1.6.0rc1 tag

git-svn-id: file:///svn/unbound/tags/release-1.6.0rc1@3958 be551aaa-1e26-0410-a405-d3ace91eadb9

.gitattributes

@@ -0,0 +1 @@
+testdata/*.[0-9] linguist-documentation

.gitignore

@@ -0,0 +1,38 @@
+*.lo
+*.o
+/.libs/
+/Makefile
+/autom4te.cache/
+/config.h
+/config.log
+/config.status
+/dnstap/dnstap_config.h
+/doc/example.conf
+/doc/libunbound.3
+/doc/unbound-anchor.8
+/doc/unbound-checkconf.8
+/doc/unbound-control.8
+/doc/unbound-host.1
+/doc/unbound.8
+/doc/unbound.conf.5
+/libtool
+/libunbound.la
+/smallapp/unbound-control-setup.sh
+/unbound
+/unbound-anchor
+/unbound-checkconf
+/unbound-control
+/unbound-control-setup
+/unbound-host
+/unbound.h
+/asynclook
+/delayer
+/lock-verify
+/memstats
+/perf
+/petal
+/pktview
+/streamtcp
+/testbound
+/unittest
+

Makefile.in

@@ -38,6 +38,7 @@ UNBOUND_VERSION_MINOR=@UNBOUND_VERSION_MINOR@
 UNBOUND_VERSION_MICRO=@UNBOUND_VERSION_MICRO@
 ALLTARGET=@ALLTARGET@
 INSTALLTARGET=@INSTALLTARGET@
+SSLLIB=@SSLLIB@
 
 # _unbound.la if pyunbound enabled.
 PYUNBOUND_TARGET=@PYUNBOUND_TARGET@
@@ -53,6 +54,7 @@ LEX=@LEX@
 STRIP=@STRIP@
 CC=@CC@
 CPPFLAGS=-I. @CPPFLAGS@
+PYTHON_CPPFLAGS=-I. @PYTHON_CPPFLAGS@
 CFLAGS=@CFLAGS@
 LDFLAGS=@LDFLAGS@
 LIBS=@LIBS@
@@ -79,7 +81,7 @@ LINTFLAGS+=@NETBSD_LINTFLAGS@
 # compat with OpenBSD
 LINTFLAGS+="-Dsigset_t=long"
 # FreeBSD
-LINTFLAGS+="-D__uint16_t=uint16_t" "-DEVP_PKEY_ASN1_METHOD=int" "-D_RuneLocale=int" "-D__va_list=va_list"
+LINTFLAGS+="-D__uint16_t=uint16_t" "-DEVP_PKEY_ASN1_METHOD=int" "-D_RuneLocale=int" "-D__va_list=va_list" "-D__uint32_t=uint32_t"
 
 INSTALL=$(SHELL) $(srcdir)/install-sh
 
@@ -94,36 +96,38 @@ PYUNBOUND_SRC=
 # libunbound_wrap.lo if python libunbound wrapper enabled.
 PYUNBOUND_OBJ=@PYUNBOUND_OBJ@
 COMMON_SRC=services/cache/dns.c services/cache/infra.c services/cache/rrset.c \
-util/data/dname.c util/data/msgencode.c util/data/msgparse.c \
+util/as112.c util/data/dname.c util/data/msgencode.c util/data/msgparse.c \
 util/data/msgreply.c util/data/packed_rrset.c iterator/iterator.c \
 iterator/iter_delegpt.c iterator/iter_donotq.c iterator/iter_fwd.c \
 iterator/iter_hints.c iterator/iter_priv.c iterator/iter_resptype.c \
 iterator/iter_scrub.c iterator/iter_utils.c services/listen_dnsport.c \
-services/localzone.c services/mesh.c services/modstack.c \
+services/localzone.c services/mesh.c services/modstack.c services/view.c \
 services/outbound_list.c services/outside_network.c util/alloc.c \
 util/config_file.c util/configlexer.c util/configparser.c \
 util/fptr_wlist.c util/locks.c util/log.c util/mini_event.c util/module.c \
 util/netevent.c util/net_help.c util/random.c util/rbtree.c util/regional.c \
 util/rtt.c util/storage/dnstree.c util/storage/lookup3.c \
 util/storage/lruhash.c util/storage/slabhash.c util/timehist.c util/tube.c \
-util/winsock_event.c validator/autotrust.c validator/val_anchor.c \
-validator/validator.c validator/val_kcache.c validator/val_kentry.c \
-validator/val_neg.c validator/val_nsec3.c validator/val_nsec.c \
-validator/val_secalgo.c validator/val_sigcrypt.c \
-validator/val_utils.c dns64/dns64.c $(CHECKLOCK_SRC) $(DNSTAP_SRC)
+util/ub_event.c util/ub_event_pluggable.c util/winsock_event.c \
+validator/autotrust.c validator/val_anchor.c validator/validator.c \
+validator/val_kcache.c validator/val_kentry.c validator/val_neg.c \
+validator/val_nsec3.c validator/val_nsec.c validator/val_secalgo.c \
+validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c cachedb/cachedb.c $(CHECKLOCK_SRC) \
+$(DNSTAP_SRC)
 COMMON_OBJ_WITHOUT_NETCALL=dns.lo infra.lo rrset.lo dname.lo msgencode.lo \
-msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
+as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
 iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
-iter_scrub.lo iter_utils.lo localzone.lo mesh.lo modstack.lo \
+iter_scrub.lo iter_utils.lo localzone.lo mesh.lo modstack.lo view.lo \
 outbound_list.lo alloc.lo config_file.lo configlexer.lo configparser.lo \
 fptr_wlist.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \
 random.lo rbtree.lo regional.lo rtt.lo dnstree.lo lookup3.lo lruhash.lo \
 slabhash.lo timehist.lo tube.lo winsock_event.lo autotrust.lo val_anchor.lo \
 validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
-val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo \
+val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo \
 $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ)
-COMMON_OBJ=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
+COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
 outside_network.lo
+COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
 # set to $COMMON_OBJ or to "" if --enableallsymbols
 COMMON_OBJ_ALL_SYMBOLS=@COMMON_OBJ_ALL_SYMBOLS@
 COMPAT_SRC=compat/ctime_r.c compat/fake-rfc2553.c compat/gmtime_r.c \
@@ -132,7 +136,8 @@ compat/memcmp.c compat/memmove.c compat/snprintf.c compat/strlcat.c \
 compat/strlcpy.c compat/strptime.c compat/getentropy_linux.c \
 compat/getentropy_osx.c compat/getentropy_solaris.c compat/getentropy_win.c \
 compat/explicit_bzero.c compat/arc4random.c compat/arc4random_uniform.c \
-compat/arc4_lock.c compat/sha512.c compat/reallocarray.c
+compat/arc4_lock.c compat/sha512.c compat/reallocarray.c compat/isblank.c \
+compat/strsep.c
 COMPAT_OBJ=$(LIBOBJS:.o=.lo)
 COMPAT_OBJ_WITHOUT_CTIME=$(LIBOBJ_WITHOUT_CTIME:.o=.lo)
 COMPAT_OBJ_WITHOUT_CTIMEARC4=$(LIBOBJ_WITHOUT_CTIMEARC4:.o=.lo)
@@ -175,7 +180,8 @@ daemon/worker.c daemon/acl_list.c daemon/daemon.c daemon/stats.c \
 testcode/replay.c testcode/fake_event.c
 TESTBOUND_OBJ=testbound.lo replay.lo fake_event.lo
 TESTBOUND_OBJ_LINK=$(TESTBOUND_OBJ) testpkts.lo worker.lo acl_list.lo \
-daemon.lo stats.lo $(COMMON_OBJ_WITHOUT_NETCALL) $(SLDNS_OBJ) $(COMPAT_OBJ)
+daemon.lo stats.lo $(COMMON_OBJ_WITHOUT_NETCALL) ub_event.lo $(SLDNS_OBJ) \
+$(COMPAT_OBJ)
 LOCKVERIFY_SRC=testcode/lock_verify.c
 LOCKVERIFY_OBJ=lock_verify.lo
 LOCKVERIFY_OBJ_LINK=$(LOCKVERIFY_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) \
@@ -207,22 +213,22 @@ DELAYER_OBJ_LINK=$(DELAYER_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) \
 $(SLDNS_OBJ)
 LIBUNBOUND_SRC=libunbound/context.c libunbound/libunbound.c \
 libunbound/libworker.c
-LIBUNBOUND_OBJ=context.lo libunbound.lo libworker.lo
-LIBUNBOUND_OBJ_LINK=$(LIBUNBOUND_OBJ) $(COMMON_OBJ) $(SLDNS_OBJ) $(COMPAT_OBJ)
+LIBUNBOUND_OBJ=context.lo libunbound.lo libworker.lo ub_event_pluggable.lo
+LIBUNBOUND_OBJ_LINK=$(LIBUNBOUND_OBJ) $(COMMON_OBJ_WITHOUT_UB_EVENT) $(SLDNS_OBJ) $(COMPAT_OBJ)
 
 # win apps or "" if not on windows
 WINAPPS=@WINAPPS@
 WIN_DAEMON_THE_SRC=winrc/win_svc.c winrc/w_inst.c
 SVCINST_SRC=winrc/unbound-service-install.c
 SVCINST_OBJ=unbound-service-install.lo
-SVCINST_OBJ_LINK=$(SVCINST_OBJ) w_inst.lo rsrc_svcinst.o $(COMPAT_OBJ_WITHOUT_CTIME)
+SVCINST_OBJ_LINK=$(SVCINST_OBJ) w_inst.lo rsrc_svcinst.o $(COMPAT_OBJ_WITHOUT_CTIMEARC4)
 SVCUNINST_SRC=winrc/unbound-service-remove.c
 SVCUNINST_OBJ=unbound-service-remove.lo
 SVCUNINST_OBJ_LINK=$(SVCUNINST_OBJ) w_inst.lo rsrc_svcuninst.o \
-$(COMPAT_OBJ_WITHOUT_CTIME)
+$(COMPAT_OBJ_WITHOUT_CTIMEARC4)
 ANCHORUPD_SRC=winrc/anchor-update.c
 ANCHORUPD_OBJ=anchor-update.lo
-ANCHORUPD_OBJ_LINK=$(ANCHORUPD_OBJ) rsrc_anchorupd.o $(COMPAT_OBJ_WITHOUT_CTIME)
+ANCHORUPD_OBJ_LINK=$(ANCHORUPD_OBJ) rsrc_anchorupd.o $(COMPAT_OBJ_WITHOUT_CTIMEARC4) wire2str.lo str2wire.lo parseutil.lo sbuffer.lo  rrdef.lo keyraw.lo  parse.lo
 RSRC_OBJ=rsrc_svcinst.o rsrc_svcuninst.o rsrc_anchorupd.o rsrc_unbound.o \
 	rsrc_unbound_host.o rsrc_unbound_anchor.o rsrc_unbound_control.o \
 	rsrc_unbound_checkconf.o
@@ -242,7 +248,7 @@ ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \
 	$(COMPAT_OBJ) $(PYUNBOUND_OBJ) \
 	$(SVCINST_OBJ) $(SVCUNINST_OBJ) $(ANCHORUPD_OBJ) $(SLDNS_OBJ)
 
-COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS)
+COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@
 LINK=$(LIBTOOL) --tag=CC --mode=link $(CC) $(staticexe) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS)
 LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) $(staticexe) -version-info @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined
 
@@ -295,22 +301,22 @@ longtest:	tests
 lib:	libunbound.la unbound.h
 
 libunbound.la:	$(LIBUNBOUND_OBJ_LINK)
-	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) -rpath $(libdir) -lssl $(LIBS)
+	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) -rpath $(libdir) $(SSLLIB) $(LIBS)
 
 unbound$(EXEEXT):	$(DAEMON_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
 
 unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
 
 unbound-control$(EXEEXT):	$(CONTROL_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
 
 unbound-host$(EXEEXT):	$(HOST_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(HOST_OBJ_LINK) -L. -L.libs -lunbound $(LIBS)
 
 unbound-anchor$(EXEEXT):	$(UBANCHOR_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(UBANCHOR_OBJ_LINK) -L. -L.libs -lunbound -lexpat -lssl $(LIBS)
+	$(LINK) -o $@ $(UBANCHOR_OBJ_LINK) -L. -L.libs -lunbound -lexpat $(SSLLIB) $(LIBS)
 
 unbound-service-install$(EXEEXT):	$(SVCINST_OBJ_LINK)
 	$(LINK) -o $@ $(SVCINST_OBJ_LINK) $(LIBS)
@@ -322,37 +328,37 @@ anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ANCHORUPD_OBJ_LINK) -L. -L.libs -lunbound $(LIBS)
 
 unittest$(EXEEXT):	$(UNITTEST_OBJ_LINK)
-	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 testbound$(EXEEXT):	$(TESTBOUND_OBJ_LINK)
-	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ_LINK)
-	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 petal$(EXEEXT):	$(PETAL_OBJ_LINK)
-	$(LINK) -o $@ $(PETAL_OBJ_LINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(PETAL_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 pktview$(EXEEXT):	$(PKTVIEW_OBJ_LINK)
-	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 memstats$(EXEEXT):	$(MEMSTATS_OBJ_LINK)
-	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ASYNCLOOK_OBJ_LINK) $(LIBS) -L. -L.libs -lunbound
 
 streamtcp$(EXEEXT):	$(STREAMTCP_OBJ_LINK)
-	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 perf$(EXEEXT):	$(PERF_OBJ_LINK)
-	$(LINK) -o $@ $(PERF_OBJ_LINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 delayer$(EXEEXT):	$(DELAYER_OBJ_LINK)
-	$(LINK) -o $@ $(DELAYER_OBJ_LINK) -lssl $(LIBS)
+	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 signit$(EXEEXT):	testcode/signit.c
-	$(CC) $(CPPFLAGS) $(CFLAGS) -o $@ testcode/signit.c $(LDFLAGS) -lldns -lssl $(LIBS)
+	$(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ -o $@ testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)
 
 unbound.h:	$(srcdir)/libunbound/unbound.h
 	sed -e 's/@''UNBOUND_VERSION_MAJOR@/$(UNBOUND_VERSION_MAJOR)/' -e 's/@''UNBOUND_VERSION_MINOR@/$(UNBOUND_VERSION_MINOR)/' -e 's/@''UNBOUND_VERSION_MICRO@/$(UNBOUND_VERSION_MICRO)/' < $(srcdir)/libunbound/unbound.h > $@
@@ -388,13 +394,13 @@ pythonmod.lo pythonmod.o: $(srcdir)/pythonmod/pythonmod.c config.h \
 
 pythonmod/interface.h:	$(srcdir)/pythonmod/interface.i config.h
 	@-if test ! -d pythonmod; then $(INSTALL) -d pythonmod; fi
-	$(SWIG) $(CPPFLAGS) -o $@ -python $(srcdir)/pythonmod/interface.i
+	$(SWIG) $(PYTHON_CPPFLAGS) -o $@ -python $(srcdir)/pythonmod/interface.i
 
 libunbound_wrap.lo libunbound_wrap.o: libunbound/python/libunbound_wrap.c \
 	unbound.h
 libunbound/python/libunbound_wrap.c:	$(srcdir)/libunbound/python/libunbound.i unbound.h
 	@-if test ! -d libunbound/python; then $(INSTALL) -d libunbound/python; fi
-	$(SWIG) -python -o $@ $(CPPFLAGS) -DPY_MAJOR_VERSION=$(PY_MAJOR_VERSION) $(srcdir)/libunbound/python/libunbound.i
+	$(SWIG) -python -o $@ $(PYTHON_CPPFLAGS) -DPY_MAJOR_VERSION=$(PY_MAJOR_VERSION) $(srcdir)/libunbound/python/libunbound.i
 
 # Pyunbound python unbound wrapper
 _unbound.la:	libunbound_wrap.lo libunbound.la
@@ -505,11 +511,11 @@ install-all:	all $(PYTHONMOD_INSTALL) $(PYUNBOUND_INSTALL) $(UNBOUND_EVENT_INSTA
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man5
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man1
-	$(LIBTOOL) --mode=install cp unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-anchor$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-anchor$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound-anchor$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-anchor$(EXEEXT)
 	$(INSTALL) -c -m 644 doc/unbound.8 $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -c -m 644 doc/unbound-checkconf.8 $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -c -m 644 doc/unbound-control.8 $(DESTDIR)$(mandir)/man8
@@ -550,7 +556,7 @@ uninstall:	$(PYTHONMOD_UNINSTALL) $(PYUNBOUND_UNINSTALL) $(UNBOUND_EVENT_UNINSTA
 	@echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand"
 
 iana_update:
-	curl -o port-numbers.tmp http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml --compressed
+	curl -o port-numbers.tmp https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml --compressed
 	if file port-numbers.tmp | grep 'gzip' >/dev/null; then zcat port-numbers.tmp; else cat port-numbers.tmp; fi | awk '/<record>/ {p=0;} /<protocol>udp/ {p=1;} /<protocol>[^u]/ {p=0;} /Decomissioned|Decommissioned|Removed|De-registered|unassigned|Unassigned|Reserved/ {u=1;} /<number>/ { if(u==1) {u=0;} else { if(p==1) { match($$0,/[0-9]+/); print substr($$0, RSTART, RLENGTH) ","}}}' | sort -nu > util/iana_ports.inc  
 	rm -f port-numbers.tmp
 
@@ -566,7 +572,7 @@ DEPEND_TARGET2=Makefile.in
 # then, remove srcdir from the (generated) parser and lexer.
 # and mention the .lo
 depend:
-	(cd $(srcdir) ; $(CC) $(DEPFLAG) $(CPPFLAGS) $(CFLAGS) $(ALL_SRC) $(COMPAT_SRC)) | \
+	(cd $(srcdir) ; $(CC) $(DEPFLAG) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ $(ALL_SRC) $(COMPAT_SRC)) | \
 		sed -e 's!'$$HOME'[^ ]* !!g' -e 's!'$$HOME'[^ ]*$$!!g' \
 			-e 's!/usr[^ ]* !!g' -e 's!/usr[^ ]*$$!!g' \
 			-e 's!/opt[^ ]* !!g' -e 's!/opt[^ ]*$$!!g' | \
@@ -611,6 +617,7 @@ rrset.lo rrset.o: $(srcdir)/services/cache/rrset.c config.h $(srcdir)/services/c
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/regional.h $(srcdir)/util/alloc.h
+as112.lo as112.o: $(srcdir)/util/as112.c $(srcdir)/util/as112.h
 dname.lo dname.o: $(srcdir)/util/data/dname.c config.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/storage/lookup3.h $(srcdir)/sldns/sbuffer.h
@@ -618,17 +625,20 @@ msgencode.lo msgencode.o: $(srcdir)/util/data/msgencode.c config.h $(srcdir)/uti
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
- $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h $(srcdir)/services/view.h
 msgparse.lo msgparse.o: $(srcdir)/util/data/msgparse.c config.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h \
- $(srcdir)/sldns/wire2str.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
 msgreply.lo msgreply.o: $(srcdir)/util/data/msgreply.c config.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/util/module.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 packed_rrset.lo packed_rrset.o: $(srcdir)/util/data/packed_rrset.c config.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
@@ -644,7 +654,7 @@ iterator.lo iterator.o: $(srcdir)/iterator/iterator.c config.h $(srcdir)/iterato
  $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/config_file.h $(srcdir)/util/random.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h
 iter_delegpt.lo iter_delegpt.o: $(srcdir)/iterator/iter_delegpt.c config.h $(srcdir)/iterator/iter_delegpt.h \
  $(srcdir)/util/log.h $(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h \
@@ -697,25 +707,33 @@ listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h
  $(srcdir)/util/rbtree.h  $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h
 localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h
+ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/data/msgencode.h $(srcdir)/util/net_help.h $(srcdir)/util/netevent.h $(srcdir)/util/as112.h
 mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/dns.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/tube.h $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/util/tube.h $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/data/dname.h
 modstack.lo modstack.o: $(srcdir)/services/modstack.c config.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h
+ $(srcdir)/validator/val_utils.h $(PYTHONMOD_HEADER)
+view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h
 outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h 
@@ -727,8 +745,7 @@ outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c confi
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/dnstap/dnstap.h \
- 
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/dnstap/dnstap.h
 alloc.lo alloc.o: $(srcdir)/util/alloc.c config.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
@@ -753,14 +770,15 @@ fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
  $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h  \
- $(srcdir)/services/localzone.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
- $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h \
- $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h \
- $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_nsec3.h \
+ $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
+ $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h \
+ $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(PYTHONMOD_HEADER)
 locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
 mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
@@ -770,20 +788,18 @@ mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 module.lo module.o: $(srcdir)/util/module.c config.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
-netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/netevent.h $(srcdir)/util/log.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
+netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/netevent.h $(srcdir)/util/ub_event.h \
+ $(srcdir)/util/log.h $(srcdir)/util/net_help.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/dnstap/dnstap.h  \
- $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
+ $(srcdir)/dnstap/dnstap.h 
 net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/sldns/parseutil.h \
- $(srcdir)/sldns/wire2str.h \
- 
+ $(srcdir)/sldns/wire2str.h
 random.lo random.o: $(srcdir)/util/random.c config.h $(srcdir)/util/random.h $(srcdir)/util/log.h
 rbtree.lo rbtree.o: $(srcdir)/util/rbtree.c config.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
@@ -808,7 +824,15 @@ tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/u
  $(srcdir)/util/netevent.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
+ $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/ub_event.h
+ub_event.lo ub_event.o: $(srcdir)/util/ub_event.c config.h $(srcdir)/util/ub_event.h $(srcdir)/util/log.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
+ub_event_pluggable.lo ub_event_pluggable.o: $(srcdir)/util/ub_event_pluggable.c config.h $(srcdir)/util/ub_event.h \
+ $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/netevent.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 winsock_event.lo winsock_event.o: $(srcdir)/util/winsock_event.c config.h
 autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/validator/autotrust.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
@@ -818,13 +842,12 @@ autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/val
  $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/validator/val_kcache.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h \
- 
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h
 val_anchor.lo val_anchor.o: $(srcdir)/validator/val_anchor.c config.h $(srcdir)/validator/val_anchor.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_sigcrypt.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/validator/autotrust.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/util/as112.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
 validator.lo validator.o: $(srcdir)/validator/validator.c config.h $(srcdir)/validator/validator.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
@@ -844,18 +867,16 @@ val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/
 val_kentry.lo val_kentry.o: $(srcdir)/validator/val_kentry.c config.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
- 
-val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h \
- $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
- $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
-val_nsec3.lo val_nsec3.o: $(srcdir)/validator/val_nsec3.c config.h \
- $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/validator.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h
+val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/rbtree.h $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
+val_nsec3.lo val_nsec3.o: $(srcdir)/validator/val_nsec3.c config.h $(srcdir)/validator/val_nsec3.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h $(srcdir)/validator/validator.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
@@ -867,17 +888,15 @@ val_nsec.lo val_nsec.o: $(srcdir)/validator/val_nsec.c config.h $(srcdir)/valida
  $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h
 val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/sldns/sbuffer.h \
- 
+ $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/sbuffer.h
 val_sigcrypt.lo val_sigcrypt.o: $(srcdir)/validator/val_sigcrypt.c config.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h $(srcdir)/validator/validator.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/util/data/dname.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
- 
+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/sldns/keyraw.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
 val_utils.lo val_utils.o: $(srcdir)/validator/val_utils.c config.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
@@ -885,7 +904,7 @@ val_utils.lo val_utils.o: $(srcdir)/validator/val_utils.c config.h $(srcdir)/val
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h \
  $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/regional.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h
 dns64.lo dns64.o: $(srcdir)/dns64/dns64.c config.h $(srcdir)/dns64/dns64.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
@@ -893,13 +912,9 @@ dns64.lo dns64.o: $(srcdir)/dns64/dns64.c config.h $(srcdir)/dns64/dns64.h $(src
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h
+cachedb.lo cachedb.o: $(srcdir)/cachedb/cachedb.c config.h
 checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/checklocks.h
-dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnstap/dnstap.h \
- $(srcdir)/dnstap/dnstap.pb-c.h
-dnstap.pb-c.lo dnstap.pb-c.o: $(srcdir)/dnstap/dnstap.pb-c.c $(srcdir)/dnstap/dnstap.pb-c.h
 unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h
@@ -908,8 +923,7 @@ unitdname.lo unitdname.o: $(srcdir)/testcode/unitdname.c config.h $(srcdir)/util
  $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 unitlruhash.lo unitlruhash.o: $(srcdir)/testcode/unitlruhash.c config.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h
-unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
  $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
@@ -945,50 +959,50 @@ testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcod
 unitldns.lo unitldns.o: $(srcdir)/testcode/unitldns.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
-cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h \
- $(srcdir)/daemon/cachedump.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
-  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/sldns/str2wire.h
-daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
-  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/util/random.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h
-remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
- $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
+cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h $(srcdir)/daemon/cachedump.h \
+ $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
+ $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
+daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/util/random.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h
+remote.lo remote.o: $(srcdir)/daemon/remote.c config.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h \
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
  $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
- $(srcdir)/validator/val_anchor.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_delegpt.h \
- $(srcdir)/services/outside_network.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h \
- $(srcdir)/sldns/wire2str.h
+ $(srcdir)/services/view.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kcache.h \
+ $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_anchor.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/services/outside_network.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
@@ -1002,41 +1016,39 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
  $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
 unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
  $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
- $(srcdir)/daemon/remote.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/mini_event.h \
- $(srcdir)/util/rbtree.h
+ $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/ub_event.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
- $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
  $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/libworker.h
 testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h \
- $(srcdir)/daemon/remote.h \
- $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/util/log.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
+ $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c \
+ $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
   $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rtt.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
+ $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
@@ -1046,31 +1058,33 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
- $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
  $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/libworker.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
-daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
-  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/util/random.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
+daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/util/random.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
@@ -1118,7 +1132,7 @@ unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/localzone.h \
- $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(PYTHONMOD_HEADER)
 worker_cb.lo worker_cb.o: $(srcdir)/smallapp/worker_cb.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
@@ -1130,30 +1144,32 @@ context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbou
  $(srcdir)/libunbound/unbound.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/sldns/sbuffer.h
 libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/libworker.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h \
- $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/sldns/sbuffer.h
-libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h \
- $(srcdir)/libunbound/libworker.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/netevent.h  $(srcdir)/services/mesh.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/util/ub_event.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/sldns/sbuffer.h
+libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/libunbound/libworker.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/libunbound/unbound-event.h $(srcdir)/services/outside_network.h $(srcdir)/util/netevent.h \
+  $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/iterator/iter_hints.h $(srcdir)/sldns/str2wire.h
 unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
@@ -1164,35 +1180,32 @@ streamtcp.lo streamtcp.o: $(srcdir)/testcode/streamtcp.c config.h $(srcdir)/util
  $(srcdir)/util/net_help.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
- 
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 delayer.lo delayer.o: $(srcdir)/testcode/delayer.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
-unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h \
- $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h
+unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h $(srcdir)/util/log.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h
 unbound-anchor.lo unbound-anchor.o: $(srcdir)/smallapp/unbound-anchor.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h \
- 
-petal.lo petal.o: $(srcdir)/testcode/petal.c config.h \
- 
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h
+petal.lo petal.o: $(srcdir)/testcode/petal.c config.h
 pythonmod_utils.lo pythonmod_utils.o: $(srcdir)/pythonmod/pythonmod_utils.c config.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
- $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h \
+ 
 win_svc.lo win_svc.o: $(srcdir)/winrc/win_svc.c config.h $(srcdir)/winrc/win_svc.h $(srcdir)/winrc/w_inst.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
   $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/winsock_event.h
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h $(srcdir)/util/ub_event.h
 w_inst.lo w_inst.o: $(srcdir)/winrc/w_inst.c config.h $(srcdir)/winrc/w_inst.h $(srcdir)/winrc/win_svc.h
 unbound-service-install.lo unbound-service-install.o: $(srcdir)/winrc/unbound-service-install.c config.h \
  $(srcdir)/winrc/w_inst.h
@@ -1200,14 +1213,11 @@ unbound-service-remove.lo unbound-service-remove.o: $(srcdir)/winrc/unbound-serv
  $(srcdir)/winrc/w_inst.h
 anchor-update.lo anchor-update.o: $(srcdir)/winrc/anchor-update.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/wire2str.h
-keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/sldns/rrdef.h \
- 
+keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h $(srcdir)/sldns/rrdef.h
 sbuffer.lo sbuffer.o: $(srcdir)/sldns/sbuffer.c config.h $(srcdir)/sldns/sbuffer.h
 wire2str.lo wire2str.o: $(srcdir)/sldns/wire2str.c config.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/keyraw.h \
- 
+ $(srcdir)/sldns/keyraw.h
 parse.lo parse.o: $(srcdir)/sldns/parse.c config.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h \
  $(srcdir)/sldns/sbuffer.h
 parseutil.lo parseutil.o: $(srcdir)/sldns/parseutil.c config.h $(srcdir)/sldns/parseutil.h
@@ -1227,8 +1237,7 @@ snprintf.lo snprintf.o: $(srcdir)/compat/snprintf.c config.h
 strlcat.lo strlcat.o: $(srcdir)/compat/strlcat.c config.h
 strlcpy.lo strlcpy.o: $(srcdir)/compat/strlcpy.c config.h
 strptime.lo strptime.o: $(srcdir)/compat/strptime.c config.h
-getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h \
- 
+getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h
 getentropy_osx.lo getentropy_osx.o: $(srcdir)/compat/getentropy_osx.c config.h
 getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h
 getentropy_win.lo getentropy_win.o: $(srcdir)/compat/getentropy_win.c
@@ -1238,3 +1247,5 @@ arc4random_uniform.lo arc4random_uniform.o: $(srcdir)/compat/arc4random_uniform.
 arc4_lock.lo arc4_lock.o: $(srcdir)/compat/arc4_lock.c config.h $(srcdir)/util/locks.h
 sha512.lo sha512.o: $(srcdir)/compat/sha512.c config.h
 reallocarray.lo reallocarray.o: $(srcdir)/compat/reallocarray.c config.h
+isblank.lo isblank.o: $(srcdir)/compat/isblank.c config.h
+strsep.lo strsep.o: $(srcdir)/compat/strsep.c config.h

acx_nlnetlabs.m4

@@ -2,7 +2,13 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 28
+# Version 34
+# 2016-03-21 Check -ldl -pthread for libcrypto for ldns and openssl 1.1.0.
+# 2016-03-21 Use HMAC_Update instead of HMAC_CTX_Init (for openssl-1.1.0).
+# 2016-01-04 -D_DEFAULT_SOURCE defined with -D_BSD_SOURCE for Linux glibc 2.20
+# 2015-12-11 FLTO check for new OSX, clang.
+# 2015-11-18 spelling check fix.
+# 2015-11-05 ACX_SSL_CHECKS no longer adds -ldl needlessly.
 # 2015-08-28 ACX_CHECK_PIE and ACX_CHECK_RELRO_NOW added.
 # 2015-03-17 AHX_CONFIG_REALLOCARRAY added
 # 2013-09-19 FLTO help text improved.
@@ -24,7 +30,7 @@
 # 2010-07-02 Add check for ss_family (for minix).
 # 2010-04-26 Fix to use CPPFLAGS for CHECK_COMPILER_FLAGS.
 # 2010-03-01 Fix RPATH using CONFIG_COMMANDS to run at the very end.
-# 2010-02-18 WITH_SSL outputs the LIBSSL_LDFLAGS, LIBS, CPPFLAGS seperate, -ldl
+# 2010-02-18 WITH_SSL outputs the LIBSSL_LDFLAGS, LIBS, CPPFLAGS separate, -ldl
 # 2010-02-01 added ACX_CHECK_MEMCMP_SIGNED, AHX_MEMCMP_BROKEN
 # 2010-01-20 added AHX_COONFIG_STRLCAT
 # 2009-07-14 U_CHAR detection improved for windows crosscompile.
@@ -239,7 +245,7 @@ ACX_CHECK_COMPILER_FLAG(xc99, [C99FLAG="-xc99"])
 
 AC_CHECK_HEADERS([getopt.h time.h],,, [AC_INCLUDES_DEFAULT])
 
-ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE,
+ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE,
 [
 #include "confdefs.h"
 #include <stdlib.h>
@@ -274,9 +280,9 @@ int test() {
 		a = 0;
 	return a;
 }
-], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"])
+], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"])
 
-ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE,
+ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE,
 [
 #include "confdefs.h"
 #include <stdlib.h>
@@ -311,7 +317,7 @@ int test() {
 		a = 0;
 	return a;
 }
-], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE"])
+], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE"])
 
 ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG,
 [
@@ -323,7 +329,7 @@ int test() {
 }
 ], [CFLAGS="$CFLAGS $C99FLAG"])
 
-ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE,
+ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE -D_DEFAULT_SOURCE,
 [
 #include <ctype.h>
 
@@ -332,7 +338,7 @@ int test() {
         a = isascii(32);
         return a;
 }
-], [CFLAGS="$CFLAGS -D_BSD_SOURCE"])
+], [CFLAGS="$CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE"])
 
 ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE,
 [
@@ -421,7 +427,7 @@ AC_DEFUN([ACX_CHECK_FLTO], [
         BAKCFLAGS="$CFLAGS"
         CFLAGS="$CFLAGS -flto"
         AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], [
-            if $CC $CFLAGS -o conftest conftest.c 2>&1 | grep "warning: no debug symbols in executable" >/dev/null; then
+            if $CC $CFLAGS -o conftest conftest.c 2>&1 | $GREP -e "warning: no debug symbols in executable" -e "warning: object" >/dev/null; then
                 CFLAGS="$BAKCFLAGS"
                 AC_MSG_RESULT(no)
             else
@@ -667,16 +673,16 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 ACX_RUNTIME_PATH_ADD([$ssldir/lib])
             fi
         
-            AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
+            AC_MSG_CHECKING([for HMAC_Update in -lcrypto])
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
             AC_TRY_LINK(, [
-                int HMAC_CTX_init(void);
-                (void)HMAC_CTX_init();
+                int HMAC_Update(void);
+                (void)HMAC_Update();
               ], [
                 AC_MSG_RESULT(yes)
-                AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-                          [If you have HMAC_CTX_init])
+                AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
+                          [If you have HMAC_Update])
               ], [
                 AC_MSG_RESULT(no)
                 # check if -lwsock32 or -lgdi32 are needed.	
@@ -686,11 +692,11 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
                 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
                 AC_TRY_LINK([], [
-                    int HMAC_CTX_init(void);
-                    (void)HMAC_CTX_init();
+                    int HMAC_Update(void);
+                    (void)HMAC_Update();
                   ],[
-                    AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-                        [If you have HMAC_CTX_init])
+                    AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
+                        [If you have HMAC_Update])
                     AC_MSG_RESULT(yes) 
                   ],[
                     AC_MSG_RESULT(no)
@@ -700,27 +706,36 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                     LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
                     AC_MSG_CHECKING([if -lcrypto needs -ldl])
                     AC_TRY_LINK([], [
-                        int HMAC_CTX_init(void);
-                        (void)HMAC_CTX_init();
+                        int HMAC_Update(void);
+                        (void)HMAC_Update();
                       ],[
-                        AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-                            [If you have HMAC_CTX_init])
+                        AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
+                            [If you have HMAC_Update])
                         AC_MSG_RESULT(yes) 
                       ],[
                         AC_MSG_RESULT(no)
-                    AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
+                        LIBS="$BAKLIBS"
+                        LIBSSL_LIBS="$BAKSSLLIBS"
+                        LIBS="$LIBS -ldl -pthread"
+                        LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
+                        AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
+                        AC_TRY_LINK([], [
+                            int HMAC_Update(void);
+                            (void)HMAC_Update();
+                          ],[
+                            AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
+                                [If you have HMAC_Update])
+                            AC_MSG_RESULT(yes) 
+                          ],[
+                            AC_MSG_RESULT(no)
+                            AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
+			])
                     ])
                 ])
             ])
         fi
         AC_SUBST(HAVE_SSL)
         AC_SUBST(RUNTIME_PATH)
-	# openssl engine functionality needs dlopen().
-	BAKLIBS="$LIBS"
-	AC_SEARCH_LIBS([dlopen], [dl])
-	if test "$LIBS" != "$BAKLIBS"; then
-		LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
-	fi
     fi
 AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT])
 AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT])
@@ -1288,6 +1303,7 @@ AC_DEFUN([ACX_STRIP_EXT_FLAGS],
   AC_MSG_NOTICE([Stripping extension flags...])
   ACX_CFLAGS_STRIP(-D_GNU_SOURCE)
   ACX_CFLAGS_STRIP(-D_BSD_SOURCE)
+  ACX_CFLAGS_STRIP(-D_DEFAULT_SOURCE)
   ACX_CFLAGS_STRIP(-D__EXTENSIONS__)
   ACX_CFLAGS_STRIP(-D_POSIX_C_SOURCE=200112)
   ACX_CFLAGS_STRIP(-D_XOPEN_SOURCE=600)
@@ -1315,6 +1331,7 @@ dnl config.h part to define omitted cflags, use with ACX_STRIP_EXT_FLAGS.
 AC_DEFUN([AHX_CONFIG_EXT_FLAGS],
 [AHX_CONFIG_FLAG_EXT(-D_GNU_SOURCE)
 AHX_CONFIG_FLAG_EXT(-D_BSD_SOURCE)
+AHX_CONFIG_FLAG_EXT(-D_DEFAULT_SOURCE)
 AHX_CONFIG_FLAG_EXT(-D__EXTENSIONS__)
 AHX_CONFIG_FLAG_EXT(-D_POSIX_C_SOURCE=200112)
 AHX_CONFIG_FLAG_EXT(-D_XOPEN_SOURCE=600)

acx_python.m4

@@ -54,7 +54,7 @@ $ac_distutils_result])
         AC_MSG_CHECKING([for Python library path])
         if test -z "$PYTHON_LDFLAGS"; then
                 PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
-                        print(get_config_var('BLDLIBRARY'));"`
+                        print('-L'+get_config_var('LIBDIR')+' -L'+get_config_var('LIBDEST')+' '+get_config_var('BLDLIBRARY'));"`
         fi
         AC_MSG_RESULT([$PYTHON_LDFLAGS])
         AC_SUBST([PYTHON_LDFLAGS])

ax_pthread.m4

@@ -82,7 +82,7 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 20
+#serial 21
 
 AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD])
 AC_DEFUN([AX_PTHREAD], [
@@ -103,8 +103,8 @@ if test x"$PTHREAD_LIBS$PTHREAD_CFLAGS" != x; then
         save_LIBS="$LIBS"
         LIBS="$PTHREAD_LIBS $LIBS"
         AC_MSG_CHECKING([for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS])
-        AC_TRY_LINK_FUNC(pthread_join, ax_pthread_ok=yes)
-        AC_MSG_RESULT($ax_pthread_ok)
+        AC_TRY_LINK_FUNC([pthread_join], [ax_pthread_ok=yes])
+        AC_MSG_RESULT([$ax_pthread_ok])
         if test x"$ax_pthread_ok" = xno; then
                 PTHREAD_LIBS=""
                 PTHREAD_CFLAGS=""
@@ -164,6 +164,20 @@ case ${host_os} in
         ;;
 esac
 
+# Clang doesn't consider unrecognized options an error unless we specify
+# -Werror. We throw in some extra Clang-specific options to ensure that
+# this doesn't happen for GCC, which also accepts -Werror.
+
+AC_MSG_CHECKING([if compiler needs -Werror to reject unknown flags])
+save_CFLAGS="$CFLAGS"
+ax_pthread_extra_flags="-Werror"
+CFLAGS="$CFLAGS $ax_pthread_extra_flags -Wunknown-warning-option -Wsizeof-array-argument"
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([int foo(void);],[foo()])],
+                  [AC_MSG_RESULT([yes])],
+                  [ax_pthread_extra_flags=
+                   AC_MSG_RESULT([no])])
+CFLAGS="$save_CFLAGS"
+
 if test x"$ax_pthread_ok" = xno; then
 for flag in $ax_pthread_flags; do
 
@@ -178,7 +192,7 @@ for flag in $ax_pthread_flags; do
                 ;;
 
                 pthread-config)
-                AC_CHECK_PROG(ax_pthread_config, pthread-config, yes, no)
+                AC_CHECK_PROG([ax_pthread_config], [pthread-config], [yes], [no])
                 if test x"$ax_pthread_config" = xno; then continue; fi
                 PTHREAD_CFLAGS="`pthread-config --cflags`"
                 PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
@@ -193,7 +207,7 @@ for flag in $ax_pthread_flags; do
         save_LIBS="$LIBS"
         save_CFLAGS="$CFLAGS"
         LIBS="$PTHREAD_LIBS $LIBS"
-        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+        CFLAGS="$CFLAGS $PTHREAD_CFLAGS $ax_pthread_extra_flags"
 
         # Check for various functions.  We must include pthread.h,
         # since some functions may be macros.  (On the Sequent, we
@@ -219,7 +233,7 @@ for flag in $ax_pthread_flags; do
         LIBS="$save_LIBS"
         CFLAGS="$save_CFLAGS"
 
-        AC_MSG_RESULT($ax_pthread_ok)
+        AC_MSG_RESULT([$ax_pthread_ok])
         if test "x$ax_pthread_ok" = xyes; then
                 break;
         fi
@@ -245,9 +259,9 @@ if test "x$ax_pthread_ok" = xyes; then
                 [attr_name=$attr; break],
                 [])
         done
-        AC_MSG_RESULT($attr_name)
+        AC_MSG_RESULT([$attr_name])
         if test "$attr_name" != PTHREAD_CREATE_JOINABLE; then
-            AC_DEFINE_UNQUOTED(PTHREAD_CREATE_JOINABLE, $attr_name,
+            AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE], [$attr_name],
                                [Define to necessary symbol if this constant
                                 uses a non-standard name on your system.])
         fi
@@ -261,24 +275,25 @@ if test "x$ax_pthread_ok" = xyes; then
             if test "$GCC" = "yes"; then
                 flag="-D_REENTRANT"
             else
+                # TODO: What about Clang on Solaris?
                 flag="-mt -D_REENTRANT"
             fi
             ;;
         esac
-        AC_MSG_RESULT(${flag})
+        AC_MSG_RESULT([$flag])
         if test "x$flag" != xno; then
             PTHREAD_CFLAGS="$flag $PTHREAD_CFLAGS"
         fi
 
         AC_CACHE_CHECK([for PTHREAD_PRIO_INHERIT],
-            ax_cv_PTHREAD_PRIO_INHERIT, [
-                AC_LINK_IFELSE([
-                    AC_LANG_PROGRAM([[#include <pthread.h>]], [[int i = PTHREAD_PRIO_INHERIT;]])],
+            [ax_cv_PTHREAD_PRIO_INHERIT], [
+                AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <pthread.h>]],
+                                                [[int i = PTHREAD_PRIO_INHERIT;]])],
                     [ax_cv_PTHREAD_PRIO_INHERIT=yes],
                     [ax_cv_PTHREAD_PRIO_INHERIT=no])
             ])
         AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes"],
-            AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], 1, [Have PTHREAD_PRIO_INHERIT.]))
+            [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.])])
 
         LIBS="$save_LIBS"
         CFLAGS="$save_CFLAGS"
@@ -301,13 +316,13 @@ fi
 
 test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"
 
-AC_SUBST(PTHREAD_LIBS)
-AC_SUBST(PTHREAD_CFLAGS)
-AC_SUBST(PTHREAD_CC)
+AC_SUBST([PTHREAD_LIBS])
+AC_SUBST([PTHREAD_CFLAGS])
+AC_SUBST([PTHREAD_CC])
 
 # Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
 if test x"$ax_pthread_ok" = xyes; then
-        ifelse([$1],,AC_DEFINE(HAVE_PTHREAD,1,[Define if you have POSIX threads libraries and header files.]),[$1])
+        ifelse([$1],,[AC_DEFINE([HAVE_PTHREAD],[1],[Define if you have POSIX threads libraries and header files.])],[$1])
         :
 else
         ax_pthread_ok=no

