-#370 new unbound.spec for CentOS 5.x from Harold Jones.

git-svn-id: file:///svn/unbound/trunk@2403 be551aaa-1e26-0410-a405-d3ace91eadb9

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.65 for unbound 1.4.8.
+# Generated by GNU Autoconf 2.65 for unbound 1.4.9.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -701,8 +701,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.4.8'
-PACKAGE_STRING='unbound 1.4.8'
+PACKAGE_VERSION='1.4.9'
+PACKAGE_STRING='unbound 1.4.9'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''
 
@@ -1458,7 +1458,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.4.8 to adapt to many kinds of systems.
+\`configure' configures unbound 1.4.9 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1524,7 +1524,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.4.8:";;
+     short | recursive ) echo "Configuration of unbound 1.4.9:";;
    esac
   cat <<\_ACEOF
 
@@ -1684,7 +1684,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.4.8
+unbound configure 1.4.9
 generated by GNU Autoconf 2.65
 
 Copyright (C) 2009 Free Software Foundation, Inc.
@@ -2148,7 +2148,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.4.8, which was
+It was created by unbound $as_me 1.4.9, which was
 generated by GNU Autoconf 2.65.  Invocation command line was
 
   $ $0 $@
@@ -2497,7 +2497,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=8
+LIBUNBOUND_REVISION=9
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2521,6 +2521,7 @@ LIBUNBOUND_AGE=0
 # 1.4.6 had 2:6:0
 # 1.4.7 had 2:7:0
 # 1.4.8 had 2:8:0
+# 1.4.9 had 2:9:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -6813,13 +6814,13 @@ if test "${lt_cv_nm_interface+set}" = set; then :
 else
   lt_cv_nm_interface="BSD nm"
   echo "int some_variable = 0;" > conftest.$ac_ext
-  (eval echo "\"\$as_me:6816: $ac_compile\"" >&5)
+  (eval echo "\"\$as_me:6817: $ac_compile\"" >&5)
   (eval "$ac_compile" 2>conftest.err)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:6819: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
+  (eval echo "\"\$as_me:6820: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
   (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:6822: output\"" >&5)
+  (eval echo "\"\$as_me:6823: output\"" >&5)
   cat conftest.out >&5
   if $GREP 'External.*some_variable' conftest.out > /dev/null; then
     lt_cv_nm_interface="MS dumpbin"
@@ -8024,7 +8025,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 8027 "configure"' > conftest.$ac_ext
+  echo '#line 8028 "configure"' > conftest.$ac_ext
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -9284,11 +9285,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9287: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9288: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:9291: \$? = $ac_status" >&5
+   echo "$as_me:9292: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -9623,11 +9624,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9626: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9627: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:9630: \$? = $ac_status" >&5
+   echo "$as_me:9631: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -9728,11 +9729,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9731: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9732: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:9735: \$? = $ac_status" >&5
+   echo "$as_me:9736: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -9783,11 +9784,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9786: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9787: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:9790: \$? = $ac_status" >&5
+   echo "$as_me:9791: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -12153,7 +12154,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12156 "configure"
+#line 12157 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -12249,7 +12250,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12252 "configure"
+#line 12253 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -16490,9 +16491,9 @@ use_ldns_builtin="no"
 if test "${with_ldns+set}" = set; then :
   withval=$with_ldns;  specialldnsdir="$withval"
 	if test "$withval" != "yes"; then
-		if test "$withval" != ""; then
+		if test "$withval" != "/usr" -a "$withval" != ""; then
 			CPPFLAGS="-I$withval/include $CPPFLAGS"
-			LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
+			LDFLAGS="-L$withval/lib $LDFLAGS"
 
 	if test "x$enable_rpath" = xyes; then
 		if echo "$withval/lib" | grep "^/" >/dev/null; then
@@ -17247,7 +17248,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.4.8, which was
+This file was extended by unbound $as_me 1.4.9, which was
 generated by GNU Autoconf 2.65.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -17313,7 +17314,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.4.8
+unbound config.status 1.4.9
 configured by $0, generated by GNU Autoconf 2.65,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 
-AC_INIT(unbound, 1.4.8, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.9, unbound-bugs@nlnetlabs.nl, unbound)
 
 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=8
+LIBUNBOUND_REVISION=9
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -33,6 +33,7 @@ LIBUNBOUND_AGE=0
 # 1.4.6 had 2:6:0
 # 1.4.7 had 2:7:0
 # 1.4.8 had 2:8:0
+# 1.4.9 had 2:9:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -700,9 +701,9 @@ AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH],
 	[specify prefix of path of ldns library to use]), 
 	[ specialldnsdir="$withval"
 	if test "$withval" != "yes"; then
-		if test "$withval" != ""; then
+		if test "$withval" != "/usr" -a "$withval" != ""; then
 			CPPFLAGS="-I$withval/include $CPPFLAGS"
-			LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
+			LDFLAGS="-L$withval/lib $LDFLAGS"
 			ACX_RUNTIME_PATH_ADD([$withval/lib])
 		fi
 		ldnsdir="$withval"

contrib/unbound.spec

@@ -1,6 +1,6 @@
 Summary: Validating, recursive, and caching DNS resolver
 Name: unbound
-Version: 1.4.4
+Version: 1.4.8
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -8,7 +8,7 @@ Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 #Source1: unbound.init
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel
+BuildRequires: flex, openssl-devel, expat-devel
 
