1.4.12rc1 tag

git-svn-id: file:///svn/unbound/tags/release-1.4.12rc1@2459 be551aaa-1e26-0410-a405-d3ace91eadb9
- fix that --enable-static-exe does not complain about it unknown.
2026-08-17 21:25:50 +02:00 · 2011-07-04 10:43:49 +00:00 · 2011-07-01 08:58:34 +00:00 · 2011-07-01 07:12:08 +00:00 · 2011-06-30 14:31:08 +00:00 · 2011-06-30 14:26:58 +00:00
103 changed files with 6715 additions and 3926 deletions
@@ -45,6 +45,11 @@ UB_ON_WINDOWS=@UB_ON_WINDOWS@
 WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
 WITH_PYUNBOUND=@WITH_PYUNBOUND@
 PYTHON_SITE_PKG=@PYTHON_SITE_PKG@
+EXPORT_ALL_SYMBOLS=@EXPORT_ALL_SYMBOLS@
+
+# override $U variable which is used by autotools for deansification (for
+# K&R C compilers), but causes problems if $U is defined in the env).
+U=

 SWIG=@SWIG@
 YACC=@YACC@
@@ -102,13 +107,25 @@ UNITTEST_SRC=$(patsubst $(srcdir)/%,%, \
 	testcode/readhex.c testcode/ldns-testpkts.c smallapp/worker_cb.c \
 	$(COMMON_SRC)
 UNITTEST_OBJ=$(addprefix $(BUILD),$(UNITTEST_SRC:.c=.lo)) $(COMPAT_OBJ)
-DAEMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/daemon/*.c)) \
-	$(COMMON_SRC)
+
+DAEMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/daemon/*.c))
+ifneq "$(EXPORT_ALL_SYMBOLS)" "yes"
+DAEMON_SRC+=$(COMMON_SRC)
+endif
 DAEMON_OBJ=$(addprefix $(BUILD),$(DAEMON_SRC:.c=.lo)) $(COMPAT_OBJ)
-CHECKCONF_SRC=smallapp/unbound-checkconf.c smallapp/worker_cb.c $(COMMON_SRC)
+
+CHECKCONF_SRC=smallapp/unbound-checkconf.c smallapp/worker_cb.c
+ifneq "$(EXPORT_ALL_SYMBOLS)" "yes"
+CHECKCONF_SRC+=$(COMMON_SRC)
+endif
 CHECKCONF_OBJ=$(addprefix $(BUILD),$(CHECKCONF_SRC:.c=.lo)) $(COMPAT_OBJ)
-CONTROL_SRC=smallapp/unbound-control.c smallapp/worker_cb.c $(COMMON_SRC)
+
+CONTROL_SRC=smallapp/unbound-control.c smallapp/worker_cb.c
+ifneq "$(EXPORT_ALL_SYMBOLS)" "yes"
+CONTROL_SRC+=$(COMMON_SRC)
+endif
 CONTROL_OBJ=$(addprefix $(BUILD),$(CONTROL_SRC:.c=.lo)) $(COMPAT_OBJ)
+
 HOST_SRC=smallapp/unbound-host.c
 HOST_OBJ=$(addprefix $(BUILD),$(HOST_SRC:.c=.lo)) $(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
 UBANCHOR_SRC=smallapp/unbound-anchor.c
@@ -175,8 +192,6 @@ ifeq "$(UB_ON_WINDOWS)" "yes"

 $(BUILD)%.o:      $(srcdir)/%.rc $(srcdir)/config.h
 	$(INFO) Resource $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(WINDRES) $(CPPFLAGS) $< $@
 endif
@@ -185,12 +200,10 @@ COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS)
 LINK=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(staticexe) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS))
 LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS) $(staticexe) -version-number @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined)

-.PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip lib longtest longcheck check
+.PHONY:	clean realclean doc lint all install uninstall tests test strip lib longtest longcheck check

 $(BUILD)%.lo:    $(srcdir)/%.c 
 	$(INFO) Build $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(COMPILE) -o $@ -c $<

@@ -214,20 +227,19 @@ longtest:	tests

 lib:	libunbound.la

-ifeq ($(patsubst ldns-src%,ldns-src,$(ldnsdir)),ldns-src)
-ldnslib=$(ldnsdir)/lib/libldns.a
-$(ldnslib):	$(ldnsdir)/lib
-$(ldnsdir)/lib:
-	@if test ! -z "$(ldnsdir)"; \
-	then (cd $(ldnsdir) && $(MAKE)); fi
-else
-ldnslib=
+UBSYMS+=-export-symbols $(srcdir)/libunbound/ubsyms.def
+CLUBSYMS=-export-symbols $(BUILD)clubsyms.def
+EXTRALINK=
+ifeq "$(EXPORT_ALL_SYMBOLS)" "yes"
+UBSYMS=
+CLUBSYMS=
+EXTRALINK=-L. -L.libs -lunbound
 endif

-libunbound.la:	$(LIBUNBOUND_OBJ) $(ldnslib)
+libunbound.la:	$(LIBUNBOUND_OBJ)
 	$(INFO) Link $@
 ifeq ($(CHECKLOCK_SRC),)
-	$Q$(LINK_LIB) -export-symbols $(srcdir)/libunbound/ubsyms.def -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
+	$Q$(LINK_LIB) $(UBSYMS) -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
 else
 	cp $(srcdir)/libunbound/ubsyms.def $(BUILD)clubsyms.def
 	echo lock_protect >> $(BUILD)clubsyms.def
@@ -240,26 +252,26 @@ else
 	echo checklock_init >> $(BUILD)clubsyms.def
 	echo checklock_thrcreate >> $(BUILD)clubsyms.def
 	echo checklock_thrjoin >> $(BUILD)clubsyms.def
-	$Q$(LINK_LIB) -export-symbols $(BUILD)clubsyms.def -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
+	$Q$(LINK_LIB) $(CLUBSYMS) -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
 endif

-unbound$(EXEEXT):	$(DAEMON_OBJ) $(ldnslib)
+unbound$(EXEEXT):	$(DAEMON_OBJ) libunbound.la
 	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) -lssl $(LIBS)
+	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) $(EXTRALINK) -lssl $(LIBS)

-unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ) $(ldnslib)
+unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ) libunbound.la
 	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(CHECKCONF_OBJ)) $(LIBS)
+	$Q$(LINK) -o $@ $(sort $(CHECKCONF_OBJ)) $(EXTRALINK) -lssl $(LIBS)

-unbound-control$(EXEEXT):	$(CONTROL_OBJ) $(ldnslib)
+unbound-control$(EXEEXT):	$(CONTROL_OBJ) libunbound.la
 	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(CONTROL_OBJ)) -lssl $(LIBS)
+	$Q$(LINK) -o $@ $(sort $(CONTROL_OBJ)) $(EXTRALINK) -lssl $(LIBS)

-unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la $(ldnslib)
+unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) -L. -L.libs -lunbound $(LIBS)

-unbound-anchor$(EXEEXT):	$(UBANCHOR_OBJ) libunbound.la $(ldnslib)
+unbound-anchor$(EXEEXT):	$(UBANCHOR_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UBANCHOR_OBJ)) -L. -L.libs -lunbound -lexpat -lssl $(LIBS)

@@ -271,19 +283,19 @@ unbound-service-remove$(EXEEXT):	$(SVCUNINST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SVCUNINST_OBJ)) $(LIBS)

-anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ) libunbound.la $(ldnslib)
+anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ANCHORUPD_OBJ)) -L. -L.libs -lunbound $(LIBS)

-unittest$(EXEEXT):	$(UNITTEST_OBJ) $(ldnslib)
+unittest$(EXEEXT):	$(UNITTEST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UNITTEST_OBJ)) $(LIBS)

-testbound$(EXEEXT):	$(TESTBOUND_OBJ) $(ldnslib)
+testbound$(EXEEXT):	$(TESTBOUND_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(TESTBOUND_OBJ)) -lssl $(LIBS)

-lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ) $(ldnslib)
+lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(LOCKVERIFY_OBJ)) $(LIBS)

@@ -291,35 +303,35 @@ petal$(EXEEXT):	$(PETAL_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PETAL_OBJ)) -lssl $(LIBS)

-pktview$(EXEEXT):	$(PKTVIEW_OBJ) $(ldnslib)
+pktview$(EXEEXT):	$(PKTVIEW_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PKTVIEW_OBJ)) $(LIBS)

-signit$(EXEEXT):	$(SIGNIT_OBJ) $(ldnslib)
+signit$(EXEEXT):	$(SIGNIT_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SIGNIT_OBJ)) $(LIBS)

-memstats$(EXEEXT):	$(MEMSTATS_OBJ) $(ldnslib)
+memstats$(EXEEXT):	$(MEMSTATS_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(MEMSTATS_OBJ)) $(LIBS)

-asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ) $(ldnslib) libunbound.la
+asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ASYNCLOOK_OBJ)) $(LIBS) -L. -L.libs -lunbound

-streamtcp$(EXEEXT):	$(STREAMTCP_OBJ) $(ldnslib)
+streamtcp$(EXEEXT):	$(STREAMTCP_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(STREAMTCP_OBJ)) $(LIBS)

-perf$(EXEEXT):	$(PERF_OBJ) $(ldnslib)
+perf$(EXEEXT):	$(PERF_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PERF_OBJ)) $(LIBS)

-delayer$(EXEEXT):	$(DELAYER_OBJ) $(ldnslib)
+delayer$(EXEEXT):	$(DELAYER_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(DELAYER_OBJ)) $(LIBS)

-harvest$(EXEEXT):	$(HARVEST_OBJ) $(ldnslib) libunbound.la
+harvest$(EXEEXT):	$(HARVEST_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HARVEST_OBJ)) $(LIBS) -L. -L.libs -lunbound

@@ -464,12 +476,6 @@ endif
 	@echo
 	@echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand"

-download_ldns:
-	svn export https://www.nlnetlabs.nl/svn/ldns/trunk/makedist.sh ldns_makedist.sh
-	./ldns_makedist.sh -s -d https://www.nlnetlabs.nl/svn/ldns/trunk
-	mv ldns-[0-9]*.tar.gz ldns-src.tar.gz
-	rm ldns-*.tar.gz.sha1 ldns_makedist.sh
-
 iana_update:
 	curl -o port-numbers.tmp http://www.iana.org/assignments/port-numbers
 	awk '/Unassigned|Reserved/ {next;} { match($$0, "[0-9]+/udp"); if (RLENGTH > 0) print substr($$0, RSTART, RLENGTH - 4) ","}' port-numbers.tmp | sort -nu > portslist.tmp
@@ -479,8 +485,6 @@ iana_update:
 # Automatic dependencies.
 $(BUILD)%.d: $(srcdir)/%.c
 	$(INFO) Depend $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(SHELL) -ec '$(CC) $(DEPFLAG) $(CPPFLAGS) $(CFLAGS) $< | sed '\''s!\(.*\)\.o[ :]*!$(dir $@)\1.lo $@ : !g'\'' > $@; [ -s $@ ] || rm -f $@'

@@ -2,7 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 11
+# Version 12
+# 2011-06-23 Add ACX_CHECK_FLTO to check -flto.
 # 2010-08-16 Fix FLAG_OMITTED for AS_TR_CPP changes in autoconf-2.66.
 # 2010-07-02 Add check for ss_family (for minix).
 # 2010-04-26 Fix to use CPPFLAGS for CHECK_COMPILER_FLAGS.
@@ -32,6 +33,7 @@
 # ACX_DETERMINE_EXT_FLAGS_UNBOUND - find out which flags enable BSD and POSIX.
 # ACX_CHECK_FORMAT_ATTRIBUTE	- find cc printf format syntax.
 # ACX_CHECK_UNUSED_ATTRIBUTE	- find cc variable unused syntax.
+# ACX_CHECK_FLTO		- see if cc supports -flto and use it if so.
 # ACX_LIBTOOL_C_ONLY		- create libtool for C only, improved.
 # ACX_TYPE_U_CHAR		- u_char type.
 # ACX_TYPE_RLIM_T		- rlim_t type.
@@ -383,6 +385,16 @@ int test() {

 ])dnl End of ACX_DETERMINE_EXT_FLAGS_UNBOUND

+dnl Check if CC supports -flto.
+dnl in a way that supports clang and suncc (that flag does something else,
+dnl but fails to link).  It sets it in CFLAGS if it works.
+AC_DEFUN([ACX_CHECK_FLTO],
+[AC_MSG_CHECKING([if $CC supports -flto])
+BAKCFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -flto"
+AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], [AC_MSG_RESULT(yes)], [CFLAGS="$BAKCFLAGS" ; AC_MSG_RESULT(no)])
+])
+
 dnl Check the printf-format attribute (if any)
 dnl result in HAVE_ATTR_FORMAT.  
 dnl Make sure you also include the AHX_CONFIG_FORMAT_ATTRIBUTE.
@@ -871,4 +871,10 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,

