revert earlier commit.

git-svn-id: file:///svn/unbound/trunk@2488 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -45,6 +45,11 @@ UB_ON_WINDOWS=@UB_ON_WINDOWS@
 WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
 WITH_PYUNBOUND=@WITH_PYUNBOUND@
 PYTHON_SITE_PKG=@PYTHON_SITE_PKG@
+EXPORT_ALL_SYMBOLS=@EXPORT_ALL_SYMBOLS@
+
+# override $U variable which is used by autotools for deansification (for
+# K&R C compilers), but causes problems if $U is defined in the env).
+U=
 
 SWIG=@SWIG@
 YACC=@YACC@
@@ -71,7 +76,8 @@ BUILD=build/
 
 WINDRES=@WINDRES@
 LINT=splint
-LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -Dglob64=glob -Dglobfree64=globfree
+LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list
+#-Dglob64=glob -Dglobfree64=globfree
 # compat with openssl linux edition.
 LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray -D"ENGINE=unsigned" -D"RSA=unsigned" -D"DSA=unsigned" -D"EVP_PKEY=unsigned" -D"EVP_MD=unsigned" -D"SSL=unsigned" -D"SSL_CTX=unsigned" -D"X509=unsigned" -D"RC4_KEY=unsigned" -D"EVP_MD_CTX=unsigned"
 # compat with NetBSD
@@ -101,13 +107,25 @@ UNITTEST_SRC=$(patsubst $(srcdir)/%,%, \
 	testcode/readhex.c testcode/ldns-testpkts.c smallapp/worker_cb.c \
 	$(COMMON_SRC)
 UNITTEST_OBJ=$(addprefix $(BUILD),$(UNITTEST_SRC:.c=.lo)) $(COMPAT_OBJ)
-DAEMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/daemon/*.c)) \
-	$(COMMON_SRC)
+
+DAEMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/daemon/*.c))
+ifneq "$(EXPORT_ALL_SYMBOLS)" "yes"
+DAEMON_SRC+=$(COMMON_SRC)
+endif
 DAEMON_OBJ=$(addprefix $(BUILD),$(DAEMON_SRC:.c=.lo)) $(COMPAT_OBJ)
-CHECKCONF_SRC=smallapp/unbound-checkconf.c smallapp/worker_cb.c $(COMMON_SRC)
+
+CHECKCONF_SRC=smallapp/unbound-checkconf.c smallapp/worker_cb.c
+ifneq "$(EXPORT_ALL_SYMBOLS)" "yes"
+CHECKCONF_SRC+=$(COMMON_SRC)
+endif
 CHECKCONF_OBJ=$(addprefix $(BUILD),$(CHECKCONF_SRC:.c=.lo)) $(COMPAT_OBJ)
-CONTROL_SRC=smallapp/unbound-control.c smallapp/worker_cb.c $(COMMON_SRC)
+
+CONTROL_SRC=smallapp/unbound-control.c smallapp/worker_cb.c
+ifneq "$(EXPORT_ALL_SYMBOLS)" "yes"
+CONTROL_SRC+=$(COMMON_SRC)
+endif
 CONTROL_OBJ=$(addprefix $(BUILD),$(CONTROL_SRC:.c=.lo)) $(COMPAT_OBJ)
+
 HOST_SRC=smallapp/unbound-host.c
 HOST_OBJ=$(addprefix $(BUILD),$(HOST_SRC:.c=.lo)) $(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
 UBANCHOR_SRC=smallapp/unbound-anchor.c
@@ -174,8 +192,6 @@ ifeq "$(UB_ON_WINDOWS)" "yes"
 
 $(BUILD)%.o:      $(srcdir)/%.rc $(srcdir)/config.h
 	$(INFO) Resource $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(WINDRES) $(CPPFLAGS) $< $@
 endif
@@ -184,12 +200,10 @@ COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS)
 LINK=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(staticexe) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS))
 LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS) $(staticexe) -version-number @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined)
 
-.PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip lib longtest longcheck check
+.PHONY:	clean realclean doc lint all install uninstall tests test strip lib longtest longcheck check
 
 $(BUILD)%.lo:    $(srcdir)/%.c 
 	$(INFO) Build $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(COMPILE) -o $@ -c $<
 
@@ -205,7 +219,7 @@ longcheck: longtest
 test:	unittest$(EXEEXT) testbound$(EXEEXT)
 	./unittest$(EXEEXT)
 	./testbound$(EXEEXT) -s
-	for x in testdata/*.rpl; do if ./testbound$(EXEEXT) -p $$x >/dev/null 2>&1; then echo $$x OK; else echo $$x failed; exit 1; fi done
+	for x in testdata/*.rpl; do echo -n "$$x "; if ./testbound$(EXEEXT) -p $$x >/dev/null 2>&1; then echo OK; else echo failed; exit 1; fi done
 	@echo test OK
 
 longtest:	tests
@@ -213,37 +227,51 @@ longtest:	tests
 
 lib:	libunbound.la
 
-ifeq ($(patsubst ldns-src%,ldns-src,$(ldnsdir)),ldns-src)
-ldnslib=$(ldnsdir)/lib/libldns.a
-$(ldnslib):	$(ldnsdir)/lib
-$(ldnsdir)/lib:
-	@if test ! -z "$(ldnsdir)"; \
-	then (cd $(ldnsdir) && $(MAKE)); fi
-else
-ldnslib=
+UBSYMS+=-export-symbols $(srcdir)/libunbound/ubsyms.def
+CLUBSYMS=-export-symbols $(BUILD)clubsyms.def
+EXTRALINK=
+ifeq "$(EXPORT_ALL_SYMBOLS)" "yes"
+UBSYMS=
+CLUBSYMS=
+EXTRALINK=-L. -L.libs -lunbound
 endif
 
-libunbound.la:	$(LIBUNBOUND_OBJ) $(ldnslib)
+libunbound.la:	$(LIBUNBOUND_OBJ)
 	$(INFO) Link $@
-	$Q$(LINK_LIB) -export-symbols $(srcdir)/libunbound/ubsyms.def -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
+ifeq ($(CHECKLOCK_SRC),)
+	$Q$(LINK_LIB) $(UBSYMS) -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
+else
+	cp $(srcdir)/libunbound/ubsyms.def $(BUILD)clubsyms.def
+	echo lock_protect >> $(BUILD)clubsyms.def
+	echo lock_unprotect >> $(BUILD)clubsyms.def
+	echo lock_get_mem >> $(BUILD)clubsyms.def
+	echo checklock_start >> $(BUILD)clubsyms.def
+	echo checklock_stop >> $(BUILD)clubsyms.def
+	echo checklock_lock >> $(BUILD)clubsyms.def
+	echo checklock_unlock >> $(BUILD)clubsyms.def
+	echo checklock_init >> $(BUILD)clubsyms.def
+	echo checklock_thrcreate >> $(BUILD)clubsyms.def
+	echo checklock_thrjoin >> $(BUILD)clubsyms.def
+	$Q$(LINK_LIB) $(CLUBSYMS) -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
+endif
 
-unbound$(EXEEXT):	$(DAEMON_OBJ) $(ldnslib)
+unbound$(EXEEXT):	$(DAEMON_OBJ) libunbound.la
 	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) -lssl $(LIBS)
+	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) $(EXTRALINK) -lssl $(LIBS)
 
-unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ) $(ldnslib)
+unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ) libunbound.la
 	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(CHECKCONF_OBJ)) $(LIBS)
+	$Q$(LINK) -o $@ $(sort $(CHECKCONF_OBJ)) $(EXTRALINK) -lssl $(LIBS)
 
-unbound-control$(EXEEXT):	$(CONTROL_OBJ) $(ldnslib)
+unbound-control$(EXEEXT):	$(CONTROL_OBJ) libunbound.la
 	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(CONTROL_OBJ)) -lssl $(LIBS)
+	$Q$(LINK) -o $@ $(sort $(CONTROL_OBJ)) $(EXTRALINK) -lssl $(LIBS)
 
-unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la $(ldnslib)
+unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) -L. -L.libs -lunbound $(LIBS)
 
-unbound-anchor$(EXEEXT):	$(UBANCHOR_OBJ) libunbound.la $(ldnslib)
+unbound-anchor$(EXEEXT):	$(UBANCHOR_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UBANCHOR_OBJ)) -L. -L.libs -lunbound -lexpat -lssl $(LIBS)
 
@@ -255,19 +283,19 @@ unbound-service-remove$(EXEEXT):	$(SVCUNINST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SVCUNINST_OBJ)) $(LIBS)
 
-anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ) libunbound.la $(ldnslib)
+anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ANCHORUPD_OBJ)) -L. -L.libs -lunbound $(LIBS)
 
-unittest$(EXEEXT):	$(UNITTEST_OBJ) $(ldnslib)
+unittest$(EXEEXT):	$(UNITTEST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UNITTEST_OBJ)) $(LIBS)
 
-testbound$(EXEEXT):	$(TESTBOUND_OBJ) $(ldnslib)
+testbound$(EXEEXT):	$(TESTBOUND_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(TESTBOUND_OBJ)) -lssl $(LIBS)
 
-lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ) $(ldnslib)
+lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(LOCKVERIFY_OBJ)) $(LIBS)
 
@@ -275,35 +303,35 @@ petal$(EXEEXT):	$(PETAL_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PETAL_OBJ)) -lssl $(LIBS)
 
-pktview$(EXEEXT):	$(PKTVIEW_OBJ) $(ldnslib)
+pktview$(EXEEXT):	$(PKTVIEW_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PKTVIEW_OBJ)) $(LIBS)
 
-signit$(EXEEXT):	$(SIGNIT_OBJ) $(ldnslib)
+signit$(EXEEXT):	$(SIGNIT_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SIGNIT_OBJ)) $(LIBS)
 
-memstats$(EXEEXT):	$(MEMSTATS_OBJ) $(ldnslib)
+memstats$(EXEEXT):	$(MEMSTATS_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(MEMSTATS_OBJ)) $(LIBS)
 
-asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ) $(ldnslib) libunbound.la
+asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ASYNCLOOK_OBJ)) $(LIBS) -L. -L.libs -lunbound
 
-streamtcp$(EXEEXT):	$(STREAMTCP_OBJ) $(ldnslib)
+streamtcp$(EXEEXT):	$(STREAMTCP_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(STREAMTCP_OBJ)) $(LIBS)
 
-perf$(EXEEXT):	$(PERF_OBJ) $(ldnslib)
+perf$(EXEEXT):	$(PERF_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PERF_OBJ)) $(LIBS)
 
-delayer$(EXEEXT):	$(DELAYER_OBJ) $(ldnslib)
+delayer$(EXEEXT):	$(DELAYER_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(DELAYER_OBJ)) $(LIBS)
 
-harvest$(EXEEXT):	$(HARVEST_OBJ) $(ldnslib) libunbound.la
+harvest$(EXEEXT):	$(HARVEST_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HARVEST_OBJ)) $(LIBS) -L. -L.libs -lunbound
 
@@ -364,7 +392,6 @@ realclean: clean
 	rm -f configure config.sub config.guess ltmain.sh aclocal.m4 libtool
 	rm -f util/configlexer.c util/configparser.c util/configparser.h
 	rm -f $(TEST_BIN)
-	if test -d ldns-src; then rm -rf ldns-src; fi
 	rm -f Makefile 
 
 $(BUILD)%.lint:    $(srcdir)/%.c 
@@ -448,23 +475,14 @@ endif
 	@echo
 	@echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand"
 
-download_ldns:
-	svn export https://www.nlnetlabs.nl/svn/ldns/trunk/makedist.sh ldns_makedist.sh
-	./ldns_makedist.sh -s -d https://www.nlnetlabs.nl/svn/ldns/trunk
-	mv ldns-[0-9]*.tar.gz ldns-src.tar.gz
-	rm ldns-*.tar.gz.sha1 ldns_makedist.sh
-
 iana_update:
-	curl -o port-numbers.tmp http://www.iana.org/assignments/port-numbers
-	awk '/Unassigned|Reserved/ {next;} { match($$0, "[0-9]+/udp"); if (RLENGTH > 0) print substr($$0, RSTART, RLENGTH - 4) ","}' port-numbers.tmp | sort -nu > portslist.tmp
-	cat portslist.tmp > util/iana_ports.inc
+	curl -o port-numbers.tmp http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml
+	awk '/<record>/ {p=0;} /<protocol>udp/ {p=1;} /<protocol>[^u]/ {p=0;} /Decomissioned|Decommissioned|Removed|De-registered|unassigned|Unassigned|Reserved/ {u=1;} /<number>/ { if(u==1) {u=0;} else { if(p==1) { match($$0,/[0-9]+/); print substr($$0, RSTART, RLENGTH) ","}}}' port-numbers.tmp | sort -nu > util/iana_ports.inc  
 	rm -f port-numbers.tmp portslist.tmp
 
 # Automatic dependencies.
 $(BUILD)%.d: $(srcdir)/%.c
 	$(INFO) Depend $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(SHELL) -ec '$(CC) $(DEPFLAG) $(CPPFLAGS) $(CFLAGS) $< | sed '\''s!\(.*\)\.o[ :]*!$(dir $@)\1.lo $@ : !g'\'' > $@; [ -s $@ ] || rm -f $@'
 

acx_nlnetlabs.m4

@@ -2,7 +2,10 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 11
+# Version 14
+# 2011-08-01 Fix nonblock test (broken at v13).
+# 2011-08-01 Fix autoconf 2.68 warnings
+# 2011-06-23 Add ACX_CHECK_FLTO to check -flto.
 # 2010-08-16 Fix FLAG_OMITTED for AS_TR_CPP changes in autoconf-2.66.
 # 2010-07-02 Add check for ss_family (for minix).
 # 2010-04-26 Fix to use CPPFLAGS for CHECK_COMPILER_FLAGS.
@@ -32,6 +35,7 @@
 # ACX_DETERMINE_EXT_FLAGS_UNBOUND - find out which flags enable BSD and POSIX.
 # ACX_CHECK_FORMAT_ATTRIBUTE	- find cc printf format syntax.
 # ACX_CHECK_UNUSED_ATTRIBUTE	- find cc variable unused syntax.
+# ACX_CHECK_FLTO		- see if cc supports -flto and use it if so.
 # ACX_LIBTOOL_C_ONLY		- create libtool for C only, improved.
 # ACX_TYPE_U_CHAR		- u_char type.
 # ACX_TYPE_RLIM_T		- rlim_t type.
@@ -383,6 +387,16 @@ int test() {
 
 ])dnl End of ACX_DETERMINE_EXT_FLAGS_UNBOUND
 
+dnl Check if CC supports -flto.
+dnl in a way that supports clang and suncc (that flag does something else,
+dnl but fails to link).  It sets it in CFLAGS if it works.
+AC_DEFUN([ACX_CHECK_FLTO],
+[AC_MSG_CHECKING([if $CC supports -flto])
+BAKCFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -flto"
+AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], [AC_MSG_RESULT(yes)], [CFLAGS="$BAKCFLAGS" ; AC_MSG_RESULT(no)])
+])
+
 dnl Check the printf-format attribute (if any)
 dnl result in HAVE_ATTR_FORMAT.  
 dnl Make sure you also include the AHX_CONFIG_FORMAT_ATTRIBUTE.
@@ -754,7 +768,7 @@ AC_DEFUN([ACX_CHECK_GETADDRINFO_WITH_INCLUDES],
 AC_MSG_CHECKING(for getaddrinfo)
 ac_cv_func_getaddrinfo=no
 AC_LINK_IFELSE(
-[
+[AC_LANG_SOURCE([[
 #ifdef __cplusplus
 extern "C"
 {
@@ -768,14 +782,14 @@ int main() {
         ;
         return 0;
 }
-],
+]])],
 dnl this case on linux, solaris, bsd
 [ac_cv_func_getaddrinfo="yes"],
 dnl no quick getaddrinfo, try mingw32 and winsock2 library.
 ORIGLIBS="$LIBS"
 LIBS="$LIBS -lws2_32"
 AC_LINK_IFELSE(
-AC_LANG_PROGRAM(
+[AC_LANG_PROGRAM(
 [
 #ifdef HAVE_WS2TCPIP_H
 #include <ws2tcpip.h>
@@ -784,7 +798,7 @@ AC_LANG_PROGRAM(
 [
         (void)getaddrinfo(NULL, NULL, NULL, NULL);
 ]
-),
+)],
 [
 ac_cv_func_getaddrinfo="yes"
 dnl already: LIBS="$LIBS -lws2_32"
@@ -848,7 +862,8 @@ if echo $target | grep mingw32 >/dev/null; then
 	AC_MSG_RESULT([no (windows)])
 	AC_DEFINE([NONBLOCKING_IS_BROKEN], 1, [Define if the network stack does not fully support nonblocking io (causes lower performance).])
 else
-AC_RUN_IFELSE(AC_LANG_PROGRAM([
+AC_RUN_IFELSE([
+AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -872,7 +887,9 @@ AC_RUN_IFELSE(AC_LANG_PROGRAM([
 #ifdef HAVE_TIME_H
 #include <time.h>
 #endif
-],[[
+
+int main(void)
+{
 	int port;
 	int sfd, cfd;
 	int num = 10;
@@ -965,7 +982,9 @@ AC_RUN_IFELSE(AC_LANG_PROGRAM([
 
 	close(sfd);
 	close(cfd);
-]]), [
+	return 0;
+}
+]])], [
 	AC_MSG_RESULT([yes])
 ], [
 	AC_MSG_RESULT([no])
@@ -1005,13 +1024,13 @@ AC_DEFUN([ACX_FUNC_IOCTLSOCKET],
 [
 # check ioctlsocket
 AC_MSG_CHECKING(for ioctlsocket)
-AC_LINK_IFELSE(AC_LANG_PROGRAM([
+AC_LINK_IFELSE([AC_LANG_PROGRAM([
 #ifdef HAVE_WINSOCK2_H
 #include <winsock2.h>
 #endif
 ], [
 	(void)ioctlsocket(0, 0, NULL);
-]), [
+])], [
 AC_MSG_RESULT(yes)
 AC_DEFINE(HAVE_IOCTLSOCKET, 1, [if the function 'ioctlsocket' is available])
 ],[AC_MSG_RESULT(no)])

acx_python.m4

@@ -129,7 +129,7 @@ $ac_distutils_result])
         AC_MSG_CHECKING([for Python site-packages path])
         if test -z "$PYTHON_SITE_PKG"; then
                 PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
-                        print distutils.sysconfig.get_python_lib(0,0);"`
+                        print distutils.sysconfig.get_python_lib(1,0);"`
         fi
         AC_MSG_RESULT([$PYTHON_SITE_PKG])
         AC_SUBST([PYTHON_SITE_PKG])

config.h.in

@@ -871,4 +871,10 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
+/** default port for unbound control traffic, registered port with IANA,
+    ub-dns-control  8953/tcp    unbound dns nameserver control */
+#define UNBOUND_CONTROL_PORT 8953
+/** the version of unbound-control that this software implements */
+#define UNBOUND_CONTROL_VERSION 1
+
 

configure.ac

@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 
-AC_INIT(unbound, 1.4.7, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.13, unbound-bugs@nlnetlabs.nl, unbound)
 
 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=7
+LIBUNBOUND_REVISION=13
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -32,6 +32,12 @@ LIBUNBOUND_AGE=0
 # 1.4.5 had 2:5:0
 # 1.4.6 had 2:6:0
 # 1.4.7 had 2:7:0
+# 1.4.8 had 2:8:0
+# 1.4.9 had 2:9:0
+# 1.4.10 had 2:10:0
+# 1.4.11 had 2:11:0
+# 1.4.12 had 2:12:0
+# 1.4.13 had 2:13:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -221,6 +227,7 @@ case "$debug_enabled" in
 		# nothing to do.
 		;;
 esac
+ACX_CHECK_FLTO
 
 AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
@@ -292,13 +299,13 @@ if test "$on_mingw" = "yes"; then
 # check windows threads
 	AC_CHECK_HEADERS([windows.h],,, [AC_INCLUDES_DEFAULT])
 	AC_MSG_CHECKING([for CreateThread])
-	AC_TRY_COMPILE([
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([
 #ifdef HAVE_WINDOWS_H
 #include <windows.h>
 #endif
 ], [
 	HANDLE t = CreateThread(NULL, 0, NULL, NULL, 0, NULL);
-],
+])],
 	AC_MSG_RESULT(yes)
 	AC_DEFINE(HAVE_WINDOWS_THREADS, 1, [Using Windows threads])
 ,	
@@ -579,7 +586,7 @@ AC_CHECK_HEADERS([expat.h],,, [AC_INCLUDES_DEFAULT])
 # set static linking if requested
 AC_SUBST(staticexe)
 staticexe=""
-AC_ARG_ENABLE(staticexe, AC_HELP_STRING([--enable-static-exe],
+AC_ARG_ENABLE(static-exe, AC_HELP_STRING([--enable-static-exe],
 	[ enable to compile executables statically against event, ldns libs, for debug purposes ]), 
 	, )
 if test x_$enable_static_exe = x_yes; then
@@ -656,13 +663,13 @@ AC_DEFUN([AC_CHECK_STRPTIME_WORKS],
 [AC_REQUIRE([AC_PROG_CC])
 AC_MSG_CHECKING(whether strptime works)
 if test c${cross_compiling} = cno; then
-AC_TRY_RUN([
+AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #define _XOPEN_SOURCE
 #include <time.h>
 int main(void) { struct tm tm; char *res;
 res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm);
 if (!res) return 1; return 0; }
-] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"])
+]])] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"])
 else
 eval "ac_cv_c_strptime_works=maybe"
 fi
@@ -692,16 +699,26 @@ AC_REPLACE_FUNCS(memmove)
 AC_REPLACE_FUNCS(gmtime_r)
 AC_REPLACE_FUNCS(ctime_r)
 
+AC_ARG_ENABLE(allsymbols, AC_HELP_STRING([--enable-allsymbols], [export all symbols from libunbound and link binaries to it, smaller install size but libunbound export table is polluted by internal symbols]))
+case "$enable_allsymbols" in
+	no)
+	EXPORT_ALL_SYMBOLS=no
+	;;
+	yes)
+	EXPORT_ALL_SYMBOLS=yes
+	;;
+esac
+AC_SUBST(EXPORT_ALL_SYMBOLS)
+
 # check this after all other compilation checks, since the linking of the lib
 # may break checks after this.
-use_ldns_builtin="no"
 AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH], 
 	[specify prefix of path of ldns library to use]), 
-	[ specialldnsdir="$withval"
+	[
 	if test "$withval" != "yes"; then
-		if test "$withval" != ""; then
+		if test "$withval" != "/usr" -a "$withval" != ""; then
 			CPPFLAGS="-I$withval/include $CPPFLAGS"
-			LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
+			LDFLAGS="-L$withval/lib $LDFLAGS"
 			ACX_RUNTIME_PATH_ADD([$withval/lib])
 		fi
 		ldnsdir="$withval"
@@ -709,23 +726,23 @@ AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH],
 	fi
 ])
 
-AC_ARG_WITH(ldns-builtin, AC_HELP_STRING([--with-ldns-builtin], 
-	[forces use of package included with this one]), [ 
-	use_ldns_builtin="yes"
-])
-
 # check if ldns is good enough
-if test "$use_ldns_builtin" = "no"; then
-	AC_CHECK_LIB(ldns, ldns_buffer_copy)
-	AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
-	AC_CHECK_FUNC(ldns_b32_ntop_extended_hex)
-	if test x$use_gost = xyes; then
-	    AC_CHECK_FUNC(ldns_key_EVP_load_gost_id)
-	    AC_CHECK_FUNCS([ldns_key_EVP_unload_gost])
-	else
-	    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
-	fi
-	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT
+AC_CHECK_LIB(ldns, ldns_rr_new,,[
+	AC_MSG_ERROR([No ldns library found, install the ldns library into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Install the package ldns or download source http://www.nlnetlabs.nl/projects/ldns])
+])
+AC_CHECK_FUNC(ldns_buffer_copy)
+AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
+AC_CHECK_FUNC(ldns_get_random)
+AC_CHECK_FUNC(ldns_b32_ntop_extended_hex)
+if test x$use_gost = xyes; then
+    AC_CHECK_FUNC(ldns_key_EVP_load_gost_id)
+    AC_CHECK_FUNCS([ldns_key_EVP_unload_gost])
+else
+    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
+fi
+AC_CHECK_HEADERS([ldns/ldns.h],,[
+	AC_MSG_ERROR([No ldns include file found, install the ldns library development files.  Install package ldns-dev or ldns-devel or download source http://www.nlnetlabs.nl/projects/ldns])
+	], [AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
 #endif
@@ -746,38 +763,18 @@ if test "$use_ldns_builtin" = "no"; then
 #include <ws2tcpip.h>
 #endif
 ])
-	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
-	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
-	    -a $ac_cv_header_ldns_ldns_h = yes \
-	    -a $ac_cv_func_ldns_b32_ntop_extended_hex = yes \
-	    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
-	    dnl ldns was found
-	    :
-	else
-	    AC_MSG_ERROR([No ldns library found (or not recent); install or update ldns library, use --with-ldns=path or --with-ldns-builtin])
-	fi
+if test $ac_cv_func_ldns_buffer_copy = yes \
+    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
+    -a $ac_cv_func_ldns_get_random = yes \
+    -a $ac_cv_header_ldns_ldns_h = yes \
+    -a $ac_cv_func_ldns_b32_ntop_extended_hex = yes \
+    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
+    dnl ldns was found
+    :
+else
+    AC_MSG_ERROR([ldns library is not recent, update the ldns library, install it into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Package libldns or download source http://www.nlnetlabs.nl/projects/ldns])
 fi
 
-if test "$use_ldns_builtin" = "yes"; then
-dnl use the builtin ldns-src.tar.gz file to build ldns.
-if test ! -f $srcdir/ldns-src.tar.gz; then
-	AC_MSG_ERROR([No ldns library found and no ldns-src.tar.gz, use --with-ldns=path.])
-fi
-echo "****************************************************************"
-echo "***                                                          ***"
-echo "*** Building ldns library from package included in this one. ***"
-echo "***                                                          ***"
-echo "****************************************************************"
-if test -d $srcdir/ldns-src; then rm -rf $srcdir/ldns-src; fi
-mkdir $srcdir/ldns-src; cp $srcdir/ldns-src.tar.gz $srcdir/ldns-src/ldns-src.tar.gz; (cd $srcdir/ldns-src; gzip -cd ldns-src.tar.gz | tar xf -); rm -f $srcdir/ldns-src/ldns-src.tar.gz; mv $srcdir/ldns-src $srcdir/ldns-srcb; mv $srcdir/ldns-srcb/ldns* $srcdir/ldns-src; rmdir $srcdir/ldns-srcb
-ldnsdir="ldns-src"
-AC_MSG_NOTICE([Configure $ldnsdir scheduled after config.status])
-AC_CONFIG_SUBDIRS([ldns-src])
-CPPFLAGS="-I$ldnsdir/include $CPPFLAGS"
-LDFLAGS="$LDFLAGS $ldnsdir/*.lo"
-AC_SUBST(ldnsdir)
-fi  dnl end of use_ldns_builtin == yes
-
 ACX_STRIP_EXT_FLAGS
 LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
 
@@ -913,6 +910,12 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
+/** default port for unbound control traffic, registered port with IANA,
+    ub-dns-control  8953/tcp    unbound dns nameserver control */
+#define UNBOUND_CONTROL_PORT 8953
+/** the version of unbound-control that this software implements */
+#define UNBOUND_CONTROL_VERSION 1
+
 ])
 
 AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8])

contrib/README

@@ -7,9 +7,6 @@ distribution but may be helpful.
 * unbound.spec and unbound.init: RPM specfile and Linux rc.d initfile.
 * update-anchor.sh: shell script that uses unbound-host to update a set
 	of trust anchor files. Run from cron twice a month.
-* update-itar.sh: shell script that updates from itar.iana.org. Run from cron.
-* split-itar.sh: shell script to split anchors.mf from itar.iana.org into
-	multiple key files so it can be used with auto-trust-anchor-file.
 * unbound_munin_ : plugin for munin statistics report
 * unbound_cacti.tar.gz : setup files for cacti statistics report
 * selinux: the .fc and .te files for SElinux protection of the unbound daemon

contrib/split-itar.sh

@@ -1,46 +0,0 @@
-#/usr/bin/env bash
-# Contributed by Tom Hendrikx <tom@whyscream.net>
-
-PROGNAME=$(basename $0)
-
-usage() {
-	echo "$PROGNAME: split the anchors.mf file from IANA into separate files." >&2
-	echo "" >&2
-	echo "$PROGNAME uses 2 arguments:" >&2
-	echo "  - the path to the anchors.mf, available at: https://itar.iana.org/" >&2
-	echo "  - the directory to leave the files, defaults to '.' (current working dir)" >&2
-	exit 1
-}
-
-if [ -n "$1" ] && [ -r "$1" ]; then
-	itar="$1"
-	echo "Reading from: $itar"
-else 
-	echo "Error: no anchors file given" >&2
-	usage
-fi
-
-if [ -n "$2" ]; then
-	dir="$2"
-else 
-	dir=$(pwd)
-fi
-
-if [ ! -d "$dir" ]; then
-	echo "Error: $dir is not a directory" >&2
-	usage
-fi
-
-while read cn line; do
-	if [ $(expr match "$cn" '[a-zA-Z0-9-]*\.') -gt 0 ]; then
-		# first line of key
-		out="$dir/$cn"anchor
-		echo "writing key for $cn to: $out"
-		echo "$cn	$line" > $out
-	elif [ "$cn" == "DS" ]; then
-		# second or later line of earlier defined key
-		echo "	$cn	$line" >> $out
-	fi
-done < "$itar"
-
-echo "Done."

contrib/unbound.spec

@@ -1,14 +1,15 @@
 Summary: Validating, recursive, and caching DNS resolver
 Name: unbound
-Version: 1.4.4
+Version: 1.4.8
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
 Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 #Source1: unbound.init
 Group: System Environment/Daemons
+Requires: ldns
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel
+BuildRequires: flex, openssl-devel, expat-devel, ldns-devel
 
 %description
 Unbound is a validating, recursive, and caching DNS resolver.
@@ -28,10 +29,6 @@ The source code is under a BSD License.
 
 # configure with /var/unbound/unbound.conf so that all default chroot, 
 # pidfile and config file are in /var/unbound, ready for chroot jail set up.
-#
-# This is a build using libldns builtin version, the resulting binaries
-# do not require libldns and this package does not have version dependencies.
-# Could be smaller using a dependency on libldns (use --with-ldns=).
 %configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath
 
 %build
@@ -92,6 +89,18 @@ if [ "$1" -ge "1" ]; then
 fi
 
 %changelog
+* Thu Jul 13 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
+- ldns required and ldns-devel required for build, no more ldns-builtin.
+
+* Thu Mar 17 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
+- removed --disable-gost, assume recent openssl on the destination platform.
+
+* Wed Mar 16 2011 Harold Jones <hajones@verisign.com> - 1.4.8
+- Bump version number to latest
+- Add expat-devel to BuildRequires
+- Added --disable-gost for building on CentOS 5.x
+- Added --with-ldns-builtin for CentOS 5.x
+
 * Thu May 22 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.0.0
 - contrib changes from Patrick Vande Walle.
 

contrib/unbound.spec_fedora

@@ -8,7 +8,7 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.4.2
+Version: 1.4.13
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -16,16 +16,20 @@ Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 Source1: unbound.init
 Source2: unbound.conf
 Source3: unbound.munin
-Source4: dlv.isc.org.key
+Source4: unbound_munin_
+Source5: root.key
+Source6: dlv.isc.org.key
 Patch1: unbound-1.2-glob.patch
 
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: flex, openssl-devel , ldns-devel >= 1.5.0, 
-BuildRequires: libevent-devel 
+BuildRequires: libevent-devel expat-devel
 %if %{with_python}
-BuildRequires:  python-devel
+BuildRequires:  python-devel swig
 %endif
+# Required for SVN versions
+# BuildRequires: bison
 
 Requires(post): chkconfig
 Requires(preun): chkconfig
@@ -34,6 +38,9 @@ Requires(postun): initscripts
 Requires: ldns >= 1.5.0
 Requires(pre): shadow-utils
 
+Obsoletes:      dnssec-conf < 1.27-2
+Provides:       dnssec-conf = 1.27-1
+
 %description
 Unbound is a validating, recursive, and caching DNS(SEC) resolver.
 
@@ -67,7 +74,7 @@ Summary: Libraries used by the unbound server and client applications
 Group: Applications/System
 Requires(post): /sbin/ldconfig
 Requires(postun): /sbin/ldconfig
-Requires: openssl >= 0.9.8g-12
+Requires: openssl 
 
 %description libs
 Contains libraries used by the unbound server and client applications
@@ -88,14 +95,14 @@ Python modules and extensions for unbound
 
 %build
 %configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
-            --disable-rpath --enable-debug --disable-static \
+            --disable-rpath --disable-static \
             --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \
             --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \
 %if %{with_python}
             --with-pythonmodule --with-pyunbound \
 %endif
-            --enable-sha2 
-%{__make} 
+            --enable-sha2 --disable-gost
+%{__make} %{?_smp_mflags}
 
 %install
 rm -rf %{buildroot}
@@ -107,16 +114,19 @@ install -m 0755 %{SOURCE2} %{buildroot}%{_sysconfdir}/unbound
 install -d 0755 %{buildroot}%{_sysconfdir}/munin/plugin-conf.d
 install -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/munin/plugin-conf.d/unbound
 install -d 0755 %{buildroot}%{_datadir}/munin/plugins/
-install -m 0755 contrib/unbound_munin_ %{buildroot}%{_datadir}/munin/plugins/unbound
+install -m 0755 %{SOURCE4} %{buildroot}%{_datadir}/munin/plugins/unbound
 for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unbound_munin_by_type unbound_munin_by_class unbound_munin_by_opcode unbound_munin_by_rcode unbound_munin_by_flags unbound_munin_histogram; do
     ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin
 done 
 
-# install DLV key
-install -m 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/unbound/
+# install root and DLV key
+install -m 0644 %{SOURCE5} %{SOURCE6} %{buildroot}%{_sysconfdir}/unbound/
 
 # remove static library from install (fedora packaging guidelines)
-rm -rf %{buildroot}%{_libdir}/*.la
+rm %{buildroot}%{_libdir}/*.la
+%if %{with_python}
+rm %{buildroot}%{python_sitearch}/*.la
+%endif
 
 mkdir -p %{buildroot}%{_localstatedir}/run/unbound
 
@@ -128,15 +138,19 @@ rm -rf ${RPM_BUILD_ROOT}
 %doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
 %attr(0755,root,root) %{_initrddir}/%{name}
 %attr(0755,root,root) %dir %{_sysconfdir}/%{name}
-%attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
+%ghost %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/root.key
 %{_sbindir}/*
 %{_mandir}/*/*
 
 %if %{with_python}
 %files python
-%{python_sitelib}/*
+%defattr(-,root,root,-)
+%{python_sitearch}/*
+%doc libunbound/python/examples/*
+%doc pythonmod/examples/*
 %endif
 
 %files munin
@@ -186,10 +200,90 @@ fi
 %postun libs -p /sbin/ldconfig
 
 %changelog
+* Tue Sep 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.13-1
+- Updated to 1.4.13
+- Fix install location of pythonmod from sitelib to sitearch
+- Removed patches merged in by upstream
+- Removed versioned openssl dep, it differs per branch
+ 
+* Mon Aug 08 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-3
+- Added pythonmod docs and examples
+- Fix for python module load in the server (Tom Hendrikx)
+- No longer enable --enable-debug as it causes degraded  performance
+  under load.
+
+* Mon Jul 18 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-1
+- Updated to 1.4.12
+
+* Sun Jul 03 2011 Paul Wouters <paul@xelerance.com> - 1.4.11-1
+- Updated to 1.4.11
+- removed integrated CVE patch
+- updated stock unbound.conf for new options introduced
+
+* Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.10-1
+- Added ghost for /var/run/unbound (bz#656710)
+
+* Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-3
+- rebuilt
+
+* Wed May 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-2
+- Applied patch for CVE-2011-1922 DoS vulnerability
+
+* Sun Mar 27 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-1
+- Updated to 1.4.9
+
+* Sat Feb 12 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-2
+- rebuilt
+
+* Tue Jan 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-1
+- Updated to 1.4.8
+- Enable root key for DNSSEC
+- Fix unbound-munin to use proper file (could cause excessive logging)
+- Build unbound-python per default
+- Disable gost as Fedora/EPEL does not allow ECC and has mangled openssl
+
+* Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-4
+- Revert last build - it was on the wrong branch
+
+* Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-3
+- Disable do-ipv6 per default - causes severe degradation on non-ipv6 machines
+  (see comments in inbound.conf)
+
+* Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-2
+- Bump release - forgot to upload the new tar ball.
+
+* Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-1
+- Upgraded to 1.4.5
+
+* Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-2
+- Added accidentally omitted svn patches to cvs 
+
+* Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-1
+- Upgraded to 1.4.4 with svn patches
+- Obsolete dnssec-conf to ensure it is de-installed
+
+* Thu Mar 11 2010 Paul Wouters <paul@xelerance.com> - 1.4.3-1
+- Update to 1.4.3 that fixes 64bit crasher
+
+* Tue Mar 09 2010 Paul Wouters <paul@xelerance.com> - 1.4.2-1
+- Updated to 1.4.2 
+- Updated unbound.conf with new options
+- Enabled pre-fetching DNSKEY records (DNSSEC speedup)
+- Enabled re-fetching popular records before they expire
+- Enabled logging of DNSSEC validation errors
+
+* Mon Mar 01 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-5
+- Overriding -D_GNU_SOURCE is no longer needed. This fixes DSO issues
+  with pthreads
+
+* Wed Feb 24 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-3
+- Change make/configure lines to attempt to fix -lphtread linking issue
+
 * Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
 - Removed dependancy for dnssec-conf
 - Added ISC DLV key (formerly in dnssec-conf)
 - Fixup old DLV locations in unbound.conf file via %%post
+- Fix parent child disagreement handling and no-ipv6 present [svn r1953]
 
