 8026 "configure"' > conftest.$ac_ext
  if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
  (eval $ac_compile) 2>&5
  ac_status=$?
@@ -9289,11 +9283,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9292: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9286: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:9296: \$? = $ac_status" >&5
+   echo "$as_me:9290: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -9628,11 +9622,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9631: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9625: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:9635: \$? = $ac_status" >&5
+   echo "$as_me:9629: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -9733,11 +9727,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9736: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9730: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:9740: \$? = $ac_status" >&5
+   echo "$as_me:9734: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -9788,11 +9782,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9791: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9785: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:9795: \$? = $ac_status" >&5
+   echo "$as_me:9789: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -12158,7 +12152,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<_LT_EOF
-#line 12161 "configure"
+#line 12155 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -12254,7 +12248,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<_LT_EOF
-#line 12257 "configure"
+#line 12251 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -15312,7 +15306,9 @@ fi

 use_gost="no"
 case "$enable_gost" in
-	yes)
+	no)
+	;;
+	*)
 	ac_fn_c_check_func "$LINENO" "EVP_PKEY_set_type_str" "ac_cv_func_EVP_PKEY_set_type_str"
 if test "x$ac_cv_func_EVP_PKEY_set_type_str" = x""yes; then :
  :
@@ -15320,22 +15316,17 @@ else
  as_fn_error "OpenSSL 1.0.0 is needed for GOST support" "$LINENO" 5
 fi

+        ac_fn_c_check_func "$LINENO" "EC_KEY_new" "ac_cv_func_EC_KEY_new"
+if test "x$ac_cv_func_EC_KEY_new" = x""yes; then :
+
+else
+  as_fn_error "OpenSSL does not support ECC, needed for GOST support" "$LINENO" 5
+fi
+
 	use_gost="yes"

 $as_echo "#define USE_GOST 1" >>confdefs.h

-	;;
-	no)
-	;;
-	*) 	ac_fn_c_check_func "$LINENO" "EVP_PKEY_set_type_str" "ac_cv_func_EVP_PKEY_set_type_str"
-if test "x$ac_cv_func_EVP_PKEY_set_type_str" = x""yes; then :
-
-	  use_gost="yes"
-
-$as_echo "#define USE_GOST 1" >>confdefs.h
-
-fi
-
 	;;
 esac

@@ -15655,6 +15646,17 @@ _ACEOF
 fi
 done
 # only in libev. (tested on 3.51)
+	for ac_func in ev_default_loop
+do :
+  ac_fn_c_check_func "$LINENO" "ev_default_loop" "ac_cv_func_ev_default_loop"
+if test "x$ac_cv_func_ev_default_loop" = x""yes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_EV_DEFAULT_LOOP 1
+_ACEOF
+
+fi
+done
+ # only in libev. (tested on 4.00)
 	if test -n "$BAK_LDFLAGS_SET"; then
 		LDFLAGS="$BAK_LDFLAGS"
 	fi
@@ -15664,6 +15666,47 @@ $as_echo "#define USE_MINI_EVENT 1" >>confdefs.h

 fi

+# check for libexpat
+
+# Check whether --with-libexpat was given.
+if test "${with_libexpat+set}" = set; then :
+  withval=$with_libexpat;
+else
+   withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
+fi
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libexpat" >&5
+$as_echo_n "checking for libexpat... " >&6; }
+found_libexpat="no"
+for dir in $withval ; do
+            if test -f "$dir/include/expat.h"; then
+		found_libexpat="yes"
+				if test "$dir" != "/usr"; then
+                    CPPFLAGS="$CPPFLAGS -I$dir/include"
+		    LDFLAGS="$LDFLAGS -L$dir/lib"
+		fi
+            	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found in $dir" >&5
+$as_echo "found in $dir" >&6; }
+                break;
+            fi
+done
+if test x_$found_libexpat != x_yes; then
+	as_fn_error "Could not find libexpat, expat.h" "$LINENO" 5
+fi
+for ac_header in expat.h
+do :
+  ac_fn_c_check_header_compile "$LINENO" "expat.h" "ac_cv_header_expat_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_expat_h" = x""yes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_EXPAT_H 1
+_ACEOF
+
+fi
+
+done
+
+
 # set static linking if requested

 staticexe=""
@@ -16096,6 +16139,73 @@ fi

 fi

+# check wether strptime also works
+for ac_func in strptime
+do :
+  ac_fn_c_check_func "$LINENO" "strptime" "ac_cv_func_strptime"
+if test "x$ac_cv_func_strptime" = x""yes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_STRPTIME 1
+_ACEOF
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether strptime works" >&5
+$as_echo_n "checking whether strptime works... " >&6; }
+if test c${cross_compiling} = cno; then
+if test "$cross_compiling" = yes; then :
+  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error "cannot run test program while cross compiling
+See \`config.log' for more details." "$LINENO" 5; }
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#define _XOPEN_SOURCE
+#include <time.h>
+int main(void) { struct tm tm; char *res;
+res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm);
+if (!res) return 1; return 0; }
+
+_ACEOF
+if ac_fn_c_try_run "$LINENO"; then :
+  eval "ac_cv_c_strptime_works=yes"
+else
+  eval "ac_cv_c_strptime_works=no"
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
+fi
+
+else
+eval "ac_cv_c_strptime_works=maybe"
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_strptime_works" >&5
+$as_echo "$ac_cv_c_strptime_works" >&6; }
+if test $ac_cv_c_strptime_works = no; then
+case " $LIBOBJS " in
+  *" strptime.$ac_objext "* ) ;;
+  *) LIBOBJS="$LIBOBJS strptime.$ac_objext"
+ ;;
+esac
+
+else
+
+cat >>confdefs.h <<_ACEOF
+#define STRPTIME_WORKS 1
+_ACEOF
+
+fi
+
+else
+  case " $LIBOBJS " in
+  *" strptime.$ac_objext "* ) ;;
+  *) LIBOBJS="$LIBOBJS strptime.$ac_objext"
+ ;;
+esac
+
+fi
+done
+
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing setusercontext" >&5
 $as_echo_n "checking for library containing setusercontext... " >&6; }
 if test "${ac_cv_search_setusercontext+set}" = set; then :
@@ -16378,9 +16488,10 @@ use_ldns_builtin="no"
 # Check whether --with-ldns was given.
 if test "${with_ldns+set}" = set; then :
  withval=$with_ldns;  specialldnsdir="$withval"
-	if test "$withval" != ""; then
-		CPPFLAGS="-I$withval/include $CPPFLAGS"
-		LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
+	if test "$withval" != "yes"; then
+		if test "$withval" != ""; then
+			CPPFLAGS="-I$withval/include $CPPFLAGS"
+			LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"

 	if test "x$enable_rpath" = xyes; then
 		if echo "$withval/lib" | grep "^/" >/dev/null; then
@@ -16388,9 +16499,10 @@ if test "${with_ldns+set}" = set; then :
 		fi
 	fi

-	fi
-	ldnsdir="$withval"
+		fi
+		ldnsdir="$withval"

+	fi

 fi

@@ -16484,6 +16596,26 @@ done
 	for ac_header in ldns/ldns.h
 do :
  ac_fn_c_check_header_compile "$LINENO" "ldns/ldns.h" "ac_cv_header_ldns_ldns_h" "$ac_includes_default
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+#ifdef HAVE_WINSOCK2_H
+#include <winsock2.h>
+#endif
+
+#ifdef HAVE_WS2TCPIP_H
+#include <ws2tcpip.h>
+#endif
+
 "
 if test "x$ac_cv_header_ldns_ldns_h" = x""yes; then :
  cat >>confdefs.h <<_ACEOF
@@ -16501,7 +16633,7 @@ done
 	    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
 	    	    :
 	else
-	    use_ldns_builtin="yes"
+	    as_fn_error "No ldns library found (or not recent); install or update ldns library, use --with-ldns=path or --with-ldns-builtin" "$LINENO" 5
 	fi
 fi

@@ -16605,7 +16737,7 @@ _ACEOF



-ac_config_files="$ac_config_files Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8"
+ac_config_files="$ac_config_files Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8"

 ac_config_headers="$ac_config_headers config.h"

@@ -17114,7 +17246,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.4.6, which was
+This file was extended by unbound $as_me 1.4.7, which was
 generated by GNU Autoconf 2.65.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -17180,7 +17312,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.4.6
+unbound config.status 1.4.7
 configured by $0, generated by GNU Autoconf 2.65,
  with options \\"\$ac_cs_config\\"

@@ -17560,6 +17692,7 @@ do
    "doc/example.conf") CONFIG_FILES="$CONFIG_FILES doc/example.conf" ;;
    "doc/libunbound.3") CONFIG_FILES="$CONFIG_FILES doc/libunbound.3" ;;
    "doc/unbound.8") CONFIG_FILES="$CONFIG_FILES doc/unbound.8" ;;
+    "doc/unbound-anchor.8") CONFIG_FILES="$CONFIG_FILES doc/unbound-anchor.8" ;;
    "doc/unbound-checkconf.8") CONFIG_FILES="$CONFIG_FILES doc/unbound-checkconf.8" ;;
    "doc/unbound.conf.5") CONFIG_FILES="$CONFIG_FILES doc/unbound.conf.5" ;;
    "doc/unbound-control.8") CONFIG_FILES="$CONFIG_FILES doc/unbound-control.8" ;;
@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)

-AC_INIT(unbound, 1.4.6, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.7, unbound-bugs@nlnetlabs.nl, unbound)

 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=6
+LIBUNBOUND_REVISION=7
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -31,6 +31,7 @@ LIBUNBOUND_AGE=0
 # 1.4.4 had 2:4:0
 # 1.4.5 had 2:5:0
 # 1.4.6 had 2:6:0
+# 1.4.7 had 2:7:0

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -153,6 +154,34 @@ AC_SUBST(UNBOUND_PIDFILE)
 ACX_ESCAPE_BACKSLASH($UNBOUND_PIDFILE, hdr_pid)
 AC_DEFINE_UNQUOTED(PIDFILE, ["$hdr_pid"], [default pidfile location])

+AC_ARG_WITH(rootkey-file, 
+    AC_HELP_STRING([--with-rootkey-file=filename], 
+    [set default pathname to root key file (default run-dir/root.key). This file is read and written.]), 
+    UNBOUND_ROOTKEY_FILE="$withval", 
+if test $on_mingw = no; then
+    UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
+else
+    UNBOUND_ROOTKEY_FILE="C:\\Program Files\\Unbound\\root.key"
+fi
+)
+AC_SUBST(UNBOUND_ROOTKEY_FILE)
+ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTKEY_FILE, hdr_rkey)
+AC_DEFINE_UNQUOTED(ROOT_ANCHOR_FILE, ["$hdr_rkey"], [default rootkey location])
+
+AC_ARG_WITH(rootcert-file, 
+    AC_HELP_STRING([--with-rootcert-file=filename], 
+    [set default pathname to root update certificate file (default run-dir/icannbundle.pem).  This file need not exist if you are content with the builtin.]), 
+    UNBOUND_ROOTCERT_FILE="$withval", 
+if test $on_mingw = no; then
+    UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
+else
+    UNBOUND_ROOTCERT_FILE="C:\\Program Files\\Unbound\\icannbundle.pem"
+fi
+)
+AC_SUBST(UNBOUND_ROOTCERT_FILE)
+ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTCERT_FILE, hdr_rpem)
+AC_DEFINE_UNQUOTED(ROOT_CERT_FILE, ["$hdr_rpem"], [default rootcert location])
+
 AC_ARG_WITH(username, 
    AC_HELP_STRING([--with-username=user], 
    [set default user that unbound changes to (default user is unbound)]), 
@@ -174,10 +203,6 @@ AC_PROG_CC
 ACX_DEPFLAG
 ACX_DETERMINE_EXT_FLAGS_UNBOUND

-# for Sun studio 11.
-ACX_CHECK_COMPILER_FLAG(xO4, [CFLAGS="$CFLAGS -xO4"])
-ACX_CHECK_COMPILER_FLAG(xtarget=generic, [CFLAGS="$CFLAGS -xtarget=generic"])
-
 # debug mode flags warnings
 AC_ARG_ENABLE(checking, AC_HELP_STRING([--enable-checking], [Enable warnings, asserts, makefile-dependencies]))
 AC_ARG_ENABLE(debug, AC_HELP_STRING([--enable-debug], [same as enable-checking]))
@@ -437,20 +462,16 @@ case "$enable_sha2" in
 	;;
 esac

-AC_ARG_ENABLE(gost, AC_HELP_STRING([--enable-gost], [Enable GOST support, experimental]))
+AC_ARG_ENABLE(gost, AC_HELP_STRING([--disable-gost], [Disable GOST support]))
 use_gost="no"
 case "$enable_gost" in
-	yes)
-	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL 1.0.0 is needed for GOST support])])
-	use_gost="yes"
-	AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
-	;;
 	no)
 	;;
-	*) dnl default
-	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [
-	  use_gost="yes"
-	  AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])])
+	*)
+	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL 1.0.0 is needed for GOST support])])
+        AC_CHECK_FUNC(EC_KEY_new, [], [AC_MSG_ERROR([OpenSSL does not support ECC, needed for GOST support])])
+	use_gost="yes"
+	AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
 	;;
 esac

@@ -524,6 +545,7 @@ large outgoing port ranges.  ])
 	AC_CHECK_FUNCS([event_base_new]) # only in libevent 1.4.1 and later
 	AC_CHECK_FUNCS([event_base_get_method]) # only in libevent 1.4.3 and later
 	AC_CHECK_FUNCS([ev_loop]) # only in libev. (tested on 3.51)
+	AC_CHECK_FUNCS([ev_default_loop]) # only in libev. (tested on 4.00)
 	if test -n "$BAK_LDFLAGS_SET"; then
 		LDFLAGS="$BAK_LDFLAGS"
 	fi
@@ -531,6 +553,29 @@ else
 	AC_DEFINE(USE_MINI_EVENT, 1, [Define if you want to use internal select based events])
 fi

+# check for libexpat
+AC_ARG_WITH(libexpat, AC_HELP_STRING([--with-libexpat=path],
+    [specify explicit path for libexpat.]),
+    [ ],[ withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr" ])
+AC_MSG_CHECKING(for libexpat)
+found_libexpat="no"
+for dir in $withval ; do
+            if test -f "$dir/include/expat.h"; then
+		found_libexpat="yes"
+		dnl assume /usr is in default path.
+		if test "$dir" != "/usr"; then
+                    CPPFLAGS="$CPPFLAGS -I$dir/include"
+		    LDFLAGS="$LDFLAGS -L$dir/lib"
+		fi
+            	AC_MSG_RESULT(found in $dir)
+                break;
+            fi
+done
+if test x_$found_libexpat != x_yes; then
+	AC_ERROR([Could not find libexpat, expat.h])
+fi
+AC_CHECK_HEADERS([expat.h],,, [AC_INCLUDES_DEFAULT])
+
 # set static linking if requested
 AC_SUBST(staticexe)
 staticexe=""
@@ -606,6 +651,29 @@ if test $ac_cv_func_daemon = yes; then
 ])
 fi

+# check wether strptime also works
+AC_DEFUN([AC_CHECK_STRPTIME_WORKS],
+[AC_REQUIRE([AC_PROG_CC])
+AC_MSG_CHECKING(whether strptime works)
+if test c${cross_compiling} = cno; then
+AC_TRY_RUN([
+#define _XOPEN_SOURCE
+#include <time.h>
+int main(void) { struct tm tm; char *res;
+res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm);
+if (!res) return 1; return 0; }
+] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"])
+else
+eval "ac_cv_c_strptime_works=maybe"
+fi
+AC_MSG_RESULT($ac_cv_c_strptime_works)
+if test $ac_cv_c_strptime_works = no; then
+AC_LIBOBJ(strptime)
+else
+AC_DEFINE_UNQUOTED([STRPTIME_WORKS], 1, [use default strptime.])
+fi
+])dnl
+AC_CHECK_FUNCS([strptime],[AC_CHECK_STRPTIME_WORKS],[AC_LIBOBJ([strptime])])
 AC_SEARCH_LIBS([setusercontext], [util])
 AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
@@ -630,13 +698,15 @@ use_ldns_builtin="no"
 AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH], 
 	[specify prefix of path of ldns library to use]), 
 	[ specialldnsdir="$withval"
-	if test "$withval" != ""; then
-		CPPFLAGS="-I$withval/include $CPPFLAGS"
-		LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
-		ACX_RUNTIME_PATH_ADD([$withval/lib])
+	if test "$withval" != "yes"; then
+		if test "$withval" != ""; then
+			CPPFLAGS="-I$withval/include $CPPFLAGS"
+			LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
+			ACX_RUNTIME_PATH_ADD([$withval/lib])
+		fi
+		ldnsdir="$withval"
+		AC_SUBST(ldnsdir)
 	fi
-	ldnsdir="$withval"
-	AC_SUBST(ldnsdir)
 ])

 AC_ARG_WITH(ldns-builtin, AC_HELP_STRING([--with-ldns-builtin], 
@@ -655,7 +725,27 @@ if test "$use_ldns_builtin" = "no"; then
 	else
 	    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
 	fi
-	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT])
+	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+#ifdef HAVE_WINSOCK2_H
+#include <winsock2.h>
+#endif
+
+#ifdef HAVE_WS2TCPIP_H
+#include <ws2tcpip.h>
+#endif
+])
 	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
 	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
 	    -a $ac_cv_header_ldns_ldns_h = yes \
@@ -664,7 +754,7 @@ if test "$use_ldns_builtin" = "no"; then
 	    dnl ldns was found
 	    :
 	else
-	    use_ldns_builtin="yes"
+	    AC_MSG_ERROR([No ldns library found (or not recent); install or update ldns library, use --with-ldns=path or --with-ldns-builtin])
 	fi
 fi

@@ -773,7 +863,13 @@ AHX_MEMCMP_BROKEN(unbound)
 char *ctime_r(const time_t *timep, char *buf);
 #endif

-#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
+#if !defined(HAVE_STRPTIME) || !defined(STRPTIME_WORKS)
+#define strptime unbound_strptime
+struct tm;
+char *strptime(const char *s, const char *format, struct tm *tm);
+#endif
+
+#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
   /* using version of libevent that is not threadsafe. */
 #  define LIBEVENT_SIGNAL_PROBLEM 1
 #endif
@@ -819,6 +915,6 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 #define UNBOUND_DNS_PORT 53
 ])

-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8])
 AC_CONFIG_HEADER([config.h])
 AC_OUTPUT
@@ -802,7 +802,8 @@ print_dp_details(SSL* ssl, struct worker* worker, struct delegpt* dp)
 {
 	char buf[257];
 	struct delegpt_addr* a;
-	int lame, dlame, rlame, rtt, edns_vs, to, lost;
+	int lame, dlame, rlame, rto, edns_vs, to, delay, entry_ttl;
+	struct rtt_info ri;
 	uint8_t edns_lame_known;
 	for(a = dp->target_list; a; a = a->next_target) {
 		addr_to_str(&a->addr, a->addrlen, buf, sizeof(buf));
@@ -813,30 +814,48 @@ print_dp_details(SSL* ssl, struct worker* worker, struct delegpt* dp)
 				return;
 		}
 		/* lookup in infra cache */
+		entry_ttl = infra_get_host_rto(worker->env.infra_cache,
+			&a->addr, a->addrlen, &ri, &delay, *worker->env.now);
+		if(entry_ttl == -2 && ri.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
+			if(!ssl_printf(ssl, "expired, rto %d msec.\n", ri.rto))
+				return;
+			continue;
+		}
+		if(entry_ttl == -1 || entry_ttl == -2) {
+			if(!ssl_printf(ssl, "not in infra cache.\n"))
+				return;
+			continue; /* skip stuff not in infra cache */
+		}
+
 		/* uses type_A because most often looked up, but other
 		 * lameness won't be reported then */
 		if(!infra_get_lame_rtt(worker->env.infra_cache, 
 			&a->addr, a->addrlen, dp->name, dp->namelen,
-			LDNS_RR_TYPE_A, &lame, &dlame, &rlame, &rtt, &lost,
+			LDNS_RR_TYPE_A, &lame, &dlame, &rlame, &rto,
 			*worker->env.now)) {
 			if(!ssl_printf(ssl, "not in infra cache.\n"))
 				return;
 			continue; /* skip stuff not in infra cache */
 		}
-		if(!ssl_printf(ssl, "%s%s%s%srtt %d msec, %d lost. ",
+		if(!ssl_printf(ssl, "%s%s%s%srto %d msec, ttl %d, ping %d "
+			"var %d rtt %d",
 			lame?"LAME ":"", dlame?"NoDNSSEC ":"",
 			a->lame?"AddrWasParentSide ":"",
-			rlame?"NoAuthButRecursive ":"", rtt, lost))
+			rlame?"NoAuthButRecursive ":"", rto, entry_ttl,
+			ri.srtt, ri.rttvar, rtt_notimeout(&ri)))
 			return;
+		if(delay)
+			if(!ssl_printf(ssl, ", probedelay %d", delay))
+				return;
 		if(infra_host(worker->env.infra_cache, &a->addr, a->addrlen,
 			*worker->env.now, &edns_vs, &edns_lame_known, &to)) {
 			if(edns_vs == -1) {
-				if(!ssl_printf(ssl, "noEDNS%s.",
-					edns_lame_known?" probed":""))
+				if(!ssl_printf(ssl, ", noEDNS%s.",
+					edns_lame_known?" probed":" assumed"))
 					return;
 			} else {
-				if(!ssl_printf(ssl, "EDNS %d%s.",
-					edns_vs, edns_lame_known?" probed":""))
+				if(!ssl_printf(ssl, ", EDNS %d%s.", edns_vs,
+					edns_lame_known?" probed":" assumed"))
 					return;
 			}
 		}
@@ -449,7 +449,7 @@ daemon_fork(struct daemon* daemon)
 	 */
 	daemon_create_workers(daemon);