cachedb/cachedb.c

@@ -0,0 +1,712 @@
+/*
+ * cachedb/cachedb.c - cache from a database external to the program module
+ *
+ * Copyright (c) 2016, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains a module that uses an external database to cache
+ * dns responses.
+ */
+
+#include "config.h"
+#ifdef USE_CACHEDB
+#include "cachedb/cachedb.h"
+#include "util/regional.h"
+#include "util/net_help.h"
+#include "util/config_file.h"
+#include "util/data/msgreply.h"
+#include "util/data/msgencode.h"
+#include "services/cache/dns.h"
+#include "validator/val_neg.h"
+#include "validator/val_secalgo.h"
+#include "iterator/iter_utils.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
+#include "sldns/sbuffer.h"
+
+#define CACHEDB_HASHSIZE 256 /* bit hash */
+
+/** the unit test testframe for cachedb, its module state contains
+ * a cache for a couple queries (in memory). */
+struct testframe_moddata {
+	/** key for single stored data element, NULL if none */
+	char* stored_key;
+	/** data for single stored data element, NULL if none */
+	uint8_t* stored_data;
+	/** length of stored data */
+	size_t stored_datalen;
+};
+
+static int
+testframe_init(struct module_env* env, struct cachedb_env* cachedb_env)
+{
+	(void)env;
+	verbose(VERB_ALGO, "testframe_init");
+	cachedb_env->backend_data = (void*)calloc(1,
+		sizeof(struct testframe_moddata));
+	if(!cachedb_env->backend_data) {
+		log_err("out of memory");
+		return 0;
+	}
+	return 1;
+}
+
+static void
+testframe_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
+{
+	struct testframe_moddata* d = (struct testframe_moddata*)
+		cachedb_env->backend_data;
+	(void)env;
+	verbose(VERB_ALGO, "testframe_deinit");
+	if(!d)
+		return;
+	free(d->stored_key);
+	free(d->stored_data);
+	free(d);
+}
+
+static int
+testframe_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
+	char* key, struct sldns_buffer* result_buffer)
+{
+	struct testframe_moddata* d = (struct testframe_moddata*)
+		cachedb_env->backend_data;
+	(void)env;
+	verbose(VERB_ALGO, "testframe_lookup of %s", key);
+	if(d->stored_key && strcmp(d->stored_key, key) == 0) {
+		if(d->stored_datalen > sldns_buffer_capacity(result_buffer))
+			return 0; /* too large */
+		verbose(VERB_ALGO, "testframe_lookup found %d bytes",
+			(int)d->stored_datalen);
+		sldns_buffer_clear(result_buffer);
+		sldns_buffer_write(result_buffer, d->stored_data,
+			d->stored_datalen);
+		sldns_buffer_flip(result_buffer);
+		return 1;
+	}
+	return 0;
+}
+
+static void
+testframe_store(struct module_env* env, struct cachedb_env* cachedb_env,
+	char* key, uint8_t* data, size_t data_len)
+{
+	struct testframe_moddata* d = (struct testframe_moddata*)
+		cachedb_env->backend_data;
+	(void)env;
+	verbose(VERB_ALGO, "testframe_store %s (%d bytes)", key, (int)data_len);
+
+	/* free old data element (if any) */
+	free(d->stored_key);
+	d->stored_key = NULL;
+	free(d->stored_data);
+	d->stored_data = NULL;
+	d->stored_datalen = 0;
+
+	d->stored_data = memdup(data, data_len);
+	if(!d->stored_data) {
+		log_err("out of memory");
+		return;
+	}
+	d->stored_datalen = data_len;
+	d->stored_key = strdup(key);
+	if(!d->stored_key) {
+		free(d->stored_data);
+		d->stored_data = NULL;
+		d->stored_datalen = 0;
+		return;
+	}
+	/* (key,data) successfully stored */
+}
+
+/** The testframe backend is for unit tests */
+static struct cachedb_backend testframe_backend = { "testframe",
+	testframe_init, testframe_deinit, testframe_lookup, testframe_store
+};
+
+/** find a particular backend from possible backends */
+static struct cachedb_backend*
+cachedb_find_backend(const char* str)
+{
+	if(strcmp(str, testframe_backend.name) == 0)
+		return &testframe_backend;
+	/* TODO add more backends here */
+	return NULL;
+}
+
+/** apply configuration to cachedb module 'global' state */
+static int
+cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
+{
+	const char* backend_str = "testframe"; /* TODO get from cfg */
+	if(backend_str && backend_str[0]) {
+		cachedb_env->backend = cachedb_find_backend(backend_str);
+		if(!cachedb_env->backend) {
+			log_err("cachedb: cannot find backend name '%s",
+				backend_str);
+			return NULL;
+		}
+	}
+	/* TODO see if more configuration needs to be applied or not */
+	return 1;
+}
+
+int 
+cachedb_init(struct module_env* env, int id)
+{
+	struct cachedb_env* cachedb_env = (struct cachedb_env*)calloc(1,
+		sizeof(struct cachedb_env));
+	if(!cachedb_env) {
+		log_err("malloc failure");
+		return 0;
+	}
+	env->modinfo[id] = (void*)cachedb_env;
+	if(!cachedb_apply_cfg(cachedb_env, env->cfg)) {
+		log_err("cachedb: could not apply configuration settings.");
+		return 0;
+	}
+	/* see if a backend is selected */
+	if(!cachedb_env->backend || !cachedb_env->backend->name)
+		return 1;
+	if(!(*cachedb_env->backend->init)(env, cachedb_env)) {
+		log_err("cachedb: could not init %s backend",
+			cachedb_env->backend->name);
+		return 0;
+	}
+	cachedb_env->enabled = 1;
+	return 1;
+}
+
+void 
+cachedb_deinit(struct module_env* env, int id)
+{
+	struct cachedb_env* cachedb_env;
+	if(!env || !env->modinfo[id])
+		return;
+	cachedb_env = (struct cachedb_env*)env->modinfo[id];
+	/* free contents */
+	/* TODO */
+	if(cachedb_env->enabled) {
+		(*cachedb_env->backend->deinit)(env, cachedb_env);
+	}
+
+	free(cachedb_env);
+	env->modinfo[id] = NULL;
+}
+
+/** new query for cachedb */
+static int
+cachedb_new(struct module_qstate* qstate, int id)
+{
+	struct cachedb_qstate* iq = (struct cachedb_qstate*)regional_alloc(
+		qstate->region, sizeof(struct cachedb_qstate));
+	qstate->minfo[id] = iq;
+	if(!iq) 
+		return 0;
+	memset(iq, 0, sizeof(*iq));
+	/* initialise it */
+	/* TODO */
+
+	return 1;
+}
+
+/**
+ * Return an error
+ * @param qstate: our query state
+ * @param id: module id
+ * @param rcode: error code (DNS errcode).
+ * @return: 0 for use by caller, to make notation easy, like:
+ * 	return error_response(..). 
+ */
+static int
+error_response(struct module_qstate* qstate, int id, int rcode)
+{
+	verbose(VERB_QUERY, "return error response %s", 
+		sldns_lookup_by_id(sldns_rcodes, rcode)?
+		sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??");
+	qstate->return_rcode = rcode;
+	qstate->return_msg = NULL;
+	qstate->ext_state[id] = module_finished;
+	return 0;
+}
+
+/**
+ * Hash the query name, type, class and dbacess-secret into lookup buffer.
+ * @param qstate: query state with query info
+ * 	and env->cfg with secret.
+ * @param buf: returned buffer with hash to lookup
+ * @param len: length of the buffer.
+ */
+static void
+calc_hash(struct module_qstate* qstate, char* buf, size_t len)
+{
+	uint8_t clear[1024];
+	size_t clen = 0;
+	uint8_t hash[CACHEDB_HASHSIZE/8];
+	const char* hex = "0123456789ABCDEF";
+	const char* secret = "default"; /* TODO: from qstate->env->cfg */
+	size_t i;
+	
+	/* copy the hash info into the clear buffer */
+	if(clen + qstate->qinfo.qname_len < sizeof(clear)) {
+		memmove(clear+clen, qstate->qinfo.qname,
+			qstate->qinfo.qname_len);
+		clen += qstate->qinfo.qname_len;
+	}
+	if(clen + 4 < sizeof(clear)) {
+		uint16_t t = htons(qstate->qinfo.qtype);
+		uint16_t c = htons(qstate->qinfo.qclass);
+		memmove(clear+clen, &t, 2);
+		memmove(clear+clen+2, &c, 2);
+		clen += 4;
+	}
+	if(secret && secret[0] && clen + strlen(secret) < sizeof(clear)) {
+		memmove(clear+clen, secret, strlen(secret));
+		clen += strlen(secret);
+	}
+	
+	/* hash the buffer */
+	secalgo_hash_sha256(clear, clen, hash);
+	memset(clear, 0, clen);
+
+	/* hex encode output for portability (some online dbs need
+	 * no nulls, no control characters, and so on) */
+	log_assert(len >= sizeof(hash)*2 + 1);
+	(void)len;
+	for(i=0; i<sizeof(hash); i++) {
+		buf[i*2] = hex[(hash[i]&0xf0)>>4];
+		buf[i*2+1] = hex[hash[i]&0x0f];
+	}
+	buf[sizeof(hash)*2] = 0;
+}
+
+/** convert data from return_msg into the data buffer */
+static int
+prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
+{
+	uint64_t timestamp, expiry;
+	size_t oldlim;
+	struct edns_data edns;
+	memset(&edns, 0, sizeof(edns));
+	edns.edns_present = 1;
+	edns.bits = EDNS_DO;
+	edns.ext_rcode = 0;
+	edns.edns_version = EDNS_ADVERTISED_VERSION;
+	edns.udp_size = EDNS_ADVERTISED_SIZE;
+
+	if(!qstate->return_msg || !qstate->return_msg->rep)
+		return 0;
+	if(verbosity >= VERB_ALGO)
+		log_dns_msg("cachedb encoding", &qstate->return_msg->qinfo,
+	                qstate->return_msg->rep);
+	if(!reply_info_answer_encode(&qstate->return_msg->qinfo,
+		qstate->return_msg->rep, 0, qstate->query_flags,
+		buf, 0, 1, qstate->env->scratch, 65535, &edns, 1, 0))
+		return 0;
+
+	/* TTLs in the return_msg are relative to time(0) so we have to
+	 * store that, we also store the smallest ttl in the packet+time(0)
+	 * as the packet expiry time */
+	/* qstate->return_msg->rep->ttl contains that relative shortest ttl */
+	timestamp = (uint64_t)*qstate->env->now;
+	expiry = timestamp + (uint64_t)qstate->return_msg->rep->ttl;
+	timestamp = htobe64(timestamp);
+	expiry = htobe64(expiry);
+	oldlim = sldns_buffer_limit(buf);
+	if(oldlim + sizeof(timestamp)+sizeof(expiry) >=
+		sldns_buffer_capacity(buf))
+		return 0; /* doesn't fit. */
+	sldns_buffer_set_limit(buf, oldlim + sizeof(timestamp)+sizeof(expiry));
+	sldns_buffer_write_at(buf, oldlim, &timestamp, sizeof(timestamp));
+	sldns_buffer_write_at(buf, oldlim+sizeof(timestamp), &expiry,
+		sizeof(expiry));
+
+	return 1;
+}
+
+/** check expiry, return true if matches OK */
+static int
+good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
+{
+	uint64_t expiry;
+	/* the expiry time is the last bytes of the buffer */
+	if(sldns_buffer_limit(buf) < sizeof(expiry))
+		return 0;
+	sldns_buffer_read_at(buf, sldns_buffer_limit(buf)-sizeof(expiry),
+		&expiry, sizeof(expiry));
+	expiry = be64toh(expiry);
+
+	if((time_t)expiry < *qstate->env->now)
+		return 0;
+
+	return 1;
+}
+
+/** convert dns message in buffer to return_msg */
+static int
+parse_data(struct module_qstate* qstate, struct sldns_buffer* buf)
+{
+	struct msg_parse* prs;
+	struct edns_data edns;
+	uint64_t timestamp, expiry;
+	time_t adjust;
+	size_t lim = sldns_buffer_limit(buf);
+	if(lim < LDNS_HEADER_SIZE+sizeof(timestamp)+sizeof(expiry))
+		return 0; /* too short */
+
+	/* remove timestamp and expiry from end */
+	sldns_buffer_read_at(buf, lim-sizeof(expiry), &expiry, sizeof(expiry));
+	sldns_buffer_read_at(buf, lim-sizeof(expiry)-sizeof(timestamp),
+		&timestamp, sizeof(timestamp));
+	expiry = be64toh(expiry);
+	timestamp = be64toh(timestamp);
+
+	/* parse DNS packet */
+	regional_free_all(qstate->env->scratch);
+	prs = (struct msg_parse*)regional_alloc(qstate->env->scratch,
+		sizeof(struct msg_parse));
+	if(!prs)
+		return 0; /* out of memory */
+	memset(prs, 0, sizeof(*prs));
+	memset(&edns, 0, sizeof(edns));
+	sldns_buffer_set_limit(buf, lim - sizeof(expiry)-sizeof(timestamp));
+	if(parse_packet(buf, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) {
+		sldns_buffer_set_limit(buf, lim);
+		return 0;
+	}
+	if(parse_extract_edns(prs, &edns, qstate->env->scratch) !=
+		LDNS_RCODE_NOERROR) {
+		sldns_buffer_set_limit(buf, lim);
+		return 0;
+	}
+
+	qstate->return_msg = dns_alloc_msg(buf, prs, qstate->region);
+	sldns_buffer_set_limit(buf, lim);
+	if(!qstate->return_msg)
+		return 0;
+	
+	qstate->return_rcode = LDNS_RCODE_NOERROR;
+
+	/* see how much of the TTL expired, and remove it */
+	adjust = *qstate->env->now - (time_t)timestamp;
+	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
+	/*adjust_msg(qstate->return_msg, adjust);*/
+	/* TODO:
+		msg->rep->ttl = r->ttl - adjust;
+		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
+		for(i=0; i<d->count + d->rrsig_count; i++) {
+			if(d->rr_ttl[i] < adjust)
+				d->rr_ttl[i] = 0;
+			else    d->rr_ttl[i] -= adjust;
+		}
+		if(d->ttl < adjust)
+			d->ttl = 0;
+		else    d->ttl -= adjust;
+		*/
+	/* TODO */
+
+	return 0;
+}
+
+/**
+ * Lookup the qstate.qinfo in extcache, store in qstate.return_msg.
+ * return true if lookup was successful.
+ */
+static int
+cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie)
+{
+	char key[(CACHEDB_HASHSIZE/8)*2+1];
+	calc_hash(qstate, key, sizeof(key));
+
+	/* call backend to fetch data for key into scratch buffer */
+	if( !(*ie->backend->lookup)(qstate->env, ie, key,
+		qstate->env->scratch_buffer)) {
+		return 0;
+	}
+
+	/* check expiry date and check if query-data matches */
+	if( !good_expiry_and_qinfo(qstate, qstate->env->scratch_buffer) ) {
+		return 0;
+	}
+
+	/* parse dns message into return_msg */
+	if( !parse_data(qstate, qstate->env->scratch_buffer) ) {
+		return 0;
+	}
+	return 1;
+}
+
+/**
+ * Store the qstate.return_msg in extcache for key qstate.info
+ */
+static void
+cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie)
+{
+	char key[(CACHEDB_HASHSIZE/8)*2+1];
+	calc_hash(qstate, key, sizeof(key));
+
+	/* prepare data in scratch buffer */
+	if(!prep_data(qstate, qstate->env->scratch_buffer))
+		return;
+	
+	/* call backend */
+	(*ie->backend->store)(qstate->env, ie, key,
+		sldns_buffer_begin(qstate->env->scratch_buffer),
+		sldns_buffer_limit(qstate->env->scratch_buffer));
+}
+
+/**
+ * See if unbound's internal cache can answer the query
+ */
+static int
+cachedb_intcache_lookup(struct module_qstate* qstate)
+{
+	struct dns_msg* msg;
+	msg = dns_cache_lookup(qstate->env, qstate->qinfo.qname,
+		qstate->qinfo.qname_len, qstate->qinfo.qtype,
+		qstate->qinfo.qclass, qstate->query_flags,
+		qstate->region, qstate->env->scratch);
+	if(!msg && qstate->env->neg_cache) {
+		/* lookup in negative cache; may result in 
+		 * NOERROR/NODATA or NXDOMAIN answers that need validation */
+		msg = val_neg_getmsg(qstate->env->neg_cache, &qstate->qinfo,
+			qstate->region, qstate->env->rrset_cache,
+			qstate->env->scratch_buffer,
+			*qstate->env->now, 1/*add SOA*/, NULL);
+	}
+	if(!msg)
+		return 0;
+	/* this is the returned msg */
+	qstate->return_rcode = LDNS_RCODE_NOERROR;
+	qstate->return_msg = msg;
+	return 1;
+}
+
+/**
+ * Store query into the internal cache of unbound.
+ */
+static void
+cachedb_intcache_store(struct module_qstate* qstate)
+{
+	if(!qstate->return_msg)
+		return;
+	(void)dns_cache_store(qstate->env, &qstate->qinfo,
+		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
+		qstate->region, qstate->query_flags);
+}
+
+/**
+ * Handle a cachedb module event with a query
+ * @param qstate: query state (from the mesh), passed between modules.
+ * 	contains qstate->env module environment with global caches and so on.
+ * @param iq: query state specific for this module.  per-query.
+ * @param ie: environment specific for this module.  global.
+ * @param id: module id.
+ */
+static void
+cachedb_handle_query(struct module_qstate* qstate,
+	struct cachedb_qstate* ATTR_UNUSED(iq),
+	struct cachedb_env* ie, int id)
+{
+	/* check if we are enabled, and skip if so */
+	if(!ie->enabled) {
+		/* pass request to next module */
+		qstate->ext_state[id] = module_wait_module;
+		return;
+	}
+
+	if(qstate->blacklist || qstate->no_cache_lookup) {
+		/* cache is blacklisted or we are instructed from edns to not look */
+		/* pass request to next module */
+		qstate->ext_state[id] = module_wait_module;
+		return;
+	}
+
+	/* lookup inside unbound's internal cache */
+	if(cachedb_intcache_lookup(qstate)) {
+		if(verbosity >= VERB_ALGO) {
+			if(qstate->return_msg->rep)
+				log_dns_msg("cachedb internal cache lookup",
+					&qstate->return_msg->qinfo,
+					qstate->return_msg->rep);
+			else log_info("cachedb internal cache lookup: rcode %s",
+				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)?
+				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)->name:"??");
+		}
+		/* we are done with the query */
+		qstate->ext_state[id] = module_finished;
+		return;
+	}
+
+	/* ask backend cache to see if we have data */
+	if(cachedb_extcache_lookup(qstate, ie)) {
+		if(verbosity >= VERB_ALGO)
+			log_dns_msg(ie->backend->name,
+				&qstate->return_msg->qinfo,
+				qstate->return_msg->rep);
+		/* store this result in internal cache */
+		cachedb_intcache_store(qstate);
+		/* we are done with the query */
+		qstate->ext_state[id] = module_finished;
+		return;
+	}
+
+	/* no cache fetches */
+	/* pass request to next module */
+	qstate->ext_state[id] = module_wait_module;
+}
+
+/**
+ * Handle a cachedb module event with a response from the iterator.
+ * @param qstate: query state (from the mesh), passed between modules.
+ * 	contains qstate->env module environment with global caches and so on.
+ * @param iq: query state specific for this module.  per-query.
+ * @param ie: environment specific for this module.  global.
+ * @param id: module id.
+ */
+static void
+cachedb_handle_response(struct module_qstate* qstate,
+	struct cachedb_qstate* ATTR_UNUSED(iq), struct cachedb_env* ie, int id)
+{
+	/* check if we are not enabled or instructed to not cache, and skip */
+	if(!ie->enabled || qstate->no_cache_store) {
+		/* we are done with the query */
+		qstate->ext_state[id] = module_finished;
+		return;
+	}
+
+	/* store the item into the backend cache */
+	cachedb_extcache_store(qstate, ie);
+
+	/* we are done with the query */
+	qstate->ext_state[id] = module_finished;
+}
+
+void 
+cachedb_operate(struct module_qstate* qstate, enum module_ev event, int id,
+	struct outbound_entry* outbound)
+{
+	struct cachedb_env* ie = (struct cachedb_env*)qstate->env->modinfo[id];
+	struct cachedb_qstate* iq = (struct cachedb_qstate*)qstate->minfo[id];
+	verbose(VERB_QUERY, "cachedb[module %d] operate: extstate:%s event:%s", 
+		id, strextstate(qstate->ext_state[id]), strmodulevent(event));
+	if(iq) log_query_info(VERB_QUERY, "cachedb operate: query", 
+		&qstate->qinfo);
+
+	/* perform cachedb state machine */
+	if((event == module_event_new || event == module_event_pass) && 
+		iq == NULL) {
+		if(!cachedb_new(qstate, id)) {
+			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			return;
+		}
+		iq = (struct cachedb_qstate*)qstate->minfo[id];
+	}
+	if(iq && (event == module_event_pass || event == module_event_new)) {
+		cachedb_handle_query(qstate, iq, ie, id);
+		return;
+	}
+	if(iq && (event == module_event_moddone)) {
+		cachedb_handle_response(qstate, iq, ie, id);
+		return;
+	}
+	if(iq && outbound) {
+		/* cachedb does not need to process responses at this time
+		 * ignore it.
+		cachedb_process_response(qstate, iq, ie, id, outbound, event);
+		*/
+		return;
+	}
+	if(event == module_event_error) {
+		verbose(VERB_ALGO, "got called with event error, giving up");
+		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		return;
+	}
+	if(!iq && (event == module_event_moddone)) {
+		/* during priming, module done but we never started */
+		qstate->ext_state[id] = module_finished;
+		return;
+	}
+
+	log_err("bad event for cachedb");
+	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+}
+
+void
+cachedb_inform_super(struct module_qstate* ATTR_UNUSED(qstate),
+	int ATTR_UNUSED(id), struct module_qstate* ATTR_UNUSED(super))
+{
+	/* cachedb does not use subordinate requests at this time */
+	verbose(VERB_ALGO, "cachedb inform_super was called");
+}
+
+void 
+cachedb_clear(struct module_qstate* qstate, int id)
+{
+	struct cachedb_qstate* iq;
+	if(!qstate)
+		return;
+	iq = (struct cachedb_qstate*)qstate->minfo[id];
+	if(iq) {
+		/* free contents of iq */
+		/* TODO */
+	}
+	qstate->minfo[id] = NULL;
+}
+
+size_t 
+cachedb_get_mem(struct module_env* env, int id)
+{
+	struct cachedb_env* ie = (struct cachedb_env*)env->modinfo[id];
+	if(!ie)
+		return 0;
+	return sizeof(*ie); /* TODO - more mem */
+}
+
+/**
+ * The cachedb function block 
+ */
+static struct module_func_block cachedb_block = {
+	"cachedb",
+	&cachedb_init, &cachedb_deinit, &cachedb_operate,
+	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
+};
+
+struct module_func_block* 
+cachedb_get_funcblock(void)
+{
+	return &cachedb_block;
+}
+#endif /* USE_CACHEDB */

cachedb/cachedb.h

@@ -0,0 +1,110 @@
+/*
+ * cachedb/cachedb.h - cache from a database external to the program module
+ *
+ * Copyright (c) 2016, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains a module that uses an external database to cache
+ * dns responses.
+ */
+#include "util/module.h"
+struct cachedb_backend;
+
+/**
+ * The global variable environment contents for the cachedb
+ * Shared between threads, this represents long term information.
+ * Like database connections.
+ */
+struct cachedb_env {
+	/** true is cachedb is enabled, the backend is turned on */
+	int enabled;
+
+	/** the backend routines */
+	struct cachedb_backend* backend;
+
+	/** backend specific data here */
+	void* backend_data;
+};
+
+/**
+ * Per query state for the cachedb module.
+ */
+struct cachedb_qstate {
+	int todo;
+};
+
+/**
+ * Backend call routines
+ */
+struct cachedb_backend {
+	/** backend name */
+	const char* name;
+
+	/** Init(env, cachedb_env): false on setup failure */
+	int (*init)(struct module_env*, struct cachedb_env*);
+
+	/** Deinit - close db for program exit */
+	void (*deinit)(struct module_env*, struct cachedb_env*);
+
+	/** Lookup (env, cachedb_env, key, result_buffer): true if found */
+	int (*lookup)(struct module_env*, struct cachedb_env*, char*,
+		struct sldns_buffer*);
+	
+	/** Store (env, cachedb_env, key, data, data_len) */
+	void (*store)(struct module_env*, struct cachedb_env*, char*,
+		uint8_t*, size_t);
+};
+
+/** Init the cachedb module */
+int cachedb_init(struct module_env* env, int id);
+/** Deinit the cachedb module */
+void cachedb_deinit(struct module_env* env, int id);
+/** Operate on an event on a query (in qstate). */
+void cachedb_operate(struct module_qstate* qstate, enum module_ev event,
+	int id, struct outbound_entry* outbound);
+/** Subordinate query done, inform this super request of its conclusion */
+void cachedb_inform_super(struct module_qstate* qstate, int id,
+	struct module_qstate* super);
+/** clear the cachedb query-specific contents out of qstate */
+void cachedb_clear(struct module_qstate* qstate, int id);
+/** return memory estimate for cachedb module */
+size_t cachedb_get_mem(struct module_env* env, int id);
+
+/**
+ * Get the function block with pointers to the cachedb functions
+ * @return the function block for "cachedb".
+ */
+struct module_func_block* cachedb_get_funcblock(void);
+

compat/arc4random.c

@@ -26,7 +26,9 @@
 #include <fcntl.h>
 #include <limits.h>
 #include <signal.h>
+#ifdef HAVE_STDINT_H
 #include <stdint.h>
+#endif
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
@@ -46,6 +48,9 @@
 #else				/* !__GNUC__ */
 #define inline
 #endif				/* !__GNUC__ */
+#ifndef MAP_ANON
+#define MAP_ANON MAP_ANONYMOUS
+#endif
 
 #define KEYSZ	32
 #define IVSZ	8

compat/explicit_bzero.c

@@ -6,7 +6,11 @@
 #include "config.h"
 #include <string.h>
 
+#ifdef HAVE_ATTR_WEAK
 __attribute__((weak)) void
+#else
+void
+#endif
 __explicit_bzero_hook(void *ATTR_UNUSED(buf), size_t ATTR_UNUSED(len))
 {
 }

compat/getentropy_linux.c

@@ -46,7 +46,12 @@
 #include <errno.h>
 #include <unistd.h>
 #include <time.h>
+
+#if defined(HAVE_SSL)
 #include <openssl/sha.h>
+#elif defined(HAVE_NETTLE)
+#include <nettle/sha.h>
+#endif
 
 #include <linux/types.h>
 #include <linux/random.h>
@@ -55,6 +60,9 @@
 #include <sys/auxv.h>
 #endif
 #include <sys/vfs.h>
+#ifndef MAP_ANON
+#define MAP_ANON MAP_ANONYMOUS
+#endif
 
 #define REPEAT 5
 #define min(a, b) (((a) < (b)) ? (a) : (b))
@@ -67,9 +75,21 @@
 			HD(b); \
 	} while (0)
 
+#if defined(HAVE_SSL)
+#define CRYPTO_SHA512_CTX		SHA512_CTX
+#define CRYPTO_SHA512_INIT(x)		SHA512_Init(x)
+#define CRYPTO_SHA512_FINAL(r, c)	SHA512_Final(r, c)
 #define HR(x, l) (SHA512_Update(&ctx, (char *)(x), (l)))
 #define HD(x)	 (SHA512_Update(&ctx, (char *)&(x), sizeof (x)))
 #define HF(x)    (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))
+#elif defined(HAVE_NETTLE)
+#define CRYPTO_SHA512_CTX		struct sha512_ctx
+#define CRYPTO_SHA512_INIT(x)		sha512_init(x)
+#define CRYPTO_SHA512_FINAL(r, c)	sha512_digest(c, SHA512_DIGEST_SIZE, r)
+#define HR(x, l) (sha512_update(&ctx, (l), (uint8_t *)(x)))
+#define HD(x)	 (sha512_update(&ctx, sizeof (x), (uint8_t *)&(x)))
+#define HF(x)    (sha512_update(&ctx, sizeof (void*), (uint8_t *)&(x)))
+#endif
 
 int	getentropy(void *buf, size_t len);
 
@@ -77,7 +97,7 @@ int	getentropy(void *buf, size_t len);
 extern int main(int, char *argv[]);
 #endif
 static int gotdata(char *buf, size_t len);
-#ifdef SYS_getrandom
+#if defined(SYS_getrandom) && defined(__NR_getrandom)
 static int getentropy_getrandom(void *buf, size_t len);
 #endif
 static int getentropy_urandom(void *buf, size_t len);
@@ -96,7 +116,7 @@ getentropy(void *buf, size_t len)
 		return -1;
 	}
 
-#ifdef SYS_getrandom
+#if defined(SYS_getrandom) && defined(__NR_getrandom)
 	/*
 	 * Try descriptor-less getrandom()
 	 */
@@ -122,7 +142,7 @@ getentropy(void *buf, size_t len)
 	 * Try to use sysctl CTL_KERN, KERN_RANDOM, RANDOM_UUID.
 	 * sysctl is a failsafe API, so it guarantees a result.  This
 	 * should work inside a chroot, or when file descriptors are
-	 * exhuasted.
+	 * exhausted.
 	 *
 	 * However this can fail if the Linux kernel removes support
 	 * for sysctl.  Starting in 2007, there have been efforts to
@@ -192,7 +212,7 @@ gotdata(char *buf, size_t len)
 	return 0;
 }
 
-#ifdef SYS_getrandom
+#if defined(SYS_getrandom) && defined(__NR_getrandom)
 static int
 getentropy_getrandom(void *buf, size_t len)
 {
@@ -337,7 +357,7 @@ getentropy_fallback(void *buf, size_t len)
 	struct rusage ru;
 	sigset_t sigset;
 	struct stat st;
-	SHA512_CTX ctx;
+	CRYPTO_SHA512_CTX ctx;
 	static pid_t lastpid;
 	pid_t pid;
 	size_t i, ii, m;
@@ -354,7 +374,7 @@ getentropy_fallback(void *buf, size_t len)
 	}
 	for (i = 0; i < len; ) {
 		int j;
-		SHA512_Init(&ctx);
+		CRYPTO_SHA512_INIT(&ctx);
 		for (j = 0; j < repeat; j++) {
 			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
 			if (e != -1) {
@@ -526,7 +546,7 @@ getentropy_fallback(void *buf, size_t len)
 #  endif
 #endif /* HAVE_GETAUXVAL */
 
-		SHA512_Final(results, &ctx);
+		CRYPTO_SHA512_FINAL(results, &ctx);
 		memcpy((char*)buf + i, results, min(sizeof(results), len - i));
 		i += min(sizeof(results), len - i);
 	}

compat/getentropy_solaris.c

@@ -30,7 +30,9 @@
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <stdlib.h>
+#ifdef HAVE_STDINT_H
 #include <stdint.h>
+#endif
 #include <stdio.h>
 #include <termios.h>
 #include <fcntl.h>
@@ -39,10 +41,14 @@
 #include <errno.h>
 #include <unistd.h>
 #include <time.h>
+#ifdef HAVE_SYS_SHA2_H
 #include <sys/sha2.h>
 #define SHA512_Init SHA512Init
 #define SHA512_Update SHA512Update
 #define SHA512_Final SHA512Final
+#else
+#include "openssl/sha.h"
+#endif
 
 #include <sys/vfs.h>
 #include <sys/statfs.h>

compat/isblank.c

@@ -0,0 +1,45 @@
+/* isblank - compatibility implementation of isblank
+ *
+ * Copyright (c) 2015, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+/* return true for a blank character: space or tab */
+int isblank(int c);
+
+/* implementation of isblank. unsigned char is the argument */
+int
+isblank(int c)
+{
+	return (c==' ' || c=='\t');
+}

compat/reallocarray.c

@@ -18,7 +18,10 @@
 #include "config.h"
 #include <sys/types.h>
 #include <errno.h>
+#ifdef HAVE_STDINT_H
 #include <stdint.h>
+#endif
+#include <limits.h>
 #include <stdlib.h>
 
 /*

compat/sha512.c

@@ -70,7 +70,7 @@ unsigned char *SHA512(void *data, unsigned int data_len, unsigned char *digest);
  * Please make sure that your system defines BYTE_ORDER.  If your
  * architecture is little-endian, make sure it also defines
  * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are
- * equivilent.
+ * equivalent.
  *
  * If your system does not define the above, then you can do so by
  * hand like this:

compat/snprintf.c

@@ -42,6 +42,7 @@
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
 #endif
+#include <limits.h>
 
 /* for test */
 /* #define SNPRINTF_TEST 1 */
@@ -428,7 +429,7 @@ print_num_llp(char** at, size_t* left, int* ret, void* value,
 	char buf[PRINT_DEC_BUFSZ];
 	int negative = 0;
 	int zero = (value == 0);
-#if defined(UINTPTR_MAX) && defined(UINT32_MAX) && (UINTPTR_MAX == UINT32_MAX)
+#if defined(SIZE_MAX) && defined(UINT32_MAX) && (UINT32_MAX == SIZE_MAX || INT32_MAX == SIZE_MAX)
 	/* avoid warning about upcast on 32bit systems */
 	unsigned long long llvalue = (unsigned long)value;
 #else

compat/strsep.c

@@ -0,0 +1,65 @@
+/** 
+ * strsep implementation for compatibility.
+ *
+  * LICENSE
+  * Copyright (c) 2016, NLnet Labs
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions are met:
+  * * Redistributions of source code must retain the above copyright notice,
+  *     this list of conditions and the following disclaimer.
+  * * Redistributions in binary form must reproduce the above copyright
+  *   notice, this list of conditions and the following disclaimer in the
+  *   documentation and/or other materials provided with the distribution.
+  * * Neither the name of NLnetLabs nor the names of its
+  *   contributors may be used to endorse or promote products derived from this
+  *   software without specific prior written permission.
+  *
+  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+  * POSSIBILITY OF SUCH DAMAGE.
+ **/
+
+#include "config.h"
+
+/** see if character is in the delimiter array */
+static int
+in_delim(char c, const char* delim)
+{
+	const char* p;
+	if(!delim)
+		return 0;
+	for(p=delim; *p; p++) {
+		if(*p == c)
+			return 1;
+	}
+	return 0;
+}
+
+char *strsep(char **stringp, const char *delim)
+{
+	char* s;
+	char* orig;
+	if(stringp == NULL || *stringp == NULL)
+		return NULL;
+	orig = *stringp;
+	s = *stringp;
+	while(*s && !in_delim(*s, delim))
+		s++;
+	if(*s) {
+		*s = 0;
+		*stringp = s+1;
+	} else {
+		*stringp = NULL;
+	}
+	return orig;
+}

config.h.in

@@ -42,12 +42,18 @@
 /* Whether the C compiler accepts the "unused" attribute */
 #undef HAVE_ATTR_UNUSED
 
+/* Whether the C compiler accepts the "weak" attribute */
+#undef HAVE_ATTR_WEAK
+
 /* Define to 1 if you have the `chown' function. */
 #undef HAVE_CHOWN
 
 /* Define to 1 if you have the `chroot' function. */
 #undef HAVE_CHROOT
 
+/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
+#undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
+
 /* Define to 1 if you have the `ctime_r' function. */
 #undef HAVE_CTIME_R
 
@@ -94,18 +100,34 @@
    don't. */
 #undef HAVE_DECL_STRLCPY
 
+/* Define to 1 if you have the declaration of `XML_StopParser', and to 0 if
+   you don't. */
+#undef HAVE_DECL_XML_STOPPARSER
+
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
+/* Define to 1 if you have the `DSA_SIG_set0' function. */
+#undef HAVE_DSA_SIG_SET0
+
 /* Define to 1 if you have the <endian.h> header file. */
 #undef HAVE_ENDIAN_H
 
 /* Define to 1 if you have the `endprotoent' function. */
 #undef HAVE_ENDPROTOENT
 
+/* Define to 1 if you have the `endpwent' function. */
+#undef HAVE_ENDPWENT
+
 /* Define to 1 if you have the `endservent' function. */
 #undef HAVE_ENDSERVENT
 
+/* Define to 1 if you have the `ERR_free_strings' function. */
+#undef HAVE_ERR_FREE_STRINGS
+
+/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
+#undef HAVE_ERR_LOAD_CRYPTO_STRINGS
+
 /* Define to 1 if you have the `event_base_free' function. */
 #undef HAVE_EVENT_BASE_FREE
 
@@ -121,6 +143,15 @@
 /* Define to 1 if you have the <event.h> header file. */
 #undef HAVE_EVENT_H
 
+/* Define to 1 if you have the `EVP_cleanup' function. */
+#undef HAVE_EVP_CLEANUP
+
+/* Define to 1 if you have the `EVP_dss1' function. */
+#undef HAVE_EVP_DSS1
+
+/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
+#undef HAVE_EVP_MD_CTX_NEW
+
 /* Define to 1 if you have the `EVP_sha1' function. */
 #undef HAVE_EVP_SHA1
 
@@ -151,6 +182,9 @@
 /* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
 #undef HAVE_FSEEKO
 
+/* Define to 1 if you have the `fsync' function. */
+#undef HAVE_FSYNC
+
 /* Whether getaddrinfo is available */
 #undef HAVE_GETADDRINFO
 
@@ -181,8 +215,8 @@
 /* Define to 1 if you have the <grp.h> header file. */
 #undef HAVE_GRP_H
 
-/* If you have HMAC_CTX_init */
-#undef HAVE_HMAC_CTX_INIT
+/* If you have HMAC_Update */
+#undef HAVE_HMAC_UPDATE
 
 /* Define to 1 if you have the `inet_aton' function. */
 #undef HAVE_INET_ATON
@@ -205,6 +239,9 @@
 /* Define to 1 if you have the <iphlpapi.h> header file. */
 #undef HAVE_IPHLPAPI_H
 
+/* Define to 1 if you have the `isblank' function. */
+#undef HAVE_ISBLANK
+
 /* Define to 1 if you have the `kill' function. */
 #undef HAVE_KILL
 
@@ -232,24 +269,54 @@
 /* Define to 1 if you have the <netinet/in.h> header file. */
 #undef HAVE_NETINET_IN_H
 
+/* Define to 1 if you have the <netinet/tcp.h> header file. */
+#undef HAVE_NETINET_TCP_H
+
+/* Use libnettle for crypto */
+#undef HAVE_NETTLE
+
+/* Define to 1 if you have the <nettle/dsa-compat.h> header file. */
+#undef HAVE_NETTLE_DSA_COMPAT_H
+
 /* Use libnss for crypto */
 #undef HAVE_NSS
 
+/* Define to 1 if you have the `OpenSSL_add_all_digests' function. */
+#undef HAVE_OPENSSL_ADD_ALL_DIGESTS
+
+/* Define to 1 if you have the <openssl/bn.h> header file. */
+#undef HAVE_OPENSSL_BN_H
+
 /* Define to 1 if you have the `OPENSSL_config' function. */
 #undef HAVE_OPENSSL_CONFIG
 
 /* Define to 1 if you have the <openssl/conf.h> header file. */
 #undef HAVE_OPENSSL_CONF_H
 
+/* Define to 1 if you have the <openssl/dh.h> header file. */
+#undef HAVE_OPENSSL_DH_H
+
+/* Define to 1 if you have the <openssl/dsa.h> header file. */
+#undef HAVE_OPENSSL_DSA_H
+
 /* Define to 1 if you have the <openssl/engine.h> header file. */
 #undef HAVE_OPENSSL_ENGINE_H
 
 /* Define to 1 if you have the <openssl/err.h> header file. */
 #undef HAVE_OPENSSL_ERR_H
 
+/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
+#undef HAVE_OPENSSL_INIT_CRYPTO
+
+/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
+#undef HAVE_OPENSSL_INIT_SSL
+
 /* Define to 1 if you have the <openssl/rand.h> header file. */
 #undef HAVE_OPENSSL_RAND_H
 
+/* Define to 1 if you have the <openssl/rsa.h> header file. */
+#undef HAVE_OPENSSL_RSA_H
+
 /* Define to 1 if you have the <openssl/ssl.h> header file. */
 #undef HAVE_OPENSSL_SSL_H
 
@@ -274,15 +341,15 @@
 /* Define to 1 if you have the `random' function. */
 #undef HAVE_RANDOM
 
+/* Define to 1 if you have the `RAND_cleanup' function. */
+#undef HAVE_RAND_CLEANUP
+
 /* Define to 1 if you have the `reallocarray' function. */
 #undef HAVE_REALLOCARRAY
 
 /* Define to 1 if you have the `recvmsg' function. */
 #undef HAVE_RECVMSG
 
-/* Define to 1 if you have the `sbrk' function. */
-#undef HAVE_SBRK
-
 /* Define to 1 if you have the `sendmsg' function. */
 #undef HAVE_SENDMSG
 
@@ -331,6 +398,9 @@
 /* Define if you have the SSL libraries installed. */
 #undef HAVE_SSL
 
+/* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
+#undef HAVE_SSL_CTX_SET_SECURITY_LEVEL
+
 /* Define to 1 if you have the <stdarg.h> header file. */
 #undef HAVE_STDARG_H
 
@@ -361,6 +431,9 @@
 /* Define to 1 if you have the `strptime' function. */
 #undef HAVE_STRPTIME
 
+/* Define to 1 if you have the `strsep' function. */
+#undef HAVE_STRSEP
+
 /* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
 #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST
 
@@ -448,8 +521,7 @@
 /* if lex has yylex_destroy */
 #undef LEX_HAS_YYLEX_DESTROY
 
-/* Define to the sub-directory in which libtool stores uninstalled libraries.
-   */
+/* Define to the sub-directory where libtool stores uninstalled libraries. */
 #undef LT_OBJDIR
 
 /* Define to the maximum message length to pass to syslog. */
@@ -471,6 +543,9 @@
 /* Put -D_BSD_SOURCE define in config.h */
 #undef OMITTED__D_BSD_SOURCE
 
+/* Put -D_DEFAULT_SOURCE define in config.h */
+#undef OMITTED__D_DEFAULT_SOURCE
+
 /* Put -D_GNU_SOURCE define in config.h */
 #undef OMITTED__D_GNU_SOURCE
 
@@ -535,6 +610,9 @@
 /* The size of `time_t', as computed by sizeof. */
 #undef SIZEOF_TIME_T
 
+/* define if (v)snprintf does not return length needed, (but length used) */
+#undef SNPRINTF_RET_BROKEN
+
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 
@@ -559,9 +637,15 @@
 /* define this to enable debug checks. */
 #undef UNBOUND_DEBUG
 
+/* Define to 1 to use cachedb support */
+#undef USE_CACHEDB
+
 /* Define to 1 to enable dnstap support */
 #undef USE_DNSTAP
 
+/* Define this to enable DSA support. */
+#undef USE_DSA
+
 /* Define this to enable ECDSA support. */
 #undef USE_ECDSA
 
@@ -574,6 +658,12 @@
 /* Define if you want to use internal select based events */
 #undef USE_MINI_EVENT
 
+/* Define this to enable client TCP Fast Open. */
+#undef USE_MSG_FASTOPEN
+
+/* Define this to enable client TCP Fast Open. */
+#undef USE_OSX_MSG_FASTOPEN
+
 /* Define this to enable SHA256 and SHA512 support. */
 #undef USE_SHA2
 
@@ -599,6 +689,9 @@
 #endif
 
 
+/* Define this to enable server TCP Fast Open. */
+#undef USE_TCP_FASTOPEN
+
 /* Whether the windows socket API is used */
 #undef USE_WINSOCK
 
@@ -722,6 +815,10 @@
 #define _BSD_SOURCE 1
 #endif 
 
+#if defined(OMITTED__D_DEFAULT_SOURCE) && !defined(_DEFAULT_SOURCE)
+#define _DEFAULT_SOURCE 1
+#endif 
+
 #if defined(OMITTED__D__EXTENSIONS__) && !defined(__EXTENSIONS__)
 #define __EXTENSIONS__ 1
 #endif 
@@ -795,6 +892,10 @@
 #include <netinet/in.h>
 #endif
 
+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
@@ -848,15 +949,13 @@
 #define MAXHOSTNAMELEN 256
 #endif
 
-
-#ifndef HAVE_SNPRINTF
+#if !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN)
 #define snprintf snprintf_unbound
 #define vsnprintf vsnprintf_unbound
 #include <stdarg.h>
 int snprintf (char *str, size_t count, const char *fmt, ...);
 int vsnprintf (char *str, size_t count, const char *fmt, va_list arg);
-#endif /* HAVE_SNPRINTF */
-
+#endif /* HAVE_SNPRINTF or SNPRINTF_RET_BROKEN */
 
 #ifndef HAVE_INET_PTON
 #define inet_pton inet_pton_unbound
@@ -952,6 +1051,16 @@ int memcmp(const void *x, const void *y, size_t n);
 char *ctime_r(const time_t *timep, char *buf);
 #endif
 
+#ifndef HAVE_STRSEP
+#define strsep unbound_strsep
+char *strsep(char **stringp, const char *delim);
+#endif
+
+#ifndef HAVE_ISBLANK
+#define isblank unbound_isblank
+int isblank(int c);
+#endif
+
 #if !defined(HAVE_STRPTIME) || !defined(STRPTIME_WORKS)
 #define strptime unbound_strptime
 struct tm;

configure.ac

@@ -9,16 +9,16 @@ sinclude(dnstap/dnstap.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[5])
-m4_define([VERSION_MICRO],[6])
+m4_define([VERSION_MINOR],[6])
+m4_define([VERSION_MICRO],[0])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
-LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=9
-LIBUNBOUND_AGE=3
+LIBUNBOUND_CURRENT=6
+LIBUNBOUND_REVISION=3
+LIBUNBOUND_AGE=4
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
 # 1.0.2 had 0:14:0
@@ -63,6 +63,11 @@ LIBUNBOUND_AGE=3
 # 1.5.4 had 5:7:3
 # 1.5.5 had 5:8:3
 # 1.5.6 had 5:9:3
+# 1.5.7 had 5:10:3
+# 1.5.8 had 6:0:4 # adds ub_ctx_set_stub
+# 1.5.9 had 6:1:4
+# 1.5.10 had 6:2:4
+# 1.6.0 had 6:3:4
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -104,7 +109,7 @@ esac
 # are we on MinGW?
 if uname -s 2>&1 | grep MINGW32 >/dev/null; then on_mingw="yes"
 else 
-	if echo $target | grep mingw32 >/dev/null; then on_mingw="yes"
+	if echo $host $target | grep mingw32 >/dev/null; then on_mingw="yes"
 	else on_mingw="no"; fi
 fi
 
@@ -114,7 +119,7 @@ fi
 if test $on_mingw = "no"; then
   ub_conf_file=`eval echo "${sysconfdir}/unbound/unbound.conf"`
 else
-  ub_conf_file="C:\\Program Files\\Unbound\\service.conf"
+  ub_conf_file="C:\\Program Files (x86)\\Unbound\\service.conf"
 fi
 AC_ARG_WITH([conf_file],
         AC_HELP_STRING([--with-conf-file=path], 
@@ -184,7 +189,7 @@ AC_ARG_WITH(rootkey-file,
 if test $on_mingw = no; then
     UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
 else
-    UNBOUND_ROOTKEY_FILE="C:\\Program Files\\Unbound\\root.key"
+    UNBOUND_ROOTKEY_FILE="C:\\Program Files (x86)\\Unbound\\root.key"
 fi
 )
 AC_SUBST(UNBOUND_ROOTKEY_FILE)
@@ -198,7 +203,7 @@ AC_ARG_WITH(rootcert-file,
 if test $on_mingw = no; then
     UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
 else
-    UNBOUND_ROOTCERT_FILE="C:\\Program Files\\Unbound\\icannbundle.pem"
+    UNBOUND_ROOTCERT_FILE="C:\\Program Files (x86)\\Unbound\\icannbundle.pem"
 fi
 )
 AC_SUBST(UNBOUND_ROOTCERT_FILE)
@@ -255,6 +260,29 @@ AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
 ACX_CHECK_UNUSED_ATTRIBUTE
 
+AC_DEFUN([CHECK_WEAK_ATTRIBUTE],
+[AC_REQUIRE([AC_PROG_CC])
+AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "weak" attribute)
+AC_CACHE_VAL(ac_cv_c_weak_attribute,
+[ac_cv_c_weak_attribute=no
+AC_TRY_COMPILE(
+[ #include <stdio.h>
+__attribute__((weak)) void f(int x) { printf("%d", x); }
+], [
+   f(1);
+],
+[ac_cv_c_weak_attribute="yes"],
+[ac_cv_c_weak_attribute="no"])
+])
+
+AC_MSG_RESULT($ac_cv_c_weak_attribute)
+if test $ac_cv_c_weak_attribute = yes; then
+  AC_DEFINE(HAVE_ATTR_WEAK, 1, [Whether the C compiler accepts the "weak" attribute])
+fi
+])dnl End of CHECK_WEAK_ATTRIBUTE
+
+CHECK_WEAK_ATTRIBUTE
+
 if test "$srcdir" != "."; then
 	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
@@ -275,7 +303,7 @@ AC_CHECK_TOOL(STRIP, strip)
 ACX_LIBTOOL_C_ONLY
 
 # Checks for header files.
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h],,, [AC_INCLUDES_DEFAULT])
 
 # check for types.  
 # Using own tests for int64* because autoconf builtin only give 32bit.
@@ -416,6 +444,36 @@ if test x_$withval != x_no; then
 		CC="$PTHREAD_CC"
 		ub_have_pthreads=yes
 		AC_CHECK_TYPES([pthread_spinlock_t, pthread_rwlock_t],,,[#include <pthread.h>])
+
+		if echo "$CFLAGS" | $GREP -e "-pthread" >/dev/null; then
+		AC_MSG_CHECKING([if -pthread unused during linking])
+		# catch clang warning 'argument unused during compilation'
+		AC_LANG_CONFTEST([AC_LANG_SOURCE(AC_INCLUDES_DEFAULT
+[[
+int main(void) {return 0;}
+]])])
+		pthread_unused="yes"
+		# first compile
+		echo "$CC $CFLAGS -c conftest.c -o conftest.o" >&AS_MESSAGE_LOG_FD
+		$CC $CFLAGS -c conftest.c -o conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
+		if test $? = 0; then 
+			# then link
+			echo "$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest contest.o" >&AS_MESSAGE_LOG_FD
+			$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
+			if test $? -ne 0; then
+				AC_MSG_RESULT(yes)
+				CFLAGS=`echo "$CFLAGS" | sed -e 's/-pthread//'`
+				PTHREAD_CFLAGS_ONLY="-pthread"
+				AC_SUBST(PTHREAD_CFLAGS_ONLY)
+			else
+				AC_MSG_RESULT(no)
+			fi
+		else
+			AC_MSG_RESULT(no)
+		fi # endif cc successful
+		rm -f conftest conftest.c conftest.o
+		fi # endif -pthread in CFLAGS
+
 		])
 fi
 
@@ -486,6 +544,8 @@ if test x_$ub_test_python != x_no; then
       LIBS="$PYTHON_LDFLAGS $LIBS"
       CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
       ub_have_python=yes
+      PC_PY_DEPENDENCY="python"
+      AC_SUBST(PC_PY_DEPENDENCY)
 
       # Check for SWIG
       ub_have_swig=no
@@ -562,13 +622,49 @@ AC_ARG_WITH([nss], AC_HELP_STRING([--with-nss=path],
 		CPPFLAGS="-I/usr/include/nspr4 $CPPFLAGS"
 	fi
         LIBS="$LIBS -lnss3 -lnspr4"
+	SSLLIB=""
+	]
+)
+
+# libnettle
+USE_NETTLE="no"
+AC_ARG_WITH([nettle], AC_HELP_STRING([--with-nettle=path],
+	[use libnettle as crypto library, installed at path.]),
+	[
+	USE_NETTLE="yes"
+	AC_DEFINE(HAVE_NETTLE, 1, [Use libnettle for crypto])
+	AC_CHECK_HEADERS([nettle/dsa-compat.h],,, [AC_INCLUDES_DEFAULT])
+	if test "$withval" != "" -a "$withval" != "yes"; then
+		CPPFLAGS="$CPPFLAGS -I$withval/include/nettle"
+		LDFLAGS="$LDFLAGS -L$withval/lib"
+		ACX_RUNTIME_PATH_ADD([$withval/lib])
+	else
+		CPPFLAGS="$CPPFLAGS -I/usr/include/nettle"
+	fi
+        LIBS="$LIBS -lhogweed -lnettle -lgmp"
+	SSLLIB=""
 	]
 )
 
 # openssl
-if test $USE_NSS = "no"; then
+if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
 ACX_WITH_SSL
 ACX_LIB_SSL
+SSLLIB="-lssl"
+
+# check if -lcrypt32 is needed because CAPIENG needs that. (on windows)
+BAKLIBS="$LIBS"
+LIBS="-lssl $LIBS"
+AC_MSG_CHECKING([if libssl needs -lcrypt32])
+AC_TRY_LINK_FUNC([HMAC_Update], [
+	AC_MSG_RESULT([no])
+	LIBS="$BAKLIBS"
+], [
+	AC_MSG_RESULT([yes])
+	LIBS="$BAKLIBS"
+	LIBS="$LIBS -lcrypt32"
+])
+
 AC_MSG_CHECKING([for LibreSSL])
 if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/null; then
 	AC_MSG_RESULT([yes])
@@ -579,9 +675,15 @@ if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/
 else
 	AC_MSG_RESULT([no])
 fi
-AC_CHECK_HEADERS([openssl/conf.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([openssl/engine.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode])
+AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1])
+
+# these check_funcs need -lssl
+BAKLIBS="$LIBS"
+LIBS="-lssl $LIBS"
+AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level])
+LIBS="$BAKLIBS"
+
 AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_OPENSSL_ERR_H
@@ -603,6 +705,7 @@ AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
 ])
 fi
+AC_SUBST(SSLLIB)
 
 
 AC_ARG_ENABLE(sha2, AC_HELP_STRING([--disable-sha2], [Disable SHA256 and SHA512 RRSIG support]))
@@ -714,7 +817,7 @@ AC_MSG_RESULT($ac_cv_c_gost_works)
 
 AC_ARG_ENABLE(gost, AC_HELP_STRING([--disable-gost], [Disable GOST support]))
 use_gost="no"
-if test $USE_NSS = "no"; then
+if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
 case "$enable_gost" in
 	no)
 	;;
@@ -728,7 +831,7 @@ case "$enable_gost" in
 	fi
 	;;
 esac
-fi dnl !USE_NSS
+fi dnl !USE_NSS && !USE_NETTLE
 
 AC_ARG_ENABLE(ecdsa, AC_HELP_STRING([--disable-ecdsa], [Disable ECDSA support]))
 use_ecdsa="no"
@@ -736,7 +839,7 @@ case "$enable_ecdsa" in
     no)
       ;;
     *)
-      if test $USE_NSS = "no"; then
+      if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
 	      AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
 	      AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
 	      AC_CHECK_DECLS([NID_X9_62_prime256v1, NID_secp384r1], [], [AC_MSG_ERROR([OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa])], [AC_INCLUDES_DEFAULT
@@ -762,16 +865,67 @@ case "$enable_ecdsa" in
       ;;
 esac
 
-AC_ARG_ENABLE(event-api, AC_HELP_STRING([--enable-event-api], [Enable (experimental) libevent-based libunbound API installed to unbound-event.h]))
-use_unbound_event="no"
+AC_ARG_ENABLE(dsa, AC_HELP_STRING([--disable-dsa], [Disable DSA support]))
+use_dsa="no"
+case "$enable_dsa" in
+    no)
+      ;;
+    *)
+      # detect if DSA is supported, and turn it off if not.
+      AC_CHECK_FUNC(DSA_SIG_new, [
+      AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
+      ], [if test "x$enable_dsa" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support DSA and you used --enable-dsa.])
+               fi ])
+      ;;
+esac
+
+
+AC_ARG_ENABLE(event-api, AC_HELP_STRING([--enable-event-api], [Enable (experimental) pluggable event base libunbound API installed to unbound-event.h]))
 case "$enable_event_api" in
     yes)
-      use_unbound_event="yes"
+      AC_SUBST(UNBOUND_EVENT_INSTALL, [unbound-event-install])
+      AC_SUBST(UNBOUND_EVENT_UNINSTALL, [unbound-event-uninstall])
       ;;
     *)
       ;;
 esac
 
+AC_ARG_ENABLE(tfo-client, AC_HELP_STRING([--enable-tfo-client], [Enable TCP Fast Open for client mode]))
+case "$enable_tfo_client" in
+	yes)
+		case `uname` in
+			Linux) AC_CHECK_DECL([MSG_FASTOPEN], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO])],
+			                     [AC_MSG_ERROR([TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client])], 
+			                     [AC_INCLUDES_DEFAULT 
+#include <netinet/tcp.h>
+])
+					AC_DEFINE_UNQUOTED([USE_MSG_FASTOPEN], [1], [Define this to enable client TCP Fast Open.])
+			  ;;
+			Darwin) AC_CHECK_DECL([CONNECT_RESUME_ON_READ_WRITE], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO])], 
+			                      [AC_MSG_ERROR([TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client])], 
+			                      [AC_INCLUDES_DEFAULT
+#include <sys/socket.h>
+])
+					AC_DEFINE_UNQUOTED([USE_OSX_MSG_FASTOPEN], [1], [Define this to enable client TCP Fast Open.])
+			  ;;
+		esac
+	;;
+	no|*)
+		;;
+esac
+
+AC_ARG_ENABLE(tfo-server, AC_HELP_STRING([--enable-tfo-server], [Enable TCP Fast Open for server mode]))
+case "$enable_tfo_server" in
+	yes)
+	      AC_CHECK_DECL([TCP_FASTOPEN], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support server mode TFO])], [AC_MSG_ERROR([TCP Fast Open is not available for server mode: please rerun without --enable-tfo-server])], [AC_INCLUDES_DEFAULT
+#include <netinet/tcp.h>
+	      ])
+		AC_DEFINE_UNQUOTED([USE_TCP_FASTOPEN], [1], [Define this to enable server TCP Fast Open.])
+		;;
+	no|*)
+		;;
+esac
+
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
     [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
@@ -849,13 +1003,11 @@ large outgoing port ranges.  ])
 	AC_CHECK_FUNCS([event_base_get_method]) # only in libevent 1.4.3 and later
 	AC_CHECK_FUNCS([ev_loop]) # only in libev. (tested on 3.51)
 	AC_CHECK_FUNCS([ev_default_loop]) # only in libev. (tested on 4.00)
+        PC_LIBEVENT_DEPENDENCY="libevent"
+        AC_SUBST(PC_LIBEVENT_DEPENDENCY)
 	if test -n "$BAK_LDFLAGS_SET"; then
 		LDFLAGS="$BAK_LDFLAGS"
 	fi
-        if test "$use_unbound_event" = "yes"; then
-		AC_SUBST(UNBOUND_EVENT_INSTALL, [unbound-event-install])
-		AC_SUBST(UNBOUND_EVENT_UNINSTALL, [unbound-event-uninstall])
-	fi
 else
 	AC_DEFINE(USE_MINI_EVENT, 1, [Define if you want to use internal select based events])
 fi
@@ -882,6 +1034,9 @@ if test x_$found_libexpat != x_yes; then
 	AC_ERROR([Could not find libexpat, expat.h])
 fi
 AC_CHECK_HEADERS([expat.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_DECLS([XML_StopParser], [], [], [AC_INCLUDES_DEFAULT
+#include <expat.h>
+])
 
 # set static linking if requested
 AC_SUBST(staticexe)
@@ -893,10 +1048,8 @@ if test x_$enable_static_exe = x_yes; then
 	staticexe="-static"
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
-		# for static crosscompile, include gdi32 and zlib here.
-		if test "`uname`" = "Linux"; then
-			LIBS="$LIBS -lgdi32 -lz"
-		fi
+		# for static compile, include gdi32 and zlib here.
+		LIBS="$LIBS -lgdi32 -lz"
 	fi
 fi
 
@@ -973,6 +1126,10 @@ AC_INCLUDES_DEFAULT
 #include <netinet/in.h>
 #endif
 
+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
@@ -986,7 +1143,7 @@ AC_INCLUDES_DEFAULT
 #endif
 ])
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
 AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
@@ -998,10 +1155,25 @@ AC_REPLACE_FUNCS(inet_aton)
 AC_REPLACE_FUNCS(inet_pton)
 AC_REPLACE_FUNCS(inet_ntop)
 AC_REPLACE_FUNCS(snprintf)
+# test if snprintf return the proper length
+if test "x$ac_cv_func_snprintf" = xyes; then
+    if test c${cross_compiling} = cno; then
+	AC_MSG_CHECKING([for correct snprintf return value])
+	AC_RUN_IFELSE([AC_LANG_SOURCE(AC_INCLUDES_DEFAULT
+[[
+int main(void) { return !(snprintf(NULL, 0, "test") == 4); }
+]])], [AC_MSG_RESULT(yes)], [
+		AC_MSG_RESULT(no)
+		AC_DEFINE([SNPRINTF_RET_BROKEN], [], [define if (v)snprintf does not return length needed, (but length used)])
+		AC_LIBOBJ(snprintf)
+	  ])
+    fi
+fi
 AC_REPLACE_FUNCS(strlcat)
 AC_REPLACE_FUNCS(strlcpy)
 AC_REPLACE_FUNCS(memmove)
 AC_REPLACE_FUNCS(gmtime_r)
+AC_REPLACE_FUNCS(isblank)
 dnl without CTIME, ARC4-functions and without reallocarray.
 LIBOBJ_WITHOUT_CTIMEARC4="$LIBOBJS"
 AC_SUBST(LIBOBJ_WITHOUT_CTIMEARC4)
@@ -1051,6 +1223,7 @@ fi
 LIBOBJ_WITHOUT_CTIME="$LIBOBJS"
 AC_SUBST(LIBOBJ_WITHOUT_CTIME)
 AC_REPLACE_FUNCS(ctime_r)
+AC_REPLACE_FUNCS(strsep)
 
 AC_ARG_ENABLE(allsymbols, AC_HELP_STRING([--enable-allsymbols], [export all symbols from libunbound and link binaries to it, smaller install size but libunbound export table is polluted by internal symbols]))
 case "$enable_allsymbols" in
@@ -1103,6 +1276,17 @@ dt_DNSTAP([$UNBOUND_RUN_DIR/dnstap.sock],
     ]
 )
 
+# check for cachedb if requested
+AC_ARG_ENABLE(cachedb, AC_HELP_STRING([--enable-cachedb], [enable cachedb module that can use external cache storage]))
+case "$enable_cachedb" in
+    yes)
+    	AC_DEFINE([USE_CACHEDB], [1], [Define to 1 to use cachedb support])
+    	;;
+    no|*)
+    	# nothing
+    	;;
+esac
+
 AC_MSG_CHECKING([if ${MAKE:-make} supports $< with implicit rule in scope])
 # on openBSD, the implicit rule make $< work.
 # on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
@@ -1209,6 +1393,10 @@ dnl includes
 #include <netinet/in.h>
 #endif
 
+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
@@ -1236,7 +1424,13 @@ AHX_CONFIG_FORMAT_ATTRIBUTE
 AHX_CONFIG_UNUSED_ATTRIBUTE
 AHX_CONFIG_FSEEKO
 AHX_CONFIG_MAXHOSTNAMELEN
-AHX_CONFIG_SNPRINTF(unbound)
+#if !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN)
+#define snprintf snprintf_unbound
+#define vsnprintf vsnprintf_unbound
+#include <stdarg.h>
+int snprintf (char *str, size_t count, const char *fmt, ...);
+int vsnprintf (char *str, size_t count, const char *fmt, va_list arg);
+#endif /* HAVE_SNPRINTF or SNPRINTF_RET_BROKEN */
 AHX_CONFIG_INET_PTON(unbound)
 AHX_CONFIG_INET_NTOP(unbound)
 AHX_CONFIG_INET_ATON(unbound)
@@ -1259,6 +1453,16 @@ AHX_MEMCMP_BROKEN(unbound)
 char *ctime_r(const time_t *timep, char *buf);
 #endif
 
+#ifndef HAVE_STRSEP
+#define strsep unbound_strsep
+char *strsep(char **stringp, const char *delim);
+#endif
+
+#ifndef HAVE_ISBLANK
+#define isblank unbound_isblank
+int isblank(int c);
+#endif
+
 #if !defined(HAVE_STRPTIME) || !defined(STRPTIME_WORKS)
 #define strptime unbound_strptime
 struct tm;
@@ -1367,6 +1571,6 @@ dnl if this is a distro tarball, that was already done by makedist.sh
 AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AC_SUBST(date, [`date +'%b %e, %Y'`])
 