 * Tue Jan 05 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-1
 - Updated to 1.4.1

contrib/update-itar.sh

@@ -1,128 +0,0 @@
-#!/bin/sh
-# update-itar.sh - update from the interim trust anchor repository
-# Copyright 2009, W.C.A. Wijngaards
-# This file is BSD licensed, see doc/LICENSE.
-
-# --- Some settings
-
-# directory where unbound works
-thedir="."
-# where is the file that unbound is going to read
-ub_ta_file="$thedir/anchors.mf"
-# where is the itar master file format
-itar_url="ftp://ftp.iana.org/itar/anchors.mf"
-# where is the itar PGP signature
-itar_sig="ftp://ftp.iana.org/itar/anchors.mf.sig"
-
-# which command to fetch urls, cmd $dest $url. "wget -O" "curl -o"
-fetch_cmd="wget -O"
-# file with pgp public key
-pgp_pub_key_file="$thedir/update-itar.key"
-# our pgp keyring (goes into .gnupg directory)
-pgp_keyring_file="update-itar.ring"
-# pgp command to use
-pgp_cmd="gpg"
-
-
-# --- The script is below
-usage ( )
-{
-	echo "usage: update-itar"
-	echo "    Updates the trust anchors from the interim trust"
-	echo "    anchor repository, https://itar.iana.org, and checks PGP sig."
-	echo
-	echo "    Updates $ub_ta_file with the latest keys."
-	echo "    Read that file from the unbound config with"
-	echo "    trust-anchor-file: "'"'"$ub_ta_file"'"'
-	echo
-	echo "    Exit code 0 means anchors updated, 1 no changes, "
-	echo "    others are errors. So, in a cronjob you can do:"
-	echo "    cd /usr/local/etc/unbound    # your unbound work dir"
-	echo "    ./update-itar.sh && unbound-control reload"
-	exit 2
-}
-
-if test $# -ne 0; then
-	usage
-fi
-tmpf="/tmp/update-itar.$$"
-
-# one argument: explanation string
-error_exit ( )
-{
-	if test -f $tmpf.log; then cat $tmpf.log; fi
-	rm -f $tmpf $tmpf.sig $tmpf.log
-	echo "Error updating trust anchors: $1"
-	exit 2
-}
-
-if test ! -f $pgp_pub_key_file || test ! -f $HOME/.gnupg/$pgp_keyring_file || \
-	test "$pgp_pub_key_file" -nt $HOME/.gnupg/$pgp_keyring_file; then
-	# default key contents right here
-	if test ! -f $pgp_pub_key_file; then
-		echo "creating default IANA ITAR pgp key file"
-		cat >$pgp_pub_key_file <<EOF
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.5
-
-mQGiBElr2DcRBAC+6YK6eSP7rzstvnMPQXMrpvVfuIR5FeTpGuwae9JP78V/iOXr
-N0yW8Dn6kdAztCMuRizL1Ij9IgaD7pjn8h09VgR4cN4LDv75rcQeWLzNxKy4UNRF
-aStL77RcIoTblBeCgHAK9FLzd0XfTGZCNaLNy9BYVSLyADOVDIqgBcrvBwCglz03
-QhOMIgaSx/XuRh6kYtynZ6kD/2GXx6pFs57b7rww8yOpdurCSOMB1wuEXiIXznTI
-06ARiib0G5VDvOdpy0LDU2526Q9f/WAERlhcExTgnTFigG4mRksUiDrrai4GIr+6
-JaivcGFVYdZZ4mZ088jcwujS/UY3C0ryGR9ufYUDAnfx6frhSl6o6j5is+jeGndF
-JYRAA/9B/1OXNVwFSiIxnP2aPUwsT1li1vaW8dhA/5PcuPLOVvEjPc1Pc16HGLhE
-8CRmMn66LqB1ccInE5hLKGGvV3pctjan+IOhaq3OHt/a+buDtTPgykchMZ2k1AzT
-RYk+gksxpIl6yTZsBH4hoRt8auxEJW8AiYbNtXXkNuWcoQL40bQsSUFOQSBUcnVz
-dCBBbmNob3IgUmVwb3NpdG9yeSA8aXRhckBpYW5hLm9yZz6IYAQTEQIAIAUCSWvY
-NwIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEPR9+zCB1GT0GUAAn29/TacF
-Teh87dls8pmkjxS4pKf1AKCJS/MvzR54AblO4DNMyc9q0G4frrkCDQRJa9g3EAgA
-ywoLxF4HVb9o926UIXw8JxNIzDPkt8galAcKRUmHQMNa/QA80WMl9Ia6DIxavGlV
-I5O1fvms297RV2KSSBjKWn6G+0me80A7aw0eHNg7habM5VtzDz5DhJbQFdJV9aYV
-DoTSnY6uR6iSSRrdZNaYdlCwDS8lBCnOKoGMArHzVCa2EdCBeCUY/eObOXtu8Gm3
-nDkuWeLPv08/0lvtr6d6VoDUEVPEsJAPONEYtpz/D+EZddUraF+3JscWqfRApBOz
-/8WHaeTNdzIH+h1ntktiizA6eH40EM6coQQxtIRsxg1DPTxofdovreMkcMI0EUUP
-awDn8gDtgG3g6Ud5zCdknwAEDQf/W3rxrEN6OZxJvWti8Iu6KOgxtuINiAsimPPX
-qy9KHowyEE9EMPzgADjWC9Reyusr4CwcootjWw7ryUwU0fXvVULKhg32NzLsx/Ci
-WtgCPSR58WZ1KKhnoB05+PTrwzhU+u64Cd/vJtFqGxSrANl2FAkPswHJMr8dMwAz
-uni7zzLJ+homW1T5AaixwmN3jeDHWshJH9E9JIhr5Y/8AzMl1V10r2u1c2ej0lBJ
-Y4GegI5cYAEBerS9d+mrbPlvbJ8AfuAuEf0y/PWJh0z1+Kck5qIbXMn/rpMBYvLJ
-Uj5CfqWlh8+hxqSYJDXtLm8hBiQFiMEew0jOc2Tw4F91OZ+jyYhJBBgRAgAJBQJJ
-a9g3AhsMAAoJEPR9+zCB1GT0AUwAn2ZtBwAyVxppdeTqilXufUvAkvjbAJ9dUpR1
-9a17/5BvDDJcIxSEKTJmDw==
-=zCNZ
------END PGP PUBLIC KEY BLOCK-----
-EOF
-	fi
-	# import the new key
-	$pgp_cmd --no-default-keyring --keyring $pgp_keyring_file \
-		--primary-keyring $pgp_keyring_file \
-		--import $pgp_pub_key_file >$tmpf.log 2>&1 \
-		|| error_exit "could not import pgp public key into keyring"
-fi
-
-$fetch_cmd $tmpf $itar_url >$tmpf.log 2>&1 \
-	|| error_exit "fetching $itar_url failed"
-tail -2 $tmpf | grep "; End of file" >/dev/null 2>&1 || \
-	error_exit "The file fetched from $itar_url was partial"
-$fetch_cmd $tmpf.sig $itar_sig >$tmpf.log 2>&1 \
-	|| error_exit "fetching $itar_sig failed"
-
-# check the file with pgp
-$pgp_cmd --no-default-keyring --keyring $pgp_keyring_file \
-	--verify $tmpf.sig $tmpf >$tmpf.log 2>&1 \
-	|| error_exit "the PGP signature failed!"
-
-# check for differences
-val=1
-if diff "$ub_ta_file" $tmpf 2>/dev/null ; then
-	# echo "The interim trust anchor repository did not change."
-	:
-else
-	echo "Updating $ub_ta_file"
-	cp $tmpf $ub_ta_file
-	val=0
-fi
-
-rm -f $tmpf $tmpf.sig $tmpf.log
-exit $val 

contrib/validation-reporter.sh

@@ -0,0 +1,117 @@
+#!/bin/sh
+# validation reporter - reports validation failures to a collection server.
+# Copyright NLnet Labs, 2010
+# BSD license.
+
+
+###
+# Here is the configuration for the validation reporter
+# it greps the failure lines out of the log and sends them to a server.
+
+# The pidfile for the reporter daemon.
+pidfile="/var/run/validation-reporter.pid"
+
+# The logfile to watch for logged validation failures.
+logfile="/var/log/unbound.log"
+
+# how to notify the upstream 
+# nc is netcat, it sends tcp to given host port.  It makes a tcp connection
+# and writes one log-line to it (grepped from the logfile).
+# the notify command can be: "nc the.server.name.org 1234"
+# the listening daemon could be:  nc -lk 127.0.0.1 1234 >> outputfile &
+notify_cmd="nc localhost 1234"
+
+
+###
+# Below this line is the code for the validation reporter,
+# first the daemon itself, then the controller for the daemon.
+reporter_daemon() {
+	trap "rm -f \"$pidfile\"" EXIT
+	tail -f $logfile | grep "unbound.*info: validation failure" | \
+	while read x; do
+		echo "$x" | $notify_cmd
+	done
+}
+
+
+###
+# controller for daemon.
+start_daemon() {
+	echo "starting reporter"
+	nohup $0 rundaemon </dev/null >/dev/null 2>&1 &
+	echo $! > "$pidfile"
+}
+
+kill_daemon() {
+	echo "stopping reporter"
+	if test -s "$pidfile"; then
+		kill `cat "$pidfile"`
+		# check it is really dead
+		if kill -0 `cat "$pidfile"` >/dev/null 2>&1; then
+			sleep 1
+			while kill -0 `cat "$pidfile"` >/dev/null 2>&1; do
+				kill `cat "$pidfile"` >/dev/null 2>&1
+				echo "waiting for reporter to stop"
+				sleep 1
+			done
+		fi
+	fi
+}
+
+get_status_daemon() {
+	if test -s "$pidfile"; then
+		if kill -0 `cat "$pidfile"`; then
+			return 0;
+		fi
+	fi
+	return 1;
+}
+
+restart_daemon() {
+	kill_daemon
+	start_daemon
+}
+
+condrestart_daemon() {
+	if get_status_daemon; then
+		echo "reporter ("`cat "$pidfile"`") is running"
+		exit 0
+	fi
+	start_daemon
+	exit 0
+}
+
+status_daemon() {
+	if get_status_daemon; then
+		echo "reporter ("`cat "$pidfile"`") is running"
+		exit 0
+	fi
+	echo "reporter is not running"
+	exit 1
+}
+
+case "$1" in
+	rundaemon)
+		reporter_daemon
+	;;
+	start)
+		start_daemon
+	;;
+	stop)
+		kill_daemon
+	;;
+	restart)
+		restart_daemon
+	;;
+	condrestart)
+		condrestart_daemon
+	;;
+	status)
+		status_daemon
+	;;
+	*)
+		echo "Usage: $0 {start|stop|restart|condrestart|status}"
+		exit 2
+	;;
+esac
+exit $?

daemon/daemon.c

@@ -326,7 +326,7 @@ daemon_create_workers(struct daemon* daemon)
 	numport = daemon_get_shufport(daemon, shufport);
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
 	
-	daemon->num = daemon->cfg->num_threads;
+	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
 	for(i=0; i<daemon->num; i++) {
@@ -539,7 +539,7 @@ daemon_delete(struct daemon* daemon)
 #endif
 #if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
 #ifndef S_SPLINT_S
-	sk_SSL_COMP_pop_free(comp_meth, (void*)CRYPTO_free);
+	sk_SSL_COMP_pop_free(comp_meth, (void(*)())CRYPTO_free);
 #endif
 #endif
 #ifdef HAVE_OPENSSL_CONFIG

daemon/remote.c

@@ -395,7 +395,6 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	/* create new commpoint unless we are servicing already */
 	if(rc->active >= rc->max_active) {
 		log_warn("drop incoming remote control: too many connections");
-		comm_point_stop_listening(c);
 	close_exit:
 #ifndef USE_WINSOCK
 		close(newfd);
@@ -429,6 +428,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	n->ssl = SSL_new(rc->ctx);
 	if(!n->ssl) {
 		log_crypto_err("could not SSL_new");
+		comm_point_delete(n->c);
 		free(n);
 		goto close_exit;
 	}
@@ -437,6 +437,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	if(!SSL_set_fd(n->ssl, newfd)) {
 		log_crypto_err("could not SSL_set_fd");
 		SSL_free(n->ssl);
+		comm_point_delete(n->c);
 		free(n);
 		goto close_exit;
 	}
@@ -702,13 +703,14 @@ print_mem(SSL* ssl, struct worker* worker, struct daemon* daemon)
 
 /** print uptime stats */
 static int
-print_uptime(SSL* ssl, struct worker* worker)
+print_uptime(SSL* ssl, struct worker* worker, int reset)
 {
 	struct timeval now = *worker->env.now_tv;
 	struct timeval up, dt;
 	timeval_subtract(&up, &now, &worker->daemon->time_boot);
 	timeval_subtract(&dt, &now, &worker->daemon->time_last_stat);
-	worker->daemon->time_last_stat = now;
+	if(reset)
+		worker->daemon->time_last_stat = now;
 	if(!ssl_printf(ssl, "time.now"SQ"%d.%6.6d\n", 
 		(unsigned)now.tv_sec, (unsigned)now.tv_usec)) return 0;
 	if(!ssl_printf(ssl, "time.up"SQ"%d.%6.6d\n", 
@@ -892,7 +894,7 @@ do_stats(SSL* ssl, struct daemon_remote* rc, int reset)
 	total.mesh_time_median /= (double)daemon->num;
 	if(!print_stats(ssl, "total", &total)) 
 		return;
-	if(!print_uptime(ssl, rc->worker))
+	if(!print_uptime(ssl, rc->worker, reset))
 		return;
 	if(daemon->cfg->stat_extended) {
 		if(!print_mem(ssl, rc->worker, daemon)) 
@@ -1062,6 +1064,9 @@ do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
 	hashvalue_t h;
 	struct query_info k;
 	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c, 0);
+	if(t == LDNS_RR_TYPE_SOA)
+		rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c,
+			PACKED_RRSET_SOA_NEG);
 	k.qname = nm;
 	k.qname_len = nmlen;
 	k.qtype = t;
@@ -1867,7 +1872,8 @@ static void
 handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 {
 	int r;
-	char magic[5];
+	char pre[10];
+	char magic[7];
 	char buf[1024];
 #ifdef USE_WINSOCK
 	/* makes it possible to set the socket blocking again. */
@@ -1876,7 +1882,7 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 #endif
 	fd_set_block(s->c->fd);
 
-	/* try to read magic UBCT string */
+	/* try to read magic UBCT[version]_space_ string */
 	ERR_clear_error();
 	if((r=SSL_read(ssl, magic, (int)sizeof(magic)-1)) <= 0) {
 		if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN)
@@ -1884,9 +1890,10 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 		log_crypto_err("could not SSL_read");
 		return;
 	}
-	magic[4] = 0;
-	if( r != 4 || strcmp(magic, "UBCT") != 0) {
+	magic[6] = 0;
+	if( r != 6 || strncmp(magic, "UBCT", 4) != 0) {
 		verbose(VERB_QUERY, "control connection has bad magic string");
+		/* probably wrong tool connected, ignore it completely */
 		return;
 	}
 
@@ -1894,6 +1901,13 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 	if(!ssl_read_line(ssl, buf, sizeof(buf))) {
 		return;
 	}
+	snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
+	if(strcmp(magic, pre) != 0) {
+		verbose(VERB_QUERY, "control connection had bad "
+			"version %s, cmd: %s", magic, buf);
+		ssl_printf(ssl, "error version mismatch\n");
+		return;
+	}
 	verbose(VERB_DETAIL, "control cmd: %s", buf);
 
 	/* figure out what to do */

daemon/stats.c

@@ -100,12 +100,14 @@ void server_stats_log(struct server_stats* stats, struct worker* worker,
 		(unsigned)stats->num_queries_missed_cache,
 		(unsigned)stats->num_queries_prefetch);
 	log_info("server stats for thread %d: requestlist max %u avg %g "
-		"exceeded %u", threadnum, (unsigned)stats->max_query_list_size,
+		"exceeded %u jostled %u", threadnum,
+		(unsigned)stats->max_query_list_size,
 		(stats->num_queries_missed_cache+stats->num_queries_prefetch)?
 			(double)stats->sum_query_list_size/
 			(stats->num_queries_missed_cache+
 			stats->num_queries_prefetch) : 0.0,
-		(unsigned)worker->env.mesh->stats_dropped);
+		(unsigned)worker->env.mesh->stats_dropped,
+		(unsigned)worker->env.mesh->stats_jostled);
 }
 
 /** get rrsets bogus number from validator */

daemon/unbound.c

@@ -199,7 +199,7 @@ checkrlimits(struct config_file* cfg)
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	int numthread = 1; /* it forks */
 #else
-	int numthread = cfg->num_threads;
+	int numthread = (cfg->num_threads?cfg->num_threads:1);
 #endif
 	size_t total = numthread * perthread + misc;
 	size_t avail;

daemon/worker.c

@@ -446,7 +446,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	uint16_t udpsize = edns->udp_size;
 	int secure = 0;
 	uint32_t timenow = *worker->env.now;
-	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
+	int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd)
+		&& worker->env.need_to_validate;
 	struct dns_msg *msg = NULL;
 	struct delegpt *dp;
 
@@ -522,7 +523,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	uint32_t timenow = *worker->env.now;
 	uint16_t udpsize = edns->udp_size;
 	int secure;
-	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
+	int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd)
+		&& worker->env.need_to_validate;
 	/* see if it is possible */
 	if(rep->ttl < timenow) {
 		/* the rrsets may have been updated in the meantime.
@@ -737,17 +739,21 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			worker->stats.unwanted_queries++;
 		return 0;
 	} else if(acl == acl_refuse) {
+		log_addr(VERB_ALGO, "refused query from",
+			&repinfo->addr, repinfo->addrlen);
+		log_buf(VERB_ALGO, "refuse", c->buffer);
+		if(worker->stats.extended)
+			worker->stats.unwanted_queries++;
+		if(worker_check_request(c->buffer, worker) == -1) {
+			comm_point_drop_reply(repinfo);
+			return 0; /* discard this */
+		}
 		ldns_buffer_set_limit(c->buffer, LDNS_HEADER_SIZE);
 		ldns_buffer_write_at(c->buffer, 4, 
 			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
 		LDNS_QR_SET(ldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(ldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
-		log_addr(VERB_ALGO, "refused query from",
-			&repinfo->addr, repinfo->addrlen);
-		log_buf(VERB_ALGO, "refuse", c->buffer);
-		if(worker->stats.extended)
-			worker->stats.unwanted_queries++;
 		return 1;
 	}
 	if((ret=worker_check_request(c->buffer, worker)) != 0) {
@@ -773,10 +779,16 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		server_stats_insrcode(&worker->stats, c->buffer);
 		return 1;
 	}
+	if(worker->env.cfg->log_queries) {
+		char ip[128];
+		addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
+		log_nametypeclass(0, ip, qinfo.qname, qinfo.qtype, qinfo.qclass);
+	}
 	if(qinfo.qtype == LDNS_RR_TYPE_AXFR || 
 		qinfo.qtype == LDNS_RR_TYPE_IXFR) {
 		verbose(VERB_ALGO, "worker request: refused zone transfer.");
 		log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
+		ldns_buffer_rewind(c->buffer);
 		LDNS_QR_SET(ldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(ldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
@@ -1243,8 +1255,9 @@ worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(worker->back, qname,
 		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
-		addr, addrlen, worker_handle_service_reply, e, 
-		worker->back->udp_buff, &outbound_entry_compare);
+		q->env->cfg->tcp_upstream, addr, addrlen,
+		worker_handle_service_reply, e, worker->back->udp_buff,
+		&outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}