 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
+/** default port for unbound control traffic, registered port with IANA,
+    ub-dns-control  8953/tcp    unbound dns nameserver control */
+#define UNBOUND_CONTROL_PORT 8953
+/** the version of unbound-control that this software implements */
+#define UNBOUND_CONTROL_VERSION 1
+

@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)

-AC_INIT(unbound, 1.4.8, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.12, unbound-bugs@nlnetlabs.nl, unbound)

 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=8
+LIBUNBOUND_REVISION=12
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -33,6 +33,10 @@ LIBUNBOUND_AGE=0
 # 1.4.6 had 2:6:0
 # 1.4.7 had 2:7:0
 # 1.4.8 had 2:8:0
+# 1.4.9 had 2:9:0
+# 1.4.10 had 2:10:0
+# 1.4.11 had 2:11:0
+# 1.4.12 had 2:12:0

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -222,6 +226,7 @@ case "$debug_enabled" in
 		# nothing to do.
 		;;
 esac
+ACX_CHECK_FLTO

 AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
@@ -580,7 +585,7 @@ AC_CHECK_HEADERS([expat.h],,, [AC_INCLUDES_DEFAULT])
 # set static linking if requested
 AC_SUBST(staticexe)
 staticexe=""
-AC_ARG_ENABLE(staticexe, AC_HELP_STRING([--enable-static-exe],
+AC_ARG_ENABLE(static-exe, AC_HELP_STRING([--enable-static-exe],
 	[ enable to compile executables statically against event, ldns libs, for debug purposes ]), 
 	, )
 if test x_$enable_static_exe = x_yes; then
@@ -693,16 +698,26 @@ AC_REPLACE_FUNCS(memmove)
 AC_REPLACE_FUNCS(gmtime_r)
 AC_REPLACE_FUNCS(ctime_r)

+AC_ARG_ENABLE(allsymbols, AC_HELP_STRING([--enable-allsymbols], [export all symbols from libunbound and link binaries to it, smaller install size but libunbound export table is polluted by internal symbols]))
+case "$enable_allsymbols" in
+	no)
+	EXPORT_ALL_SYMBOLS=no
+	;;
+	yes)
+	EXPORT_ALL_SYMBOLS=yes
+	;;
+esac
+AC_SUBST(EXPORT_ALL_SYMBOLS)
+
 # check this after all other compilation checks, since the linking of the lib
 # may break checks after this.
-use_ldns_builtin="no"
 AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH], 
 	[specify prefix of path of ldns library to use]), 
-	[ specialldnsdir="$withval"
+	[
 	if test "$withval" != "yes"; then
-		if test "$withval" != ""; then
+		if test "$withval" != "/usr" -a "$withval" != ""; then
 			CPPFLAGS="-I$withval/include $CPPFLAGS"
-			LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
+			LDFLAGS="-L$withval/lib $LDFLAGS"
 			ACX_RUNTIME_PATH_ADD([$withval/lib])
 		fi
 		ldnsdir="$withval"
@@ -710,23 +725,23 @@ AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH],
 	fi
 ])

-AC_ARG_WITH(ldns-builtin, AC_HELP_STRING([--with-ldns-builtin], 
-	[forces use of package included with this one]), [ 
-	use_ldns_builtin="yes"
-])
-
 # check if ldns is good enough
-if test "$use_ldns_builtin" = "no"; then
-	AC_CHECK_LIB(ldns, ldns_buffer_copy)
-	AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
-	AC_CHECK_FUNC(ldns_b32_ntop_extended_hex)
-	if test x$use_gost = xyes; then
-	    AC_CHECK_FUNC(ldns_key_EVP_load_gost_id)
-	    AC_CHECK_FUNCS([ldns_key_EVP_unload_gost])
-	else
-	    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
-	fi
-	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT
+AC_CHECK_LIB(ldns, ldns_rr_new,,[
+	AC_MSG_ERROR([No ldns library found, install the ldns library into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Install the package ldns or download source http://www.nlnetlabs.nl/projects/ldns])
+])
+AC_CHECK_FUNC(ldns_buffer_copy)
+AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
+AC_CHECK_FUNC(ldns_get_random)
+AC_CHECK_FUNC(ldns_b32_ntop_extended_hex)
+if test x$use_gost = xyes; then
+    AC_CHECK_FUNC(ldns_key_EVP_load_gost_id)
+    AC_CHECK_FUNCS([ldns_key_EVP_unload_gost])
+else
+    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
+fi
+AC_CHECK_HEADERS([ldns/ldns.h],,[
+	AC_MSG_ERROR([No ldns include file found, install the ldns library development files.  Install package ldns-dev or ldns-devel or download source http://www.nlnetlabs.nl/projects/ldns])
+	], [AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
 #endif
@@ -747,38 +762,18 @@ if test "$use_ldns_builtin" = "no"; then
 #include <ws2tcpip.h>
 #endif
 ])
-	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
-	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
-	    -a $ac_cv_header_ldns_ldns_h = yes \
-	    -a $ac_cv_func_ldns_b32_ntop_extended_hex = yes \
-	    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
-	    dnl ldns was found
-	    :
-	else
-	    AC_MSG_ERROR([No ldns library found (or not recent); install or update ldns library, use --with-ldns=path or --with-ldns-builtin])
-	fi
+if test $ac_cv_func_ldns_buffer_copy = yes \
+    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
+    -a $ac_cv_func_ldns_get_random = yes \
+    -a $ac_cv_header_ldns_ldns_h = yes \
+    -a $ac_cv_func_ldns_b32_ntop_extended_hex = yes \
+    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
+    dnl ldns was found
+    :
+else
+    AC_MSG_ERROR([ldns library is not recent, update the ldns library, install it into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Package libldns or download source http://www.nlnetlabs.nl/projects/ldns])
 fi

-if test "$use_ldns_builtin" = "yes"; then
-dnl use the builtin ldns-src.tar.gz file to build ldns.
-if test ! -f $srcdir/ldns-src.tar.gz; then
-	AC_MSG_ERROR([No ldns library found and no ldns-src.tar.gz, use --with-ldns=path.])
-fi
-echo "****************************************************************"
-echo "***                                                          ***"
-echo "*** Building ldns library from package included in this one. ***"
-echo "***                                                          ***"
-echo "****************************************************************"
-if test -d $srcdir/ldns-src; then rm -rf $srcdir/ldns-src; fi
-mkdir $srcdir/ldns-src; cp $srcdir/ldns-src.tar.gz $srcdir/ldns-src/ldns-src.tar.gz; (cd $srcdir/ldns-src; gzip -cd ldns-src.tar.gz | tar xf -); rm -f $srcdir/ldns-src/ldns-src.tar.gz; mv $srcdir/ldns-src $srcdir/ldns-srcb; mv $srcdir/ldns-srcb/ldns* $srcdir/ldns-src; rmdir $srcdir/ldns-srcb
-ldnsdir="ldns-src"
-AC_MSG_NOTICE([Configure $ldnsdir scheduled after config.status])
-AC_CONFIG_SUBDIRS([ldns-src])
-CPPFLAGS="-I$ldnsdir/include $CPPFLAGS"
-LDFLAGS="$LDFLAGS $ldnsdir/*.lo"
-AC_SUBST(ldnsdir)
-fi  dnl end of use_ldns_builtin == yes
-
 ACX_STRIP_EXT_FLAGS
 LDFLAGS="$LATE_LDFLAGS $LDFLAGS"

@@ -914,6 +909,12 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,

 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
+/** default port for unbound control traffic, registered port with IANA,
+    ub-dns-control  8953/tcp    unbound dns nameserver control */
+#define UNBOUND_CONTROL_PORT 8953
+/** the version of unbound-control that this software implements */
+#define UNBOUND_CONTROL_VERSION 1
+
 ])

 AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8])
@@ -1,6 +1,6 @@
 Summary: Validating, recursive, and caching DNS resolver
 Name: unbound
-Version: 1.4.4
+Version: 1.4.8
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -8,7 +8,7 @@ Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 #Source1: unbound.init
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel
+BuildRequires: flex, openssl-devel, expat-devel

 %description
 Unbound is a validating, recursive, and caching DNS resolver.
@@ -32,7 +32,7 @@ The source code is under a BSD License.
 # This is a build using libldns builtin version, the resulting binaries
 # do not require libldns and this package does not have version dependencies.
 # Could be smaller using a dependency on libldns (use --with-ldns=).
-%configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath
+%configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath --with-ldns-builtin

 %build
 #%{__make} %{?_smp_mflags}
@@ -92,6 +92,15 @@ if [ "$1" -ge "1" ]; then
 fi

 %changelog
+* Thu Mar 17 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
+- removed --disable-gost, assume recent openssl on the destination platform.
+
+* Wed Mar 16 2011 Harold Jones <hajones@verisign.com> - 1.4.8
+- Bump version number to latest
+- Add expat-devel to BuildRequires
+- Added --disable-gost for building on CentOS 5.x
+- Added --with-ldns-builtin for CentOS 5.x
+
 * Thu May 22 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.0.0
 - contrib changes from Patrick Vande Walle.

@@ -395,7 +395,6 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	/* create new commpoint unless we are servicing already */
 	if(rc->active >= rc->max_active) {
 		log_warn("drop incoming remote control: too many connections");
-		comm_point_stop_listening(c);
 	close_exit:
 #ifndef USE_WINSOCK
 		close(newfd);
@@ -702,13 +701,14 @@ print_mem(SSL* ssl, struct worker* worker, struct daemon* daemon)

 /** print uptime stats */
 static int
-print_uptime(SSL* ssl, struct worker* worker)
+print_uptime(SSL* ssl, struct worker* worker, int reset)
 {
 	struct timeval now = *worker->env.now_tv;
 	struct timeval up, dt;
 	timeval_subtract(&up, &now, &worker->daemon->time_boot);
 	timeval_subtract(&dt, &now, &worker->daemon->time_last_stat);
-	worker->daemon->time_last_stat = now;
+	if(reset)
+		worker->daemon->time_last_stat = now;
 	if(!ssl_printf(ssl, "time.now"SQ"%d.%6.6d\n", 
 		(unsigned)now.tv_sec, (unsigned)now.tv_usec)) return 0;
 	if(!ssl_printf(ssl, "time.up"SQ"%d.%6.6d\n", 
@@ -892,7 +892,7 @@ do_stats(SSL* ssl, struct daemon_remote* rc, int reset)
 	total.mesh_time_median /= (double)daemon->num;
 	if(!print_stats(ssl, "total", &total)) 
 		return;
-	if(!print_uptime(ssl, rc->worker))
+	if(!print_uptime(ssl, rc->worker, reset))
 		return;
 	if(daemon->cfg->stat_extended) {
 		if(!print_mem(ssl, rc->worker, daemon)) 
@@ -1062,6 +1062,9 @@ do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
 	hashvalue_t h;
 	struct query_info k;
 	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c, 0);
+	if(t == LDNS_RR_TYPE_SOA)
+		rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c,
+			PACKED_RRSET_SOA_NEG);
 	k.qname = nm;
 	k.qname_len = nmlen;
 	k.qtype = t;
@@ -1867,7 +1870,8 @@ static void
 handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 {
 	int r;
-	char magic[5];
+	char pre[10];
+	char magic[7];
 	char buf[1024];
 #ifdef USE_WINSOCK
 	/* makes it possible to set the socket blocking again. */
@@ -1876,7 +1880,7 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 #endif
 	fd_set_block(s->c->fd);

-	/* try to read magic UBCT string */
+	/* try to read magic UBCT[version]_space_ string */
 	ERR_clear_error();
 	if((r=SSL_read(ssl, magic, (int)sizeof(magic)-1)) <= 0) {
 		if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN)
@@ -1884,9 +1888,10 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 		log_crypto_err("could not SSL_read");
 		return;
 	}
-	magic[4] = 0;
-	if( r != 4 || strcmp(magic, "UBCT") != 0) {
+	magic[6] = 0;
+	if( r != 6 || strncmp(magic, "UBCT", 4) != 0) {
 		verbose(VERB_QUERY, "control connection has bad magic string");
+		/* probably wrong tool connected, ignore it completely */
 		return;
 	}

