pointrelease 1.6.3 tag

git-svn-id: file:///svn/unbound/tags/release-1.6.3@4221 be551aaa-1e26-0410-a405-d3ace91eadb9

.gitattributes

@@ -0,0 +1 @@
+testdata/*.[0-9] linguist-documentation

.gitignore

@@ -0,0 +1,39 @@
+*.lo
+*.o
+/.libs/
+/Makefile
+/autom4te.cache/
+/config.h
+/config.log
+/config.status
+/dnstap/dnstap_config.h
+/dnscrypt/dnscrypt_config.h
+/doc/example.conf
+/doc/libunbound.3
+/doc/unbound-anchor.8
+/doc/unbound-checkconf.8
+/doc/unbound-control.8
+/doc/unbound-host.1
+/doc/unbound.8
+/doc/unbound.conf.5
+/libtool
+/libunbound.la
+/smallapp/unbound-control-setup.sh
+/unbound
+/unbound-anchor
+/unbound-checkconf
+/unbound-control
+/unbound-control-setup
+/unbound-host
+/unbound.h
+/asynclook
+/delayer
+/lock-verify
+/memstats
+/perf
+/petal
+/pktview
+/streamtcp
+/testbound
+/unittest
+

ac_pkg_swig.m4

@@ -103,9 +103,20 @@ AC_DEFUN([AC_PROG_SWIG],[
                         if test -z "$available_patch" ; then
                                 [available_patch=0]
                         fi
-                        if test $available_major -ne $required_major \
-                                -o $available_minor -ne $required_minor \
-                                -o $available_patch -lt $required_patch ; then
+			[badversion=0]
+			if test $available_major -lt $required_major ; then
+				[badversion=1]
+			fi
+                        if test $available_major -eq $required_major \
+                                -a $available_minor -lt $required_minor ; then
+				[badversion=1]
+			fi
+                        if test $available_major -eq $required_major \
+                                -a $available_minor -eq $required_minor \
+                                -a $available_patch -lt $required_patch ; then
+				[badversion=1]
+			fi
+			if test $badversion -eq 1 ; then
                                 AC_MSG_WARN([SWIG version >= $1 is required.  You have $swig_version.  You should look at http://www.swig.org])
                                 SWIG='echo "Error: SWIG version >= $1 is required.  You have '"$swig_version"'.  You should look at http://www.swig.org" ; false'
                         else

acx_nlnetlabs.m4

@@ -2,7 +2,15 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 26
+# Version 34
+# 2016-03-21 Check -ldl -pthread for libcrypto for ldns and openssl 1.1.0.
+# 2016-03-21 Use HMAC_Update instead of HMAC_CTX_Init (for openssl-1.1.0).
+# 2016-01-04 -D_DEFAULT_SOURCE defined with -D_BSD_SOURCE for Linux glibc 2.20
+# 2015-12-11 FLTO check for new OSX, clang.
+# 2015-11-18 spelling check fix.
+# 2015-11-05 ACX_SSL_CHECKS no longer adds -ldl needlessly.
+# 2015-08-28 ACX_CHECK_PIE and ACX_CHECK_RELRO_NOW added.
+# 2015-03-17 AHX_CONFIG_REALLOCARRAY added
 # 2013-09-19 FLTO help text improved.
 # 2013-07-18 Enable ACX_CHECK_COMPILER_FLAG to test for -Wstrict-prototypes
 # 2013-06-25 FLTO has --disable-flto option.
@@ -22,7 +30,7 @@
 # 2010-07-02 Add check for ss_family (for minix).
 # 2010-04-26 Fix to use CPPFLAGS for CHECK_COMPILER_FLAGS.
 # 2010-03-01 Fix RPATH using CONFIG_COMMANDS to run at the very end.
-# 2010-02-18 WITH_SSL outputs the LIBSSL_LDFLAGS, LIBS, CPPFLAGS seperate, -ldl
+# 2010-02-18 WITH_SSL outputs the LIBSSL_LDFLAGS, LIBS, CPPFLAGS separate, -ldl
 # 2010-02-01 added ACX_CHECK_MEMCMP_SIGNED, AHX_MEMCMP_BROKEN
 # 2010-01-20 added AHX_COONFIG_STRLCAT
 # 2009-07-14 U_CHAR detection improved for windows crosscompile.
@@ -93,6 +101,8 @@
 # ACX_CHECK_MEMCMP_SIGNED	- check if memcmp uses signed characters.
 # AHX_MEMCMP_BROKEN		- replace memcmp func for CHECK_MEMCMP_SIGNED.
 # ACX_CHECK_SS_FAMILY           - check for sockaddr_storage.ss_family
+# ACX_CHECK_PIE			- add --enable-pie option and check if works
+# ACX_CHECK_RELRO_NOW		- add --enable-relro-now option and check it
 #
 
 dnl Escape backslashes as \\, for C:\ paths, for the C preprocessor defines.
@@ -235,7 +245,7 @@ ACX_CHECK_COMPILER_FLAG(xc99, [C99FLAG="-xc99"])
 
 AC_CHECK_HEADERS([getopt.h time.h],,, [AC_INCLUDES_DEFAULT])
 
-ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE,
+ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE,
 [
 #include "confdefs.h"
 #include <stdlib.h>
@@ -270,9 +280,9 @@ int test() {
 		a = 0;
 	return a;
 }
-], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"])
+], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"])
 
-ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE,
+ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE,
 [
 #include "confdefs.h"
 #include <stdlib.h>
@@ -307,7 +317,7 @@ int test() {
 		a = 0;
 	return a;
 }
-], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE"])
+], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE"])
 
 ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG,
 [
@@ -319,7 +329,7 @@ int test() {
 }
 ], [CFLAGS="$CFLAGS $C99FLAG"])
 
-ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE,
+ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE -D_DEFAULT_SOURCE,
 [
 #include <ctype.h>
 
@@ -328,7 +338,7 @@ int test() {
         a = isascii(32);
         return a;
 }
-], [CFLAGS="$CFLAGS -D_BSD_SOURCE"])
+], [CFLAGS="$CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE"])
 
 ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE,
 [
@@ -417,7 +427,7 @@ AC_DEFUN([ACX_CHECK_FLTO], [
         BAKCFLAGS="$CFLAGS"
         CFLAGS="$CFLAGS -flto"
         AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], [
-            if $CC $CFLAGS -o conftest conftest.c 2>&1 | grep "warning: no debug symbols in executable" >/dev/null; then
+            if $CC $CFLAGS -o conftest conftest.c 2>&1 | $GREP -e "warning: no debug symbols in executable" -e "warning: object" >/dev/null; then
                 CFLAGS="$BAKCFLAGS"
                 AC_MSG_RESULT(no)
             else
@@ -663,16 +673,16 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 ACX_RUNTIME_PATH_ADD([$ssldir/lib])
             fi
         
-            AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
+            AC_MSG_CHECKING([for HMAC_Update in -lcrypto])
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
             AC_TRY_LINK(, [
-                int HMAC_CTX_init(void);
-                (void)HMAC_CTX_init();
+                int HMAC_Update(void);
+                (void)HMAC_Update();
               ], [
                 AC_MSG_RESULT(yes)
-                AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-                          [If you have HMAC_CTX_init])
+                AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
+                          [If you have HMAC_Update])
               ], [
                 AC_MSG_RESULT(no)
                 # check if -lwsock32 or -lgdi32 are needed.	
@@ -682,11 +692,11 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
                 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
                 AC_TRY_LINK([], [
-                    int HMAC_CTX_init(void);
-                    (void)HMAC_CTX_init();
+                    int HMAC_Update(void);
+                    (void)HMAC_Update();
                   ],[
-                    AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-                        [If you have HMAC_CTX_init])
+                    AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
+                        [If you have HMAC_Update])
                     AC_MSG_RESULT(yes) 
                   ],[
                     AC_MSG_RESULT(no)
@@ -696,27 +706,36 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                     LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
                     AC_MSG_CHECKING([if -lcrypto needs -ldl])
                     AC_TRY_LINK([], [
-                        int HMAC_CTX_init(void);
-                        (void)HMAC_CTX_init();
+                        int HMAC_Update(void);
+                        (void)HMAC_Update();
                       ],[
-                        AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-                            [If you have HMAC_CTX_init])
+                        AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
+                            [If you have HMAC_Update])
                         AC_MSG_RESULT(yes) 
                       ],[
                         AC_MSG_RESULT(no)
-                    AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
+                        LIBS="$BAKLIBS"
+                        LIBSSL_LIBS="$BAKSSLLIBS"
+                        LIBS="$LIBS -ldl -pthread"
+                        LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
+                        AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
+                        AC_TRY_LINK([], [
+                            int HMAC_Update(void);
+                            (void)HMAC_Update();
+                          ],[
+                            AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
+                                [If you have HMAC_Update])
+                            AC_MSG_RESULT(yes) 
+                          ],[
+                            AC_MSG_RESULT(no)
+                            AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
+			])
                     ])
                 ])
             ])
         fi
         AC_SUBST(HAVE_SSL)
         AC_SUBST(RUNTIME_PATH)
-	# openssl engine functionality needs dlopen().
-	BAKLIBS="$LIBS"
-	AC_SEARCH_LIBS([dlopen], [dl])
-	if test "$LIBS" != "$BAKLIBS"; then
-		LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
-	fi
     fi
 AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT])
 AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT])
@@ -1213,6 +1232,16 @@ struct tm *gmtime_r(const time_t *timep, struct tm *result);
 #endif
 ])
 
+dnl provide reallocarray compat prototype.
+dnl $1: unique name for compat code
+AC_DEFUN([AHX_CONFIG_REALLOCARRAY],
+[
+#ifndef HAVE_REALLOCARRAY
+#define reallocarray reallocarray$1
+void* reallocarray(void *ptr, size_t nmemb, size_t size);
+#endif
+])
+
 dnl provide w32 compat definition for sleep
 AC_DEFUN([AHX_CONFIG_W32_SLEEP],
 [
@@ -1274,6 +1303,7 @@ AC_DEFUN([ACX_STRIP_EXT_FLAGS],
   AC_MSG_NOTICE([Stripping extension flags...])
   ACX_CFLAGS_STRIP(-D_GNU_SOURCE)
   ACX_CFLAGS_STRIP(-D_BSD_SOURCE)
+  ACX_CFLAGS_STRIP(-D_DEFAULT_SOURCE)
   ACX_CFLAGS_STRIP(-D__EXTENSIONS__)
   ACX_CFLAGS_STRIP(-D_POSIX_C_SOURCE=200112)
   ACX_CFLAGS_STRIP(-D_XOPEN_SOURCE=600)
@@ -1301,6 +1331,7 @@ dnl config.h part to define omitted cflags, use with ACX_STRIP_EXT_FLAGS.
 AC_DEFUN([AHX_CONFIG_EXT_FLAGS],
 [AHX_CONFIG_FLAG_EXT(-D_GNU_SOURCE)
 AHX_CONFIG_FLAG_EXT(-D_BSD_SOURCE)
+AHX_CONFIG_FLAG_EXT(-D_DEFAULT_SOURCE)
 AHX_CONFIG_FLAG_EXT(-D__EXTENSIONS__)
 AHX_CONFIG_FLAG_EXT(-D_POSIX_C_SOURCE=200112)
 AHX_CONFIG_FLAG_EXT(-D_XOPEN_SOURCE=600)
@@ -1375,4 +1406,46 @@ AC_DEFUN([ACX_CHECK_SS_FAMILY],
 #endif
 ]) ])
 
+dnl Check if CC and linker support -fPIE and -pie.
+dnl If so, sets them in CFLAGS / LDFLAGS.
+AC_DEFUN([ACX_CHECK_PIE], [
+    AC_ARG_ENABLE([pie], AS_HELP_STRING([--enable-pie], [Enable Position-Independent Executable (eg. to fully benefit from ASLR, small performance penalty)]))
+    AS_IF([test "x$enable_pie" = "xyes"], [
+	AC_MSG_CHECKING([if $CC supports PIE])
+	BAKLDFLAGS="$LDFLAGS"
+	BAKCFLAGS="$CFLAGS"
+	LDFLAGS="$LDFLAGS -pie"
+	CFLAGS="$CFLAGS -fPIE"
+	AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], [
+	    if $CC $CFLAGS $LDFLAGS -o conftest conftest.c 2>&1 | grep "warning: no debug symbols in executable" >/dev/null; then
+		LDFLAGS="$BAKLDFLAGS"
+		AC_MSG_RESULT(no)
+	    else
+		AC_MSG_RESULT(yes)
+	    fi
+	    rm -f conftest conftest.c conftest.o
+	], [LDFLAGS="$BAKLDFLAGS" ; CFLAGS="$BAKCFLAGS" ; AC_MSG_RESULT(no)])
+    ])
+])
+
+dnl Check if linker supports -Wl,-z,relro,-z,now.
+dnl If so, adds it to LDFLAGS.
+AC_DEFUN([ACX_CHECK_RELRO_NOW], [
+    AC_ARG_ENABLE([relro_now], AS_HELP_STRING([--enable-relro-now], [Enable full relocation binding at load-time (RELRO NOW, to protect GOT and .dtor areas)]))
+    AS_IF([test "x$enable_relro_now" = "xyes"], [
+	AC_MSG_CHECKING([if $CC supports -Wl,-z,relro,-z,now])
+	BAKLDFLAGS="$LDFLAGS"
+	LDFLAGS="$LDFLAGS -Wl,-z,relro,-z,now"
+	AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], [
+	    if $CC $CFLAGS $LDFLAGS -o conftest conftest.c 2>&1 | grep "warning: no debug symbols in executable" >/dev/null; then
+		LDFLAGS="$BAKLDFLAGS"
+		AC_MSG_RESULT(no)
+	    else
+		AC_MSG_RESULT(yes)
+	    fi
+	    rm -f conftest conftest.c conftest.o
+	], [LDFLAGS="$BAKLDFLAGS" ; AC_MSG_RESULT(no)])
+    ])
+])
+
 dnl End of file

acx_python.m4

@@ -22,8 +22,7 @@ AC_DEFUN([AC_PYTHON_DEVEL],[
         # Check if you have distutils, else fail
         #
         AC_MSG_CHECKING([for the distutils Python package])
-        ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`
-        if test -z "$ac_distutils_result"; then
+        if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then
                 AC_MSG_RESULT([yes])
         else
                 AC_MSG_RESULT([no])
@@ -54,7 +53,7 @@ $ac_distutils_result])
         AC_MSG_CHECKING([for Python library path])
         if test -z "$PYTHON_LDFLAGS"; then
                 PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
-                        print(get_config_var('BLDLIBRARY'));"`
+                        print('-L'+get_config_var('LIBDIR')+' -L'+get_config_var('LIBDEST')+' '+get_config_var('BLDLIBRARY'));"`
         fi
         AC_MSG_RESULT([$PYTHON_LDFLAGS])
         AC_SUBST([PYTHON_LDFLAGS])

ax_pthread.m4

@@ -82,7 +82,7 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 20
+#serial 21
 
 AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD])
 AC_DEFUN([AX_PTHREAD], [
@@ -103,8 +103,8 @@ if test x"$PTHREAD_LIBS$PTHREAD_CFLAGS" != x; then
         save_LIBS="$LIBS"
         LIBS="$PTHREAD_LIBS $LIBS"
         AC_MSG_CHECKING([for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS])
-        AC_TRY_LINK_FUNC(pthread_join, ax_pthread_ok=yes)
-        AC_MSG_RESULT($ax_pthread_ok)
+        AC_TRY_LINK_FUNC([pthread_join], [ax_pthread_ok=yes])
+        AC_MSG_RESULT([$ax_pthread_ok])
         if test x"$ax_pthread_ok" = xno; then
                 PTHREAD_LIBS=""
                 PTHREAD_CFLAGS=""
@@ -164,6 +164,20 @@ case ${host_os} in
         ;;
 esac
 
+# Clang doesn't consider unrecognized options an error unless we specify
+# -Werror. We throw in some extra Clang-specific options to ensure that
+# this doesn't happen for GCC, which also accepts -Werror.
+
+AC_MSG_CHECKING([if compiler needs -Werror to reject unknown flags])
+save_CFLAGS="$CFLAGS"
+ax_pthread_extra_flags="-Werror"
+CFLAGS="$CFLAGS $ax_pthread_extra_flags -Wunknown-warning-option -Wsizeof-array-argument"
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([int foo(void);],[foo()])],
+                  [AC_MSG_RESULT([yes])],
+                  [ax_pthread_extra_flags=
+                   AC_MSG_RESULT([no])])
+CFLAGS="$save_CFLAGS"
+
 if test x"$ax_pthread_ok" = xno; then
 for flag in $ax_pthread_flags; do
 
@@ -178,7 +192,7 @@ for flag in $ax_pthread_flags; do
                 ;;
 
                 pthread-config)
-                AC_CHECK_PROG(ax_pthread_config, pthread-config, yes, no)
+                AC_CHECK_PROG([ax_pthread_config], [pthread-config], [yes], [no])
                 if test x"$ax_pthread_config" = xno; then continue; fi
                 PTHREAD_CFLAGS="`pthread-config --cflags`"
                 PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
@@ -193,7 +207,7 @@ for flag in $ax_pthread_flags; do
         save_LIBS="$LIBS"
         save_CFLAGS="$CFLAGS"
         LIBS="$PTHREAD_LIBS $LIBS"
-        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+        CFLAGS="$CFLAGS $PTHREAD_CFLAGS $ax_pthread_extra_flags"
 
         # Check for various functions.  We must include pthread.h,
         # since some functions may be macros.  (On the Sequent, we
@@ -219,7 +233,7 @@ for flag in $ax_pthread_flags; do
         LIBS="$save_LIBS"
         CFLAGS="$save_CFLAGS"
 
-        AC_MSG_RESULT($ax_pthread_ok)
+        AC_MSG_RESULT([$ax_pthread_ok])
         if test "x$ax_pthread_ok" = xyes; then
                 break;
         fi
@@ -245,9 +259,9 @@ if test "x$ax_pthread_ok" = xyes; then
                 [attr_name=$attr; break],
                 [])
         done
-        AC_MSG_RESULT($attr_name)
+        AC_MSG_RESULT([$attr_name])
         if test "$attr_name" != PTHREAD_CREATE_JOINABLE; then
-            AC_DEFINE_UNQUOTED(PTHREAD_CREATE_JOINABLE, $attr_name,
+            AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE], [$attr_name],
                                [Define to necessary symbol if this constant
                                 uses a non-standard name on your system.])
         fi
@@ -261,24 +275,25 @@ if test "x$ax_pthread_ok" = xyes; then
             if test "$GCC" = "yes"; then
                 flag="-D_REENTRANT"
             else
+                # TODO: What about Clang on Solaris?
                 flag="-mt -D_REENTRANT"
             fi
             ;;
         esac
-        AC_MSG_RESULT(${flag})
+        AC_MSG_RESULT([$flag])
         if test "x$flag" != xno; then
             PTHREAD_CFLAGS="$flag $PTHREAD_CFLAGS"
         fi
 
         AC_CACHE_CHECK([for PTHREAD_PRIO_INHERIT],
-            ax_cv_PTHREAD_PRIO_INHERIT, [
-                AC_LINK_IFELSE([
-                    AC_LANG_PROGRAM([[#include <pthread.h>]], [[int i = PTHREAD_PRIO_INHERIT;]])],
+            [ax_cv_PTHREAD_PRIO_INHERIT], [
+                AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <pthread.h>]],
+                                                [[int i = PTHREAD_PRIO_INHERIT;]])],
                     [ax_cv_PTHREAD_PRIO_INHERIT=yes],
                     [ax_cv_PTHREAD_PRIO_INHERIT=no])
             ])
         AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes"],
-            AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], 1, [Have PTHREAD_PRIO_INHERIT.]))
+            [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.])])
 
         LIBS="$save_LIBS"
         CFLAGS="$save_CFLAGS"
@@ -301,13 +316,13 @@ fi
 
 test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"
 
-AC_SUBST(PTHREAD_LIBS)
-AC_SUBST(PTHREAD_CFLAGS)
-AC_SUBST(PTHREAD_CC)
+AC_SUBST([PTHREAD_LIBS])
+AC_SUBST([PTHREAD_CFLAGS])
+AC_SUBST([PTHREAD_CC])
 
 # Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
 if test x"$ax_pthread_ok" = xyes; then
-        ifelse([$1],,AC_DEFINE(HAVE_PTHREAD,1,[Define if you have POSIX threads libraries and header files.]),[$1])
+        ifelse([$1],,[AC_DEFINE([HAVE_PTHREAD],[1],[Define if you have POSIX threads libraries and header files.])],[$1])
         :
 else
         ax_pthread_ok=no

cachedb/cachedb.c

@@ -0,0 +1,712 @@
+/*
+ * cachedb/cachedb.c - cache from a database external to the program module
+ *
+ * Copyright (c) 2016, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains a module that uses an external database to cache
+ * dns responses.
+ */
+
+#include "config.h"
+#ifdef USE_CACHEDB
+#include "cachedb/cachedb.h"
+#include "util/regional.h"
+#include "util/net_help.h"
+#include "util/config_file.h"
+#include "util/data/msgreply.h"
+#include "util/data/msgencode.h"
+#include "services/cache/dns.h"
+#include "validator/val_neg.h"
+#include "validator/val_secalgo.h"
+#include "iterator/iter_utils.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
+#include "sldns/sbuffer.h"
+
+#define CACHEDB_HASHSIZE 256 /* bit hash */
+
+/** the unit test testframe for cachedb, its module state contains
+ * a cache for a couple queries (in memory). */
+struct testframe_moddata {
+	/** key for single stored data element, NULL if none */
+	char* stored_key;
+	/** data for single stored data element, NULL if none */
+	uint8_t* stored_data;
+	/** length of stored data */
+	size_t stored_datalen;
+};
+
+static int
+testframe_init(struct module_env* env, struct cachedb_env* cachedb_env)
+{
+	(void)env;
+	verbose(VERB_ALGO, "testframe_init");
+	cachedb_env->backend_data = (void*)calloc(1,
+		sizeof(struct testframe_moddata));
+	if(!cachedb_env->backend_data) {
+		log_err("out of memory");
+		return 0;
+	}
+	return 1;
+}
+
+static void
+testframe_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
+{
+	struct testframe_moddata* d = (struct testframe_moddata*)
+		cachedb_env->backend_data;
+	(void)env;
+	verbose(VERB_ALGO, "testframe_deinit");
+	if(!d)
+		return;
+	free(d->stored_key);
+	free(d->stored_data);
+	free(d);
+}
+
+static int
+testframe_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
+	char* key, struct sldns_buffer* result_buffer)
+{
+	struct testframe_moddata* d = (struct testframe_moddata*)
+		cachedb_env->backend_data;
+	(void)env;
+	verbose(VERB_ALGO, "testframe_lookup of %s", key);
+	if(d->stored_key && strcmp(d->stored_key, key) == 0) {
+		if(d->stored_datalen > sldns_buffer_capacity(result_buffer))
+			return 0; /* too large */
+		verbose(VERB_ALGO, "testframe_lookup found %d bytes",
+			(int)d->stored_datalen);
+		sldns_buffer_clear(result_buffer);
+		sldns_buffer_write(result_buffer, d->stored_data,
+			d->stored_datalen);
+		sldns_buffer_flip(result_buffer);
+		return 1;
+	}
+	return 0;
+}
+
+static void
+testframe_store(struct module_env* env, struct cachedb_env* cachedb_env,
+	char* key, uint8_t* data, size_t data_len)
+{
+	struct testframe_moddata* d = (struct testframe_moddata*)
+		cachedb_env->backend_data;
+	(void)env;
+	verbose(VERB_ALGO, "testframe_store %s (%d bytes)", key, (int)data_len);
+
+	/* free old data element (if any) */
+	free(d->stored_key);
+	d->stored_key = NULL;
+	free(d->stored_data);
+	d->stored_data = NULL;
+	d->stored_datalen = 0;
+
+	d->stored_data = memdup(data, data_len);
+	if(!d->stored_data) {
+		log_err("out of memory");
+		return;
+	}
+	d->stored_datalen = data_len;
+	d->stored_key = strdup(key);
+	if(!d->stored_key) {
+		free(d->stored_data);
+		d->stored_data = NULL;
+		d->stored_datalen = 0;
+		return;
+	}
+	/* (key,data) successfully stored */
+}
+
+/** The testframe backend is for unit tests */
+static struct cachedb_backend testframe_backend = { "testframe",
+	testframe_init, testframe_deinit, testframe_lookup, testframe_store
+};
+
+/** find a particular backend from possible backends */
+static struct cachedb_backend*
+cachedb_find_backend(const char* str)
+{
+	if(strcmp(str, testframe_backend.name) == 0)
+		return &testframe_backend;
+	/* TODO add more backends here */
+	return NULL;
+}
+
+/** apply configuration to cachedb module 'global' state */
+static int
+cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
+{
+	const char* backend_str = "testframe"; /* TODO get from cfg */
+	if(backend_str && backend_str[0]) {
+		cachedb_env->backend = cachedb_find_backend(backend_str);
+		if(!cachedb_env->backend) {
+			log_err("cachedb: cannot find backend name '%s",
+				backend_str);
+			return NULL;
+		}
+	}
+	/* TODO see if more configuration needs to be applied or not */
+	return 1;
+}
+
+int 
+cachedb_init(struct module_env* env, int id)
+{
+	struct cachedb_env* cachedb_env = (struct cachedb_env*)calloc(1,
+		sizeof(struct cachedb_env));
+	if(!cachedb_env) {
+		log_err("malloc failure");
+		return 0;
+	}
+	env->modinfo[id] = (void*)cachedb_env;
+	if(!cachedb_apply_cfg(cachedb_env, env->cfg)) {
+		log_err("cachedb: could not apply configuration settings.");
+		return 0;
+	}
+	/* see if a backend is selected */
+	if(!cachedb_env->backend || !cachedb_env->backend->name)
+		return 1;
+	if(!(*cachedb_env->backend->init)(env, cachedb_env)) {
+		log_err("cachedb: could not init %s backend",
+			cachedb_env->backend->name);
+		return 0;
+	}
+	cachedb_env->enabled = 1;
+	return 1;
+}
+
+void 
+cachedb_deinit(struct module_env* env, int id)
+{
+	struct cachedb_env* cachedb_env;
+	if(!env || !env->modinfo[id])
+		return;
+	cachedb_env = (struct cachedb_env*)env->modinfo[id];
+	/* free contents */
+	/* TODO */
+	if(cachedb_env->enabled) {
+		(*cachedb_env->backend->deinit)(env, cachedb_env);
+	}
+
+	free(cachedb_env);
+	env->modinfo[id] = NULL;
+}
+
+/** new query for cachedb */
+static int
+cachedb_new(struct module_qstate* qstate, int id)
+{
+	struct cachedb_qstate* iq = (struct cachedb_qstate*)regional_alloc(
+		qstate->region, sizeof(struct cachedb_qstate));
+	qstate->minfo[id] = iq;
+	if(!iq) 
+		return 0;
+	memset(iq, 0, sizeof(*iq));
+	/* initialise it */
+	/* TODO */
+
+	return 1;
+}
+
+/**
+ * Return an error
+ * @param qstate: our query state
+ * @param id: module id
+ * @param rcode: error code (DNS errcode).
+ * @return: 0 for use by caller, to make notation easy, like:
+ * 	return error_response(..). 
+ */
+static int
+error_response(struct module_qstate* qstate, int id, int rcode)
+{
+	verbose(VERB_QUERY, "return error response %s", 
+		sldns_lookup_by_id(sldns_rcodes, rcode)?
+		sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??");
+	qstate->return_rcode = rcode;
+	qstate->return_msg = NULL;
+	qstate->ext_state[id] = module_finished;
+	return 0;
+}
+
+/**
+ * Hash the query name, type, class and dbacess-secret into lookup buffer.
+ * @param qstate: query state with query info
+ * 	and env->cfg with secret.
+ * @param buf: returned buffer with hash to lookup
+ * @param len: length of the buffer.
+ */
+static void
+calc_hash(struct module_qstate* qstate, char* buf, size_t len)
+{
+	uint8_t clear[1024];
+	size_t clen = 0;
+	uint8_t hash[CACHEDB_HASHSIZE/8];
+	const char* hex = "0123456789ABCDEF";
+	const char* secret = "default"; /* TODO: from qstate->env->cfg */
+	size_t i;
+	
+	/* copy the hash info into the clear buffer */
+	if(clen + qstate->qinfo.qname_len < sizeof(clear)) {
+		memmove(clear+clen, qstate->qinfo.qname,
+			qstate->qinfo.qname_len);
+		clen += qstate->qinfo.qname_len;
+	}
+	if(clen + 4 < sizeof(clear)) {
+		uint16_t t = htons(qstate->qinfo.qtype);
+		uint16_t c = htons(qstate->qinfo.qclass);
+		memmove(clear+clen, &t, 2);
+		memmove(clear+clen+2, &c, 2);
+		clen += 4;
+	}
+	if(secret && secret[0] && clen + strlen(secret) < sizeof(clear)) {
+		memmove(clear+clen, secret, strlen(secret));
+		clen += strlen(secret);
+	}
+	
+	/* hash the buffer */
+	secalgo_hash_sha256(clear, clen, hash);
+	memset(clear, 0, clen);
+
+	/* hex encode output for portability (some online dbs need
+	 * no nulls, no control characters, and so on) */
+	log_assert(len >= sizeof(hash)*2 + 1);
+	(void)len;
+	for(i=0; i<sizeof(hash); i++) {
+		buf[i*2] = hex[(hash[i]&0xf0)>>4];
+		buf[i*2+1] = hex[hash[i]&0x0f];
+	}
+	buf[sizeof(hash)*2] = 0;
+}
+
+/** convert data from return_msg into the data buffer */
+static int
+prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
+{
+	uint64_t timestamp, expiry;
+	size_t oldlim;
+	struct edns_data edns;
+	memset(&edns, 0, sizeof(edns));
+	edns.edns_present = 1;
+	edns.bits = EDNS_DO;
+	edns.ext_rcode = 0;
+	edns.edns_version = EDNS_ADVERTISED_VERSION;
+	edns.udp_size = EDNS_ADVERTISED_SIZE;
+
+	if(!qstate->return_msg || !qstate->return_msg->rep)
+		return 0;
+	if(verbosity >= VERB_ALGO)
+		log_dns_msg("cachedb encoding", &qstate->return_msg->qinfo,
+	                qstate->return_msg->rep);
+	if(!reply_info_answer_encode(&qstate->return_msg->qinfo,
+		qstate->return_msg->rep, 0, qstate->query_flags,
+		buf, 0, 1, qstate->env->scratch, 65535, &edns, 1, 0))
+		return 0;
+
+	/* TTLs in the return_msg are relative to time(0) so we have to
+	 * store that, we also store the smallest ttl in the packet+time(0)
+	 * as the packet expiry time */
+	/* qstate->return_msg->rep->ttl contains that relative shortest ttl */
+	timestamp = (uint64_t)*qstate->env->now;
+	expiry = timestamp + (uint64_t)qstate->return_msg->rep->ttl;
+	timestamp = htobe64(timestamp);
+	expiry = htobe64(expiry);
+	oldlim = sldns_buffer_limit(buf);
+	if(oldlim + sizeof(timestamp)+sizeof(expiry) >=
+		sldns_buffer_capacity(buf))
+		return 0; /* doesn't fit. */
+	sldns_buffer_set_limit(buf, oldlim + sizeof(timestamp)+sizeof(expiry));
+	sldns_buffer_write_at(buf, oldlim, &timestamp, sizeof(timestamp));
+	sldns_buffer_write_at(buf, oldlim+sizeof(timestamp), &expiry,
+		sizeof(expiry));
+
+	return 1;
+}
+
+/** check expiry, return true if matches OK */
+static int
+good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
+{
+	uint64_t expiry;
+	/* the expiry time is the last bytes of the buffer */
+	if(sldns_buffer_limit(buf) < sizeof(expiry))
+		return 0;
+	sldns_buffer_read_at(buf, sldns_buffer_limit(buf)-sizeof(expiry),
+		&expiry, sizeof(expiry));
+	expiry = be64toh(expiry);
+
+	if((time_t)expiry < *qstate->env->now)
+		return 0;
+
+	return 1;
+}
+
+/** convert dns message in buffer to return_msg */
+static int
+parse_data(struct module_qstate* qstate, struct sldns_buffer* buf)
+{
+	struct msg_parse* prs;
+	struct edns_data edns;
+	uint64_t timestamp, expiry;
+	time_t adjust;
+	size_t lim = sldns_buffer_limit(buf);
+	if(lim < LDNS_HEADER_SIZE+sizeof(timestamp)+sizeof(expiry))
+		return 0; /* too short */
+
+	/* remove timestamp and expiry from end */
+	sldns_buffer_read_at(buf, lim-sizeof(expiry), &expiry, sizeof(expiry));
+	sldns_buffer_read_at(buf, lim-sizeof(expiry)-sizeof(timestamp),
+		&timestamp, sizeof(timestamp));
+	expiry = be64toh(expiry);
+	timestamp = be64toh(timestamp);
+
+	/* parse DNS packet */
+	regional_free_all(qstate->env->scratch);
+	prs = (struct msg_parse*)regional_alloc(qstate->env->scratch,
+		sizeof(struct msg_parse));
+	if(!prs)
+		return 0; /* out of memory */
+	memset(prs, 0, sizeof(*prs));
+	memset(&edns, 0, sizeof(edns));
+	sldns_buffer_set_limit(buf, lim - sizeof(expiry)-sizeof(timestamp));
+	if(parse_packet(buf, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) {
+		sldns_buffer_set_limit(buf, lim);
+		return 0;
+	}
+	if(parse_extract_edns(prs, &edns, qstate->env->scratch) !=
+		LDNS_RCODE_NOERROR) {
+		sldns_buffer_set_limit(buf, lim);
+		return 0;
+	}
+
+	qstate->return_msg = dns_alloc_msg(buf, prs, qstate->region);
+	sldns_buffer_set_limit(buf, lim);
+	if(!qstate->return_msg)
+		return 0;
+	
+	qstate->return_rcode = LDNS_RCODE_NOERROR;
+
+	/* see how much of the TTL expired, and remove it */
+	adjust = *qstate->env->now - (time_t)timestamp;
+	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
+	/*adjust_msg(qstate->return_msg, adjust);*/
+	/* TODO:
+		msg->rep->ttl = r->ttl - adjust;
+		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
+		for(i=0; i<d->count + d->rrsig_count; i++) {
+			if(d->rr_ttl[i] < adjust)
+				d->rr_ttl[i] = 0;
+			else    d->rr_ttl[i] -= adjust;
+		}
+		if(d->ttl < adjust)
+			d->ttl = 0;
+		else    d->ttl -= adjust;
+		*/
+	/* TODO */
+
+	return 0;
+}
+
+/**
+ * Lookup the qstate.qinfo in extcache, store in qstate.return_msg.
+ * return true if lookup was successful.
+ */
+static int
+cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie)
+{
+	char key[(CACHEDB_HASHSIZE/8)*2+1];
+	calc_hash(qstate, key, sizeof(key));
+
+	/* call backend to fetch data for key into scratch buffer */
+	if( !(*ie->backend->lookup)(qstate->env, ie, key,
+		qstate->env->scratch_buffer)) {
+		return 0;
+	}
+
+	/* check expiry date and check if query-data matches */
+	if( !good_expiry_and_qinfo(qstate, qstate->env->scratch_buffer) ) {
+		return 0;
+	}
+
+	/* parse dns message into return_msg */
+	if( !parse_data(qstate, qstate->env->scratch_buffer) ) {
+		return 0;
+	}
+	return 1;
+}
+
+/**
+ * Store the qstate.return_msg in extcache for key qstate.info
+ */
+static void
+cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie)
+{
+	char key[(CACHEDB_HASHSIZE/8)*2+1];
+	calc_hash(qstate, key, sizeof(key));
+
+	/* prepare data in scratch buffer */
+	if(!prep_data(qstate, qstate->env->scratch_buffer))
+		return;
+	
+	/* call backend */
+	(*ie->backend->store)(qstate->env, ie, key,
+		sldns_buffer_begin(qstate->env->scratch_buffer),
+		sldns_buffer_limit(qstate->env->scratch_buffer));
+}
+
+/**
+ * See if unbound's internal cache can answer the query
+ */
+static int
+cachedb_intcache_lookup(struct module_qstate* qstate)
+{
+	struct dns_msg* msg;
+	msg = dns_cache_lookup(qstate->env, qstate->qinfo.qname,
+		qstate->qinfo.qname_len, qstate->qinfo.qtype,
+		qstate->qinfo.qclass, qstate->query_flags,
+		qstate->region, qstate->env->scratch);
+	if(!msg && qstate->env->neg_cache) {
+		/* lookup in negative cache; may result in 
+		 * NOERROR/NODATA or NXDOMAIN answers that need validation */
+		msg = val_neg_getmsg(qstate->env->neg_cache, &qstate->qinfo,
+			qstate->region, qstate->env->rrset_cache,
+			qstate->env->scratch_buffer,
+			*qstate->env->now, 1/*add SOA*/, NULL);
+	}
+	if(!msg)
+		return 0;
+	/* this is the returned msg */
+	qstate->return_rcode = LDNS_RCODE_NOERROR;
+	qstate->return_msg = msg;
+	return 1;
+}
+
+/**
+ * Store query into the internal cache of unbound.
+ */
+static void
+cachedb_intcache_store(struct module_qstate* qstate)
+{
+	if(!qstate->return_msg)
+		return;
+	(void)dns_cache_store(qstate->env, &qstate->qinfo,
+		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
+		qstate->region, qstate->query_flags);
+}
+
+/**
+ * Handle a cachedb module event with a query
+ * @param qstate: query state (from the mesh), passed between modules.
+ * 	contains qstate->env module environment with global caches and so on.
+ * @param iq: query state specific for this module.  per-query.
+ * @param ie: environment specific for this module.  global.
+ * @param id: module id.
+ */
+static void
+cachedb_handle_query(struct module_qstate* qstate,
+	struct cachedb_qstate* ATTR_UNUSED(iq),
+	struct cachedb_env* ie, int id)
+{
+	/* check if we are enabled, and skip if so */
+	if(!ie->enabled) {
+		/* pass request to next module */
+		qstate->ext_state[id] = module_wait_module;
+		return;
+	}
+
+	if(qstate->blacklist || qstate->no_cache_lookup) {
+		/* cache is blacklisted or we are instructed from edns to not look */
+		/* pass request to next module */
+		qstate->ext_state[id] = module_wait_module;
+		return;
+	}
+
+	/* lookup inside unbound's internal cache */
+	if(cachedb_intcache_lookup(qstate)) {
+		if(verbosity >= VERB_ALGO) {
+			if(qstate->return_msg->rep)
+				log_dns_msg("cachedb internal cache lookup",
+					&qstate->return_msg->qinfo,
+					qstate->return_msg->rep);
+			else log_info("cachedb internal cache lookup: rcode %s",
+				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)?
+				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)->name:"??");
+		}
+		/* we are done with the query */
+		qstate->ext_state[id] = module_finished;
+		return;
+	}
+
+	/* ask backend cache to see if we have data */
+	if(cachedb_extcache_lookup(qstate, ie)) {
+		if(verbosity >= VERB_ALGO)
+			log_dns_msg(ie->backend->name,
+				&qstate->return_msg->qinfo,
+				qstate->return_msg->rep);
+		/* store this result in internal cache */
+		cachedb_intcache_store(qstate);
+		/* we are done with the query */
+		qstate->ext_state[id] = module_finished;
+		return;
+	}
+
+	/* no cache fetches */
+	/* pass request to next module */
+	qstate->ext_state[id] = module_wait_module;
+}
+
+/**
+ * Handle a cachedb module event with a response from the iterator.
+ * @param qstate: query state (from the mesh), passed between modules.
+ * 	contains qstate->env module environment with global caches and so on.
+ * @param iq: query state specific for this module.  per-query.
+ * @param ie: environment specific for this module.  global.
+ * @param id: module id.
+ */
+static void
+cachedb_handle_response(struct module_qstate* qstate,
+	struct cachedb_qstate* ATTR_UNUSED(iq), struct cachedb_env* ie, int id)
+{
+	/* check if we are not enabled or instructed to not cache, and skip */
+	if(!ie->enabled || qstate->no_cache_store) {
+		/* we are done with the query */
+		qstate->ext_state[id] = module_finished;
+		return;
+	}
+
+	/* store the item into the backend cache */
+	cachedb_extcache_store(qstate, ie);
+
+	/* we are done with the query */
+	qstate->ext_state[id] = module_finished;
+}
+
+void 
+cachedb_operate(struct module_qstate* qstate, enum module_ev event, int id,
+	struct outbound_entry* outbound)
+{
+	struct cachedb_env* ie = (struct cachedb_env*)qstate->env->modinfo[id];
+	struct cachedb_qstate* iq = (struct cachedb_qstate*)qstate->minfo[id];
+	verbose(VERB_QUERY, "cachedb[module %d] operate: extstate:%s event:%s", 
+		id, strextstate(qstate->ext_state[id]), strmodulevent(event));
+	if(iq) log_query_info(VERB_QUERY, "cachedb operate: query", 
+		&qstate->qinfo);
+
+	/* perform cachedb state machine */
+	if((event == module_event_new || event == module_event_pass) && 
+		iq == NULL) {
+		if(!cachedb_new(qstate, id)) {
+			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			return;
+		}
+		iq = (struct cachedb_qstate*)qstate->minfo[id];
+	}
+	if(iq && (event == module_event_pass || event == module_event_new)) {
+		cachedb_handle_query(qstate, iq, ie, id);
+		return;
+	}
+	if(iq && (event == module_event_moddone)) {
+		cachedb_handle_response(qstate, iq, ie, id);
+		return;
+	}
+	if(iq && outbound) {
+		/* cachedb does not need to process responses at this time
+		 * ignore it.
+		cachedb_process_response(qstate, iq, ie, id, outbound, event);
+		*/
+		return;
+	}
+	if(event == module_event_error) {
+		verbose(VERB_ALGO, "got called with event error, giving up");
+		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		return;
+	}
+	if(!iq && (event == module_event_moddone)) {
+		/* during priming, module done but we never started */
+		qstate->ext_state[id] = module_finished;
+		return;
+	}
+
+	log_err("bad event for cachedb");
+	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+}
+
+void
+cachedb_inform_super(struct module_qstate* ATTR_UNUSED(qstate),
+	int ATTR_UNUSED(id), struct module_qstate* ATTR_UNUSED(super))
+{
+	/* cachedb does not use subordinate requests at this time */
+	verbose(VERB_ALGO, "cachedb inform_super was called");
+}
+
+void 
+cachedb_clear(struct module_qstate* qstate, int id)
+{
+	struct cachedb_qstate* iq;
+	if(!qstate)
+		return;
+	iq = (struct cachedb_qstate*)qstate->minfo[id];
+	if(iq) {
+		/* free contents of iq */
+		/* TODO */
+	}
+	qstate->minfo[id] = NULL;
+}
+
+size_t 
+cachedb_get_mem(struct module_env* env, int id)
+{
+	struct cachedb_env* ie = (struct cachedb_env*)env->modinfo[id];
+	if(!ie)
+		return 0;
+	return sizeof(*ie); /* TODO - more mem */
+}
+
+/**
+ * The cachedb function block 
+ */
+static struct module_func_block cachedb_block = {
+	"cachedb",
+	&cachedb_init, &cachedb_deinit, &cachedb_operate,
+	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
+};
+
+struct module_func_block* 
+cachedb_get_funcblock(void)
+{
+	return &cachedb_block;
+}
+#endif /* USE_CACHEDB */

cachedb/cachedb.h

@@ -0,0 +1,110 @@
+/*
+ * cachedb/cachedb.h - cache from a database external to the program module
+ *
+ * Copyright (c) 2016, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains a module that uses an external database to cache
+ * dns responses.
+ */
+#include "util/module.h"
+struct cachedb_backend;
+
+/**
+ * The global variable environment contents for the cachedb
+ * Shared between threads, this represents long term information.
+ * Like database connections.
+ */
+struct cachedb_env {
+	/** true is cachedb is enabled, the backend is turned on */
+	int enabled;
+
+	/** the backend routines */
+	struct cachedb_backend* backend;
+
+	/** backend specific data here */
+	void* backend_data;
+};
+
+/**
+ * Per query state for the cachedb module.
+ */
+struct cachedb_qstate {
+	int todo;
+};
+
+/**
+ * Backend call routines
+ */
+struct cachedb_backend {
+	/** backend name */
+	const char* name;
+
+	/** Init(env, cachedb_env): false on setup failure */
+	int (*init)(struct module_env*, struct cachedb_env*);
+
+	/** Deinit - close db for program exit */
+	void (*deinit)(struct module_env*, struct cachedb_env*);
+
+	/** Lookup (env, cachedb_env, key, result_buffer): true if found */
+	int (*lookup)(struct module_env*, struct cachedb_env*, char*,
+		struct sldns_buffer*);
+	
+	/** Store (env, cachedb_env, key, data, data_len) */
+	void (*store)(struct module_env*, struct cachedb_env*, char*,
+		uint8_t*, size_t);
+};
+
+/** Init the cachedb module */
+int cachedb_init(struct module_env* env, int id);
+/** Deinit the cachedb module */
+void cachedb_deinit(struct module_env* env, int id);
+/** Operate on an event on a query (in qstate). */
+void cachedb_operate(struct module_qstate* qstate, enum module_ev event,
+	int id, struct outbound_entry* outbound);
+/** Subordinate query done, inform this super request of its conclusion */
+void cachedb_inform_super(struct module_qstate* qstate, int id,
+	struct module_qstate* super);
+/** clear the cachedb query-specific contents out of qstate */
+void cachedb_clear(struct module_qstate* qstate, int id);
+/** return memory estimate for cachedb module */
+size_t cachedb_get_mem(struct module_env* env, int id);
+
+/**
+ * Get the function block with pointers to the cachedb functions
+ * @return the function block for "cachedb".
+ */
+struct module_func_block* cachedb_get_funcblock(void);
+

compat/arc4_lock.c

@@ -48,7 +48,7 @@ void _ARC4_UNLOCK(void)
 }
 #else /* !THREADS_DISABLED */
 
-static lock_quick_t arc4lock;
+static lock_quick_type arc4lock;
 static int arc4lockinit = 0;
 
 void _ARC4_LOCK(void)

compat/arc4random.c

@@ -26,7 +26,9 @@
 #include <fcntl.h>
 #include <limits.h>
 #include <signal.h>
+#ifdef HAVE_STDINT_H
 #include <stdint.h>
+#endif
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
@@ -46,6 +48,9 @@
 #else				/* !__GNUC__ */
 #define inline
 #endif				/* !__GNUC__ */
+#ifndef MAP_ANON
+#define MAP_ANON MAP_ANONYMOUS
+#endif
 
 #define KEYSZ	32
 #define IVSZ	8

compat/ctime_r.c

@@ -6,7 +6,7 @@
 #include "util/locks.h"
 
 /** the lock for ctime buffer */
-static lock_basic_t ctime_lock;
+static lock_basic_type ctime_lock;
 /** has it been inited */
 static int ctime_r_init = 0;
 

compat/explicit_bzero.c

@@ -6,7 +6,11 @@
 #include "config.h"
 #include <string.h>
 
+#ifdef HAVE_ATTR_WEAK
 __attribute__((weak)) void
+#else
+void
+#endif
 __explicit_bzero_hook(void *ATTR_UNUSED(buf), size_t ATTR_UNUSED(len))
 {
 }

compat/getentropy_linux.c

@@ -46,7 +46,12 @@
 #include <errno.h>
 #include <unistd.h>
 #include <time.h>
+
+#if defined(HAVE_SSL)
 #include <openssl/sha.h>
+#elif defined(HAVE_NETTLE)
+#include <nettle/sha.h>
+#endif
 
 #include <linux/types.h>
 #include <linux/random.h>
@@ -55,6 +60,9 @@
 #include <sys/auxv.h>
 #endif
 #include <sys/vfs.h>
+#ifndef MAP_ANON
+#define MAP_ANON MAP_ANONYMOUS
+#endif
 
 #define REPEAT 5
 #define min(a, b) (((a) < (b)) ? (a) : (b))
@@ -67,9 +75,21 @@
 			HD(b); \
 	} while (0)
 
+#if defined(HAVE_SSL)
+#define CRYPTO_SHA512_CTX		SHA512_CTX
+#define CRYPTO_SHA512_INIT(x)		SHA512_Init(x)
+#define CRYPTO_SHA512_FINAL(r, c)	SHA512_Final(r, c)
 #define HR(x, l) (SHA512_Update(&ctx, (char *)(x), (l)))
 #define HD(x)	 (SHA512_Update(&ctx, (char *)&(x), sizeof (x)))
 #define HF(x)    (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))
+#elif defined(HAVE_NETTLE)
+#define CRYPTO_SHA512_CTX		struct sha512_ctx
+#define CRYPTO_SHA512_INIT(x)		sha512_init(x)
+#define CRYPTO_SHA512_FINAL(r, c)	sha512_digest(c, SHA512_DIGEST_SIZE, r)
+#define HR(x, l) (sha512_update(&ctx, (l), (uint8_t *)(x)))
+#define HD(x)	 (sha512_update(&ctx, sizeof (x), (uint8_t *)&(x)))
+#define HF(x)    (sha512_update(&ctx, sizeof (void*), (uint8_t *)&(x)))
+#endif
 
 int	getentropy(void *buf, size_t len);
 
@@ -77,6 +97,9 @@ int	getentropy(void *buf, size_t len);
 extern int main(int, char *argv[]);
 #endif
 static int gotdata(char *buf, size_t len);
+#if defined(SYS_getrandom) && defined(__NR_getrandom)
+static int getentropy_getrandom(void *buf, size_t len);
+#endif
 static int getentropy_urandom(void *buf, size_t len);
 #ifdef SYS__sysctl
 static int getentropy_sysctl(void *buf, size_t len);
@@ -93,6 +116,17 @@ getentropy(void *buf, size_t len)
 		return -1;
 	}
 
+#if defined(SYS_getrandom) && defined(__NR_getrandom)
+	/*
+	 * Try descriptor-less getrandom()
+	 */
+	ret = getentropy_getrandom(buf, len);
+	if (ret != -1)
+		return (ret);
+	if (errno != ENOSYS)
+		return (-1);
+#endif
+
 	/*
 	 * Try to get entropy with /dev/urandom
 	 *
@@ -108,7 +142,7 @@ getentropy(void *buf, size_t len)
 	 * Try to use sysctl CTL_KERN, KERN_RANDOM, RANDOM_UUID.
 	 * sysctl is a failsafe API, so it guarantees a result.  This
 	 * should work inside a chroot, or when file descriptors are
-	 * exhuasted.
+	 * exhausted.
 	 *
 	 * However this can fail if the Linux kernel removes support
 	 * for sysctl.  Starting in 2007, there have been efforts to
@@ -178,6 +212,25 @@ gotdata(char *buf, size_t len)
 	return 0;
 }
 
+#if defined(SYS_getrandom) && defined(__NR_getrandom)
+static int
+getentropy_getrandom(void *buf, size_t len)
+{
+	int pre_errno = errno;
+	int ret;
+	if (len > 256)
+		return (-1);
+	do {
+		ret = syscall(SYS_getrandom, buf, len, 0);
+	} while (ret == -1 && errno == EINTR);
+
+	if (ret != (int)len)
+		return (-1);
+	errno = pre_errno;
+	return (0);
+}
+#endif
+
 static int
 getentropy_urandom(void *buf, size_t len)
 {
@@ -251,7 +304,7 @@ getentropy_sysctl(void *buf, size_t len)
 		struct __sysctl_args args = {
 			.name = mib,
 			.nlen = 3,
-			.oldval = buf + i,
+			.oldval = (char *)buf + i,
 			.oldlenp = &chunk,
 		};
 		if (syscall(SYS__sysctl, &args) != 0)
@@ -304,7 +357,7 @@ getentropy_fallback(void *buf, size_t len)
 	struct rusage ru;
 	sigset_t sigset;
 	struct stat st;
-	SHA512_CTX ctx;
+	CRYPTO_SHA512_CTX ctx;
 	static pid_t lastpid;
 	pid_t pid;
 	size_t i, ii, m;
@@ -321,7 +374,7 @@ getentropy_fallback(void *buf, size_t len)
 	}
 	for (i = 0; i < len; ) {
 		int j;
-		SHA512_Init(&ctx);
+		CRYPTO_SHA512_INIT(&ctx);
 		for (j = 0; j < repeat; j++) {
 			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
 			if (e != -1) {
@@ -474,24 +527,26 @@ getentropy_fallback(void *buf, size_t len)
 
 			HD(cnt);
 		}
-#ifdef AT_RANDOM
+#ifdef HAVE_GETAUXVAL
+#  ifdef AT_RANDOM
 		/* Not as random as you think but we take what we are given */
 		p = (char *) getauxval(AT_RANDOM);
 		if (p)
 			HR(p, 16);
-#endif
-#ifdef AT_SYSINFO_EHDR
+#  endif
+#  ifdef AT_SYSINFO_EHDR
 		p = (char *) getauxval(AT_SYSINFO_EHDR);
 		if (p)
 			HR(p, pgs);
-#endif
-#ifdef AT_BASE
+#  endif
+#  ifdef AT_BASE
 		p = (char *) getauxval(AT_BASE);
 		if (p)
 			HD(p);
-#endif
+#  endif
+#endif /* HAVE_GETAUXVAL */
 
-		SHA512_Final(results, &ctx);
+		CRYPTO_SHA512_FINAL(results, &ctx);
 		memcpy((char*)buf + i, results, min(sizeof(results), len - i));
 		i += min(sizeof(results), len - i);
 	}

compat/getentropy_solaris.c

@@ -30,7 +30,9 @@
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <stdlib.h>
+#ifdef HAVE_STDINT_H
 #include <stdint.h>
+#endif
 #include <stdio.h>
 #include <termios.h>
 #include <fcntl.h>
@@ -39,10 +41,14 @@
 #include <errno.h>
 #include <unistd.h>
 #include <time.h>
+#ifdef HAVE_SYS_SHA2_H
 #include <sys/sha2.h>
 #define SHA512_Init SHA512Init
 #define SHA512_Update SHA512Update
 #define SHA512_Final SHA512Final
+#else
+#include "openssl/sha.h"
+#endif
 
 #include <sys/vfs.h>
 #include <sys/statfs.h>

compat/isblank.c

@@ -0,0 +1,45 @@
+/* isblank - compatibility implementation of isblank
+ *
+ * Copyright (c) 2015, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+/* return true for a blank character: space or tab */
+int isblank(int c);
+
+/* implementation of isblank. unsigned char is the argument */
+int
+isblank(int c)
+{
+	return (c==' ' || c=='\t');
+}

compat/reallocarray.c

@@ -0,0 +1,42 @@
+/*	$OpenBSD: reallocarray.c,v 1.1 2014/05/08 21:43:49 deraadt Exp $	*/
+/*
+ * Copyright (c) 2008 Otto Moerbeek <otto@drijf.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "config.h"
+#include <sys/types.h>
+#include <errno.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <limits.h>
+#include <stdlib.h>
+
+/*
+ * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX
+ * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW
+ */
+#define MUL_NO_OVERFLOW	((size_t)1 << (sizeof(size_t) * 4))
+
+void *
+reallocarray(void *optr, size_t nmemb, size_t size)
+{
+	if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
+	    nmemb > 0 && SIZE_MAX / nmemb < size) {
+		errno = ENOMEM;
+		return NULL;
+	}
+	return realloc(optr, size * nmemb);
+}

compat/sha512.c

@@ -70,7 +70,7 @@ unsigned char *SHA512(void *data, unsigned int data_len, unsigned char *digest);
  * Please make sure that your system defines BYTE_ORDER.  If your
  * architecture is little-endian, make sure it also defines
  * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are
- * equivilent.
+ * equivalent.
  *
  * If your system does not define the above, then you can do so by
  * hand like this:

compat/snprintf.c

@@ -42,6 +42,7 @@
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
 #endif
+#include <limits.h>
 
 /* for test */
 /* #define SNPRINTF_TEST 1 */
@@ -428,7 +429,7 @@ print_num_llp(char** at, size_t* left, int* ret, void* value,
 	char buf[PRINT_DEC_BUFSZ];
 	int negative = 0;
 	int zero = (value == 0);
-#if defined(UINTPTR_MAX) && defined(UINT32_MAX) && (UINTPTR_MAX == UINT32_MAX)
+#if defined(SIZE_MAX) && defined(UINT32_MAX) && (UINT32_MAX == SIZE_MAX || INT32_MAX == SIZE_MAX)
 	/* avoid warning about upcast on 32bit systems */
 	unsigned long long llvalue = (unsigned long)value;
 #else

compat/strsep.c

@@ -0,0 +1,65 @@
+/** 
+ * strsep implementation for compatibility.
+ *
+  * LICENSE
+  * Copyright (c) 2016, NLnet Labs
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions are met:
+  * * Redistributions of source code must retain the above copyright notice,
+  *     this list of conditions and the following disclaimer.
+  * * Redistributions in binary form must reproduce the above copyright
+  *   notice, this list of conditions and the following disclaimer in the
+  *   documentation and/or other materials provided with the distribution.
+  * * Neither the name of NLnetLabs nor the names of its
+  *   contributors may be used to endorse or promote products derived from this
+  *   software without specific prior written permission.
+  *
+  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+  * POSSIBILITY OF SUCH DAMAGE.
+ **/
+
+#include "config.h"
+
+/** see if character is in the delimiter array */
+static int
+in_delim(char c, const char* delim)
+{
+	const char* p;
+	if(!delim)
+		return 0;
+	for(p=delim; *p; p++) {
+		if(*p == c)
+			return 1;
+	}
+	return 0;
+}
+
+char *strsep(char **stringp, const char *delim)
+{
+	char* s;
+	char* orig;
+	if(stringp == NULL || *stringp == NULL)
+		return NULL;
+	orig = *stringp;
+	s = *stringp;
+	while(*s && !in_delim(*s, delim))
+		s++;
+	if(*s) {
+		*s = 0;
+		*stringp = s+1;
+	} else {
+		*stringp = NULL;
+	}
+	return orig;
+}

config.guess

@@ -1,14 +1,12 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
-#   2011, 2012 Free Software Foundation, Inc.
+#   Copyright 1992-2013 Free Software Foundation, Inc.
 