-#ifdef HAVE_EV_LOOP
+#if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* in libev the first inited base gets signals */
 	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports, 1))
 		fatal_exit("Could not initialize main thread");
@@ -463,7 +463,7 @@ daemon_fork(struct daemon* daemon)
 	/* Special handling for the main thread. This is the thread
 	 * that handles signals and remote control.
 	 */
-#ifndef HAVE_EV_LOOP
+#if !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
 	/* libevent has the last inited base get signals (or any base) */
 	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports, 1))
 		fatal_exit("Could not initialize main thread");
@@ -59,6 +59,7 @@
 #include "util/module.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
+#include "services/cache/infra.h"
 #include "services/mesh.h"
 #include "services/localzone.h"
 #include "util/storage/slabhash.h"
@@ -1097,6 +1098,25 @@ do_flush_stats(SSL* ssl, struct worker* worker)
 	send_ok(ssl);
 }

+/** flush infra cache */
+static void
+do_flush_infra(SSL* ssl, struct worker* worker, char* arg)
+{
+	struct sockaddr_storage addr;
+	socklen_t len;
+	if(strcmp(arg, "all") == 0) {
+		slabhash_clear(worker->env.infra_cache->hosts);
+		send_ok(ssl);
+		return;
+	}
+	if(!ipstrtoaddr(arg, UNBOUND_DNS_PORT, &addr, &len)) {
+		(void)ssl_printf(ssl, "error parsing ip addr: '%s'\n", arg);
+		return;
+	}
+	infra_remove_host(worker->env.infra_cache, &addr, len);
+	send_ok(ssl);
+}
+
 /** flush requestlist */
 static void
 do_flush_requestlist(SSL* ssl, struct worker* worker)
@@ -1317,7 +1337,7 @@ parse_delegpt(SSL* ssl, struct regional* region, char* args, uint8_t* root)
 			return NULL;
 		}
 		/* add address */
-		if(!delegpt_add_addr(dp, region, &addr, addrlen, 0, 0, 1)) {
+		if(!delegpt_add_addr(dp, region, &addr, addrlen, 0, 0)) {
 			(void)ssl_printf(ssl, "error out of memory\n");
 			return NULL;
 		}
@@ -1494,6 +1514,89 @@ do_dump_requestlist(SSL* ssl, struct worker* worker)
 	}
 }

+/** structure for argument data for dump infra host */
+struct infra_arg {
+	/** the infra cache */
+	struct infra_cache* infra;
+	/** the SSL connection */
+	SSL* ssl;
+	/** the time now */
+	uint32_t now;
+	/** ipstr */
+	char* ipstr;
+};
+
+/** callback for every lame element in the infra cache */
+static void
+dump_infra_lame(struct lruhash_entry* e, void* arg)
+{
+	struct infra_arg* a = (struct infra_arg*)arg;
+	struct infra_lame_key* k = (struct infra_lame_key*)e->key;
+	struct infra_lame_data* d = (struct infra_lame_data*)e->data;
+	ldns_rdf* rdf;
+	size_t pos = 0;
+	char* nm;
+	/* skip expired */
+	if(d->ttl < a->now) {
+		return;
+	}
+	/* use ldns print for domain name */
+	if(ldns_wire2dname(&rdf, k->zonename, k->namelen, &pos)
+		!= LDNS_STATUS_OK)
+		return;
+	nm = ldns_rdf2str(rdf);
+	ldns_rdf_deep_free(rdf);
+	if(!ssl_printf(a->ssl, "%s lame %s ttl %d dnssec %d rec %d "
+		"A %d other %d\n", a->ipstr, nm, (int)(d->ttl - a->now),
+		d->isdnsseclame, d->rec_lame, d->lame_type_A, d->lame_other)) {
+		free(nm);
+		return;
+	}
+	free(nm);
+}
+
+/** callback for every host element in the infra cache */
+static void
+dump_infra_host(struct lruhash_entry* e, void* arg)
+{
+	struct infra_arg* a = (struct infra_arg*)arg;
+	struct infra_host_key* k = (struct infra_host_key*)e->key;
+	struct infra_host_data* d = (struct infra_host_data*)e->data;
+	char ip_str[1024];
+	addr_to_str(&k->addr, k->addrlen, ip_str, sizeof(ip_str));
+	a->ipstr = ip_str;
+	/* skip expired stuff (only backed off) */
+	if(d->ttl < a->now) {
+		if(d->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
+			if(!ssl_printf(a->ssl, "%s expired rto %d\n", ip_str,
+				d->rtt.rto)) return;
+		}
+		if(d->lameness)
+			lruhash_traverse(d->lameness, 0, &dump_infra_lame, arg);
+		return;
+	}
+	if(!ssl_printf(a->ssl, "%s ttl %d ping %d var %d rtt %d rto %d "
+		"ednsknown %d edns %d delay %d\n",
+		ip_str, (int)(d->ttl - a->now),
+		d->rtt.srtt, d->rtt.rttvar, rtt_notimeout(&d->rtt), d->rtt.rto,
+		(int)d->edns_lame_known, (int)d->edns_version,
+		(int)(a->now<d->probedelay?d->probedelay-a->now:0)))
+		return;
+	if(d->lameness)
+		lruhash_traverse(d->lameness, 0, &dump_infra_lame, arg);
+}
+
+/** do the dump_infra command */
+static void
+do_dump_infra(SSL* ssl, struct worker* worker)
+{
+	struct infra_arg arg;
+	arg.infra = worker->env.infra_cache;
+	arg.ssl = ssl;
+	arg.now = *worker->env.now;
+	slabhash_traverse(arg.infra->hosts, 0, &dump_infra_host, (void*)&arg);
+}
+
 /** do the log_reopen command */
 static void
 do_log_reopen(SSL* ssl, struct worker* worker)
@@ -1636,62 +1739,69 @@ distribute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd)
 	}
 }

+/** check for name with end-of-string, space or tab after it */
+static int
+cmdcmp(char* p, const char* cmd, size_t len)
+{
+	return strncmp(p,cmd,len)==0 && (p[len]==0||p[len]==' '||p[len]=='\t');
+}
+
 /** execute a remote control command */
 static void
 execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd, 
 	struct worker* worker)
 {
 	char* p = skipwhite(cmd);
-	/* compare command - check longer strings first in case of substrings*/
-	if(strncmp(p, "stop", 4) == 0) {
+	/* compare command */
+	if(cmdcmp(p, "stop", 4)) {
 		do_stop(ssl, rc);
 		return;
-	} else if(strncmp(p, "reload", 6) == 0) {
+	} else if(cmdcmp(p, "reload", 6)) {
 		do_reload(ssl, rc);
 		return;
-	} else if(strncmp(p, "stats_noreset", 13) == 0) {
+	} else if(cmdcmp(p, "stats_noreset", 13)) {
 		do_stats(ssl, rc, 0);
 		return;
-	} else if(strncmp(p, "stats", 5) == 0) {
+	} else if(cmdcmp(p, "stats", 5)) {
 		do_stats(ssl, rc, 1);
 		return;
-	} else if(strncmp(p, "status", 6) == 0) {
+	} else if(cmdcmp(p, "status", 6)) {
 		do_status(ssl, worker);
 		return;
-	} else if(strncmp(p, "dump_cache", 10) == 0) {
+	} else if(cmdcmp(p, "dump_cache", 10)) {
 		(void)dump_cache(ssl, worker);
 		return;
-	} else if(strncmp(p, "load_cache", 10) == 0) {
+	} else if(cmdcmp(p, "load_cache", 10)) {
 		if(load_cache(ssl, worker)) send_ok(ssl);
 		return;
-	} else if(strncmp(p, "list_forwards", 13) == 0) {
+	} else if(cmdcmp(p, "list_forwards", 13)) {
 		do_list_forwards(ssl, worker);
 		return;
-	} else if(strncmp(p, "list_stubs", 10) == 0) {
+	} else if(cmdcmp(p, "list_stubs", 10)) {
 		do_list_stubs(ssl, worker);
 		return;
-	} else if(strncmp(p, "list_local_zones", 16) == 0) {
+	} else if(cmdcmp(p, "list_local_zones", 16)) {
 		do_list_local_zones(ssl, worker);
 		return;
-	} else if(strncmp(p, "list_local_data", 15) == 0) {
+	} else if(cmdcmp(p, "list_local_data", 15)) {
 		do_list_local_data(ssl, worker);
 		return;
-	} else if(strncmp(p, "forward", 7) == 0) {
+	} else if(cmdcmp(p, "forward", 7)) {
 		/* must always distribute this cmd */
 		if(rc) distribute_cmd(rc, ssl, cmd);
 		do_forward(ssl, worker, skipwhite(p+7));
 		return;
-	} else if(strncmp(p, "flush_stats", 11) == 0) {
+	} else if(cmdcmp(p, "flush_stats", 11)) {
 		/* must always distribute this cmd */
 		if(rc) distribute_cmd(rc, ssl, cmd);
 		do_flush_stats(ssl, worker);
 		return;
-	} else if(strncmp(p, "flush_requestlist", 17) == 0) {
+	} else if(cmdcmp(p, "flush_requestlist", 17)) {
 		/* must always distribute this cmd */
 		if(rc) distribute_cmd(rc, ssl, cmd);
 		do_flush_requestlist(ssl, worker);
 		return;
-	} else if(strncmp(p, "lookup", 6) == 0) {
+	} else if(cmdcmp(p, "lookup", 6)) {
 		do_lookup(ssl, worker, skipwhite(p+6));
 		return;
 	}
@@ -1704,29 +1814,33 @@ execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd,
 		distribute_cmd(rc, ssl, cmd);
 	}
 #endif
-	if(strncmp(p, "verbosity", 9) == 0) {
+	if(cmdcmp(p, "verbosity", 9)) {
 		do_verbosity(ssl, skipwhite(p+9));
-	} else if(strncmp(p, "local_zone_remove", 17) == 0) {
+	} else if(cmdcmp(p, "local_zone_remove", 17)) {
 		do_zone_remove(ssl, worker, skipwhite(p+17));
-	} else if(strncmp(p, "local_zone", 10) == 0) {
+	} else if(cmdcmp(p, "local_zone", 10)) {
 		do_zone_add(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "local_data_remove", 17) == 0) {
+	} else if(cmdcmp(p, "local_data_remove", 17)) {
 		do_data_remove(ssl, worker, skipwhite(p+17));
-	} else if(strncmp(p, "local_data", 10) == 0) {
+	} else if(cmdcmp(p, "local_data", 10)) {
 		do_data_add(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "flush_zone", 10) == 0) {
+	} else if(cmdcmp(p, "flush_zone", 10)) {
 		do_flush_zone(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "flush_type", 10) == 0) {
+	} else if(cmdcmp(p, "flush_type", 10)) {
 		do_flush_type(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "flush", 5) == 0) {
+	} else if(cmdcmp(p, "flush_infra", 11)) {
+		do_flush_infra(ssl, worker, skipwhite(p+11));
+	} else if(cmdcmp(p, "flush", 5)) {
 		do_flush_name(ssl, worker, skipwhite(p+5));
-	} else if(strncmp(p, "dump_requestlist", 16) == 0) {
+	} else if(cmdcmp(p, "dump_requestlist", 16)) {
 		do_dump_requestlist(ssl, worker);
-	} else if(strncmp(p, "log_reopen", 10) == 0) {
+	} else if(cmdcmp(p, "dump_infra", 10)) {
+		do_dump_infra(ssl, worker);
+	} else if(cmdcmp(p, "log_reopen", 10)) {
 		do_log_reopen(ssl, worker);
-	} else if(strncmp(p, "set_option", 10) == 0) {
+	} else if(cmdcmp(p, "set_option", 10)) {
 		do_set_option(ssl, worker, skipwhite(p+10));
-	} else if(strncmp(p, "get_option", 10) == 0) {
+	} else if(cmdcmp(p, "get_option", 10)) {
 		do_get_option(ssl, worker, skipwhite(p+10));
 	} else {
 		(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
@@ -89,7 +89,7 @@
 /** global debug value to keep track of heap memory allocation */
 void* unbound_start_brk = 0;

-#if !defined(HAVE_EVENT_BASE_GET_METHOD) && defined(HAVE_EV_LOOP)
+#if !defined(HAVE_EVENT_BASE_GET_METHOD) && (defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
 static const char* ev_backend2str(int b)
 {
 	switch(b) {
@@ -122,11 +122,12 @@ static void get_event_sys(const char** n, const char** s, const char** m)
 	*n = "libevent";
 	b = event_base_new();
 	*m = event_base_get_method(b);
-#  elif defined(HAVE_EV_LOOP)
+#  elif defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	*n = "libev";
 	b = (struct event_base*)ev_default_loop(EVFLAG_AUTO);
 	*m = ev_backend2str(ev_backend((struct ev_loop*)b));
 #  else
+	*n = "unknown";
 	*m = "not obtainable";
 	b = NULL;
 #  endif
@@ -178,6 +178,8 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 		+ sizeof(*worker->env.scratch_buffer) 
 		+ ldns_buffer_capacity(worker->env.scratch_buffer)
 		+ forwards_get_mem(worker->env.fwds);
+	if(worker->thread_num == 0)
+		me += acl_list_get_mem(worker->daemon->acl);
 	if(cur_serv) {
 		me += serviced_get_mem(cur_serv);
 	}
@@ -283,9 +285,10 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 	return 0;
 }

-/** check request sanity. Returns error code, 0 OK, or -1 discard. 
+/** check request sanity.
 * @param pkt: the wire packet to examine for sanity.
 * @param worker: parameters for checking.
+ * @return error code, 0 OK, or -1 discard.
 */
 static int 
 worker_check_request(ldns_buffer* pkt, struct worker* worker)
@@ -993,6 +996,7 @@ void worker_probe_timer_cb(void* arg)
 struct worker* 
 worker_create(struct daemon* daemon, int id, int* ports, int n)
 {
+	unsigned int seed;
 	struct worker* worker = (struct worker*)calloc(1, 
 		sizeof(struct worker));
 	if(!worker) 
@@ -1010,6 +1014,19 @@ worker_create(struct daemon* daemon, int id, int* ports, int n)
 		free(worker);
 		return NULL;
 	}
+	/* create random state here to avoid locking trouble in RAND_bytes */
+	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
+		(((unsigned int)worker->thread_num)<<17);
+		/* shift thread_num so it does not match out pid bits */
+	if(!(worker->rndstate = ub_initstate(seed, daemon->rand))) {
+		seed = 0;
+		log_err("could not init random numbers.");
+		tube_delete(worker->cmd);
+		free(worker->ports);
+		free(worker);
+		return NULL;
+	}
+	seed = 0;
 	return worker;
 }

@@ -1017,7 +1034,6 @@ int
 worker_init(struct worker* worker, struct config_file *cfg, 
 	struct listen_port* ports, int do_sigs)
 {
-	unsigned int seed;
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create(do_sigs);
 	if(!worker->base) {
@@ -1062,16 +1078,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	} else { /* !do_sigs */
 		worker->comsig = NULL;
 	}
-	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
-		(((unsigned int)worker->thread_num)<<17);
-		/* shift thread_num so it does not match out pid bits */
-	if(!(worker->rndstate = ub_initstate(seed, NULL))) {
-		seed = 0;
-		log_err("could not init random numbers.");
-		worker_delete(worker);
-		return 0;
-	}
-	seed = 0;
 	worker->front = listen_create(worker->base, ports,
 		cfg->msg_buffer_size, (int)cfg->incoming_num_tcp, 
 		worker_handle_request, worker);
@@ -1124,7 +1130,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	if(worker->thread_num == 0)
 		log_set_time(worker->env.now);
 	worker->env.worker = worker;
-	worker->env.send_packet = &worker_send_packet;
 	worker->env.send_query = &worker_send_query;
 	worker->env.alloc = &worker->alloc;
 	worker->env.rnd = worker->rndstate;
@@ -1213,19 +1218,6 @@ worker_delete(struct worker* worker)
 	free(worker);
 }

-int 
-worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-        socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp)
-{
-	struct worker* worker = q->env->worker;
-	if(use_tcp) {
-		return pending_tcp_query(worker->back, pkt, addr, addrlen, 
-			timeout, worker_handle_reply, q) != 0;
-	}
-	return pending_udp_query(worker->back, pkt, addr, addrlen, 
-		timeout*1000, worker_handle_reply, q) != 0;
-}
-
 /** compare outbound entry qstates */
 static int
 outbound_entry_compare(void* a, void* b)
@@ -1275,15 +1267,6 @@ void worker_stats_clear(struct worker* worker)
 }

 /* --- fake callbacks for fptr_wlist to work --- */
-int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
-	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
-{
-	log_assert(0);
-	return 0;
-}
-
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
@@ -164,20 +164,6 @@ void worker_send_cmd(struct worker* worker, enum worker_commands cmd);
 */
 void worker_sighandler(int sig, void* arg);

-/**
- * Worker service routine to send udp messages for modules.
- * @param pkt: packet to send.
- * @param addr: where to.
- * @param addrlen: length of addr.
- * @param timeout: seconds to wait until timeout.
- * @param q: wich query state to reactivate upon return.
- * @param use_tcp: true to use TCP, false for UDP.
- * @return: false on failure (memory or socket related). no query was
- *      sent.
- */
-int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-	socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp);
-
 /**
 * Worker service routine to send serviced queries to authoritative servers.
 * @param qname: query name. (host order)
@@ -1,3 +1,166 @@
+5 November 2010: Wouter
+	- do not synthesize a CNAME message from cache for qtype DS.
+
+4 November 2010: Wouter
+	- Use central entropy to seed threads.
+
+3 November 2010: Wouter
+	- Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
+
+2 November 2010: Wouter
+	- tag 1.4.7rc1.
+	- code review.
+
+1 November 2010: Wouter
+	- GOST code enabled by default (RFC 5933).
+
+27 October 2010: Wouter
+	- Fix uninit value in dump_infra print.
+	- Fix validation failure for parent and child on same server with an
+	  insecure childzone and a CNAME from parent to child.
+	- Configure detects libev-4.00.
+
+26 October 2010: Wouter
+	- dump_infra and flush_infra commands for unbound-control.
+	- no timeout backoff if meanwhile a query succeeded.
+	- Change of timeout code.  No more lost and backoff in blockage.
+	  At 12sec timeout (and at least 2x lost before) one probe per IP
+	  is allowed only.  At 120sec, the IP is blocked.  After 15min, a
+	  120sec entry has a single retry packet.
+
+25 October 2010: Wouter
+	- Configure errors if ldns is not found.
+
+22 October 2010: Wouter
+	- Windows 7 fix for the installer.
+
+21 October 2010: Wouter
+	- Fix bug where fallback_tcp causes wrong roundtrip and edns
+	  observation to be noted in cache.  Fix bug where EDNSprobe halted
+	  exponential backoff if EDNS status unknown.
+	- new unresponsive host method, exponentially increasing block backoff.
+	- iana portlist updated.
+
+20 October 2010: Wouter
+	- interface automatic works for some people with ip6 disabled.
+	  Therefore the error check is removed, so they can use the option.
+
+19 October 2010: Wouter
+	- Fix for request list growth, if a server has long timeout but the
+	  lost counter is low, then its effective rtt is the one without
+	  exponential backoff applied.  Because the backoff is not working.
+	  The lost counter can then increase and the server is blacklisted,
+	  or the lost counter does not increase and the server is working
+	  for some queries.
+
+18 October 2010: Wouter
+	- iana portlist updated.
+
+13 October 2010: Wouter
+	- Fix TCP so it uses a random outgoing-interface.
+	- unbound-anchor handles ADDPEND keystate.
+
+11 October 2010: Wouter
+	- Fix bug when DLV below a trust-anchor that uses NSEC3 optout where
+	  the zone has a secure delegation hosted on the same server did not
+	  verify as secure (it was insecure by mistake).
+	- iana portlist updated.
+	- ldns tarball updated (for reading cachedumps with bad RR data).
+
+1 October 2010: Wouter
+	- test for unbound-anchor. fix for reading certs.
+	- Fix alloc_reg_release for longer uptime in out of memory conditions.
+
+28 September 2010: Wouter
+	- unbound-anchor working, it creates or updates a root.key file.
+	  Use it before you start the validator (e.g. at system boot time).
+
+27 September 2010: Wouter
+	- iana portlist updated.
+
+24 September 2010: Wouter
+	- bug#329: in example.conf show correct ipv4 link-local 169.254/16.
+
+23 September 2010: Wouter
+	- unbound-anchor app, unbound requires libexpat (xml parser library).
+
+22 September 2010: Wouter
+	- compliance with draft-ietf-dnsop-default-local-zones-14, removed
+	  reverse ipv6 orchid prefix from builtin list.
+	- iana portlist updated.
+
+17 September 2010: Wouter
+	- DLV has downgrade protection again, because the RFC says so.
+	- iana portlist updated.
+
+16 September 2010: Wouter
+	- Algorithm rollover operational reality intrudes, for trust-anchor,
+	  5011-store, and DLV-anchor if one key matches it's good enough.
+	- iana portlist updated.
+	- Fix reported validation error in out of memory condition.
+
+15 September 2010: Wouter
+	- Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
+
+14 September 2010: Wouter
+	- increased mesh-max-activation from 1000 to 3000 for crazy domains
+	  like _tcp.slb.com with 262 servers.
+	- iana portlist updated.
+
+13 September 2010: Wouter
+	- bug#327: Fix for cannot access stub zones until the root is primed.
+
+9 September 2010: Wouter
+	- unresponsive servers are not completely blacklisted (because of
+	  firewalls), but also not probed all the time (because of the request
+	  list size it generates).  The probe rate is 1%.
+	- iana portlist updated.
+
+20 August 2010: Wouter
+	- openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled.
+	  iterator get_mem includes priv_get_mem.  delegpt nodup removed.
+	  listen_pushback, query_info_allocqname, write_socket, send_packet,
+	  comm_point_set_cb_arg and listen_resume removed.
+
+19 August 2010: Wouter
+	- Fix bug#321: resolution of rs.ripe.net artifacts with 0x20.
+	  Delegpt structures checked for duplicates always.
+	  No more nameserver lookups generated when depth is full anyway.
+	- example.conf notes how to do DNSSEC validation and track the root.
+	- iana portlist updated.
+
+18 August 2010: Wouter
+	- Fix bug#322: configure does not respect CFLAGS on Solaris.
+	  Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line
+	  if use sun-cc, but some systems need different flags.
+
+16 August 2010: Wouter
+	- Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP
+	  changes, uses m4_bpatsubst now.
+	- make test (or make check) should be more portable and run the unit 
+	  test and testbound scripts. (make longtest has special requirements).
+
+13 August 2010: Wouter
+	- More pleasant remote control command parsing.
+	- documentation added for return values reported by doxygen 1.7.1.
+	- iana portlist updated.
+
+9 August 2010: Wouter
+	- Fix name of rrset printed that failed validation.
+
+5 August 2010: Wouter
+	- Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
+
+4 August 2010: Wouter
+	- Fix validation in case a trust anchor enters into a zone with
+	  unsupported algorithms.
+
+3 August 2010: Wouter
+	- updated ldns tarball with bugfixes.
+	- release tag 1.4.6.
+	- trunk becomes 1.4.7 develop.
+	- iana portlist updated.
+
 22 July 2010: Wouter
 	- more error details on failed remote control connection.