-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h contrib/libunbound.pc])
 AC_CONFIG_HEADER([config.h])
 AC_OUTPUT

contrib/aaaa-filter-iterator.patch

@@ -1,8 +1,10 @@
---- unbound-1.4.17.orig/doc/unbound.conf.5.in
-+++ unbound-1.4.17/doc/unbound.conf.5.in
-@@ -519,6 +519,13 @@ authority servers and checks if the repl
- Disabled by default. 
- This feature is an experimental implementation of draft dns\-0x20.
+Index: trunk/doc/unbound.conf.5.in
+===================================================================
+--- trunk/doc/unbound.conf.5.in	(revision 3587)
++++ trunk/doc/unbound.conf.5.in	(working copy)
+@@ -593,6 +593,13 @@
+ possible. Best effort approach, full QNAME and original QTYPE will be sent when
+ upstream replies with a RCODE other than NOERROR. Default is off.
  .TP
 +.B aaaa\-filter: \fI<yes or no>
 +Activate behavior similar to BIND's AAAA-filter.
@@ -13,20 +15,12 @@
 +.TP
  .B private\-address: \fI<IP address or subnet>
  Give IPv4 of IPv6 addresses or classless subnets. These are addresses
- on your private network, and are not allowed to be returned for public
---- unbound-1.4.17.orig/util/config_file.c
-+++ unbound-1.4.17/util/config_file.c
-@@ -160,6 +160,7 @@ config_create(void)
- 	cfg->harden_below_nxdomain = 0;
- 	cfg->harden_referral_path = 0;
- 	cfg->use_caps_bits_for_id = 0;
-+	cfg->aaaa_filter = 0; /* ASN: default is disabled */
- 	cfg->private_address = NULL;
- 	cfg->private_domain = NULL;
- 	cfg->unwanted_threshold = 0;
---- unbound-1.4.17.orig/iterator/iter_scrub.c
-+++ unbound-1.4.17/iterator/iter_scrub.c
-@@ -580,6 +580,32 @@ static int sanitize_nsec_is_overreach(st
+ on your private network, and are not allowed to be returned for
+Index: trunk/iterator/iter_scrub.c
+===================================================================
+--- trunk/iterator/iter_scrub.c	(revision 3587)
++++ trunk/iterator/iter_scrub.c	(working copy)
+@@ -617,6 +617,32 @@
  }
  
  /**
@@ -38,7 +32,7 @@
 + */
 +static int
 +asn_lookup_a_record_from_cache(struct query_info* qinfo,
-+	struct module_env* env, struct iter_env* ie)
++	struct module_env* env, struct iter_env* ATTR_UNUSED(ie))
 +{
 +	struct ub_packed_rrset_key* akey;
 +
@@ -59,7 +53,7 @@
   * Given a response event, remove suspect RRsets from the response.
   * "Suspect" rrsets are potentially poison. Note that this routine expects
   * the response to be in a "normalized" state -- that is, all "irrelevant"
-@@ -598,6 +625,7 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -635,6 +661,7 @@
  	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
  	struct iter_env* ie)
  {
@@ -67,7 +61,7 @@
  	int del_addi = 0; /* if additional-holding rrsets are deleted, we
  		do not trust the normalized additional-A-AAAA any more */
  	struct rrset_parse* rrset, *prev;
-@@ -633,6 +661,13 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -670,6 +697,13 @@
  		rrset = rrset->rrset_all_next;
  	}
  
@@ -81,7 +75,7 @@
  	/* At this point, we brutally remove ALL rrsets that aren't 
  	 * children of the originating zone. The idea here is that, 
  	 * as far as we know, the server that we contacted is ONLY 
-@@ -644,6 +679,24 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -681,6 +715,24 @@
  	rrset = msg->rrset_first;
  	while(rrset) {
  
@@ -105,10 +99,24 @@
 +
  		/* remove private addresses */
  		if( (rrset->type == LDNS_RR_TYPE_A || 
- 			rrset->type == LDNS_RR_TYPE_AAAA) &&
---- unbound-1.4.17.orig/iterator/iterator.c
-+++ unbound-1.4.17/iterator/iterator.c
-@@ -1579,6 +1579,53 @@ processDSNSFind(struct module_qstate* qs
+ 			rrset->type == LDNS_RR_TYPE_AAAA)) {
+Index: trunk/iterator/iter_utils.c
+===================================================================
+--- trunk/iterator/iter_utils.c	(revision 3587)
++++ trunk/iterator/iter_utils.c	(working copy)
+@@ -175,6 +175,7 @@
+ 	}
+ 	iter_env->supports_ipv6 = cfg->do_ip6;
+ 	iter_env->supports_ipv4 = cfg->do_ip4;
++	iter_env->aaaa_filter = cfg->aaaa_filter;
+ 	return 1;
+ }
+ 
+Index: trunk/iterator/iterator.c
+===================================================================
+--- trunk/iterator/iterator.c	(revision 3587)
++++ trunk/iterator/iterator.c	(working copy)
+@@ -1776,6 +1776,53 @@
  
  	return 0;
  }
@@ -128,7 +136,7 @@
 + */
 +static int
 +asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
-+	struct iter_env* ie, int id)
++	struct iter_env* ATTR_UNUSED(ie), int id)
 +{
 +	struct module_qstate* subq = NULL;
 +
@@ -162,7 +170,7 @@
  	
  /** 
   * This is the request event state where the request will be sent to one of
-@@ -1626,6 +1673,13 @@ processQueryTargets(struct module_qstate
+@@ -1823,6 +1870,13 @@
  		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
  	}
  	
@@ -176,7 +184,7 @@
  	/* Make sure we have a delegation point, otherwise priming failed
  	 * or another failure occurred */
  	if(!iq->dp) {
-@@ -2568,6 +2622,62 @@ processFinished(struct module_qstate* qs
+@@ -2922,6 +2976,61 @@
  	return 0;
  }
  
@@ -195,9 +203,8 @@
 +asn_processAAAAResponse(struct module_qstate* qstate, int id,
 +	struct module_qstate* super)
 +{
-+	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
++	/*struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];*/
 +	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
-+	struct ub_packed_rrset_key* rrset;
 +	struct delegpt_ns* dpns = NULL;
 +	int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
 +
@@ -239,7 +246,7 @@
  /*
   * Return priming query results to interestes super querystates.
   * 
-@@ -2587,6 +2697,9 @@ iter_inform_super(struct module_qstate*
+@@ -2941,6 +3050,9 @@
  	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
  		super->minfo[id])->state == DSNS_FIND_STATE)
  		processDSNSResponse(qstate, id, super);
@@ -249,7 +256,7 @@
  	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
  		error_supers(qstate, id, super);
  	else if(qstate->is_priming)
-@@ -2624,6 +2737,9 @@ iter_handle(struct module_qstate* qstate
+@@ -2978,6 +3090,9 @@
  			case INIT_REQUEST_3_STATE:
  				cont = processInitRequest3(qstate, iq, id);
  				break;
@@ -259,7 +266,7 @@
  			case QUERYTARGETS_STATE:
  				cont = processQueryTargets(qstate, iq, ie, id);
  				break;
-@@ -2863,6 +2979,8 @@ iter_state_to_string(enum iter_state sta
+@@ -3270,6 +3385,8 @@
  		return "INIT REQUEST STATE (stage 2)";
  	case INIT_REQUEST_3_STATE:
  		return "INIT REQUEST STATE (stage 3)";
@@ -268,7 +275,7 @@
  	case QUERYTARGETS_STATE :
  		return "QUERY TARGETS STATE";
  	case PRIME_RESP_STATE :
-@@ -2887,6 +3005,7 @@ iter_state_is_responsestate(enum iter_st
+@@ -3294,6 +3411,7 @@
  		case INIT_REQUEST_STATE :
  		case INIT_REQUEST_2_STATE :
  		case INIT_REQUEST_3_STATE :
@@ -276,29 +283,21 @@
  		case QUERYTARGETS_STATE :
  		case COLLECT_CLASS_STATE :
  			return 0;
---- unbound-1.4.17.orig/iterator/iter_utils.c
-+++ unbound-1.4.17/iterator/iter_utils.c
-@@ -128,6 +128,7 @@ iter_apply_cfg(struct iter_env* iter_env
- 	}
- 	iter_env->supports_ipv6 = cfg->do_ip6;
- 	iter_env->supports_ipv4 = cfg->do_ip4;
-+	iter_env->aaaa_filter = cfg->aaaa_filter;
- 	return 1;
- }
- 
---- unbound-1.4.17.orig/iterator/iterator.h
-+++ unbound-1.4.17/iterator/iterator.h
-@@ -110,6 +110,9 @@ struct iter_env {
- 	 * array of max_dependency_depth+1 size.
+Index: trunk/iterator/iterator.h
+===================================================================
+--- trunk/iterator/iterator.h	(revision 3587)
++++ trunk/iterator/iterator.h	(working copy)
+@@ -113,6 +113,9 @@
  	 */
  	int* target_fetch_policy;
-+
+ 
 +	/** ASN: AAAA-filter flag */
 +	int aaaa_filter;
++
+ 	/** ip6.arpa dname in wireformat, used for qname-minimisation */
+ 	uint8_t* ip6arpa_dname;
  };
- 
- /**
-@@ -135,6 +138,14 @@ enum iter_state {
+@@ -163,6 +166,14 @@
  	INIT_REQUEST_3_STATE,
  
  	/**
@@ -313,7 +312,7 @@
  	 * Each time a delegation point changes for a given query or a 
  	 * query times out and/or wakes up, this state is (re)visited. 
  	 * This state is reponsible for iterating through a list of 
-@@ -309,6 +320,13 @@ struct iter_qstate {
+@@ -346,6 +357,13 @@
  	 */
  	int refetch_glue;
  
@@ -326,31 +325,61 @@
 +
  	/** list of pending queries to authoritative servers. */
  	struct outbound_list outlist;
- };
---- unbound-1.4.17.orig/util/config_file.h
-+++ unbound-1.4.17/util/config_file.h
-@@ -169,6 +169,8 @@ struct config_file {
- 	int harden_referral_path;
+ 
+Index: trunk/pythonmod/interface.i
+===================================================================
+--- trunk/pythonmod/interface.i	(revision 3587)
++++ trunk/pythonmod/interface.i	(working copy)
+@@ -632,6 +632,7 @@
+    int harden_dnssec_stripped;
+    int harden_referral_path;
+    int use_caps_bits_for_id;
++   int aaaa_filter; /* ASN */
+    struct config_strlist* private_address;
+    struct config_strlist* private_domain;
+    size_t unwanted_threshold;
+Index: trunk/util/config_file.c
+===================================================================
+--- trunk/util/config_file.c	(revision 3587)
++++ trunk/util/config_file.c	(working copy)
+@@ -176,6 +176,7 @@
+ 	cfg->harden_referral_path = 0;
+ 	cfg->harden_algo_downgrade = 0;
+ 	cfg->use_caps_bits_for_id = 0;
++	cfg->aaaa_filter = 0; /* ASN: default is disabled */
+ 	cfg->caps_whitelist = NULL;
+ 	cfg->private_address = NULL;
+ 	cfg->private_domain = NULL;
+Index: trunk/util/config_file.h
+===================================================================
+--- trunk/util/config_file.h	(revision 3587)
++++ trunk/util/config_file.h	(working copy)
+@@ -179,6 +179,8 @@
+ 	int harden_algo_downgrade;
  	/** use 0x20 bits in query as random ID bits */
  	int use_caps_bits_for_id;
 +	/** ASN: enable AAAA filter? */
 +	int aaaa_filter;
+ 	/** 0x20 whitelist, domains that do not use capsforid */
+ 	struct config_strlist* caps_whitelist;
  	/** strip away these private addrs from answers, no DNS Rebinding */
- 	struct config_strlist* private_address;
- 	/** allow domain (and subdomains) to use private address space */
---- unbound-1.4.17.orig/util/configlexer.lex
-+++ unbound-1.4.17/util/configlexer.lex
-@@ -177,6 +177,7 @@ harden-below-nxdomain{COLON}	{ YDVAR(1,
- harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+Index: trunk/util/configlexer.lex
+===================================================================
+--- trunk/util/configlexer.lex	(revision 3587)
++++ trunk/util/configlexer.lex	(working copy)
+@@ -267,6 +267,7 @@
  use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+ caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
  unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 +aaaa-filter{COLON}		{ YDVAR(1, VAR_AAAA_FILTER) }
  private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
  private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
  prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
---- unbound-1.4.17.orig/util/configparser.y
-+++ unbound-1.4.17/util/configparser.y
-@@ -92,6 +92,7 @@ extern struct config_parser_state* cfg_p
+Index: trunk/util/configparser.y
+===================================================================
+--- trunk/util/configparser.y	(revision 3587)
++++ trunk/util/configparser.y	(working copy)
+@@ -92,6 +92,7 @@
  %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
  %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
  %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
@@ -358,7 +387,7 @@
  %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
  %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
  %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -151,6 +152,7 @@ content_server: server_num_threads | ser
+@@ -169,6 +170,7 @@
  	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
  	server_harden_referral_path | server_private_address |
  	server_private_domain | server_extended_statistics | 
@@ -366,8 +395,8 @@
  	server_local_data_ptr | server_jostle_timeout | 
  	server_unwanted_reply_threshold | server_log_time_ascii | 
  	server_domain_insecure | server_val_sig_skew_min | 
-@@ -802,6 +803,15 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR
- 		free($2);
+@@ -893,6 +895,15 @@
+ 			yyerror("out of memory");
  	}
  	;
 +server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
@@ -382,13 +411,3 @@
  server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
  	{
  		OUTYY(("P(server_private_address:%s)\n", $2));
---- unbound-1.4.17.orig/pythonmod/interface.i
-+++ unbound-1.4.17/pythonmod/interface.i
-@@ -626,6 +626,7 @@ struct config_file {
-    int harden_dnssec_stripped;
-    int harden_referral_path;
-    int use_caps_bits_for_id;
-+   int aaaa_filter; /* ASN */
-    struct config_strlist* private_address;
-    struct config_strlist* private_domain;
-    size_t unwanted_threshold;

contrib/create_unbound_ad_servers.cmd

@@ -1,33 +1,33 @@
-@Echo off
-rem Convert the Yoyo.org anti-ad server listing
-rem into an unbound dns spoof redirection list.
-rem Written by Y.Voinov (c) 2014
-
-rem Note: Wget required!
-
-rem Variables
-set prefix="C:\Program Files (x86)"
-set dst_dir=%prefix%\Unbound
-set work_dir=%TEMP%
-set list_addr="http://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml&showintro=1&startdate%5Bday%5D=&startdate%5Bmonth%5D=&startdate%5Byear%5D="
-
-rem Check Wget installed
-for /f "delims=" %%a in ('where wget') do @set wget=%%a
-if /I "%wget%"=="" echo Wget not found. If installed, add path to PATH environment variable. & exit 1
-echo Wget found: %wget%
-
-"%wget%" -O %work_dir%\yoyo_ad_servers %list_addr%
-
-del /Q /F /S %dst_dir%\unbound_ad_servers
-
-for /F "eol=; tokens=*" %%a in (%work_dir%\yoyo_ad_servers) do (
-echo local-zone: %%a redirect>>%dst_dir%\unbound_ad_servers
-echo local-data: "%%a A 127.0.0.1">>%dst_dir%\unbound_ad_servers
-)
-
-echo Done.
-rem  then add an include line to your unbound.conf pointing to the full path of
-rem  the unbound_ad_servers file:
-rem
-rem   include: $dst_dir/unbound_ad_servers
-rem
+@Echo off
+rem Convert the Yoyo.org anti-ad server listing
+rem into an unbound dns spoof redirection list.
+rem Written by Y.Voinov (c) 2014
+
+rem Note: Wget required!
+
+rem Variables
+set prefix="C:\Program Files (x86)"
+set dst_dir=%prefix%\Unbound
+set work_dir=%TEMP%
+set list_addr="http://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml&showintro=1&startdate%5Bday%5D=&startdate%5Bmonth%5D=&startdate%5Byear%5D="
+
+rem Check Wget installed
+for /f "delims=" %%a in ('where wget') do @set wget=%%a
+if /I "%wget%"=="" echo Wget not found. If installed, add path to PATH environment variable. & exit 1
+echo Wget found: %wget%
+
+"%wget%" -O %work_dir%\yoyo_ad_servers %list_addr%
+
+del /Q /F /S %dst_dir%\unbound_ad_servers
+
+for /F "eol=; tokens=*" %%a in (%work_dir%\yoyo_ad_servers) do (
+echo local-zone: %%a redirect>>%dst_dir%\unbound_ad_servers
+echo local-data: "%%a A 127.0.0.1">>%dst_dir%\unbound_ad_servers
+)
+
+echo Done.
+rem  then add an include line to your unbound.conf pointing to the full path of
+rem  the unbound_ad_servers file:
+rem
+rem   include: $dst_dir/unbound_ad_servers
+rem

contrib/libunbound.pc.in

@@ -0,0 +1,13 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: unbound
+Description: Library with validating, recursive, and caching DNS resolver
+URL: http://www.unbound.net
+Version: @PACKAGE_VERSION@
+Requires: libcrypto libssl @PC_LIBEVENT_DEPENDENCY@ @PC_PY_DEPENDENCY@
+Libs: -L${libdir} -lunbound
+Libs.private: @SSLLIB@ @LIBS@
+Cflags: -I${includedir} 

contrib/unbound.spec_fedora

@@ -273,7 +273,7 @@ fi
 - Change make/configure lines to attempt to fix -lphtread linking issue
 
 * Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
-- Removed dependancy for dnssec-conf
+- Removed dependency for dnssec-conf
 - Added ISC DLV key (formerly in dnssec-conf)
 - Fixup old DLV locations in unbound.conf file via %%post
 - Fix parent child disagreement handling and no-ipv6 present [svn r1953]
@@ -312,7 +312,7 @@ fi
 - Re-enabled glob.patch
 
 * Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-7
-- unbound-iterator.patch was not commited
+- unbound-iterator.patch was not committed
 
 * Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-6
 - Fix for https://bugzilla.redhat.com/show_bug.cgi?id=499793
@@ -338,11 +338,11 @@ fi
 
 * Wed Jan 14 2009 Paul Wouters <paul@xelerance.com - 1.2.0-1
 - Updated to 1.2.0
-- Added dependancy on minimum SSL for CVE-2008-5077
-- Added dependancy on bc for unbound-munin
+- Added dependency on minimum SSL for CVE-2008-5077
+- Added dependency on bc for unbound-munin
 - Added minimum requirement of libevent 1.4.5. Crashes with older versions
   (note: libevent is stale in EL-4 and not in EL-5, needs fixing there)
-- Removed dependancy on selinux-policy (will get used when available)
+- Removed dependency on selinux-policy (will get used when available)
 - Enable options as per draft-wijngaards-dnsext-resolver-side-mitigation-00.txt
 - Enable unwanted-reply-threshold to mitigate against a Kaminsky attack
 - Enable val-clean-additional to drop addition unsigned data from signed
@@ -423,7 +423,7 @@ fi
 - Build against ldns-1.3.0
 
 * Wed May 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.0-1
-- Split of -devel package, fixed dependancies, make rpmlint happy
+- Split of -devel package, fixed dependencies, make rpmlint happy
 
 * Thu Apr 25 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.12
 - Using parts from ports collection entry by Jaap Akkerhuis.

contrib/unbound_munin_

@@ -150,7 +150,7 @@ get_state ( ) {
 			fi
 		done
 		# try to get it
-		echo $$ >$lock
+		if echo $$ >$lock ; then : ; else break; fi
 	done
 	# do not refetch if the file exists and only LEE seconds old
 	if test -f $state; then
@@ -266,7 +266,6 @@ if test "$1" = "config" ; then
 		echo "graph_args --base 1024 -l 0"
 		echo "graph_vlabel memory used in bytes"
 		echo "graph_category DNS"
-		p_config "mem.total.sbrk" "Total memory" "GAUGE"
 		p_config "mem.cache.rrset" "RRset cache memory" "GAUGE"
 		p_config "mem.cache.message" "Message cache memory" "GAUGE"
 		p_config "mem.mod.iterator" "Iterator module memory" "GAUGE"
@@ -458,20 +457,6 @@ queue)
 	done
 	;;
 memory)
-	mn=`echo mem.total.sbrk | sed $ABBREV | tr . _`
-	get_value 'mem.total.sbrk'
-	if test $value -eq 0; then
-		chk=`echo $ctrl | sed -e 's/-control$/-checkconf/'`
-		pidf=`$chk -o pidfile $conf 2>&1`
-		pid=`cat $pidf 2>&1`
-		value=`ps -p "$pid" -o rss= 2>&1`
-		if test "`expr $value + 1 - 1 2>&1`" -eq "$value" 2>&1; then
-			value=`expr $value \* 1024` 
-		else
-			value=0
-		fi
-	fi
-	echo "$mn.value" $value
 	for x in mem.cache.rrset mem.cache.message mem.mod.iterator \
 		mem.mod.validator msg.cache.count rrset.cache.count \
 		infra.cache.count key.cache.count; do

daemon/acl_list.c

@@ -45,6 +45,8 @@
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
+#include "services/localzone.h"
+#include "sldns/str2wire.h"
 
 struct acl_list* 
 acl_list_create(void)
@@ -71,21 +73,21 @@ acl_list_delete(struct acl_list* acl)
 }
 
 /** insert new address into acl_list structure */
-static int
+static struct acl_addr*
 acl_list_insert(struct acl_list* acl, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int net, enum acl_access control, 
 	int complain_duplicates)
 {
-	struct acl_addr* node = regional_alloc(acl->region,
+	struct acl_addr* node = regional_alloc_zero(acl->region,
 		sizeof(struct acl_addr));
 	if(!node)
-		return 0;
+		return NULL;
 	node->control = control;
 	if(!addr_tree_insert(&acl->tree, &node->node, addr, addrlen, net)) {
 		if(complain_duplicates)
 			verbose(VERB_QUERY, "duplicate acl address ignored.");
 	}
-	return 1;
+	return node;
 }
 
 /** apply acl_list string */
@@ -125,6 +127,205 @@ acl_list_str_cfg(struct acl_list* acl, const char* str, const char* s2,
 	return 1;
 }
 
+/** find or create node (NULL on parse or error) */
+static struct acl_addr*
+acl_find_or_create(struct acl_list* acl, const char* str)
+{
+	struct acl_addr* node;
+	struct sockaddr_storage addr;
+	int net;
+	socklen_t addrlen;
+	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
+		log_err("cannot parse netblock: %s", str);
+		return NULL;
+	}
+	/* find or create node */
+	if(!(node=(struct acl_addr*)addr_tree_find(&acl->tree, &addr,
+		addrlen, net))) {
+		/* create node, type 'allow' since otherwise tags are
+		 * pointless, can override with specific access-control: cfg */
+		if(!(node=(struct acl_addr*)acl_list_insert(acl, &addr,
+			addrlen, net, acl_allow, 1))) {
+			log_err("out of memory");
+			return NULL;
+		}
+	}
+	return node;
+}
+
+/** apply acl_tag string */
+static int
+acl_list_tags_cfg(struct acl_list* acl, const char* str, uint8_t* bitmap,
+	size_t bitmaplen)
+{
+	struct acl_addr* node;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	node->taglen = bitmaplen;
+	node->taglist = regional_alloc_init(acl->region, bitmap, bitmaplen);
+	if(!node->taglist) {
+		log_err("out of memory");
+		return 0;
+	}
+	return 1;
+}
+
+/** apply acl_view string */
+static int
+acl_list_view_cfg(struct acl_list* acl, const char* str, const char* str2,
+	struct views* vs)
+{
+	struct acl_addr* node;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	node->view = views_find_view(vs, str2, 0 /* get read lock*/);
+	if(!node->view) {
+		log_err("no view with name: %s", str2);
+		return 0;
+	}
+	lock_rw_unlock(&node->view->lock);
+	return 1;
+}
+
+/** apply acl_tag_action string */
+static int
+acl_list_tag_action_cfg(struct acl_list* acl, struct config_file* cfg,
+	const char* str, const char* tag, const char* action)
+{
+	struct acl_addr* node;
+	int tagid;
+	enum localzone_type t;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	/* allocate array if not yet */
+	if(!node->tag_actions) {
+		node->tag_actions = (uint8_t*)regional_alloc_zero(acl->region,
+			sizeof(*node->tag_actions)*cfg->num_tags);
+		if(!node->tag_actions) {
+			log_err("out of memory");
+			return 0;
+		}
+		node->tag_actions_size = (size_t)cfg->num_tags;
+	}
+	/* parse tag */
+	if((tagid=find_tag_id(cfg, tag)) == -1) {
+		log_err("cannot parse tag (define-tag it): %s %s", str, tag);
+		return 0;
+	}
+	if((size_t)tagid >= node->tag_actions_size) {
+		log_err("tagid too large for array %s %s", str, tag);
+		return 0;
+	}
+	if(!local_zone_str2type(action, &t)) {
+		log_err("cannot parse access control action type: %s %s %s",
+			str, tag, action);
+		return 0;
+	}
+	node->tag_actions[tagid] = (uint8_t)t;
+	return 1;
+}
+
+/** check wire data parse */
+static int
+check_data(const char* data, const struct config_strlist* head)
+{
+	char buf[65536];
+	uint8_t rr[LDNS_RR_BUF_SIZE];
+	size_t len = sizeof(rr);
+	int res;
+	/* '.' is sufficient for validation, and it makes the call to
+	 * sldns_wirerr_get_type() simpler below. */
+	snprintf(buf, sizeof(buf), "%s %s", ".", data);
+	res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600, NULL, 0,
+		NULL, 0);
+
+	/* Reject it if we would end up having CNAME and other data (including
+	 * another CNAME) for the same tag. */
+	if(res == 0 && head) {
+		const char* err_data = NULL;
+
+		if(sldns_wirerr_get_type(rr, len, 1) == LDNS_RR_TYPE_CNAME) {
+			/* adding CNAME while other data already exists. */
+			err_data = data;
+		} else {
+			snprintf(buf, sizeof(buf), "%s %s", ".", head->str);
+			len = sizeof(rr);
+			res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600,
+				NULL, 0, NULL, 0);
+			if(res != 0) {
+				/* This should be impossible here as head->str
+				 * has been validated, but we check it just in
+				 * case. */
+				return 0;
+			}
+			if(sldns_wirerr_get_type(rr, len, 1) ==
+				LDNS_RR_TYPE_CNAME) /* already have CNAME */
+				err_data = head->str;
+		}
+		if(err_data) {
+			log_err("redirect tag data '%s' must not coexist with "
+				"other data.", err_data);
+			return 0;
+		}
+	}
+	if(res == 0)
+		return 1;
+	log_err("rr data [char %d] parse error %s",
+		(int)LDNS_WIREPARSE_OFFSET(res)-13,
+		sldns_get_errorstr_parse(res));
+	return 0;
+}
+
+/** apply acl_tag_data string */
+static int
+acl_list_tag_data_cfg(struct acl_list* acl, struct config_file* cfg,
+	const char* str, const char* tag, const char* data)
+{
+	struct acl_addr* node;
+	int tagid;
+	char* dupdata;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	/* allocate array if not yet */
+	if(!node->tag_datas) {
+		node->tag_datas = (struct config_strlist**)regional_alloc_zero(
+			acl->region, sizeof(*node->tag_datas)*cfg->num_tags);
+		if(!node->tag_datas) {
+			log_err("out of memory");
+			return 0;
+		}
+		node->tag_datas_size = (size_t)cfg->num_tags;
+	}
+	/* parse tag */
+	if((tagid=find_tag_id(cfg, tag)) == -1) {
+		log_err("cannot parse tag (define-tag it): %s %s", str, tag);
+		return 0;
+	}
+	if((size_t)tagid >= node->tag_datas_size) {
+		log_err("tagid too large for array %s %s", str, tag);
+		return 0;
+	}
+
+	/* check data? */
+	if(!check_data(data, node->tag_datas[tagid])) {
+		log_err("cannot parse access-control-tag data: %s %s '%s'",
+			str, tag, data);
+		return 0;
+	}
+
+	dupdata = regional_strdup(acl->region, data);
+	if(!dupdata) {
+		log_err("out of memory");
+		return 0;
+	}
+	if(!cfg_region_strlist_insert(acl->region,
+		&(node->tag_datas[tagid]), dupdata)) {
+		log_err("out of memory");
+		return 0;
+	}
+	return 1;
+}
+
 /** read acl_list config */
 static int 
 read_acl_list(struct acl_list* acl, struct config_file* cfg)
@@ -138,13 +339,114 @@ read_acl_list(struct acl_list* acl, struct config_file* cfg)
 	return 1;
 }
 
+/** read acl tags config */
+static int 
+read_acl_tags(struct acl_list* acl, struct config_file* cfg)
+{
+	struct config_strbytelist* np, *p = cfg->acl_tags;
+	cfg->acl_tags = NULL;
+	while(p) {
+		log_assert(p->str && p->str2);
+		if(!acl_list_tags_cfg(acl, p->str, p->str2, p->str2len)) {
+			config_del_strbytelist(p);
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
+/** read acl view config */
+static int 
+read_acl_view(struct acl_list* acl, struct config_file* cfg, struct views* v)
+{
+	struct config_str2list* np, *p = cfg->acl_view;
+	cfg->acl_view = NULL;
+	while(p) {
+		log_assert(p->str && p->str2);
+		if(!acl_list_view_cfg(acl, p->str, p->str2, v)) {
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
+/** read acl tag actions config */
+static int 
+read_acl_tag_actions(struct acl_list* acl, struct config_file* cfg)
+{
+	struct config_str3list* p, *np;
+	p = cfg->acl_tag_actions;
+	cfg->acl_tag_actions = NULL;
+	while(p) {
+		log_assert(p->str && p->str2 && p->str3);
+		if(!acl_list_tag_action_cfg(acl, cfg, p->str, p->str2,
+			p->str3)) {
+			config_deltrplstrlist(p);
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p->str3);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
+/** read acl tag datas config */
+static int 
+read_acl_tag_datas(struct acl_list* acl, struct config_file* cfg)
+{
+	struct config_str3list* p, *np;
+	p = cfg->acl_tag_datas;
+	cfg->acl_tag_datas = NULL;
+	while(p) {
+		log_assert(p->str && p->str2 && p->str3);
+		if(!acl_list_tag_data_cfg(acl, cfg, p->str, p->str2, p->str3)) {
+			config_deltrplstrlist(p);
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p->str3);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
 int 
-acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
+acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
+	struct views* v)
 {
 	regional_free_all(acl->region);
 	addr_tree_init(&acl->tree);
 	if(!read_acl_list(acl, cfg))
 		return 0;
+	if(!read_acl_view(acl, cfg, v))
+		return 0;
+	if(!read_acl_tags(acl, cfg))
+		return 0;
+	if(!read_acl_tag_actions(acl, cfg))
+		return 0;
+	if(!read_acl_tag_datas(acl, cfg))
+		return 0;
 	/* insert defaults, with '0' to ignore them if they are duplicates */
 	if(!acl_list_str_cfg(acl, "0.0.0.0/0", "refuse", 0))
 		return 0;
@@ -163,13 +465,18 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
 }
 
 enum acl_access 
-acl_list_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
+acl_get_control(struct acl_addr* acl)
+{
+	if(acl) return acl->control;
+	return acl_deny;
+}
+
+struct acl_addr*
+acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
         socklen_t addrlen)
 {
-	struct acl_addr* r = (struct acl_addr*)addr_tree_lookup(&acl->tree,
+	return (struct acl_addr*)addr_tree_lookup(&acl->tree,
 		addr, addrlen);
-	if(r) return r->control;
-	return acl_deny;
 }
 
 size_t 

daemon/acl_list.h

@@ -43,6 +43,7 @@
 #ifndef DAEMON_ACL_LIST_H
 #define DAEMON_ACL_LIST_H
 #include "util/storage/dnstree.h"
+#include "services/view.h"
 struct config_file;
 struct regional;
 
@@ -87,6 +88,21 @@ struct acl_addr {
 	struct addr_tree_node node;
 	/** access control on this netblock */
 	enum acl_access control;
+	/** tag bitlist */
+	uint8_t* taglist;
+	/** length of the taglist (in bytes) */
+	size_t taglen;
+	/** array per tagnumber of localzonetype(in one byte). NULL if none. */
+	uint8_t* tag_actions;
+	/** size of the tag_actions_array */
+	size_t tag_actions_size;
+	/** array per tagnumber, with per tag a list of rdata strings.
+	 * NULL if none.  strings are like 'A 127.0.0.1' 'AAAA ::1' */
+	struct config_strlist** tag_datas;
+	/** size of the tag_datas array */
+	size_t tag_datas_size;
+	/* view element, NULL if none */
+	struct view* view;
 };
 
 /**
@@ -105,19 +121,29 @@ void acl_list_delete(struct acl_list* acl);
  * Process access control config.
  * @param acl: where to store.
  * @param cfg: config options.
+ * @param v: views structure
  * @return 0 on error.
  */
-int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg);
+int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
+	struct views* v);
 
 /**
- * Lookup address to see its access control status.
+ * Lookup access control status for acl structure.
+ * @param acl: structure for acl storage.
+ * @return: what to do with message from this address.
+ */
+enum acl_access acl_get_control(struct acl_addr* acl);
+
+/**
+ * Lookup address to see its acl structure
  * @param acl: structure for address storage.
  * @param addr: address to check
  * @param addrlen: length of addr.
- * @return: what to do with message from this address.
+ * @return: acl structure from this address.
  */
-enum acl_access acl_list_lookup(struct acl_list* acl, 
-	struct sockaddr_storage* addr, socklen_t addrlen);
+struct acl_addr*
+acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
+        socklen_t addrlen);
 
 /**
  * Get memory used by acl structure.

daemon/cachedump.c

@@ -563,6 +563,7 @@ load_qinfo(char* str, struct query_info* qinfo, struct regional* region)
 	qinfo->qclass = sldns_wirerr_get_class(rr, rr_len, dname_len);
 	qinfo->qname_len = dname_len;
 	qinfo->qname = (uint8_t*)regional_alloc_init(region, rr, dname_len);
+	qinfo->local_alias = NULL;
 	if(!qinfo->qname) {
 		log_warn("error out of memory");
 		return NULL;
@@ -826,6 +827,7 @@ int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
 	qinfo.qname_len = nmlen;
 	qinfo.qtype = LDNS_RR_TYPE_A;
 	qinfo.qclass = LDNS_RR_CLASS_IN;
+	qinfo.local_alias = NULL;
 
 	dname_str(nm, b);
 	if(!ssl_printf(ssl, "The following name servers are used for lookup "

daemon/daemon.c

@@ -79,6 +79,7 @@
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
 #include "services/localzone.h"
+#include "services/view.h"
 #include "services/modstack.h"
 #include "util/module.h"
 #include "util/random.h"
@@ -204,20 +205,29 @@ daemon_init(void)
 	signal_handling_record();
 	checklock_start();
 #ifdef HAVE_SSL
+#  ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
-	ERR_load_SSL_strings();
-#  ifdef HAVE_OPENSSL_CONFIG
-	OPENSSL_config("unbound");
 #  endif
+	ERR_load_SSL_strings();
 #  ifdef USE_GOST
 	(void)sldns_key_EVP_load_gost_id();
 #  endif
+#  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 	OpenSSL_add_all_algorithms();
+#  else
+	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
+		| OPENSSL_INIT_ADD_ALL_DIGESTS
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 	/* grab the COMP method ptr because openssl leaks it */
 	comp_meth = (void*)SSL_COMP_get_compression_methods();
 #  endif
+#  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
+#  else
+	(void)OPENSSL_init_ssl(0, NULL);
+#  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	if(!ub_openssl_lock_init())
 		fatal_exit("could not init openssl locks");
@@ -239,9 +249,16 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
+	/* init edns_known_options */
+	if(!edns_known_options_init(daemon->env)) {
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	alloc_init(&daemon->superalloc, NULL, 0);
 	daemon->acl = acl_list_create();
 	if(!daemon->acl) {
+		edns_known_options_delete(daemon->env);
 		free(daemon->env);
 		free(daemon);
 		return NULL;
@@ -338,6 +355,7 @@ static void daemon_setup_modules(struct daemon* daemon)
 		daemon->env)) {
 		fatal_exit("failed to setup modules");
 	}
+	log_edns_known_options(VERB_ALGO, daemon->env);
 }
 
 /**
@@ -407,6 +425,8 @@ daemon_create_workers(struct daemon* daemon)
 	}
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
+	if(!daemon->workers)
+		fatal_exit("out of memory during daemon init");
 	if(daemon->cfg->dnstap) {
 #ifdef USE_DNSTAP
 		daemon->dtenv = dt_create(daemon->cfg->dnstap_socket_path,
@@ -531,8 +551,15 @@ void
 daemon_fork(struct daemon* daemon)
 {
 	log_assert(daemon);
-	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg))
+	if(!(daemon->views = views_create()))
+		fatal_exit("Could not create views: out of memory");
+	/* create individual views and their localzone/data trees */
+	if(!views_apply_cfg(daemon->views, daemon->cfg))
+		fatal_exit("Could not set up views");
+
+	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->views))
 		fatal_exit("Could not setup access control list");
+	/* create global local_zones */
 	if(!(daemon->local_zones = local_zones_create()))
 		fatal_exit("Could not create local zones: out of memory");
 	if(!local_zones_apply_cfg(daemon->local_zones, daemon->cfg))
@@ -589,13 +616,14 @@ daemon_cleanup(struct daemon* daemon)
 	log_thread_set(NULL);
 	/* clean up caches because
 	 * a) RRset IDs will be recycled after a reload, causing collisions
-	 * b) validation config can change, thus rrset, msg, keycache clear 
-	 * The infra cache is kept, the timing and edns info is still valid */
+	 * b) validation config can change, thus rrset, msg, keycache clear */
 	slabhash_clear(&daemon->env->rrset_cache->table);
 	slabhash_clear(daemon->env->msg_cache);
 	local_zones_delete(daemon->local_zones);
 	daemon->local_zones = NULL;
-	/* key cache is cleared by module desetup during next daemon_init() */
+	views_delete(daemon->views);
+	daemon->views = NULL;
+	/* key cache is cleared by module desetup during next daemon_fork() */
 	daemon_remote_clear(daemon->rc);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
@@ -624,6 +652,8 @@ daemon_delete(struct daemon* daemon)
 		slabhash_delete(daemon->env->msg_cache);
 		rrset_cache_delete(daemon->env->rrset_cache);
 		infra_delete(daemon->env->infra_cache);
+		edns_known_options_delete(daemon->env);
+		inplace_cb_lists_delete(daemon->env);
 	}
 	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
@@ -647,18 +677,27 @@ daemon_delete(struct daemon* daemon)
 #  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
 #    ifndef S_SPLINT_S
+#      if OPENSSL_VERSION_NUMBER < 0x10100000
 	sk_SSL_COMP_pop_free(comp_meth, (void(*)())CRYPTO_free);
+#      endif
 #    endif
 #  endif
 #  ifdef HAVE_OPENSSL_CONFIG
 	EVP_cleanup();
+#  if OPENSSL_VERSION_NUMBER < 0x10100000
 	ENGINE_cleanup();
+#  endif
 	CONF_modules_free();
 #  endif
+#  ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
 	CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
-	ERR_remove_state(0);
+#  endif
+#  ifdef HAVE_ERR_FREE_STRINGS
 	ERR_free_strings();
+#  endif
+#  if OPENSSL_VERSION_NUMBER < 0x10100000
 	RAND_cleanup();
+#  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	ub_openssl_lock_delete();
 #  endif

daemon/daemon.h

@@ -45,9 +45,6 @@
 #include "util/locks.h"
 #include "util/alloc.h"
 #include "services/modstack.h"
-#ifdef UB_ON_WINDOWS
-#  include "util/winsock_event.h"
-#endif
 struct config_file;
 struct worker;
 struct listen_port;
@@ -56,6 +53,7 @@ struct module_env;
 struct rrset_cache;
 struct acl_list;
 struct local_zones;
+struct views;
 struct ub_randstate;
 struct daemon_remote;
 
@@ -114,6 +112,8 @@ struct daemon {
 	struct timeval time_last_stat;
 	/** time when daemon started */
 	struct timeval time_boot;
+	/** views structure containing view tree */
+	struct views* views;
 #ifdef USE_DNSTAP
 	/** the dnstap environment master value, copied and changed by threads*/
 	struct dt_env* dtenv;

daemon/remote.c

@@ -46,9 +46,12 @@
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
 #endif
-#ifndef HEADER_DH_H
+#ifdef HAVE_OPENSSL_DH_H
 #include <openssl/dh.h>
 #endif
+#ifdef HAVE_OPENSSL_BN_H
+#include <openssl/bn.h>
+#endif
 
 #include <ctype.h>
 #include "daemon/remote.h"
@@ -140,49 +143,68 @@ timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
 
 /*
  * The following function was generated using the openssl utility, using
- * the command : "openssl dhparam -dsaparam -C 1024"
+ * the command : "openssl dhparam -C 2048"
  * (some openssl versions reject DH that is 'too small', eg. 512).
  */
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
 #ifndef S_SPLINT_S
-DH *get_dh1024()
+static DH *get_dh2048(void)
 {
-	static unsigned char dh1024_p[]={
-		0xB3,0x67,0x2E,0x3B,0x68,0xC5,0xDA,0x58,0x46,0xD6,0x2B,0xD3,
-		0x41,0x78,0x97,0xE4,0xE1,0x61,0x71,0x68,0xE6,0x0F,0x1D,0x78,
-		0x05,0xAA,0xF0,0xFF,0x30,0xDF,0xAC,0x49,0x7F,0xE0,0x90,0xFE,
-		0xB9,0x56,0x4E,0x3F,0xE2,0x98,0x8A,0xED,0xF5,0x28,0x39,0xEF,
-		0x2E,0xA6,0xB7,0x67,0xB2,0x43,0xE4,0x53,0xF8,0xEB,0x2C,0x1F,
-		0x06,0x77,0x3A,0x6F,0x62,0x98,0xC1,0x3B,0xF7,0xBA,0x4D,0x93,
-		0xF7,0xEB,0x5A,0xAD,0xC5,0x5F,0xF0,0xB7,0x24,0x35,0x81,0xF7,
-		0x7F,0x1F,0x24,0xC0,0xDF,0xD3,0xD8,0x40,0x72,0x7E,0xF3,0x19,
-		0x2B,0x26,0x27,0xF4,0xB6,0xB3,0xD4,0x7D,0x08,0x23,0xBE,0x68,
-		0x2B,0xCA,0xB4,0x46,0xA8,0x9E,0xDD,0x6C,0x3D,0x75,0xA6,0x48,
-		0xF7,0x44,0x43,0xBF,0x91,0xC2,0xB4,0x49,
+	static unsigned char dh2048_p[]={
+		0xE7,0x36,0x28,0x3B,0xE4,0xC3,0x32,0x1C,0x01,0xC3,0x67,0xD6,
+		0xF5,0xF3,0xDA,0xDC,0x71,0xC0,0x42,0x8B,0xE6,0xEB,0x8D,0x80,
+		0x35,0x7F,0x09,0x45,0x30,0xE5,0xB2,0x92,0x81,0x3F,0x08,0xCD,
+		0x36,0x5E,0x19,0x83,0x62,0xCC,0xAE,0x9B,0x81,0x66,0x24,0xEE,
+		0x16,0x6F,0xA9,0x9E,0xF4,0x82,0x1B,0xDD,0x46,0xC7,0x33,0x5D,
+		0xF4,0xCA,0xE6,0x8F,0xFC,0xD4,0xD8,0x58,0x94,0x24,0x5D,0xFF,
+		0x0A,0xE8,0xEF,0x3D,0xCE,0xBB,0x50,0x94,0xE0,0x5F,0xE8,0x41,
+		0xC3,0x35,0x30,0x37,0xD5,0xCB,0x8F,0x3D,0x95,0x15,0x1A,0x77,
+		0x42,0xB2,0x06,0x86,0xF6,0x09,0x66,0x0E,0x9A,0x25,0x94,0x3E,
+		0xD2,0x04,0x25,0x25,0x1D,0x23,0xEB,0xDC,0x4D,0x0C,0x83,0x28,
+		0x2E,0x15,0x81,0x2D,0xC1,0xAF,0x8D,0x36,0x64,0xE3,0x9A,0x83,
+		0x78,0xC2,0x8D,0xC0,0x9D,0xD9,0x3A,0x1C,0xC5,0x2B,0x50,0x68,
+		0x07,0xA9,0x4B,0x8C,0x07,0x57,0xD6,0x15,0x03,0x4E,0x9E,0x01,
+		0xF2,0x6F,0x35,0xAC,0x26,0x9C,0x92,0x68,0x61,0x13,0xFB,0x01,
+		0xBA,0x22,0x36,0x01,0x55,0xB6,0x62,0xD9,0xB2,0x98,0xCE,0x5D,
+		0x4B,0xA5,0x41,0xD6,0xE5,0x70,0x78,0x12,0x1F,0x64,0xB6,0x6F,
+		0xB0,0x91,0x51,0x91,0x92,0xC0,0x94,0x3A,0xD1,0x28,0x4D,0x30,
+		0x84,0x3E,0xE4,0xE4,0x7F,0x47,0x89,0xB1,0xB6,0x8C,0x8E,0x0E,
+		0x26,0xDB,0xCD,0x17,0x07,0x2A,0x21,0x7A,0xCC,0x68,0xE8,0x57,
+		0x94,0x9E,0x59,0x61,0xEC,0x20,0x34,0x26,0x0D,0x66,0x44,0xEB,
+		0x6F,0x02,0x58,0xE2,0xED,0xF6,0xF3,0x1B,0xBF,0x9E,0x45,0x52,
+		0x5A,0x49,0xA1,0x5B,
 		};
-	static unsigned char dh1024_g[]={
-		0x5F,0x37,0xB5,0x80,0x4D,0xB4,0xC4,0xB2,0x37,0x12,0xD5,0x2F,
-		0x56,0x81,0xB0,0xDF,0x3D,0x27,0xA2,0x54,0xE7,0x14,0x65,0x2D,
-		0x72,0xA8,0x97,0xE0,0xA9,0x4A,0x09,0x5E,0x89,0xBE,0x34,0x9A,
-		0x90,0x98,0xC1,0xE8,0xBB,0x01,0x2B,0xC2,0x74,0x74,0x90,0x59,
-		0x0B,0x72,0x62,0x5C,0xFD,0x49,0x63,0x4B,0x38,0x91,0xF1,0x7F,
-		0x13,0x25,0xEB,0x52,0x50,0x47,0xA2,0x8C,0x32,0x28,0x42,0xAC,
-		0xBD,0x7A,0xCC,0x58,0xBE,0x36,0xDA,0x6A,0x24,0x06,0xC7,0xF1,
-		0xDA,0x8D,0x8A,0x3B,0x03,0xFA,0x6F,0x25,0xE5,0x20,0xA7,0xD6,
-		0x6F,0x74,0x61,0x53,0x14,0x81,0x29,0x04,0xB5,0x61,0x12,0x53,
-		0xA3,0xD6,0x09,0x98,0x0C,0x8F,0x1C,0xBB,0xD7,0x1C,0x2C,0xEE,
-		0x56,0x4B,0x74,0x8F,0x4A,0xF8,0xA9,0xD5,
+	static unsigned char dh2048_g[]={
+		0x02,
 		};
-	DH *dh;
+	DH *dh = NULL;
+	BIGNUM *p = NULL, *g = NULL;
 
-	if ((dh=DH_new()) == NULL) return(NULL);
-	dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
-	dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
-	if ((dh->p == NULL) || (dh->g == NULL))
-		{ DH_free(dh); return(NULL); }
-	dh->length = 160;
-	return(dh);
+	dh = DH_new();
+	p = BN_bin2bn(dh2048_p, sizeof(dh2048_p), NULL);
+	g = BN_bin2bn(dh2048_g, sizeof(dh2048_g), NULL);
+	if (!dh || !p || !g)
+		goto err;
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+	dh->p = p;
+	dh->g = g;
+#else
+	if (!DH_set0_pqg(dh, p, NULL, g))
+		goto err;
+#endif
+	return dh;
+err:
+	if (p)
+		BN_free(p);
+	if (g)
+		BN_free(g);
+	if (dh)
+		DH_free(dh);
+	return NULL;
 }
 #endif /* SPLINT */
+#endif /* OPENSSL_VERSION_NUMBER < 0x10100000 */
 
 struct daemon_remote*
 daemon_remote_create(struct config_file* cfg)
@@ -208,12 +230,14 @@ daemon_remote_create(struct config_file* cfg)
 		return NULL;
 	}
 	/* no SSLv2, SSLv3 because has defects */
-	if(!(SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)){
+	if((SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
+		!= SSL_OP_NO_SSLv2){
 		log_crypto_err("could not set SSL_OP_NO_SSLv2");
 		daemon_remote_delete(rc);
 		return NULL;
 	}
-	if(!(SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)){
+	if((SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
+		!= SSL_OP_NO_SSLv3){
 		log_crypto_err("could not set SSL_OP_NO_SSLv3");
 		daemon_remote_delete(rc);
 		return NULL;
@@ -221,18 +245,27 @@ daemon_remote_create(struct config_file* cfg)
 
 	if (cfg->remote_control_use_cert == 0) {
 		/* No certificates are requested */
-		if(!SSL_CTX_set_cipher_list(rc->ctx, "aNULL")) {
+#ifdef HAVE_SSL_CTX_SET_SECURITY_LEVEL
+		SSL_CTX_set_security_level(rc->ctx, 0);
+#endif
+		if(!SSL_CTX_set_cipher_list(rc->ctx, "aNULL, eNULL")) {
 			log_crypto_err("Failed to set aNULL cipher list");
+			daemon_remote_delete(rc);
 			return NULL;
 		}
 
+		/* in openssl 1.1, the securitylevel 0 allows eNULL, that
+		 * does not need the DH */
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
 		/* Since we have no certificates and hence no source of
 		 * DH params, let's generate and set them
 		 */
-		if(!SSL_CTX_set_tmp_dh(rc->ctx,get_dh1024())) {
+		if(!SSL_CTX_set_tmp_dh(rc->ctx,get_dh2048())) {
 			log_crypto_err("Wanted to set DH param, but failed");
+			daemon_remote_delete(rc);
 			return NULL;
 		}
+#endif
 		return rc;
 	}
 	rc->use_cert = 1;
@@ -357,8 +390,12 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 		if(fd != -1) {
 #ifdef HAVE_CHOWN
 			if (cfg->username && cfg->username[0] &&
-				cfg_uid != (uid_t)-1)
-				chown(ip, cfg_uid, cfg_gid);
+				cfg_uid != (uid_t)-1) {
+				if(chown(ip, cfg_uid, cfg_gid) == -1)
+					log_err("cannot chown %u.%u %s: %s",
+					  (unsigned)cfg_uid, (unsigned)cfg_gid,
+					  ip, strerror(errno));
+			}
 			chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP));
 #else
 			(void)cfg;
@@ -387,7 +424,7 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 
 		/* open fd */
 		fd = create_tcp_accept_sock(res, 1, &noproto, 0,
-			cfg->ip_transparent);
+			cfg->ip_transparent, 0, cfg->ip_freebind);
 		freeaddrinfo(res);
 	}
 
@@ -732,6 +769,8 @@ print_stats(SSL* ssl, const char* nm, struct stats_info* s)
 		(unsigned long)s->svr.num_queries_missed_cache)) return 0;
 	if(!ssl_printf(ssl, "%s.num.prefetch"SQ"%lu\n", nm, 
 		(unsigned long)s->svr.num_queries_prefetch)) return 0;
+	if(!ssl_printf(ssl, "%s.num.zero_ttl"SQ"%lu\n", nm,
+		(unsigned long)s->svr.zero_ttl_responses)) return 0;
 	if(!ssl_printf(ssl, "%s.num.recursivereplies"SQ"%lu\n", nm, 
 		(unsigned long)s->mesh_replies_sent)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.avg"SQ"%g\n", nm,
@@ -790,12 +829,6 @@ print_mem(SSL* ssl, struct worker* worker, struct daemon* daemon)
 {
 	int m;
 	size_t msg, rrset, val, iter;
-#ifdef HAVE_SBRK
-	extern void* unbound_start_brk;
-	void* cur = sbrk(0);
-	if(!print_longnum(ssl, "mem.total.sbrk"SQ, 
-		(size_t)((char*)cur - (char*)unbound_start_brk))) return 0;
-#endif /* HAVE_SBRK */
 	msg = slabhash_get_mem(daemon->env->msg_cache);
 	rrset = slabhash_get_mem(&daemon->env->rrset_cache->table);
 	val=0;
@@ -1095,8 +1128,8 @@ find_arg2(SSL* ssl, char* arg, char** arg2)
 }
 
 /** Add a new zone */
-static void
-do_zone_add(SSL* ssl, struct worker* worker, char* arg)
+static int
+perform_zone_add(SSL* ssl, struct local_zones* zones, char* arg)
 {
 	uint8_t* nm;
 	int nmlabs;
@@ -1105,83 +1138,266 @@ do_zone_add(SSL* ssl, struct worker* worker, char* arg)
 	enum localzone_type t;
 	struct local_zone* z;
 	if(!find_arg2(ssl, arg, &arg2))
-		return;
+		return 0;
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
-		return;
+		return 0;
 	if(!local_zone_str2type(arg2, &t)) {
 		ssl_printf(ssl, "error not a zone type. %s\n", arg2);
 		free(nm);
-		return;
+		return 0;
 	}
-	lock_rw_wrlock(&worker->daemon->local_zones->lock);
-	if((z=local_zones_find(worker->daemon->local_zones, nm, nmlen, 
+	lock_rw_wrlock(&zones->lock);
+	if((z=local_zones_find(zones, nm, nmlen, 
 		nmlabs, LDNS_RR_CLASS_IN))) {
 		/* already present in tree */
 		lock_rw_wrlock(&z->lock);
 		z->type = t; /* update type anyway */
 		lock_rw_unlock(&z->lock);
 		free(nm);
-		lock_rw_unlock(&worker->daemon->local_zones->lock);
-		send_ok(ssl);
-		return;
+		lock_rw_unlock(&zones->lock);
+		return 1;
 	}
-	if(!local_zones_add_zone(worker->daemon->local_zones, nm, nmlen, 
+	if(!local_zones_add_zone(zones, nm, nmlen, 
 		nmlabs, LDNS_RR_CLASS_IN, t)) {
-		lock_rw_unlock(&worker->daemon->local_zones->lock);
+		lock_rw_unlock(&zones->lock);
 		ssl_printf(ssl, "error out of memory\n");
-		return;
+		return 0;
 	}
-	lock_rw_unlock(&worker->daemon->local_zones->lock);
+	lock_rw_unlock(&zones->lock);
+	return 1;
+}
+
+/** Do the local_zone command */
+static void
+do_zone_add(SSL* ssl, struct local_zones* zones, char* arg)
+{
+	if(!perform_zone_add(ssl, zones, arg))
+		return;
 	send_ok(ssl);
 }
 