@@ -1894,6 +1899,13 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 	if(!ssl_read_line(ssl, buf, sizeof(buf))) {
 		return;
 	}
+	snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
+	if(strcmp(magic, pre) != 0) {
+		verbose(VERB_QUERY, "control connection had bad "
+			"version %s, cmd: %s", magic, buf);
+		ssl_printf(ssl, "error version mismatch\n");
+		return;
+	}
 	verbose(VERB_DETAIL, "control cmd: %s", buf);

 	/* figure out what to do */
@@ -100,12 +100,14 @@ void server_stats_log(struct server_stats* stats, struct worker* worker,
 		(unsigned)stats->num_queries_missed_cache,
 		(unsigned)stats->num_queries_prefetch);
 	log_info("server stats for thread %d: requestlist max %u avg %g "
-		"exceeded %u", threadnum, (unsigned)stats->max_query_list_size,
+		"exceeded %u jostled %u", threadnum,
+		(unsigned)stats->max_query_list_size,
 		(stats->num_queries_missed_cache+stats->num_queries_prefetch)?
 			(double)stats->sum_query_list_size/
 			(stats->num_queries_missed_cache+
 			stats->num_queries_prefetch) : 0.0,
-		(unsigned)worker->env.mesh->stats_dropped);
+		(unsigned)worker->env.mesh->stats_dropped,
+		(unsigned)worker->env.mesh->stats_jostled);
 }

 /** get rrsets bogus number from validator */
@@ -446,7 +446,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	uint16_t udpsize = edns->udp_size;
 	int secure = 0;
 	uint32_t timenow = *worker->env.now;
-	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
+	int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd)
+		&& worker->env.need_to_validate;
 	struct dns_msg *msg = NULL;
 	struct delegpt *dp;

@@ -522,7 +523,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	uint32_t timenow = *worker->env.now;
 	uint16_t udpsize = edns->udp_size;
 	int secure;
-	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
+	int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd)
+		&& worker->env.need_to_validate;
 	/* see if it is possible */
 	if(rep->ttl < timenow) {
 		/* the rrsets may have been updated in the meantime.
@@ -737,17 +739,21 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			worker->stats.unwanted_queries++;
 		return 0;
 	} else if(acl == acl_refuse) {
+		log_addr(VERB_ALGO, "refused query from",
+			&repinfo->addr, repinfo->addrlen);
+		log_buf(VERB_ALGO, "refuse", c->buffer);
+		if(worker->stats.extended)
+			worker->stats.unwanted_queries++;
+		if(worker_check_request(c->buffer, worker) == -1) {
+			comm_point_drop_reply(repinfo);
+			return 0; /* discard this */
+		}
 		ldns_buffer_set_limit(c->buffer, LDNS_HEADER_SIZE);
 		ldns_buffer_write_at(c->buffer, 4, 
 			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
 		LDNS_QR_SET(ldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(ldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
-		log_addr(VERB_ALGO, "refused query from",
-			&repinfo->addr, repinfo->addrlen);
-		log_buf(VERB_ALGO, "refuse", c->buffer);
-		if(worker->stats.extended)
-			worker->stats.unwanted_queries++;
 		return 1;
 	}
 	if((ret=worker_check_request(c->buffer, worker)) != 0) {
@@ -773,10 +779,16 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		server_stats_insrcode(&worker->stats, c->buffer);
 		return 1;
 	}
+	if(worker->env.cfg->log_queries) {
+		char ip[128];
+		addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
+		log_nametypeclass(0, ip, qinfo.qname, qinfo.qtype, qinfo.qclass);
+	}
 	if(qinfo.qtype == LDNS_RR_TYPE_AXFR || 
 		qinfo.qtype == LDNS_RR_TYPE_IXFR) {
 		verbose(VERB_ALGO, "worker request: refused zone transfer.");
 		log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
+		ldns_buffer_rewind(c->buffer);
 		LDNS_QR_SET(ldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(ldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
@@ -1,3 +1,143 @@
+1 July 2011: Wouter
+	- version number in example config file.
+	- fix that --enable-static-exe does not complain about it unknown.
+
+30 June 2011: Wouter
+	- tag relase 1.4.11, trunk is 1.4.12 development.
+	- iana portlist updated.
+	- fix bug#395: id bits of other query may leak out under conditions
+	- fix replyaddr count wrong after jostled queries, which leads to
+	  eventual starvation where the daemon has no replyaddrs left to use.
+	- fix comment about rndc port, that referred to the old port number.
+	- fix that the listening socket is not closed when too many remote
+	  control connections are made at the same time.
+	- removed ldns-src tarball inside the unbound tarball.
+
+23 June 2011: Wouter
+	- Changed -flto check to support clang compiler.
+	- tag 1.4.11rc3 created.
+
+17 June 2011: Wouter
+	- tag 1.4.11rc1 created.
+	- remove warning about signed/unsigned from flex (other flex version).
+	- updated aclocal.m4 and libtool to match.
+	- tag 1.4.11rc2 created.
+
+16 June 2011: Wouter
+	- log-queries: yesno option, default is no, prints querylog.
+	- version is 1.4.11.
+
+14 June 2011: Wouter
+	- Use -flto compiler flag for link time optimization, if supported.
+	- iana portlist updated.
+
+12 June 2011: Wouter
+	- IPv6 service address for d.root-servers.net (2001:500:2D::D).
+
+10 June 2011: Wouter
+	- unbound-control has version number in the header,
+	  UBCT[version]_space_ is the header sent by the client now.
+	- Unbound control port number is registered with IANA:
+	  ub-dns-control  8953/tcp    unbound dns nameserver control
+	  This is the new default for the control-port config setting.
+	- statistics-interval prints the number of jostled queries to log.
+
+30 May 2011: Wouter
+	- Fix Makefile for U in environment, since wrong U is more common than
+	  deansification necessity.
+	- iana portlist updated.
+	- updated ldns tarball to 1.6.10rc2 snapshot of today.
+
+25 May 2011: Wouter
+	- Fix assertion failure when unbound generates an empty error reply
+	  in response to a query, CVE-2011-1922 VU#531342.
+	- This fix is in tag 1.4.10.
+	- defense in depth against the above bug, an error is printed to log
+	  instead of an assertion failure.
+
+10 May 2011: Wouter
+	- bug#386: --enable-allsymbols option links all binaries to libunbound
+	  and reduces install size significantly.
+	- feature, ignore-cd-flag: yesno to provide dnssec to legacy servers.
+	- iana portlist updated.
+	- Fix TTL of SOA so negative TTL is separately cached from normal TTL.
+
+14 April 2011: Wouter
+	- configure created with newer autoconf 2.66.
+
+12 April 2011: Wouter
+	- bug#378: Fix that configure checks for ldns_get_random presence.
+
+8 April 2011: Wouter
+	- iana portlist updated.
+	- queries with CD flag set cause DNSSEC validation, but the answer is
+	  not withheld if it is bogus.  Thus, unbound will retry if it is bad
+	  and curb the TTL if it is bad, thus protecting the cache for use by
+	  downstream validators.
+	- val-override-date: -1 ignores dates entirely, for NTP usage.
+
+29 March 2011: Wouter
+	- harden-below-nxdomain: changed so that it activates when the
+	  cached nxdomain is dnssec secure.  This avoids backwards
+	  incompatibility because those old servers do not have dnssec.
+
+24 March 2011: Wouter
+	- iana portlist updated.
+	- release 1.4.9.
+	- trunk is 1.5.0
+
+17 March 2011: Wouter
+	- bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
+	  Applied but did not do the --disable-gost.
+
+10 March 2011: Wouter
+	- tag 1.4.9 release candidate 1 created.
+
+3 March 2011: Wouter
+	- updated ldns to today.
+
+1 March 2011: Wouter
+	- Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
+	- give config parse error for multiple names on a stub or forward zone.
+	- updated ldns tarball to 1.6.9(todays snapshot).
+
+24 February 2011: Wouter
+	- bug #361: Fix, time.elapsed variable not reset with stats_noreset.
+
+23 February 2011: Wouter
+	- iana portlist updated.
+	- common.sh to version 3.
+
+18 February 2011: Wouter
+	- common.sh in testdata updated to version 2.
+
+15 February 2011: Wouter
+	- Added explicit note on unbound-anchor usage:
+	  Please note usage of unbound-anchor root anchor is at your own risk
+	  and under the terms of our LICENSE (see that file in the source).
+
+11 February 2011: Wouter
+	- iana portlist updated.
+	- tpkg updated with common.sh for common functionality.
+
+7 February 2011: Wouter
+	- Added regression test for addition of a .net DS to the root, and
+	  cache effects with different TTL for glue and DNSKEY.
+	- iana portlist updated.
+
+28 January 2011: Wouter
+	- Fix remove private address does not throw away entire response.
+
+24 January 2011: Wouter
+	- release 1.4.8
+
+19 January 2011: Wouter
+	- fix bug#349: no -L/usr for ldns.
+
+18 January 2011: Wouter
+	- ldns 1.6.8 tarball included.
+	- release 1.4.8rc1.
+
 17 January 2011: Wouter
 	- add get and set option for harden-below-nxdomain feature.
 	- iana portlist updated.
@@ -11,16 +11,14 @@ This software is under BSD license, see LICENSE for details.

 * Uses the following libraries; 
  * ldns	http://www.nlnetlabs.nl/ldns/			(BSD license)
-    (required) can use tarball from source directory.
+    (required) can use ldns build directory directly with --with-ldns=path.
  * libevent	http://www.monkey.org/~provos/libevent/		(BSD license)
    (optional) can use builtin alternative instead.

 * Make and install: ./configure; make; make install
  * Use GNU make; default on linux, often called 'gmake' on BSD and Solaris.
  * --with-ldns=/path/to/ldns
-  	If ldns is not detected on the system, a prepackaged tarball
-	of the ldns library is used to compile and statically link against.
-	If detected on the system, it will dynamically link against it.
+	It will dynamically link against it.
  * --with-libevent=/path/to/libevent
  	Can be set to either the system install or the build directory.
 	--with-libevent=no (default) gives a builtin alternative 
@@ -1,16 +1,21 @@

 Specification for the unbound-control protocol.

-Server listens on 953 TCP (localhost by default). Client connects,
+Server listens on 8953 TCP (localhost by default). Client connects,
 SSLv3 or TLSv1 connection setup (server selfsigned certificate, 
 client has cert signed by server certificate).

+Port 8953 is registered with IANA as:
+ub-dns-control  8953/tcp    unbound dns nameserver control
+# Wouter Wijngaards <wouter&nlnetlabs.nl> 10 May 2011
+On may 11 2011, ticket [IANA #442315].
+
 Query and Response
 ------------------
 Client sends 
-	UBCT [commandline] \n
-	fixed string UBCT, then an ascii text line, with a command, 
-	some whitespace allowed. Line ends with '\n'.
+	UBCT[version] [commandline] \n
+	fixed string UBCT1 (for version 1), then an ascii text line,
+	with a command, some whitespace allowed. Line ends with '\n'.

 Server executes command. And sends reply in ascii text over channel, 
 closes the channel when done.
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page.
+# See unbound.conf(5) man page, version @version@.
 #
 # this is a comment.