@@ -28,6 +28,8 @@ This software is under BSD license, see LICENSE for details.
 	of outgoing ports. This improves randomization and spoof 
 	resistance. For the default of 16 ports the builtin alternative 
 	works well and is a little faster.
+  * --with-libexpat=/path/to/libexpat
+  	Can be set to the install directory of libexpat.
  * --without-pthreads 
 	This disables pthreads. Without this option the pthreads library 
 	is detected automatically. Use this option to disable threading
@@ -59,6 +61,13 @@ This software is under BSD license, see LICENSE for details.
  * --with-chroot-dir=path
  	Set default chroot directory,
 	the default is /usr/local/etc/unbound.
+  * --with-rootkey-file=path
+  	Set the default root.key path.  This file is read and written.
+	the default is /usr/local/etc/unbound/root.key
+  * --with-rootcert-file=path
+  	Set the default root update certificate path.  A builtin certificate
+	is used if this file is empty or does not exist.
+	the default is /usr/local/etc/unbound/icannbundle.pem
  * --with-username=user
  	Set default user name to change to,
 	the default is the "unbound" user.
@@ -72,8 +81,7 @@ This software is under BSD license, see LICENSE for details.
  * --disable-gost
  	Disable support for GOST crypto, RFC 5933.

-* 'make test' attempts to run a series of tests, depending on the support
-  programs that are installed.
+* 'make test' runs a series of self checks.

 Known issues
 ------------
@@ -97,6 +105,7 @@ o The warning 'openssl has no entropy, seeding with time', with chroot
 o On Solaris 5.10 some libtool packages from repositories do not work with
  gcc, showing errors gcc: unrecognized option `-KPIC'
  To solve this do ./configure libtool=./libtool [your options...].
+  On Solaris you may pass CFLAGS="-xO4 -xtarget=generic" if you use sun-cc.
 o If unbound-control (or munin graphs) do not work, this can often be because
  the unbound-control-setup script creates the keys with restricted 
  permissions, and the files need to be made readable or ownered by both the
@@ -1,8 +1,11 @@
 README unbound tests

-There is a test setup for unbound. Use
+For a quick test that runs unit tests and state machine tests, use
 	make test
-To make and run the tests. The results are summarized at the end.
+
+There is a long test setup for unbound that needs tools installed. Use
+	make longtest
+To make and run the long tests. The results are summarized at the end.

 You need to have the following programs installed and in your PATH.
 * dig - from the bind-tools package. Used to send DNS queries.
@@ -12,10 +15,6 @@ You need to have the following programs installed and in your PATH.
 * xxd and nc (optional) - for (malformed) packet transmission.
 The optional programs are detected and can be omitted.

-Without any support programs, unittest and testbound can still be used.
-	(cd testdata; ../testcode/mini_tpkg.sh exe 02-unittest.tpkg)
-	(cd testdata; ../testcode/mini_tpkg.sh exe 03-testbound.tpkg)
-
 testdata/ contains the data for tests. 
 testcode/ contains scripts and c code for the tests.

@@ -271,7 +271,7 @@ server:
 	# private-address: 10.0.0.0/8
 	# private-address: 172.16.0.0/12
 	# private-address: 192.168.0.0/16
-	# private-address: 192.254.0.0/16
+	# private-address: 169.254.0.0/16
 	# private-address: fd00::/8
 	# private-address: fe80::/10

@@ -305,6 +305,14 @@ server:
 	# separated by spaces. "iterator" or "validator iterator"
 	# module-config: "validator iterator"

+	# File with trusted keys, kept uptodate using RFC5011 probes,
+	# initial file like trust-anchor-file, then it stores metadata.
+	# Use several entries, one per domain name, to track multiple zones.
+	#
+	# If you want to perform DNSSEC validation, run unbound-anchor before
+	# you start unbound (i.e. in the system boot scripts).  And enable:
+	# auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
+
 	# File with DLV trusted keys. Same format as trust-anchor-file.
 	# There can be only one DLV configured, it is trusted from root down.
 	# Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
@@ -313,15 +321,12 @@ server:
 	# File with trusted keys for validation. Specify more than one file
 	# with several entries, one file per entry.
 	# Zone file format, with DS and DNSKEY entries.
+	# Note this gets out of date, use auto-trust-anchor-file please.
 	# trust-anchor-file: ""
 	
-	# File with trusted keys, kept uptodate using RFC5011 probes,
-	# initial file like trust-anchor-file, then it stores metadata.
-	# Use several entries, one per domain name, to track multiple zones.
-	# auto-trust-anchor-file: ""
-
 	# Trusted key for validation. DS or DNSKEY. specify the RR on a
 	# single line, surrounded by "". TTL is ignored. class is IN default.
+	# Note this gets out of date, use auto-trust-anchor-file please.
 	# (These examples are from August 2007 and may not be valid anymore).
 	# trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ=="
 	# trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"
@@ -330,6 +335,7 @@ server:
 	# with several entries, one file per entry. Like trust-anchor-file
 	# but has a different file format. Format is BIND-9 style format, 
 	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
+	# you need external update procedures to track changes in keys.
 	# trusted-keys-file: ""

 	# Ignore chain of trust. Domain is treated as insecure.
@@ -0,0 +1,171 @@
+.TH "unbound-anchor" "8" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound-anchor.8 -- unbound anchor maintenance utility manual
+.\"
+.\" Copyright (c) 2008, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.LP
+.B unbound\-anchor
+\- Unbound anchor utility.
+.SH "SYNOPSIS"
+.B unbound\-anchor
+.RB [ opts ]
+.SH "DESCRIPTION"
+.B Unbound\-anchor
+performs setup or update of the root trust anchor for DNSSEC validation.
+It can be run (as root) from the commandline, or run as part of startup
+scripts.  Before you start the \fIunbound\fR(8) DNS server.
+.P
+Suggested usage:
+.P
+.nf
+	# in the init scripts.
+	# provide or update the root anchor (if necessary)
+	unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
+	# start validating resolver
+	# the unbound.conf contains:
+	#   auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
+	unbound -c unbound.conf
+.fi
+.P
+This tool provides builtin default contents for the root anchor and root
+update certificate files.
+.P
+It tests if the root anchor file works, and if not, and an update is possible,
+attempts to update the root anchor using the root update certificate.
+It performs a https fetch of root-anchors.xml and checks the results, if
+all checks are successful, it updates the root anchor file.  Otherwise
+the root anchor file is unchanged.  It performs RFC5011 tracking if the
+DNSSEC information available via the DNS makes that possible.
+.P
+If does not perform an update if the certificate is expired, if the network
+is down or other errors occur.
+.P
+The available options are:
+.TP
+.B \-a \fIfile
+The root anchor key file, that is read in and written out.
+Default is @UNBOUND_ROOTKEY_FILE@.
+If the file does not exist, or is empty, a builtin root key is written to it.
+.TP
+.B \-c \fIfile
+The root update certificate file, that is read in.
+Default is @UNBOUND_ROOTCERT_FILE@.
+If the file does not exist, or is empty, a builtin certificate is used.
+.TP
+.B \-l
+List the builtin root key and builtin root update certificate on stdout.
+.TP
+.B \-u \fIname
+The server name, it connects to https://name.  Specify without https:// prefix.
+The default is "data.iana.org".  It connects to the port specified with \-P.
+You can pass an IPv4 addres or IPv6 address (no brackets) if you want.
+.TP
+.B \-x \fIpath
+The pathname to the root\-anchors.xml file on the server. (forms URL with \-u).
+The default is /root\-anchors/root\-anchors.xml.
+.TP
+.B \-s \fIpath
+The pathname to the root\-anchors.p7s file on the server. (forms URL with \-u).
+The default is /root\-anchors/root\-anchors.p7s.  This file has to be a PKCS7
+signature over the xml file, using the pem file (\-c) as trust anchor.
+.TP
+.B \-4
+Use IPv4 for domain resolution and contacting the server on https.  Default is
+to use IPv4 and IPv6 where appropriate.
+.TP
+.B \-6
+Use IPv6 for domain resolution and contacting the server on https.  Default is
+to use IPv4 and IPv6 where appropriate.
+.TP
+.B \-f \fIresolv.conf
+Use the given resolv.conf file.  Not enabled by default, but you could try to
+pass /etc/resolv.conf on some systems.  It contains the IP addresses of the
+recursive nameservers to use.  However, since this tool could be used to
+bootstrap that very recursive nameserver, it would not be useful (since
+that server is not up yet, since we are bootstrapping it).  It could be
+useful in a situation where you know an upstream cache is deployed (and
+running) and in captive portal situations.
+.TP
+.B \-r \fIroot.hints
+Use the given root.hints file (same syntax as the BIND and Unbound root hints
+file) to bootstrap domain resolution.  By default a list of builtin root
+hints is used.  Unbound\-anchor goes to the network itself for these roots,
+to resolve the server (\-u option) and to check the root DNSKEY records.
+It does so, because the tool when used for bootstrapping the recursive
+resolver, cannot use that recursive resolver itself because it is bootstrapping
+that server.
+.TP
+.B \-v
+More verbose. Once prints informational messages, multiple times may enable
+large debug amounts (such as full certificates or byte\-dumps of downloaded
+files).  By default it prints almost nothing.  It also prints nothing on
+errors by default; in that case the original root anchor file is simply
+left undisturbed, so that a recursive server can start right after it.
+.TP
+.B \-C \fIunbound.conf
+Debug option to read unbound.conf into the resolver process used.
+.TP
+.B \-P \fIport
+Set the port number to use for the https connection.  The default is 443.
+.TP
+.B \-F
+Debug option to force update of the root anchor through downloading the xml
+file and verifying it with the certificate.  By default it first tries to
+update by contacting the DNS, which uses much less bandwidth, is much
+faster (200 msec not 2 sec), and is nicer to the deployed infrastructure.
+With this option, it still attempts to do so (and may verbosely tell you),
+but then ignores the result and goes on to use the xml fallback method.
+.TP
+.B \-h
+Show the version and commandline option help.
+.TP
+.B \-v
+More verbose.  Prints output detailing what happens.
+.SH "EXIT CODE"
+This tool exits with value 1 if the root anchor was updated using the
+certificate or if the builtin root-anchor was used.  It exits with code
+0 if no update was necessary, if the update was possible with RFC5011
+tracking, or if an error occurred.
+.P
+You can check the exit value in this manner:
+.nf
+	unbound-anchor -a "root.key" || logger "Please check root.key"
+.fi
+Or something more suitable for your operational environment.
+.SH "TRUST"
+The root keys and update certificate included in this tool
+are provided for convenience and under the terms of our
+license (see the LICENSE file in the source distribution or
+http://unbound.nlnetlabs.nl/svn/trunk/LICENSE) and might be stale or
+not suitable to your purpose.
+.P
+By running "unbound\-anchor \-l" the  keys and certificate that are
+configured in the code are printed for your convenience.
+.P
+The build\-in configuration can be overridden by providing a root\-cert
+file and a rootkey file.
+.SH "FILES"
+.TP
+.I @UNBOUND_ROOTKEY_FILE@
+The root anchor file, updated with 5011 tracking, and read and written to.
+The file is created if it does not exist.
+.TP
+.I @UNBOUND_ROOTCERT_FILE@
+The trusted self\-signed certificate that is used to verify the downloaded
+DNSSEC root trust anchor.  You can update it by fetching it from
+https://data.iana.org/root\-anchors/icannbundle.pem (and validate it).
+If the file does not exist or is empty, a builtin version is used.
+.TP
+.I https://data.iana.org/root\-anchors/root\-anchors.xml
+Source for the root key information.
+.TP
+.I https://data.iana.org/root\-anchors/root\-anchors.p7s
+Signature on the root key information.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5), 
+\fIunbound\fR(8).
@@ -142,6 +142,14 @@ Show what is worked on.  Prints all queries that the server is currently
 working on.  Prints the time that users have been waiting.  For internal
 requests, no time is printed.  And then prints out the module status.
 .TP
+.B flush_infra \fIall|IP
+If all then entire infra cache is emptied.  If a specific IP address, the
+entry for that address is removed from the cache.  It contains EDNS, ping
+and lameness data.
+.TP
+.B dump_infra
+Show the contents of the infra cache.
+.TP
 .B set_option \fIopt: val
 Set the option to the given value without a reload.  The cache is therefore
 not flushed.  The option must end with a ':' and whitespace must be between the
@@ -124,9 +124,8 @@ interface and port number), if not specified the default port (from
 .TP
 .B interface\-automatic: \fI<yes or no>
 Detect source interface on UDP queries and copy them to replies.  This 
-feature is experimental, and needs support in your OS for IPv6 
-(and its socket options) and IPv4 (and have source\-interface socket options). 
-Default value is no.
+feature is experimental, and needs support in your OS for particular socket
+options.  Default value is no.
 .TP
 .B outgoing\-interface: \fI<ip address>
 Interface to use to connect to the network. This interface is used to send
@@ -488,7 +487,7 @@ that you configured is allowed to, and you can specify additional
 names using \fBprivate\-domain\fR.  No private addresses are enabled
 by default.  We consider to enable this for the RFC1918 private IP
 address space by default in later releases. That would enable private 
-addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 192.254.0.0/16 
+addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 
 fd00::/8 and fe80::/10, since the RFC standards say these addresses 
 should not be visible on the public internet.  Turning on 127.0.0.0/8 
 would hinder many spamblocklists as they use that.
@@ -803,9 +802,6 @@ Reverse data for zone D.F.ip6.arpa.
 \h'5'\fIreverse RFC4291 IPv6 Link Local Addresses\fR
 Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa.
 .TP 10
-\h'5'\fIreverse RFC4843 Orchid Prefix\fR
-Reverse data for zone 0.1.1.0.0.2.ip6.arpa.
-.TP 10
 \h'5'\fIreverse IPv6 Example Prefix\fR
 Reverse data for zone 8.B.D.0.1.0.0.2.ip6.arpa. This zone is used for
 tutorials and examples. You can remove the block on this zone with:
@@ -81,7 +81,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
 		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, 
-			a->bogus, a->lame, 0))
+			a->bogus, a->lame))
 			return NULL;
 	}
 	return copy;
@@ -154,7 +154,7 @@ delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr,
 int 
 delegpt_add_target(struct delegpt* dp, struct regional* region, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int lame, int nodup)
+	socklen_t addrlen, int bogus, int lame)
 {
 	struct delegpt_ns* ns = delegpt_find_ns(dp, name, namelen);
 	if(!ns) {
@@ -168,23 +168,22 @@ delegpt_add_target(struct delegpt* dp, struct regional* region,
 		if(ns->got4 && ns->got6)
 			ns->resolved = 1;
 	}
-	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, nodup);
+	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame);
 }

 int 
 delegpt_add_addr(struct delegpt* dp, struct regional* region, 
 	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
-	int lame, int nodup)
+	int lame)
 {
 	struct delegpt_addr* a;
-	if(nodup) {
-		if((a = delegpt_find_addr(dp, addr, addrlen))) {
-			if(bogus)
-				a->bogus = bogus;
-			if(!lame)
-				a->lame = 0;
-			return 1;
-		}
+	/* check for duplicates */
+	if((a = delegpt_find_addr(dp, addr, addrlen))) {
+		if(bogus)
+			a->bogus = bogus;
+		if(!lame)
+			a->lame = 0;
+		return 1;
 	}

 	a = (struct delegpt_addr*)regional_alloc(region,
@@ -361,10 +360,10 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 			continue;

 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_A) {
-			if(!delegpt_add_rrset_A(dp, region, s, 0, 0))
+			if(!delegpt_add_rrset_A(dp, region, s, 0))
 				return NULL;
 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_AAAA) {
-			if(!delegpt_add_rrset_AAAA(dp, region, s, 0, 0))
+			if(!delegpt_add_rrset_AAAA(dp, region, s, 0))
 				return NULL;
 		}
 	}
@@ -394,7 +393,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,

 int 
 delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int lame, int nodup)
+	struct ub_packed_rrset_key* ak, int lame)
 {
        struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
        size_t i;
@@ -409,7 +408,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
                memmove(&sa.sin_addr, d->rr_data[i]+2, INET_SIZE);
                if(!delegpt_add_target(dp, region, ak->rk.dname,
                        ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), lame, nodup))
+                        len, (d->security==sec_status_bogus), lame))
                        return 0;
        }
        return 1;
@@ -417,7 +416,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,

 int 
 delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int lame, int nodup)
+	struct ub_packed_rrset_key* ak, int lame)
 {
        struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
        size_t i;
@@ -432,7 +431,7 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
                memmove(&sa.sin6_addr, d->rr_data[i]+2, INET6_SIZE);
                if(!delegpt_add_target(dp, region, ak->rk.dname,
                        ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), lame, nodup))
+                        len, (d->security==sec_status_bogus), lame))
                        return 0;
        }
        return 1;
@@ -447,9 +446,9 @@ delegpt_add_rrset(struct delegpt* dp, struct regional* region,
 	if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS)
 		return delegpt_rrset_add_ns(dp, region, rrset, lame);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A)
-		return delegpt_add_rrset_A(dp, region, rrset, lame, 1);
+		return delegpt_add_rrset_A(dp, region, rrset, lame);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA)
-		return delegpt_add_rrset_AAAA(dp, region, rrset, lame, 1);
+		return delegpt_add_rrset_AAAA(dp, region, rrset, lame);
 	log_warn("Unknown rrset type added to delegpt");
 	return 1;
 }
@@ -185,7 +185,7 @@ int delegpt_add_ns(struct delegpt* dp, struct regional* regional,
 * @param regional: where to allocate the info.
 * @param ns_rrset: NS rrset.
 * @param lame: rrset is lame, disprefer it.
- * return 0 on alloc error.
+ * @return 0 on alloc error.
 */
 int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
 	struct ub_packed_rrset_key* ns_rrset, int lame);
@@ -201,13 +201,11 @@ int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
 * @param addrlen: the length of addr.
 * @param bogus: security status for the address, pass true if bogus.
 * @param lame: address is lame.
- * @param nodup: if true, no address duplicates are made by this add. 
- *	name duplicates are always filtered.
 * @return false on error.
 */
 int delegpt_add_target(struct delegpt* dp, struct regional* regional, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int lame, int nodup);
+	socklen_t addrlen, int bogus, int lame);

 /**
 * Add A RRset to delegpt.
@@ -215,11 +213,10 @@ int delegpt_add_target(struct delegpt* dp, struct regional* regional,
 * @param regional: where to allocate the info.
 * @param rrset: RRset A to add.
 * @param lame: rrset is lame, disprefer it.
- * @param nodup: if true, no duplicates are made by this add. takes time.
 * @return 0 on alloc error.
 */
 int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int lame, int nodup);
+	struct ub_packed_rrset_key* rrset, int lame);

 /**
 * Add AAAA RRset to delegpt.
@@ -227,11 +224,10 @@ int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional,
 * @param regional: where to allocate the info.
 * @param rrset: RRset AAAA to add.
 * @param lame: rrset is lame, disprefer it.
- * @param nodup: if true, no duplicates are made by this add. takes time.
 * @return 0 on alloc error.
 */
 int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int lame, int nodup);
+	struct ub_packed_rrset_key* rrset, int lame);

 /**
 * Add any RRset to delegpt.
@@ -253,12 +249,10 @@ int delegpt_add_rrset(struct delegpt* dp, struct regional* regional,
 * @param addrlen: the length of addr.
 * @param bogus: if address is bogus.
 * @param lame: if address is lame.
- * @param nodup: if true, no duplicates are made by this add. takes time.
 * @return false on error.
 */
 int delegpt_add_addr(struct delegpt* dp, struct regional* regional, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
-	int lame, int nodup);
+	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, int lame);

 /** 
 * Find NS record in name list of delegation point.
@@ -215,8 +215,7 @@ read_fwds_addr(struct iter_forwards* fwd, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen, 
-			0, 0, 1)) {
+		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen, 0, 0)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -88,7 +88,7 @@ ah(struct delegpt* dp, struct regional* r, const char* sv, const char* ip)
 	if(!delegpt_add_ns(dp, r, ldns_rdf_data(rdf), 0) ||
 	   !extstrtoaddr(ip, &addr, &addrlen) ||
 	   !delegpt_add_target(dp, r, ldns_rdf_data(rdf), ldns_rdf_size(rdf),
-		&addr, addrlen, 0, 0, 1)) {
+		&addr, addrlen, 0, 0)) {
 		ldns_rdf_deep_free(rdf);
 		return 0;
 	}
@@ -229,8 +229,7 @@ read_stubs_addr(struct iter_hints* hints, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen, 
-			0, 0, 1)) {
+		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen, 0, 0)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -325,7 +324,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len, 
-					0, 0, 1)) {
+					0, 0)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}
@@ -341,7 +340,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len,
-					0, 0, 1)) {
+					0, 0)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}
@@ -452,6 +451,13 @@ hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,
 		len, labs, qclass);
 	if(!r) return NULL;