 %description
 Unbound is a validating, recursive, and caching DNS resolver.
@@ -32,7 +32,7 @@ The source code is under a BSD License.
 # This is a build using libldns builtin version, the resulting binaries
 # do not require libldns and this package does not have version dependencies.
 # Could be smaller using a dependency on libldns (use --with-ldns=).
-%configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath
+%configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath --with-ldns-builtin
 
 %build
 #%{__make} %{?_smp_mflags}
@@ -92,6 +92,15 @@ if [ "$1" -ge "1" ]; then
 fi
 
 %changelog
+* Thu Mar 17 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
+- removed --disable-gost, assume recent openssl on the destination platform.
+
+* Wed Mar 16 2011 Harold Jones <hajones@verisign.com> - 1.4.8
+- Bump version number to latest
+- Add expat-devel to BuildRequires
+- Added --disable-gost for building on CentOS 5.x
+- Added --with-ldns-builtin for CentOS 5.x
+
 * Thu May 22 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.0.0
 - contrib changes from Patrick Vande Walle.
 

daemon/remote.c

@@ -702,13 +702,14 @@ print_mem(SSL* ssl, struct worker* worker, struct daemon* daemon)
 
 /** print uptime stats */
 static int
-print_uptime(SSL* ssl, struct worker* worker)
+print_uptime(SSL* ssl, struct worker* worker, int reset)
 {
 	struct timeval now = *worker->env.now_tv;
 	struct timeval up, dt;
 	timeval_subtract(&up, &now, &worker->daemon->time_boot);
 	timeval_subtract(&dt, &now, &worker->daemon->time_last_stat);
-	worker->daemon->time_last_stat = now;
+	if(reset)
+		worker->daemon->time_last_stat = now;
 	if(!ssl_printf(ssl, "time.now"SQ"%d.%6.6d\n", 
 		(unsigned)now.tv_sec, (unsigned)now.tv_usec)) return 0;
 	if(!ssl_printf(ssl, "time.up"SQ"%d.%6.6d\n", 
@@ -892,7 +893,7 @@ do_stats(SSL* ssl, struct daemon_remote* rc, int reset)
 	total.mesh_time_median /= (double)daemon->num;
 	if(!print_stats(ssl, "total", &total)) 
 		return;
-	if(!print_uptime(ssl, rc->worker))
+	if(!print_uptime(ssl, rc->worker, reset))
 		return;
 	if(daemon->cfg->stat_extended) {
 		if(!print_mem(ssl, rc->worker, daemon)) 

doc/Changelog

@@ -1,3 +1,55 @@
+17 March 2011: Wouter
+	- bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
+	  Applied but did not do the --disable-gost.
+
+10 March 2011: Wouter
+	- tag 1.4.9 release candidate 1 created.
+
+3 March 2011: Wouter
+	- updated ldns to today.
+
+1 March 2011: Wouter
+	- Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
+	- give config parse error for multiple names on a stub or forward zone.
+	- updated ldns tarball to 1.6.9(todays snapshot).
+
+24 February 2011: Wouter
+	- bug #361: Fix, time.elapsed variable not reset with stats_noreset.
+
+23 February 2011: Wouter
+	- iana portlist updated.
+	- common.sh to version 3.
+
+18 February 2011: Wouter
+	- common.sh in testdata updated to version 2.
+
+15 February 2011: Wouter
+	- Added explicit note on unbound-anchor usage:
+	  Please note usage of unbound-anchor root anchor is at your own risk
+	  and under the terms of our LICENSE (see that file in the source).
+
+11 February 2011: Wouter
+	- iana portlist updated.
+	- tpkg updated with common.sh for common functionality.
+
+7 February 2011: Wouter
+	- Added regression test for addition of a .net DS to the root, and
+	  cache effects with different TTL for glue and DNSKEY.
+	- iana portlist updated.
+
+28 January 2011: Wouter
+	- Fix remove private address does not throw away entire response.
+
+24 January 2011: Wouter
+	- release 1.4.8
+
+19 January 2011: Wouter
+	- fix bug#349: no -L/usr for ldns.
+
+18 January 2011: Wouter
+	- ldns 1.6.8 tarball included.
+	- release 1.4.8rc1.
+
 17 January 2011: Wouter
 	- add get and set option for harden-below-nxdomain feature.
 	- iana portlist updated.

doc/example.conf.in

@@ -319,6 +319,8 @@ server:
 	#
 	# If you want to perform DNSSEC validation, run unbound-anchor before
 	# you start unbound (i.e. in the system boot scripts).  And enable:
+	# Please note usage of unbound-anchor root anchor is at your own risk
+	# and under the terms of our LICENSE (see that file in the source).
 	# auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
 