doc/Changelog

@@ -1,3 +1,303 @@
+12 September 2011: Wouter
+	- Reverted dns EDNS backoff fix, it did not help and needs
+	  fragmentation fixes instead.
+
+7 September 2011: Wouter
+	- Fix operation in ipv6 only (do-ip4: no) mode.
+
+6 September 2011: Wouter
+	- fedora specfile updated.
+
+5 September 2011: Wouter
+	- tag 1.4.13rc1
+
+2 September 2011: Wouter
+	- iana portlist updated.
+
+26 August 2011: Wouter
+	- Fix num-threads 0 does not segfault, reported by Simon Deziel.
+	- Fix validation failures due to EDNS backoff retries, the retry
+	  for fetch of data has want_dnssec because the iter_indicate_dnssec
+	  function returns true when validation failure retry happens, and
+	  then the serviced query code does not fallback to noEDNS, even if
+	  the cache says it has this.  This helps for DLV deployment when
+	  the DNSSEC status is not known for sure before the lookup concludes.
+
+24 August 2011: Wouter
+	- Applied patch from Karel Slany that fixes a memory leak in the
+	  unbound python module, in string conversions.
+
+22 August 2011: Wouter
+	- Fix validation of qtype ANY responses with CNAMEs (thanks Cathy
+	  Zhang and Luo Ce).  Unbound responds with the RR types that are
+	  available at the name for qtype ANY and validates those RR types.
+	  It does not test for completeness (i.e. with NSEC or NSEC3 query),
+	  and it does not follow the CNAME or DNAME to another name (with
+	  even more data for the already large response).
+	- Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
+	- Documented the options that work with control set_option command.
+	- tcp-upstream yes/no option (works with set_option) for tunnels.
+
+18 August 2011: Wouter
+	- fix autoconf call in makedist crosscompile to RC or snapshot.
+
+17 August 2011: Wouter
+	- Fix validation of . DS query.
+	- new xml format at IANA, new awk for iana_update.
+	- iana portlist updated.
+
+10 August 2011: Wouter
+	- Fix python site-packages path to /usr/lib64.
+	- updated patch from Tom.
+	- fix memory and fd leak after out-of-memory condition.
+
+9 August 2011: Wouter
+	- patch from Tom Hendrikx fixes load of python modules.
+
+8 August 2011: Wouter
+	- make clean had ldns-src reference, removed.
+
+1 August 2011: Wouter
+	- Fix autoconf 2.68 warnings
+
+14 July 2011: Wouter
+	- Unbound implements RFC6303 (since version 1.4.7).
+	- tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the
+	  meantime, those are for 1.4.13).
+	- iana portlist updated.
+
+13 July 2011: Wouter
+	- Quick fix for contrib/unbound.spec example, no ldns-builtin any more.
+
+11 July 2011: Wouter
+	- Fix wildcard expansion no-data reply under an optout NSEC3 zone is
+	  validated as insecure, reported by Jia Li (lijia@cnnic.cn).
+
+4 July 2011: Wouter
+	- 1.4.12rc1 tag created.
+
+1 July 2011: Wouter
+	- version number in example config file.
+	- fix that --enable-static-exe does not complain about it unknown.
+
+30 June 2011: Wouter
+	- tag relase 1.4.11, trunk is 1.4.12 development.
+	- iana portlist updated.
+	- fix bug#395: id bits of other query may leak out under conditions
+	- fix replyaddr count wrong after jostled queries, which leads to
+	  eventual starvation where the daemon has no replyaddrs left to use.
+	- fix comment about rndc port, that referred to the old port number.
+	- fix that the listening socket is not closed when too many remote
+	  control connections are made at the same time.
+	- removed ldns-src tarball inside the unbound tarball.
+
+23 June 2011: Wouter
+	- Changed -flto check to support clang compiler.
+	- tag 1.4.11rc3 created.
+
+17 June 2011: Wouter
+	- tag 1.4.11rc1 created.
+	- remove warning about signed/unsigned from flex (other flex version).
+	- updated aclocal.m4 and libtool to match.
+	- tag 1.4.11rc2 created.
+
+16 June 2011: Wouter
+	- log-queries: yesno option, default is no, prints querylog.
+	- version is 1.4.11.
+
+14 June 2011: Wouter
+	- Use -flto compiler flag for link time optimization, if supported.
+	- iana portlist updated.
+
+12 June 2011: Wouter
+	- IPv6 service address for d.root-servers.net (2001:500:2D::D).
+
+10 June 2011: Wouter
+	- unbound-control has version number in the header,
+	  UBCT[version]_space_ is the header sent by the client now.
+	- Unbound control port number is registered with IANA:
+	  ub-dns-control  8953/tcp    unbound dns nameserver control
+	  This is the new default for the control-port config setting.
+	- statistics-interval prints the number of jostled queries to log.
+
+30 May 2011: Wouter
+	- Fix Makefile for U in environment, since wrong U is more common than
+	  deansification necessity.
+	- iana portlist updated.
+	- updated ldns tarball to 1.6.10rc2 snapshot of today.
+
+25 May 2011: Wouter
+	- Fix assertion failure when unbound generates an empty error reply
+	  in response to a query, CVE-2011-1922 VU#531342.
+	- This fix is in tag 1.4.10.
+	- defense in depth against the above bug, an error is printed to log
+	  instead of an assertion failure.
+
+10 May 2011: Wouter
+	- bug#386: --enable-allsymbols option links all binaries to libunbound
+	  and reduces install size significantly.
+	- feature, ignore-cd-flag: yesno to provide dnssec to legacy servers.
+	- iana portlist updated.
+	- Fix TTL of SOA so negative TTL is separately cached from normal TTL.
+
+14 April 2011: Wouter
+	- configure created with newer autoconf 2.66.
+
+12 April 2011: Wouter
+	- bug#378: Fix that configure checks for ldns_get_random presence.
+
+8 April 2011: Wouter
+	- iana portlist updated.
+	- queries with CD flag set cause DNSSEC validation, but the answer is
+	  not withheld if it is bogus.  Thus, unbound will retry if it is bad
+	  and curb the TTL if it is bad, thus protecting the cache for use by
+	  downstream validators.
+	- val-override-date: -1 ignores dates entirely, for NTP usage.
+
+29 March 2011: Wouter
+	- harden-below-nxdomain: changed so that it activates when the
+	  cached nxdomain is dnssec secure.  This avoids backwards
+	  incompatibility because those old servers do not have dnssec.
+
+24 March 2011: Wouter
+	- iana portlist updated.
+	- release 1.4.9.
+	- trunk is 1.5.0
+
+17 March 2011: Wouter
+	- bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
+	  Applied but did not do the --disable-gost.
+
+10 March 2011: Wouter
+	- tag 1.4.9 release candidate 1 created.
+
+3 March 2011: Wouter
+	- updated ldns to today.
+
+1 March 2011: Wouter
+	- Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
+	- give config parse error for multiple names on a stub or forward zone.
+	- updated ldns tarball to 1.6.9(todays snapshot).
+
+24 February 2011: Wouter
+	- bug #361: Fix, time.elapsed variable not reset with stats_noreset.
+
+23 February 2011: Wouter
+	- iana portlist updated.
+	- common.sh to version 3.
+
+18 February 2011: Wouter
+	- common.sh in testdata updated to version 2.
+
+15 February 2011: Wouter
+	- Added explicit note on unbound-anchor usage:
+	  Please note usage of unbound-anchor root anchor is at your own risk
+	  and under the terms of our LICENSE (see that file in the source).
+
+11 February 2011: Wouter
+	- iana portlist updated.
+	- tpkg updated with common.sh for common functionality.
+
+7 February 2011: Wouter
+	- Added regression test for addition of a .net DS to the root, and
+	  cache effects with different TTL for glue and DNSKEY.
+	- iana portlist updated.
+
+28 January 2011: Wouter
+	- Fix remove private address does not throw away entire response.
+
+24 January 2011: Wouter
+	- release 1.4.8
+
+19 January 2011: Wouter
+	- fix bug#349: no -L/usr for ldns.
+
+18 January 2011: Wouter
+	- ldns 1.6.8 tarball included.
+	- release 1.4.8rc1.
+
+17 January 2011: Wouter
+	- add get and set option for harden-below-nxdomain feature.
+	- iana portlist updated.
+
+14 January 2011: Wouter
+	- Fix so a changed NS RRset does not get moved name stuck on old
+	  server, for type NS the TTL is not increased.
+
+13 January 2011: Wouter
+	- Fix prefetch so it does not get stuck on old server for moved names.
+
+12 January 2011: Wouter
+	- iana portlist updated.
+
+11 January 2011: Wouter
+	- Fix insecure CNAME sequence marked as secure, reported by Bert
+	  Hubert.
+
+10 January 2011: Wouter
+	- faster lruhash get_mem routine.
+
+4 January 2011: Wouter
+	- bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root.
+	- iana portlist updated.
+
+23 December 2010: Wouter
+	- Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
+
+21 December 2010: Wouter
+	- algorithm compromise protection using the algorithms signalled in
+	  the DS record.  Also, trust anchors, DLV, and RFC5011 receive this,
+	  and thus, if you have multiple algorithms in your trust-anchor-file
+	  then it will now behave different than before.  Also, 5011 rollover
+	  for algorithms needs to be double-signature until the old algorithm
+	  is revoked.
+	  It is not an option, because I see no use to turn the security off.
+	- iana portlist updated.
+
+17 December 2010: Wouter
+	- squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them).
+	- fix validation in this case: CNAME to nodata for co-hosted opt-in
+	  NSEC3 insecure delegation, was bogus, fixed to be insecure.
+
+16 December 2010: Wouter
+	- Fix our 'BDS' license (typo reported by Xavier Belanger).
+
+10 December 2010: Wouter
+	- iana portlist updated.
+	- review changes for unbound-anchor.
+
+2 December 2010: Wouter
+	- feature typetransparent localzone, does not block other RR types.
+
+1 December 2010: Wouter
+	- Fix bug#338: print address when socket creation fails.
+
+30 November 2010: Wouter
+	- Fix storage of EDNS failures in the infra cache.
+	- iana portlist updated.
+
+18 November 2010: Wouter
+	- harden-below-nxdomain option, default off (because very old
+	  software may be incompatible).  We could enable it by default in
+	  the future.
+
+17 November 2010: Wouter
+	- implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.
+	- make test output nicer.
+
+15 November 2010: Wouter
+	- silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
+	- iana portlist updated.
+	- so-sndbuf option for very busy servers, a bit like so-rcvbuf.
+
+9 November 2010: Wouter
+	- unbound-anchor compiles with openssl 0.9.7.
+
+8 November 2010: Wouter
+	- release tag 1.4.7.
+	- trunk is version 1.4.8.
+	- Be lenient and accept imgw.pl malformed packet (like BIND).
+
 5 November 2010: Wouter
 	- do not synthesize a CNAME message from cache for qtype DS.
 

doc/README

@@ -11,16 +11,14 @@ This software is under BSD license, see LICENSE for details.
 
 * Uses the following libraries; 
   * ldns	http://www.nlnetlabs.nl/ldns/			(BSD license)
-    (required) can use tarball from source directory.
+    (required) can use ldns build directory directly with --with-ldns=path.
   * libevent	http://www.monkey.org/~provos/libevent/		(BSD license)
     (optional) can use builtin alternative instead.
 
 * Make and install: ./configure; make; make install
   * Use GNU make; default on linux, often called 'gmake' on BSD and Solaris.
   * --with-ldns=/path/to/ldns
-  	If ldns is not detected on the system, a prepackaged tarball
-	of the ldns library is used to compile and statically link against.
-	If detected on the system, it will dynamically link against it.
+	It will dynamically link against it.
   * --with-libevent=/path/to/libevent
   	Can be set to either the system install or the build directory.
 	--with-libevent=no (default) gives a builtin alternative 
@@ -128,7 +126,7 @@ o See Credits file for contributors.
 Your Support
 ------------
 NLnet Labs offers all of its software products as open source, most are
-published under a BDS license. You can download them, not only from the
+published under a BSD license. You can download them, not only from the
 NLnet Labs website but also through the various OS distributions for
 which NSD, ldns, and Unbound are packaged. We therefore have little idea
 who uses our software in production environments and have no direct ties

doc/control_proto_spec.txt

@@ -1,16 +1,21 @@
 
 Specification for the unbound-control protocol.
 
-Server listens on 953 TCP (localhost by default). Client connects,
+Server listens on 8953 TCP (localhost by default). Client connects,
 SSLv3 or TLSv1 connection setup (server selfsigned certificate, 
 client has cert signed by server certificate).
 
+Port 8953 is registered with IANA as:
+ub-dns-control  8953/tcp    unbound dns nameserver control
+# Wouter Wijngaards <wouter&nlnetlabs.nl> 10 May 2011
+On may 11 2011, ticket [IANA #442315].
+
 Query and Response
 ------------------
 Client sends 
-	UBCT [commandline] \n
-	fixed string UBCT, then an ascii text line, with a command, 
-	some whitespace allowed. Line ends with '\n'.
+	UBCT[version] [commandline] \n
+	fixed string UBCT1 (for version 1), then an ascii text line,
+	with a command, some whitespace allowed. Line ends with '\n'.
 
 Server executes command. And sends reply in ascii text over channel, 
 closes the channel when done.

doc/example.conf.in

@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page.
+# See unbound.conf(5) man page, version @version@.
 #
 # this is a comment.
 
@@ -79,6 +79,10 @@ server:
 	# 0 is system default.  Use 4m to catch query spikes for busy servers.
 	# so-rcvbuf: 0
 
+	# buffer size for UDP port 53 outgoing (SO_SNDBUF socket option).
+	# 0 is system default.  Use 4m to handle spikes on very busy servers.
+	# so-sndbuf: 0
+
 	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
 	# is set with msg-buffer-size). 1480 can solve fragmentation (timeouts).
 	# edns-buffer-size: 4096
@@ -149,6 +153,10 @@ server:
 	# Enable TCP, "yes" or "no".
 	# do-tcp: yes
 
+	# upstream connections use TCP only (and no UDP), "yes" or "no"
+	# useful for tunneling scenarios, default no.
+	# tcp-upstream: no
+
 	# Detach from the terminal, run in background, "yes" or "no".
 	# do-daemonize: yes
 
@@ -208,6 +216,9 @@ server:
 
 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	# log-time-ascii: no
+	
+	# print one line with time, IP, name, type, class for every query.
+	# log-queries: no
 
 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"
@@ -253,6 +264,9 @@ server:
 	# Default on, which insists on dnssec data for trust-anchored zones.
 	# harden-dnssec-stripped: yes
 
+	# Harden against queries that fall under dnssec-signed nxdomain names.
+	# harden-below-nxdomain: no
+
         # Harden the referral path by performing additional queries for
 	# infrastructure data.  Validates the replies (if possible).
 	# Default off, because the lookups burden the server.  Experimental 
@@ -311,6 +325,8 @@ server:
 	#
 	# If you want to perform DNSSEC validation, run unbound-anchor before
 	# you start unbound (i.e. in the system boot scripts).  And enable:
+	# Please note usage of unbound-anchor root anchor is at your own risk
+	# and under the terms of our LICENSE (see that file in the source).
 	# auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
 
 	# File with DLV trusted keys. Same format as trust-anchor-file.
@@ -343,7 +359,7 @@ server:
 
 	# Override the date for validation with a specific fixed date.
 	# Do not set this unless you are debugging signature inception
-	# and expiration. "" or "0" turns the feature off. 
+	# and expiration. "" or "0" turns the feature off. -1 ignores date.
 	# val-override-date: ""
 
 	# The time to live for bogus data, rrsets and messages. This avoids
@@ -369,6 +385,11 @@ server:
 	# replies if the message is found secure. The default is off.
 	# val-permissive-mode: no
 
+	# Ignore the CD flag in incoming queries and refuse them bogus data.
+	# Enable it if the only clients of unbound are legacy servers (w2008)
+	# that set CD but cannot validate themselves.
+	# ignore-cd-flag: no
+
 	# Have the validator log failed validations for your diagnosis.
 	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
 	# val-log-level: 0
@@ -411,6 +432,7 @@ server:
 	# o transparent gives local data, but resolves normally for other names
 	# o redirect serves the zone data for any subdomain in the zone.
 	# o nodefault can be used to normally resolve AS112 zones.
+	# o typetransparent resolves normally for other types and other names
 	#
 	# defaults are localhost address, reverse for 127.0.0.1 and ::1
 	# and nxdomain for AS112 zones. If you configure one of these zones
@@ -457,7 +479,7 @@ remote-control:
 	# control-interface: ::1
 
 	# port number for remote control operations.
-	# control-port: 953
+	# control-port: 8953
 
 	# unbound server key file.
 	# server-key-file: "@UNBOUND_RUN_DIR@/unbound_server.key"

doc/unbound-anchor.8.in

@@ -26,6 +26,9 @@ Suggested usage:
 	# in the init scripts.
 	# provide or update the root anchor (if necessary)
 	unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
+	# Please note usage of this root anchor is at your own risk
+	# and under the terms of our LICENSE (see source).
+	#
 	# start validating resolver
 	# the unbound.conf contains:
 	#   auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"

doc/unbound-control.8.in

@@ -151,17 +151,31 @@ and lameness data.
 Show the contents of the infra cache.
 .TP
 .B set_option \fIopt: val
-Set the option to the given value without a reload.  The cache is therefore
-not flushed.  The option must end with a ':' and whitespace must be between the
-option and the value.  Some values may not have an effect if set this way,
-the new values are not written to the config file, not all options are supported.
+Set the option to the given value without a reload.  The cache is
+therefore not flushed.  The option must end with a ':' and whitespace
+must be between the option and the value.  Some values may not have an
+effect if set this way, the new values are not written to the config file,
+not all options are supported.  This is different from the set_option call
+in libunbound, where all values work because unbound has not been inited.
+.IP
+The values that work are: statistics\-interval, statistics\-cumulative,
+do\-not\-query\-localhost, harden\-short\-bufsize, harden\-large\-queries,
+harden\-glue, harden\-dnssec\-stripped, harden\-below\-nxdomain,
+harden\-referral\-path, prefetch, prefetch\-key, log\-queries,
+hide\-identity, hide\-version, identity, version, val\-log\-level,
+val\-log\-squelch, ignore\-cd\-flag, add\-holddown, del\-holddown,
+keep\-missing, tcp\-upstream.
 .TP
 .B get_option \fIopt
 Get the value of the option.  Give the option name without a trailing ':'.
-The value is printed.  If the value is "", nothing is printed and the
-connection closes.  On error 'error ...' is printed (it gives a syntax
-error on unknown option).  For some options a list of values, one on
-each line, is printed.  Not all options are supported.
+The value is printed.  If the value is "", nothing is printed
+and the connection closes.  On error 'error ...' is printed (it gives
+a syntax error on unknown option).  For some options a list of values,
+one on each line, is printed.  The options are shown from the config file
+as modified with set_option.  For some options an override may have been
+taken that does not show up with this command, not results from e.g. the
+verbosity and forward control commands.  Not all options work, see list_stubs,
+list_forwards, list_local_zones and list_local_data for those.
 .TP
 .B list_stubs
 List the stub zones in use.  These are printed one by one to the output.

doc/unbound.conf.5.in

@@ -231,6 +231,17 @@ net.core.rmem_max.  On BSD change kern.ipc.maxsockbuf in /etc/sysctl.conf.
 On OpenBSD change header and recompile kernel. On Solaris ndd \-set
 /dev/udp udp_max_buf 8388608.
 .TP
+.B so\-sndbuf: \fI<number>
+If not 0, then set the SO_SNDBUF socket option to get more buffer space on
+UDP port 53 outgoing queries.  This for very busy servers handles spikes
+in answer traffic, otherwise 'send: resource temporarily unavailable'
+can get logged, the buffer overrun is also visible by netstat \-su.
+Default is 0 (use system value).  Specify the number of bytes to ask
+for, try "4m" on a very busy server.  The OS caps it at a maximum, on
+linux unbound needs root permission to bypass the limit, or the admin
+can use sysctl net.core.wmem_max.  On BSD, Solaris changes are similar
+to so\-rcvbuf.
+.TP
 .B rrset\-cache\-size: \fI<number>
 Number of bytes size of the RRset cache. Default is 4 megabytes.
 A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
@@ -289,6 +300,10 @@ Enable or disable whether UDP queries are answered or issued. Default is yes.
 .B do\-tcp: \fI<yes or no>
 Enable or disable whether TCP queries are answered or issued. Default is yes.
 .TP
+.B tcp\-upstream: \fI<yes or no>
+Enable or disable whether the upstream queries use TCP only for transport.
+Default is no.  Useful in tunneling scenarios.
+.TP
 .B do\-daemonize: \fI<yes or no>
 Enable or disable whether the unbound server forks into the background as
 a daemon. Default is yes.
@@ -384,6 +399,12 @@ Sets logfile lines to use a timestamp in UTC ascii. Default is no, which
 prints the seconds since 1970 in brackets. No effect if using syslog, in
 that case syslog formats the timestamp printed into the log files.
 .TP
+.B log\-queries: \fI<yes or no>
+Prints one line per query to the log, with the log timestamp and IP address,
+name, type and class.  Default is no.  Note that it takes time to print these
+lines which makes the server (significantly) slower.  Odd (nonprintable)
+characters in names are printed as '?'.
+.TP
 .B pidfile: \fI<filename>
 The process id is written to the file. Default is "@UNBOUND_PIDFILE@". 
 So,
@@ -455,6 +476,15 @@ removes DNSSEC data from packets, or a zone changes from signed to
 unsigned to badly signed often. If turned off you run the risk of a 
 downgrade attack that disables security for a zone. Default is on.
 .TP
+.B harden\-below\-nxdomain: \fI<yes or no>
+From draft-vixie-dnsext-resimprove, returns nxdomain to queries for a name
+below another name that is already known to be nxdomain.  DNSSEC mandates
+noerror for empty nonterminals, hence this is possible.  Very old software
+might return nxdomain for empty nonterminals (that usually happen for reverse
+IP address lookups), and thus may be incompatible with this.  To try to avoid
+this only DNSSEC-secure nxdomains are used, because the old software does not
+have DNSSEC.  Default is off.
+.TP
 .B harden\-referral\-path: \fI<yes or no>
 Harden the referral path by performing additional queries for
 infrastructure data.  Validates the replies if trust anchors are configured
@@ -588,7 +618,8 @@ externally can create validation failures for that internal domain.
 Default is "" or "0", which disables this debugging feature. If enabled by
 giving a RRSIG style date, that date is used for verifying RRSIG inception
 and expiration dates, instead of the current date. Do not set this unless 
-you are debugging signature inception and expiration.
+you are debugging signature inception and expiration. The value \-1 ignores
+the date altogether, useful for some special applications.
 .TP
 .B val\-sig\-skew\-min: \fI<seconds>
 Minimum number of seconds of clock skew to apply to validated signatures.
@@ -636,6 +667,14 @@ receives the bogus data. For messages that are found to be secure the AD bit
 is set in replies. Also logging is performed as for full validation.
 The default value is "no". 
 .TP
+.B ignore\-cd\-flag: \fI<yes or no>
+Instruct unbound to ignore the CD flag from clients and refuse to
+return bogus answers to them.  Thus, the CD (Checking Disabled) flag
+does not disable checking any more.  This is useful if legacy (w2008)
+servers that set the CD flag but cannot validate DNSSEC themselves are
+the clients, and then unbound provides them with DNSSEC protection.
+The default value is "no".
+.TP
 .B val\-nsec3\-keysize\-iterations: \fI<"list of values">
 List of keysize and iteration count values, separated by spaces, surrounded
 by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
@@ -681,11 +720,12 @@ A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
 or gigabytes (1024*1024 bytes in a megabyte).
 .TP
 .B local\-zone: \fI<zone> <type>
-Configure a local zone. The type determines the answer to give if there is
-no match from local\-data. The types are deny, refuse, static, transparent, 
-redirect, nodefault, and are explained below. After that the default settings
-are listed. Use local\-data: to enter data into the local zone. Answers for
-local zones are authoritative DNS answers. By default the zones are class IN.
+Configure a local zone. The type determines the answer to give if
+there is no match from local\-data. The types are deny, refuse, static,
+transparent, redirect, nodefault, typetransparent, and are explained
+below. After that the default settings are listed. Use local\-data: to
+enter data into the local zone. Answers for local zones are authoritative
+DNS answers. By default the zones are class IN.
 .IP
 If you need more complicated authoritative data, with referrals, wildcards,
 CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
@@ -713,6 +753,13 @@ given in localdata, then a noerror nodata answer is returned.
 If no local\-zone is given local\-data causes a transparent zone
 to be created by default.
 .TP 10
+\h'5'\fItypetransparent\fR 
+If there is a match from local data, the query is answered.  If the query
+is for a different name, or for the same name but for a different type,
+the query is resolved normally.  So, similar to transparent but types
+that are not listed in local data are resolved normally, so if an A record
+is in the local data that does not cause a nodata reply for AAAA queries.
+.TP 10
 \h'5'\fIredirect\fR 
 The query is answered from the local data for the zone name.
 There may be no local data beneath the zone name.
@@ -851,10 +898,9 @@ By default localhost (127.0.0.1 and ::1) is listened to.
 Use 0.0.0.0 and ::0 to listen to all interfaces.
 .TP 5
 .B control\-port: <port number>
-The port number to listen on for control commands, default is 953
-(that is the same port number named uses to listen to rndc).
-If you change this port number, and permissions have been dropped, a
-reload is not sufficient to open the port again, you must then restart.
+The port number to listen on for control commands, default is 8953.
+If you change this port number, and permissions have been dropped,
+a reload is not sufficient to open the port again, you must then restart.
 .TP 5
 .B server\-key\-file: "<private key file>"
 Path to the server private key, by default unbound_server.key.