+	/* If there is no cache (root prime situation) */
+	if(cache_dp == NULL) {
+		if(r->dp->namelabs != 1)
+			return r; /* no cache dp, use any non-root stub */
+		return NULL;
+	}
+
 	/*
 	 * If the stub is same as the delegation we got
 	 * And has noprime set, we need to 'prime' to use this stub instead.
@@ -183,7 +183,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
 	struct delegpt_addr* a)
 {
-	int rtt, lame, reclame, dnsseclame, lost;
+	int rtt, lame, reclame, dnsseclame;
 	if(a->bogus)
 		return -1; /* address of server is bogus */
 	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
@@ -197,19 +197,18 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, 
 		name, namelen, qtype, &lame, &dnsseclame, &reclame, 
-		&rtt, &lost, now)) {
+		&rtt, now)) {
 		log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen);
-		verbose(VERB_ALGO, "   rtt=%d lost=%d%s%s%s%s", rtt, lost,
+		verbose(VERB_ALGO, "   rtt=%d%s%s%s%s", rtt,
 			lame?" LAME":"",
 			dnsseclame?" DNSSEC_LAME":"",
 			reclame?" REC_LAME":"",
 			a->lame?" ADDR_LAME":"");
 		if(lame)
 			return -1; /* server is lame */
-		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT && 
-			lost >= USEFUL_SERVER_MAX_LOST)
-			/* server is unresponsive, but keep trying slowly */
-			return USEFUL_SERVER_TOP_TIMEOUT+1;
+		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT)
+			/* server is unresponsive */
+			return USEFUL_SERVER_TOP_TIMEOUT;
 		/* select remainder from worst to best */
 		else if(reclame)
 			return rtt+USEFUL_SERVER_TOP_TIMEOUT*3; /* nonpref */
@@ -217,8 +216,6 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 			return rtt+USEFUL_SERVER_TOP_TIMEOUT*2; /* nonpref */
 		else if(a->lame)
 			return rtt+USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
-		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT) /* not blacklisted*/
-			return USEFUL_SERVER_TOP_TIMEOUT+1;
 		else	return rtt;
 	}
 	/* no server information present */
@@ -852,7 +849,7 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env,
 			log_rrset_key(VERB_ALGO, "found parent-side", akey);
 			ns->done_pside4 = 1;
 			/* a negative-cache-element has no addresses it adds */
-			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1))
+			if(!delegpt_add_rrset_A(dp, region, akey, 1))
 				log_err("malloc failure in lookup_parent_glue");
 			lock_rw_unlock(&akey->entry.lock);
 		}
@@ -864,7 +861,7 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env,
 			log_rrset_key(VERB_ALGO, "found parent-side", akey);
 			ns->done_pside6 = 1;
 			/* a negative-cache-element has no addresses it adds */
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1))
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1))
 				log_err("malloc failure in lookup_parent_glue");
 			lock_rw_unlock(&akey->entry.lock);
 		}
@@ -159,6 +159,7 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
 * @param qinfo: query name and type
 * @param qflags: query flags with RD flag
 * @param dp: delegpt to check.
+ * @return true if dp is useless.
 */
 int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
 	struct delegpt* dp);
@@ -323,11 +323,8 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 		(msg->rep->ns_numrrsets + msg->rep->ar_numrrsets) *
 		sizeof(struct ub_packed_rrset_key*));

-	/* if the rcode was NXDOMAIN, and we prepended DNAME/CNAMEs, then
-	 * it should now be NOERROR. */
-	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NXDOMAIN) {
-		FLAGS_SET_RCODE(msg->rep->flags, LDNS_RCODE_NOERROR);
-	}
+	/* NXDOMAIN rcode can stay if we prepended DNAME/CNAMEs, because
+	 * this is what recursors should give. */
 	msg->rep->rrset_count += num_an + num_ns;
 	msg->rep->an_numrrsets += num_an;
 	msg->rep->ns_numrrsets += num_ns;
@@ -537,6 +534,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 * @param ie: iterator global state.
 * @param id: module id.
 * @param qclass: the class to prime.
+ * @return 0 on failure
 */
 static int
 prime_root(struct module_qstate* qstate, struct iter_qstate* iq, 
@@ -596,6 +594,8 @@ prime_root(struct module_qstate* qstate, struct iter_qstate* iq,
 * @param q: request name.
 * @return true if a priming subrequest was made, false if not. The will only
 *         issue a priming request if it detects an unprimed stub.
+ *         Uses value of 2 to signal during stub-prime in root-prime situation
+ *         that a noprime-stub is available and resolution can continue.
 */
 static int
 prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, 
@@ -621,6 +621,8 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq,

 	/* is it a noprime stub (always use) */
 	if(stub->noprime) {
+		int r = 0;
+		if(iq->dp == NULL) r = 2;
 		/* copy the dp out of the fixed hints structure, so that
 		 * it can be changed when servicing this query */
 		iq->dp = delegpt_copy(stub_dp, qstate->region);
@@ -631,7 +633,7 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 		log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name, 
 			LDNS_RR_TYPE_NS, q->qclass);
-		return 0;
+		return r;
 	}

 	/* Otherwise, we need to (re)prime the stub. */
@@ -936,7 +938,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
 				qstate->region, qstate->env->rrset_cache,
 				qstate->env->scratch_buffer, 
-				*qstate->env->now, 1/*add SOA*/);
+				*qstate->env->now, 1/*add SOA*/, NULL);
 		}
 	}
 	if(msg) {
@@ -1033,6 +1035,12 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* If the cache has returned nothing, then we have a 
 		 * root priming situation. */
 		if(iq->dp == NULL) {
+			/* if there is a stub, then no root prime needed */
+			int r = prime_stub(qstate, iq, ie, id, &iq->qchase);
+			if(r == 2)
+				break; /* got noprime-stub-zone, continue */
+			else if(r)
+				return 0; /* stub prime request made */
 			if(forwards_lookup_root(qstate->env->fwds, 
 				iq->qchase.qclass)) {
 				/* forward zone root, no root prime needed */
@@ -1302,6 +1310,9 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 	int missing;
 	int toget = 0;

+	if(iq->depth == ie->max_dependency_depth)
+		return 0;
+
 	iter_mark_cycle_targets(qstate, iq->dp);
 	missing = (int)delegpt_count_missing_targets(iq->dp);
 	log_assert(maxtargets != 0); /* that would not be useful */
@@ -1434,6 +1445,10 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			return 0; /* and wait for them */
 		}
 	}
+	if(iq->depth == ie->max_dependency_depth) {
+		verbose(VERB_QUERY, "maxdepth and need more nameservers, fail");
+		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
+	}
 	/* mark cycle targets for parent-side lookups */
 	iter_mark_pside_cycle_targets(qstate, iq->dp);
 	/* see if we can issue queries to get nameserver addresses */
@@ -2658,7 +2673,8 @@ iter_get_mem(struct module_env* env, int id)
 	if(!ie)
 		return 0;
 	return sizeof(*ie) + sizeof(int)*((size_t)ie->max_dependency_depth+1)
-		+ hints_get_mem(ie->hints) + donotq_get_mem(ie->donotq);
+		+ hints_get_mem(ie->hints) + donotq_get_mem(ie->donotq)
+		+ priv_get_mem(ie->priv);
 }

 /**
@@ -75,6 +75,8 @@ struct iter_priv;
 * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
 * fast server, this causes server exploration as a side benefit. msec. */
 #define RTT_BAND 400
+/** Start value for blacklisting a host, 2*USEFUL_SERVER_TOP_TIMEOUT in sec */
+#define INFRA_BACKOFF_INITIAL 240

 /**
 * Global state for the iterator. 
@@ -185,7 +185,6 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 		libworker_delete(w);
 		return NULL;
 	}
-	w->env->send_packet = &libworker_send_packet;
 	w->env->send_query = &libworker_send_query;
 	w->env->detach_subs = &mesh_detach_subs;
 	w->env->attach_sub = &mesh_attach_sub;
@@ -671,18 +670,6 @@ void libworker_alloc_cleanup(void* arg)
        slabhash_clear(w->env->msg_cache);
 }

-int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-        socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp)
-{
-	struct libworker* w = (struct libworker*)q->env->worker;
-	if(use_tcp) {
-		return pending_tcp_query(w->back, pkt, addr, addrlen,
-			timeout, libworker_handle_reply, q) != 0;
-	}
-	return pending_udp_query(w->back, pkt, addr, addrlen,
-		timeout*1000, libworker_handle_reply, q) != 0;
-}
-
 /** compare outbound entry qstates */
 static int
 outbound_entry_compare(void* a, void* b)
@@ -823,15 +810,6 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 	log_assert(0);
 }

-int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
-	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
-{
-	log_assert(0);
-	return 0;
-}
-
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
@@ -107,20 +107,6 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q);
 /** cleanup the cache to remove all rrset IDs from it, arg is libworker */
 void libworker_alloc_cleanup(void* arg);

-/**
- * Worker service routine to send udp messages for modules.
- * @param pkt: packet to send.
- * @param addr: where to.
- * @param addrlen: length of addr.
- * @param timeout: seconds to wait until timeout.
- * @param q: wich query state to reactivate upon return.
- * @param use_tcp: true to use TCP, false for UDP.
- * @return: false on failure (memory or socket related). no query was
- *      sent.
- */
-int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
-        socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp);
-
 /**
 * Worker service routine to send serviced queries to authoritative servers.
 * @param qname: query name. (host order)
@@ -55,6 +55,7 @@ Generate a distribution tar file for unbound.
                 Detected from svn working copy if not specified.
    -l ldnsdir   Directory where ldns resides. Detected from Makefile.
    -wssl openssl.xx.tar.gz Also build openssl from tarball for windows dist.
+    -wxp expat.xx.tar.gz Also build expat from tarball for windows dist.
    -w ...       Build windows binary dist. last args passed to configure.
 EOF
    exit 1
@@ -135,6 +136,7 @@ RC="no"
 LDNSDIR=""
 DOWIN="no"
 WINSSL=""
+WINEXPAT=""

 # Parse the command line arguments.
 while [ "$1" ]; do
@@ -153,6 +155,10 @@ while [ "$1" ]; do
 	    WINSSL="$2"
 	    shift
 	    ;;
+        "-wxp")
+	    WINEXPAT="$2"
+	    shift
+	    ;;
        "-w")
            DOWIN="yes"
 	    shift
@@ -208,6 +214,22 @@ if [ "$DOWIN" = "yes" ]; then
 		cd ..
 	fi

+	if test -n "$WINEXPAT"; then
+		info "Cross compile $WINEXPAT"
+		info "wxp: tar unpack"
+		(cd ..; gzip -cd $WINEXPAT) | tar xf - || error_cleanup "tar unpack of $WINEXPAT failed"
+		wxpinstall="`pwd`/wxpinstall"
+		cd expat-* || error_cleanup "no expat-X dir in tarball"
+		info "wxp: configure"
+		mingw32-configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib"  || error_cleanup "libexpat configure failed"
+		#info "wxp: make"
+		#make || error_cleanup "libexpat crosscompile failed"
+		info "wxp: make installlib"
+		make installlib || error_cleanup "libexpat install failed"
+		cross_flag="$cross_flag --with-libexpat=$wxpinstall"
+		cd ..
+	fi
+
 	info "Exporting source from SVN."
 	svn export "$SVNROOT" unbound || error_cleanup "SVN command failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from SVN"
@@ -260,14 +282,15 @@ if [ "$DOWIN" = "yes" ]; then
    $strip anchor-update.exe
    $strip unbound-control.exe
    $strip unbound-host.exe
+    $strip unbound-anchor.exe
    $strip unbound-checkconf.exe
    $strip unbound-service-install.exe
    $strip unbound-service-remove.exe
    cd tmp.$$
    cp ../doc/example.conf example.conf
-    cp ../unbound.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt .
+    cp ../unbound.exe ../unbound-anchor.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt .
    # zipfile
-    zip ../$file LICENSE README.txt unbound.exe unbound-host.exe unbound-control.exe unbound-checkconf.exe unbound-service-install.exe unbound-service-remove.exe example.conf service.conf unbound-website.url
+    zip ../$file LICENSE README.txt unbound.exe unbound-anchor.exe unbound-host.exe unbound-control.exe unbound-checkconf.exe unbound-service-install.exe unbound-service-remove.exe example.conf service.conf unbound-website.url
    info "Testing $file"
    (cd .. ; zip -T $file )
    # installer
@@ -385,6 +408,7 @@ replace_all doc/unbound.8.in
 replace_all doc/unbound.conf.5.in
 replace_all doc/unbound-checkconf.8.in
 replace_all doc/unbound-control.8.in
+replace_all doc/unbound-anchor.8.in
 replace_all doc/unbound-host.1
 replace_all doc/libunbound.3.in

@@ -74,6 +74,7 @@ void invalidateQueryInCache(struct module_qstate* qstate, struct query_info* qin
 * 
 * @param qstate: module environment
 * @param pkt: a ldns_buffer which contains ldns_packet data
+ * @return 0 on failure, out of memory or parse error.
 */
 int createResponse(struct module_qstate* qstate, ldns_buffer* pkt);

@@ -180,7 +180,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 0, 0)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 0)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -198,7 +198,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, 0)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -230,7 +230,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, (int)ns->lame, 1)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, (int)ns->lame)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -248,7 +248,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, (int)ns->lame, 1)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, (int)ns->lame)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -630,8 +630,10 @@ dns_cache_lookup(struct module_env* env,
 		lock_rw_unlock(&rrset->entry.lock);
 	}

-	/* see if we have CNAME for this domain */
-	if( (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 
+	/* see if we have CNAME for this domain,
+	 * but not for DS records (which are part of the parent) */
+	if( qtype != LDNS_RR_TYPE_DS &&
+	   (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 
 		LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
 		struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 		if(msg) {
@@ -47,6 +47,10 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/config_file.h"
+#include "iterator/iterator.h"
+
+/** Timeout when only a single probe query per IP is allowed. */
+#define PROBE_MAXRTO 12000 /* in msec */

 size_t 
 infra_host_sizefunc(void* k, void* ATTR_UNUSED(d))
@@ -101,6 +105,7 @@ infra_create(struct config_file* cfg)
 	infra->host_ttl = cfg->host_ttl;
 	infra->lame_ttl = cfg->lame_ttl;
 	infra->max_lame_size = cfg->infra_cache_lame_size;
+	infra->jostle = cfg->jostle_time;
 	return infra;
 }

@@ -122,6 +127,7 @@ infra_adjust(struct infra_cache* infra, struct config_file* cfg)
 	infra->host_ttl = cfg->host_ttl;
 	infra->lame_ttl = cfg->lame_ttl;
 	infra->max_lame_size = cfg->infra_cache_lame_size;
+	infra->jostle = cfg->jostle_time;
 	maxmem = cfg->infra_cache_numhosts * 
 		(sizeof(struct infra_host_key)+sizeof(struct infra_host_data));
 	if(maxmem != slabhash_get_size(infra->hosts) ||
@@ -152,6 +158,19 @@ hash_addr(struct sockaddr_storage* addr, socklen_t addrlen)
 	return h;
 }

+void 
+infra_remove_host(struct infra_cache* infra,
+        struct sockaddr_storage* addr, socklen_t addrlen)
+{
+	struct infra_host_key k;
+	k.addrlen = addrlen;
+	memcpy(&k.addr, addr, addrlen);
+	k.entry.hash = hash_addr(addr, addrlen);
+	k.entry.key = (void*)&k;
+	k.entry.data = NULL;
+	slabhash_remove(infra->hosts, k.entry.hash, &k);
+}
+
 /** lookup version that does not check host ttl (you check it) */
 static struct lruhash_entry* 
 infra_lookup_host_nottl(struct infra_cache* infra,
@@ -197,7 +216,7 @@ host_entry_init(struct infra_cache* infra, struct lruhash_entry* e,
 	rtt_init(&data->rtt);
 	data->edns_version = 0;
 	data->edns_lame_known = 0;
-	data->num_timeouts = 0;
+	data->probedelay = 0;
 }

 /** 
@@ -242,8 +261,10 @@ infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 0);
 	struct infra_host_data* data;
+	int wr = 0;
 	if(e && ((struct infra_host_data*)e->data)->ttl < timenow) {
 		/* it expired, try to reuse existing entry */
+		int old = ((struct infra_host_data*)e->data)->rtt.rto;
 		lock_rw_unlock(&e->lock);
 		e = infra_lookup_host_nottl(infra, addr, addrlen, 1);
 		if(e) {
@@ -251,6 +272,10 @@ infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 			/* re-initialise */
 			/* do not touch lameness, it may be valid still */
 			host_entry_init(infra, e, timenow);
+			wr = 1;
+			/* TOP_TIMEOUT remains on reuse */
+			if(old >= USEFUL_SERVER_TOP_TIMEOUT)
+				((struct infra_host_data*)e->data)->rtt.rto=old;
 		}
 	}
 	if(!e) {
@@ -269,6 +294,22 @@ infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 	*to = rtt_timeout(&data->rtt);
 	*edns_vs = data->edns_version;
 	*edns_lame_known = data->edns_lame_known;
+	if(*to >= PROBE_MAXRTO && rtt_notimeout(&data->rtt)*4 <= *to) {
+		/* delay other queries, this is the probe query */
+		if(!wr) {
+			lock_rw_unlock(&e->lock);
+			e = infra_lookup_host_nottl(infra, addr, addrlen, 1);
+			if(!e) { /* flushed from cache real fast, no use to
+				allocate just for the probedelay */
+				return 1;
+			}
+			data = (struct infra_host_data*)e->data;
+		}
+		/* add 999 to round up the timeout value from msec to sec,
+		 * then add a whole second so it is certain that this probe
+		 * has timed out before the next is allowed */
+		data->probedelay = timenow + ((*to)+1999)/1000;
+	}
 	lock_rw_unlock(&e->lock);
 	return 1;
 }
@@ -456,7 +497,7 @@ infra_update_tcp_works(struct infra_cache* infra,
 	if(data->rtt.rto >= RTT_MAX_TIMEOUT)
 		/* do not disqualify this server altogether, it is better
 		 * than nothing */
-		data->rtt.rto = RTT_MAX_TIMEOUT-1;
+		data->rtt.rto = RTT_MAX_TIMEOUT-1000;
 	lock_rw_unlock(&e->lock);
 }

@@ -481,11 +522,9 @@ infra_rtt_update(struct infra_cache* infra,
 	data = (struct infra_host_data*)e->data;
 	if(roundtrip == -1) {
 		rtt_lost(&data->rtt, orig_rtt);
-		if(data->num_timeouts<255)
-			data->num_timeouts++; 
 	} else {
 		rtt_update(&data->rtt, roundtrip);
-		data->num_timeouts = 0;
+		data->probedelay = 0;
 	}
 	if(data->rtt.rto > 0)
 		rto = data->rtt.rto;
@@ -496,6 +535,27 @@ infra_rtt_update(struct infra_cache* infra,
 	return rto;
 }

+int infra_get_host_rto(struct infra_cache* infra,
+        struct sockaddr_storage* addr, socklen_t addrlen,
+	struct rtt_info* rtt, int* delay, uint32_t timenow)
+{
+	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
+		addrlen, 0);
+	struct infra_host_data* data;
+	int ttl = -2;
+	if(!e) return -1;
+	data = (struct infra_host_data*)e->data;
+	if(data->ttl >= timenow) {
+		ttl = (int)(data->ttl - timenow);
+		memmove(rtt, &data->rtt, sizeof(*rtt));
+		if(timenow < data->probedelay)
+			*delay = (int)(data->probedelay - timenow);
+		else	*delay = 0;
+	}
+	lock_rw_unlock(&e->lock);
+	return ttl;
+}
+
 int 
 infra_edns_update(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen,
@@ -530,8 +590,7 @@ int
 infra_get_lame_rtt(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen,
        uint8_t* name, size_t namelen, uint16_t qtype, 
-	int* lame, int* dnsseclame, int* reclame, int* rtt, int* lost,
-	uint32_t timenow)
+	int* lame, int* dnsseclame, int* reclame, int* rtt, uint32_t timenow)
 {
 	struct infra_host_data* host;
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
@@ -541,7 +600,10 @@ infra_get_lame_rtt(struct infra_cache* infra,
 		return 0;
 	host = (struct infra_host_data*)e->data;
 	*rtt = rtt_unclamped(&host->rtt);
-	*lost = (int)host->num_timeouts;
+	if(host->rtt.rto >= PROBE_MAXRTO && timenow < host->probedelay
+		&& rtt_notimeout(&host->rtt)*4 <= host->rtt.rto)
+		/* single probe for this domain, and we are not probing */
+		*rtt = USEFUL_SERVER_TOP_TIMEOUT;
 	/* check lameness first, if so, ttl on host does not matter anymore */
 	if(infra_lookup_lame(host, name, namelen, timenow, 
 		&dlm, &rlm, &alm, &olm)) {
@@ -576,6 +638,15 @@ infra_get_lame_rtt(struct infra_cache* infra,
 	*dnsseclame = 0;
 	*reclame = 0;
 	if(timenow > host->ttl) {
+		/* expired entry */
+		/* see if this can be a re-probe of an unresponsive server */
+		/* minus 1000 because that is outside of the RTTBAND, so
+		 * blacklisted servers stay blacklisted if this is chosen */
+		if(host->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
+			*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
+			lock_rw_unlock(&e->lock);
+			return 1;
+		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
@@ -64,6 +64,8 @@ struct infra_host_key {
 struct infra_host_data {
 	/** TTL value for this entry. absolute time. */
 	uint32_t ttl;
+	/** time in seconds (absolute) when probing re-commences, 0 disabled */
+	uint32_t probedelay;
 	/** round trip times for timeout calculation */
 	struct rtt_info rtt;
 	/** Names of the zones that are lame. NULL=no lame zones. */
@@ -74,8 +76,6 @@ struct infra_host_data {
 	 * EDNS lame is when EDNS queries or replies are dropped, 
 	 * and cause a timeout */
 	uint8_t edns_lame_known;
-	/** Number of consequtive timeouts; reset when reply arrives OK. */
-	uint8_t num_timeouts;
 };

 /**
@@ -120,6 +120,8 @@ struct infra_cache {
 	int lame_ttl;
 	/** infra lame cache max memory per host, in bytes */
 	size_t max_lame_size;
+	/** jostle timeout in msec */
+	size_t jostle;
 };

 /** infra host cache default hash lookup size */
@@ -140,6 +142,10 @@ struct infra_cache* infra_create(struct config_file* cfg);
 */
 void infra_delete(struct infra_cache* infra);