 	# File with DLV trusted keys. Same format as trust-anchor-file.

doc/unbound-anchor.8.in

@@ -26,6 +26,9 @@ Suggested usage:
 	# in the init scripts.
 	# provide or update the root anchor (if necessary)
 	unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
+	# Please note usage of this root anchor is at your own risk
+	# and under the terms of our LICENSE (see source).
+	#
 	# start validating resolver
 	# the unbound.conf contains:
 	#   auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"

iterator/iter_scrub.c

@@ -643,9 +643,9 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 		if( (rrset->type == LDNS_RR_TYPE_A || 
 			rrset->type == LDNS_RR_TYPE_AAAA) &&
 			priv_rrset_bad(ie->priv, pkt, rrset)) {
-			/* set servfail, so the classification becomes
-			 * THROWAWAY, instead of LAME or other unwanted */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_SERVFAIL);
+
+			/* do not set servfail since this leads to too
+			 * many drops of other people using rfc1918 space */
 			remove_rrset("sanitize: removing public name with "
 				"private address", pkt, msg, prev, &rrset);
 			continue;

testcode/do-tests.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
+. testdata/common.sh
 
 NEED_SPLINT='00-lint.tpkg'
 NEED_DOXYGEN='01-doc.tpkg'
-NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg fwd_oneport.tpkg fwd_udptmout.tpkg fwd_waitudp.tpkg tcp_sigpipe.tpkg hostsfileosx.tpkg local_nodefault.tpkg fwd_zero.tpkg'
 NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_CURL='06-ianaports.tpkg root_anchor.tpkg'
@@ -11,8 +11,8 @@ NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg edns_cache.tpkg'
 NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
 
 # test if dig and ldns-testns are available.
-if test ! -x "`which dig 2>&1`"; then echo No 'dig' in path; exit 1; fi
-if test ! -x "`which ldns-testns 2>&1`"; then echo No 'ldns-testns' in path; exit 1; fi
+test_tool_avail "dig"
+test_tool_avail "ldns-testns"
 
 # test for ipv6, uses streamptcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
@@ -33,41 +33,13 @@ sh ../testcode/mini_tpkg.sh clean
 rm -f .perfstats.txt
 for test in `ls *.tpkg`; do
 	SKIP=0
-	if echo $NEED_SPLINT | grep $test >/dev/null; then
-		if test ! -x "`which splint`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_DOXYGEN | grep $test >/dev/null; then
-		if test ! -x "`which doxygen`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_CURL | grep $test >/dev/null; then
-		if test ! -x "`which curl`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_LDNS_TESTNS | grep $test >/dev/null; then
-		if test ! -x "`which ldns-testns`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_XXD | grep $test >/dev/null; then
-		if test ! -x "`which xxd`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_NC | grep $test >/dev/null; then
-		if test ! -x "`which nc`"; then
-			SKIP=1;
-		fi
-	fi
-	if echo $NEED_WHOAMI | grep $test >/dev/null; then
-		if test ! -x "`which whoami`"; then
-			SKIP=1;
-		fi
-	fi
+	skip_if_in_list $test "$NEED_SPLINT" "splint"
+	skip_if_in_list $test "$NEED_DOXYGEN" "doxygen"
+	skip_if_in_list $test "$NEED_CURL" "curl"
+	skip_if_in_list $test "$NEED_XXD" "xxd"
+	skip_if_in_list $test "$NEED_NC" "nc"
+	skip_if_in_list $test "$NEED_WHOAMI" "whoami"
+
 	if echo $NEED_IPV6 | grep $test >/dev/null; then
 		if test "$HAVE_IPV6" = no; then
 			SKIP=1;

testcode/mini_tpkg.sh

@@ -81,6 +81,8 @@ mv $name.dir/* .
 
 # EXE
 echo "minitpkg exe $name" > $result
+grep "Description:" $name.dsc >> $result 2>&1
+echo "DateRunStart: "`date "+%s" 2>/dev/null` >> $result
 if test -f $name.pre; then
 	echo "minitpkg exe $name.pre"
 	echo "minitpkg exe $name.pre" >> $result
@@ -112,6 +114,7 @@ if test -f $name.post; then
 		echo "Warning: $name.post did not exit successfully"
 	fi
 fi
+echo "DateRunEnd: "`date "+%s" 2>/dev/null` >> $result
 
 mv $result ..
 cd ..