-timestamp='2012-06-10'
+timestamp='2013-06-10'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
+# the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful, but
@@ -22,19 +20,17 @@ timestamp='2012-06-10'
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
-
-
-# Originally written by Per Bothner.  Please send patches (context
-# diff format) to <config-patches@gnu.org> and include a ChangeLog
-# entry.
+# the same distribution terms that you use for the rest of that
+# program.  This Exception is an additional permission under section 7
+# of the GNU General Public License, version 3 ("GPLv3").
 #
-# This script attempts to guess a canonical system name similar to
-# config.sub.  If it succeeds, it prints the system name on stdout, and
-# exits with 0.  Otherwise, it exits with 1.
+# Originally written by Per Bothner.
 #
 # You can get the latest version of this script from:
 # http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+#
+# Please send patches with a ChangeLog entry to config-patches@gnu.org.
+
 
 me=`echo "$0" | sed -e 's,.*/,,'`
 
@@ -54,9 +50,7 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000,
-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012
-Free Software Foundation, Inc.
+Copyright 1992-2013 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -138,6 +132,27 @@ UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
 UNAME_SYSTEM=`(uname -s) 2>/dev/null`  || UNAME_SYSTEM=unknown
 UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
 
+case "${UNAME_SYSTEM}" in
+Linux|GNU|GNU/*)
+	# If the system lacks a compiler, then just pick glibc.
+	# We could probably try harder.
+	LIBC=gnu
+
+	eval $set_cc_for_build
+	cat <<-EOF > $dummy.c
+	#include <features.h>
+	#if defined(__UCLIBC__)
+	LIBC=uclibc
+	#elif defined(__dietlibc__)
+	LIBC=dietlibc
+	#else
+	LIBC=gnu
+	#endif
+	EOF
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
+	;;
+esac
+
 # Note: order is significant - the case branches are not exclusive.
 
 case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
@@ -200,6 +215,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
 	echo "${machine}-${os}${release}"
 	exit ;;
+    *:Bitrig:*:*)
+	UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'`
+	echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE}
+	exit ;;
     *:OpenBSD:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
 	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
@@ -302,7 +321,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
 	echo arm-acorn-riscix${UNAME_RELEASE}
 	exit ;;
-    arm:riscos:*:*|arm:RISCOS:*:*)
+    arm*:riscos:*:*|arm*:RISCOS:*:*)
 	echo arm-unknown-riscos
 	exit ;;
     SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
@@ -801,6 +820,9 @@ EOF
     i*:CYGWIN*:*)
 	echo ${UNAME_MACHINE}-pc-cygwin
 	exit ;;
+    *:MINGW64*:*)
+	echo ${UNAME_MACHINE}-pc-mingw64
+	exit ;;
     *:MINGW*:*)
 	echo ${UNAME_MACHINE}-pc-mingw32
 	exit ;;
@@ -852,21 +874,21 @@ EOF
 	exit ;;
     *:GNU:*:*)
 	# the GNU system
-	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
+	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
 	exit ;;
     *:GNU/*:*:*)
 	# other systems with GNU libc and userland
-	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-gnu
+	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
 	exit ;;
     i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
 	exit ;;
     aarch64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     aarch64_be:Linux:*:*)
 	UNAME_MACHINE=aarch64_be
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     alpha:Linux:*:*)
 	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
@@ -879,59 +901,54 @@ EOF
 	  EV68*) UNAME_MACHINE=alphaev68 ;;
 	esac
 	objdump --private-headers /bin/sh | grep -q ld.so.1
-	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
-	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
+	if test "$?" = 0 ; then LIBC="gnulibc1" ; fi
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    arc:Linux:*:* | arceb:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     arm*:Linux:*:*)
 	eval $set_cc_for_build
 	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
 	    | grep -q __ARM_EABI__
 	then
-	    echo ${UNAME_MACHINE}-unknown-linux-gnu
+	    echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	else
 	    if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
 		| grep -q __ARM_PCS_VFP
 	    then
-		echo ${UNAME_MACHINE}-unknown-linux-gnueabi
+		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi
 	    else
-		echo ${UNAME_MACHINE}-unknown-linux-gnueabihf
+		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf
 	    fi
 	fi
 	exit ;;
     avr32*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     cris:Linux:*:*)
-	echo ${UNAME_MACHINE}-axis-linux-gnu
+	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
 	exit ;;
     crisv32:Linux:*:*)
-	echo ${UNAME_MACHINE}-axis-linux-gnu
+	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
 	exit ;;
     frv:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     hexagon:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     i*86:Linux:*:*)
-	LIBC=gnu
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#ifdef __dietlibc__
-	LIBC=dietlibc
-	#endif
-EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
-	echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
+	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
 	exit ;;
     ia64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     m32r*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     m68*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     mips:Linux:*:* | mips64:Linux:*:*)
 	eval $set_cc_for_build
@@ -950,54 +967,63 @@ EOF
 	#endif
 EOF
 	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
-	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
+	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
 	;;
+    or1k:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     or32:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     padre:Linux:*:*)
-	echo sparc-unknown-linux-gnu
+	echo sparc-unknown-linux-${LIBC}
 	exit ;;
     parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-gnu
+	echo hppa64-unknown-linux-${LIBC}
 	exit ;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
-	  PA7*) echo hppa1.1-unknown-linux-gnu ;;
-	  PA8*) echo hppa2.0-unknown-linux-gnu ;;
-	  *)    echo hppa-unknown-linux-gnu ;;
+	  PA7*) echo hppa1.1-unknown-linux-${LIBC} ;;
+	  PA8*) echo hppa2.0-unknown-linux-${LIBC} ;;
+	  *)    echo hppa-unknown-linux-${LIBC} ;;
 	esac
 	exit ;;
     ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-gnu
+	echo powerpc64-unknown-linux-${LIBC}
 	exit ;;
     ppc:Linux:*:*)
-	echo powerpc-unknown-linux-gnu
+	echo powerpc-unknown-linux-${LIBC}
+	exit ;;
+    ppc64le:Linux:*:*)
+	echo powerpc64le-unknown-linux-${LIBC}
+	exit ;;
+    ppcle:Linux:*:*)
+	echo powerpcle-unknown-linux-${LIBC}
 	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
-	echo ${UNAME_MACHINE}-ibm-linux
+	echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
 	exit ;;
     sh64*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     sh*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     sparc:Linux:*:* | sparc64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     tile*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     vax:Linux:*:*)
-	echo ${UNAME_MACHINE}-dec-linux-gnu
+	echo ${UNAME_MACHINE}-dec-linux-${LIBC}
 	exit ;;
     x86_64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     xtensa*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
@@ -1201,6 +1227,9 @@ EOF
     BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
 	echo i586-pc-haiku
 	exit ;;
+    x86_64:Haiku:*:*)
+	echo x86_64-unknown-haiku
+	exit ;;
     SX-4:SUPER-UX:*:*)
 	echo sx4-nec-superux${UNAME_RELEASE}
 	exit ;;
@@ -1227,19 +1256,21 @@ EOF
 	exit ;;
     *:Darwin:*:*)
 	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
-	case $UNAME_PROCESSOR in
-	    i386)
-		eval $set_cc_for_build
-		if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
-		  if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
-		      (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
-		      grep IS_64BIT_ARCH >/dev/null
-		  then
-		      UNAME_PROCESSOR="x86_64"
-		  fi
-		fi ;;
-	    unknown) UNAME_PROCESSOR=powerpc ;;
-	esac
+	eval $set_cc_for_build
+	if test "$UNAME_PROCESSOR" = unknown ; then
+	    UNAME_PROCESSOR=powerpc
+	fi
+	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+	    if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		grep IS_64BIT_ARCH >/dev/null
+	    then
+		case $UNAME_PROCESSOR in
+		    i386) UNAME_PROCESSOR=x86_64 ;;
+		    powerpc) UNAME_PROCESSOR=powerpc64 ;;
+		esac
+	    fi
+	fi
 	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
 	exit ;;
     *:procnto*:*:* | *:QNX:[0123456789]*:*)
@@ -1330,9 +1361,6 @@ EOF
 	exit ;;
 esac
 
-#echo '(No uname command or uname output not recognized.)' 1>&2
-#echo "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" 1>&2
-
 eval $set_cc_for_build
 cat >$dummy.c <<EOF
 #ifdef _SEQUENT_

config.h.in

@@ -3,6 +3,9 @@
 /* Directory to chroot to */
 #undef CHROOT_DIR
 
+/* Define this to enable client subnet option. */
+#undef CLIENT_SUBNET
+
 /* Do sha512 definitions in config.h */
 #undef COMPAT_SHA512
 
@@ -42,12 +45,18 @@
 /* Whether the C compiler accepts the "unused" attribute */
 #undef HAVE_ATTR_UNUSED
 
-/* Define to 1 if your system has a working `chown' function. */
+/* Whether the C compiler accepts the "weak" attribute */
+#undef HAVE_ATTR_WEAK
+
+/* Define to 1 if you have the `chown' function. */
 #undef HAVE_CHOWN
 
 /* Define to 1 if you have the `chroot' function. */
 #undef HAVE_CHROOT
 
+/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
+#undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
+
 /* Define to 1 if you have the `ctime_r' function. */
 #undef HAVE_CTIME_R
 
@@ -62,6 +71,14 @@
    if you don't. */
 #undef HAVE_DECL_ARC4RANDOM_UNIFORM
 
+/* Define to 1 if you have the declaration of `inet_ntop', and to 0 if you
+   don't. */
+#undef HAVE_DECL_INET_NTOP
+
+/* Define to 1 if you have the declaration of `inet_pton', and to 0 if you
+   don't. */
+#undef HAVE_DECL_INET_PTON
+
 /* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
    don't. */
 #undef HAVE_DECL_NID_SECP384R1
@@ -70,6 +87,10 @@
    if you don't. */
 #undef HAVE_DECL_NID_X9_62_PRIME256V1
 
+/* Define to 1 if you have the declaration of `reallocarray', and to 0 if you
+   don't. */
+#undef HAVE_DECL_REALLOCARRAY
+
 /* Define to 1 if you have the declaration of `sk_SSL_COMP_pop_free', and to 0
    if you don't. */
 #undef HAVE_DECL_SK_SSL_COMP_POP_FREE
@@ -78,6 +99,10 @@
    `SSL_COMP_get_compression_methods', and to 0 if you don't. */
 #undef HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 
+/* Define to 1 if you have the declaration of `SSL_CTX_set_ecdh_auto', and to
+   0 if you don't. */
+#undef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO
+
 /* Define to 1 if you have the declaration of `strlcat', and to 0 if you
    don't. */
 #undef HAVE_DECL_STRLCAT
@@ -86,18 +111,34 @@
    don't. */
 #undef HAVE_DECL_STRLCPY
 
+/* Define to 1 if you have the declaration of `XML_StopParser', and to 0 if
+   you don't. */
+#undef HAVE_DECL_XML_STOPPARSER
+
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
+/* Define to 1 if you have the `DSA_SIG_set0' function. */
+#undef HAVE_DSA_SIG_SET0
+
 /* Define to 1 if you have the <endian.h> header file. */
 #undef HAVE_ENDIAN_H
 
 /* Define to 1 if you have the `endprotoent' function. */
 #undef HAVE_ENDPROTOENT
 
+/* Define to 1 if you have the `endpwent' function. */
+#undef HAVE_ENDPWENT
+
 /* Define to 1 if you have the `endservent' function. */
 #undef HAVE_ENDSERVENT
 
+/* Define to 1 if you have the `ERR_free_strings' function. */
+#undef HAVE_ERR_FREE_STRINGS
+
+/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
+#undef HAVE_ERR_LOAD_CRYPTO_STRINGS
+
 /* Define to 1 if you have the `event_base_free' function. */
 #undef HAVE_EVENT_BASE_FREE
 
@@ -113,6 +154,15 @@
 /* Define to 1 if you have the <event.h> header file. */
 #undef HAVE_EVENT_H
 
+/* Define to 1 if you have the `EVP_cleanup' function. */
+#undef HAVE_EVP_CLEANUP
+
+/* Define to 1 if you have the `EVP_dss1' function. */
+#undef HAVE_EVP_DSS1
+
+/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
+#undef HAVE_EVP_MD_CTX_NEW
+
 /* Define to 1 if you have the `EVP_sha1' function. */
 #undef HAVE_EVP_SHA1
 
@@ -143,9 +193,15 @@
 /* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
 #undef HAVE_FSEEKO
 
+/* Define to 1 if you have the `fsync' function. */
+#undef HAVE_FSYNC
+
 /* Whether getaddrinfo is available */
 #undef HAVE_GETADDRINFO
 
+/* Define to 1 if you have the `getauxval' function. */
+#undef HAVE_GETAUXVAL
+
 /* Define to 1 if you have the `getentropy' function. */
 #undef HAVE_GETENTROPY
 
@@ -170,8 +226,8 @@
 /* Define to 1 if you have the <grp.h> header file. */
 #undef HAVE_GRP_H
 
-/* If you have HMAC_CTX_init */
-#undef HAVE_HMAC_CTX_INIT
+/* If you have HMAC_Update */
+#undef HAVE_HMAC_UPDATE
 
 /* Define to 1 if you have the `inet_aton' function. */
 #undef HAVE_INET_ATON
@@ -194,6 +250,9 @@
 /* Define to 1 if you have the <iphlpapi.h> header file. */
 #undef HAVE_IPHLPAPI_H
 
+/* Define to 1 if you have the `isblank' function. */
+#undef HAVE_ISBLANK
+
 /* Define to 1 if you have the `kill' function. */
 #undef HAVE_KILL
 
@@ -221,24 +280,54 @@
 /* Define to 1 if you have the <netinet/in.h> header file. */
 #undef HAVE_NETINET_IN_H
 
+/* Define to 1 if you have the <netinet/tcp.h> header file. */
+#undef HAVE_NETINET_TCP_H
+
+/* Use libnettle for crypto */
+#undef HAVE_NETTLE
+
+/* Define to 1 if you have the <nettle/dsa-compat.h> header file. */
+#undef HAVE_NETTLE_DSA_COMPAT_H
+
 /* Use libnss for crypto */
 #undef HAVE_NSS
 
+/* Define to 1 if you have the `OpenSSL_add_all_digests' function. */
+#undef HAVE_OPENSSL_ADD_ALL_DIGESTS
+
+/* Define to 1 if you have the <openssl/bn.h> header file. */
+#undef HAVE_OPENSSL_BN_H
+
 /* Define to 1 if you have the `OPENSSL_config' function. */
 #undef HAVE_OPENSSL_CONFIG
 
 /* Define to 1 if you have the <openssl/conf.h> header file. */
 #undef HAVE_OPENSSL_CONF_H
 
+/* Define to 1 if you have the <openssl/dh.h> header file. */
+#undef HAVE_OPENSSL_DH_H
+
+/* Define to 1 if you have the <openssl/dsa.h> header file. */
+#undef HAVE_OPENSSL_DSA_H
+
 /* Define to 1 if you have the <openssl/engine.h> header file. */
 #undef HAVE_OPENSSL_ENGINE_H
 
 /* Define to 1 if you have the <openssl/err.h> header file. */
 #undef HAVE_OPENSSL_ERR_H
 
+/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
+#undef HAVE_OPENSSL_INIT_CRYPTO
+
+/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
+#undef HAVE_OPENSSL_INIT_SSL
+
 /* Define to 1 if you have the <openssl/rand.h> header file. */
 #undef HAVE_OPENSSL_RAND_H
 
+/* Define to 1 if you have the <openssl/rsa.h> header file. */
+#undef HAVE_OPENSSL_RSA_H
+
 /* Define to 1 if you have the <openssl/ssl.h> header file. */
 #undef HAVE_OPENSSL_SSL_H
 
@@ -263,12 +352,15 @@
 /* Define to 1 if you have the `random' function. */
 #undef HAVE_RANDOM
 
+/* Define to 1 if you have the `RAND_cleanup' function. */
+#undef HAVE_RAND_CLEANUP
+
+/* Define to 1 if you have the `reallocarray' function. */
+#undef HAVE_REALLOCARRAY
+
 /* Define to 1 if you have the `recvmsg' function. */
 #undef HAVE_RECVMSG
 
-/* Define to 1 if you have the `sbrk' function. */
-#undef HAVE_SBRK
-
 /* Define to 1 if you have the `sendmsg' function. */
 #undef HAVE_SENDMSG
 
@@ -296,6 +388,9 @@
 /* Define to 1 if you have the `SHA512_Update' function. */
 #undef HAVE_SHA512_UPDATE
 
+/* Define to 1 if you have the `shmget' function. */
+#undef HAVE_SHMGET
+
 /* Define to 1 if you have the `sigprocmask' function. */
 #undef HAVE_SIGPROCMASK
 
@@ -317,6 +412,9 @@
 /* Define if you have the SSL libraries installed. */
 #undef HAVE_SSL
 
+/* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
+#undef HAVE_SSL_CTX_SET_SECURITY_LEVEL
+
 /* Define to 1 if you have the <stdarg.h> header file. */
 #undef HAVE_STDARG_H
 
@@ -347,15 +445,27 @@
 /* Define to 1 if you have the `strptime' function. */
 #undef HAVE_STRPTIME
 
+/* Define to 1 if you have the `strsep' function. */
+#undef HAVE_STRSEP
+
 /* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
 #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST
 
+/* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
+#undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
+
 /* Define if you have Swig libraries and header files. */
 #undef HAVE_SWIG
 
 /* Define to 1 if you have the <syslog.h> header file. */
 #undef HAVE_SYSLOG_H
 
+/* Define to 1 if systemd should be used */
+#undef HAVE_SYSTEMD
+
+/* Define to 1 if you have the <sys/ipc.h> header file. */
+#undef HAVE_SYS_IPC_H
+
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H
 
@@ -365,6 +475,9 @@
 /* Define to 1 if you have the <sys/sha2.h> header file. */
 #undef HAVE_SYS_SHA2_H
 
+/* Define to 1 if you have the <sys/shm.h> header file. */
+#undef HAVE_SYS_SHM_H
+
 /* Define to 1 if you have the <sys/socket.h> header file. */
 #undef HAVE_SYS_SOCKET_H
 
@@ -380,6 +493,9 @@
 /* Define to 1 if you have the <sys/uio.h> header file. */
 #undef HAVE_SYS_UIO_H
 
+/* Define to 1 if you have the <sys/un.h> header file. */
+#undef HAVE_SYS_UN_H
+
 /* Define to 1 if you have the <sys/wait.h> header file. */
 #undef HAVE_SYS_WAIT_H
 
@@ -428,8 +544,7 @@
 /* if lex has yylex_destroy */
 #undef LEX_HAS_YYLEX_DESTROY
 
-/* Define to the sub-directory in which libtool stores uninstalled libraries.
-   */
+/* Define to the sub-directory where libtool stores uninstalled libraries. */
 #undef LT_OBJDIR
 
 /* Define to the maximum message length to pass to syslog. */
@@ -451,6 +566,9 @@
 /* Put -D_BSD_SOURCE define in config.h */
 #undef OMITTED__D_BSD_SOURCE
 
+/* Put -D_DEFAULT_SOURCE define in config.h */
+#undef OMITTED__D_DEFAULT_SOURCE
+
 /* Put -D_GNU_SOURCE define in config.h */
 #undef OMITTED__D_GNU_SOURCE
 
@@ -515,6 +633,9 @@
 /* The size of `time_t', as computed by sizeof. */
 #undef SIZEOF_TIME_T
 
+/* define if (v)snprintf does not return length needed, (but length used) */
+#undef SNPRINTF_RET_BROKEN
+
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 
@@ -539,9 +660,18 @@
 /* define this to enable debug checks. */
 #undef UNBOUND_DEBUG
 
+/* Define to 1 to use cachedb support */
+#undef USE_CACHEDB
+
+/* Define to 1 to enable dnscrypt support */
+#undef USE_DNSCRYPT
+
 /* Define to 1 to enable dnstap support */
 #undef USE_DNSTAP
 
+/* Define this to enable DSA support. */
+#undef USE_DSA
+
 /* Define this to enable ECDSA support. */
 #undef USE_ECDSA
 
@@ -554,6 +684,15 @@
 /* Define if you want to use internal select based events */
 #undef USE_MINI_EVENT
 
+/* Define this to enable client TCP Fast Open. */
+#undef USE_MSG_FASTOPEN
+
+/* Define this to enable client TCP Fast Open. */
+#undef USE_OSX_MSG_FASTOPEN
+
+/* Define this to enable SHA1 support. */
+#undef USE_SHA1
+
 /* Define this to enable SHA256 and SHA512 support. */
 #undef USE_SHA2
 
@@ -579,6 +718,9 @@
 #endif
 
 
+/* Define this to enable server TCP Fast Open. */
+#undef USE_TCP_FASTOPEN
+
 /* Whether the windows socket API is used */
 #undef USE_WINSOCK
 
@@ -702,6 +844,10 @@
 #define _BSD_SOURCE 1
 #endif 
 
+#if defined(OMITTED__D_DEFAULT_SOURCE) && !defined(_DEFAULT_SOURCE)
+#define _DEFAULT_SOURCE 1
+#endif 
+
 #if defined(OMITTED__D__EXTENSIONS__) && !defined(__EXTENSIONS__)
 #define __EXTENSIONS__ 1
 #endif 
@@ -775,6 +921,10 @@
 #include <netinet/in.h>
 #endif
 
+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
@@ -793,6 +943,10 @@
 #define ARG_LL "%I64"
 #endif
 
+#ifndef AF_LOCAL
+#define AF_LOCAL AF_UNIX
+#endif
+
 
  
 #ifdef HAVE_ATTR_FORMAT
@@ -824,15 +978,13 @@
 #define MAXHOSTNAMELEN 256
 #endif
 
-
-#ifndef HAVE_SNPRINTF
+#if !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN)
 #define snprintf snprintf_unbound
 #define vsnprintf vsnprintf_unbound
 #include <stdarg.h>
 int snprintf (char *str, size_t count, const char *fmt, ...);
 int vsnprintf (char *str, size_t count, const char *fmt, va_list arg);
-#endif /* HAVE_SNPRINTF */
-
+#endif /* HAVE_SNPRINTF or SNPRINTF_RET_BROKEN */
 
 #ifndef HAVE_INET_PTON
 #define inet_pton inet_pton_unbound
@@ -876,6 +1028,12 @@ struct tm *gmtime_r(const time_t *timep, struct tm *result);
 #endif
 
 
+#ifndef HAVE_REALLOCARRAY
+#define reallocarray reallocarrayunbound
+void* reallocarray(void *ptr, size_t nmemb, size_t size);
+#endif
+
+
 #if !defined(HAVE_SLEEP) || defined(HAVE_WINDOWS_H)
 #define sleep(x) Sleep((x)*1000) /* on win32 */
 #endif /* HAVE_SLEEP */
@@ -922,6 +1080,24 @@ int memcmp(const void *x, const void *y, size_t n);
 char *ctime_r(const time_t *timep, char *buf);
 #endif
 
+#ifndef HAVE_STRSEP
+#define strsep unbound_strsep
+char *strsep(char **stringp, const char *delim);
+#endif
+
+#ifndef HAVE_ISBLANK
+#define isblank unbound_isblank
+int isblank(int c);
+#endif
+
+#if defined(HAVE_INET_NTOP) && !HAVE_DECL_INET_NTOP
+const char *inet_ntop(int af, const void *src, char *dst, size_t size);
+#endif
+
+#if defined(HAVE_INET_PTON) && !HAVE_DECL_INET_PTON
+int inet_pton(int af, const char* src, void* dst);
+#endif
+
 #if !defined(HAVE_STRPTIME) || !defined(STRPTIME_WORKS)
 #define strptime unbound_strptime
 struct tm;
@@ -941,6 +1117,9 @@ uint32_t arc4random(void);
 #  if !HAVE_DECL_ARC4RANDOM_UNIFORM && defined(HAVE_ARC4RANDOM_UNIFORM)
 uint32_t arc4random_uniform(uint32_t upper_bound);
 #  endif
+#  if !HAVE_DECL_REALLOCARRAY
+void *reallocarray(void *ptr, size_t nmemb, size_t size);
+#  endif
 #endif /* HAVE_LIBRESSL */
 #ifndef HAVE_ARC4RANDOM
 void explicit_bzero(void* buf, size_t len);

config.sub

@@ -1,24 +1,18 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
-#   2011, 2012 Free Software Foundation, Inc.
+#   Copyright 1992-2013 Free Software Foundation, Inc.
 
-timestamp='2012-04-18'
+timestamp='2013-08-10'
 
-# This file is (in principle) common to ALL GNU software.
-# The presence of a machine in this file suggests that SOME GNU software
-# can handle that machine.  It does not imply ALL GNU software can.
-#
-# This file is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
+# This file is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <http://www.gnu.org/licenses/>.
@@ -26,11 +20,12 @@ timestamp='2012-04-18'
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
+# the same distribution terms that you use for the rest of that
+# program.  This Exception is an additional permission under section 7
+# of the GNU General Public License, version 3 ("GPLv3").
 
 
-# Please send patches to <config-patches@gnu.org>.  Submit a context
-# diff and a properly formatted GNU ChangeLog entry.
+# Please send patches with a ChangeLog entry to config-patches@gnu.org.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
 # Supply the specified configuration type as an argument.
@@ -73,9 +68,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000,
-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012
-Free Software Foundation, Inc.
+Copyright 1992-2013 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -123,7 +116,7 @@ esac
 maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
   nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
-  linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
+  linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
   knetbsd*-gnu* | netbsd*-gnu* | \
   kopensolaris*-gnu* | \
   storm-chaos* | os2-emx* | rtmk-nova*)
@@ -156,7 +149,7 @@ case $os in
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis | -knuth | -cray | -microblaze)
+	-apple | -axis | -knuth | -cray | -microblaze*)
 		os=
 		basic_machine=$1
 		;;
@@ -259,10 +252,12 @@ case $basic_machine in
 	| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \
 	| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
 	| am33_2.0 \
-	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr | avr32 \
-        | be32 | be64 \
+	| arc | arceb \
+	| arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \
+	| avr | avr32 \
+	| be32 | be64 \
 	| bfin \
-	| c4x | clipper \
+	| c4x | c8051 | clipper \
 	| d10v | d30v | dlx | dsp16xx \
 	| epiphany \
 	| fido | fr30 | frv \
@@ -273,7 +268,7 @@ case $basic_machine in
 	| le32 | le64 \
 	| lm32 \
 	| m32c | m32r | m32rle | m68000 | m68k | m88k \
-	| maxq | mb | microblaze | mcore | mep | metag \
+	| maxq | mb | microblaze | microblazeel | mcore | mep | metag \
 	| mips | mipsbe | mipseb | mipsel | mipsle \
 	| mips16 \
 	| mips64 | mips64el \
@@ -291,16 +286,17 @@ case $basic_machine in
 	| mipsisa64r2 | mipsisa64r2el \
 	| mipsisa64sb1 | mipsisa64sb1el \
 	| mipsisa64sr71k | mipsisa64sr71kel \
+	| mipsr5900 | mipsr5900el \
 	| mipstx39 | mipstx39el \
 	| mn10200 | mn10300 \
 	| moxie \
 	| mt \
 	| msp430 \
 	| nds32 | nds32le | nds32be \
-	| nios | nios2 \
+	| nios | nios2 | nios2eb | nios2el \
 	| ns16k | ns32k \
 	| open8 \
-	| or32 \
+	| or1k | or32 \
 	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle \
 	| pyramid \
@@ -370,13 +366,13 @@ case $basic_machine in
 	| aarch64-* | aarch64_be-* \
 	| alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \
 	| alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \
-	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* \
+	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \
 	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
 	| avr-* | avr32-* \
 	| be32-* | be64-* \
 	| bfin-* | bs2000-* \
 	| c[123]* | c30-* | [cjt]90-* | c4x-* \
-	| clipper-* | craynv-* | cydra-* \
+	| c8051-* | clipper-* | craynv-* | cydra-* \
 	| d10v-* | d30v-* | dlx-* \
 	| elxsi-* \
 	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
@@ -389,7 +385,8 @@ case $basic_machine in
 	| lm32-* \
 	| m32c-* | m32r-* | m32rle-* \
 	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* | microblaze-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
+	| microblaze-* | microblazeel-* \
 	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
 	| mips16-* \
 	| mips64-* | mips64el-* \
@@ -407,12 +404,13 @@ case $basic_machine in
 	| mipsisa64r2-* | mipsisa64r2el-* \
 	| mipsisa64sb1-* | mipsisa64sb1el-* \
 	| mipsisa64sr71k-* | mipsisa64sr71kel-* \
+	| mipsr5900-* | mipsr5900el-* \
 	| mipstx39-* | mipstx39el-* \
 	| mmix-* \
 	| mt-* \
 	| msp430-* \
 	| nds32-* | nds32le-* | nds32be-* \
-	| nios-* | nios2-* \
+	| nios-* | nios2-* | nios2eb-* | nios2el-* \
 	| none-* | np1-* | ns16k-* | ns32k-* \
 	| open8-* \
 	| orion-* \
@@ -788,11 +786,15 @@ case $basic_machine in
 		basic_machine=ns32k-utek
 		os=-sysv
 		;;
-	microblaze)
+	microblaze*)
 		basic_machine=microblaze-xilinx
 		;;
+	mingw64)
+		basic_machine=x86_64-pc
+		os=-mingw64
+		;;
 	mingw32)
-		basic_machine=i386-pc
+		basic_machine=i686-pc
 		os=-mingw32
 		;;
 	mingw32ce)
@@ -828,7 +830,7 @@ case $basic_machine in
 		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
 		;;
 	msys)
-		basic_machine=i386-pc
+		basic_machine=i686-pc
 		os=-msys
 		;;
 	mvs)
@@ -1004,7 +1006,7 @@ case $basic_machine in
 		;;
 	ppc64)	basic_machine=powerpc64-unknown
 		;;
-	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
+	ppc64-* | ppc64p7-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
 		basic_machine=powerpc64le-unknown
@@ -1019,7 +1021,11 @@ case $basic_machine in
 		basic_machine=i586-unknown
 		os=-pw32
 		;;
-	rdos)
+	rdos | rdos64)
+		basic_machine=x86_64-pc
+		os=-rdos
+		;;
+	rdos32)
 		basic_machine=i386-pc
 		os=-rdos
 		;;
@@ -1346,21 +1352,21 @@ case $os in
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
 	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
 	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
-	      | -sym* | -kopensolaris* \
+	      | -sym* | -kopensolaris* | -plan9* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
 	      | -aos* | -aros* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
 	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
-	      | -openbsd* | -solidbsd* \
+	      | -bitrig* | -openbsd* | -solidbsd* \
 	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
 	      | -chorusos* | -chorusrdb* | -cegcc* \
 	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -linux-gnu* | -linux-android* \
-	      | -linux-newlib* | -linux-uclibc* \
+	      | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
+	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* \
 	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
@@ -1492,9 +1498,6 @@ case $os in
 	-aros*)
 		os=-aros
 		;;
-	-kaos*)
-		os=-kaos
-		;;
 	-zvmoe)
 		os=-zvmoe
 		;;
@@ -1543,6 +1546,9 @@ case $basic_machine in
 	c4x-* | tic4x-*)
 		os=-coff
 		;;
+	c8051-*)
+		os=-elf
+		;;
 	hexagon-*)
 		os=-elf
 		;;
@@ -1586,6 +1592,9 @@ case $basic_machine in
 	mips*-*)
 		os=-elf
 		;;
+	or1k-*)
+		os=-elf
+		;;
 	or32-*)
 		os=-coff
 		;;

configure.ac

@@ -6,19 +6,20 @@ sinclude(ax_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 sinclude(dnstap/dnstap.m4)
+sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[5])
-m4_define([VERSION_MICRO],[1])
+m4_define([VERSION_MINOR],[6])
+m4_define([VERSION_MICRO],[2])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
-LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=3
-LIBUNBOUND_AGE=3
+LIBUNBOUND_CURRENT=7
+LIBUNBOUND_REVISION=1
+LIBUNBOUND_AGE=5
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
 # 1.0.2 had 0:14:0
@@ -57,7 +58,19 @@ LIBUNBOUND_AGE=3
 # 1.4.21 had 4:1:2
 # 1.4.22 had 4:1:2
 # 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
-# 1.5.1 had 5:4:3
+# 1.5.1 had 5:3:3
+# 1.5.2 had 5:5:3
+# 1.5.3 had 5:6:3
+# 1.5.4 had 5:7:3
+# 1.5.5 had 5:8:3
+# 1.5.6 had 5:9:3
+# 1.5.7 had 5:10:3
+# 1.5.8 had 6:0:4 # adds ub_ctx_set_stub
+# 1.5.9 had 6:1:4
+# 1.5.10 had 6:2:4
+# 1.6.0 had 6:3:4
+# 1.6.1 had 7:0:5 # ub_callback_t typedef renamed to ub_callback_type
+# 1.6.2 had 7:1:5
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -99,7 +112,7 @@ esac
 # are we on MinGW?
 if uname -s 2>&1 | grep MINGW32 >/dev/null; then on_mingw="yes"
 else 
-	if echo $target | grep mingw32 >/dev/null; then on_mingw="yes"
+	if echo $host $target | grep mingw32 >/dev/null; then on_mingw="yes"
 	else on_mingw="no"; fi
 fi
 
@@ -118,6 +131,8 @@ AC_ARG_WITH([conf_file],
 AC_SUBST(ub_conf_file)
 ACX_ESCAPE_BACKSLASH($ub_conf_file, hdr_config)
 AC_DEFINE_UNQUOTED(CONFIGFILE, ["$hdr_config"], [Pathname to the Unbound configuration file])
+ub_conf_dir=`AS_DIRNAME(["$ub_conf_file"])`
+AC_SUBST(ub_conf_dir)
 
 # Determine run, chroot directory and pidfile locations
 AC_ARG_WITH(run-dir, 
@@ -241,11 +256,36 @@ case "$debug_enabled" in
 		;;
 esac
 ACX_CHECK_FLTO
+ACX_CHECK_PIE
+ACX_CHECK_RELRO_NOW
 
 AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
 ACX_CHECK_UNUSED_ATTRIBUTE
 
+AC_DEFUN([CHECK_WEAK_ATTRIBUTE],
+[AC_REQUIRE([AC_PROG_CC])
+AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "weak" attribute)
+AC_CACHE_VAL(ac_cv_c_weak_attribute,
+[ac_cv_c_weak_attribute=no
+AC_TRY_COMPILE(
+[ #include <stdio.h>
+__attribute__((weak)) void f(int x) { printf("%d", x); }
+], [
+   f(1);
+],
+[ac_cv_c_weak_attribute="yes"],
+[ac_cv_c_weak_attribute="no"])
+])
+
+AC_MSG_RESULT($ac_cv_c_weak_attribute)
+if test $ac_cv_c_weak_attribute = yes; then
+  AC_DEFINE(HAVE_ATTR_WEAK, 1, [Whether the C compiler accepts the "weak" attribute])
+fi
+])dnl End of CHECK_WEAK_ATTRIBUTE
+
+CHECK_WEAK_ATTRIBUTE
+
 if test "$srcdir" != "."; then
 	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
@@ -266,7 +306,7 @@ AC_CHECK_TOOL(STRIP, strip)
 ACX_LIBTOOL_C_ONLY
 
 # Checks for header files.
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h sys/ipc.h sys/shm.h],,, [AC_INCLUDES_DEFAULT])
 
 # check for types.  
 # Using own tests for int64* because autoconf builtin only give 32bit.
@@ -407,6 +447,36 @@ if test x_$withval != x_no; then
 		CC="$PTHREAD_CC"
 		ub_have_pthreads=yes
 		AC_CHECK_TYPES([pthread_spinlock_t, pthread_rwlock_t],,,[#include <pthread.h>])
+
+		if echo "$CFLAGS" | $GREP -e "-pthread" >/dev/null; then
+		AC_MSG_CHECKING([if -pthread unused during linking])
+		# catch clang warning 'argument unused during compilation'
+		AC_LANG_CONFTEST([AC_LANG_SOURCE(AC_INCLUDES_DEFAULT
+[[
+int main(void) {return 0;}
+]])])
+		pthread_unused="yes"
+		# first compile
+		echo "$CC $CFLAGS -c conftest.c -o conftest.o" >&AS_MESSAGE_LOG_FD
+		$CC $CFLAGS -c conftest.c -o conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
+		if test $? = 0; then 
+			# then link
+			echo "$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest contest.o" >&AS_MESSAGE_LOG_FD
+			$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
+			if test $? -ne 0; then
+				AC_MSG_RESULT(yes)
+				CFLAGS=`echo "$CFLAGS" | sed -e 's/-pthread//'`
+				PTHREAD_CFLAGS_ONLY="-pthread"
+				AC_SUBST(PTHREAD_CFLAGS_ONLY)
+			else
+				AC_MSG_RESULT(no)
+			fi
+		else
+			AC_MSG_RESULT(no)
+		fi # endif cc successful
+		rm -f conftest conftest.c conftest.o
+		fi # endif -pthread in CFLAGS
+
 		])
 fi
 
@@ -470,15 +540,19 @@ if test x_$ub_test_python != x_no; then
 		AC_ERROR([Python version >= 2.4.0 is required])
 	fi
 
+      [PY_MAJOR_VERSION="`$PYTHON -c \"import sys; print(sys.version_info[0])\"`"]
+      AC_SUBST(PY_MAJOR_VERSION)
       # Have Python
       AC_DEFINE(HAVE_PYTHON,1,[Define if you have Python libraries and header files.])
       LIBS="$PYTHON_LDFLAGS $LIBS"
       CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
       ub_have_python=yes
+      PC_PY_DEPENDENCY="python"
+      AC_SUBST(PC_PY_DEPENDENCY)
 
       # Check for SWIG
       ub_have_swig=no
-      AC_PROG_SWIG
+      AC_PROG_SWIG(2.0.1)
       AC_MSG_CHECKING(SWIG)
       if test ! -x "$SWIG"; then
          AC_ERROR([failed to find swig tool, install it, or do not build Python module and PyUnbound])
@@ -551,27 +625,69 @@ AC_ARG_WITH([nss], AC_HELP_STRING([--with-nss=path],
 		CPPFLAGS="-I/usr/include/nspr4 $CPPFLAGS"
 	fi
         LIBS="$LIBS -lnss3 -lnspr4"
+	SSLLIB=""
+	]
+)
+
+# libnettle
+USE_NETTLE="no"
+AC_ARG_WITH([nettle], AC_HELP_STRING([--with-nettle=path],
+	[use libnettle as crypto library, installed at path.]),
+	[
+	USE_NETTLE="yes"
+	AC_DEFINE(HAVE_NETTLE, 1, [Use libnettle for crypto])
+	AC_CHECK_HEADERS([nettle/dsa-compat.h],,, [AC_INCLUDES_DEFAULT])
+	if test "$withval" != "" -a "$withval" != "yes"; then
+		CPPFLAGS="$CPPFLAGS -I$withval/include/nettle"
+		LDFLAGS="$LDFLAGS -L$withval/lib"
+		ACX_RUNTIME_PATH_ADD([$withval/lib])
+	else
+		CPPFLAGS="$CPPFLAGS -I/usr/include/nettle"
+	fi
+        LIBS="$LIBS -lhogweed -lnettle -lgmp"
+	SSLLIB=""
 	]
 )
 
 # openssl
-if test $USE_NSS = "no"; then
+if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
 ACX_WITH_SSL
 ACX_LIB_SSL
+SSLLIB="-lssl"
+
+# check if -lcrypt32 is needed because CAPIENG needs that. (on windows)
+BAKLIBS="$LIBS"
+LIBS="-lssl $LIBS"
+AC_MSG_CHECKING([if libssl needs -lcrypt32])
+AC_TRY_LINK_FUNC([HMAC_Update], [
+	AC_MSG_RESULT([no])
+	LIBS="$BAKLIBS"
+], [
+	AC_MSG_RESULT([yes])
+	LIBS="$BAKLIBS"
+	LIBS="$LIBS -lcrypt32"
+])
+
 AC_MSG_CHECKING([for LibreSSL])
-if grep OPENSSL_VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/null; then
+if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/null; then
 	AC_MSG_RESULT([yes])
 	AC_DEFINE([HAVE_LIBRESSL], [1], [Define if we have LibreSSL])
 	# libressl provides these compat functions, but they may also be
 	# declared by the OS in libc.  See if they have been declared.
-	AC_CHECK_DECLS([strlcpy,strlcat,arc4random,arc4random_uniform])
+	AC_CHECK_DECLS([strlcpy,strlcat,arc4random,arc4random_uniform,reallocarray])
 else
 	AC_MSG_RESULT([no])
 fi
-AC_CHECK_HEADERS([openssl/conf.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([openssl/engine.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode])
-AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free], [], [], [
+AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1])
+
+# these check_funcs need -lssl
+BAKLIBS="$LIBS"
+LIBS="-lssl $LIBS"
+AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level])
+LIBS="$BAKLIBS"
+
+AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
@@ -592,6 +708,17 @@ AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
 ])
 fi
+AC_SUBST(SSLLIB)
+
+
+AC_ARG_ENABLE(sha1, AC_HELP_STRING([--disable-sha1], [Disable SHA1 RRSIG support, does not disable nsec3 support]))
+case "$enable_sha1" in
+	no)
+	;;
+	yes|*)
+	AC_DEFINE([USE_SHA1], [1], [Define this to enable SHA1 support.])
+	;;
+esac
 
 
 AC_ARG_ENABLE(sha2, AC_HELP_STRING([--disable-sha2], [Disable SHA256 and SHA512 RRSIG support]))
@@ -603,6 +730,19 @@ case "$enable_sha2" in
 	;;
 esac
 
+AC_ARG_ENABLE(subnet, AC_HELP_STRING([--enable-subnet], [Enable client subnet]))
+case "$enable_subnet" in
+	yes)
+	AC_DEFINE([CLIENT_SUBNET], [1], [Define this to enable client subnet option.])
+	SUBNET_OBJ="edns-subnet.lo subnetmod.lo addrtree.lo subnet-whitelist.lo"
+	AC_SUBST(SUBNET_OBJ)
+	SUBNET_HEADER='$(srcdir)/edns-subnet/subnetmod.h $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/edns-subnet/subnet-whitelist.h $(srcdir)/edns-subnet/addrtree.h'
+	AC_SUBST(SUBNET_HEADER)
+	;;
+	no|*)
+	;;
+esac
+
 # check wether gost also works
 AC_DEFUN([AC_CHECK_GOST_WORKS],
 [AC_REQUIRE([AC_PROG_CC])
@@ -703,7 +843,7 @@ AC_MSG_RESULT($ac_cv_c_gost_works)
 
 AC_ARG_ENABLE(gost, AC_HELP_STRING([--disable-gost], [Disable GOST support]))
 use_gost="no"
-if test $USE_NSS = "no"; then
+if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
 case "$enable_gost" in
 	no)
 	;;
@@ -717,7 +857,7 @@ case "$enable_gost" in
 	fi
 	;;
 esac
-fi dnl !USE_NSS
+fi dnl !USE_NSS && !USE_NETTLE
 
 AC_ARG_ENABLE(ecdsa, AC_HELP_STRING([--disable-ecdsa], [Disable ECDSA support]))
 use_ecdsa="no"
@@ -725,7 +865,7 @@ case "$enable_ecdsa" in
     no)
       ;;
     *)
-      if test $USE_NSS = "no"; then
+      if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
 	      AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
 	      AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
 	      AC_CHECK_DECLS([NID_X9_62_prime256v1, NID_secp384r1], [], [AC_MSG_ERROR([OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa])], [AC_INCLUDES_DEFAULT
@@ -751,16 +891,67 @@ case "$enable_ecdsa" in
       ;;
 esac
 
-AC_ARG_ENABLE(event-api, AC_HELP_STRING([--enable-event-api], [Enable (experimental) libevent-based libunbound API installed to unbound-event.h]))
-use_unbound_event="no"
+AC_ARG_ENABLE(dsa, AC_HELP_STRING([--disable-dsa], [Disable DSA support]))
+use_dsa="no"
+case "$enable_dsa" in
+    no)
+      ;;
+    *)
+      # detect if DSA is supported, and turn it off if not.
+      AC_CHECK_FUNC(DSA_SIG_new, [
+      AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
+      ], [if test "x$enable_dsa" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support DSA and you used --enable-dsa.])
+               fi ])
+      ;;
+esac
+
+
+AC_ARG_ENABLE(event-api, AC_HELP_STRING([--enable-event-api], [Enable (experimental) pluggable event base libunbound API installed to unbound-event.h]))
 case "$enable_event_api" in
     yes)
-      use_unbound_event="yes"
+      AC_SUBST(UNBOUND_EVENT_INSTALL, [unbound-event-install])
+      AC_SUBST(UNBOUND_EVENT_UNINSTALL, [unbound-event-uninstall])
       ;;
     *)
       ;;
 esac
 
+AC_ARG_ENABLE(tfo-client, AC_HELP_STRING([--enable-tfo-client], [Enable TCP Fast Open for client mode]))
+case "$enable_tfo_client" in
+	yes)
+		case `uname` in
+			Linux) AC_CHECK_DECL([MSG_FASTOPEN], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO])],
+			                     [AC_MSG_ERROR([TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client])], 
+			                     [AC_INCLUDES_DEFAULT 
+#include <netinet/tcp.h>
+])
+					AC_DEFINE_UNQUOTED([USE_MSG_FASTOPEN], [1], [Define this to enable client TCP Fast Open.])
+			  ;;
+			Darwin) AC_CHECK_DECL([CONNECT_RESUME_ON_READ_WRITE], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO])], 
+			                      [AC_MSG_ERROR([TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client])], 
+			                      [AC_INCLUDES_DEFAULT
+#include <sys/socket.h>
+])
+					AC_DEFINE_UNQUOTED([USE_OSX_MSG_FASTOPEN], [1], [Define this to enable client TCP Fast Open.])
+			  ;;
+		esac
+	;;
+	no|*)
+		;;
+esac
+
+AC_ARG_ENABLE(tfo-server, AC_HELP_STRING([--enable-tfo-server], [Enable TCP Fast Open for server mode]))
+case "$enable_tfo_server" in
+	yes)
+	      AC_CHECK_DECL([TCP_FASTOPEN], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support server mode TFO])], [AC_MSG_ERROR([TCP Fast Open is not available for server mode: please rerun without --enable-tfo-server])], [AC_INCLUDES_DEFAULT
+#include <netinet/tcp.h>
+	      ])
+		AC_DEFINE_UNQUOTED([USE_TCP_FASTOPEN], [1], [Define this to enable server TCP Fast Open.])
+		;;
+	no|*)
+		;;
+esac
+
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
     [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
@@ -838,13 +1029,11 @@ large outgoing port ranges.  ])
 	AC_CHECK_FUNCS([event_base_get_method]) # only in libevent 1.4.3 and later
 	AC_CHECK_FUNCS([ev_loop]) # only in libev. (tested on 3.51)
 	AC_CHECK_FUNCS([ev_default_loop]) # only in libev. (tested on 4.00)
+        PC_LIBEVENT_DEPENDENCY="libevent"
+        AC_SUBST(PC_LIBEVENT_DEPENDENCY)
 	if test -n "$BAK_LDFLAGS_SET"; then
 		LDFLAGS="$BAK_LDFLAGS"
 	fi
-        if test "$use_unbound_event" = "yes"; then
-		AC_SUBST(UNBOUND_EVENT_INSTALL, [unbound-event-install])
-		AC_SUBST(UNBOUND_EVENT_UNINSTALL, [unbound-event-uninstall])
-	fi
 else
 	AC_DEFINE(USE_MINI_EVENT, 1, [Define if you want to use internal select based events])
 fi
@@ -871,6 +1060,9 @@ if test x_$found_libexpat != x_yes; then
 	AC_ERROR([Could not find libexpat, expat.h])
 fi
 AC_CHECK_HEADERS([expat.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_DECLS([XML_StopParser], [], [], [AC_INCLUDES_DEFAULT
+#include <expat.h>
+])
 
 # set static linking if requested
 AC_SUBST(staticexe)
@@ -882,13 +1074,15 @@ if test x_$enable_static_exe = x_yes; then
 	staticexe="-static"
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
-		# for static crosscompile, include gdi32 and zlib here.
-		if test "`uname`" = "Linux"; then
-			LIBS="$LIBS -lgdi32 -lz"
-		fi
+		# for static compile, include gdi32 and zlib here.
+		LIBS="$LIBS -lgdi32 -lz"
 	fi
 fi
 
+# Include systemd.m4 - begin
+sinclude(systemd.m4)
+# Include systemd.m4 - end
+
 # set lock checking if requested
 AC_ARG_ENABLE(lock_checks, AC_HELP_STRING([--enable-lock-checks],
 	[ enable to check lock and unlock calls, for debug purposes ]), 
@@ -938,6 +1132,12 @@ if test $ac_cv_func_daemon = yes; then
 ])
 fi
 
+AC_CHECK_MEMBERS([struct sockaddr_un.sun_len],,,[
+AC_INCLUDES_DEFAULT
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+])
 AC_CHECK_MEMBERS([struct in_pktinfo.ipi_spec_dst],,,[
 AC_INCLUDES_DEFAULT
 #if HAVE_SYS_PARAM_H
@@ -956,6 +1156,10 @@ AC_INCLUDES_DEFAULT
 #include <netinet/in.h>
 #endif
 
+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
@@ -969,7 +1173,7 @@ AC_INCLUDES_DEFAULT
 #endif
 ])
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
 AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
@@ -977,16 +1181,55 @@ AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 if echo $build_os | grep darwin8 > /dev/null; then
 	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
 fi
+AC_CHECK_DECLS([inet_pton,inet_ntop], [], [], [
+AC_INCLUDES_DEFAULT
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+
+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+#ifdef HAVE_WINSOCK2_H
+#include <winsock2.h>
+#endif
+
+#ifdef HAVE_WS2TCPIP_H
+#include <ws2tcpip.h>
+#endif
+])
 AC_REPLACE_FUNCS(inet_aton)
 AC_REPLACE_FUNCS(inet_pton)
 AC_REPLACE_FUNCS(inet_ntop)
 AC_REPLACE_FUNCS(snprintf)
+# test if snprintf return the proper length
+if test "x$ac_cv_func_snprintf" = xyes; then
+    if test c${cross_compiling} = cno; then
+	AC_MSG_CHECKING([for correct snprintf return value])
+	AC_RUN_IFELSE([AC_LANG_SOURCE(AC_INCLUDES_DEFAULT
+[[
+int main(void) { return !(snprintf(NULL, 0, "test") == 4); }
+]])], [AC_MSG_RESULT(yes)], [
+		AC_MSG_RESULT(no)
+		AC_DEFINE([SNPRINTF_RET_BROKEN], [], [define if (v)snprintf does not return length needed, (but length used)])
+		AC_LIBOBJ(snprintf)
+	  ])
+    fi
+fi
 AC_REPLACE_FUNCS(strlcat)
 AC_REPLACE_FUNCS(strlcpy)
 AC_REPLACE_FUNCS(memmove)
 AC_REPLACE_FUNCS(gmtime_r)
+AC_REPLACE_FUNCS(isblank)
+dnl without CTIME, ARC4-functions and without reallocarray.
 LIBOBJ_WITHOUT_CTIMEARC4="$LIBOBJS"
 AC_SUBST(LIBOBJ_WITHOUT_CTIMEARC4)
+AC_REPLACE_FUNCS(reallocarray)
 if test "$USE_NSS" = "no"; then
 	AC_REPLACE_FUNCS(arc4random)
 	AC_REPLACE_FUNCS(arc4random_uniform)
@@ -997,11 +1240,11 @@ if test "$USE_NSS" = "no"; then
 		    if test "$USE_WINSOCK" = 1; then
 			AC_LIBOBJ(getentropy_win)
 		    else
-			case `uname` in
-			Darwin)
+			case "$host" in
+			Darwin|*darwin*)
 				AC_LIBOBJ(getentropy_osx)
 			;;
-			SunOS)
+			*solaris*|*sunos*|SunOS)
 				AC_LIBOBJ(getentropy_solaris)
 				AC_CHECK_HEADERS([sys/sha2.h],, [
 					AC_CHECK_FUNCS([SHA512_Update],,[
@@ -1012,14 +1255,16 @@ if test "$USE_NSS" = "no"; then
 					# this lib needed for sha2 on solaris
 					LIBS="$LIBS -lmd"
 				fi
+				AC_SEARCH_LIBS([clock_gettime], [rt])
 			;;
-			Linux|*)
+			*linux*|Linux|*)
 				AC_LIBOBJ(getentropy_linux)
 				AC_CHECK_FUNCS([SHA512_Update],,[
 					AC_DEFINE([COMPAT_SHA512], [1], [Do sha512 definitions in config.h])
 					AC_LIBOBJ(sha512)
 				])
 				AC_CHECK_HEADERS([sys/sysctl.h],,, [AC_INCLUDES_DEFAULT])
+				AC_CHECK_FUNCS([getauxval])
 				AC_SEARCH_LIBS([clock_gettime], [rt])
 			;;
 			esac
@@ -1030,6 +1275,7 @@ fi
 LIBOBJ_WITHOUT_CTIME="$LIBOBJS"
 AC_SUBST(LIBOBJ_WITHOUT_CTIME)
 AC_REPLACE_FUNCS(ctime_r)
+AC_REPLACE_FUNCS(strsep)
 
 AC_ARG_ENABLE(allsymbols, AC_HELP_STRING([--enable-allsymbols], [export all symbols from libunbound and link binaries to it, smaller install size but libunbound export table is polluted by internal symbols]))
 case "$enable_allsymbols" in
@@ -1082,6 +1328,30 @@ dt_DNSTAP([$UNBOUND_RUN_DIR/dnstap.sock],
     ]
 )
 
+# check for dnscrypt if requested
+dnsc_DNSCRYPT([
+        AC_DEFINE([USE_DNSCRYPT], [1], [Define to 1 to enable dnscrypt support])
+        AC_SUBST([ENABLE_DNSCRYPT], [1])
+
+        AC_SUBST([DNSCRYPT_SRC], ["dnscrypt/dnscrypt.c"])
+        AC_SUBST([DNSCRYPT_OBJ], ["dnscrypt.lo"])
+    ],
+    [
+        AC_SUBST([ENABLE_DNSCRYPT], [0])
+    ]
+)
+
+# check for cachedb if requested
+AC_ARG_ENABLE(cachedb, AC_HELP_STRING([--enable-cachedb], [enable cachedb module that can use external cache storage]))
+case "$enable_cachedb" in
+    yes)
+    	AC_DEFINE([USE_CACHEDB], [1], [Define to 1 to use cachedb support])
+    	;;
+    no|*)
+    	# nothing
+    	;;
+esac
+
 AC_MSG_CHECKING([if ${MAKE:-make} supports $< with implicit rule in scope])
 # on openBSD, the implicit rule make $< work.
 # on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
@@ -1188,6 +1458,10 @@ dnl includes
 #include <netinet/in.h>
 #endif
 
+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
@@ -1205,13 +1479,23 @@ dnl includes
 #else
 #define ARG_LL "%I64"
 #endif
+
+#ifndef AF_LOCAL
+#define AF_LOCAL AF_UNIX
+#endif
 ]
 
 AHX_CONFIG_FORMAT_ATTRIBUTE
 AHX_CONFIG_UNUSED_ATTRIBUTE
 AHX_CONFIG_FSEEKO
 AHX_CONFIG_MAXHOSTNAMELEN
-AHX_CONFIG_SNPRINTF(unbound)
+#if !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN)
+#define snprintf snprintf_unbound
+#define vsnprintf vsnprintf_unbound
+#include <stdarg.h>
+int snprintf (char *str, size_t count, const char *fmt, ...);
+int vsnprintf (char *str, size_t count, const char *fmt, va_list arg);
+#endif /* HAVE_SNPRINTF or SNPRINTF_RET_BROKEN */
 AHX_CONFIG_INET_PTON(unbound)
 AHX_CONFIG_INET_NTOP(unbound)
 AHX_CONFIG_INET_ATON(unbound)
@@ -1219,6 +1503,7 @@ AHX_CONFIG_MEMMOVE(unbound)
 AHX_CONFIG_STRLCAT(unbound)
 AHX_CONFIG_STRLCPY(unbound)
 AHX_CONFIG_GMTIME_R(unbound)
+AHX_CONFIG_REALLOCARRAY(unbound)
 AHX_CONFIG_W32_SLEEP
 AHX_CONFIG_W32_USLEEP
 AHX_CONFIG_W32_RANDOM
@@ -1233,6 +1518,24 @@ AHX_MEMCMP_BROKEN(unbound)
 char *ctime_r(const time_t *timep, char *buf);
 #endif
 
+#ifndef HAVE_STRSEP
+#define strsep unbound_strsep
+char *strsep(char **stringp, const char *delim);
+#endif
+
+#ifndef HAVE_ISBLANK
+#define isblank unbound_isblank
+int isblank(int c);
+#endif
+
+#if defined(HAVE_INET_NTOP) && !HAVE_DECL_INET_NTOP
+const char *inet_ntop(int af, const void *src, char *dst, size_t size);
+#endif
+
+#if defined(HAVE_INET_PTON) && !HAVE_DECL_INET_PTON
+int inet_pton(int af, const char* src, void* dst);
+#endif
+
 #if !defined(HAVE_STRPTIME) || !defined(STRPTIME_WORKS)
 #define strptime unbound_strptime
 struct tm;
@@ -1252,6 +1555,9 @@ uint32_t arc4random(void);
 #  if !HAVE_DECL_ARC4RANDOM_UNIFORM && defined(HAVE_ARC4RANDOM_UNIFORM)
 uint32_t arc4random_uniform(uint32_t upper_bound);
 #  endif
+#  if !HAVE_DECL_REALLOCARRAY
+void *reallocarray(void *ptr, size_t nmemb, size_t size);
+#  endif
 #endif /* HAVE_LIBRESSL */
 #ifndef HAVE_ARC4RANDOM
 void explicit_bzero(void* buf, size_t len);
@@ -1338,6 +1644,6 @@ dnl if this is a distro tarball, that was already done by makedist.sh
 AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AC_SUBST(date, [`date +'%b %e, %Y'`])
 
-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service])
 AC_CONFIG_HEADER([config.h])
 AC_OUTPUT

contrib/README

@@ -15,8 +15,6 @@ distribution but may be helpful.
 	a local-zone and local-data include file for unbound.conf.
 * unbound-host.nagios.patch: makes unbound-host return status that fits right
 	in with the nagios monitoring framework.  Contributed by Migiel de Vos.
-* unbound_unixsock.diff: Add Unix socket support for unbound-control. 
-	Contributed by Ilya Bakulin, 2012-08-28.
 * patch_rsamd5_enable.diff: this patch enables RSAMD5 validation (otherwise
   it is treated as insecure).  The RSAMD5 algorithm is deprecated (RFC6725).
 * create_unbound_ad_servers.sh: shell script to enter anti-ad server lists.
@@ -29,4 +27,7 @@ distribution but may be helpful.
   works like the BIND feature (removes AAAA records unless AAAA-only domain).
   Useful for certain 'broken IPv6 default route' scenarios.
   Patch from Stephane Lapie for ASAHI Net.
-
+* unbound_smf22.tar.gz: Solaris SMF installation/removal scripts.
+  Contributed by Yuri Voinov.
+* unbound.socket and unbound.service: systemd files for unbound, install them
+  in /usr/lib/systemd/system.  Contributed by Sami Kerola and Pavel Odintsov.

contrib/aaaa-filter-iterator.patch

@@ -1,8 +1,10 @@
---- unbound-1.4.17.orig/doc/unbound.conf.5.in
-+++ unbound-1.4.17/doc/unbound.conf.5.in
-@@ -519,6 +519,13 @@ authority servers and checks if the repl
- Disabled by default. 
- This feature is an experimental implementation of draft dns\-0x20.
+Index: trunk/doc/unbound.conf.5.in
+===================================================================
+--- trunk/doc/unbound.conf.5.in	(revision 3587)
++++ trunk/doc/unbound.conf.5.in	(working copy)
+@@ -593,6 +593,13 @@
+ possible. Best effort approach, full QNAME and original QTYPE will be sent when
+ upstream replies with a RCODE other than NOERROR. Default is off.
  .TP
 +.B aaaa\-filter: \fI<yes or no>
 +Activate behavior similar to BIND's AAAA-filter.
@@ -13,20 +15,12 @@
 +.TP
  .B private\-address: \fI<IP address or subnet>
  Give IPv4 of IPv6 addresses or classless subnets. These are addresses
- on your private network, and are not allowed to be returned for public
---- unbound-1.4.17.orig/util/config_file.c
-+++ unbound-1.4.17/util/config_file.c
-@@ -160,6 +160,7 @@ config_create(void)
- 	cfg->harden_below_nxdomain = 0;
- 	cfg->harden_referral_path = 0;
- 	cfg->use_caps_bits_for_id = 0;
-+	cfg->aaaa_filter = 0; /* ASN: default is disabled */
- 	cfg->private_address = NULL;
- 	cfg->private_domain = NULL;
- 	cfg->unwanted_threshold = 0;
---- unbound-1.4.17.orig/iterator/iter_scrub.c
-+++ unbound-1.4.17/iterator/iter_scrub.c
-@@ -580,6 +580,32 @@ static int sanitize_nsec_is_overreach(st
+ on your private network, and are not allowed to be returned for
+Index: trunk/iterator/iter_scrub.c
+===================================================================
+--- trunk/iterator/iter_scrub.c	(revision 3587)
++++ trunk/iterator/iter_scrub.c	(working copy)
+@@ -617,6 +617,32 @@
  }
  
  /**
@@ -38,7 +32,7 @@
 + */
 +static int
 +asn_lookup_a_record_from_cache(struct query_info* qinfo,
-+	struct module_env* env, struct iter_env* ie)
++	struct module_env* env, struct iter_env* ATTR_UNUSED(ie))
 +{
 +	struct ub_packed_rrset_key* akey;
 +
@@ -59,7 +53,7 @@
   * Given a response event, remove suspect RRsets from the response.
   * "Suspect" rrsets are potentially poison. Note that this routine expects
   * the response to be in a "normalized" state -- that is, all "irrelevant"
-@@ -598,6 +625,7 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -635,6 +661,7 @@
  	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
  	struct iter_env* ie)
  {
@@ -67,7 +61,7 @@
  	int del_addi = 0; /* if additional-holding rrsets are deleted, we
  		do not trust the normalized additional-A-AAAA any more */
  	struct rrset_parse* rrset, *prev;
-@@ -633,6 +661,13 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -670,6 +697,13 @@
  		rrset = rrset->rrset_all_next;
  	}
  
@@ -81,7 +75,7 @@
  	/* At this point, we brutally remove ALL rrsets that aren't 
  	 * children of the originating zone. The idea here is that, 
  	 * as far as we know, the server that we contacted is ONLY 
-@@ -644,6 +679,24 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -681,6 +715,24 @@
  	rrset = msg->rrset_first;
  	while(rrset) {
  
@@ -105,10 +99,24 @@
 +
  		/* remove private addresses */
  		if( (rrset->type == LDNS_RR_TYPE_A || 
- 			rrset->type == LDNS_RR_TYPE_AAAA) &&
---- unbound-1.4.17.orig/iterator/iterator.c
-+++ unbound-1.4.17/iterator/iterator.c
-@@ -1579,6 +1579,53 @@ processDSNSFind(struct module_qstate* qs
+ 			rrset->type == LDNS_RR_TYPE_AAAA)) {
+Index: trunk/iterator/iter_utils.c
+===================================================================
+--- trunk/iterator/iter_utils.c	(revision 3587)
++++ trunk/iterator/iter_utils.c	(working copy)
+@@ -175,6 +175,7 @@
+ 	}
+ 	iter_env->supports_ipv6 = cfg->do_ip6;
+ 	iter_env->supports_ipv4 = cfg->do_ip4;
++	iter_env->aaaa_filter = cfg->aaaa_filter;
+ 	return 1;
+ }
+ 
+Index: trunk/iterator/iterator.c
+===================================================================
+--- trunk/iterator/iterator.c	(revision 3587)
++++ trunk/iterator/iterator.c	(working copy)
+@@ -1776,6 +1776,53 @@
  
  	return 0;
  }
@@ -128,7 +136,7 @@
 + */
 +static int
 +asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
-+	struct iter_env* ie, int id)
++	struct iter_env* ATTR_UNUSED(ie), int id)
 +{
 +	struct module_qstate* subq = NULL;
 +
@@ -162,7 +170,7 @@
  	
  /** 
   * This is the request event state where the request will be sent to one of
-@@ -1626,6 +1673,13 @@ processQueryTargets(struct module_qstate
+@@ -1823,6 +1870,13 @@
  		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
  	}
  	
@@ -176,7 +184,7 @@
  	/* Make sure we have a delegation point, otherwise priming failed
  	 * or another failure occurred */
  	if(!iq->dp) {
-@@ -2568,6 +2622,62 @@ processFinished(struct module_qstate* qs
+@@ -2922,6 +2976,61 @@
  	return 0;
  }
  
@@ -195,9 +203,8 @@
 +asn_processAAAAResponse(struct module_qstate* qstate, int id,
 +	struct module_qstate* super)
 +{
-+	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
++	/*struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];*/
 +	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
-+	struct ub_packed_rrset_key* rrset;
 +	struct delegpt_ns* dpns = NULL;
 +	int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
 +
@@ -239,7 +246,7 @@
  /*
   * Return priming query results to interestes super querystates.
   * 
-@@ -2587,6 +2697,9 @@ iter_inform_super(struct module_qstate*
+@@ -2941,6 +3050,9 @@
  	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
  		super->minfo[id])->state == DSNS_FIND_STATE)
  		processDSNSResponse(qstate, id, super);
@@ -249,7 +256,7 @@
  	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
  		error_supers(qstate, id, super);
  	else if(qstate->is_priming)
-@@ -2624,6 +2737,9 @@ iter_handle(struct module_qstate* qstate
+@@ -2978,6 +3090,9 @@
  			case INIT_REQUEST_3_STATE:
  				cont = processInitRequest3(qstate, iq, id);
  				break;
@@ -259,7 +266,7 @@
  			case QUERYTARGETS_STATE:
  				cont = processQueryTargets(qstate, iq, ie, id);
  				break;
-@@ -2863,6 +2979,8 @@ iter_state_to_string(enum iter_state sta
+@@ -3270,6 +3385,8 @@
  		return "INIT REQUEST STATE (stage 2)";
  	case INIT_REQUEST_3_STATE:
  		return "INIT REQUEST STATE (stage 3)";
@@ -268,7 +275,7 @@
  	case QUERYTARGETS_STATE :
  		return "QUERY TARGETS STATE";
  	case PRIME_RESP_STATE :
-@@ -2887,6 +3005,7 @@ iter_state_is_responsestate(enum iter_st
+@@ -3294,6 +3411,7 @@
  		case INIT_REQUEST_STATE :
  		case INIT_REQUEST_2_STATE :
  		case INIT_REQUEST_3_STATE :
@@ -276,29 +283,21 @@
  		case QUERYTARGETS_STATE :
  		case COLLECT_CLASS_STATE :
  			return 0;
---- unbound-1.4.17.orig/iterator/iter_utils.c
-+++ unbound-1.4.17/iterator/iter_utils.c
-@@ -128,6 +128,7 @@ iter_apply_cfg(struct iter_env* iter_env
- 	}
- 	iter_env->supports_ipv6 = cfg->do_ip6;
- 	iter_env->supports_ipv4 = cfg->do_ip4;
-+	iter_env->aaaa_filter = cfg->aaaa_filter;
- 	return 1;
- }
- 
---- unbound-1.4.17.orig/iterator/iterator.h
-+++ unbound-1.4.17/iterator/iterator.h
-@@ -110,6 +110,9 @@ struct iter_env {
- 	 * array of max_dependency_depth+1 size.
+Index: trunk/iterator/iterator.h
+===================================================================
+--- trunk/iterator/iterator.h	(revision 3587)
++++ trunk/iterator/iterator.h	(working copy)
+@@ -113,6 +113,9 @@
  	 */
  	int* target_fetch_policy;
-+
+ 
 +	/** ASN: AAAA-filter flag */
 +	int aaaa_filter;
++
+ 	/** ip6.arpa dname in wireformat, used for qname-minimisation */
+ 	uint8_t* ip6arpa_dname;
  };
- 
- /**
-@@ -135,6 +138,14 @@ enum iter_state {
+@@ -163,6 +166,14 @@
  	INIT_REQUEST_3_STATE,
  
  	/**
@@ -313,7 +312,7 @@
  	 * Each time a delegation point changes for a given query or a 
  	 * query times out and/or wakes up, this state is (re)visited. 
  	 * This state is reponsible for iterating through a list of 
-@@ -309,6 +320,13 @@ struct iter_qstate {
+@@ -346,6 +357,13 @@
  	 */
  	int refetch_glue;
  