+/** explicitly delete an infra host element */
+void infra_remove_host(struct infra_cache* infra,
+        struct sockaddr_storage* addr, socklen_t addrlen);
+
 /**
 * Adjust infra cache to use updated configuration settings.
 * This may clean the cache. Operates a bit like realloc.
@@ -169,6 +175,8 @@ struct infra_host_data* infra_lookup_host(struct infra_cache* infra,
 * Find host information to send a packet. Creates new entry if not found.
 * Lameness is empty. EDNS is 0 (try with first), and rtt is returned for 
 * the first message to it.
+ * Use this to send a packet only, because it also locks out others when
+ * probing is restricted.
 * @param infra: infrastructure cache.
 * @param addr: host address.
 * @param addrlen: length of addr.
@@ -261,6 +269,7 @@ int infra_edns_update(struct infra_cache* infra,

 /**
 * Get Lameness information and average RTT if host is in the cache.
+ * This information is to be used for server selection.
 * @param infra: infrastructure cache.
 * @param addr: host address.
 * @param addrlen: length of addr.
@@ -273,16 +282,28 @@ int infra_edns_update(struct infra_cache* infra,
 * @param reclame: if function returns true, this is if it is recursion lame.
 * @param rtt: if function returns true, this returns avg rtt of the server.
 * 	The rtt value is unclamped and reflects recent timeouts.
- * @param lost: number of queries lost in a row.  Reset to 0 when an answer
- * 	gets back.  Gives a connectivity number.
 * @param timenow: what time it is now.
 * @return if found in cache, or false if not (or TTL bad).
 */
 int infra_get_lame_rtt(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen, 
 	uint8_t* name, size_t namelen, uint16_t qtype, 
-	int* lame, int* dnsseclame, int* reclame, int* rtt, int* lost,
-	uint32_t timenow);
+	int* lame, int* dnsseclame, int* reclame, int* rtt, uint32_t timenow);
+
+/**
+ * Get additional (debug) info on timing.
+ * @param infra: infra cache.
+ * @param addr: host address.
+ * @param addrlen: length of addr.
+ * @param rtt: the rtt_info is copied into here (caller alloced return struct).
+ * @param delay: probe delay (if any).
+ * @param timenow: what time it is now.
+ * @return TTL the infra host element is valid for. If -1: not found in cache.
+ *	TTL -2: found but expired.
+ */
+int infra_get_host_rto(struct infra_cache* infra,
+        struct sockaddr_storage* addr, socklen_t addrlen, 
+	struct rtt_info* rtt, int* delay, uint32_t timenow);

 /**
 * Get memory used by the infra cache.
@@ -715,32 +715,6 @@ listen_delete(struct listen_dnsport* front)
 	free(front);
 }

-void listen_pushback(struct listen_dnsport* listen)
-{
-	struct listen_list *p;
-	log_assert(listen);
-	for(p = listen->cps; p; p = p->next)
-	{
-		if(p->com->type != comm_udp &&
-			p->com->type != comm_tcp_accept)
-			continue;
-		comm_point_stop_listening(p->com);
-	}
-}
-
-void listen_resume(struct listen_dnsport* listen)
-{
-	struct listen_list *p;
-	log_assert(listen);
-	for(p = listen->cps; p; p = p->next)
-	{
-		if(p->com->type != comm_udp &&
-			p->com->type != comm_tcp_accept)
-			continue;
-		comm_point_start_listening(p->com, -1, -1);
-	}
-}
-
 struct listen_port* 
 listening_ports_open(struct config_file* cfg)
 {
@@ -770,10 +744,6 @@ listening_ports_open(struct config_file* cfg)
 	if(!do_ip4 && !do_ip6) {
 		return NULL;
 	}
-	if(do_auto && (!do_ip4 || !do_ip6)) {
-		log_warn("interface_automatic option does not work when either do-ip4 or do-ip6 is not enabled. Disabling option.");
-		do_auto = 0;
-	}
 	/* create ip4 and ip6 ports so that return addresses are nice. */
 	if(do_auto || cfg->num_ifs == 0) {
 		if(do_ip6) {
@@ -130,25 +130,6 @@ struct listen_dnsport* listen_create(struct comm_base* base,
 	struct listen_port* ports, size_t bufsize, int tcp_accept_count,
 	comm_point_callback_t* cb, void* cb_arg);

-/**
- * Stop listening to the dnsports. Ports are still open but not checked
- * for readability - performs pushback of the load.
- * @param listen: the listening structs to stop listening on. Note that
- *    udp and tcp-accept handlers stop, but ongoing tcp-handlers are kept
- *    going, since its rude to 'reset connection by peer' them, instead,
- *    we keep them and the callback will be called when its ready. It can
- *    be dropped at that time. New tcp and udp queries can be served by 
- *    other threads.
- */
-void listen_pushback(struct listen_dnsport* listen);
-
-/**
- * Start listening again to the dnsports.
- * Call after the listen_pushback has been called.
- * @param listen: the listening structs to stop listening on.
- */
-void listen_resume(struct listen_dnsport* listen);
-
 /**
 * delete the listening structure
 * @param listen: listening structure.
@@ -698,7 +698,6 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg,
 		!add_as112_default(zones, cfg, buf, "9.e.f.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "a.e.f.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "b.e.f.ip6.arpa.") ||
-		!add_as112_default(zones, cfg, buf, "0.1.1.0.0.2.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "8.b.d.0.1.0.0.2.ip6.arpa.")) {
 		log_err("out of memory adding default zone");
 		return 0;
@@ -63,7 +63,7 @@ struct timehist;
 * Maximum number of mesh state activations. Any more is likely an
 * infinite loop in the module. It is then terminated.
 */
-#define MESH_MAX_ACTIVATION 1000
+#define MESH_MAX_ACTIVATION 3000

 /**
 * Max number of references-to-references-to-references.. search size.
@@ -130,6 +130,65 @@ waiting_tcp_delete(struct waiting_tcp* w)
 	free(w);
 }

+/** 
+ * Pick random outgoing-interface of that family, and bind it.
+ * port set to 0 so OS picks a port number for us.
+ * if it is the ANY address, do not bind.
+ * @param w: tcp structure with destination address.
+ * @param s: socket fd.
+ * @return false on error, socket closed.
+ */
+static int
+pick_outgoing_tcp(struct waiting_tcp* w, int s)
+{
+	struct port_if* pi = NULL;
+	int num;
+#ifdef INET6
+	if(addr_is_ip6(&w->addr, w->addrlen))
+		num = w->outnet->num_ip6;
+	else
+#endif
+		num = w->outnet->num_ip4;
+	if(num == 0) {
+		log_err("no TCP outgoing interfaces of family");
+		log_addr(VERB_OPS, "for addr", &w->addr, w->addrlen);
+#ifndef USE_WINSOCK
+		close(s);
+#else
+		closesocket(s);
+#endif
+		return 0;
+	}
+#ifdef INET6
+	if(addr_is_ip6(&w->addr, w->addrlen))
+		pi = &w->outnet->ip6_ifs[ub_random_max(w->outnet->rnd, num)];
+	else
+#endif
+		pi = &w->outnet->ip4_ifs[ub_random_max(w->outnet->rnd, num)];
+	log_assert(pi);
+	if(addr_is_any(&pi->addr, pi->addrlen)) {
+		/* binding to the ANY interface is for listening sockets */
+		return 1;
+	}
+	/* set port to 0 */
+	if(addr_is_ip6(&pi->addr, pi->addrlen))
+		((struct sockaddr_in6*)&pi->addr)->sin6_port = 0;
+	else	((struct sockaddr_in*)&pi->addr)->sin_port = 0;
+	if(bind(s, (struct sockaddr*)&pi->addr, pi->addrlen) != 0) {
+#ifndef USE_WINSOCK
+		log_err("outgoing tcp: bind: %s", strerror(errno));
+		close(s);
+#else
+		log_err("outgoing tcp: bind: %s", 
+			wsa_strerror(WSAGetLastError()));
+		closesocket(s);
+#endif
+		return 0;
+	}
+	log_addr(VERB_ALGO, "tcp bound to src", &pi->addr, pi->addrlen);
+	return 1;
+}
+
 /** use next free buffer to service a tcp query */
 static int
 outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
@@ -156,6 +215,9 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
 		log_addr(0, "failed address", &w->addr, w->addrlen);
 		return 0;
 	}
+	if(!pick_outgoing_tcp(w, s))
+		return 0;
+
 	fd_set_nonblock(s);
 	if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
 #ifndef USE_WINSOCK
@@ -1243,13 +1305,15 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, now, &vs,
 		&edns_lame_known, &rtt))
 		return 0;
+	sq->last_rtt = rtt;
 	if(sq->status == serviced_initial) {
 		if(edns_lame_known == 0 && rtt > 5000 && rtt < 10001) {
 			/* perform EDNS lame probe - check if server is
 			 * EDNS lame (EDNS queries to it are dropped) */
 			verbose(VERB_ALGO, "serviced query: send probe to see "
 				" if use of EDNS causes timeouts");
-			rtt /= 10;
+			/* even 700 msec may be too small */
+			rtt = 1000;
 			sq->status = serviced_query_PROBE_EDNS;
 		} else if(vs != -1) {
 			sq->status = serviced_query_UDP_EDNS;
@@ -1259,7 +1323,6 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 	}
 	serviced_encode(sq, buff, sq->status == serviced_query_UDP_EDNS);
 	sq->last_sent_time = *sq->outnet->now_tv;
-	sq->last_rtt = rtt;
 	sq->edns_lame_known = (int)edns_lame_known;
 	verbose(VERB_ALGO, "serviced query UDP timeout=%d msec", rtt);
 	sq->pending = pending_udp_query(sq->outnet, buff, &sq->addr, 
@@ -1522,7 +1585,8 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		serviced_callbacks(sq, error, c, rep);
 		return 0;
 	}
-	if(sq->status == serviced_query_UDP_EDNS 
+	if(!fallback_tcp) {
+	    if(sq->status == serviced_query_UDP_EDNS 
 		&& (LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
 			== LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(
 			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL)) {
@@ -1533,7 +1597,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
 		}
 		return 0;
-	} else if(sq->status == serviced_query_PROBE_EDNS) {
+	    } else if(sq->status == serviced_query_PROBE_EDNS) {
 		/* probe without EDNS succeeds, so we conclude that this
 		 * host likely has EDNS packets dropped */
 		log_addr(VERB_DETAIL, "timeouts, concluded that connection to "
@@ -1545,7 +1609,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			log_err("Out of memory caching no edns for host");
 		  }
 		sq->status = serviced_query_UDP;
-	} else if(sq->status == serviced_query_UDP_EDNS && 
+	    } else if(sq->status == serviced_query_UDP_EDNS && 
 		!sq->edns_lame_known) {
 		/* now we know that edns queries received answers store that */
 		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen, 
@@ -1553,7 +1617,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			log_err("Out of memory caching edns works");
 		}
 		sq->edns_lame_known = 1;
-	} else if(sq->status == serviced_query_UDP_EDNS_fallback &&
+	    } else if(sq->status == serviced_query_UDP_EDNS_fallback &&
 		!sq->edns_lame_known && (LDNS_RCODE_WIRE(
 		ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR || 
 		LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
@@ -1568,8 +1632,8 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			log_err("Out of memory caching no edns for host");
 		  }
 		sq->status = serviced_query_UDP;
-	}
-	if(now.tv_sec > sq->last_sent_time.tv_sec ||
+	    }
+	    if(now.tv_sec > sq->last_sent_time.tv_sec ||
 		(now.tv_sec == sq->last_sent_time.tv_sec &&
 		now.tv_usec > sq->last_sent_time.tv_usec)) {
 		/* convert from microseconds to milliseconds */
@@ -1580,7 +1644,8 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		if(!infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen, 
 			roundtime, sq->last_rtt, (uint32_t)now.tv_sec))
 			log_err("out of memory noting rtt.");
-	}
+	    }
+	} /* end of if_!fallback_tcp */
 	/* perform TC flag check and TCP fallback after updating our
 	 * cache entries for EDNS status and RTT times */
 	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) || fallback_tcp) {
@@ -96,6 +96,8 @@ usage()
 	printf("  flush_stats 			flush statistics, make zero\n");
 	printf("  flush_requestlist 		drop queries that are worked on\n");
 	printf("  dump_requestlist		show what is worked on\n");
+	printf("  flush_infra [all | ip] 	remove ping, edns for one IP or all\n");
+	printf("  dump_infra			show ping and edns entries\n");
 	printf("  set_option opt: val		set option to value, no reload\n");
 	printf("  get_option opt		get option value\n");
 	printf("  list_stubs			list stub-zones and root hints in use\n");
@@ -100,15 +100,6 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 	log_assert(0);
 }

-int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
-	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
-{
-	log_assert(0);
-	return 0;
-}
-
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
@@ -140,15 +131,6 @@ worker_alloc_cleanup(void* ATTR_UNUSED(arg))
 	log_assert(0);
 }

-int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
-	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
-{
-	log_assert(0);
-	return 0;
-}
-
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
@@ -5,7 +5,7 @@ NEED_DOXYGEN='01-doc.tpkg'
 NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg fwd_oneport.tpkg fwd_udptmout.tpkg fwd_waitudp.tpkg tcp_sigpipe.tpkg hostsfileosx.tpkg local_nodefault.tpkg fwd_zero.tpkg'
 NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
-NEED_CURL='06-ianaports.tpkg'
+NEED_CURL='06-ianaports.tpkg root_anchor.tpkg'
 NEED_WHOAMI='07-confroot.tpkg'
 NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg'
 NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
@@ -228,7 +228,7 @@ pending_find_match(struct replay_runtime* runtime, struct entry** entry,
 * @param runtime: runtime.
 * @param entry: if true, the entry that matches is returned.
 * @param pend: if true, the outgoing message that matches is returned.
- * return: true if pending query matches the now event.
+ * @return: true if pending query matches the now event.
 */
 static int 
 pending_matches_range(struct replay_runtime* runtime, 
@@ -1119,14 +1119,6 @@ void listening_ports_free(struct listen_port* list)
 	free(list);
 }

-void listen_pushback(struct listen_dnsport* ATTR_UNUSED(listen))
-{
-}
-
-void listen_resume(struct listen_dnsport* ATTR_UNUSED(listen))
-{
-}
-
 struct comm_point* comm_point_create_local(struct comm_base* ATTR_UNUSED(base),
        int ATTR_UNUSED(fd), size_t ATTR_UNUSED(bufsize),
        comm_point_callback_t* ATTR_UNUSED(callback), 
@@ -258,8 +258,7 @@ static struct entry* new_entry()
 * @param buf: is the buffer to store the result in
 * @param offset: is the starting position in the result buffer
 * @param buf_len: is the length of buf.
- *
- * This function returns the length of the result
+ * @return This function returns the length of the result
 */
 static size_t
 hexstr2bin(char *hexstr, int len, uint8_t *buf, size_t offset, size_t buf_len)
@@ -80,7 +80,6 @@ cd $dir
 mv $name.dir/* .