testdata/common.sh

@@ -0,0 +1,256 @@
+# common.sh - an include file for commonly used functions for test code.
+# BSD licensed (see LICENSE file).
+#
+# Version 3
+# 2011-02-23: get_pcat for PCAT, PCAT_DIFF and PCAT_PRINT defines.
+# 2011-02-18: ports check on BSD,Solaris. wait_nsd_up.
+# 2011-02-11: first version.
+#
+# include this file from a tpkg script with
+#   . ../common.sh
+#
+# overview of functions available:
+# error x		: print error and exit
+# info x		: print info
+# test_tool_avail x	: see if program in path and complain, exit if not.
+# get_ldns_testns	: set LDNS_TESTNS to executable ldns-testns
+# get_make		: set MAKE to gmake or make tool.
+# get_gcc		: set cc or gcc in CC
+# get_pcat		: set PCAT, PCAT_DIFF and PCAT_PRINT executables.
+# set_doxygen_path	: set doxygen path
+# skip_if_in_list	: set SKIP=1 if name in list and tool not available.
+# get_random_port x	: get RND_PORT a sequence of free random port numbers.
+# wait_server_up	: wait on logfile to see when server comes up.
+# wait_ldns_testns_up   : wait for ldns-testns to come up.
+# wait_unbound_up	: wait for unbound to come up.
+# wait_petal_up		: wait for petal to come up.
+# wait_nsd_up		: wait for nsd to come up.
+# wait_server_up_or_fail: wait for server to come up or print a failure string
+# kill_pid		: kill a server, make sure and wait for it to go down.
+
+
+# print error and exit
+# $0: name of program
+# $1: error to printout.
+error () {
+	echo "$0: error: $1" >&2
+	exit 1
+}
+
+# print info
+# $0: name of program
+# $1: to printout.
+info () {
+	echo "$0: info: $1"
+}
+
+# test if 'tool' is available in path and complain otherwise.
+# $1: tool
+test_tool_avail () {
+	if test ! -x "`which $1 2>&1`"; then
+		echo No "$1" in path
+		exit 1
+	fi
+}
+
+# get ldns-testns tool in LDNS_TESTNS variable.
+get_ldns_testns () {
+	if test -x "`which ldns-testns 2>&1`"; then
+		LDNS_TESTNS=ldns-testns
+	else
+		LDNS_TESTNS=/home/wouter/bin/ldns-testns
+	fi
+}
+
+# get make tool in MAKE variable, gmake is used if present.
+get_make () {
+	if test -x "`which gmake 2>&1`"; then
+		MAKE=gmake
+	else
+		MAKE=make
+	fi
+}
+
+# get cc tool in CC variable, gcc is used if present.
+get_gcc () {
+	if test -x "`which gcc 2>&1`"; then
+		CC=gcc
+	else
+		CC=cc
+	fi
+}
+
+# get pcat, pcat-print and pcat-diff
+get_pcat () {
+	PCAT=`which pcat`
+	PCAT_PRINT=`which pcat-print`
+	PCAT_DIFF=`which pcat-diff`
+}
+
+# set SKIP=1 if the name is in list and tool is not available.
+# $1: name of package to check.
+# $2: list of packages that need the tool.
+# #3: name of the tool required.
+skip_if_in_list () {
+	if echo $2 | grep $1 >/dev/null; then
+		if test ! -x "`which $3 2>&1`"; then
+			SKIP=1;
+		fi
+	fi
+}
+
+# function to get a number of random port numbers.
+# $1: number of random ports.
+# RND_PORT is returned as the starting port number
+get_random_port () {
+	local plist
+	local cont
+	local collisions
+	local i
+	local MAXCOLLISION=1000
+	cont=1
+	collisions=0
+	while test "$cont" = 1; do
+		#netstat -n -A ip -A ip6 -a | sed -e "s/^.*:\([0-9]*\) .*$/\1/"
+		RND_PORT=$(( $RANDOM + 5354 ))
+		# depending on uname try to check for collisions in port numbers
+		case "`uname`" in
+		linux|Linux)