@@ -326,31 +325,61 @@
 +
  	/** list of pending queries to authoritative servers. */
  	struct outbound_list outlist;
- };
---- unbound-1.4.17.orig/util/config_file.h
-+++ unbound-1.4.17/util/config_file.h
-@@ -169,6 +169,8 @@ struct config_file {
- 	int harden_referral_path;
+ 
+Index: trunk/pythonmod/interface.i
+===================================================================
+--- trunk/pythonmod/interface.i	(revision 3587)
++++ trunk/pythonmod/interface.i	(working copy)
+@@ -632,6 +632,7 @@
+    int harden_dnssec_stripped;
+    int harden_referral_path;
+    int use_caps_bits_for_id;
++   int aaaa_filter; /* ASN */
+    struct config_strlist* private_address;
+    struct config_strlist* private_domain;
+    size_t unwanted_threshold;
+Index: trunk/util/config_file.c
+===================================================================
+--- trunk/util/config_file.c	(revision 3587)
++++ trunk/util/config_file.c	(working copy)
+@@ -176,6 +176,7 @@
+ 	cfg->harden_referral_path = 0;
+ 	cfg->harden_algo_downgrade = 0;
+ 	cfg->use_caps_bits_for_id = 0;
++	cfg->aaaa_filter = 0; /* ASN: default is disabled */
+ 	cfg->caps_whitelist = NULL;
+ 	cfg->private_address = NULL;
+ 	cfg->private_domain = NULL;
+Index: trunk/util/config_file.h
+===================================================================
+--- trunk/util/config_file.h	(revision 3587)
++++ trunk/util/config_file.h	(working copy)
+@@ -179,6 +179,8 @@
+ 	int harden_algo_downgrade;
  	/** use 0x20 bits in query as random ID bits */
  	int use_caps_bits_for_id;
 +	/** ASN: enable AAAA filter? */
 +	int aaaa_filter;
+ 	/** 0x20 whitelist, domains that do not use capsforid */
+ 	struct config_strlist* caps_whitelist;
  	/** strip away these private addrs from answers, no DNS Rebinding */
- 	struct config_strlist* private_address;
- 	/** allow domain (and subdomains) to use private address space */
---- unbound-1.4.17.orig/util/configlexer.lex
-+++ unbound-1.4.17/util/configlexer.lex
-@@ -177,6 +177,7 @@ harden-below-nxdomain{COLON}	{ YDVAR(1,
- harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+Index: trunk/util/configlexer.lex
+===================================================================
+--- trunk/util/configlexer.lex	(revision 3587)
++++ trunk/util/configlexer.lex	(working copy)
+@@ -267,6 +267,7 @@
  use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+ caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
  unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 +aaaa-filter{COLON}		{ YDVAR(1, VAR_AAAA_FILTER) }
  private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
  private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
  prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
---- unbound-1.4.17.orig/util/configparser.y
-+++ unbound-1.4.17/util/configparser.y
-@@ -92,6 +92,7 @@ extern struct config_parser_state* cfg_p
+Index: trunk/util/configparser.y
+===================================================================
+--- trunk/util/configparser.y	(revision 3587)
++++ trunk/util/configparser.y	(working copy)
+@@ -92,6 +92,7 @@
  %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
  %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
  %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
@@ -358,7 +387,7 @@
  %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
  %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
  %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -151,6 +152,7 @@ content_server: server_num_threads | ser
+@@ -169,6 +170,7 @@
  	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
  	server_harden_referral_path | server_private_address |
  	server_private_domain | server_extended_statistics | 
@@ -366,8 +395,8 @@
  	server_local_data_ptr | server_jostle_timeout | 
  	server_unwanted_reply_threshold | server_log_time_ascii | 
  	server_domain_insecure | server_val_sig_skew_min | 
-@@ -802,6 +803,15 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR
- 		free($2);
+@@ -893,6 +895,15 @@
+ 			yyerror("out of memory");
  	}
  	;
 +server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
@@ -382,13 +411,3 @@
  server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
  	{
  		OUTYY(("P(server_private_address:%s)\n", $2));
---- unbound-1.4.17.orig/pythonmod/interface.i
-+++ unbound-1.4.17/pythonmod/interface.i
-@@ -626,6 +626,7 @@ struct config_file {
-    int harden_dnssec_stripped;
-    int harden_referral_path;
-    int use_caps_bits_for_id;
-+   int aaaa_filter; /* ASN */
-    struct config_strlist* private_address;
-    struct config_strlist* private_domain;
-    size_t unwanted_threshold;

contrib/create_unbound_ad_servers.cmd

@@ -1,33 +1,33 @@
-@Echo off
-rem Convert the Yoyo.org anti-ad server listing
-rem into an unbound dns spoof redirection list.
-rem Written by Y.Voinov (c) 2014
-
-rem Note: Wget required!
-
-rem Variables
-set prefix="C:\Program Files (x86)"
-set dst_dir=%prefix%\Unbound
-set work_dir=%TEMP%
-set list_addr="http://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml&showintro=1&startdate%5Bday%5D=&startdate%5Bmonth%5D=&startdate%5Byear%5D="
-
-rem Check Wget installed
-for /f "delims=" %%a in ('where wget') do @set wget=%%a
-if /I "%wget%"=="" echo Wget not found. If installed, add path to PATH environment variable. & exit 1
-echo Wget found: %wget%
-
-"%wget%" -O %work_dir%\yoyo_ad_servers %list_addr%
-
-del /Q /F /S %dst_dir%\unbound_ad_servers
-
-for /F "eol=; tokens=*" %%a in (%work_dir%\yoyo_ad_servers) do (
-echo local-zone: %%a redirect>>%dst_dir%\unbound_ad_servers
-echo local-data: "%%a A 127.0.0.1">>%dst_dir%\unbound_ad_servers
-)
-
-echo Done.
-rem  then add an include line to your unbound.conf pointing to the full path of
-rem  the unbound_ad_servers file:
-rem
-rem   include: $dst_dir/unbound_ad_servers
-rem
+@Echo off
+rem Convert the Yoyo.org anti-ad server listing
+rem into an unbound dns spoof redirection list.
+rem Written by Y.Voinov (c) 2014
+
+rem Note: Wget required!
+
+rem Variables
+set prefix="C:\Program Files (x86)"
+set dst_dir=%prefix%\Unbound
+set work_dir=%TEMP%
+set list_addr="http://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml&showintro=1&startdate%5Bday%5D=&startdate%5Bmonth%5D=&startdate%5Byear%5D="
+
+rem Check Wget installed
+for /f "delims=" %%a in ('where wget') do @set wget=%%a
+if /I "%wget%"=="" echo Wget not found. If installed, add path to PATH environment variable. & exit 1
+echo Wget found: %wget%
+
+"%wget%" -O %work_dir%\yoyo_ad_servers %list_addr%
+
+del /Q /F /S %dst_dir%\unbound_ad_servers
+
+for /F "eol=; tokens=*" %%a in (%work_dir%\yoyo_ad_servers) do (
+echo local-zone: %%a redirect>>%dst_dir%\unbound_ad_servers
+echo local-data: "%%a A 127.0.0.1">>%dst_dir%\unbound_ad_servers
+)
+
+echo Done.
+rem  then add an include line to your unbound.conf pointing to the full path of
+rem  the unbound_ad_servers file:
+rem
+rem   include: $dst_dir/unbound_ad_servers
+rem

contrib/libunbound.pc.in

@@ -0,0 +1,13 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: unbound
+Description: Library with validating, recursive, and caching DNS resolver
+URL: http://www.unbound.net
+Version: @PACKAGE_VERSION@
+Requires: libcrypto libssl @PC_LIBEVENT_DEPENDENCY@ @PC_PY_DEPENDENCY@
+Libs: -L${libdir} -lunbound
+Libs.private: @SSLLIB@ @LIBS@
+Cflags: -I${includedir} 

contrib/unbound.service.in

@@ -0,0 +1,28 @@
+[Unit]
+Description=Validating, recursive, and caching DNS resolver
+Documentation=man:unbound(8)
+
+[Install]
+WantedBy=multi-user.target
+
+[Service]
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStart=/home/vagrant/unbound_systemd/unbound
+NotifyAccess=main
+Type=notify
+CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectHome=true
+ProtectControlGroups=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadWritePaths=/etc/unbound /run
+RestrictAddressFamilies=AF_INET AF_UNIX
+RestrictRealtime=true
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
+

contrib/unbound.socket.in

@@ -0,0 +1,6 @@
+[Socket]
+ListenDatagram=127.0.0.1:1153
+ListenStream=127.0.0.1:1153
+# ListenStream=@UNBOUND_RUN_DIR@/control
+[Install]
+WantedBy=sockets.target

contrib/unbound.spec_fedora

@@ -18,7 +18,6 @@ Source2: unbound.conf
 Source3: unbound.munin
 Source4: unbound_munin_
 Source5: root.key
-Source6: dlv.isc.org.key
 Patch1: unbound-1.2-glob.patch
 
 Group: System Environment/Daemons
@@ -140,7 +139,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %attr(0755,root,root) %dir %{_sysconfdir}/%{name}
 %ghost %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/root.key
 %{_sbindir}/*
 %{_mandir}/*/*
@@ -178,11 +176,6 @@ exit 0
 
 %post
 /sbin/chkconfig --add %{name}
-# dnssec-conf used to contain our DLV key, but now we include it via unbound
-# If unbound had previously been configured with dnssec-configure, we need
-# to migrate the location of the DLV key file (to keep DLV enabled, and because
-# unbound won't start with a bad location for a DLV key file.
-sed -i "s:/etc/pki/dnssec-keys[/]*dlv:/etc/unbound:" %{_sysconfdir}/unbound/unbound.conf
 
 %post libs -p /sbin/ldconfig
 
@@ -280,7 +273,7 @@ fi
 - Change make/configure lines to attempt to fix -lphtread linking issue
 
 * Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
-- Removed dependancy for dnssec-conf
+- Removed dependency for dnssec-conf
 - Added ISC DLV key (formerly in dnssec-conf)
 - Fixup old DLV locations in unbound.conf file via %%post
 - Fix parent child disagreement handling and no-ipv6 present [svn r1953]
@@ -319,7 +312,7 @@ fi
 - Re-enabled glob.patch
 
 * Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-7
-- unbound-iterator.patch was not commited
+- unbound-iterator.patch was not committed
 
 * Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-6
 - Fix for https://bugzilla.redhat.com/show_bug.cgi?id=499793
@@ -345,11 +338,11 @@ fi
 
 * Wed Jan 14 2009 Paul Wouters <paul@xelerance.com - 1.2.0-1
 - Updated to 1.2.0
-- Added dependancy on minimum SSL for CVE-2008-5077
-- Added dependancy on bc for unbound-munin
+- Added dependency on minimum SSL for CVE-2008-5077
+- Added dependency on bc for unbound-munin
 - Added minimum requirement of libevent 1.4.5. Crashes with older versions
   (note: libevent is stale in EL-4 and not in EL-5, needs fixing there)
-- Removed dependancy on selinux-policy (will get used when available)
+- Removed dependency on selinux-policy (will get used when available)
 - Enable options as per draft-wijngaards-dnsext-resolver-side-mitigation-00.txt
 - Enable unwanted-reply-threshold to mitigate against a Kaminsky attack
 - Enable val-clean-additional to drop addition unsigned data from signed
@@ -430,7 +423,7 @@ fi
 - Build against ldns-1.3.0
 
 * Wed May 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.0-1
-- Split of -devel package, fixed dependancies, make rpmlint happy
+- Split of -devel package, fixed dependencies, make rpmlint happy
 
 * Thu Apr 25 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.12
 - Using parts from ports collection entry by Jaap Akkerhuis.

contrib/unbound_cache.cmd

@@ -2,7 +2,7 @@
 rem --------------------------------------------------------------
 rem -- DNS cache save/load script
 rem --
-rem -- Version 1.0
+rem -- Version 1.2
 rem -- By Yuri Voinov (c) 2014
 rem --------------------------------------------------------------
 
@@ -19,47 +19,87 @@ exit 1
 
 :start
 
-set arg=%1
+rem arg1 - command (optional)
+rem arg2 - file name (optional)
+set arg1=%1
+set arg2=%2
 
-if /I "%arg%" == "-h" goto help
+if /I "%arg1%" == "-h" goto help
 
-if "%arg%" == "" (
+if "%arg1%" == "" (
 echo Loading cache from %program_path%\%fname%
+dir /a %program_path%\%fname%
 type %program_path%\%fname%|%uc% load_cache
 goto end
 )
 
-if /I "%arg%" == "-s" (
+if defined %arg2% (goto Not_Defined) else (goto Defined)
+
+rem If file not specified; use default dump file
+:Not_defined
+if /I "%arg1%" == "-s" (
 echo Saving cache to %program_path%\%fname%
 %uc% dump_cache>%program_path%\%fname%
+dir /a %program_path%\%fname%
 echo ok
 goto end
 )
 
-if /I "%arg%" == "-l" (
+if /I "%arg1%" == "-l" (
+echo Loading cache from %program_path%\%fname%
+dir /a %program_path%\%fname%
+type %program_path%\%fname%|%uc% load_cache
+goto end
+)
+
+if /I "%arg1%" == "-r" (
+echo Saving cache to %program_path%\%fname%
+dir /a %program_path%\%fname%
+%uc% dump_cache>%program_path%\%fname%
+echo ok
 echo Loading cache from %program_path%\%fname%
 type %program_path%\%fname%|%uc% load_cache
 goto end
 )
 
-if /I "%arg%" == "-r" (
-echo Saving cache to %program_path%\%fname%
-%uc% dump_cache>%program_path%\%fname%
+rem If file name specified; use this filename
+:Defined
+if /I "%arg1%" == "-s" (
+echo Saving cache to %arg2%
+%uc% dump_cache>%arg2%
+dir /a %arg2%
 echo ok
-echo Loading cache from %program_path%\%fname%
-type %program_path%\%fname%|%uc% load_cache
+goto end
+)
+
+if /I "%arg1%" == "-l" (
+echo Loading cache from %arg2%
+dir /a %arg2%
+type %arg2%|%uc% load_cache
+goto end
+)
+
+if /I "%arg1%" == "-r" (
+echo Saving cache to %arg2%
+dir /a %arg2%
+%uc% dump_cache>%arg2%
+echo ok
+echo Loading cache from %arg2%
+type %arg2%|%uc% load_cache
 goto end
 )
 
 :help
-echo Usage: unbound_cache.cmd [-s] or [-l] or [-r] or [-h]
+echo Usage: unbound_cache.cmd [-s] or [-l] or [-r] or [-h] [filename]
 echo.
 echo l - Load - default mode. Warming up Unbound DNS cache from saved file. cache-ttl must be high value.
 echo s - Save - save Unbound DNS cache contents to plain file with domain names.
 echo r - Reload - reloadind new cache entries and refresh existing cache
 echo h - this screen.
+echo filename - file to save/load dumped cache. If not specified, %program_path%\%fname% will be used instead.
 echo Note: Run without any arguments will be in default mode.
 echo       Also, unbound-control must be configured.
 exit 1
 
 :end
+exit 0

contrib/unbound_cache.sh

@@ -1,13 +1,13 @@
 #!/sbin/sh
-#
+
 # --------------------------------------------------------------
 # -- DNS cache save/load script
 # --
-# -- Version 1.0
+# -- Version 1.2
 # -- By Yuri Voinov (c) 2006, 2014
 # --------------------------------------------------------------
 #
-# ident   "@(#)unbound_cache.sh     1.1     14/04/26 YV"
+# ident   "@(#)unbound_cache.sh     1.2     14/10/30 YV"
 #
 
 #############
@@ -27,9 +27,10 @@ BASENAME=`which basename`
 CAT=`which cat`
 CUT=`which cut`
 ECHO=`which echo`
+EXPR=`which expr`
 GETOPT=`which getopt`
 ID=`which id`
-PRINTF=`which printf`
+LS=`which ls`
 
 ###############
 # Subroutines #
@@ -38,12 +39,13 @@ PRINTF=`which printf`
 usage_note ()
 {
 # Script usage note
- $ECHO "Usage: `$BASENAME $0` [-s] or [-l] or [-r] or [-h]"
- $ECHO
+ $ECHO "Usage: `$BASENAME $0` [-s] or [-l] or [-r] or [-h] [filename]"
+ $ECHO .
  $ECHO "l - Load - default mode. Warming up Unbound DNS cache from saved file. cache-ttl must be high value."
  $ECHO "s - Save - save Unbound DNS cache contents to plain file with domain names."
  $ECHO "r - Reload - reloadind new cache entries and refresh existing cache"
  $ECHO "h - this screen."
+ $ECHO "filename - file to save/load dumped cache. If not specified, $CONF/$FNAME will be used instead."
  $ECHO "Note: Run without any arguments will be in default mode."
  $ECHO "      Also, unbound-control must be configured."
  exit 0
@@ -68,7 +70,12 @@ check_uc ()
 
 check_saved_file ()
 {
- if [ ! -f "$CONF/$FNAME" ]; then
+ filename=$1
+ if [ ! -z "$filename" -a ! -f "$filename" ]; then
+  $ECHO .
+  $ECHO "ERROR: File $filename does not exists. Save it first."
+  exit 1
+ elif [ ! -f "$CONF/$FNAME" ]; then
   $ECHO .
   $ECHO "ERROR: File $CONF/$FNAME does not exists. Save it first."
   exit 1
@@ -78,24 +85,42 @@ check_saved_file ()
 save_cache ()
 {
  # Save unbound cache
- $PRINTF "Saving cache in $CONF/$FNAME..."
- $UC dump_cache>$CONF/$FNAME
+ filename=$1
+ if [ -z "$filename" ]; then
+  $ECHO "Saving cache in $CONF/$FNAME..."
+  $UC dump_cache>$CONF/$FNAME
+  $LS -lh $CONF/$FNAME
+ else
+  $ECHO "Saving cache in $filename..."
+  $UC dump_cache>$filename
+  $LS -lh $filename
+ fi
  $ECHO "ok"
 }
 
 load_cache ()
 {
- # Load saved cache contents and warmup DNS cache
- $PRINTF "Loading cache from saved $CONF/$FNAME..."
- check_saved_file
- $CAT $CONF/$FNAME|$UC load_cache
+ # Load saved cache contents and warmup cache
+ filename=$1
+ if [ -z "$filename" ]; then
+  $ECHO "Loading cache from saved $CONF/$FNAME..."
+  $LS -lh $CONF/$FNAME
+  check_saved_file $filename
+  $CAT $CONF/$FNAME|$UC load_cache
+ else
+  $ECHO "Loading cache from saved $filename..."
+  $LS -lh $filename
+  check_saved_file $filename
+  $CAT $filename|$UC load_cache
+ fi
 }
 
 reload_cache ()
 {
  # Reloading and refresh existing cache and saved dump
- save_cache
- load_cache
+ filename=$1
+ save_cache $filename
+ load_cache $filename
 }
 
 ##############
@@ -109,27 +134,41 @@ root_check
 check_uc
 
 # Check command-line arguments
-if [ "x$1" = "x" ]; then
-# If arguments list empty, load cache by default
+if [ "x$*" = "x" ]; then
+ # If arguments list empty,load cache by default
  load_cache
 else
- arg_list=$1
+ arg_list=$*
  # Parse command line
  set -- `$GETOPT sSlLrRhH: $arg_list` || {
   usage_note 1>&2
  }
 
-  # Read arguments
+ # Read arguments
  for i in $arg_list
   do
    case $i in
-    -s | -S) save_cache;;
-    -l | -L) load_cache;;
-    -r | -R) reload_cache;;
+    -s | -S) save="1";;
+    -l | -L) save="0";;
+    -r | -R) save="2";;
     -h | -H | \?) usage_note;;
+    *) shift
+       file=$1
+       break;;
    esac
-   break
+   shift
   done
+
+ # Remove trailing --
+ shift `$EXPR $OPTIND - 1`
+fi
+
+if [ "$save" = "1" ]; then
+ save_cache $file
+elif [ "$save" = "0" ]; then
+ load_cache $file
+elif [ "$save" = "2" ]; then
+ reload_cache $file
 fi
 
 exit 0

contrib/unbound_munin_

@@ -150,7 +150,7 @@ get_state ( ) {
 			fi
 		done
 		# try to get it
-		echo $$ >$lock
+		if echo $$ >$lock ; then : ; else break; fi
 	done
 	# do not refetch if the file exists and only LEE seconds old
 	if test -f $state; then
@@ -210,6 +210,7 @@ exist_config ( ) {
 	if grep '^'$1'=' $state >/dev/null 2>&1; then
 		echo "$mn.label $2"
 		echo "$mn.min 0"
+		echo "$mn.type ABSOLUTE"
 	fi
 }
 
@@ -218,6 +219,7 @@ p_config ( ) {
 	mn=`echo $1 | sed $ABBREV | tr . _`
 	echo $mn.label "$2"
 	echo $mn.min 0
+	echo $mn.type $3
 }
 
 if test "$1" = "config" ; then
@@ -228,20 +230,21 @@ if test "$1" = "config" ; then
 	hits)
 		echo "graph_title Unbound DNS traffic and cache hits"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
 			sed -e 's/=.*//'`; do
 			exist_config $x "queries handled by `basename $x .num.queries`"
 		done
-		p_config "total.num.queries" "total queries from clients"
-		p_config "total.num.cachehits" "cache hits"
-		p_config "total.num.prefetch" "cache prefetch"
-		p_config "num.query.tcp" "TCP queries"
-		p_config "num.query.tcpout" "TCP out queries"
-		p_config "num.query.ipv6" "IPv6 queries"
-		p_config "unwanted.queries" "queries that failed acl"
-		p_config "unwanted.replies" "unwanted or unsolicited replies"
+		p_config "total.num.queries" "total queries from clients" "ABSOLUTE"
+		p_config "total.num.cachehits" "cache hits" "ABSOLUTE"
+		p_config "total.num.prefetch" "cache prefetch" "ABSOLUTE"
+		p_config "num.query.tcp" "TCP queries" "ABSOLUTE"
+		p_config "num.query.tcpout" "TCP out queries" "ABSOLUTE"
+		p_config "num.query.ipv6" "IPv6 queries" "ABSOLUTE"
+		p_config "unwanted.queries" "queries that failed acl" "ABSOLUTE"
+		p_config "unwanted.replies" "unwanted or unsolicited replies" "ABSOLUTE"
 		echo "u_replies.warning $warn"
 		echo "u_replies.critical $crit"
 		echo "graph_info DNS queries to the recursive resolver. The unwanted replies could be innocent duplicate packets, late replies, or spoof threats."
@@ -250,11 +253,12 @@ if test "$1" = "config" ; then
 		echo "graph_title Unbound requestlist size"
 		echo "graph_args --base 1000 -l 0"
 		echo "graph_vlabel number of queries"
+		echo "graph_scale no"
 		echo "graph_category DNS"
-		p_config "total.requestlist.avg" "Average size of queue on insert"
-		p_config "total.requestlist.max" "Max size of queue (in 5 min)"
-		p_config "total.requestlist.overwritten" "Number of queries replaced by new ones"
-		p_config "total.requestlist.exceeded" "Number of queries dropped due to lack of space"
+		p_config "total.requestlist.avg" "Average size of queue on insert" "GAUGE"
+		p_config "total.requestlist.max" "Max size of queue (in 5 min)" "GAUGE"
+		p_config "total.requestlist.overwritten" "Number of queries replaced by new ones" "GAUGE"
+		p_config "total.requestlist.exceeded" "Number of queries dropped due to lack of space" "GAUGE"
 		echo "graph_info The queries that did not hit the cache and need recursion service take up space in the requestlist. If there are too many queries, first queries get overwritten, and at last resort dropped."
 		;;
 	memory)
@@ -262,128 +266,143 @@ if test "$1" = "config" ; then
 		echo "graph_args --base 1024 -l 0"
 		echo "graph_vlabel memory used in bytes"
 		echo "graph_category DNS"
-		p_config "mem.total.sbrk" "Total memory"
-		p_config "mem.cache.rrset" "RRset cache memory"
-		p_config "mem.cache.message" "Message cache memory"
-		p_config "mem.mod.iterator" "Iterator module memory"
-		p_config "mem.mod.validator" "Validator module and key cache memory"
-		p_config "msg.cache.count" "msg cache count"
-		p_config "rrset.cache.count" "rrset cache count"
-		p_config "infra.cache.count" "infra cache count"
-		p_config "key.cache.count" "key cache count"
+		p_config "mem.cache.rrset" "RRset cache memory" "GAUGE"
+		p_config "mem.cache.message" "Message cache memory" "GAUGE"
+		p_config "mem.mod.iterator" "Iterator module memory" "GAUGE"
+		p_config "mem.mod.validator" "Validator module and key cache memory" "GAUGE"
+		p_config "msg.cache.count" "msg cache count" "GAUGE"
+		p_config "rrset.cache.count" "rrset cache count" "GAUGE"
+		p_config "infra.cache.count" "infra cache count" "GAUGE"
+		p_config "key.cache.count" "key cache count" "GAUGE"
 		echo "graph_info The memory used by unbound."
 		;;
 	by_type)
 		echo "graph_title Unbound DNS queries by type"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.query.type" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.query.type.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
 		echo "graph_info queries by DNS RR type queried for"
 		;;
 	by_class)
 		echo "graph_title Unbound DNS queries by class"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.query.class" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.query.class.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
 		echo "graph_info queries by DNS RR class queried for."
 		;;
 	by_opcode)
 		echo "graph_title Unbound DNS queries by opcode"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.query.opcode" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.query.opcode.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
 		echo "graph_info queries by opcode in the query packet."
 		;;
 	by_rcode)
 		echo "graph_title Unbound DNS answers by return code"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel answer packets / second"
+		echo "graph_vlabel answer packets / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.answer.rcode" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.answer.rcode.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
-		p_config "num.answer.secure" "answer secure"
-		p_config "num.answer.bogus" "answer bogus"
-		p_config "num.rrset.bogus" "num rrsets marked bogus"
-		echo "graph_info answers sorted by return value. rrsets bogus is the number of rrsets marked bogus per second by the validator"
+		p_config "num.answer.secure" "answer secure" "ABSOLUTE"
+		p_config "num.answer.bogus" "answer bogus" "ABSOLUTE"
+		p_config "num.rrset.bogus" "num rrsets marked bogus" "ABSOLUTE"
+		echo "graph_info answers sorted by return value. rrsets bogus is the number of rrsets marked bogus per \${graph_period} by the validator"
 		;;
 	by_flags)
 		echo "graph_title Unbound DNS incoming queries by flags"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
-		p_config "num.query.flags.QR" "QR (query reply) flag"
-		p_config "num.query.flags.AA" "AA (auth answer) flag"
-		p_config "num.query.flags.TC" "TC (truncated) flag"
-		p_config "num.query.flags.RD" "RD (recursion desired) flag"
-		p_config "num.query.flags.RA" "RA (rec avail) flag"
-		p_config "num.query.flags.Z" "Z (zero) flag"
-		p_config "num.query.flags.AD" "AD (auth data) flag"
-		p_config "num.query.flags.CD" "CD (check disabled) flag"
-		p_config "num.query.edns.present" "EDNS OPT present"
-		p_config "num.query.edns.DO" "DO (DNSSEC OK) flag"
+		p_config "num.query.flags.QR" "QR (query reply) flag" "ABSOLUTE"
+		p_config "num.query.flags.AA" "AA (auth answer) flag" "ABSOLUTE"
+		p_config "num.query.flags.TC" "TC (truncated) flag" "ABSOLUTE"
+		p_config "num.query.flags.RD" "RD (recursion desired) flag" "ABSOLUTE"
+		p_config "num.query.flags.RA" "RA (rec avail) flag" "ABSOLUTE"
+		p_config "num.query.flags.Z" "Z (zero) flag" "ABSOLUTE"
+		p_config "num.query.flags.AD" "AD (auth data) flag" "ABSOLUTE"
+		p_config "num.query.flags.CD" "CD (check disabled) flag" "ABSOLUTE"
+		p_config "num.query.edns.present" "EDNS OPT present" "ABSOLUTE"
+		p_config "num.query.edns.DO" "DO (DNSSEC OK) flag" "ABSOLUTE"
 		echo "graph_info This graphs plots the flags inside incoming queries. For example, if QR, AA, TC, RA, Z flags are set, the query can be rejected. RD, AD, CD and DO are legitimately set by some software."
 		;;
 	histogram)
 		echo "graph_title Unbound DNS histogram of reply time"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		echo hcache.label "cache hits"
 		echo hcache.min 0
+		echo hcache.type ABSOLUTE
 		echo hcache.draw AREA
 		echo hcache.colour 999999
 		echo h64ms.label "0 msec - 66 msec"
 		echo h64ms.min 0
+		echo h64ms.type ABSOLUTE
 		echo h64ms.draw STACK
 		echo h64ms.colour 0000FF
 		echo h128ms.label "66 msec - 131 msec"
 		echo h128ms.min 0
+		echo h128ms.type ABSOLUTE
 		echo h128ms.colour 1F00DF
 		echo h128ms.draw STACK
 		echo h256ms.label "131 msec - 262 msec"
 		echo h256ms.min 0
+		echo h256ms.type ABSOLUTE
 		echo h256ms.draw STACK
 		echo h256ms.colour 3F00BF
 		echo h512ms.label "262 msec - 524 msec"
 		echo h512ms.min 0
+		echo h512ms.type ABSOLUTE
 		echo h512ms.draw STACK
 		echo h512ms.colour 5F009F
 		echo h1s.label "524 msec - 1 sec"
 		echo h1s.min 0
+		echo h1s.type ABSOLUTE
 		echo h1s.draw STACK
 		echo h1s.colour 7F007F
 		echo h2s.label "1 sec - 2 sec"
 		echo h2s.min 0
+		echo h2s.type ABSOLUTE
 		echo h2s.draw STACK
 		echo h2s.colour 9F005F
 		echo h4s.label "2 sec - 4 sec"
 		echo h4s.min 0
+		echo h4s.type ABSOLUTE
 		echo h4s.draw STACK
 		echo h4s.colour BF003F
 		echo h8s.label "4 sec - 8 sec"
 		echo h8s.min 0
+		echo h8s.type ABSOLUTE
 		echo h8s.draw STACK
 		echo h8s.colour DF001F
 		echo h16s.label "8 sec - ..."
 		echo h16s.min 0
+		echo h16s.type ABSOLUTE
 		echo h16s.draw STACK
 		echo h16s.colour FF0000
 		echo "graph_info Histogram of the reply times for queries."
@@ -404,20 +423,6 @@ if test $value = 0 || test $value = "0.000000"; then
 fi
 elapsed="$value"
 
-# print value for $1 / elapsed
-print_qps ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	get_value $1
-	echo "$mn.value" `echo scale=6';' $value / $elapsed | bc `
-}
-
-# print qps if line already found in $2
-print_qps_line ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	value="`echo $2 | sed -e 's/^.*=//'`"
-	echo "$mn.value" `echo scale=6';' $value / $elapsed | bc `
-}
-
 # print value for $1
 print_value ( ) {
 	mn=`echo $1 | sed $ABBREV | tr . _`
@@ -425,6 +430,14 @@ print_value ( ) {
 	echo "$mn.value" $value
 }
 
+# print value if line already found in $2
+print_value_line ( ) {
+	mn=`echo $1 | sed $ABBREV | tr . _`
+	value="`echo $2 | sed -e 's/^.*=//'`"
+	echo "$mn.value" $value
+}
+
+
 case $id in
 hits)
 	for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
@@ -433,7 +446,7 @@ hits)
 		num.query.tcpout num.query.ipv6 unwanted.queries \
 		unwanted.replies; do
 		if grep "^"$x"=" $state >/dev/null 2>&1; then
-			print_qps $x
+			print_value $x
 		fi
 	done
 	;;
@@ -444,20 +457,6 @@ queue)
 	done
 	;;
 memory)
-	mn=`echo mem.total.sbrk | sed $ABBREV | tr . _`
-	get_value 'mem.total.sbrk'
-	if test $value -eq 0; then
-		chk=`echo $ctrl | sed -e 's/-control$/-checkconf/'`
-		pidf=`$chk -o pidfile $conf 2>&1`
-		pid=`cat $pidf 2>&1`
-		value=`ps -p "$pid" -o rss= 2>&1`
-		if test "`expr $value + 1 - 1 2>&1`" -eq "$value" 2>&1; then
-			value=`expr $value \* 1024` 
-		else
-			value=0
-		fi
-	fi
-	echo "$mn.value" $value
 	for x in mem.cache.rrset mem.cache.message mem.mod.iterator \
 		mem.mod.validator msg.cache.count rrset.cache.count \
 		infra.cache.count key.cache.count; do
@@ -467,38 +466,38 @@ memory)
 by_type)
 	for x in `grep "^num.query.type" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
 	;;
 by_class)
 	for x in `grep "^num.query.class" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
 	;;
 by_opcode)
 	for x in `grep "^num.query.opcode" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
 	;;
 by_rcode)
 	for x in `grep "^num.answer.rcode" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
-	print_qps "num.answer.secure"
-	print_qps "num.answer.bogus"
-	print_qps "num.rrset.bogus"
+	print_value "num.answer.secure"
+	print_value "num.answer.bogus"
+	print_value "num.rrset.bogus"
 	;;
 by_flags)
 	for x in num.query.flags.QR num.query.flags.AA num.query.flags.TC num.query.flags.RD num.query.flags.RA num.query.flags.Z num.query.flags.AD num.query.flags.CD num.query.edns.present num.query.edns.DO; do
-		print_qps $x
+		print_value $x
 	done
 	;;
 histogram)
 	get_value total.num.cachehits
-	echo hcache.value `echo scale=6';' $value / $elapsed | bc `
+	echo hcache.value $value
 	r=0
 	for x in histogram.000000.000000.to.000000.000001 \
 		histogram.000000.000001.to.000000.000002 \
@@ -520,21 +519,21 @@ histogram)
 		get_value $x
 		r=`expr $r + $value`
 	done
-	echo h64ms.value `echo scale=6';' $r / $elapsed | bc `
+	echo h64ms.value $r
 	get_value histogram.000000.065536.to.000000.131072
-	echo h128ms.value `echo scale=6';' $value / $elapsed | bc `
+	echo h128ms.value $value
 	get_value histogram.000000.131072.to.000000.262144
-	echo h256ms.value `echo scale=6';' $value / $elapsed | bc `
+	echo h256ms.value $value
 	get_value histogram.000000.262144.to.000000.524288
-	echo h512ms.value `echo scale=6';' $value / $elapsed | bc `
+	echo h512ms.value $value
 	get_value histogram.000000.524288.to.000001.000000
-	echo h1s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h1s.value $value
 	get_value histogram.000001.000000.to.000002.000000
-	echo h2s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h2s.value $value
 	get_value histogram.000002.000000.to.000004.000000
-	echo h4s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h4s.value $value
 	get_value histogram.000004.000000.to.000008.000000
-	echo h8s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h8s.value $value
 	r=0
 	for x in histogram.000008.000000.to.000016.000000 \
 		histogram.000016.000000.to.000032.000000 \
@@ -555,6 +554,6 @@ histogram)
 		get_value $x
 		r=`expr $r + $value`
 	done
-	echo h16s.value `echo scale=6';' $r / $elapsed | bc `
+	echo h16s.value $r
 	;;
 esac

contrib/unbound_unixsock.diff

@@ -1,305 +0,0 @@
-diff --git a/daemon/remote.c b/daemon/remote.c
-index a2b2204..b6990f3 100644
---- a/daemon/remote.c
-+++ b/daemon/remote.c
-@@ -81,6 +81,11 @@
- #ifdef HAVE_NETDB_H
- #include <netdb.h>
- #endif
-+#ifdef HAVE_PWD_H
-+#include <pwd.h>
-+#include <sys/stat.h>
-+#include <fcntl.h>
-+#endif
- 
- /* just for portability */
- #ifdef SQ
-@@ -235,7 +240,8 @@ void daemon_remote_delete(struct daemon_remote* rc)
-  * @return false on failure.
-  */
- static int
--add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err)
-+add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
-+	struct config_file* cfg)
- {
- 	struct addrinfo hints;
- 	struct addrinfo* res;
-@@ -246,29 +252,74 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err)
- 	snprintf(port, sizeof(port), "%d", nr);
- 	port[sizeof(port)-1]=0;
- 	memset(&hints, 0, sizeof(hints));
--	hints.ai_socktype = SOCK_STREAM;
--	hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
--	if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
--#ifdef USE_WINSOCK
--		if(!noproto_is_err && r == EAI_NONAME) {
--			/* tried to lookup the address as name */
--			return 1; /* return success, but do nothing */
-+
-+	if(ip[0] == '/') {
-+		/* This looks like UNIX socket! */
-+		fd = create_domain_accept_sock(ip);
-+/*
-+ * When unbound starts, it first creates a socket and then
-+ * drops privs, so the socket is created as root user.
-+ * This is fine, but we would like to set _unbound user group
-+ * for this socket, and permissions should be 0660 so only
-+ * root and _unbound group members can invoke unbound-control.
-+ * The username used here is the same as username that unbound
-+ * uses for its worker processes.
-+ */
-+
-+/*
-+ * Note: this code is an exact copy of code from daemon.c
-+ * Normally this should be either wrapped into a function,
-+ * or gui/gid values should be retrieved at config parsing time
-+ * and then stored in configfile structure.
-+ * This requires action from unbound developers!
-+*/
-+#ifdef HAVE_GETPWNAM
-+		struct passwd *pwd = NULL;
-+		uid_t uid;
-+		gid_t gid;
-+		/* initialize, but not to 0 (root) */
-+		memset(&uid, 112, sizeof(uid));
-+		memset(&gid, 112, sizeof(gid));
-+		log_assert(cfg);
-+
-+		if(cfg->username && cfg->username[0]) {
-+			if((pwd = getpwnam(cfg->username)) == NULL)
-+				fatal_exit("user '%s' does not exist.",
-+					cfg->username);
-+			uid = pwd->pw_uid;
-+			gid = pwd->pw_gid;
-+			endpwent();
- 		}
-+
-+		chown(ip, 0, gid);
-+		chmod(ip, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
-+#endif
-+	} else {
-+		hints.ai_socktype = SOCK_STREAM;
-+		hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
-+		if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
-+#ifdef USE_WINSOCK
-+			if(!noproto_is_err && r == EAI_NONAME) {
-+				/* tried to lookup the address as name */
-+				return 1; /* return success, but do nothing */
-+			}
- #endif /* USE_WINSOCK */
--                log_err("control interface %s:%s getaddrinfo: %s %s",
--			ip?ip:"default", port, gai_strerror(r),
-+			log_err("control interface %s:%s getaddrinfo: %s %s",
-+				ip?ip:"default", port, gai_strerror(r),
- #ifdef EAI_SYSTEM
- 			r==EAI_SYSTEM?(char*)strerror(errno):""
- #else
- 			""
- #endif
- 			);
--		return 0;
-+			return 0;
-+		}
-+
-+		/* open fd */
-+		fd = create_tcp_accept_sock(res, 1, &noproto);
-+		freeaddrinfo(res);
- 	}
- 
--	/* open fd */
--	fd = create_tcp_accept_sock(res, 1, &noproto);
--	freeaddrinfo(res);
- 	if(fd == -1 && noproto) {
- 		if(!noproto_is_err)
- 			return 1; /* return success, but do nothing */
-@@ -305,7 +356,7 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
- 	if(cfg->control_ifs) {
- 		struct config_strlist* p;
- 		for(p = cfg->control_ifs; p; p = p->next) {
--			if(!add_open(p->str, cfg->control_port, &l, 1)) {
-+			if(!add_open(p->str, cfg->control_port, &l, 1, cfg)) {
- 				listening_ports_free(l);
- 				return NULL;
- 			}
-@@ -313,12 +364,12 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
- 	} else {
- 		/* defaults */
- 		if(cfg->do_ip6 &&
--			!add_open("::1", cfg->control_port, &l, 0)) {
-+			!add_open("::1", cfg->control_port, &l, 0, cfg)) {
- 			listening_ports_free(l);
- 			return NULL;
- 		}
- 		if(cfg->do_ip4 &&
--			!add_open("127.0.0.1", cfg->control_port, &l, 1)) {
-+			!add_open("127.0.0.1", cfg->control_port, &l, 1, cfg)) {
- 			listening_ports_free(l);
- 			return NULL;
- 		}
-diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
-index ea7ec3a..4cb04e2 100644
---- a/services/listen_dnsport.c
-+++ b/services/listen_dnsport.c
-@@ -55,6 +55,10 @@
- #endif
- #include <fcntl.h>
- 
-+#ifndef USE_WINSOCK
-+#include <sys/un.h>
-+#endif
-+
- /** number of queued TCP connections for listen() */
- #define TCP_BACKLOG 5 
- 
-@@ -376,6 +380,53 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
- }
- 
- int
-+create_domain_accept_sock(char *path) {
-+	int s;
-+	struct sockaddr_un unixaddr;
-+
-+#ifndef USE_WINSOCK
-+	unixaddr.sun_len = sizeof(unixaddr);
-+	unixaddr.sun_family = AF_UNIX;
-+	strlcpy(unixaddr.sun_path, path, 104);
-+
-+	if((s = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
-+		log_err("Cannot create UNIX socket %s (%s)",
-+			path, strerror(errno));
-+		return -1;
-+	}
-+
-+	if(unlink(path) && errno != ENOENT) {
-+		/* The socket already exists and cannot be removed */
-+		log_err("Cannot remove old UNIX socket %s (%s)",
-+			path, strerror(errno));
-+		return -1;
-+	}
-+
-+	if(bind(s, (struct sockaddr *) &unixaddr,
-+		sizeof(struct sockaddr_un)) == -1) {
-+		log_err("Cannot bind UNIX socket %s (%s)",
-+			path, strerror(errno));
-+		return -1;
-+	}
-+
-+	if(!fd_set_nonblock(s)) {
-+		log_err("Cannot set non-blocking mode");
-+		return -1;
-+	}
-+
-+	if(listen(s, TCP_BACKLOG) == -1) {
-+		log_err("can't listen: %s", strerror(errno));
-+		return -1;
-+	}
-+
-+	return s;
-+#else
-+	log_err("UNIX sockets are not supported");
-+	return -1;
-+#endif
-+}
-+
-+int
- create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto)
- {
- 	int s;
-diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
-index a872f92..10631fd 100644
---- a/smallapp/unbound-control.c
-+++ b/smallapp/unbound-control.c
-@@ -59,6 +59,8 @@
- #include "util/locks.h"
- #include "util/net_help.h"
- 
-+#include <sys/un.h>
-+
- /** Give unbound-control usage, and exit (1). */
- static void
- usage()
-@@ -158,6 +160,7 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
- {
- 	struct sockaddr_storage addr;
- 	socklen_t addrlen;
-+	int addrfamily = 0;
- 	int fd;
- 	/* use svr or the first config entry */
- 	if(!svr) {
-@@ -176,12 +179,21 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
- 	if(strchr(svr, '@')) {
- 		if(!extstrtoaddr(svr, &addr, &addrlen))
- 			fatal_exit("could not parse IP@port: %s", svr);
-+	} else if(svr[0] == '/') {
-+		struct sockaddr_un* unixsock = (struct sockaddr_un *) &addr;
-+		unixsock->sun_family = AF_UNIX;
-+		unixsock->sun_len = sizeof(unixsock);
-+		strlcpy(unixsock->sun_path, svr, 104);
-+		addrlen = sizeof(struct sockaddr_un);
-+		addrfamily = AF_UNIX;
- 	} else {
- 		if(!ipstrtoaddr(svr, cfg->control_port, &addr, &addrlen))
- 			fatal_exit("could not parse IP: %s", svr);
- 	}
--	fd = socket(addr_is_ip6(&addr, addrlen)?AF_INET6:AF_INET, 
--		SOCK_STREAM, 0);
-+
-+	if(addrfamily != AF_UNIX)
-+		addrfamily = addr_is_ip6(&addr, addrlen)?AF_INET6:AF_INET;
-+	fd = socket(addrfamily, SOCK_STREAM, 0);
- 	if(fd == -1) {
- #ifndef USE_WINSOCK
- 		fatal_exit("socket: %s", strerror(errno));
-diff --git a/util/net_help.c b/util/net_help.c
-index b3136a3..5b5b4a3 100644
---- a/util/net_help.c
-+++ b/util/net_help.c
-@@ -45,6 +45,7 @@
- #include "util/module.h"
- #include "util/regional.h"
- #include <fcntl.h>
-+#include <sys/un.h>
- #include <openssl/ssl.h>
- #include <openssl/err.h>
- 
-@@ -135,7 +136,7 @@ log_addr(enum verbosity_value v, const char* str,
- {
- 	uint16_t port;
- 	const char* family = "unknown";
--	char dest[100];
-+	char dest[108];
- 	int af = (int)((struct sockaddr_in*)addr)->sin_family;
- 	void* sinaddr = &((struct sockaddr_in*)addr)->sin_addr;
- 	if(verbosity < v)
-@@ -148,15 +149,23 @@ log_addr(enum verbosity_value v, const char* str,
- 		case AF_UNIX: family="unix"; break;
- 		default: break;
- 	}
--	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
--		strncpy(dest, "(inet_ntop error)", sizeof(dest));
-+
-+	if(af != AF_UNIX) {
-+		if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
-+			strncpy(dest, "(inet_ntop error)", sizeof(dest));
-+		}
-+		dest[sizeof(dest)-1] = 0;
-+		port = ntohs(((struct sockaddr_in*)addr)->sin_port);
-+		if(verbosity >= 4)
-+			verbose(v, "%s %s %s port %d (len %d)", str, family,
-+				dest, (int)port, (int)addrlen);
-+		else	verbose(v, "%s %s port %d", str, dest, (int)port);
-+	} else {
-+		struct sockaddr_un* unixsock;
-+		unixsock = (struct sockaddr_un *) addr;
-+		strlcpy(dest, unixsock->sun_path, sizeof(dest));
-+		verbose(v, "%s %s %s", str, family, dest);
- 	}
--	dest[sizeof(dest)-1] = 0;
--	port = ntohs(((struct sockaddr_in*)addr)->sin_port);
--	if(verbosity >= 4)
--		verbose(v, "%s %s %s port %d (len %d)", str, family, dest, 
--			(int)port, (int)addrlen);
--	else	verbose(v, "%s %s port %d", str, dest, (int)port);
- }
- 
- int 

contrib/warmup.cmd

@@ -1,68 +1,153 @@
 @echo off
 
 rem --------------------------------------------------------------
-rem -- Warm up DNS cache script by your own MRU domains
+rem -- Warm up DNS cache script by your own MRU domains or from
+rem -- file when it specified as script argument.
 rem --
-rem -- Version 1.0
+rem -- Version 1.1
 rem -- By Yuri Voinov (c) 2014
 rem --------------------------------------------------------------
 
+rem DNS host address
+set address="127.0.0.1"
+
 rem Check dig installed
 for /f "delims=" %%a in ('where dig') do @set dig=%%a
 if /I "%dig%"=="" echo Dig not found. If installed, add path to PATH environment variable. & exit 1
 echo Dig found: %dig%
 
-echo Warming up cache by MRU domains...
-rem dig -f my_domains 1>nul 2>nul
-rem echo Done.
+set arg=%1%
 
+if defined %arg% (goto builtin) else (goto from_file)
+
+:builtin
+echo Warming up cache by MRU domains...
 for %%a in (
-mail.ru
-my.mail.ru
-mra.mail.ru
+2gis.ru
+admir.kz
+adobe.com
 agent.mail.ru
-news.mail.ru
-icq.com
-lenta.ru
-gazeta.ru
-peerbet.ru
-www.opennet.ru
-snob.ru
+aimp.ru
+akamai.com
+akamai.net
+almaty.tele2.kz
+aol.com
+apple.com
+arin.com
 artlebedev.ru
-mail.google.com
-translate.google.com
+auto.mail.ru
+beeline.kz
+bing.com
+blogspot.com
+comodo.com
+dnscrypt.org
 drive.google.com
+drive.mail.ru
+facebook.com
+farmanager.com
+fb.com
+firefox.com
+forum.farmanager.com
+gazeta.ru
+getsharex.com
+gismeteo.ru
 google.com
 google.kz
-drive.google.com
-blogspot.com
-farmanager.com
-forum.farmanager.com
+google.ru
+googlevideo.com
+goto.kz
+iana.org
+icq.com
+imap.mail.ru
+instagram.com
+intel.com
+irr.kz
+java.com
+kaspersky.com
+kaspersky.ru
+kcell.kz
+krisha.kz
+lady.mail.ru
+lenta.ru
+libreoffice.org
+linkedin.com
+livejournal.com
+mail.google.com
+mail.ru
+microsoft.com
+mozilla.org
+mra.mail.ru
+munin-monitoring.org
+my.mail.ru
+news.bbcimg.co.uk
+news.mail.ru
+newsimg.bbc.net.uk
+nvidia.com
+odnoklassniki.ru
+ok.ru
+opencsw.org
+opendns.com
+opendns.org
+opennet.ru
+opera.com
+oracle.com
+peerbet.ru
+piriform.com
 plugring.farmanager.com
+privoxy.org
+qip.ru
+raidcall.com
+rambler.ru
+reddit.com
+ru.wikipedia.org
+shallalist.de
+skype.com
+snob.ru
+squid-cache.org
+squidclamav.darold.net
+squidguard.org
+ssl.comodo.com
+ssl.verisign.com
 symantec.com
 symantecliveupdate.com
-shalla.de
-torstatus.blutmagie.de
-torproject.org
-dnscrypt.org
-unbound.net
-getsharex.com
-skype.com
-vlc.org
-aimp.ru
-mozilla.org
-libreoffice.org
-piriform.com
-raidcall.com
-nvidia.com
-intel.com
-microsoft.com
-windowsupdate.com
-ru.wikipedia.org
-www.bbc.co.uk
+tele2.kz
 tengrinews.kz
-) do "%dig%" %%a 1>nul 2>nul
+thunderbird.com
+torproject.org
+torstatus.blutmagie.de
+translate.google.com
+unbound.net
+verisign.com
+vk.com
+vk.me
+vk.ru
+vkontakte.com
+vkontakte.ru
+vlc.org
+watsapp.net
+weather.mail.ru
+windowsupdate.com
+www.baidu.com
+www.bbc.co.uk
+www.internic.net
+www.opennet.ru
+www.topgear.com
+ya.ru
+yahoo.com
+yandex.com
+yandex.ru
+youtube.com
+ytimg.com
+) do "%dig%" %%a @%address% 1>nul 2>nul
+goto end
 
+:from_file
+echo Warming up cache from %1% file...
+%dig% -f %arg% @%address% 1>nul 2>nul 
+
+:end
 echo Saving cache...
-unbound_cache.cmd -s
+if exist unbound_cache.cmd unbound_cache.cmd -s
 echo Done.
+
+exit 0

contrib/warmup.sh

@@ -1,65 +1,150 @@
 #!/bin/sh
 
 # --------------------------------------------------------------
-# -- Warm up DNS cache script by your own MRU domains
+# -- Warm up DNS cache script by your own MRU domains or from
+# -- file when it specified as script argument.
 # --
-# -- Version 1.0
+# -- Version 1.1
 # -- By Yuri Voinov (c) 2014
 # --------------------------------------------------------------
 
+# Default DNS host address
+address="127.0.0.1"
+
+cat=`which cat`
 dig=`which dig`
 
+if [ -z "$1" ]; then
 echo "Warming up cache by MRU domains..."
-$dig -f - >/dev/null 2>&1 <<EOT
-mail.ru
-my.mail.ru
-mra.mail.ru
+$dig -f - @$address >/dev/null 2>&1 <<EOT
+2gis.ru
+admir.kz
+adobe.com
 agent.mail.ru
-news.mail.ru
-icq.com
-lenta.ru
-gazeta.ru
-peerbet.ru
-www.opennet.ru
-snob.ru
+aimp.ru
+akamai.com
+akamai.net
+almaty.tele2.kz
+aol.com
+apple.com
+arin.com
 artlebedev.ru
-mail.google.com
-translate.google.com
+auto.mail.ru
+beeline.kz
+bing.com
+blogspot.com
+clamav.net
+comodo.com
+dnscrypt.org
 drive.google.com
+drive.mail.ru
+facebook.com
+farmanager.com
+fb.com
+firefox.com
+forum.farmanager.com
+gazeta.ru
+getsharex.com
+gismeteo.ru
 google.com
 google.kz
-drive.google.com
-blogspot.com
-farmanager.com
-forum.farmanager.com
+google.ru
+googlevideo.com
+goto.kz
+iana.org
+icq.com
+imap.mail.ru
+instagram.com
+instagram.com
+intel.com
+irr.kz
+java.com
+kaspersky.com
+kaspersky.ru
+kcell.kz
+krisha.kz
+lady.mail.ru
+lenta.ru
+libreoffice.org
+linkedin.com
+livejournal.com
+mail.google.com
+mail.ru
+microsoft.com
+mozilla.org
+mra.mail.ru
+munin-monitoring.org
+my.mail.ru
+news.bbcimg.co.uk
+news.mail.ru
+newsimg.bbc.net.uk
+nvidia.com
+odnoklassniki.ru
+ok.ru
+opencsw.org
+opendns.com
+opendns.org
+opennet.ru
+opera.com
+oracle.com
+peerbet.ru
+piriform.com
 plugring.farmanager.com
+privoxy.org
+qip.ru
+raidcall.com
+rambler.ru
+reddit.com
+ru.wikipedia.org
+shallalist.de
+skype.com
+snob.ru
+squid-cache.org
+squidclamav.darold.net
+squidguard.org
+ssl.comodo.com
+ssl.verisign.com
 symantec.com
 symantecliveupdate.com
-shalla.de
-torstatus.blutmagie.de
-torproject.org
-dnscrypt.org
-unbound.net
-getsharex.com
-skype.com
-vlc.org
-aimp.ru
-mozilla.org
-libreoffice.org
-piriform.com
-raidcall.com
-nvidia.com
-intel.com
-microsoft.com
-windowsupdate.com
-ru.wikipedia.org
-www.bbc.co.uk
+tele2.kz
 tengrinews.kz
+thunderbird.com
+torproject.org
+torstatus.blutmagie.de
+translate.google.com
+unbound.net
+verisign.com
+vk.com
+vk.me
+vk.ru
+vkontakte.com
+vkontakte.ru
+vlc.org
+watsapp.net
+weather.mail.ru
+windowsupdate.com
+www.baidu.com
+www.bbc.co.uk
+www.internic.net
+www.opennet.ru
+www.topgear.com
+ya.ru
+yahoo.com
+yandex.com
+yandex.ru
+youtube.com
+ytimg.com
 EOT
+else
+ echo "Warming up cache from $1 file..."
+ $cat $1 | $dig -f - @$address >/dev/null 2>&1 
+fi
+
 echo "Done."
 
 echo "Saving cache..."
-/usr/local/bin/unbound_cache.sh -s
+script=`which unbound_cache.sh`
+[ -f "$script" ] && $script -s
 echo "Done."
 
 exit 0

daemon/acl_list.c

@@ -45,6 +45,8 @@
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
+#include "services/localzone.h"
+#include "sldns/str2wire.h"
 
 struct acl_list* 
 acl_list_create(void)
@@ -71,21 +73,21 @@ acl_list_delete(struct acl_list* acl)
 }
 
 /** insert new address into acl_list structure */
-static int
+static struct acl_addr*
 acl_list_insert(struct acl_list* acl, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int net, enum acl_access control, 
 	int complain_duplicates)
 {
-	struct acl_addr* node = regional_alloc(acl->region,
+	struct acl_addr* node = regional_alloc_zero(acl->region,
 		sizeof(struct acl_addr));
 	if(!node)
-		return 0;
+		return NULL;
 	node->control = control;
 	if(!addr_tree_insert(&acl->tree, &node->node, addr, addrlen, net)) {
 		if(complain_duplicates)
 			verbose(VERB_QUERY, "duplicate acl address ignored.");
 	}
-	return 1;
+	return node;
 }
 
 /** apply acl_list string */
@@ -125,6 +127,205 @@ acl_list_str_cfg(struct acl_list* acl, const char* str, const char* s2,
 	return 1;
 }
 
+/** find or create node (NULL on parse or error) */
+static struct acl_addr*
+acl_find_or_create(struct acl_list* acl, const char* str)
+{
+	struct acl_addr* node;
+	struct sockaddr_storage addr;
+	int net;
+	socklen_t addrlen;
+	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
+		log_err("cannot parse netblock: %s", str);
+		return NULL;
+	}
+	/* find or create node */
+	if(!(node=(struct acl_addr*)addr_tree_find(&acl->tree, &addr,
+		addrlen, net))) {
+		/* create node, type 'allow' since otherwise tags are
+		 * pointless, can override with specific access-control: cfg */
+		if(!(node=(struct acl_addr*)acl_list_insert(acl, &addr,
+			addrlen, net, acl_allow, 1))) {
+			log_err("out of memory");
+			return NULL;
+		}
+	}
+	return node;
+}
+
+/** apply acl_tag string */
+static int
+acl_list_tags_cfg(struct acl_list* acl, const char* str, uint8_t* bitmap,
+	size_t bitmaplen)
+{
+	struct acl_addr* node;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	node->taglen = bitmaplen;
+	node->taglist = regional_alloc_init(acl->region, bitmap, bitmaplen);
+	if(!node->taglist) {
+		log_err("out of memory");
+		return 0;
+	}
+	return 1;
+}
+
+/** apply acl_view string */
+static int
+acl_list_view_cfg(struct acl_list* acl, const char* str, const char* str2,
+	struct views* vs)
+{
+	struct acl_addr* node;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	node->view = views_find_view(vs, str2, 0 /* get read lock*/);
+	if(!node->view) {
+		log_err("no view with name: %s", str2);
+		return 0;
+	}
+	lock_rw_unlock(&node->view->lock);
+	return 1;
+}
+
+/** apply acl_tag_action string */
+static int
+acl_list_tag_action_cfg(struct acl_list* acl, struct config_file* cfg,
+	const char* str, const char* tag, const char* action)
+{
+	struct acl_addr* node;
+	int tagid;
+	enum localzone_type t;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	/* allocate array if not yet */
+	if(!node->tag_actions) {
+		node->tag_actions = (uint8_t*)regional_alloc_zero(acl->region,
+			sizeof(*node->tag_actions)*cfg->num_tags);
+		if(!node->tag_actions) {
+			log_err("out of memory");
+			return 0;
+		}
+		node->tag_actions_size = (size_t)cfg->num_tags;
+	}
+	/* parse tag */
+	if((tagid=find_tag_id(cfg, tag)) == -1) {
+		log_err("cannot parse tag (define-tag it): %s %s", str, tag);
+		return 0;
+	}
+	if((size_t)tagid >= node->tag_actions_size) {
+		log_err("tagid too large for array %s %s", str, tag);
+		return 0;
+	}
+	if(!local_zone_str2type(action, &t)) {
+		log_err("cannot parse access control action type: %s %s %s",
+			str, tag, action);
+		return 0;
+	}
+	node->tag_actions[tagid] = (uint8_t)t;
+	return 1;
+}
+
+/** check wire data parse */
+static int
+check_data(const char* data, const struct config_strlist* head)
+{
+	char buf[65536];
+	uint8_t rr[LDNS_RR_BUF_SIZE];
+	size_t len = sizeof(rr);
+	int res;
+	/* '.' is sufficient for validation, and it makes the call to
+	 * sldns_wirerr_get_type() simpler below. */
+	snprintf(buf, sizeof(buf), "%s %s", ".", data);
+	res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600, NULL, 0,
+		NULL, 0);
+
+	/* Reject it if we would end up having CNAME and other data (including
+	 * another CNAME) for the same tag. */
+	if(res == 0 && head) {
+		const char* err_data = NULL;
+
+		if(sldns_wirerr_get_type(rr, len, 1) == LDNS_RR_TYPE_CNAME) {
+			/* adding CNAME while other data already exists. */
+			err_data = data;
+		} else {
+			snprintf(buf, sizeof(buf), "%s %s", ".", head->str);
+			len = sizeof(rr);
+			res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600,
+				NULL, 0, NULL, 0);
+			if(res != 0) {
+				/* This should be impossible here as head->str
+				 * has been validated, but we check it just in
+				 * case. */
+				return 0;
+			}
+			if(sldns_wirerr_get_type(rr, len, 1) ==
+				LDNS_RR_TYPE_CNAME) /* already have CNAME */
+				err_data = head->str;
+		}
+		if(err_data) {
+			log_err("redirect tag data '%s' must not coexist with "
+				"other data.", err_data);
+			return 0;
+		}
+	}
+	if(res == 0)
+		return 1;
+	log_err("rr data [char %d] parse error %s",
+		(int)LDNS_WIREPARSE_OFFSET(res)-13,
+		sldns_get_errorstr_parse(res));
+	return 0;
+}
+
+/** apply acl_tag_data string */
+static int
+acl_list_tag_data_cfg(struct acl_list* acl, struct config_file* cfg,
+	const char* str, const char* tag, const char* data)
+{
+	struct acl_addr* node;
+	int tagid;
+	char* dupdata;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	/* allocate array if not yet */
+	if(!node->tag_datas) {
+		node->tag_datas = (struct config_strlist**)regional_alloc_zero(
+			acl->region, sizeof(*node->tag_datas)*cfg->num_tags);
+		if(!node->tag_datas) {
+			log_err("out of memory");
+			return 0;
+		}
+		node->tag_datas_size = (size_t)cfg->num_tags;
+	}
+	/* parse tag */
+	if((tagid=find_tag_id(cfg, tag)) == -1) {
+		log_err("cannot parse tag (define-tag it): %s %s", str, tag);
+		return 0;
+	}
+	if((size_t)tagid >= node->tag_datas_size) {
+		log_err("tagid too large for array %s %s", str, tag);
+		return 0;
+	}
+
+	/* check data? */
+	if(!check_data(data, node->tag_datas[tagid])) {
+		log_err("cannot parse access-control-tag data: %s %s '%s'",
+			str, tag, data);
+		return 0;
+	}
+
+	dupdata = regional_strdup(acl->region, data);
+	if(!dupdata) {
+		log_err("out of memory");
+		return 0;
+	}
+	if(!cfg_region_strlist_insert(acl->region,
+		&(node->tag_datas[tagid]), dupdata)) {
+		log_err("out of memory");
+		return 0;
+	}
+	return 1;
+}
+
 /** read acl_list config */
 static int 
 read_acl_list(struct acl_list* acl, struct config_file* cfg)
@@ -138,13 +339,114 @@ read_acl_list(struct acl_list* acl, struct config_file* cfg)
 	return 1;
 }
 
+/** read acl tags config */
+static int 
+read_acl_tags(struct acl_list* acl, struct config_file* cfg)
+{
+	struct config_strbytelist* np, *p = cfg->acl_tags;
+	cfg->acl_tags = NULL;
+	while(p) {
+		log_assert(p->str && p->str2);
+		if(!acl_list_tags_cfg(acl, p->str, p->str2, p->str2len)) {
+			config_del_strbytelist(p);
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
+/** read acl view config */
+static int 
+read_acl_view(struct acl_list* acl, struct config_file* cfg, struct views* v)
+{
+	struct config_str2list* np, *p = cfg->acl_view;
+	cfg->acl_view = NULL;
+	while(p) {
+		log_assert(p->str && p->str2);
+		if(!acl_list_view_cfg(acl, p->str, p->str2, v)) {
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
+/** read acl tag actions config */
+static int 
+read_acl_tag_actions(struct acl_list* acl, struct config_file* cfg)
+{
+	struct config_str3list* p, *np;
+	p = cfg->acl_tag_actions;
+	cfg->acl_tag_actions = NULL;
+	while(p) {
+		log_assert(p->str && p->str2 && p->str3);
+		if(!acl_list_tag_action_cfg(acl, cfg, p->str, p->str2,
+			p->str3)) {
+			config_deltrplstrlist(p);
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p->str3);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
+/** read acl tag datas config */
+static int 
+read_acl_tag_datas(struct acl_list* acl, struct config_file* cfg)
+{
+	struct config_str3list* p, *np;
+	p = cfg->acl_tag_datas;
+	cfg->acl_tag_datas = NULL;
+	while(p) {
+		log_assert(p->str && p->str2 && p->str3);
+		if(!acl_list_tag_data_cfg(acl, cfg, p->str, p->str2, p->str3)) {
+			config_deltrplstrlist(p);
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p->str3);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
 int 
-acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
+acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
+	struct views* v)
 {
 	regional_free_all(acl->region);
 	addr_tree_init(&acl->tree);
 	if(!read_acl_list(acl, cfg))
 		return 0;
+	if(!read_acl_view(acl, cfg, v))
+		return 0;
+	if(!read_acl_tags(acl, cfg))
+		return 0;
+	if(!read_acl_tag_actions(acl, cfg))
+		return 0;
+	if(!read_acl_tag_datas(acl, cfg))
+		return 0;
 	/* insert defaults, with '0' to ignore them if they are duplicates */
 	if(!acl_list_str_cfg(acl, "0.0.0.0/0", "refuse", 0))
 		return 0;
@@ -163,13 +465,18 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
 }
 
 enum acl_access 
-acl_list_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
+acl_get_control(struct acl_addr* acl)
+{
+	if(acl) return acl->control;
+	return acl_deny;
+}
+
+struct acl_addr*
+acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
         socklen_t addrlen)
 {
-	struct acl_addr* r = (struct acl_addr*)addr_tree_lookup(&acl->tree,
+	return (struct acl_addr*)addr_tree_lookup(&acl->tree,
 		addr, addrlen);
-	if(r) return r->control;
-	return acl_deny;
 }
 
 size_t 

daemon/acl_list.h

@@ -43,6 +43,7 @@
 #ifndef DAEMON_ACL_LIST_H
 #define DAEMON_ACL_LIST_H
 #include "util/storage/dnstree.h"
+#include "services/view.h"
 struct config_file;
 struct regional;
 