 # EXE
-echo "minitpkg exe $name"
 echo "minitpkg exe $name" > $result
 if test -f $name.pre; then
 	echo "minitpkg exe $name.pre"
@@ -0,0 +1,618 @@
+/*
+ * petal.c - https daemon that is small and beautiful.
+ *
+ * Copyright (c) 2010, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * HTTP1.1/SSL server.
+ */
+
+#include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_OPENSSL_SSL_H
+#include <openssl/ssl.h>
+#endif
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <ctype.h>
+#include <signal.h>
+#if defined(UNBOUND_ALLOC_LITE) || defined(UNBOUND_ALLOC_STATS)
+#ifdef malloc
+#undef malloc
+#endif
+#ifdef free
+#undef free
+#endif
+#endif /* alloc lite or alloc stats */
+
+/** verbosity for this application */
+static int verb = 0;
+
+/** Give petal usage, and exit (1). */
+static void
+usage()
+{
+	printf("Usage:	petal [opts]\n");
+	printf("	https daemon serves files from ./'host'/filename\n");
+	printf("	(no hostname: from the 'default' directory)\n");
+	printf("-a addr		bind to this address, 127.0.0.1\n");
+	printf("-p port		port number, default 443\n");
+	printf("-k keyfile	SSL private key file (PEM), petal.key\n");
+	printf("-c certfile	SSL certificate file (PEM), petal.pem\n");
+	printf("-v		more verbose\n");
+	printf("-h		show this usage help\n");
+	printf("Version %s\n", PACKAGE_VERSION);
+	printf("BSD licensed, see LICENSE in source package for details.\n");
+	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+	exit(1);
+}
+
+/** fatal exit */
+static void print_exit(const char* str) {printf("error %s\n", str); exit(1);}
+/** print errno */
+static void log_errno(const char* str)
+{printf("error %s: %s\n", str, strerror(errno));}
+
+/** parse a text IP address into a sockaddr */
+static int
+parse_ip_addr(char* str, int port, struct sockaddr_storage* ret, socklen_t* l)
+{
+	socklen_t len = 0;
+	struct sockaddr_storage* addr = NULL;
+	struct sockaddr_in6 a6;
+	struct sockaddr_in a;
+	uint16_t p = (uint16_t)port;
+	int fam = 0;
+	memset(&a6, 0, sizeof(a6));
+	memset(&a, 0, sizeof(a));
+
+	if(inet_pton(AF_INET6, str, &a6.sin6_addr) > 0) {
+		/* it is an IPv6 */
+		fam = AF_INET6;
+		a6.sin6_family = AF_INET6;
+		a6.sin6_port = (in_port_t)htons(p);
+		addr = (struct sockaddr_storage*)&a6;
+		len = (socklen_t)sizeof(struct sockaddr_in6);
+	}
+	if(inet_pton(AF_INET, str, &a.sin_addr) > 0) {
+		/* it is an IPv4 */
+		fam = AF_INET;
+		a.sin_family = AF_INET;
+		a.sin_port = (in_port_t)htons(p);
+		addr = (struct sockaddr_storage*)&a;
+		len = (socklen_t)sizeof(struct sockaddr_in);
+	}
+	if(!len) print_exit("cannot parse addr");
+	*l = len;
+	memmove(ret, addr, len);
+	return fam;
+}
+
+/** close the fd */
+static void
+fd_close(int fd)
+{
+#ifndef USE_WINSOCK
+	close(fd);
+#else
+	closesocket(fd);
+#endif
+}
+
+/** 
+ * Read one line from SSL
+ * zero terminates.
+ * skips "\r\n" (but not copied to buf).
+ * @param ssl: the SSL connection to read from (blocking).
+ * @param buf: buffer to return line in.
+ * @param len: size of the buffer.
+ * @return 0 on error, 1 on success.
+ */
+static int
+read_ssl_line(SSL* ssl, char* buf, size_t len)
+{
+	size_t n = 0;
+	int r;
+	int endnl = 0;
+	while(1) {
+		if(n >= len) {
+			if(verb) printf("line too long\n");
+			return 0;
+		}
+		if((r = SSL_read(ssl, buf+n, 1)) <= 0) {
+			if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) {
+				/* EOF */
+				break;
+			}
+			if(verb) printf("could not SSL_read\n");
+			return 0;
+		}
+		if(endnl && buf[n] == '\n') {
+			break;
+		} else if(endnl) {
+			/* bad data */
+			if(verb) printf("error: stray linefeeds\n");
+			return 0;
+		} else if(buf[n] == '\r') {
+			/* skip \r, and also \n on the wire */
+			endnl = 1;
+			continue;
+		} else if(buf[n] == '\n') {
+			/* skip the \n, we are done */
+			break;
+		} else n++;
+	}
+	buf[n] = 0;
+	return 1;
+}
+
+/** process one http header */
+static int
+process_one_header(char* buf, char* file, size_t flen, char* host, size_t hlen,
+	int* vs)
+{
+	if(strncasecmp(buf, "GET ", 4) == 0) {
+		char* e = strstr(buf, " HTTP/1.1");
+		if(!e) e = strstr(buf, " http/1.1");
+		if(!e) {
+			e = strstr(buf, " HTTP/1.0");
+			if(!e) e = strstr(buf, " http/1.0");
+			if(!e) e = strrchr(buf, ' ');
+			if(!e) e = strrchr(buf, '\t');
+			if(e) *vs = 10;
+		}
+		if(e) *e = 0;
+		if(strlen(buf) < 4) return 0;
+		(void)strlcpy(file, buf+4, flen);
+	} else if(strncasecmp(buf, "Host: ", 6) == 0) {
+		(void)strlcpy(host, buf+6, hlen);
+	}
+	return 1;
+}
+
+/** read http headers and process them */
+static int
+read_http_headers(SSL* ssl, char* file, size_t flen, char* host, size_t hlen,
+	int* vs)
+{
+	char buf[1024];
+	file[0] = 0;
+	host[0] = 0;
+	while(read_ssl_line(ssl, buf, sizeof(buf))) {
+		if(verb>=2) printf("read: %s\n", buf);
+		if(buf[0] == 0)
+			return 1;
+		if(!process_one_header(buf, file, flen, host, hlen, vs))
+			return 0;
+	}
+	return 0;
+}
+
+/** setup SSL context */
+static SSL_CTX*
+setup_ctx(char* key, char* cert)
+{
+	SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method());
+	if(!ctx) print_exit("out of memory");
+	(void)SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
+	if(!SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM))
+		print_exit("cannot read cert");
+	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM))
+		print_exit("cannot read key");
+	if(!SSL_CTX_check_private_key(ctx))
+		print_exit("private key is not correct");
+	if(!SSL_CTX_load_verify_locations(ctx, cert, NULL))
+		print_exit("cannot load cert verify locations");
+	return ctx;
+}
+
+/** setup listening TCP */
+static int
+setup_fd(char* addr, int port)
+{
+	struct sockaddr_storage ad;
+	socklen_t len;
+	int fd;
+	int c = 1;
+	int fam = parse_ip_addr(addr, port, &ad, &len);
+	fd = socket(fam, SOCK_STREAM, 0);
+	if(fd == -1) {
+		log_errno("socket");
+		return -1;
+	}
+	if(setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
+		(void*)&c, (socklen_t) sizeof(int)) < 0) {
+		log_errno("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
+	}
+	if(bind(fd, (struct sockaddr*)&ad, len) == -1) {
+		log_errno("bind");
+		fd_close(fd);
+		return -1;
+	}
+	if(listen(fd, 5) == -1) {
+		log_errno("listen");
+		fd_close(fd);
+		return -1;
+	}
+	return fd;
+}
+
+/** setup SSL connection to the client */
+static SSL*
+setup_ssl(int s, SSL_CTX* ctx)
+{
+	SSL* ssl = SSL_new(ctx);
+	if(!ssl) return NULL;
+	SSL_set_accept_state(ssl);
+	(void)SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
+	if(!SSL_set_fd(ssl, s)) {
+		SSL_free(ssl);
+		return NULL;
+	}
+	return ssl;
+}
+
+/** check a file name for safety */
+static int
+file_name_is_safe(char* s)
+{
+	size_t l = strlen(s);
+	if(s[0] != '/')
+		return 0; /* must start with / */
+	if(strstr(s, "/../"))
+		return 0; /* no updirs in URL */
+	if(l>=3 && s[l-1]=='.' && s[l-2]=='.' && s[l-3]=='/')
+		return 0; /* ends with /.. */
+	return 1;
+}
+
+/** adjust host and filename */
+static void
+adjust_host_file(char* host, char* file)
+{
+	size_t i, len;
+	/* remove a port number if present */
+	if(strrchr(host, ':'))
+		*strrchr(host, ':') = 0;
+	/* lowercase */
+	len = strlen(host);
+	for(i=0; i<len; i++)
+		host[i] = tolower((unsigned char)host[i]);
+	len = strlen(file);
+	for(i=0; i<len; i++)
+		file[i] = tolower((unsigned char)file[i]);
+}
+
+/** check a host name for safety */
+static int
+host_name_is_safe(char* s)
+{
+	if(strchr(s, '/'))
+		return 0;
+	if(strcmp(s, "..") == 0)
+		return 0;
+	if(strcmp(s, ".") == 0)
+		return 0;
+	return 1;
+}
+
+/** provide file in whole transfer */
+static void
+provide_file_10(SSL* ssl, char* fname)
+{
+	char* buf, *at;
+	size_t len, avail, header_reserve=1024;
+	FILE* in = fopen(fname, 
+#ifndef USE_WINSOCK
+		"r"
+#else
+		"rb"
+#endif
+		);
+	int r;
+	const char* rcode = "200 OK";
+	if(!in) {
+		char hdr[1024];
+		rcode = "404 File not found";
+		r = snprintf(hdr, sizeof(hdr), "HTTP/1.1 %s\r\n\r\n", rcode);
+		if(SSL_write(ssl, hdr, r) <= 0) {
+			/* write failure */
+		}
+		return;
+	}
+	fseek(in, 0, SEEK_END);
+	len = (size_t)ftell(in);
+	fseek(in, 0, SEEK_SET);
+	/* plus some space for the header */
+	buf = (char*)malloc(len+header_reserve);
+	if(!buf) {
+		fclose(in);
+		return;
+	}
+	avail = len+header_reserve;
+	at = buf;
+	r = snprintf(at, avail, "HTTP/1.1 %s\r\n", rcode);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Server: petal/%s\r\n", PACKAGE_VERSION);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Content-Length: %u\r\n", (unsigned)len);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "\r\n");
+	at += r;
+	avail -= r;
+	if(avail < len) { /* robust */
+		free(buf);
+		fclose(in);
+		return;
+	}
+	if(fread(at, 1, len, in) != len) {
+		free(buf);
+		fclose(in);
+		return;
+	}
+	fclose(in);
+	at += len;
+	avail -= len;
+	if(SSL_write(ssl, buf, at-buf) <= 0) {
+		/* write failure */
+	}
+	free(buf);
+}
+
+/** provide file over SSL, chunked encoding */
+static void
+provide_file_chunked(SSL* ssl, char* fname)
+{
+	char buf[16384];
+	char* at = buf;
+	size_t avail = sizeof(buf);
+	int r;
+	FILE* in = fopen(fname, 
+#ifndef USE_WINSOCK
+		"r"
+#else
+		"rb"
+#endif
+		);
+	const char* rcode = "200 OK";
+	if(!in) {
+		rcode = "404 File not found";
+	}
+
+	/* print headers */
+	r = snprintf(at, avail, "HTTP/1.1 %s\r\n", rcode);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Server: petal/%s\r\n", PACKAGE_VERSION);
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Transfer-Encoding: chunked\r\n");
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "Connection: close\r\n");
+	at += r;
+	avail -= r;
+	r = snprintf(at, avail, "\r\n");
+	at += r;
+	avail -= r;
+	if(avail < 16) { /* robust */
+		if(in) fclose(in);
+		return;
+	}
+
+	do {
+		char tmpbuf[sizeof(buf)];
+		/* read chunk; space-16 for xxxxCRLF..CRLF0CRLFCRLF (3 spare)*/
+		size_t red = in?fread(tmpbuf, 1, avail-16, in):0;
+		/* prepare chunk */
+		r = snprintf(at, avail, "%x\r\n", (unsigned)red);
+		if(verb >= 3)
+		{printf("chunk len %x\n", (unsigned)red); fflush(stdout);}
+		at += r;
+		avail -= r;
+		if(red != 0) {
+			if(red > avail) break; /* robust */
+			memmove(at, tmpbuf, red);
+			at += red;
+			avail -= red;
+			r = snprintf(at, avail, "\r\n");
+			at += r;
+			avail -= r;
+		}
+		if(in && feof(in) && red != 0) {
+			r = snprintf(at, avail, "0\r\n");
+			at += r;
+			avail -= r;
+		}
+		if(!in || feof(in)) {
+			r = snprintf(at, avail, "\r\n");
+			at += r;
+			avail -= r;
+		}
+		/* send chunk */
+		if(SSL_write(ssl, buf, at-buf) <= 0) {
+			/* SSL error */
+			break;
+		}
+
+		/* setup for next chunk */
+		at = buf;
+		avail = sizeof(buf);
+	} while(in && !feof(in) && !ferror(in));
+
+	if(in) fclose(in);
+}
+
+/** provide service to the ssl descriptor */
+static void
+service_ssl(SSL* ssl, struct sockaddr_storage* from, socklen_t falen)
+{
+	char file[1024];
+	char host[1024];
+	char combined[2048];
+	int vs = 11;
+	if(!read_http_headers(ssl, file, sizeof(file), host, sizeof(host),
+		&vs))
+		return;
+	adjust_host_file(host, file);
+	if(host[0] == 0 || !host_name_is_safe(host))
+		(void)strlcpy(host, "default", sizeof(host));
+	if(!file_name_is_safe(file)) {
+		return;
+	}
+	snprintf(combined, sizeof(combined), "%s%s", host, file);
+	if(verb) {
+		char out[100];
+		void* a = &((struct sockaddr_in*)from)->sin_addr;
+		if(falen != (socklen_t)sizeof(struct sockaddr_in))
+			a = &((struct sockaddr_in6*)from)->sin6_addr;
+		out[0]=0;
+		(void)inet_ntop((int)((struct sockaddr_in*)from)->sin_family,
+			a, out, (socklen_t)sizeof(out));
+		printf("%s requests %s\n", out, combined);
+		fflush(stdout);
+	}
+	if(vs == 10)
+		provide_file_10(ssl, combined);
+	else	provide_file_chunked(ssl, combined);
+}
+
+/** provide ssl service */
+static void
+do_service(char* addr, int port, char* key, char* cert)
+{
+	SSL_CTX* sslctx = setup_ctx(key, cert);
+	int fd = setup_fd(addr, port);
+	int go = 1;
+	if(fd == -1) print_exit("could not setup sockets");
+	if(verb) {printf("petal start\n"); fflush(stdout);}
+	while(go) {
+		struct sockaddr_storage from;
+		socklen_t flen = (socklen_t)sizeof(from);
+		int s = accept(fd, (struct sockaddr*)&from, &flen);
+		if(verb) fflush(stdout);
+		if(s != -1) {
+			SSL* ssl = setup_ssl(s, sslctx);
+			if(verb) fflush(stdout);
+			if(ssl) {
+				service_ssl(ssl, &from, flen);
+				if(verb) fflush(stdout);
+				SSL_shutdown(ssl);
+				SSL_free(ssl);
+			}
+			fd_close(s);
+		} else if (verb >=2) log_errno("accept");
+		if(verb) fflush(stdout);
+	}
+	/* if we get a kill signal, the process dies and the OS reaps us */
+	if(verb) printf("petal end\n");
+	fd_close(fd);
+	SSL_CTX_free(sslctx);
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** Main routine for petal */
+int main(int argc, char* argv[])
+{
+	int c;
+	int port = 443;
+	char* addr = "127.0.0.1", *key = "petal.key", *cert = "petal.pem";
+#ifdef USE_WINSOCK
+	WSADATA wsa_data;
+	if((c=WSAStartup(MAKEWORD(2,2), &wsa_data)) != 0)
+	{	printf("WSAStartup failed\n"); exit(1); }
+	atexit((void (*)(void))WSACleanup);
+#endif
+
+	/* parse the options */
+	while( (c=getopt(argc, argv, "a:c:k:hp:v")) != -1) {
+		switch(c) {
+		case 'a':
+			addr = optarg;
+			break;
+		case 'c':
+			cert = optarg;
+			break;
+		case 'k':
+			key = optarg;
+			break;
+		case 'p':
+			port = atoi(optarg);
+			break;
+		case 'v':
+			verb++;
+			break;
+		case '?':
+		case 'h':
+		default:
+			usage();
+		}
+	}
+	argc -= optind;
+	argv += optind;
+	if(argc != 0)
+		usage();
+
+#ifdef SIGPIPE
+	(void)signal(SIGPIPE, SIG_IGN);
+#endif
+	ERR_load_crypto_strings();
+	ERR_load_SSL_strings();
+	OpenSSL_add_all_algorithms();
+	(void)SSL_library_init();
+
+	do_service(addr, port, key, cert);
+
+	CRYPTO_cleanup_all_ex_data();
+	ERR_remove_state(0);
+	ERR_free_strings();
+	RAND_cleanup();
+	return 0;
+}
@@ -251,6 +251,7 @@ void remove_configfile(void)
 * Main fake event test program. Setup, teardown and report errors.
 * @param argc: arg count.
 * @param argv: array of commandline arguments.
+ * @return program failure if test fails.
 */
 int 
 main(int argc, char* argv[])
@@ -267,7 +268,6 @@ main(int argc, char* argv[])
 	(void)putenv("TZ=UTC");

 	log_init(NULL, 0, NULL);
-	log_info("Start of %s testbound program.", PACKAGE_STRING);
 	/* determine commandline options for the daemon */
 	pass_argc = 1;
 	pass_argv[0] = "unbound";
@@ -321,6 +321,7 @@ main(int argc, char* argv[])
 		testbound_usage();
 		return 1;
 	}
+	log_info("Start of %s testbound program.", PACKAGE_STRING);
 	if(atexit(&remove_configfile) != 0)
 		fatal_exit("atexit() failed: %s", strerror(errno));

@@ -304,6 +304,34 @@ net_test(void)
 		unit_assert(ipstrtoaddr("2::ffff:192.168.0.2", 53, &a, &l));
 		unit_assert(!addr_is_ip4mapped(&a, l));
 	}
+	/* test addr_is_any */
+	unit_show_func("util/net_help.c", "addr_is_any");
+	if(1) {
+		struct sockaddr_storage a;
+		socklen_t l = (socklen_t)sizeof(a);
+		unit_assert(ipstrtoaddr("0.0.0.0", 53, &a, &l));
+		unit_assert(addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("0.0.0.0", 10053, &a, &l));
+		unit_assert(addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("0.0.0.0", 0, &a, &l));
+		unit_assert(addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("::0", 0, &a, &l));
+		unit_assert(addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("::0", 53, &a, &l));
+		unit_assert(addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("::1", 53, &a, &l));
+		unit_assert(!addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("2001:1667::1", 0, &a, &l));
+		unit_assert(!addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("2001::0", 0, &a, &l));
+		unit_assert(!addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("10.0.0.0", 0, &a, &l));
+		unit_assert(!addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("0.0.0.10", 0, &a, &l));
+		unit_assert(!addr_is_any(&a, l));
+		unit_assert(ipstrtoaddr("192.0.2.1", 0, &a, &l));
+		unit_assert(!addr_is_any(&a, l));
+	}
 }

 #include "util/config_file.h"
@@ -487,6 +515,7 @@ void unit_show_feature(const char* feature)
 * Main unit test program. Setup, teardown and report errors.
 * @param argc: arg count.
 * @param argv: array of commandline arguments.
+ * @return program failure if test fails.
 */
 int 
 main(int argc, char* argv[])
@@ -161,7 +161,7 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
 			rrset->rk.dname, ntohs(rrset->rk.type),
 			ntohs(rrset->rk.rrset_class));
 	}
-	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, &reason);
+	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, 1, &reason);
 	if(vsig) {
 		printf("verify outcome is: %s %s\n", sec_status_to_string(sec),
 			reason?reason:"");
@@ -0,0 +1 @@
+example.com.	3600	IN	DS	57024 7 1 46d134be319b2cc910b9938f1cb25dc41abb27bf ; xicit-citor-vasin-rarus-nygir-nagam-zulor-dylos-gokar-ranor-zixyx
@@ -0,0 +1 @@
+example.com.	3600	IN	DNSKEY	257 3 7 AwEAAbvre/wK/WVeoj0SiwVkTD+NefvHPru9YIqLWY0m+0E5NYOpJZdc+PGQQYRzFNOlugVZtFirmv5Lmz7GNiASXtG/IFi//SlE30DxEKQOjt2F6qSZTZ1nZ5XOIMGTwWyp4OoI0egk5JavC5mQbyXqcj82ywt6F5Z3CmnThVl6MtOv ;{id = 57024 (ksk), size = 1024b}
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 7 (RSASHA1_NSEC3)
+Modulus: u+t7/Ar9ZV6iPRKLBWRMP415+8c+u71giotZjSb7QTk1g6kll1z48ZBBhHMU06W6BVm0WKua/kubPsY2IBJe0b8gWL/9KUTfQPEQpA6O3YXqpJlNnWdnlc4gwZPBbKng6gjR6CTklq8LmZBvJepyPzbLC3oXlncKadOFWXoy068=
+PublicExponent: AQAB
+PrivateExponent: WsmD1trAXS8BFpxUycARDksdecRizHTLpWN5WjZRAMvQzND1NlFWe+4DmSe4EiBo5JjYBlaxxNVmJUfBcnEtmTfED52KiOfvMQFS8ii+14UqZqLj6iyqh9MeWsxAzC3J0A+nBu7lAgqvwCCqrqSOmF/8EJSZWEGla8qWylKMgyE=
+Prime1: 4hE5iju9vDvbPCmy4+K6nwELakuyrcaxdvPxEUicSkbTpBRnIDuerGJySnuNbiLScq7WUyJsjLsq0wOFNCtlVw==
+Prime2: 1M0299YZUU0NxAGMFeKEQAvuO0r3zXbgURwLyXLoerhs1K6S1szT+/vgbPLwL55IR7A/LDa6u6SqMrqdGqb1aQ==
+Exponent1: csYd+YGVNdEJ4ISnLy24Y+vK2N+vyqxbAzKcjJLZzpgg8WfuZ539VDXzIr+RsX36bIE5jSGoDNclydY6tZ7mpw==
+Exponent2: yF2NMyAA6J8fpf069GQ6178kCeoVlv0mStiYdI5gPSSnPD4/fkaQFsPbVVoNMxjav71AThYeDo4Fvwwc3rpzeQ==
+Coefficient: gIrzPgL4XhCn/yP0qRCqBTmnqRLeEvRsYNz2T8gsyVGc9gyt/9ouhKOGGHmD2DJf7yWfJiQEEuhw+lBBTNNKtQ==
@@ -0,0 +1,437 @@
+; config options
+; The island of trust is at example.com (the DLV repository)
+server:
+	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	trust-anchor: "example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator, DLV to zone below optout, check negative cache.
+; DLV example.com.
+; trust anchor at example.net but no secure delegation to
+; sub.example.net  signed with DLV but not by parent.
+; parent uses optout NSEC3.
+; then a signed delegation to down.sub.example.net.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN A
+SECTION AUTHORITY
+net.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN A
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.5
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; DLV query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.net.example.com. IN DLV
+SECTION ANSWER
+sub.example.net.example.com.	3600	IN	DLV	30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
+sub.example.net.example.com.	3600	IN	RRSIG	DLV 3 5 3600 20070926135752 20070829135752 2854 example.com. AAdhy87nuDEaxmc+k9pJHYnhKiEYL++OLPxzOdwEQOtsHi7jeD3lRDU= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+down.sub.example.net.example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+sub.example.net.example.com. IN NSEC zzz.example.net.example.com. RRSIG NSEC DLV
+sub.example.net.example.com.	3600	IN	RRSIG	NSEC 3 5 3600 20070926134150 20070829134150 2854 example.com. AG/M+H/lex1CMTIuO+JpdmTjCzt7XBsLtRLPDfYTykhxnnECzZwkMnQ= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net.example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+example.com IN NSEC sub.example.net.example.com. SOA NS RRSIG NSEC
+example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. ALITtZY03PDWnuAeEL/5VwMIXY3iC2y7Qkeq5DgAHmPbNyWiOmJNEKg= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+com.example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+example.com IN NSEC sub.example.net.example.com. SOA NS RRSIG NSEC
+example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. ALITtZY03PDWnuAeEL/5VwMIXY3iC2y7Qkeq5DgAHmPbNyWiOmJNEKg= ;{id = 2854}
+ENTRY_END
+
+RANGE_END
+
+; ns.example.net.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+; DS RR is
+; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
+; DNSKEY prime query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN DNSKEY
+SECTION ANSWER
+example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
+SECTION AUTHORITY
+example.net.    IN NS   ns.example.net.
+example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.net.         IN      A       1.2.3.5
+ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
+ENTRY_END
+
+; NS query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN NS
+SECTION ANSWER
+example.net.    IN NS   ns.example.net.
+example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.net.         IN      A       1.2.3.5
+ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
+ENTRY_END
+
+; no DS to sub.example.net, optout NSEC3.
+; NSEC3PARAM 1 1 31 DE15C001
+; example.net. 		-> hk4jq0lg6q3bt992urc88dqten1k2be8.
+; sub.example.net. 	-> ecs17hqd0kf7dk9g1cjvevj25pginrf2.
+; *.example.net. 	-> 1tgbedpeeuubbsejh2dqvso62f8n4dk1.
+; down.sub.example.net. -> 9j1r8re9b1238vd907tilclgat1i0fre.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id 
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.net. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+example.net. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.net.	3600	IN	RRSIG	SOA 5 2 3600 20070926134150 20070829134150 30899 example.net. ELVULZHTRc0Qk06rSBRnB/T6sm1+AbAtdEJHN6PCsz2Z3s3E5A8NH7Krz0VzRaYIEUStnbAtuE3oP8XHWHBnyQ== ;{id = 30899}
+; CE is example.net
+hk4jq0lg6q3bt992urc88dqten1k2be8.example.net. IN NSEC3 1 1 31 DE15C001 hl4jq0lg6q3bt992urc88dqten1k2be8 NS SOA NAPTR RRSIG DNSKEY NSEC3PARAM
+hk4jq0lg6q3bt992urc88dqten1k2be8.example.net.	3600	IN	RRSIG	NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. n1dQKbRoB+X4K003RAhdUp6ZUP5dCiwQi+apGfLII8wmCUmw/cKiz7/Ijhs/+88hZwq/7yhlZM0D/yqAUKUiAA== ;{id = 30899}
+; NC covers sub.example.net
+ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net. IN NSEC3 1 1 31 de15c001 efs17hqd0kf7dk9g1cjvevj25pginrf2 A RRSIG
+ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net.	3600	IN	RRSIG	NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. oSVB7Dyp7/yaOlT8AFwBJZdqwRRSQ8XFzCpu1AP51JPIuhCg5byepdvY6UC3xXc7YVO6h74tpxFCGqLpRXwDoQ== ;{id = 30899}
+SECTION ADDITIONAL
+ENTRY_END
+
+; delegation to sub.example.net, optout NSEC3.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.net. IN NS
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.net.    IN NS   ns.sub.example.net.
+hk4jq0lg6q3bt992urc88dqten1k2be8.example.net. IN NSEC3 1 1 31 DE15C001 hl4jq0lg6q3bt992urc88dqten1k2be8 NS SOA NAPTR RRSIG DNSKEY NSEC3PARAM
+hk4jq0lg6q3bt992urc88dqten1k2be8.example.net.	3600	IN	RRSIG	NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. n1dQKbRoB+X4K003RAhdUp6ZUP5dCiwQi+apGfLII8wmCUmw/cKiz7/Ijhs/+88hZwq/7yhlZM0D/yqAUKUiAA== ;{id = 30899}
+ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net. IN NSEC3 1 1 31 de15c001 efs17hqd0kf7dk9g1cjvevj25pginrf2 A RRSIG
+ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net.	3600	IN	RRSIG	NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. oSVB7Dyp7/yaOlT8AFwBJZdqwRRSQ8XFzCpu1AP51JPIuhCg5byepdvY6UC3xXc7YVO6h74tpxFCGqLpRXwDoQ== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.net.         IN      A       1.2.3.6
+ENTRY_END
+
+
+RANGE_END
+
+; ns.sub.example.net.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+; DS is
+; sub.example.net.	3600	IN	DS	30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
+; DNSKEY query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.net. IN DNSKEY
+SECTION ANSWER
+sub.example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.net.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. PATh0K1jz9QeN02C79noX9gwK+Nr5VznWPQwygm/pYDsOb0z3EsaiOrzyoreegDKgoNn3kN0CywS+usCWM6hrw== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.net.    IN NS   ns.sub.example.net.
+sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.net.         IN      A       1.2.3.6
+ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
+ENTRY_END
+
+; NS query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.net. IN NS
+SECTION ANSWER
+sub.example.net.    IN NS   ns.sub.example.net.
+sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.net.         IN      A       1.2.3.6
+ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
+ENTRY_END
+
+; www.sub.example.net query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.net. IN A
+SECTION ANSWER
+www.sub.example.net. IN A 10.20.30.40
+www.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. Q+88AIM3K8q6S0bHeFVT742EepZFxOxgtaL1V68DEkP4NePKzL4zttWQD3uI/5ALw/fIrC7G43Eo+epWn2ZGCA== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.net.    IN NS   ns.sub.example.net.
+sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.net.         IN      A       1.2.3.6
+ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
+ENTRY_END
+
+; DS for down.sub.example.net
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+down.sub.example.net. IN DS
+SECTION ANSWER
+down.sub.example.net.   3600    IN      DS      60946 5 1 c636304ab7cdb6272215aceac95a8d312ac7a4f6 
+down.sub.example.net.	3600	IN	RRSIG	DS 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AMc8J534UF2+0PtPSNBw6RzN4Q5gXfnBXiUfpuT/MR1YtOE/5AP/0dTgvqvKRiFZx3NjOPeZmRnaabxkw0Qzrw== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; delegation to down.sub.example.net
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+down.sub.example.net. IN NS
+SECTION ANSWER
+SECTION AUTHORITY
+down.sub.example.net. IN NS ns.down.sub.example.net.
+; the DS record is not given (like it was parent and child hosted on the same
+; server)
+;down.sub.example.net.   3600    IN      DS      60946 5 1 c636304ab7cdb6272215aceac95a8d312ac7a4f6 
+;down.sub.example.net.	3600	IN	RRSIG	DS 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AMc8J534UF2+0PtPSNBw6RzN4Q5gXfnBXiUfpuT/MR1YtOE/5AP/0dTgvqvKRiFZx3NjOPeZmRnaabxkw0Qzrw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.down.sub.example.net. IN A 1.2.3.7
+ENTRY_END
+
+RANGE_END
+
+; ns.down.sub.example.net.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.7
+; DNSKEY query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+down.sub.example.net. IN DNSKEY
+SECTION ANSWER
+down.sub.example.net.	3600	IN	DNSKEY	257 3 5 AwEAAeiaUiUIpWMfYz5L0sfJTZWnuN9IyBX4em9VjsoqQTsOD1HDQpNb4buvJo7pN2aBCxNS7e0OL8e2mVB6CLZ+8ek= ;{id = 60946 (ksk), size = 512b}
+down.sub.example.net.	3600	IN	RRSIG	DNSKEY 5 4 3600 20070926134150 20070829134150 60946 down.sub.example.net. lK5HNva/IPw0CS9BfBd16fqm5y9bgCSwGsBLBAA1d5SCcKep6AVrv6NFuXl12d1G3MdQ4ruHi6eDDO5dhtkfrw== ;{id = 60946}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; www.down.sub.example.net.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.down.sub.example.net. IN A
+SECTION ANSWER
+www.down.sub.example.net. IN A 10.20.30.44
+www.down.sub.example.net.	3600	IN	RRSIG	A 5 5 3600 20070926134150 20070829134150 60946 down.sub.example.net. Hg5WF/xW8PRth2rl1mZcYK8/pgGpM73e/fD+mH/XElEKgL9zq0ou8psA0I6OvMLGBN6RQeknQHRAy3D2/5k/Wg== ;{id = 60946}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.down.sub.example.net. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.down.sub.example.net. IN A
+SECTION ANSWER
+www.down.sub.example.net. IN A 10.20.30.44
+www.down.sub.example.net.	3600	IN	RRSIG	A 5 5 3600 20070926134150 20070829134150 60946 down.sub.example.net. Hg5WF/xW8PRth2rl1mZcYK8/pgGpM73e/fD+mH/XElEKgL9zq0ou8psA0I6OvMLGBN6RQeknQHRAy3D2/5k/Wg== ;{id = 60946}
+ENTRY_END
+
+SCENARIO_END
@@ -145,7 +145,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA NOERROR
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
@@ -5,7 +5,7 @@ server:
 	private-address: 10.0.0.0/8
 	private-address: 172.16.0.0/12
 	private-address: 192.168.0.0/16
-	private-address: 192.254.0.0/16
+	private-address: 169.254.0.0/16
 	private-address: fd00::/8
 	private-address: fe80::/10