-/** Remove a zone */
+/** Do the local_zones command */
 static void
-do_zone_remove(SSL* ssl, struct worker* worker, char* arg)
+do_zones_add(SSL* ssl, struct local_zones* zones)
+{
+	char buf[2048];
+	int num = 0;
+	while(ssl_read_line(ssl, buf, sizeof(buf))) {
+		if(buf[0] == 0x04 && buf[1] == 0)
+			break; /* end of transmission */
+		if(!perform_zone_add(ssl, zones, buf)) {
+			if(!ssl_printf(ssl, "error for input line: %s\n", buf))
+				return;
+		}
+		else
+			num++;
+	}
+	(void)ssl_printf(ssl, "added %d zones\n", num);
+}
+
+/** Remove a zone */
+static int
+perform_zone_remove(SSL* ssl, struct local_zones* zones, char* arg)
 {
 	uint8_t* nm;
 	int nmlabs;
 	size_t nmlen;
 	struct local_zone* z;
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
-		return;
-	lock_rw_wrlock(&worker->daemon->local_zones->lock);
-	if((z=local_zones_find(worker->daemon->local_zones, nm, nmlen, 
+		return 0;
+	lock_rw_wrlock(&zones->lock);
+	if((z=local_zones_find(zones, nm, nmlen, 
 		nmlabs, LDNS_RR_CLASS_IN))) {
 		/* present in tree */
-		local_zones_del_zone(worker->daemon->local_zones, z);
+		local_zones_del_zone(zones, z);
 	}
-	lock_rw_unlock(&worker->daemon->local_zones->lock);
+	lock_rw_unlock(&zones->lock);
 	free(nm);
+	return 1;
+}
+
+/** Do the local_zone_remove command */
+static void
+do_zone_remove(SSL* ssl, struct local_zones* zones, char* arg)
+{
+	if(!perform_zone_remove(ssl, zones, arg))
+		return;
 	send_ok(ssl);
 }
 
+/** Do the local_zones_remove command */
+static void
+do_zones_remove(SSL* ssl, struct local_zones* zones)
+{
+	char buf[2048];
+	int num = 0;
+	while(ssl_read_line(ssl, buf, sizeof(buf))) {
+		if(buf[0] == 0x04 && buf[1] == 0)
+			break; /* end of transmission */
+		if(!perform_zone_remove(ssl, zones, buf)) {
+			if(!ssl_printf(ssl, "error for input line: %s\n", buf))
+				return;
+		}
+		else
+			num++;
+	}
+	(void)ssl_printf(ssl, "removed %d zones\n", num);
+}
+
 /** Add new RR data */
-static void
-do_data_add(SSL* ssl, struct worker* worker, char* arg)
+static int
+perform_data_add(SSL* ssl, struct local_zones* zones, char* arg)
 {
-	if(!local_zones_add_RR(worker->daemon->local_zones, arg)) {
+	if(!local_zones_add_RR(zones, arg)) {
 		ssl_printf(ssl,"error in syntax or out of memory, %s\n", arg);
-		return;
+		return 0;
 	}
+	return 1;
+}
+
+/** Do the local_data command */
+static void
+do_data_add(SSL* ssl, struct local_zones* zones, char* arg)
+{
+	if(!perform_data_add(ssl, zones, arg))
+		return;
 	send_ok(ssl);
 }
 
-/** Remove RR data */
+/** Do the local_datas command */
 static void
-do_data_remove(SSL* ssl, struct worker* worker, char* arg)
+do_datas_add(SSL* ssl, struct local_zones* zones)
+{
+	char buf[2048];
+	int num = 0;
+	while(ssl_read_line(ssl, buf, sizeof(buf))) {
+		if(buf[0] == 0x04 && buf[1] == 0)
+			break; /* end of transmission */
+		if(!perform_data_add(ssl, zones, buf)) {
+			if(!ssl_printf(ssl, "error for input line: %s\n", buf))
+				return;
+		}
+		else
+			num++;
+	}
+	(void)ssl_printf(ssl, "added %d datas\n", num);
+}
+
+/** Remove RR data */
+static int
+perform_data_remove(SSL* ssl, struct local_zones* zones, char* arg)
 {
 	uint8_t* nm;
 	int nmlabs;
 	size_t nmlen;
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
-		return;
-	local_zones_del_data(worker->daemon->local_zones, nm,
+		return 0;
+	local_zones_del_data(zones, nm,
 		nmlen, nmlabs, LDNS_RR_CLASS_IN);
 	free(nm);
+	return 1;
+}
+
+/** Do the local_data_remove command */
+static void
+do_data_remove(SSL* ssl, struct local_zones* zones, char* arg)
+{
+	if(!perform_data_remove(ssl, zones, arg))
+		return;
 	send_ok(ssl);
 }
 
+/** Do the local_datas_remove command */
+static void
+do_datas_remove(SSL* ssl, struct local_zones* zones)
+{
+	char buf[2048];
+	int num = 0;
+	while(ssl_read_line(ssl, buf, sizeof(buf))) {
+		if(buf[0] == 0x04 && buf[1] == 0)
+			break; /* end of transmission */
+		if(!perform_data_remove(ssl, zones, buf)) {
+			if(!ssl_printf(ssl, "error for input line: %s\n", buf))
+				return;
+		}
+		else
+			num++;
+	}
+	(void)ssl_printf(ssl, "removed %d datas\n", num);
+}
+
+/** Add a new zone to view */
+static void
+do_view_zone_add(SSL* ssl, struct worker* worker, char* arg)
+{
+	char* arg2;
+	struct view* v;
+	if(!find_arg2(ssl, arg, &arg2))
+		return;
+	v = views_find_view(worker->daemon->views,
+		arg, 1 /* get write lock*/);
+	if(!v) {
+		ssl_printf(ssl,"no view with name: %s\n", arg);
+		return;
+	}
+	do_zone_add(ssl, v->local_zones, arg2);
+	lock_rw_unlock(&v->lock);
+}
+
+/** Remove a zone from view */
+static void
+do_view_zone_remove(SSL* ssl, struct worker* worker, char* arg)
+{
+	char* arg2;
+	struct view* v;
+	if(!find_arg2(ssl, arg, &arg2))
+		return;
+	v = views_find_view(worker->daemon->views,
+		arg, 1 /* get write lock*/);
+	if(!v) {
+		ssl_printf(ssl,"no view with name: %s\n", arg);
+		return;
+	}
+	do_zone_remove(ssl, v->local_zones, arg2);
+	lock_rw_unlock(&v->lock);
+}
+
+/** Add new RR data to view */
+static void
+do_view_data_add(SSL* ssl, struct worker* worker, char* arg)
+{
+	char* arg2;
+	struct view* v;
+	if(!find_arg2(ssl, arg, &arg2))
+		return;
+	v = views_find_view(worker->daemon->views,
+		arg, 1 /* get write lock*/);
+	if(!v) {
+		ssl_printf(ssl,"no view with name: %s\n", arg);
+		return;
+	}
+	do_data_add(ssl, v->local_zones, arg2);
+	lock_rw_unlock(&v->lock);
+}
+
+/** Remove RR data from view */
+static void
+do_view_data_remove(SSL* ssl, struct worker* worker, char* arg)
+{
+	char* arg2;
+	struct view* v;
+	if(!find_arg2(ssl, arg, &arg2))
+		return;
+	v = views_find_view(worker->daemon->views,
+		arg, 1 /* get write lock*/);
+	if(!v) {
+		ssl_printf(ssl,"no view with name: %s\n", arg);
+		return;
+	}
+	do_data_remove(ssl, v->local_zones, arg2);
+	lock_rw_unlock(&v->lock);
+}
+
 /** cache lookup of nameservers */
 static void
 do_lookup(SSL* ssl, struct worker* worker, char* arg)
@@ -1210,6 +1426,7 @@ do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
 	k.qname_len = nmlen;
 	k.qtype = t;
 	k.qclass = c;
+	k.local_alias = NULL;
 	h = query_info_hash(&k, 0);
 	slabhash_remove(worker->env.msg_cache, h, &k);
 	if(t == LDNS_RR_TYPE_AAAA) {
@@ -2155,6 +2372,14 @@ do_set_option(SSL* ssl, struct worker* worker, char* arg)
 		(void)ssl_printf(ssl, "error setting option\n");
 		return;
 	}
+	/* effectuate some arguments */
+	if(strcmp(arg, "val-override-date:") == 0) {
+		int m = modstack_find(&worker->env.mesh->mods, "validator");
+		struct val_env* val_env = NULL;
+		if(m != -1) val_env = (struct val_env*)worker->env.modinfo[m];
+		if(val_env)
+			val_env->date_override = worker->env.cfg->val_date_override;
+	}
 	send_ok(ssl);
 }
 
@@ -2235,9 +2460,8 @@ do_list_stubs(SSL* ssl, struct worker* worker)
 
 /** do the list_local_zones command */
 static void
-do_list_local_zones(SSL* ssl, struct worker* worker)
+do_list_local_zones(SSL* ssl, struct local_zones* zones)
 {
-	struct local_zones* zones = worker->daemon->local_zones;
 	struct local_zone* z;
 	char buf[257];
 	lock_rw_rdlock(&zones->lock);
@@ -2258,9 +2482,8 @@ do_list_local_zones(SSL* ssl, struct worker* worker)
 
 /** do the list_local_data command */
 static void
-do_list_local_data(SSL* ssl, struct worker* worker)
+do_list_local_data(SSL* ssl, struct worker* worker, struct local_zones* zones)
 {
-	struct local_zones* zones = worker->daemon->local_zones;
 	struct local_zone* z;
 	struct local_data* d;
 	struct local_rrset* p;
@@ -2296,6 +2519,34 @@ do_list_local_data(SSL* ssl, struct worker* worker)
 	lock_rw_unlock(&zones->lock);
 }
 
+/** do the view_list_local_zones command */
+static void
+do_view_list_local_zones(SSL* ssl, struct worker* worker, char* arg)
+{
+	struct view* v = views_find_view(worker->daemon->views,
+		arg, 0 /* get read lock*/);
+	if(!v) {
+		ssl_printf(ssl,"no view with name: %s\n", arg);
+		return;
+	}
+	do_list_local_zones(ssl, v->local_zones);
+	lock_rw_unlock(&v->lock);
+}
+
+/** do the view_list_local_data command */
+static void
+do_view_list_local_data(SSL* ssl, struct worker* worker, char* arg)
+{
+	struct view* v = views_find_view(worker->daemon->views,
+		arg, 0 /* get read lock*/);
+	if(!v) {
+		ssl_printf(ssl,"no view with name: %s\n", arg);
+		return;
+	}
+	do_list_local_data(ssl, worker, v->local_zones);
+	lock_rw_unlock(&v->lock);
+}
+
 /** struct for user arg ratelimit list */
 struct ratelimit_list_arg {
 	/** the infra cache */
@@ -2408,10 +2659,16 @@ execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd,
 		do_insecure_list(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "list_local_zones", 16)) {
-		do_list_local_zones(ssl, worker);
+		do_list_local_zones(ssl, worker->daemon->local_zones);
 		return;
 	} else if(cmdcmp(p, "list_local_data", 15)) {
-		do_list_local_data(ssl, worker);
+		do_list_local_data(ssl, worker, worker->daemon->local_zones);
+		return;
+	} else if(cmdcmp(p, "view_list_local_zones", 21)) {
+		do_view_list_local_zones(ssl, worker, skipwhite(p+21));
+		return;
+	} else if(cmdcmp(p, "view_list_local_data", 20)) {
+		do_view_list_local_data(ssl, worker, skipwhite(p+20));
 		return;
 	} else if(cmdcmp(p, "ratelimit_list", 14)) {
 		do_ratelimit_list(ssl, worker, p+14);
@@ -2477,13 +2734,29 @@ execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd,
 	if(cmdcmp(p, "verbosity", 9)) {
 		do_verbosity(ssl, skipwhite(p+9));
 	} else if(cmdcmp(p, "local_zone_remove", 17)) {
-		do_zone_remove(ssl, worker, skipwhite(p+17));
+		do_zone_remove(ssl, worker->daemon->local_zones, skipwhite(p+17));
+	} else if(cmdcmp(p, "local_zones_remove", 18)) {
+		do_zones_remove(ssl, worker->daemon->local_zones);
 	} else if(cmdcmp(p, "local_zone", 10)) {
-		do_zone_add(ssl, worker, skipwhite(p+10));
+		do_zone_add(ssl, worker->daemon->local_zones, skipwhite(p+10));
+	} else if(cmdcmp(p, "local_zones", 11)) {
+		do_zones_add(ssl, worker->daemon->local_zones);
 	} else if(cmdcmp(p, "local_data_remove", 17)) {
-		do_data_remove(ssl, worker, skipwhite(p+17));
+		do_data_remove(ssl, worker->daemon->local_zones, skipwhite(p+17));
+	} else if(cmdcmp(p, "local_datas_remove", 18)) {
+		do_datas_remove(ssl, worker->daemon->local_zones);
 	} else if(cmdcmp(p, "local_data", 10)) {
-		do_data_add(ssl, worker, skipwhite(p+10));
+		do_data_add(ssl, worker->daemon->local_zones, skipwhite(p+10));
+	} else if(cmdcmp(p, "local_datas", 11)) {
+		do_datas_add(ssl, worker->daemon->local_zones);
+	} else if(cmdcmp(p, "view_local_zone_remove", 22)) {
+		do_view_zone_remove(ssl, worker, skipwhite(p+22));
+	} else if(cmdcmp(p, "view_local_zone", 15)) {
+		do_view_zone_add(ssl, worker, skipwhite(p+15));
+	} else if(cmdcmp(p, "view_local_data_remove", 22)) {
+		do_view_data_remove(ssl, worker, skipwhite(p+22));
+	} else if(cmdcmp(p, "view_local_data", 15)) {
+		do_view_data_add(ssl, worker, skipwhite(p+15));
 	} else if(cmdcmp(p, "flush_zone", 10)) {
 		do_flush_zone(ssl, worker, skipwhite(p+10));
 	} else if(cmdcmp(p, "flush_type", 10)) {

daemon/remote.h

@@ -56,8 +56,8 @@ struct comm_reply;
 struct comm_point;
 struct daemon_remote;
 
-/** number of seconds timeout on incoming remote control handshake */
-#define REMOTE_CONTROL_TCP_TIMEOUT 120
+/** number of milliseconds timeout on incoming remote control handshake */
+#define REMOTE_CONTROL_TCP_TIMEOUT 120000
 
 /**
  * a busy control command connection, SSL state

daemon/stats.c

@@ -251,6 +251,7 @@ void server_stats_add(struct stats_info* total, struct stats_info* a)
 		total->svr.qEDNS += a->svr.qEDNS;
 		total->svr.qEDNS_DO += a->svr.qEDNS_DO;
 		total->svr.ans_rcode_nodata += a->svr.ans_rcode_nodata;
+		total->svr.zero_ttl_responses += a->svr.zero_ttl_responses;
 		total->svr.ans_secure += a->svr.ans_secure;
 		total->svr.ans_bogus += a->svr.ans_bogus;
 		total->svr.rrset_bogus += a->svr.rrset_bogus;

daemon/stats.h

@@ -131,7 +131,8 @@ struct server_stats {
 	size_t unwanted_queries;
 	/** usage of tcp accept list */
 	size_t tcp_accept_usage;
-
+	/** answers served from expired cache */
+	size_t zero_ttl_responses;
 	/** histogram data exported to array 
 	 * if the array is the same size, no data is lost, and
 	 * if all histograms are same size (is so by default) then

daemon/unbound.c

@@ -57,6 +57,7 @@
 #include "util/data/msgreply.h"
 #include "util/module.h"
 #include "util/net_help.h"
+#include "util/ub_event.h"
 #include <signal.h>
 #include <fcntl.h>
 #include <openssl/crypto.h>
@@ -77,22 +78,6 @@
 #include <login_cap.h>
 #endif
 
-#ifdef USE_MINI_EVENT
-#  ifdef USE_WINSOCK
-#    include "util/winsock_event.h"
-#  else
-#    include "util/mini_event.h"
-#  endif
-#else
-#  ifdef HAVE_EVENT_H
-#    include <event.h>
-#  else
-#    include "event2/event.h"
-#    include "event2/event_struct.h"
-#    include "event2/event_compat.h"
-#  endif
-#endif
-
 #ifdef UB_ON_WINDOWS
 #  include "winrc/win_svc.h"
 #endif
@@ -102,64 +87,14 @@
 #  include "nss.h"
 #endif
 
-#ifdef HAVE_SBRK
-/** global debug value to keep track of heap memory allocation */
-void* unbound_start_brk = 0;
-#endif
-
-#if !defined(HAVE_EVENT_BASE_GET_METHOD) && (defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
-static const char* ev_backend2str(int b)
-{
-	switch(b) {
-	case EVBACKEND_SELECT:	return "select";
-	case EVBACKEND_POLL:	return "poll";
-	case EVBACKEND_EPOLL:	return "epoll";
-	case EVBACKEND_KQUEUE:	return "kqueue";
-	case EVBACKEND_DEVPOLL: return "devpoll";
-	case EVBACKEND_PORT:	return "evport";
-	}
-	return "unknown";
-}
-#endif
-
-/** get the event system in use */
-static void get_event_sys(const char** n, const char** s, const char** m)
-{
-#ifdef USE_WINSOCK
-	*n = "event";
-	*s = "winsock";
-	*m = "WSAWaitForMultipleEvents";
-#elif defined(USE_MINI_EVENT)
-	*n = "mini-event";
-	*s = "internal";
-	*m = "select";
-#else
-	struct event_base* b;
-	*s = event_get_version();
-#  ifdef HAVE_EVENT_BASE_GET_METHOD
-	*n = "libevent";
-	b = event_base_new();
-	*m = event_base_get_method(b);
-#  elif defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
-	*n = "libev";
-	b = (struct event_base*)ev_default_loop(EVFLAG_AUTO);
-	*m = ev_backend2str(ev_backend((struct ev_loop*)b));
-#  else
-	*n = "unknown";
-	*m = "not obtainable";
-	b = NULL;
-#  endif
-#  ifdef HAVE_EVENT_BASE_FREE
-	event_base_free(b);
-#  endif
-#endif
-}
-
 /** print usage. */
-static void usage()
+static void usage(void)
 {
 	const char** m;
 	const char *evnm="event", *evsys="", *evmethod="";
+	time_t t;
+	struct timeval now;
+	struct ub_event_base* base;
 	printf("usage:  unbound [options]\n");
 	printf("	start unbound daemon DNS resolver.\n");
 	printf("-h	this help\n");
@@ -173,13 +108,20 @@ static void usage()
 	printf("   	service - used to start from services control panel\n");
 #endif
 	printf("Version %s\n", PACKAGE_VERSION);
-	get_event_sys(&evnm, &evsys, &evmethod);
+	base = ub_default_event_base(0,&t,&now);
+	ub_get_event_sys(base, &evnm, &evsys, &evmethod);
 	printf("linked libs: %s %s (it uses %s), %s\n", 
 		evnm, evsys, evmethod,
 #ifdef HAVE_SSL
+#  ifdef SSLEAY_VERSION
 		SSLeay_version(SSLEAY_VERSION)
+#  else
+		OpenSSL_version(OPENSSL_VERSION)
+#  endif
 #elif defined(HAVE_NSS)
 		NSS_GetVersion()
+#elif defined(HAVE_NETTLE)
+		"nettle"
 #endif
 		);
 	printf("linked modules:");
@@ -188,6 +130,7 @@ static void usage()
 	printf("\n");
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+	ub_event_base_free(base);
 }
 
 #ifndef unbound_testbound
@@ -228,7 +171,7 @@ checkrlimits(struct config_file* cfg)
 	struct rlimit rlim;
 
 	if(total > 1024 && 
-		strncmp(event_get_version(), "mini-event", 10) == 0) {
+		strncmp(ub_event_get_version(), "mini-event", 10) == 0) {
 		log_warn("too many file descriptors requested. The builtin"
 			"mini-event cannot handle more than 1024. Config "
 			"for less fds or compile with libevent");
@@ -242,7 +185,7 @@ checkrlimits(struct config_file* cfg)
 		total = 1024;
 	}
 	if(perthread > 64 && 
-		strncmp(event_get_version(), "winsock-event", 13) == 0) {
+		strncmp(ub_event_get_version(), "winsock-event", 13) == 0) {
 		log_err("too many file descriptors requested. The winsock"
 			" event handler cannot handle more than 64 per "
 			" thread. Config for less fds");
@@ -296,19 +239,32 @@ checkrlimits(struct config_file* cfg)
 #endif /* S_SPLINT_S */
 }
 
+/** set default logfile identity based on value from argv[0] at startup **/
+static void
+log_ident_set_fromdefault(struct config_file* cfg,
+	const char *log_default_identity)
+{
+	if(cfg->log_identity == NULL || cfg->log_identity[0] == 0)
+		log_ident_set(log_default_identity);
+	else
+		log_ident_set(cfg->log_identity);
+}
+
 /** set verbosity, check rlimits, cache settings */
 static void
 apply_settings(struct daemon* daemon, struct config_file* cfg, 
-	int cmdline_verbose, int debug_mode)
+	int cmdline_verbose, int debug_mode, const char* log_default_identity)
 {
 	/* apply if they have changed */
 	verbosity = cmdline_verbose + cfg->verbosity;
 	if (debug_mode > 1) {
 		cfg->use_syslog = 0;
+		free(cfg->logfile);
 		cfg->logfile = NULL;
 	}
 	daemon_apply_cfg(daemon, cfg);
 	checkrlimits(cfg);
+	log_ident_set_fromdefault(cfg, log_default_identity);
 }
 
 #ifdef HAVE_KILL
@@ -441,6 +397,9 @@ static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	const char** cfgfile)
 {
+#ifdef HAVE_KILL
+	int pidinchroot;
+#endif
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;
 
@@ -450,6 +409,9 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 		/* endpwent below, in case we need pwd for setusercontext */
 	}
 #endif
+#ifdef UB_ON_WINDOWS
+	w_config_adjust_directory(cfg);
+#endif
 
 	/* init syslog (as root) if needed, before daemonize, otherwise
 	 * a fork error could not be printed since daemonize closed stderr.*/
@@ -476,6 +438,12 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif
 
 #ifdef HAVE_KILL
+	/* true if pidfile is inside chrootdir, or nochroot */
+	pidinchroot = !(cfg->chrootdir && cfg->chrootdir[0]) ||
+				(cfg->chrootdir && cfg->chrootdir[0] &&
+				strncmp(cfg->pidfile, cfg->chrootdir,
+				strlen(cfg->chrootdir))==0);
+
 	/* check old pid file before forking */
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		/* calculate position of pidfile */
@@ -485,12 +453,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 				cfg, 1);
 		if(!daemon->pidfile)
 			fatal_exit("pidfile alloc: out of memory");
-		checkoldpid(daemon->pidfile,
-			/* true if pidfile is inside chrootdir, or nochroot */
-			!(cfg->chrootdir && cfg->chrootdir[0]) ||
-			(cfg->chrootdir && cfg->chrootdir[0] &&
-			strncmp(daemon->pidfile, cfg->chrootdir,
-				strlen(cfg->chrootdir))==0));
+		checkoldpid(daemon->pidfile, pidinchroot);
 	}
 #endif
 
@@ -503,10 +466,11 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #ifdef HAVE_KILL
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		writepid(daemon->pidfile, getpid());
-		if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
+		if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1 &&
+			pidinchroot) {
 #  ifdef HAVE_CHOWN
 			if(chown(daemon->pidfile, cfg_uid, cfg_gid) == -1) {
-				log_err("cannot chown %u.%u %s: %s",
+				verbose(VERB_QUERY, "cannot chown %u.%u %s: %s",
 					(unsigned)cfg_uid, (unsigned)cfg_gid,
 					daemon->pidfile, strerror(errno));
 			}
@@ -592,7 +556,9 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 			log_warn("unable to initgroups %s: %s",
 				cfg->username, strerror(errno));
 #  endif /* HAVE_INITGROUPS */
+#  ifdef HAVE_ENDPWENT
 		endpwent();
+#  endif
 
 #ifdef HAVE_SETRESGID
 		if(setresgid(cfg_gid,cfg_gid,cfg_gid) != 0)
@@ -628,9 +594,10 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
  * @param cmdline_verbose: verbosity resulting from commandline -v.
  *    These increase verbosity as specified in the config file.
  * @param debug_mode: if set, do not daemonize.
+ * @param log_default_identity: Default identity to report in logs
  */
 static void 
-run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
+run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char* log_default_identity)
 {
 	struct config_file* cfg = NULL;
 	struct daemon* daemon = NULL;
@@ -652,7 +619,7 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
 					cfgfile);
 			log_warn("Continuing with default config settings");
 		}
-		apply_settings(daemon, cfg, cmdline_verbose, debug_mode);
+		apply_settings(daemon, cfg, cmdline_verbose, debug_mode, log_default_identity);
 		if(!done_setup)
 			config_lookup_uid(cfg);
 	
@@ -660,7 +627,7 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
 		if(!daemon_open_shared_ports(daemon))
 			fatal_exit("could not open ports");
 		if(!done_setup) { 
-			perform_setup(daemon, cfg, debug_mode, &cfgfile); 
+			perform_setup(daemon, cfg, debug_mode, &cfgfile);
 			done_setup = 1; 
 		} else {
 			/* reopen log after HUP to facilitate log rotation */
@@ -707,19 +674,16 @@ main(int argc, char* argv[])
 	int c;
 	const char* cfgfile = CONFIGFILE;
 	const char* winopt = NULL;
+	const char* log_ident_default;
 	int cmdline_verbose = 0;
 	int debug_mode = 0;
 #ifdef UB_ON_WINDOWS
 	int cmdline_cfg = 0;
 #endif
 
-#ifdef HAVE_SBRK
-	/* take debug snapshot of heap */
-	unbound_start_brk = sbrk(0);
-#endif
-
 	log_init(NULL, 0, NULL);
-	log_ident_set(strrchr(argv[0],'/')?strrchr(argv[0],'/')+1:argv[0]);
+	log_ident_default = strrchr(argv[0],'/')?strrchr(argv[0],'/')+1:argv[0];
+	log_ident_set(log_ident_default);
 	/* parse the options */
 	while( (c=getopt(argc, argv, "c:dhvw:")) != -1) {
 		switch(c) {
@@ -730,7 +694,7 @@ main(int argc, char* argv[])
 #endif
 			break;
 		case 'v':
-			cmdline_verbose ++;
+			cmdline_verbose++;
 			verbosity++;
 			break;
 		case 'd':
@@ -763,7 +727,7 @@ main(int argc, char* argv[])
 		return 1;
 	}
 
-	run_daemon(cfgfile, cmdline_verbose, debug_mode);
+	run_daemon(cfgfile, cmdline_verbose, debug_mode, log_ident_default);
 	log_init(NULL, 0, NULL); /* close logfile */
 	return 0;
 }

daemon/worker.c

@@ -101,57 +101,14 @@
  */
 #define PREFETCH_EXPIRY_ADD 60
 
-#ifdef UNBOUND_ALLOC_STATS
-/** measure memory leakage */
-static void
-debug_memleak(size_t accounted, size_t heap, 
-	size_t total_alloc, size_t total_free)
-{
-	static int init = 0;
-	static size_t base_heap, base_accounted, base_alloc, base_free;
-	size_t base_af, cur_af, grow_af, grow_acc;
-	if(!init) {
-		init = 1;
-		base_heap = heap;
-		base_accounted = accounted;
-		base_alloc = total_alloc;
-		base_free = total_free;
-	}
-	base_af = base_alloc - base_free;
-	cur_af = total_alloc - total_free;
-	grow_af = cur_af - base_af;
-	grow_acc = accounted - base_accounted;
-	log_info("Leakage: %d leaked. growth: %u use, %u acc, %u heap",
-		(int)(grow_af - grow_acc), (unsigned)grow_af, 
-		(unsigned)grow_acc, (unsigned)(heap - base_heap));
-}
-
-/** give debug heap size indication */
-static void
-debug_total_mem(size_t calctotal)
-{
-#ifdef HAVE_SBRK
-	extern void* unbound_start_brk;
-	extern size_t unbound_mem_alloc, unbound_mem_freed;
-	void* cur = sbrk(0);
-	int total = cur-unbound_start_brk;
-	log_info("Total heap memory estimate: %u  total-alloc: %u  "
-		"total-free: %u", (unsigned)total, 
-		(unsigned)unbound_mem_alloc, (unsigned)unbound_mem_freed);
-	debug_memleak(calctotal, (size_t)total, 
-		unbound_mem_alloc, unbound_mem_freed);
-#else
-	(void)calctotal;
-#endif /* HAVE_SBRK */
-}
-#endif /* UNBOUND_ALLOC_STATS */
-
 /** Report on memory usage by this thread and global */
 static void
 worker_mem_report(struct worker* ATTR_UNUSED(worker), 
 	struct serviced_query* ATTR_UNUSED(cur_serv))
 {
 #ifdef UNBOUND_ALLOC_STATS
+	/* measure memory leakage */
+	extern size_t unbound_mem_alloc, unbound_mem_freed;
 	/* debug func in validator module */
 	size_t total, front, back, mesh, msg, rrset, infra, ac, superac;
 	size_t me, iter, val, anch;
@@ -199,7 +156,9 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 		(unsigned)mesh, (unsigned)msg, (unsigned)rrset, 
 		(unsigned)infra, (unsigned)iter, (unsigned)val, (unsigned)anch,
 		(unsigned)ac, (unsigned)superac, (unsigned)me);
-	debug_total_mem(total);
+	log_info("Total heap memory estimate: %u  total-alloc: %u  "
+		"total-free: %u", (unsigned)total, 
+		(unsigned)unbound_mem_alloc, (unsigned)unbound_mem_freed);
 #else /* no UNBOUND_ALLOC_STATS */
 	size_t val = 0;
 	int i;
@@ -483,15 +442,17 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 		qinfo->qname_len, qinfo->qtype, qinfo->qclass,
 		worker->scratchpad, &msg, timenow);
 	if(!dp) { /* no delegation, need to reprime */
-		regional_free_all(worker->scratchpad);
 		return 0;
 	}
+	/* In case we have a local alias, copy it into the delegation message.
+	 * Shallow copy should be fine, as we'll be done with msg in this
+	 * function. */
+	msg->qinfo.local_alias = qinfo->local_alias;
 	if(must_validate) {
 		switch(check_delegation_secure(msg->rep)) {
 		case sec_status_unchecked:
 			/* some rrsets have not been verified yet, go and 
 			 * let validator do that */
-			regional_free_all(worker->scratchpad);
 			return 0;
 		case sec_status_bogus:
 			/* some rrsets are bogus, reply servfail */
@@ -499,9 +460,11 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 			edns->udp_size = EDNS_ADVERTISED_SIZE;
 			edns->ext_rcode = 0;
 			edns->bits &= EDNS_DO;
+			if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL,
+				msg->rep, LDNS_RCODE_SERVFAIL, edns, worker->scratchpad))
+					return 0;
 			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 				&msg->qinfo, id, flags, edns);
-			regional_free_all(worker->scratchpad);
 			if(worker->stats.extended) {
 				worker->stats.ans_bogus++;
 				worker->stats.ans_rcode[LDNS_RCODE_SERVFAIL]++;
@@ -527,14 +490,19 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
 	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
+	if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, msg->rep,
+		(int)(flags&LDNS_RCODE_MASK), edns, worker->scratchpad))
+			return 0;
 	msg->rep->flags |= BIT_QR|BIT_RA;
 	if(!reply_info_answer_encode(&msg->qinfo, msg->rep, id, flags, 
 		repinfo->c->buffer, 0, 1, worker->scratchpad,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
+		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
+			LDNS_RCODE_SERVFAIL, edns, worker->scratchpad))
+				edns->opt_list = NULL;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 			&msg->qinfo, id, flags, edns);
 	}
-	regional_free_all(worker->scratchpad);
 	if(worker->stats.extended) {
 		if(secure) worker->stats.ans_secure++;
 		server_stats_insrcode(&worker->stats, repinfo->c->buffer);
@@ -553,17 +521,29 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	int secure;
 	int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd)
 		&& worker->env.need_to_validate;
-	/* see if it is possible */
-	if(rep->ttl < timenow) {
-		/* the rrsets may have been updated in the meantime.
-		 * we will refetch the message format from the
-		 * authoritative server 
-		 */
-		return 0;
+	if(worker->env.cfg->serve_expired) {
+		/* always lock rrsets, rep->ttl is ignored */
+		if(!rrset_array_lock(rep->ref, rep->rrset_count, 0))
+			return 0;
+		/* below, rrsets with ttl before timenow become TTL 0 in
+		 * the response */
+		/* This response was served with zero TTL */
+		if (timenow >= rep->ttl) {
+			worker->stats.zero_ttl_responses++;
+		}
+	} else {
+		/* see if it is possible */
+		if(rep->ttl < timenow) {
+			/* the rrsets may have been updated in the meantime.
+			 * we will refetch the message format from the
+			 * authoritative server 
+			 */
+			return 0;
+		}
+		if(!rrset_array_lock(rep->ref, rep->rrset_count, timenow))
+			return 0;
+		/* locked and ids and ttls are OK. */
 	}
-	if(!rrset_array_lock(rep->ref, rep->rrset_count, timenow))
-		return 0;
-	/* locked and ids and ttls are OK. */
 	/* check CNAME chain (if any) */
 	if(rep->an_numrrsets > 0 && (rep->rrsets[0]->rk.type == 
 		htons(LDNS_RR_TYPE_CNAME) || rep->rrsets[0]->rk.type == 
@@ -574,7 +554,6 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		bail_out:
 			rrset_array_unlock_touch(worker->env.rrset_cache, 
 				worker->scratchpad, rep->ref, rep->rrset_count);
-			regional_free_all(worker->scratchpad);
 			return 0;
 		}
 	}
@@ -585,11 +564,13 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		edns->udp_size = EDNS_ADVERTISED_SIZE;
 		edns->ext_rcode = 0;
 		edns->bits &= EDNS_DO;
+		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, rep,
+			LDNS_RCODE_SERVFAIL, edns, worker->scratchpad))
+				return 0;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 			qinfo, id, flags, edns);
 		rrset_array_unlock_touch(worker->env.rrset_cache, 
 			worker->scratchpad, rep->ref, rep->rrset_count);
-		regional_free_all(worker->scratchpad);
 		if(worker->stats.extended) {
 			worker->stats.ans_bogus ++;
 			worker->stats.ans_rcode[LDNS_RCODE_SERVFAIL] ++;
@@ -616,9 +597,15 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
 	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
+	if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, rep,
+		(int)(flags&LDNS_RCODE_MASK), edns, worker->scratchpad))
+			return 0;
 	if(!reply_info_answer_encode(qinfo, rep, id, flags, 
 		repinfo->c->buffer, timenow, 1, worker->scratchpad,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
+		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
+			LDNS_RCODE_SERVFAIL, edns, worker->scratchpad))
+				edns->opt_list = NULL;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 			qinfo, id, flags, edns);
 	}
@@ -626,7 +613,6 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	 * is bad while holding locks. */
 	rrset_array_unlock_touch(worker->env.rrset_cache, worker->scratchpad,
 		rep->ref, rep->rrset_count);
-	regional_free_all(worker->scratchpad);
 	if(worker->stats.extended) {
 		if(secure) worker->stats.ans_secure++;
 		server_stats_insrcode(&worker->stats, repinfo->c->buffer);
@@ -658,9 +644,11 @@ reply_and_prefetch(struct worker* worker, struct query_info* qinfo,
  * @param pkt: buffer
  * @param str: string to put into text record (<255).
  * @param edns: edns reply information.
+ * @param worker: worker with scratch region.
  */
 static void
-chaos_replystr(sldns_buffer* pkt, const char* str, struct edns_data* edns)
+chaos_replystr(sldns_buffer* pkt, const char* str, struct edns_data* edns,
+	struct worker* worker)
 {
 	size_t len = strlen(str);
 	unsigned int rd = LDNS_RD_WIRE(sldns_buffer_begin(pkt));
@@ -689,6 +677,9 @@ chaos_replystr(sldns_buffer* pkt, const char* str, struct edns_data* edns)
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
 	edns->bits &= EDNS_DO;
+	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
+		LDNS_RCODE_NOERROR, edns, worker->scratchpad))
+			edns->opt_list = NULL;
 	attach_edns_record(pkt, edns);
 }
 
@@ -718,13 +709,13 @@ answer_chaos(struct worker* w, struct query_info* qinfo,
 			char buf[MAXHOSTNAMELEN+1];
 			if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
 				buf[MAXHOSTNAMELEN] = 0;
-				chaos_replystr(pkt, buf, edns);
+				chaos_replystr(pkt, buf, edns, w);
 			} else 	{
 				log_err("gethostname: %s", strerror(errno));
-				chaos_replystr(pkt, "no hostname", edns);
+				chaos_replystr(pkt, "no hostname", edns, w);
 			}
 		}
-		else 	chaos_replystr(pkt, cfg->identity, edns);
+		else 	chaos_replystr(pkt, cfg->identity, edns, w);
 		return 1;
 	}
 	if(query_dname_compare(qinfo->qname, 
@@ -735,8 +726,8 @@ answer_chaos(struct worker* w, struct query_info* qinfo,
 		if(cfg->hide_version) 
 			return 0;
 		if(cfg->version==NULL || cfg->version[0]==0)
-			chaos_replystr(pkt, PACKAGE_STRING, edns);
-		else 	chaos_replystr(pkt, cfg->version, edns);
+			chaos_replystr(pkt, PACKAGE_STRING, edns, w);
+		else 	chaos_replystr(pkt, cfg->version, edns, w);
 		return 1;
 	}
 	return 0;
@@ -768,6 +759,8 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_flip(c->buffer);
 		return 1;
 	}
 
@@ -799,6 +792,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct query_info qinfo;
 	struct edns_data edns;
 	enum acl_access acl;
+	struct acl_addr* acladdr;
 	int rc = 0;
 
 	if(error != NETEVENT_NOERROR) {
@@ -811,8 +805,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		dt_msg_send_client_query(&worker->dtenv, &repinfo->addr, c->type,
 			c->buffer);
 #endif
-	acl = acl_list_lookup(worker->daemon->acl, &repinfo->addr, 
+	acladdr = acl_addr_lookup(worker->daemon->acl, &repinfo->addr, 
 		repinfo->addrlen);
+	acl = acl_get_control(acladdr);
 	if((ret=deny_refuse_all(c, acl, worker, repinfo)) != -1)
 	{
 		if(ret == 1)
@@ -865,12 +860,18 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		}
 		goto send_reply;
 	}
-	if((ret=parse_edns_from_pkt(c->buffer, &edns)) != 0) {
+	if((ret=parse_edns_from_pkt(c->buffer, &edns, worker->scratchpad)) != 0) {
+		struct edns_data reply_edns;
 		verbose(VERB_ALGO, "worker parse edns: formerror.");
 		log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
-		sldns_buffer_rewind(c->buffer);
-		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		memset(&reply_edns, 0, sizeof(reply_edns));
+		reply_edns.edns_present = 1;
+		reply_edns.udp_size = EDNS_ADVERTISED_SIZE;
 		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), ret);
+		error_encode(c->buffer, ret, &qinfo,
+			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
+			sldns_buffer_read_u16_at(c->buffer, 2), &reply_edns);
+		regional_free_all(worker->scratchpad);
 		server_stats_insrcode(&worker->stats, c->buffer);
 		goto send_reply;
 	}
@@ -879,12 +880,14 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		edns.edns_version = EDNS_ADVERTISED_VERSION;
 		edns.udp_size = EDNS_ADVERTISED_SIZE;
 		edns.bits &= EDNS_DO;
+		edns.opt_list = NULL;
 		verbose(VERB_ALGO, "query with bad edns version.");
 		log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
 		error_encode(c->buffer, EDNS_RCODE_BADVERS&0xf, &qinfo,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), NULL);
 		attach_edns_record(c->buffer, &edns);
+		regional_free_all(worker->scratchpad);
 		goto send_reply;
 	}
 	if(edns.edns_present && edns.udp_size < NORMAL_UDP_SIZE &&
@@ -913,6 +916,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		sldns_buffer_write_at(c->buffer, 4, 
 			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
 		sldns_buffer_flip(c->buffer);
+		regional_free_all(worker->scratchpad);
 		goto send_reply;
 	}
 	if(worker->stats.extended)
@@ -923,10 +927,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	if(qinfo.qclass == LDNS_RR_CLASS_CH && answer_chaos(worker, &qinfo,
 		&edns, c->buffer)) {
 		server_stats_insrcode(&worker->stats, c->buffer);
+		regional_free_all(worker->scratchpad);
 		goto send_reply;
 	}
-	if(local_zones_answer(worker->daemon->local_zones, &qinfo, &edns, 
-		c->buffer, worker->scratchpad, repinfo)) {
+	if(local_zones_answer(worker->daemon->local_zones, &worker->env, &qinfo,
+		&edns, c->buffer, worker->scratchpad, repinfo, acladdr->taglist,
+		acladdr->taglen, acladdr->tag_actions,
+		acladdr->tag_actions_size, acladdr->tag_datas,
+		acladdr->tag_datas_size, worker->daemon->cfg->tagname,
+		worker->daemon->cfg->num_tags, acladdr->view)) {
 		regional_free_all(worker->scratchpad);
 		if(sldns_buffer_limit(c->buffer) == 0) {
 			comm_point_drop_reply(repinfo);
@@ -940,6 +949,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	 * might need to bail out based on ACLs now. */
 	if((ret=deny_refuse_non_local(c, acl, worker, repinfo)) != -1)
 	{
+		regional_free_all(worker->scratchpad);
 		if(ret == 1)
 			goto send_reply;
 		return ret;
@@ -956,46 +966,76 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
 		sldns_buffer_flip(c->buffer);
+		regional_free_all(worker->scratchpad);
 		server_stats_insrcode(&worker->stats, c->buffer);
 		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
 			&repinfo->addr, repinfo->addrlen);
 		goto send_reply;
 	}
-	h = query_info_hash(&qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
-	if((e=slabhash_lookup(worker->env.msg_cache, h, &qinfo, 0))) {
-		/* answer from cache - we have acquired a readlock on it */
-		if(answer_from_cache(worker, &qinfo, 
-			(struct reply_info*)e->data, 
-			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer), 
-			sldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
-			&edns)) {
-			/* prefetch it if the prefetch TTL expired */
-			if(worker->env.cfg->prefetch && *worker->env.now >=
-				((struct reply_info*)e->data)->prefetch_ttl) {
-				time_t leeway = ((struct reply_info*)e->
-					data)->ttl - *worker->env.now;
-				lock_rw_unlock(&e->lock);
-				reply_and_prefetch(worker, &qinfo, 
-					sldns_buffer_read_u16_at(c->buffer, 2),
-					repinfo, leeway);
-				rc = 0;
-				goto send_reply_rc;
-			}
-			lock_rw_unlock(&e->lock);
-			goto send_reply;
+
+	/* If we've found a local alias, replace the qname with the alias
+	 * target before resolving it. */
+	if(qinfo.local_alias) {
+		struct ub_packed_rrset_key* rrset = qinfo.local_alias->rrset;
+		struct packed_rrset_data* d = rrset->entry.data;
+
+		/* Sanity check: our current implementation only supports
+		 * a single CNAME RRset as a local alias. */
+		if(qinfo.local_alias->next ||
+			rrset->rk.type != htons(LDNS_RR_TYPE_CNAME) ||
+			d->count != 1) {
+			log_err("assumption failure: unexpected local alias");
+			regional_free_all(worker->scratchpad);
+			return 0; /* drop it */
 		}
-		verbose(VERB_ALGO, "answer from the cache failed");
-		lock_rw_unlock(&e->lock);
+		qinfo.qname = d->rr_data[0] + 2;
+		qinfo.qname_len = d->rr_len[0] - 2;
 	}
-	if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
-		if(answer_norec_from_cache(worker, &qinfo,
-			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer), 
-			sldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
-			&edns)) {
-			goto send_reply;
+
+	if(!edns_bypass_cache_stage(edns.opt_list, &worker->env)) {
+		h = query_info_hash(&qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
+		if((e=slabhash_lookup(worker->env.msg_cache, h, &qinfo, 0))) {
+			/* answer from cache - we have acquired a readlock on it */
+			if(answer_from_cache(worker, &qinfo, 
+				(struct reply_info*)e->data, 
+				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer), 
+				sldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
+				&edns)) {
+				/* prefetch it if the prefetch TTL expired */
+				if((worker->env.cfg->prefetch || worker->env.cfg->serve_expired)
+					&& *worker->env.now >=
+					((struct reply_info*)e->data)->prefetch_ttl) {
+					time_t leeway = ((struct reply_info*)e->
+						data)->ttl - *worker->env.now;
+					if(((struct reply_info*)e->data)->ttl
+						< *worker->env.now)
+						leeway = 0;
+					lock_rw_unlock(&e->lock);
+					reply_and_prefetch(worker, &qinfo, 
+						sldns_buffer_read_u16_at(c->buffer, 2),
+						repinfo, leeway);
+					rc = 0;
+					regional_free_all(worker->scratchpad);
+					goto send_reply_rc;
+				}
+				lock_rw_unlock(&e->lock);
+				regional_free_all(worker->scratchpad);
+				goto send_reply;
+			}
+			verbose(VERB_ALGO, "answer from the cache failed");
+			lock_rw_unlock(&e->lock);
+		}
+		if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
+			if(answer_norec_from_cache(worker, &qinfo,
+				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer), 
+				sldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
+				&edns)) {
+				regional_free_all(worker->scratchpad);
+				goto send_reply;
+			}
+			verbose(VERB_ALGO, "answer norec from cache -- "
+				"need to validate or not primed");
 		}
-		verbose(VERB_ALGO, "answer norec from cache -- "
-			"need to validate or not primed");
 	}
 	sldns_buffer_rewind(c->buffer);
 	server_stats_querymiss(&worker->stats, worker);
@@ -1012,6 +1052,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	mesh_new_client(worker->env.mesh, &qinfo, 
 		sldns_buffer_read_u16_at(c->buffer, 2),
 		&edns, repinfo, *(uint16_t*)(void *)sldns_buffer_begin(c->buffer));
+	regional_free_all(worker->scratchpad);
 	worker_mem_report(worker, NULL);
 	return 0;
 
@@ -1212,7 +1253,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		cfg->do_tcp?cfg->outgoing_num_tcp:0, 
 		worker->daemon->env->infra_cache, worker->rndstate,
 		cfg->use_caps_bits_for_id, worker->ports, worker->numports,
-		cfg->unwanted_threshold, &worker_alloc_cleanup, worker,
+		cfg->unwanted_threshold, cfg->outgoing_tcp_mss,
+		&worker_alloc_cleanup, worker,
 		cfg->do_udp, worker->daemon->connect_sslctx, cfg->delay_close,
 		dtenv);
 	if(!worker->back) {
@@ -1347,10 +1389,10 @@ worker_delete(struct worker* worker)
 }
 
 struct outbound_entry*
-worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
-	uint16_t qclass, uint16_t flags, int dnssec, int want_dnssec,
-	int nocaps, struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t* zone, size_t zonelen, struct module_qstate* q)
+worker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec,
+	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* zone, size_t zonelen, int ssl_upstream,
+	struct module_qstate* q)
 {
 	struct worker* worker = q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -1358,11 +1400,10 @@ worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	if(!e) 
 		return NULL;
 	e->qstate = q;
-	e->qsent = outnet_serviced_query(worker->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, want_dnssec, nocaps,
-		q->env->cfg->tcp_upstream, q->env->cfg->ssl_upstream, addr,
-		addrlen, zone, zonelen, worker_handle_service_reply, e,
-		worker->back->udp_buff);
+	e->qsent = outnet_serviced_query(worker->back, qinfo, flags, dnssec,
+		want_dnssec, nocaps, q->env->cfg->tcp_upstream,
+		ssl_upstream, addr, addrlen, zone, zonelen, q,
+		worker_handle_service_reply, e, worker->back->udp_buff, q->env);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -1402,13 +1443,13 @@ void worker_stop_accept(void* arg)
 }
 
 /* --- fake callbacks for fptr_wlist to work --- */
-struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
-	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
-	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
-	int ATTR_UNUSED(nocaps), struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
-	size_t ATTR_UNUSED(zonelen), struct module_qstate* ATTR_UNUSED(q))
+struct outbound_entry* libworker_send_query(
+	struct query_info* ATTR_UNUSED(qinfo),
+	uint16_t ATTR_UNUSED(flags), int ATTR_UNUSED(dnssec),
+	int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps),
+	struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen),
+	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen),
+	int ATTR_UNUSED(ssl_upstream), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;

daemon/worker.h

@@ -61,6 +61,7 @@ struct ub_randstate;
 struct regional;
 struct tube;
 struct daemon_remote;
+struct query_info;
 
 /** worker commands */
 enum worker_commands {

dns64/dns64.c

@@ -521,13 +521,14 @@ handle_event_moddone(struct module_qstate* qstate, int id)
      *   - An internal query.
      *   - A query for a record type other than AAAA.
      *   - CD FLAG was set on querier
-     *   - An AAAA query for which an error was returned.
+     *   - An AAAA query for which an error was returned.(qstate.return_rcode)
+     *     -> treated as servfail thus synthesize (sec 5.1.3 6147), thus
+     *        synthesize in (sec 5.1.2 of RFC6147).
      *   - A successful AAAA query with an answer.
      */
 	if ( (enum dns64_qstate)qstate->minfo[id] == DNS64_INTERNAL_QUERY
             || qstate->qinfo.qtype != LDNS_RR_TYPE_AAAA
 	    || (qstate->query_flags & BIT_CD)
-	    || qstate->return_rcode != LDNS_RCODE_NOERROR  
 	    || (qstate->return_msg &&
 		    qstate->return_msg->rep &&
 		    reply_find_answer_rrset(&qstate->qinfo,
@@ -824,8 +825,9 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	}
 
 	/* Store the generated response in cache. */
-	if (!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-	    0, 0, 0, NULL, super->query_flags))
+	if (!super->no_cache_store &&
+		!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
+		0, 0, 0, NULL, super->query_flags))
 		log_err("out of memory");
 }
 
@@ -871,7 +873,7 @@ static struct module_func_block dns64_block = {
  * Function for returning the above function block.
  */
 struct module_func_block *
-dns64_get_funcblock()
+dns64_get_funcblock(void)
 {
 	return &dns64_block;
 }

dnstap/dnstap.c

@@ -128,7 +128,8 @@ dt_create(const char *socket_path, unsigned num_workers)
 	struct fstrm_writer *fw;
 	struct fstrm_writer_options *fwopt;
 
-	verbose(VERB_OPS, "opening dnstap socket %s", socket_path);
+	verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
+		socket_path);
 	log_assert(socket_path != NULL);
 	log_assert(num_workers > 0);
 