@@ -75,7 +76,7 @@ struct acl_list {
 	 * Tree of the addresses that are allowed/blocked.
 	 * contents of type acl_addr.
 	 */
-	rbtree_t tree;
+	rbtree_type tree;
 };
 
 /**
@@ -87,6 +88,21 @@ struct acl_addr {
 	struct addr_tree_node node;
 	/** access control on this netblock */
 	enum acl_access control;
+	/** tag bitlist */
+	uint8_t* taglist;
+	/** length of the taglist (in bytes) */
+	size_t taglen;
+	/** array per tagnumber of localzonetype(in one byte). NULL if none. */
+	uint8_t* tag_actions;
+	/** size of the tag_actions_array */
+	size_t tag_actions_size;
+	/** array per tagnumber, with per tag a list of rdata strings.
+	 * NULL if none.  strings are like 'A 127.0.0.1' 'AAAA ::1' */
+	struct config_strlist** tag_datas;
+	/** size of the tag_datas array */
+	size_t tag_datas_size;
+	/* view element, NULL if none */
+	struct view* view;
 };
 
 /**
@@ -105,19 +121,29 @@ void acl_list_delete(struct acl_list* acl);
  * Process access control config.
  * @param acl: where to store.
  * @param cfg: config options.
+ * @param v: views structure
  * @return 0 on error.
  */
-int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg);
+int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
+	struct views* v);
 
 /**
- * Lookup address to see its access control status.
+ * Lookup access control status for acl structure.
+ * @param acl: structure for acl storage.
+ * @return: what to do with message from this address.
+ */
+enum acl_access acl_get_control(struct acl_addr* acl);
+
+/**
+ * Lookup address to see its acl structure
  * @param acl: structure for address storage.
  * @param addr: address to check
  * @param addrlen: length of addr.
- * @return: what to do with message from this address.
+ * @return: acl structure from this address.
  */
-enum acl_access acl_list_lookup(struct acl_list* acl, 
-	struct sockaddr_storage* addr, socklen_t addrlen);
+struct acl_addr*
+acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
+        socklen_t addrlen);
 
 /**
  * Get memory used by acl structure.

daemon/cachedump.c

@@ -56,9 +56,9 @@
 #include "iterator/iter_utils.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
 
 /** dump one rrset zonefile line */
 static int
@@ -223,6 +223,8 @@ copy_msg(struct regional* region, struct lruhash_entry* e,
 	struct query_info** k, struct reply_info** d)
 {
 	struct reply_info* rep = (struct reply_info*)e->data;
+	if(rep->rrset_count > RR_COUNT_MAX)
+		return 0; /* to protect against integer overflow */
 	*d = (struct reply_info*)regional_alloc_init(region, e->data,
 		sizeof(struct reply_info) + 
 		sizeof(struct rrset_ref) * (rep->rrset_count-1) +
@@ -470,6 +472,10 @@ load_rrset(SSL* ssl, sldns_buffer* buf, struct worker* worker)
 		log_warn("bad rrset without contents");
 		return 0;
 	}
+	if(rr_count > RR_COUNT_MAX || rrsig_count > RR_COUNT_MAX) {
+		log_warn("bad rrset with too many rrs");
+		return 0;
+	}
 	d->count = (size_t)rr_count;
 	d->rrsig_count = (size_t)rrsig_count;
 	d->security = (enum sec_status)security;
@@ -557,6 +563,7 @@ load_qinfo(char* str, struct query_info* qinfo, struct regional* region)
 	qinfo->qclass = sldns_wirerr_get_class(rr, rr_len, dname_len);
 	qinfo->qname_len = dname_len;
 	qinfo->qname = (uint8_t*)regional_alloc_init(region, rr, dname_len);
+	qinfo->local_alias = NULL;
 	if(!qinfo->qname) {
 		log_warn("error out of memory");
 		return NULL;
@@ -646,6 +653,10 @@ load_msg(SSL* ssl, sldns_buffer* buf, struct worker* worker)
 	rep.ttl = (time_t)ttl;
 	rep.prefetch_ttl = PREFETCH_TTL_CALC(rep.ttl);
 	rep.security = (enum sec_status)security;
+	if(an > RR_COUNT_MAX || ns > RR_COUNT_MAX || ar > RR_COUNT_MAX) {
+		log_warn("error too many rrsets");
+		return 0; /* protect against integer overflow in alloc */
+	}
 	rep.an_numrrsets = (size_t)an;
 	rep.ns_numrrsets = (size_t)ns;
 	rep.ar_numrrsets = (size_t)ar;
@@ -816,6 +827,7 @@ int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
 	qinfo.qname_len = nmlen;
 	qinfo.qtype = LDNS_RR_TYPE_A;
 	qinfo.qclass = LDNS_RR_CLASS_IN;
+	qinfo.local_alias = NULL;
 
 	dname_str(nm, b);
 	if(!ssl_printf(ssl, "The following name servers are used for lookup "

daemon/daemon.c

@@ -73,20 +73,27 @@
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/data/msgreply.h"
+#include "util/shm_side/shm_main.h"
 #include "util/storage/lookup3.h"
 #include "util/storage/slabhash.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
 #include "services/localzone.h"
+#include "services/view.h"
 #include "services/modstack.h"
 #include "util/module.h"
 #include "util/random.h"
 #include "util/tube.h"
 #include "util/net_help.h"
-#include "ldns/keyraw.h"
+#include "sldns/keyraw.h"
+#include "respip/respip.h"
 #include <signal.h>
 
+#ifdef HAVE_SYSTEMD
+#include <systemd/sd-daemon.h>
+#endif
+
 /** How many quit requests happened. */
 static int sig_record_quit = 0;
 /** How many reload requests happened. */
@@ -174,8 +181,15 @@ static void
 signal_handling_playback(struct worker* wrk)
 {
 #ifdef SIGHUP
-	if(sig_record_reload)
+	if(sig_record_reload) {
+# ifdef HAVE_SYSTEMD
+		sd_notify(0, "RELOADING=1");
+# endif
 		worker_sighandler(SIGHUP, wrk);
+# ifdef HAVE_SYSTEMD
+		sd_notify(0, "READY=1");
+# endif
+	}
 #endif
 	if(sig_record_quit)
 		worker_sighandler(SIGTERM, wrk);
@@ -204,20 +218,29 @@ daemon_init(void)
 	signal_handling_record();
 	checklock_start();
 #ifdef HAVE_SSL
+#  ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
-	ERR_load_SSL_strings();
-#  ifdef HAVE_OPENSSL_CONFIG
-	OPENSSL_config("unbound");
 #  endif
+	ERR_load_SSL_strings();
 #  ifdef USE_GOST
 	(void)sldns_key_EVP_load_gost_id();
 #  endif
+#  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 	OpenSSL_add_all_algorithms();
+#  else
+	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
+		| OPENSSL_INIT_ADD_ALL_DIGESTS
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 	/* grab the COMP method ptr because openssl leaks it */
 	comp_meth = (void*)SSL_COMP_get_compression_methods();
 #  endif
+#  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
+#  else
+	(void)OPENSSL_init_ssl(0, NULL);
+#  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	if(!ub_openssl_lock_init())
 		fatal_exit("could not init openssl locks");
@@ -239,9 +262,16 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
+	/* init edns_known_options */
+	if(!edns_known_options_init(daemon->env)) {
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	alloc_init(&daemon->superalloc, NULL, 0);
 	daemon->acl = acl_list_create();
 	if(!daemon->acl) {
+		edns_known_options_delete(daemon->env);
 		free(daemon->env);
 		free(daemon);
 		return NULL;
@@ -338,6 +368,7 @@ static void daemon_setup_modules(struct daemon* daemon)
 		daemon->env)) {
 		fatal_exit("failed to setup modules");
 	}
+	log_edns_known_options(VERB_ALGO, daemon->env);
 }
 
 /**
@@ -399,8 +430,16 @@ daemon_create_workers(struct daemon* daemon)
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
 	
 	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
+	if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
+		log_warn("cannot reduce num-threads to %d because so-reuseport "
+			"so continuing with %d threads.", (int)daemon->num,
+			(int)daemon->num_ports);
+		daemon->num = (int)daemon->num_ports;
+	}
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
+	if(!daemon->workers)
+		fatal_exit("out of memory during daemon init");
 	if(daemon->cfg->dnstap) {
 #ifdef USE_DNSTAP
 		daemon->dtenv = dt_create(daemon->cfg->dnstap_socket_path,
@@ -464,7 +503,7 @@ thread_start(void* arg)
 #endif
 #ifdef SO_REUSEPORT
 	if(worker->daemon->cfg->so_reuseport)
-		port_num = worker->thread_num;
+		port_num = worker->thread_num % worker->daemon->num_ports;
 	else
 		port_num = 0;
 #endif
@@ -524,17 +563,55 @@ daemon_stop_others(struct daemon* daemon)
 void 
 daemon_fork(struct daemon* daemon)
 {
+	int have_view_respip_cfg = 0;
+
 	log_assert(daemon);
-	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg))
+	if(!(daemon->views = views_create()))
+		fatal_exit("Could not create views: out of memory");
+	/* create individual views and their localzone/data trees */
+	if(!views_apply_cfg(daemon->views, daemon->cfg))
+		fatal_exit("Could not set up views");
+
+	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->views))
 		fatal_exit("Could not setup access control list");
+	if(daemon->cfg->dnscrypt) {
+#ifdef USE_DNSCRYPT
+		daemon->dnscenv = dnsc_create();
+		if (!daemon->dnscenv)
+			fatal_exit("dnsc_create failed");
+		dnsc_apply_cfg(daemon->dnscenv, daemon->cfg);
+#else
+		fatal_exit("dnscrypt enabled in config but unbound was not built with "
+				   "dnscrypt support");
+#endif
+	}
+	/* create global local_zones */
 	if(!(daemon->local_zones = local_zones_create()))
 		fatal_exit("Could not create local zones: out of memory");
 	if(!local_zones_apply_cfg(daemon->local_zones, daemon->cfg))
 		fatal_exit("Could not set up local zones");
 
+	/* process raw response-ip configuration data */
+	if(!(daemon->respip_set = respip_set_create()))
+		fatal_exit("Could not create response IP set");
+	if(!respip_global_apply_cfg(daemon->respip_set, daemon->cfg))
+		fatal_exit("Could not set up response IP set");
+	if(!respip_views_apply_cfg(daemon->views, daemon->cfg,
+		&have_view_respip_cfg))
+		fatal_exit("Could not set up per-view response IP sets");
+	daemon->use_response_ip = !respip_set_is_empty(daemon->respip_set) ||
+		have_view_respip_cfg;
+
 	/* setup modules */
 	daemon_setup_modules(daemon);
 
+	/* response-ip-xxx options don't work as expected without the respip
+	 * module.  To avoid run-time operational surprise we reject such
+	 * configuration. */
+	if(daemon->use_response_ip &&
+		modstack_find(&daemon->mods, "respip") < 0)
+		fatal_exit("response-ip options require respip module");
+
 	/* first create all the worker structures, so we can pass
 	 * them to the newly created threads. 
 	 */
@@ -561,14 +638,26 @@ daemon_fork(struct daemon* daemon)
 #endif
 	signal_handling_playback(daemon->workers[0]);
 
+	if (!shm_main_init(daemon))
+		log_warn("SHM has failed");
+
 	/* Start resolver service on main thread. */
+#ifdef HAVE_SYSTEMD
+	sd_notify(0, "READY=1");
+#endif
 	log_info("start of service (%s).", PACKAGE_STRING);
 	worker_work(daemon->workers[0]);
+#ifdef HAVE_SYSTEMD
+	sd_notify(0, "STOPPING=1");
+#endif
 	log_info("service stopped (%s).", PACKAGE_STRING);
 
 	/* we exited! a signal happened! Stop other threads */
 	daemon_stop_others(daemon);
 
+	/* Shutdown SHM */
+	shm_main_shutdown(daemon);
+
 	daemon->need_to_exit = daemon->workers[0]->need_to_exit;
 }
 
@@ -583,13 +672,16 @@ daemon_cleanup(struct daemon* daemon)
 	log_thread_set(NULL);
 	/* clean up caches because
 	 * a) RRset IDs will be recycled after a reload, causing collisions
-	 * b) validation config can change, thus rrset, msg, keycache clear 
-	 * The infra cache is kept, the timing and edns info is still valid */
+	 * b) validation config can change, thus rrset, msg, keycache clear */
 	slabhash_clear(&daemon->env->rrset_cache->table);
 	slabhash_clear(daemon->env->msg_cache);
 	local_zones_delete(daemon->local_zones);
 	daemon->local_zones = NULL;
-	/* key cache is cleared by module desetup during next daemon_init() */
+	respip_set_delete(daemon->respip_set);
+	daemon->respip_set = NULL;
+	views_delete(daemon->views);
+	daemon->views = NULL;
+	/* key cache is cleared by module desetup during next daemon_fork() */
 	daemon_remote_clear(daemon->rc);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
@@ -618,6 +710,7 @@ daemon_delete(struct daemon* daemon)
 		slabhash_delete(daemon->env->msg_cache);
 		rrset_cache_delete(daemon->env->rrset_cache);
 		infra_delete(daemon->env->infra_cache);
+		edns_known_options_delete(daemon->env);
 	}
 	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
@@ -641,18 +734,27 @@ daemon_delete(struct daemon* daemon)
 #  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
 #    ifndef S_SPLINT_S
+#      if OPENSSL_VERSION_NUMBER < 0x10100000
 	sk_SSL_COMP_pop_free(comp_meth, (void(*)())CRYPTO_free);
+#      endif
 #    endif
 #  endif
 #  ifdef HAVE_OPENSSL_CONFIG
 	EVP_cleanup();
+#  if OPENSSL_VERSION_NUMBER < 0x10100000
 	ENGINE_cleanup();
+#  endif
 	CONF_modules_free();
 #  endif
+#  ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
 	CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
-	ERR_remove_state(0);
+#  endif
+#  ifdef HAVE_ERR_FREE_STRINGS
 	ERR_free_strings();
+#  endif
+#  if OPENSSL_VERSION_NUMBER < 0x10100000
 	RAND_cleanup();
+#  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	ub_openssl_lock_delete();
 #  endif

daemon/daemon.h

@@ -45,9 +45,6 @@
 #include "util/locks.h"
 #include "util/alloc.h"
 #include "services/modstack.h"
-#ifdef UB_ON_WINDOWS
-#  include "util/winsock_event.h"
-#endif
 struct config_file;
 struct worker;
 struct listen_port;
@@ -56,14 +53,22 @@ struct module_env;
 struct rrset_cache;
 struct acl_list;
 struct local_zones;
+struct views;
 struct ub_randstate;
 struct daemon_remote;
+struct respip_set;
+struct shm_main_info;
 
 #include "dnstap/dnstap_config.h"
 #ifdef USE_DNSTAP
 struct dt_env;
 #endif
 
+#include "dnscrypt/dnscrypt_config.h"
+#ifdef USE_DNSCRYPT
+struct dnsc_env;
+#endif
+
 /**
  * Structure holding worker list.
  * Holds globally visible information.
@@ -114,9 +119,20 @@ struct daemon {
 	struct timeval time_last_stat;
 	/** time when daemon started */
 	struct timeval time_boot;
+	/** views structure containing view tree */
+	struct views* views;
 #ifdef USE_DNSTAP
 	/** the dnstap environment master value, copied and changed by threads*/
 	struct dt_env* dtenv;
+#endif
+	struct shm_main_info* shm_info;
+	/** response-ip set with associated actions and tags. */
+	struct respip_set* respip_set;
+	/** some response-ip tags or actions are configured if true */
+	int use_response_ip;
+#ifdef USE_DNSCRYPT
+	/** the dnscrypt environment */
+	struct dnsc_env* dnscenv;
 #endif
 };
 

daemon/remote.h

@@ -56,8 +56,8 @@ struct comm_reply;
 struct comm_point;
 struct daemon_remote;
 
-/** number of seconds timeout on incoming remote control handshake */
-#define REMOTE_CONTROL_TCP_TIMEOUT 120
+/** number of milliseconds timeout on incoming remote control handshake */
+#define REMOTE_CONTROL_TCP_TIMEOUT 120000
 
 /**
  * a busy control command connection, SSL state
@@ -89,6 +89,8 @@ struct daemon_remote {
 	struct worker* worker;
 	/** commpoints for accepting remote control connections */
 	struct listen_list* accept_list;
+	/* if certificates are used */
+	int use_cert;
 	/** number of active commpoints that are handling remote control */
 	int active;
 	/** max active commpoints */

daemon/stats.c

@@ -50,12 +50,13 @@
 #include "daemon/daemon.h"
 #include "services/mesh.h"
 #include "services/outside_network.h"
+#include "services/listen_dnsport.h"
 #include "util/config_file.h"
 #include "util/tube.h"
 #include "util/timehist.h"
 #include "util/net_help.h"
 #include "validator/validator.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
 #include "validator/val_kcache.h"
@@ -101,12 +102,14 @@ void server_stats_log(struct server_stats* stats, struct worker* worker,
 	int threadnum)
 {
 	log_info("server stats for thread %d: %u queries, "
-		"%u answers from cache, %u recursions, %u prefetch", 
+		"%u answers from cache, %u recursions, %u prefetch, %u rejected by "
+		"ip ratelimiting",
 		threadnum, (unsigned)stats->num_queries, 
 		(unsigned)(stats->num_queries - 
 			stats->num_queries_missed_cache),
 		(unsigned)stats->num_queries_missed_cache,
-		(unsigned)stats->num_queries_prefetch);
+		(unsigned)stats->num_queries_prefetch,
+		(unsigned)stats->num_queries_ip_ratelimited);
 	log_info("server stats for thread %d: requestlist max %u avg %g "
 		"exceeded %u jostled %u", threadnum,
 		(unsigned)stats->max_query_list_size,
@@ -140,6 +143,7 @@ void
 server_stats_compile(struct worker* worker, struct stats_info* s, int reset)
 {
 	int i;
+	struct listen_list* lp;
 
 	s->svr = worker->stats;
 	s->mesh_num_states = worker->env.mesh->all.count;
@@ -174,6 +178,13 @@ server_stats_compile(struct worker* worker, struct stats_info* s, int reset)
 		s->svr.key_cache_count = count_slabhash_entries(worker->env.key_cache->slab);
 	else	s->svr.key_cache_count = 0;
 
+	/* get tcp accept usage */
+	s->svr.tcp_accept_usage = 0;
+	for(lp = worker->front->cps; lp; lp = lp->next) {
+		if(lp->com->type == comm_tcp_accept)
+			s->svr.tcp_accept_usage += lp->com->cur_tcp_count;
+	}
+
 	if(reset && !worker->env.cfg->stat_cumulative) {
 		worker_stats_clear(worker);
 	}
@@ -217,9 +228,18 @@ void server_stats_reply(struct worker* worker, int reset)
 void server_stats_add(struct stats_info* total, struct stats_info* a)
 {
 	total->svr.num_queries += a->svr.num_queries;
+	total->svr.num_queries_ip_ratelimited += a->svr.num_queries_ip_ratelimited;
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
 	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
 	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
+#ifdef USE_DNSCRYPT
+    total->svr.num_query_dnscrypt_crypted += a->svr.num_query_dnscrypt_crypted;
+    total->svr.num_query_dnscrypt_cert += a->svr.num_query_dnscrypt_cert;
+    total->svr.num_query_dnscrypt_cleartext += \
+        a->svr.num_query_dnscrypt_cleartext;
+    total->svr.num_query_dnscrypt_crypted_malformed += \
+        a->svr.num_query_dnscrypt_crypted_malformed;
+#endif
 	/* the max size reached is upped to higher of both */
 	if(a->svr.max_query_list_size > total->svr.max_query_list_size)
 		total->svr.max_query_list_size = a->svr.max_query_list_size;
@@ -242,11 +262,13 @@ void server_stats_add(struct stats_info* total, struct stats_info* a)
 		total->svr.qEDNS += a->svr.qEDNS;
 		total->svr.qEDNS_DO += a->svr.qEDNS_DO;
 		total->svr.ans_rcode_nodata += a->svr.ans_rcode_nodata;
+		total->svr.zero_ttl_responses += a->svr.zero_ttl_responses;
 		total->svr.ans_secure += a->svr.ans_secure;
 		total->svr.ans_bogus += a->svr.ans_bogus;
 		total->svr.rrset_bogus += a->svr.rrset_bogus;
 		total->svr.unwanted_replies += a->svr.unwanted_replies;
 		total->svr.unwanted_queries += a->svr.unwanted_queries;
+		total->svr.tcp_accept_usage += a->svr.tcp_accept_usage;
 		for(i=0; i<STATS_QTYPE_NUM; i++)
 			total->svr.qtype[i] += a->svr.qtype[i];
 		for(i=0; i<STATS_QCLASS_NUM; i++)

daemon/stats.h

@@ -43,6 +43,7 @@
 #ifndef DAEMON_STATS_H
 #define DAEMON_STATS_H
 #include "util/timehist.h"
+#include "dnscrypt/dnscrypt_config.h"
 struct worker;
 struct config_file;
 struct comm_point;
@@ -63,6 +64,8 @@ struct sldns_buffer;
 struct server_stats {
 	/** number of queries from clients received. */
 	size_t num_queries;
+	/** number of queries that have been dropped/ratelimited by ip. */
+	size_t num_queries_ip_ratelimited;
 	/** number of queries that had a cache-miss. */
 	size_t num_queries_missed_cache;
 	/** number of prefetch queries - cachehits with prefetch */
@@ -129,7 +132,10 @@ struct server_stats {
 	size_t unwanted_replies;
 	/** unwanted traffic received on client-facing ports */
 	size_t unwanted_queries;
-
+	/** usage of tcp accept list */
+	size_t tcp_accept_usage;
+	/** answers served from expired cache */
+	size_t zero_ttl_responses;
 	/** histogram data exported to array 
 	 * if the array is the same size, no data is lost, and
 	 * if all histograms are same size (is so by default) then
@@ -144,6 +150,16 @@ struct server_stats {
 	size_t infra_cache_count;
 	/** number of key cache entries */
 	size_t key_cache_count;
+#ifdef USE_DNSCRYPT
+    /** number of queries that used dnscrypt */
+    size_t num_query_dnscrypt_crypted;
+    /** number of queries that queried dnscrypt certificates */
+    size_t num_query_dnscrypt_cert;
+    /** number of queries in clear text and not asking for the certificates */
+    size_t num_query_dnscrypt_cleartext;
+    /** number of malformed encrypted queries */
+    size_t num_query_dnscrypt_crypted_malformed;
+#endif
 };
 
 /** 

daemon/unbound.c

@@ -57,6 +57,7 @@
 #include "util/data/msgreply.h"
 #include "util/module.h"
 #include "util/net_help.h"
+#include "util/ub_event.h"
 #include <signal.h>
 #include <fcntl.h>
 #include <openssl/crypto.h>
@@ -77,22 +78,6 @@
 #include <login_cap.h>
 #endif
 
-#ifdef USE_MINI_EVENT
-#  ifdef USE_WINSOCK
-#    include "util/winsock_event.h"
-#  else
-#    include "util/mini_event.h"
-#  endif
-#else
-#  ifdef HAVE_EVENT_H
-#    include <event.h>
-#  else
-#    include "event2/event.h"
-#    include "event2/event_struct.h"
-#    include "event2/event_compat.h"
-#  endif
-#endif
-
 #ifdef UB_ON_WINDOWS
 #  include "winrc/win_svc.h"
 #endif
@@ -102,64 +87,14 @@
 #  include "nss.h"
 #endif
 
-#ifdef HAVE_SBRK
-/** global debug value to keep track of heap memory allocation */
-void* unbound_start_brk = 0;
-#endif
-
-#if !defined(HAVE_EVENT_BASE_GET_METHOD) && (defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
-static const char* ev_backend2str(int b)
-{
-	switch(b) {
-	case EVBACKEND_SELECT:	return "select";
-	case EVBACKEND_POLL:	return "poll";
-	case EVBACKEND_EPOLL:	return "epoll";
-	case EVBACKEND_KQUEUE:	return "kqueue";
-	case EVBACKEND_DEVPOLL: return "devpoll";
-	case EVBACKEND_PORT:	return "evport";
-	}
-	return "unknown";
-}
-#endif
-
-/** get the event system in use */
-static void get_event_sys(const char** n, const char** s, const char** m)
-{
-#ifdef USE_WINSOCK
-	*n = "event";
-	*s = "winsock";
-	*m = "WSAWaitForMultipleEvents";
-#elif defined(USE_MINI_EVENT)
-	*n = "mini-event";
-	*s = "internal";
-	*m = "select";
-#else
-	struct event_base* b;
-	*s = event_get_version();
-#  ifdef HAVE_EVENT_BASE_GET_METHOD
-	*n = "libevent";
-	b = event_base_new();
-	*m = event_base_get_method(b);
-#  elif defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
-	*n = "libev";
-	b = (struct event_base*)ev_default_loop(EVFLAG_AUTO);
-	*m = ev_backend2str(ev_backend((struct ev_loop*)b));
-#  else
-	*n = "unknown";
-	*m = "not obtainable";
-	b = NULL;
-#  endif
-#  ifdef HAVE_EVENT_BASE_FREE
-	event_base_free(b);
-#  endif
-#endif
-}
-
 /** print usage. */
-static void usage()
+static void usage(void)
 {
 	const char** m;
 	const char *evnm="event", *evsys="", *evmethod="";
+	time_t t;
+	struct timeval now;
+	struct ub_event_base* base;
 	printf("usage:  unbound [options]\n");
 	printf("	start unbound daemon DNS resolver.\n");
 	printf("-h	this help\n");
@@ -173,13 +108,20 @@ static void usage()
 	printf("   	service - used to start from services control panel\n");
 #endif
 	printf("Version %s\n", PACKAGE_VERSION);
-	get_event_sys(&evnm, &evsys, &evmethod);
+	base = ub_default_event_base(0,&t,&now);
+	ub_get_event_sys(base, &evnm, &evsys, &evmethod);
 	printf("linked libs: %s %s (it uses %s), %s\n", 
 		evnm, evsys, evmethod,
 #ifdef HAVE_SSL
+#  ifdef SSLEAY_VERSION
 		SSLeay_version(SSLEAY_VERSION)
+#  else
+		OpenSSL_version(OPENSSL_VERSION)
+#  endif
 #elif defined(HAVE_NSS)
 		NSS_GetVersion()
+#elif defined(HAVE_NETTLE)
+		"nettle"
 #endif
 		);
 	printf("linked modules:");
@@ -188,6 +130,7 @@ static void usage()
 	printf("\n");
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+	ub_event_base_free(base);
 }
 
 #ifndef unbound_testbound
@@ -228,7 +171,7 @@ checkrlimits(struct config_file* cfg)
 	struct rlimit rlim;
 
 	if(total > 1024 && 
-		strncmp(event_get_version(), "mini-event", 10) == 0) {
+		strncmp(ub_event_get_version(), "mini-event", 10) == 0) {
 		log_warn("too many file descriptors requested. The builtin"
 			"mini-event cannot handle more than 1024. Config "
 			"for less fds or compile with libevent");
@@ -242,7 +185,7 @@ checkrlimits(struct config_file* cfg)
 		total = 1024;
 	}
 	if(perthread > 64 && 
-		strncmp(event_get_version(), "winsock-event", 13) == 0) {
+		strncmp(ub_event_get_version(), "winsock-event", 13) == 0) {
 		log_err("too many file descriptors requested. The winsock"
 			" event handler cannot handle more than 64 per "
 			" thread. Config for less fds");
@@ -296,19 +239,37 @@ checkrlimits(struct config_file* cfg)
 #endif /* S_SPLINT_S */
 }
 
+/** set default logfile identity based on value from argv[0] at startup **/
+static void
+log_ident_set_fromdefault(struct config_file* cfg,
+	const char *log_default_identity)
+{
+	if(cfg->log_identity == NULL || cfg->log_identity[0] == 0)
+		log_ident_set(log_default_identity);
+	else
+		log_ident_set(cfg->log_identity);
+}
+
 /** set verbosity, check rlimits, cache settings */
 static void
 apply_settings(struct daemon* daemon, struct config_file* cfg, 
-	int cmdline_verbose, int debug_mode)
+	int cmdline_verbose, int debug_mode, const char* log_default_identity)
 {
 	/* apply if they have changed */
 	verbosity = cmdline_verbose + cfg->verbosity;
 	if (debug_mode > 1) {
 		cfg->use_syslog = 0;
+		free(cfg->logfile);
 		cfg->logfile = NULL;
 	}
 	daemon_apply_cfg(daemon, cfg);
 	checkrlimits(cfg);
+
+	if (cfg->use_systemd && cfg->do_daemonize) {
+		log_warn("use-systemd and do-daemonize should not be enabled at the same time");
+	}
+
+	log_ident_set_fromdefault(cfg, log_default_identity);
 }
 
 #ifdef HAVE_KILL
@@ -441,23 +402,21 @@ static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	const char** cfgfile)
 {
+#ifdef HAVE_KILL
+	int pidinchroot;
+#endif
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;
-	uid_t uid;
-	gid_t gid;
-	/* initialize, but not to 0 (root) */
-	memset(&uid, 112, sizeof(uid));
-	memset(&gid, 112, sizeof(gid));
-	log_assert(cfg);
 
 	if(cfg->username && cfg->username[0]) {
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
-		uid = pwd->pw_uid;
-		gid = pwd->pw_gid;
 		/* endpwent below, in case we need pwd for setusercontext */
 	}
 #endif
+#ifdef UB_ON_WINDOWS
+	w_config_adjust_directory(cfg);
+#endif
 
 	/* init syslog (as root) if needed, before daemonize, otherwise
 	 * a fork error could not be printed since daemonize closed stderr.*/
@@ -484,6 +443,12 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif
 
 #ifdef HAVE_KILL
+	/* true if pidfile is inside chrootdir, or nochroot */
+	pidinchroot = !(cfg->chrootdir && cfg->chrootdir[0]) ||
+				(cfg->chrootdir && cfg->chrootdir[0] &&
+				strncmp(cfg->pidfile, cfg->chrootdir,
+				strlen(cfg->chrootdir))==0);
+
 	/* check old pid file before forking */
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		/* calculate position of pidfile */
@@ -493,12 +458,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 				cfg, 1);
 		if(!daemon->pidfile)
 			fatal_exit("pidfile alloc: out of memory");
-		checkoldpid(daemon->pidfile,
-			/* true if pidfile is inside chrootdir, or nochroot */
-			!(cfg->chrootdir && cfg->chrootdir[0]) ||
-			(cfg->chrootdir && cfg->chrootdir[0] &&
-			strncmp(daemon->pidfile, cfg->chrootdir,
-				strlen(cfg->chrootdir))==0));
+		checkoldpid(daemon->pidfile, pidinchroot);
 	}
 #endif
 
@@ -511,33 +471,29 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #ifdef HAVE_KILL
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		writepid(daemon->pidfile, getpid());
-		if(!(cfg->chrootdir && cfg->chrootdir[0]) || 
-			(cfg->chrootdir && cfg->chrootdir[0] && 
-			strncmp(daemon->pidfile, cfg->chrootdir, 
-			strlen(cfg->chrootdir))==0)) {
-			/* delete of pidfile could potentially work,
-			 * chown to get permissions */
-			if(cfg->username && cfg->username[0]) {
-			  if(chown(daemon->pidfile, uid, gid) == -1) {
-				log_err("cannot chown %u.%u %s: %s",
-					(unsigned)uid, (unsigned)gid,
+		if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1 &&
+			pidinchroot) {
+#  ifdef HAVE_CHOWN
+			if(chown(daemon->pidfile, cfg_uid, cfg_gid) == -1) {
+				verbose(VERB_QUERY, "cannot chown %u.%u %s: %s",
+					(unsigned)cfg_uid, (unsigned)cfg_gid,
 					daemon->pidfile, strerror(errno));
-			  }
 			}
+#  endif /* HAVE_CHOWN */
 		}
 	}
 #else
 	(void)daemon;
-#endif
+#endif /* HAVE_KILL */
 
 	/* Set user context */
 #ifdef HAVE_GETPWNAM
-	if(cfg->username && cfg->username[0]) {
+	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
 #ifdef HAVE_SETUSERCONTEXT
 		/* setusercontext does initgroups, setuid, setgid, and
 		 * also resource limits from login config, but we
 		 * still call setresuid, setresgid to be sure to set all uid*/
-		if(setusercontext(NULL, pwd, uid, (unsigned)
+		if(setusercontext(NULL, pwd, cfg_uid, (unsigned)
 			LOGIN_SETALL & ~LOGIN_SETUSER & ~LOGIN_SETGROUP) != 0)
 			log_warn("unable to setusercontext %s: %s",
 				cfg->username, strerror(errno));
@@ -599,29 +555,31 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 
 	/* drop permissions after chroot, getpwnam, pidfile, syslog done*/
 #ifdef HAVE_GETPWNAM
-	if(cfg->username && cfg->username[0]) {
+	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
 #  ifdef HAVE_INITGROUPS
-		if(initgroups(cfg->username, gid) != 0)
+		if(initgroups(cfg->username, cfg_gid) != 0)
 			log_warn("unable to initgroups %s: %s",
 				cfg->username, strerror(errno));
 #  endif /* HAVE_INITGROUPS */
+#  ifdef HAVE_ENDPWENT
 		endpwent();
+#  endif
 
 #ifdef HAVE_SETRESGID
-		if(setresgid(gid,gid,gid) != 0)
+		if(setresgid(cfg_gid,cfg_gid,cfg_gid) != 0)
 #elif defined(HAVE_SETREGID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setregid(gid,gid) != 0)
+		if(setregid(cfg_gid,cfg_gid) != 0)
 #else /* use setgid */
-		if(setgid(gid) != 0)
+		if(setgid(cfg_gid) != 0)
 #endif /* HAVE_SETRESGID */
 			fatal_exit("unable to set group id of %s: %s", 
 				cfg->username, strerror(errno));
 #ifdef HAVE_SETRESUID
-		if(setresuid(uid,uid,uid) != 0)
+		if(setresuid(cfg_uid,cfg_uid,cfg_uid) != 0)
 #elif defined(HAVE_SETREUID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setreuid(uid,uid) != 0)
+		if(setreuid(cfg_uid,cfg_uid) != 0)
 #else /* use setuid */
-		if(setuid(uid) != 0)
+		if(setuid(cfg_uid) != 0)
 #endif /* HAVE_SETRESUID */
 			fatal_exit("unable to set user id of %s: %s", 
 				cfg->username, strerror(errno));
@@ -641,9 +599,10 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
  * @param cmdline_verbose: verbosity resulting from commandline -v.
  *    These increase verbosity as specified in the config file.
  * @param debug_mode: if set, do not daemonize.
+ * @param log_default_identity: Default identity to report in logs
  */
 static void 
-run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
+run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char* log_default_identity)
 {
 	struct config_file* cfg = NULL;
 	struct daemon* daemon = NULL;
@@ -665,13 +624,15 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
 					cfgfile);
 			log_warn("Continuing with default config settings");
 		}
-		apply_settings(daemon, cfg, cmdline_verbose, debug_mode);
+		apply_settings(daemon, cfg, cmdline_verbose, debug_mode, log_default_identity);
+		if(!done_setup)
+			config_lookup_uid(cfg);
 	
 		/* prepare */
 		if(!daemon_open_shared_ports(daemon))
 			fatal_exit("could not open ports");
 		if(!done_setup) { 
-			perform_setup(daemon, cfg, debug_mode, &cfgfile); 
+			perform_setup(daemon, cfg, debug_mode, &cfgfile);
 			done_setup = 1; 
 		} else {
 			/* reopen log after HUP to facilitate log rotation */
@@ -718,19 +679,16 @@ main(int argc, char* argv[])
 	int c;
 	const char* cfgfile = CONFIGFILE;
 	const char* winopt = NULL;
+	const char* log_ident_default;
 	int cmdline_verbose = 0;
 	int debug_mode = 0;
 #ifdef UB_ON_WINDOWS
 	int cmdline_cfg = 0;
 #endif
 
-#ifdef HAVE_SBRK
-	/* take debug snapshot of heap */
-	unbound_start_brk = sbrk(0);
-#endif
-
 	log_init(NULL, 0, NULL);
-	log_ident_set(strrchr(argv[0],'/')?strrchr(argv[0],'/')+1:argv[0]);
+	log_ident_default = strrchr(argv[0],'/')?strrchr(argv[0],'/')+1:argv[0];
+	log_ident_set(log_ident_default);
 	/* parse the options */
 	while( (c=getopt(argc, argv, "c:dhvw:")) != -1) {
 		switch(c) {
@@ -741,7 +699,7 @@ main(int argc, char* argv[])
 #endif
 			break;
 		case 'v':
-			cmdline_verbose ++;
+			cmdline_verbose++;
 			verbosity++;
 			break;
 		case 'd':
@@ -774,7 +732,7 @@ main(int argc, char* argv[])
 		return 1;
 	}
 
-	run_daemon(cfgfile, cmdline_verbose, debug_mode);
+	run_daemon(cfgfile, cmdline_verbose, debug_mode, log_ident_default);
 	log_init(NULL, 0, NULL); /* close logfile */
 	return 0;
 }

daemon/worker.h

@@ -61,6 +61,7 @@ struct ub_randstate;
 struct regional;
 struct tube;
 struct daemon_remote;
+struct query_info;
 
 /** worker commands */
 enum worker_commands {
@@ -84,7 +85,7 @@ struct worker {
 	/** global shared daemon structure */
 	struct daemon* daemon;
 	/** thread id */
-	ub_thread_t thr_id;
+	ub_thread_type thr_id;
 	/** pipe, for commands for this worker */
 	struct tube* cmd;
 	/** the event base this worker works with */
@@ -103,6 +104,10 @@ struct worker {
 	struct comm_point* cmd_com;
 	/** timer for statistics */
 	struct comm_timer* stat_timer;
+	/** ratelimit for errors, time value */
+	time_t err_limit_time;
+	/** ratelimit for errors, packet count */
+	unsigned int err_limit_count;
 
 	/** random() table for this worker. */
 	struct ub_randstate* rndstate;

dns64/dns64.c

@@ -411,31 +411,6 @@ handle_ipv6_ptr(struct module_qstate* qstate, int id)
     return module_wait_subquery;
 }
 
-/** allocate (special) rrset keys, return 0 on error */
-static int
-repinfo_alloc_rrset_keys(struct reply_info* rep, 
-	struct regional* region)
-{
-	size_t i;
-	for(i=0; i<rep->rrset_count; i++) {
-		if(region) {
-			rep->rrsets[i] = (struct ub_packed_rrset_key*)
-				regional_alloc(region, 
-				sizeof(struct ub_packed_rrset_key));
-			if(rep->rrsets[i]) {
-				memset(rep->rrsets[i], 0, 
-					sizeof(struct ub_packed_rrset_key));
-				rep->rrsets[i]->entry.key = rep->rrsets[i];
-			}
-		}
-		else return 0;/*	rep->rrsets[i] = alloc_special_obtain(alloc);*/
-		if(!rep->rrsets[i])
-			return 0;
-		rep->rrsets[i]->entry.data = NULL;
-	}
-	return 1;
-}
-
 static enum module_ext_state
 generate_type_A_query(struct module_qstate* qstate, int id)
 {
@@ -521,13 +496,14 @@ handle_event_moddone(struct module_qstate* qstate, int id)
      *   - An internal query.
      *   - A query for a record type other than AAAA.
      *   - CD FLAG was set on querier
-     *   - An AAAA query for which an error was returned.
+     *   - An AAAA query for which an error was returned.(qstate.return_rcode)
+     *     -> treated as servfail thus synthesize (sec 5.1.3 6147), thus
+     *        synthesize in (sec 5.1.2 of RFC6147).
      *   - A successful AAAA query with an answer.
      */
 	if ( (enum dns64_qstate)qstate->minfo[id] == DNS64_INTERNAL_QUERY
             || qstate->qinfo.qtype != LDNS_RR_TYPE_AAAA
 	    || (qstate->query_flags & BIT_CD)
-	    || qstate->return_rcode != LDNS_RCODE_NOERROR  
 	    || (qstate->return_msg &&
 		    qstate->return_msg->rep &&
 		    reply_find_answer_rrset(&qstate->qinfo,
@@ -590,6 +566,10 @@ dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
 	 * for the RRs themselves. Each RR has a length, TTL, pointer to wireformat
 	 * data, 2 bytes of data length, and 16 bytes of IPv6 address.
 	 */
+	if(fd->count > RR_COUNT_MAX) {
+		*dd_out = NULL;
+		return; /* integer overflow protection in alloc */
+	}
 	if (!(dd = *dd_out = regional_alloc(region,
 		  sizeof(struct packed_rrset_data)
 		  + fd->count * (sizeof(size_t) + sizeof(time_t) +
@@ -614,8 +594,10 @@ dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
 	dd->rr_ttl = (time_t*)&dd->rr_data[dd->count];
 	for(i = 0; i < fd->count; ++i) {
 		if (fd->rr_len[i] != 6 || fd->rr_data[i][0] != 0
-		    || fd->rr_data[i][1] != 4)
+		    || fd->rr_data[i][1] != 4) {
+			*dd_out = NULL;
 			return;
+		}
 		dd->rr_len[i] = 18;
 		dd->rr_data[i] =
 		    (uint8_t*)&dd->rr_ttl[dd->count] + 18*i;
@@ -634,6 +616,7 @@ dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
 	 */
 	if(!dk) {
 		log_err("no key");
+		*dd_out = NULL;
 		return;
 	}
 
@@ -642,6 +625,7 @@ dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
 
 	if(!dk->rk.dname) {
 		log_err("out of memory");
+		*dd_out = NULL;
 		return;
 	}
 
@@ -698,7 +682,7 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 		return;
 
 	/* allocate ub_key structures special or not */
-	if(!repinfo_alloc_rrset_keys(cp, super->region)) {
+	if(!reply_info_alloc_rrset_keys(cp, NULL, super->region)) {
 		return;
 	}
 
@@ -713,6 +697,8 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 		if(i<rep->an_numrrsets && fk->rk.type == htons(LDNS_RR_TYPE_A)) {
 			/* also sets dk->entry.hash */
 			dns64_synth_aaaa_data(fk, fd, dk, &dd, super->region, dns64_env);
+			if(!dd)
+				return;
 			/* Delete negative AAAA record from cache stored by
 			 * the iterator module */
 			rrset_cache_remove(super->env->rrset_cache, dk->rk.dname, 
@@ -814,8 +800,9 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	}
 
 	/* Store the generated response in cache. */
-	if (!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-	    0, 0, 0, NULL, super->query_flags))
+	if (!super->no_cache_store &&
+		!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
+		0, 0, 0, NULL, super->query_flags))
 		log_err("out of memory");
 }
 
@@ -861,7 +848,7 @@ static struct module_func_block dns64_block = {
  * Function for returning the above function block.
  */
 struct module_func_block *
-dns64_get_funcblock()
+dns64_get_funcblock(void)
 {
 	return &dns64_block;
 }

dnscrypt/cert.h

@@ -0,0 +1,32 @@
+#ifndef UNBOUND_DNSCRYPT_CERT_H
+#define UNBOUND_DNSCRYPT_CERT_H
+
+/**
+ * \file
+ * certificate type for dnscrypt for use in other header files
+ */
+
+#include <sodium.h>
+#define CERT_MAGIC_CERT "DNSC"
+#define CERT_MAJOR_VERSION 1
+#define CERT_MINOR_VERSION 0
+#define CERT_OLD_MAGIC_HEADER "7PYqwfzt"
+
+#define CERT_FILE_EXPIRE_DAYS 365
+
+struct SignedCert {
+    uint8_t magic_cert[4];
+    uint8_t version_major[2];
+    uint8_t version_minor[2];
+
+    // Signed Content
+    uint8_t server_publickey[crypto_box_PUBLICKEYBYTES];
+    uint8_t magic_query[8];
+    uint8_t serial[4];
+    uint8_t ts_begin[4];
+    uint8_t ts_end[4];
+    uint8_t end[64];
+};
+
+
+#endif

dnscrypt/dnscrypt.c

@@ -0,0 +1,531 @@
+
+#include "config.h"
+#include <stdlib.h>
+#include <fcntl.h>
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <sys/time.h>
+#include <sys/types.h>
+#include "sldns/sbuffer.h"
+#include "util/config_file.h"
+#include "util/net_help.h"
+#include "util/netevent.h"
+#include "util/log.h"
+
+#include "dnscrypt/cert.h"
+#include "dnscrypt/dnscrypt.h"
+
+#include <ctype.h>
+
+/**
+ * \file
+ * dnscrypt functions for encrypting DNS packets.
+ */
+
+#define DNSCRYPT_QUERY_BOX_OFFSET \
+    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_PUBLICKEYBYTES + crypto_box_HALF_NONCEBYTES)
+
+//  8 bytes: magic header (CERT_MAGIC_HEADER)
+// 12 bytes: the client's nonce
+// 12 bytes: server nonce extension
+// 16 bytes: Poly1305 MAC (crypto_box_ZEROBYTES - crypto_box_BOXZEROBYTES)
+
+#define DNSCRYPT_REPLY_BOX_OFFSET \
+    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_HALF_NONCEBYTES + crypto_box_HALF_NONCEBYTES)
+
+/**
+ * Decrypt a query using the keypair that was found using dnsc_find_keypair.
+ * The client nonce will be extracted from the encrypted query and stored in
+ * client_nonce, a shared secret will be computed and stored in nmkey and the
+ * buffer will be decrypted inplace.
+ * \param[in] keypair the keypair that matches this encrypted query.
+ * \param[in] client_nonce where the client nonce will be stored.
+ * \param[in] nmkey where the shared secret key will be written.
+ * \param[in] buffer the encrypted buffer.
+ * \return 0 on success.
+ */
+static int
+dnscrypt_server_uncurve(const KeyPair *keypair,
+                        uint8_t client_nonce[crypto_box_HALF_NONCEBYTES],
+                        uint8_t nmkey[crypto_box_BEFORENMBYTES],
+                        struct sldns_buffer* buffer)
+{
+    size_t len = sldns_buffer_limit(buffer);
+    uint8_t *const buf = sldns_buffer_begin(buffer);
+    uint8_t nonce[crypto_box_NONCEBYTES];
+    struct dnscrypt_query_header *query_header;
+
+    if (len <= DNSCRYPT_QUERY_HEADER_SIZE) {
+        return -1;
+    }
+
+    query_header = (struct dnscrypt_query_header *)buf;
+    memcpy(nmkey, query_header->publickey, crypto_box_PUBLICKEYBYTES);
+    if (crypto_box_beforenm(nmkey, nmkey, keypair->crypt_secretkey) != 0) {
+        return -1;
+    }
+
+    memcpy(nonce, query_header->nonce, crypto_box_HALF_NONCEBYTES);
+    memset(nonce + crypto_box_HALF_NONCEBYTES, 0, crypto_box_HALF_NONCEBYTES);
+
+    sldns_buffer_set_at(buffer,
+                        DNSCRYPT_QUERY_BOX_OFFSET - crypto_box_BOXZEROBYTES,
+                        0, crypto_box_BOXZEROBYTES);
+
+    if (crypto_box_open_afternm
+        (buf + DNSCRYPT_QUERY_BOX_OFFSET - crypto_box_BOXZEROBYTES,
+         buf + DNSCRYPT_QUERY_BOX_OFFSET - crypto_box_BOXZEROBYTES,
+         len - DNSCRYPT_QUERY_BOX_OFFSET + crypto_box_BOXZEROBYTES, nonce,
+         nmkey) != 0) {
+        return -1;
+    }
+
+    while (*sldns_buffer_at(buffer, --len) == 0)
+	    ;
+
+    if (*sldns_buffer_at(buffer, len) != 0x80) {
+        return -1;
+    }
+
+    memcpy(client_nonce, nonce, crypto_box_HALF_NONCEBYTES);
+    memmove(sldns_buffer_begin(buffer),
+            sldns_buffer_at(buffer, DNSCRYPT_QUERY_HEADER_SIZE),
+            len - DNSCRYPT_QUERY_HEADER_SIZE);
+
+    sldns_buffer_set_position(buffer, 0);
+    sldns_buffer_set_limit(buffer, len - DNSCRYPT_QUERY_HEADER_SIZE);
+
+    return 0;
+}
+
+
+/**
+ * Add random padding to a buffer, according to a client nonce.
+ * The length has to depend on the query in order to avoid reply attacks.
+ *
+ * @param buf a buffer
+ * @param len the initial size of the buffer
+ * @param max_len the maximum size
+ * @param nonce a nonce, made of the client nonce repeated twice
+ * @param secretkey
+ * @return the new size, after padding
+ */
+size_t
+dnscrypt_pad(uint8_t *buf, const size_t len, const size_t max_len,
+             const uint8_t *nonce, const uint8_t *secretkey)
+{
+    uint8_t *buf_padding_area = buf + len;
+    size_t padded_len;
+    uint32_t rnd;
+
+    // no padding
+    if (max_len < len + DNSCRYPT_MIN_PAD_LEN)
+        return len;
+
+    assert(nonce[crypto_box_HALF_NONCEBYTES] == nonce[0]);
+
+    crypto_stream((unsigned char *)&rnd, (unsigned long long)sizeof(rnd), nonce,
+                  secretkey);
+    padded_len =
+        len + DNSCRYPT_MIN_PAD_LEN + rnd % (max_len - len -
+                                            DNSCRYPT_MIN_PAD_LEN + 1);
+    padded_len += DNSCRYPT_BLOCK_SIZE - padded_len % DNSCRYPT_BLOCK_SIZE;
+    if (padded_len > max_len)
+        padded_len = max_len;
+
+    memset(buf_padding_area, 0, padded_len - len);
+    *buf_padding_area = 0x80;
+
+    return padded_len;
+}
+
+uint64_t
+dnscrypt_hrtime(void)
+{
+    struct timeval tv;
+    uint64_t ts = (uint64_t)0U;
+    int ret;
+
+    ret = gettimeofday(&tv, NULL);
+    if (ret == 0) {
+        ts = (uint64_t)tv.tv_sec * 1000000U + (uint64_t)tv.tv_usec;
+    } else {
+	log_err("gettimeofday: %s", strerror(errno));
+    }
+    return ts;
+}
+
+/**
+ * Add the server nonce part to once.
+ * The nonce is made half of client nonce and the seconf half of the server
+ * nonce, both of them of size crypto_box_HALF_NONCEBYTES.
+ * \param[in] nonce: a uint8_t* of size crypto_box_NONCEBYTES
+ */
+static void
+add_server_nonce(uint8_t *nonce)
+{
+    uint64_t ts;
+    uint64_t tsn;
+    uint32_t suffix;
+    ts = dnscrypt_hrtime();
+    // TODO? dnscrypt-wrapper does some logic with context->nonce_ts_last
+    // unclear if we really need it, so skipping it for now.
+    tsn = (ts << 10) | (randombytes_random() & 0x3ff);
+#if (BYTE_ORDER == LITTLE_ENDIAN)
+    tsn =
+        (((uint64_t)htonl((uint32_t)tsn)) << 32) | htonl((uint32_t)(tsn >> 32));
+#endif
+    memcpy(nonce + crypto_box_HALF_NONCEBYTES, &tsn, 8);
+    suffix = randombytes_random();
+    memcpy(nonce + crypto_box_HALF_NONCEBYTES + 8, &suffix, 4);
+}
+
+/**
+ * Encrypt a reply using the keypair that was used with the query.
+ * The client nonce will be extracted from the encrypted query and stored in
+ * The buffer will be encrypted inplace.
+ * \param[in] keypair the keypair that matches this encrypted query.
+ * \param[in] client_nonce client nonce used during the query
+ * \param[in] nmkey shared secret key used during the query.
+ * \param[in] buffer the buffer where to encrypt the reply.
+ * \param[in] udp if whether or not it is a UDP query.
+ * \param[in] max_udp_size configured max udp size.
+ * \return 0 on success.
+ */
+static int
+dnscrypt_server_curve(const KeyPair *keypair,
+                      uint8_t client_nonce[crypto_box_HALF_NONCEBYTES],
+                      uint8_t nmkey[crypto_box_BEFORENMBYTES],
+                      struct sldns_buffer* buffer,
+                      uint8_t udp,
+                      size_t max_udp_size)
+{
+    size_t dns_reply_len = sldns_buffer_limit(buffer);
+    size_t max_len = dns_reply_len + DNSCRYPT_MAX_PADDING + DNSCRYPT_REPLY_HEADER_SIZE;
+    size_t max_reply_size = max_udp_size - 20U - 8U;
+    uint8_t nonce[crypto_box_NONCEBYTES];
+    uint8_t *boxed;
+    uint8_t *const buf = sldns_buffer_begin(buffer);
+    size_t len = sldns_buffer_limit(buffer);
+
+    if(udp){
+        if (max_len > max_reply_size)
+            max_len = max_reply_size;
+    }
+
+
+    memcpy(nonce, client_nonce, crypto_box_HALF_NONCEBYTES);
+    memcpy(nonce + crypto_box_HALF_NONCEBYTES, client_nonce,
+           crypto_box_HALF_NONCEBYTES);
+
+    boxed = buf + DNSCRYPT_REPLY_BOX_OFFSET;
+    memmove(boxed + crypto_box_MACBYTES, buf, len);
+    len = dnscrypt_pad(boxed + crypto_box_MACBYTES, len,
+                       max_len - DNSCRYPT_REPLY_HEADER_SIZE, nonce,
+                       keypair->crypt_secretkey);
+    sldns_buffer_set_at(buffer,
+                        DNSCRYPT_REPLY_BOX_OFFSET - crypto_box_BOXZEROBYTES,
+                        0, crypto_box_ZEROBYTES);
+
+    // add server nonce extension
+    add_server_nonce(nonce);
+
+    if (crypto_box_afternm
+        (boxed - crypto_box_BOXZEROBYTES, boxed - crypto_box_BOXZEROBYTES,
+         len + crypto_box_ZEROBYTES, nonce, nmkey) != 0) {
+        return -1;
+    }
+
+    sldns_buffer_write_at(buffer, 0, DNSCRYPT_MAGIC_RESPONSE, DNSCRYPT_MAGIC_HEADER_LEN);
+    sldns_buffer_write_at(buffer, DNSCRYPT_MAGIC_HEADER_LEN, nonce, crypto_box_NONCEBYTES);
+    sldns_buffer_set_limit(buffer, len + DNSCRYPT_REPLY_HEADER_SIZE);
+    return 0;
+}
+
+/**
+ * Read the content of fname into buf.
+ * \param[in] fname name of the file to read.
+ * \param[in] buf the buffer in which to read the content of the file.
+ * \param[in] count number of bytes to read.
+ * \return 0 on success.
+ */
+static int
+dnsc_read_from_file(char *fname, char *buf, size_t count)
+{
+	int fd;
+	fd = open(fname, O_RDONLY);
+	if (fd == -1) {
+		return -1;
+	}
+	if (read(fd, buf, count) != (ssize_t)count) {
+		close(fd);
+		return -2;
+	}
+	close(fd);
+	return 0;
+}
+
+/**
+ * Parse certificates files provided by the configuration and load them into
+ * dnsc_env.
+ * \param[in] env the dnsc_env structure to load the certs into.
+ * \param[in] cfg the configuration.
+ * \return the number of certificates loaded.
+ */
+static int
+dnsc_parse_certs(struct dnsc_env *env, struct config_file *cfg)
+{
+	struct config_strlist *head;
+	size_t signed_cert_id;
+
+	env->signed_certs_count = 0U;
+	for (head = cfg->dnscrypt_provider_cert; head; head = head->next) {
+		env->signed_certs_count++;
+	}
+	env->signed_certs = sodium_allocarray(env->signed_certs_count,
+										  sizeof *env->signed_certs);
+
+	signed_cert_id = 0U;
+	for(head = cfg->dnscrypt_provider_cert; head; head = head->next, signed_cert_id++) {
+		if(dnsc_read_from_file(
+				head->str,
+				(char *)(env->signed_certs + signed_cert_id),
+				sizeof(struct SignedCert)) != 0) {
+			fatal_exit("dnsc_parse_certs: failed to load %s: %s", head->str, strerror(errno));
+		}
+		verbose(VERB_OPS, "Loaded cert %s", head->str);
+	}
+	return signed_cert_id;
+}
+
+/**
+ * Helper function to convert a binary key into a printable fingerprint.
+ * \param[in] fingerprint the buffer in which to write the printable key.
+ * \param[in] key the key to convert.
+ */
+void
+dnsc_key_to_fingerprint(char fingerprint[80U], const uint8_t * const key)
+{
+    const size_t fingerprint_size = 80U;
+    size_t       fingerprint_pos = (size_t) 0U;
+    size_t       key_pos = (size_t) 0U;
+
+    for (;;) {
+        assert(fingerprint_size > fingerprint_pos);
+        snprintf(&fingerprint[fingerprint_pos],
+                        fingerprint_size - fingerprint_pos, "%02X%02X",
+                        key[key_pos], key[key_pos + 1U]);
+        key_pos += 2U;
+        if (key_pos >= crypto_box_PUBLICKEYBYTES) {
+            break;
+        }
+        fingerprint[fingerprint_pos + 4U] = ':';
+        fingerprint_pos += 5U;
+    }
+}
+
+/**
+ * Find the keypair matching a DNSCrypt query.
+ * \param[in] dnscenv The DNSCrypt enviroment, which contains the list of keys
+ * supported by the server.
+ * \param[in] buffer The encrypted DNS query.
+ * \return a KeyPair * if we found a key pair matching the query, NULL otherwise.
+ */
+static const KeyPair *
+dnsc_find_keypair(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
+{
+	const KeyPair *keypairs = dnscenv->keypairs;
+	struct dnscrypt_query_header *dnscrypt_header;
+	size_t i;
+
+	if (sldns_buffer_limit(buffer) < DNSCRYPT_QUERY_HEADER_SIZE) {
+		return NULL;
+	}
+	dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
+	for (i = 0U; i < dnscenv->keypairs_count; i++) {
+		if (memcmp(keypairs[i].crypt_publickey, dnscrypt_header->magic_query,
+                   DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
+			return &keypairs[i];
+		}
+	}
+	return NULL;
+}
+
+/**
+ * Insert local-zone and local-data into configuration.
+ * In order to be able to serve certs over TXT, we can reuse the local-zone and
+ * local-data config option. The zone and qname are infered from the
+ * provider_name and the content of the TXT record from the certificate content.
+ * returns the number of certtificate TXT record that were loaded.
+ * < 0 in case of error.
+ */
+static int
+dnsc_load_local_data(struct dnsc_env* dnscenv, struct config_file *cfg)
+{
+    size_t i, j;
+	// Insert 'local-zone: "2.dnscrypt-cert.example.com" deny'
+    if(!cfg_str2list_insert(&cfg->local_zones,
+                            strdup(dnscenv->provider_name),
+                            strdup("deny"))) {
+        log_err("Could not load dnscrypt local-zone: %s deny",
+                dnscenv->provider_name);
+        return -1;
+    }
+
+    // Add local data entry of type:
+    // 2.dnscrypt-cert.example.com 86400 IN TXT "DNSC......"
+    for(i=0; i<dnscenv->signed_certs_count; i++) {
+        const char *ttl_class_type = " 86400 IN TXT \"";
+        struct SignedCert *cert = dnscenv->signed_certs + i;
+        uint16_t rrlen = strlen(dnscenv->provider_name) +
+                         strlen(ttl_class_type) +
+                         4 * sizeof(struct SignedCert) + // worst case scenario
+                         1 + // trailing double quote
+                         1;
+        char *rr = malloc(rrlen);
+        if(!rr) {
+            log_err("Could not allocate memory");
+            return -2;
+        }
+        snprintf(rr, rrlen - 1, "%s 86400 IN TXT \"", dnscenv->provider_name);
+        for(j=0; j<sizeof(struct SignedCert); j++) {
+       	    int c = (int)*((const uint8_t *) cert + j);
+            if (isprint(c) && c != '"' && c != '\\') {
+                snprintf(rr + strlen(rr), rrlen - 1 - strlen(rr), "%c", c);
+            } else {
+                snprintf(rr + strlen(rr), rrlen - 1 - strlen(rr), "\\%03d", c);
+            }
+        }
+        snprintf(rr + strlen(rr), rrlen - 1 - strlen(rr), "\"");
+        cfg_strlist_insert(&cfg->local_data, strdup(rr));
+        free(rr);
+    }
+    return dnscenv->signed_certs_count;
+}
+
+/**
+ * Parse the secret key files from `dnscrypt-secret-key` config and populates
+ * a list of secret/public keys supported by dnscrypt listener.
+ * \param[in] env The dnsc_env structure which will hold the keypairs.
+ * \param[in] cfg The config with the secret key file paths.
+ */
+static int
+dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
+{
+	struct config_strlist *head;
+	size_t keypair_id;
+
+	env->keypairs_count = 0U;
+	for (head = cfg->dnscrypt_secret_key; head; head = head->next) {
+		env->keypairs_count++;
+	}
+	env->keypairs = sodium_allocarray(env->keypairs_count,
+										  sizeof *env->keypairs);
+
+	keypair_id = 0U;
+	for(head = cfg->dnscrypt_secret_key; head; head = head->next, keypair_id++) {
+		char fingerprint[80];
+		if(dnsc_read_from_file(
+				head->str,
+				(char *)(env->keypairs[keypair_id].crypt_secretkey),
+				crypto_box_SECRETKEYBYTES) != 0) {
+			fatal_exit("dnsc_parse_keys: failed to load %s: %s", head->str, strerror(errno));
+		}
+		verbose(VERB_OPS, "Loaded key %s", head->str);
+		if (crypto_scalarmult_base(env->keypairs[keypair_id].crypt_publickey,
+								   env->keypairs[keypair_id].crypt_secretkey) != 0) {
+			fatal_exit("dnsc_parse_keys: could not generate public key from %s", head->str);
+		}
+		dnsc_key_to_fingerprint(fingerprint, env->keypairs[keypair_id].crypt_publickey);
+		verbose(VERB_OPS, "Crypt public key fingerprint for %s: %s", head->str, fingerprint);
+	}
+	return keypair_id;
+}
+
+
+/**
+ * #########################################################
+ * ############# Publicly accessible functions #############
+ * #########################################################
+ */
+
+int
+dnsc_handle_curved_request(struct dnsc_env* dnscenv,
+                           struct comm_reply* repinfo)
+{
+    struct comm_point* c = repinfo->c;
+
+    repinfo->is_dnscrypted = 0;
+    if( !c->dnscrypt ) {
+        return 1;
+    }
+    // Attempt to decrypt the query. If it is not crypted, we may still need
+    // to serve the certificate.
+    verbose(VERB_ALGO, "handle request called on DNSCrypt socket");
+    if ((repinfo->keypair = dnsc_find_keypair(dnscenv, c->buffer)) != NULL) {
+        if(dnscrypt_server_uncurve(repinfo->keypair,
+                                   repinfo->client_nonce,
+                                   repinfo->nmkey,
+                                   c->buffer) != 0){
+            verbose(VERB_ALGO, "dnscrypt: Failed to uncurve");
+            comm_point_drop_reply(repinfo);
+            return 0;
+        }
+        repinfo->is_dnscrypted = 1;
+        sldns_buffer_rewind(c->buffer);
+    }
+    return 1;
+}
+
+int
+dnsc_handle_uncurved_request(struct comm_reply *repinfo)
+{
+    if(!repinfo->c->dnscrypt) {
+        return 1;
+    }
+    sldns_buffer_copy(repinfo->c->dnscrypt_buffer, repinfo->c->buffer);
+    if(!repinfo->is_dnscrypted) {
+        return 1;
+    }
+	if(dnscrypt_server_curve(repinfo->keypair,
+                             repinfo->client_nonce,
+                             repinfo->nmkey,
+                             repinfo->c->dnscrypt_buffer,
+                             repinfo->c->type == comm_udp,
+                             repinfo->max_udp_size) != 0){
+		verbose(VERB_ALGO, "dnscrypt: Failed to curve cached missed answer");
+		comm_point_drop_reply(repinfo);
+		return 0;
+	}
+    return 1;
+}
+
+struct dnsc_env *
+dnsc_create(void)
+{
+	struct dnsc_env *env;
+	if (sodium_init() == -1) {
+		fatal_exit("dnsc_create: could not initialize libsodium.");
+	}
+	env = (struct dnsc_env *) calloc(1, sizeof(struct dnsc_env));
+	return env;
+}
+
+int
+dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
+{
+	if(dnsc_parse_certs(env, cfg) <= 0) {
+		fatal_exit("dnsc_apply_cfg: no cert file loaded");
+	}
+	if(dnsc_parse_keys(env, cfg) <= 0) {
+		fatal_exit("dnsc_apply_cfg: no key file loaded");
+	}
+	randombytes_buf(env->hash_key, sizeof env->hash_key);
+	env->provider_name = cfg->dnscrypt_provider;
+
+	if(dnsc_load_local_data(env, cfg) <= 0) {
+		fatal_exit("dnsc_apply_cfg: could not load local data");
+	}
+	return 0;
+}

dnscrypt/dnscrypt.h

@@ -0,0 +1,102 @@
+#ifndef UNBOUND_DNSCRYPT_H
+#define UNBOUND_DNSCRYPT_H
+
+/**
+ * \file
+ * dnscrypt functions for encrypting DNS packets.
+ */
+
+#include "dnscrypt/dnscrypt_config.h"
+#ifdef USE_DNSCRYPT
+
+#define DNSCRYPT_MAGIC_HEADER_LEN 8U
+#define DNSCRYPT_MAGIC_RESPONSE  "r6fnvWj8"
+
+#ifndef DNSCRYPT_MAX_PADDING
+# define DNSCRYPT_MAX_PADDING 256U
+#endif
+#ifndef DNSCRYPT_BLOCK_SIZE
+# define DNSCRYPT_BLOCK_SIZE 64U
+#endif
+#ifndef DNSCRYPT_MIN_PAD_LEN
+# define DNSCRYPT_MIN_PAD_LEN 8U
+#endif
+
+#define crypto_box_HALF_NONCEBYTES (crypto_box_NONCEBYTES / 2U)
+
+#include "config.h"
+#include "dnscrypt/cert.h"
+
+#define DNSCRYPT_QUERY_HEADER_SIZE \
+    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_PUBLICKEYBYTES + crypto_box_HALF_NONCEBYTES + crypto_box_MACBYTES)
+#define DNSCRYPT_RESPONSE_HEADER_SIZE \
+    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_NONCEBYTES + crypto_box_MACBYTES)
+
+#define DNSCRYPT_REPLY_HEADER_SIZE \
+    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_HALF_NONCEBYTES * 2 + crypto_box_MACBYTES)
+
+struct sldns_buffer;
+struct config_file;
+struct comm_reply;
+
+typedef struct KeyPair_ {
+    uint8_t crypt_publickey[crypto_box_PUBLICKEYBYTES];
+    uint8_t crypt_secretkey[crypto_box_SECRETKEYBYTES];
+} KeyPair;
+
+struct dnsc_env {
+	struct SignedCert *signed_certs;
+	size_t signed_certs_count;
+	uint8_t provider_publickey[crypto_sign_ed25519_PUBLICKEYBYTES];
+	uint8_t provider_secretkey[crypto_sign_ed25519_SECRETKEYBYTES];
+	KeyPair *keypairs;
+	size_t keypairs_count;
+	uint64_t nonce_ts_last;
+	unsigned char hash_key[crypto_shorthash_KEYBYTES];
+	char * provider_name;
+};
+
+struct dnscrypt_query_header {
+    uint8_t magic_query[DNSCRYPT_MAGIC_HEADER_LEN];
+    uint8_t publickey[crypto_box_PUBLICKEYBYTES];
+    uint8_t nonce[crypto_box_HALF_NONCEBYTES];
+    uint8_t mac[crypto_box_MACBYTES];
+};
+
+/**
+ * Initialize DNSCrypt enviroment.
+ * Initialize sodium library and allocate the dnsc_env structure.
+ * \return an uninitialized struct dnsc_env.
+ */
+struct dnsc_env * dnsc_create(void);
+
+/**
+ * Apply configuration.
+ * Read certificates and secret keys from configuration. Initialize hashkey and
+ * provider name as well as loading cert TXT records.
+ * In case of issue applying configuration, this function fatals.
+ * \param[in] env the struct dnsc_env to populate.
+ * \param[in] cfg the config_file struct with dnscrypt options.
+ * \return 0 on success.
+ */
+int dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg);
+
+/**
+ * handle a crypted dnscrypt request.
+ * Determine wether or not a query is coming over the dnscrypt listener and
+ * attempt to uncurve it or detect if it is a certificate query.
+ * return 0 in case of failure.
+ */
+int dnsc_handle_curved_request(struct dnsc_env* dnscenv,
+                               struct comm_reply* repinfo);
+/**
+ * handle an unencrypted dnscrypt request.
+ * Determine wether or not a query is going over the dnscrypt channel and
+ * attempt to curve it unless it was not crypted like when  it is a
+ * certificate query.
+ * \return 0 in case of failure.
+ */
+
+int dnsc_handle_uncurved_request(struct comm_reply *repinfo);
+#endif /* USE_DNSCRYPT */
+#endif

dnscrypt/dnscrypt.m4

@@ -0,0 +1,25 @@
+# dnscrypt.m4
+
+# dnsc_DNSCRYPT([action-if-true], [action-if-false])
+# --------------------------------------------------------------------------
+# Check for required dnscrypt libraries and add dnscrypt configure args.
+AC_DEFUN([dnsc_DNSCRYPT],
+[
+  AC_ARG_ENABLE([dnscrypt],
+    AS_HELP_STRING([--enable-dnscrypt],
+                   [Enable dnscrypt support (requires libsodium)]),
+    [opt_dnscrypt=$enableval], [opt_dnscrypt=no])
+
+  if test "x$opt_dnscrypt" != "xno"; then
+    AC_ARG_WITH([libsodium], AC_HELP_STRING([--with-libsodium=path],
+    	[Path where libsodium is installed, for dnscrypt]), [
+	CFLAGS="$CFLAGS -I$withval/include"
+	LDFLAGS="$LDFLAGS -L$withval/lib"
+    ])
+    AC_SEARCH_LIBS([sodium_init], [sodium], [],
+      AC_MSG_ERROR([The sodium library was not found. Please install sodium!]))
+    $1
+  else
+    $2
+  fi
+])

dnscrypt/dnscrypt_config.h.in

@@ -0,0 +1,17 @@
+#ifndef UNBOUND_DNSCRYPT_CONFIG_H
+#define UNBOUND_DNSCRYPT_CONFIG_H
+
+/*
+ * Process this file (dnscrypt_config.h.in) with AC_CONFIG_FILES to generate
+ * dnscrypt_config.h.
+ *
+ * This file exists so that USE_DNSCRYPT can be used without including config.h.
+ */
+
+#if @ENABLE_DNSCRYPT@ /* ENABLE_DNSCRYPT */
+# ifndef USE_DNSCRYPT
+#  define USE_DNSCRYPT 1
+# endif
+#endif
+
+#endif /* UNBOUND_DNSCRYPT_CONFIG_H */

dnstap/dnstap.c

@@ -39,7 +39,7 @@
 #include "config.h"
 #include <string.h>
 #include <sys/time.h>
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
 #include "util/netevent.h"
@@ -121,14 +121,17 @@ dt_msg_init(const struct dt_env *env,
 struct dt_env *
 dt_create(const char *socket_path, unsigned num_workers)
 {
+#ifdef UNBOUND_DEBUG
 	fstrm_res res;
+#endif
 	struct dt_env *env;
 	struct fstrm_iothr_options *fopt;
 	struct fstrm_unix_writer_options *fuwopt;
 	struct fstrm_writer *fw;
 	struct fstrm_writer_options *fwopt;
 