@@ -0,0 +1,64 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 81.187.81.187
+stub-zone:
+        name: "lp0.eu"
+	stub-addr: 81.2.80.65
+	stub-prime: no
+CONFIG_END
+
+SCENARIO_BEGIN Test resolve of stub zone without root prime.
+
+; this server does not respond. (for the root)
+RANGE_BEGIN 0 100
+	ADDRESS 81.187.81.187
+ENTRY_BEGIN
+MATCH
+ADJUST copy_id copy_query
+REPLY QR SERVFAIL
+SECTION QUESTION
+. IN NS
+ENTRY_END
+RANGE_END
+
+; lp0.eu server
+RANGE_BEGIN 0 100
+	ADDRESS 81.2.80.65
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+proxima.lp0.eu. IN A
+SECTION ANSWER
+proxima.lp0.eu. IN A 81.2.80.65
+SECTION AUTHORITY
+lp0.eu. IN NS proxima.lp0.eu.
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+proxima.lp0.eu. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+proxima.lp0.eu. IN A
+SECTION ANSWER
+proxima.lp0.eu. IN A 81.2.80.65
+SECTION AUTHORITY
+lp0.eu. IN NS proxima.lp0.eu.
+ENTRY_END
+
+SCENARIO_END
@@ -420,7 +420,7 @@ ENTRY_END
 STEP 41 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all ttl
-REPLY QR RD RA NOERROR
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 www.foo.com. IN A
 SECTION ANSWER
@@ -157,7 +157,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA AD NXDOMAIN
 SECTION QUESTION
 cname.example.com. IN A
 SECTION ANSWER
@@ -217,7 +217,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA AD NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
@@ -0,0 +1,158 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with CNAME to insecure NSEC delegation
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN CNAME www.sub.example.com.
+www.example.com.	3600	IN	RRSIG	CNAME 3 3 3600 20070926134802 20070829134802 2854 example.com. AKvv+5rFiCFiNRbdpna4rQtyARsLltUL9lXRWgpBVB5voJNJ9g/n/f4= ;{id = 2854}
+SECTION AUTHORITY
+sub.example.com. IN NSEC zzz.example.com. NS
+sub.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134802 20070829134802 2854 example.com. AJPvjSrqGbe3ZBOxV9J3XyFeOqrcPfIYPIWnlmj6G+PebJdAkvwIu9o= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+; this server also serves the zone sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+sub.example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN CNAME www.sub.example.com.
+www.example.com.	3600	IN	RRSIG	CNAME 3 3 3600 20070926134802 20070829134802 2854 example.com. AKvv+5rFiCFiNRbdpna4rQtyARsLltUL9lXRWgpBVB5voJNJ9g/n/f4= ;{id = 2854}
+SECTION AUTHORITY
+sub.example.com. IN NSEC zzz.example.com. NS
+sub.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134802 20070829134802 2854 example.com. AJPvjSrqGbe3ZBOxV9J3XyFeOqrcPfIYPIWnlmj6G+PebJdAkvwIu9o= ;{id = 2854}
+sub.example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+SCENARIO_END
@@ -217,7 +217,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA AD NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
@@ -0,0 +1,162 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with CNAME to insecure optin NSEC3
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN CNAME www.sub.example.com.
+www.example.com.	3600	IN	RRSIG	CNAME 3 3 3600 20070926134802 20070829134802 2854 example.com. AKvv+5rFiCFiNRbdpna4rQtyARsLltUL9lXRWgpBVB5voJNJ9g/n/f4= ;{id = 2854}
+SECTION AUTHORITY
+; NSEC3PARAM 1 0 1 -
+; example.com. -> 9vq38lj9qs6s1aruer131mbtsfnvek2p.
+; sub.example.com. -> 7t1ect6t5vp0s7se8si9d07roqupr3gc.
+; www.example.com. -> 0lverorlcjoa2lji5rik0otij3lgoj3l.
+7t1ect6t5vp0s7se8si9d07roqupr3gc.example.com. IN NSEC3 1 0 1 - 7t1ect6t5vp0s7se8si9d07roqupr3gd NS
+7t1ect6t5vp0s7se8si9d07roqupr3gc.example.com.	3600	IN	RRSIG	NSEC3 3 3 3600 20070926134802 20070829134802 2854 example.com. AIiTSxI4hTDiDzo+bMaOKSvjIyoChgjY19y2NQG/Mtt80sNbDBY126I= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+; this server also serves the zone sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+sub.example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN CNAME www.sub.example.com.
+www.example.com.	3600	IN	RRSIG	CNAME 3 3 3600 20070926134802 20070829134802 2854 example.com. AKvv+5rFiCFiNRbdpna4rQtyARsLltUL9lXRWgpBVB5voJNJ9g/n/f4= ;{id = 2854}
+SECTION AUTHORITY
+7t1ect6t5vp0s7se8si9d07roqupr3gc.example.com. IN NSEC3 1 0 1 - 7t1ect6t5vp0s7se8si9d07roqupr3gd NS
+7t1ect6t5vp0s7se8si9d07roqupr3gc.example.com.	3600	IN	RRSIG	NSEC3 3 3 3600 20070926134802 20070829134802 2854 example.com. AIiTSxI4hTDiDzo+bMaOKSvjIyoChgjY19y2NQG/Mtt80sNbDBY126I= ;{id = 2854}
+sub.example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+SCENARIO_END
@@ -219,7 +219,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA AD NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
@@ -131,8 +131,8 @@ SECTION AUTHORITY
 ; SOA record is missing in reply.
 ; Denies A, note this is the end of the NSEC chain.
 ; from wrong side of zone-cut
-www.example.com.	IN	NSEC	example.com. NS RRSIG NSEC
-www.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926135752 20070829135752 2854 example.com. MCwCFCQcnUp3juEjo72FpC82jFwZ2DStAhQpwpdMvEycW2elKfxpDdIHlT5ERg== ;{id = 2854}
+www.example.com.	3600	IN	NSEC	example.com. NS DS RRSIG NSEC 
+www.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926135752 20070829135752 2854 example.com. AA+3mzAYPyQ8G9EKxeyNM+UZY+RtCiS5BOkS8h4wSxMT3lfVdadGpn8= ;{id = 2854}
 SECTION ADDITIONAL
 ENTRY_END
 RANGE_END
@@ -201,7 +201,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA AD NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
@@ -0,0 +1,207 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com. DS 57024 7 1 46d134be319b2cc910b9938f1cb25dc41abb27bf"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with optout NSEC3 response that gets no AD.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.	3600	IN	RRSIG	NS 7 2 3600 20070926134150 20070829134150 57024 example.com. fIE3H2v3wAm3GPajsdgJn+A8R4Cp7dMXf1PSUQ8BfklzMBMJjpc0oM/S7u/HVLYQs1jx8CMdw2TZEpIPfo6Rl0TekDqNtVk6IBw1H+zxDFwf3v7UdOjm8s6FfoEJcZ5yEFV/Lps82NzHCR9uqprhv6ddQdAeVNA5QHis1c5Y1P0= ;{id = 57024}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 7 3 3600 20070926134150 20070829134150 57024 example.com. b0iX5vuTqngB5F0ORFrFLx8sAeTHGJVcPpD34iNFY71ZoFnHrHfAMWC3RAWz+nQ1NmH1oDdA8NTYN/aQQNzwEz4VmVYA2PANBSiwSY3q3gp9PWZU6CfRNf2dU/210H0y35FroQpADszmwC+Hlbcvll+bQj3fSyT2W/69kRVssj4= ;{id = 57024}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.	3600	IN	DNSKEY	257 3 7 AwEAAbvre/wK/WVeoj0SiwVkTD+NefvHPru9YIqLWY0m+0E5NYOpJZdc+PGQQYRzFNOlugVZtFirmv5Lmz7GNiASXtG/IFi//SlE30DxEKQOjt2F6qSZTZ1nZ5XOIMGTwWyp4OoI0egk5JavC5mQbyXqcj82ywt6F5Z3CmnThVl6MtOv ;{id = 57024 (ksk), size = 1024b}
+example.com.	3600	IN	RRSIG	DNSKEY 7 2 3600 20070926134150 20070829134150 57024 example.com. lqOo8W7UffLZIKBoIJg8OAPkmCWptnstiLIg1bAtzuEZDZFr2KNZGv+5k6hbRJKYnZRLReY4v8G9Eg0GCC/44gLm8BZlnh/4jLOjMH9MKusFV/jNqz/HABITYn1pBwvVak7lzqN+bmL0KMyWf1MzPWilx4fM9YWinsQFILVLPL0= ;{id = 57024}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 7 2 3600 20070926134150 20070829134150 57024 example.com. fIE3H2v3wAm3GPajsdgJn+A8R4Cp7dMXf1PSUQ8BfklzMBMJjpc0oM/S7u/HVLYQs1jx8CMdw2TZEpIPfo6Rl0TekDqNtVk6IBw1H+zxDFwf3v7UdOjm8s6FfoEJcZ5yEFV/Lps82NzHCR9uqprhv6ddQdAeVNA5QHis1c5Y1P0= ;{id = 57024}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 7 3 3600 20070926134150 20070829134150 57024 example.com. b0iX5vuTqngB5F0ORFrFLx8sAeTHGJVcPpD34iNFY71ZoFnHrHfAMWC3RAWz+nQ1NmH1oDdA8NTYN/aQQNzwEz4VmVYA2PANBSiwSY3q3gp9PWZU6CfRNf2dU/210H0y35FroQpADszmwC+Hlbcvll+bQj3fSyT2W/69kRVssj4= ;{id = 57024}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.	3600	IN	RRSIG	SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+
+; optout
+; example.com. -> onib9mgub9h0rml3cdf5bgrj59dkjhvk.
+; sub.example.com. -> kg19n32806c832kijdnglq8p9m2r5mdj.
+; *.example.com. -> 4f3cnt8cu22tngec382jj4gde4rb47ub.
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com. NSEC3 1 1 0 - pnib9mgub9h0rml3cdf5bgrj59dkjhvk NS SOA RRSIG DNSKEY NSEC3PARAM
+jg19n32806c832kijdnglq8p9m2r5mdj.example.com. NSEC3 1 1 0 - lg19n32806c832kijdnglq8p9m2r5mdj NS DS RRSIG
+
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jHrF+lnyRL1LE/Bwz6C+jZg3E/2qQkVSboGxya6iX71v0zA3eUsob9m9l3gHNlhwhyahbamHUKx+OMvtYuzRa+RMv4ObuLRIt8StdixeXaUU+rx7C2qCKOFsa5q4HzK4bLYPfyb5T9w67HbzHPLEllXPA7tghzyzCM9qBtbvwK4= ;{id = 57024}
+jg19n32806c832kijdnglq8p9m2r5mdj.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. f7ZSCahAuKOLXquM0jpdU6I9AX31CgGicRiB3aU4jvqQp/EygbCNn5kfpyXY0FvZvzggpl8naXSStOPN9dy3bb0NwGQkJcYD94NEw307T8uEunOvx1ug5TuakBAwqjY8xKM3xab3LnWYRtx4zdln/3ZDHvBUwfzkxUZrzeKjpiI= ;{id = 57024}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN MX
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.	3600	IN	RRSIG	SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+
+; optout
+; example.com. -> onib9mgub9h0rml3cdf5bgrj59dkjhvk.
+; sub.example.com. -> kg19n32806c832kijdnglq8p9m2r5mdj.
+; *.example.com. -> 4f3cnt8cu22tngec382jj4gde4rb47ub.
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com. NSEC3 1 1 0 - pnib9mgub9h0rml3cdf5bgrj59dkjhvk NS SOA RRSIG DNSKEY NSEC3PARAM
+jg19n32806c832kijdnglq8p9m2r5mdj.example.com. NSEC3 1 1 0 - lg19n32806c832kijdnglq8p9m2r5mdj NS DS RRSIG
+
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jHrF+lnyRL1LE/Bwz6C+jZg3E/2qQkVSboGxya6iX71v0zA3eUsob9m9l3gHNlhwhyahbamHUKx+OMvtYuzRa+RMv4ObuLRIt8StdixeXaUU+rx7C2qCKOFsa5q4HzK4bLYPfyb5T9w67HbzHPLEllXPA7tghzyzCM9qBtbvwK4= ;{id = 57024}
+jg19n32806c832kijdnglq8p9m2r5mdj.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. f7ZSCahAuKOLXquM0jpdU6I9AX31CgGicRiB3aU4jvqQp/EygbCNn5kfpyXY0FvZvzggpl8naXSStOPN9dy3bb0NwGQkJcYD94NEw307T8uEunOvx1ug5TuakBAwqjY8xKM3xab3LnWYRtx4zdln/3ZDHvBUwfzkxUZrzeKjpiI= ;{id = 57024}
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+sub.example.com. IN MX
+ENTRY_END
+
+; recursion happens here.
+; no AD flag on this because an optout NSEC3 is used.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+sub.example.com. IN MX
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.    3600    IN      RRSIG   SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com. NSEC3 1 1 0 - pnib9mgub9h0rml3cdf5bgrj59dkjhvk NS SOA RRSIG DNSKEY NSEC3PARAM
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.   3600    IN      RRSIG   NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jHrF+lnyRL1LE/Bwz6C+jZg3E/2qQkVSboGxya6iX71v0zA3eUsob9m9l3gHNlhwhyahbamHUKx+OMvtYuzRa+RMv4ObuLRIt8StdixeXaUU+rx7C2qCKOFsa5q4HzK4bLYPfyb5T9w67HbzHPLEllXPA7tghzyzCM9qBtbvwK4= ;{id = 57024}
+jg19n32806c832kijdnglq8p9m2r5mdj.example.com. NSEC3 1 1 0 - lg19n32806c832kijdnglq8p9m2r5mdj NS DS RRSIG
+jg19n32806c832kijdnglq8p9m2r5mdj.example.com.   3600    IN      RRSIG   NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. f7ZSCahAuKOLXquM0jpdU6I9AX31CgGicRiB3aU4jvqQp/EygbCNn5kfpyXY0FvZvzggpl8naXSStOPN9dy3bb0NwGQkJcYD94NEw307T8uEunOvx1ug5TuakBAwqjY8xKM3xab3LnWYRtx4zdln/3ZDHvBUwfzkxUZrzeKjpiI= ;{id = 57024}
+SECTION ADDITIONAL
+ENTRY_END
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+sub.example.com. IN DS
+ENTRY_END
+
+; recursion happens here.
+; no AD flag here because of RFC5155 9.2 section.
+; even though we are sure there is no DS, this is what the RFC says.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.    3600    IN      RRSIG   SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com. NSEC3 1 1 0 - pnib9mgub9h0rml3cdf5bgrj59dkjhvk NS SOA RRSIG DNSKEY NSEC3PARAM
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.   3600    IN      RRSIG   NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jHrF+lnyRL1LE/Bwz6C+jZg3E/2qQkVSboGxya6iX71v0zA3eUsob9m9l3gHNlhwhyahbamHUKx+OMvtYuzRa+RMv4ObuLRIt8StdixeXaUU+rx7C2qCKOFsa5q4HzK4bLYPfyb5T9w67HbzHPLEllXPA7tghzyzCM9qBtbvwK4= ;{id = 57024}
+jg19n32806c832kijdnglq8p9m2r5mdj.example.com. NSEC3 1 1 0 - lg19n32806c832kijdnglq8p9m2r5mdj NS DS RRSIG
+jg19n32806c832kijdnglq8p9m2r5mdj.example.com.   3600    IN      RRSIG   NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. f7ZSCahAuKOLXquM0jpdU6I9AX31CgGicRiB3aU4jvqQp/EygbCNn5kfpyXY0FvZvzggpl8naXSStOPN9dy3bb0NwGQkJcYD94NEw307T8uEunOvx1ug5TuakBAwqjY8xKM3xab3LnWYRtx4zdln/3ZDHvBUwfzkxUZrzeKjpiI= ;{id = 57024}
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,83 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	trust-anchor: "lp0.eu. IN DNSKEY 257 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3"
+	val-override-date: "20100913111500"
+	; the dlv anchor is completely ignored, but here to test that.
+	dlv-anchor: "dlv.isc.org. IN DNSKEY 257 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3"
+
+stub-zone:
+	name: "."
+	stub-addr: 81.187.81.187
+stub-zone:
+        name: "lp0.eu"
+	stub-addr: 81.2.80.65
+	stub-prime: no
+CONFIG_END
+
+SCENARIO_BEGIN Test validation of stub zone without root prime.
+
+; this server does not respond. (for the root)
+RANGE_BEGIN 0 100
+	ADDRESS 81.187.81.187
+ENTRY_BEGIN
+MATCH
+ADJUST copy_id copy_query
+REPLY QR SERVFAIL
+SECTION QUESTION
+. IN NS
+ENTRY_END
+RANGE_END
+
+; lp0.eu server
+RANGE_BEGIN 0 100
+	ADDRESS 81.2.80.65
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+lp0.eu. IN DNSKEY
+SECTION ANSWER
+lp0.eu.	3600	IN	DNSKEY	257 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30900 (ksk), size = 512b}
+lp0.eu.	3600	IN	RRSIG	DNSKEY 5 2 3600 20101013111500 20100909111500 30900 lp0.eu. zWYOT1zmB2k7hMl7mke7k1UNp4lDveUxi2EnF0tW++j2/qJopiAAcFHBo2GOo88jHcLWycurf0Qo+YGXfFbpEg== ;{id = 30900}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+proxima.lp0.eu. IN A
+SECTION ANSWER
+proxima.lp0.eu. IN A 81.2.80.65
+proxima.lp0.eu.	3600	IN	RRSIG	A 5 3 3600 20101013111500 20100909111500 30900 lp0.eu. xwS3PLSlxh500pDYh/t6fnLzxQAra6n3nhzk4fVqLzwmneBIfcx4F/vO44wRzXSprz1UbMkVUcruTbQYlLFBEg== ;{id = 30900}
+SECTION AUTHORITY
+lp0.eu. IN NS proxima.lp0.eu.
+lp0.eu.	3600	IN	RRSIG	NS 5 2 3600 20101013111500 20100909111500 30900 lp0.eu. KM7Zfwc1b0Ay8Ezer0ZAERPbmgGzKIrTfZMxzXzSkVx5DWirTtdgPTNVG/y9fkN4tUARNhElN2eb0ufb04Hdgw== ;{id = 30900}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+proxima.lp0.eu. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+proxima.lp0.eu. IN A
+SECTION ANSWER
+proxima.lp0.eu. IN A 81.2.80.65
+proxima.lp0.eu.	3600	IN	RRSIG	A 5 3 3600 20101013111500 20100909111500 30900 lp0.eu. xwS3PLSlxh500pDYh/t6fnLzxQAra6n3nhzk4fVqLzwmneBIfcx4F/vO44wRzXSprz1UbMkVUcruTbQYlLFBEg== ;{id = 30900}
+SECTION AUTHORITY
+lp0.eu. IN NS proxima.lp0.eu.
+lp0.eu.	3600	IN	RRSIG	NS 5 2 3600 20101013111500 20100909111500 30900 lp0.eu. KM7Zfwc1b0Ay8Ezer0ZAERPbmgGzKIrTfZMxzXzSkVx5DWirTtdgPTNVG/y9fkN4tUARNhElN2eb0ufb04Hdgw== ;{id = 30900}
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,167 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.	3600	IN	DNSKEY	256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}"
+	trust-anchor: "example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with multiple algorithm DS trust anchor
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,167 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	trust-anchor: "example.com.	3600	IN	DS	30899 5 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with multiple algorithm DS trust anchor
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END
@@ -256,6 +256,16 @@ a.b.sub.example.com. IN A
 SECTION ANSWER
 a.b.sub.example.com. IN CNAME c.c.example.com.
 ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.b.sub.example.com. IN DS
+SECTION AUTHORITY
+b.sub.example.com. IN SOA B-EXAMPLE. b-example. 1 2 3 7 7
+ENTRY_END
 RANGE_END