@@ -474,7 +475,7 @@ dt_msg_send_outside_response(struct dt_env *env,
 			return;
 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
 	} else {
-		if (!env->log_resolver_query_messages)
+		if (!env->log_resolver_response_messages)
 			return;
 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE);
 	}

dnstap/dnstap.proto

@@ -105,7 +105,7 @@ message Message {
 
     enum Type {
         // AUTH_QUERY is a DNS query message received from a resolver by an
-        // authoritative name server, from the perspective of the authorative
+        // authoritative name server, from the perspective of the authoritative
         // name server.
         AUTH_QUERY = 1;
 

doc/Changelog

@@ -1,3 +1,736 @@
+8 December 2016: Wouter
+	- Fix downcast warnings from visual studio in sldns code.
+
+7 December 2016: Ralph
+	- Add DSA support for OpenSSL 1.1.0
+	- Fix remote control without cert for LibreSSL
+
+6 December 2016: George
+	- Added generic EDNS code for registering known EDNS option codes,
+	  bypassing the cache response stage and uniquifying mesh states. Four EDNS
+	  option lists were added to module_qstate (module_qstate.edns_opts_*) to
+	  store EDNS options from/to front/back side.
+	- Added two flags to module_qstate (no_cache_lookup, no_cache_store) that
+	  control the modules' cache interactions.
+	- Added code for registering inplace callback functions. The registered
+	  functions can be called just before replying with local data or Chaos,
+	  replying from cache, replying with SERVFAIL, replying with a resolved
+	  query, sending a query to a nameserver. The functions can inspect the
+	  available data and maybe change response/query related data (i.e. append
+	  EDNS options).
+	- Updated Python module for the above.
+	- Updated Python documentation.
+
+5 December 2016: Ralph
+	- Fix #1173: differ local-zone type deny from unset
+	  tag_actions element.
+
+5 December 2016: Wouter
+	- Fix #1170: document that 'inform' local-zone uses local-data.
+
+1 December 2016: Ralph
+	- hyphen as minus fix, by Andreas Schulze
+
+30 November 2016: Ralph
+	- Added local-zones and local-data bulk addition and removal
+	  functionality in unbound-control (local_zones, local_zones_remove,
+	  local_datas and local_datas_remove).
+	- iana portlist update
+
+29 November 2016: Wouter
+	- version 1.6.0 is in the development branch.
+	- braces in view.c around lock statements.
+
+28 November 2016: Wouter
+	- new install-sh.
+
+25 November 2016: Wouter
+	- Fix that with openssl 1.1 control-use-cert: no uses less cpu, by
+	  using no encryption over the unix socket.
+
+22 Novenber 2016: Ralph
+	- Make access-control-tag-data RDATA absolute. This makes the RDATA
+	  origin consistent between local-data and access-control-tag-data.
+	- Fix NSEC ENT wildcard check. Matching wildcard does not have to be a
+	  subdomain of the NSEC owner.
+	- QNAME minimisation uses QTYPE=A, therefore always check cache for
+	  this type in harden-below-nxdomain functionality.
+	- Added unit test for QNAME minimisation + harden below nxdomain
+	  synergy.
+
+22 November 2016: Wouter
+	- iana portlist update.
+	- Fix unit tests for DS hash processing for fake-dsa test option.
+	- patch from Dag-Erling Smorgrav that removes code that relies
+	  on sbrk().
+
+21 November 2016: Wouter
+	- Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing
+	  Underneath" for the harden-below-nxdomain option.
+
+10 November 2016: Ralph
+	- Fix #1155: test status code of unbound-control in 04-checkconf,
+	  not the status code from the tee command.
+
+4 November 2016: Ralph
+	- Added stub-ssl-upstream and forward-ssl-upstream options.
+
+4 November 2016: Wouter
+	- configure detects ssl security level API function in the autoconf
+	  manner.  Every function on its own, so that other libraries (eg.
+	  LibreSSL) can develop their API without hindrance.
+	- Fix #1154: segfault when reading config with duplicate zones.
+	- Note that for harden-below-nxdomain the nxdomain must be secure,
+	  this means nsec3 with optout is insufficient.
+
+3 November 2016: Ralph
+	- Set OpenSSL security level to 0 when using aNULL ciphers.
+
+3 November 2016: Wouter
+	- .gitattributes line for githubs code language display.
+	- log-identity: config option to set sys log identity, patch from
+	  "Robin H. Johnson" <robbat2@gentoo.org>
+
+2 November 2016: Wouter
+	- iana portlist update.
+
+31 October 2016: Wouter
+	- Fix failure to build on arm64 with no sbrk.
+	- iana portlist update.
+
+28 October 2016: Wouter
+	- Patch for server.num.zero_ttl stats for count of expired replies,
+	  from Pavel Odintsov.
+
+26 October 2016: Wouter
+	- Fix unit tests for openssl 1.1, with no DSA, by faking DSA, enabled
+	  with the undocumented switch 'fake-dsa'.  It logs a warning.
+
+25 October 2016: Wouter
+	- Fix #1134: unbound-control set_option -- val-override-date: -1 works
+	  immediately to ignore datetime, or back to 0 to enable it again.
+	  The -- is to ignore the '-1' as an option flag.
+
+24 October 2016: Wouter
+	- serve-expired config option: serve expired responses with TTL 0.
+	- g.root-servers.net has AAAA address.
+
+21 October 2016: Wouter
+	- Ported tests for local_cname unit test to testbound framework.
+
+20 October 2016: Wouter
+	- suppress compile warning in lex files.
+	- init lzt variable, for older gcc compiler warnings.
+	- fix --enable-dsa to work, instead of copying ecdsa enable.
+	- Fix DNSSEC validation of query type ANY with DNAME answers.
+	- Fixup query_info local_alias init.
+
+19 October 2016: Wouter
+	- Fix #1130: whitespace in example.conf.in more consistent.
+
+18 October 2016: Wouter
+	- Patch that resolves CNAMEs entered in local-data conf statements that
+	  point to data on the internet, from Jinmei Tatuya (Infoblox).
+	- Removed patch comments from acllist.c and msgencode.c
+	- Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf,
+	  from Jinmei Tatuya (Infoblox).
+	- Fix #1125: unbound could reuse an answer packet incorrectly for
+	  clients with different EDNS parameters, from Jinmei Tatuya.
+	- Fix #1118: libunbound.pc sets strange Libs, Libs.private values.
+	- Added Requires line to libunbound.pc
+	- Please doxygen by modifying mesh.h
+
+17 October 2016: Wouter
+	- Re-fix #839 from view commit overwrite.
+	- Fixup const void cast warning.
+
+12 October 2016: Ralph
+	- Free view config elements.
+
+11 October 2016: Ralph
+	- Added qname-minimisation-strict config option.
+	- iana portlist update.
+	- fix memoryleak logfile when in debug mode.
+
+5 October 2016: Ralph
+	- Added views functionality.
+	- Fix #1117: spelling errors, from Robert Edmonds.
+
+30 September 2016: Wouter
+	- Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav.
+
+29 September 2016: Wouter
+	- Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
+	- Fix #839: Memory grows unexpectedly with large RPZ files.
+	- Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile.
+	- Fix #841: big local-zone's make it consume large amounts of memory.
+
+27 September 2016: Wouter
+	- tag for 1.5.10 release
+	- trunk contains 1.5.11 in development.
+	- Fix dnstap relaying "random" messages instead of resolver/forwarder
+	  responses, from Nikolay Edigaryev.
+	- Fix #836: unbound could echo back EDNS options in an error response.
+
+20 September 2016: Wouter
+	- iana portlist update.
+	- Fix #835: fix --disable-dsa with nettle verify.
+	- tag for 1.5.10rc1 release.
+
+15 September 2016: Wouter
+	- Fix 883: error for duplicate local zone entry.
+	- Test for openssl init_crypto and init_ssl functions.
+
+15 September 2016: Ralph
+	- fix potential memory leak in daemon/remote.c and nullpointer
+	  dereference in validator/autotrust.
+	- iana portlist update.
+
+13 September 2016: Wouter
+	- Silenced flex-generated sign-unsigned warning print with gcc
+	  diagnostic pragma.
+	- Fix for new splint on FreeBSD.  Fix cast for sockaddr_un.sun_len.
+
+9 September 2016: Wouter
+	- Fix #831: workaround for spurious fread_chk warning against petal.c
+
+5 September 2016: Ralph
+	- Take configured minimum TTL into consideration when reducing TTL
+	  to original TTL from RRSIG.
+
+5 September 2016: Wouter
+	- Fix #829: doc of sldns_wire2str_rdata_buf() return value has an
+	  off-by-one typo, from Jinmei Tatuya (Infoblox).
+	- Fix incomplete prototypes reported by Dag-Erling Smørgrav.
+	- Fix #828: missing type in access-control-tag-action redirect results
+	  in NXDOMAIN.
+
+2 September 2016: Wouter
+	- Fix compile with openssl 1.1.0 with api=1.1.0.
+
+1 September 2016: Wouter
+	- RFC 7958 is now out, updated docs for unbound-anchor.
+	- Fix for compile without warnings with openssl 1.1.0.
+	- Fix #826: Fix refuse_non_local could result in a broken response.
+	- iana portlist update.
+
+29 August 2016: Wouter
+	- Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A.
+	  Siewior.
+	- Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
+
+25 August 2016: Ralph
+	- Clarify local-zone-override entry in unbound.conf.5 
+	
+25 August 2016: Wouter
+	- 64bit build option for makedist windows compile, -w64.
+
+24 August 2016: Ralph
+	- Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter
+	  in each iteration in find_tag_datas().
+	- unbound.conf.5 entries for define-tag, access-control-tag,
+	  access-control-tag-action, access-control-tag-data, local-zone-tag,
+	  and local-zone-override.
+	  
+23 August 2016: Wouter
+	- Fix #804: unbound stops responding after outage.  Fixes queries
+	  that attempt to wait for an empty list of subqueries.
+	- Fix #804: lower num_target_queries for iterator also for failed
+	  lookups.
+
+8 August 2016: Wouter
+	- Note that OPENPGPKEY type is RFC 7929.
+
+4 August 2016: Wouter
+	- Fix #807: workaround for possible some "unused" function parameters
+	  in test code, from Jinmei Tatuya.
+
+3 August 2016: Wouter
+	- use sendmsg instead of sendto for TFO.
+
+28 July 2016: Wouter
+	- Fix #806: wrong comment removed.
+
+26 July 2016: Wouter
+	- nicer ratelimit-below-domain explanation.
+
+22 July 2016: Wouter
+	- Fix #801: missing error condition handling in
+	  daemon_create_workers().
+	- Fix #802: workaround for function parameters that are "unused"
+	  without log_assert.
+	- Fix #803: confusing (and incorrect) code comment in daemon_cleanup().
+
+20 July 2016: Wouter
+	- Fix typo in unbound.conf.
+
+18 July 2016: Wouter
+	- Fix #798: Client-side TCP fast open fails (Linux).
+
+14 July 2016: Wouter
+	- TCP Fast open patch from Sara Dickinson.
+	- Fixed unbound.doxygen for 1.8.11.
+
+7 July 2016: Wouter
+	- access-control-tag-data implemented. verbose(4) prints tag debug.
+
+5 July 2016: Wouter
+	- Fix dynamic link of anchor-update.exe on windows.
+	- Fix detect of mingw for MXE package build.
+	- Fixes for 64bit windows compile.
+	- Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and
+	  --with-libunbound-only --with-nettle.
+
+4 July 2016: Wouter
+	- For #787: prefer-ip6 option for unbound.conf prefers to send
+	  upstream queries to ipv6 servers.
+	- Fix #787: outgoing-interface netblock/64 ipv6 option to use linux
+	  freebind to use 64bits of entropy for every query with random local
+	  part.
+
+30 June 2016: Wouter
+	- Document always_transparent, always_refuse, always_nxdomain types.
+
+29 June 2016: Wouter
+	- Fix static compile on windows missing gdi32.
+
+28 June 2016: Wouter
+	- Create a pkg-config file for libunbound in contrib.
+
+27 June 2016: Wouter
+	- Fix #784: Build configure assumess that having getpwnam means there
+	  is endpwent function available.
+	- Updated repository with newer flex and bison output.
+
+24 June 2016: Ralph
+	- Possibility to specify local-zone type for an acl/tag pair
+	- Possibility to specify (override) local-zone type for a source address
+	  block
+16 June 2016: Ralph
+	- Decrease dp attempts at each QNAME minimisation iteration
+
+16 June 2016: Wouter
+	- Fix tcp timeouts in tv.usec.
+
+15 June 2016: Wouter
+	- TCP_TIMEOUT is specified in milliseconds.
+	- If more than half of tcp connections are in use, a shorter timeout
+	  is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
+
+14 June 2016: Ralph
+	- QNAME minimisation unit test for dropped QTYPE=A queries.
+
+14 June 2016: Wouter
+	- Fix 775: unbound-host and unbound-anchor crash on windows, ignore
+	  null delete for wsaevent.
+	- Fix spelling in freebind option man page text.
+	- Fix windows link of ssl with crypt32.
+	- Fix 779: Union casting is non-portable.
+	- Fix 780: MAP_ANON not defined in HP-UX 11.31.
+	- Fix 781: prealloc() is an HP-UX system library call.
+
+13 June 2016: Ralph
+	- Use QTYPE=A for QNAME minimisation.
+	- Keep track of number of time-outs when performing QNAME minimisation.
+	  Stop minimising when number of time-outs for a QNAME/QTYPE pair is
+	  more than three.
+
+13 June 2016: Wouter
+	- Fix #778: unbound 1.5.9: -h segfault (null deref).
+	- Fix directory: fix for unbound-checkconf, it restores cwd.
+
+10 June 2016: Wouter
+	- And delete service.conf.shipped on uninstall.
+	- In unbound.conf directory: dir immediately changes to that directory,
+	  so that include: file below that is relative to that directory.
+	  With chroot, make the directory an absolute path inside chroot.
+	- keep debug symbols in windows build.
+	- do not delete service.conf on windows uninstall.
+	- document directory immediate fix and allow EXECUTABLE syntax in it
+	  on windows.
+
+9 June 2016: Wouter
+	- Trunk is called 1.5.10 (with previous fixes already in there to 2
+	  june).
+	- Revert fix for NetworkService account on windows due to breakage
+	  it causes.
+	- Fix that windows install will not overwrite existing service.conf
+	  file (and ignore gui config choices if it exists).
+
+7 June 2016: Ralph
+	- Lookup localzones by taglist from acl.
+	- Possibility to lookup local_zone, regardless the taglist.
+	- Added local_zone/taglist/acl unit test.
+
+7 June 2016: Wouter
+	- Fix #773: Non-standard Python location build failure with pyunbound.
+	- Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
+
+6 June 2016: Wouter
+	- Better help text from -h (from Ray Griffith).
+	- access-control-tag config directive.
+	- local-zone-override config directive.
+	- access-control-tag-action and access-control-tag-data config
+	  directives.
+	- free acl-tags, acltag-action and acltag-data config lists during
+	  initialisation to free up memory for more entries.
+
+3 June 2016: Wouter
+	- Fix to not ignore return value of chown() in daemon startup.
+
+2 June 2016: Wouter
+	- Fix libubound for edns optlist feature.
+	- Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc.
+	- Fix #752: retry resource temporarily unavailable on control pipe.
+	- un-document localzone tags.
+	- tag for release 1.5.9rc1.
+	  And this also became release 1.5.9.
+	- Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to
+	  Program Files with (x86) appended.
+	- re-documented localzone tags in example.conf.
+
+31 May 2016: Wouter
+	- Fix windows service to be created run with limited rights, as a
+	  network service account, from Mario Turschmann.
+	- compat strsep implementation.
+	- generic edns option parse and store code.
+	- and also generic edns options for upstream messages (and replies).
+	  after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID),
+	  to insert use edns_opt_append(edns, region, code, len, bindata) on
+	  the opt_list passed to send_query, or in edns_opt_inplace_reply.
+
+30 May 2016: Wouter
+	- Fix time in case answer comes from cache in ub_resolve_event().
+	- Attempted fix for #765: _unboundmodule missing for python3.
+
+27 May 2016: Wouter
+	- Fix #770: Small subgroup attack on DH used in unix pipe on localhost
+	  if unbound control uses a unix local named pipe.
+	- Document write permission to directory of trust anchor needed.
+	- Fix #768:  Unbound Service Sometimes Can Not Shutdown
+	  Completely, WER Report Shown Up.  Close handle before closing WSA.
+
+26 May 2016: Wouter
+	- Updated patch from Charles Walker.
+
+24 May 2016: Wouter
+	- disable-dnssec-lame-check config option from Charles Walker.
+	- remove memory leak from lame-check patch.
+	- iana portlist update.
+
+23 May 2016: Wouter
+	- Fix #767:  Reference to an expired Internet-Draft in
+	  harden-below-nxdomain documentation.
+
+20 May 2016: Ralph
+	- No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC 
+	  signed zones.
+	- iana portlist update.
+
+19 May 2016: Wouter
+	- Fix #766: dns64 should synthesize results on timeout/errors.
+
+18 May 2016: Wouter
+	- Fix #761: DNSSEC LAME false positive resolving nic.club.
+
+17 May 2016: Wouter
+	- trunk updated with output of flex 2.6.0.
+
+6 May 2016: Wouter
+	- Fix memory leak in out-of-memory conditions of local zone add.
+
+29 April 2016: Wouter
+	- Fix sldns with static checking fixes copied from getdns.
+
+28 April 2016: Wouter
+	- Fix #759: 0x20 capsforid no longer checks type PTR, for
+	  compatibility with cisco dns guard.  This lowers false positives.
+
+18 April 2016: Wouter
+	- Fix some malformed reponses to edns queries get fallback to nonedns.
+
+15 April 2016: Wouter
+	- cachedb module event handling design.
+
+14 April 2016: Wouter
+	- cachedb module framework (empty).
+	- iana portlist update.
+
+12 April 2016: Wouter
+	- Fix #753: document dump_requestlist is for first thread.
+
+24 March 2016: Wouter
+	- Document permit-small-holddown for 5011 debug.
+	- Fix #749: unbound-checkconf gets SIGSEGV when use against a
+	  malformatted conf file.
+
+23 March 2016: Wouter
+	- OpenSSL 1.1.0 portability, --disable-dsa configure option.
+
+21 March 2016: Wouter
+	- Fix compile of getentropy_linux for SLES11 servicepack 4.
+	- Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev.
+	- Fix test for openssl to use HMAC_Update for 1.1.0.
+	- acx_nlnetlabs.m4 to v33, with HMAC_Update.
+	- acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto.
+	- ERR_remove_state deprecated since openssl 1.0.0.
+	- OPENSSL_config is deprecated, removing.
+
+18 March 2016: Ralph
+	- Validate QNAME minimised NXDOMAIN responses.
+	- If QNAME minimisation is enabled, do cache lookup for QTYPE NS in
+	  harden-below-nxdomain.
+
+17 March 2016: Ralph
+	- Limit number of QNAME minimisation iterations.
+
+17 March 2016: Wouter
+	- Fix #746: Fix unbound sets CD bit on all forwards.
+	  If no trust anchors, it'll not set CD bit when forwarding to another
+	  server.  If a trust anchor, no CD bit on the first attempt to a
+	  forwarder, but CD bit thereafter on repeated attempts to get DNSSEC.
+	- iana portlist update.
+
+16 March 2016: Wouter
+	- Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma.
+	- Fix ip-transparent for tcp on freebsd.
+
+15 March 2016: Wouter
+	- ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for
+	  binding to an IP address while the interface or address is down.
+
+14 March 2016: Wouter
+	- Fix warnings in ifdef corner case, older or unknown libevent.
+	- Fix compile for ub_event code with older libev.
+
+11 March 2016: Wouter
+	- Remove warning about unused parameter in event_pluggable.c.
+	- Fix libev usage of dispatch return value.
+	- No side effects in tolower() call, in case it is a macro.
+	- For test put free in pluggable api in parenthesis.
+
+10 March 2016: Wouter
+	- Fixup backend2str for libev.
+
+09 March 2016: Willem
+	- User defined pluggable event API for libunbound
+	- Fixup of compile fix for pluggable event API from P.Y. Adi
+	  Prasaja.
+
+09 March 2016: Wouter
+	- Updated configure and ltmain.sh.
+	- Updated L root IPv6 address.
+
+07 March 2016: Wouter
+	- Fix #747: assert in outnet_serviced_query_stop.
+	- iana ports fetched via https.
+	- iana portlist update.
+
+03 March 2016: Wouter
+	- configure tests for the weak attribute support by the compiler.
+
+02 March 2016: Wouter
+	- 1.5.8 release tag
+	- trunk contains 1.5.9 in development.
+	- iana portlist update.
+	- Fix #745: unbound.py - idn2dname throws UnicodeError when idnname
+	  contains trailing dot.
+
+24 February 2016: Wouter
+	- Fix OpenBSD asynclook lock free that gets used later (fix test code).
+	- Fix that NSEC3 negative cache is used when there is no salt.
+
+23 February 2016: Wouter
+	- ub_ctx_set_stub() function for libunbound to config stub zones.
+	- sorted ubsyms.def file with exported libunbound functions.
+
+19 February 2016: Wouter
+	- Print understandable debug log when unusable DS record is seen.
+	- load gost algorithm if digest is seen before key algorithm.
+	- iana portlist update.
+
+17 February 2016: Wouter
+	- Fix that "make install" fails due to "text file busy" error.
+
+16 February 2016: Wouter
+	- Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.
+
+15 February 2016: Wouter
+	- ip-transparent option for FreeBSD with IP_BINDANY socket option.
+	- wait for sendto to drain socket buffers when they are full.
+
+9 February 2016: Wouter
+	- Test for type OPENPGPKEY.
+	- insecure-lan-zones: yesno config option, patch from Dag-Erling
+	  Smørgrav.
+
+8 February 2016: Wouter
+	- Fix patch typo in prevuous commit for 734 from Adi Prasaja.
+	- RR Type CSYNC support RFC 7477, in debug printout and config input.
+	- RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
+
+29 January 2016: Wouter
+	- Neater cmdline_verbose increment patch from Edgar Pettijohn.
+
+27 January 2016: Wouter
+	- Made netbsd sendmsg test nonfatal, in case of false positives.
+	- Fix #741: log message for dnstap socket connection is more clear.
+
+26 January 2016: Wouter
+	- Fix #734: chown the pidfile if it resides inside the chroot.
+	- Use arc4random instead of random in tests (because it is
+	  available, possibly as compat, anyway).
+	- Fix cmsg alignment for argument to sendmsg on NetBSD.
+	- Fix that unbound complains about unimplemented IP_PKTINFO for
+	  sendmsg on NetBSD (for interface-automatic).
+
+25 January 2016: Wouter
+	- Fix #738: Swig should not be invoked with CPPFLAGS.
+
+19 January 2016: Wouter
+	- Squelch 'cannot assign requested address' log messages unless
+	  verbosity is high, it was spammed after network down.
+
+14 January 2016: Wouter
+	- Fix to simplify empty string checking from Michael McConville.
+	- iana portlist update.
+
+12 January 2016: Wouter
+	- Fix #734: Do not log an error when the PID file cannot be chown'ed.
+	  Patch from Simon Deziel.
+
+11 January 2016: Wouter
+	- Fix test if -pthreads unused to use better grep for portability.
+
+06 January 2016: Wouter
+	- Fix mingw crosscompile for recent mingw.
+	- Update aclocal, autoconf output with new versions (1.15, 2.4.6).
+
+05 January 2016: Wouter
+	- #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch
+	  from Daisuke Higashi.
+	- Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
+	  by default, and can be unblocked with "nodefault" localzone config.
+
+04 January 2016: Wouter
+	- Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined,
+	  for Linux glibc 2.20.
+	- Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
+	  source code, so it applies cleanly again.  Removed unused variable
+	  warnings.
+
+15 December 2015: Ralph
+	- Fix #729: omit use of escape sequences in echo since they are not 
+	  portable (unbound-control-setup).
+
+11 December 2015: Wouter
+	- remove NULL-checks before free, patch from Michael McConville.
+	- updated ax_pthread.m4 to version 21 with clang support, this
+	  removes a warning from compilation.
+	- OSX portability, detect if sbrk is deprecated.
+	- OSX clang, stop -pthread unused during link stage warnings.
+	- OSX clang new flto check.
+
+10 December 2015: Wouter
+	- 1.5.7 release
+	- trunk has 1.5.8 in development.
+
+8 December 2015: Wouter
+	- Fixup 724 for unbound-control.
+
+7 December 2015: Ralph
+	- Do not minimise forwarded requests.
+
+4 December 2015: Wouter
+	- Removed unneeded whitespace from example.conf.
+
+3 December 2015: Ralph
+	- (after rc1 tag)
+	- Committed fix to qname minimisation and unit test case for it.
+	
+3 December 2015: Wouter
+	- iana portlist update.
+	- 1.5.7rc1 prerelease tag.
+
+2 December 2015: Wouter
+	- Fixup 724: Fix PCA prompt for unbound-service-install.exe.
+	  re-enable stdout printout.
+	- For 724: Add Changelog to windows binary dist.
+
+1 December 2015: Ralph
+	- Qname minimisation review fixes
+
+1 December 2015: Wouter
+	- Fixup 724 fix for fname_after_chroot() calls.
+	- Remove stdout printout for unbound-service-install.exe
+	- .gitignore for git users.
+
+30 November 2015: Ralph
+	- Implemented qname minimisation
+
+30 November 2015: Wouter
+	- Fix for #724: conf syntax to read files from run dir (on Windows).
+
+25 November 2015: Wouter
+	- Fix for #720, fix unbound-control-setup windows batch file.
+
+24 November 2015: Wouter
+	- Fix #720: add windows scripts to zip bundle.
+	- iana portlist update.
+
+20 November 2015: Wouter
+	- Added assert on rrset cache correctness.
+	- Fix that malformed EDNS query gets a response without malformed EDNS.
+
+18 November 2015: Wouter
+	- newer acx_nlnetlabs.m4.
+	- spelling fixes from Igor Sobrado Delgado.
+
+17 November 2015: Wouter
+	- Fix #594. libunbound: optionally use libnettle for crypto.
+	  Contributed by Luca Bruno.  Added --with-nettle for use with
+	  --with-libunbound-only.
+	- refactor nsec3 hash implementation to be more library-portable.
+	- iana portlist update.
+	- Fixup DER encoded DSA signatures for libnettle.
+
+16 November 2015: Wouter
+	- Fix for lenient accept of reverse order DNAME and CNAME.
+
+6 November 2015: Wouter
+	- Change example.conf: ftp.internic.net to https://www.internic.net
+
+5 November 2015: Wouter
+	- ACX_SSL_CHECKS no longer adds -ldl needlessly.
+
+3 November 2015: Wouter
+	- Fix #718: Fix unbound-control-setup with support for env
+	  without HEREDOC bash support.
+
+29 October 2015: Wouter
+	- patch from Doug Hogan for SSL_OP_NO_SSLvx options.
+	- Fix #716: nodata proof with empty non-terminals and wildcards.
+
+28 October 2015: Wouter
+	- Fix checklock testcode for linux threads on exit.
+
+27 October 2015: Wouter
+	- isblank() compat implementation.
+	- detect libexpat without xml_StopParser function.
+	- portability fixes.
+	- portability, replace snprintf if return value broken.
+
+23 October 2015: Wouter
+	- Fix #714: Document config to block private-address for IPv4
+	  mapped IPv6 addresses.
+
+22 October 2015: Wouter
+	- Fix #712: unbound-anchor appears to not fsync root.key.
+
+20 October 2015: Wouter
+	- 1.5.6 release.
+	- trunk tracks development of 1.5.7.
+
 15 October 2015: Wouter
 	- Fix segfault in the dns64 module in the formaterror error path.
 	- Fix sldns_wire2str_rdata_scan for malformed RRs.
@@ -753,7 +1486,7 @@
 	  existence in 4592.  NSEC empty non-terminals exist and thus the
 	  RCODE should have been NOERROR. If this occurs, and the RRsets
 	  are secure, we set the RCODE to NOERROR and the security status
-	  of the reponse is also considered secure.
+	  of the response is also considered secure.
 
 14 February 2014: Wouter
 	- Works on Minix (3.2.1).
@@ -1525,7 +2258,7 @@
 	- Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc.
 	- Fix warnings with gcc 4.6 in compat/inet_ntop.c.
 	- Fix warning unused in compat/strptime.c.
-	- Fix malloc detection and double defintion.
+	- Fix malloc detection and double definition.
 
 2 December 2011: Wouter
 	- configure generated with autoconf 2.68.
@@ -4970,7 +5703,7 @@
 	- Advertise builtin select libevent alternative when no libevent
 	  is found.
 	- signit can generate NSEC3 hashes, for generating tests.
-	- multiple nsec3 paramaters in message test.
+	- multiple nsec3 parameters in message test.
 	- too high nsec3 iterations becomes insecure test.
 
 21 September 2007: Wouter
@@ -5041,7 +5774,7 @@
 	- testbound can replay a TCP query (set MATCH TCP in the QUERY).
 	- DS and noDS referral validation test.
 	- if you configure many trust anchors, parent trust anchors can
-	  securely deny existance of child trust anchors, if validated.
+	  securely deny existence of child trust anchors, if validated.
 	- not all *.name NSECs are present because a wildcard was matched,
 	  and *.name NSECs can prove nodata for empty nonterminals.
 	  Also, for wildcard name NSECs, check they are not from the parent
@@ -5348,7 +6081,7 @@
 
 17 July 2007: Wouter
 	- forward zone options in config file.
-	- forward per zone in iterator. takes precendence over stubs.
+	- forward per zone in iterator. takes precedence over stubs.
 	- fixup commithooks.
 	- removed forward-to and forward-to-port features, subsumed by
 	  new forward zones.
@@ -5449,7 +6182,7 @@
 	  ldns and libevent are linked statically. Default is off.
 	- make install and make uninstall. Works with static-exe and without.
 	  installation of unbound binary and manual pages.
-	- alignement problem fix on solaris 64.
+	- alignment problem fix on solaris 64.
 	- fixup address in case of TCP error.
 
 12 June 2007: Wouter
@@ -5532,7 +6265,7 @@
 	- removed FLAG_CD from message and rrset caches. This was useful for
 	  an agnostic forwarder, but not for a sophisticated (trust value per
 	  rrset enabled) cache.
-	- iterator reponse typing.
+	- iterator response typing.
 	- iterator cname handle.
 	- iterator prime start.
 	- subquery work.
@@ -5552,7 +6285,7 @@
 	- Acknowledge use of unbound-java code in iterator. Nicer readme.
 	- services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and
 	  rrset cache from module environment.
-	- packed rrset key has type and class as easily accessable struct
+	- packed rrset key has type and class as easily accessible struct
 	  members. They are still kept in network format for fast msg encode.
 	- dns cache find_delegation routine.
 	- iterator main functions setup.
@@ -5636,7 +6369,7 @@
 	- EDNS read from query, used to make reply smaller.
 	- advertised edns value constants.
 	- EDNS BADVERS response, if asked for too high edns version.
-	- EDNS extended error reponses once the EDNS record from the query
+	- EDNS extended error responses once the EDNS record from the query
 	  has successfully been parsed.
 
 4 May 2007: Wouter

doc/example.conf.in

@@ -8,7 +8,7 @@
 #Use this to include other text into the file.
 #include: "otherfile.conf"
 
-# The server clause sets the main parameters. 
+# The server clause sets the main parameters.
 server:
 	# whitespace is not necessary, but looks cleaner.
 
@@ -40,7 +40,7 @@ server:
 	# interface: 2001:DB8::5
 
 	# enable this feature to copy the source address of queries to reply.
-	# Socket options are not supported on all platforms. experimental. 
+	# Socket options are not supported on all platforms. experimental.
 	# interface-automatic: no
 
 	# port to answer queries from
@@ -53,6 +53,15 @@ server:
 	# outgoing-interface: 2001:DB8::5
 	# outgoing-interface: 2001:DB8::6
 
+	# Specify a netblock to use remainder 64 bits as random bits for
+	# upstream queries.  Uses freebind option (Linux).
+	# outgoing-interface: 2001:DB8::/64
+	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
+	# And: ip -6 route add local 2001:db8::/64 dev lo
+	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
+	# Set this to yes to prefer ipv6 upstream servers over ipv4.
+	# prefer-ip6: no
+
 	# number of ports to allocate per thread, determines the size of the
 	# port range that can be open simultaneously.  About double the
 	# num-queries-per-thread, or, use as many as the OS will allow you.
@@ -84,14 +93,20 @@ server:
 	# buffer size for UDP port 53 outgoing (SO_SNDBUF socket option).
 	# 0 is system default.  Use 4m to handle spikes on very busy servers.
 	# so-sndbuf: 0
-	
+
 	# use SO_REUSEPORT to distribute queries over threads.
 	# so-reuseport: no
-	
+
 	# use IP_TRANSPARENT so the interface: addresses can be non-local
 	# and you can config non-existing IPs that are going to work later on
+	# (uses IP_BINDANY on FreeBSD).
 	# ip-transparent: no
 
+	# use IP_FREEBIND so the interface: addresses can be non-local
+	# and you can bind to nonexisting IPs and interfaces that are down.
+	# Linux only.  On Linux you also have ip-transparent that is similar.
+	# ip-freebind: no
+
 	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
 	# is set with msg-buffer-size). 1480 can solve fragmentation (timeouts).
 	# edns-buffer-size: 4096
@@ -105,7 +120,7 @@ server:
 	# msg-buffer-size: 65552
 
 	# the amount of memory to use for the message cache.
-	# plain value in bytes or you can append k, m or G. default is "4Mb". 
+	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# msg-cache-size: 4m
 
 	# the number of slabs to use for the message cache.
@@ -118,12 +133,12 @@ server:
 
 	# if very busy, 50% queries run to completion, 50% get timeout in msec
 	# jostle-timeout: 200
-	
+
 	# msec to wait before close of port on timeout UDP. 0 disables.
 	# delay-close: 0
 
 	# the amount of memory to use for the RRset cache.
-	# plain value in bytes or you can append k, m or G. default is "4Mb". 
+	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# rrset-cache-size: 4m
 
 	# the number of slabs to use for the RRset cache.
@@ -145,7 +160,7 @@ server:
 	# the time to live (TTL) value for cached roundtrip times, lameness and
 	# EDNS version information for hosts. In seconds.
 	# infra-host-ttl: 900
-	
+
 	# minimum wait time for responses, increase if uplink is long. In msec.
 	# infra-cache-min-rtt: 50
 
@@ -157,6 +172,10 @@ server:
 	# the maximum number of hosts that are cached (roundtrip, EDNS, lame).
 	# infra-cache-numhosts: 10000
 
+	# define a number of tags here, use with local-zone, access-control.
+	# repeat the define-tag statement to add additional tags.
+	# define-tag: "tag1 tag2 tag3"
+
 	# Enable IPv4, "yes" or "no".
 	# do-ip4: yes
 
@@ -173,6 +192,14 @@ server:
 	# useful for tunneling scenarios, default no.
 	# tcp-upstream: no
 
+	# Maximum segment size (MSS) of TCP socket on which the server
+	# responds to queries. Default is 0, system default MSS.
+	# tcp-mss: 0
+
+	# Maximum segment size (MSS) of TCP socket for outgoing queries.
+	# Default is 0, system default MSS.
+	# outgoing-tcp-mss: 0
+
 	# Detach from the terminal, run in background, "yes" or "no".
 	# do-daemonize: yes
 
@@ -189,14 +216,31 @@ server:
 	# access-control: ::1 allow
 	# access-control: ::ffff:127.0.0.1 allow
 
+	# tag access-control with list of tags (in "" with spaces between)
+	# Clients using this access control element use localzones that
+	# are tagged with one of these tags.
+	# access-control-tag: 192.0.2.0/24 "tag2 tag3"
+
+	# set action for particular tag for given access control element
+	# if you have multiple tag values, the tag used to lookup the action
+	# is the first tag match between access-control-tag and local-zone-tag
+	# where "first" comes from the order of the define-tag values.
+	# access-control-tag-action: 192.0.2.0/24 tag3 refuse
+
+	# set redirect data for particular tag for access control element
+	# access-control-tag-data: 192.0.2.0/24 tag2 "A 127.0.0.1"
+
+	# Set view for access control element
+	# access-control-view: 192.0.2.0/24 viewname
+
 	# if given, a chroot(2) is done to the given directory.
 	# i.e. you can chroot to the working directory, for example,
 	# for extra security, but make sure all files are in that directory.
 	#
 	# If chroot is enabled, you should pass the configfile (from the
 	# commandline) as a full path from the original root. After the
-	# chroot has been performed the now defunct portion of the config 
-	# file path is removed to be able to reread the config after a reload. 
+	# chroot has been performed the now defunct portion of the config
+	# file path is removed to be able to reread the config after a reload.
 	#
 	# All other file paths (working dir, logfile, roothints, and
 	# key files) can be specified in several ways:
@@ -205,7 +249,7 @@ server:
 	# 	o as an absolute path relative to the original root.
 	# In the last case the path is adjusted to remove the unused portion.
 	#
-	# The pid file can be absolute and outside of the chroot, it is 
+	# The pid file can be absolute and outside of the chroot, it is
 	# written just prior to performing the chroot and dropping permissions.
 	#
 	# Additionally, unbound may need to access /dev/random (for entropy).
@@ -219,22 +263,28 @@ server:
 	# If you give "" no privileges are dropped.
 	# username: "@UNBOUND_USERNAME@"
 
-	# the working directory. The relative files in this config are 
+	# the working directory. The relative files in this config are
 	# relative to this directory. If you give "" the working directory
 	# is not changed.
+	# If you give a server: directory: dir before include: file statements
+	# then those includes can be relative to the working directory.
 	# directory: "@UNBOUND_RUN_DIR@"
 
-	# the log file, "" means log to stderr. 
+	# the log file, "" means log to stderr.
 	# Use of this option sets use-syslog to "no".
 	# logfile: ""
 
-	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to 
-	# log to, with identity "unbound". If yes, it overrides the logfile.
-	# use-syslog: yes 
+	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to
+	# log to. If yes, it overrides the logfile.
+	# use-syslog: yes
+
+	# Log identity to report. if empty, defaults to the name of argv[0]
+	# (usually "unbound").
+	# log-identity: ""
 
 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	# log-time-ascii: no
-	
+
 	# print one line with time, IP, name, type, class for every query.
 	# log-queries: no
 
@@ -242,7 +292,7 @@ server:
 	# pidfile: "@UNBOUND_PIDFILE@"
 
 	# file to read root hints from.
-	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
+	# get one from https://www.internic.net/domain/named.cache
 	# root-hints: ""
 
 	# enable to not answer id.server and hostname.bind queries.
@@ -258,8 +308,8 @@ server:
 	# version: ""
 
 	# the target fetch policy.
-	# series of integers describing the policy per dependency depth. 
-	# The number of values in the list determines the maximum dependency 
+	# series of integers describing the policy per dependency depth.
+	# The number of values in the list determines the maximum dependency
 	# depth the recursor will pursue before giving up. Each integer means:
 	# 	-1 : fetch all targets opportunistically,
 	# 	0: fetch on demand,
@@ -267,17 +317,17 @@ server:
 	# Enclose the list of numbers between quotes ("").
 	# target-fetch-policy: "3 2 1 0 0"
 
-	# Harden against very small EDNS buffer sizes. 
+	# Harden against very small EDNS buffer sizes.
 	# harden-short-bufsize: no
 
 	# Harden against unseemly large queries.
 	# harden-large-queries: no
 
-	# Harden against out of zone rrsets, to avoid spoofing attempts. 
+	# Harden against out of zone rrsets, to avoid spoofing attempts.
 	# harden-glue: yes
 
 	# Harden against receiving dnssec-stripped data. If you turn it
-	# off, failing to validate dnskey data for a trustanchor will 
+	# off, failing to validate dnskey data for a trustanchor will
 	# trigger insecure mode for that zone (like without a trustanchor).
 	# Default on, which insists on dnssec data for trust-anchored zones.
 	# harden-dnssec-stripped: yes
@@ -285,9 +335,9 @@ server:
 	# Harden against queries that fall under dnssec-signed nxdomain names.
 	# harden-below-nxdomain: no
 
-        # Harden the referral path by performing additional queries for
+	# Harden the referral path by performing additional queries for
 	# infrastructure data.  Validates the replies (if possible).
-	# Default off, because the lookups burden the server.  Experimental 
+	# Default off, because the lookups burden the server.  Experimental
 	# implementation of draft-wijngaards-dnsext-resolver-side-mitigation.
 	# harden-referral-path: no
 
@@ -296,18 +346,30 @@ server:
 	# to validate the zone.
 	# harden-algo-downgrade: no
 
+	# Sent minimum amount of information to upstream servers to enhance
+	# privacy. Only sent minimum required labels of the QNAME and set QTYPE
+	# to NS when possible.
+	# qname-minimisation: no
+
+	# QNAME minimisation in strict mode. Do not fall-back to sending full
+	# QNAME to potentially broken nameservers. A lot of domains will not be
+	# resolvable when this option in enabled.
+	# This option only has effect when qname-minimisation is enabled.
+	# qname-minimisation-strict: no
+
 	# Use 0x20-encoded random bits in the query to foil spoof attempts.
 	# This feature is an experimental implementation of draft dns-0x20.
 	# use-caps-for-id: no
-	
+
 	# Domains (and domains in them) without support for dns-0x20 and
 	# the fallback fails because they keep sending different answers.
 	# caps-whitelist: "licdn.com"
+	# caps-whitelist: "senderbase.org"
 
-	# Enforce privacy of these addresses. Strips them away from answers. 
-	# It may cause DNSSEC validation to additionally mark it as bogus. 
-	# Protects against 'DNS Rebinding' (uses browser as network proxy). 
-	# Only 'private-domain' and 'local-data' names are allowed to have 
+	# Enforce privacy of these addresses. Strips them away from answers.
+	# It may cause DNSSEC validation to additionally mark it as bogus.
+	# Protects against 'DNS Rebinding' (uses browser as network proxy).
+	# Only 'private-domain' and 'local-data' names are allowed to have
 	# these private addresses. No default.
 	# private-address: 10.0.0.0/8
 	# private-address: 172.16.0.0/12
@@ -315,6 +377,7 @@ server:
 	# private-address: 169.254.0.0/16
 	# private-address: fd00::/8
 	# private-address: fe80::/10
+	# private-address: ::ffff:0:0/96
 
 	# Allow the domain (and its subdomains) to contain private addresses.
 	# local-data statements are allowed to contain private addresses too.
@@ -349,6 +412,9 @@ server:
 	# into response messages when those sections are not required.
 	# minimal-responses: no
 
+	# true to disable DNSSEC lameness check in iterator.
+	# disable-dnssec-lame-check: no
+
 	# module configuration of the server. A string with identifiers
 	# separated by spaces. Syntax: "[dns64] [validator] iterator"
 	# module-config: "validator iterator"
@@ -373,7 +439,7 @@ server:
 	# Zone file format, with DS and DNSKEY entries.
 	# Note this gets out of date, use auto-trust-anchor-file please.
 	# trust-anchor-file: ""
-	
+
 	# Trusted key for validation. DS or DNSKEY. specify the RR on a
 	# single line, surrounded by "". TTL is ignored. class is IN default.
 	# Note this gets out of date, use auto-trust-anchor-file please.
@@ -383,7 +449,7 @@ server:
 
 	# File with trusted keys for validation. Specify more than one file
 	# with several entries, one file per entry. Like trust-anchor-file
-	# but has a different file format. Format is BIND-9 style format, 
+	# but has a different file format. Format is BIND-9 style format,
 	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
 	# you need external update procedures to track changes in keys.
 	# trusted-keys-file: ""
@@ -408,7 +474,7 @@ server:
 
 	# Should additional section of secure message also be kept clean of
 	# unsecure data. Useful to shield the users of this validator from
-	# potential bogus data in the additional section. All unsigned data 
+	# potential bogus data in the additional section. All unsigned data
 	# in the additional section is removed from secure messages.
 	# val-clean-additional: yes
 
@@ -424,6 +490,10 @@ server:
 	# that set CD but cannot validate themselves.
 	# ignore-cd-flag: no
 
+	# Serve expired reponses from cache, with TTL 0 in the response,
+	# and then attempt to fetch the data afresh.
+	# serve-expired: no
+
 	# Have the validator log failed validations for your diagnosis.
 	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
 	# val-log-level: 0
@@ -433,7 +503,7 @@ server:
 	# A message with an NSEC3 with larger count is marked insecure.
 	# List in ascending order the keysize and count values.
 	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
-	
+
 	# instruct the auto-trust-anchor-file probing to add anchors after ttl.
 	# add-holddown: 2592000 # 30 days
 
@@ -444,11 +514,12 @@ server:
 	# If the value 0 is given, missing anchors are not removed.
 	# keep-missing: 31622400 # 366 days
 
-	# debug option that allows very small holddown times for key rollover
+	# debug option that allows very small holddown times for key rollover,
+	# otherwise the RFC mandates probe intervals must be at least 1 hour.
 	# permit-small-holddown: no
 
 	# the amount of memory to use for the key cache.
-	# plain value in bytes or you can append k, m or G. default is "4Mb". 
+	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# key-cache-size: 4m
 
 	# the number of slabs to use for the key cache.
@@ -457,7 +528,7 @@ server:
 	# key-cache-slabs: 4
 
 	# the amount of memory to use for the negative cache (used for DLV).
-	# plain value in bytes or you can append k, m or G. default is "1Mb". 
+	# plain value in bytes or you can append k, m or G. default is "1Mb".
 	# neg-cache-size: 1m
 
 	# By default, for a number of zones a small default 'nothing here'
@@ -469,6 +540,7 @@ server:
 	# local-zone: "localhost." nodefault
 	# local-zone: "127.in-addr.arpa." nodefault
 	# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
+	# local-zone: "onion." nodefault
 	# local-zone: "10.in-addr.arpa." nodefault
 	# local-zone: "16.172.in-addr.arpa." nodefault
 	# local-zone: "17.172.in-addr.arpa." nodefault
@@ -501,31 +573,37 @@ server:
 	# local-zone: "b.e.f.ip6.arpa." nodefault
 	# local-zone: "8.b.d.0.1.0.0.2.ip6.arpa." nodefault
 	# And for 64.100.in-addr.arpa. to 127.100.in-addr.arpa.
-	
-	# if unbound is running service for the local host then it is useful
+
+	# If unbound is running service for the local host then it is useful
 	# to perform lan-wide lookups to the upstream, and unblock the
 	# long list of local-zones above.  If this unbound is a dns server
 	# for a network of computers, disabled is better and stops information
 	# leakage of local lan information.
 	# unblock-lan-zones: no
 
+	# The insecure-lan-zones option disables validation for
+	# these zones, as if they were all listed as domain-insecure.
+	# insecure-lan-zones: no
+
 	# a number of locally served zones can be configured.
 	# 	local-zone: <zone> <type>
 	# 	local-data: "<resource record string>"
-	# o deny serves local data (if any), else, drops queries. 
+	# o deny serves local data (if any), else, drops queries.
 	# o refuse serves local data (if any), else, replies with error.
 	# o static serves local data, else, nxdomain or nodata answer.
 	# o transparent gives local data, but resolves normally for other names
 	# o redirect serves the zone data for any subdomain in the zone.
 	# o nodefault can be used to normally resolve AS112 zones.
 	# o typetransparent resolves normally for other types and other names
-	# o inform resolves normally, but logs client IP address
+	# o inform acts like transparent, but logs client IP address
 	# o inform_deny drops queries and logs client IP address
+	# o always_transparent, always_refuse, always_nxdomain, resolve in
+	#   that way but ignore local data for that name.
 	#
 	# defaults are localhost address, reverse for 127.0.0.1 and ::1
 	# and nxdomain for AS112 zones. If you configure one of these zones
 	# the default content is omitted, or you can omit it with 'nodefault'.
-	# 
+	#
 	# If you configure local-data without specifying local-zone, by
 	# default a transparent local-zone is created for the data.
 	#
@@ -547,6 +625,12 @@ server:
 	# you need to do the reverse notation yourself.
 	# local-data-ptr: "192.0.2.3 www.example.com"
 
+	# tag a localzone with a list of tag names (in "" with spaces between)
+	# local-zone-tag: "example.com" "tag2 tag3"
+
+	# add a netblock specific override to a localzone, with zone type
+	# local-zone-override: "example.com" 192.0.2.0/24 refuse
+
 	# service clients over SSL (on the TCP sockets), with plain DNS inside
 	# the SSL stream.  Give the certificate to use and private key.
 	# default is "" (disabled).  requires restart to take effect.
@@ -571,7 +655,7 @@ server:
 	# ratelimit-size: 4m
 	# ratelimit cache slabs, reduces lock contention if equal to cpucount.
 	# ratelimit-slabs: 4
-	
+
 	# 0 blocks when ratelimited, otherwise let 1/xth traffic through
 	# ratelimit-factor: 10
 
@@ -580,7 +664,7 @@ server:
 	# ratelimit-for-domain: example.com 1000
 	# override the ratelimits for all domains below a domain name
 	# can give this multiple times, the name closest to the zone is used.
-	# ratelimit-below-domain: example 1000
+	# ratelimit-below-domain: com 1000
 
 # Python config section. To enable:
 # o use --with-pythonmodule to configure before compiling.
@@ -590,7 +674,7 @@ python:
 	# Script file to load
 	# python-script: "@UNBOUND_SHARE_DIR@/ubmodule-tst.py"
 
-# Remote control config section. 
+# Remote control config section.
 remote-control:
 	# Enable remote control with unbound-control(8) here.
 	# set up the keys and certificates with unbound-control-setup.
@@ -621,9 +705,9 @@ remote-control:
 	# control-cert-file: "@UNBOUND_RUN_DIR@/unbound_control.pem"
 
 # Stub zones.
-# Create entries like below, to make all queries for 'example.com' and 
-# 'example.org' go to the given list of nameservers. list zero or more 
-# nameservers by hostname or by ipaddress. If you set stub-prime to yes, 
+# Create entries like below, to make all queries for 'example.com' and
+# 'example.org' go to the given list of nameservers. list zero or more
+# nameservers by hostname or by ipaddress. If you set stub-prime to yes,
 # the list is treated as priming hints (default is no).
 # With stub-first yes, it attempts without the stub if it fails.
 # Consider adding domain-insecure: name and local-zone: name nodefault
@@ -633,6 +717,7 @@ remote-control:
 #	stub-addr: 192.0.2.68
 #	stub-prime: no
 #	stub-first: no
+#	stub-ssl-upstream: no
 # stub-zone:
 #	name: "example.org"
 #	stub-host: ns.example.com.
@@ -648,6 +733,23 @@ remote-control:
 # 	forward-addr: 192.0.2.68
 # 	forward-addr: 192.0.2.73@5355  # forward to port 5355.
 # 	forward-first: no
+# 	forward-ssl-upstream: no
 # forward-zone:
 # 	name: "example.org"
 # 	forward-host: fwd.example.com
+
+# Views
+# Create named views. Name must be unique. Map views to requests using
+# the access-control-view option. Views can contain zero or more local-zone
+# and local-data options. Options from matching views will override global
+# options. Global options will be used if no matching view is found.
+# With view-first yes, it will try to answer using the global local-zone and
+# local-data elements if there is no view specific match.
+# view:
+#	name: "viewname"
+#	local-zone: "example.com" redirect
+#	local-data: "example.com A 192.0.2.3"
+#	view-first: no
+# view:
+#	name: "anotherview"
+#	local-zone: "example.com" refuse

doc/libunbound.3.in

@@ -19,6 +19,7 @@
 .B ub_ctx_get_option,
 .B ub_ctx_config,
 .B ub_ctx_set_fwd,
+.B ub_ctx_set_stub,
 .B ub_ctx_resolvconf,
 .B ub_ctx_hosts,
 .B ub_ctx_add_ta,
@@ -65,6 +66,12 @@
 \fBub_ctx_set_fwd\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR addr);
 .LP
 \fIint\fR
+\fBub_ctx_set_stub\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone,
+\fIchar*\fR addr,
+.br
+		\fIint\fR isprime);
+.LP
+\fIint\fR
 \fBub_ctx_resolvconf\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
@@ -173,7 +180,7 @@ and
 .B ub_ctx_hosts
 to read them.
 Before you call this, use the openssl functions CRYPTO_set_id_callback and
-CRYPTO_set_locking_callback to set up asyncronous operation if you use
+CRYPTO_set_locking_callback to set up asynchronous operation if you use
 lib openssl (the application calls these functions once for initialisation).
 Openssl 1.0.0 or later uses the CRYPTO_THREADID_set_callback function.
 .TP
@@ -207,6 +214,15 @@ that case the addresses are used as backup servers.
 At this time it is only possible to set configuration before the
 first resolve is done.
 .TP
+.B ub_ctx_set_stub
+Set a stub zone, authoritative dns servers to use for a particular zone.
+IP4 or IP6 address.  If the address is NULL the stub entry is removed.
+Set isprime true if you configure root hints with it.  Otherwise similar to
+the stub zone item from unbound's config file.  Can be called several times,
+for different zones, or to add multiple addresses for a particular zone.
+At this time it is only possible to set configuration before the
+first resolve is done.
+.TP
 .B ub_ctx_resolvconf
 By default the root servers are queried and full resolver mode is used, but
 you can use this call to read the list of nameservers to use from the

doc/unbound-anchor.8.in

@@ -16,6 +16,8 @@
 .SH "DESCRIPTION"
 .B Unbound\-anchor
 performs setup or update of the root trust anchor for DNSSEC validation.
+The program fetches the trust anchor with the method from RFC7958 when
+regular RFC5011 update fails to bring it up to date.
 It can be run (as root) from the commandline, or run as part of startup
 scripts.  Before you start the \fIunbound\fR(8) DNS server.
 .P
@@ -39,8 +41,8 @@ update certificate files.
 .P
 It tests if the root anchor file works, and if not, and an update is possible,
 attempts to update the root anchor using the root update certificate.
-It performs a https fetch of root-anchors.xml and checks the results, if
-all checks are successful, it updates the root anchor file.  Otherwise
+It performs a https fetch of root-anchors.xml and checks the results (RFC7958), 
+if all checks are successful, it updates the root anchor file.  Otherwise
 the root anchor file is unchanged.  It performs RFC5011 tracking if the
 DNSSEC information available via the DNS makes that possible.
 .P
@@ -65,7 +67,7 @@ List the builtin root key and builtin root update certificate on stdout.
 .B \-u \fIname
 The server name, it connects to https://name.  Specify without https:// prefix.
 The default is "data.iana.org".  It connects to the port specified with \-P.
-You can pass an IPv4 addres or IPv6 address (no brackets) if you want.
+You can pass an IPv4 address or IPv6 address (no brackets) if you want.
 .TP
 .B \-x \fIpath
 The pathname to the root\-anchors.xml file on the server. (forms URL with \-u).