doc/unbound.doxygen

@@ -835,13 +835,13 @@ HTML_STYLESHEET        =
 # 180 is cyan, 240 is blue, 300 purple, and 360 is red again.
 # The allowed range is 0 to 359.
 
-HTML_COLORSTYLE_HUE    = 220
+#HTML_COLORSTYLE_HUE    = 220
 
 # The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of
 # the colors in the HTML output. For a value of 0 the output will use
 # grayscales only. A value of 255 will produce the most vivid colors.
 
-HTML_COLORSTYLE_SAT    = 100
+#HTML_COLORSTYLE_SAT    = 100
 
 # The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to
 # the luminance component of the colors in the HTML output. Values below
@@ -850,7 +850,7 @@ HTML_COLORSTYLE_SAT    = 100
 # so 80 represents a gamma of 0.8, The value 220 represents a gamma of 2.2,
 # and 100 does not change the gamma.
 
-HTML_COLORSTYLE_GAMMA  = 80
+#HTML_COLORSTYLE_GAMMA  = 80
 
 # If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML
 # page will contain the date and time when the page was generated. Setting
@@ -903,11 +903,11 @@ DOCSET_BUNDLE_ID       = org.doxygen.Project
 # the documentation publisher. This should be a reverse domain-name style
 # string, e.g. com.mycompany.MyDocSet.documentation.
 
-DOCSET_PUBLISHER_ID    = org.doxygen.Publisher
+#DOCSET_PUBLISHER_ID    = org.doxygen.Publisher
 
 # The GENERATE_PUBLISHER_NAME tag identifies the documentation publisher.
 
-DOCSET_PUBLISHER_NAME  = Publisher
+#DOCSET_PUBLISHER_NAME  = Publisher
 
 # If the GENERATE_HTMLHELP tag is set to YES, additional index files
 # will be generated that can be used as input for tools like the
@@ -1058,7 +1058,7 @@ TREEVIEW_WIDTH         = 250
 # When the EXT_LINKS_IN_WINDOW option is set to YES doxygen will open
 # links to external symbols imported via tag files in a separate window.
 
-EXT_LINKS_IN_WINDOW    = NO
+#EXT_LINKS_IN_WINDOW    = NO
 
 # Use this tag to change the font size of Latex formulas included
 # as images in the HTML documentation. The default is 10. Note that
@@ -1074,7 +1074,7 @@ FORMULA_FONTSIZE       = 10
 # Note that when changing this option you need to delete any form_*.png files
 # in the HTML output before the changes have effect.
 
-FORMULA_TRANSPARENT    = YES
+#FORMULA_TRANSPARENT    = YES
 
 # When the SEARCHENGINE tag is enabled doxygen will generate a search box
 # for the HTML output. The underlying search engine uses javascript
@@ -1486,7 +1486,7 @@ HAVE_DOT               = NO
 # explicitly to a value larger than 0 to get control over the balance
 # between CPU load and processing speed.
 
-DOT_NUM_THREADS        = 0
+#DOT_NUM_THREADS        = 0
 
 # By default doxygen will write a font called FreeSans.ttf to the output
 # directory and reference it in all dot files that doxygen generates. This

iterator/iter_delegpt.c

@@ -482,3 +482,13 @@ void delegpt_no_ipv6(struct delegpt* dp)
 			ns->resolved = 1;
 	}
 }
+
+void delegpt_no_ipv4(struct delegpt* dp)
+{
+	struct delegpt_ns* ns;
+	for(ns = dp->nslist; ns; ns = ns->next) {
+		/* no ipv4, so only ipv6 is enough to resolve a nameserver */
+		if(ns->got6)
+			ns->resolved = 1;
+	}
+}

iterator/iter_delegpt.h

@@ -339,4 +339,11 @@ void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg);
  */
 void delegpt_no_ipv6(struct delegpt* dp);
 
+/**
+ * Register the fact that there is no ipv4 and thus As are not going 
+ * to be queried for or be useful.
+ * @param dp: the delegation point. Updated to reflect no ipv4.
+ */
+void delegpt_no_ipv4(struct delegpt* dp);
+
 #endif /* ITERATOR_ITER_DELEGPT_H */

iterator/iter_hints.c

@@ -132,6 +132,7 @@ compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
       }
       if(do_ip6) {
 	if(!ah(dp, r, "A.ROOT-SERVERS.NET.", "2001:503:ba3e::2:30")) return 0;
+	if(!ah(dp, r, "D.ROOT-SERVERS.NET.", "2001:500:2d::d")) return 0;
 	if(!ah(dp, r, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) return 0;
 	if(!ah(dp, r, "H.ROOT-SERVERS.NET.", "2001:500:1::803f:235")) return 0;
 	if(!ah(dp, r, "I.ROOT-SERVERS.NET.", "2001:7fe::53")) return 0;

iterator/iter_resptype.c

@@ -54,6 +54,8 @@ response_type_from_cache(struct dns_msg* msg,
 	/* If the message is NXDOMAIN, then it is an ANSWER. */
 	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NXDOMAIN)
 		return RESPONSE_TYPE_ANSWER;
+	if(request->qtype == LDNS_RR_TYPE_ANY)
+		return RESPONSE_TYPE_ANSWER;
 	
 	/* First we look at the answer section. This can tell us if this is
 	 * CNAME or positive ANSWER. */
@@ -117,6 +119,15 @@ response_type_from_server(int rdset,
 		if( (msg->rep->flags&BIT_RA) &&
 			!(msg->rep->flags&BIT_AA) && !rdset)
 				return RESPONSE_TYPE_REC_LAME;
+		/* it could be a CNAME with NXDOMAIN rcode */
+		for(i=0; i<msg->rep->an_numrrsets; i++) {
+			s = msg->rep->rrsets[i];
+			if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME &&
+				query_dname_compare(request->qname,
+				s->rk.dname) == 0) {
+				return RESPONSE_TYPE_CNAME;
+			}
+		}
 		return RESPONSE_TYPE_ANSWER;
 	}
 	
@@ -179,6 +190,9 @@ response_type_from_server(int rdset,
 				get_cname_target(s, &mname, &mname_len);
 			}
 		}
+		/* not a referral, and qtype any, thus an answer */
+		if(request->qtype == LDNS_RR_TYPE_ANY)
+			return RESPONSE_TYPE_ANSWER;
 		/* if we encountered a CNAME (or a bunch of CNAMEs), and 
 		 * still got to here, then it is a CNAME response. 
 		 * (This is regardless of the AA bit at this point) */

iterator/iter_scrub.c

@@ -363,10 +363,6 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 					"too long");
 				return 0;
 			}
-			/* internally we have CNAME'd/DNAME'd chains ending
-			 * in nxdomain with NOERROR rcode, change rcode
-			 * to reflect this (if needed) */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_NOERROR);
 			if(nx && nx->type == LDNS_RR_TYPE_CNAME && 
 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 				/* check next cname */
@@ -405,14 +401,21 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 
 		/* Follow the CNAME chain. */
 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
+			uint8_t* oldsname = sname;
 			if(!parse_get_cname_target(rrset, &sname, &snamelen))
 				return 0;
 			prev = rrset;
 			rrset = rrset->rrset_all_next;
-			/* internally we have CNAME'd/DNAME'd chains ending
-			 * in nxdomain with NOERROR rcode, change rcode
-			 * to reflect this (if needed) */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_NOERROR);
+			/* in CNAME ANY response, can have data after CNAME */
+			if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
+				while(rrset && rrset->section ==
+					LDNS_SECTION_ANSWER &&
+					dname_pkt_compare(pkt, oldsname,
+					rrset->dname) == 0) {
+					prev = rrset;
+					rrset = rrset->rrset_all_next;
+				}
+			}
 			continue;
 		}
 
@@ -643,9 +646,9 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 		if( (rrset->type == LDNS_RR_TYPE_A || 
 			rrset->type == LDNS_RR_TYPE_AAAA) &&
 			priv_rrset_bad(ie->priv, pkt, rrset)) {
-			/* set servfail, so the classification becomes
-			 * THROWAWAY, instead of LAME or other unwanted */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_SERVFAIL);
+
+			/* do not set servfail since this leads to too
+			 * many drops of other people using rfc1918 space */
 			remove_rrset("sanitize: removing public name with "
 				"private address", pkt, msg, prev, &rrset);
 			continue;

iterator/iter_utils.c

@@ -132,6 +132,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 		return 0;
 	}
 	iter_env->supports_ipv6 = cfg->do_ip6;
+	iter_env->supports_ipv4 = cfg->do_ip4;
 	return 1;
 }
 
@@ -150,6 +151,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
  *		o The address is bogus (DNSSEC validation failure).
  *		o Listed as donotquery
  *		o is ipv6 but no ipv6 support (in operating system).
+ *		o is ipv4 but no ipv4 support (in operating system).
  *		o is lame
  *	Otherwise, an rtt in milliseconds.
  *	0 .. USEFUL_SERVER_TOP_TIMEOUT-1
@@ -194,6 +196,9 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip6 available */
 	}
+	if(!iter_env->supports_ipv4 && !addr_is_ip6(&a->addr, a->addrlen)) {
+		return -1; /* there is no ip4 available */
+	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, 
 		name, namelen, qtype, &lame, &dnsseclame, &reclame, 

iterator/iterator.c

@@ -940,6 +940,11 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 				qstate->env->scratch_buffer, 
 				*qstate->env->now, 1/*add SOA*/, NULL);
 		}
+		/* item taken from cache does not match our query name, thus
+		 * security needs to be re-examined later */
+		if(msg && query_dname_compare(qstate->qinfo.qname,
+			iq->qchase.qname) != 0)
+			msg->rep->security = sec_status_unchecked;
 	}
 	if(msg) {
 		/* handle positive cache response */
@@ -1013,10 +1018,16 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		delname = iq->qchase.qname;
 		delnamelen = iq->qchase.qname_len;
 	}
-	if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue) {
+	if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue ||
+	   (iq->qchase.qtype == LDNS_RR_TYPE_NS && qstate->prefetch_leeway)) {
 		/* remove first label from delname, root goes to hints,
 		 * but only to fetch glue, not for qtype=DS. */
-		if(dname_is_root(delname) && iq->refetch_glue)
+		/* also when prefetching an NS record, fetch it again from
+		 * its parent, just as if it expired, so that you do not
+		 * get stuck on an older nameserver that gives old NSrecords */
+		if(dname_is_root(delname) && (iq->refetch_glue ||
+			(iq->qchase.qtype == LDNS_RR_TYPE_NS &&
+			qstate->prefetch_leeway)))
 			delname = NULL; /* go to root priming */
 		else 	dname_remove_label(&delname, &delnamelen);
 		iq->refetch_glue = 0; /* if CNAME causes restart, no refetch */
@@ -1356,7 +1367,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			query_count++;
 		}
 		/* Send the A request. */
-		if(!ns->got4) {
+		if(ie->supports_ipv4 && !ns->got4) {
 			if(!generate_target_query(qstate, iq, id, 
 				ns->name, ns->namelen, 
 				LDNS_RR_TYPE_A, iq->qchase.qclass)) {
@@ -1465,7 +1476,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			ns->done_pside6 = 1;
 			query_count++;
 		}
-		if(!ns->done_pside4) {
+		if(ie->supports_ipv4 && !ns->done_pside4) {
 			/* Send the A request. */
 			if(!generate_parentside_target_query(qstate, iq, id, 
 				ns->name, ns->namelen, 
@@ -1545,6 +1556,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	if(!ie->supports_ipv6)
 		delegpt_no_ipv6(iq->dp);
+	if(!ie->supports_ipv4)
+		delegpt_no_ipv4(iq->dp);
 	delegpt_log(VERB_ALGO, iq->dp);
 
 	if(iq->num_current_queries>0) {
@@ -2398,6 +2411,8 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 		/* reset the query name back */
 		iq->response->qinfo = qstate->qinfo;
+		/* the security state depends on the combination */
+		iq->response->rep->security = sec_status_unchecked;
 		/* store message with the finished prepended items,
 		 * but only if we did recursion. The nonrecursion referral
 		 * from cache does not need to be stored in the msg cache. */

iterator/iterator.h

@@ -93,6 +93,9 @@ struct iter_env {
 	/** A flag to indicate whether or not we have an IPv6 route */
 	int supports_ipv6;
 
+	/** A flag to indicate whether or not we have an IPv4 route */
+	int supports_ipv4;
+
 	/** A set of inetaddrs that should never be queried. */
 	struct iter_donotq* donotq;
 

libunbound/libworker.c

@@ -694,8 +694,9 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(w->back, qname,
 		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
-		addr, addrlen, libworker_handle_service_reply, e, 
-		w->back->udp_buff, &outbound_entry_compare);
+		q->env->cfg->tcp_upstream, addr, addrlen,
+		libworker_handle_service_reply, e, w->back->udp_buff,
+		&outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}

makedist.sh

@@ -56,6 +56,7 @@ Generate a distribution tar file for unbound.
     -l ldnsdir   Directory where ldns resides. Detected from Makefile.
     -wssl openssl.xx.tar.gz Also build openssl from tarball for windows dist.
     -wxp expat.xx.tar.gz Also build expat from tarball for windows dist.
+    -wldns ldns.xx.tar.gz Also build libldns from tarball for windows dist.
     -w ...       Build windows binary dist. last args passed to configure.
 EOF
     exit 1
@@ -137,6 +138,7 @@ LDNSDIR=""
 DOWIN="no"
 WINSSL=""
 WINEXPAT=""
+WINLDNS=""
 
 # Parse the command line arguments.
 while [ "$1" ]; do
@@ -151,6 +153,10 @@ while [ "$1" ]; do
         "-s")
             SNAPSHOT="yes"
             ;;
+        "-wldns")
+	    WINLDNS="$2"
+	    shift
+	    ;;
         "-wssl")
 	    WINSSL="$2"
 	    shift
@@ -187,8 +193,8 @@ if [ "$DOWIN" = "yes" ]; then
 	configure="mingw32-configure"
 	strip="i686-pc-mingw32-strip"
 	makensis="makensis"	# from mingw32-nsis package
-	# in crosscompile no installed ldns, use builtin (not linux-ldns)
-	cross_flag="--with-ldns-builtin"
+	# flags for crosscompiled dependency libraries
+	cross_flag=""
 
 	check_svn_root
 	create_temp_dir
@@ -214,6 +220,21 @@ if [ "$DOWIN" = "yes" ]; then
 		cd ..
 	fi
 
+	if test -n "$WINLDNS"; then
+		info "Cross compile $WINLDNS"
+		info "ldns tar unpack"
+		(cd ..; gzip -cd $WINLDNS) | tar xf - || error_cleanup "tar unpack of $WINLDNS failed"
+		cd ldns-* || error_cleanup "no ldns-X dir in tarball"
+		# we can use the cross_flag with openssl in it
+		info "ldns: Configure $cross_flag"
+		mingw32-configure  $cross_flag || error_cleanup "ldns configure failed"
+		info "ldns: make"
+		make || error_cleanup "ldns crosscompile failed"
+		# use from the build directory.
+		cross_flag="$cross_flag --with-ldns=`pwd`"
+		cd ..
+	fi
+
 	if test -n "$WINEXPAT"; then
 		info "Cross compile $WINEXPAT"
 		info "wxp: tar unpack"
@@ -259,7 +280,8 @@ if [ "$DOWIN" = "yes" ]; then
     	replace_text "configure.ac" "AC_INIT(unbound, $version" "AC_INIT(unbound, $version2"
     	version="$version2"
     	info "Rebuilding configure script (autoconf) snapshot."
-    	autoconf || autoheader || error_cleanup "Autoconf failed."
+    	autoconf || error_cleanup "Autoconf failed."
+    	autoheader || error_cleanup "Autoheader failed."
     	rm -r autom4te* || echo "ignored"
     fi
 
@@ -410,6 +432,7 @@ replace_all doc/unbound-checkconf.8.in
 replace_all doc/unbound-control.8.in
 replace_all doc/unbound-anchor.8.in
 replace_all doc/unbound-host.1
+replace_all doc/example.conf.in
 replace_all doc/libunbound.3.in
 
 info "Renaming Unbound directory to unbound-$version."

pythonmod/interface.i

@@ -868,6 +868,15 @@ void log_dns_msg(const char* str, struct query_info* qinfo, struct reply_info* r
 void log_query_info(enum verbosity_value v, const char* str, struct query_info* qinf);
 void regional_log_stats(struct regional *r);
 
+// Free allocated memory from marked sources returning corresponding types
+%typemap(newfree, noblock = 1) char * {
+  free($1);
+}
+
+// Mark as source returning newly allocated memory
+%newobject ldns_rr_type2str;
+%newobject ldns_rr_class2str;
+
 // LDNS functions
 char *ldns_rr_type2str(const uint16_t atype);
 char *ldns_rr_class2str(const uint16_t aclass);

pythonmod/pythonmod.c

@@ -153,6 +153,8 @@ int pythonmod_init(struct module_env* env, int id)
    }
    PyRun_SimpleString("sys.path.append('"RUN_DIR"') \n");
    PyRun_SimpleString("sys.path.append('"SHARE_DIR"') \n");
+   PyRun_SimpleString("import distutils.sysconfig \n");
+   PyRun_SimpleString("sys.path.append(distutils.sysconfig.get_python_lib(1,0)) \n");
    if (PyRun_SimpleString("from unboundmodule import *\n") < 0)
    {
       log_err("pythonmod: cannot initialize core module: unboundmodule.py"); 

services/cache/dns.c

@@ -49,6 +49,7 @@
 #include "util/module.h"
 #include "util/net_help.h"
 #include "util/regional.h"
+#include "util/config_file.h"
 