@@ -212,6 +212,9 @@ server:

 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	# log-time-ascii: no
+	
+	# print one line with time, IP, name, type, class for every query.
+	# log-queries: no

 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"
@@ -257,8 +260,7 @@ server:
 	# Default on, which insists on dnssec data for trust-anchored zones.
 	# harden-dnssec-stripped: yes

-	# Harden against queries that fall under known nxdomain names.
-	# Default off because very old software can be incompatible.
+	# Harden against queries that fall under dnssec-signed nxdomain names.
 	# harden-below-nxdomain: no

        # Harden the referral path by performing additional queries for
@@ -319,6 +321,8 @@ server:
 	#
 	# If you want to perform DNSSEC validation, run unbound-anchor before
 	# you start unbound (i.e. in the system boot scripts).  And enable:
+	# Please note usage of unbound-anchor root anchor is at your own risk
+	# and under the terms of our LICENSE (see that file in the source).
 	# auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"

 	# File with DLV trusted keys. Same format as trust-anchor-file.
@@ -351,7 +355,7 @@ server:

 	# Override the date for validation with a specific fixed date.
 	# Do not set this unless you are debugging signature inception
-	# and expiration. "" or "0" turns the feature off. 
+	# and expiration. "" or "0" turns the feature off. -1 ignores date.
 	# val-override-date: ""

 	# The time to live for bogus data, rrsets and messages. This avoids
@@ -377,6 +381,11 @@ server:
 	# replies if the message is found secure. The default is off.
 	# val-permissive-mode: no

+	# Ignore the CD flag in incoming queries and refuse them bogus data.
+	# Enable it if the only clients of unbound are legacy servers (w2008)
+	# that set CD but cannot validate themselves.
+	# ignore-cd-flag: no
+
 	# Have the validator log failed validations for your diagnosis.
 	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
 	# val-log-level: 0
@@ -466,7 +475,7 @@ remote-control:
 	# control-interface: ::1

 	# port number for remote control operations.
-	# control-port: 953
+	# control-port: 8953

 	# unbound server key file.
 	# server-key-file: "@UNBOUND_RUN_DIR@/unbound_server.key"
@@ -26,6 +26,9 @@ Suggested usage:
 	# in the init scripts.
 	# provide or update the root anchor (if necessary)
 	unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
+	# Please note usage of this root anchor is at your own risk
+	# and under the terms of our LICENSE (see source).
+	#
 	# start validating resolver
 	# the unbound.conf contains:
 	#   auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
@@ -395,6 +395,12 @@ Sets logfile lines to use a timestamp in UTC ascii. Default is no, which
 prints the seconds since 1970 in brackets. No effect if using syslog, in
 that case syslog formats the timestamp printed into the log files.
 .TP
+.B log\-queries: \fI<yes or no>
+Prints one line per query to the log, with the log timestamp and IP address,
+name, type and class.  Default is no.  Note that it takes time to print these
+lines which makes the server (significantly) slower.  Odd (nonprintable)
+characters in names are printed as '?'.
+.TP
 .B pidfile: \fI<filename>
 The process id is written to the file. Default is "@UNBOUND_PIDFILE@". 
 So,
@@ -471,7 +477,9 @@ From draft-vixie-dnsext-resimprove, returns nxdomain to queries for a name
 below another name that is already known to be nxdomain.  DNSSEC mandates
 noerror for empty nonterminals, hence this is possible.  Very old software
 might return nxdomain for empty nonterminals (that usually happen for reverse
-IP address lookups), and thus may be incompatible with this.  Default is off.
+IP address lookups), and thus may be incompatible with this.  To try to avoid
+this only DNSSEC-secure nxdomains are used, because the old software does not
+have DNSSEC.  Default is off.
 .TP
 .B harden\-referral\-path: \fI<yes or no>
 Harden the referral path by performing additional queries for
@@ -606,7 +614,8 @@ externally can create validation failures for that internal domain.
 Default is "" or "0", which disables this debugging feature. If enabled by
 giving a RRSIG style date, that date is used for verifying RRSIG inception
 and expiration dates, instead of the current date. Do not set this unless 
-you are debugging signature inception and expiration.
+you are debugging signature inception and expiration. The value \-1 ignores
+the date altogether, useful for some special applications.
 .TP
 .B val\-sig\-skew\-min: \fI<seconds>
 Minimum number of seconds of clock skew to apply to validated signatures.
@@ -654,6 +663,14 @@ receives the bogus data. For messages that are found to be secure the AD bit
 is set in replies. Also logging is performed as for full validation.
 The default value is "no". 
 .TP
+.B ignore\-cd\-flag: \fI<yes or no>
+Instruct unbound to ignore the CD flag from clients and refuse to
+return bogus answers to them.  Thus, the CD (Checking Disabled) flag
+does not disable checking any more.  This is useful if legacy (w2008)
+servers that set the CD flag but cannot validate DNSSEC themselves are
+the clients, and then unbound provides them with DNSSEC protection.
+The default value is "no".
+.TP
 .B val\-nsec3\-keysize\-iterations: \fI<"list of values">
 List of keysize and iteration count values, separated by spaces, surrounded
 by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
@@ -877,10 +894,9 @@ By default localhost (127.0.0.1 and ::1) is listened to.
 Use 0.0.0.0 and ::0 to listen to all interfaces.
 .TP 5
 .B control\-port: <port number>
-The port number to listen on for control commands, default is 953
-(that is the same port number named uses to listen to rndc).
-If you change this port number, and permissions have been dropped, a
-reload is not sufficient to open the port again, you must then restart.
+The port number to listen on for control commands, default is 8953.
+If you change this port number, and permissions have been dropped,
+a reload is not sufficient to open the port again, you must then restart.
 .TP 5
 .B server\-key\-file: "<private key file>"
 Path to the server private key, by default unbound_server.key.
@@ -132,6 +132,7 @@ compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
      }
      if(do_ip6) {
 	if(!ah(dp, r, "A.ROOT-SERVERS.NET.", "2001:503:ba3e::2:30")) return 0;
+	if(!ah(dp, r, "D.ROOT-SERVERS.NET.", "2001:500:2d::d")) return 0;
 	if(!ah(dp, r, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) return 0;
 	if(!ah(dp, r, "H.ROOT-SERVERS.NET.", "2001:500:1::803f:235")) return 0;
 	if(!ah(dp, r, "I.ROOT-SERVERS.NET.", "2001:7fe::53")) return 0;
@@ -643,9 +643,9 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 		if( (rrset->type == LDNS_RR_TYPE_A || 
 			rrset->type == LDNS_RR_TYPE_AAAA) &&
 			priv_rrset_bad(ie->priv, pkt, rrset)) {
-			/* set servfail, so the classification becomes
-			 * THROWAWAY, instead of LAME or other unwanted */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_SERVFAIL);
+
+			/* do not set servfail since this leads to too
+			 * many drops of other people using rfc1918 space */
 			remove_rrset("sanitize: removing public name with "
 				"private address", pkt, msg, prev, &rrset);
 			continue;
@@ -56,6 +56,7 @@ Generate a distribution tar file for unbound.
    -l ldnsdir   Directory where ldns resides. Detected from Makefile.
    -wssl openssl.xx.tar.gz Also build openssl from tarball for windows dist.
    -wxp expat.xx.tar.gz Also build expat from tarball for windows dist.
+    -wldns ldns.xx.tar.gz Also build libldns from tarball for windows dist.
    -w ...       Build windows binary dist. last args passed to configure.
 EOF
    exit 1
@@ -137,6 +138,7 @@ LDNSDIR=""
 DOWIN="no"
 WINSSL=""
 WINEXPAT=""
+WINLDNS=""

 # Parse the command line arguments.
 while [ "$1" ]; do
@@ -151,6 +153,10 @@ while [ "$1" ]; do
        "-s")
            SNAPSHOT="yes"
            ;;
+        "-wldns")
+	    WINLDNS="$2"
+	    shift
+	    ;;
        "-wssl")
 	    WINSSL="$2"
 	    shift
@@ -187,8 +193,8 @@ if [ "$DOWIN" = "yes" ]; then
 	configure="mingw32-configure"
 	strip="i686-pc-mingw32-strip"
 	makensis="makensis"	# from mingw32-nsis package
-	# in crosscompile no installed ldns, use builtin (not linux-ldns)
-	cross_flag="--with-ldns-builtin"
+	# flags for crosscompiled dependency libraries
+	cross_flag=""

 	check_svn_root
 	create_temp_dir
@@ -214,6 +220,21 @@ if [ "$DOWIN" = "yes" ]; then
 		cd ..
 	fi

+	if test -n "$WINLDNS"; then
+		info "Cross compile $WINLDNS"
+		info "ldns tar unpack"
+		(cd ..; gzip -cd $WINLDNS) | tar xf - || error_cleanup "tar unpack of $WINLDNS failed"
+		cd ldns-* || error_cleanup "no ldns-X dir in tarball"
+		# we can use the cross_flag with openssl in it
+		info "ldns: Configure $cross_flag"
+		mingw32-configure  $cross_flag || error_cleanup "ldns configure failed"
+		info "ldns: make"
+		make || error_cleanup "ldns crosscompile failed"
+		# use from the build directory.
+		cross_flag="$cross_flag --with-ldns=`pwd`"
+		cd ..
+	fi
+
 	if test -n "$WINEXPAT"; then
 		info "Cross compile $WINEXPAT"
 		info "wxp: tar unpack"
@@ -410,6 +431,7 @@ replace_all doc/unbound-checkconf.8.in
 replace_all doc/unbound-control.8.in
 replace_all doc/unbound-anchor.8.in
 replace_all doc/unbound-host.1
+replace_all doc/example.conf.in
 replace_all doc/libunbound.3.in

 info "Renaming Unbound directory to unbound-$version."
@@ -685,7 +685,7 @@ dns_cache_lookup(struct module_env* env,
 			struct reply_info* data = (struct reply_info*)e->data;
 			struct dns_msg* msg;
 			if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
-			  && data->security != sec_status_bogus
+			  && data->security == sec_status_secure
 			  && (msg=tomsg(env, &k, data, region, now, scratch))){
 				lock_rw_unlock(&e->lock);
 				msg->qinfo.qname=qname;
@@ -270,7 +270,11 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
        uint16_t qflags, struct edns_data* edns, struct comm_reply* rep,
        uint16_t qid)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	/* do not use CD flag from user for mesh state, we want the CD-query
+	 * to receive validation anyway, to protect out cache contents and
+	 * avoid bad-data in this cache that a downstream validator cannot
+	 * remove from this cache */
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -298,7 +302,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	/* see if it already exists, if not, create one */
 	if(!s) {
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
@@ -357,7 +361,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, ldns_buffer* buf, 
 	uint16_t qid, mesh_cb_func_t cb, void* cb_arg)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -366,7 +370,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	/* see if it already exists, if not, create one */
 	if(!s) {
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
 		if(!s) {
 			return 0;
 		}
@@ -403,7 +407,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
        uint16_t qflags, uint32_t leeway)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
 	struct rbnode_t* n;
 	/* already exists, and for a different purpose perhaps.
 	 * if mesh_no_list, keep it that way. */
@@ -420,7 +424,7 @@ void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
 		mesh->stats_dropped ++;
 		return;
 	}
-	s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+	s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
 	if(!s) {
 		log_err("prefetch mesh_state_create: out of memory");
 		return;
@@ -524,22 +528,24 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	int i;
 	if(!mstate)
 		return;
+	mesh = mstate->s.env->mesh;
 	/* drop unsent replies */
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep;
 		struct mesh_cb* cb;
 		for(rep=mstate->reply_list; rep; rep=rep->next) {
 			comm_point_drop_reply(&rep->query_reply);
+			mesh->num_reply_addrs--;
 		}
 		for(cb=mstate->cb_list; cb; cb=cb->next) {
 			fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
 			(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
 				sec_status_unchecked, NULL);
+			mesh->num_reply_addrs--;
 		}
 	}

 	/* de-init modules */
-	mesh = mstate->s.env->mesh;
 	for(i=0; i<mesh->mods.num; i++) {
 		fptr_ok(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
 		(*mesh->mods.mod[i]->clear)(&mstate->s, i);
@@ -768,7 +774,8 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	struct timeval duration;
 	int secure;
 	/* examine security status */
-	if(m->s.env->need_to_validate && !(r->qflags&BIT_CD) && rep && 
+	if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
+		m->s.env->cfg->ignore_cd) && rep && 
 		rep->security <= sec_status_bogus) {
 		rcode = LDNS_RCODE_SERVFAIL;
 		if(m->s.env->cfg->stat_extended) 
@@ -81,7 +81,7 @@ while test $# -ne 0; do
 	echo "	-d dir	use directory to store keys and certificates."
 	echo "		default: $DESTDIR"
 	echo "please run this command using the same user id that the "
-	echo "unboun daemon uses, it needs read privileges."
+	echo "unbound daemon uses, it needs read privileges."
 	exit 1
 	;;
 	esac
@@ -258,12 +258,13 @@ send_file(SSL* ssl, FILE* in, char* buf, size_t sz)
 static int
 go_cmd(SSL* ssl, int argc, char* argv[])
 {
-	const char* pre="UBCT";
+	char pre[10];
 	const char* space=" ";
 	const char* newline="\n";
 	int was_error = 0, first_line = 1;
 	int r, i;
 	char buf[1024];
+	snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
 	if(SSL_write(ssl, pre, (int)strlen(pre)) <= 0)
 		ssl_err("could not SSL_write");
 	for(i=0; i<argc; i++) {
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
+. testdata/common.sh

 NEED_SPLINT='00-lint.tpkg'
 NEED_DOXYGEN='01-doc.tpkg'
-NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg fwd_oneport.tpkg fwd_udptmout.tpkg fwd_waitudp.tpkg tcp_sigpipe.tpkg hostsfileosx.tpkg local_nodefault.tpkg fwd_zero.tpkg'
 NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_CURL='06-ianaports.tpkg root_anchor.tpkg'
@@ -11,8 +11,8 @@ NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg edns_cache.tpkg'
 NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'

 # test if dig and ldns-testns are available.
-if test ! -x "`which dig 2>&1`"; then echo No 'dig' in path; exit 1; fi
-if test ! -x "`which ldns-testns 2>&1`"; then echo No 'ldns-testns' in path; exit 1; fi
+test_tool_avail "dig"
+test_tool_avail "ldns-testns"

 # test for ipv6, uses streamptcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
@@ -33,41 +33,13 @@ sh ../testcode/mini_tpkg.sh clean
 rm -f .perfstats.txt
 for test in `ls *.tpkg`; do
 	SKIP=0
-	if echo $NEED_SPLINT | grep $test >/dev/null; then
-		if test ! -x "`which splint`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_DOXYGEN | grep $test >/dev/null; then
-		if test ! -x "`which doxygen`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_CURL | grep $test >/dev/null; then
-		if test ! -x "`which curl`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_LDNS_TESTNS | grep $test >/dev/null; then
-		if test ! -x "`which ldns-testns`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_XXD | grep $test >/dev/null; then
-		if test ! -x "`which xxd`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_NC | grep $test >/dev/null; then
-		if test ! -x "`which nc`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_WHOAMI | grep $test >/dev/null; then
-		if test ! -x "`which whoami`"; then
-			SKIP=1;
-		fi
-	fi
+	skip_if_in_list $test "$NEED_SPLINT" "splint"
+	skip_if_in_list $test "$NEED_DOXYGEN" "doxygen"
+	skip_if_in_list $test "$NEED_CURL" "curl"
+	skip_if_in_list $test "$NEED_XXD" "xxd"
+	skip_if_in_list $test "$NEED_NC" "nc"
+	skip_if_in_list $test "$NEED_WHOAMI" "whoami"
+
 	if echo $NEED_IPV6 | grep $test >/dev/null; then
 		if test "$HAVE_IPV6" = no; then
 			SKIP=1;
@@ -81,6 +81,8 @@ mv $name.dir/* .