doc/unbound-control.8.in

@@ -99,6 +99,22 @@ but if the name has become an empty nonterminal (there is still data in
 domain names below the removed name), NOERROR nodata answers are the 
 result for that name.
 .TP
+.B local_zones
+Add local zones read from stdin of unbound\-control. Input is read per line,
+with name space type on a line. For bulk additions.
+.TP
+.B local_zones_remove
+Remove local zones read from stdin of unbound\-control. Input is one name per
+line. For bulk removals.
+.TP
+.B local_datas
+Add local data RRs read from stdin of unbound\-control. Input is one RR per
+line. For bulk additions.
+.TP
+.B local_datas_remove
+Remove local data RRs read from stdin of unbound\-control. Input is one name per
+line. For bulk removals.
+.TP
 .B dump_cache
 The contents of the cache is printed in a text format to stdout. You can
 redirect it to a file to store the cache in a file.
@@ -169,7 +185,7 @@ therefore not flushed.  The option must end with a ':' and whitespace
 must be between the option and the value.  Some values may not have an
 effect if set this way, the new values are not written to the config file,
 not all options are supported.  This is different from the set_option call
-in libunbound, where all values work because unbound has not been inited.
+in libunbound, where all values work because unbound has not been initialized.
 .IP
 The values that work are: statistics\-interval, statistics\-cumulative,
 do\-not\-query\-localhost, harden\-short\-bufsize, harden\-large\-queries,
@@ -263,6 +279,21 @@ estimated qps and qps limit from config.  With +a it prints all domains, not
 just the ratelimited domains, with their estimated qps.  The ratelimited
 domains return an error for uncached (new) queries, but cached queries work
 as normal.
+.TP
+.B view_list_local_zones \fIview\fR
+\fIlist_local_zones\fR for given view.
+.TP
+.B view_local_zone \fIview\fR \fIname\fR \fItype
+\fIlocal_zone\fR for given view.
+.TP
+.B view_local_zone_remove \fIview\fR \fIname
+\fIlocal_zone_remove\fR for given view.
+.TP
+.B view_local_data \fIview\fR \fIRR data...
+\fIlocal_data\fR for given view.
+.TP
+.B view_local_data_remove \fIview\fR \fIname
+\fIlocal_data_remove\fR for given view.
 .SH "EXIT CODE"
 The unbound\-control program exits with status code 1 on error, 0 on success.
 .SH "SET UP"
@@ -301,6 +332,9 @@ and resulted in recursive processing, taking a slot in the requestlist.
 Not part of the recursivereplies (or the histogram thereof) or cachemiss,
 as a cache response was sent.
 .TP
+.I threadX.num.zero_ttl
+number of replies with ttl zero, because they served an expired cache entry.
+.TP
 .I threadX.num.recursivereplies
 The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
 .TP
@@ -350,6 +384,9 @@ summed over threads.
 .I total.num.prefetch
 summed over threads.
 .TP
+.I total.num.zero_ttl
+summed over threads.
+.TP
 .I total.num.recursivereplies
 summed over threads.
 .TP
@@ -384,9 +421,6 @@ uptime since server boot in seconds.
 time since last statistics printout, in seconds.
 .SH EXTENDED STATISTICS
 .TP
-.I mem.total.sbrk
-If sbrk(2) is available, an estimate of the heap size of the program in number of bytes. Close to the total memory used by the program, as reported by top and ps.  Could be wrong if the OS allocates memory non\-contiguously.
-.TP
 .I mem.cache.rrset
 Memory in bytes in use by the RRset cache.
 .TP

doc/unbound.conf.5.in

@@ -72,7 +72,8 @@ Processing continues as if the text from the included file was copied into
 the config file at that point.  If also using chroot, using full path names
 for the included files works, relative pathnames for the included names work
 if the directory where the daemon is started equals its chroot/working 
-directory.  Wildcards can be used to include multiple files, see \fIglob\fR(7).
+directory or is specified before the include statement with directory: dir.
+Wildcards can be used to include multiple files, see \fIglob\fR(7).
 .SS "Server Options"
 These options are part of the
 .B server:
@@ -126,7 +127,7 @@ Detect source interface on UDP queries and copy them to replies.  This
 feature is experimental, and needs support in your OS for particular socket
 options.  Default value is no.
 .TP
-.B outgoing\-interface: \fI<ip address>
+.B outgoing\-interface: \fI<ip address or ip6 netblock>
 Interface to use to connect to the network. This interface is used to send
 queries to authoritative servers and receive their replies. Can be given 
 multiple times to work on several interfaces. If none are given the 
@@ -136,12 +137,28 @@ and
 .B outgoing\-interface:
 lines, the interfaces are then used for both purposes. Outgoing queries are 
 sent via a random outgoing interface to counter spoofing.
+.IP
+If an IPv6 netblock is specified instead of an individual IPv6 address,
+outgoing UDP queries will use a randomised source address taken from the
+netblock to counter spoofing. Requires the IPv6 netblock to be routed to the
+host running unbound, and requires OS support for unprivileged non-local binds
+(currently only supported on Linux). Several netblocks may be specified with
+multiple
+.B outgoing\-interface:
+options, but do not specify both an individual IPv6 address and an IPv6
+netblock, or the randomisation will be compromised.  Consider combining with
+.B prefer\-ip6: yes
+to increase the likelihood of IPv6 nameservers being selected for queries.
+On Linux you need these two commands to be able to use the freebind socket
+option to receive traffic for the ip6 netblock:
+ip \-6 addr add mynetblock/64 dev lo &&
+ip \-6 route add local mynetblock/64 dev lo
 .TP
 .B outgoing\-range: \fI<number>
 Number of ports to open. This number of file descriptors can be opened per 
 thread. Must be at least 1. Default depends on compile options. Larger 
 numbers need extra resources from the operating system.  For performance a
-a very large value is best, use libevent to make this possible.
+very large value is best, use libevent to make this possible.
 .TP
 .B outgoing\-port\-permit: \fI<port number or range>
 Permit unbound to open this port or range of ports for use to send queries.
@@ -275,7 +292,14 @@ are going to exist later on, with host failover configuration.  This is
 a lot like interface\-automatic, but that one services all interfaces
 and with this option you can select which (future) interfaces unbound
 provides service on.  This option needs unbound to be started with root
-permissions on some systems.
+permissions on some systems.  The option uses IP_BINDANY on FreeBSD systems.
+.TP
+.B ip\-freebind: \fI<yes or no>
+If yes, then use IP_FREEBIND socket option on sockets where unbound
+is listening to incoming traffic.  Default no.  Allows you to bind to
+IP addresses that are nonlocal or do not exist, like when the network
+interface or IP address is down.  Exists only on Linux, where the similar
+ip\-transparent option is also available.
 .TP
 .B rrset\-cache\-size: \fI<number>
 Number of bytes size of the RRset cache. Default is 4 megabytes.
@@ -322,6 +346,10 @@ Lower limit for dynamic retransmit timeout calculation in infrastructure
 cache. Default is 50 milliseconds. Increase this value if using forwarders
 needing more time to do recursive name resolution.
 .TP
+.B define\-tag: \fI<"list of tags">
+Define the tags that can be used with local\-zone and access\-control.
+Enclose the list between quotes ("") and put spaces between tags.
+.TP
 .B do\-ip4: \fI<yes or no>
 Enable or disable whether ip4 queries are answered or issued. Default is yes.
 .TP
@@ -332,12 +360,32 @@ IPv6 to the internet nameservers.  With this option you can disable the
 ipv6 transport for sending DNS traffic, it does not impact the contents of
 the DNS traffic, which may have ip4 and ip6 addresses in it.
 .TP
+.B prefer\-ip6: \fI<yes or no>
+If enabled, prefer IPv6 transport for sending DNS queries to internet
+nameservers. Default is no.
+.TP
 .B do\-udp: \fI<yes or no>
 Enable or disable whether UDP queries are answered or issued. Default is yes.
 .TP
 .B do\-tcp: \fI<yes or no>
 Enable or disable whether TCP queries are answered or issued. Default is yes.
 .TP
+.B tcp\-mss: \fI<number>
+Maximum segment size (MSS) of TCP socket on which the server responds
+to queries. Value lower than common MSS on Ethernet 
+(1220 for example) will address path MTU problem.
+Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
+Default is system default MSS determined by interface MTU and
+negotiation between server and client.
+.TP
+.B outgoing\-tcp\-mss: \fI<number>
+Maximum segment size (MSS) of TCP socket for outgoing queries
+(from Unbound to other servers). Value lower than
+common MSS on Ethernet (1220 for example) will address path MTU problem.
+Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
+Default is system default MSS determined by interface MTU and
+negotiation between Unbound and other servers.
+.TP
 .B tcp\-upstream: \fI<yes or no>
 Enable or disable whether the upstream queries use TCP only for transport.
 Default is no.  Useful in tunneling scenarios.
@@ -409,6 +457,26 @@ allowed full recursion but only the static data.  With deny_non_local,
 messages that are disallowed are dropped, with refuse_non_local they
 receive error code REFUSED.
 .TP
+.B access\-control\-tag: \fI<IP netblock> <"list of tags">
+Assign tags to access-control elements. Clients using this access control
+element use localzones that are tagged with one of these tags. Tags must be
+defined in \fIdefine\-tags\fR.  Enclose list of tags in quotes ("") and put
+spaces between tags. If access\-control\-tag is configured for a netblock that
+does not have an access\-control, an access\-control element with action
+\fIallow\fR is configured for this netblock.
+.TP
+.B access\-control\-tag\-action: \fI<IP netblock> <tag> <action>
+Set action for particular tag for given access control element. If you have
+multiple tag values, the tag used to lookup the action is the first tag match
+between access\-control\-tag and local\-zone\-tag where "first" comes from the
+order of the define-tag values.
+.TP
+.B access\-control\-tag\-data: \fI<IP netblock> <tag> <"resource record string">
+Set redirect data for particular tag for given access control element.
+.TP
+.B access\-control\-view: \fI<IP netblock> <view name>
+Set view for given access control element.
+.TP
 .B chroot: \fI<directory>
 If chroot is enabled, you should pass the configfile (from the
 commandline) as a full path from the original root. After the
@@ -444,6 +512,10 @@ requires privileges, then a reload will fail; a restart is needed.
 .TP
 .B directory: \fI<directory>
 Sets the working directory for the program. Default is "@UNBOUND_RUN_DIR@".
+On Windows the string "%EXECUTABLE%" tries to change to the directory
+that unbound.exe resides in.
+If you give a server: directory: dir before include: file statements
+then those includes can be relative to the working directory.
 .TP
 .B logfile: \fI<filename>
 If "" is given, logging goes to stderr, or nowhere once daemonized.
@@ -462,6 +534,13 @@ The log facility LOG_DAEMON is used, with identity "unbound".
 The logfile setting is overridden when use\-syslog is turned on.
 The default is to log to syslog.
 .TP
+.B log\-identity: \fI<string>
+If "" is given (default), then the name of the executable, usually "unbound"
+is used to report to the log.  Enter a string to override it
+with that, which is useful on systems that run more than one instance of
+unbound, with different configurations, so that the logs can be easily
+distinguished against.
+.TP
 .B log\-time\-ascii: \fI<yes or no>
 Sets logfile lines to use a timestamp in UTC ascii. Default is no, which
 prints the seconds since 1970 in brackets. No effect if using syslog, in
@@ -545,13 +624,15 @@ unsigned to badly signed often. If turned off you run the risk of a
 downgrade attack that disables security for a zone. Default is on.
 .TP
 .B harden\-below\-nxdomain: \fI<yes or no>
-From draft\-vixie\-dnsext\-resimprove, returns nxdomain to queries for a name
+From RFC 8020 (with title "NXDOMAIN: There Really Is Nothing Underneath"),
+returns nxdomain to queries for a name
 below another name that is already known to be nxdomain.  DNSSEC mandates
 noerror for empty nonterminals, hence this is possible.  Very old software
 might return nxdomain for empty nonterminals (that usually happen for reverse
 IP address lookups), and thus may be incompatible with this.  To try to avoid
 this only DNSSEC-secure nxdomains are used, because the old software does not
 have DNSSEC.  Default is off.
+The nxdomain must be secure, this means nsec3 with optout is insufficient.
 .TP
 .B harden\-referral\-path: \fI<yes or no>
 Harden the referral path by performing additional queries for
@@ -585,23 +666,37 @@ queries.  For domains that do not support 0x20 and also fail with fallback
 because they keep sending different answers, like some load balancers.
 Can be given multiple times, for different domains.
 .TP
+.B qname\-minimisation: \fI<yes or no>
+Send minimum amount of information to upstream servers to enhance privacy.
+Only sent minimum required labels of the QNAME and set QTYPE to NS when 
+possible. Best effort approach; full QNAME and original QTYPE will be sent when
+upstream replies with a RCODE other than NOERROR, except when receiving
+NXDOMAIN from a DNSSEC signed zone. Default is off.
+.TP
+.B qname\-minimisation\-strict: \fI<yes or no>
+QNAME minimisation in strict mode. Do not fall-back to sending full QNAME to
+potentially broken nameservers. A lot of domains will not be resolvable when
+this option in enabled. Only use if you know what you are doing.
+This option only has effect when qname-minimisation is enabled. Default is off.
+.TP
 .B private\-address: \fI<IP address or subnet>
 Give IPv4 of IPv6 addresses or classless subnets. These are addresses
-on your private network, and are not allowed to be returned for public
-internet names.  Any occurence of such addresses are removed from
-DNS answers. Additionally, the DNSSEC validator may mark the answers
-bogus. This protects against so\-called DNS Rebinding, where a user browser
-is turned into a network proxy, allowing remote access through the browser
-to other parts of your private network.  Some names can be allowed to
-contain your private addresses, by default all the \fBlocal\-data\fR
-that you configured is allowed to, and you can specify additional
-names using \fBprivate\-domain\fR.  No private addresses are enabled
-by default.  We consider to enable this for the RFC1918 private IP
-address space by default in later releases. That would enable private 
-addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 
-fd00::/8 and fe80::/10, since the RFC standards say these addresses 
-should not be visible on the public internet.  Turning on 127.0.0.0/8 
-would hinder many spamblocklists as they use that.
+on your private network, and are not allowed to be returned for
+public internet names.  Any occurrence of such addresses are removed
+from DNS answers. Additionally, the DNSSEC validator may mark the
+answers bogus. This protects against so\-called DNS Rebinding, where
+a user browser is turned into a network proxy, allowing remote access
+through the browser to other parts of your private network.  Some names
+can be allowed to contain your private addresses, by default all the
+\fBlocal\-data\fR that you configured is allowed to, and you can specify
+additional names using \fBprivate\-domain\fR.  No private addresses are
+enabled by default.  We consider to enable this for the RFC1918 private
+IP address space by default in later releases. That would enable private
+addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16
+fd00::/8 and fe80::/10, since the RFC standards say these addresses
+should not be visible on the public internet.  Turning on 127.0.0.0/8
+would hinder many spamblocklists as they use that.  Adding ::ffff:0:0/96
+stops IPv4-mapped IPv6 addresses from bypassing the filter.
 .TP
 .B private\-domain: \fI<domain name>
 Allow this domain, and all its subdomains to contain private addresses.
@@ -648,6 +743,13 @@ This may cause a slight speedup.  The default is no, because the DNS
 protocol RFCs mandate these sections, and the additional content could
 be of use and save roundtrips for clients.
 .TP
+.B disable-dnssec-lame-check: \fI<yes or no>
+If true, disables the DNSSEC lameness check in the iterator.  This check
+sees if RRSIGs are present in the answer, when dnssec is expected,
+and retries another authority if RRSIGs are unexpectedly missing.
+The validator will insist in RRSIGs for DNSSEC signed domains regardless
+of this setting, if a trust anchor is loaded.
+.TP
 .B module\-config: \fI<"module names">
 Module configuration, a list of module names separated by spaces, surround
 the string with quotes (""). The modules can be validator, iterator.
@@ -666,7 +768,9 @@ File with trust anchor for one zone, which is tracked with RFC5011 probes.
 The probes are several times per month, thus the machine must be online
 frequently.  The initial file can be one with contents as described in
 \fBtrust\-anchor\-file\fR.  The file is written to when the anchor is updated,
-so the unbound user must have write permission.
+so the unbound user must have write permission.  Write permission to the file,
+but also to the directory it is in (to create a temporary file, which is
+necessary to deal with filesystem full events).
 .TP
 .B trust\-anchor: \fI<"Resource Record">
 A DS or DNSKEY RR for a key to use for validation. Multiple entries can be
@@ -746,7 +850,7 @@ Instruct the validator to remove data from the additional section of secure
 messages that are not signed properly. Messages that are insecure, bogus,
 indeterminate or unchecked are not affected. Default is yes. Use this setting
 to protect the users that rely on this validator for authentication from 
-protentially bad data in the additional section.
+potentially bad data in the additional section.
 .TP
 .B val\-log\-level: \fI<number>
 Have the validator print validation failures to the log.  Regardless of
@@ -773,6 +877,11 @@ servers that set the CD flag but cannot validate DNSSEC themselves are
 the clients, and then unbound provides them with DNSSEC protection.
 The default value is "no".
 .TP
+.B serve\-expired: \fI<yes or no>
+If enabled, unbound attempts to serve old responses from cache with a
+TTL of 0 in the response without waiting for the actual resolution to finish.
+The actual resolution answer ends up in the cache later on.  Default is "no".
+.TP
 .B val\-nsec3\-keysize\-iterations: \fI<"list of values">
 List of keysize and iteration count values, separated by spaces, surrounded
 by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
@@ -832,10 +941,16 @@ as a (DHCP-) DNS network resolver for a group of machines, where such
 lookups should be filtered (RFC compliance), this also stops potential
 data leakage about the local network to the upstream DNS servers.
 .TP
+.B insecure\-lan\-zones: \fI<yesno>
+Default is disabled.  If enabled, then reverse lookups in private
+address space are not validated.  This is usually required whenever
+\fIunblock\-lan\-zones\fR is used.
+.TP
 .B local\-zone: \fI<zone> <type>
 Configure a local zone. The type determines the answer to give if
 there is no match from local\-data. The types are deny, refuse, static,
 transparent, redirect, nodefault, typetransparent, inform, inform_deny,
+always_transparent, always_refuse, always_nxdomain,
 and are explained below. After that the default settings are listed. Use
 local\-data: to enter data into the local zone. Answers for local zones
 are authoritative DNS answers. By default the zones are class IN.
@@ -886,16 +1001,25 @@ queries for www.example.com and www.foo.example.com are redirected, so
 that users with web browsers cannot access sites with suffix example.com.
 .TP 10
 \h'5'\fIinform\fR 
-The query is answered normally.  The client IP address (@portnumber)
-is printed to the logfile.  The log message is: timestamp, unbound-pid,
-info: zonename inform IP@port queryname type class.  This option can be
-used for normal resolution, but machines looking up infected names are
-logged, eg. to run antivirus on them.
+The query is answered normally, same as transparent.  The client IP
+address (@portnumber) is printed to the logfile.  The log message is:
+timestamp, unbound-pid, info: zonename inform IP@port queryname type
+class.  This option can be used for normal resolution, but machines
+looking up infected names are logged, eg. to run antivirus on them.
 .TP 10
 \h'5'\fIinform_deny\fR 
 The query is dropped, like 'deny', and logged, like 'inform'.  Ie. find
 infected machines without answering the queries.
 .TP 10
+\h'5'\fIalways_transparent\fR 
+Like transparent, but ignores local data and resolves normally.
+.TP 10
+\h'5'\fIalways_refuse\fR 
+Like refuse, but ignores local data and refuses the query.
+.TP 10
+\h'5'\fIalways_nxdomain\fR 
+Like static, but ignores local data and returns nxdomain for the query.
+.TP 10
 \h'5'\fInodefault\fR 
 Used to turn off default contents for AS112 zones. The other types
 also turn off default contents for the zone. The 'nodefault' option 
@@ -903,10 +1027,10 @@ has no other effect than turning off default contents for the
 given zone.  Use \fInodefault\fR if you use exactly that zone, if you want to
 use a subzone, use \fItransparent\fR.
 .P
-The default zones are localhost, reverse 127.0.0.1 and ::1, and the AS112
-zones. The AS112 zones are reverse DNS zones for private use and reserved
-IP addresses for which the servers on the internet cannot provide correct
-answers. They are configured by default to give nxdomain (no reverse 
+The default zones are localhost, reverse 127.0.0.1 and ::1, the onion and
+the AS112 zones. The AS112 zones are reverse DNS zones for private use and
+reserved IP addresses for which the servers on the internet cannot provide
+correct answers. They are configured by default to give nxdomain (no reverse
 information) answers. The defaults can be turned off by specifying your
 own local\-zone of that name, or using the 'nodefault' type. Below is a 
 list of the default zone contents.
@@ -950,6 +1074,15 @@ local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
     PTR localhost."
 .fi
 .TP 10
+\h'5'\fIonion (RFC 7686)\fR 
+Default content:
+.nf
+local\-zone: "onion." static
+local\-data: "onion. 10800 IN NS localhost."
+local\-data: "onion. 10800 IN 
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+.fi
+.TP 10
 \h'5'\fIreverse RFC1918 local use zones\fR 
 Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to 
 31.172.in\-addr.arpa, 168.192.in\-addr.arpa.
@@ -1004,6 +1137,18 @@ Configure local data shorthand for a PTR record with the reversed IPv4 or
 IPv6 address and the host name.  For example "192.0.2.4 www.example.com".
 TTL can be inserted like this: "2001:DB8::4 7200 www.example.com"
 .TP 5
+.B local\-zone\-tag: \fI<zone> <"list of tags">
+Assign tags to localzones. Tagged localzones will only be applied when the
+used access-control element has a matching tag. Tags must be defined in
+\fIdefine\-tags\fR.  Enclose list of tags in quotes ("") and put spaces between
+tags.
+.TP 5
+.B local\-zone\-override: \fI<zone> <IP netblock> <type>
+Override the localzone type for queries from addresses matching netblock. 
+Use this localzone type, regardless the type configured for the local-zone
+(both tagged and untagged) and regardless the type configured using
+access\-control\-tag\-action.
+.TP 5
 .B ratelimit: \fI<number or 0>
 Enable ratelimiting of queries sent to nameserver for performing recursion.
 If 0, the default, it is disabled.  This option is experimental at this time.
@@ -1033,7 +1178,7 @@ If set to 0, all queries are dropped for domains where the limit is
 exceeded.  If set to another value, 1 in that number is allowed through
 to complete.  Default is 10, allowing 1/10 traffic to flow normally.
 This can make ordinary queries complete (if repeatedly queried for),
-and enter the cache, whilst also mitigiting the traffic flow by the
+and enter the cache, whilst also mitigating the traffic flow by the
 factor given.
 .TP 5
 .B ratelimit\-for\-domain: \fI<domain> <number qps>
@@ -1158,6 +1303,10 @@ If enabled, a query is attempted without the stub clause if it fails.
 The data could not be retrieved and would have caused SERVFAIL because
 the servers are unreachable, instead it is tried without this clause.
 The default is no.
+.TP
+.B stub\-ssl\-upstream: \fI<yes or no>
+Enabled or disable whether the queries to this stub use SSL for transport.
+Default is no.
 .SS "Forward Zone Options"
 .LP
 There may be multiple
@@ -1188,6 +1337,36 @@ If enabled, a query is attempted without the forward clause if it fails.
 The data could not be retrieved and would have caused SERVFAIL because
 the servers are unreachable, instead it is tried without this clause.
 The default is no.
+.TP
+.B forward\-ssl\-upstream: \fI<yes or no>
+Enabled or disable whether the queries to this forwarder use SSL for transport.
+Default is no.
+.SS "View Options"
+.LP
+There may be multiple
+.B view:
+clauses. Each with a \fBname:\fR and zero or more \fBlocal\-zone\fR and
+\fBlocal\-data\fR elements. View can be mapped to requests by specifying the view
+name in an \fBaccess\-control\-view\fR element. Options from matching views will
+override global options. Global options will be used if no matching view
+is found.
+.TP
+.B name: \fI<view name>
+Name of the view. Must be unique. This name is used in access\-control\-view
+elements.
+.TP
+.B local\-zone: \fI<zone> <type>
+View specific local\-zone elements. Has the same types and behaviour as the
+global local\-zone elements.
+.TP
+.B local\-data: \fI"<resource record string>"
+View specific local\-data elements. Has the same behaviour as the global
+local\-data elements.
+.TP
+.B view\-first: \fI<yes or no>
+If enabled, it attempts to use the global local\-zone and local\-data if there
+is no match in the view specific options.
+The default is no.
 .SS "Python Module Options"
 .LP
 The

doc/unbound.doxygen

@@ -623,7 +623,9 @@ EXCLUDE                = ./build \
                          pythonmod/examples/resip.py \
                          libunbound/python/unbound.py \
                          libunbound/python/libunbound_wrap.c \
-                         ./ldns-src
+                         ./ldns-src \
+			 doc/control_proto_spec.txt \
+			 doc/requirements.txt
 
 # The EXCLUDE_SYMLINKS tag can be used select whether or not files or
 # directories that are symbolic links (a Unix filesystem feature) are excluded

install-sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2011-11-20.07; # UTC
+scriptversion=2013-12-25.23; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -41,19 +41,15 @@ scriptversion=2011-11-20.07; # UTC
 # This script is compatible with the BSD install script, but was written
 # from scratch.
 
+tab='	'
 nl='
 '
-IFS=" ""	$nl"
+IFS=" $tab$nl"
 
-# set DOITPROG to echo to test this script
+# Set DOITPROG to "echo" to test this script.
 
-# Don't use :- since 4.3BSD and earlier shells don't like it.
 doit=${DOITPROG-}
-if test -z "$doit"; then
-  doit_exec=exec
-else
-  doit_exec=$doit
-fi
+doit_exec=${doit:-exec}
 
 # Put in absolute file names if you don't have them in your path;
 # or use environment vars.
@@ -68,17 +64,6 @@ mvprog=${MVPROG-mv}
 rmprog=${RMPROG-rm}
 stripprog=${STRIPPROG-strip}
 
-posix_glob='?'
-initialize_posix_glob='
-  test "$posix_glob" != "?" || {
-    if (set -f) 2>/dev/null; then
-      posix_glob=
-    else
-      posix_glob=:
-    fi
-  }
-'
-
 posix_mkdir=
 
 # Desired mode of installed file.
@@ -97,7 +82,7 @@ dir_arg=
 dst_arg=
 
 copy_on_change=false
-no_target_directory=
+is_target_a_directory=possibly
 
 usage="\
 Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
@@ -137,46 +122,57 @@ while test $# -ne 0; do
     -d) dir_arg=true;;
 
     -g) chgrpcmd="$chgrpprog $2"
-	shift;;
+        shift;;
 
     --help) echo "$usage"; exit $?;;
 
     -m) mode=$2
-	case $mode in
-	  *' '* | *'	'* | *'
-'*	  | *'*'* | *'?'* | *'['*)
-	    echo "$0: invalid mode: $mode" >&2
-	    exit 1;;
-	esac
-	shift;;
+        case $mode in
+          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*)
+            echo "$0: invalid mode: $mode" >&2
+            exit 1;;
+        esac
+        shift;;
 
     -o) chowncmd="$chownprog $2"
-	shift;;
+        shift;;
 
     -s) stripcmd=$stripprog;;
 
-    -t) dst_arg=$2
-	# Protect names problematic for 'test' and other utilities.
-	case $dst_arg in
-	  -* | [=\(\)!]) dst_arg=./$dst_arg;;
-	esac
-	shift;;
+    -t)
+        is_target_a_directory=always
+        dst_arg=$2
+        # Protect names problematic for 'test' and other utilities.
+        case $dst_arg in
+          -* | [=\(\)!]) dst_arg=./$dst_arg;;
+        esac
+        shift;;
 
-    -T) no_target_directory=true;;
+    -T) is_target_a_directory=never;;
 
     --version) echo "$0 $scriptversion"; exit $?;;
 
-    --)	shift
-	break;;
+    --) shift
+        break;;
 
-    -*)	echo "$0: invalid option: $1" >&2
-	exit 1;;
+    -*) echo "$0: invalid option: $1" >&2
+        exit 1;;
 
     *)  break;;
   esac
   shift
 done
 
+# We allow the use of options -d and -T together, by making -d
+# take the precedence; this is for compatibility with GNU install.
+
+if test -n "$dir_arg"; then
+  if test -n "$dst_arg"; then
+    echo "$0: target directory not allowed when installing a directory." >&2
+    exit 1
+  fi
+fi
+
 if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
   # When -d is used, all remaining arguments are directories to create.
   # When -t is used, the destination is already specified.
@@ -207,6 +203,15 @@ if test $# -eq 0; then
   exit 0
 fi
 
+if test -z "$dir_arg"; then
+  if test $# -gt 1 || test "$is_target_a_directory" = always; then
+    if test ! -d "$dst_arg"; then
+      echo "$0: $dst_arg: Is not a directory." >&2
+      exit 1
+    fi
+  fi
+fi
+
 if test -z "$dir_arg"; then
   do_exit='(exit $ret); exit $ret'
   trap "ret=129; $do_exit" 1
@@ -223,16 +228,16 @@ if test -z "$dir_arg"; then
 
     *[0-7])
       if test -z "$stripcmd"; then
-	u_plus_rw=
+        u_plus_rw=
       else
-	u_plus_rw='% 200'
+        u_plus_rw='% 200'
       fi
       cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
     *)
       if test -z "$stripcmd"; then
-	u_plus_rw=
+        u_plus_rw=
       else
-	u_plus_rw=,u+rw
+        u_plus_rw=,u+rw
       fi
       cp_umask=$mode$u_plus_rw;;
   esac
@@ -269,41 +274,15 @@ do
     # If destination is a directory, append the input filename; won't work
     # if double slashes aren't ignored.
     if test -d "$dst"; then
-      if test -n "$no_target_directory"; then
-	echo "$0: $dst_arg: Is a directory" >&2
-	exit 1
+      if test "$is_target_a_directory" = never; then
+        echo "$0: $dst_arg: Is a directory" >&2
+        exit 1
       fi
       dstdir=$dst
       dst=$dstdir/`basename "$src"`
       dstdir_status=0
     else
-      # Prefer dirname, but fall back on a substitute if dirname fails.
-      dstdir=`
-	(dirname "$dst") 2>/dev/null ||
-	expr X"$dst" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
-	     X"$dst" : 'X\(//\)[^/]' \| \
-	     X"$dst" : 'X\(//\)$' \| \
-	     X"$dst" : 'X\(/\)' \| . 2>/dev/null ||
-	echo X"$dst" |
-	    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)[^/].*/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\).*/{
-		   s//\1/
-		   q
-		 }
-		 s/.*/./; q'
-      `
-
+      dstdir=`dirname "$dst"`
       test -d "$dstdir"
       dstdir_status=$?
     fi
@@ -314,74 +293,74 @@ do
   if test $dstdir_status != 0; then
     case $posix_mkdir in
       '')
-	# Create intermediate dirs using mode 755 as modified by the umask.
-	# This is like FreeBSD 'install' as of 1997-10-28.
-	umask=`umask`
-	case $stripcmd.$umask in
-	  # Optimize common cases.
-	  *[2367][2367]) mkdir_umask=$umask;;
-	  .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
+        # Create intermediate dirs using mode 755 as modified by the umask.
+        # This is like FreeBSD 'install' as of 1997-10-28.
+        umask=`umask`
+        case $stripcmd.$umask in
+          # Optimize common cases.
+          *[2367][2367]) mkdir_umask=$umask;;
+          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
 
-	  *[0-7])
-	    mkdir_umask=`expr $umask + 22 \
-	      - $umask % 100 % 40 + $umask % 20 \
-	      - $umask % 10 % 4 + $umask % 2
-	    `;;
-	  *) mkdir_umask=$umask,go-w;;
-	esac
+          *[0-7])
+            mkdir_umask=`expr $umask + 22 \
+              - $umask % 100 % 40 + $umask % 20 \
+              - $umask % 10 % 4 + $umask % 2
+            `;;
+          *) mkdir_umask=$umask,go-w;;
+        esac
 
-	# With -d, create the new directory with the user-specified mode.
-	# Otherwise, rely on $mkdir_umask.
-	if test -n "$dir_arg"; then
-	  mkdir_mode=-m$mode
-	else
-	  mkdir_mode=
-	fi
+        # With -d, create the new directory with the user-specified mode.
+        # Otherwise, rely on $mkdir_umask.
+        if test -n "$dir_arg"; then
+          mkdir_mode=-m$mode
+        else
+          mkdir_mode=
+        fi
 
-	posix_mkdir=false
-	case $umask in
-	  *[123567][0-7][0-7])
-	    # POSIX mkdir -p sets u+wx bits regardless of umask, which
-	    # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-	    ;;
-	  *)
-	    tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-	    trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
+        posix_mkdir=false
+        case $umask in
+          *[123567][0-7][0-7])
+            # POSIX mkdir -p sets u+wx bits regardless of umask, which
+            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
+            ;;
+          *)
+            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
 
-	    if (umask $mkdir_umask &&
-		exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
-	    then
-	      if test -z "$dir_arg" || {
-		   # Check for POSIX incompatibilities with -m.
-		   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-		   # other-writable bit of parent directory when it shouldn't.
-		   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-		   ls_ld_tmpdir=`ls -ld "$tmpdir"`
-		   case $ls_ld_tmpdir in
-		     d????-?r-*) different_mode=700;;
-		     d????-?--*) different_mode=755;;
-		     *) false;;
-		   esac &&
-		   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
-		     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
-		     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-		   }
-		 }
-	      then posix_mkdir=:
-	      fi
-	      rmdir "$tmpdir/d" "$tmpdir"
-	    else
-	      # Remove any dirs left behind by ancient mkdir implementations.
-	      rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
-	    fi
-	    trap '' 0;;
-	esac;;
+            if (umask $mkdir_umask &&
+                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+            then
+              if test -z "$dir_arg" || {
+                   # Check for POSIX incompatibilities with -m.
+                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
+                   # other-writable bit of parent directory when it shouldn't.
+                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
+                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
+                   case $ls_ld_tmpdir in
+                     d????-?r-*) different_mode=700;;
+                     d????-?--*) different_mode=755;;
+                     *) false;;
+                   esac &&
+                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
+                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
+                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
+                   }
+                 }
+              then posix_mkdir=:
+              fi
+              rmdir "$tmpdir/d" "$tmpdir"
+            else
+              # Remove any dirs left behind by ancient mkdir implementations.
+              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+            fi
+            trap '' 0;;
+        esac;;
     esac
 
     if
       $posix_mkdir && (
-	umask $mkdir_umask &&
-	$doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
+        umask $mkdir_umask &&
+        $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
       )
     then :
     else
@@ -391,53 +370,51 @@ do
       # directory the slow way, step by step, checking for races as we go.
 
       case $dstdir in
-	/*) prefix='/';;
-	[-=\(\)!]*) prefix='./';;
-	*)  prefix='';;
+        /*) prefix='/';;
+        [-=\(\)!]*) prefix='./';;
+        *)  prefix='';;
       esac
 
-      eval "$initialize_posix_glob"
-
       oIFS=$IFS
       IFS=/
-      $posix_glob set -f
+      set -f
       set fnord $dstdir
       shift
-      $posix_glob set +f
+      set +f
       IFS=$oIFS
 
       prefixes=
 
       for d
       do
-	test X"$d" = X && continue
+        test X"$d" = X && continue
 
-	prefix=$prefix$d
-	if test -d "$prefix"; then
-	  prefixes=
-	else
-	  if $posix_mkdir; then
-	    (umask=$mkdir_umask &&
-	     $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
-	    # Don't fail if two instances are running concurrently.
-	    test -d "$prefix" || exit 1
-	  else
-	    case $prefix in
-	      *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
-	      *) qprefix=$prefix;;
-	    esac
-	    prefixes="$prefixes '$qprefix'"
-	  fi
-	fi
-	prefix=$prefix/
+        prefix=$prefix$d
+        if test -d "$prefix"; then
+          prefixes=
+        else
+          if $posix_mkdir; then
+            (umask=$mkdir_umask &&
+             $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
+            # Don't fail if two instances are running concurrently.
+            test -d "$prefix" || exit 1
+          else
+            case $prefix in
+              *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
+              *) qprefix=$prefix;;
+            esac
+            prefixes="$prefixes '$qprefix'"
+          fi
+        fi
+        prefix=$prefix/
       done
 
       if test -n "$prefixes"; then
-	# Don't fail if two instances are running concurrently.
-	(umask $mkdir_umask &&
-	 eval "\$doit_exec \$mkdirprog $prefixes") ||
-	  test -d "$dstdir" || exit 1
-	obsolete_mkdir_used=true
+        # Don't fail if two instances are running concurrently.
+        (umask $mkdir_umask &&
+         eval "\$doit_exec \$mkdirprog $prefixes") ||
+          test -d "$dstdir" || exit 1
+        obsolete_mkdir_used=true
       fi
     fi
   fi
@@ -472,15 +449,12 @@ do
 
     # If -C, don't bother to copy if it wouldn't change the file.
     if $copy_on_change &&
-       old=`LC_ALL=C ls -dlL "$dst"	2>/dev/null` &&
-       new=`LC_ALL=C ls -dlL "$dsttmp"	2>/dev/null` &&
-
-       eval "$initialize_posix_glob" &&
-       $posix_glob set -f &&
+       old=`LC_ALL=C ls -dlL "$dst"     2>/dev/null` &&
+       new=`LC_ALL=C ls -dlL "$dsttmp"  2>/dev/null` &&
+       set -f &&
        set X $old && old=:$2:$4:$5:$6 &&
        set X $new && new=:$2:$4:$5:$6 &&
-       $posix_glob set +f &&
-
+       set +f &&
        test "$old" = "$new" &&
        $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
     then
@@ -493,24 +467,24 @@ do
       # to itself, or perhaps because mv is so ancient that it does not
       # support -f.
       {
-	# Now remove or move aside any old file at destination location.
-	# We try this two ways since rm can't unlink itself on some
-	# systems and the destination file might be busy for other
-	# reasons.  In this case, the final cleanup might fail but the new
-	# file should still install successfully.
-	{
-	  test ! -f "$dst" ||
-	  $doit $rmcmd -f "$dst" 2>/dev/null ||
-	  { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-	    { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
-	  } ||
-	  { echo "$0: cannot unlink or rename $dst" >&2
-	    (exit 1); exit 1
-	  }
-	} &&
+        # Now remove or move aside any old file at destination location.
+        # We try this two ways since rm can't unlink itself on some
+        # systems and the destination file might be busy for other
+        # reasons.  In this case, the final cleanup might fail but the new
+        # file should still install successfully.
+        {
+          test ! -f "$dst" ||
+          $doit $rmcmd -f "$dst" 2>/dev/null ||
+          { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
+            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
+          } ||
+          { echo "$0: cannot unlink or rename $dst" >&2
+            (exit 1); exit 1
+          }
+        } &&
 
-	# Now rename the file to the real destination.
-	$doit $mvcmd "$dsttmp" "$dst"
+        # Now rename the file to the real destination.
+        $doit $mvcmd "$dsttmp" "$dst"
       }
     fi || exit 1
 

iterator/iter_delegpt.c

@@ -72,6 +72,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 		return NULL;
 	copy->bogus = dp->bogus;
 	copy->has_parent_side_NS = dp->has_parent_side_NS;
+	copy->ssl_upstream = dp->ssl_upstream;
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		if(!delegpt_add_ns(copy, region, ns->name, ns->lame))
 			return NULL;

iterator/iter_delegpt.h

@@ -81,6 +81,8 @@ struct delegpt {
 	uint8_t has_parent_side_NS;
 	/** for assertions on type of delegpt */
 	uint8_t dp_type_mlc;
+	/** use SSL for upstream query */
+	uint8_t ssl_upstream;
 };
 
 /**
@@ -355,7 +357,7 @@ void delegpt_no_ipv4(struct delegpt* dp);
 
 /** 
  * create malloced delegation point, with the given name 
- * @param name: uncompressed wireformat of degegpt name.
+ * @param name: uncompressed wireformat of delegpt name.
  * @return NULL on alloc failure
  */
 struct delegpt* delegpt_create_mlc(uint8_t* name);

iterator/iter_fwd.c

@@ -265,6 +265,8 @@ read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
 		 * last resort will ask for parent-side NS record and thus
 		 * fallback to the internet name servers on a failure */
 		dp->has_parent_side_NS = (uint8_t)!s->isfirst;
+		/* use SSL for queries to this forwarder */
+		dp->ssl_upstream = (uint8_t)s->ssl_upstream;
 		verbose(VERB_QUERY, "Forward zone server list:");
 		delegpt_log(VERB_QUERY, dp);
 		if(!forwards_insert(fwd, LDNS_RR_CLASS_IN, dp))
@@ -294,6 +296,7 @@ make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
 	uint8_t* dname;
 	size_t dname_len;
 	for(s = cfg->stubs; s; s = s->next) {
+		if(!s->name) continue;
 		dname = sldns_str2wire_dname(s->name, &dname_len);
 		if(!dname) {
 			log_err("cannot parse stub name '%s'", s->name);

iterator/iter_hints.c

@@ -147,12 +147,14 @@ compile_time_root_prime(int do_ip4, int do_ip6)
 	if(!ah(dp, "B.ROOT-SERVERS.NET.", "2001:500:84::b")) goto failed;
 	if(!ah(dp, "C.ROOT-SERVERS.NET.", "2001:500:2::c")) goto failed;
 	if(!ah(dp, "D.ROOT-SERVERS.NET.", "2001:500:2d::d")) goto failed;
+	if(!ah(dp, "E.ROOT-SERVERS.NET.", "2001:500:a8::e")) goto failed;
 	if(!ah(dp, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) goto failed;
+	if(!ah(dp, "G.ROOT-SERVERS.NET.", "2001:500:12::d0d")) goto failed;
 	if(!ah(dp, "H.ROOT-SERVERS.NET.", "2001:500:1::53")) goto failed;
 	if(!ah(dp, "I.ROOT-SERVERS.NET.", "2001:7fe::53")) goto failed;
 	if(!ah(dp, "J.ROOT-SERVERS.NET.", "2001:503:c27::2:30")) goto failed;
 	if(!ah(dp, "K.ROOT-SERVERS.NET.", "2001:7fd::1")) goto failed;
-	if(!ah(dp, "L.ROOT-SERVERS.NET.", "2001:500:3::42")) goto failed;
+	if(!ah(dp, "L.ROOT-SERVERS.NET.", "2001:500:9f::42")) goto failed;
 	if(!ah(dp, "M.ROOT-SERVERS.NET.", "2001:dc3::35")) goto failed;
       }
 	return dp;
@@ -274,6 +276,8 @@ read_stubs(struct iter_hints* hints, struct config_file* cfg)
 		 * last resort will ask for parent-side NS record and thus
 		 * fallback to the internet name servers on a failure */
 		dp->has_parent_side_NS = (uint8_t)!s->isfirst;
+		/* ssl_upstream */
+		dp->ssl_upstream = (uint8_t)s->ssl_upstream;
 		delegpt_log(VERB_QUERY, dp);
 		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, !s->isprime))
 			return 0;

iterator/iter_scrub.c

@@ -405,7 +405,43 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 
 		/* Follow the CNAME chain. */
 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
+			struct rrset_parse* nx = rrset->rrset_all_next;
 			uint8_t* oldsname = sname;
+			/* see if the next one is a DNAME, if so, swap them */
+			if(nx && nx->section == LDNS_SECTION_ANSWER &&
+				nx->type == LDNS_RR_TYPE_DNAME &&
+				nx->rr_count == 1 &&
+				pkt_strict_sub(pkt, sname, nx->dname)) {
+				/* there is a DNAME after this CNAME, it 
+				 * is in the ANSWER section, and the DNAME
+				 * applies to the name we cover */
+				/* check if the alias of the DNAME equals
+				 * this CNAME */
+				uint8_t alias[LDNS_MAX_DOMAINLEN+1];
+				size_t aliaslen = 0;
+				uint8_t* t = NULL;
+				size_t tlen = 0;
+				if(synth_cname(sname, snamelen, nx, alias,
+					&aliaslen, pkt) &&
+					parse_get_cname_target(rrset, &t, &tlen) &&
+			   		dname_pkt_compare(pkt, alias, t) == 0) {
+					/* the synthesized CNAME equals the
+					 * current CNAME.  This CNAME is the
+					 * one that the DNAME creates, and this
+					 * CNAME is better capitalised */
+					verbose(VERB_ALGO, "normalize: re-order of DNAME and its CNAME");
+					if(prev) prev->rrset_all_next = nx;
+					else msg->rrset_first = nx;
+					if(nx->rrset_all_next == NULL)
+						msg->rrset_last = rrset;
+					rrset->rrset_all_next =
+						nx->rrset_all_next;
+					nx->rrset_all_next = rrset;
+					prev = nx;
+				}
+			}
+
+			/* move to next name in CNAME chain */
 			if(!parse_get_cname_target(rrset, &sname, &snamelen))
 				return 0;
 			prev = rrset;
@@ -638,7 +674,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	 * children of the originating zone. The idea here is that, 
 	 * as far as we know, the server that we contacted is ONLY 
 	 * authoritative for the originating zone. It, of course, MAY 
-	 * be authoriative for any other zones, and of course, MAY 
+	 * be authoritative for any other zones, and of course, MAY 
 	 * NOT be authoritative for some subdomains of the originating 
 	 * zone. */
 	prev = NULL;

iterator/iter_utils.c

@@ -255,7 +255,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 			return -1; /* server is lame */
 		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT)
 			/* server is unresponsive,
-			 * we used to return TOP_TIMOUT, but fairly useless,
+			 * we used to return TOP_TIMEOUT, but fairly useless,
 			 * because if == TOP_TIMEOUT is dropped because
 			 * blacklisted later, instead, remove it here, so
 			 * other choices (that are not blacklisted) can be
@@ -306,7 +306,7 @@ iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
 	return got_it;
 }
 
-/** filter the addres list, putting best targets at front,
+/** filter the address list, putting best targets at front,
  * returns number of best targets (or 0, no suitable targets) */
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
@@ -360,6 +360,39 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 		}
 	}
 	*selected_rtt = low_rtt;
+
+	if (env->cfg->prefer_ip6) {
+		int got_num6 = 0;
+		int low_rtt6 = 0;
+		int i;
+		prev = NULL;
+		a = dp->result_list;
+		for(i = 0; i < got_num; i++) {
+			swap_to_front = 0;
+			if(a->addr.ss_family == AF_INET6) {
+				got_num6++;
+				swap_to_front = 1;
+				if(low_rtt6 == 0 || a->sel_rtt < low_rtt6) {
+					low_rtt6 = a->sel_rtt;
+				}
+			}
+			/* swap to front if IPv6, or move to next result */
+			if(swap_to_front && prev) {
+				n = a->next_result;
+				prev->next_result = n;
+				a->next_result = dp->result_list;
+				dp->result_list = a;
+				a = n;
+			} else {
+				prev = a;
+				a = a->next_result;
+			}
+		}
+		if(got_num6 > 0) {
+			got_num = got_num6;
+			*selected_rtt = low_rtt6;
+		}
+	}
 	return got_num;
 }
 
@@ -499,6 +532,7 @@ causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
 	qinf.qname_len = namelen;
 	qinf.qtype = t;
 	qinf.qclass = c;
+	qinf.local_alias = NULL;
 	fptr_ok(fptr_whitelist_modenv_detect_cycle(
 		qstate->env->detect_cycle));
 	return (*qstate->env->detect_cycle)(qstate, &qinf, 
@@ -590,6 +624,27 @@ iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
 	return 1;
 }
 
+int
+iter_indicates_dnssec_fwd(struct module_env* env, struct query_info *qinfo)
+{
+	struct trust_anchor* a;
+	if(!env || !env->anchors || !qinfo || !qinfo->qname)
+		return 0;
+	/* a trust anchor exists above the name? */
+	if((a=anchors_lookup(env->anchors, qinfo->qname, qinfo->qname_len,
+		qinfo->qclass))) { 
+		if(a->numDS == 0 && a->numDNSKEY == 0) {
+			/* insecure trust point */
+			lock_basic_unlock(&a->lock);
+			return 0;
+		}
+		lock_basic_unlock(&a->lock);
+		return 1;
+	}
+	/* no trust anchor above it. */
+	return 0;
+}
+
 int 
 iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
         struct dns_msg* msg, uint16_t dclass)

iterator/iter_utils.h

@@ -173,6 +173,18 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
 int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
 	struct delegpt* dp);
 
+/**
+ * See if qname has DNSSEC needs in the forwarding case.  This is true if
+ * there is a trust anchor above it.  Whether there is an insecure delegation
+ * to the data is unknown, but CD-retry is needed.
+ * @param env: environment with anchors.
+ * @param qinfo: query name and class.
+ * @return true if trust anchor above qname, false if no anchor or insecure
+ * point above qname.
+ */
+int iter_indicates_dnssec_fwd(struct module_env* env,
+	struct query_info *qinfo);
+
 /**
  * See if delegation is expected to have DNSSEC information (RRSIGs) in 
  * its answers, or not. Inspects delegation point (name), trust anchors,

iterator/iterator.c

@@ -64,6 +64,7 @@
 #include "util/random.h"
 #include "sldns/rrdef.h"
 #include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
 #include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
 
@@ -81,6 +82,7 @@ iter_init(struct module_env* env, int id)
 		log_err("iterator: could not apply configuration settings.");
 		return 0;
 	}
+
 	return 1;
 }
 
@@ -145,6 +147,14 @@ iter_new(struct module_qstate* qstate, int id)
 	/* Start with the (current) qname. */
 	iq->qchase = qstate->qinfo;
 	outbound_list_init(&iq->outlist);
+	iq->minimise_count = 0;
+	iq->minimise_timeout_count = 0;
+	if (qstate->env->cfg->qname_minimisation)
+		iq->minimisation_state = INIT_MINIMISE_STATE;
+	else
+		iq->minimisation_state = DONOT_MINIMISE_STATE;
+	
+	memset(&iq->qinfo_out, 0, sizeof(struct query_info));
 	return 1;
 }
 
@@ -176,7 +186,7 @@ next_state(struct iter_qstate* iq, enum iter_state nextstate)
 /**
  * Transition an event to its final state. Final states always either return
  * a result up the module chain, or reactivate a dependent event. Which
- * final state to transtion to is set in the module state for the event when
+ * final state to transition to is set in the module state for the event when
  * it was created, and depends on the original purpose of the event.
  *
  * The response is stored in the qstate->buf buffer.
@@ -206,6 +216,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) {
 		/* mark address as failed. */
 		struct delegpt_ns* dpns = NULL;
+		super_iq->num_target_queries--; 
 		if(super_iq->dp)
 			dpns = delegpt_find_ns(super_iq->dp, 
 				qstate->qinfo.qname, qstate->qinfo.qname_len);
@@ -219,13 +230,11 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 			return;
 		} else {
 			/* see if the failure did get (parent-lame) info */
-			if(!cache_fill_missing(super->env, 
-				super_iq->qchase.qclass, super->region, 
-				super_iq->dp))
+			if(!cache_fill_missing(super->env, super_iq->qchase.qclass,
+				super->region, super_iq->dp))
 				log_err("out of memory adding missing");
 		}
 		dpns->resolved = 1; /* mark as failed */
-		super_iq->num_target_queries--; 
 	}
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) {
 		/* prime failed to get delegation */
@@ -268,27 +277,29 @@ error_response(struct module_qstate* qstate, int id, int rcode)
 static int
 error_response_cache(struct module_qstate* qstate, int id, int rcode)
 {
-	/* store in cache */
-	struct reply_info err;
-	if(qstate->prefetch_leeway > NORR_TTL) {
-		verbose(VERB_ALGO, "error response for prefetch in cache");
-		/* attempt to adjust the cache entry prefetch */
-		if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo,
-			NORR_TTL, qstate->query_flags))
-			return error_response(qstate, id, rcode);
-		/* if that fails (not in cache), fall through to store err */
+	if(!qstate->no_cache_store) {
+		/* store in cache */
+		struct reply_info err;
+		if(qstate->prefetch_leeway > NORR_TTL) {
+			verbose(VERB_ALGO, "error response for prefetch in cache");
+			/* attempt to adjust the cache entry prefetch */
+			if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo,
+				NORR_TTL, qstate->query_flags))
+				return error_response(qstate, id, rcode);
+			/* if that fails (not in cache), fall through to store err */
+		}
+		memset(&err, 0, sizeof(err));
+		err.flags = (uint16_t)(BIT_QR | BIT_RA);
+		FLAGS_SET_RCODE(err.flags, rcode);
+		err.qdcount = 1;
+		err.ttl = NORR_TTL;
+		err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
+		/* do not waste time trying to validate this servfail */
+		err.security = sec_status_indeterminate;
+		verbose(VERB_ALGO, "store error response in message cache");
+		iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
+			qstate->query_flags);
 	}
-	memset(&err, 0, sizeof(err));
-	err.flags = (uint16_t)(BIT_QR | BIT_RA);
-	FLAGS_SET_RCODE(err.flags, rcode);
-	err.qdcount = 1;
-	err.ttl = NORR_TTL;
-	err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
-	/* do not waste time trying to validate this servfail */
-	err.security = sec_status_indeterminate;
-	verbose(VERB_ALGO, "store error response in message cache");
-	iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
-		qstate->query_flags);
 	return error_response(qstate, id, rcode);
 }
 
@@ -506,7 +517,7 @@ target_count_increase(struct iter_qstate* iq, int num)
 /**
  * Generate a subrequest.
  * Generate a local request event. Local events are tied to this module, and
- * have a correponding (first tier) event that is waiting for this event to
+ * have a corresponding (first tier) event that is waiting for this event to
  * resolve to continue.
  *
  * @param qname The query name for this request.
@@ -541,6 +552,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	qinf.qname_len = qnamelen;
 	qinf.qtype = qtype;
 	qinf.qclass = qclass;
+	qinf.local_alias = NULL;
 
 	/* RD should be set only when sending the query back through the INIT
 	 * state. */
@@ -590,6 +602,11 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq->qchase = subq->qinfo;
 		subiq->chase_flags = subq->query_flags;
 		subiq->refetch_glue = 0;
+		if(qstate->env->cfg->qname_minimisation)
+			subiq->minimisation_state = INIT_MINIMISE_STATE;
+		else
+			subiq->minimisation_state = DONOT_MINIMISE_STATE;
+		memset(&subiq->qinfo_out, 0, sizeof(struct query_info));
 	}
 	return 1;
 }
@@ -953,7 +970,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 {
 	uint8_t* delname;
 	size_t delnamelen;
-	struct dns_msg* msg;
+	struct dns_msg* msg = NULL;
 
 	log_query_info(VERB_DETAIL, "resolving", &qstate->qinfo);
 	/* check effort */
@@ -993,13 +1010,13 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * getting older results from cache is a bad idea, no cache */
 		verbose(VERB_ALGO, "cache blacklisted, going to the network");
 		msg = NULL;
-	} else {
+	} else if(!qstate->no_cache_lookup) {
 		msg = dns_cache_lookup(qstate->env, iq->qchase.qname, 
 			iq->qchase.qname_len, iq->qchase.qtype, 
 			iq->qchase.qclass, qstate->query_flags,
 			qstate->region, qstate->env->scratch);
 		if(!msg && qstate->env->neg_cache) {
-			/* lookup in negative cache; may result in 
+			/* lookup in negative cache; may result in
 			 * NOERROR/NODATA or NXDOMAIN answers that need validation */
 			msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
 				qstate->region, qstate->env->rrset_cache,
@@ -1042,6 +1059,8 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->query_restart_count++;
 			iq->sent_count = 0;
 			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
+			if(qstate->env->cfg->qname_minimisation)
+				iq->minimisation_state = INIT_MINIMISE_STATE;
 			return next_state(iq, INIT_REQUEST_STATE);
 		}
 
@@ -1062,6 +1081,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->refetch_glue = 0;
+		iq->minimisation_state = DONOT_MINIMISE_STATE;
 		/* the request has been forwarded.
 		 * forwarded requests need to be immediately sent to the 
 		 * next state, QUERYTARGETS. */
@@ -1599,6 +1619,8 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->refetch_glue = 1;
 			iq->query_restart_count++;
 			iq->sent_count = 0;
+			if(qstate->env->cfg->qname_minimisation)
+				iq->minimisation_state = INIT_MINIMISE_STATE;
 			return next_state(iq, INIT_REQUEST_STATE);
 		}
 	}
@@ -1680,10 +1702,11 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* if this was a parent-side glue query itself, then store that
 	 * failure in cache. */
-	if(iq->query_for_pside_glue && !iq->pside_glue)
-		iter_store_parentside_neg(qstate->env, &qstate->qinfo,
-			iq->deleg_msg?iq->deleg_msg->rep:
-			(iq->response?iq->response->rep:NULL));
+	if(!qstate->no_cache_store && iq->query_for_pside_glue
+		&& !iq->pside_glue)
+			iter_store_parentside_neg(qstate->env, &qstate->qinfo,
+				iq->deleg_msg?iq->deleg_msg->rep:
+				(iq->response?iq->response->rep:NULL));
 
 	verbose(VERB_QUERY, "out of query targets -- returning SERVFAIL");
 	/* fail -- no more targets, no more hope of targets, no hope 
@@ -1975,9 +1998,109 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 	}
 