 /** store rrsets in the rrset cache. 
  * @param env: module environment with caches.
@@ -417,14 +418,14 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 
 /** generate dns_msg from cached message */
 static struct dns_msg*
-tomsg(struct module_env* env, struct msgreply_entry* e, struct reply_info* r, 
+tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, 
 	struct regional* region, uint32_t now, struct regional* scratch)
 {
 	struct dns_msg* msg;
 	size_t i;
 	if(now > r->ttl)
 		return NULL;
-	msg = gen_dns_msg(region, &e->key, r->rrset_count);
+	msg = gen_dns_msg(region, q, r->rrset_count);
 	if(!msg)
 		return NULL;
 	msg->rep->flags = r->flags;
@@ -606,7 +607,7 @@ dns_cache_lookup(struct module_env* env,
 	if(e) {
 		struct msgreply_entry* key = (struct msgreply_entry*)e->key;
 		struct reply_info* data = (struct reply_info*)e->data;
-		struct dns_msg* msg = tomsg(env, key, data, region, now, 
+		struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 
 			scratch);
 		if(msg) {
 			lock_rw_unlock(&e->lock);
@@ -670,6 +671,33 @@ dns_cache_lookup(struct module_env* env,
 		}
 		lock_rw_unlock(&rrset->entry.lock);
 	}
+
+	/* stop downwards cache search on NXDOMAIN.
+	 * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
+	 * means bla.foo also does not exist.  The DNSSEC proofs are
+	 * the same.  We search upwards for NXDOMAINs. */
+	if(env->cfg->harden_below_nxdomain)
+	    while(!dname_is_root(k.qname)) {
+		dname_remove_label(&k.qname, &k.qname_len);
+		h = query_info_hash(&k);
+		e = slabhash_lookup(env->msg_cache, h, &k, 0);
+		if(e) {
+			struct reply_info* data = (struct reply_info*)e->data;
+			struct dns_msg* msg;
+			if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
+			  && data->security == sec_status_secure
+			  && (msg=tomsg(env, &k, data, region, now, scratch))){
+				lock_rw_unlock(&e->lock);
+				msg->qinfo.qname=qname;
+				msg->qinfo.qname_len=qnamelen;
+				/* check that DNSSEC really works out */
+				msg->rep->security = sec_status_unchecked;
+				return msg;
+			}
+			lock_rw_unlock(&e->lock);
+		}
+	}
+
 	return NULL;
 }
 

services/cache/infra.c

@@ -275,7 +275,8 @@ infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 			wr = 1;
 			/* TOP_TIMEOUT remains on reuse */
 			if(old >= USEFUL_SERVER_TOP_TIMEOUT)
-				((struct infra_host_data*)e->data)->rtt.rto=old;
+				((struct infra_host_data*)e->data)->rtt.rto
+					= USEFUL_SERVER_TOP_TIMEOUT;
 		}
 	}
 	if(!e) {
@@ -575,7 +576,8 @@ infra_edns_update(struct infra_cache* infra,
 	/* have an entry, update the rtt, and the ttl */
 	data = (struct infra_host_data*)e->data;
 	/* do not update if noEDNS and stored is yesEDNS */
-	if(!(edns_version == -1 && data->edns_version != -1)) {
+	if(!(edns_version == -1 && (data->edns_version != -1 &&
+		data->edns_lame_known))) {
 		data->edns_version = edns_version;
 		data->edns_lame_known = 1;
 	}

services/cache/rrset.c

@@ -120,7 +120,7 @@ rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key,
 
 /** see if rrset needs to be updated in the cache */
 static int
-need_to_update_rrset(void* nd, void* cd, uint32_t timenow, int equal)
+need_to_update_rrset(void* nd, void* cd, uint32_t timenow, int equal, int ns)
 {
 	struct packed_rrset_data* newd = (struct packed_rrset_data*)nd;
 	struct packed_rrset_data* cached = (struct packed_rrset_data*)cd;
@@ -145,10 +145,22 @@ need_to_update_rrset(void* nd, void* cd, uint32_t timenow, int equal)
 	/*	o item in cache has expired */
 	if( cached->ttl < timenow )
 		return 1;
-        /*      o same trust, but different in data - insert it */
-        if( newd->trust == cached->trust && !equal )
-                return 1;
-        return 0;
+	/*  o same trust, but different in data - insert it */
+	if( newd->trust == cached->trust && !equal ) {
+		/* if this is type NS, do not 'stick' to owner that changes
+		 * the NS RRset, but use the old TTL for the new data, and
+		 * update to fetch the latest data. ttl is not expired, because
+		 * that check was before this one. */
+		if(ns) {
+			size_t i;
+			newd->ttl = cached->ttl;
+			for(i=0; i<(newd->count+newd->rrsig_count); i++)
+				if(newd->rr_ttl[i] > newd->ttl)
+					newd->rr_ttl[i] = newd->ttl;
+		}
+		return 1;
+	}
+	return 0;
 }
 
 /** Update RRSet special key ID */
@@ -191,7 +203,7 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 		equal = rrsetdata_equal((struct packed_rrset_data*)k->entry.
 			data, (struct packed_rrset_data*)e->data);
 		if(!need_to_update_rrset(k->entry.data, e->data, timenow,
-			equal)) {
+			equal, (rrset_type==LDNS_RR_TYPE_NS))) {
 			/* cache is superior, return that value */
 			lock_rw_unlock(&e->lock);
 			ub_packed_rrset_parsedelete(k, alloc);
@@ -338,9 +350,15 @@ rrset_update_sec_status(struct rrset_cache* r,
 		if(updata->trust > cachedata->trust)
 			cachedata->trust = updata->trust;
 		cachedata->security = updata->security;
-		cachedata->ttl = updata->ttl + now;
-		for(i=0; i<cachedata->count+cachedata->rrsig_count; i++)
-			cachedata->rr_ttl[i] = updata->rr_ttl[i]+now;
+		/* for NS records only shorter TTLs, other types: update it */
+		if(ntohs(rrset->rk.type) != LDNS_RR_TYPE_NS ||
+			updata->ttl+now < cachedata->ttl ||
+			cachedata->ttl < now ||
+			updata->security == sec_status_bogus) {
+			cachedata->ttl = updata->ttl + now;
+			for(i=0; i<cachedata->count+cachedata->rrsig_count; i++)
+				cachedata->rr_ttl[i] = updata->rr_ttl[i]+now;
+		}
 	}
 	lock_rw_unlock(&e->lock);
 }

services/listen_dnsport.c

@@ -90,7 +90,8 @@ verbose_print_addr(struct addrinfo *addr)
 
 int
 create_udp_sock(int family, int socktype, struct sockaddr* addr,
-        socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv)
+        socklen_t addrlen, int v6only, int* inuse, int* noproto,
+	int rcv, int snd)
 {
 	int s;
 #if defined(IPV6_USE_MIN_MTU)
@@ -102,6 +103,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #if !defined(SO_RCVBUFFORCE) && !defined(SO_RCVBUF)
 	(void)rcv;
 #endif
+#if !defined(SO_SNDBUFFORCE) && !defined(SO_SNDBUF)
+	(void)snd;
+#endif
 #ifndef IPV6_V6ONLY
 	(void)v6only;
 #endif
@@ -182,6 +186,65 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		}
 #  endif
 #endif /* SO_RCVBUF */
+	}
+	/* first do RCVBUF as the receive buffer is more important */
+	if(snd) {
+#ifdef SO_SNDBUF
+		int got;
+		socklen_t slen = (socklen_t)sizeof(got);
+#  ifdef SO_SNDBUFFORCE
+		/* Linux specific: try to use root permission to override
+		 * system limits on sndbuf. The limit is stored in 
+		 * /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */
+		if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd, 
+			(socklen_t)sizeof(snd)) < 0) {
+			if(errno != EPERM) {
+#    ifndef USE_WINSOCK
+				log_err("setsockopt(..., SO_SNDBUFFORCE, "
+					"...) failed: %s", strerror(errno));
+				close(s);
+#    else
+				log_err("setsockopt(..., SO_SNDBUFFORCE, "
+					"...) failed: %s", 
+					wsa_strerror(WSAGetLastError()));
+				closesocket(s);
+#    endif
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
+#  endif /* SO_SNDBUFFORCE */
+			if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd, 
+				(socklen_t)sizeof(snd)) < 0) {
+#  ifndef USE_WINSOCK
+				log_err("setsockopt(..., SO_SNDBUF, "
+					"...) failed: %s", strerror(errno));
+				close(s);
+#  else
+				log_err("setsockopt(..., SO_SNDBUF, "
+					"...) failed: %s", 
+					wsa_strerror(WSAGetLastError()));
+				closesocket(s);
+#  endif
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
+			/* check if we got the right thing or if system
+			 * reduced to some system max.  Warn if so */
+			if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got, 
+				&slen) >= 0 && got < snd/2) {
+				log_warn("so-sndbuf %u was not granted. "
+					"Got %u. To fix: start with "
+					"root permissions(linux) or sysctl "
+					"bigger net.core.wmem_max(linux) or "
+					"kern.ipc.maxsockbuf(bsd) values.",
+					(unsigned)snd, (unsigned)got);
+			}
+#  ifdef SO_SNDBUFFORCE
+		}
+#  endif
+#endif /* SO_SNDBUF */
 	}
 	if(family == AF_INET6) {
 # if defined(IPV6_V6ONLY)
@@ -280,15 +343,21 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		/* detect freebsd jail with no ipv6 permission */
 		if(family==AF_INET6 && errno==EINVAL)
 			*noproto = 1;
-		else if(errno != EADDRINUSE)
+		else if(errno != EADDRINUSE) {
 			log_err("can't bind socket: %s", strerror(errno));
+			log_addr(0, "failed address",
+				(struct sockaddr_storage*)addr, addrlen);
+		}
 #endif /* EADDRINUSE */
 		close(s);
 #else /* USE_WINSOCK */
 		if(WSAGetLastError() != WSAEADDRINUSE &&
-			WSAGetLastError() != WSAEADDRNOTAVAIL)
+			WSAGetLastError() != WSAEADDRNOTAVAIL) {
 			log_err("can't bind socket: %s", 
 				wsa_strerror(WSAGetLastError()));
+			log_addr(0, "failed address",
+				(struct sockaddr_storage*)addr, addrlen);
+		}
 		closesocket(s);
 #endif
 		return -1;
@@ -368,10 +437,18 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto)
 		/* detect freebsd jail with no ipv6 permission */
 		if(addr->ai_family==AF_INET6 && errno==EINVAL)
 			*noproto = 1;
-		else log_err("can't bind socket: %s", strerror(errno));
+		else {
+			log_err("can't bind socket: %s", strerror(errno));
+			log_addr(0, "failed address",
+				(struct sockaddr_storage*)addr->ai_addr,
+				addr->ai_addrlen);
+		}
 #else
 		log_err("can't bind socket: %s", 
 			wsa_strerror(WSAGetLastError()));
+		log_addr(0, "failed address",
+			(struct sockaddr_storage*)addr->ai_addr,
+			addr->ai_addrlen);
 #endif
 		return -1;
 	}
@@ -394,7 +471,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto)
  */
 static int
 make_sock(int stype, const char* ifname, const char* port, 
-	struct addrinfo *hints, int v6only, int* noip6, size_t rcv)
+	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd)
 {
 	struct addrinfo *res = NULL;
 	int r, s, inuse, noproto;
@@ -420,8 +497,8 @@ make_sock(int stype, const char* ifname, const char* port,
 	if(stype == SOCK_DGRAM) {
 		verbose_print_addr(res);
 		s = create_udp_sock(res->ai_family, res->ai_socktype,
-			(struct sockaddr*)res->ai_addr,
-			res->ai_addrlen, v6only, &inuse, &noproto, (int)rcv);
+			(struct sockaddr*)res->ai_addr, res->ai_addrlen,
+			v6only, &inuse, &noproto, (int)rcv, (int)snd);
 		if(s == -1 && inuse) {
 			log_err("bind: address already in use");
 		} else if(s == -1 && noproto && hints->ai_family == AF_INET6){
@@ -440,7 +517,7 @@ make_sock(int stype, const char* ifname, const char* port,
 /** make socket and first see if ifname contains port override info */
 static int
 make_sock_port(int stype, const char* ifname, const char* port, 
-	struct addrinfo *hints, int v6only, int* noip6, size_t rcv)
+	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd)
 {
 	char* s = strchr(ifname, '@');
 	if(s) {
@@ -461,9 +538,10 @@ make_sock_port(int stype, const char* ifname, const char* port,
 		newif[s-ifname] = 0;
 		strncpy(p, s+1, sizeof(p));
 		p[strlen(s+1)]=0;
-		return make_sock(stype, newif, p, hints, v6only, noip6, rcv);
+		return make_sock(stype, newif, p, hints, v6only, noip6,
+			rcv, snd);
 	}
-	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv);
+	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv, snd);
 }
 
 /**
@@ -553,19 +631,20 @@ set_recvpktinfo(int s, int family)
  * @param port: Port number to use (as string).
  * @param list: list of open ports, appended to, changed to point to list head.
  * @param rcv: receive buffer size for UDP
+ * @param snd: send buffer size for UDP
  * @return: returns false on error.
  */
 static int
 ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, 
 	struct addrinfo *hints, const char* port, struct listen_port** list,
-	size_t rcv)
+	size_t rcv, size_t snd)
 {
 	int s, noip6=0;
 	if(!do_udp && !do_tcp)
 		return 0;
 	if(do_auto) {
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv)) == -1) {
+			&noip6, rcv, snd)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -586,7 +665,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	} else if(do_udp) {
 		/* regular udp socket */
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv)) == -1) {
+			&noip6, rcv, snd)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -604,7 +683,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	}
 	if(do_tcp) {
 		if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, 
-			&noip6, 0)) == -1) {
+			&noip6, 0, 0)) == -1) {
 			if(noip6) {
 				/*log_warn("IPv6 protocol not available");*/
 				return 1;
@@ -750,7 +829,8 @@ listening_ports_open(struct config_file* cfg)
 			hints.ai_family = AF_INET6;
 			if(!ports_create_if(do_auto?"::0":"::1", 
 				do_auto, cfg->do_udp, do_tcp, 
-				&hints, portbuf, &list, cfg->socket_rcvbuf)) {
+				&hints, portbuf, &list,
+				cfg->so_rcvbuf, cfg->so_sndbuf)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -759,7 +839,8 @@ listening_ports_open(struct config_file* cfg)
 			hints.ai_family = AF_INET;
 			if(!ports_create_if(do_auto?"0.0.0.0":"127.0.0.1", 
 				do_auto, cfg->do_udp, do_tcp, 
-				&hints, portbuf, &list, cfg->socket_rcvbuf)) {
+				&hints, portbuf, &list,
+				cfg->so_rcvbuf, cfg->so_sndbuf)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -771,7 +852,7 @@ listening_ports_open(struct config_file* cfg)
 			hints.ai_family = AF_INET6;
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list, 
-				cfg->socket_rcvbuf)) {
+				cfg->so_rcvbuf, cfg->so_sndbuf)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -781,7 +862,7 @@ listening_ports_open(struct config_file* cfg)
 			hints.ai_family = AF_INET;
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list, 
-				cfg->socket_rcvbuf)) {
+				cfg->so_rcvbuf, cfg->so_sndbuf)) {
 				listening_ports_free(list);
 				return NULL;
 			}

services/listen_dnsport.h

@@ -162,10 +162,12 @@ size_t listen_get_mem(struct listen_dnsport* listen);
  * @param noproto: on error, this is set true if cause is that the
 	IPv6 proto (family) is not available.
  * @param rcv: set size on rcvbuf with socket option, if 0 it is not set.
+ * @param snd: set size on sndbuf with socket option, if 0 it is not set.
  * @return: the socket. -1 on error.
  */
 int create_udp_sock(int family, int socktype, struct sockaddr* addr, 
-	socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv);
+	socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv,
+	int snd);
 
 /**
  * Create and bind TCP listening socket

services/localzone.c

@@ -612,6 +612,8 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg,
 {
 	struct local_zone* z;
 
+	/* this list of zones is from RFC 6303 */
+
 	/* localhost. zone */
 	if(!lz_exists(zones, "localhost.") &&
 		!lz_nodefault(cfg, "localhost.")) {
@@ -967,6 +969,10 @@ void local_zones_print(struct local_zones* zones)
 			log_nametypeclass(0, "transparent zone", 
 				z->name, 0, z->dclass);
 			break;
+		case local_zone_typetransparent:
+			log_nametypeclass(0, "typetransparent zone", 
+				z->name, 0, z->dclass);
+			break;
 		case local_zone_static:
 			log_nametypeclass(0, "static zone", 
 				z->name, 0, z->dclass);
@@ -1095,7 +1101,10 @@ lz_zone_answer(struct local_zone* z, struct query_info* qinfo,
 			*(uint16_t*)ldns_buffer_begin(buf), 
 			ldns_buffer_read_u16_at(buf, 2), edns);
 		return 1;
-	} 
+	} else if(z->type == local_zone_typetransparent) {
+		/* no NODATA or NXDOMAINS for this zone type */
+		return 0;
+	}
 	/* else z->type == local_zone_transparent */
 
 	/* if the zone is transparent and the name exists, but the type
@@ -1152,6 +1161,7 @@ const char* local_zone_type2str(enum localzone_type t)
 		case local_zone_refuse: return "refuse";
 		case local_zone_redirect: return "redirect";
 		case local_zone_transparent: return "transparent";
+		case local_zone_typetransparent: return "typetransparent";
 		case local_zone_static: return "static";
 		case local_zone_nodefault: return "nodefault";
 	}
@@ -1168,6 +1178,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
 		*t = local_zone_static;
 	else if(strcmp(type, "transparent") == 0)
 		*t = local_zone_transparent;
+	else if(strcmp(type, "typetransparent") == 0)
+		*t = local_zone_typetransparent;
 	else if(strcmp(type, "redirect") == 0)
 		*t = local_zone_redirect;
 	else return 0;

services/localzone.h

@@ -63,6 +63,8 @@ enum localzone_type {
 	local_zone_static,
 	/** resolve normally */
 	local_zone_transparent,
+	/** do not block types at localdata names */
+	local_zone_typetransparent,
 	/** answer with data at zone apex */
 	local_zone_redirect,
 	/** remove default AS112 blocking contents for zone

services/mesh.c

@@ -270,7 +270,11 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
         uint16_t qflags, struct edns_data* edns, struct comm_reply* rep,
         uint16_t qid)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	/* do not use CD flag from user for mesh state, we want the CD-query
+	 * to receive validation anyway, to protect out cache contents and
+	 * avoid bad-data in this cache that a downstream validator cannot
+	 * remove from this cache */
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -298,7 +302,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	/* see if it already exists, if not, create one */
 	if(!s) {
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
@@ -357,7 +361,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, ldns_buffer* buf, 
 	uint16_t qid, mesh_cb_func_t cb, void* cb_arg)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -366,7 +370,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	/* see if it already exists, if not, create one */
 	if(!s) {
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
 		if(!s) {
 			return 0;
 		}
@@ -403,7 +407,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
         uint16_t qflags, uint32_t leeway)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
 	struct rbnode_t* n;
 	/* already exists, and for a different purpose perhaps.
 	 * if mesh_no_list, keep it that way. */
@@ -420,7 +424,7 @@ void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
 		mesh->stats_dropped ++;
 		return;
 	}
-	s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+	s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
 	if(!s) {
 		log_err("prefetch mesh_state_create: out of memory");
 		return;
@@ -524,22 +528,24 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	int i;
 	if(!mstate)
 		return;
+	mesh = mstate->s.env->mesh;
 	/* drop unsent replies */
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep;
 		struct mesh_cb* cb;
 		for(rep=mstate->reply_list; rep; rep=rep->next) {
 			comm_point_drop_reply(&rep->query_reply);
+			mesh->num_reply_addrs--;
 		}
 		for(cb=mstate->cb_list; cb; cb=cb->next) {
 			fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
 			(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
 				sec_status_unchecked, NULL);
+			mesh->num_reply_addrs--;
 		}
 	}
 