 # EXE
 echo "minitpkg exe $name" > $result
+grep "Description:" $name.dsc >> $result 2>&1
+echo "DateRunStart: "`date "+%s" 2>/dev/null` >> $result
 if test -f $name.pre; then
 	echo "minitpkg exe $name.pre"
 	echo "minitpkg exe $name.pre" >> $result
@@ -112,6 +114,7 @@ if test -f $name.post; then
 		echo "Warning: $name.post did not exit successfully"
 	fi
 fi
+echo "DateRunEnd: "`date "+%s" 2>/dev/null` >> $result

 mv $result ..
 cd ..
@@ -0,0 +1,256 @@
+# common.sh - an include file for commonly used functions for test code.
+# BSD licensed (see LICENSE file).
+#
+# Version 3
+# 2011-02-23: get_pcat for PCAT, PCAT_DIFF and PCAT_PRINT defines.
+# 2011-02-18: ports check on BSD,Solaris. wait_nsd_up.
+# 2011-02-11: first version.
+#
+# include this file from a tpkg script with
+#   . ../common.sh
+#
+# overview of functions available:
+# error x		: print error and exit
+# info x		: print info
+# test_tool_avail x	: see if program in path and complain, exit if not.
+# get_ldns_testns	: set LDNS_TESTNS to executable ldns-testns
+# get_make		: set MAKE to gmake or make tool.
+# get_gcc		: set cc or gcc in CC
+# get_pcat		: set PCAT, PCAT_DIFF and PCAT_PRINT executables.
+# set_doxygen_path	: set doxygen path
+# skip_if_in_list	: set SKIP=1 if name in list and tool not available.
+# get_random_port x	: get RND_PORT a sequence of free random port numbers.
+# wait_server_up	: wait on logfile to see when server comes up.
+# wait_ldns_testns_up   : wait for ldns-testns to come up.
+# wait_unbound_up	: wait for unbound to come up.
+# wait_petal_up		: wait for petal to come up.
+# wait_nsd_up		: wait for nsd to come up.
+# wait_server_up_or_fail: wait for server to come up or print a failure string
+# kill_pid		: kill a server, make sure and wait for it to go down.
+
+
+# print error and exit
+# $0: name of program
+# $1: error to printout.
+error () {
+	echo "$0: error: $1" >&2
+	exit 1
+}
+
+# print info
+# $0: name of program
+# $1: to printout.
+info () {
+	echo "$0: info: $1"
+}
+
+# test if 'tool' is available in path and complain otherwise.
+# $1: tool
+test_tool_avail () {
+	if test ! -x "`which $1 2>&1`"; then
+		echo No "$1" in path
+		exit 1
+	fi
+}
+
+# get ldns-testns tool in LDNS_TESTNS variable.
+get_ldns_testns () {
+	if test -x "`which ldns-testns 2>&1`"; then
+		LDNS_TESTNS=ldns-testns
+	else
+		LDNS_TESTNS=/home/wouter/bin/ldns-testns
+	fi
+}
+
+# get make tool in MAKE variable, gmake is used if present.
+get_make () {
+	if test -x "`which gmake 2>&1`"; then
+		MAKE=gmake
+	else
+		MAKE=make
+	fi
+}
+
+# get cc tool in CC variable, gcc is used if present.
+get_gcc () {
+	if test -x "`which gcc 2>&1`"; then
+		CC=gcc
+	else
+		CC=cc
+	fi
+}
+
+# get pcat, pcat-print and pcat-diff
+get_pcat () {
+	PCAT=`which pcat`
+	PCAT_PRINT=`which pcat-print`
+	PCAT_DIFF=`which pcat-diff`
+}
+
+# set SKIP=1 if the name is in list and tool is not available.
+# $1: name of package to check.
+# $2: list of packages that need the tool.
+# #3: name of the tool required.
+skip_if_in_list () {
+	if echo $2 | grep $1 >/dev/null; then
+		if test ! -x "`which $3 2>&1`"; then
+			SKIP=1;
+		fi
+	fi
+}
+
+# function to get a number of random port numbers.
+# $1: number of random ports.
+# RND_PORT is returned as the starting port number
+get_random_port () {
+	local plist
+	local cont
+	local collisions
+	local i
+	local MAXCOLLISION=1000
+	cont=1
+	collisions=0
+	while test "$cont" = 1; do
+		#netstat -n -A ip -A ip6 -a | sed -e "s/^.*:\([0-9]*\) .*$/\1/"
+		RND_PORT=$(( $RANDOM + 5354 ))
+		# depending on uname try to check for collisions in port numbers
+		case "`uname`" in
+		linux|Linux)
+			plist=`netstat -n -A ip -A ip6 -a | sed -e 's/^.*:\([0-9]*\) .*$/\1/'`
+		;;
+		FreeBSD|freebsd|NetBSD|netbsd|OpenBSD|openbsd)
+			plist=`netstat -n -a | grep "^[ut][dc]p[46] " | sed -e 's/^.*\.\([0-9]*\) .*$/\1/'`
+		;;
+		Solaris|SunOS)
+			plist=`netstat -n -a | sed -e 's/^.*\.\([0-9]*\) .*$/\1/' | grep '^[0-9]*$'`
+		;;
+		*)
+			plist=""
+		;;
+		esac
+		cont=0
+		for (( i=0 ; i < $1 ; i++ )); do
+			if echo "$plist" | grep '^'`expr $i + $RND_PORT`'$' >/dev/null 2>&1; then
+				cont=1;
+				collisions=`expr $collisions + 1`
+			fi
+		done
+		if test $collisions = $MAXCOLLISION; then
+			error "too many collisions getting random port number"
+		fi
+	done
+}
+
+# wait for server to go up, pass <logfilename> <string to watch>
+# $1 : logfilename
+# $2 : string to watch for.
+# exits with failure if it does not come up
+wait_server_up () {
+	local MAX_UP_TRY=120
+	local WAIT_THRES=30
+	local try
+	for (( try=0 ; try <= $MAX_UP_TRY ; try++ )) ; do
+		if test -f $1 && fgrep "$2" $1 >/dev/null; then
+			#echo "done on try $try"
+			break;
+		fi
+		if test $try -eq $MAX_UP_TRY; then
+			echo "Server in $1 did not go up!"
+			cat $1
+			exit 1;
+		fi
+		if test $try -ge $WAIT_THRES; then
+			sleep 1
+		fi
+	done
+}
+
+# wait for ldns-testns to come up
+# $1 : logfilename that is watched.
+wait_ldns_testns_up () {
+	wait_server_up "$1" "Listening on port"
+}
+
+# wait for unbound to come up
+# string 'Start of service' in log.
+# $1 : logfilename that is watched.
+wait_unbound_up () {
+	wait_server_up "$1" "start of service"
+}
+
+# wait for petal to come up
+# string 'petal start' in log.
+# $1 : logfilename that is watched.
+wait_petal_up () {
+	wait_server_up "$1" "petal start"
+}
+
+# wait for nsd to come up
+# string nsd start in log.
+# $1 : logfilename that is watched.
+wait_nsd_up () {
+	wait_server_up "$1" " started (NSD "
+}
+
+# wait for server to go up, pass <logfilename> <string to watch> <badstr>
+# $1 : logfile
+# $2 : success string
+# $3 : failure string
+wait_server_up_or_fail () {
+	local MAX_UP_TRY=120
+	local WAIT_THRES=30
+	local try
+	for (( try=0 ; try <= $MAX_UP_TRY ; try++ )) ; do
+		if test -f $1 && fgrep "$2" $1 >/dev/null; then
+			echo "done on try $try"
+			break;
+		fi
+		if test -f $1 && fgrep "$3" $1 >/dev/null; then
+			echo "failed on try $try"
+			break;
+		fi
+		if test $try -eq $MAX_UP_TRY; then
+			echo "Server in $1 did not go up!"
+			cat $1
+			exit 1;
+		fi
+		if test $try -ge $WAIT_THRES; then
+			sleep 1
+		fi
+	done
+}
+
+# kill a pid, make sure and wait for it to go down.
+# $1 : pid to kill
+kill_pid () {
+	local MAX_DOWN_TRY=120
+	local WAIT_THRES=30
+	local try
+	kill $1
+	for (( try=0 ; try <= $MAX_DOWN_TRY ; try++ )) ; do
+		if kill -0 $1 >/dev/null 2>&1; then
+			:
+		else
+			#echo "done on try $try"
+			break;
+		fi
+		if test $try -eq $MAX_DOWN_TRY; then
+			echo "Server in $1 did not go down! Send SIGKILL"
+			kill -9 $1 >/dev/null 2>&1
+		fi
+		if test $try -ge $WAIT_THRES; then
+			sleep 1
+		fi
+		# re-send the signal
+		kill $1 >/dev/null 2>&1
+	done
+	return 0
+}
+
+# set doxygen path, so that make doc can find doxygen
+set_doxygen_path () {
+	if test -x '/home/wouter/bin/doxygen'; then
+	        export PATH="/home/wouter/bin:$PATH"
+	fi
+}
+
@@ -0,0 +1,208 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test cache of SOA with minimum ttl and normal ttl.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com. 86400 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+SECTION AUTHORITY
+example.com. 3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NXDOMAIN
+SECTION QUESTION
+nx.example.com. IN A
+SECTION AUTHORITY
+example.com. 3600 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+ENTRY_END
+
+RANGE_END
+
+; put both queries with SOA records into the cache and then query them from
+; the cache.
+; first the nxdomain, so that the positive SOA answer later overrides the
+; SOA from the authority section from that nxdomain.
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+nx.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+nx.example.com. IN A
+SECTION AUTHORITY
+example.com. 3600 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+ENTRY_END
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+example.com. IN SOA
+ENTRY_END
+
+; recursion happens here.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com. 86400 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+SECTION AUTHORITY
+example.com. 3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 IN 	A	1.2.3.4
+ENTRY_END
+
+; now check them from the cache (no seconds elapsed).
+
+STEP 110 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+nx.example.com. IN A
+ENTRY_END
+
+STEP 120 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+nx.example.com. IN A
+SECTION AUTHORITY
+example.com. 3600 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+ENTRY_END
+
+STEP 130 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+example.com. IN SOA
+ENTRY_END
+
+STEP 140 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com. 86400 IN SOA dns1.icann.org. hostmaster.icann.org. 2010074630 7200 3600 1209600 3600
+SECTION AUTHORITY
+example.com. 3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 IN 	A	1.2.3.4
+ENTRY_END
+
+SCENARIO_END
@@ -2,6 +2,8 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	harden-below-nxdomain: yes
+	trust-anchor: ". IN DNSKEY 257 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3"
+	val-override-date: "20070916134226"

 stub-zone:
 	name: "."
@@ -25,6 +27,17 @@ SECTION ADDITIONAL
 K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
 ENTRY_END