-	verbose(VERB_OPS, "opening dnstap socket %s", socket_path);
+	verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
+		socket_path);
 	log_assert(socket_path != NULL);
 	log_assert(num_workers > 0);
 
@@ -137,7 +140,12 @@ dt_create(const char *socket_path, unsigned num_workers)
 		return NULL;
 
 	fwopt = fstrm_writer_options_init();
-	res = fstrm_writer_options_add_content_type(fwopt,
+#ifdef UNBOUND_DEBUG
+	res = 
+#else
+	(void)
+#endif
+	    fstrm_writer_options_add_content_type(fwopt,
 		DNSTAP_CONTENT_TYPE, sizeof(DNSTAP_CONTENT_TYPE) - 1);
 	log_assert(res == fstrm_res_success);
 
@@ -474,7 +482,7 @@ dt_msg_send_outside_response(struct dt_env *env,
 			return;
 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
 	} else {
-		if (!env->log_resolver_query_messages)
+		if (!env->log_resolver_response_messages)
 			return;
 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE);
 	}

dnstap/dnstap.proto

@@ -105,7 +105,7 @@ message Message {
 
     enum Type {
         // AUTH_QUERY is a DNS query message received from a resolver by an
-        // authoritative name server, from the perspective of the authorative
+        // authoritative name server, from the perspective of the authoritative
         // name server.
         AUTH_QUERY = 1;
 

doc/example.conf.in

@@ -8,7 +8,7 @@
 #Use this to include other text into the file.
 #include: "otherfile.conf"
 
-# The server clause sets the main parameters. 
+# The server clause sets the main parameters.
 server:
 	# whitespace is not necessary, but looks cleaner.
 
@@ -19,6 +19,14 @@ server:
 	# Set to "" or 0 to disable. Default is disabled.
 	# statistics-interval: 0
 
+	# enable shm for stats, default no.  if you enable also enable
+	# statistics-interval, every time it also writes stats to the
+	# shared memory segment keyed with shm-key.
+	# shm-enable: no
+
+	# shm for stats uses this key, and key+1 for the shared mem segment.
+	# shm-key: 11777
+
 	# enable cumulative statistics, without clearing them after printing.
 	# statistics-cumulative: no
 
@@ -40,7 +48,7 @@ server:
 	# interface: 2001:DB8::5
 
 	# enable this feature to copy the source address of queries to reply.
-	# Socket options are not supported on all platforms. experimental. 
+	# Socket options are not supported on all platforms. experimental.
 	# interface-automatic: no
 
 	# port to answer queries from
@@ -53,6 +61,15 @@ server:
 	# outgoing-interface: 2001:DB8::5
 	# outgoing-interface: 2001:DB8::6
 
+	# Specify a netblock to use remainder 64 bits as random bits for
+	# upstream queries.  Uses freebind option (Linux).
+	# outgoing-interface: 2001:DB8::/64
+	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
+	# And: ip -6 route add local 2001:db8::/64 dev lo
+	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
+	# Set this to yes to prefer ipv6 upstream servers over ipv4.
+	# prefer-ip6: no
+
 	# number of ports to allocate per thread, determines the size of the
 	# port range that can be open simultaneously.  About double the
 	# num-queries-per-thread, or, use as many as the OS will allow you.
@@ -84,10 +101,20 @@ server:
 	# buffer size for UDP port 53 outgoing (SO_SNDBUF socket option).
 	# 0 is system default.  Use 4m to handle spikes on very busy servers.
 	# so-sndbuf: 0
-	
+
 	# use SO_REUSEPORT to distribute queries over threads.
 	# so-reuseport: no
 
+	# use IP_TRANSPARENT so the interface: addresses can be non-local
+	# and you can config non-existing IPs that are going to work later on
+	# (uses IP_BINDANY on FreeBSD).
+	# ip-transparent: no
+
+	# use IP_FREEBIND so the interface: addresses can be non-local
+	# and you can bind to nonexisting IPs and interfaces that are down.
+	# Linux only.  On Linux you also have ip-transparent that is similar.
+	# ip-freebind: no
+
 	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
 	# is set with msg-buffer-size). 1480 can solve fragmentation (timeouts).
 	# edns-buffer-size: 4096
@@ -101,7 +128,7 @@ server:
 	# msg-buffer-size: 65552
 
 	# the amount of memory to use for the message cache.
-	# plain value in bytes or you can append k, m or G. default is "4Mb". 
+	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# msg-cache-size: 4m
 
 	# the number of slabs to use for the message cache.
@@ -114,12 +141,12 @@ server:
 
 	# if very busy, 50% queries run to completion, 50% get timeout in msec
 	# jostle-timeout: 200
-	
+
 	# msec to wait before close of port on timeout UDP. 0 disables.
 	# delay-close: 0
 
 	# the amount of memory to use for the RRset cache.
-	# plain value in bytes or you can append k, m or G. default is "4Mb". 
+	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# rrset-cache-size: 4m
 
 	# the number of slabs to use for the RRset cache.
@@ -135,10 +162,16 @@ server:
 	# cache. Items are not cached for longer. In seconds.
 	# cache-max-ttl: 86400
 
+	# the time to live (TTL) value cap for negative responses in the cache
+	# cache-max-negative-ttl: 3600
+
 	# the time to live (TTL) value for cached roundtrip times, lameness and
 	# EDNS version information for hosts. In seconds.
 	# infra-host-ttl: 900
 
+	# minimum wait time for responses, increase if uplink is long. In msec.
+	# infra-cache-min-rtt: 50
+
 	# the number of slabs to use for the Infrastructure cache.
 	# the number of slabs must be a power of 2.
 	# more slabs reduce lock contention, but fragment memory usage.
@@ -147,6 +180,10 @@ server:
 	# the maximum number of hosts that are cached (roundtrip, EDNS, lame).
 	# infra-cache-numhosts: 10000
 
+	# define a number of tags here, use with local-zone, access-control.
+	# repeat the define-tag statement to add additional tags.
+	# define-tag: "tag1 tag2 tag3"
+
 	# Enable IPv4, "yes" or "no".
 	# do-ip4: yes
 
@@ -163,7 +200,19 @@ server:
 	# useful for tunneling scenarios, default no.
 	# tcp-upstream: no
 
+	# Maximum segment size (MSS) of TCP socket on which the server
+	# responds to queries. Default is 0, system default MSS.
+	# tcp-mss: 0
+
+	# Maximum segment size (MSS) of TCP socket for outgoing queries.
+	# Default is 0, system default MSS.
+	# outgoing-tcp-mss: 0
+
+	# Use systemd socket activation for UDP, TCP, and control sockets.
+	# use-systemd: no
+
 	# Detach from the terminal, run in background, "yes" or "no".
+	# Set the value to "no" when unbound runs as systemd service.
 	# do-daemonize: yes
 
 	# control which clients are allowed to make (recursive) queries
@@ -179,14 +228,31 @@ server:
 	# access-control: ::1 allow
 	# access-control: ::ffff:127.0.0.1 allow
 
+	# tag access-control with list of tags (in "" with spaces between)
+	# Clients using this access control element use localzones that
+	# are tagged with one of these tags.
+	# access-control-tag: 192.0.2.0/24 "tag2 tag3"
+
+	# set action for particular tag for given access control element
+	# if you have multiple tag values, the tag used to lookup the action
+	# is the first tag match between access-control-tag and local-zone-tag
+	# where "first" comes from the order of the define-tag values.
+	# access-control-tag-action: 192.0.2.0/24 tag3 refuse
+
+	# set redirect data for particular tag for access control element
+	# access-control-tag-data: 192.0.2.0/24 tag2 "A 127.0.0.1"
+
+	# Set view for access control element
+	# access-control-view: 192.0.2.0/24 viewname
+
 	# if given, a chroot(2) is done to the given directory.
 	# i.e. you can chroot to the working directory, for example,
 	# for extra security, but make sure all files are in that directory.
 	#
 	# If chroot is enabled, you should pass the configfile (from the
 	# commandline) as a full path from the original root. After the
-	# chroot has been performed the now defunct portion of the config 
-	# file path is removed to be able to reread the config after a reload. 
+	# chroot has been performed the now defunct portion of the config
+	# file path is removed to be able to reread the config after a reload.
 	#
 	# All other file paths (working dir, logfile, roothints, and
 	# key files) can be specified in several ways:
@@ -195,7 +261,7 @@ server:
 	# 	o as an absolute path relative to the original root.
 	# In the last case the path is adjusted to remove the unused portion.
 	#
-	# The pid file can be absolute and outside of the chroot, it is 
+	# The pid file can be absolute and outside of the chroot, it is
 	# written just prior to performing the chroot and dropping permissions.
 	#
 	# Additionally, unbound may need to access /dev/random (for entropy).
@@ -209,30 +275,40 @@ server:
 	# If you give "" no privileges are dropped.
 	# username: "@UNBOUND_USERNAME@"
 
-	# the working directory. The relative files in this config are 
+	# the working directory. The relative files in this config are
 	# relative to this directory. If you give "" the working directory
 	# is not changed.
+	# If you give a server: directory: dir before include: file statements
+	# then those includes can be relative to the working directory.
 	# directory: "@UNBOUND_RUN_DIR@"
 
-	# the log file, "" means log to stderr. 
+	# the log file, "" means log to stderr.
 	# Use of this option sets use-syslog to "no".
 	# logfile: ""
 
-	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to 
-	# log to, with identity "unbound". If yes, it overrides the logfile.
-	# use-syslog: yes 
+	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to
+	# log to. If yes, it overrides the logfile.
+	# use-syslog: yes
+
+	# Log identity to report. if empty, defaults to the name of argv[0]
+	# (usually "unbound").
+	# log-identity: ""
 
 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	# log-time-ascii: no
-	
+
 	# print one line with time, IP, name, type, class for every query.
 	# log-queries: no
 
+	# print one line per reply, with time, IP, name, type, class, rcode,
+	# timetoresolve, fromcache and responsesize.
+	# log-replies: no
+
 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"
 
 	# file to read root hints from.
-	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
+	# get one from https://www.internic.net/domain/named.cache
 	# root-hints: ""
 
 	# enable to not answer id.server and hostname.bind queries.
@@ -240,6 +316,9 @@ server:
 
 	# enable to not answer version.server and version.bind queries.
 	# hide-version: no
+	
+	# enable to not answer trustanchor.unbound queries.
+	# hide-trustanchor: no
 
 	# the identity to report. Leave "" or default to return hostname.
 	# identity: ""
@@ -248,8 +327,8 @@ server:
 	# version: ""
 
 	# the target fetch policy.
-	# series of integers describing the policy per dependency depth. 
-	# The number of values in the list determines the maximum dependency 
+	# series of integers describing the policy per dependency depth.
+	# The number of values in the list determines the maximum dependency
 	# depth the recursor will pursue before giving up. Each integer means:
 	# 	-1 : fetch all targets opportunistically,
 	# 	0: fetch on demand,
@@ -257,17 +336,17 @@ server:
 	# Enclose the list of numbers between quotes ("").
 	# target-fetch-policy: "3 2 1 0 0"
 
-	# Harden against very small EDNS buffer sizes. 
+	# Harden against very small EDNS buffer sizes.
 	# harden-short-bufsize: no
 
 	# Harden against unseemly large queries.
 	# harden-large-queries: no
 
-	# Harden against out of zone rrsets, to avoid spoofing attempts. 
+	# Harden against out of zone rrsets, to avoid spoofing attempts.
 	# harden-glue: yes
 
 	# Harden against receiving dnssec-stripped data. If you turn it
-	# off, failing to validate dnskey data for a trustanchor will 
+	# off, failing to validate dnskey data for a trustanchor will
 	# trigger insecure mode for that zone (like without a trustanchor).
 	# Default on, which insists on dnssec data for trust-anchored zones.
 	# harden-dnssec-stripped: yes
@@ -275,20 +354,41 @@ server:
 	# Harden against queries that fall under dnssec-signed nxdomain names.
 	# harden-below-nxdomain: no
 
-        # Harden the referral path by performing additional queries for
+	# Harden the referral path by performing additional queries for
 	# infrastructure data.  Validates the replies (if possible).
-	# Default off, because the lookups burden the server.  Experimental 
+	# Default off, because the lookups burden the server.  Experimental
 	# implementation of draft-wijngaards-dnsext-resolver-side-mitigation.
 	# harden-referral-path: no
 
+	# Harden against algorithm downgrade when multiple algorithms are
+	# advertised in the DS record.  If no, allows the weakest algorithm
+	# to validate the zone.
+	# harden-algo-downgrade: no
+
+	# Sent minimum amount of information to upstream servers to enhance
+	# privacy. Only sent minimum required labels of the QNAME and set QTYPE
+	# to NS when possible.
+	# qname-minimisation: no
+
+	# QNAME minimisation in strict mode. Do not fall-back to sending full
+	# QNAME to potentially broken nameservers. A lot of domains will not be
+	# resolvable when this option in enabled.
+	# This option only has effect when qname-minimisation is enabled.
+	# qname-minimisation-strict: no
+
 	# Use 0x20-encoded random bits in the query to foil spoof attempts.
 	# This feature is an experimental implementation of draft dns-0x20.
 	# use-caps-for-id: no
 
-	# Enforce privacy of these addresses. Strips them away from answers. 
-	# It may cause DNSSEC validation to additionally mark it as bogus. 
-	# Protects against 'DNS Rebinding' (uses browser as network proxy). 
-	# Only 'private-domain' and 'local-data' names are allowed to have 
+	# Domains (and domains in them) without support for dns-0x20 and
+	# the fallback fails because they keep sending different answers.
+	# caps-whitelist: "licdn.com"
+	# caps-whitelist: "senderbase.org"
+
+	# Enforce privacy of these addresses. Strips them away from answers.
+	# It may cause DNSSEC validation to additionally mark it as bogus.
+	# Protects against 'DNS Rebinding' (uses browser as network proxy).
+	# Only 'private-domain' and 'local-data' names are allowed to have
 	# these private addresses. No default.
 	# private-address: 10.0.0.0/8
 	# private-address: 172.16.0.0/12
@@ -296,6 +396,7 @@ server:
 	# private-address: 169.254.0.0/16
 	# private-address: fd00::/8
 	# private-address: fe80::/10
+	# private-address: ::ffff:0:0/96
 
 	# Allow the domain (and its subdomains) to contain private addresses.
 	# local-data statements are allowed to contain private addresses too.
@@ -330,6 +431,9 @@ server:
 	# into response messages when those sections are not required.
 	# minimal-responses: no
 
+	# true to disable DNSSEC lameness check in iterator.
+	# disable-dnssec-lame-check: no
+
 	# module configuration of the server. A string with identifiers
 	# separated by spaces. Syntax: "[dns64] [validator] iterator"
 	# module-config: "validator iterator"
@@ -346,7 +450,7 @@ server:
 
 	# File with DLV trusted keys. Same format as trust-anchor-file.
 	# There can be only one DLV configured, it is trusted from root down.
-	# Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
+	# DLV is going to be decommissioned.  Please do not use it any more.
 	# dlv-anchor-file: "dlv.isc.org.key"
 
 	# File with trusted keys for validation. Specify more than one file
@@ -354,7 +458,7 @@ server:
 	# Zone file format, with DS and DNSKEY entries.
 	# Note this gets out of date, use auto-trust-anchor-file please.
 	# trust-anchor-file: ""
-	
+
 	# Trusted key for validation. DS or DNSKEY. specify the RR on a
 	# single line, surrounded by "". TTL is ignored. class is IN default.
 	# Note this gets out of date, use auto-trust-anchor-file please.
@@ -364,7 +468,7 @@ server:
 
 	# File with trusted keys for validation. Specify more than one file
 	# with several entries, one file per entry. Like trust-anchor-file
-	# but has a different file format. Format is BIND-9 style format, 
+	# but has a different file format. Format is BIND-9 style format,
 	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
 	# you need external update procedures to track changes in keys.
 	# trusted-keys-file: ""
@@ -389,7 +493,7 @@ server:
 
 	# Should additional section of secure message also be kept clean of
 	# unsecure data. Useful to shield the users of this validator from
-	# potential bogus data in the additional section. All unsigned data 
+	# potential bogus data in the additional section. All unsigned data
 	# in the additional section is removed from secure messages.
 	# val-clean-additional: yes
 
@@ -405,6 +509,10 @@ server:
 	# that set CD but cannot validate themselves.
 	# ignore-cd-flag: no
 
+	# Serve expired reponses from cache, with TTL 0 in the response,
+	# and then attempt to fetch the data afresh.
+	# serve-expired: no
+
 	# Have the validator log failed validations for your diagnosis.
 	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
 	# val-log-level: 0
@@ -414,7 +522,7 @@ server:
 	# A message with an NSEC3 with larger count is marked insecure.
 	# List in ascending order the keysize and count values.
 	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
-	
+
 	# instruct the auto-trust-anchor-file probing to add anchors after ttl.
 	# add-holddown: 2592000 # 30 days
 
@@ -425,8 +533,12 @@ server:
 	# If the value 0 is given, missing anchors are not removed.
 	# keep-missing: 31622400 # 366 days
 
+	# debug option that allows very small holddown times for key rollover,
+	# otherwise the RFC mandates probe intervals must be at least 1 hour.
+	# permit-small-holddown: no
+
 	# the amount of memory to use for the key cache.
-	# plain value in bytes or you can append k, m or G. default is "4Mb". 
+	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# key-cache-size: 4m
 
 	# the number of slabs to use for the key cache.
@@ -435,9 +547,9 @@ server:
 	# key-cache-slabs: 4
 
 	# the amount of memory to use for the negative cache (used for DLV).
-	# plain value in bytes or you can append k, m or G. default is "1Mb". 
+	# plain value in bytes or you can append k, m or G. default is "1Mb".
 	# neg-cache-size: 1m
-	
+
 	# By default, for a number of zones a small default 'nothing here'
 	# reply is built-in.  Query traffic is thus blocked.  If you
 	# wish to serve such zone you can unblock them by uncommenting one
@@ -447,6 +559,7 @@ server:
 	# local-zone: "localhost." nodefault
 	# local-zone: "127.in-addr.arpa." nodefault
 	# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
+	# local-zone: "onion." nodefault
 	# local-zone: "10.in-addr.arpa." nodefault
 	# local-zone: "16.172.in-addr.arpa." nodefault
 	# local-zone: "17.172.in-addr.arpa." nodefault
@@ -479,29 +592,37 @@ server:
 	# local-zone: "b.e.f.ip6.arpa." nodefault
 	# local-zone: "8.b.d.0.1.0.0.2.ip6.arpa." nodefault
 	# And for 64.100.in-addr.arpa. to 127.100.in-addr.arpa.
-	
-	# if unbound is running service for the local host then it is useful
+
+	# If unbound is running service for the local host then it is useful
 	# to perform lan-wide lookups to the upstream, and unblock the
 	# long list of local-zones above.  If this unbound is a dns server
 	# for a network of computers, disabled is better and stops information
 	# leakage of local lan information.
 	# unblock-lan-zones: no
 
+	# The insecure-lan-zones option disables validation for
+	# these zones, as if they were all listed as domain-insecure.
+	# insecure-lan-zones: no
+
 	# a number of locally served zones can be configured.
 	# 	local-zone: <zone> <type>
 	# 	local-data: "<resource record string>"
-	# o deny serves local data (if any), else, drops queries. 
+	# o deny serves local data (if any), else, drops queries.
 	# o refuse serves local data (if any), else, replies with error.
 	# o static serves local data, else, nxdomain or nodata answer.
 	# o transparent gives local data, but resolves normally for other names
 	# o redirect serves the zone data for any subdomain in the zone.
 	# o nodefault can be used to normally resolve AS112 zones.
 	# o typetransparent resolves normally for other types and other names
+	# o inform acts like transparent, but logs client IP address
+	# o inform_deny drops queries and logs client IP address
+	# o always_transparent, always_refuse, always_nxdomain, resolve in
+	#   that way but ignore local data for that name.
 	#
 	# defaults are localhost address, reverse for 127.0.0.1 and ::1
 	# and nxdomain for AS112 zones. If you configure one of these zones
 	# the default content is omitted, or you can omit it with 'nodefault'.
-	# 
+	#
 	# If you configure local-data without specifying local-zone, by
 	# default a transparent local-zone is created for the data.
 	#
@@ -523,12 +644,18 @@ server:
 	# you need to do the reverse notation yourself.
 	# local-data-ptr: "192.0.2.3 www.example.com"
 
+	# tag a localzone with a list of tag names (in "" with spaces between)
+	# local-zone-tag: "example.com" "tag2 tag3"
+
+	# add a netblock specific override to a localzone, with zone type
+	# local-zone-override: "example.com" 192.0.2.0/24 refuse
+
 	# service clients over SSL (on the TCP sockets), with plain DNS inside
 	# the SSL stream.  Give the certificate to use and private key.
 	# default is "" (disabled).  requires restart to take effect.
 	# ssl-service-key: "path/to/privatekeyfile.key"
 	# ssl-service-pem: "path/to/publiccertfile.pem"
-	# ssl-port: 443
+	# ssl-port: 853
 
 	# request upstream over SSL (with plain DNS inside the SSL stream).
 	# Default is no.  Can be turned on and off with unbound-control.
@@ -538,6 +665,40 @@ server:
 	# Enable dns64 in module-config.  Used to synthesize IPv6 from IPv4.
 	# dns64-prefix: 64:ff9b::0/96
 
+	# ratelimit for uncached, new queries, this limits recursion effort.
+	# ratelimiting is experimental, and may help against randomqueryflood.
+	# if 0(default) it is disabled, otherwise state qps allowed per zone.
+	# ratelimit: 0
+
+	# ratelimits are tracked in a cache, size in bytes of cache (or k,m).
+	# ratelimit-size: 4m
+	# ratelimit cache slabs, reduces lock contention if equal to cpucount.
+	# ratelimit-slabs: 4
+
+	# 0 blocks when ratelimited, otherwise let 1/xth traffic through
+	# ratelimit-factor: 10
+
+	# override the ratelimit for a specific domain name.
+	# give this setting multiple times to have multiple overrides.
+	# ratelimit-for-domain: example.com 1000
+	# override the ratelimits for all domains below a domain name
+	# can give this multiple times, the name closest to the zone is used.
+	# ratelimit-below-domain: com 1000
+
+	# global query ratelimit for all ip addresses.
+	# feature is experimental.
+	# if 0(default) it is disabled, otherwise states qps allowed per ip address
+	# ip-ratelimit: 0
+
+	# ip ratelimits are tracked in a cache, size in bytes of cache (or k,m).
+	# ip-ratelimit-size: 4m
+	# ip ratelimit cache slabs, reduces lock contention if equal to cpucount.
+	# ip-ratelimit-slabs: 4
+
+	# 0 blocks when ip is ratelimited, otherwise let 1/xth traffic through
+	# ip-ratelimit-factor: 10
+
+
 # Python config section. To enable:
 # o use --with-pythonmodule to configure before compiling.
 # o list python in the module-config string (above) to enable.
@@ -546,12 +707,16 @@ python:
 	# Script file to load
 	# python-script: "@UNBOUND_SHARE_DIR@/ubmodule-tst.py"
 
-# Remote control config section. 
+# Remote control config section.
 remote-control:
 	# Enable remote control with unbound-control(8) here.
 	# set up the keys and certificates with unbound-control-setup.
 	# control-enable: no
 
+	# Set to no and use an absolute path as control-interface to use
+	# a unix local named pipe for unbound-control.
+	# control-use-cert: yes
+
 	# what interfaces are listened to for remote control.
 	# give 0.0.0.0 and ::0 to listen to all interfaces.
 	# control-interface: 127.0.0.1
@@ -573,16 +738,19 @@ remote-control:
 	# control-cert-file: "@UNBOUND_RUN_DIR@/unbound_control.pem"
 
 # Stub zones.
-# Create entries like below, to make all queries for 'example.com' and 
-# 'example.org' go to the given list of nameservers. list zero or more 
-# nameservers by hostname or by ipaddress. If you set stub-prime to yes, 
+# Create entries like below, to make all queries for 'example.com' and
+# 'example.org' go to the given list of nameservers. list zero or more
+# nameservers by hostname or by ipaddress. If you set stub-prime to yes,
 # the list is treated as priming hints (default is no).
 # With stub-first yes, it attempts without the stub if it fails.
+# Consider adding domain-insecure: name and local-zone: name nodefault
+# to the server: section if the stub is a locally served zone.
 # stub-zone:
 #	name: "example.com"
 #	stub-addr: 192.0.2.68
 #	stub-prime: no
 #	stub-first: no
+#	stub-ssl-upstream: no
 # stub-zone:
 #	name: "example.org"
 #	stub-host: ns.example.com.
@@ -598,6 +766,44 @@ remote-control:
 # 	forward-addr: 192.0.2.68
 # 	forward-addr: 192.0.2.73@5355  # forward to port 5355.
 # 	forward-first: no
+# 	forward-ssl-upstream: no
 # forward-zone:
 # 	name: "example.org"
 # 	forward-host: fwd.example.com
+
+# Views
+# Create named views. Name must be unique. Map views to requests using
+# the access-control-view option. Views can contain zero or more local-zone
+# and local-data options. Options from matching views will override global
+# options. Global options will be used if no matching view is found.
+# With view-first yes, it will try to answer using the global local-zone and
+# local-data elements if there is no view specific match.
+# view:
+#	name: "viewname"
+#	local-zone: "example.com" redirect
+#	local-data: "example.com A 192.0.2.3"
+# 	local-data-ptr: "192.0.2.3 www.example.com"
+#	view-first: no
+# view:
+#	name: "anotherview"
+#	local-zone: "example.com" refuse
+
+# DNSCrypt
+# Caveats:
+# 1. the keys/certs cannot be produced by unbound. You can use dnscrypt-wrapper
+#   for this: https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage
+# 2. dnscrypt channel attaches to an interface. you MUST set interfaces to
+#   listen on `dnscrypt-port` with the follo0wing snippet:
+# server:
+#     interface: 0.0.0.0@443
+#     interface: ::0@443
+#
+# Finally, `dnscrypt` config has its own section.
+# dnscrypt:
+#     dnscrypt-enable: yes
+#     dnscrypt-port: 443
+#     dnscrypt-provider: 2.dnscrypt-cert.example.com.
+#     dnscrypt-secret-key: /path/unbound-conf/keys1/1.key
+#     dnscrypt-secret-key: /path/unbound-conf/keys2/1.key
+#     dnscrypt-provider-cert: /path/unbound-conf/keys1/1.cert
+#     dnscrypt-provider-cert: /path/unbound-conf/keys2/1.cert

doc/libunbound.3.in

@@ -12,13 +12,14 @@
 .B unbound.h,
 .B ub_ctx,
 .B ub_result,
-.B ub_callback_t,
+.B ub_callback_type,
 .B ub_ctx_create,
 .B ub_ctx_delete,
 .B ub_ctx_set_option,
 .B ub_ctx_get_option,
 .B ub_ctx_config,
 .B ub_ctx_set_fwd,
+.B ub_ctx_set_stub,
 .B ub_ctx_resolvconf,
 .B ub_ctx_hosts,
 .B ub_ctx_add_ta,
@@ -65,6 +66,12 @@
 \fBub_ctx_set_fwd\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR addr);
 .LP
 \fIint\fR
+\fBub_ctx_set_stub\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone,
+\fIchar*\fR addr,
+.br
+		\fIint\fR isprime);
+.LP
+\fIint\fR
 \fBub_ctx_resolvconf\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
@@ -113,7 +120,7 @@
 .br
                  \fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata, 
 .br
-                 \fIub_callback_t\fR callback, \fIint*\fR async_id);
+                 \fIub_callback_type\fR callback, \fIint*\fR async_id);
 .LP
 \fIint\fR
 \fBub_cancel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR async_id);
@@ -173,8 +180,9 @@ and
 .B ub_ctx_hosts
 to read them.
 Before you call this, use the openssl functions CRYPTO_set_id_callback and
-CRYPTO_set_locking_callback to set up asyncronous operation if you use
+CRYPTO_set_locking_callback to set up asynchronous operation if you use
 lib openssl (the application calls these functions once for initialisation).
+Openssl 1.0.0 or later uses the CRYPTO_THREADID_set_callback function.
 .TP
 .B ub_ctx_delete
 Delete validation context and free associated resources.
@@ -206,6 +214,15 @@ that case the addresses are used as backup servers.
 At this time it is only possible to set configuration before the
 first resolve is done.
 .TP
+.B ub_ctx_set_stub
+Set a stub zone, authoritative dns servers to use for a particular zone.
+IP4 or IP6 address.  If the address is NULL the stub entry is removed.
+Set isprime true if you configure root hints with it.  Otherwise similar to
+the stub zone item from unbound's config file.  Can be called several times,
+for different zones, or to add multiple addresses for a particular zone.
+At this time it is only possible to set configuration before the
+first resolve is done.
+.TP
 .B ub_ctx_resolvconf
 By default the root servers are queried and full resolver mode is used, but
 you can use this call to read the list of nameservers to use from the

doc/unbound-anchor.8.in

@@ -16,6 +16,8 @@
 .SH "DESCRIPTION"
 .B Unbound\-anchor
 performs setup or update of the root trust anchor for DNSSEC validation.
+The program fetches the trust anchor with the method from RFC7958 when
+regular RFC5011 update fails to bring it up to date.
 It can be run (as root) from the commandline, or run as part of startup
 scripts.  Before you start the \fIunbound\fR(8) DNS server.
 .P
@@ -39,8 +41,8 @@ update certificate files.
 .P
 It tests if the root anchor file works, and if not, and an update is possible,
 attempts to update the root anchor using the root update certificate.
-It performs a https fetch of root-anchors.xml and checks the results, if
-all checks are successful, it updates the root anchor file.  Otherwise
+It performs a https fetch of root-anchors.xml and checks the results (RFC7958), 
+if all checks are successful, it updates the root anchor file.  Otherwise
 the root anchor file is unchanged.  It performs RFC5011 tracking if the
 DNSSEC information available via the DNS makes that possible.
 .P
@@ -65,7 +67,7 @@ List the builtin root key and builtin root update certificate on stdout.
 .B \-u \fIname
 The server name, it connects to https://name.  Specify without https:// prefix.
 The default is "data.iana.org".  It connects to the port specified with \-P.
-You can pass an IPv4 addres or IPv6 address (no brackets) if you want.
+You can pass an IPv4 address or IPv6 address (no brackets) if you want.
 .TP
 .B \-x \fIpath
 The pathname to the root\-anchors.xml file on the server. (forms URL with \-u).

doc/unbound-checkconf.8.in

@@ -13,6 +13,7 @@ unbound\-checkconf
 .SH "SYNOPSIS"
 .B unbound\-checkconf
 .RB [ \-h ]
+.RB [ \-f ]
 .RB [ \-o
 .IR option ]
 .RI [ cfgfile ]
@@ -29,6 +30,9 @@ The available options are:
 .B \-h
 Show the version and commandline option help.
 .TP
+.B \-f
+Print full pathname, with chroot applied to it.  Use with the \-o option.
+.TP
 .B \-o\fI option
 If given, after checking the config file the value of this option is 
 printed to stdout.  For "" (disabled) options an empty line is printed.

doc/unbound-control.8.in

@@ -99,6 +99,22 @@ but if the name has become an empty nonterminal (there is still data in
 domain names below the removed name), NOERROR nodata answers are the 
 result for that name.
 .TP
+.B local_zones
+Add local zones read from stdin of unbound\-control. Input is read per line,
+with name space type on a line. For bulk additions.
+.TP
+.B local_zones_remove
+Remove local zones read from stdin of unbound\-control. Input is one name per
+line. For bulk removals.
+.TP
+.B local_datas
+Add local data RRs read from stdin of unbound\-control. Input is one RR per
+line. For bulk additions.
+.TP
+.B local_datas_remove
+Remove local data RRs read from stdin of unbound\-control. Input is one name per
+line. For bulk removals.
+.TP
 .B dump_cache
 The contents of the cache is printed in a text format to stdout. You can
 redirect it to a file to store the cache in a file.
@@ -169,7 +185,7 @@ therefore not flushed.  The option must end with a ':' and whitespace
 must be between the option and the value.  Some values may not have an
 effect if set this way, the new values are not written to the config file,
 not all options are supported.  This is different from the set_option call
-in libunbound, where all values work because unbound has not been inited.
+in libunbound, where all values work because unbound has not been initialized.
 .IP
 The values that work are: statistics\-interval, statistics\-cumulative,
 do\-not\-query\-localhost, harden\-short\-bufsize, harden\-large\-queries,
@@ -177,7 +193,8 @@ harden\-glue, harden\-dnssec\-stripped, harden\-below\-nxdomain,
 harden\-referral\-path, prefetch, prefetch\-key, log\-queries,
 hide\-identity, hide\-version, identity, version, val\-log\-level,
 val\-log\-squelch, ignore\-cd\-flag, add\-holddown, del\-holddown,
-keep\-missing, tcp\-upstream, ssl\-upstream, max\-udp\-size.
+keep\-missing, tcp\-upstream, ssl\-upstream, max\-udp\-size, ratelimit,
+ip\-ratelimit, cache\-max\-ttl, cache\-min\-ttl, cache\-max\-negative\-ttl.
 .TP
 .B get_option \fIopt
 Get the value of the option.  Give the option name without a trailing ':'.
@@ -197,6 +214,9 @@ This includes the root hints in use.
 .B list_forwards
 List the forward zones in use.  These are printed zone by zone to the output.
 .TP
+.B list_insecure
+List the zones with domain\-insecure.
+.TP
 .B list_local_zones
 List the local zones in use.  These are printed one per line with zone type.
 .TP
@@ -252,6 +272,37 @@ port number can be set explicitly (default port is 53 (DNS)).
 By default the forwarder information from the config file for the root "." is
 used.  The config file is not changed, so after a reload these changes are
 gone.  Other forward zones from the config file are not affected by this command.
+.TP
+.B ratelimit_list \fR[\fI+a\fR]
+List the domains that are ratelimited.  Printed one per line with current
+estimated qps and qps limit from config.  With +a it prints all domains, not
+just the ratelimited domains, with their estimated qps.  The ratelimited
+domains return an error for uncached (new) queries, but cached queries work
+as normal.
+.TP
+.B ip_ratelimit_list \fR[\fI+a\fR]
+List the ip addresses that are ratelimited.  Printed one per line with current
+estimated qps and qps limit from config.  With +a it prints all ips, not
+just the ratelimited ips, with their estimated qps.  The ratelimited
+ips are dropped before checking the cache.
+.TP
+.B view_list_local_zones \fIview\fR
+\fIlist_local_zones\fR for given view.
+.TP
+.B view_local_zone \fIview\fR \fIname\fR \fItype
+\fIlocal_zone\fR for given view.
+.TP
+.B view_local_zone_remove \fIview\fR \fIname
+\fIlocal_zone_remove\fR for given view.
+.TP
+.B view_list_local_data \fIview\fR
+\fIlist_local_data\fR for given view.
+.TP
+.B view_local_data \fIview\fR \fIRR data...
+\fIlocal_data\fR for given view.
+.TP
+.B view_local_data_remove \fIview\fR \fIname
+\fIlocal_data_remove\fR for given view.
 .SH "EXIT CODE"
 The unbound\-control program exits with status code 1 on error, 0 on success.
 .SH "SET UP"
@@ -277,6 +328,9 @@ The \fIstats\fR command shows a number of statistic counters.
 .I threadX.num.queries
 number of queries received by thread
 .TP
+.I threadX.num.queries_ip_ratelimited
+number of queries rate limited by thread
+.TP
 .I threadX.num.cachehits
 number of queries that were successfully answered using a cache lookup
 .TP
@@ -290,6 +344,9 @@ and resulted in recursive processing, taking a slot in the requestlist.
 Not part of the recursivereplies (or the histogram thereof) or cachemiss,
 as a cache response was sent.
 .TP
+.I threadX.num.zero_ttl
+number of replies with ttl zero, because they served an expired cache entry.
+.TP
 .I threadX.num.recursivereplies
 The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
 .TP
@@ -322,6 +379,11 @@ less than this time.  Because of big outliers (usually queries to non
 responsive servers), the average can be bigger than the median.  This median
 has been calculated by interpolation from a histogram.
 .TP
+.I threadX.tcpusage
+The currently held tcp buffers for incoming connections.  A spot value on
+the time of the request.  This helps you spot if the incoming\-num\-tcp
+buffers are full.
+.TP
 .I total.num.queries
 summed over threads.
 .TP
@@ -334,6 +396,9 @@ summed over threads.
 .I total.num.prefetch
 summed over threads.
 .TP
+.I total.num.zero_ttl
+summed over threads.
+.TP
 .I total.num.recursivereplies
 summed over threads.
 .TP
@@ -355,6 +420,9 @@ summed over threads.
 .I total.recursion.time.median
 averaged over threads.
 .TP
+.I total.tcpusage
+summed over threads.
+.TP
 .I time.now
 current time in seconds since 1970.
 .TP
@@ -365,9 +433,6 @@ uptime since server boot in seconds.
 time since last statistics printout, in seconds.
 .SH EXTENDED STATISTICS
 .TP
-.I mem.total.sbrk
-If sbrk(2) is available, an estimate of the heap size of the program in number of bytes. Close to the total memory used by the program, as reported by top and ps.  Could be wrong if the OS allocates memory non\-contiguously.
-.TP
 .I mem.cache.rrset
 Memory in bytes in use by the RRset cache.
 .TP