+			plist=`netstat -n -A ip -A ip6 -a | sed -e 's/^.*:\([0-9]*\) .*$/\1/'`
+		;;
+		FreeBSD|freebsd|NetBSD|netbsd|OpenBSD|openbsd)
+			plist=`netstat -n -a | grep "^[ut][dc]p[46] " | sed -e 's/^.*\.\([0-9]*\) .*$/\1/'`
+		;;
+		Solaris|SunOS)
+			plist=`netstat -n -a | sed -e 's/^.*\.\([0-9]*\) .*$/\1/' | grep '^[0-9]*$'`
+		;;
+		*)
+			plist=""
+		;;
+		esac
+		cont=0
+		for (( i=0 ; i < $1 ; i++ )); do
+			if echo "$plist" | grep '^'`expr $i + $RND_PORT`'$' >/dev/null 2>&1; then
+				cont=1;
+				collisions=`expr $collisions + 1`
+			fi
+		done
+		if test $collisions = $MAXCOLLISION; then
+			error "too many collisions getting random port number"
+		fi
+	done
+}
+
+# wait for server to go up, pass <logfilename> <string to watch>
+# $1 : logfilename
+# $2 : string to watch for.
+# exits with failure if it does not come up
+wait_server_up () {
+	local MAX_UP_TRY=120
+	local WAIT_THRES=30
+	local try
+	for (( try=0 ; try <= $MAX_UP_TRY ; try++ )) ; do
+		if test -f $1 && fgrep "$2" $1 >/dev/null; then
+			#echo "done on try $try"
+			break;
+		fi
+		if test $try -eq $MAX_UP_TRY; then
+			echo "Server in $1 did not go up!"
+			cat $1
+			exit 1;
+		fi
+		if test $try -ge $WAIT_THRES; then
+			sleep 1
+		fi
+	done
+}
+
+# wait for ldns-testns to come up
+# $1 : logfilename that is watched.
+wait_ldns_testns_up () {
+	wait_server_up "$1" "Listening on port"
+}
+
+# wait for unbound to come up
+# string 'Start of service' in log.
+# $1 : logfilename that is watched.
+wait_unbound_up () {
+	wait_server_up "$1" "start of service"
+}
+
+# wait for petal to come up
+# string 'petal start' in log.
+# $1 : logfilename that is watched.
+wait_petal_up () {
+	wait_server_up "$1" "petal start"
+}
+
+# wait for nsd to come up
+# string nsd start in log.
+# $1 : logfilename that is watched.
+wait_nsd_up () {
+	wait_server_up "$1" " started (NSD "
+}
+
+# wait for server to go up, pass <logfilename> <string to watch> <badstr>
+# $1 : logfile
+# $2 : success string
+# $3 : failure string
+wait_server_up_or_fail () {
+	local MAX_UP_TRY=120
+	local WAIT_THRES=30
+	local try
+	for (( try=0 ; try <= $MAX_UP_TRY ; try++ )) ; do
+		if test -f $1 && fgrep "$2" $1 >/dev/null; then
+			echo "done on try $try"
+			break;
+		fi
+		if test -f $1 && fgrep "$3" $1 >/dev/null; then
+			echo "failed on try $try"
+			break;
+		fi
+		if test $try -eq $MAX_UP_TRY; then
+			echo "Server in $1 did not go up!"
+			cat $1
+			exit 1;
+		fi
+		if test $try -ge $WAIT_THRES; then
+			sleep 1
+		fi
+	done
+}
+
+# kill a pid, make sure and wait for it to go down.
+# $1 : pid to kill
+kill_pid () {
+	local MAX_DOWN_TRY=120
+	local WAIT_THRES=30
+	local try
+	kill $1
+	for (( try=0 ; try <= $MAX_DOWN_TRY ; try++ )) ; do
+		if kill -0 $1 >/dev/null 2>&1; then
+			:
+		else
+			#echo "done on try $try"
+			break;
+		fi
+		if test $try -eq $MAX_DOWN_TRY; then
+			echo "Server in $1 did not go down! Send SIGKILL"
+			kill -9 $1 >/dev/null 2>&1
+		fi
+		if test $try -ge $WAIT_THRES; then
+			sleep 1
+		fi
+		# re-send the signal
+		kill $1 >/dev/null 2>&1
+	done
+	return 0
+}
+
+# set doxygen path, so that make doc can find doxygen
+set_doxygen_path () {
+	if test -x '/home/wouter/bin/doxygen'; then
+	        export PATH="/home/wouter/bin:$PATH"
+	fi
+}
+