+	if(iq->minimisation_state == INIT_MINIMISE_STATE) {
+		/* (Re)set qinfo_out to (new) delegation point, except when
+		 * qinfo_out is already a subdomain of dp. This happens when
+		 * increasing by more than one label at once (QNAMEs with more
+		 * than MAX_MINIMISE_COUNT labels). */
+		if(!(iq->qinfo_out.qname_len 
+			&& dname_subdomain_c(iq->qchase.qname, 
+				iq->qinfo_out.qname)
+			&& dname_subdomain_c(iq->qinfo_out.qname, 
+				iq->dp->name))) {
+			iq->qinfo_out.qname = iq->dp->name;
+			iq->qinfo_out.qname_len = iq->dp->namelen;
+			iq->qinfo_out.qtype = LDNS_RR_TYPE_A;
+			iq->qinfo_out.qclass = iq->qchase.qclass;
+			iq->qinfo_out.local_alias = NULL;
+			iq->minimise_count = 0;
+		}
+
+		iq->minimisation_state = MINIMISE_STATE;
+	}
+	if(iq->minimisation_state == MINIMISE_STATE) {
+		int qchaselabs = dname_count_labels(iq->qchase.qname);
+		int labdiff = qchaselabs -
+			dname_count_labels(iq->qinfo_out.qname);
+
+		iq->qinfo_out.qname = iq->qchase.qname;
+		iq->qinfo_out.qname_len = iq->qchase.qname_len;
+		iq->minimise_count++;
+		iq->minimise_timeout_count = 0;
+
+		iter_dec_attempts(iq->dp, 1);
+
+		/* Limit number of iterations for QNAMEs with more
+		 * than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB
+		 * labels of QNAME always individually.
+		 */
+		if(qchaselabs > MAX_MINIMISE_COUNT && labdiff > 1 && 
+			iq->minimise_count > MINIMISE_ONE_LAB) {
+			if(iq->minimise_count < MAX_MINIMISE_COUNT) {
+				int multilabs = qchaselabs - 1 - 
+					MINIMISE_ONE_LAB;
+				int extralabs = multilabs / 
+					MINIMISE_MULTIPLE_LABS;
+
+				if (MAX_MINIMISE_COUNT - iq->minimise_count >= 
+					multilabs % MINIMISE_MULTIPLE_LABS)
+					/* Default behaviour is to add 1 label
+					 * every iteration. Therefore, decrement
+					 * the extralabs by 1 */
+					extralabs--;
+				if (extralabs < labdiff)
+					labdiff -= extralabs;
+				else
+					labdiff = 1;
+			}
+			/* Last minimised iteration, send all labels with
+			 * QTYPE=NS */
+			else
+				labdiff = 1;
+		}
+
+		if(labdiff > 1) {
+			verbose(VERB_QUERY, "removing %d labels", labdiff-1);
+			dname_remove_labels(&iq->qinfo_out.qname, 
+				&iq->qinfo_out.qname_len, 
+				labdiff-1);
+		}
+		if(labdiff < 1 || (labdiff < 2 
+			&& (iq->qchase.qtype == LDNS_RR_TYPE_DS
+			|| iq->qchase.qtype == LDNS_RR_TYPE_A)))
+			/* Stop minimising this query, resolve "as usual" */
+			iq->minimisation_state = DONOT_MINIMISE_STATE;
+		else if(!qstate->no_cache_lookup) {
+			struct dns_msg* msg = dns_cache_lookup(qstate->env, 
+				iq->qinfo_out.qname, iq->qinfo_out.qname_len, 
+				iq->qinfo_out.qtype, iq->qinfo_out.qclass, 
+				qstate->query_flags, qstate->region, 
+				qstate->env->scratch);
+			if(msg && msg->rep->an_numrrsets == 0
+				&& FLAGS_GET_RCODE(msg->rep->flags) == 
+				LDNS_RCODE_NOERROR)
+				/* no need to send query if it is already 
+				 * cached as NOERROR/NODATA */
+				return 1;
+		}
+	}
+	if(iq->minimisation_state == SKIP_MINIMISE_STATE) {
+		iq->minimise_timeout_count++;
+		if(iq->minimise_timeout_count < MAX_MINIMISE_TIMEOUT_COUNT)
+			/* Do not increment qname, continue incrementing next 
+			 * iteration */
+			iq->minimisation_state = MINIMISE_STATE;
+		else if(!qstate->env->cfg->qname_minimisation_strict)
+			/* Too many time-outs detected for this QNAME and QTYPE.
+			 * We give up, disable QNAME minimisation. */
+			iq->minimisation_state = DONOT_MINIMISE_STATE;
+	}
+	if(iq->minimisation_state == DONOT_MINIMISE_STATE)
+		iq->qinfo_out = iq->qchase;
+
 	/* We have a valid target. */
 	if(verbosity >= VERB_QUERY) {
-		log_query_info(VERB_QUERY, "sending query:", &iq->qchase);
+		log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out);
 		log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
 			&target->addr, target->addrlen);
 		verbose(VERB_ALGO, "dnssec status: %s%s",
@@ -1985,13 +2108,18 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->dnssec_lame_query?" but lame_query anyway": "");
 	}
 	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
-	outq = (*qstate->env->send_query)(
-		iq->qchase.qname, iq->qchase.qname_len, 
-		iq->qchase.qtype, iq->qchase.qclass, 
-		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), EDNS_DO|BIT_CD, 
+	outq = (*qstate->env->send_query)(&iq->qinfo_out,
+		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), 
+		/* unset CD if to forwarder(RD set) and not dnssec retry
+		 * (blacklist nonempty) and no trust-anchors are configured
+		 * above the qname or on the first attempt when dnssec is on */
+		EDNS_DO| ((iq->chase_to_rd||(iq->chase_flags&BIT_RD)!=0)&&
+		!qstate->blacklist&&(!iter_indicates_dnssec_fwd(qstate->env,
+		&iq->qinfo_out)||target->attempts==1)?0:BIT_CD), 
 		iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
-		ie, iq), &target->addr, target->addrlen, iq->dp->name,
-		iq->dp->namelen, qstate);
+		ie, iq), &target->addr, target->addrlen,
+		iq->dp->name, iq->dp->namelen,
+		(iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream), qstate);
 	if(!outq) {
 		log_addr(VERB_DETAIL, "error sending query to auth server", 
 			&target->addr, target->addrlen);
@@ -2042,6 +2170,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	enum response_type type;
 	iq->num_current_queries--;
 	if(iq->response == NULL) {
+		/* Don't increment qname when QNAME minimisation is enabled */
+		if(qstate->env->cfg->qname_minimisation)
+			iq->minimisation_state = SKIP_MINIMISE_STATE;
 		iq->chase_to_rd = 0;
 		iq->dnssec_lame_query = 0;
 		verbose(VERB_ALGO, "query response was timeout");
@@ -2056,8 +2187,10 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * differently. No queries should be sent elsewhere */
 		type = RESPONSE_TYPE_ANSWER;
 	}
-	if(iq->dnssec_expected && !iq->dnssec_lame_query &&
+	if(!qstate->env->cfg->disable_dnssec_lame_check && iq->dnssec_expected 
+                && !iq->dnssec_lame_query &&
 		!(iq->chase_flags&BIT_RD) 
+		&& iq->sent_count < DNSSEC_LAME_DETECT_COUNT
 		&& type != RESPONSE_TYPE_LAME 
 		&& type != RESPONSE_TYPE_REC_LAME 
 		&& type != RESPONSE_TYPE_THROWAWAY 
@@ -2127,10 +2260,11 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->num_target_queries = 0;
 			return processDSNSFind(qstate, iq, id);
 		}
-		iter_dns_store(qstate->env, &iq->response->qinfo,
-			iq->response->rep, 0, qstate->prefetch_leeway,
-			iq->dp&&iq->dp->has_parent_side_NS,
-			qstate->region, qstate->query_flags);
+		if(!qstate->no_cache_store)
+			iter_dns_store(qstate->env, &iq->response->qinfo,
+				iq->response->rep, 0, qstate->prefetch_leeway,
+				iq->dp&&iq->dp->has_parent_side_NS,
+				qstate->region, qstate->query_flags);
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
@@ -2142,6 +2276,47 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			sock_list_insert(&qstate->reply_origin, 
 				&qstate->reply->addr, qstate->reply->addrlen, 
 				qstate->region);
+		if(iq->minimisation_state != DONOT_MINIMISE_STATE) {
+			if(FLAGS_GET_RCODE(iq->response->rep->flags) != 
+				LDNS_RCODE_NOERROR) {
+				if(qstate->env->cfg->qname_minimisation_strict)
+					return final_state(iq);
+				/* Best effort qname-minimisation. 
+				 * Stop minimising and send full query when
+				 * RCODE is not NOERROR. */
+				iq->minimisation_state = DONOT_MINIMISE_STATE;
+			}
+			if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
+				LDNS_RCODE_NXDOMAIN) {
+				/* Stop resolving when NXDOMAIN is DNSSEC
+				 * signed. Based on assumption that namservers
+				 * serving signed zones do not return NXDOMAIN
+				 * for empty-non-terminals. */
+				if(iq->dnssec_expected)
+					return final_state(iq);
+				/* Make subrequest to validate intermediate
+				 * NXDOMAIN if harden-below-nxdomain is
+				 * enabled. */
+				if(qstate->env->cfg->harden_below_nxdomain) {
+					struct module_qstate* subq = NULL;
+					log_query_info(VERB_QUERY,
+						"schedule NXDOMAIN validation:",
+						&iq->response->qinfo);
+					if(!generate_sub_request(
+						iq->response->qinfo.qname,
+						iq->response->qinfo.qname_len,
+						iq->response->qinfo.qtype,
+						iq->response->qinfo.qclass,
+						qstate, id, iq,
+						INIT_REQUEST_STATE,
+						FINISHED_STATE, &subq, 1))
+						verbose(VERB_ALGO,
+						"could not validate NXDOMAIN "
+						"response");
+				}
+			}
+			return next_state(iq, QUERYTARGETS_STATE);
+		}
 		return final_state(iq);
 	} else if(type == RESPONSE_TYPE_REFERRAL) {
 		/* REFERRAL type responses get a reset of the 
@@ -2157,7 +2332,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 
 		/* if hardened, only store referral if we asked for it */
-		if(!qstate->env->cfg->harden_referral_path ||
+		if(!qstate->no_cache_store &&
+		(!qstate->env->cfg->harden_referral_path ||
 		    (  qstate->qinfo.qtype == LDNS_RR_TYPE_NS 
 			&& (qstate->query_flags&BIT_RD) 
 			&& !(qstate->query_flags&BIT_CD)
@@ -2172,7 +2348,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				iq->qchase.qname, iq->qchase.qname_len,
 				LDNS_RR_TYPE_NS, iq->qchase.qclass)
 			  )
-		    )) {
+		    ))) {
 			/* Store the referral under the current query */
 			/* no prefetch-leeway, since its not the answer */
 			iter_dns_store(qstate->env, &iq->response->qinfo,
@@ -2185,22 +2361,25 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 					iq->response->rep, iq->dp->name);
 		}
 		/* store parent-side-in-zone-glue, if directly queried for */
-		if(iq->query_for_pside_glue && !iq->pside_glue) {
-			iq->pside_glue = reply_find_rrset(iq->response->rep, 
-				iq->qchase.qname, iq->qchase.qname_len, 
-				iq->qchase.qtype, iq->qchase.qclass);
-			if(iq->pside_glue) {
-				log_rrset_key(VERB_ALGO, "found parent-side "
-					"glue", iq->pside_glue);
-				iter_store_parentside_rrset(qstate->env,
-					iq->pside_glue);
-			}
+		if(!qstate->no_cache_store && iq->query_for_pside_glue
+			&& !iq->pside_glue) {
+				iq->pside_glue = reply_find_rrset(iq->response->rep, 
+					iq->qchase.qname, iq->qchase.qname_len, 
+					iq->qchase.qtype, iq->qchase.qclass);
+				if(iq->pside_glue) {
+					log_rrset_key(VERB_ALGO, "found parent-side "
+						"glue", iq->pside_glue);
+					iter_store_parentside_rrset(qstate->env,
+						iq->pside_glue);
+				}
 		}
 
 		/* Reset the event state, setting the current delegation 
 		 * point to the referral. */
 		iq->deleg_msg = iq->response;
 		iq->dp = delegpt_from_message(iq->response, qstate->region);
+		if (qstate->env->cfg->qname_minimisation)
+			iq->minimisation_state = INIT_MINIMISE_STATE;
 		if(!iq->dp)
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
@@ -2273,13 +2452,16 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* NOTE : set referral=1, so that rrsets get stored but not 
 		 * the partial query answer (CNAME only). */
 		/* prefetchleeway applied because this updates answer parts */
-		iter_dns_store(qstate->env, &iq->response->qinfo,
-			iq->response->rep, 1, qstate->prefetch_leeway,
-			iq->dp&&iq->dp->has_parent_side_NS, NULL,
-			qstate->query_flags);
+		if(!qstate->no_cache_store)
+			iter_dns_store(qstate->env, &iq->response->qinfo,
+				iq->response->rep, 1, qstate->prefetch_leeway,
+				iq->dp&&iq->dp->has_parent_side_NS, NULL,
+				qstate->query_flags);
 		/* set the current request's qname to the new value. */
 		iq->qchase.qname = sname;
 		iq->qchase.qname_len = snamelen;
+		if (qstate->env->cfg->qname_minimisation)
+			iq->minimisation_state = INIT_MINIMISE_STATE;
 		/* Clear the query state, since this is a query restart. */
 		iq->deleg_msg = NULL;
 		iq->dp = NULL;
@@ -2353,6 +2535,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* LAME, THROWAWAY and "unknown" all end up here.
 	 * Recycle to the QUERYTARGETS state to hopefully try a 
 	 * different target. */
+	if (qstate->env->cfg->qname_minimisation &&
+		!qstate->env->cfg->qname_minimisation_strict)
+		iq->minimisation_state = DONOT_MINIMISE_STATE;
 	return next_state(iq, QUERYTARGETS_STATE);
 }
 
@@ -2485,6 +2670,10 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	log_query_info(VERB_ALGO, "processTargetResponse", &qstate->qinfo);
 	log_query_info(VERB_ALGO, "processTargetResponse super", &forq->qinfo);
 
+	/* Tell the originating event that this target query has finished
+	 * (regardless if it succeeded or not). */
+	foriq->num_target_queries--;
+
 	/* check to see if parent event is still interested (in orig name).  */
 	if(!foriq->dp) {
 		verbose(VERB_ALGO, "subq: parent not interested, was reset");
@@ -2500,10 +2689,6 @@ processTargetResponse(struct module_qstate* qstate, int id,
 		return;
 	}
 
-	/* Tell the originating event that this target query has finished
-	 * (regardless if it succeeded or not). */
-	foriq->num_target_queries--;
-
 	/* if iq->query_for_pside_glue then add the pside_glue (marked lame) */
 	if(iq->pside_glue) {
 		/* if the pside_glue is NULL, then it could not be found,
@@ -2751,10 +2936,11 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		&qstate->qinfo);
 
 	/* store negative cache element for parent side glue. */
-	if(iq->query_for_pside_glue && !iq->pside_glue)
-		iter_store_parentside_neg(qstate->env, &qstate->qinfo,
-			iq->deleg_msg?iq->deleg_msg->rep:
-			(iq->response?iq->response->rep:NULL));
+	if(!qstate->no_cache_store && iq->query_for_pside_glue
+		&& !iq->pside_glue)
+			iter_store_parentside_neg(qstate->env, &qstate->qinfo,
+				iq->deleg_msg?iq->deleg_msg->rep:
+				(iq->response?iq->response->rep:NULL));
 	if(!iq->response) {
 		verbose(VERB_ALGO, "No response is set, servfail");
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -2790,7 +2976,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* store message with the finished prepended items,
 		 * but only if we did recursion. The nonrecursion referral
 		 * from cache does not need to be stored in the msg cache. */
-		if(qstate->query_flags&BIT_RD) {
+		if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) {
 			iter_dns_store(qstate->env, &qstate->qinfo, 
 				iq->response->rep, 0, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS,
@@ -2962,13 +3148,26 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 		goto handle_it;
 	}
 	/* edns is not examined, but removed from message to help cache */
-	if(parse_extract_edns(prs, &edns) != LDNS_RCODE_NOERROR)
+	if(parse_extract_edns(prs, &edns, qstate->env->scratch) !=
+		LDNS_RCODE_NOERROR)
 		goto handle_it;
+
+	/* Copy the edns options we may got from the back end */
+	if(edns.opt_list) {
+		qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list,
+			qstate->region);
+		if(!qstate->edns_opts_back_in) {
+			log_err("out of memory on incoming message");
+			/* like packet got dropped */
+			goto handle_it;
+		}
+	}
+
 	/* remove CD-bit, we asked for in case we handle validation ourself */
 	prs->flags &= ~BIT_CD;
 
 	/* normalize and sanitize: easy to delete items from linked lists */
-	if(!scrub_message(pkt, prs, &iq->qchase, iq->dp->name, 
+	if(!scrub_message(pkt, prs, &iq->qinfo_out, iq->dp->name, 
 		qstate->env->scratch, qstate->env, ie)) {
 		/* if 0x20 enabled, start fallback, but we have no message */
 		if(event == module_event_capsfail && !iq->caps_fallback) {

iterator/iterator.h

@@ -61,6 +61,23 @@ struct rbtree_t;
 #define MAX_REFERRAL_COUNT	130
 /** max number of queries-sent-out.  Make sure large NS set does not loop */
 #define MAX_SENT_COUNT		32
+/** max number of queries for which to perform dnsseclameness detection,
+ * (rrsigs misssing detection) after that, just pick up that response */
+#define DNSSEC_LAME_DETECT_COUNT 4
+/**
+ * max number of QNAME minimisation iterations. Limits number of queries for
+ * QNAMEs with a lot of labels.
+*/
+#define MAX_MINIMISE_COUNT	10
+/* max number of time-outs for minimised query. Prevents resolving failures
+ * when the QNAME minimisation QTYPE is blocked. */
+#define MAX_MINIMISE_TIMEOUT_COUNT 3
+/**
+ * number of labels from QNAME that are always send individually when using
+ * QNAME minimisation, even when the number of labels of the QNAME is bigger
+ * tham MAX_MINIMISE_COUNT */
+#define MINIMISE_ONE_LAB	4
+#define MINIMISE_MULTIPLE_LABS	(MAX_MINIMISE_COUNT - MINIMISE_ONE_LAB)
 /** at what query-sent-count to stop target fetch policy */
 #define TARGET_FETCH_STOP	3
 /** how nice is a server without further information, in msec 
@@ -112,6 +129,32 @@ struct iter_env {
 	 * array of max_dependency_depth+1 size.
 	 */
 	int* target_fetch_policy;
+
+	/** ip6.arpa dname in wireformat, used for qname-minimisation */
+	uint8_t* ip6arpa_dname;
+};
+
+/**
+ * QNAME minimisation state
+ */
+enum minimisation_state {
+	/**
+	 * (Re)start minimisation. Outgoing QNAME should be set to dp->name.
+	 * State entered on new query or after following refferal or CNAME.
+	 */
+	INIT_MINIMISE_STATE = 0,
+	/**
+	 * QNAME minimisataion ongoing. Increase QNAME on every iteration.
+	 */
+	MINIMISE_STATE,
+	/**
+	 * Don't increment QNAME this iteration
+	 */
+	SKIP_MINIMISE_STATE,
+	/**
+	 * Send out full QNAME + original QTYPE
+	 */
+	DONOT_MINIMISE_STATE,
 };
 
 /**
@@ -322,6 +365,26 @@ struct iter_qstate {
 
 	/** list of pending queries to authoritative servers. */
 	struct outbound_list outlist;
+
+	/** QNAME minimisation state, RFC7816 */
+	enum minimisation_state minimisation_state;
+
+	/**
+	 * The query info that is sent upstream. Will be a subset of qchase
+	 * when qname minimisation is enabled.
+	 */
+	struct query_info qinfo_out;
+
+	/**
+	 * Count number of QNAME minisation iterations. Used to limit number of
+	 * outgoing queries when QNAME minimisation is enabled.
+	 */
+	int minimise_count;
+
+	/**
+	 * Count number of time-outs. Used to prevent resolving failures when
+	 * the QNAME minimisation QTYPE is blocked. */
+	int minimise_timeout_count;
 };
 
 /**

libunbound/context.c

@@ -62,6 +62,7 @@ context_finalize(struct ub_ctx* ctx)
 	config_apply(cfg);
 	if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
 		return UB_INITFAIL;
+	log_edns_known_options(VERB_ALGO, ctx->env);
 	ctx->local_zones = local_zones_create();
 	if(!ctx->local_zones)
 		return UB_NOMEM;

libunbound/context.h

@@ -49,7 +49,7 @@
 struct libworker;
 struct tube;
 struct sldns_buffer;
-struct event_base;
+struct ub_event_base;
 
 /**
  * The context structure
@@ -114,7 +114,7 @@ struct ub_ctx {
 	struct ub_randstate* seed_rnd;
 
 	/** event base for event oriented interface */
-	struct event_base* event_base;
+	struct ub_event_base* event_base;
 	/** libworker for event based interface */
 	struct libworker* event_worker;
 

libunbound/libunbound.c

@@ -57,6 +57,7 @@
 #include "util/random.h"
 #include "util/net_help.h"
 #include "util/tube.h"
+#include "util/ub_event.h"
 #include "services/modstack.h"
 #include "services/localzone.h"
 #include "services/cache/infra.h"
@@ -68,6 +69,9 @@
 #ifdef HAVE_SYS_WAIT_H
 #include <sys/wait.h>
 #endif
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
 
 #if defined(UB_ON_WINDOWS) && defined (HAVE_WINDOWS_H)
 #include <windows.h>
@@ -128,6 +132,15 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)
 		errno = ENOMEM;
 		return NULL;
 	}
+	/* init edns_known_options */
+	if(!edns_known_options_init(ctx->env)) {
+		config_delete(ctx->env->cfg);
+		free(ctx->env);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = ENOMEM;
+		return NULL;
+	}
 	ctx->env->alloc = &ctx->superalloc;
 	ctx->env->worker = NULL;
 	ctx->env->need_to_validate = 0;
@@ -147,6 +160,7 @@ ub_ctx_create(void)
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
 		modstack_desetup(&ctx->mods, ctx->env);
+		edns_known_options_delete(ctx->env);
 		free(ctx->env);
 		free(ctx);
 		errno = e;
@@ -158,6 +172,7 @@ ub_ctx_create(void)
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
 		modstack_desetup(&ctx->mods, ctx->env);
+		edns_known_options_delete(ctx->env);
 		free(ctx->env);
 		free(ctx);
 		errno = e;
@@ -166,6 +181,20 @@ ub_ctx_create(void)
 	return ctx;
 }
 
+struct ub_ctx* 
+ub_ctx_create_ub_event(struct ub_event_base* ueb)
+{
+	struct ub_ctx* ctx = ub_ctx_create_nopipe();
+	if(!ctx)
+		return NULL;
+	/* no pipes, but we have the locks to make sure everything works */
+	ctx->created_bg = 0;
+	ctx->dothread = 1; /* the processing is in the same process,
+		makes ub_cancel and ub_ctx_delete do the right thing */
+	ctx->event_base = ueb;
+	return ctx;
+}
+
 struct ub_ctx* 
 ub_ctx_create_event(struct event_base* eb)
 {
@@ -176,7 +205,11 @@ ub_ctx_create_event(struct event_base* eb)
 	ctx->created_bg = 0;
 	ctx->dothread = 1; /* the processing is in the same process,
 		makes ub_cancel and ub_ctx_delete do the right thing */
-	ctx->event_base = eb;
+	ctx->event_base = ub_libevent_event_base(eb);
+	if (!ctx->event_base) {
+		ub_ctx_delete(ctx);
+		return NULL;
+	}
 	return ctx;
 }
 	
@@ -276,6 +309,8 @@ ub_ctx_delete(struct ub_ctx* ctx)
 		rrset_cache_delete(ctx->env->rrset_cache);
 		infra_delete(ctx->env->infra_cache);
 		config_delete(ctx->env->cfg);
+		edns_known_options_delete(ctx->env);
+		inplace_cb_lists_delete(ctx->env);
 		free(ctx->env);
 	}
 	ub_randfree(ctx->seed_rnd);
@@ -695,6 +730,9 @@ ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 		}
 	}
 
+	/* set time in case answer comes from cache */
+	ub_comm_base_now(ctx->event_worker->base);
+
 	/* create new ctx_query and attempt to add to the list */
 	q = context_new(ctx, name, rrtype, rrclass, (ub_callback_t)callback,
 		mydata);
@@ -921,6 +959,88 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 	return UB_NOERROR;
 }
 
+int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr,
+	int isprime)
+{
+	char* a;
+	struct config_stub **prev, *elem;
+
+	/* check syntax for zone name */
+	if(zone) {
+		uint8_t* nm;
+		int nmlabs;
+		size_t nmlen;
+		if(!parse_dname(zone, &nm, &nmlen, &nmlabs)) {
+			errno=EINVAL;
+			return UB_SYNTAX;
+		}
+		free(nm);
+	} else {
+		zone = ".";
+	}
+
+	/* check syntax for addr (if not NULL) */
+	if(addr) {
+		struct sockaddr_storage storage;
+		socklen_t stlen;
+		if(!extstrtoaddr(addr, &storage, &stlen)) {
+			errno=EINVAL;
+			return UB_SYNTAX;
+		}
+	}
+
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno=EINVAL;
+		return UB_AFTERFINAL;
+	}
+
+	/* arguments all right, now find or add the stub */
+	prev = &ctx->env->cfg->stubs;
+	elem = cfg_stub_find(&prev, zone);
+	if(!elem && !addr) {
+		/* not found and we want to delete, nothing to do */
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOERROR;
+	} else if(elem && !addr) {
+		/* found, and we want to delete */
+		*prev = elem->next;
+		config_delstub(elem);
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOERROR;
+	} else if(!elem) {
+		/* not found, create the stub entry */
+		elem=(struct config_stub*)calloc(1, sizeof(struct config_stub));
+		if(elem) elem->name = strdup(zone);
+		if(!elem || !elem->name) {
+			free(elem);
+			lock_basic_unlock(&ctx->cfglock);
+			errno = ENOMEM;
+			return UB_NOMEM;
+		}
+		elem->next = ctx->env->cfg->stubs;
+		ctx->env->cfg->stubs = elem;
+	}
+
+	/* add the address to the list and set settings */
+	elem->isprime = isprime;
+	a = strdup(addr);
+	if(!a) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno = ENOMEM;
+		return UB_NOMEM;
+	}
+	if(!cfg_strlist_insert(&elem->addrs, a)) {
+		lock_basic_unlock(&ctx->cfglock);
+		free(a);
+		errno = ENOMEM;
+		return UB_NOMEM;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
 int 
 ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
 {
@@ -1238,10 +1358,12 @@ const char* ub_version(void)
 
 int 
 ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base) {
+	struct ub_event_base* new_base;
+
 	if (!ctx || !ctx->event_base || !base) {
 		return UB_INITFAIL;
 	}
-	if (ctx->event_base == base) {
+	if (ub_libevent_get_event_base(ctx->event_base) == base) {
 		/* already set */
 		return UB_NOERROR;
 	}
@@ -1250,9 +1372,11 @@ ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base) {
 	/* destroy the current worker - safe to pass in NULL */
 	libworker_delete_event(ctx->event_worker);
 	ctx->event_worker = NULL;
-	ctx->event_base = base;	
+	new_base = ub_libevent_event_base(base);
+	if (new_base)
+		ctx->event_base = new_base;	
 	ctx->created_bg = 0;
 	ctx->dothread = 1;
 	lock_basic_unlock(&ctx->cfglock);
-	return UB_NOERROR;
+	return new_base ? UB_NOERROR : UB_INITFAIL;
 }

libunbound/libworker.c

@@ -119,7 +119,7 @@ libworker_delete_event(struct libworker* w)
 
 /** setup fresh libworker struct */
 static struct libworker*
-libworker_setup(struct ub_ctx* ctx, int is_bg, struct event_base* eb)
+libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 {
 	unsigned int seed;
 	struct libworker* w = (struct libworker*)calloc(1, sizeof(*w));
@@ -232,6 +232,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct event_base* eb)
 		cfg->do_tcp?cfg->outgoing_num_tcp:0,
 		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
 		ports, numports, cfg->unwanted_threshold,
+		cfg->outgoing_tcp_mss,
 		&libworker_alloc_cleanup, w, cfg->do_udp, w->sslctx,
 		cfg->delay_close, NULL);
 	if(!w->is_bg || w->is_bg_thread) {
@@ -257,7 +258,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct event_base* eb)
 }
 
 struct libworker* libworker_create_event(struct ub_ctx* ctx,
-	struct event_base* eb)
+	struct ub_event_base* eb)
 {
 	return libworker_setup(ctx, 0, eb);
 }
@@ -572,14 +573,17 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 {
 	qinfo->qtype = (uint16_t)q->res->qtype;
 	qinfo->qclass = (uint16_t)q->res->qclass;
+	qinfo->local_alias = NULL;
 	qinfo->qname = sldns_str2wire_dname(q->res->qname, &qinfo->qname_len);
 	if(!qinfo->qname) {
 		return 0;
 	}
+	qinfo->local_alias = NULL;
 	edns->edns_present = 1;
 	edns->ext_rcode = 0;
 	edns->edns_version = 0;
 	edns->bits = EDNS_DO;
+	edns->opt_list = NULL;
 	if(sldns_buffer_capacity(w->back->udp_buff) < 65535)
 		edns->udp_size = (uint16_t)sldns_buffer_capacity(
 			w->back->udp_buff);
@@ -605,8 +609,9 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 	/* see if there is a fixed answer */
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch, NULL)) {
+	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns, 
+		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
+		NULL, 0, NULL, 0, NULL)) {
 		regional_free_all(w->env->scratch);
 		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
 			w->back->udp_buff, sec_status_insecure, NULL);
@@ -675,8 +680,9 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 	/* see if there is a fixed answer */
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch, NULL)) {
+	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns, 
+		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
+		NULL, 0, NULL, 0, NULL)) {
 		regional_free_all(w->env->scratch);
 		free(qinfo.qname);
 		libworker_event_done_cb(q, LDNS_RCODE_NOERROR,
@@ -795,8 +801,9 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	/* see if there is a fixed answer */
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(w->ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch, NULL)) {
+	if(local_zones_answer(w->ctx->local_zones, w->env, &qinfo, &edns, 
+		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
+		NULL, 0, NULL, 0, NULL)) {
 		regional_free_all(w->env->scratch);
 		q->msg_security = sec_status_insecure;
 		add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL);
@@ -819,11 +826,10 @@ void libworker_alloc_cleanup(void* arg)
         slabhash_clear(w->env->msg_cache);
 }
 
-struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
-        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
-	socklen_t addrlen, uint8_t* zone, size_t zonelen,
-	struct module_qstate* q)
+struct outbound_entry* libworker_send_query(struct query_info* qinfo,
+	uint16_t flags, int dnssec, int want_dnssec, int nocaps,
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
+	size_t zonelen, int ssl_upstream, struct module_qstate* q)
 {
 	struct libworker* w = (struct libworker*)q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -831,11 +837,10 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 	if(!e)
 		return NULL;
 	e->qstate = q;
-	e->qsent = outnet_serviced_query(w->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, want_dnssec, nocaps,
-		q->env->cfg->tcp_upstream, q->env->cfg->ssl_upstream, addr,
-		addrlen, zone, zonelen, libworker_handle_service_reply, e,
-		w->back->udp_buff);
+	e->qsent = outnet_serviced_query(w->back, qinfo, flags, dnssec,
+		want_dnssec, nocaps, q->env->cfg->tcp_upstream, ssl_upstream,
+		addr, addrlen, zone, zonelen, q, libworker_handle_service_reply,
+		e, w->back->udp_buff, q->env);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -950,13 +955,12 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 	log_assert(0);
 }
 
-struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
-	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
-	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
-	int ATTR_UNUSED(nocaps), struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
-	size_t ATTR_UNUSED(zonelen), struct module_qstate* ATTR_UNUSED(q))
+struct outbound_entry* worker_send_query(struct query_info* ATTR_UNUSED(qinfo),
+	uint16_t ATTR_UNUSED(flags), int ATTR_UNUSED(dnssec),
+	int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps),
+	struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen),
+	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen),
+	int ATTR_UNUSED(ssl_upstream), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;

libunbound/libworker.h

@@ -1,5 +1,5 @@
 /*
- * libunbound/worker.h - worker thread or process that resolves
+ * libunbound/libworker.h - worker thread or process that resolves
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
@@ -58,7 +58,8 @@ struct comm_reply;
 struct regional;
 struct tube;
 struct sldns_buffer;
-struct event_base;
+struct ub_event_base;
+struct query_info;
 
 /** 
  * The library-worker status structure
@@ -115,7 +116,7 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q);
  * @return new worker or NULL.
  */
 struct libworker* libworker_create_event(struct ub_ctx* ctx,
-	struct event_base* eb);
+	struct ub_event_base* eb);
 
 /**
  * Attach context_query to mesh for callback in event-driven setup.

libunbound/python/Makefile

@@ -36,7 +36,7 @@
 help:
 	@echo "Please use \`make <target>' where <target> is one of"
 	@echo "  testenv   to make test environment and run bash "
-	@echo "            usefull in case you don't want to install unbound but want to test examples"
+	@echo "            useful in case you don't want to install unbound but want to test examples"
 	@echo "  doc       to make documentation"
 	@echo "  clean     clean all"
 

libunbound/python/doc/conf.py

@@ -82,10 +82,13 @@ pygments_style = 'sphinx'
 # Options for HTML output
 # -----------------------
 
+# The theme that the html output should use.
+html_theme = "classic"
+
 # The style sheet to use for HTML and HTML Help pages. A file of that name
 # must exist either in Sphinx' static/ path, or in one of the custom paths
 # given in html_static_path.
-html_style = 'default.css'
+#html_style = 'default.css'
 
 # The name for this set of Sphinx documents.  If None, it defaults to
 # "<project> v<release> documentation".

libunbound/python/doc/examples/example1a.rst

@@ -1,26 +1,33 @@
 .. _example_resolve_name:
 
-==============================
 Resolve a name
-==============================
+==============
 
-This basic example shows how to create a context and resolve a host address (DNS record of A type).
+This basic example shows how to create a context and resolve a host address
+(DNS record of A type).
+
+Source code
+-----------
 
 ::
 
-	#!/usr/bin/python
-	import unbound
-	
-	ctx = unbound.ub_ctx()
-	ctx.resolvconf("/etc/resolv.conf")
-	
-	status, result = ctx.resolve("www.google.com")
-	if status == 0 and result.havedata:
-		print "Result.data:", result.data.address_list
-	elif status != 0:
-		print "Resolve error:", unbound.ub_strerror(status)
+    #!/usr/bin/python
+    import unbound
 
-In contrast with C API, the source code is more compact while the performance of C implementation is preserved. 
-The main advantage is that you need not take care about the deallocation and allocation of context and result structures; pyUnbound module do it automatically for you. 
+    ctx = unbound.ub_ctx()
+    ctx.resolvconf("/etc/resolv.conf")
 
-If only domain name is given, the :meth:`unbound.ub_ctx.resolve` looks for A records in IN class.
+    status, result = ctx.resolve("www.google.com")
+    if status == 0 and result.havedata:
+        print "Result.data:", result.data.address_list
+    elif status != 0:
+        print "Resolve error:", unbound.ub_strerror(status)
+
+In contrast with the C API, the source code is more compact while the
+performance of C implementation is preserved. 
+The main advantage is that you need not take care about the deallocation and
+allocation of context and result structures; pyUnbound module does it
+automatically for you. 
+
+If only domain name is given, the :meth:`unbound.ub_ctx.resolve` looks for
+A records in IN class.

libunbound/python/doc/examples/example1b.rst

@@ -1,33 +1,37 @@
 .. _example_reverse_lookup:
 
-==============================
 Reverse DNS lookup
-==============================
+==================
 
-Reverse DNS lookup involves determining the hostname associated with a given IP address.
+Reverse DNS lookup involves determining the hostname associated with a given IP
+address.
 This example shows how reverse lookup can be done using unbound module.
 
 For the reverse DNS records, the special domain in-addr.arpa is reserved. 
-For example, a host name for the IP address 74.125.43.147 can be obtained by issuing a DNS query for the PTR record for address 147.43.125.74.in-addr.arpa.
+For example, a host name for the IP address ``74.125.43.147`` can be obtained
+by issuing a DNS query for the PTR record for address
+``147.43.125.74.in-addr.arpa.``
+
+Source code
+-----------
 
 ::
 
-	#!/usr/bin/python
-	import unbound
-	
-	ctx = unbound.ub_ctx()
-	ctx.resolvconf("/etc/resolv.conf")
-	
-	status, result = ctx.resolve(unbound.reverse("74.125.43.147") + ".in-addr.arpa.", unbound.RR_TYPE_PTR, unbound.RR_CLASS_IN)
-	if status == 0 and result.havedata:
-		print "Result.data:", result.data.domain_list
-	elif status != 0:
-		print "Resolve error:", unbound.ub_strerror(status)
+    #!/usr/bin/python
+    import unbound
 
-In order to simplify the python code, unbound module contains function which reverses the hostname components. 
+    ctx = unbound.ub_ctx()
+    ctx.resolvconf("/etc/resolv.conf")
+
+    status, result = ctx.resolve(unbound.reverse("74.125.43.147") + ".in-addr.arpa.", unbound.RR_TYPE_PTR, unbound.RR_CLASS_IN)
+    if status == 0 and result.havedata:
+        print "Result.data:", result.data.domain_list
+    elif status != 0:
+        print "Resolve error:", unbound.ub_strerror(status)
+
+In order to simplify the python code, unbound module contains the
+:meth:`unbound.reverse` function which reverses the hostname components.
 This function is defined as follows::
 
-	def reverse(domain):
-		return '.'.join([a for a in domain.split(".")][::-1])
-
-
+    def reverse(domain):
+        return '.'.join([a for a in domain.split(".")][::-1])

libunbound/python/doc/examples/example2.rst

@@ -1,41 +1,41 @@
 .. _example_setup_ctx:
 
-==============================
 Lookup from threads
-==============================
+===================
 
-This example shows how to use unbound module from a threaded program. 
-In this example, three lookup threads are created which work in background. 
-Each thread resolves different DNS record. 
+This example shows how to use unbound module from a threaded program.
+In this example, three lookup threads are created which work in background.
+Each thread resolves different DNS record.
+
+Source code
+-----------
 
 ::
 
-	#!/usr/bin/python
-	from unbound import ub_ctx, RR_TYPE_A, RR_CLASS_IN
-	from threading import Thread
-	
-	ctx = ub_ctx()
-	ctx.resolvconf("/etc/resolv.conf")
-	
-	class LookupThread(Thread):
-		def __init__(self,ctx, name):
-			Thread.__init__(self)
-			self.ctx = ctx
-			self.name = name
+    #!/usr/bin/python
+    from unbound import ub_ctx, RR_TYPE_A, RR_CLASS_IN
+    from threading import Thread
 
-		def run(self):
-			print "Thread lookup started:",self.name
-			status, result = self.ctx.resolve(self.name, RR_TYPE_A, RR_CLASS_IN)
-			if status == 0 and result.havedata:
-				print "  Result:",self.name,":", result.data.address_list
-	
-	threads = []
-	for name in ["www.fit.vutbr.cz","www.vutbr.cz","www.google.com"]:
-		thread = LookupThread(ctx, name)
-		thread.start()
-		threads.append(thread)
-	    
-	for thread in threads:
-		thread.join()
+    ctx = ub_ctx()
+    ctx.resolvconf("/etc/resolv.conf")
 
+    class LookupThread(Thread):
+        def __init__(self,ctx, name):
+            Thread.__init__(self)
+            self.ctx = ctx
+            self.name = name
 
+        def run(self):
+            print "Thread lookup started:",self.name
+            status, result = self.ctx.resolve(self.name, RR_TYPE_A, RR_CLASS_IN)
+            if status == 0 and result.havedata:
+                print "  Result:",self.name,":", result.data.address_list
+
+    threads = []
+    for name in ["www.fit.vutbr.cz","www.vutbr.cz","www.google.com"]:
+        thread = LookupThread(ctx, name)
+        thread.start()
+        threads.append(thread)
+
+    for thread in threads:
+        thread.join()

libunbound/python/doc/examples/example3.rst

@@ -1,12 +1,14 @@
 .. _example_asynch:
 
-==============================
 Asynchronous lookup
-==============================
+===================
 
 This example performs the name lookup in the background. 
 The main program keeps running while the name is resolved. 
 
+Source code
+-----------
+
 ::
 
 	#!/usr/bin/python
@@ -33,4 +35,5 @@ The main program keeps running while the name is resolved.
 	if (status != 0):
 		print "Resolve error:", unbound.ub_strerror(status)
 
-The :meth:`unbound.ub_ctx.resolve_async` method is able to pass on any Python object. In this example, we used a dictionary object `my_data`.
+The :meth:`unbound.ub_ctx.resolve_async` method is able to pass on any Python
+object. In this example, we used a dictionary object ``my_data``.

libunbound/python/doc/examples/example4.rst

@@ -1,33 +1,35 @@
 .. _example_examine:
 
-==============================
 DNSSEC validator
-==============================
+================
 
 This example program performs DNSSEC validation of a DNS lookup.
 
+Source code
+-----------
+
 ::
 
-	#!/usr/bin/python
-	import os
-	from unbound import ub_ctx,RR_TYPE_A,RR_CLASS_IN
-	
-	ctx = ub_ctx()
-	ctx.resolvconf("/etc/resolv.conf")
-	if (os.path.isfile("keys")):
-		ctx.add_ta_file("keys") #read public keys for DNSSEC verification
-	
-	status, result = ctx.resolve("www.nic.cz", RR_TYPE_A, RR_CLASS_IN)
-	if status == 0 and result.havedata:
-	
-	    print "Result:", result.data.address_list
-	
-	    if result.secure:
-	        print "Result is secure"
-	    elif result.bogus:
-	        print "Result is bogus"
-	    else:
-	        print "Result is insecure"
+    #!/usr/bin/python
+    import os
+    from unbound import ub_ctx,RR_TYPE_A,RR_CLASS_IN
+
+    ctx = ub_ctx()
+    ctx.resolvconf("/etc/resolv.conf")
+    if (os.path.isfile("keys")):
+        ctx.add_ta_file("keys") #read public keys for DNSSEC verification
+
+    status, result = ctx.resolve("www.nic.cz", RR_TYPE_A, RR_CLASS_IN)
+    if status == 0 and result.havedata:
+
+        print "Result:", result.data.address_list
+
+        if result.secure:
+            print "Result is secure"
+        elif result.bogus:
+            print "Result is bogus"
+        else:
+            print "Result is insecure"
 
 More detailed informations can be seen in libUnbound DNSSEC tutorial `here`_.
 

libunbound/python/doc/examples/example5.rst

@@ -1,13 +1,17 @@
 .. _example_resolver_only:
 
-==============================
 Resolver only
-==============================
+=============
 
 This example program shows how to perform DNS resolution only.
 Unbound contains two basic modules: resolver and validator.
-In case, the validator is not necessary, the validator module can be turned off using "module-config" option.
-This option contains a list of module names separated by the space char. This list determined which modules should be employed and in what order.
+In case, the validator is not necessary, the validator module can be turned off
+using "module-config" option.
+This option contains a list of module names separated by the space char. This
+list determined which modules should be employed and in what order.
+
+Source code
+-----------
 
 ::
 
@@ -25,5 +29,6 @@ This option contains a list of module names separated by the space char. This li
 	    print "Result:", result.data.address_list
 
 .. note::
-   The :meth:`unbound.ub_ctx.set_option` method must be used before the first resolution (i.e. before :meth:`unbound.ub_ctx.resolve` or :meth:`unbound.ub_ctx.resolve_async` call). 
-
+   The :meth:`unbound.ub_ctx.set_option` method must be used before the first
+   resolution (i.e. before :meth:`unbound.ub_ctx.resolve` or
+   :meth:`unbound.ub_ctx.resolve_async` call).

libunbound/python/doc/examples/example6.rst

@@ -1,11 +1,13 @@
 .. _example_localzone:
 
-==============================
 Local zone manipulation
-==============================
+=======================
 
-This example program shows how to define local zone containing custom DNS records.
+This example program shows how to define local zone containing custom DNS
+records.
 
-..	literalinclude:: example6-1.py
-	:language: python
+Source code
+-----------
 
+.. literalinclude:: example6-1.py
+    :language: python

libunbound/python/doc/examples/example7.rst

@@ -1,18 +1,33 @@
 .. _example_idna:
 
-=================================================
 Internationalized domain name support
-=================================================
+=====================================
 
 Unlike the libUnbound, pyUnbound is able to handle IDN queries.
 
-..	literalinclude:: example7-1.py
-	:language: python
+Automatic IDN DNAME conversion
+-------------------------------
 
-If we use unicode string in :meth:`unbound.ub_ctx.resolve` method, the IDN DNAME conversion (if it is necessary) is performed on background.
+If we use unicode string in :meth:`unbound.ub_ctx.resolve` method,
+the IDN DNAME conversion (if it is necessary) is performed on background.
 
-..	literalinclude:: example7-2.py
-	:language: python
+Source code
+...........
 
-The :class:`unbound.ub_data` class contains attributes suffix which converts the dname to UTF string. These attributes have the '_idn' suffix.
-Apart from this aproach, two conversion functions exist (:func:`unbound.idn2dname` and :func:`unbound.dname2idn`).
+.. literalinclude:: example7-1.py
+    :language: python
+
+IDN converted attributes
+------------------------
+
+The :class:`unbound.ub_data` class contains attributes suffix which converts
+the dname to UTF string. These attributes have the ``_idn`` suffix.
+
+Apart from this aproach, two conversion functions exist
+(:func:`unbound.idn2dname` and :func:`unbound.dname2idn`).
+
+Source code
+...........
+
+.. literalinclude:: example7-2.py
+    :language: python

libunbound/python/doc/examples/example8.rst

@@ -1,28 +1,34 @@
 .. _example_mxlookup:
 
-=================================================
 Lookup for MX and NS records
-=================================================
+============================
 
-The pyUnbound extension provides functions which are able to encode RAW RDATA produces by unbound resolver (see :class:`unbound.ub_data`).
+The pyUnbound extension provides functions which are able to encode RAW RDATA
+produces by unbound resolver (see :class:`unbound.ub_data`).
 
-..	literalinclude:: example8-1.py
-	:language: python
+Source code
+-----------
 
-Previous example produces following output::
+.. literalinclude:: example8-1.py
+    :language: python
 
-	Result:
-		raw data: 00 0F 05 6D 61 69 6C 34 03 6E 69 63 02 63 7A 00;00 14 02 6D 78 05 63 7A 6E 69 63 03 6F 72 67 00;00 0A 04 6D 61 69 6C 03 6E 69 63 02 63 7A 00
-		priority:15 address: mail4.nic.cz.
-		priority:20 address: mx.cznic.org.
-		priority:10 address: mail.nic.cz.
+Output
+------
 
-	Result:
-		raw data: D9 1F CD 32
-		address: 217.31.205.50
+The previous example produces the following output::
 
-	Result:
-		raw data: 01 61 02 6E 73 03 6E 69 63 02 63 7A 00;01 65 02 6E 73 03 6E 69 63 02 63 7A 00;01 63 02 6E 73 03 6E 69 63 02 63 7A 00
-		host: a.ns.nic.cz.
-		host: e.ns.nic.cz.
-		host: c.ns.nic.cz.
+    Result:
+        raw data: 00 0F 05 6D 61 69 6C 34 03 6E 69 63 02 63 7A 00;00 14 02 6D 78 05 63 7A 6E 69 63 03 6F 72 67 00;00 0A 04 6D 61 69 6C 03 6E 69 63 02 63 7A 00
+        priority:15 address: mail4.nic.cz.
+        priority:20 address: mx.cznic.org.
+        priority:10 address: mail.nic.cz.
+
+    Result:
+        raw data: D9 1F CD 32
+        address: 217.31.205.50
+
+    Result:
+        raw data: 01 61 02 6E 73 03 6E 69 63 02 63 7A 00;01 65 02 6E 73 03 6E 69 63 02 63 7A 00;01 63 02 6E 73 03 6E 69 63 02 63 7A 00
+        host: a.ns.nic.cz.
+        host: e.ns.nic.cz.
+        host: c.ns.nic.cz.

libunbound/python/doc/examples/index.rst

@@ -1,14 +1,16 @@
 Examples
-==============================
+========
 
-Here you can find several examples which utilizes the unbound library in Python environment. 
-Unbound is a caching validator and resolver and can be linked into an application, as a library where can answer DNS queries for the application. 
+Here you can find several examples which utilizes the unbound library in Python
+environment. Unbound is a caching validator and resolver and can be linked into
+an application, as a library where can answer DNS queries for the application.
 This set of examples shows how to use the functions from Python environment.
 
-`Tutorials`
+Tutorials
+---------
 
 .. toctree::
-	:maxdepth: 1
-	:glob:
+    :maxdepth: 1
+    :glob:
 
-	example*
+    example*

libunbound/python/doc/install.rst

@@ -1,31 +1,38 @@
 Installation
-===================================
+============
 
-**Prerequisites**
+Prerequisites
+-------------
 
 Python 2.4 or higher, SWIG 1.3 or higher, GNU make
 
-**Compiling**
+Compiling
+---------
 
 After downloading, you can compile the pyUnbound library by doing::
 
-	> tar -xzf unbound-x.x.x-py.tar.gz
-	> cd unbound-x.x.x
-	> ./configure --with-pyunbound
-	> make
+    > tar -xzf unbound-x.x.x-py.tar.gz
+    > cd unbound-x.x.x
+    > ./configure --with-pyunbound
+    > make
 
-You may want to --with-pythonmodule as well if you want to use python as
-a module in the resolver.
+You may want to enable ``--with-pythonmodule`` as well if you want to use
+python as a module in the resolver.
 
-You need GNU make to compile sources; SWIG and Python devel libraries to compile extension module. 
+You need ``GNU make`` to compile sources; ``SWIG`` and ``Python devel``
+libraries to compile extension module. 
 
 
-**Testing**
+Testing
+-------
 
-If the compilation is successfull, you can test the python LDNS extension module by::
+If the compilation is successful, you can test the python LDNS extension module
+by::
 
-	> cd contrib/python
-	> make testenv
-	> ./dns-lookup.py
+    > cd contrib/python
+    > make testenv
+    > ./dns-lookup.py
 
-You may want to make install in the main directory since make testenv is for debugging.  In contrib/examples you can find simple applications written in Python using the Unbound extension.
+You may want to ``make install`` in the main directory since ``make testenv``
+is for debugging.  In contrib/examples you can find simple applications written
+in Python using the Unbound extension.

libunbound/python/doc/intro.rst

@@ -1,39 +1,58 @@
 Introduction
-===================================
+============
 
-**Unbound**
+Unbound
+-------
 
-	`Unbound`_  is  an implementation of a DNS resolver, that performs caching and DNSSEC validation.
-	Together with unbound, the libunbound library is provided.
-	This library can be used to convert hostnames to ip addresses, and back, as well as obtain other information. 
-	Since the resolver allows to specify the class and type of a query (A record, NS, MX, ...), this library offers powerful resolving tool. 
-	The library also performs public-key validation of results with DNSSEC.
-	
-	.. _Unbound: http://www.unbound.net/documentation
+`Unbound`_  is  an implementation of a DNS resolver, that performs caching and
+DNSSEC validation.
+Together with unbound, the libunbound library is provided.
+This library can be used to convert hostnames to ip addresses, and back, as
+well as obtain other information.
+Since the resolver allows to specify the class and type of a query (A record,
+NS, MX, ...), this library offers powerful resolving tool.
+The library also performs public-key validation of results with DNSSEC.
 
-**pyUnbound**
+.. _Unbound: http://www.unbound.net/documentation
 
-	The pyUnbound is an extension module for Python which provides an object-oriented interface to libunbound. 
-	It is the first Python module which offers thread-safe caching resolver.
-	
-	The interface was designed with the emphasis on the simplicity of use.
-	There are two main classes :class:`unbound.ub_ctx` (a validation and resolution context) and :class:`unbound.ub_result` which contains the validation and resolution results.
-	The objects are thread-safe, and a context can be used in non-threaded as well as threaded environment. 
-	Resolution can be performed blocking and non-blocking (i.e. asynchronous).  
-	The asynchronous method returns from the call immediately, so that processing can go on, while the results become available later.
+pyUnbound
+---------
 
-**Features**
-	* customizable caching validation resolver for synchronous and asynchronous lookups
-	* easy to use object interface
-	* easy to integrate extension module
-	* designed for thread environment (i.e. thread-safe)
-	* allows define and customize of local zone and its RR's during the operation (i.e. without restart)
-	* includes encoding functions to simplify the results retrieval
-	* Internationalized domain name (`IDN`_) support
+The pyUnbound is an extension module for Python which provides an
+object-oriented interface to libunbound. 
+It is the first Python module which offers thread-safe caching resolver.
 
-	.. _IDN: http://en.wikipedia.org/wiki/Internationalized_domain_name
+The interface was designed with the emphasis on the simplicity of use.
+There are two main classes :class:`unbound.ub_ctx` (a validation and resolution
+context) and :class:`unbound.ub_result` which contains the validation and
+resolution results.
+The objects are thread-safe, and a context can be used in non-threaded as well
+as threaded environment.
+Resolution can be performed blocking and non-blocking (i.e. asynchronous).
+The asynchronous method returns from the call immediately, so that processing
+can go on, while the results become available later.
 