doc/unbound.conf.5.in

@@ -72,7 +72,8 @@ Processing continues as if the text from the included file was copied into
 the config file at that point.  If also using chroot, using full path names
 for the included files works, relative pathnames for the included names work
 if the directory where the daemon is started equals its chroot/working 
-directory.  Wildcards can be used to include multiple files, see \fIglob\fR(7).
+directory or is specified before the include statement with directory: dir.
+Wildcards can be used to include multiple files, see \fIglob\fR(7).
 .SS "Server Options"
 These options are part of the
 .B server:
@@ -126,7 +127,7 @@ Detect source interface on UDP queries and copy them to replies.  This
 feature is experimental, and needs support in your OS for particular socket
 options.  Default value is no.
 .TP
-.B outgoing\-interface: \fI<ip address>
+.B outgoing\-interface: \fI<ip address or ip6 netblock>
 Interface to use to connect to the network. This interface is used to send
 queries to authoritative servers and receive their replies. Can be given 
 multiple times to work on several interfaces. If none are given the 
@@ -136,12 +137,28 @@ and
 .B outgoing\-interface:
 lines, the interfaces are then used for both purposes. Outgoing queries are 
 sent via a random outgoing interface to counter spoofing.
+.IP
+If an IPv6 netblock is specified instead of an individual IPv6 address,
+outgoing UDP queries will use a randomised source address taken from the
+netblock to counter spoofing. Requires the IPv6 netblock to be routed to the
+host running unbound, and requires OS support for unprivileged non-local binds
+(currently only supported on Linux). Several netblocks may be specified with
+multiple
+.B outgoing\-interface:
+options, but do not specify both an individual IPv6 address and an IPv6
+netblock, or the randomisation will be compromised.  Consider combining with
+.B prefer\-ip6: yes
+to increase the likelihood of IPv6 nameservers being selected for queries.
+On Linux you need these two commands to be able to use the freebind socket
+option to receive traffic for the ip6 netblock:
+ip \-6 addr add mynetblock/64 dev lo &&
+ip \-6 route add local mynetblock/64 dev lo
 .TP
 .B outgoing\-range: \fI<number>
 Number of ports to open. This number of file descriptors can be opened per 
 thread. Must be at least 1. Default depends on compile options. Larger 
 numbers need extra resources from the operating system.  For performance a
-a very large value is best, use libevent to make this possible.
+very large value is best, use libevent to make this possible.
 .TP
 .B outgoing\-port\-permit: \fI<port number or range>
 Permit unbound to open this port or range of ports for use to send queries.
@@ -164,12 +181,14 @@ By default only ports above 1024 that have not been assigned by IANA are used.
 Give a port number or a range of the form "low\-high", without spaces.
 .TP
 .B outgoing\-num\-tcp: \fI<number>
-Number of outgoing TCP buffers to allocate per thread. Default is 10. If set
-to 0, or if do\-tcp is "no", no TCP queries to authoritative servers are done.
+Number of outgoing TCP buffers to allocate per thread. Default is 10. If
+set to 0, or if do\-tcp is "no", no TCP queries to authoritative servers
+are done.  For larger installations increasing this value is a good idea.
 .TP
 .B incoming\-num\-tcp: \fI<number>
-Number of incoming TCP buffers to allocate per thread. Default is 10. If set
-to 0, or if do\-tcp is "no", no TCP queries from clients are accepted.
+Number of incoming TCP buffers to allocate per thread. Default is
+10. If set to 0, or if do\-tcp is "no", no TCP queries from clients are
+accepted. For larger installations increasing this value is a good idea.
 .TP
 .B edns\-buffer\-size: \fI<number>
 Number of bytes size to advertise as the EDNS reassembly buffer size.
@@ -265,6 +284,23 @@ it then attempts to open the port and passes the option if it was available
 at compile time, if that works it is used, if it fails, it continues
 silently (unless verbosity 3) without the option.
 .TP
+.B ip\-transparent: \fI<yes or no>
+If yes, then use IP_TRANSPARENT socket option on sockets where unbound
+is listening for incoming traffic.  Default no.  Allows you to bind to
+non\-local interfaces.  For example for non\-existant IP addresses that
+are going to exist later on, with host failover configuration.  This is
+a lot like interface\-automatic, but that one services all interfaces
+and with this option you can select which (future) interfaces unbound
+provides service on.  This option needs unbound to be started with root
+permissions on some systems.  The option uses IP_BINDANY on FreeBSD systems.
+.TP
+.B ip\-freebind: \fI<yes or no>
+If yes, then use IP_FREEBIND socket option on sockets where unbound
+is listening to incoming traffic.  Default no.  Allows you to bind to
+IP addresses that are nonlocal or do not exist, like when the network
+interface or IP address is down.  Exists only on Linux, where the similar
+ip\-transparent option is also available.
+.TP
 .B rrset\-cache\-size: \fI<number>
 Number of bytes size of the RRset cache. Default is 4 megabytes.
 A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
@@ -284,12 +320,16 @@ trust (very large) TTL values.
 .TP
 .B cache\-min\-ttl: \fI<seconds>
 Time to live minimum for RRsets and messages in the cache. Default is 0.
-If the the minimum kicks in, the data is cached for longer than the domain
+If the minimum kicks in, the data is cached for longer than the domain
 owner intended, and thus less queries are made to look up the data.
 Zero makes sure the data in the cache is as the domain owner intended,
 higher values, especially more than an hour or so, can lead to trouble as 
 the data in the cache does not match up with the actual data any more.
 .TP
+.B cache\-max\-negative\-ttl: \fI<seconds>
+Time to live maximum for negative responses, these have a SOA in the
+authority section that is limited in time.  Default is 3600.
+.TP
 .B infra\-host\-ttl: \fI<seconds>
 Time to live for entries in the host cache. The host cache contains 
 roundtrip timing, lameness and EDNS support information. Default is 900.
@@ -301,6 +341,15 @@ by threads. Must be set to a power of 2.
 .B infra\-cache\-numhosts: \fI<number>
 Number of hosts for which information is cached. Default is 10000.
 .TP
+.B infra\-cache\-min\-rtt: \fI<msec>
+Lower limit for dynamic retransmit timeout calculation in infrastructure
+cache. Default is 50 milliseconds. Increase this value if using forwarders
+needing more time to do recursive name resolution.
+.TP
+.B define\-tag: \fI<"list of tags">
+Define the tags that can be used with local\-zone and access\-control.
+Enclose the list between quotes ("") and put spaces between tags.
+.TP
 .B do\-ip4: \fI<yes or no>
 Enable or disable whether ip4 queries are answered or issued. Default is yes.
 .TP
@@ -311,12 +360,32 @@ IPv6 to the internet nameservers.  With this option you can disable the
 ipv6 transport for sending DNS traffic, it does not impact the contents of
 the DNS traffic, which may have ip4 and ip6 addresses in it.
 .TP
+.B prefer\-ip6: \fI<yes or no>
+If enabled, prefer IPv6 transport for sending DNS queries to internet
+nameservers. Default is no.
+.TP
 .B do\-udp: \fI<yes or no>
 Enable or disable whether UDP queries are answered or issued. Default is yes.
 .TP
 .B do\-tcp: \fI<yes or no>
 Enable or disable whether TCP queries are answered or issued. Default is yes.
 .TP
+.B tcp\-mss: \fI<number>
+Maximum segment size (MSS) of TCP socket on which the server responds
+to queries. Value lower than common MSS on Ethernet 
+(1220 for example) will address path MTU problem.
+Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
+Default is system default MSS determined by interface MTU and
+negotiation between server and client.
+.TP
+.B outgoing\-tcp\-mss: \fI<number>
+Maximum segment size (MSS) of TCP socket for outgoing queries
+(from Unbound to other servers). Value lower than
+common MSS on Ethernet (1220 for example) will address path MTU problem.
+Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
+Default is system default MSS determined by interface MTU and
+negotiation between Unbound and other servers.
+.TP
 .B tcp\-upstream: \fI<yes or no>
 Enable or disable whether the upstream queries use TCP only for transport.
 Default is no.  Useful in tunneling scenarios.
@@ -341,17 +410,23 @@ The public key certificate pem file for the ssl service.  Default is "",
 turned off.
 .TP
 .B ssl\-port: \fI<number>
-The port number on which to provide TCP SSL service, default 443, only
+The port number on which to provide TCP SSL service, default 853, only
 interfaces configured with that port number as @number get the SSL service.
 .TP
+.B use\-systemd: \fI<yes or no>
+Enable or disable systemd socket activation.
+Default is no.
+.TP
 .B do\-daemonize: \fI<yes or no>
 Enable or disable whether the unbound server forks into the background as
-a daemon. Default is yes.
+a daemon.  Set the value to \fIno\fR when unbound runs as systemd service.
+Default is yes.
 .TP
 .B access\-control: \fI<IP netblock> <action>
 The netblock is given as an IP4 or IP6 address with /size appended for a 
 classless network block. The action can be \fIdeny\fR, \fIrefuse\fR, 
 \fIallow\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or \fIrefuse_non_local\fR.
+The most specific netblock match is used, if none match \fIdeny\fR is used.
 .IP
 The action \fIdeny\fR stops queries from hosts from that netblock.
 .IP
@@ -387,6 +462,26 @@ allowed full recursion but only the static data.  With deny_non_local,
 messages that are disallowed are dropped, with refuse_non_local they
 receive error code REFUSED.
 .TP
+.B access\-control\-tag: \fI<IP netblock> <"list of tags">
+Assign tags to access-control elements. Clients using this access control
+element use localzones that are tagged with one of these tags. Tags must be
+defined in \fIdefine\-tags\fR.  Enclose list of tags in quotes ("") and put
+spaces between tags. If access\-control\-tag is configured for a netblock that
+does not have an access\-control, an access\-control element with action
+\fIallow\fR is configured for this netblock.
+.TP
+.B access\-control\-tag\-action: \fI<IP netblock> <tag> <action>
+Set action for particular tag for given access control element. If you have
+multiple tag values, the tag used to lookup the action is the first tag match
+between access\-control\-tag and local\-zone\-tag where "first" comes from the
+order of the define-tag values.
+.TP
+.B access\-control\-tag\-data: \fI<IP netblock> <tag> <"resource record string">
+Set redirect data for particular tag for given access control element.
+.TP
+.B access\-control\-view: \fI<IP netblock> <view name>
+Set view for given access control element.
+.TP
 .B chroot: \fI<directory>
 If chroot is enabled, you should pass the configfile (from the
 commandline) as a full path from the original root. After the
@@ -422,6 +517,10 @@ requires privileges, then a reload will fail; a restart is needed.
 .TP
 .B directory: \fI<directory>
 Sets the working directory for the program. Default is "@UNBOUND_RUN_DIR@".
+On Windows the string "%EXECUTABLE%" tries to change to the directory
+that unbound.exe resides in.
+If you give a server: directory: dir before include: file statements
+then those includes can be relative to the working directory.
 .TP
 .B logfile: \fI<filename>
 If "" is given, logging goes to stderr, or nowhere once daemonized.
@@ -440,6 +539,13 @@ The log facility LOG_DAEMON is used, with identity "unbound".
 The logfile setting is overridden when use\-syslog is turned on.
 The default is to log to syslog.
 .TP
+.B log\-identity: \fI<string>
+If "" is given (default), then the name of the executable, usually "unbound"
+is used to report to the log.  Enter a string to override it
+with that, which is useful on systems that run more than one instance of
+unbound, with different configurations, so that the logs can be easily
+distinguished against.
+.TP
 .B log\-time\-ascii: \fI<yes or no>
 Sets logfile lines to use a timestamp in UTC ascii. Default is no, which
 prints the seconds since 1970 in brackets. No effect if using syslog, in
@@ -451,6 +557,13 @@ name, type and class.  Default is no.  Note that it takes time to print these
 lines which makes the server (significantly) slower.  Odd (nonprintable)
 characters in names are printed as '?'.
 .TP
+.B log\-replies: \fI<yes or no>
+Prints one line per reply to the log, with the log timestamp and IP address,
+name, type, class, return code, time to resolve, from cache and response size.
+Default is no.  Note that it takes time to print these
+lines which makes the server (significantly) slower.  Odd (nonprintable)
+characters in names are printed as '?'.
+.TP
 .B pidfile: \fI<filename>
 The process id is written to the file. Default is "@UNBOUND_PIDFILE@". 
 So,
@@ -459,7 +572,7 @@ kill \-HUP `cat @UNBOUND_PIDFILE@`
 .fi
 triggers a reload,
 .nf
-kill \-QUIT `cat @UNBOUND_PIDFILE@` 
+kill \-TERM `cat @UNBOUND_PIDFILE@` 
 .fi
 gracefully terminates.
 .TP
@@ -483,6 +596,9 @@ If enabled version.server and version.bind queries are refused.
 Set the version to report. If set to "", the default, then the package
 version is returned.
 .TP
+.B hide\-trustanchor: \fI<yes or no>
+If enabled trustanchor.unbound queries are refused.
+.TP
 .B target\-fetch\-policy: \fI<"list of numbers">
 Set the target fetch policy used by unbound to determine if it should fetch
 nameserver target addresses opportunistically. The policy is described per
@@ -523,13 +639,15 @@ unsigned to badly signed often. If turned off you run the risk of a
 downgrade attack that disables security for a zone. Default is on.
 .TP
 .B harden\-below\-nxdomain: \fI<yes or no>
-From draft\-vixie\-dnsext\-resimprove, returns nxdomain to queries for a name
+From RFC 8020 (with title "NXDOMAIN: There Really Is Nothing Underneath"),
+returns nxdomain to queries for a name
 below another name that is already known to be nxdomain.  DNSSEC mandates
 noerror for empty nonterminals, hence this is possible.  Very old software
 might return nxdomain for empty nonterminals (that usually happen for reverse
 IP address lookups), and thus may be incompatible with this.  To try to avoid
 this only DNSSEC-secure nxdomains are used, because the old software does not
 have DNSSEC.  Default is off.
+The nxdomain must be secure, this means nsec3 with optout is insufficient.
 .TP
 .B harden\-referral\-path: \fI<yes or no>
 Harden the referral path by performing additional queries for
@@ -543,6 +661,13 @@ extra query load that is generated.  Experimental option.
 If you enable it consider adding more numbers after the target\-fetch\-policy
 to increase the max depth that is checked to.
 .TP
+.B harden\-algo\-downgrade: \fI<yes or no>
+Harden against algorithm downgrade when multiple algorithms are
+advertised in the DS record.  If no, allows the weakest algorithm to
+validate the zone.  Default is no.  Zone signers must produce zones
+that allow this feature to work, but sometimes they do not, and turning
+this option off avoids that validation failure.
+.TP
 .B use\-caps\-for\-id: \fI<yes or no>
 Use 0x20\-encoded random bits in the query to foil spoof attempts.
 This perturbs the lowercase and uppercase of query names sent to 
@@ -550,23 +675,43 @@ authority servers and checks if the reply still has the correct casing.
 Disabled by default. 
 This feature is an experimental implementation of draft dns\-0x20.
 .TP
+.B caps\-whitelist: \fI<domain>
+Whitelist the domain so that it does not receive caps\-for\-id perturbed
+queries.  For domains that do not support 0x20 and also fail with fallback
+because they keep sending different answers, like some load balancers.
+Can be given multiple times, for different domains.
+.TP
+.B qname\-minimisation: \fI<yes or no>
+Send minimum amount of information to upstream servers to enhance privacy.
+Only sent minimum required labels of the QNAME and set QTYPE to NS when 
+possible. Best effort approach; full QNAME and original QTYPE will be sent when
+upstream replies with a RCODE other than NOERROR, except when receiving
+NXDOMAIN from a DNSSEC signed zone. Default is off.
+.TP
+.B qname\-minimisation\-strict: \fI<yes or no>
+QNAME minimisation in strict mode. Do not fall-back to sending full QNAME to
+potentially broken nameservers. A lot of domains will not be resolvable when
+this option in enabled. Only use if you know what you are doing.
+This option only has effect when qname-minimisation is enabled. Default is off.
+.TP
 .B private\-address: \fI<IP address or subnet>
 Give IPv4 of IPv6 addresses or classless subnets. These are addresses
-on your private network, and are not allowed to be returned for public
-internet names.  Any occurence of such addresses are removed from
-DNS answers. Additionally, the DNSSEC validator may mark the answers
-bogus. This protects against so\-called DNS Rebinding, where a user browser
-is turned into a network proxy, allowing remote access through the browser
-to other parts of your private network.  Some names can be allowed to
-contain your private addresses, by default all the \fBlocal\-data\fR
-that you configured is allowed to, and you can specify additional
-names using \fBprivate\-domain\fR.  No private addresses are enabled
-by default.  We consider to enable this for the RFC1918 private IP
-address space by default in later releases. That would enable private 
-addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 
-fd00::/8 and fe80::/10, since the RFC standards say these addresses 
-should not be visible on the public internet.  Turning on 127.0.0.0/8 
-would hinder many spamblocklists as they use that.
+on your private network, and are not allowed to be returned for
+public internet names.  Any occurrence of such addresses are removed
+from DNS answers. Additionally, the DNSSEC validator may mark the
+answers bogus. This protects against so\-called DNS Rebinding, where
+a user browser is turned into a network proxy, allowing remote access
+through the browser to other parts of your private network.  Some names
+can be allowed to contain your private addresses, by default all the
+\fBlocal\-data\fR that you configured is allowed to, and you can specify
+additional names using \fBprivate\-domain\fR.  No private addresses are
+enabled by default.  We consider to enable this for the RFC1918 private
+IP address space by default in later releases. That would enable private
+addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16
+fd00::/8 and fe80::/10, since the RFC standards say these addresses
+should not be visible on the public internet.  Turning on 127.0.0.0/8
+would hinder many spamblocklists as they use that.  Adding ::ffff:0:0/96
+stops IPv4-mapped IPv6 addresses from bypassing the filter.
 .TP
 .B private\-domain: \fI<domain name>
 Allow this domain, and all its subdomains to contain private addresses.
@@ -613,6 +758,13 @@ This may cause a slight speedup.  The default is no, because the DNS
 protocol RFCs mandate these sections, and the additional content could
 be of use and save roundtrips for clients.
 .TP
+.B disable-dnssec-lame-check: \fI<yes or no>
+If true, disables the DNSSEC lameness check in the iterator.  This check
+sees if RRSIGs are present in the answer, when dnssec is expected,
+and retries another authority if RRSIGs are unexpectedly missing.
+The validator will insist in RRSIGs for DNSSEC signed domains regardless
+of this setting, if a trust anchor is loaded.
+.TP
 .B module\-config: \fI<"module names">
 Module configuration, a list of module names separated by spaces, surround
 the string with quotes (""). The modules can be validator, iterator.
@@ -631,7 +783,10 @@ File with trust anchor for one zone, which is tracked with RFC5011 probes.
 The probes are several times per month, thus the machine must be online
 frequently.  The initial file can be one with contents as described in
 \fBtrust\-anchor\-file\fR.  The file is written to when the anchor is updated,
-so the unbound user must have write permission.
+so the unbound user must have write permission.  Write permission to the file,
+but also to the directory it is in (to create a temporary file, which is
+necessary to deal with filesystem full events), it must also be inside the
+chroot (if that is used).
 .TP
 .B trust\-anchor: \fI<"Resource Record">
 A DS or DNSKEY RR for a key to use for validation. Multiple entries can be
@@ -650,14 +805,19 @@ It is possible to use wildcards with this statement, the wildcard is
 expanded on start and on reload.
 .TP
 .B dlv\-anchor\-file: \fI<filename>
+This option was used during early days DNSSEC deployment when no parent-side
+DS record registrations were easily available.  Nowadays, it is best to have
+DS records registered with the parent zone (many top level zones are signed).
 File with trusted keys for DLV (DNSSEC Lookaside Validation). Both DS and
 DNSKEY entries can be used in the file, in the same format as for
 \fItrust\-anchor\-file:\fR statements. Only one DLV can be configured, more
 would be slow. The DLV configured is used as a root trusted DLV, this 
 means that it is a lookaside for the root. Default is "", or no dlv anchor file.
+DLV is going to be decommissioned.  Please do not use it any more.
 .TP
 .B dlv\-anchor: \fI<"Resource Record">
 Much like trust\-anchor, this is a DLV anchor with the DS or DNSKEY inline.
+DLV is going to be decommissioned.  Please do not use it any more.
 .TP
 .B domain\-insecure: \fI<domain name>
 Sets domain name to be insecure, DNSSEC chain of trust is ignored towards
@@ -706,7 +866,7 @@ Instruct the validator to remove data from the additional section of secure
 messages that are not signed properly. Messages that are insecure, bogus,
 indeterminate or unchecked are not affected. Default is yes. Use this setting
 to protect the users that rely on this validator for authentication from 
-protentially bad data in the additional section.
+potentially bad data in the additional section.
 .TP
 .B val\-log\-level: \fI<number>
 Have the validator print validation failures to the log.  Regardless of
@@ -733,6 +893,11 @@ servers that set the CD flag but cannot validate DNSSEC themselves are
 the clients, and then unbound provides them with DNSSEC protection.
 The default value is "no".
 .TP
+.B serve\-expired: \fI<yes or no>
+If enabled, unbound attempts to serve old responses from cache with a
+TTL of 0 in the response without waiting for the actual resolution to finish.
+The actual resolution answer ends up in the cache later on.  Default is "no".
+.TP
 .B val\-nsec3\-keysize\-iterations: \fI<"list of values">
 List of keysize and iteration count values, separated by spaces, surrounded
 by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
@@ -762,6 +927,10 @@ mechanism work with zones that perform regular (non\-5011) rollovers.
 The default is 366 days.  The value 0 does not remove missing anchors,
 as per the RFC.
 .TP
+.B permit\-small\-holddown: \fI<yes or no>
+Debug option that allows the autotrust 5011 rollover timers to assume
+very small values.  Default is no.
+.TP
 .B key\-cache\-size: \fI<number>
 Number of bytes size of the key cache. Default is 4 megabytes.
 A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
@@ -788,13 +957,19 @@ as a (DHCP-) DNS network resolver for a group of machines, where such
 lookups should be filtered (RFC compliance), this also stops potential
 data leakage about the local network to the upstream DNS servers.
 .TP
+.B insecure\-lan\-zones: \fI<yesno>
+Default is disabled.  If enabled, then reverse lookups in private
+address space are not validated.  This is usually required whenever
+\fIunblock\-lan\-zones\fR is used.
+.TP
 .B local\-zone: \fI<zone> <type>
 Configure a local zone. The type determines the answer to give if
 there is no match from local\-data. The types are deny, refuse, static,
-transparent, redirect, nodefault, typetransparent, and are explained
-below. After that the default settings are listed. Use local\-data: to
-enter data into the local zone. Answers for local zones are authoritative
-DNS answers. By default the zones are class IN.
+transparent, redirect, nodefault, typetransparent, inform, inform_deny,
+always_transparent, always_refuse, always_nxdomain,
+and are explained below. After that the default settings are listed. Use
+local\-data: to enter data into the local zone. Answers for local zones
+are authoritative DNS answers. By default the zones are class IN.
 .IP
 If you need more complicated authoritative data, with referrals, wildcards,
 CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
@@ -841,16 +1016,37 @@ local\-data: "example.com. A 127.0.0.1"
 queries for www.example.com and www.foo.example.com are redirected, so
 that users with web browsers cannot access sites with suffix example.com.
 .TP 10
+\h'5'\fIinform\fR 
+The query is answered normally, same as transparent.  The client IP
+address (@portnumber) is printed to the logfile.  The log message is:
+timestamp, unbound-pid, info: zonename inform IP@port queryname type
+class.  This option can be used for normal resolution, but machines
+looking up infected names are logged, eg. to run antivirus on them.
+.TP 10
+\h'5'\fIinform_deny\fR 
+The query is dropped, like 'deny', and logged, like 'inform'.  Ie. find
+infected machines without answering the queries.
+.TP 10
+\h'5'\fIalways_transparent\fR 
+Like transparent, but ignores local data and resolves normally.
+.TP 10
+\h'5'\fIalways_refuse\fR 
+Like refuse, but ignores local data and refuses the query.
+.TP 10
+\h'5'\fIalways_nxdomain\fR 
+Like static, but ignores local data and returns nxdomain for the query.
+.TP 10
 \h'5'\fInodefault\fR 
 Used to turn off default contents for AS112 zones. The other types
 also turn off default contents for the zone. The 'nodefault' option 
 has no other effect than turning off default contents for the 
-given zone.
+given zone.  Use \fInodefault\fR if you use exactly that zone, if you want to
+use a subzone, use \fItransparent\fR.
 .P
-The default zones are localhost, reverse 127.0.0.1 and ::1, and the AS112
-zones. The AS112 zones are reverse DNS zones for private use and reserved
-IP addresses for which the servers on the internet cannot provide correct
-answers. They are configured by default to give nxdomain (no reverse 
+The default zones are localhost, reverse 127.0.0.1 and ::1, the onion and
+the AS112 zones. The AS112 zones are reverse DNS zones for private use and
+reserved IP addresses for which the servers on the internet cannot provide
+correct answers. They are configured by default to give nxdomain (no reverse
 information) answers. The defaults can be turned off by specifying your
 own local\-zone of that name, or using the 'nodefault' type. Below is a 
 list of the default zone contents.
@@ -894,6 +1090,15 @@ local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
     PTR localhost."
 .fi
 .TP 10
+\h'5'\fIonion (RFC 7686)\fR 
+Default content:
+.nf
+local\-zone: "onion." static
+local\-data: "onion. 10800 IN NS localhost."
+local\-data: "onion. 10800 IN 
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+.fi
+.TP 10
 \h'5'\fIreverse RFC1918 local use zones\fR 
 Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to 
 31.172.in\-addr.arpa, 168.192.in\-addr.arpa.
@@ -947,6 +1152,91 @@ it as detailed in the stub zone section below.
 Configure local data shorthand for a PTR record with the reversed IPv4 or
 IPv6 address and the host name.  For example "192.0.2.4 www.example.com".
 TTL can be inserted like this: "2001:DB8::4 7200 www.example.com"
+.TP 5
+.B local\-zone\-tag: \fI<zone> <"list of tags">
+Assign tags to localzones. Tagged localzones will only be applied when the
+used access-control element has a matching tag. Tags must be defined in
+\fIdefine\-tags\fR.  Enclose list of tags in quotes ("") and put spaces between
+tags.
+.TP 5
+.B local\-zone\-override: \fI<zone> <IP netblock> <type>
+Override the localzone type for queries from addresses matching netblock. 
+Use this localzone type, regardless the type configured for the local-zone
+(both tagged and untagged) and regardless the type configured using
+access\-control\-tag\-action.
+.TP 5
+.B ratelimit: \fI<number or 0>
+Enable ratelimiting of queries sent to nameserver for performing recursion.
+If 0, the default, it is disabled.  This option is experimental at this time.
+The ratelimit is in queries per second that are allowed.  More queries are
+turned away with an error (servfail).  This stops recursive floods, eg. random
+query names, but not spoofed reflection floods.  Cached responses are not
+ratelimited by this setting.  The zone of the query is determined by examining
+the nameservers for it, the zone name is used to keep track of the rate.
+For example, 1000 may be a suitable value to stop the server from being
+overloaded with random names, and keeps unbound from sending traffic to the
+nameservers for those zones.
+.TP 5
+.B ratelimit\-size: \fI<memory size>
+Give the size of the data structure in which the current ongoing rates are
+kept track in.  Default 4m.  In bytes or use m(mega), k(kilo), g(giga).
+The ratelimit structure is small, so this data structure likely does
+not need to be large.
+.TP 5
+.B ratelimit\-slabs: \fI<number>
+Give power of 2 number of slabs, this is used to reduce lock contention
+in the ratelimit tracking data structure.  Close to the number of cpus is
+a fairly good setting.
+.TP 5
+.B ratelimit\-factor: \fI<number>
+Set the amount of queries to rate limit when the limit is exceeded.
+If set to 0, all queries are dropped for domains where the limit is
+exceeded.  If set to another value, 1 in that number is allowed through
+to complete.  Default is 10, allowing 1/10 traffic to flow normally.
+This can make ordinary queries complete (if repeatedly queried for),
+and enter the cache, whilst also mitigating the traffic flow by the
+factor given.
+.TP 5
+.B ratelimit\-for\-domain: \fI<domain> <number qps>
+Override the global ratelimit for an exact match domain name with the listed
+number.  You can give this for any number of names.  For example, for
+a top\-level\-domain you may want to have a higher limit than other names.
+.TP 5
+.B ratelimit\-below\-domain: \fI<domain> <number qps>
+Override the global ratelimit for a domain name that ends in this name.
+You can give this multiple times, it then describes different settings
+in different parts of the namespace.  The closest matching suffix is used
+to determine the qps limit.  The rate for the exact matching domain name
+is not changed, use ratelimit\-for\-domain to set that, you might want
+to use different settings for a top\-level\-domain and subdomains.
+.TP 5
+.B ip\-ratelimit: \fI<number or 0>
+Enable global ratelimiting of queries accepted per ip address.
+If 0, the default, it is disabled.  This option is experimental at this time.
+The ratelimit is in queries per second that are allowed.  More queries are
+completely dropped and will not receive a reply, SERVFAIL or otherwise.
+IP ratelimiting happens before looking in the cache. This may be useful for
+mitigating amplification attacks.
+.TP 5
+.B ip\-ratelimit\-size: \fI<memory size>
+Give the size of the data structure in which the current ongoing rates are
+kept track in.  Default 4m.  In bytes or use m(mega), k(kilo), g(giga).
+The ip ratelimit structure is small, so this data structure likely does
+not need to be large.
+.TP 5
+.B ip\-ratelimit\-slabs: \fI<number>
+Give power of 2 number of slabs, this is used to reduce lock contention
+in the ip ratelimit tracking data structure.  Close to the number of cpus is
+a fairly good setting.
+.TP 5
+.B ip\-ratelimit\-factor: \fI<number>
+Set the amount of queries to rate limit when the limit is exceeded.
+If set to 0, all queries are dropped for addresses where the limit is
+exceeded.  If set to another value, 1 in that number is allowed through
+to complete.  Default is 10, allowing 1/10 traffic to flow normally.
+This can make ordinary queries complete (if repeatedly queried for),
+and enter the cache, whilst also mitigating the traffic flow by the
+factor given.
 .SS "Remote Control Options"
 In the
 .B remote\-control:
@@ -958,36 +1248,47 @@ to setup SSLv3 / TLSv1 security for the connection.  The
 section for options.  To setup the correct self\-signed certificates use the
 \fIunbound\-control\-setup\fR(8) utility.
 .TP 5
-.B control\-enable:     \fI<yes or no>
+.B control\-enable: \fI<yes or no>
 The option is used to enable remote control, default is "no".
 If turned off, the server does not listen for control commands.
 .TP 5
-.B control\-interface: <ip address>
-Give IPv4 or IPv6 addresses to listen on for control commands.
+.B control\-interface: \fI<ip address or path>
+Give IPv4 or IPv6 addresses or local socket path to listen on for
+control commands.
 By default localhost (127.0.0.1 and ::1) is listened to.
 Use 0.0.0.0 and ::0 to listen to all interfaces.
+If you change this and permissions have been dropped, you must restart
+the server for the change to take effect.
 .TP 5
-.B control\-port: <port number>
-The port number to listen on for control commands, default is 8953.
-If you change this port number, and permissions have been dropped,
-a reload is not sufficient to open the port again, you must then restart.
+.B control\-port: \fI<port number>
+The port number to listen on for IPv4 or IPv6 control interfaces,
+default is 8953.
+If you change this and permissions have been dropped, you must restart
+the server for the change to take effect.
 .TP 5
-.B server\-key\-file: "<private key file>"
+.B control\-use\-cert: \fI<yes or no>
+Whether to require certificate authentication of control connections.
+The default is "yes".
+This should not be changed unless there are other mechanisms in place
+to prevent untrusted users from accessing the remote control
+interface.
+.TP 5
+.B server\-key\-file: \fI<private key file>
 Path to the server private key, by default unbound_server.key.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
 This file is used by the unbound server, but not by \fIunbound\-control\fR.
 .TP 5
-.B server\-cert\-file: "<certificate file.pem>"
+.B server\-cert\-file: \fI<certificate file.pem>
 Path to the server self signed certificate, by default unbound_server.pem.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
 This file is used by the unbound server, and also by \fIunbound\-control\fR.
 .TP 5
-.B control\-key\-file: "<private key file>"
+.B control\-key\-file: \fI<private key file>
 Path to the control client private key, by default unbound_control.key.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
 This file is used by \fIunbound\-control\fR.
 .TP 5
-.B control\-cert\-file: "<certificate file.pem>"
+.B control\-cert\-file: \fI<certificate file.pem>
 Path to the control client certificate, by default unbound_control.pem.
 This certificate has to be signed with the server certificate.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
@@ -1018,6 +1319,12 @@ bit on replies for the private zone (authoritative servers do not set the
 AD bit).  This setup makes unbound capable of answering queries for the 
 private zone, and can even set the AD bit ('authentic'), but the AA 
 ('authoritative') bit is not set on these replies. 
+.P
+Consider adding \fBserver:\fR statements for \fBdomain\-insecure:\fR and
+for \fBlocal\-zone:\fI name nodefault\fR for the zone if it is a locally
+served zone.  The insecure clause stops DNSSEC from invalidating the
+zone.  The local zone nodefault (or \fItransparent\fR) clause makes the
+(reverse\-) zone bypass unbound's filtering of RFC1918 zones.
 .TP
 .B name: \fI<domain name>
 Name of the stub zone.
@@ -1040,6 +1347,10 @@ If enabled, a query is attempted without the stub clause if it fails.
 The data could not be retrieved and would have caused SERVFAIL because
 the servers are unreachable, instead it is tried without this clause.
 The default is no.
+.TP
+.B stub\-ssl\-upstream: \fI<yes or no>
+Enabled or disable whether the queries to this stub use SSL for transport.
+Default is no.
 .SS "Forward Zone Options"
 .LP
 There may be multiple
@@ -1070,6 +1381,40 @@ If enabled, a query is attempted without the forward clause if it fails.
 The data could not be retrieved and would have caused SERVFAIL because
 the servers are unreachable, instead it is tried without this clause.
 The default is no.
+.TP
+.B forward\-ssl\-upstream: \fI<yes or no>
+Enabled or disable whether the queries to this forwarder use SSL for transport.
+Default is no.
+.SS "View Options"
+.LP
+There may be multiple
+.B view:
+clauses. Each with a \fBname:\fR and zero or more \fBlocal\-zone\fR and
+\fBlocal\-data\fR elements. View can be mapped to requests by specifying the view
+name in an \fBaccess\-control\-view\fR element. Options from matching views will
+override global options. Global options will be used if no matching view
+is found.
+.TP
+.B name: \fI<view name>
+Name of the view. Must be unique. This name is used in access\-control\-view
+elements.
+.TP
+.B local\-zone: \fI<zone> <type>
+View specific local\-zone elements. Has the same types and behaviour as the
+global local\-zone elements.
+.TP
+.B local\-data: \fI"<resource record string>"
+View specific local\-data elements. Has the same behaviour as the global
+local\-data elements.
+.TP
+.B local\-data\-ptr: \fI"IPaddr name"
+View specific local\-data\-ptr elements. Has the same behaviour as the global
+local\-data\-ptr elements.
+.TP
+.B view\-first: \fI<yes or no>
+If enabled, it attempts to use the global local\-zone and local\-data if there
+is no match in the view specific options.
+The default is no.
 .SS "Python Module Options"
 .LP
 The
@@ -1079,9 +1424,15 @@ acts like the iterator and validator modules do, on queries and answers.
 To enable the script module it has to be compiled into the daemon,
 and the word "python" has to be put in the \fBmodule\-config:\fR option
 (usually first, or between the validator and iterator).
+.LP
+If the \fBchroot:\fR option is enabled, you should make sure Python's
+library directory structure is bind mounted in the new root environment, see
+\fImount\fR(8).  Also the \fBpython\-script:\fR path should be specified as an
+absolute path relative to the new root, or as a relative path to the working
+directory.
 .TP
 .B python\-script: \fI<python file>\fR
-The script file to load. 
+The script file to load.
 .SS "DNS64 Module Options"
 .LP
 The dns64 module must be configured in the \fBmodule\-config:\fR "dns64
@@ -1095,6 +1446,79 @@ It must be /96 or shorter.  The default prefix is 64:ff9b::/96.
 .B dns64\-synthall: \fI<yes or no>\fR
 Debug option, default no.  If enabled, synthesize all AAAA records
 despite the presence of actual AAAA records.
+.SS "DNSCrypt Options"
+.LP
+The
+.B dnscrypt:
+clause give the settings of the dnscrypt channel. While those options are
+available, they are only meaningful if unbound was compiled with
+\fB\-\-enable\-dnscrypt\fR.
+Currently certificate and secret/public keys cannot be generated by unbound.
+You can use dnscrypt-wrapper to generate those: https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage
+.TP
+.B dnscrypt\-enable: \fI<yes or no>\fR
+Whether or not the \fBdnscrypt\fR config should be enabled. You may define
+configuration but not activate it.
+The default is no.
+.TP
+.B dnscrypt\-port: \fI<port number>
+On which port should \fBdnscrypt\fR should be activated. Note that you should
+have a matching \fBinterface\fR option defined in the \fBserver\fR section for
+this port.
+.TP
+.B dnscrypt\-provider: \fI<provider name>\fR
+The provider name to use to distribute certificates. This is of the form:
+\fB2.dnscrypt-cert.example.com.\fR. The name \fIMUST\fR end with a dot.
+.TP
+.B dnscrypt\-secret\-key: \fI<path to secret key file>\fR
+Path to the time limited secret key file. This option may be specified multiple
+times.
+.TP
+.B dnscrypt\-provider\-cert: \fI<path to cert file>\fR
+Path to the certificate related to the \fBdnscrypt\-secret\-key\fRs. This option
+may be specified multiple times.
+.SS "EDNS Client Subnet Module Options"
+.LP
+The ECS module must be configured in the \fBmodule\-config:\fR "subnetcache
+validator iterator" directive and be compiled into the daemon to be
+enabled.  These settings go in the \fBserver:\fR section.
+.LP
+If the destination address is whitelisted with Unbound will add the EDNS0 option
+to the query containing the relevant part of the client's address. When an
+answer contains the ECS option the response and the option are placed in a
+specialized cache. If the authority indicated no support, the response is stored
+in the regular cache.
+.LP
+Additionally, when a client includes the option in its queries, Unbound will
+forward the option to the authority regardless of the authorities presence in
+the whitelist. In this case the lookup in the regular cache is skipped.
+.LP
+The maximum size of the ECS cache is controlled by 'msg-cache-size' in the
+configuration file. On top of that, for each query only 100 different subnets
+are allowed to be stored for each address family. Exceeding that number, older
+entries will be purged from cache.
+.TP
+.B send\-client\-subnet: \fI<IP address>\fR
+Send client source address to this authority. Append /num to indicate a
+classless delegation netblock, for example like 10.2.3.4/24 or 2001::11/64. Can
+be given multiple times. Authorities not listed will not receive edns-subnet
+information.
+.TP
+.B client\-subnet\-always\-forward: \fI<yes or no>\fR
+Specify whether the ECS whitelist check (configured using
+\fBsend\-client\-subnet\fR) is applied for all queries, even if the triggering
+query contains an ECS record, or only for queries for which the ECS record is
+generated using the querier address (and therefore did not contain ECS data in
+the client query). If enabled, the whitelist check is skipped when the client
+query contains an ECS record. Default is no.
+.TP
+.B max\-client\-subnet\-ipv6: \fI<number>\fR
+Specifies the maximum prefix length of the client source address we are willing
+to expose to third parties for IPv6.  Defaults to 56.
+.TP
+.B max\-client\-subnet\-ipv4: \fI<number>\fR
+Specifies the maximum prefix length of the client source address we are willing
+to expose to third parties for IPv4. Defaults to 24.
 .SH "MEMORY CONTROL EXAMPLE"
 In the example config settings below memory usage is reduced. Some service
 levels are lower, notable very large data and a high TCP load are no longer

doc/unbound.doxygen

@@ -623,7 +623,9 @@ EXCLUDE                = ./build \
                          pythonmod/examples/resip.py \
                          libunbound/python/unbound.py \
                          libunbound/python/libunbound_wrap.c \
-                         ./ldns-src
+                         ./ldns-src \
+			 doc/control_proto_spec.txt \
+			 doc/requirements.txt
 
 # The EXCLUDE_SYMLINKS tag can be used select whether or not files or
 # directories that are symbolic links (a Unix filesystem feature) are excluded

edns-subnet/addrtree.c

@@ -0,0 +1,531 @@
+/*
+ * edns-subnet/addrtree.c -- radix tree for edns subnet cache.
+ *
+ * Copyright (c) 2013, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/** \file 
+ * addrtree -- radix tree for edns subnet cache.
+ */
+
+#include "config.h"
+#include "util/log.h"
+#include "util/data/msgreply.h"
+#include "util/module.h"
+#include "addrtree.h"
+
+/** 
+ * Create a new edge
+ * @param node: Child node this edge will connect to.
+ * @param addr: full key to this edge.
+ * @param addrlen: length of relevant part of key for this node
+ * @param parent_node: Parent node for node
+ * @param parent_index: Index of child node at parent node
+ * @return new addredge or NULL on failure
+ */
+static struct addredge * 
+edge_create(struct addrnode *node, const addrkey_t *addr, 
+	addrlen_t addrlen, struct addrnode *parent_node, int parent_index)
+{
+	size_t n;
+	struct addredge *edge = (struct addredge *)malloc( sizeof (*edge) );
+	if (!edge)
+		return NULL;
+	edge->node = node;
+	edge->len = addrlen;
+	edge->parent_index = parent_index;
+	edge->parent_node = parent_node;
+	/* ceil() */
+	n = (size_t)((addrlen / KEYWIDTH) + ((addrlen % KEYWIDTH != 0)?1:0));
+	edge->str = (addrkey_t *)calloc(n, sizeof (addrkey_t));
+	if (!edge->str) {
+		free(edge);
+		return NULL;
+	}
+	memcpy(edge->str, addr, n * sizeof (addrkey_t));
+	/* Only manipulate other objects after successful alloc */
+	node->parent_edge = edge;
+	log_assert(parent_node->edge[parent_index] == NULL);
+	parent_node->edge[parent_index] = edge;
+	return edge;
+}
+
+/** 
+ * Create a new node
+ * @param tree: Tree the node lives in.
+ * @param elem: Element to store at this node
+ * @param scope: Scopemask from server reply
+ * @param ttl: Element is valid up to this time. Absolute, seconds
+ * @return new addrnode or NULL on failure
+ */
+static struct addrnode * 
+node_create(struct addrtree *tree, void *elem, addrlen_t scope, 
+	time_t ttl)
+{
+	struct addrnode* node = (struct addrnode *)malloc( sizeof (*node) );
+	if (!node)
+		return NULL;
+	node->elem = elem;
+	tree->node_count++;
+	node->scope = scope;
+	node->ttl = ttl;
+	node->edge[0] = NULL;
+	node->edge[1] = NULL;
+	node->parent_edge = NULL;
+	node->next = NULL;
+	node->prev = NULL;
+	return node;
+}
+
+/** Size in bytes of node and parent edge
+ * @param tree: tree the node lives in
+ * @param n: node which size must be calculated 
+ * @return size in bytes.
+ **/
+static inline size_t 
+node_size(const struct addrtree *tree, const struct addrnode *n)
+{
+	return sizeof *n + sizeof *n->parent_edge + n->parent_edge->len + 
+		(n->elem?tree->sizefunc(n->elem):0);
+}
+
+struct addrtree * 
+addrtree_create(addrlen_t max_depth, void (*delfunc)(void *, void *), 
+	size_t (*sizefunc)(void *), void *env, unsigned int max_node_count)
+{
+	struct addrtree *tree;
+	log_assert(delfunc != NULL);
+	log_assert(sizefunc != NULL);
+	tree = (struct addrtree *)calloc(1, sizeof(*tree));
+	if (!tree)
+		return NULL;
+	tree->root = node_create(tree, NULL, 0, 0);
+	if (!tree->root) {
+		free(tree);
+		return NULL;
+	}
+	tree->size_bytes = sizeof *tree + sizeof *tree->root;
+	tree->first = NULL;
+	tree->last = NULL;
+	tree->max_depth = max_depth;
+	tree->delfunc = delfunc;
+	tree->sizefunc = sizefunc;
+	tree->env = env;
+	tree->node_count = 0;
+	tree->max_node_count = max_node_count;
+	return tree;
+}
+
+/** 
+ * Scrub a node clean of elem
+ * @param tree: tree the node lives in.
+ * @param node: node to be cleaned.
+ */
+static void
+clean_node(struct addrtree *tree, struct addrnode *node)
+{
+	if (!node->elem) return;
+	tree->size_bytes -= tree->sizefunc(node->elem);
+	tree->delfunc(tree->env, node->elem);
+	node->elem = NULL;
+}
+
+/** Remove specified node from LRU list */
+static void
+lru_pop(struct addrtree *tree, struct addrnode *node)
+{
+	if (node == tree->first) {
+		if (!node->next) { /* it is the last as well */
+			tree->first = NULL;
+			tree->last = NULL;
+		} else {
+			tree->first = node->next;
+			tree->first->prev = NULL;
+		}
+	} else if (node == tree->last) { /* but not the first */
+		tree->last = node->prev;
+		tree->last->next = NULL;
+	} else {
+		node->prev->next = node->next;
+		node->next->prev = node->prev;
+	}
+}
+
+/** Add node to LRU list as most recently used. */
+static void
+lru_push(struct addrtree *tree, struct addrnode *node)
+{
+	if (!tree->first) {
+		tree->first = node;
+		node->prev = NULL;
+	} else {
+		tree->last->next = node;
+		node->prev = tree->last;
+	}
+	tree->last = node;
+	node->next = NULL;
+}
+
+/** Move node to the end of LRU list */
+static void
+lru_update(struct addrtree *tree, struct addrnode *node)
+{
+	if (tree->root == node) return;
+	lru_pop(tree, node);
+	lru_push(tree, node);
+}
+
+/** 
+ * Purge a node from the tree. Node and parentedge are cleaned and 
+ * free'd.
+ * @param tree: Tree the node lives in.
+ * @param node: Node to be freed
+ */
+static void
+purge_node(struct addrtree *tree, struct addrnode *node)
+{
+	struct addredge *parent_edge, *child_edge = NULL;
+	int index;
+	int keep = node->edge[0] && node->edge[1];
+	
+	clean_node(tree, node);
+	parent_edge = node->parent_edge;
+	if (keep || !parent_edge) return;
+	tree->node_count--;
+	index = parent_edge->parent_index;
+	child_edge = node->edge[!node->edge[0]];
+	if (child_edge) {
+		child_edge->parent_node  = parent_edge->parent_node;
+		child_edge->parent_index = index;
+	}
+	parent_edge->parent_node->edge[index] = child_edge;
+	tree->size_bytes -= node_size(tree, node);
+	free(parent_edge->str);
+	free(parent_edge);
+	lru_pop(tree, node);
+	free(node);
+}
+
+/**
+ * If a limit is set remove old nodes while above that limit.
+ * @param tree: Tree to be cleaned up.
+ */
+static void
+lru_cleanup(struct addrtree *tree)
+{
+	struct addrnode *n, *p;
+	int children;
+	if (tree->max_node_count == 0) return;
+	while (tree->node_count > tree->max_node_count) {
+		n = tree->first;
+		if (!n) break;
+		children = (n->edge[0] != NULL) + (n->edge[1] != NULL);
+		/** Don't remove this node, it is either the root or we can't
+		 * do without it because it has 2 children */
+		if (children == 2 || !n->parent_edge) {
+			lru_update(tree, n);
+			continue;
+		}
+		p = n->parent_edge->parent_node;
+		purge_node(tree, n);
+		/** Since we removed n, n's parent p is eligible for deletion
+		 * if it is not the root node, caries no data and has only 1
+		 * child */
+		children = (p->edge[0] != NULL) + (p->edge[1] != NULL);
+		if (!p->elem && children == 1 && p->parent_edge) {
+			purge_node(tree, p);
+		}
+	}
+}
+
+inline size_t
+addrtree_size(const struct addrtree *tree)
+{
+	return tree?tree->size_bytes:0;
+}
+
+void addrtree_delete(struct addrtree *tree)
+{
+	struct addrnode *n;
+	if (!tree) return;
+	clean_node(tree, tree->root);
+	free(tree->root);
+	tree->size_bytes -= sizeof(struct addrnode);
+	while ((n = tree->first)) {
+		tree->first = n->next;
+		clean_node(tree, n);
+		tree->size_bytes -= node_size(tree, n);
+		free(n->parent_edge->str);
+		free(n->parent_edge);
+		free(n);
+	}
+	log_assert(sizeof *tree == addrtree_size(tree));
+	free(tree);
+}
+
+/**
+ * Get N'th bit from address 
+ * @param addr: address to inspect
+ * @param addrlen: length of addr in bits
+ * @param n: index of bit to test. Must be in range [0, addrlen)
+ * @return 0 or 1
+ */
+static int 
+getbit(const addrkey_t *addr, addrlen_t addrlen, addrlen_t n)
+{
+	log_assert(addrlen > n);
+	return (int)(addr[n/KEYWIDTH]>>((KEYWIDTH-1)-(n%KEYWIDTH))) & 1;
+}
+
+/**
+ * Test for equality on N'th bit.
+ * @return 0 for equal, 1 otherwise 
+ */
+static inline int 
+cmpbit(const addrkey_t *key1, const addrkey_t *key2, addrlen_t n)
+{
+	addrkey_t c = key1[n/KEYWIDTH] ^ key2[n/KEYWIDTH];
+	return (int)(c >> ((KEYWIDTH-1)-(n%KEYWIDTH))) & 1;
+}
+
+/**
+ * Common number of bits in prefix.
+ * @param s1: first prefix.
+ * @param l1: length of s1 in bits.
+ * @param s2: second prefix.
+ * @param l2: length of s2 in bits.
+ * @param skip: nr of bits already checked.
+ * @return common number of bits.
+ */
+static addrlen_t 
+bits_common(const addrkey_t *s1, addrlen_t l1, 
+	const addrkey_t *s2, addrlen_t l2, addrlen_t skip)
+{
+	addrlen_t len, i;
+	len = (l1 > l2) ? l2 : l1;
+	log_assert(skip < len);
+	for (i = skip; i < len; i++) {
+		if (cmpbit(s1, s2, i)) return i;
+	}
+	return len;
+} 
+
+/**
+ * Tests if s1 is a substring of s2
+ * @param s1: first prefix.
+ * @param l1: length of s1 in bits.
+ * @param s2: second prefix.
+ * @param l2: length of s2 in bits.
+ * @param skip: nr of bits already checked.
+ * @return 1 for substring, 0 otherwise 
+ */
+static int 
+issub(const addrkey_t *s1, addrlen_t l1, 
+	const addrkey_t *s2, addrlen_t l2,  addrlen_t skip)
+{
+	return bits_common(s1, l1, s2, l2, skip) == l1;
+}
+
+void
+addrtree_insert(struct addrtree *tree, const addrkey_t *addr, 
+	addrlen_t sourcemask, addrlen_t scope, void *elem, time_t ttl, 
+	time_t now)
+{
+	struct addrnode *newnode, *node;
+	struct addredge *edge;
+	int index;
+	addrlen_t common, depth;
+
+	node = tree->root;
+	log_assert(node != NULL);
+
+	/* Protect our cache against too much fine-grained data */
+	if (tree->max_depth < scope) scope = tree->max_depth;
+	/* Server answer was less specific than question */
+	if (scope < sourcemask) sourcemask = scope;
+
+	depth = 0;
+	while (1) {
+		log_assert(depth <= sourcemask);
+		/* Case 1: update existing node */
+		if (depth == sourcemask) {
+			/* update this node's scope and data */
+			clean_node(tree, node);
+			node->ttl = ttl;
+			node->elem = elem;
+			node->scope = scope;
+			tree->size_bytes += tree->sizefunc(elem);
+			return;
+		}
+		index = getbit(addr, sourcemask, depth);
+		/* Get an edge to an unexpired node */
+		edge = node->edge[index];
+		while (edge) {
+			/* Purge all expired nodes on path */
+			if (!edge->node->elem || edge->node->ttl >= now)
+				break;
+			purge_node(tree, edge->node);
+			edge = node->edge[index];
+		}
+		/* Case 2: New leafnode */
+		if (!edge) {
+			newnode = node_create(tree, elem, scope, ttl);
+			if (!newnode) return;
+			if (!edge_create(newnode, addr, sourcemask, node,
+				index)) {
+				clean_node(tree, newnode);
+				tree->node_count--;
+				free(newnode);
+				return;
+			}
+			tree->size_bytes += node_size(tree, newnode);
+			lru_push(tree, newnode);
+			lru_cleanup(tree);
+			return;
+		}
+		/* Case 3: Traverse edge */
+		common = bits_common(edge->str, edge->len, addr, sourcemask,
+			depth);
+		if (common == edge->len) {
+			/* We update the scope of intermediate nodes. Apparently
+			 * the * authority changed its mind. If we would not do
+			 * this we might not be able to reach our new node. */
+			node->scope = scope;
+			depth = edge->len;
+			node = edge->node;
+			continue;
+		}
+		/* Case 4: split. */
+		if (!(newnode = node_create(tree, NULL, 0, 0)))
+			return;
+		node->edge[index] = NULL;
+		if (!edge_create(newnode, addr, common, node, index)) {
+			node->edge[index] = edge;
+			clean_node(tree, newnode);
+			tree->node_count--;
+			free(newnode);
+			return;
+		}
+		lru_push(tree, newnode);
+		/* connect existing child to our new node */
+		index = getbit(edge->str, edge->len, common);
+		newnode->edge[index] = edge;
+		edge->parent_node = newnode;
+		edge->parent_index = (int)index;
+		
+		if (common == sourcemask) {
+			/* Data is stored in the node */
+			newnode->elem = elem;
+			newnode->scope = scope;
+			newnode->ttl = ttl;
+		} 
+		
+		tree->size_bytes += node_size(tree, newnode);
+
+		if (common != sourcemask) {
+			/* Data is stored in other leafnode */
+			node = newnode;
+			newnode = node_create(tree, elem, scope, ttl);
+			if (!edge_create(newnode, addr, sourcemask, node,
+				index^1)) {
+				clean_node(tree, newnode);
+				tree->node_count--;
+				free(newnode);
+				return;
+			}
+			tree->size_bytes += node_size(tree, newnode);
+			lru_push(tree, newnode);
+		}
+		lru_cleanup(tree);
+		return;
+	}
+}
+
+struct addrnode *
+addrtree_find(struct addrtree *tree, const addrkey_t *addr, 
+	addrlen_t sourcemask, time_t now)
+{
+	struct addrnode *node = tree->root;
+	struct addredge *edge = NULL;
+	addrlen_t depth = 0;
+
+	log_assert(node != NULL);
+	while (1) {
+		/* Current node more specific then question. */
+		log_assert(depth <= sourcemask);
+		/* does this node have data? if yes, see if we have a match */
+		if (node->elem && node->ttl >= now) {
+			/* saved at wrong depth */;
+			log_assert(node->scope >= depth) 
+			if (depth == node->scope ||
+				(node->scope > sourcemask &&
+				 depth == sourcemask)) {
+				/* Authority indicates it does not have a more
+				 * precise answer or we cannot ask a more
+				 * specific question. */
+				lru_update(tree, node);
+				return node;
+			}
+		}
+		/* This is our final depth, but we haven't found an answer. */
+		if (depth == sourcemask)
+			return NULL;
+		/* Find an edge to traverse */
+		edge = node->edge[getbit(addr, sourcemask, depth)];
+		if (!edge || !edge->node)
+			return NULL;
+		if (edge->len > sourcemask )
+			return NULL;
+		if (!issub(edge->str, edge->len, addr, sourcemask, depth))
+			return NULL;
+		log_assert(depth < edge->len);
+		depth = edge->len;
+		node = edge->node;
+	}
+}
+
+/** Wrappers for static functions to unit test */
+int unittest_wrapper_addrtree_cmpbit(const addrkey_t *key1, 
+	const addrkey_t *key2, addrlen_t n) {
+	return cmpbit(key1, key2, n);
+}
+addrlen_t unittest_wrapper_addrtree_bits_common(const addrkey_t *s1, 
+	addrlen_t l1, const addrkey_t *s2, addrlen_t l2, addrlen_t skip) {
+	return bits_common(s1, l1, s2, l2, skip);
+}
+int unittest_wrapper_addrtree_getbit(const addrkey_t *addr, 
+	addrlen_t addrlen, addrlen_t n) {
+	return getbit(addr, addrlen, n);
+}
+int unittest_wrapper_addrtree_issub(const addrkey_t *s1, addrlen_t l1, 
+	const addrkey_t *s2, addrlen_t l2,  addrlen_t skip) {
+	return issub(s1, l1, s2, l2, skip);
+}

edns-subnet/addrtree.h

@@ -0,0 +1,187 @@
+/*
+ * edns-subnet/addrtree.h -- radix tree for edns subnet cache.
+ *
+ * Copyright (c) 2013, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ * The addrtree is a radix tree designed for edns subnet. Most notable
+ * is the addition of 'scope' to a node. Scope is only relevant for
+ * nodes with elem set, it indicates the number of bits the authority
+ * desires.
+ *
+ * For retrieving data one needs an address and address length
+ * (sourcemask). While traversing the tree the first matching node is
+ * returned. A node matches when
+ * 		node.scope<=sourcemask && node.elem!=NULL
+ * 		(This is the most specific answer the authority has.)
+ * or
+ * 		node.sourcemask==sourcemask && node.elem!=NULL
+ * 		(This is the most specific question the client can ask.)
+ *
+ * Insertion needs an address, sourcemask and scope. The length of the
+ * address is capped by min(sourcemask, scope). While traversing the
+ * tree the scope of all visited nodes is updated. This ensures we are
+ * always able to find the most specific answer available.
+ */
+
+#ifndef ADDRTREE_H
+#define ADDRTREE_H
+
+typedef uint8_t addrlen_t;
+typedef uint8_t addrkey_t;
+#define KEYWIDTH 8
+
+struct addrtree {
+	struct addrnode *root;
+	/** Number of elements in the tree (not always equal to number of 
+	 * nodes) */
+	unsigned int node_count;
+	/** Maximum number of allowed nodes, will be enforced by LRU list.
+	 * Excluding the root node, 0 for unlimited */
+	unsigned int max_node_count;
+	/** Size of tree in bytes */
+	size_t size_bytes;
+	/** Maximum prefix length we are willing to cache. */
+	addrlen_t max_depth;
+	/** External function to delete elem. Called as 
+	 * delfunc(addrnode->elem, addrtree->env) */
+	void (*delfunc)(void *, void *);
+	/** Environment for delfunc */
+	void *env;
+	/** External function returning size of elem. Called as
+	 * sizefunc(addrnode->elem) */
+	size_t (*sizefunc)(void *);
+	/** first node in LRU list, first candidate to go */
+	struct addrnode* first;
+	/** last node in LRU list, last candidate to go */
+	struct addrnode *last;
+};
+
+struct addrnode {
+	/** Payload of node, may be NULL */
+	void *elem;
+	/** Abs time in seconds in which elem is meaningful */
+	time_t ttl;
+	/** Number of significant bits in address. */
+	addrlen_t scope;
+	/** A node can have 0-2 edges, set to NULL for unused */
+	struct addredge *edge[2];
+	/** edge between this node and parent */
+	struct addredge *parent_edge;
+	/** previous node in LRU list */
+	struct addrnode *prev;
+	/** next node in LRU list */
+	struct addrnode *next;
+};
+
+struct addredge {
+	/** address of connected node */
+	addrkey_t *str;
+	/** lenght in bits of str */
+	addrlen_t len;
+	/** child node this edge is connected to */
+	struct addrnode *node;
+	/** Parent node this ege is connected to */
+	struct addrnode *parent_node;
+	/** Index of this edge in parent_node */
+	int parent_index;
+};
+
+/**
+ * Size of tree in bytes.
+ * @param tree: Tree.
+ * @return size of tree in bytes.
+ */
+size_t addrtree_size(const struct addrtree *tree);
+
+/** 
+ * Create a new tree.
+ * @param max_depth: Tree will cap keys to this length.
+ * @param delfunc: f(element, env) delete element.
+ * @param sizefunc: f(element) returning the size of element.
+ * @param env: Module environment for alloc information.
+ * @param max_node_count: Maximum size of this data structure in nodes. 
+ * 			0 for unlimited.
+ * @return new addrtree or NULL on failure.
+ */
+struct addrtree * 
+addrtree_create(addrlen_t max_depth, void (*delfunc)(void *, void *), 
+	size_t (*sizefunc)(void *), void *env, unsigned int max_node_count);
+
+/** 
+ * Free tree and all nodes below.
+ * @param tree: Tree to be freed.
+ */
+void addrtree_delete(struct addrtree *tree);
+
+/**
+ * Insert an element in the tree. Failures are silent. Sourcemask and
+ * scope might be changed according to local policy. Caller should no 
+ * longer access elem, it could be free'd now or later during future
+ * inserts.
+ * 
+ * @param tree: Tree insert elem in.
+ * @param addr: key for element lookup.
+ * @param sourcemask: Length of addr in bits.
+ * @param scope: Number of significant bits in addr.
+ * @param elem: data to store in the tree.
+ * @param ttl: elem is valid up to this time, seconds.
+ * @param now: Current time in seconds.
+ */
+void addrtree_insert(struct addrtree *tree, const addrkey_t *addr, 
+	addrlen_t sourcemask, addrlen_t scope, void *elem, time_t ttl, 
+	time_t now);
+
+/**
+ * Find a node containing an element in the tree.
+ * 
+ * @param tree: Tree to search.
+ * @param addr: key for element lookup.
+ * @param sourcemask: Length of addr in bits.
+ * @param now: Current time in seconds.
+ * @return addrnode or NULL on miss.
+ */
+struct addrnode * addrtree_find(struct addrtree *tree, 
+	const addrkey_t *addr, addrlen_t sourcemask, time_t now);
+
+/** Wrappers for static functions to unit test */
+int unittest_wrapper_addrtree_cmpbit(const addrkey_t *key1, 
+	const addrkey_t *key2, addrlen_t n);
+addrlen_t unittest_wrapper_addrtree_bits_common(const addrkey_t *s1, 
+	addrlen_t l1, const addrkey_t *s2, addrlen_t l2, addrlen_t skip);
+int unittest_wrapper_addrtree_getbit(const addrkey_t *addr, 
+	addrlen_t addrlen, addrlen_t n);
+int unittest_wrapper_addrtree_issub(const addrkey_t *s1, addrlen_t l1, 
+	const addrkey_t *s2, addrlen_t l2,  addrlen_t skip);
+#endif /* ADDRTREE_H */

edns-subnet/edns-subnet.c

@@ -0,0 +1,65 @@
+/*
+ * edns-subnet/edns-subnet.c - Subnet option related constants 
+ *
+ * Copyright (c) 2013, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * \file
+ * Subnet option related constants. 
+ */
+
+#include "config.h"
+
+#ifdef CLIENT_SUBNET /* keeps splint happy */
+#include "edns-subnet/edns-subnet.h"
+#include <string.h>
+
+int
+copy_clear(uint8_t* dst, size_t dstlen, uint8_t* src, size_t srclen, size_t n)
+{
+	size_t intpart = n / 8;  /* bytes */
+	size_t fracpart = n % 8; /* bits */
+	size_t written = intpart;
+	if (intpart > dstlen || intpart > srclen)
+		return 1;
+	if (fracpart && (intpart+1 > dstlen || intpart+1 > srclen))
+		return 1;
+	memcpy(dst, src, intpart);
+	if (fracpart) {
+		dst[intpart] = src[intpart] & ~(0xFF >> fracpart);
+		written++;
+	}
+	memset(dst + written, 0, dstlen - written);
+	return 0;
+}
+
+#endif /* CLIENT_SUBNET */

edns-subnet/edns-subnet.h

@@ -0,0 +1,67 @@
+/*
+ * edns-subnet/edns-subnet.h - Subnet option related constants 
+ *
+ * Copyright (c) 2013, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * \file
+ * Subnet option related constants. 
+ */
+
+#include "util/net_help.h"
+
+#ifndef EDNSSUBNET_EDNSSUBNET_H
+#define EDNSSUBNET_EDNSSUBNET_H
+
+/** In use by the edns subnet option code, as assigned by IANA */
+#define EDNSSUBNET_ADDRFAM_IP4 1
+#define EDNSSUBNET_ADDRFAM_IP6 2
+
+/**
+ * ECS option
+ */
+struct ecs_data {
+	uint16_t subnet_addr_fam;
+	uint8_t subnet_source_mask;
+	uint8_t subnet_scope_mask;
+	uint8_t subnet_addr[INET6_SIZE];
+	int subnet_validdata;
+};
+
+/** 
+ * copy the first n BITS from src to dst iff both src and dst 
+ * are large enough, return 0 on succes
+ */
+int
+copy_clear(uint8_t* dst, size_t dstlen, uint8_t* src, size_t srclen, size_t n);
+
+#endif /* EDNSSUBNET_EDNSSUBNET_H */

edns-subnet/subnet-whitelist.c

@@ -0,0 +1,153 @@
+/*
+ * edns-subnet/subnet-whitelist.c - Hosts we actively try to send subnet option
+ * to.
+ *
+ * Copyright (c) 2013, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * \file
+ *
+ * Keep track of the white listed servers for subnet option. Based
+ * on acl_list.c|h
+ */
+
+#include "config.h"
+
+#ifdef CLIENT_SUBNET /* keeps splint happy */
+#include "edns-subnet/edns-subnet.h"
+#include "edns-subnet/subnet-whitelist.h"
+#include "util/regional.h"
+#include "util/log.h"
+#include "util/config_file.h"
+#include "util/net_help.h"
+#include "util/storage/dnstree.h"
+
+struct ednssubnet_upstream* 
+upstream_create(void)
+{
+	struct ednssubnet_upstream* upstream = 
+		(struct ednssubnet_upstream*)calloc(1,
+		sizeof(struct ednssubnet_upstream));
+	if(!upstream)
+		return NULL;
+	upstream->region = regional_create();
+	if(!upstream->region) {
+		upstream_delete(upstream);
+		return NULL;
+	}
+	return upstream;
+}
+
+void 
+upstream_delete(struct ednssubnet_upstream* upstream)
+{
+	if(!upstream) 
+		return;
+	regional_destroy(upstream->region);
+	free(upstream);
+}
+
+/** insert new address into upstream structure */
+static int
+upstream_insert(struct ednssubnet_upstream* upstream, 
+	struct sockaddr_storage* addr, socklen_t addrlen, int net)
+{
+	struct addr_tree_node* node = (struct addr_tree_node*)regional_alloc(
+		upstream->region, sizeof(*node));
+	if(!node)
+		return 0;
+	if(!addr_tree_insert(&upstream->tree, node, addr, addrlen, net)) {
+		verbose(VERB_QUERY,
+			"duplicate send-client-subnet address ignored.");
+	}
+	return 1;
+}
+
+/** apply edns-subnet string */
+static int
+upstream_str_cfg(struct ednssubnet_upstream* upstream, const char* str)
+{
+	struct sockaddr_storage addr;
+	int net;
+	socklen_t addrlen;
+	verbose(VERB_ALGO, "send-client-subnet: %s", str);
+	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
+		log_err("cannot parse send-client-subnet netblock: %s", str);
+		return 0;
+	}
+	if(!upstream_insert(upstream, &addr, addrlen, net)) {
+		log_err("out of memory");
+		return 0;
+	}
+	return 1;
+}
+
+/** read client_subnet config */
+static int 
+read_upstream(struct ednssubnet_upstream* upstream, struct config_file* cfg)
+{
+	struct config_strlist* p;
+	for(p = cfg->client_subnet; p; p = p->next) {
+		log_assert(p->str);
+		if(!upstream_str_cfg(upstream, p->str))
+			return 0;
+	}
+	return 1;
+}
+
+int 
+upstream_apply_cfg(struct ednssubnet_upstream* upstream,
+	struct config_file* cfg)
+{
+	regional_free_all(upstream->region);
+	addr_tree_init(&upstream->tree);
+	if(!read_upstream(upstream, cfg))
+		return 0;
+	addr_tree_init_parents(&upstream->tree);
+	return 1;
+}
+
+int 
+upstream_is_whitelisted(struct ednssubnet_upstream* upstream,
+	struct sockaddr_storage* addr, socklen_t addrlen)
+{
+	return addr_tree_lookup(&upstream->tree, addr, addrlen) != NULL;
+}
+
+size_t 
+upstream_get_mem(struct ednssubnet_upstream* upstream)
+{
+	if(!upstream) return 0;
+	return sizeof(*upstream) + regional_get_mem(upstream->region);
+}
+
+#endif /* CLIENT_SUBNET */

edns-subnet/subnet-whitelist.h

@@ -0,0 +1,102 @@
+/*
+ * edns-subnet/subnet-whitelist.h - Hosts we actively try to send subnet option
+ * to.
+ *
+ * Copyright (c) 2013, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * \file
+ *
+ * Keep track of the white listed servers for subnet option. Based
+ * on acl_list.c|h
+ */
+
+#ifndef EDNSSUBNET_WHITELIST_H
+#define EDNSSUBNET_WHITELIST_H
+#include "util/storage/dnstree.h"
+
+struct config_file;
+struct regional;
+
+/**
+ * ednssubnet_upstream structure
+ */
+struct ednssubnet_upstream {
+	/** regional for allocation */
+	struct regional* region;
+	/** 
+	 * Tree of the address spans that are whitelisted.
+	 * contents of type addr_tree_node. Each node is an address span 
+	 * Unbound will append subnet option for.
+	 */
+	rbtree_type tree;
+};
+
+/**
+ * Create ednssubnet_upstream structure 
+ * @return new structure or NULL on error.
+ */
+struct ednssubnet_upstream* upstream_create(void);
+
+/**
+ * Delete ednssubnet_upstream structure.
+ * @param upstream: to delete.
+ */
+void upstream_delete(struct ednssubnet_upstream* upstream);
+
+/**
+ * Process ednssubnet_upstream config.
+ * @param upstream: where to store.
+ * @param cfg: config options.
+ * @return 0 on error.
+ */
+int upstream_apply_cfg(struct ednssubnet_upstream* upstream,
+	struct config_file* cfg);
+
+/**
+ * See if an address is whitelisted.
+ * @param upstream: structure for address storage.
+ * @param addr: address to check
+ * @param addrlen: length of addr.
+ * @return: true if the address is whitelisted for subnet option. 
+ */
+int upstream_is_whitelisted(struct ednssubnet_upstream* upstream,
+	struct sockaddr_storage* addr, socklen_t addrlen);
+
+/**
+ * Get memory used by ednssubnet_upstream structure.
+ * @param upstream: structure for address storage.
+ * @return bytes in use.
+ */
+size_t upstream_get_mem(struct ednssubnet_upstream* upstream);
+
+#endif /* EDNSSUBNET_WHITELIST_H */