+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN DNSKEY
+SECTION ANSWER
+.	3600	IN	DNSKEY	257 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30900 (ksk), size = 512b}
+.	3600	IN	RRSIG	DNSKEY 5 0 3600 20070926134150 20070829134150 30900 . BlVcSh8xSgm7ne+XVCJwNHQKjk5kTJgG4Fa3sOSfp3YUjb2YclmVWyIw7XEHl0/C6CN5gdy18idnM6vT6Hy42A== ;{id = 30900}
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qtype qname
 ADJUST copy_id
@@ -33,6 +46,11 @@ SECTION QUESTION
 example.local. IN A
 SECTION AUTHORITY
 .	86400	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2010111601 1800 900 604800 86400
+.	86400	IN	RRSIG	SOA 5 0 86400 20070926134150 20070829134150 30900 . bOYbFZZp7vWWC2oxV+kph+YXjoQj2f6QJktlgmzRI7oReFX9jy/LibTPQi/sW0SGHpLaj3G5p4IfIlBibne4DA== ;{id = 30900}
+.	86400	IN	NSEC	ac. NS SOA RRSIG NSEC DNSKEY 
+.	86400	IN	RRSIG	NSEC 5 0 86400 20070926134150 20070829134150 30900 . U+/m5+FmczzkosEx1aTP7MK/F3PpcKWct8CzM1jhjwNe2RlnW7qFe0IH8SLzD/elvxDTQMpJSMlKOhUUdapB8g== ;{id = 30900}
+lk.	86400	IN	NSEC	lr. NS DS RRSIG NSEC 
+lk.	86400	IN	RRSIG	NSEC 5 1 86400 20070926134150 20070829134150 30900 . j6Pw5Eu9vGHDJcckTSWa8YD1b7FV7c/Z8aVkLfJCH+iPcaa40/LSp784+t2PnAAXL8fgriNL6jF/ve1rti3ANQ== ;{id = 30900}
 ENTRY_END
 RANGE_END

@@ -140,12 +140,16 @@ ENTRY_END
 ENTRY_BEGIN
 MATCH opcode qtype qname
 ADJUST copy_id
-REPLY QR AA NOERROR
+REPLY QR AA NXDOMAIN
 SECTION QUESTION
-example.com. IN SOA
-SECTION ANSWER
-example.com.	IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
-example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+nx.example.com. IN A
+SECTION AUTHORITY
+example.com.	7200 IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
+example.com.    7200 IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+nw.example.com.	7200	IN	NSEC	ny.example.com. A RRSIG 
+nw.example.com.	7200	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AHMp+sqWyR3JL6P0LhJ10fufMFSkW9+DM3QghOokyqgbRu54Q1XrHoE= ;{id = 2854}
+!.example.com. 7200 IN NSEC +.example.com. A RRSIG
+!.example.com.	7200	IN	RRSIG	NSEC 3 3 7200 20070926134150 20070829134150 2854 example.com. AJsNy2VkFTJEMShfEcvIkBe+UViVYDJbNNuGnwf/QecOrhONaVpIXy4= ;{id = 2854}
 ENTRY_END

 RANGE_END
@@ -204,19 +208,23 @@ STEP 14 QUERY
 ENTRY_BEGIN
 REPLY RD DO
 SECTION QUESTION
-example.com. IN SOA
+nx.example.com. IN A
 ENTRY_END

 STEP 15 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA AD NXDOMAIN
 SECTION QUESTION
-example.com. IN SOA
+nx.example.com. IN A
 SECTION ANSWER
-example.com.	IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
-example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
 SECTION AUTHORITY
+example.com.	7200 IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
+example.com.    7200    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+nw.example.com.	7200	IN	NSEC	ny.example.com. A RRSIG 
+nw.example.com.	7200	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AHMp+sqWyR3JL6P0LhJ10fufMFSkW9+DM3QghOokyqgbRu54Q1XrHoE= ;{id = 2854}
+!.example.com. 7200 IN NSEC +.example.com. A RRSIG
+!.example.com.	7200	IN	RRSIG	NSEC 3 3 7200 20070926134150 20070829134150 2854 example.com. AJsNy2VkFTJEMShfEcvIkBe+UViVYDJbNNuGnwf/QecOrhONaVpIXy4= ;{id = 2854}
 SECTION ADDITIONAL
 ENTRY_END

@@ -238,8 +246,8 @@ SECTION ANSWER
 SECTION AUTHORITY
 sub.example.com. IN	NSEC www.example.com. NS RRSIG NSEC
 sub.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFDCaiDM6G+glwNW276HWdH+McmjgAhRSwF5OfimNQCqkWgnYotLOwUghKQ== ;{id = 2854}
-example.com.	IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
-example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+example.com.	7200 IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
+example.com.    7200 IN RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
 ENTRY_END

 SCENARIO_END
@@ -112,7 +112,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NXDOMAIN
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION ANSWER
@@ -136,6 +136,12 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION ANSWER
 SECTION AUTHORITY
+; example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
+; example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+; 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
+; 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
+; b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
+; b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
 SECTION ADDITIONAL
 ENTRY_END

@@ -130,7 +130,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA NOERROR
 SECTION QUESTION
 a.z.w.example. IN MX
 SECTION ANSWER
@@ -194,7 +194,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.sub.example.com. IN DS
 SECTION ANSWER
@@ -195,7 +195,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
@@ -201,7 +201,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NXDOMAIN
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
@@ -149,6 +149,29 @@ onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070
 jg19n32806c832kijdnglq8p9m2r5mdj.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. f7ZSCahAuKOLXquM0jpdU6I9AX31CgGicRiB3aU4jvqQp/EygbCNn5kfpyXY0FvZvzggpl8naXSStOPN9dy3bb0NwGQkJcYD94NEw307T8uEunOvx1ug5TuakBAwqjY8xKM3xab3LnWYRtx4zdln/3ZDHvBUwfzkxUZrzeKjpiI= ;{id = 57024}
 SECTION ADDITIONAL
 ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NXDOMAIN
+SECTION QUESTION
+rub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.	3600	IN	RRSIG	SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+
+; optout
+; example.com. -> onib9mgub9h0rml3cdf5bgrj59dkjhvk.
+; rub.example.com. -> c2bqk3tb4foaenfbp1v0pdk6mor3r7vo.
+; *.example.com. -> 4f3cnt8cu22tngec382jj4gde4rb47ub.
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com. NSEC3 1 1 0 - pnib9mgub9h0rml3cdf5bgrj59dkjhvk NS SOA RRSIG DNSKEY NSEC3PARAM
+22bqk3tb4foaenfbp1v0pdk6mor3r7vo.example.com. NSEC3 1 1 0 - f2bqk3tb4foaenfbp1v0pdk6mor3r7vo NS RRSIG
+
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jHrF+lnyRL1LE/Bwz6C+jZg3E/2qQkVSboGxya6iX71v0zA3eUsob9m9l3gHNlhwhyahbamHUKx+OMvtYuzRa+RMv4ObuLRIt8StdixeXaUU+rx7C2qCKOFsa5q4HzK4bLYPfyb5T9w67HbzHPLEllXPA7tghzyzCM9qBtbvwK4= ;{id = 57024}
+22bqk3tb4foaenfbp1v0pdk6mor3r7vo.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jk6EYU9qTrmNeeKuQRG7iKyfNJnBt45MToPVpAQ+LoGDC3muy4bkWeKspj68cN9E5wNijfmm1eFK3khSSEnM50mfJbpiwlbKgL0VZz33Zn+Wu8b7sTtdDwDH7MUBLRwHeb7W+NtQIEXPLs4Z3BXHzAXy5ZpSjQ3PJZn6zBx4/dw= ;{id = 57024}
+SECTION ADDITIONAL
+ENTRY_END
 RANGE_END

 STEP 1 QUERY
@@ -204,4 +227,31 @@ jg19n32806c832kijdnglq8p9m2r5mdj.example.com.   3600    IN      RRSIG   NSEC3 7
 SECTION ADDITIONAL
 ENTRY_END

+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+rub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+; no AD flag here because of RFC5155 9.2 section.
+; also for NXDOMAIN
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+rub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.    3600    IN      RRSIG   SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com. NSEC3 1 1 0 - pnib9mgub9h0rml3cdf5bgrj59dkjhvk NS SOA RRSIG DNSKEY NSEC3PARAM
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.   3600    IN      RRSIG   NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jHrF+lnyRL1LE/Bwz6C+jZg3E/2qQkVSboGxya6iX71v0zA3eUsob9m9l3gHNlhwhyahbamHUKx+OMvtYuzRa+RMv4ObuLRIt8StdixeXaUU+rx7C2qCKOFsa5q4HzK4bLYPfyb5T9w67HbzHPLEllXPA7tghzyzCM9qBtbvwK4= ;{id = 57024}
+22bqk3tb4foaenfbp1v0pdk6mor3r7vo.example.com. NSEC3 1 1 0 - f2bqk3tb4foaenfbp1v0pdk6mor3r7vo NS RRSIG
+22bqk3tb4foaenfbp1v0pdk6mor3r7vo.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jk6EYU9qTrmNeeKuQRG7iKyfNJnBt45MToPVpAQ+LoGDC3muy4bkWeKspj68cN9E5wNijfmm1eFK3khSSEnM50mfJbpiwlbKgL0VZz33Zn+Wu8b7sTtdDwDH7MUBLRwHeb7W+NtQIEXPLs4Z3BXHzAXy5ZpSjQ3PJZn6zBx4/dw= ;{id = 57024}
+SECTION ADDITIONAL
+ENTRY_END
+
 SCENARIO_END
@@ -140,7 +140,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN ANY
 SECTION ANSWER
@@ -156,7 +156,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NXDOMAIN
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
@@ -141,7 +141,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NXDOMAIN
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
@@ -244,7 +244,6 @@ ENTRY_END

 RANGE_END

-
 ; first ask for +CD and get the data in the cache.
 STEP 1 QUERY
 ENTRY_BEGIN
@@ -266,7 +265,8 @@ example.com.	IN NS	ns.example.com.
 example.com.	IN NS	ns2.sub.example.com.
 SECTION ADDITIONAL
 ns.example.com.		IN 	A	1.2.3.4
-ns2.sub.example.com.	IN 	A 	100.200.30.40
+; already validated and thus stripped from the answer.
+;ns2.sub.example.com.	IN 	A 	100.200.30.40
 ENTRY_END

 ; now the data is in the cache, validate a referral from cache
@@ -89,6 +89,7 @@ config_create(void)
 	cfg->do_tcp = 1;
 	cfg->use_syslog = 1;
 	cfg->log_time_ascii = 0;
+	cfg->log_queries = 0;
 #ifndef USE_WINSOCK
 #  ifdef USE_MINI_EVENT
 	/* select max 1024 sockets */
@@ -177,6 +178,7 @@ config_create(void)
 	cfg->val_log_level = 0;
 	cfg->val_log_squelch = 0;
 	cfg->val_permissive_mode = 0;
+	cfg->ignore_cd = 0;
 	cfg->add_holddown = 30*24*3600;
 	cfg->del_holddown = 30*24*3600;
 	cfg->keep_missing = 366*24*3600; /* one year plus a little leeway */
@@ -189,7 +191,7 @@ config_create(void)
 	cfg->python_script = NULL;
 	cfg->remote_control_enable = 0;
 	cfg->control_ifs = NULL;
-	cfg->control_port = 953;
+	cfg->control_port = UNBOUND_CONTROL_PORT;
 	if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key"))) 
 		goto error_exit;
 	if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem"))) 
@@ -381,7 +383,9 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("val-clean-additional:", val_clean_additional)
 	else S_NUMBER_OR_ZERO("val-log-level:", val_log_level)
 	else S_YNO("val-log-squelch:", val_log_squelch)
+	else S_YNO("log-queries:", log_queries)
 	else S_YNO("val-permissive-mode:", val_permissive_mode)
+	else S_YNO("ignore-cd-flag:", ignore_cd)
 	else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
 	else S_UNSIGNED_OR_ZERO("add-holddown:", add_holddown)
 	else S_UNSIGNED_OR_ZERO("del-holddown:", del_holddown)
@@ -578,6 +582,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_STR(opt, "username", username)
 	else O_STR(opt, "directory", directory)
 	else O_STR(opt, "logfile", logfile)
+	else O_YNO(opt, "log-queries", log_queries)
 	else O_STR(opt, "pidfile", pidfile)
 	else O_YNO(opt, "hide-identity", hide_identity)
 	else O_YNO(opt, "hide-version", hide_version)
@@ -599,6 +604,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "val-clean-additional", val_clean_additional)
 	else O_DEC(opt, "val-log-level", val_log_level)
 	else O_YNO(opt, "val-permissive-mode", val_permissive_mode)
+	else O_YNO(opt, "ignore-cd-flag", ignore_cd)
 	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
 	else O_UNS(opt, "add-holddown", add_holddown)
 	else O_UNS(opt, "del-holddown", del_holddown)
@@ -192,6 +192,8 @@ struct config_file {
 	int use_syslog;
 	/** log timestamp in ascii UTC */
 	int log_time_ascii;
+	/** log queries with one line per query */
+	int log_queries;