testdata/val_nsec3_b1_nameerror.rpl

@@ -112,7 +112,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NXDOMAIN
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION ANSWER

testdata/val_nsec3_b1_nameerror_nowc.rpl

@@ -136,6 +136,12 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION ANSWER
 SECTION AUTHORITY
+; example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
+; example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+; 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
+; 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
+; b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
+; b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
 SECTION ADDITIONAL
 ENTRY_END
 

testdata/val_nsec3_b4_wild.rpl

@@ -130,7 +130,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA NOERROR
 SECTION QUESTION
 a.z.w.example. IN MX
 SECTION ANSWER

testdata/val_nsec3_cname_ds.rpl

@@ -194,7 +194,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.sub.example.com. IN DS
 SECTION ANSWER

testdata/val_nsec3_cname_par.rpl

@@ -195,7 +195,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER

testdata/val_nsec3_cname_sub.rpl

@@ -201,7 +201,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NXDOMAIN
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER

testdata/val_nsec3_optout_ad.rpl

@@ -149,6 +149,29 @@ onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070
 jg19n32806c832kijdnglq8p9m2r5mdj.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. f7ZSCahAuKOLXquM0jpdU6I9AX31CgGicRiB3aU4jvqQp/EygbCNn5kfpyXY0FvZvzggpl8naXSStOPN9dy3bb0NwGQkJcYD94NEw307T8uEunOvx1ug5TuakBAwqjY8xKM3xab3LnWYRtx4zdln/3ZDHvBUwfzkxUZrzeKjpiI= ;{id = 57024}
 SECTION ADDITIONAL
 ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NXDOMAIN
+SECTION QUESTION
+rub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.	3600	IN	RRSIG	SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+
+; optout
+; example.com. -> onib9mgub9h0rml3cdf5bgrj59dkjhvk.
+; rub.example.com. -> c2bqk3tb4foaenfbp1v0pdk6mor3r7vo.
+; *.example.com. -> 4f3cnt8cu22tngec382jj4gde4rb47ub.
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com. NSEC3 1 1 0 - pnib9mgub9h0rml3cdf5bgrj59dkjhvk NS SOA RRSIG DNSKEY NSEC3PARAM
+22bqk3tb4foaenfbp1v0pdk6mor3r7vo.example.com. NSEC3 1 1 0 - f2bqk3tb4foaenfbp1v0pdk6mor3r7vo NS RRSIG
+
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jHrF+lnyRL1LE/Bwz6C+jZg3E/2qQkVSboGxya6iX71v0zA3eUsob9m9l3gHNlhwhyahbamHUKx+OMvtYuzRa+RMv4ObuLRIt8StdixeXaUU+rx7C2qCKOFsa5q4HzK4bLYPfyb5T9w67HbzHPLEllXPA7tghzyzCM9qBtbvwK4= ;{id = 57024}
+22bqk3tb4foaenfbp1v0pdk6mor3r7vo.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jk6EYU9qTrmNeeKuQRG7iKyfNJnBt45MToPVpAQ+LoGDC3muy4bkWeKspj68cN9E5wNijfmm1eFK3khSSEnM50mfJbpiwlbKgL0VZz33Zn+Wu8b7sTtdDwDH7MUBLRwHeb7W+NtQIEXPLs4Z3BXHzAXy5ZpSjQ3PJZn6zBx4/dw= ;{id = 57024}
+SECTION ADDITIONAL
+ENTRY_END
 RANGE_END
 
 STEP 1 QUERY
@@ -204,4 +227,31 @@ jg19n32806c832kijdnglq8p9m2r5mdj.example.com.   3600    IN      RRSIG   NSEC3 7
 SECTION ADDITIONAL
 ENTRY_END
 
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+rub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+; no AD flag here because of RFC5155 9.2 section.
+; also for NXDOMAIN
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+rub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.    3600    IN      RRSIG   SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com. NSEC3 1 1 0 - pnib9mgub9h0rml3cdf5bgrj59dkjhvk NS SOA RRSIG DNSKEY NSEC3PARAM
+onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.   3600    IN      RRSIG   NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jHrF+lnyRL1LE/Bwz6C+jZg3E/2qQkVSboGxya6iX71v0zA3eUsob9m9l3gHNlhwhyahbamHUKx+OMvtYuzRa+RMv4ObuLRIt8StdixeXaUU+rx7C2qCKOFsa5q4HzK4bLYPfyb5T9w67HbzHPLEllXPA7tghzyzCM9qBtbvwK4= ;{id = 57024}
+22bqk3tb4foaenfbp1v0pdk6mor3r7vo.example.com. NSEC3 1 1 0 - f2bqk3tb4foaenfbp1v0pdk6mor3r7vo NS RRSIG
+22bqk3tb4foaenfbp1v0pdk6mor3r7vo.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jk6EYU9qTrmNeeKuQRG7iKyfNJnBt45MToPVpAQ+LoGDC3muy4bkWeKspj68cN9E5wNijfmm1eFK3khSSEnM50mfJbpiwlbKgL0VZz33Zn+Wu8b7sTtdDwDH7MUBLRwHeb7W+NtQIEXPLs4Z3BXHzAXy5ZpSjQ3PJZn6zBx4/dw= ;{id = 57024}
+SECTION ADDITIONAL
+ENTRY_END
+
 SCENARIO_END

testdata/val_nsec3_wcany.rpl

@@ -140,7 +140,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN ANY
 SECTION ANSWER

testdata/val_nx_nsec3_collision.rpl

@@ -156,7 +156,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NXDOMAIN
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER

testdata/val_nx_nsec3_params.rpl

@@ -141,7 +141,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NXDOMAIN
+REPLY QR RD RA NXDOMAIN
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER

util/configlexer.c

@@ -1610,7 +1610,7 @@ static int input (void );
 /* This used to be an fputs(), but since the string might contain NUL's,
  * we now use fwrite().
  */
-#define ECHO fwrite( yytext, yyleng, 1, yyout )
+#define ECHO do { if (fwrite( yytext, yyleng, 1, yyout )) {} } while (0)
 #endif
 