edns-subnet/subnetmod.c

@@ -0,0 +1,808 @@
+/*
+ * edns-subnet/subnetmod.c - edns subnet module. Must be called before validator
+ * and iterator.
+ *
+ * Copyright (c) 2013, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ /**
+ * \file
+ * subnet module for unbound.
+ */
+
+#include "config.h"
+
+#ifdef CLIENT_SUBNET /* keeps splint happy */
+
+#include "edns-subnet/subnetmod.h"
+#include "edns-subnet/edns-subnet.h"
+#include "edns-subnet/addrtree.h"
+#include "edns-subnet/subnet-whitelist.h"
+
+#include "services/mesh.h"
+#include "services/cache/dns.h"
+#include "util/module.h"
+#include "util/regional.h"
+#include "util/storage/slabhash.h"
+#include "util/config_file.h"
+#include "util/data/msgreply.h"
+#include "sldns/sbuffer.h"
+
+#define ECS_MAX_TREESIZE 100
+
+/** externally called */
+void 
+subnet_data_delete(void *d, void *ATTR_UNUSED(arg))
+{
+	struct subnet_msg_cache_data *r;
+	r = (struct subnet_msg_cache_data*)d;
+	addrtree_delete(r->tree4);
+	addrtree_delete(r->tree6);
+	free(r);
+}
+
+/** externally called */
+size_t 
+msg_cache_sizefunc(void *k, void *d)
+{
+	struct msgreply_entry *q = (struct msgreply_entry*)k;
+	struct subnet_msg_cache_data *r = (struct subnet_msg_cache_data*)d;
+	size_t s = sizeof(struct msgreply_entry) 
+		+ sizeof(struct subnet_msg_cache_data)
+		+ q->key.qname_len + lock_get_mem(&q->entry.lock);
+	s += addrtree_size(r->tree4);
+	s += addrtree_size(r->tree6);
+	return s;
+}
+
+/** new query for ecs module */
+static int
+subnet_new_qstate(struct module_qstate *qstate, int id)
+{
+	struct subnet_qstate *sq = (struct subnet_qstate*)regional_alloc(
+		qstate->region, sizeof(struct subnet_qstate));
+	if(!sq) 
+		return 0;
+	qstate->minfo[id] = sq;
+	memset(sq, 0, sizeof(*sq));
+	return 1;
+}
+
+/** Add ecs struct to edns list, after parsing it to wire format. */
+static void
+ecs_opt_list_append(struct ecs_data* ecs, struct edns_option** list,
+	struct module_qstate *qstate)
+{
+	size_t sn_octs, sn_octs_remainder;
+	sldns_buffer* buf = qstate->env->scratch_buffer;
+
+	if(ecs->subnet_validdata) {
+		log_assert(ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4 || 
+			ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6);
+		log_assert(ecs->subnet_addr_fam != EDNSSUBNET_ADDRFAM_IP4 || 
+			ecs->subnet_source_mask <=  INET_SIZE*8);
+		log_assert(ecs->subnet_addr_fam != EDNSSUBNET_ADDRFAM_IP6 || 
+			ecs->subnet_source_mask <= INET6_SIZE*8);
+
+		sn_octs = ecs->subnet_source_mask / 8;
+		sn_octs_remainder =
+			(size_t)((ecs->subnet_source_mask % 8)>0?1:0);
+		
+		log_assert(sn_octs + sn_octs_remainder <= INET6_SIZE);
+		
+		sldns_buffer_clear(buf);
+		sldns_buffer_write_u16(buf, ecs->subnet_addr_fam);
+		sldns_buffer_write_u8(buf, ecs->subnet_source_mask);
+		sldns_buffer_write_u8(buf, ecs->subnet_scope_mask);
+		sldns_buffer_write(buf, ecs->subnet_addr, sn_octs);
+		if(sn_octs_remainder)
+			sldns_buffer_write_u8(buf, ecs->subnet_addr[sn_octs] & 
+				~(0xFF >> (ecs->subnet_source_mask % 8)));
+		sldns_buffer_flip(buf);
+
+		edns_opt_list_append(list,
+				qstate->env->cfg->client_subnet_opcode,
+				sn_octs + sn_octs_remainder + 4,
+				sldns_buffer_begin(buf), qstate->region);
+	}
+}
+
+int ecs_whitelist_check(struct query_info* ATTR_UNUSED(qinfo),
+	uint16_t ATTR_UNUSED(flags), struct module_qstate* qstate,
+	struct sockaddr_storage* addr, socklen_t addrlen,
+	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen),
+	struct regional* ATTR_UNUSED(region), int id, void* ATTR_UNUSED(cbargs))
+{
+	struct subnet_qstate *sq;
+	struct subnet_env *sn_env;
+	
+	if(!(sq=(struct subnet_qstate*)qstate->minfo[id]))
+		return 1;
+	sn_env = (struct subnet_env*)qstate->env->modinfo[id];
+
+	/* Cache by default, might be disabled after parsing EDNS option
+	 * received from nameserver. */
+	qstate->no_cache_store = 0;
+
+	if(sq->ecs_server_out.subnet_validdata && ((sq->subnet_downstream &&
+		qstate->env->cfg->client_subnet_always_forward) ||
+		upstream_is_whitelisted(sn_env->edns_subnet_upstreams, 
+		addr, addrlen))) {
+		/* Address on whitelist or client query contains ECS option, we
+		 * want to sent out ECS. Only add option if it is not already
+		 * set. */
+		if(!(sq->subnet_sent)) {
+			ecs_opt_list_append(&sq->ecs_server_out,
+				&qstate->edns_opts_back_out, qstate);
+			sq->subnet_sent = 1;
+		}
+	}
+	else if(sq->subnet_sent) {
+		/* Outgoing ECS option is set, but we don't want to sent it to
+		 * this address, remove option. */
+		edns_opt_list_remove(&qstate->edns_opts_back_out,
+			qstate->env->cfg->client_subnet_opcode);
+		sq->subnet_sent = 0;
+	}
+	return 1;
+}
+
+
+int
+subnetmod_init(struct module_env *env, int id)
+{
+	struct subnet_env *sn_env = (struct subnet_env*)calloc(1,
+		sizeof(struct subnet_env));
+	if(!sn_env) {
+		log_err("malloc failure");
+		return 0;
+	}
+	alloc_init(&sn_env->alloc, NULL, 0);
+	env->modinfo[id] = (void*)sn_env;
+	/* Copy msg_cache settings */
+	sn_env->subnet_msg_cache = slabhash_create(env->cfg->msg_cache_slabs,
+		HASH_DEFAULT_STARTARRAY, env->cfg->msg_cache_size,
+		msg_cache_sizefunc, query_info_compare, query_entry_delete,
+		subnet_data_delete, NULL);
+	if(!sn_env->subnet_msg_cache) {
+		log_err("subnet: could not create cache");
+		free(sn_env);
+		env->modinfo[id] = NULL;
+		return 0;
+	}
+	/* whitelist for edns subnet capable servers */
+	sn_env->edns_subnet_upstreams = upstream_create();
+	if(!sn_env->edns_subnet_upstreams ||
+		!upstream_apply_cfg(sn_env->edns_subnet_upstreams, env->cfg)) {
+		log_err("subnet: could not create ECS whitelist");
+		slabhash_delete(sn_env->subnet_msg_cache);
+		free(sn_env);
+		env->modinfo[id] = NULL;
+		return 0;
+	}
+
+	verbose(VERB_QUERY, "subnet: option registered (%d)",
+		env->cfg->client_subnet_opcode);
+	/* Create new mesh state for all queries. */
+	env->unique_mesh = 1;
+	if(!edns_register_option(env->cfg->client_subnet_opcode,
+		env->cfg->client_subnet_always_forward /* bypass cache */,
+		0 /* no aggregation */, env)) {
+		log_err("subnet: could not register opcode");
+		upstream_delete(sn_env->edns_subnet_upstreams);
+		slabhash_delete(sn_env->subnet_msg_cache);
+		free(sn_env);
+		env->modinfo[id] = NULL;
+		return 0;
+	}
+	inplace_cb_register((void*)ecs_whitelist_check, inplace_cb_query, NULL,
+		env, id);
+	inplace_cb_register((void*)ecs_edns_back_parsed,
+		inplace_cb_edns_back_parsed, NULL, env, id);
+	inplace_cb_register((void*)ecs_query_response,
+		inplace_cb_query_response, NULL, env, id);
+	lock_rw_init(&sn_env->biglock);
+	return 1;
+}
+
+void
+subnetmod_deinit(struct module_env *env, int id)
+{
+	struct subnet_env *sn_env;
+	if(!env || !env->modinfo[id])
+		return;
+	sn_env = (struct subnet_env*)env->modinfo[id];
+	lock_rw_destroy(&sn_env->biglock);
+	inplace_cb_delete(env, inplace_cb_edns_back_parsed, id);
+	inplace_cb_delete(env, inplace_cb_query, id);
+	upstream_delete(sn_env->edns_subnet_upstreams);
+	slabhash_delete(sn_env->subnet_msg_cache);
+	alloc_clear(&sn_env->alloc);
+	free(sn_env);
+	env->modinfo[id] = NULL;
+}
+
+/** Tells client that upstream has no/improper support */
+static void
+cp_edns_bad_response(struct ecs_data *target, struct ecs_data *source)
+{
+	target->subnet_scope_mask  = 0;
+	target->subnet_source_mask = source->subnet_source_mask;
+	target->subnet_addr_fam    = source->subnet_addr_fam;
+	memcpy(target->subnet_addr, source->subnet_addr, INET6_SIZE);
+	target->subnet_validdata = 1;
+}
+
+static void
+delfunc(void *envptr, void *elemptr) {
+	struct reply_info *elem = (struct reply_info *)elemptr;
+	struct subnet_env *env = (struct subnet_env *)envptr;
+	reply_info_parsedelete(elem, &env->alloc);
+}
+
+static size_t
+sizefunc(void *elemptr) {
+	struct reply_info *elem  = (struct reply_info *)elemptr;
+	return sizeof (struct reply_info) - sizeof (struct rrset_ref)
+		+ elem->rrset_count * sizeof (struct rrset_ref)
+		+ elem->rrset_count * sizeof (struct ub_packed_rrset_key *);
+}
+
+/**
+ * Select tree from cache entry based on edns data.
+ * If for address family not present it will create a new one.
+ * NULL on failure to create. */
+static struct addrtree* 
+get_tree(struct subnet_msg_cache_data *data, struct ecs_data *edns, 
+	struct subnet_env *env, struct config_file* cfg)
+{
+	struct addrtree *tree;
+	if (edns->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4) {
+		if (!data->tree4)
+			data->tree4 = addrtree_create(
+				cfg->max_client_subnet_ipv4, &delfunc,
+				&sizefunc, env, ECS_MAX_TREESIZE);
+		tree = data->tree4;
+	} else {
+		if (!data->tree6)
+			data->tree6 = addrtree_create(
+				cfg->max_client_subnet_ipv6, &delfunc,
+				&sizefunc, env, ECS_MAX_TREESIZE);
+		tree = data->tree6;
+	}
+	return tree;
+}
+
+static void
+update_cache(struct module_qstate *qstate, int id)
+{
+	struct msgreply_entry *mrep_entry;
+	struct addrtree *tree;
+	struct reply_info *rep;
+	struct query_info qinf;
+	struct subnet_env *sne = qstate->env->modinfo[id];
+	struct subnet_qstate *sq = (struct subnet_qstate*)qstate->minfo[id];
+	struct slabhash *subnet_msg_cache = sne->subnet_msg_cache;
+	struct ecs_data *edns = &sq->ecs_client_in;
+	size_t i;
+
+	/* We already calculated hash upon lookup */
+	hashvalue_type h = qstate->minfo[id] ? 
+		((struct subnet_qstate*)qstate->minfo[id])->qinfo_hash : 
+		query_info_hash(&qstate->qinfo, qstate->query_flags);
+	/* Step 1, general qinfo lookup */
+	struct lruhash_entry *lru_entry = slabhash_lookup(subnet_msg_cache, h,
+		&qstate->qinfo, 1);
+	int acquired_lock = (lru_entry != NULL);
+	if (!lru_entry) {
+		qinf = qstate->qinfo;
+		qinf.qname = memdup(qstate->qinfo.qname,
+			qstate->qinfo.qname_len);
+		if(!qinf.qname) {
+			log_err("memdup failed");
+			return;
+		}
+		mrep_entry = query_info_entrysetup(&qinf, NULL, h);
+		free(qinf.qname); /* if qname 'consumed', it is set to NULL */
+		if (!mrep_entry) {
+			log_err("query_info_entrysetup failed");
+			return;
+		}
+		lru_entry = &mrep_entry->entry;
+		lru_entry->data = calloc(1,
+			sizeof(struct subnet_msg_cache_data));
+		if (!lru_entry->data) {
+			log_err("malloc failed");
+			return;
+		}
+	}
+	/* Step 2, find the correct tree */
+	if (!(tree = get_tree(lru_entry->data, edns, sne, qstate->env->cfg))) {
+		if (acquired_lock) lock_rw_unlock(&lru_entry->lock);
+		log_err("Subnet cache insertion failed");
+		return;
+	}
+	rep = reply_info_copy(qstate->return_msg->rep, &sne->alloc, NULL);
+	if (!rep) {
+		if (acquired_lock) lock_rw_unlock(&lru_entry->lock);
+		log_err("Subnet cache insertion failed");
+		return;
+	}
+	
+	/* store RRsets */
+	for(i=0; i<rep->rrset_count; i++) {
+		rep->ref[i].key = rep->rrsets[i];
+		rep->ref[i].id = rep->rrsets[i]->id;
+	}
+	reply_info_set_ttls(rep, *qstate->env->now);
+	rep->flags |= (BIT_RA | BIT_QR); /* fix flags to be sensible for */
+	rep->flags &= ~(BIT_AA | BIT_CD);/* a reply based on the cache   */
+	addrtree_insert(tree, (addrkey_t*)edns->subnet_addr, 
+		edns->subnet_source_mask, 
+		sq->ecs_server_in.subnet_scope_mask, rep,
+		rep->ttl, *qstate->env->now);
+	if (acquired_lock) {
+		lock_rw_unlock(&lru_entry->lock);
+	} else {
+		slabhash_insert(subnet_msg_cache, h, lru_entry, lru_entry->data,
+			NULL);
+	}
+}
+
+/** Lookup in cache and reply true iff reply is sent. */
+static int
+lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
+{
+	struct lruhash_entry *e;
+	struct module_env *env = qstate->env;
+	struct subnet_env *sne = (struct subnet_env*)env->modinfo[id];
+	hashvalue_type h = query_info_hash(&qstate->qinfo, qstate->query_flags);
+	struct subnet_msg_cache_data *data;
+	struct ecs_data *ecs = &sq->ecs_client_in;
+	struct addrtree *tree;
+	struct addrnode *node;
+	uint8_t scope;
+
+	memset(&sq->ecs_client_out, 0, sizeof(sq->ecs_client_out));
+
+	if (sq) sq->qinfo_hash = h; /* Might be useful on cache miss */
+	e = slabhash_lookup(sne->subnet_msg_cache, h, &qstate->qinfo, 1);
+	if (!e) return 0; /* qinfo not in cache */
+	data = e->data;
+	tree = (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4)?
+		data->tree4 : data->tree6;
+	if (!tree) { /* qinfo in cache but not for this family */
+		lock_rw_unlock(&e->lock);
+		return 0;
+	}
+	node = addrtree_find(tree, (addrkey_t*)ecs->subnet_addr, 
+		ecs->subnet_source_mask, *env->now);
+	if (!node) { /* plain old cache miss */
+		lock_rw_unlock(&e->lock);
+		return 0;
+	}
+
+	qstate->return_msg = tomsg(NULL, &qstate->qinfo,
+		(struct reply_info *)node->elem, qstate->region, *env->now,
+		env->scratch);
+	scope = (uint8_t)node->scope;
+	lock_rw_unlock(&e->lock);
+	
+	if (!qstate->return_msg) { /* Failed allocation or expired TTL */
+		return 0;
+	}
+	
+	if (sq->subnet_downstream) { /* relay to interested client */
+		sq->ecs_client_out.subnet_scope_mask = scope;
+		sq->ecs_client_out.subnet_addr_fam = ecs->subnet_addr_fam;
+		sq->ecs_client_out.subnet_source_mask = ecs->subnet_source_mask;
+		memcpy(&sq->ecs_client_out.subnet_addr, &ecs->subnet_addr,
+			INET6_SIZE);
+		sq->ecs_client_out.subnet_validdata = 1;
+	}
+	return 1;
+}
+
+/**
+ * Test first bits of addresses for equality. Caller is responsible
+ * for making sure that both a and b are at least net/8 octets long.
+ * @param a: first address.
+ * @param a: seconds address.
+ * @param net: Number of bits to test.
+ * @return: 1 if equal, 0 otherwise.
+ */
+static int 
+common_prefix(uint8_t *a, uint8_t *b, uint8_t net)
+{
+	size_t n = (size_t)net / 8;
+	return !memcmp(a, b, n) && ((net % 8) == 0 || a[n] == b[n]);
+}
+
+static enum module_ext_state
+eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
+{
+	struct subnet_env *sne = qstate->env->modinfo[id];
+
+	struct ecs_data *c_in  = &sq->ecs_client_in; /* rcvd from client */
+	struct ecs_data *c_out = &sq->ecs_client_out;/* will send to client */
+	struct ecs_data *s_in  = &sq->ecs_server_in; /* rcvd from auth */
+	struct ecs_data *s_out = &sq->ecs_server_out;/* sent to auth */
+
+	memset(c_out, 0, sizeof(*c_out));
+
+	if (!qstate->return_msg) return module_error;
+	
+	/* We have not asked for subnet data */
+	if (!sq->subnet_sent) {
+		if (s_in->subnet_validdata)
+			verbose(VERB_QUERY, "subnet: received spurious data");
+		if (sq->subnet_downstream) /* Copy back to client */
+			cp_edns_bad_response(c_out, c_in);
+		return module_finished;
+	}
+	
+	/* subnet sent but nothing came back */
+	if (!s_in->subnet_validdata) {
+		/* The authority indicated no support for edns subnet. As a
+		 * consequence the answer ended up in the regular cache. It
+		 * is still usefull to put it in the edns subnet cache for
+		 * when a client explicitly asks for subnet specific answer. */
+		verbose(VERB_QUERY, "subnet: Authority indicates no support");
+		lock_rw_wrlock(&sne->biglock);
+		update_cache(qstate, id);
+		lock_rw_unlock(&sne->biglock);
+		if (sq->subnet_downstream)
+			cp_edns_bad_response(c_out, c_in);
+		return module_finished;
+	}
+	
+	/* Being here means we have asked for and got a subnet specific 
+	 * answer. Also, the answer from the authority is not yet cached 
+	 * anywhere. */
+	
+	/* can we accept response? */
+	if(s_out->subnet_addr_fam != s_in->subnet_addr_fam ||
+		s_out->subnet_source_mask != s_in->subnet_source_mask ||
+		!common_prefix(s_out->subnet_addr, s_in->subnet_addr, 
+			s_out->subnet_source_mask))
+	{
+		/* we can not accept, restart query without option */
+		verbose(VERB_QUERY, "subnet: forged data");
+		s_out->subnet_validdata = 0;
+		(void)edns_opt_list_remove(&qstate->edns_opts_back_out,
+			qstate->env->cfg->client_subnet_opcode);
+		sq->subnet_sent = 0;
+		return module_restart_next;
+	}
+
+	lock_rw_wrlock(&sne->biglock);
+	update_cache(qstate, id);
+	lock_rw_unlock(&sne->biglock);
+	
+	if (sq->subnet_downstream) {
+		/* Client wants to see the answer, echo option back
+		 * and adjust the scope. */
+		c_out->subnet_addr_fam = c_in->subnet_addr_fam;
+		c_out->subnet_source_mask = c_in->subnet_source_mask;
+		memcpy(&c_out->subnet_addr, &c_in->subnet_addr, INET6_SIZE);
+		c_out->subnet_scope_mask = s_in->subnet_scope_mask;
+		c_out->subnet_validdata = 1;
+	}
+	return module_finished;
+}
+
+/** Parse EDNS opt data containing ECS */
+static int
+parse_subnet_option(struct edns_option* ecs_option, struct ecs_data* ecs)
+{
+	memset(ecs, 0, sizeof(*ecs));
+	if (ecs_option->opt_len < 4)
+		return 0;
+
+	ecs->subnet_addr_fam = sldns_read_uint16(ecs_option->opt_data);
+	ecs->subnet_source_mask = ecs_option->opt_data[2];
+	ecs->subnet_scope_mask = ecs_option->opt_data[3];
+	/* remaing bytes indicate address */
+	
+	/* validate input*/
+	/* option length matches calculated length? */
+	if (ecs_option->opt_len != (size_t)((ecs->subnet_source_mask+7)/8 + 4))
+		return 0;
+	if (ecs_option->opt_len - 4 > INET6_SIZE || ecs_option->opt_len == 0)
+		return 0;
+	if (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4) {
+		if (ecs->subnet_source_mask > 32 || ecs->subnet_scope_mask > 32)
+			return 0;
+	} else if (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6) {
+		if (ecs->subnet_source_mask > 128 ||
+			ecs->subnet_scope_mask > 128)
+			return 0;
+	} else
+		return 0;
+	
+	/* valid ECS data, write to ecs_data */
+	if (copy_clear(ecs->subnet_addr, INET6_SIZE, ecs_option->opt_data + 4, 
+		ecs_option->opt_len - 4, ecs->subnet_source_mask))
+		return 0;
+	ecs->subnet_validdata = 1;
+	return 1;
+}
+
+static void
+subnet_option_from_ss(struct sockaddr_storage *ss, struct ecs_data* ecs,
+	struct config_file* cfg)
+{
+	void* sinaddr;
+
+	/* Construct subnet option from original query */
+	if(((struct sockaddr_in*)ss)->sin_family == AF_INET) {
+		ecs->subnet_source_mask = cfg->max_client_subnet_ipv4;
+		ecs->subnet_addr_fam = EDNSSUBNET_ADDRFAM_IP4;
+		sinaddr = &((struct sockaddr_in*)ss)->sin_addr;
+		if (!copy_clear( ecs->subnet_addr, INET6_SIZE,
+			(uint8_t *)sinaddr, INET_SIZE,
+			ecs->subnet_source_mask)) {
+			ecs->subnet_validdata = 1;
+		}
+	}
+#ifdef INET6
+	else {
+		ecs->subnet_source_mask = cfg->max_client_subnet_ipv6;
+		ecs->subnet_addr_fam = EDNSSUBNET_ADDRFAM_IP6;
+		sinaddr = &((struct sockaddr_in6*)ss)->sin6_addr;
+		if (!copy_clear( ecs->subnet_addr, INET6_SIZE,
+			(uint8_t *)sinaddr, INET6_SIZE,
+			ecs->subnet_source_mask)) {
+			ecs->subnet_validdata = 1;
+		}
+	}
+#else
+			/* We don't know how to handle ip6, just pass */
+#endif /* INET6 */
+}
+
+int
+ecs_query_response(struct module_qstate* qstate, struct dns_msg* response,
+	int id, void* ATTR_UNUSED(cbargs))
+{
+	struct subnet_qstate *sq;
+	
+	if(!response || !(sq=(struct subnet_qstate*)qstate->minfo[id]))
+		return 1;
+
+	if(sq->subnet_sent &&
+		FLAGS_GET_RCODE(response->rep->flags) == LDNS_RCODE_REFUSED) {
+		/* REFUSED reponse to ECS query, remove ECS option. */
+		edns_opt_list_remove(&qstate->edns_opts_back_out,
+			qstate->env->cfg->client_subnet_opcode);
+		sq->subnet_sent = 0;
+		memset(&sq->ecs_server_out, 0, sizeof(sq->ecs_server_out));
+	}
+	return 1;
+}
+
+int
+ecs_edns_back_parsed(struct module_qstate* qstate, int id,
+	void* ATTR_UNUSED(cbargs))
+{
+	struct subnet_qstate *sq;
+	struct edns_option* ecs_opt;
+	
+	if(!(sq=(struct subnet_qstate*)qstate->minfo[id]))
+		return 1;
+	if((ecs_opt = edns_opt_list_find(
+		qstate->edns_opts_back_in,
+		qstate->env->cfg->client_subnet_opcode))) {
+		if(parse_subnet_option(ecs_opt, &sq->ecs_server_in) &&
+			sq->subnet_sent &&
+			sq->ecs_server_in.subnet_validdata)
+			/* Only skip global cache store if we sent an ECS option
+			 * and received one back. Answers from non-whitelisted
+			 * servers will end up in global cache. Ansers for
+			 * queries with 0 source will not (unless nameserver
+			 * does not support ECS). */
+			qstate->no_cache_store = 1;
+	}
+
+	return 1;
+}
+
+void
+subnetmod_operate(struct module_qstate *qstate, enum module_ev event, 
+	int id, struct outbound_entry* outbound)
+{
+	struct subnet_env *sne = qstate->env->modinfo[id];
+	struct subnet_qstate *sq = (struct subnet_qstate*)qstate->minfo[id];
+	
+	verbose(VERB_QUERY, "subnet[module %d] operate: extstate:%s "
+		"event:%s", id, strextstate(qstate->ext_state[id]), 
+		strmodulevent(event));
+	log_query_info(VERB_QUERY, "subnet operate: query", &qstate->qinfo);
+
+	if((event == module_event_new || event == module_event_pass) &&
+		sq == NULL) {
+		struct edns_option* ecs_opt;
+		if(!subnet_new_qstate(qstate, id)) {
+			qstate->return_msg = NULL;
+			qstate->ext_state[id] = module_finished;
+			return;
+		}
+
+		sq = (struct subnet_qstate*)qstate->minfo[id];
+
+		if((ecs_opt = edns_opt_list_find(
+			qstate->edns_opts_front_in,
+			qstate->env->cfg->client_subnet_opcode))) {
+			if(!parse_subnet_option(ecs_opt, &sq->ecs_client_in)) {
+				/* Wrongly formatted ECS option. RFC mandates to
+				 * return FORMERROR. */
+				qstate->return_rcode = LDNS_RCODE_FORMERR;
+				qstate->ext_state[id] = module_finished;
+				return;
+			}
+			sq->subnet_downstream = 1;
+		}
+		else if(qstate->mesh_info->reply_list) {
+			subnet_option_from_ss(
+				&qstate->mesh_info->reply_list->query_reply.addr,
+				&sq->ecs_client_in, qstate->env->cfg);
+		}
+		
+		if(sq->ecs_client_in.subnet_validdata == 0) {
+			/* No clients are interested in result or we could not
+			 * parse it, we don't do client subnet */
+			sq->ecs_server_out.subnet_validdata = 0;
+			verbose(VERB_ALGO, "subnet: pass to next module");
+			qstate->ext_state[id] = module_wait_module;
+			return;
+		}
+
+		lock_rw_wrlock(&sne->biglock);
+		if (lookup_and_reply(qstate, id, sq)) {
+			lock_rw_unlock(&sne->biglock);
+			verbose(VERB_QUERY, "subnet: answered from cache");
+			qstate->ext_state[id] = module_finished;
+
+			ecs_opt_list_append(&sq->ecs_client_out,
+				&qstate->edns_opts_front_out, qstate);
+			return;
+		}
+		lock_rw_unlock(&sne->biglock);
+		
+		sq->ecs_server_out.subnet_addr_fam =
+			sq->ecs_client_in.subnet_addr_fam;
+		sq->ecs_server_out.subnet_source_mask =
+			sq->ecs_client_in.subnet_source_mask;
+		/* Limit source prefix to configured maximum */
+		if(sq->ecs_server_out.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4 
+			&& sq->ecs_server_out.subnet_source_mask >
+			qstate->env->cfg->max_client_subnet_ipv4)
+			sq->ecs_server_out.subnet_source_mask =
+				qstate->env->cfg->max_client_subnet_ipv4;
+		else if(sq->ecs_server_out.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6 
+			&& sq->ecs_server_out.subnet_source_mask >
+			qstate->env->cfg->max_client_subnet_ipv6)
+			sq->ecs_server_out.subnet_source_mask =
+				qstate->env->cfg->max_client_subnet_ipv6;
+		/* Safe to copy completely, even if the source is limited by the
+		 * configuration. ecs_opt_list_append() will limit the address.
+		 * */
+		memcpy(&sq->ecs_server_out.subnet_addr,
+			sq->ecs_client_in.subnet_addr, INET6_SIZE);
+		sq->ecs_server_out.subnet_scope_mask = 0;
+		sq->ecs_server_out.subnet_validdata = 1;
+		if(sq->ecs_server_out.subnet_source_mask != 0 &&
+			sq->subnet_downstream)
+			/* ECS specific data required, do not look at the global
+			 * cache in other modules. */
+			qstate->no_cache_lookup = 1;
+		
+		/* pass request to next module */
+		verbose(VERB_ALGO,
+			"subnet: not found in cache. pass to next module");
+		qstate->ext_state[id] = module_wait_module;
+		return;
+	}
+	/* Query handed back by next module, we have a 'final' answer */
+	if(sq && event == module_event_moddone) {
+		qstate->ext_state[id] = eval_response(qstate, id, sq);
+		if(qstate->ext_state[id] == module_finished) {
+			ecs_opt_list_append(&sq->ecs_client_out,
+				&qstate->edns_opts_front_out, qstate);
+		}
+		return;
+	}
+	if(sq && outbound) {
+		return;
+	}
+	/* We are being revisited */
+	if(event == module_event_pass || event == module_event_new) {
+		/* Just pass it on, we already did the work */
+		verbose(VERB_ALGO, "subnet: pass to next module");
+		qstate->ext_state[id] = module_wait_module;
+		return;
+	}
+	if(!sq && (event == module_event_moddone)) {
+		/* during priming, module done but we never started */
+		qstate->ext_state[id] = module_finished;
+		return;
+	}
+	log_err("subnet: bad event %s", strmodulevent(event));
+	qstate->ext_state[id] = module_error;
+	return;
+}
+
+void
+subnetmod_clear(struct module_qstate *ATTR_UNUSED(qstate),
+	int ATTR_UNUSED(id))
+{
+	/* qstate has no data outside region */
+}
+
+void
+subnetmod_inform_super(struct module_qstate *ATTR_UNUSED(qstate),
+	int ATTR_UNUSED(id), struct module_qstate *ATTR_UNUSED(super))
+{
+	/* Not used */
+}
+
+size_t
+subnetmod_get_mem(struct module_env *env, int id)
+{
+	struct subnet_env *sn_env = env->modinfo[id];
+	if (!sn_env) return 0;
+	return sizeof(*sn_env) + 
+		slabhash_get_mem(sn_env->subnet_msg_cache) +
+		upstream_get_mem(sn_env->edns_subnet_upstreams);
+}
+
+/**
+ * The module function block 
+ */
+static struct module_func_block subnetmod_block = {
+	"subnet", &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
+	&subnetmod_inform_super, &subnetmod_clear, &subnetmod_get_mem
+};
+
+struct module_func_block*
+subnetmod_get_funcblock(void)
+{
+	return &subnetmod_block;
+}
+
+/** Wrappers for static functions to unit test */
+size_t
+unittest_wrapper_subnetmod_sizefunc(void *elemptr)
+{
+	return sizefunc(elemptr);
+}
+
+#endif  /* CLIENT_SUBNET */

edns-subnet/subnetmod.h

@@ -0,0 +1,130 @@
+/*
+ * edns-subnet/subnetmod.h - edns subnet module. Must be called before validator
+ * and iterator.
+ *
+ * Copyright (c) 2013, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * \file
+ * subnet module for unbound.
+ */
+
+#ifndef SUBNETMOD_H
+#define SUBNETMOD_H
+#include "util/module.h"
+#include "services/outbound_list.h"
+#include "util/alloc.h"
+#include "util/net_help.h"
+#include "util/storage/slabhash.h"
+#include "edns-subnet/addrtree.h"
+#include "edns-subnet/edns-subnet.h"
+
+/**
+ * Global state for the subnet module.
+ */
+struct subnet_env {
+	/** shared message cache
+	 * key: struct query_info*
+	 * data: struct subnet_msg_cache_data* */
+	struct slabhash* subnet_msg_cache;
+	/** access control, which upstream servers we send client address */
+	struct ednssubnet_upstream* edns_subnet_upstreams;
+	/** allocation service */
+	struct alloc_cache alloc;
+	lock_rw_type biglock;
+};
+
+struct subnet_msg_cache_data {
+	struct addrtree* tree4;
+	struct addrtree* tree6;
+};
+
+struct subnet_qstate {
+	/** We need the hash for both cache lookup and insert */
+	hashvalue_type qinfo_hash;
+	/** ecs_data for client communication */
+	struct ecs_data	ecs_client_in;
+	struct ecs_data	ecs_client_out;
+	/** ecss data for server communication */
+	struct ecs_data	ecs_server_in;
+	struct ecs_data	ecs_server_out;
+	int subnet_downstream;
+	int subnet_sent;
+};
+
+void subnet_data_delete(void* d, void* ATTR_UNUSED(arg));
+size_t msg_cache_sizefunc(void* k, void* d);
+
+/**
+ * Get the module function block.
+ * @return: function block with function pointers to module methods.
+ */
+struct module_func_block* subnetmod_get_funcblock(void);
+
+/** subnet module init */
+int subnetmod_init(struct module_env* env, int id);
+
+/** subnet module deinit */
+void subnetmod_deinit(struct module_env* env, int id);
+
+/** subnet module operate on a query */
+void subnetmod_operate(struct module_qstate* qstate, enum module_ev event,
+	int id, struct outbound_entry* outbound);
+
+/** subnet module  */
+void subnetmod_inform_super(struct module_qstate* qstate, int id,
+	struct module_qstate* super);
+
+/** subnet module cleanup query state */
+void subnetmod_clear(struct module_qstate* qstate, int id);
+
+/** subnet module alloc size routine */
+size_t subnetmod_get_mem(struct module_env* env, int id);
+
+/** Wrappers for static functions to unit test */
+size_t unittest_wrapper_subnetmod_sizefunc(void *elemptr);
+
+/** Whitelist check, called just before query is sent upstream. */
+int ecs_whitelist_check(struct query_info* qinfo, uint16_t flags,
+	struct module_qstate* qstate, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* zone, size_t zonelen,
+	struct regional* region, int id, void* cbargs);
+
+/** Check whether reponse from server contains ECS record, if so, skip cache
+ * store. Called just after parsing EDNS data from server. */
+int ecs_edns_back_parsed(struct module_qstate* qstate, int id, void* cbargs);
+
+/** Remove ECS record from back_out when query resulted in REFUSED response. */
+int ecs_query_response(struct module_qstate* qstate, struct dns_msg* response,
+	int id, void* cbargs);
+
+#endif /* SUBNETMOD_H */

install-sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2011-11-20.07; # UTC
+scriptversion=2013-12-25.23; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -41,19 +41,15 @@ scriptversion=2011-11-20.07; # UTC
 # This script is compatible with the BSD install script, but was written
 # from scratch.
 
+tab='	'
 nl='
 '
-IFS=" ""	$nl"
+IFS=" $tab$nl"
 
-# set DOITPROG to echo to test this script
+# Set DOITPROG to "echo" to test this script.
 
-# Don't use :- since 4.3BSD and earlier shells don't like it.
 doit=${DOITPROG-}
-if test -z "$doit"; then
-  doit_exec=exec
-else
-  doit_exec=$doit
-fi
+doit_exec=${doit:-exec}
 
 # Put in absolute file names if you don't have them in your path;
 # or use environment vars.
@@ -68,17 +64,6 @@ mvprog=${MVPROG-mv}
 rmprog=${RMPROG-rm}
 stripprog=${STRIPPROG-strip}
 
-posix_glob='?'
-initialize_posix_glob='
-  test "$posix_glob" != "?" || {
-    if (set -f) 2>/dev/null; then
-      posix_glob=
-    else
-      posix_glob=:
-    fi
-  }
-'
-
 posix_mkdir=
 
 # Desired mode of installed file.
@@ -97,7 +82,7 @@ dir_arg=
 dst_arg=
 
 copy_on_change=false
-no_target_directory=
+is_target_a_directory=possibly
 
 usage="\
 Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
@@ -137,46 +122,57 @@ while test $# -ne 0; do
     -d) dir_arg=true;;
 
     -g) chgrpcmd="$chgrpprog $2"
-	shift;;
+        shift;;
 
     --help) echo "$usage"; exit $?;;
 
     -m) mode=$2
-	case $mode in
-	  *' '* | *'	'* | *'
-'*	  | *'*'* | *'?'* | *'['*)
-	    echo "$0: invalid mode: $mode" >&2
-	    exit 1;;
-	esac
-	shift;;
+        case $mode in
+          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*)
+            echo "$0: invalid mode: $mode" >&2
+            exit 1;;
+        esac
+        shift;;
 
     -o) chowncmd="$chownprog $2"
-	shift;;
+        shift;;
 
     -s) stripcmd=$stripprog;;
 
-    -t) dst_arg=$2
-	# Protect names problematic for 'test' and other utilities.
-	case $dst_arg in
-	  -* | [=\(\)!]) dst_arg=./$dst_arg;;
-	esac
-	shift;;
+    -t)
+        is_target_a_directory=always
+        dst_arg=$2
+        # Protect names problematic for 'test' and other utilities.
+        case $dst_arg in
+          -* | [=\(\)!]) dst_arg=./$dst_arg;;
+        esac
+        shift;;
 
-    -T) no_target_directory=true;;
+    -T) is_target_a_directory=never;;
 
     --version) echo "$0 $scriptversion"; exit $?;;
 
-    --)	shift
-	break;;
+    --) shift
+        break;;
 
-    -*)	echo "$0: invalid option: $1" >&2
-	exit 1;;
+    -*) echo "$0: invalid option: $1" >&2
+        exit 1;;
 
     *)  break;;
   esac
   shift
 done
 
+# We allow the use of options -d and -T together, by making -d
+# take the precedence; this is for compatibility with GNU install.
+
+if test -n "$dir_arg"; then
+  if test -n "$dst_arg"; then
+    echo "$0: target directory not allowed when installing a directory." >&2
+    exit 1
+  fi
+fi
+
 if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
   # When -d is used, all remaining arguments are directories to create.
   # When -t is used, the destination is already specified.
@@ -207,6 +203,15 @@ if test $# -eq 0; then
   exit 0
 fi
 
+if test -z "$dir_arg"; then
+  if test $# -gt 1 || test "$is_target_a_directory" = always; then
+    if test ! -d "$dst_arg"; then
+      echo "$0: $dst_arg: Is not a directory." >&2
+      exit 1
+    fi
+  fi
+fi
+
 if test -z "$dir_arg"; then
   do_exit='(exit $ret); exit $ret'
   trap "ret=129; $do_exit" 1
@@ -223,16 +228,16 @@ if test -z "$dir_arg"; then
 
     *[0-7])
       if test -z "$stripcmd"; then
-	u_plus_rw=
+        u_plus_rw=
       else
-	u_plus_rw='% 200'
+        u_plus_rw='% 200'
       fi
       cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
     *)
       if test -z "$stripcmd"; then
-	u_plus_rw=
+        u_plus_rw=
       else
-	u_plus_rw=,u+rw
+        u_plus_rw=,u+rw
       fi
       cp_umask=$mode$u_plus_rw;;
   esac
@@ -269,41 +274,15 @@ do
     # If destination is a directory, append the input filename; won't work
     # if double slashes aren't ignored.
     if test -d "$dst"; then
-      if test -n "$no_target_directory"; then
-	echo "$0: $dst_arg: Is a directory" >&2
-	exit 1
+      if test "$is_target_a_directory" = never; then
+        echo "$0: $dst_arg: Is a directory" >&2
+        exit 1
       fi
       dstdir=$dst
       dst=$dstdir/`basename "$src"`
       dstdir_status=0
     else
-      # Prefer dirname, but fall back on a substitute if dirname fails.
-      dstdir=`
-	(dirname "$dst") 2>/dev/null ||
-	expr X"$dst" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
-	     X"$dst" : 'X\(//\)[^/]' \| \
-	     X"$dst" : 'X\(//\)$' \| \
-	     X"$dst" : 'X\(/\)' \| . 2>/dev/null ||
-	echo X"$dst" |
-	    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)[^/].*/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\).*/{
-		   s//\1/
-		   q
-		 }
-		 s/.*/./; q'
-      `
-
+      dstdir=`dirname "$dst"`
       test -d "$dstdir"
       dstdir_status=$?
     fi
@@ -314,74 +293,74 @@ do
   if test $dstdir_status != 0; then
     case $posix_mkdir in
       '')
-	# Create intermediate dirs using mode 755 as modified by the umask.
-	# This is like FreeBSD 'install' as of 1997-10-28.
-	umask=`umask`
-	case $stripcmd.$umask in
-	  # Optimize common cases.
-	  *[2367][2367]) mkdir_umask=$umask;;
-	  .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
+        # Create intermediate dirs using mode 755 as modified by the umask.
+        # This is like FreeBSD 'install' as of 1997-10-28.
+        umask=`umask`
+        case $stripcmd.$umask in
+          # Optimize common cases.
+          *[2367][2367]) mkdir_umask=$umask;;
+          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
 
-	  *[0-7])
-	    mkdir_umask=`expr $umask + 22 \
-	      - $umask % 100 % 40 + $umask % 20 \
-	      - $umask % 10 % 4 + $umask % 2
-	    `;;
-	  *) mkdir_umask=$umask,go-w;;
-	esac
+          *[0-7])
+            mkdir_umask=`expr $umask + 22 \
+              - $umask % 100 % 40 + $umask % 20 \
+              - $umask % 10 % 4 + $umask % 2
+            `;;
+          *) mkdir_umask=$umask,go-w;;
+        esac
 
-	# With -d, create the new directory with the user-specified mode.
-	# Otherwise, rely on $mkdir_umask.
-	if test -n "$dir_arg"; then
-	  mkdir_mode=-m$mode
-	else
-	  mkdir_mode=
-	fi
+        # With -d, create the new directory with the user-specified mode.
+        # Otherwise, rely on $mkdir_umask.
+        if test -n "$dir_arg"; then
+          mkdir_mode=-m$mode
+        else
+          mkdir_mode=
+        fi
 
-	posix_mkdir=false
-	case $umask in
-	  *[123567][0-7][0-7])
-	    # POSIX mkdir -p sets u+wx bits regardless of umask, which
-	    # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-	    ;;
-	  *)
-	    tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-	    trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
+        posix_mkdir=false
+        case $umask in
+          *[123567][0-7][0-7])
+            # POSIX mkdir -p sets u+wx bits regardless of umask, which
+            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
+            ;;
+          *)
+            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
 
-	    if (umask $mkdir_umask &&
-		exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
-	    then
-	      if test -z "$dir_arg" || {
-		   # Check for POSIX incompatibilities with -m.
-		   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-		   # other-writable bit of parent directory when it shouldn't.
-		   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-		   ls_ld_tmpdir=`ls -ld "$tmpdir"`
-		   case $ls_ld_tmpdir in
-		     d????-?r-*) different_mode=700;;
-		     d????-?--*) different_mode=755;;
-		     *) false;;
-		   esac &&
-		   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
-		     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
-		     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-		   }
-		 }
-	      then posix_mkdir=:
-	      fi
-	      rmdir "$tmpdir/d" "$tmpdir"
-	    else
-	      # Remove any dirs left behind by ancient mkdir implementations.
-	      rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
-	    fi
-	    trap '' 0;;
-	esac;;
+            if (umask $mkdir_umask &&
+                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+            then
+              if test -z "$dir_arg" || {
+                   # Check for POSIX incompatibilities with -m.
+                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
+                   # other-writable bit of parent directory when it shouldn't.
+                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
+                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
+                   case $ls_ld_tmpdir in
+                     d????-?r-*) different_mode=700;;
+                     d????-?--*) different_mode=755;;
+                     *) false;;
+                   esac &&
+                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
+                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
+                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
+                   }
+                 }
+              then posix_mkdir=:
+              fi
+              rmdir "$tmpdir/d" "$tmpdir"
+            else
+              # Remove any dirs left behind by ancient mkdir implementations.
+              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+            fi
+            trap '' 0;;
+        esac;;
     esac
 
     if
       $posix_mkdir && (
-	umask $mkdir_umask &&
-	$doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
+        umask $mkdir_umask &&
+        $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
       )
     then :
     else
@@ -391,53 +370,51 @@ do
       # directory the slow way, step by step, checking for races as we go.
 
       case $dstdir in
-	/*) prefix='/';;
-	[-=\(\)!]*) prefix='./';;
-	*)  prefix='';;
+        /*) prefix='/';;
+        [-=\(\)!]*) prefix='./';;
+        *)  prefix='';;
       esac
 
-      eval "$initialize_posix_glob"
-
       oIFS=$IFS
       IFS=/
-      $posix_glob set -f
+      set -f
       set fnord $dstdir
       shift
-      $posix_glob set +f
+      set +f
       IFS=$oIFS
 
       prefixes=
 
       for d
       do
-	test X"$d" = X && continue
+        test X"$d" = X && continue
 
-	prefix=$prefix$d
-	if test -d "$prefix"; then
-	  prefixes=
-	else
-	  if $posix_mkdir; then
-	    (umask=$mkdir_umask &&
-	     $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
-	    # Don't fail if two instances are running concurrently.
-	    test -d "$prefix" || exit 1
-	  else
-	    case $prefix in
-	      *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
-	      *) qprefix=$prefix;;
-	    esac
-	    prefixes="$prefixes '$qprefix'"
-	  fi
-	fi
-	prefix=$prefix/
+        prefix=$prefix$d
+        if test -d "$prefix"; then
+          prefixes=
+        else
+          if $posix_mkdir; then
+            (umask=$mkdir_umask &&
+             $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
+            # Don't fail if two instances are running concurrently.
+            test -d "$prefix" || exit 1
+          else
+            case $prefix in
+              *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
+              *) qprefix=$prefix;;
+            esac
+            prefixes="$prefixes '$qprefix'"
+          fi
+        fi
+        prefix=$prefix/
       done
 
       if test -n "$prefixes"; then
-	# Don't fail if two instances are running concurrently.
-	(umask $mkdir_umask &&
-	 eval "\$doit_exec \$mkdirprog $prefixes") ||
-	  test -d "$dstdir" || exit 1
-	obsolete_mkdir_used=true
+        # Don't fail if two instances are running concurrently.
+        (umask $mkdir_umask &&
+         eval "\$doit_exec \$mkdirprog $prefixes") ||
+          test -d "$dstdir" || exit 1
+        obsolete_mkdir_used=true
       fi
     fi
   fi
@@ -472,15 +449,12 @@ do
 
     # If -C, don't bother to copy if it wouldn't change the file.
     if $copy_on_change &&
-       old=`LC_ALL=C ls -dlL "$dst"	2>/dev/null` &&
-       new=`LC_ALL=C ls -dlL "$dsttmp"	2>/dev/null` &&
-
-       eval "$initialize_posix_glob" &&
-       $posix_glob set -f &&
+       old=`LC_ALL=C ls -dlL "$dst"     2>/dev/null` &&
+       new=`LC_ALL=C ls -dlL "$dsttmp"  2>/dev/null` &&
+       set -f &&
        set X $old && old=:$2:$4:$5:$6 &&
        set X $new && new=:$2:$4:$5:$6 &&
-       $posix_glob set +f &&
-
+       set +f &&
        test "$old" = "$new" &&
        $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
     then
@@ -493,24 +467,24 @@ do
       # to itself, or perhaps because mv is so ancient that it does not
       # support -f.
       {
-	# Now remove or move aside any old file at destination location.
-	# We try this two ways since rm can't unlink itself on some
-	# systems and the destination file might be busy for other
-	# reasons.  In this case, the final cleanup might fail but the new
-	# file should still install successfully.
-	{
-	  test ! -f "$dst" ||
-	  $doit $rmcmd -f "$dst" 2>/dev/null ||
-	  { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-	    { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
-	  } ||
-	  { echo "$0: cannot unlink or rename $dst" >&2
-	    (exit 1); exit 1
-	  }
-	} &&
+        # Now remove or move aside any old file at destination location.
+        # We try this two ways since rm can't unlink itself on some
+        # systems and the destination file might be busy for other
+        # reasons.  In this case, the final cleanup might fail but the new
+        # file should still install successfully.
+        {
+          test ! -f "$dst" ||
+          $doit $rmcmd -f "$dst" 2>/dev/null ||
+          { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
+            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
+          } ||
+          { echo "$0: cannot unlink or rename $dst" >&2
+            (exit 1); exit 1
+          }
+        } &&
 
-	# Now rename the file to the real destination.
-	$doit $mvcmd "$dsttmp" "$dst"
+        # Now rename the file to the real destination.
+        $doit $mvcmd "$dsttmp" "$dst"
       }
     fi || exit 1
 

iterator/iter_delegpt.c

@@ -47,8 +47,8 @@
 #include "util/data/packed_rrset.h"
 #include "util/data/msgreply.h"
 #include "util/net_help.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
 
 struct delegpt* 
 delegpt_create(struct regional* region)
@@ -72,6 +72,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 		return NULL;
 	copy->bogus = dp->bogus;
 	copy->has_parent_side_NS = dp->has_parent_side_NS;
+	copy->ssl_upstream = dp->ssl_upstream;
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		if(!delegpt_add_ns(copy, region, ns->name, ns->lame))
 			return NULL;

iterator/iter_delegpt.h

@@ -81,6 +81,8 @@ struct delegpt {
 	uint8_t has_parent_side_NS;
 	/** for assertions on type of delegpt */
 	uint8_t dp_type_mlc;
+	/** use SSL for upstream query */
+	uint8_t ssl_upstream;
 };
 
 /**
@@ -355,7 +357,7 @@ void delegpt_no_ipv4(struct delegpt* dp);
 
 /** 
  * create malloced delegation point, with the given name 
- * @param name: uncompressed wireformat of degegpt name.
+ * @param name: uncompressed wireformat of delegpt name.
  * @return NULL on alloc failure
  */
 struct delegpt* delegpt_create_mlc(uint8_t* name);

iterator/iter_donotq.h

@@ -58,7 +58,7 @@ struct iter_donotq {
 	 * contents of type addr_tree_node. Each node is an address span 
 	 * that must not be used to send queries to.
 	 */
-	rbtree_t tree;
+	rbtree_type tree;
 };
 
 /**

iterator/iter_fwd.c

@@ -46,8 +46,8 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "ldns/rrdef.h"
-#include "ldns/str2wire.h"
+#include "sldns/rrdef.h"
+#include "sldns/str2wire.h"
 
 int
 fwd_cmp(const void* k1, const void* k2)
@@ -82,7 +82,7 @@ static void fwd_zone_free(struct iter_forward_zone* n)
 	free(n);
 }
 
-static void delfwdnode(rbnode_t* n, void* ATTR_UNUSED(arg))
+static void delfwdnode(rbnode_type* n, void* ATTR_UNUSED(arg))
 {
 	struct iter_forward_zone* node = (struct iter_forward_zone*)n;
 	fwd_zone_free(node);
@@ -265,6 +265,8 @@ read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
 		 * last resort will ask for parent-side NS record and thus
 		 * fallback to the internet name servers on a failure */
 		dp->has_parent_side_NS = (uint8_t)!s->isfirst;
+		/* use SSL for queries to this forwarder */
+		dp->ssl_upstream = (uint8_t)s->ssl_upstream;
 		verbose(VERB_QUERY, "Forward zone server list:");
 		delegpt_log(VERB_QUERY, dp);
 		if(!forwards_insert(fwd, LDNS_RR_CLASS_IN, dp))
@@ -294,6 +296,7 @@ make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
 	uint8_t* dname;
 	size_t dname_len;
 	for(s = cfg->stubs; s; s = s->next) {
+		if(!s->name) continue;
 		dname = sldns_str2wire_dname(s->name, &dname_len);
 		if(!dname) {
 			log_err("cannot parse stub name '%s'", s->name);
@@ -329,7 +332,7 @@ forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 struct delegpt* 
 forwards_find(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 {
-	rbnode_t* res = NULL;
+	rbnode_type* res = NULL;
 	struct iter_forward_zone key;
 	key.node.key = &key;
 	key.dclass = qclass;
@@ -344,7 +347,7 @@ struct delegpt*
 forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 {
 	/* lookup the forward zone in the tree */
-	rbnode_t* res = NULL;
+	rbnode_type* res = NULL;
 	struct iter_forward_zone *result;
 	struct iter_forward_zone key;
 	key.node.key = &key;
@@ -385,7 +388,7 @@ int
 forwards_next_root(struct iter_forwards* fwd, uint16_t* dclass)
 {
 	struct iter_forward_zone key;
-	rbnode_t* n;
+	rbnode_type* n;
 	struct iter_forward_zone* p;
 	if(*dclass == 0) {
 		/* first root item is first item in tree */

iterator/iter_fwd.h

@@ -57,7 +57,7 @@ struct iter_forwards {
 	 * match which gives the ancestor needed.
 	 * contents of type iter_forward_zone.
 	 */
-	rbtree_t* tree;
+	rbtree_type* tree;
 };
 
 /**
@@ -65,7 +65,7 @@ struct iter_forwards {
  */
 struct iter_forward_zone {
 	/** redblacktree node, key is this structure: class and name */
-	rbnode_t node;
+	rbnode_type node;
 	/** name */
 	uint8_t* name;
 	/** length of name */

iterator/iter_hints.c

@@ -46,9 +46,9 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "ldns/rrdef.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 struct iter_hints* 
 hints_create(void)
@@ -67,7 +67,7 @@ static void hints_stub_free(struct iter_hints_stub* s)
 	free(s);
 }
 
-static void delhintnode(rbnode_t* n, void* ATTR_UNUSED(arg))
+static void delhintnode(rbnode_type* n, void* ATTR_UNUSED(arg))
 {
 	struct iter_hints_stub* node = (struct iter_hints_stub*)n;
 	hints_stub_free(node);
@@ -135,7 +135,7 @@ compile_time_root_prime(int do_ip4, int do_ip6)
 	if(!ah(dp, "E.ROOT-SERVERS.NET.", "192.203.230.10")) goto failed;
 	if(!ah(dp, "F.ROOT-SERVERS.NET.", "192.5.5.241"))	goto failed;
 	if(!ah(dp, "G.ROOT-SERVERS.NET.", "192.112.36.4"))	goto failed;
-	if(!ah(dp, "H.ROOT-SERVERS.NET.", "128.63.2.53"))	goto failed;
+	if(!ah(dp, "H.ROOT-SERVERS.NET.", "198.97.190.53"))	goto failed;
 	if(!ah(dp, "I.ROOT-SERVERS.NET.", "192.36.148.17"))	goto failed;
 	if(!ah(dp, "J.ROOT-SERVERS.NET.", "192.58.128.30"))	goto failed;
 	if(!ah(dp, "K.ROOT-SERVERS.NET.", "193.0.14.129"))	goto failed;
@@ -147,12 +147,14 @@ compile_time_root_prime(int do_ip4, int do_ip6)
 	if(!ah(dp, "B.ROOT-SERVERS.NET.", "2001:500:84::b")) goto failed;
 	if(!ah(dp, "C.ROOT-SERVERS.NET.", "2001:500:2::c")) goto failed;
 	if(!ah(dp, "D.ROOT-SERVERS.NET.", "2001:500:2d::d")) goto failed;
+	if(!ah(dp, "E.ROOT-SERVERS.NET.", "2001:500:a8::e")) goto failed;
 	if(!ah(dp, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) goto failed;
-	if(!ah(dp, "H.ROOT-SERVERS.NET.", "2001:500:1::803f:235")) goto failed;
+	if(!ah(dp, "G.ROOT-SERVERS.NET.", "2001:500:12::d0d")) goto failed;
+	if(!ah(dp, "H.ROOT-SERVERS.NET.", "2001:500:1::53")) goto failed;
 	if(!ah(dp, "I.ROOT-SERVERS.NET.", "2001:7fe::53")) goto failed;
 	if(!ah(dp, "J.ROOT-SERVERS.NET.", "2001:503:c27::2:30")) goto failed;
 	if(!ah(dp, "K.ROOT-SERVERS.NET.", "2001:7fd::1")) goto failed;
-	if(!ah(dp, "L.ROOT-SERVERS.NET.", "2001:500:3::42")) goto failed;
+	if(!ah(dp, "L.ROOT-SERVERS.NET.", "2001:500:9f::42")) goto failed;
 	if(!ah(dp, "M.ROOT-SERVERS.NET.", "2001:dc3::35")) goto failed;
       }
 	return dp;
@@ -274,6 +276,8 @@ read_stubs(struct iter_hints* hints, struct config_file* cfg)
 		 * last resort will ask for parent-side NS record and thus
 		 * fallback to the internet name servers on a failure */
 		dp->has_parent_side_NS = (uint8_t)!s->isfirst;
+		/* ssl_upstream */
+		dp->ssl_upstream = (uint8_t)s->ssl_upstream;
 		delegpt_log(VERB_QUERY, dp);
 		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, !s->isprime))
 			return 0;

iterator/iter_hints.h

@@ -59,7 +59,7 @@ struct iter_hints {
 	 * contents of type iter_hints_stub. The class IN root is in here.
 	 * uses name_tree_node from dnstree.h.
 	 */
-	rbtree_t tree;
+	rbtree_type tree;
 };
 
 /**

iterator/iter_priv.c

@@ -49,8 +49,8 @@
 #include "util/data/msgparse.h"
 #include "util/net_help.h"
 #include "util/storage/dnstree.h"
-#include "ldns/str2wire.h"
-#include "ldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/sbuffer.h"
 
 struct iter_priv* priv_create(void)
 {

iterator/iter_priv.h

@@ -60,14 +60,14 @@ struct iter_priv {
 	 * contents of type addr_tree_node.
 	 * No further data need, only presence or absence.
 	 */
-	rbtree_t a;
+	rbtree_type a;
 	/** 
 	 * Tree of the domains spans that are allowed to contain
 	 * the blocked address spans.
 	 * contents of type name_tree_node.
 	 * No further data need, only presence or absence.
 	 */
-	rbtree_t n;
+	rbtree_type n;
 };
 
 /**

iterator/iter_resptype.c

@@ -45,8 +45,8 @@
 #include "services/cache/dns.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "ldns/rrdef.h"
-#include "ldns/pkthdr.h"
+#include "sldns/rrdef.h"
+#include "sldns/pkthdr.h"
 
 enum response_type 
 response_type_from_cache(struct dns_msg* msg, 

iterator/iter_scrub.c

@@ -53,7 +53,7 @@
 #include "util/data/dname.h"
 #include "util/data/msgreply.h"
 #include "util/alloc.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** RRset flag used during scrubbing. The RRset is OK. */
 #define RRSET_SCRUB_OK	0x80
@@ -161,8 +161,8 @@ mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg,
 	for(rr = rrset->rr_first; rr; rr = rr->next) {
 		if(get_additional_name(rrset, rr, &nm, &nmlen, pkt)) {
 			/* mark A */
-			hashvalue_t h = pkt_hash_rrset(pkt, nm, LDNS_RR_TYPE_A, 
-				rrset->rrset_class, 0);
+			hashvalue_type h = pkt_hash_rrset(pkt, nm,
+				LDNS_RR_TYPE_A, rrset->rrset_class, 0);
 			struct rrset_parse* r = msgparse_hashtable_lookup(
 				msg, pkt, h, 0, nm, nmlen, 
 				LDNS_RR_TYPE_A, rrset->rrset_class);
@@ -372,7 +372,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				/* check next cname */
 				uint8_t* t = NULL;
 				size_t tlen = 0;
-				if(!parse_get_cname_target(rrset, &t, &tlen))
+				if(!parse_get_cname_target(nx, &t, &tlen))
 					return 0;
 				if(dname_pkt_compare(pkt, alias, t) == 0) {
 					/* it's OK and better capitalized */
@@ -405,7 +405,43 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 
 		/* Follow the CNAME chain. */
 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
+			struct rrset_parse* nx = rrset->rrset_all_next;
 			uint8_t* oldsname = sname;
+			/* see if the next one is a DNAME, if so, swap them */
+			if(nx && nx->section == LDNS_SECTION_ANSWER &&
+				nx->type == LDNS_RR_TYPE_DNAME &&
+				nx->rr_count == 1 &&
+				pkt_strict_sub(pkt, sname, nx->dname)) {
+				/* there is a DNAME after this CNAME, it 
+				 * is in the ANSWER section, and the DNAME
+				 * applies to the name we cover */
+				/* check if the alias of the DNAME equals
+				 * this CNAME */
+				uint8_t alias[LDNS_MAX_DOMAINLEN+1];
+				size_t aliaslen = 0;
+				uint8_t* t = NULL;
+				size_t tlen = 0;
+				if(synth_cname(sname, snamelen, nx, alias,
+					&aliaslen, pkt) &&
+					parse_get_cname_target(rrset, &t, &tlen) &&
+			   		dname_pkt_compare(pkt, alias, t) == 0) {
+					/* the synthesized CNAME equals the
+					 * current CNAME.  This CNAME is the
+					 * one that the DNAME creates, and this
+					 * CNAME is better capitalised */
+					verbose(VERB_ALGO, "normalize: re-order of DNAME and its CNAME");
+					if(prev) prev->rrset_all_next = nx;
+					else msg->rrset_first = nx;
+					if(nx->rrset_all_next == NULL)
+						msg->rrset_last = rrset;
+					rrset->rrset_all_next =
+						nx->rrset_all_next;
+					nx->rrset_all_next = rrset;
+					prev = nx;
+				}
+			}
+
+			/* move to next name in CNAME chain */
 			if(!parse_get_cname_target(rrset, &sname, &snamelen))
 				return 0;
 			prev = rrset;
@@ -638,7 +674,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	 * children of the originating zone. The idea here is that, 
 	 * as far as we know, the server that we contacted is ONLY 
 	 * authoritative for the originating zone. It, of course, MAY 
-	 * be authoriative for any other zones, and of course, MAY 
+	 * be authoritative for any other zones, and of course, MAY 
 	 * NOT be authoritative for some subdomains of the originating 
 	 * zone. */
 	prev = NULL;
@@ -680,7 +716,9 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				 * (we dont want its glue that was approved
 				 * during the normalize action) */
 				del_addi = 1;
-			} else if(!env->cfg->harden_glue) {
+			} else if(!env->cfg->harden_glue && (
+				rrset->type == LDNS_RR_TYPE_A ||
+				rrset->type == LDNS_RR_TYPE_AAAA)) {
 				/* store in cache! Since it is relevant
 				 * (from normalize) it will be picked up 
 				 * from the cache to be used later */

iterator/iter_utils.c

@@ -64,7 +64,8 @@
 #include "validator/val_kentry.h"
 #include "validator/val_utils.h"
 #include "validator/val_sigcrypt.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
 
 /** time when nameserver glue is said to be 'recent' */
 #define SUSPICION_RECENT_EXPIRY 86400
@@ -105,6 +106,40 @@ read_fetch_policy(struct iter_env* ie, const char* str)
 	return 1;
 }
 
+/** apply config caps whitelist items to name tree */
+static int
+caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
+{
+	struct config_strlist* p;
+	for(p=cfg->caps_whitelist; p; p=p->next) {
+		struct name_tree_node* n;
+		size_t len;
+		uint8_t* nm = sldns_str2wire_dname(p->str, &len);
+		if(!nm) {
+			log_err("could not parse %s", p->str);
+			return 0;
+		}
+		n = (struct name_tree_node*)calloc(1, sizeof(*n));
+		if(!n) {
+			log_err("out of memory");
+			free(nm);
+			return 0;
+		}
+		n->node.key = n;
+		n->name = nm;
+		n->len = len;
+		n->labs = dname_count_labels(nm);
+		n->dclass = LDNS_RR_CLASS_IN;
+		if(!name_tree_insert(ntree, n, nm, len, n->labs, n->dclass)) {
+			/* duplicate element ignored, idempotent */
+			free(n->name);
+			free(n);
+		}
+	}
+	name_tree_init_parents(ntree);
+	return 1;
+}
+
 int 
 iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 {
@@ -128,6 +163,16 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 		log_err("Could not set private addresses");
 		return 0;
 	}
+	if(cfg->caps_whitelist) {
+		if(!iter_env->caps_white)
+			iter_env->caps_white = rbtree_create(name_tree_compare);
+		if(!iter_env->caps_white || !caps_white_apply_cfg(
+			iter_env->caps_white, cfg)) {
+			log_err("Could not set capsforid whitelist");
+			return 0;
+		}
+
+	}
 	iter_env->supports_ipv6 = cfg->do_ip6;
 	iter_env->supports_ipv4 = cfg->do_ip4;
 	return 1;
@@ -210,7 +255,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 			return -1; /* server is lame */
 		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT)
 			/* server is unresponsive,
-			 * we used to return TOP_TIMOUT, but fairly useless,
+			 * we used to return TOP_TIMEOUT, but fairly useless,
 			 * because if == TOP_TIMEOUT is dropped because
 			 * blacklisted later, instead, remove it here, so
 			 * other choices (that are not blacklisted) can be
@@ -261,7 +306,7 @@ iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
 	return got_it;
 }
 
-/** filter the addres list, putting best targets at front,
+/** filter the address list, putting best targets at front,
  * returns number of best targets (or 0, no suitable targets) */
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
@@ -315,6 +360,39 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 		}
 	}
 	*selected_rtt = low_rtt;
+
+	if (env->cfg->prefer_ip6) {
+		int got_num6 = 0;
+		int low_rtt6 = 0;
+		int i;
+		prev = NULL;
+		a = dp->result_list;
+		for(i = 0; i < got_num; i++) {
+			swap_to_front = 0;
+			if(a->addr.ss_family == AF_INET6) {
+				got_num6++;
+				swap_to_front = 1;
+				if(low_rtt6 == 0 || a->sel_rtt < low_rtt6) {
+					low_rtt6 = a->sel_rtt;
+				}
+			}
+			/* swap to front if IPv6, or move to next result */
+			if(swap_to_front && prev) {
+				n = a->next_result;
+				prev->next_result = n;
+				a->next_result = dp->result_list;
+				dp->result_list = a;
+				a = n;
+			} else {
+				prev = a;
+				a = a->next_result;
+			}
+		}
+		if(got_num6 > 0) {
+			got_num = got_num6;
+			*selected_rtt = low_rtt6;
+		}
+	}
 	return got_num;
 }
 
@@ -454,6 +532,7 @@ causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
 	qinf.qname_len = namelen;
 	qinf.qtype = t;
 	qinf.qclass = c;
+	qinf.local_alias = NULL;
 	fptr_ok(fptr_whitelist_modenv_detect_cycle(
 		qstate->env->detect_cycle));
 	return (*qstate->env->detect_cycle)(qstate, &qinf, 
@@ -545,6 +624,27 @@ iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
 	return 1;
 }
 
+int
+iter_indicates_dnssec_fwd(struct module_env* env, struct query_info *qinfo)
+{
+	struct trust_anchor* a;
+	if(!env || !env->anchors || !qinfo || !qinfo->qname)
+		return 0;
+	/* a trust anchor exists above the name? */
+	if((a=anchors_lookup(env->anchors, qinfo->qname, qinfo->qname_len,
+		qinfo->qclass))) { 
+		if(a->numDS == 0 && a->numDNSKEY == 0) {
+			/* insecure trust point */
+			lock_basic_unlock(&a->lock);
+			return 0;
+		}
+		lock_basic_unlock(&a->lock);
+		return 1;
+	}
+	/* no trust anchor above it. */
+	return 0;
+}
+
 int 
 iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
         struct dns_msg* msg, uint16_t dclass)
@@ -714,6 +814,48 @@ reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region)
 	return 1;
 }
 
+void 
+caps_strip_reply(struct reply_info* rep)
+{
+	size_t i;
+	if(!rep) return;
+	/* see if message is a referral, in which case the additional and
+	 * NS record cannot be removed */
+	/* referrals have the AA flag unset (strict check, not elsewhere in
+	 * unbound, but for 0x20 this is very convenient). */
+	if(!(rep->flags&BIT_AA))
+		return;
+	/* remove the additional section from the reply */
+	if(rep->ar_numrrsets != 0) {
+		verbose(VERB_ALGO, "caps fallback: removing additional section");
+		rep->rrset_count -= rep->ar_numrrsets;
+		rep->ar_numrrsets = 0;
+	}
+	/* is there an NS set in the authority section to remove? */
+	/* the failure case (Cisco firewalls) only has one rrset in authsec */
+	for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
+		struct ub_packed_rrset_key* s = rep->rrsets[i];
+		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS) {
+			/* remove NS rrset and break from loop (loop limits
+			 * have changed) */
+			/* move last rrset into this position (there is no
+			 * additional section any more) */
+			verbose(VERB_ALGO, "caps fallback: removing NS rrset");
+			if(i < rep->rrset_count-1)
+				rep->rrsets[i]=rep->rrsets[rep->rrset_count-1];
+			rep->rrset_count --;
+			rep->ns_numrrsets --;
+			break;
+		}
+	}
+}
+
+int caps_failed_rcode(struct reply_info* rep)
+{
+	return !(FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR ||
+		FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN);
+}
+
 void 
 iter_store_parentside_rrset(struct module_env* env, 
 	struct ub_packed_rrset_key* rrset)

iterator/iter_utils.h

@@ -173,6 +173,18 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
 int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
 	struct delegpt* dp);
 
+/**
+ * See if qname has DNSSEC needs in the forwarding case.  This is true if
+ * there is a trust anchor above it.  Whether there is an insecure delegation
+ * to the data is unknown, but CD-retry is needed.
+ * @param env: environment with anchors.
+ * @param qinfo: query name and class.
+ * @return true if trust anchor above qname, false if no anchor or insecure
+ * point above qname.
+ */
+int iter_indicates_dnssec_fwd(struct module_env* env,
+	struct query_info *qinfo);
+
 /**
  * See if delegation is expected to have DNSSEC information (RRSIGs) in 
  * its answers, or not. Inspects delegation point (name), trust anchors,
@@ -222,6 +234,23 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
  */
 int reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region);
 
+/**
+ * Remove unused bits from the reply if possible.
+ * So that caps-for-id (0x20) fallback is more likely to be successful.
+ * This removes like, the additional section, and NS record in the authority
+ * section if those records are gratuitous (not for a referral).
+ * @param rep: the reply to strip stuff out of.
+ */
+void caps_strip_reply(struct reply_info* rep);
+
+/**
+ * see if reply has a 'useful' rcode for capsforid comparison, so
+ * not SERVFAIL or REFUSED, and thus NOERROR or NXDOMAIN.
+ * @param rep: reply to check.
+ * @return true if the rcode is a bad type of message.
+ */
+int caps_failed_rcode(struct reply_info* rep);
+
 /**
  * Store parent-side rrset in seperate rrset cache entries for later 
  * last-resort * lookups in case the child-side versions of this information 

iterator/iterator.c

@@ -61,10 +61,12 @@
 #include "util/data/msgencode.h"
 #include "util/fptr_wlist.h"
 #include "util/config_file.h"
-#include "ldns/rrdef.h"
-#include "ldns/wire2str.h"
-#include "ldns/parseutil.h"
-#include "ldns/sbuffer.h"
+#include "util/random.h"
+#include "sldns/rrdef.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
+#include "sldns/parseutil.h"
+#include "sldns/sbuffer.h"
 
 int 
 iter_init(struct module_env* env, int id)
@@ -80,9 +82,20 @@ iter_init(struct module_env* env, int id)
 		log_err("iterator: could not apply configuration settings.");
 		return 0;
 	}
+
 	return 1;
 }
 
+/** delete caps_whitelist element */
+static void
+caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d))
+{
+	if(n) {
+		free(((struct name_tree_node*)n)->name);
+		free(n);
+	}
+}
+
 void 
 iter_deinit(struct module_env* env, int id)
 {
@@ -93,6 +106,10 @@ iter_deinit(struct module_env* env, int id)
 	free(iter_env->target_fetch_policy);
 	priv_delete(iter_env->priv);
 	donotq_delete(iter_env->donotq);
+	if(iter_env->caps_white) {
+		traverse_postorder(iter_env->caps_white, caps_free, NULL);
+		free(iter_env->caps_white);
+	}
 	free(iter_env);
 	env->modinfo[id] = NULL;
 }
@@ -120,6 +137,8 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->query_restart_count = 0;
 	iq->referral_count = 0;
 	iq->sent_count = 0;
+	iq->ratelimit_ok = 0;
+	iq->target_count = NULL;
 	iq->wait_priming_stub = 0;
 	iq->refetch_glue = 0;
 	iq->dnssec_expected = 0;
@@ -128,6 +147,14 @@ iter_new(struct module_qstate* qstate, int id)
 	/* Start with the (current) qname. */
 	iq->qchase = qstate->qinfo;
 	outbound_list_init(&iq->outlist);
+	iq->minimise_count = 0;
+	iq->minimise_timeout_count = 0;
+	if (qstate->env->cfg->qname_minimisation)
+		iq->minimisation_state = INIT_MINIMISE_STATE;
+	else
+		iq->minimisation_state = DONOT_MINIMISE_STATE;
+	
+	memset(&iq->qinfo_out, 0, sizeof(struct query_info));
 	return 1;
 }
 
@@ -159,7 +186,7 @@ next_state(struct iter_qstate* iq, enum iter_state nextstate)
 /**
  * Transition an event to its final state. Final states always either return
  * a result up the module chain, or reactivate a dependent event. Which
- * final state to transtion to is set in the module state for the event when
+ * final state to transition to is set in the module state for the event when
  * it was created, and depends on the original purpose of the event.
  *
  * The response is stored in the qstate->buf buffer.
@@ -189,6 +216,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) {
 		/* mark address as failed. */
 		struct delegpt_ns* dpns = NULL;
+		super_iq->num_target_queries--; 
 		if(super_iq->dp)
 			dpns = delegpt_find_ns(super_iq->dp, 
 				qstate->qinfo.qname, qstate->qinfo.qname_len);
@@ -202,13 +230,11 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 			return;
 		} else {
 			/* see if the failure did get (parent-lame) info */
-			if(!cache_fill_missing(super->env, 
-				super_iq->qchase.qclass, super->region, 
-				super_iq->dp))
+			if(!cache_fill_missing(super->env, super_iq->qchase.qclass,
+				super->region, super_iq->dp))
 				log_err("out of memory adding missing");
 		}
 		dpns->resolved = 1; /* mark as failed */
-		super_iq->num_target_queries--; 
 	}
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) {
 		/* prime failed to get delegation */
@@ -251,27 +277,29 @@ error_response(struct module_qstate* qstate, int id, int rcode)
 static int
 error_response_cache(struct module_qstate* qstate, int id, int rcode)
 {
-	/* store in cache */
-	struct reply_info err;
-	if(qstate->prefetch_leeway > NORR_TTL) {
-		verbose(VERB_ALGO, "error response for prefetch in cache");
-		/* attempt to adjust the cache entry prefetch */
-		if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo,
-			NORR_TTL, qstate->query_flags))
-			return error_response(qstate, id, rcode);
-		/* if that fails (not in cache), fall through to store err */
+	if(!qstate->no_cache_store) {
+		/* store in cache */
+		struct reply_info err;
+		if(qstate->prefetch_leeway > NORR_TTL) {
+			verbose(VERB_ALGO, "error response for prefetch in cache");
+			/* attempt to adjust the cache entry prefetch */
+			if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo,
+				NORR_TTL, qstate->query_flags))
+				return error_response(qstate, id, rcode);
+			/* if that fails (not in cache), fall through to store err */
+		}
+		memset(&err, 0, sizeof(err));
+		err.flags = (uint16_t)(BIT_QR | BIT_RA);
+		FLAGS_SET_RCODE(err.flags, rcode);
+		err.qdcount = 1;
+		err.ttl = NORR_TTL;
+		err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
+		/* do not waste time trying to validate this servfail */
+		err.security = sec_status_indeterminate;
+		verbose(VERB_ALGO, "store error response in message cache");
+		iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
+			qstate->query_flags);
 	}
-	memset(&err, 0, sizeof(err));
-	err.flags = (uint16_t)(BIT_QR | BIT_RA);
-	FLAGS_SET_RCODE(err.flags, rcode);
-	err.qdcount = 1;
-	err.ttl = NORR_TTL;
-	err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
-	/* do not waste time trying to validate this servfail */
-	err.security = sec_status_indeterminate;
-	verbose(VERB_ALGO, "store error response in message cache");
-	iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
-		qstate->query_flags);
 	return error_response(qstate, id, rcode);
 }
 