 	/* de-init modules */
-	mesh = mstate->s.env->mesh;
 	for(i=0; i<mesh->mods.num; i++) {
 		fptr_ok(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
 		(*mesh->mods.mod[i]->clear)(&mstate->s, i);
@@ -768,7 +774,8 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	struct timeval duration;
 	int secure;
 	/* examine security status */
-	if(m->s.env->need_to_validate && !(r->qflags&BIT_CD) && rep && 
+	if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
+		m->s.env->cfg->ignore_cd) && rep && 
 		rep->security <= sec_status_bogus) {
 		rcode = LDNS_RCODE_SERVFAIL;
 		if(m->s.env->cfg->stat_extended) 

services/outside_network.c

@@ -820,12 +820,14 @@ udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int port,
 		struct sockaddr_in6* sa = (struct sockaddr_in6*)addr;
 		sa->sin6_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET6, SOCK_DGRAM, 
-			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto, 0);
+			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
+			0, 0);
 	} else {
 		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
 		sa->sin_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET, SOCK_DGRAM, 
-			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto, 0);
+			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
+			0, 0);
 	}
 	return fd;
 }
@@ -1306,6 +1308,7 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 		&edns_lame_known, &rtt))
 		return 0;
 	sq->last_rtt = rtt;
+	verbose(VERB_ALGO, "EDNS lookup known=%d vs=%d", edns_lame_known, vs);
 	if(sq->status == serviced_initial) {
 		if(edns_lame_known == 0 && rtt > 5000 && rtt < 10001) {
 			/* perform EDNS lame probe - check if server is
@@ -1591,6 +1594,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			== LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(
 			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL)) {
 		/* try to get an answer by falling back without EDNS */
+		verbose(VERB_ALGO, "serviced query: attempt without EDNS");
 		sq->status = serviced_query_UDP_EDNS_fallback;
 		sq->retry = 0;
 		if(!serviced_udp_send(sq, c->buffer)) {
@@ -1612,6 +1616,8 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 	    } else if(sq->status == serviced_query_UDP_EDNS && 
 		!sq->edns_lame_known) {
 		/* now we know that edns queries received answers store that */
+		log_addr(VERB_ALGO, "serviced query: EDNS works for",
+			&sq->addr, sq->addrlen);
 		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen, 
 			0, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching edns works");
@@ -1626,11 +1632,18 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		/* the fallback produced a result that looks promising, note
 		 * that this server should be approached without EDNS */
 		/* only store noEDNS in cache if domain is noDNSSEC */
-		if(!sq->want_dnssec)
+		if(!sq->want_dnssec) {
+		  log_addr(VERB_ALGO, "serviced query: EDNS fails for",
+			&sq->addr, sq->addrlen);
 		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
 			-1, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching no edns for host");
 		  }
+		} else {
+		  log_addr(VERB_ALGO, "serviced query: EDNS fails, but "
+		  	"not stored because need DNSSEC for", &sq->addr,
+			sq->addrlen);
+		}
 		sq->status = serviced_query_UDP;
 	    }
 	    if(now.tv_sec > sq->last_sent_time.tv_sec ||
@@ -1680,7 +1693,7 @@ callback_list_find(struct serviced_query* sq, void* cb_arg,
 struct serviced_query* 
 outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, int want_dnssec,
+	uint16_t flags, int dnssec, int want_dnssec, int tcp_upstream,
 	struct sockaddr_storage* addr, socklen_t addrlen, 
 	comm_point_callback_t* callback, void* callback_arg, 
 	ldns_buffer* buff, int (*arg_compare)(void*,void*))
@@ -1706,7 +1719,7 @@ outnet_serviced_query(struct outside_network* outnet,
 			return NULL;
 		}
 		/* perform first network action */
-		if(outnet->do_udp) {
+		if(outnet->do_udp && !tcp_upstream) {
 			if(!serviced_udp_send(sq, buff)) {
 				(void)rbtree_delete(outnet->serviced, sq);
 				free(sq->qbuf);

services/outside_network.h

@@ -435,6 +435,7 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  *	If the value includes BIT_DO, DO bit is set when in EDNS queries.
  * @param want_dnssec: signatures are needed, without EDNS the answer is
  * 	likely to be useless.
+ * @param tcp_upstream: use TCP for upstream queries.
  * @param callback: callback function.
  * @param callback_arg: user argument to callback function.
  * @param addr: to which server to send the query.
@@ -447,7 +448,7 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  */
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, int want_dnssec,
+	uint16_t flags, int dnssec, int want_dnssec, int tcp_upstream,
 	struct sockaddr_storage* addr, socklen_t addrlen, 
 	comm_point_callback_t* callback, void* callback_arg, 
 	ldns_buffer* buff, int (*arg_compare)(void*,void*));

smallapp/unbound-anchor.c

@@ -236,7 +236,6 @@ get_builtin_ds(void)
 {
 	return
 ". IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5\n";
-		;
 }
 
 /** print hex data */
@@ -671,10 +670,12 @@ pick_random_ip(struct ip_list* list)
 	if(num == 0) return NULL;
 	/* not perfect, but random enough */
 	sel = (int)ldns_get_random() % num;
+	/* skip over unused elements that we did not select */
 	while(sel > 0 && p) {
 		if(!p->used) sel--;
 		p = p->next;
 	}
+	/* find the next unused element */
 	while(p && p->used)
 		p = p->next;
 	if(!p) return NULL; /* robustness */
@@ -692,6 +693,17 @@ fd_close(int fd)
 #endif
 }
 
+/** printout socket errno */
+static void
+print_sock_err(const char* msg)
+{
+#ifndef USE_WINSOCK
+	if(verb) printf("%s: %s\n", msg, strerror(errno));
+#else
+	if(verb) printf("%s: %s\n", msg, wsa_strerror(WSAGetLastError()));
+#endif
+}
+
 /** connect to IP address */
 static int
 connect_to_ip(struct ip_list* ip)
@@ -701,21 +713,11 @@ connect_to_ip(struct ip_list* ip)
 	fd = socket(ip->len==(socklen_t)sizeof(struct sockaddr_in)?
 		AF_INET:AF_INET6, SOCK_STREAM, 0);
 	if(fd == -1) {
-#ifndef USE_WINSOCK
-		if(verb) printf("socket: %s\n", strerror(errno));
-#else
-		if(verb) printf("socket: %s\n",
-			wsa_strerror(WSAGetLastError()));
-#endif
+		print_sock_err("socket");
 		return -1;
 	}
 	if(connect(fd, (struct sockaddr*)&ip->addr, ip->len) < 0) {
-#ifndef USE_WINSOCK
-		if(verb) printf("connect: %s\n", strerror(errno));
-#else
-		if(verb) printf("connect: %s\n",
-			wsa_strerror(WSAGetLastError()));
-#endif
+		print_sock_err("connect");
 		fd_close(fd);
 		return -1;
 	}
@@ -965,6 +967,7 @@ do_chunked_read(SSL* ssl)
 			return NULL;
 		}
 		if(verb>=2) printf("chunk len: %d\n", (int)len);
+		/* are we done? */
 		if(len == 0) {
 			char z = 0;
 			/* skip end-of-chunk-trailer lines,
@@ -1023,6 +1026,35 @@ write_http_get(SSL* ssl, char* pathname, char* urlname)
 	return 0;
 }
 
+/** read chunked data and zero terminate; len is without zero */
+static char*
+read_chunked_zero_terminate(SSL* ssl, size_t* len)
+{
+	/* do the chunked version */
+	BIO* tmp = do_chunked_read(ssl);
+	char* data, *d = NULL;
+	size_t l;
+	if(!tmp) {
+		if(verb) printf("could not read from https\n");
+		return NULL;
+	}
+	l = (size_t)BIO_get_mem_data(tmp, &d);
+	if(verb>=2) printf("chunked data is %d\n", (int)l);
+	if(l == 0 || d == NULL) {
+		if(verb) printf("out of memory\n");
+		return NULL;
+	}
+	*len = l-1;
+	data = (char*)malloc(l);
+	if(data == NULL) {
+		if(verb) printf("out of memory\n");
+		return NULL;
+	}
+	memcpy(data, d, l);
+	BIO_free(tmp);
+	return data;
+}
+
 /** read HTTP result from SSL */
 static BIO*
 read_http_result(SSL* ssl)
@@ -1034,33 +1066,11 @@ read_http_result(SSL* ssl)
 		return NULL;
 	}
 	if(len == 0) {
-		/* do the chunked version */
-		BIO* tmp = do_chunked_read(ssl);
-		char* d = NULL;
-		size_t l;
-		if(!tmp) {
-			if(verb) printf("could not read from https\n");
-			return NULL;
-		}
-		l = (size_t)BIO_get_mem_data(tmp, &d);
-		if(verb>=2) printf("chunked data is %d\n", (int)l);
-		if(l == 0 || d == NULL) {
-			if(verb) printf("out of memory\n");
-			return NULL;
-		}
-		/* the result is zero terminated for robustness, but we 
-		 * do not include that in the BIO len (for binary data) */
-		len = l-1;
-		data = (char*)malloc(l);
-		if(data == NULL) {
-			if(verb) printf("out of memory\n");
-			return NULL;
-		}
-		memcpy(data, d, l);
-		BIO_free(tmp);
+		data = read_chunked_zero_terminate(ssl, &len);
 	} else {
 		data = read_data_chunk(ssl, len);
 	}
+	if(!data) return NULL;
 	if(verb >= 4) print_data("read data", data, (int)len);
 	m = BIO_new_mem_buf(data, (int)len);
 	if(!m) {
@@ -1359,9 +1369,11 @@ xml_is_zone_name(BIO* zone, char* name)
 	(void)BIO_seek(zone, 0);
 	zlen = BIO_get_mem_data(zone, &z);
 	if(!zlen || !z) return 0;
+	/* zero terminate */
 	if(zlen >= (long)sizeof(buf)) return 0;
 	memmove(buf, z, (size_t)zlen);
 	buf[zlen] = 0;
+	/* compare */
 	return (strncasecmp(buf, name, strlen(name)) == 0);
 }
 
@@ -1400,7 +1412,7 @@ xml_startelem(void *userData, const XML_Char *name, const XML_Char **atts)
 		return;
 	}
 
-	/* write whitespace separators to outputBIO here */
+	/* for other types we prepare to pick up the data */
 	if(!data->use_key)
 		return;
 	b = xml_selectbio(data, data->tag);
@@ -1555,8 +1567,7 @@ xml_parse(BIO* xml, time_t now)
 	}
 	if(!XML_Parse(parser, pp, len, 1 /*isfinal*/ )) {
 		const char *e = XML_ErrorString(XML_GetErrorCode(parser));
-		if(verb) printf("XML_Parse failure %s\n",
-			e?e:"");
+		if(verb) printf("XML_Parse failure %s\n", e?e:"");
 		exit(0);
 	}
 
@@ -1594,39 +1605,43 @@ xml_parse(BIO* xml, time_t now)
 static int
 verify_p7sig(BIO* data, BIO* p7s, STACK_OF(X509)* trust)
 {
-	X509_VERIFY_PARAM* param = X509_VERIFY_PARAM_new();
 	PKCS7* p7;
 	X509_STORE *store = X509_STORE_new();
 	int secure = 0;
 	int i;
-
-	(void)BIO_reset(p7s);
-	(void)BIO_reset(data);
-
-	if(!param || !store) {
+#ifdef X509_V_FLAG_CHECK_SS_SIGNATURE
+	X509_VERIFY_PARAM* param = X509_VERIFY_PARAM_new();
+	if(!param) {
 		if(verb) printf("out of memory\n");
-		X509_VERIFY_PARAM_free(param);
 		X509_STORE_free(store);
 		return 0;
 	}
+	/* do the selfcheck on the root certificate; it checks that the
+	 * input is valid */
+	X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CHECK_SS_SIGNATURE);
+	if(store) X509_STORE_set1_param(store, param);
+#endif
+	if(!store) {
+		if(verb) printf("out of memory\n");
+#ifdef X509_V_FLAG_CHECK_SS_SIGNATURE
+		X509_VERIFY_PARAM_free(param);
+#endif
+		return 0;
+	}
+
+	(void)BIO_reset(p7s);
+	(void)BIO_reset(data);
 
 	/* convert p7s to p7 (the signature) */
 	p7 = d2i_PKCS7_bio(p7s, NULL);
 	if(!p7) {
 		if(verb) printf("could not parse p7s signature file\n");
-		X509_VERIFY_PARAM_free(param);
 		X509_STORE_free(store);
 		return 0;
 	}
 	if(verb >= 2) printf("parsed the PKCS7 signature\n");
 
 	/* convert trust to trusted certificate store */
-	/* do the selfcheck on the root certificate; it checks that the
-	 * input is valid */
-#ifdef X509_V_FLAG_CHECK_SS_SIGNATURE
-	X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CHECK_SS_SIGNATURE);
-#endif
-	X509_STORE_set1_param(store, param);
 	for(i=0; i<sk_X509_num(trust); i++) {
 		if(!X509_STORE_add_cert(store, sk_X509_value(trust, i))) {
 			if(verb) printf("failed X509_STORE_add_cert\n");

smallapp/unbound-checkconf.c

@@ -318,7 +318,7 @@ morechecks(struct config_file* cfg, const char* fname)
 
 	if(cfg->verbosity < 0)
 		fatal_exit("verbosity value < 0");
-	if(cfg->num_threads < 0 || cfg->num_threads > 10000)
+	if(cfg->num_threads <= 0 || cfg->num_threads > 10000)
 		fatal_exit("num_threads value weird");
 	if(!cfg->do_ip4 && !cfg->do_ip6)
 		fatal_exit("ip4 and ip6 are both disabled, pointless");

smallapp/unbound-control-setup.sh

@@ -81,7 +81,7 @@ while test $# -ne 0; do
 	echo "	-d dir	use directory to store keys and certificates."
 	echo "		default: $DESTDIR"
 	echo "please run this command using the same user id that the "
-	echo "unboun daemon uses, it needs read privileges."
+	echo "unbound daemon uses, it needs read privileges."
 	exit 1
 	;;
 	esac

smallapp/unbound-control.c

@@ -258,12 +258,13 @@ send_file(SSL* ssl, FILE* in, char* buf, size_t sz)
 static int
 go_cmd(SSL* ssl, int argc, char* argv[])
 {
-	const char* pre="UBCT";
+	char pre[10];
 	const char* space=" ";
 	const char* newline="\n";
 	int was_error = 0, first_line = 1;
 	int r, i;
 	char buf[1024];
+	snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
 	if(SSL_write(ssl, pre, (int)strlen(pre)) <= 0)
 		ssl_err("could not SSL_write");
 	for(i=0; i<argc; i++) {

testcode/checklocks.c

@@ -52,7 +52,7 @@
 #ifdef USE_THREAD_DEBUG
 
 /** How long to wait before lock attempt is a failure. */
-#define CHECK_LOCK_TIMEOUT 30 /* seconds */
+#define CHECK_LOCK_TIMEOUT 120 /* seconds */
 /** How long to wait before join attempt is a failure. */
 #define CHECK_JOIN_TIMEOUT 120 /* seconds */
 

testcode/do-tests.sh

@@ -1,18 +1,18 @@
 #!/usr/bin/env bash
+. testdata/common.sh
 
 NEED_SPLINT='00-lint.tpkg'
 NEED_DOXYGEN='01-doc.tpkg'
-NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg fwd_oneport.tpkg fwd_udptmout.tpkg fwd_waitudp.tpkg tcp_sigpipe.tpkg hostsfileosx.tpkg local_nodefault.tpkg fwd_zero.tpkg'
 NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_CURL='06-ianaports.tpkg root_anchor.tpkg'
 NEED_WHOAMI='07-confroot.tpkg'
-NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg'
+NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg edns_cache.tpkg'
 NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
 
 # test if dig and ldns-testns are available.
-if test ! -x "`which dig 2>&1`"; then echo No 'dig' in path; exit 1; fi
-if test ! -x "`which ldns-testns 2>&1`"; then echo No 'ldns-testns' in path; exit 1; fi
+test_tool_avail "dig"
+test_tool_avail "ldns-testns"
 
 # test for ipv6, uses streamptcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
@@ -33,41 +33,13 @@ sh ../testcode/mini_tpkg.sh clean
 rm -f .perfstats.txt
 for test in `ls *.tpkg`; do
 	SKIP=0
-	if echo $NEED_SPLINT | grep $test >/dev/null; then
-		if test ! -x "`which splint`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_DOXYGEN | grep $test >/dev/null; then
-		if test ! -x "`which doxygen`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_CURL | grep $test >/dev/null; then
-		if test ! -x "`which curl`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_LDNS_TESTNS | grep $test >/dev/null; then
-		if test ! -x "`which ldns-testns`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_XXD | grep $test >/dev/null; then
-		if test ! -x "`which xxd`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_NC | grep $test >/dev/null; then
-		if test ! -x "`which nc`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_WHOAMI | grep $test >/dev/null; then
-		if test ! -x "`which whoami`"; then
-			SKIP=1;
-		fi
-	fi
+	skip_if_in_list $test "$NEED_SPLINT" "splint"
+	skip_if_in_list $test "$NEED_DOXYGEN" "doxygen"
+	skip_if_in_list $test "$NEED_CURL" "curl"
+	skip_if_in_list $test "$NEED_XXD" "xxd"
+	skip_if_in_list $test "$NEED_NC" "nc"
+	skip_if_in_list $test "$NEED_WHOAMI" "whoami"
+
 	if echo $NEED_IPV6 | grep $test >/dev/null; then
 		if test "$HAVE_IPV6" = no; then
 			SKIP=1;

testcode/fake_event.c

@@ -1007,8 +1007,8 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 	uint16_t flags, int dnssec, int ATTR_UNUSED(want_dnssec),
-	struct sockaddr_storage* addr, socklen_t addrlen, 
-	comm_point_callback_t* callback, void* callback_arg, 
+	int ATTR_UNUSED(tcp_upstream), struct sockaddr_storage* addr,
+	socklen_t addrlen, comm_point_callback_t* callback, void* callback_arg, 
 	ldns_buffer* ATTR_UNUSED(buff), int (*arg_compare)(void*,void*))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;

testcode/mini_tpkg.sh

@@ -81,6 +81,8 @@ mv $name.dir/* .
 