 /* Gets input and stuffs it into "buf".  number of characters read, or YY_NULL,
@@ -1621,7 +1621,7 @@ static int input (void );
 	if ( YY_CURRENT_BUFFER_LVALUE->yy_is_interactive ) \
 		{ \
 		int c = '*'; \
-		int n; \
+		unsigned n; \
 		for ( n = 0; n < max_size && \
 			     (c = getc( yyin )) != EOF && c != '\n'; ++n ) \
 			buf[n] = (char) c; \

util/configparser.c

@@ -780,10 +780,10 @@ static const yytype_uint16 yyrline[] =
      701,   711,   721,   731,   741,   751,   758,   765,   774,   783,
      792,   799,   809,   823,   830,   848,   861,   874,   883,   892,
      901,   911,   921,   930,   937,   946,   955,   964,   972,   985,
-     993,  1015,  1022,  1037,  1044,  1051,  1058,  1068,  1075,  1082,
-    1089,  1094,  1095,  1096,  1096,  1096,  1097,  1097,  1097,  1098,
-    1100,  1110,  1119,  1126,  1133,  1140,  1147,  1154,  1159,  1160,
-    1161,  1163
+     993,  1015,  1022,  1037,  1047,  1054,  1061,  1071,  1081,  1088,
+    1095,  1100,  1101,  1102,  1102,  1102,  1103,  1103,  1103,  1104,
+    1106,  1116,  1125,  1132,  1139,  1146,  1153,  1160,  1165,  1166,
+    1167,  1169
 };
 #endif
 
@@ -3228,6 +3228,9 @@ yyreduce:
 #line 1038 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(cfg_parser->cfg->stubs->name)
+			yyerror("stub name override, there must be one name "
+				"for one stub-zone");
 		free(cfg_parser->cfg->stubs->name);
 		cfg_parser->cfg->stubs->name = (yyvsp[(2) - (2)].str);
 	}
@@ -3236,7 +3239,7 @@ yyreduce:
   case 204:
 
 /* Line 1455 of yacc.c  */
-#line 1045 "util/configparser.y"
+#line 1048 "util/configparser.y"
     {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[(2) - (2)].str)))
@@ -3247,7 +3250,7 @@ yyreduce:
   case 205:
 
 /* Line 1455 of yacc.c  */
-#line 1052 "util/configparser.y"
+#line 1055 "util/configparser.y"
     {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[(2) - (2)].str)))
@@ -3258,7 +3261,7 @@ yyreduce:
   case 206:
 
 /* Line 1455 of yacc.c  */
-#line 1059 "util/configparser.y"
+#line 1062 "util/configparser.y"
     {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3272,9 +3275,12 @@ yyreduce:
   case 207:
 
 /* Line 1455 of yacc.c  */
-#line 1069 "util/configparser.y"
+#line 1072 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(cfg_parser->cfg->forwards->name)
+			yyerror("forward name override, there must be one "
+				"name for one forward-zone");
 		free(cfg_parser->cfg->forwards->name);
 		cfg_parser->cfg->forwards->name = (yyvsp[(2) - (2)].str);
 	}
@@ -3283,7 +3289,7 @@ yyreduce:
   case 208:
 
 /* Line 1455 of yacc.c  */
-#line 1076 "util/configparser.y"
+#line 1082 "util/configparser.y"
     {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[(2) - (2)].str)))
@@ -3294,7 +3300,7 @@ yyreduce:
   case 209:
 
 /* Line 1455 of yacc.c  */
-#line 1083 "util/configparser.y"
+#line 1089 "util/configparser.y"
     {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[(2) - (2)].str)))
@@ -3305,7 +3311,7 @@ yyreduce:
   case 210:
 
 /* Line 1455 of yacc.c  */
-#line 1090 "util/configparser.y"
+#line 1096 "util/configparser.y"
     { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
@@ -3314,7 +3320,7 @@ yyreduce:
   case 220:
 
 /* Line 1455 of yacc.c  */
-#line 1101 "util/configparser.y"
+#line 1107 "util/configparser.y"
     {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3328,7 +3334,7 @@ yyreduce:
   case 221:
 
 /* Line 1455 of yacc.c  */
-#line 1111 "util/configparser.y"
+#line 1117 "util/configparser.y"
     {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -3341,7 +3347,7 @@ yyreduce:
   case 222:
 
 /* Line 1455 of yacc.c  */
-#line 1120 "util/configparser.y"
+#line 1126 "util/configparser.y"
     {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->control_ifs, (yyvsp[(2) - (2)].str)))
@@ -3352,7 +3358,7 @@ yyreduce:
   case 223:
 
 /* Line 1455 of yacc.c  */
-#line 1127 "util/configparser.y"
+#line 1133 "util/configparser.y"
     {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->server_key_file);
@@ -3363,7 +3369,7 @@ yyreduce:
   case 224:
 
 /* Line 1455 of yacc.c  */
-#line 1134 "util/configparser.y"
+#line 1140 "util/configparser.y"
     {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->server_cert_file);
@@ -3374,7 +3380,7 @@ yyreduce:
   case 225:
 
 /* Line 1455 of yacc.c  */
-#line 1141 "util/configparser.y"
+#line 1147 "util/configparser.y"
     {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->control_key_file);
@@ -3385,7 +3391,7 @@ yyreduce:
   case 226:
 
 /* Line 1455 of yacc.c  */
-#line 1148 "util/configparser.y"
+#line 1154 "util/configparser.y"
     {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->control_cert_file);
@@ -3396,7 +3402,7 @@ yyreduce:
   case 227:
 