@@ -307,6 +335,8 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 	if(num_an + num_ns == 0)
 		return 1;
 	verbose(VERB_ALGO, "prepending %d rrsets", (int)num_an + (int)num_ns);
+	if(num_an > RR_COUNT_MAX || num_ns > RR_COUNT_MAX ||
+		msg->rep->rrset_count > RR_COUNT_MAX) return 0; /* overflow */
 	sets = regional_alloc(region, (num_an+num_ns+msg->rep->rrset_count) *
 		sizeof(struct ub_packed_rrset_key*));
 	if(!sets) 
@@ -342,6 +372,29 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 	return 1;
 }
 
+/**
+ * Find rrset in ANSWER prepend list.
+ * to avoid duplicate DNAMEs when a DNAME is traversed twice.
+ * @param iq: iterator query state.
+ * @param rrset: rrset to add.
+ * @return false if not found
+ */
+static int
+iter_find_rrset_in_prepend_answer(struct iter_qstate* iq,
+	struct ub_packed_rrset_key* rrset)
+{
+	struct iter_prep_list* p = iq->an_prepend_list;
+	while(p) {
+		if(ub_rrset_compare(p->rrset, rrset) == 0 &&
+			rrsetdata_equal((struct packed_rrset_data*)p->rrset
+			->entry.data, (struct packed_rrset_data*)rrset
+			->entry.data))
+			return 1;
+		p = p->next;
+	}
+	return 0;
+}
+
 /**
  * Add rrset to ANSWER prepend list
  * @param qstate: query state.
@@ -424,14 +477,16 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * by this DNAME following, so we don't process the DNAME 
 		 * directly.  */
 		if(ntohs(r->rk.type) == LDNS_RR_TYPE_DNAME &&
-			dname_strict_subdomain_c(*mname, r->rk.dname)) {
+			dname_strict_subdomain_c(*mname, r->rk.dname) &&
+			!iter_find_rrset_in_prepend_answer(iq, r)) {
 			if(!iter_add_prepend_answer(qstate, iq, r))
 				return 0;
 			continue;
 		}
 
 		if(ntohs(r->rk.type) == LDNS_RR_TYPE_CNAME &&
-			query_dname_compare(*mname, r->rk.dname) == 0) {
+			query_dname_compare(*mname, r->rk.dname) == 0 &&
+			!iter_find_rrset_in_prepend_answer(iq, r)) {
 			/* Add this relevant CNAME rrset to the prepend list.*/
 			if(!iter_add_prepend_answer(qstate, iq, r))
 				return 0;
@@ -454,10 +509,40 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 1;
 }
 
+/** see if target name is caps-for-id whitelisted */
+static int
+is_caps_whitelisted(struct iter_env* ie, struct iter_qstate* iq)
+{
+	if(!ie->caps_white) return 0; /* no whitelist, or no capsforid */
+	return name_tree_lookup(ie->caps_white, iq->qchase.qname,
+		iq->qchase.qname_len, dname_count_labels(iq->qchase.qname),
+		iq->qchase.qclass) != NULL;
+}
+
+/** create target count structure for this query */
+static void
+target_count_create(struct iter_qstate* iq)
+{
+	if(!iq->target_count) {
+		iq->target_count = (int*)calloc(2, sizeof(int));
+		/* if calloc fails we simply do not track this number */
+		if(iq->target_count)
+			iq->target_count[0] = 1;
+	}
+}
+
+static void
+target_count_increase(struct iter_qstate* iq, int num)
+{
+	target_count_create(iq);
+	if(iq->target_count)
+		iq->target_count[1] += num;
+}
+
 /**
  * Generate a subrequest.
  * Generate a local request event. Local events are tied to this module, and
- * have a correponding (first tier) event that is waiting for this event to
+ * have a corresponding (first tier) event that is waiting for this event to
  * resolve to continue.
  *
  * @param qname The query name for this request.
@@ -492,6 +577,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	qinf.qname_len = qnamelen;
 	qinf.qtype = qtype;
 	qinf.qclass = qclass;
+	qinf.local_alias = NULL;
 
 	/* RD should be set only when sending the query back through the INIT
 	 * state. */
@@ -529,6 +615,10 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq = (struct iter_qstate*)subq->minfo[id];
 		memset(subiq, 0, sizeof(*subiq));
 		subiq->num_target_queries = 0;
+		target_count_create(iq);
+		subiq->target_count = iq->target_count;
+		if(iq->target_count)
+			iq->target_count[0] ++; /* extra reference */
 		subiq->num_current_queries = 0;
 		subiq->depth = iq->depth+1;
 		outbound_list_init(&subiq->outlist);
@@ -537,6 +627,11 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq->qchase = subq->qinfo;
 		subiq->chase_flags = subq->query_flags;
 		subiq->refetch_glue = 0;
+		if(qstate->env->cfg->qname_minimisation)
+			subiq->minimisation_state = INIT_MINIMISE_STATE;
+		else
+			subiq->minimisation_state = DONOT_MINIMISE_STATE;
+		memset(&subiq->qinfo_out, 0, sizeof(struct query_info));
 	}
 	return 1;
 }
@@ -900,7 +995,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 {
 	uint8_t* delname;
 	size_t delnamelen;
-	struct dns_msg* msg;
+	struct dns_msg* msg = NULL;
 
 	log_query_info(VERB_DETAIL, "resolving", &qstate->qinfo);
 	/* check effort */
@@ -940,13 +1035,13 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * getting older results from cache is a bad idea, no cache */
 		verbose(VERB_ALGO, "cache blacklisted, going to the network");
 		msg = NULL;
-	} else {
+	} else if(!qstate->no_cache_lookup) {
 		msg = dns_cache_lookup(qstate->env, iq->qchase.qname, 
 			iq->qchase.qname_len, iq->qchase.qtype, 
 			iq->qchase.qclass, qstate->query_flags,
 			qstate->region, qstate->env->scratch);
 		if(!msg && qstate->env->neg_cache) {
-			/* lookup in negative cache; may result in 
+			/* lookup in negative cache; may result in
 			 * NOERROR/NODATA or NXDOMAIN answers that need validation */
 			msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
 				qstate->region, qstate->env->rrset_cache,
@@ -989,6 +1084,8 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->query_restart_count++;
 			iq->sent_count = 0;
 			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
+			if(qstate->env->cfg->qname_minimisation)
+				iq->minimisation_state = INIT_MINIMISE_STATE;
 			return next_state(iq, INIT_REQUEST_STATE);
 		}
 
@@ -1009,6 +1106,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->refetch_glue = 0;
+		iq->minimisation_state = DONOT_MINIMISE_STATE;
 		/* the request has been forwarded.
 		 * forwarded requests need to be immediately sent to the 
 		 * next state, QUERYTARGETS. */
@@ -1098,6 +1196,32 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			 * results of priming. */
 			return 0;
 		}
+		if(!iq->ratelimit_ok && qstate->prefetch_leeway)
+			iq->ratelimit_ok = 1; /* allow prefetches, this keeps
+			otherwise valid data in the cache */
+		if(!iq->ratelimit_ok && infra_ratelimit_exceeded(
+			qstate->env->infra_cache, iq->dp->name,
+			iq->dp->namelen, *qstate->env->now)) {
+			/* and increment the rate, so that the rate for time
+			 * now will also exceed the rate, keeping cache fresh */
+			(void)infra_ratelimit_inc(qstate->env->infra_cache,
+				iq->dp->name, iq->dp->namelen,
+				*qstate->env->now);
+			/* see if we are passed through with slip factor */
+			if(qstate->env->cfg->ratelimit_factor != 0 &&
+				ub_random_max(qstate->env->rnd,
+				    qstate->env->cfg->ratelimit_factor) == 1) {
+				iq->ratelimit_ok = 1;
+				log_nametypeclass(VERB_ALGO, "ratelimit allowed through for "
+					"delegation point", iq->dp->name,
+					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
+			} else {
+				log_nametypeclass(VERB_ALGO, "ratelimit exceeded with "
+					"delegation point", iq->dp->name,
+					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
+				return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			}
+		}
 
 		/* see if this dp not useless.
 		 * It is useless if:
@@ -1227,7 +1351,7 @@ processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* If the RD flag wasn't set, then we just finish with the 
 	 * cached referral as the response. */
-	if(!(qstate->query_flags & BIT_RD)) {
+	if(!(qstate->query_flags & BIT_RD) && iq->deleg_msg) {
 		iq->response = iq->deleg_msg;
 		if(verbosity >= VERB_ALGO && iq->response)
 			log_dns_msg("no RD requested, using delegation msg", 
@@ -1356,6 +1480,14 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	if(iq->depth == ie->max_dependency_depth)
 		return 0;
+	if(iq->depth > 0 && iq->target_count &&
+		iq->target_count[1] > MAX_TARGET_COUNT) {
+		char s[LDNS_MAX_DOMAINLEN+1];
+		dname_str(qstate->qinfo.qname, s);
+		verbose(VERB_QUERY, "request %s has exceeded the maximum "
+			"number of glue fetches %d", s, iq->target_count[1]);
+		return 0;
+	}
 
 	iter_mark_cycle_targets(qstate, iq->dp);
 	missing = (int)delegpt_count_missing_targets(iq->dp);
@@ -1512,6 +1644,8 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->refetch_glue = 1;
 			iq->query_restart_count++;
 			iq->sent_count = 0;
+			if(qstate->env->cfg->qname_minimisation)
+				iq->minimisation_state = INIT_MINIMISE_STATE;
 			return next_state(iq, INIT_REQUEST_STATE);
 		}
 	}
@@ -1538,6 +1672,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += qs;
+		target_count_increase(iq, qs);
 		if(qs != 0) {
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0; /* and wait for them */
@@ -1547,6 +1682,14 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "maxdepth and need more nameservers, fail");
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
+	if(iq->depth > 0 && iq->target_count &&
+		iq->target_count[1] > MAX_TARGET_COUNT) {
+		char s[LDNS_MAX_DOMAINLEN+1];
+		dname_str(qstate->qinfo.qname, s);
+		verbose(VERB_QUERY, "request %s has exceeded the maximum "
+			"number of glue fetches %d", s, iq->target_count[1]);
+		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
+	}
 	/* mark cycle targets for parent-side lookups */
 	iter_mark_pside_cycle_targets(qstate, iq->dp);
 	/* see if we can issue queries to get nameserver addresses */
@@ -1576,6 +1719,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(query_count != 0) { /* suspend to await results */
 			verbose(VERB_ALGO, "try parent-side glue lookup");
 			iq->num_target_queries += query_count;
+			target_count_increase(iq, query_count);
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0;
 		}
@@ -1583,10 +1727,11 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* if this was a parent-side glue query itself, then store that
 	 * failure in cache. */
-	if(iq->query_for_pside_glue && !iq->pside_glue)
-		iter_store_parentside_neg(qstate->env, &qstate->qinfo,
-			iq->deleg_msg?iq->deleg_msg->rep:
-			(iq->response?iq->response->rep:NULL));
+	if(!qstate->no_cache_store && iq->query_for_pside_glue
+		&& !iq->pside_glue)
+			iter_store_parentside_neg(qstate->env, &qstate->qinfo,
+				iq->deleg_msg?iq->deleg_msg->rep:
+				(iq->response?iq->response->rep:NULL));
 
 	verbose(VERB_QUERY, "out of query targets -- returning SERVFAIL");
 	/* fail -- no more targets, no more hope of targets, no hope 
@@ -1731,6 +1876,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += extra;
+		target_count_increase(iq, extra);
 		if(iq->num_target_queries > 0) {
 			/* wait to get all targets, we want to try em */
 			verbose(VERB_ALGO, "wait for all targets for fallback");
@@ -1743,11 +1889,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * the original query is one that matched too, so we have
 		 * caps_server+1 number of matching queries now */
 		if(iq->caps_server+1 >= naddr*3 ||
-			iq->caps_server+1 >= MAX_SENT_COUNT) {
+			iq->caps_server*2+2 >= MAX_SENT_COUNT) {
+			/* *2 on sentcount check because ipv6 may fail */
 			/* we're done, process the response */
 			verbose(VERB_ALGO, "0x20 fallback had %d responses "
 				"match for %d wanted, done.", 
 				(int)iq->caps_server+1, (int)naddr*3);
+			iq->response = iq->caps_response;
 			iq->caps_fallback = 0;
 			iter_dec_attempts(iq->dp, 3); /* space for fallback */
 			iq->num_current_queries++; /* RespState decrements it*/
@@ -1771,6 +1919,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* errors ignored, these targets are not strictly necessary for
 		 * this result, we do not have to reply with SERVFAIL */
 		iq->num_target_queries += extra;
+		target_count_increase(iq, extra);
 	}
 
 	/* Add the current set of unused targets to our queue. */
@@ -1816,10 +1965,29 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 					return 1;
 				}
 				iq->num_target_queries += qs;
+				target_count_increase(iq, qs);
 			}
 			/* Since a target query might have been made, we 
 			 * need to check again. */
 			if(iq->num_target_queries == 0) {
+				/* if in capsforid fallback, instead of last
+				 * resort, we agree with the current reply
+				 * we have (if any) (our count of addrs bad)*/
+				if(iq->caps_fallback && iq->caps_reply) {
+					/* we're done, process the response */
+					verbose(VERB_ALGO, "0x20 fallback had %d responses, "
+						"but no more servers except "
+						"last resort, done.", 
+						(int)iq->caps_server+1);
+					iq->response = iq->caps_response;
+					iq->caps_fallback = 0;
+					iter_dec_attempts(iq->dp, 3); /* space for fallback */
+					iq->num_current_queries++; /* RespState decrements it*/
+					iq->referral_count++; /* make sure we don't loop */
+					iq->sent_count = 0;
+					iq->state = QUERY_RESP_STATE;
+					return 1;
+				}
 				return processLastResort(qstate, iq, ie, id);
 			}
 		}
@@ -1846,9 +2014,118 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return 0;
 	}
 
+	/* if not forwarding, check ratelimits per delegationpoint name */
+	if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
+		if(!infra_ratelimit_inc(qstate->env->infra_cache, iq->dp->name,
+			iq->dp->namelen, *qstate->env->now)) {
+			verbose(VERB_ALGO, "query exceeded ratelimits");
+			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		}
+	}
+
+	if(iq->minimisation_state == INIT_MINIMISE_STATE) {
+		/* (Re)set qinfo_out to (new) delegation point, except when
+		 * qinfo_out is already a subdomain of dp. This happens when
+		 * increasing by more than one label at once (QNAMEs with more
+		 * than MAX_MINIMISE_COUNT labels). */
+		if(!(iq->qinfo_out.qname_len 
+			&& dname_subdomain_c(iq->qchase.qname, 
+				iq->qinfo_out.qname)
+			&& dname_subdomain_c(iq->qinfo_out.qname, 
+				iq->dp->name))) {
+			iq->qinfo_out.qname = iq->dp->name;
+			iq->qinfo_out.qname_len = iq->dp->namelen;
+			iq->qinfo_out.qtype = LDNS_RR_TYPE_A;
+			iq->qinfo_out.qclass = iq->qchase.qclass;
+			iq->qinfo_out.local_alias = NULL;
+			iq->minimise_count = 0;
+		}
+
+		iq->minimisation_state = MINIMISE_STATE;
+	}
+	if(iq->minimisation_state == MINIMISE_STATE) {
+		int qchaselabs = dname_count_labels(iq->qchase.qname);
+		int labdiff = qchaselabs -
+			dname_count_labels(iq->qinfo_out.qname);
+
+		iq->qinfo_out.qname = iq->qchase.qname;
+		iq->qinfo_out.qname_len = iq->qchase.qname_len;
+		iq->minimise_count++;
+		iq->minimise_timeout_count = 0;
+
+		iter_dec_attempts(iq->dp, 1);
+
+		/* Limit number of iterations for QNAMEs with more
+		 * than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB
+		 * labels of QNAME always individually.
+		 */
+		if(qchaselabs > MAX_MINIMISE_COUNT && labdiff > 1 && 
+			iq->minimise_count > MINIMISE_ONE_LAB) {
+			if(iq->minimise_count < MAX_MINIMISE_COUNT) {
+				int multilabs = qchaselabs - 1 - 
+					MINIMISE_ONE_LAB;
+				int extralabs = multilabs / 
+					MINIMISE_MULTIPLE_LABS;
+
+				if (MAX_MINIMISE_COUNT - iq->minimise_count >= 
+					multilabs % MINIMISE_MULTIPLE_LABS)
+					/* Default behaviour is to add 1 label
+					 * every iteration. Therefore, decrement
+					 * the extralabs by 1 */
+					extralabs--;
+				if (extralabs < labdiff)
+					labdiff -= extralabs;
+				else
+					labdiff = 1;
+			}
+			/* Last minimised iteration, send all labels with
+			 * QTYPE=NS */
+			else
+				labdiff = 1;
+		}
+
+		if(labdiff > 1) {
+			verbose(VERB_QUERY, "removing %d labels", labdiff-1);
+			dname_remove_labels(&iq->qinfo_out.qname, 
+				&iq->qinfo_out.qname_len, 
+				labdiff-1);
+		}
+		if(labdiff < 1 || (labdiff < 2 
+			&& (iq->qchase.qtype == LDNS_RR_TYPE_DS
+			|| iq->qchase.qtype == LDNS_RR_TYPE_A)))
+			/* Stop minimising this query, resolve "as usual" */
+			iq->minimisation_state = DONOT_MINIMISE_STATE;
+		else if(!qstate->no_cache_lookup) {
+			struct dns_msg* msg = dns_cache_lookup(qstate->env, 
+				iq->qinfo_out.qname, iq->qinfo_out.qname_len, 
+				iq->qinfo_out.qtype, iq->qinfo_out.qclass, 
+				qstate->query_flags, qstate->region, 
+				qstate->env->scratch);
+			if(msg && msg->rep->an_numrrsets == 0
+				&& FLAGS_GET_RCODE(msg->rep->flags) == 
+				LDNS_RCODE_NOERROR)
+				/* no need to send query if it is already 
+				 * cached as NOERROR/NODATA */
+				return 1;
+		}
+	}
+	if(iq->minimisation_state == SKIP_MINIMISE_STATE) {
+		iq->minimise_timeout_count++;
+		if(iq->minimise_timeout_count < MAX_MINIMISE_TIMEOUT_COUNT)
+			/* Do not increment qname, continue incrementing next 
+			 * iteration */
+			iq->minimisation_state = MINIMISE_STATE;
+		else if(!qstate->env->cfg->qname_minimisation_strict)
+			/* Too many time-outs detected for this QNAME and QTYPE.
+			 * We give up, disable QNAME minimisation. */
+			iq->minimisation_state = DONOT_MINIMISE_STATE;
+	}
+	if(iq->minimisation_state == DONOT_MINIMISE_STATE)
+		iq->qinfo_out = iq->qchase;
+
 	/* We have a valid target. */
 	if(verbosity >= VERB_QUERY) {
-		log_query_info(VERB_QUERY, "sending query:", &iq->qchase);
+		log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out);
 		log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
 			&target->addr, target->addrlen);
 		verbose(VERB_ALGO, "dnssec status: %s%s",
@@ -1856,15 +2133,24 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->dnssec_lame_query?" but lame_query anyway": "");
 	}
 	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
-	outq = (*qstate->env->send_query)(
-		iq->qchase.qname, iq->qchase.qname_len, 
-		iq->qchase.qtype, iq->qchase.qclass, 
-		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), EDNS_DO|BIT_CD, 
-		iq->dnssec_expected, iq->caps_fallback, &target->addr,
-		target->addrlen, iq->dp->name, iq->dp->namelen, qstate);
+	outq = (*qstate->env->send_query)(&iq->qinfo_out,
+		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), 
+		/* unset CD if to forwarder(RD set) and not dnssec retry
+		 * (blacklist nonempty) and no trust-anchors are configured
+		 * above the qname or on the first attempt when dnssec is on */
+		EDNS_DO| ((iq->chase_to_rd||(iq->chase_flags&BIT_RD)!=0)&&
+		!qstate->blacklist&&(!iter_indicates_dnssec_fwd(qstate->env,
+		&iq->qinfo_out)||target->attempts==1)?0:BIT_CD), 
+		iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
+		ie, iq), &target->addr, target->addrlen,
+		iq->dp->name, iq->dp->namelen,
+		(iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream), qstate);
 	if(!outq) {
 		log_addr(VERB_DETAIL, "error sending query to auth server", 
 			&target->addr, target->addrlen);
+		if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok)
+		    infra_ratelimit_dec(qstate->env->infra_cache, iq->dp->name,
+			iq->dp->namelen, *qstate->env->now);
 		return next_state(iq, QUERYTARGETS_STATE);
 	}
 	outbound_list_insert(&iq->outlist, outq);
@@ -1908,7 +2194,14 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	int dnsseclame = 0;
 	enum response_type type;
 	iq->num_current_queries--;
+
+	if(!inplace_cb_query_response_call(qstate->env, qstate, iq->response))
+		log_err("unable to call query_response callback");
+
 	if(iq->response == NULL) {
+		/* Don't increment qname when QNAME minimisation is enabled */
+		if(qstate->env->cfg->qname_minimisation)
+			iq->minimisation_state = SKIP_MINIMISE_STATE;
 		iq->chase_to_rd = 0;
 		iq->dnssec_lame_query = 0;
 		verbose(VERB_ALGO, "query response was timeout");
@@ -1923,8 +2216,10 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * differently. No queries should be sent elsewhere */
 		type = RESPONSE_TYPE_ANSWER;
 	}
-	if(iq->dnssec_expected && !iq->dnssec_lame_query &&
+	if(!qstate->env->cfg->disable_dnssec_lame_check && iq->dnssec_expected 
+                && !iq->dnssec_lame_query &&
 		!(iq->chase_flags&BIT_RD) 
+		&& iq->sent_count < DNSSEC_LAME_DETECT_COUNT
 		&& type != RESPONSE_TYPE_LAME 
 		&& type != RESPONSE_TYPE_REC_LAME 
 		&& type != RESPONSE_TYPE_THROWAWAY 
@@ -1967,6 +2262,22 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		} else
 			iter_scrub_ds(iq->response, ns, iq->dp->name);
 	} else iter_scrub_ds(iq->response, NULL, NULL);
+	if(type == RESPONSE_TYPE_THROWAWAY &&
+		FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_YXDOMAIN) {
+		/* YXDOMAIN is a permanent error, no need to retry */
+		type = RESPONSE_TYPE_ANSWER;
+	}
+	if(type == RESPONSE_TYPE_CNAME && iq->response->rep->an_numrrsets >= 1
+		&& ntohs(iq->response->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DNAME) {
+		uint8_t* sname = NULL;
+		size_t snamelen = 0;
+		get_cname_target(iq->response->rep->rrsets[0], &sname,
+			&snamelen);
+		if(snamelen && dname_subdomain_c(sname, iq->response->rep->rrsets[0]->rk.dname)) {
+			/* DNAME to a subdomain loop; do not recurse */
+			type = RESPONSE_TYPE_ANSWER;
+		}
+	}
 
 	/* handle each of the type cases */
 	if(type == RESPONSE_TYPE_ANSWER) {
@@ -1994,10 +2305,11 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->num_target_queries = 0;
 			return processDSNSFind(qstate, iq, id);
 		}
-		iter_dns_store(qstate->env, &iq->response->qinfo,
-			iq->response->rep, 0, qstate->prefetch_leeway,
-			iq->dp&&iq->dp->has_parent_side_NS,
-			qstate->region, qstate->query_flags);
+		if(!qstate->no_cache_store)
+			iter_dns_store(qstate->env, &iq->response->qinfo,
+				iq->response->rep, 0, qstate->prefetch_leeway,
+				iq->dp&&iq->dp->has_parent_side_NS,
+				qstate->region, qstate->query_flags);
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
@@ -2009,14 +2321,64 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			sock_list_insert(&qstate->reply_origin, 
 				&qstate->reply->addr, qstate->reply->addrlen, 
 				qstate->region);
+		if(iq->minimisation_state != DONOT_MINIMISE_STATE) {
+			if(FLAGS_GET_RCODE(iq->response->rep->flags) != 
+				LDNS_RCODE_NOERROR) {
+				if(qstate->env->cfg->qname_minimisation_strict)
+					return final_state(iq);
+				/* Best effort qname-minimisation. 
+				 * Stop minimising and send full query when
+				 * RCODE is not NOERROR. */
+				iq->minimisation_state = DONOT_MINIMISE_STATE;
+			}
+			if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
+				LDNS_RCODE_NXDOMAIN) {
+				/* Stop resolving when NXDOMAIN is DNSSEC
+				 * signed. Based on assumption that namservers
+				 * serving signed zones do not return NXDOMAIN
+				 * for empty-non-terminals. */
+				if(iq->dnssec_expected)
+					return final_state(iq);
+				/* Make subrequest to validate intermediate
+				 * NXDOMAIN if harden-below-nxdomain is
+				 * enabled. */
+				if(qstate->env->cfg->harden_below_nxdomain) {
+					struct module_qstate* subq = NULL;
+					log_query_info(VERB_QUERY,
+						"schedule NXDOMAIN validation:",
+						&iq->response->qinfo);
+					if(!generate_sub_request(
+						iq->response->qinfo.qname,
+						iq->response->qinfo.qname_len,
+						iq->response->qinfo.qtype,
+						iq->response->qinfo.qclass,
+						qstate, id, iq,
+						INIT_REQUEST_STATE,
+						FINISHED_STATE, &subq, 1))
+						verbose(VERB_ALGO,
+						"could not validate NXDOMAIN "
+						"response");
+				}
+			}
+			return next_state(iq, QUERYTARGETS_STATE);
+		}
 		return final_state(iq);
 	} else if(type == RESPONSE_TYPE_REFERRAL) {
 		/* REFERRAL type responses get a reset of the 
 		 * delegation point, and back to the QUERYTARGETS_STATE. */
 		verbose(VERB_DETAIL, "query response was REFERRAL");
 
+		if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
+			/* we have a referral, no ratelimit, we can send
+			 * our queries to the given name */
+			infra_ratelimit_dec(qstate->env->infra_cache,
+				iq->dp->name, iq->dp->namelen,
+				*qstate->env->now);
+		}
+
 		/* if hardened, only store referral if we asked for it */
-		if(!qstate->env->cfg->harden_referral_path ||
+		if(!qstate->no_cache_store &&
+		(!qstate->env->cfg->harden_referral_path ||
 		    (  qstate->qinfo.qtype == LDNS_RR_TYPE_NS 
 			&& (qstate->query_flags&BIT_RD) 
 			&& !(qstate->query_flags&BIT_CD)
@@ -2031,7 +2393,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				iq->qchase.qname, iq->qchase.qname_len,
 				LDNS_RR_TYPE_NS, iq->qchase.qclass)
 			  )
-		    )) {
+		    ))) {
 			/* Store the referral under the current query */
 			/* no prefetch-leeway, since its not the answer */
 			iter_dns_store(qstate->env, &iq->response->qinfo,
@@ -2044,22 +2406,25 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 					iq->response->rep, iq->dp->name);
 		}
 		/* store parent-side-in-zone-glue, if directly queried for */
-		if(iq->query_for_pside_glue && !iq->pside_glue) {
-			iq->pside_glue = reply_find_rrset(iq->response->rep, 
-				iq->qchase.qname, iq->qchase.qname_len, 
-				iq->qchase.qtype, iq->qchase.qclass);
-			if(iq->pside_glue) {
-				log_rrset_key(VERB_ALGO, "found parent-side "
-					"glue", iq->pside_glue);
-				iter_store_parentside_rrset(qstate->env,
-					iq->pside_glue);
-			}
+		if(!qstate->no_cache_store && iq->query_for_pside_glue
+			&& !iq->pside_glue) {
+				iq->pside_glue = reply_find_rrset(iq->response->rep, 
+					iq->qchase.qname, iq->qchase.qname_len, 
+					iq->qchase.qtype, iq->qchase.qclass);
+				if(iq->pside_glue) {
+					log_rrset_key(VERB_ALGO, "found parent-side "
+						"glue", iq->pside_glue);
+					iter_store_parentside_rrset(qstate->env,
+						iq->pside_glue);
+				}
 		}
 
 		/* Reset the event state, setting the current delegation 
 		 * point to the referral. */
 		iq->deleg_msg = iq->response;
 		iq->dp = delegpt_from_message(iq->response, qstate->region);
+		if (qstate->env->cfg->qname_minimisation)
+			iq->minimisation_state = INIT_MINIMISE_STATE;
 		if(!iq->dp)
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
@@ -2132,13 +2497,16 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* NOTE : set referral=1, so that rrsets get stored but not 
 		 * the partial query answer (CNAME only). */
 		/* prefetchleeway applied because this updates answer parts */
-		iter_dns_store(qstate->env, &iq->response->qinfo,
-			iq->response->rep, 1, qstate->prefetch_leeway,
-			iq->dp&&iq->dp->has_parent_side_NS, NULL,
-			qstate->query_flags);
+		if(!qstate->no_cache_store)
+			iter_dns_store(qstate->env, &iq->response->qinfo,
+				iq->response->rep, 1, qstate->prefetch_leeway,
+				iq->dp&&iq->dp->has_parent_side_NS, NULL,
+				qstate->query_flags);
 		/* set the current request's qname to the new value. */
 		iq->qchase.qname = sname;
 		iq->qchase.qname_len = snamelen;
+		if (qstate->env->cfg->qname_minimisation)
+			iq->minimisation_state = INIT_MINIMISE_STATE;
 		/* Clear the query state, since this is a query restart. */
 		iq->deleg_msg = NULL;
 		iq->dp = NULL;
@@ -2212,6 +2580,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* LAME, THROWAWAY and "unknown" all end up here.
 	 * Recycle to the QUERYTARGETS state to hopefully try a 
 	 * different target. */
+	if (qstate->env->cfg->qname_minimisation &&
+		!qstate->env->cfg->qname_minimisation_strict)
+		iq->minimisation_state = DONOT_MINIMISE_STATE;
 	return next_state(iq, QUERYTARGETS_STATE);
 }
 
@@ -2344,6 +2715,10 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	log_query_info(VERB_ALGO, "processTargetResponse", &qstate->qinfo);
 	log_query_info(VERB_ALGO, "processTargetResponse super", &forq->qinfo);
 
+	/* Tell the originating event that this target query has finished
+	 * (regardless if it succeeded or not). */
+	foriq->num_target_queries--;
+
 	/* check to see if parent event is still interested (in orig name).  */
 	if(!foriq->dp) {
 		verbose(VERB_ALGO, "subq: parent not interested, was reset");
@@ -2359,10 +2734,6 @@ processTargetResponse(struct module_qstate* qstate, int id,
 		return;
 	}
 
-	/* Tell the originating event that this target query has finished
-	 * (regardless if it succeeded or not). */
-	foriq->num_target_queries--;
-
 	/* if iq->query_for_pside_glue then add the pside_glue (marked lame) */
 	if(iq->pside_glue) {
 		/* if the pside_glue is NULL, then it could not be found,
@@ -2483,6 +2854,12 @@ processClassResponse(struct module_qstate* qstate, int id,
 			/* copy appropriate rcode */
 			to->rep->flags = from->rep->flags;
 			/* copy rrsets */
+			if(from->rep->rrset_count > RR_COUNT_MAX ||
+				to->rep->rrset_count > RR_COUNT_MAX) {
+				log_err("malloc failed (too many rrsets) in collect ANY"); 
+				foriq->state = FINISHED_STATE;
+				return; /* integer overflow protection */
+			}
 			dest = regional_alloc(forq->region, sizeof(dest[0])*n);
 			if(!dest) {
 				log_err("malloc failed in collect ANY"); 
@@ -2604,10 +2981,11 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		&qstate->qinfo);
 
 	/* store negative cache element for parent side glue. */
-	if(iq->query_for_pside_glue && !iq->pside_glue)
-		iter_store_parentside_neg(qstate->env, &qstate->qinfo,
-			iq->deleg_msg?iq->deleg_msg->rep:
-			(iq->response?iq->response->rep:NULL));
+	if(!qstate->no_cache_store && iq->query_for_pside_glue
+		&& !iq->pside_glue)
+			iter_store_parentside_neg(qstate->env, &qstate->qinfo,
+				iq->deleg_msg?iq->deleg_msg->rep:
+				(iq->response?iq->response->rep:NULL));
 	if(!iq->response) {
 		verbose(VERB_ALGO, "No response is set, servfail");
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -2643,7 +3021,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* store message with the finished prepended items,
 		 * but only if we did recursion. The nonrecursion referral
 		 * from cache does not need to be stored in the msg cache. */
-		if(qstate->query_flags&BIT_RD) {
+		if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) {
 			iter_dns_store(qstate->env, &qstate->qinfo, 
 				iq->response->rep, 0, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS,
@@ -2779,6 +3157,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->caps_fallback = 1;
 			iq->caps_server = 0;
 			iq->caps_reply = NULL;
+			iq->caps_response = NULL;
 			iq->state = QUERYTARGETS_STATE;
 			iq->num_current_queries--;
 			/* need fresh attempts for the 0x20 fallback, if
@@ -2814,15 +3193,43 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 		goto handle_it;
 	}
 	/* edns is not examined, but removed from message to help cache */
-	if(parse_extract_edns(prs, &edns) != LDNS_RCODE_NOERROR)
+	if(parse_extract_edns(prs, &edns, qstate->env->scratch) !=
+		LDNS_RCODE_NOERROR)
 		goto handle_it;
+
+	/* Copy the edns options we may got from the back end */
+	if(edns.opt_list) {
+		qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list,
+			qstate->region);
+		if(!qstate->edns_opts_back_in) {
+			log_err("out of memory on incoming message");
+			/* like packet got dropped */
+			goto handle_it;
+		}
+		if(!inplace_cb_edns_back_parsed_call(qstate->env, qstate)) {
+			log_err("unable to call edns_back_parsed callback");
+			goto handle_it;
+		}
+	}
+
 	/* remove CD-bit, we asked for in case we handle validation ourself */
 	prs->flags &= ~BIT_CD;
 
 	/* normalize and sanitize: easy to delete items from linked lists */
-	if(!scrub_message(pkt, prs, &iq->qchase, iq->dp->name, 
-		qstate->env->scratch, qstate->env, ie))
+	if(!scrub_message(pkt, prs, &iq->qinfo_out, iq->dp->name, 
+		qstate->env->scratch, qstate->env, ie)) {
+		/* if 0x20 enabled, start fallback, but we have no message */
+		if(event == module_event_capsfail && !iq->caps_fallback) {
+			iq->caps_fallback = 1;
+			iq->caps_server = 0;
+			iq->caps_reply = NULL;
+			iq->caps_response = NULL;
+			iq->state = QUERYTARGETS_STATE;
+			iq->num_current_queries--;
+			verbose(VERB_DETAIL, "Capsforid: scrub failed, starting fallback with no response");
+		}
 		goto handle_it;
+	}
 
 	/* allocate response dns_msg in region */
 	iq->response = dns_alloc_msg(pkt, prs, qstate->region);
@@ -2836,11 +3243,15 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->response->rep);
 	
 	if(event == module_event_capsfail || iq->caps_fallback) {
+		/* for fallback we care about main answer, not additionals */
+		/* removing that makes comparison more likely to succeed */
+		caps_strip_reply(iq->response->rep);
 		if(!iq->caps_fallback) {
 			/* start fallback */
 			iq->caps_fallback = 1;
 			iq->caps_server = 0;
 			iq->caps_reply = iq->response->rep;
+			iq->caps_response = iq->response;
 			iq->state = QUERYTARGETS_STATE;
 			iq->num_current_queries--;
 			verbose(VERB_DETAIL, "Capsforid: starting fallback");
@@ -2849,8 +3260,24 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* check if reply is the same, otherwise, fail */
 			if(!iq->caps_reply) {
 				iq->caps_reply = iq->response->rep;
+				iq->caps_response = iq->response;
 				iq->caps_server = -1; /*become zero at ++,
 				so that we start the full set of trials */
+			} else if(caps_failed_rcode(iq->caps_reply) &&
+				!caps_failed_rcode(iq->response->rep)) {
+				/* prefer to upgrade to non-SERVFAIL */
+				iq->caps_reply = iq->response->rep;
+				iq->caps_response = iq->response;
+			} else if(!caps_failed_rcode(iq->caps_reply) &&
+				caps_failed_rcode(iq->response->rep)) {
+				/* if we have non-SERVFAIL as answer then 
+				 * we can ignore SERVFAILs for the equality
+				 * comparison */
+				/* no instructions here, skip other else */
+			} else if(caps_failed_rcode(iq->caps_reply) &&
+				caps_failed_rcode(iq->response->rep)) {
+				/* failure is same as other failure in fallbk*/
+				/* no instructions here, skip other else */
 			} else if(!reply_equal(iq->response->rep, iq->caps_reply,
 				qstate->env->scratch)) {
 				verbose(VERB_DETAIL, "Capsforid fallback: "
@@ -2928,6 +3355,8 @@ iter_clear(struct module_qstate* qstate, int id)
 	iq = (struct iter_qstate*)qstate->minfo[id];
 	if(iq) {
 		outbound_list_clear(&iq->outlist);
+		if(iq->target_count && --iq->target_count[0] == 0)
+			free(iq->target_count);
 		iq->num_current_queries = 0;
 	}
 	qstate->minfo[id] = NULL;

iterator/iterator.h

@@ -51,13 +51,33 @@ struct iter_forwards;
 struct iter_donotq;
 struct iter_prep_list;
 struct iter_priv;
+struct rbtree_type;
 
+/** max number of targets spawned for a query and its subqueries */
+#define MAX_TARGET_COUNT	64
 /** max number of query restarts. Determines max number of CNAME chain. */
 #define MAX_RESTART_COUNT       8
 /** max number of referrals. Makes sure resolver does not run away */
 #define MAX_REFERRAL_COUNT	130
 /** max number of queries-sent-out.  Make sure large NS set does not loop */
 #define MAX_SENT_COUNT		32
+/** max number of queries for which to perform dnsseclameness detection,
+ * (rrsigs misssing detection) after that, just pick up that response */
+#define DNSSEC_LAME_DETECT_COUNT 4
+/**
+ * max number of QNAME minimisation iterations. Limits number of queries for
+ * QNAMEs with a lot of labels.
+*/
+#define MAX_MINIMISE_COUNT	10
+/* max number of time-outs for minimised query. Prevents resolving failures
+ * when the QNAME minimisation QTYPE is blocked. */
+#define MAX_MINIMISE_TIMEOUT_COUNT 3
+/**
+ * number of labels from QNAME that are always send individually when using
+ * QNAME minimisation, even when the number of labels of the QNAME is bigger
+ * tham MAX_MINIMISE_COUNT */
+#define MINIMISE_ONE_LAB	4
+#define MINIMISE_MULTIPLE_LABS	(MAX_MINIMISE_COUNT - MINIMISE_ONE_LAB)
 /** at what query-sent-count to stop target fetch policy */
 #define TARGET_FETCH_STOP	3
 /** how nice is a server without further information, in msec 
@@ -94,6 +114,9 @@ struct iter_env {
 	/** private address space and private domains */
 	struct iter_priv* priv;
 
+	/** whitelist for capsforid names */
+	struct rbtree_type* caps_white;
+
 	/** The maximum dependency depth that this resolver will pursue. */
 	int max_dependency_depth;
 
@@ -106,6 +129,32 @@ struct iter_env {
 	 * array of max_dependency_depth+1 size.
 	 */
 	int* target_fetch_policy;
+
+	/** ip6.arpa dname in wireformat, used for qname-minimisation */
+	uint8_t* ip6arpa_dname;
+};
+
+/**
+ * QNAME minimisation state
+ */
+enum minimisation_state {
+	/**
+	 * (Re)start minimisation. Outgoing QNAME should be set to dp->name.
+	 * State entered on new query or after following refferal or CNAME.
+	 */
+	INIT_MINIMISE_STATE = 0,
+	/**
+	 * QNAME minimisataion ongoing. Increase QNAME on every iteration.
+	 */
+	MINIMISE_STATE,
+	/**
+	 * Don't increment QNAME this iteration
+	 */
+	SKIP_MINIMISE_STATE,
+	/**
+	 * Send out full QNAME + original QTYPE
+	 */
+	DONOT_MINIMISE_STATE,
 };
 
 /**
@@ -233,6 +282,7 @@ struct iter_qstate {
 	/** state for capsfail: stored query for comparisons. Can be NULL if
 	 * no response had been seen prior to starting the fallback. */
 	struct reply_info* caps_reply;
+	struct dns_msg* caps_response;
 
 	/** Current delegation message - returned for non-RD queries */
 	struct dns_msg* deleg_msg;
@@ -251,6 +301,13 @@ struct iter_qstate {
 
 	/** number of queries fired off */
 	int sent_count;
+	
+	/** number of target queries spawned in [1], for this query and its
+	 * subqueries, the malloced-array is shared, [0] refcount. */
+	int* target_count;
+
+	/** if true, already tested for ratelimiting and passed the test */
+	int ratelimit_ok;
 
 	/**
 	 * The query must store NS records from referrals as parentside RRs
@@ -308,6 +365,26 @@ struct iter_qstate {
 
 	/** list of pending queries to authoritative servers. */
 	struct outbound_list outlist;
+
+	/** QNAME minimisation state, RFC7816 */
+	enum minimisation_state minimisation_state;
+
+	/**
+	 * The query info that is sent upstream. Will be a subset of qchase
+	 * when qname minimisation is enabled.
+	 */
+	struct query_info qinfo_out;
+
+	/**
+	 * Count number of QNAME minisation iterations. Used to limit number of
+	 * outgoing queries when QNAME minimisation is enabled.
+	 */
+	int minimise_count;
+
+	/**
+	 * Count number of time-outs. Used to prevent resolving failures when
+	 * the QNAME minimisation QTYPE is blocked. */
+	int minimise_timeout_count;
 };
 
 /**

libunbound/context.c

@@ -49,7 +49,7 @@
 #include "services/cache/infra.h"
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 int 
 context_finalize(struct ub_ctx* ctx)
@@ -62,6 +62,7 @@ context_finalize(struct ub_ctx* ctx)
 	config_apply(cfg);
 	if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
 		return UB_INITFAIL;
+	log_edns_known_options(VERB_ALGO, ctx->env);
 	ctx->local_zones = local_zones_create();
 	if(!ctx->local_zones)
 		return UB_NOMEM;
@@ -126,7 +127,7 @@ find_id(struct ub_ctx* ctx, int* id)
 
 struct ctx_query* 
 context_new(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass, 
-	ub_callback_t cb, void* cbarg)
+	ub_callback_type cb, void* cbarg)
 {
 	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
 	if(!q) return NULL;
@@ -360,7 +361,7 @@ context_serialize_cancel(struct ctx_query* q, uint32_t* len)
 	/* format of cancel:
 	 * 	o uint32 cmd
 	 * 	o uint32 async-id */
-	uint8_t* p = (uint8_t*)malloc(2*sizeof(uint32_t));
+	uint8_t* p = (uint8_t*)reallocarray(NULL, sizeof(uint32_t), 2);
 	if(!p) return NULL;
 	*len = 2*sizeof(uint32_t);
 	sldns_write_uint32(p, UB_LIBCMD_CANCEL);

libunbound/context.h

@@ -49,7 +49,7 @@
 struct libworker;
 struct tube;
 struct sldns_buffer;
-struct event_base;
+struct ub_event_base;
 
 /**
  * The context structure
@@ -61,17 +61,17 @@ struct event_base;
 struct ub_ctx {
 	/* --- pipes --- */
 	/** mutex on query write pipe */
-	lock_basic_t qqpipe_lock;
+	lock_basic_type qqpipe_lock;
 	/** the query write pipe */
 	struct tube* qq_pipe;
 	/** mutex on result read pipe */
-	lock_basic_t rrpipe_lock;
+	lock_basic_type rrpipe_lock;
 	/** the result read pipe */
 	struct tube* rr_pipe;
 
 	/* --- shared data --- */
 	/** mutex for access to env.cfg, finalized and dothread */
-	lock_basic_t cfglock;
+	lock_basic_type cfglock;
 	/** 
 	 * The context has been finalized 
 	 * This is after config when the first resolve is done.
@@ -84,7 +84,7 @@ struct ub_ctx {
 	/** pid of bg worker process */
 	pid_t bg_pid;
 	/** tid of bg worker thread */
-	ub_thread_t bg_tid;
+	ub_thread_type bg_tid;
 
 	/** do threading (instead of forking) for async resolution */
 	int dothread;
@@ -114,7 +114,7 @@ struct ub_ctx {
 	struct ub_randstate* seed_rnd;
 
 	/** event base for event oriented interface */
-	struct event_base* event_base;
+	struct ub_event_base* event_base;
 	/** libworker for event based interface */
 	struct libworker* event_worker;
 
@@ -129,7 +129,7 @@ struct ub_ctx {
 	 * Used to see if querynum is free for use.
 	 * Content of type ctx_query.
 	 */ 
-	rbtree_t queries;
+	rbtree_type queries;
 };
 
 /**
@@ -140,7 +140,7 @@ struct ub_ctx {
  */
 struct ctx_query {
 	/** node in rbtree, must be first entry, key is ptr to the querynum */
-	struct rbnode_t node;
+	struct rbnode_type node;
 	/** query id number, key for node */
 	int querynum;
 	/** was this an async query? */
@@ -149,7 +149,7 @@ struct ctx_query {
 	int cancelled;
 
 	/** for async query, the callback function */
-	ub_callback_t cb;
+	ub_callback_type cb;
 	/** for async query, the callback user arg */
 	void* cb_arg;
 
@@ -242,7 +242,7 @@ void context_query_delete(struct ctx_query* q);
  * @return new ctx_query or NULL for malloc failure.
  */
 struct ctx_query* context_new(struct ub_ctx* ctx, const char* name, int rrtype,
-        int rrclass, ub_callback_t cb, void* cbarg);
+        int rrclass, ub_callback_type cb, void* cbarg);
 
 /**
  * Get a new alloc. Creates a new one or uses a cached one.

libunbound/libunbound.c

@@ -57,14 +57,21 @@
 #include "util/random.h"
 #include "util/net_help.h"
 #include "util/tube.h"
+#include "util/ub_event.h"
 #include "services/modstack.h"
 #include "services/localzone.h"
 #include "services/cache/infra.h"
 #include "services/cache/rrset.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #ifdef HAVE_PTHREAD
 #include <signal.h>
 #endif
+#ifdef HAVE_SYS_WAIT_H
+#include <sys/wait.h>
+#endif
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
 
 #if defined(UB_ON_WINDOWS) && defined (HAVE_WINDOWS_H)
 #include <windows.h>
@@ -125,6 +132,15 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)
 		errno = ENOMEM;
 		return NULL;
 	}
+	/* init edns_known_options */
+	if(!edns_known_options_init(ctx->env)) {
+		config_delete(ctx->env->cfg);
+		free(ctx->env);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = ENOMEM;
+		return NULL;
+	}
 	ctx->env->alloc = &ctx->superalloc;
 	ctx->env->worker = NULL;
 	ctx->env->need_to_validate = 0;
@@ -144,6 +160,7 @@ ub_ctx_create(void)
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
 		modstack_desetup(&ctx->mods, ctx->env);
+		edns_known_options_delete(ctx->env);
 		free(ctx->env);
 		free(ctx);
 		errno = e;
@@ -155,6 +172,7 @@ ub_ctx_create(void)
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
 		modstack_desetup(&ctx->mods, ctx->env);
+		edns_known_options_delete(ctx->env);
 		free(ctx->env);
 		free(ctx);
 		errno = e;
@@ -163,6 +181,20 @@ ub_ctx_create(void)
 	return ctx;
 }
 
+struct ub_ctx* 
+ub_ctx_create_ub_event(struct ub_event_base* ueb)
+{
+	struct ub_ctx* ctx = ub_ctx_create_nopipe();
+	if(!ctx)
+		return NULL;
+	/* no pipes, but we have the locks to make sure everything works */
+	ctx->created_bg = 0;
+	ctx->dothread = 1; /* the processing is in the same process,
+		makes ub_cancel and ub_ctx_delete do the right thing */
+	ctx->event_base = ueb;
+	return ctx;
+}
+
 struct ub_ctx* 
 ub_ctx_create_event(struct event_base* eb)
 {
@@ -173,13 +205,17 @@ ub_ctx_create_event(struct event_base* eb)
 	ctx->created_bg = 0;
 	ctx->dothread = 1; /* the processing is in the same process,
 		makes ub_cancel and ub_ctx_delete do the right thing */
-	ctx->event_base = eb;
+	ctx->event_base = ub_libevent_event_base(eb);
+	if (!ctx->event_base) {
+		ub_ctx_delete(ctx);
+		return NULL;
+	}
 	return ctx;
 }
 	
 /** delete q */
 static void
-delq(rbnode_t* n, void* ATTR_UNUSED(arg))
+delq(rbnode_type* n, void* ATTR_UNUSED(arg))
 {
 	struct ctx_query* q = (struct ctx_query*)n;
 	context_query_delete(q);
@@ -218,6 +254,12 @@ static void ub_stop_bg(struct ub_ctx* ctx)
 			ub_thread_join(ctx->bg_tid);
 		} else {
 			lock_basic_unlock(&ctx->cfglock);
+#ifndef UB_ON_WINDOWS
+			if(waitpid(ctx->bg_pid, NULL, 0) == -1) {
+				if(verbosity > 2)
+					log_err("waitpid: %s", strerror(errno));
+			}
+#endif
 		}
 	}
 	else {
@@ -267,6 +309,7 @@ ub_ctx_delete(struct ub_ctx* ctx)
 		rrset_cache_delete(ctx->env->rrset_cache);
 		infra_delete(ctx->env->infra_cache);
 		config_delete(ctx->env->cfg);
+		edns_known_options_delete(ctx->env);
 		free(ctx->env);
 	}
 	ub_randfree(ctx->seed_rnd);
@@ -456,7 +499,7 @@ ub_fd(struct ub_ctx* ctx)
 /** process answer from bg worker */
 static int
 process_answer_detail(struct ub_ctx* ctx, uint8_t* msg, uint32_t len,
-	ub_callback_t* cb, void** cbarg, int* err,
+	ub_callback_type* cb, void** cbarg, int* err,
 	struct ub_result** res)
 {
 	struct ctx_query* q;
@@ -523,7 +566,7 @@ static int
 process_answer(struct ub_ctx* ctx, uint8_t* msg, uint32_t len)
 {
 	int err;
-	ub_callback_t cb;
+	ub_callback_type cb;
 	void* cbarg;
 	struct ub_result* res;
 	int r;
@@ -566,7 +609,7 @@ int
 ub_wait(struct ub_ctx* ctx)
 {
 	int err;
-	ub_callback_t cb;
+	ub_callback_type cb;
 	void* cbarg;
 	struct ub_result* res;
 	int r;
@@ -662,7 +705,8 @@ ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
 
 int 
 ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype, 
-	int rrclass, void* mydata, ub_event_callback_t callback, int* async_id)
+	int rrclass, void* mydata, ub_event_callback_type callback,
+	int* async_id)
 {
 	struct ctx_query* q;
 	int r;
@@ -686,8 +730,11 @@ ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 		}
 	}
 
+	/* set time in case answer comes from cache */
+	ub_comm_base_now(ctx->event_worker->base);
+
 	/* create new ctx_query and attempt to add to the list */
-	q = context_new(ctx, name, rrtype, rrclass, (ub_callback_t)callback,
+	q = context_new(ctx, name, rrtype, rrclass, (ub_callback_type)callback,
 		mydata);
 	if(!q)
 		return UB_NOMEM;
@@ -701,7 +748,7 @@ ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 
 int 
 ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, 
-	int rrclass, void* mydata, ub_callback_t callback, int* async_id)
+	int rrclass, void* mydata, ub_callback_type callback, int* async_id)
 {
 	struct ctx_query* q;
 	uint8_t* msg = NULL;
@@ -912,6 +959,88 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 	return UB_NOERROR;
 }
 
+int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr,
+	int isprime)
+{
+	char* a;
+	struct config_stub **prev, *elem;
+
+	/* check syntax for zone name */
+	if(zone) {
+		uint8_t* nm;
+		int nmlabs;
+		size_t nmlen;
+		if(!parse_dname(zone, &nm, &nmlen, &nmlabs)) {
+			errno=EINVAL;
+			return UB_SYNTAX;
+		}
+		free(nm);
+	} else {
+		zone = ".";
+	}
+
+	/* check syntax for addr (if not NULL) */
+	if(addr) {
+		struct sockaddr_storage storage;
+		socklen_t stlen;
+		if(!extstrtoaddr(addr, &storage, &stlen)) {
+			errno=EINVAL;
+			return UB_SYNTAX;
+		}
+	}
+
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno=EINVAL;
+		return UB_AFTERFINAL;
+	}
+
+	/* arguments all right, now find or add the stub */
+	prev = &ctx->env->cfg->stubs;
+	elem = cfg_stub_find(&prev, zone);
+	if(!elem && !addr) {
+		/* not found and we want to delete, nothing to do */
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOERROR;
+	} else if(elem && !addr) {
+		/* found, and we want to delete */
+		*prev = elem->next;
+		config_delstub(elem);
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOERROR;
+	} else if(!elem) {
+		/* not found, create the stub entry */
+		elem=(struct config_stub*)calloc(1, sizeof(struct config_stub));
+		if(elem) elem->name = strdup(zone);
+		if(!elem || !elem->name) {
+			free(elem);
+			lock_basic_unlock(&ctx->cfglock);
+			errno = ENOMEM;
+			return UB_NOMEM;
+		}
+		elem->next = ctx->env->cfg->stubs;
+		ctx->env->cfg->stubs = elem;
+	}
+
+	/* add the address to the list and set settings */
+	elem->isprime = isprime;
+	a = strdup(addr);
+	if(!a) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno = ENOMEM;
+		return UB_NOMEM;
+	}
+	if(!cfg_strlist_insert(&elem->addrs, a)) {
+		lock_basic_unlock(&ctx->cfglock);
+		free(a);
+		errno = ENOMEM;
+		return UB_NOMEM;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
 int 
 ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
 {
@@ -946,7 +1075,7 @@ ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
 			while (ptr) {
 				numserv++;
 				if((retval=ub_ctx_set_fwd(ctx, 
-					ptr->IpAddress.String)!=0)) {
+					ptr->IpAddress.String))!=0) {
 					free(info);
 					return retval;
 				}
@@ -1028,7 +1157,6 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 					"\\hosts");
 				retval=ub_ctx_hosts(ctx, buf);
 			}
-			free(name);
 			return retval;
 		}
 		return UB_READFILE;
@@ -1053,6 +1181,8 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 		/* skip addr */
 		while(isxdigit((unsigned char)*parse) || *parse == '.' || *parse == ':')
 			parse++;
+		if(*parse == '\r')
+			parse++;
 		if(*parse == '\n' || *parse == 0)
 			continue;
 		if(*parse == '%') 
@@ -1066,7 +1196,8 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 		*parse++ = 0; /* end delimiter for addr ... */
 		/* go to names and add them */
 		while(*parse) {
-			while(*parse == ' ' || *parse == '\t' || *parse=='\n')
+			while(*parse == ' ' || *parse == '\t' || *parse=='\n'
+				|| *parse=='\r')
 				parse++;
 			if(*parse == 0 || *parse == '#')
 				break;
@@ -1227,10 +1358,12 @@ const char* ub_version(void)
 
 int 
 ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base) {
+	struct ub_event_base* new_base;
+
 	if (!ctx || !ctx->event_base || !base) {
 		return UB_INITFAIL;
 	}
-	if (ctx->event_base == base) {
+	if (ub_libevent_get_event_base(ctx->event_base) == base) {
 		/* already set */
 		return UB_NOERROR;
 	}
@@ -1239,9 +1372,11 @@ ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base) {
 	/* destroy the current worker - safe to pass in NULL */
 	libworker_delete_event(ctx->event_worker);
 	ctx->event_worker = NULL;
-	ctx->event_base = base;	
+	new_base = ub_libevent_event_base(base);
+	if (new_base)
+		ctx->event_base = new_base;	
 	ctx->created_bg = 0;
 	ctx->dothread = 1;
 	lock_basic_unlock(&ctx->cfglock);
-	return UB_NOERROR;
+	return new_base ? UB_NOERROR : UB_INITFAIL;
 }

libunbound/libworker.c

@@ -70,8 +70,8 @@
 #include "util/tube.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
 
 /** handle new query command for bg worker */
 static void handle_newq(struct libworker* w, uint8_t* buf, uint32_t len);
@@ -119,7 +119,7 @@ libworker_delete_event(struct libworker* w)
 
 /** setup fresh libworker struct */
 static struct libworker*
-libworker_setup(struct ub_ctx* ctx, int is_bg, struct event_base* eb)
+libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 {
 	unsigned int seed;
 	struct libworker* w = (struct libworker*)calloc(1, sizeof(*w));
@@ -232,6 +232,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct event_base* eb)
 		cfg->do_tcp?cfg->outgoing_num_tcp:0,
 		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
 		ports, numports, cfg->unwanted_threshold,
+		cfg->outgoing_tcp_mss,
 		&libworker_alloc_cleanup, w, cfg->do_udp, w->sslctx,
 		cfg->delay_close, NULL);
 	if(!w->is_bg || w->is_bg_thread) {
@@ -257,7 +258,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct event_base* eb)
 }
 
 struct libworker* libworker_create_event(struct ub_ctx* ctx,
-	struct event_base* eb)
+	struct ub_event_base* eb)
 {
 	return libworker_setup(ctx, 0, eb);
 }
@@ -572,14 +573,17 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 {
 	qinfo->qtype = (uint16_t)q->res->qtype;
 	qinfo->qclass = (uint16_t)q->res->qclass;
+	qinfo->local_alias = NULL;
 	qinfo->qname = sldns_str2wire_dname(q->res->qname, &qinfo->qname_len);
 	if(!qinfo->qname) {
 		return 0;
 	}
+	qinfo->local_alias = NULL;
 	edns->edns_present = 1;
 	edns->ext_rcode = 0;
 	edns->edns_version = 0;
 	edns->bits = EDNS_DO;
+	edns->opt_list = NULL;
 	if(sldns_buffer_capacity(w->back->udp_buff) < 65535)
 		edns->udp_size = (uint16_t)sldns_buffer_capacity(
 			w->back->udp_buff);
@@ -605,8 +609,9 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 	/* see if there is a fixed answer */
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
+	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns, 
+		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
+		NULL, 0, NULL, 0, NULL)) {
 		regional_free_all(w->env->scratch);
 		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
 			w->back->udp_buff, sec_status_insecure, NULL);
@@ -634,7 +639,7 @@ libworker_event_done_cb(void* arg, int rcode, sldns_buffer* buf,
 	enum sec_status s, char* why_bogus)
 {
 	struct ctx_query* q = (struct ctx_query*)arg;
-	ub_event_callback_t cb = (ub_event_callback_t)q->cb;
+	ub_event_callback_type cb = (ub_event_callback_type)q->cb;
 	void* cb_arg = q->cb_arg;
 	int cancelled = q->cancelled;
 
@@ -675,8 +680,9 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 	/* see if there is a fixed answer */
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
+	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns, 
+		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
+		NULL, 0, NULL, 0, NULL)) {
 		regional_free_all(w->env->scratch);
 		free(qinfo.qname);
 		libworker_event_done_cb(q, LDNS_RCODE_NOERROR,
@@ -795,8 +801,9 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	/* see if there is a fixed answer */
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(w->ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
+	if(local_zones_answer(w->ctx->local_zones, w->env, &qinfo, &edns, 
+		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
+		NULL, 0, NULL, 0, NULL)) {
 		regional_free_all(w->env->scratch);
 		q->msg_security = sec_status_insecure;
 		add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL);
@@ -819,11 +826,10 @@ void libworker_alloc_cleanup(void* arg)
         slabhash_clear(w->env->msg_cache);
 }
 
-struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
-        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
-	socklen_t addrlen, uint8_t* zone, size_t zonelen,
-	struct module_qstate* q)
+struct outbound_entry* libworker_send_query(struct query_info* qinfo,
+	uint16_t flags, int dnssec, int want_dnssec, int nocaps,
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
+	size_t zonelen, int ssl_upstream, struct module_qstate* q)
 {
 	struct libworker* w = (struct libworker*)q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -831,11 +837,10 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 	if(!e)
 		return NULL;
 	e->qstate = q;
-	e->qsent = outnet_serviced_query(w->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, want_dnssec, nocaps,
-		q->env->cfg->tcp_upstream, q->env->cfg->ssl_upstream, addr,
-		addrlen, zone, zonelen, libworker_handle_service_reply, e,
-		w->back->udp_buff);
+	e->qsent = outnet_serviced_query(w->back, qinfo, flags, dnssec,
+		want_dnssec, nocaps, q->env->cfg->tcp_upstream, ssl_upstream,
+		addr, addrlen, zone, zonelen, q, libworker_handle_service_reply,
+		e, w->back->udp_buff, q->env);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -950,13 +955,12 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 	log_assert(0);
 }
 
-struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
-	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
-	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
-	int ATTR_UNUSED(nocaps), struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
-	size_t ATTR_UNUSED(zonelen), struct module_qstate* ATTR_UNUSED(q))
+struct outbound_entry* worker_send_query(struct query_info* ATTR_UNUSED(qinfo),
+	uint16_t ATTR_UNUSED(flags), int ATTR_UNUSED(dnssec),
+	int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps),
+	struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen),
+	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen),
+	int ATTR_UNUSED(ssl_upstream), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;

libunbound/libworker.h

@@ -1,5 +1,5 @@
 /*
- * libunbound/worker.h - worker thread or process that resolves
+ * libunbound/libworker.h - worker thread or process that resolves
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
@@ -58,7 +58,8 @@ struct comm_reply;
 struct regional;
 struct tube;
 struct sldns_buffer;
-struct event_base;
+struct ub_event_base;
+struct query_info;
 
 /** 
  * The library-worker status structure
@@ -115,7 +116,7 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q);
  * @return new worker or NULL.
  */
 struct libworker* libworker_create_event(struct ub_ctx* ctx,
-	struct event_base* eb);
+	struct ub_event_base* eb);
 
 /**
  * Attach context_query to mesh for callback in event-driven setup.

libunbound/python/Makefile

@@ -36,7 +36,7 @@
 help:
 	@echo "Please use \`make <target>' where <target> is one of"
 	@echo "  testenv   to make test environment and run bash "
-	@echo "            usefull in case you don't want to install unbound but want to test examples"
+	@echo "            useful in case you don't want to install unbound but want to test examples"
 	@echo "  doc       to make documentation"
 	@echo "  clean     clean all"
 
@@ -48,17 +48,14 @@ help:
 #../../.libs/libunbound.so.0:	../../Makefile
 	#$(MAKE) -C ../..
 
-#../../ldns-src/lib/libldns.so:	../../ldns-src/Makefile
-	#$(MAKE) -C ../../ldns-src
-
 clean:
 	rm -rdf examples/unbound
 	rm -f _unbound.so libunbound_wrap.o
 	$(MAKE) -C ../.. clean
 
-testenv: ../../.libs/libunbound.so.2 ../../ldns-src/lib/libldns.so ../../.libs/_unbound.so
+testenv: ../../.libs/libunbound.so.2 ../../.libs/_unbound.so
 	rm -rdf examples/unbound
-	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.2 unbound/libunbound.so.2 && ln -s ../../../../ldns-src/lib/libldns.so.1 unbound/libldns.so.1 && ls -la
+	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.2 unbound/libunbound.so.2 && ls -la
 	cd examples && if test -f ../../../.libs/_unbound.so; then cp ../../../.libs/_unbound.so . ; fi
 	@echo "Run a script by typing ./script_name.py"
 	cd examples && LD_LIBRARY_PATH=unbound bash