 	/** do not report identity (id.server, hostname.bind) */
 	int hide_identity;
@@ -236,6 +238,8 @@ struct config_file {
 	int val_log_squelch;
 	/** should validator allow bogus messages to go through */
 	int val_permissive_mode;
+	/** ignore the CD flag in incoming queries and refuse them bogus data */
+	int ignore_cd;
 	/** nsec3 maximum iterations per key size, string */
 	char* val_nsec3_key_iterations;
 	/** autotrust add holddown time, in seconds */
@@ -204,6 +204,7 @@ val-sig-skew-max{COLON}		{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 val-bogus-ttl{COLON}		{ YDVAR(1, VAR_BOGUS_TTL) }
 val-clean-additional{COLON}	{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 val-permissive-mode{COLON}	{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+ignore-cd-flag{COLON}		{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
 val-log-level{COLON}		{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 key-cache-size{COLON}		{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 key-cache-slabs{COLON}		{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
@@ -215,6 +216,7 @@ del-holddown{COLON}		{ YDVAR(1, VAR_DEL_HOLDDOWN) }
 keep-missing{COLON}		{ YDVAR(1, VAR_KEEP_MISSING) }
 use-syslog{COLON}		{ YDVAR(1, VAR_USE_SYSLOG) }
 log-time-ascii{COLON}		{ YDVAR(1, VAR_LOG_TIME_ASCII) }
+log-queries{COLON}		{ YDVAR(1, VAR_LOG_QUERIES) }
 local-zone{COLON}		{ YDVAR(2, VAR_LOCAL_ZONE) }
 local-data{COLON}		{ YDVAR(1, VAR_LOCAL_DATA) }
 local-data-ptr{COLON}		{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
@@ -1,10 +1,9 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.4.3.  */

 /* Skeleton interface for Bison's Yacc-like parsers in C
   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
-   Free Software Foundation, Inc.
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
+   2009, 2010 Free Software Foundation, Inc.
   
   This program is free software: you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -154,7 +153,9 @@
     VAR_PREFETCH = 370,
     VAR_PREFETCH_KEY = 371,
     VAR_SO_SNDBUF = 372,
-     VAR_HARDEN_BELOW_NXDOMAIN = 373
+     VAR_HARDEN_BELOW_NXDOMAIN = 373,
+     VAR_IGNORE_CD_FLAG = 374,
+     VAR_LOG_QUERIES = 375
   };
 #endif
 /* Tokens.  */
@@ -274,6 +275,8 @@
 #define VAR_PREFETCH_KEY 371
 #define VAR_SO_SNDBUF 372
 #define VAR_HARDEN_BELOW_NXDOMAIN 373
+#define VAR_IGNORE_CD_FLAG 374
+#define VAR_LOG_QUERIES 375



@@ -282,15 +285,15 @@
 typedef union YYSTYPE
 {

-/* Line 1676 of yacc.c  */
+/* Line 1685 of yacc.c  */
 #line 64 "util/configparser.y"

 	char*	str;



-/* Line 1676 of yacc.c  */
-#line 294 "util/configparser.h"
+/* Line 1685 of yacc.c  */
+#line 297 "util/configparser.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -102,6 +102,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_AUTO_TRUST_ANCHOR_FILE VAR_KEEP_MISSING VAR_ADD_HOLDDOWN 
 %token VAR_DEL_HOLDDOWN VAR_SO_RCVBUF VAR_EDNS_BUFFER_SIZE VAR_PREFETCH
 %token VAR_PREFETCH_KEY VAR_SO_SNDBUF VAR_HARDEN_BELOW_NXDOMAIN
+%token VAR_IGNORE_CD_FLAG VAR_LOG_QUERIES

 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -155,7 +156,8 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_auto_trust_anchor_file | server_add_holddown | 
 	server_del_holddown | server_keep_missing | server_so_rcvbuf |
 	server_edns_buffer_size | server_prefetch | server_prefetch_key |
-	server_so_sndbuf | server_harden_below_nxdomain
+	server_so_sndbuf | server_harden_below_nxdomain | server_ignore_cd_flag |
+	server_log_queries
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -395,6 +397,15 @@ server_log_time_ascii: VAR_LOG_TIME_ASCII STRING_ARG
 		free($2);
 	}
 	;
+server_log_queries: VAR_LOG_QUERIES STRING_ARG
+	{
+		OUTYY(("P(server_log_queries:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->log_queries = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_chroot: VAR_CHROOT STRING_ARG
 	{
 		OUTYY(("P(server_chroot:%s)\n", $2));
@@ -918,6 +929,15 @@ server_val_permissive_mode: VAR_VAL_PERMISSIVE_MODE STRING_ARG
 		free($2);
 	}
 	;
+server_ignore_cd_flag: VAR_IGNORE_CD_FLAG STRING_ARG
+	{
+		OUTYY(("P(server_ignore_cd_flag:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->ignore_cd = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_val_log_level: VAR_VAL_LOG_LEVEL STRING_ARG
 	{
 		OUTYY(("P(server_val_log_level:%s)\n", $2));
@@ -1037,6 +1057,9 @@ server_local_data_ptr: VAR_LOCAL_DATA_PTR STRING_ARG
 stub_name: VAR_NAME STRING_ARG
 	{
 		OUTYY(("P(name:%s)\n", $2));
+		if(cfg_parser->cfg->stubs->name)
+			yyerror("stub name override, there must be one name "
+				"for one stub-zone");
 		free(cfg_parser->cfg->stubs->name);
 		cfg_parser->cfg->stubs->name = $2;
 	}
@@ -1068,6 +1091,9 @@ stub_prime: VAR_STUB_PRIME STRING_ARG
 forward_name: VAR_NAME STRING_ARG
 	{
 		OUTYY(("P(name:%s)\n", $2));
+		if(cfg_parser->cfg->forwards->name)
+			yyerror("forward name override, there must be one "
+				"name for one forward-zone");
 		free(cfg_parser->cfg->forwards->name);
 		cfg_parser->cfg->forwards->name = $2;
 	}
@@ -145,11 +145,13 @@ nsec_at_apex(ldns_buffer* pkt)

 /** Calculate rrset flags */
 static uint32_t
-pkt_rrset_flags(ldns_buffer* pkt, uint16_t type)
+pkt_rrset_flags(ldns_buffer* pkt, uint16_t type, ldns_pkt_section sec)
 {
 	uint32_t f = 0;
 	if(type == LDNS_RR_TYPE_NSEC && nsec_at_apex(pkt)) {
 		f |= PACKED_RRSET_NSEC_AT_APEX;
+	} else if(type == LDNS_RR_TYPE_SOA && sec == LDNS_SECTION_AUTHORITY) {
+		f |= PACKED_RRSET_SOA_NEG;
 	}
 	return f;
 }
@@ -482,7 +484,7 @@ find_rrset(struct msg_parse* msg, ldns_buffer* pkt, uint8_t* dname,
 		}
 	}
 	/* find by hashing and lookup in hashtable */
-	*rrset_flags = pkt_rrset_flags(pkt, type);
+	*rrset_flags = pkt_rrset_flags(pkt, type, section);
 	
 	/* if rrsig - try to lookup matching data set first */
 	if(type == LDNS_RR_TYPE_RRSIG && pkt_rrsig_covered(pkt, 
@@ -54,6 +54,10 @@ typedef uint64_t rrset_id_t;
 #define PACKED_RRSET_NSEC_AT_APEX 0x1
 /** this rrset is A/AAAA and is in-zone-glue (from parent side of zonecut) */
 #define PACKED_RRSET_PARENT_SIDE 0x2
+/** this rrset is SOA and has the negative ttl (from nxdomain or nodata),
+ * this is set on SOA rrsets in the authority section, to keep its TTL separate
+ * from the SOA in the answer section from a direct SOA query or ANY query. */
+#define PACKED_RRSET_SOA_NEG 0x4

 /**
 * The identifying information for an RRset.
@@ -73,6 +77,7 @@ struct packed_rrset_key {
 	 * Flags. 32bit to be easy for hashing:
 	 * 	o PACKED_RRSET_NSEC_AT_APEX
 	 * 	o PACKED_RRSET_PARENT_SIDE
+	 * 	o PACKED_RRSET_SOA_NEG
 	 */
 	uint32_t flags;
 	/** the rrset type in network format */
@@ -1908,7 +1908,6 @@
 2256,
 2257,
 2258,
-2259,
 2260,
 2261,
 2262,
@@ -3821,6 +3820,7 @@
 4358,
 4359,
 4361,
+4362,
 4368,
 4369,
 4370,
@@ -3987,6 +3987,9 @@
 4869,
 4870,
 4871,
+4876,
+4877,
+4878,
 4881,
 4882,
 4884,
@@ -4146,7 +4149,6 @@
 5313,
 5314,
 5315,
-5316,
 5343,
 5344,
 5350,
@@ -4263,6 +4265,7 @@
 5680,
 5681,
 5682,
+5683,
 5688,
 5689,
 5713,
@@ -4304,6 +4307,7 @@
 5784,
 5785,
 5786,
+5787,
 5793,
 5794,
 5813,
@@ -4332,13 +4336,14 @@
 6064,
 6065,
 6066,
-6068,
 6069,
 6070,
 6071,
 6072,
 6073,
 6074,
+6082,
+6083,
 6085,
 6086,
 6087,
@@ -4369,6 +4374,7 @@
 6147,
 6148,
 6149,
+6160,
 6161,
 6162,
 6163,
@@ -4462,6 +4468,8 @@
 6671,
 6672,
 6673,
+6678,
+6679,
 6689,
 6697,
 6701,
@@ -4488,6 +4496,7 @@
 6850,
 6868,
 6888,
+6935,
 6936,
 6946,
 6951,
@@ -4517,6 +4526,7 @@
 7013,
 7014,
 7015,
+7019,
 7020,
 7021,
 7022,
@@ -4530,6 +4540,7 @@
 7099,
 7100,
 7101,
+7107,
 7121,
 7128,
 7129,
@@ -4699,6 +4710,7 @@
 8131,
 8132,
 8148,
+8149,
 8160,
 8161,
 8182,
@@ -4745,6 +4757,7 @@
 8473,
 8474,
 8500,
+8501,
 8554,
 8555,
 8567,
@@ -4764,6 +4777,7 @@
 8770,
 8786,
 8787,
+8793,
 8800,
 8804,
 8873,
@@ -4877,6 +4891,7 @@
 9444,
 9450,
 9500,
+9522,
 9535,
 9536,
 9555,
@@ -5026,6 +5041,7 @@
 13218,
 13223,
 13224,
+13400,
 13720,
 13721,
 13722,
@@ -5054,6 +5070,7 @@
 14936,
 14937,
 15000,
+15118,
 15345,
 15363,
 15555,
@@ -271,7 +271,7 @@ log_nametypeclass(enum verbosity_value v, const char* str, uint8_t* name,
 		snprintf(c, sizeof(c), "CLASS%d", (int)dclass);
 		cs = c;
 	}
-	log_info("%s <%s %s %s>", str, buf, ts, cs);
+	log_info("%s %s %s %s", str, buf, ts, cs);
 }

 void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone, 
@@ -400,7 +400,10 @@ comm_point_send_udp_msg_if(struct comm_point *c, ldns_buffer* packet,
 #endif /* S_SPLINT_S */

 	log_assert(c->fd != -1);
-	log_assert(ldns_buffer_remaining(packet) > 0);
+#ifdef UNBOUND_DEBUG
+	if(ldns_buffer_remaining(packet) == 0)
+		log_err("error: send empty UDP packet");
+#endif
 	log_assert(addr && addrlen > 0);