 ; server ns.c.example.com.
@@ -294,6 +304,16 @@ c.c.example.com. IN A
 SECTION ANSWER
 c.c.example.com. IN A	11.11.11.11
 ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+c.c.example.com. IN DS
+SECTION AUTHORITY
+c.example.com. IN SOA C-EXAMPLE. c-example. 1 2 3 4 5
+ENTRY_END
 RANGE_END

 STEP 1 QUERY
@@ -317,4 +337,23 @@ SECTION AUTHORITY
 SECTION ADDITIONAL
 ENTRY_END

+; test that a DS query does not get CNAME redirected, but instead
+; asked to the right server that has to respond to it.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+a.b.sub.example.com. IN DS
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+a.b.sub.example.com. IN DS
+SECTION AUTHORITY
+b.sub.example.com. IN SOA B-EXAMPLE. b-example. 1 2 3 7 7
+ENTRY_END
+
 SCENARIO_END
@@ -322,6 +322,7 @@ alloc_reg_release(struct alloc_cache* alloc, struct regional* r)
 		regional_destroy(r);
 		return;
 	}
+	if(!r) return;
 	regional_free_all(r);
 	log_assert(r->next == NULL);
 	r->next = (char*)alloc->reg_list;
@@ -1392,7 +1392,7 @@ void errinf_rrset(struct module_qstate* qstate, struct ub_packed_rrset_key *rr)
 		log_err("malloc failure in errinf_rrset");
 		return;
 	}
-	dname_str(qstate->qinfo.qname, dname);
+	dname_str(rr->rk.dname, dname);
 	snprintf(buf, sizeof(buf), "for <%s %s %s>", dname, t, c);
 	free(t);
 	free(c);
@@ -257,6 +257,7 @@ void dname_remove_labels(uint8_t** dname, size_t* len, int n);
 * Count labels for the RRSIG signature label field.
 * Like a normal labelcount, but "*" wildcard and "." root are not counted.
 * @param dname: valid uncompressed wireformat.
+ * @return number of labels like in RRSIG; '*' and '.' are not counted.
 */
 int dname_signame_label_count(uint8_t* dname);

@@ -516,18 +516,6 @@ query_info_parse(struct query_info* m, ldns_buffer* query)
 	return 1;
 }

-int 
-query_info_allocqname(struct query_info* m)
-{
-	uint8_t* q = m->qname;
-	if(!(m->qname = (uint8_t*)malloc(m->qname_len))) {
-		log_err("query_info_allocqname: out of memory");
-		return 0; /* out of memory */
-	}
-	memcpy(m->qname, q, m->qname_len);
-	return 1;
-}
-
 /** tiny subroutine for msgreply_compare */
 #define COMPARE_IT(x, y) \
 	if( (x) < (y) ) return -1; \
@@ -263,13 +263,6 @@ void reply_info_set_ttls(struct reply_info* rep, uint32_t timenow);
 */
 void reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc);

-/**
- * Allocate and copy the qname (obtained from query_info_parse()).
- * @param m: the queryinfo structure.
- * @return: 0 on alloc failure.
- */
-int query_info_allocqname(struct query_info* m);
-
 /**
 * Compare two queryinfo structures, on query and type, class. 
 * It is _not_ sorted in canonical ordering.
@@ -245,16 +245,6 @@ fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_t fptr)
 	return 0;
 }

-int 
-fptr_whitelist_modenv_send_packet(int (*fptr)(ldns_buffer* pkt,
-        struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-        struct module_qstate* q, int use_tcp))
-{
-	if(fptr == &worker_send_packet) return 1;
-	else if(fptr == &libworker_send_packet) return 1;
-	return 0;
-}
-
 /** whitelist env->send_query callbacks */
 int 
 fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
@@ -183,16 +183,6 @@ int fptr_whitelist_hash_deldatafunc(lruhash_deldatafunc_t fptr);
 */
 int fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_t fptr);

-/**
- * Check function pointer whitelist for module_env send_packet callback values.
- *
- * @param fptr: function pointer to check.
- * @return false if not in whitelist.
- */
-int fptr_whitelist_modenv_send_packet(int (*fptr)(ldns_buffer* pkt, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int timeout, 
-	struct module_qstate* q, int use_tcp));
-
 /**
 * Check function pointer whitelist for module_env send_query callback values.
 *
@@ -3177,7 +3177,6 @@
 3562,
 3563,
 3564,
-3566,
 3567,
 3568,
 3569,
@@ -3844,6 +3843,7 @@
 4404,
 4405,
 4406,
+4425,
 4426,
 4430,
 4441,
@@ -3865,6 +3865,8 @@
 4457,
 4458,
 4484,
+4486,
+4488,
 4500,
 4535,
 4536,
@@ -3937,6 +3939,9 @@
 4700,
 4701,
 4702,
+4725,
+4726,
+4727,
 4728,
 4729,
 4730,
@@ -4074,6 +4079,8 @@
 5100,
 5101,
 5102,
+5104,
+5105,
 5111,
 5112,
 5113,
@@ -4382,6 +4389,7 @@
 6300,
 6301,
 6306,
+6315,
 6316,
 6320,
 6321,
@@ -4612,6 +4620,7 @@
 7727,
 7734,
 7738,
+7741,
 7743,
 7744,
 7747,
@@ -4643,6 +4652,7 @@
 7967,
 7979,
 7980,
+7982,
 7998,
 7999,
 8000,
@@ -4660,6 +4670,7 @@
 8032,
 8033,
 8034,
+8040,
 8052,
 8053,
 8054,
@@ -4961,6 +4972,7 @@
 10544,
 10800,
 10805,
+10810,
 10860,
 10990,
 11000,
@@ -4984,6 +4996,8 @@
 11600,
 11720,
 11751,
+11876,
+11877,
 11967,
 12000,
 12001,
@@ -5044,6 +5058,8 @@
 15555,
 15660,
 15740,
+15998,
+16003,
 16161,
 16309,
 16310,
@@ -5104,9 +5120,11 @@
 20002,
 20003,
 20005,
+20012,
 20014,
 20034,
 20046,
+20048,
 20049,
 20167,
 20202,
@@ -5204,6 +5222,7 @@
 30002,
 30260,
 30999,
+31029,
 31416,
 31457,
 31620,
@@ -82,24 +82,6 @@ struct module_env {
 	struct key_cache* key_cache;

 	/* --- services --- */
-	/** 
-	 * Direct access to the network, this packet gets sent to destination.
-	 * Send DNS query to server. operate() should return with wait_reply.
-	 * Later on a callback will cause operate() to be called with event
-	 * timeout or reply. Replied packet is then in the query buffer.
-	 * @param pkt: packet to send.
-	 * @param addr: where to.
-	 * @param addrlen: length of addr.
-	 * @param timeout: seconds to wait until timeout.
-	 * @param q: wich query state to reactivate upon return.
-	 * @param use_tcp: set to true to send over TCP. 0 for UDP.
-	 * @return: false on failure (memory or socket related). no query was
-	 *	sent.
-	 */
-	int (*send_packet)(ldns_buffer* pkt, struct sockaddr_storage* addr,
-		socklen_t addrlen, int timeout, struct module_qstate* q,
-		int use_tcp);
-
 	/** 
 	 * Send serviced DNS query to server. UDP/TCP and EDNS is handled.
 	 * operate() should return with wait_reply. Later on a callback 
@@ -60,30 +60,6 @@ str_is_ip6(const char* str)
 	else    return 0;
 }

-int 
-write_socket(int s, const void *buf, size_t size)
-{
-	const char* data = (const char*)buf;
-	size_t total_count = 0;
-
-	fd_set_block(s);
-	while (total_count < size) {
-		ssize_t count
-			= write(s, data + total_count, size - total_count);
-		if (count == -1) {
-			if (errno != EAGAIN && errno != EINTR) {
-				fd_set_nonblock(s);
-				return 0;
-			} else {
-				continue;
-			}
-		}
-		total_count += count;
-	}
-	fd_set_nonblock(s);
-	return 1;
-}
-
 int 
 fd_set_nonblock(int s) 
 {
@@ -502,6 +478,21 @@ int addr_is_broadcast(struct sockaddr_storage* addr, socklen_t addrlen)
 		&& memcmp(sinaddr, "\377\377\377\377", 4) == 0;
 }

+int addr_is_any(struct sockaddr_storage* addr, socklen_t addrlen)
+{
+	int af = (int)((struct sockaddr_in*)addr)->sin_family;
+	void* sinaddr = &((struct sockaddr_in*)addr)->sin_addr;
+	void* sin6addr = &((struct sockaddr_in6*)addr)->sin6_addr;
+	if(af == AF_INET && addrlen>=(socklen_t)sizeof(struct sockaddr_in)
+		&& memcmp(sinaddr, "\000\000\000\000", 4) == 0)
+		return 1;
+	else if(af==AF_INET6 && addrlen>=(socklen_t)sizeof(struct sockaddr_in6)
+		&& memcmp(sin6addr, "\000\000\000\000\000\000\000\000"
+		"\000\000\000\000\000\000\000\000", 16) == 0)
+		return 1;
+	return 0;
+}
+
 void sock_list_insert(struct sock_list** list, struct sockaddr_storage* addr,
 	socklen_t len, struct regional* region)
 {
@@ -100,16 +100,6 @@ extern uint16_t EDNS_ADVERTISED_SIZE;
 */
 int str_is_ip6(const char* str);

-/**
- * Write (blocking) to a nonblocking socket.
- * @param s: fd. Is set to be nonblocking at exit.
- * @param buf: data buffer.
- * @param size: length of data to send.
- * @return: 0 on error. errno is set.
- */
-int
-write_socket(int s, const void *buf, size_t size);
-
 /**
 * Set fd nonblocking.
 * @param s: file descriptor.
@@ -233,7 +223,7 @@ int sockaddr_cmp_addr(struct sockaddr_storage* addr1, socklen_t len1,
 * Checkout address family.
 * @param addr: the sockaddr to examine.
 * @param len: the length of addr.
- * return: true if sockaddr is ip6.
+ * @return: true if sockaddr is ip6.
 */
 int addr_is_ip6(struct sockaddr_storage* addr, socklen_t len);

@@ -272,7 +262,7 @@ void addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
 	char* buf, size_t len);

 /**
- * See if sockaddr is an ipv6 mapped ipv4 address, ::ffff:0.0.0.0
+ * See if sockaddr is an ipv6 mapped ipv4 address, "::ffff:0.0.0.0"
 * @param addr: address
 * @param addrlen: length of address
 * @return true if so
@@ -287,6 +277,14 @@ int addr_is_ip4mapped(struct sockaddr_storage* addr, socklen_t addrlen);
 */
 int addr_is_broadcast(struct sockaddr_storage* addr, socklen_t addrlen);

+/**
+ * See if sockaddr is 0.0.0.0 or ::0.
+ * @param addr: address
+ * @param addrlen: length of address
+ * @return true if so
+ */
+int addr_is_any(struct sockaddr_storage* addr, socklen_t addrlen);
+
 /**
 * Insert new socket list item. If fails logs error.
 * @param list: pointer to pointer to first item.
@@ -176,7 +176,7 @@ comm_base_create(int sigs)
 	/* use mini event time-sharing feature */
 	b->eb->base = event_init(&b->eb->secs, &b->eb->now);
 #else
-#  ifdef HAVE_EV_LOOP
+#  if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* libev */
 	if(sigs)
 		b->eb->base=(struct event_base *)ev_default_loop(EVFLAG_AUTO);
@@ -200,7 +200,7 @@ comm_base_create(int sigs)
 	/* avoid event_get_method call which causes crashes even when
 	 * not printing, because its result is passed */
 	verbose(VERB_ALGO, 
-#ifdef HAVE_EV_LOOP
+#if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 		"libev"
 #elif defined(USE_MINI_EVENT)
 		"event "
@@ -332,10 +332,10 @@ comm_point_send_udp_msg(struct comm_point *c, ldns_buffer* packet,
 	return 1;
 }

+#if defined(AF_INET6) && defined(IPV6_PKTINFO) && (defined(HAVE_RECVMSG) || defined(HAVE_SENDMSG))
 /** print debug ancillary info */
 static void p_ancil(const char* str, struct comm_reply* r)
 {
-#if defined(AF_INET6) && defined(IPV6_PKTINFO) && (defined(HAVE_RECVMSG) || defined(HAVE_SENDMSG))
 	if(r->srctype != 4 && r->srctype != 6) {
 		log_info("%s: unknown srctype %d", str, r->srctype);
 		return;
@@ -371,13 +371,10 @@ static void p_ancil(const char* str, struct comm_reply* r)
 		}
 		buf1[sizeof(buf1)-1]=0;
 		log_info("%s: %s", str, buf1);
-#endif
+#endif /* IP_PKTINFO or PI_RECVDSTDADDR */
 	}
-#else
-	(void)str;
-	(void)r;
-#endif
 }
+#endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG||HAVE_SENDMSG */

 /** send a UDP reply over specified interface*/
 static int
@@ -431,7 +428,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, ldns_buffer* packet,
 #else
 		verbose(VERB_ALGO, "no IP_PKTINFO or IP_SENDSRCADDR");
 		msg.msg_control = NULL;
-#endif
+#endif /* IP_PKTINFO or IP_SENDSRCADDR */
 	} else if(r->srctype == 6) {
 		msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
 		log_assert(msg.msg_controllen <= sizeof(control));
@@ -472,7 +469,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, ldns_buffer* packet,
 	(void)r;
 	log_err("sendmsg: IPV6_PKTINFO not supported");
 	return 0;
-#endif
+#endif /* AF_INET6 && IPV6_PKTINFO && HAVE_SENDMSG */
 }

 void 
@@ -546,7 +543,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 				memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg),
 					sizeof(struct in_addr));
 				break;
-#endif
+#endif /* IP_PKTINFO or IP_RECVDSTADDR */
 			}
 		}
 		if(verbosity >= VERB_ALGO)
@@ -567,7 +564,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 	(void)arg;
 	fatal_exit("recvmsg: No support for IPV6_PKTINFO. "
 		"Please disable interface-automatic");
-#endif
+#endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG */
 }

 void 
@@ -1489,13 +1486,6 @@ comm_point_delete(struct comm_point* c)
 	free(c);
 }

-void 
-comm_point_set_cb_arg(struct comm_point* c, void *arg)
-{
-	log_assert(c);
-	c->cb_arg = arg;
-}
-
 void 
 comm_point_send_reply(struct comm_reply *repinfo)
 {
@@ -403,13 +403,6 @@ void comm_point_close(struct comm_point* c);
 */
 void comm_point_delete(struct comm_point* c);

-/**
- * Reset the callback argument for a comm point.
- * @param c: the comm point to change.
- * @param arg: the new callback user argument.
- */
-void comm_point_set_cb_arg(struct comm_point* c, void* arg);
-
 /**
 * Send reply. Put message into commpoint buffer.
 * @param repinfo: The reply info copied from a commpoint callback call.
@@ -99,6 +99,10 @@ rtt_lost(struct rtt_info* rtt, int orig)
 {
 	/* exponential backoff */

+	/* if a query succeeded and put down the rto meanwhile, ignore this */
+	if(rtt->rto < orig)
+		return;
+
 	/* the original rto is doubled, not the current one to make sure
 	 * that the values in the cache are not increased by lots of
 	 * queries simultaneously as they time out at the same time */
@@ -109,3 +113,8 @@ rtt_lost(struct rtt_info* rtt, int orig)
 			rtt->rto = RTT_MAX_TIMEOUT;
 	}
 }
+
+int rtt_notimeout(const struct rtt_info* rtt)
+{
+	return calc_rto(rtt);
+}
@@ -81,6 +81,13 @@ int rtt_timeout(const struct rtt_info* rtt);
 */
 int rtt_unclamped(const struct rtt_info* rtt);

+/**
+ * RTT for valid responses. Without timeouts.
+ * @param rtt: round trip statistics structure.
+ * @return: value in msec.
+ */
+int rtt_notimeout(const struct rtt_info* rtt);
+
 /**
 * Update the statistics with a new roundtrip estimate observation.
 * @param rtt: round trip statistics structure.
@@ -975,7 +975,7 @@ verify_dnskey(struct module_env* env, struct val_env* ve,
 	if(tp->ds_rrset) {
 		/* verify with ds, any will do to prime autotrust */
 		enum sec_status sec = val_verify_DNSKEY_with_DS(
-			env, ve, rrset, tp->ds_rrset, &reason);
+			env, ve, rrset, tp->ds_rrset, 0, &reason);
 		verbose(VERB_ALGO, "autotrust: validate DNSKEY with DS: %s",
 			sec_status_to_string(sec));
 		if(sec == sec_status_secure) {
@@ -985,7 +985,7 @@ verify_dnskey(struct module_env* env, struct val_env* ve,
 	if(tp->dnskey_rrset) {
 		/* verify with keys */
 		enum sec_status sec = val_verify_rrset(env, ve, rrset,
-			tp->dnskey_rrset, &reason);
+			tp->dnskey_rrset, 0, &reason);
 		verbose(VERB_ALGO, "autotrust: validate DNSKEY with keys: %s",
 			sec_status_to_string(sec));
 		if(sec == sec_status_secure) {
@@ -141,6 +141,7 @@ void autr_global_delete(struct autr_global_data* global);
 /**
 * See if autotrust anchors are configured and how many.
 * @param anchors: the trust anchors structure.
+ * @return number of autotrust trust anchors
 */
 size_t autr_get_num_anchors(struct val_anchors* anchors);

@@ -1255,7 +1255,7 @@ neg_nsec3_getnc(struct val_neg_zone* zone, uint8_t* hashnc, size_t nclen,
 static struct dns_msg*
 neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
 		int qlabs, ldns_buffer* buf, struct rrset_cache* rrset_cache,
-		struct regional* region, uint32_t now)
+		struct regional* region, uint32_t now, uint8_t* topname)
 {
 	struct dns_msg* msg;
 	struct val_neg_data* data;
@@ -1305,6 +1305,12 @@ neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
 			return NULL;
 		return msg;
 	}
+
+	/* optout is not allowed without knowing the trust-anchor in use,
+	 * otherwise the optout could spoof away that anchor */
+	if(!topname)
+		return NULL;
+
 	/* if there is no exact match, it must be in an optout span
 	 * (an existing DS implies an NSEC3 must exist) */
 	nc_rrset = neg_nsec3_getnc(zone, hashnc, nclen, rrset_cache, 
@@ -1379,7 +1385,7 @@ static int add_soa(struct rrset_cache* rrset_cache, uint32_t now,
 struct dns_msg* 
 val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo, 
 	struct regional* region, struct rrset_cache* rrset_cache, 
-	ldns_buffer* buf, uint32_t now, int addsoa)
+	ldns_buffer* buf, uint32_t now, int addsoa, uint8_t* topname)
 {
 	struct dns_msg* msg;
 	struct ub_packed_rrset_key* rrset;
@@ -1391,6 +1397,7 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
 	/* only for DS queries */
 	if(qinfo->qtype != LDNS_RR_TYPE_DS)
 		return NULL;
+	log_assert(!topname || dname_subdomain_c(qinfo->qname, topname));

 	/* see if info from neg cache is available 
 	 * For NSECs, because there is no optout; a DS next to a delegation
@@ -1426,13 +1433,19 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
 		qinfo->qclass);
 	while(zone && !zone->in_use)
 		zone = zone->parent;
+	/* check that the zone is not too high up so that we do not pick data
+	 * out of a zone that is above the last-seen key (or trust-anchor). */
+	if(zone && topname) {
+		if(!dname_subdomain_c(zone->name, topname))
+			zone = NULL;
+	}
 	if(!zone) {
 		lock_basic_unlock(&neg->lock);
 		return NULL;
 	}

 	msg = neg_nsec3_proof_ds(zone, qinfo->qname, qinfo->qname_len, 
-		zname_labs+1, buf, rrset_cache, region, now);
+		zname_labs+1, buf, rrset_cache, region, now, topname);
 	if(msg && addsoa && !add_soa(rrset_cache, now, region, msg, zone)) {
 		lock_basic_unlock(&neg->lock);
 		return NULL;
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`example.com. 3600 IN DS 57024 7 1 46d134be319b2cc910b9938f1cb25dc41abb27bf ; xicit-citor-vasin-rarus-nygir-nagam-zulor-dylos-gokar-ranor-zixyx`
				`@@ -0,0 +1 @@`
				`example.com. 3600 IN DNSKEY 257 3 7 AwEAAbvre/wK/WVeoj0SiwVkTD+NefvHPru9YIqLWY0m+0E5NYOpJZdc+PGQQYRzFNOlugVZtFirmv5Lmz7GNiASXtG/IFi//SlE30DxEKQOjt2F6qSZTZ1nZ5XOIMGTwWyp4OoI0egk5JavC5mQbyXqcj82ywt6F5Z3CmnThVl6MtOv ;{id = 57024 (ksk), size = 1024b}`