 /* Line 1455 of yacc.c  */
-#line 1155 "util/configparser.y"
+#line 1161 "util/configparser.y"
     { 
 		OUTYY(("\nP(python:)\n")); 
 	}
@@ -3405,7 +3411,7 @@ yyreduce:
   case 231:
 
 /* Line 1455 of yacc.c  */
-#line 1164 "util/configparser.y"
+#line 1170 "util/configparser.y"
     {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->python_script);
@@ -3416,7 +3422,7 @@ yyreduce:
 
 
 /* Line 1455 of yacc.c  */
-#line 3420 "util/configparser.c"
+#line 3426 "util/configparser.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -3628,7 +3634,7 @@ yyreturn:
 
 
 /* Line 1675 of yacc.c  */
-#line 1169 "util/configparser.y"
+#line 1175 "util/configparser.y"
 
 
 /* parse helper routines could be here */

util/configparser.y

@@ -1037,6 +1037,9 @@ server_local_data_ptr: VAR_LOCAL_DATA_PTR STRING_ARG
 stub_name: VAR_NAME STRING_ARG
 	{
 		OUTYY(("P(name:%s)\n", $2));
+		if(cfg_parser->cfg->stubs->name)
+			yyerror("stub name override, there must be one name "
+				"for one stub-zone");
 		free(cfg_parser->cfg->stubs->name);
 		cfg_parser->cfg->stubs->name = $2;
 	}
@@ -1068,6 +1071,9 @@ stub_prime: VAR_STUB_PRIME STRING_ARG
 forward_name: VAR_NAME STRING_ARG
 	{
 		OUTYY(("P(name:%s)\n", $2));
+		if(cfg_parser->cfg->forwards->name)
+			yyerror("forward name override, there must be one "
+				"name for one forward-zone");
 		free(cfg_parser->cfg->forwards->name);
 		cfg_parser->cfg->forwards->name = $2;
 	}

util/iana_ports.inc

@@ -3821,6 +3821,7 @@
 4358,
 4359,
 4361,
+4362,
 4368,
 4369,
 4370,
@@ -3987,6 +3988,9 @@
 4869,
 4870,
 4871,
+4876,
+4877,
+4878,
 4881,
 4882,
 4884,
@@ -4304,6 +4308,7 @@
 5784,
 5785,
 5786,
+5787,
 5793,
 5794,
 5813,
@@ -4339,6 +4344,7 @@
 6072,
 6073,
 6074,
+6083,
 6085,
 6086,
 6087,
@@ -4530,6 +4536,7 @@
 7099,
 7100,
 7101,
+7107,
 7121,
 7128,
 7129,
@@ -5026,6 +5033,7 @@
 13218,
 13223,
 13224,
+13400,
 13720,
 13721,
 13722,

validator/val_nsec3.c

@@ -1055,6 +1055,11 @@ nsec3_do_prove_nameerror(struct module_env* env, struct nsec3_filter* flt,
 			"that the applicable wildcard did not exist.");
 		return sec_status_bogus;
 	}
+
+	if(ce.nc_rrset && nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {
+		verbose(VERB_ALGO, "nsec3 nameerror proof: nc has optout");
+		return sec_status_insecure;
+	}
 	return sec_status_secure;
 }
 
@@ -1264,6 +1269,10 @@ nsec3_prove_wildcard(struct module_env* env, struct val_env* ve,
 			"NSEC3 that covered the next closer name.");
 		return sec_status_bogus;
 	}
+	if(ce.nc_rrset && nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {
+		verbose(VERB_ALGO, "proveWildcard: NSEC3 optout");
+		return sec_status_insecure;
+	}
 	return sec_status_secure;
 }
 
@@ -1381,7 +1390,7 @@ nsec3_prove_nxornodata(struct module_env* env, struct val_env* ve,
 	struct ub_packed_rrset_key** list, size_t num, 
 	struct query_info* qinfo, struct key_entry_key* kkey, int* nodata)
 {
-	enum sec_status sec;
+	enum sec_status sec, secnx;
 	rbtree_t ct;
 	struct nsec3_filter flt;
 	*nodata = 0;
@@ -1398,12 +1407,16 @@ nsec3_prove_nxornodata(struct module_env* env, struct val_env* ve,
 	/* try nxdomain and nodata after another, while keeping the
 	 * hash cache intact */
 
-	sec = nsec3_do_prove_nameerror(env, &flt, &ct, qinfo);
-	if(sec==sec_status_secure)
+	secnx = nsec3_do_prove_nameerror(env, &flt, &ct, qinfo);
+	if(secnx==sec_status_secure)
 		return sec_status_secure;
 	sec = nsec3_do_prove_nodata(env, &flt, &ct, qinfo);
 	if(sec==sec_status_secure) {
 		*nodata = 1;
+	} else if(sec == sec_status_insecure) {
+		*nodata = 1;
+	} else if(secnx == sec_status_insecure) {
+		sec = sec_status_insecure;
 	}
 	return sec;
 }