 # EXE
 echo "minitpkg exe $name" > $result
+grep "Description:" $name.dsc >> $result 2>&1
+echo "DateRunStart: "`date "+%s" 2>/dev/null` >> $result
 if test -f $name.pre; then
 	echo "minitpkg exe $name.pre"
 	echo "minitpkg exe $name.pre" >> $result
@@ -112,6 +114,7 @@ if test -f $name.post; then
 		echo "Warning: $name.post did not exit successfully"
 	fi
 fi
+echo "DateRunEnd: "`date "+%s" 2>/dev/null` >> $result
 
 mv $result ..
 cd ..

testcode/unitmain.c

@@ -435,7 +435,7 @@ infra_test(void)
 	unit_assert( infra_edns_update(slab, &one, onelen, -1, now) );
 	unit_assert( infra_host(slab, &one, onelen, 
 			now, &vs, &edns_lame, &to) );
-	unit_assert( vs == 0 && to == init*2  && edns_lame == 0);
+	unit_assert( vs == -1 && to == init*2  && edns_lame == 1);
 
 	now += cfg->host_ttl + 10;
 	unit_assert( infra_host(slab, &one, onelen, 
@@ -465,6 +465,22 @@ infra_test(void)
 	unit_assert(!dlame && !rlame && alame && olame);
 	lock_rw_unlock(&k->entry.lock);
 
+	/* test that noEDNS cannot overwrite known-yesEDNS */
+	now += cfg->host_ttl + 10;
+	unit_assert( infra_host(slab, &one, onelen, 
+			now, &vs, &edns_lame, &to) );
+	unit_assert( vs == 0 && to == init && edns_lame == 0 );
+
+	unit_assert( infra_edns_update(slab, &one, onelen, 0, now) );
+	unit_assert( infra_host(slab, &one, onelen, 
+			now, &vs, &edns_lame, &to) );
+	unit_assert( vs == 0 && to == init && edns_lame == 1 );
+
+	unit_assert( infra_edns_update(slab, &one, onelen, -1, now) );
+	unit_assert( infra_host(slab, &one, onelen, 
+			now, &vs, &edns_lame, &to) );
+	unit_assert( vs == 0 && to == init && edns_lame == 1 );
+
 	infra_delete(slab);
 	config_delete(cfg);
 }

testcode/unitmsgparse.c

@@ -53,6 +53,8 @@
 
 /** verbose message parse unit test */
 static int vbmp = 0;
+/** do not accept formerr */
+static int check_formerr_gone = 0;
 /** if matching within a section should disregard the order of RRs. */
 static int matches_nolocation = 0;
 /** see if RRSIGs are properly matched to RRsets. */
@@ -415,10 +417,12 @@ testpkt(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out,
 	if(ret != 0) {
 		if(vbmp) printf("parse code %d: %s\n", ret, 
 			ldns_lookup_by_id(ldns_rcodes, ret)->name);
-		if(ret == LDNS_RCODE_FORMERR)
+		if(ret == LDNS_RCODE_FORMERR) {
+			unit_assert(!check_formerr_gone);
 			checkformerr(pkt);
+		}
 		unit_assert(ret != LDNS_RCODE_SERVFAIL);
-	} else {
+	} else if(!check_formerr_gone) {
 		const size_t lim = 512;
 		ret = reply_info_encode(&qi, rep, id, flags, out, timenow,
 			region, 65535, (int)(edns.bits & EDNS_DO) );
@@ -599,6 +603,10 @@ void msgparse_test(void)
 	check_rrsigs = 0;
 	matches_nolocation = 0; 
 
+	check_formerr_gone = 1;
+	testfromdrillfile(pkt, &alloc, out, "testdata/test_packets.8");
+	check_formerr_gone = 0;
+
 	/* cleanup */
 	alloc_clear(&alloc);
 	alloc_clear(&super_a);

testcode/unitverify.c

@@ -148,6 +148,33 @@ should_be_bogus(struct ub_packed_rrset_key* rrset, struct query_info* qinfo)
 	return 0;
 }
 
+/** return number of rrs in an rrset */
+static size_t
+rrset_get_count(struct ub_packed_rrset_key* rrset)
+{
+	struct packed_rrset_data* d = (struct packed_rrset_data*)
+	rrset->entry.data;
+	if(!d) return 0;
+	return d->count;
+}
+
+/** setup sig alg list from dnskey */
+static void
+setup_sigalg(struct ub_packed_rrset_key* dnskey, uint8_t* sigalg)
+{
+	uint8_t a[ALGO_NEEDS_MAX];
+	size_t i, n = 0;
+	memset(a, 0, sizeof(a));
+	for(i=0; i<rrset_get_count(dnskey); i++) {
+		uint8_t algo = (uint8_t)dnskey_get_algo(dnskey, i);
+		if(a[algo] == 0) {
+			a[algo] = 1;
+			sigalg[n++] = algo;
+		}
+	}
+	sigalg[n] = 0;
+}
+
 /** verify and test one rrset against the key rrset */
 static void
 verifytest_rrset(struct module_env* env, struct val_env* ve, 
@@ -156,12 +183,14 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
 {
 	enum sec_status sec;
 	char* reason = NULL;
+	uint8_t sigalg[ALGO_NEEDS_MAX+1];
 	if(vsig) {
 		log_nametypeclass(VERB_QUERY, "verify of rrset",
 			rrset->rk.dname, ntohs(rrset->rk.type),
 			ntohs(rrset->rk.rrset_class));
 	}
-	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, 1, &reason);
+	setup_sigalg(dnskey, sigalg); /* check all algorithms in the dnskey */
+	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, sigalg, &reason);
 	if(vsig) {
 		printf("verify outcome is: %s %s\n", sec_status_to_string(sec),
 			reason?reason:"");

testdata/common.sh

@@ -0,0 +1,256 @@
+# common.sh - an include file for commonly used functions for test code.
+# BSD licensed (see LICENSE file).
+#
+# Version 3
+# 2011-02-23: get_pcat for PCAT, PCAT_DIFF and PCAT_PRINT defines.
+# 2011-02-18: ports check on BSD,Solaris. wait_nsd_up.
+# 2011-02-11: first version.
+#
+# include this file from a tpkg script with
+#   . ../common.sh
+#
+# overview of functions available:
+# error x		: print error and exit
+# info x		: print info
+# test_tool_avail x	: see if program in path and complain, exit if not.
+# get_ldns_testns	: set LDNS_TESTNS to executable ldns-testns
+# get_make		: set MAKE to gmake or make tool.
+# get_gcc		: set cc or gcc in CC
+# get_pcat		: set PCAT, PCAT_DIFF and PCAT_PRINT executables.
+# set_doxygen_path	: set doxygen path
+# skip_if_in_list	: set SKIP=1 if name in list and tool not available.
+# get_random_port x	: get RND_PORT a sequence of free random port numbers.
+# wait_server_up	: wait on logfile to see when server comes up.
+# wait_ldns_testns_up   : wait for ldns-testns to come up.
+# wait_unbound_up	: wait for unbound to come up.
+# wait_petal_up		: wait for petal to come up.
+# wait_nsd_up		: wait for nsd to come up.
+# wait_server_up_or_fail: wait for server to come up or print a failure string
+# kill_pid		: kill a server, make sure and wait for it to go down.
+
+
+# print error and exit
+# $0: name of program
+# $1: error to printout.
+error () {
+	echo "$0: error: $1" >&2
+	exit 1
+}
+
+# print info
+# $0: name of program
+# $1: to printout.
+info () {
+	echo "$0: info: $1"
+}
+
+# test if 'tool' is available in path and complain otherwise.
+# $1: tool
+test_tool_avail () {
+	if test ! -x "`which $1 2>&1`"; then
+		echo No "$1" in path
+		exit 1
+	fi
+}
+
+# get ldns-testns tool in LDNS_TESTNS variable.
+get_ldns_testns () {
+	if test -x "`which ldns-testns 2>&1`"; then
+		LDNS_TESTNS=ldns-testns
+	else
+		LDNS_TESTNS=/home/wouter/bin/ldns-testns
+	fi
+}
+
+# get make tool in MAKE variable, gmake is used if present.
+get_make () {
+	if test -x "`which gmake 2>&1`"; then
+		MAKE=gmake
+	else
+		MAKE=make
+	fi
+}
+
+# get cc tool in CC variable, gcc is used if present.
+get_gcc () {
+	if test -x "`which gcc 2>&1`"; then
+		CC=gcc
+	else
+		CC=cc
+	fi
+}
+
+# get pcat, pcat-print and pcat-diff
+get_pcat () {
+	PCAT=`which pcat`
+	PCAT_PRINT=`which pcat-print`
+	PCAT_DIFF=`which pcat-diff`
+}
+
+# set SKIP=1 if the name is in list and tool is not available.
+# $1: name of package to check.
+# $2: list of packages that need the tool.
+# #3: name of the tool required.
+skip_if_in_list () {
+	if echo $2 | grep $1 >/dev/null; then
+		if test ! -x "`which $3 2>&1`"; then
+			SKIP=1;
+		fi
+	fi
+}
+
+# function to get a number of random port numbers.
+# $1: number of random ports.
+# RND_PORT is returned as the starting port number
+get_random_port () {
+	local plist
+	local cont
+	local collisions
+	local i
+	local MAXCOLLISION=1000
+	cont=1
+	collisions=0
+	while test "$cont" = 1; do
+		#netstat -n -A ip -A ip6 -a | sed -e "s/^.*:\([0-9]*\) .*$/\1/"
+		RND_PORT=$(( $RANDOM + 5354 ))
+		# depending on uname try to check for collisions in port numbers
+		case "`uname`" in
+		linux|Linux)
+			plist=`netstat -n -A ip -A ip6 -a | sed -e 's/^.*:\([0-9]*\) .*$/\1/'`
+		;;
+		FreeBSD|freebsd|NetBSD|netbsd|OpenBSD|openbsd)
+			plist=`netstat -n -a | grep "^[ut][dc]p[46] " | sed -e 's/^.*\.\([0-9]*\) .*$/\1/'`
+		;;
+		Solaris|SunOS)
+			plist=`netstat -n -a | sed -e 's/^.*\.\([0-9]*\) .*$/\1/' | grep '^[0-9]*$'`
+		;;
+		*)
+			plist=""
+		;;
+		esac
+		cont=0
+		for (( i=0 ; i < $1 ; i++ )); do
+			if echo "$plist" | grep '^'`expr $i + $RND_PORT`'$' >/dev/null 2>&1; then
+				cont=1;
+				collisions=`expr $collisions + 1`
+			fi
+		done
+		if test $collisions = $MAXCOLLISION; then
+			error "too many collisions getting random port number"
+		fi
+	done
+}
+
+# wait for server to go up, pass <logfilename> <string to watch>
+# $1 : logfilename
+# $2 : string to watch for.
+# exits with failure if it does not come up
+wait_server_up () {
+	local MAX_UP_TRY=120
+	local WAIT_THRES=30
+	local try
+	for (( try=0 ; try <= $MAX_UP_TRY ; try++ )) ; do
+		if test -f $1 && fgrep "$2" $1 >/dev/null; then
+			#echo "done on try $try"
+			break;
+		fi
+		if test $try -eq $MAX_UP_TRY; then
+			echo "Server in $1 did not go up!"
+			cat $1
+			exit 1;
+		fi
+		if test $try -ge $WAIT_THRES; then
+			sleep 1
+		fi
+	done
+}
+
+# wait for ldns-testns to come up
+# $1 : logfilename that is watched.
+wait_ldns_testns_up () {
+	wait_server_up "$1" "Listening on port"
+}
+
+# wait for unbound to come up
+# string 'Start of service' in log.
+# $1 : logfilename that is watched.
+wait_unbound_up () {
+	wait_server_up "$1" "start of service"
+}
+
+# wait for petal to come up
+# string 'petal start' in log.
+# $1 : logfilename that is watched.
+wait_petal_up () {
+	wait_server_up "$1" "petal start"
+}
+
+# wait for nsd to come up
+# string nsd start in log.
+# $1 : logfilename that is watched.
+wait_nsd_up () {
+	wait_server_up "$1" " started (NSD "
+}
+
+# wait for server to go up, pass <logfilename> <string to watch> <badstr>
+# $1 : logfile
+# $2 : success string
+# $3 : failure string
+wait_server_up_or_fail () {
+	local MAX_UP_TRY=120
+	local WAIT_THRES=30
+	local try
+	for (( try=0 ; try <= $MAX_UP_TRY ; try++ )) ; do
+		if test -f $1 && fgrep "$2" $1 >/dev/null; then
+			echo "done on try $try"
+			break;
+		fi
+		if test -f $1 && fgrep "$3" $1 >/dev/null; then
+			echo "failed on try $try"
+			break;
+		fi
+		if test $try -eq $MAX_UP_TRY; then
+			echo "Server in $1 did not go up!"
+			cat $1
+			exit 1;
+		fi
+		if test $try -ge $WAIT_THRES; then
+			sleep 1
+		fi
+	done
+}
+
+# kill a pid, make sure and wait for it to go down.
+# $1 : pid to kill
+kill_pid () {
+	local MAX_DOWN_TRY=120
+	local WAIT_THRES=30
+	local try
+	kill $1
+	for (( try=0 ; try <= $MAX_DOWN_TRY ; try++ )) ; do
+		if kill -0 $1 >/dev/null 2>&1; then
+			:
+		else
+			#echo "done on try $try"
+			break;
+		fi
+		if test $try -eq $MAX_DOWN_TRY; then
+			echo "Server in $1 did not go down! Send SIGKILL"
+			kill -9 $1 >/dev/null 2>&1
+		fi
+		if test $try -ge $WAIT_THRES; then
+			sleep 1
+		fi
+		# re-send the signal
+		kill $1 >/dev/null 2>&1
+	done
+	return 0
+}
+
+# set doxygen path, so that make doc can find doxygen
+set_doxygen_path () {
+	if test -x '/home/wouter/bin/doxygen'; then
+	        export PATH="/home/wouter/bin:$PATH"
+	fi
+}
+

testdata/iter_domain_sale.rpl

@@ -0,0 +1,272 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test resolver with a domain sale
+; and the old operator is nasty, keeps running his server with the old data.
+; and lots of lookups keep going towards the domain.
+; eventually, the NS record has to timeout.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net. (before sale of domain)
+RANGE_BEGIN 0 20
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net. (after sale of domain)
+RANGE_BEGIN 30 200
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	8.8.8.8
+ENTRY_END
+RANGE_END
+
+; ns.example.com. first owner
+RANGE_BEGIN 0 200
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+; nxdomains for any name,type
+; last in RANGE so that it matches everything left over.
+; it includes the NS record.
+ENTRY_BEGIN
+MATCH opcode
+ADJUST copy_id copy_query
+REPLY QR AA NXDOMAIN
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	3600 IN SOA	a. b. 1 2 3 4 5
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com. new owner
+RANGE_BEGIN 0 200
+	ADDRESS 8.8.8.8
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	8.8.8.8
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	88.88.88.88
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	8.8.8.8
+ENTRY_END
+RANGE_END
+
+; Fetch the old record from the old owner.
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 5 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+; the domain is sold (right at this time).
+; but the information stays in the cache.
+
+; after 1800 secs still the cached answer
+STEP 20 TIME_PASSES ELAPSE 1800
+
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 1800 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	1800 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	1800 	IN 	A	1.2.3.4
+ENTRY_END
+
+; and ask another query
+STEP 50 QUERY 
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+nx1.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+nx1.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	3600 IN SOA	a. b. 1 2 3 4 5
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+; after another 1900 seconds the domain must have timed out.
+STEP 70 TIME_PASSES ELAPSE 1900
+
+; the NS record should have timed out.
+STEP 80 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 90 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	88.88.88.88
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	8.8.8.8
+ENTRY_END
+
+SCENARIO_END

testdata/iter_domain_sale_nschange.rpl

@@ -0,0 +1,340 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test resolver with a domain sale and NS changes
+; and the old operator is nasty, keeps running his server with the old data.
+; and lots of lookups keep going towards the domain.
+; and the old server is changing the NS record of the old domain.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net. (before sale of domain)
+RANGE_BEGIN 0 20
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net. (after sale of domain)
+RANGE_BEGIN 30 200
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	8.8.8.8
+ENTRY_END
+RANGE_END
+
+; ns.example.com. first owner
+RANGE_BEGIN 0 30
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+; nxdomains for any name,type
+; last in RANGE so that it matches everything left over.
+; it includes the NS record.
+ENTRY_BEGIN
+MATCH opcode
+ADJUST copy_id copy_query
+REPLY QR AA NXDOMAIN
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	3600 IN SOA	a. b. 1 2 3 4 5
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com. first owner, NS changed
+RANGE_BEGIN 40 200
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	nsb.example.com.
+SECTION ADDITIONAL
+nsb.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	nsb.example.com.
+SECTION ADDITIONAL
+nsb.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+; nxdomains for any name,type
+; last in RANGE so that it matches everything left over.
+; it includes the NS record.
+ENTRY_BEGIN
+MATCH opcode
+ADJUST copy_id copy_query
+REPLY QR AA NXDOMAIN
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	3600 IN SOA	a. b. 1 2 3 4 5
+example.com.	3600 IN NS	nsb.example.com.
+SECTION ADDITIONAL
+nsb.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com. new owner
+RANGE_BEGIN 0 200
+	ADDRESS 8.8.8.8
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	8.8.8.8
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	88.88.88.88
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	8.8.8.8
+ENTRY_END
+RANGE_END
+
+; Fetch the old record from the old owner.
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 5 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+; the domain is sold (right at this time).
+; but the information stays in the cache.
+
+; after 1800 secs still the cached answer
+STEP 20 TIME_PASSES ELAPSE 1800
+
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 1800 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	1800 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	1800 	IN 	A	1.2.3.4
+ENTRY_END
+
+; and ask another query
+STEP 50 QUERY 
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+nx1.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+nx1.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	3600 IN SOA	a. b. 1 2 3 4 5
+example.com.	3600 IN NS	nsb.example.com.
+SECTION ADDITIONAL
+nsb.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+STEP 62 QUERY 
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+nx1.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 63 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+nx1.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	3600 IN SOA	a. b. 1 2 3 4 5
+example.com.	1800 IN NS	nsb.example.com.
+SECTION ADDITIONAL
+nsb.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+; after another 1900 seconds the domain must have timed out.
+STEP 70 TIME_PASSES ELAPSE 1900
+
+; the NS record should have timed out.
+STEP 80 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 90 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	88.88.88.88
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	8.8.8.8
+ENTRY_END
+
+SCENARIO_END

testdata/iter_prefetch_ns.rpl

@@ -0,0 +1,293 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	prefetch: "yes"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test resolver prefetch of NS record for moved domain
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net. (before sale of domain)
+RANGE_BEGIN 0 20
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net. (after sale of domain)
+RANGE_BEGIN 30 200
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	8.8.8.8
+ENTRY_END
+RANGE_END
+
+; ns.example.com. first owner
+RANGE_BEGIN 0 200
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com. new owner
+RANGE_BEGIN 0 200
+	ADDRESS 8.8.8.8
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	8.8.8.8
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	88.88.88.88
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	8.8.8.8
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 5 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+example.com. IN NS
+ENTRY_END
+; recursion happens here.
+STEP 15 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	3600 IN NS	ns.example.com.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+; after 1800 secs still the cached answer
+STEP 20 TIME_PASSES ELAPSE 1800
+
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 1800 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	1800 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	1800 	IN 	A	1.2.3.4
+ENTRY_END
+
+STEP 44 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+example.com. IN NS
+ENTRY_END
+; recursion happens here.
+STEP 45 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	1800 IN NS	ns.example.com.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ns.example.com.	1800 	IN 	A	1.2.3.4
+ENTRY_END
+
+; after 1440 we are 360 seconds before the expiry
+STEP 50 TIME_PASSES ELAPSE 1440
+
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+example.com. IN NS
+ENTRY_END
+; recursion happens here.
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	360 IN NS	ns.example.com.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ns.example.com.	360 	IN 	A	1.2.3.4
+ENTRY_END
+
+STEP 80 TRAFFIC
+; let traffic flow for prefetch to happen
+
+; after 360 + 2000 we are after the change to new owner.
+STEP 100 TIME_PASSES ELAPSE 2360
+
+; the NS record should have timed out.
+STEP 120 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 130 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	88.88.88.88
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	8.8.8.8
+ENTRY_END
+
+SCENARIO_END

testdata/iter_soamin.rpl

@@ -0,0 +1,208 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test cache of SOA with minimum ttl and normal ttl.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com. 86400 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+SECTION AUTHORITY
+example.com. 3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NXDOMAIN
+SECTION QUESTION
+nx.example.com. IN A
+SECTION AUTHORITY
+example.com. 3600 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+ENTRY_END
+
+RANGE_END
+
+; put both queries with SOA records into the cache and then query them from
+; the cache.
+; first the nxdomain, so that the positive SOA answer later overrides the
+; SOA from the authority section from that nxdomain.
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+nx.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+nx.example.com. IN A
+SECTION AUTHORITY
+example.com. 3600 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+ENTRY_END
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+example.com. IN SOA
+ENTRY_END
+
+; recursion happens here.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com. 86400 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+SECTION AUTHORITY
+example.com. 3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 IN 	A	1.2.3.4
+ENTRY_END
+
+; now check them from the cache (no seconds elapsed).
+
+STEP 110 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+nx.example.com. IN A
+ENTRY_END
+
+STEP 120 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+nx.example.com. IN A
+SECTION AUTHORITY
+example.com. 3600 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+ENTRY_END
+
+STEP 130 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+example.com. IN SOA
+ENTRY_END
+
+STEP 140 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com. 86400 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+SECTION AUTHORITY
+example.com. 3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 IN 	A	1.2.3.4
+ENTRY_END
+
+SCENARIO_END