 	msg.msg_name = addr;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Wouter Wijngaards	f03af3154d	1.4.12rc1 tag git-svn-id: file:///svn/unbound/tags/release-1.4.12rc1@2459 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-04 10:43:49 +00:00
Wouter Wijngaards	60e8c22040	- fix that --enable-static-exe does not complain about it unknown. git-svn-id: file:///svn/unbound/trunk@2458 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-01 08:58:34 +00:00
Wouter Wijngaards	a742415b5c	version number in example config file. git-svn-id: file:///svn/unbound/trunk@2457 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-01 07:12:08 +00:00
Wouter Wijngaards	7b5262ccd2	autoconf git-svn-id: file:///svn/unbound/trunk@2456 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:31:08 +00:00
Matthijs Mekking	c3da97fb35	suggested change git-svn-id: file:///svn/unbound/trunk@2455 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:26:58 +00:00
Wouter Wijngaards	844b5e71b1	nicer text git-svn-id: file:///svn/unbound/trunk@2454 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:22:06 +00:00
Wouter Wijngaards	172260232e	nicer text git-svn-id: file:///svn/unbound/trunk@2453 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:19:23 +00:00
Wouter Wijngaards	c155cfc8bc	fixup. git-svn-id: file:///svn/unbound/trunk@2452 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:15:41 +00:00
Wouter Wijngaards	447b6a1149	compile fix. git-svn-id: file:///svn/unbound/trunk@2451 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:14:42 +00:00
Wouter Wijngaards	7070c35e11	nicer error messages. git-svn-id: file:///svn/unbound/trunk@2450 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:13:48 +00:00
Wouter Wijngaards	dd03b668c5	fix neater. git-svn-id: file:///svn/unbound/trunk@2449 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:02:16 +00:00
Wouter Wijngaards	1dff4206d5	fix makedist for crosscompile to windows without ldns tarball builtin. git-svn-id: file:///svn/unbound/trunk@2448 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 13:24:10 +00:00
Wouter Wijngaards	bbe76430fe	- removed ldns-src tarball inside the unbound tarball. git-svn-id: file:///svn/unbound/trunk@2447 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 12:59:27 +00:00
Wouter Wijngaards	2c9bf883c9	- fix comment about rndc port, that referred to the old port number. - fix that the listening socket is not closed when too many remote control connections are made at the same time. git-svn-id: file:///svn/unbound/trunk@2446 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 12:13:55 +00:00
Wouter Wijngaards	59f5480df1	- fix replyaddr count wrong after jostled queries, which leads to eventual starvation where the daemon has no replyaddrs left to use. git-svn-id: file:///svn/unbound/trunk@2445 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 11:01:44 +00:00
Wouter Wijngaards	bc06ab0377	fix bug#395: id bits of other query may leak out under conditions git-svn-id: file:///svn/unbound/trunk@2444 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 09:42:20 +00:00
Wouter Wijngaards	668bcfc499	iana portlist updated git-svn-id: file:///svn/unbound/trunk@2443 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 09:10:53 +00:00
Wouter Wijngaards	9229c58c2f	1.4.12 in trunk and configure updated. git-svn-id: file:///svn/unbound/trunk@2442 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 08:56:56 +00:00
Wouter Wijngaards	c89323ef93	tag rc3 git-svn-id: file:///svn/unbound/trunk@2439 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-23 11:49:15 +00:00
Wouter Wijngaards	4f68378640	- Changed -flto check to support clang compiler. git-svn-id: file:///svn/unbound/trunk@2438 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-23 09:00:05 +00:00
Wouter Wijngaards	ff23baadcc	and new configure git-svn-id: file:///svn/unbound/trunk@2436 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-17 12:03:58 +00:00
Wouter Wijngaards	7c128d5013	changelog git-svn-id: file:///svn/unbound/trunk@2435 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-17 12:00:47 +00:00
Wouter Wijngaards	b279987e9f	updated autoconf files. git-svn-id: file:///svn/unbound/trunk@2434 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-17 11:52:45 +00:00
Wouter Wijngaards	8ecb52c532	Different flex version, no warning about signed and unsigned comparison. git-svn-id: file:///svn/unbound/trunk@2433 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-17 09:59:53 +00:00
Wouter Wijngaards	28912ed659	changelogentry git-svn-id: file:///svn/unbound/trunk@2432 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-17 09:43:22 +00:00
Wouter Wijngaards	f24f631838	tag 1.4.11rc1 git-svn-id: file:///svn/unbound/trunk@2431 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-17 09:42:37 +00:00
Wouter Wijngaards	42730aad99	- version is 1.4.11. git-svn-id: file:///svn/unbound/trunk@2430 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-16 13:27:57 +00:00
Wouter Wijngaards	8def9c1043	- log-queries: yesno option, default is no, prints querylog. git-svn-id: file:///svn/unbound/trunk@2429 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-16 13:15:57 +00:00
Wouter Wijngaards	ecf4deedbe	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@2428 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-14 09:01:45 +00:00
Wouter Wijngaards	139ab47dc6	- Use -flto compiler flag for link time optimization, if supported. git-svn-id: file:///svn/unbound/trunk@2427 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-14 08:39:53 +00:00
Wouter Wijngaards	608f82a1cd	IPv6 service address for d.root-servers.net (2001:500:2D::D) git-svn-id: file:///svn/unbound/trunk@2426 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-12 09:51:00 +00:00
Wouter Wijngaards	5cbf6d059b	- statistics-interval prints the number of jostled queries to log. git-svn-id: file:///svn/unbound/trunk@2425 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-10 10:41:40 +00:00
Wouter Wijngaards	a11fbf9ca0	- unbound-control has version number in the header, UBCT[version]_space_ is the header sent by the client now. - Unbound control port number is registered with IANA: ub-dns-control 8953/tcp unbound dns nameserver control This is the new default for the control-port config setting. git-svn-id: file:///svn/unbound/trunk@2424 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-10 10:11:38 +00:00
Wouter Wijngaards	30a339d1a8	updated ldns tarball. git-svn-id: file:///svn/unbound/trunk@2423 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-05-30 12:09:05 +00:00
Wouter Wijngaards	92e1ec3444	iana portlist updated git-svn-id: file:///svn/unbound/trunk@2422 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-05-30 12:04:31 +00:00
Wouter Wijngaards	62eea87455	- Fix Makefile for U in environment, since wrong U is more common than deansification necessity. git-svn-id: file:///svn/unbound/trunk@2421 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-05-30 11:52:14 +00:00
Wouter Wijngaards	30602d5d59	- defense in depth against the above bug, an error is printed to log instead of an assertion failure. git-svn-id: file:///svn/unbound/trunk@2420 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-05-25 11:32:05 +00:00
Wouter Wijngaards	b23ed42b55	1.4.10 tag created. git-svn-id: file:///svn/unbound/trunk@2419 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-05-25 06:09:01 +00:00
Wouter Wijngaards	784d659e91	- Fix TTL of SOA so negative TTL is separately cached from normal TTL. git-svn-id: file:///svn/unbound/trunk@2416 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-05-10 12:34:47 +00:00
Wouter Wijngaards	4df60a1343	iana portlist updated git-svn-id: file:///svn/unbound/trunk@2415 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-05-10 11:22:32 +00:00
Wouter Wijngaards	ca38a8bd55	- feature, ignore-cd-flag: yesno to provide dnssec to legacy servers. git-svn-id: file:///svn/unbound/trunk@2414 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-05-10 11:20:14 +00:00
Wouter Wijngaards	6e9d8fb22c	- bug#386: --enable-allsymbols option links all binaries to libunbound and reduces install size significantly. git-svn-id: file:///svn/unbound/trunk@2413 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-05-10 10:57:42 +00:00
Wouter Wijngaards	35140bb612	- configure created with newer autoconf 2.66. git-svn-id: file:///svn/unbound/trunk@2412 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-04-14 10:59:57 +00:00
Wouter Wijngaards	de82245d3e	- bug#378: Fix that configure checks for ldns_get_random presence. git-svn-id: file:///svn/unbound/trunk@2411 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-04-12 07:01:18 +00:00
Wouter Wijngaards	3922eed584	val-override-date: -1 ignores dates entirely, for NTP usage. git-svn-id: file:///svn/unbound/trunk@2410 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-04-08 14:06:46 +00:00
Wouter Wijngaards	efb9c02d54	- iana portlist updated. - queries with CD flag set cause DNSSEC validation, but the answer is not withheld if it is bogus. Thus, unbound will retry if it is bad and curb the TTL if it is bad, thus protecting the cache for use by downstream validators. git-svn-id: file:///svn/unbound/trunk@2409 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-04-08 13:58:41 +00:00
Wouter Wijngaards	04fa474ac3	fix test git-svn-id: file:///svn/unbound/trunk@2408 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-29 10:38:59 +00:00
Wouter Wijngaards	3c87eb6c49	- harden-below-nxdomain: changed so that it activates when the cached nxdomain is dnssec secure. This avoids backwards incompatibility because those old servers do not have dnssec. git-svn-id: file:///svn/unbound/trunk@2407 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-29 09:47:54 +00:00
Wouter Wijngaards	fcc7f9dae0	trunk to 1.5.0 git-svn-id: file:///svn/unbound/trunk@2406 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-24 10:35:17 +00:00
Wouter Wijngaards	654a9160f5	iana portlist updated. 1.4.9 release. git-svn-id: file:///svn/unbound/trunk@2404 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-24 10:08:43 +00:00
Wouter Wijngaards	682ad09bc4	-#370 new unbound.spec for CentOS 5.x from Harold Jones. git-svn-id: file:///svn/unbound/trunk@2403 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-17 08:18:00 +00:00
Wouter Wijngaards	ffb54322cb	tag 1.4.9rc1 created. svn:NO TEST git-svn-id: file:///svn/unbound/trunk@2402 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-14 09:38:42 +00:00
Wouter Wijngaards	cc763c103b	updated ldns tarball to 1.6.9rc1. git-svn-id: file:///svn/unbound/trunk@2400 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-03 08:57:17 +00:00
Wouter Wijngaards	9053ee101d	updated ldns tarball to 1.6.9. git-svn-id: file:///svn/unbound/trunk@2399 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-01 13:06:38 +00:00
Wouter Wijngaards	0b0a580422	- give config parse error for multiple names on a stub or forward zone. git-svn-id: file:///svn/unbound/trunk@2398 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-01 12:59:27 +00:00
Wouter Wijngaards	b4a089ff0d	- Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout. git-svn-id: file:///svn/unbound/trunk@2397 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-03-01 12:48:45 +00:00
Wouter Wijngaards	ee6f5c5b51	- bug #361 : Fix, time.elapsed variable not reset with stats_noreset. git-svn-id: file:///svn/unbound/trunk@2396 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-24 12:16:12 +00:00
Wouter Wijngaards	c2299a3c5f	version 3 for common.sh git-svn-id: file:///svn/unbound/trunk@2395 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-23 15:17:49 +00:00
Wouter Wijngaards	255d669e58	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@2394 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-23 10:27:53 +00:00
Wouter Wijngaards	c07e17fda3	Compat with tpkg timing code. git-svn-id: file:///svn/unbound/trunk@2393 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-23 09:56:13 +00:00
Wouter Wijngaards	d8928e1b19	common.sh to version 2. git-svn-id: file:///svn/unbound/trunk@2392 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-18 16:11:21 +00:00
Wouter Wijngaards	01dd4a3568	- Added explicit note on unbound-anchor usage: Please note usage of unbound-anchor root anchor is at your own risk and under the terms of our LICENSE (see that file in the source). git-svn-id: file:///svn/unbound/trunk@2391 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-15 12:58:37 +00:00
Wouter Wijngaards	1550bc65f3	use common functionality file. git-svn-id: file:///svn/unbound/trunk@2390 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-11 12:30:42 +00:00
Wouter Wijngaards	4011c3861b	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@2389 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-11 12:28:30 +00:00
Wouter Wijngaards	58c2cc2740	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@2388 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-07 13:24:50 +00:00
Wouter Wijngaards	87296966ae	- Added regression test for addition of a .net DS to the root, and cache effects with different TTL for glue and DNSKEY. git-svn-id: file:///svn/unbound/trunk@2387 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-02-07 12:07:46 +00:00
Wouter Wijngaards	eed924d7be	- Fix remove private address does not throw away entire response. git-svn-id: file:///svn/unbound/trunk@2386 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-01-28 16:11:49 +00:00
Wouter Wijngaards	36d5a75848	Version bump. git-svn-id: file:///svn/unbound/trunk@2385 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-01-24 14:59:33 +00:00
Wouter Wijngaards	5996f3b2a9	Note release point. git-svn-id: file:///svn/unbound/trunk@2383 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-01-21 08:53:14 +00:00
Wouter Wijngaards	5e2a137562	fix bug 349 git-svn-id: file:///svn/unbound/trunk@2381 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-01-19 06:59:24 +00:00
Wouter Wijngaards	5a154aeb78	ldns tarball updated git-svn-id: file:///svn/unbound/trunk@2380 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-01-18 08:35:20 +00:00