-**Application area**
-	* DNS-based applications performing DNS lookups; the caching resolver can reduce overhead
-	* Applications where the validation of DNS records is required
-	* Great solution for customizable and dynamic DNS-based white/blacklists (spam rejection, connection rejection, ...) using the dynamic local zone manipulation
+Features
+--------
+
+* Customizable caching validation resolver for synchronous and asynchronous
+  lookups
+* Easy to use object interface
+* Easy to integrate extension module
+* Designed for thread environment (i.e. thread-safe)
+* Allows define and customize of local zone and its RR's during the operation
+  (i.e. without restart)
+* Includes encoding functions to simplify the results retrieval
+* Internationalized domain name (`IDN`_) support
+
+.. _IDN: http://en.wikipedia.org/wiki/Internationalized_domain_name
+
+Application area
+----------------
+
+* DNS-based applications performing DNS lookups; the caching resolver can
+  reduce overhead
+* Applications where the validation of DNS records is required
+* Great solution for customizable and dynamic DNS-based white/blacklists (spam
+  rejection, connection rejection, ...) using the dynamic local zone
+  manipulation

libunbound/python/doc/modules/unbound.rst

@@ -42,7 +42,7 @@ Class ub_result
 	 	False, if validation failed or domain queried has no security info.
 	 
 	  	It is possible to get a result with no data (havedata is false),
-	  	and secure is true. This means that the non-existance of the data
+	  	and secure is true. This means that the non-existence of the data
 	  	was cryptographically proven (with signatures).
 
 	.. attribute:: bogus

libunbound/python/examples/dnssec-valid.py

@@ -44,7 +44,7 @@ ctx.debugout(fw)
 ctx.debuglevel(2)
 
 if os.path.isfile("keys"):
-    ctx.add_ta_file("keys") #read public keys for DNSSEC verificatio
+    ctx.add_ta_file("keys") #read public keys for DNSSEC verification
 
 status, result = ctx.resolve("www.nic.cz", RR_TYPE_A, RR_CLASS_IN)
 if status == 0 and result.havedata:

libunbound/python/libunbound.i

@@ -1,5 +1,5 @@
 /*
- * libounbound.i: pyUnbound module (libunbound wrapper for Python)
+ * libunbound.i: pyUnbound module (libunbound wrapper for Python)
  * 
  * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
  *                     Marek Vavrusa  (xvavru00 AT stud.fit.vutbr.cz)
@@ -455,7 +455,7 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
         #_UB_CTX_METHODS#   
         
         def zone_print(self):
-            """Print local zones using debougout"""            
+            """Print local zones using debugout"""            
             _unbound.ub_ctx_print_local_zones(self)
 
         def zone_add(self,zonename,zonetype):
@@ -945,7 +945,7 @@ int _ub_resolve_async(struct ub_ctx* ctx, char* name, int rrtype, int rrclass, v
            :param idnname: (unicode string) IDN name
            :returns: (string) domain name
         """
-        return '.'.join([encodings.idna.ToASCII(a) for a in idnname.split('.')])
+        return '.'.join([encodings.idna.ToASCII(a) if a else '' for a in idnname.split('.')])
 
     def dname2idn(name):
         """Converts canonic domain name in IDN format to unicode string

libunbound/ubsyms.def

@@ -1,33 +1,35 @@
-ub_ctx_create
-ub_ctx_create_event
-ub_ctx_delete
-ub_ctx_get_option
-ub_ctx_set_option
-ub_ctx_config
-ub_ctx_set_fwd
-ub_ctx_resolvconf
-ub_ctx_hosts
+ub_cancel
 ub_ctx_add_ta
 ub_ctx_add_ta_autr
 ub_ctx_add_ta_file
-ub_ctx_trustedkeys
-ub_ctx_debugout
-ub_ctx_debuglevel
 ub_ctx_async
-ub_poll
-ub_wait
+ub_ctx_config
+ub_ctx_create
+ub_ctx_create_event
+ub_ctx_create_ub_event
+ub_ctx_data_add
+ub_ctx_data_remove
+ub_ctx_debuglevel
+ub_ctx_debugout
+ub_ctx_delete
+ub_ctx_get_option
+ub_ctx_hosts
+ub_ctx_print_local_zones
+ub_ctx_resolvconf
+ub_ctx_set_event
+ub_ctx_set_fwd
+ub_ctx_set_option
+ub_ctx_set_stub
+ub_ctx_trustedkeys
+ub_ctx_zone_add
+ub_ctx_zone_remove
 ub_fd
+ub_poll
 ub_process
 ub_resolve
 ub_resolve_async
 ub_resolve_event
-ub_cancel
 ub_resolve_free
 ub_strerror
-ub_ctx_print_local_zones
-ub_ctx_zone_add
-ub_ctx_zone_remove
-ub_ctx_data_add
-ub_ctx_data_remove
 ub_version
-ub_ctx_set_event
+ub_wait

libunbound/unbound-event.h

@@ -36,20 +36,21 @@
 /**
  * \file
  *
- * This file contains the unbound interface for use with libevent.
- * You have to use the same libevent that unbound was compiled with,
- * otherwise it wouldn't work, the event and event_base structures would
- * be different.  If unbound is compiled without libevent support then
- * this header file is not supposed to be installed on the system.
+ * This file contains the unbound interface for use with user defined
+ * pluggable event bases.
  *
- * Use ub_ctx_create_event_base() to create an unbound context that uses
- * the event base that you have made.  Then, use the ub_resolve_event call
- * to add DNS resolve queries to the context.  Those then run when you
- * call event_dispatch() on your event_base, and when they are done you
- * get a function callback.
+ * Use ub_ctx_create_event_ub_base() to create an unbound context that uses
+ * the user provided event base API.  Then, use the ub_resolve_event call
+ * to add DNS resolve queries to the context.  Those then run whith the
+ * provided event_base, and when they are done you get a function callback.
  *
  * This method does not fork another process or create a thread, the effort
- * is done by the unbound state machines that are connected to the event_base.
+ * is done by the unbound state machines that are connected to the event base.
+ *
+ * It is also possible to provide a libevent based event base by using
+ * ub_ctx_create_event_base().  But you have to use the same libevent that
+ * unbound was compiled with, otherwise it wouldn't work, the event and
+ * event_base structures would be different.
  */
 #ifndef _UB_UNBOUND_EVENT_H
 #define _UB_UNBOUND_EVENT_H
@@ -62,12 +63,136 @@ struct ub_ctx;
 struct ub_result;
 struct event_base;
 
+/** event timeout */
+#define UB_EV_TIMEOUT      0x01
+/** event fd readable */
+#define UB_EV_READ         0x02
+/** event fd writable */
+#define UB_EV_WRITE        0x04
+/** event signal */
+#define UB_EV_SIGNAL       0x08
+/** event must persist */
+#define UB_EV_PERSIST      0x10
+
+/** magic number to identify this version of the pluggable event api */
+#define UB_EVENT_MAGIC     0x44d74d78
+
+struct ub_event;
+struct ub_event_base;
+struct timeval;
+
+/**
+ * The Virtual Method Table for and ub_event_base "object"
+ */
+struct ub_event_base_vmt {
+	/** Destructor for the ub_event_base object,
+	 * (not called by libunbound) */
+	void (*free)(struct ub_event_base*);
+	/** Run the event loop
+	 * (not called by libunbound when using ub_resolve_event) */
+	int (*dispatch)(struct ub_event_base*);
+	/** Exit the given event loop */
+	int (*loopexit)(struct ub_event_base*, struct timeval*);
+	/** Instantiate a new ub_event associated with this event base */
+	struct ub_event* (*new_event)(struct ub_event_base*,
+		int fd, short bits, void (*cb)(int, short, void*), void* arg);
+	/** Instantiate a new signal associated with this event base,
+	 * (not called by libunbound) */
+	struct ub_event* (*new_signal)(struct ub_event_base*, int fd,
+		void (*cb)(int, short, void*), void* arg);
+	/** Create a new ub_event associated with the given wsaevent,
+	 * (not called by libunbound) */
+	struct ub_event* (*winsock_register_wsaevent)(struct ub_event_base*,
+		void* wsaevent, void (*cb)(int, short, void*), void* arg);
+};
+
+/**
+ * A user defined pluggable event base is registered by providing a
+ * ub_event_base "object" with the ub_ctx_create_ub_event() function.
+ * The magic number must be correct and the Virtual Method Table must be
+ * fully equipped providing the event base API to be used by libunbound.
+ */
+struct ub_event_base {
+	/** magic must be UB_EVENT_MAGIC (0x44d74d78) */
+	unsigned long magic;
+	/** Virtual Method Table for ub_event_base */
+	struct ub_event_base_vmt* vmt;
+};
+
+/**
+ * The Virtual Method Table for and ub_event "object"
+ */
+struct ub_event_vmt {
+	/** Add event bits for this event to fire on.
+	 * The event will be deactivated before this function is called. */
+	void (*add_bits)(struct ub_event*, short);
+	/** Configure the event so it will not longer fire on given bits 
+	 * The event will be deactivated before this function is called. */
+	void (*del_bits)(struct ub_event*, short);
+	/** Change or set the file descriptor on the event 
+	 * The event will be deactivated before this function is called. */
+	void (*set_fd)(struct ub_event*, int);
+	/** Destructor for the ub_event object */
+	void (*free)(struct ub_event*);
+	/** Activate the event.  The given timeval is an timeout value. */
+	int (*add)(struct ub_event*, struct timeval*);
+	/** Deactivate the event */
+	int (*del)(struct ub_event*);
+	/** Reconfigure and activate a timeout event */
+	int (*add_timer)(struct ub_event*, struct ub_event_base*,
+		void (*cb)(int, short, void*), void* arg, struct timeval*);
+	/** Deactivate the timeout event */
+	int (*del_timer)(struct ub_event*);
+	/** Activate a signal event (not called by libunbound). */
+	int (*add_signal)(struct ub_event*, struct timeval*);
+	/** Deactivate a signal event (not called by libunbound). */
+	int (*del_signal)(struct ub_event*);
+	/** Destructor for a ub_event associated with a wsaevent,
+	 * (not called by libunbound)
+	 */
+	void (*winsock_unregister_wsaevent)(struct ub_event* ev);
+	/** Libunbound will signal the eventloop when a TCP windows socket
+	 * will block on next read or write (given by the eventbits), to work
+	 * around edge trigger event behaviour of select on windows with TCP.
+	 */
+	void (*winsock_tcp_wouldblock)(struct ub_event*, int eventbit);
+};
+
+/**
+ * An "object" comprising a user defined pluggable event.
+ * The magic number must be correct and the Virtual Method Table must be
+ * fully equipped providing the ub_event API to be used by libunbound.
+ */
+struct ub_event {
+	/** magic must be UB_EVENT_MAGIC (0x44d74d78) */
+	unsigned long magic;
+	/** Virtual Method Table for ub_event */
+	struct ub_event_vmt* vmt;
+};
+
 typedef void (*ub_event_callback_t)(void*, int, void*, int, int, char*);
 
 /**
  * Create a resolving and validation context.
  * The information from /etc/resolv.conf and /etc/hosts is not utilised by
  * default. Use ub_ctx_resolvconf and ub_ctx_hosts to read them.
+ * @param base: the pluggable event base that the caller has created.
+ *      The unbound context uses this event base.
+ * @return a new context. default initialisation.
+ * 	returns NULL on error.
+ * You must use ub_resolve_event with this context.
+ * Do not call ub_ctx_async, ub_poll, ub_wait, ub_process, this is all done
+ * with the event_base.  Setup the options you like with the other functions.
+ */
+struct ub_ctx* ub_ctx_create_ub_event(struct ub_event_base* base);
+
+/**
+ * Create a resolving and validation context.
+ * The information from /etc/resolv.conf and /etc/hosts is not utilised by
+ * default. Use ub_ctx_resolvconf and ub_ctx_hosts to read them.
+ * You have to use the same libevent that unbound was compiled with,
+ * otherwise it wouldn't work, the event and event_base structures would
+ * be different.
  * @param base: the event base that the caller has created.  The unbound
  *	context uses this event base.
  * @return a new context. default initialisation.
@@ -79,7 +204,10 @@ typedef void (*ub_event_callback_t)(void*, int, void*, int, int, char*);
 struct ub_ctx* ub_ctx_create_event(struct event_base* base);
 
 /**
- * Set a new event_base on a context created with ub_ctx_create_event.
+ * Set a new libevent event_base on a context created with ub_ctx_create_event.
+ * You have to use the same libevent that unbound was compiled with,
+ * otherwise it wouldn't work, the event and event_base structures would
+ * be different.
  * Any outbound queries will be canceled.
  * @param ctx the ub_ctx to update.  Must have been created with ub_ctx_create_event
  * @param base the new event_base to attach to the ctx

libunbound/unbound.h

@@ -303,6 +303,27 @@ int ub_ctx_config(struct ub_ctx* ctx, const char* fname);
  */
 int ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr);
 
+/**
+ * Add a stub zone, with given address to send to.  This is for custom
+ * root hints or pointing to a local authoritative dns server.
+ * For dns resolvers and the 'DHCP DNS' ip address, use ub_ctx_set_fwd.
+ * This is similar to a stub-zone entry in unbound.conf.
+ *
+ * @param ctx: context.
+ *	It is only possible to set configuration before the
+ *	first resolve is done.
+ * @param zone: name of the zone, string.
+ * @param addr: address, IP4 or IP6 in string format.
+ * 	The addr is added to the list of stub-addresses if the entry exists.
+ * 	If the addr is NULL the stub entry is removed.
+ * @param isprime: set to true to set stub-prime to yes for the stub.
+ * 	For local authoritative servers, people usually set it to false,
+ * 	For root hints it should be set to true.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr,
+	int isprime);
+
 /**
  * Read list of nameservers to use from the filename given.
  * Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.

libunbound/worker.h

@@ -48,13 +48,12 @@ struct comm_reply;
 struct comm_point;
 struct module_qstate;
 struct tube;
+struct edns_option;
+struct query_info;
 
 /**
  * Worker service routine to send serviced queries to authoritative servers.
- * @param qname: query name. (host order)
- * @param qnamelen: length in bytes of qname, including trailing 0.
- * @param qtype: query type. (host order)
- * @param qclass: query class. (host order)
+ * @param qinfo: query info.
  * @param flags: host order flags word, with opcode and CD bit.
  * @param dnssec: if set, EDNS record will have DO bit set.
  * @param want_dnssec: signatures needed.
@@ -63,15 +62,15 @@ struct tube;
  * @param addrlen: length of addr.
  * @param zone: delegation point name.
  * @param zonelen: length of zone name wireformat dname.
+ * @param ssl_upstream: use SSL for upstream queries.
  * @param q: wich query state to reactivate upon return.
  * @return: false on failure (memory or socket related). no query was
  *      sent.
  */
-struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
-        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
-	socklen_t addrlen, uint8_t* zone, size_t zonelen,
-	struct module_qstate* q);
+struct outbound_entry* libworker_send_query(struct query_info* qinfo,
+	uint16_t flags, int dnssec, int want_dnssec, int nocaps,
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
+	size_t zonelen, int ssl_upstream, struct module_qstate* q);
 
 /** process incoming replies from the network */
 int libworker_handle_reply(struct comm_point* c, void* arg, int error,
@@ -106,10 +105,7 @@ void worker_sighandler(int sig, void* arg);
 
 /**
  * Worker service routine to send serviced queries to authoritative servers.
- * @param qname: query name. (host order)
- * @param qnamelen: length in bytes of qname, including trailing 0.
- * @param qtype: query type. (host order)
- * @param qclass: query class. (host order)
+ * @param qinfo: query info.
  * @param flags: host order flags word, with opcode and CD bit.
  * @param dnssec: if set, EDNS record will have DO bit set.
  * @param want_dnssec: signatures needed.
@@ -118,15 +114,15 @@ void worker_sighandler(int sig, void* arg);
  * @param addrlen: length of addr.
  * @param zone: wireformat dname of the zone.
  * @param zonelen: length of zone name.
+ * @param ssl_upstream: use SSL for upstream queries.
  * @param q: wich query state to reactivate upon return.
  * @return: false on failure (memory or socket related). no query was
  *      sent.
  */
-struct outbound_entry* worker_send_query(uint8_t* qname, size_t qnamelen, 
-	uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
-	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
-	socklen_t addrlen, uint8_t* zone, size_t zonelen,
-	struct module_qstate* q);
+struct outbound_entry* worker_send_query(struct query_info* qinfo,
+	uint16_t flags, int dnssec, int want_dnssec, int nocaps,
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
+	size_t zonelen, int ssl_upstream, struct module_qstate* q);
 
 /** 
  * process control messages from the main thread. Frees the control 

makedist.sh

@@ -55,6 +55,7 @@ Generate a distribution tar file for unbound.
                  Detected from svn working copy if not specified.
     -wssl openssl.xx.tar.gz Also build openssl from tarball for windows dist.
     -wxp expat.xx.tar.gz Also build expat from tarball for windows dist.
+    -w64	 64bit windows compile.
     -w ...       Build windows binary dist. last args passed to configure.
 EOF
     exit 1
@@ -177,6 +178,7 @@ storehash () {
 SNAPSHOT="no"
 RC="no"
 DOWIN="no"
+W64="no"
 WINSSL=""
 WINEXPAT=""
 
@@ -201,6 +203,10 @@ while [ "$1" ]; do
 	    WINEXPAT="$2"
 	    shift
 	    ;;
+	"-w64")
+	    W64="yes"
+	    shift
+	    ;;
         "-w")
             DOWIN="yes"
 	    shift
@@ -222,8 +228,15 @@ if [ "$DOWIN" = "yes" ]; then
     if test "`uname`" = "Linux"; then 
 	info "Crosscompile windows dist"
         cross="yes"
-	configure="mingw32-configure"
-	strip="i686-w64-mingw32-strip"
+	if test "$W64" = "yes"; then
+		warch="x86_64"   # i686 for 32bit, or x86_64 for 64bit
+		mw64="mingw64"   # mingw32 or mingw64
+	else
+		warch="i686"
+		mw64="mingw32"
+	fi
+	configure="${mw64}-configure"   # mingw32-configure, mingw64-configure
+	strip="${warch}-w64-mingw32-strip"
 	makensis="makensis"	# from mingw32-nsis package
 	# flags for crosscompiled dependency libraries
 	cross_flag=""
@@ -241,9 +254,13 @@ if [ "$DOWIN" = "yes" ]; then
 		# configure for crosscompile, without CAPI because it fails
 		# cross-compilation and it is not used anyway
 		# before 1.0.1i need --cross-compile-prefix=i686-w64-mingw32-
-		sslflags="no-asm -DOPENSSL_NO_CAPIENG mingw"
+		if test "$mw64" = "mingw64"; then
+			sslflags="no-asm -DOPENSSL_NO_CAPIENG mingw64"
+		else
+			sslflags="no-asm -DOPENSSL_NO_CAPIENG mingw"
+		fi
 		info "winssl: Configure $sslflags"
-		CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar RANLIB=i686-w64-mingw32-ranlib ./Configure --prefix="$sslinstall" $sslflags || error_cleanup "OpenSSL Configure failed"
+		CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib ./Configure --prefix="$sslinstall" $sslflags || error_cleanup "OpenSSL Configure failed"
 		info "winssl: make"
 		make || error_cleanup "OpenSSL crosscompile failed"
 		# only install sw not docs, which take a long time.
@@ -260,7 +277,7 @@ if [ "$DOWIN" = "yes" ]; then
 		wxpinstall="`pwd`/wxpinstall"
 		cd expat-* || error_cleanup "no expat-X dir in tarball"
 		info "wxp: configure"
-		mingw32-configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib"  || error_cleanup "libexpat configure failed"
+		$configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib"  || error_cleanup "libexpat configure failed"
 		#info "wxp: make"
 		#make || error_cleanup "libexpat crosscompile failed"
 		info "wxp: make installlib"
@@ -307,8 +324,8 @@ if [ "$DOWIN" = "yes" ]; then
     # procedure for making unbound installer on mingw. 
     info "Creating windows dist unbound $version"
     info "Calling configure"
-    echo "$configure"' --enable-debug --enable-static-exe '"$* $cross_flag"
-    $configure --enable-debug --enable-static-exe $* $cross_flag \
+    echo "$configure"' --enable-debug --enable-static-exe --disable-flto '"$* $cross_flag"
+    $configure --enable-debug --enable-static-exe --disable-flto $* $cross_flag \
 	|| error_cleanup "Could not configure"
     info "Calling make"
     make || error_cleanup "Could not make"
@@ -319,19 +336,20 @@ if [ "$DOWIN" = "yes" ]; then
     rm -f $file
     info "Creating $file"
     mkdir tmp.$$
-    $strip unbound.exe
-    $strip anchor-update.exe
-    $strip unbound-control.exe
-    $strip unbound-host.exe
-    $strip unbound-anchor.exe
-    $strip unbound-checkconf.exe
-    $strip unbound-service-install.exe
-    $strip unbound-service-remove.exe
+    # keep debug symbols
+    #$strip unbound.exe
+    #$strip anchor-update.exe
+    #$strip unbound-control.exe
+    #$strip unbound-host.exe
+    #$strip unbound-anchor.exe
+    #$strip unbound-checkconf.exe
+    #$strip unbound-service-install.exe
+    #$strip unbound-service-remove.exe
     cd tmp.$$
-    cp ../doc/example.conf example.conf
-    cp ../unbound.exe ../unbound-anchor.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-control-setup.cmd ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt .
+    cp ../doc/example.conf ../doc/Changelog .
+    cp ../unbound.exe ../unbound-anchor.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-control-setup.cmd ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt ../contrib/create_unbound_ad_servers.cmd ../contrib/warmup.cmd ../contrib/unbound_cache.cmd .
     # zipfile
-    zip ../$file LICENSE README.txt unbound.exe unbound-anchor.exe unbound-host.exe unbound-control.exe unbound-checkconf.exe unbound-service-install.exe unbound-service-remove.exe unbound-control-setup.cmd example.conf service.conf unbound-website.url
+    zip ../$file LICENSE README.txt unbound.exe unbound-anchor.exe unbound-host.exe unbound-control.exe unbound-checkconf.exe unbound-service-install.exe unbound-service-remove.exe unbound-control-setup.cmd example.conf service.conf unbound-website.url create_unbound_ad_servers.cmd warmup.cmd unbound_cache.cmd Changelog
     info "Testing $file"
     (cd .. ; zip -T $file )
     # installer

pythonmod/doc/conf.py

@@ -80,10 +80,13 @@ pygments_style = 'sphinx'
 # Options for HTML output
 # -----------------------
 
+# The theme that the html output should use.
+html_theme = "classic"
+
 # The style sheet to use for HTML and HTML Help pages. A file of that name
 # must exist either in Sphinx' static/ path, or in one of the custom paths
 # given in html_static_path.
-html_style = 'default.css'
+#html_style = 'default.css'
 
 # The name for this set of Sphinx documents.  If None, it defaults to
 # "<project> v<release> documentation".

pythonmod/doc/examples/example1.rst

@@ -1,10 +1,12 @@
 .. _log_handler:
 
 Packet logger
-=========================
+=============
 
 This example shows how to log and print details about query and response.
-As soon as the ``iterator`` has finished (event is :data:`module_event_moddone`), ``qstate.return_msg`` contains response packet or ``None``.
+As soon as the ``iterator`` has finished (event is
+:data:`module_event_moddone`), ``qstate.return_msg`` contains response packet
+or ``None``.
 This packet will be send to a client that asked for it.
 
 Complete source code
@@ -14,14 +16,16 @@ Complete source code
    :language: python
 
 Testing
-------------------
+-------
 Run the unbound server:
 
 ``root@localhost>unbound -dv -c ./test-log.conf``
 
-In case you use own configuration file, don't forget to enable python module: ``module-config: "validator python iterator"`` and use valid script path: ``python-script: "./examples/log.py"``.
+In case you use own configuration file, don't forget to enable python module:
+``module-config: "validator python iterator"`` and use valid script path:
+``python-script: "./examples/log.py"``.
 
-Example of output::	
+Example of output::
 
    [1231790168] unbound[7941:0] info: response for <f.gtld-servers.NET. AAAA IN>
    [1231790168] unbound[7941:0] info: reply from <gtld-servers.NET.> 192.5.6.31#53

pythonmod/doc/examples/example2.rst

@@ -1,12 +1,14 @@
 Response generation
-=====================
+===================
 
 This example shows how to handle queries and generate response packet.
 
 .. note::
-   If the python module is the first module and validator module is enabled (``module-config: "python validator iterator"``),
-   a return_msg security flag has to be set at least to 2. Leaving security flag untouched causes that the
-   response will be refused by unbound worker as unbound will consider it as non-valid response.
+   If the python module is the first module and validator module is enabled
+   (``module-config: "python validator iterator"``), a return_msg security flag
+   has to be set at least to 2. Leaving security flag untouched causes that the
+   response will be refused by unbound worker as unbound will consider it as
+   non-valid response.
 
 Complete source code
 --------------------
@@ -27,20 +29,21 @@ Query for a A record ending with .localdomain
 
 Dig produces the following output::
 
-	;; global options:  printcmd
-	;; Got answer:
-	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48426
-	;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
-	
-	;; QUESTION SECTION:
-	;test.xxx.localdomain.		IN	A
-	
-	;; ANSWER SECTION:
-	test.xxx.localdomain.	10	IN	A	127.0.0.1
-	
-	;; Query time: 2 msec
-	;; SERVER: 127.0.0.1#53(127.0.0.1)
-	;; WHEN: Mon Jan 01 12:46:02 2009
-	;; MSG SIZE  rcvd: 54
+    ;; global options:  printcmd
+    ;; Got answer:
+    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48426
+    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
 
-As we handle (override) in python module only queries ending with "localdomain.", the unboud can still resolve host names.
+    ;; QUESTION SECTION:
+    ;test.xxx.localdomain.      IN  A
+
+    ;; ANSWER SECTION:
+    test.xxx.localdomain.   10  IN  A   127.0.0.1
+
+    ;; Query time: 2 msec
+    ;; SERVER: 127.0.0.1#53(127.0.0.1)
+    ;; WHEN: Mon Jan 01 12:46:02 2009
+    ;; MSG SIZE  rcvd: 54
+
+As we handle (override) in the python module only queries ending with
+``localdomain.``, unboud can still resolve host names.

pythonmod/doc/examples/example4.rst

@@ -1,15 +1,19 @@
 DNS-based language dictionary
-===============================
+=============================
 
 This example shows how to create a simple language dictionary based on **DNS**
-service within 15 minutes. The translation will be performed using TXT resource records.
+service within 15 minutes. The translation will be performed using TXT resource
+records.
 
 Key parts
------------
+---------
 
 Initialization
-~~~~~~~~~~~~~~~~~~~~~~~
-On **init()** module loads dictionary from a text file containing records in ``word [tab] translation`` format.
+~~~~~~~~~~~~~~
+
+On **init()** module loads dictionary from a text file containing records in
+``word [tab] translation`` format.
+
 ::
 
    def init(id, cfg):
@@ -20,11 +24,14 @@ On **init()** module loads dictionary from a text file containing records in ``w
 The suitable file can be found at http://slovnik.zcu.cz
 
 DNS query and word lookup
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Let's define the following format od DNS queries: ``word1[.]word2[.] ... wordN[.]{en,cs}[._dict_.cz.]``.
+Let's define the following format od DNS queries:
+``word1[.]word2[.] ... wordN[.]{en,cs}[._dict_.cz.]``.
 Word lookup is done by simple ``dict`` lookup from broken DNS request.
-Query name is divided into a list of labels. This list is accesible as qname_list attribute.
+Query name is divided into a list of labels. This list is accessible as
+``qname_list`` attribute.
+
 ::
 
    aword = ' '.join(qstate.qinfo.qname_list[0:-4]) #skip last four labels
@@ -37,35 +44,40 @@ Query name is divided into a list of labels. This list is accesible as qname_lis
    if (adict == "cs") and (aword in cz_dict):
       words = cz_dict[aword] # CS -> EN
 
-In the first step, we get a string in the form: ``word1[space]word2[space]...word[space]``.
-In the second assignment, fourth label from the end is obtained. This label should contains *"cs"* or *"en"*.
-This label determines the direction of translation.
-
+In the first step, we get a string in the form:
+``word1[space]word2[space]...word[space]``.
+In the second assignment, fourth label from the end is obtained. This label
+should contains *"cs"* or *"en"*. This label determines the direction of
+translation.
 
 Forming of a DNS reply
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~
 
 DNS reply is formed only on valid match and added as TXT answer.
+
 ::
 
-	msg = DNSMessage(qstate.qinfo.qname_str, RR_TYPE_TXT, RR_CLASS_IN, PKT_AA)
+    msg = DNSMessage(qstate.qinfo.qname_str, RR_TYPE_TXT, RR_CLASS_IN, PKT_AA)
 
-	for w in words:
-		msg.answer.append("%s 300 IN TXT \"%s\"" % (qstate.qinfo.qname_str, w.replace("\"", "\\\"")))
+    for w in words:
+        msg.answer.append("%s 300 IN TXT \"%s\"" % (qstate.qinfo.qname_str, w.replace("\"", "\\\"")))
 
-	if not msg.set_return_msg(qstate):
-		qstate.ext_state[id] = MODULE_ERROR 
-		return True
+    if not msg.set_return_msg(qstate):
+        qstate.ext_state[id] = MODULE_ERROR 
+        return True
 
-	qstate.return_rcode = RCODE_NOERROR
-	qstate.ext_state[id] = MODULE_FINISHED 
-	return True
+    qstate.return_rcode = RCODE_NOERROR
+    qstate.ext_state[id] = MODULE_FINISHED 
+    return True
 
-In the first step, a :class:`DNSMessage` instance is created for a given query *(type TXT)*.
+In the first step, a :class:`DNSMessage` instance is created for a given query
+*(type TXT)*.
 The fourth argument specifies the flags *(authoritative answer)*.
-In the second step, we append TXT records containing the translation *(on the right side of RR)*.
+In the second step, we append TXT records containing the translation *(on the
+right side of RR)*.
 Then, the response is finished and ``qstate.return_msg`` contains new response.
-If no error, the module sets :attr:`module_qstate.return_rcode` and :attr:`module_qstate.ext_state`.
+If no error, the module sets :attr:`module_qstate.return_rcode` and
+:attr:`module_qstate.ext_state`.
 
 **Steps:**
 
@@ -82,80 +94,82 @@ Run the Unbound server:
 
 In case you use own configuration file, don't forget to enable Python module::
 
-	module-config: "validator python iterator"
+    module-config: "validator python iterator"
 
 and use valid script path::
 
-	python-script: "./examples/dict.py"
+    python-script: "./examples/dict.py"
 
 The translation from english word *"a bar fly"* to Czech can be done by doing:
 
 ``>>>dig TXT @127.0.0.1 a.bar.fly.en._dict_.cz``
 
-::	
+::
+
+    ; (1 server found)
+    ;; global options:  printcmd
+    ;; Got answer:
+    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48691
+    ;; flags: aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
+
+    ;; QUESTION SECTION:
+    ;a.bar.fly.en._dict_.cz.    IN  TXT
+
+    ;; ANSWER SECTION:
+    a.bar.fly.en._dict_.cz. 300 IN  TXT "barov\253 povale\232"
+
+    ;; Query time: 5 msec
+    ;; SERVER: 127.0.0.1#53(127.0.0.1)
+    ;; WHEN: Mon Jan 01 17:44:18 2009
+    ;; MSG SIZE  rcvd: 67
 
-	; (1 server found)
-	;; global options:  printcmd
-	;; Got answer:
-	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48691
-	;; flags: aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
-	
-	;; QUESTION SECTION:
-	;a.bar.fly.en._dict_.cz.		IN	TXT
-	
-	;; ANSWER SECTION:
-	a.bar.fly.en._dict_.cz.	300	IN	TXT	"barov\253 povale\232"
-	
-	;; Query time: 5 msec
-	;; SERVER: 127.0.0.1#53(127.0.0.1)
-	;; WHEN: Mon Jan 01 17:44:18 2009
-	;; MSG SIZE  rcvd: 67
-	
 ``>>>dig TXT @127.0.0.1 nic.cs._dict_.cz``
+
 ::
 	
-	; <<>> DiG 9.5.0-P2 <<>> TXT @127.0.0.1 nic.cs._dict_.cz
-	; (1 server found)
-	;; global options:  printcmd
-	;; Got answer:
-	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58710
-	;; flags: aa rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
-	
-	;; QUESTION SECTION:
-	;nic.cs._dict_.cz.		IN	TXT
-	
-	;; ANSWER SECTION:
-	nic.cs._dict_.cz.	300	IN	TXT	"aught"
-	nic.cs._dict_.cz.	300	IN	TXT	"naught"
-	nic.cs._dict_.cz.	300	IN	TXT	"nihil"
-	nic.cs._dict_.cz.	300	IN	TXT	"nix"
-	nic.cs._dict_.cz.	300	IN	TXT	"nothing"
-	nic.cs._dict_.cz.	300	IN	TXT	"zilch"
-	
-	;; Query time: 0 msec
-	;; SERVER: 127.0.0.1#53(127.0.0.1)
-	;; WHEN: Mon Jan 01 17:45:39 2009
-	;; MSG SIZE  rcvd: 143
+    ; <<>> DiG 9.5.0-P2 <<>> TXT @127.0.0.1 nic.cs._dict_.cz
+    ; (1 server found)
+    ;; global options:  printcmd
+    ;; Got answer:
+    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58710
+    ;; flags: aa rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
 
-Proof that the unbound still works as resolver.
+    ;; QUESTION SECTION:
+    ;nic.cs._dict_.cz.      IN  TXT
+
+    ;; ANSWER SECTION:
+    nic.cs._dict_.cz.   300 IN  TXT "aught"
+    nic.cs._dict_.cz.   300 IN  TXT "naught"
+    nic.cs._dict_.cz.   300 IN  TXT "nihil"
+    nic.cs._dict_.cz.   300 IN  TXT "nix"
+    nic.cs._dict_.cz.   300 IN  TXT "nothing"
+    nic.cs._dict_.cz.   300 IN  TXT "zilch"
+
+    ;; Query time: 0 msec
+    ;; SERVER: 127.0.0.1#53(127.0.0.1)
+    ;; WHEN: Mon Jan 01 17:45:39 2009
+    ;; MSG SIZE  rcvd: 143
+
+    Proof that the unbound still works as resolver.
 
 ``>>>dig A @127.0.0.1 www.nic.cz``
+
 ::
 
-	; (1 server found)
-	;; global options:  printcmd
-	;; Got answer:
-	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19996
-	;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 5
-	
-	;; QUESTION SECTION:
-	;www.nic.cz.			IN	A
-	
-	;; ANSWER SECTION:
-	www.nic.cz.		1662	IN	A	217.31.205.50
-	
-	;; AUTHORITY SECTION:
-	...
+    ; (1 server found)
+    ;; global options:  printcmd
+    ;; Got answer:
+    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19996
+    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 5
+
+    ;; QUESTION SECTION:
+    ;www.nic.cz.            IN  A
+
+    ;; ANSWER SECTION:
+    www.nic.cz.     1662    IN  A   217.31.205.50
+
+    ;; AUTHORITY SECTION:
+    ...
 
 Complete source code
 --------------------

pythonmod/doc/examples/example5.rst

@@ -0,0 +1,191 @@
+EDNS options
+============
+
+This example shows how to interact with EDNS options.
+
+When quering unbound with the EDNS option ``65001`` and data ``0xc001`` we
+expect an answer with the same EDNS option code and data ``0xdeadbeef``.
+
+
+Key parts
+~~~~~~~~~
+
+This example relies on the following functionalities:
+
+
+Registering EDNS options
+------------------------
+
+By registering EDNS options we can tune unbound's behavior when encountering a
+query with a known EDNS option. The two available options are:
+
+- ``bypass_cache_stage``: If set to ``True`` unbound will not try to answer
+  from cache. Instead execution is passed to the modules
+- ``no_aggregation``: If set to ``True`` unbound will consider this query
+  unique and will not aggregate it with similar queries
+
+Both values default to ``False``.
+
+.. code-block:: python
+
+    if not register_edns_option(env, 65001, bypass_cache_stage=True,
+                                no_aggregation=True):
+        log_info("python: Could not register EDNS option {}".format(65001))
+
+
+EDNS option lists
+-----------------
+
+EDNS option lists can be found in the :class:`module_qstate` class. There are
+four available lists in total:
+
+- :class:`module_qstate.edns_opts_front_in`: options that came from the client
+  side. **Should not** be changed
+- :class:`module_qstate.edns_opts_back_out`: options that will be sent to the
+  server side. Can be populated by edns literate modules
+- :class:`module_qstate.edns_opts_back_in`: options that came from the server
+  side. **Should not** be changed
+- :class:`module_qstate.edns_opts_front_out`: options that will be sent to the
+  client side. Can be populated by edns literate modules
+
+Each list element has the following members:
+
+- ``code``: the EDNS option code;
+- ``data``: the EDNS option data.
+
+
+Reading an EDNS option list
+...........................
+
+The lists' contents can be accessed in python by their ``_iter`` counterpart as
+an iterator:
+
+.. code-block:: python
+
+    if not edns_opt_list_is_empty(qstate.edns_opts_front_in):
+        for o in qstate.edns_opts_front_in_iter:
+            log_info("python:    Code: {}, Data: '{}'".format(o.code,
+                            "".join('{:02x}'.format(x) for x in o.data)))
+
+
+Writing to an EDNS option list
+..............................
+
+By appending to an EDNS option list we can add new EDNS options. The new
+element is going to be allocated in :class:`module_qstate.region`. The data
+**must** be represented with a python ``bytearray``:
+
+.. code-block:: python
+
+    b = bytearray.fromhex("deadbeef")
+    if not edns_opt_list_append(qstate.edns_opts_front_out,
+                           o.code, b, qstate.region):
+        log_info("python: Could not append EDNS option {}".format(o.code))
+
+We can also remove an EDNS option code from an EDNS option list.
+
+.. code-block:: python
+
+    if not edns_opt_list_remove(edns_opt_list, code):
+        log_info("python: Option code {} was not found in the "
+                 "list.".format(code))
+
+.. note:: All occurences of the EDNS option code will be removed from the list:
+
+
+Controlling other modules' cache behavior
+-----------------------------------------
+
+During the modules' operation, some modules may interact with the cache
+(e.g., iterator). This behavior can be controlled by using the following
+:class:`module_qstate` flags:
+
+- :class:`module_qstate.no_cache_lookup`: Modules *operating after* this module
+  will not lookup the cache for an answer
+- :class:`module_qstate.no_cache_store`: Modules *operating after* this module
+  will not store the response in the cache
+
+Both values default to ``0``.
+
+.. code-block:: python
+
+    def operate(id, event, qstate, qdata):
+        if (event == MODULE_EVENT_NEW) or (event == MODULE_EVENT_PASS):
+            # Detect if edns option code 56001 is present from the client side. If
+            # so turn on the flags for cache management.
+            if not edns_opt_list_is_empty(qstate.edns_opts_front_in):
+                log_info("python: searching for edns option code 65001 during NEW "
+                        "or PASS event ")
+                for o in qstate.edns_opts_front_in_iter:
+                    if o.code == 65001:
+                        log_info("python: found edns option code 65001")
+                        # Instruct other modules to not lookup for an
+                        # answer in the cache.
+                        qstate.no_cache_lookup = 1
+                        log_info("python: enabled no_cache_lookup")
+
+                        # Instruct other modules to not store the answer in
+                        # the cache.
+                        qstate.no_cache_store = 1
+                        log_info("python: enabled no_cache_store")
+
+
+Testing
+~~~~~~~
+
+Run the Unbound server: ::
+
+    root@localhost$ unbound -dv -c ./test-edns.conf
+
+In case you use your own configuration file, don't forget to enable the Python
+module::
+
+    module-config: "validator python iterator"
+
+and use a valid script path::
+
+    python-script: "./examples/edns.py"
+
+Quering with EDNS option ``65001:0xc001``:
+
+::
+
+    root@localhost$ dig @localhost nlnetlabs.nl +ednsopt=65001:c001
+
+    ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @localhost nlnetlabs.nl +ednsopt=65001:c001
+    ; (1 server found)
+    ;; global options: +cmd
+    ;; Got answer:
+    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33450
+    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 3
+
+    ;; OPT PSEUDOSECTION:
+    ; EDNS: version: 0, flags:; udp: 4096
+    ; OPT=65001: de ad be ef ("....")
+    ;; QUESTION SECTION:
+    ;nlnetlabs.nl.                  IN      A
+
+    ;; ANSWER SECTION:
+    nlnetlabs.nl.           10200   IN      A       185.49.140.10
+
+    ;; AUTHORITY SECTION:
+    nlnetlabs.nl.           10200   IN      NS      anyns.pch.net.
+    nlnetlabs.nl.           10200   IN      NS      ns.nlnetlabs.nl.
+    nlnetlabs.nl.           10200   IN      NS      ns-ext1.sidn.nl.
+    nlnetlabs.nl.           10200   IN      NS      sec2.authdns.ripe.net.
+
+    ;; ADDITIONAL SECTION:
+    ns.nlnetlabs.nl.        10200   IN      AAAA    2a04:b900::8:0:0:60
+    ns.nlnetlabs.nl.        10200   IN      A       185.49.140.60
+
+    ;; Query time: 10 msec
+    ;; SERVER: 127.0.0.1#53(127.0.0.1)
+    ;; WHEN: Mon Dec 05 14:50:56 CET 2016
+    ;; MSG SIZE  rcvd: 212
+
+
+Complete source code
+~~~~~~~~~~~~~~~~~~~~
+
+.. literalinclude:: ../../examples/edns.py
+    :language: python

pythonmod/doc/examples/example6.rst

@@ -0,0 +1,299 @@
+Inplace callbacks
+=================
+
+This example shows how to register and use inplace callback functions. These
+functions are going to be called just before unbound replies back to a client.
+They can perform certain actions without interrupting unbound's execution flow
+(e.g. add/remove EDNS options, manipulate the reply).
+
+Two different scenarios will be shown:
+
+- If answering from cache and the client used EDNS option code ``65002`` we
+  will answer with the same code but with data ``0xdeadbeef``;
+- When answering with a SERVFAIL we also add an empty EDNS option code
+  ``65003``.
+
+
+Key parts
+~~~~~~~~~
+
+This example relies on the following functionalities:
+
+
+Registering inplace callback functions
+--------------------------------------
+
+There are four types of inplace callback functions:
+
+- `inplace callback reply functions`_
+- `inplace callback reply_cache functions`_
+- `inplace callback reply_local functions`_
+- `inplace callback reply_servfail functions`_
+
+
+Inplace callback reply functions
+................................
+
+Called when answering with a *resolved* query.
+
+The callback function's prototype is the following:
+
+.. code-block:: python
+
+    def inplace_reply_callback(qinfo, qstate, rep, rcode, edns, opt_list_out, region):
+        """Function that will be registered as an inplace callback function.
+        It will be called when answering with a resolved query.
+        :param qinfo: query_info struct;
+        :param qstate: module qstate. It contains the available opt_lists; It
+                       SHOULD NOT be altered;
+        :param rep: reply_info struct;
+        :param rcode: return code for the query;
+        :param edns: edns_data to be sent to the client side. It SHOULD NOT be
+                     altered;
+        :param opt_list_out: the list with the EDNS options that will be sent as a
+                             reply. It can be populated with EDNS options;
+        :param region: region to allocate temporary data. Needs to be used when we
+                       want to append a new option to opt_list_out.
+        :return: True on success, False on failure.
+        """
+
+.. note:: The function's name is irrelevant.
+
+We can register such function as:
+
+.. code-block:: python
+
+    if not register_inplace_cb_reply(inplace_reply_callback, env):
+        log_info("python: Could not register inplace callback function.")
+
+
+Inplace callback reply_cache functions
+......................................
+
+Called when answering *from cache*.
+
+The callback function's prototype is the following:
+
+.. code-block:: python
+
+    def inplace_cache_callback(qinfo, qstate, rep, rcode, edns, opt_list_out, region):
+        """Function that will be registered as an inplace callback function.
+        It will be called when answering from the cache.
+        :param qinfo: query_info struct;
+        :param qstate: module qstate. None;
+        :param rep: reply_info struct;
+        :param rcode: return code for the query;
+        :param edns: edns_data sent from the client side. The list with the EDNS
+                     options is accesible through edns.opt_list. It SHOULD NOT be
+                     altered;
+        :param opt_list_out: the list with the EDNS options that will be sent as a
+                             reply. It can be populated with EDNS options;
+        :param region: region to allocate temporary data. Needs to be used when we
+                       want to append a new option to opt_list_out.
+        :return: True on success, False on failure.
+        """
+
+.. note:: The function's name is irrelevant.
+
+We can register such function as:
+
+.. code-block:: python
+
+    if not register_inplace_cb_reply_cache(inplace_cache_callback, env):
+        log_info("python: Could not register inplace callback function.")
+
+
+Inplace callback reply_local functions
+......................................
+
+Called when answering with *local data* or a *Chaos(CH) reply*.
+
+The callback function's prototype is the following:
+
+.. code-block:: python
+
+    def inplace_local_callback(qinfo, qstate, rep, rcode, edns, opt_list_out, region):
+        """Function that will be registered as an inplace callback function.
+        It will be called when answering from local data.
+        :param qinfo: query_info struct;
+        :param qstate: module qstate. None;
+        :param rep: reply_info struct;
+        :param rcode: return code for the query;
+        :param edns: edns_data sent from the client side. The list with the
+                     EDNS options is accesible through edns.opt_list. It
+                     SHOULD NOT be altered;
+        :param opt_list_out: the list with the EDNS options that will be sent as a
+                             reply. It can be populated with EDNS options;
+        :param region: region to allocate temporary data. Needs to be used when we
+                       want to append a new option to opt_list_out.
+        :return: True on success, False on failure.
+        """
+
+.. note:: The function's name is irrelevant.
+
+We can register such function as:
+
+.. code-block:: python
+
+    if not register_inplace_cb_reply_local(inplace_local_callback, env):
+        log_info("python: Could not register inplace callback function.")
+
+
+Inplace callback reply_servfail functions
+.........................................
+
+Called when answering with *SERVFAIL*.
+
+The callback function's prototype is the following:
+
+.. code-block:: python
+
+    def inplace_servfail_callback(qinfo, qstate, rep, rcode, edns, opt_list_out, region):
+        """Function that will be registered as an inplace callback function.
+        It will be called when answering with SERVFAIL.
+        :param qinfo: query_info struct;
+        :param qstate: module qstate. If not None the relevant opt_lists are
+                       available here;
+        :param rep: reply_info struct. None;
+        :param rcode: return code for the query. LDNS_RCODE_SERVFAIL;
+        :param edns: edns_data to be sent to the client side. If qstate is None
+                     edns.opt_list contains the EDNS options sent from the client
+                     side. It SHOULD NOT be altered;
+        :param opt_list_out: the list with the EDNS options that will be sent as a
+                             reply. It can be populated with EDNS options;
+        :param region: region to allocate temporary data. Needs to be used when we
+                       want to append a new option to opt_list_out.
+        :return: True on success, False on failure.
+        """
+
+.. note:: The function's name is irrelevant.
+
+We can register such function as:
+
+.. code-block:: python
+
+    if not register_inplace_cb_reply_servfail(inplace_servfail_callback, env):
+        log_info("python: Could not register inplace callback function.")
+
+
+Testing
+~~~~~~~
+
+Run the Unbound server: ::
+
+    root@localhost$ unbound -dv -c ./test-inplace_callbacks.conf
+
+In case you use your own configuration file, don't forget to enable the Python
+module::
+
+    module-config: "validator python iterator"
+
+and use a valid script path ::
+
+    python-script: "./examples/inplace_callbacks.py"
+
+On the first query for the nlnetlabs.nl A record we get no EDNS option back:
+
+::
+
+    root@localhost$ dig @localhost nlnetlabs.nl +ednsopt=65002
+
+    ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @localhost nlnetlabs.nl +ednsopt=65002
+    ; (1 server found)
+    ;; global options: +cmd
+    ;; Got answer:
+    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48057
+    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 3
+
+    ;; OPT PSEUDOSECTION:
+    ; EDNS: version: 0, flags:; udp: 4096
+    ;; QUESTION SECTION:
+    ;nlnetlabs.nl.                  IN      A
+
+    ;; ANSWER SECTION:
+    nlnetlabs.nl.           10200   IN      A       185.49.140.10
+
+    ;; AUTHORITY SECTION:
+    nlnetlabs.nl.           10200   IN      NS      ns.nlnetlabs.nl.
+    nlnetlabs.nl.           10200   IN      NS      sec2.authdns.ripe.net.
+    nlnetlabs.nl.           10200   IN      NS      anyns.pch.net.
+    nlnetlabs.nl.           10200   IN      NS      ns-ext1.sidn.nl.
+
+    ;; ADDITIONAL SECTION:
+    ns.nlnetlabs.nl.        10200   IN      A       185.49.140.60
+    ns.nlnetlabs.nl.        10200   IN      AAAA    2a04:b900::8:0:0:60
+
+    ;; Query time: 813 msec
+    ;; SERVER: 127.0.0.1#53(127.0.0.1)
+    ;; WHEN: Mon Dec 05 16:15:32 CET 2016
+    ;; MSG SIZE  rcvd: 204
+
+When we issue the same query again we get a cached response and the expected
+``65002: 0xdeadbeef`` EDNS option:
+
+::
+
+    root@localhost$ dig @localhost nlnetlabs.nl +ednsopt=65002
+
+    ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @localhost nlnetlabs.nl +ednsopt=65002
+    ; (1 server found)
+    ;; global options: +cmd
+    ;; Got answer:
+    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26489
+    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 3
+
+    ;; OPT PSEUDOSECTION:
+    ; EDNS: version: 0, flags:; udp: 4096
+    ; OPT=65002: de ad be ef ("....")
+    ;; QUESTION SECTION:
+    ;nlnetlabs.nl.                  IN      A
+
+    ;; ANSWER SECTION:
+    nlnetlabs.nl.           10197   IN      A       185.49.140.10
+
+    ;; AUTHORITY SECTION:
+    nlnetlabs.nl.           10197   IN      NS      ns.nlnetlabs.nl.
+    nlnetlabs.nl.           10197   IN      NS      sec2.authdns.ripe.net.
+    nlnetlabs.nl.           10197   IN      NS      anyns.pch.net.
+    nlnetlabs.nl.           10197   IN      NS      ns-ext1.sidn.nl.
+
+    ;; ADDITIONAL SECTION:
+    ns.nlnetlabs.nl.        10197   IN      AAAA    2a04:b900::8:0:0:60
+    ns.nlnetlabs.nl.        10197   IN      A       185.49.140.60
+
+    ;; Query time: 0 msec
+    ;; SERVER: 127.0.0.1#53(127.0.0.1)
+    ;; WHEN: Mon Dec 05 16:50:04 CET 2016
+    ;; MSG SIZE  rcvd: 212
+
+By issuing a query for a bogus domain unbound replies with SERVFAIL and an
+empty EDNS option code ``65003``. *For this example to work unbound needs to be
+validating*:
+
+::
+
+    root@localhost$ dig @localhost bogus.nlnetlabs.nl txt
+
+    ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @localhost bogus.nlnetlabs.nl txt
+    ; (1 server found)
+    ;; global options: +cmd
+    ;; Got answer:
+    ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 19865
+    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
+
+    ;; OPT PSEUDOSECTION:
+    ; EDNS: version: 0, flags:; udp: 4096
+    ; OPT=65003
+    ;; QUESTION SECTION:
+    ;bogus.nlnetlabs.nl.            IN      TXT
+
+    ;; Query time: 11 msec
+    ;; SERVER: 127.0.0.1#53(127.0.0.1)
+    ;; WHEN: Mon Dec 05 17:06:01 CET 2016
+    ;; MSG SIZE  rcvd: 51
+
+
+Complete source code
+~~~~~~~~~~~~~~~~~~~~
+.. literalinclude:: ../../examples/inplace_callbacks.py
+    :language: python

pythonmod/doc/examples/index.rst

@@ -1,15 +1,16 @@
 .. _Tutorials:
 
-==============================
+Examples
+========
+
+Here you can find several tutorials which clarify the usage and capabilities of
+the Unbound scriptable interface. 
+
 Tutorials
-==============================
-
-Here you can find several tutorials which clarify the usage and capabilities of Unbound scriptable interface. 
-
-`Tutorials`
+---------
 
 .. toctree::
-	:maxdepth: 2
-	:glob:
+    :maxdepth: 2
+    :glob:
 
-	example*
+    example*

pythonmod/doc/install.rst

@@ -1,39 +1,44 @@
 Installation
-===================================
+============
 
-**Prerequisites**
+Prerequisites
+-------------
 
 Python 2.4 or higher, SWIG 1.3 or higher, GNU make
 
-**Download**
+Download
+--------
 
 You can download the source codes `here`_.
 The latest release is 1.1.1, Jan 15, 2009.
 
 .. _here: unbound-1.1.1-py.tar.gz
 
-**Compiling**
+Compiling
+---------
 
 After downloading, you can compile the Unbound library by doing::
 
-	> tar -xzf unbound-1.1.1-py.tar.gz
-	> cd unbound-1.1.1
-	> ./configure --with-pythonmodule
-	> make
+    > tar -xzf unbound-1.1.1-py.tar.gz
+    > cd unbound-1.1.1
+    > ./configure --with-pythonmodule
+    > make
 
 You need GNU make to compile sources.
 SWIG and Python devel libraries to compile extension module. 
 
-**Testing**
+Testing
+-------
 
 If the compilation is successful, you can test the extension module by::
 
-	> cd pythonmod
-	> make sudo # or "make test" or "make suexec"
+    > cd pythonmod
+    > make sudo # or "make test" or "make suexec"
 
-This will start unbound server with language dictionary service (see :ref:`Tutorials`).
+This will start unbound server with language dictionary service
+(see :ref:`Tutorials`).
 In order to test this service, type::
-  
+
    > dig TXT @127.0.0.1 aught.en._dict_.cz
 
 Dig should print this message (czech equivalent of aught)::
@@ -44,16 +49,17 @@ Dig should print this message (czech equivalent of aught)::
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30085
    ;; flags: aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
-   
+
    ;; QUESTION SECTION:
-   ;aught.en._dict_.cz.		IN	TXT
-   
+   ;aught.en._dict_.cz.     IN  TXT
+
    ;; ANSWER SECTION:
-   aught.en._dict_.cz.	300	IN	TXT	"nic"
-   
+   aught.en._dict_.cz.  300 IN  TXT "nic"
+
    ;; Query time: 11 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Thu Jan 10 16:45:58 2009
    ;; MSG SIZE  rcvd: 52
 
-The ``pythonmod/examples`` directory contains simple applications written in Python.
+The ``pythonmod/examples`` directory contains simple applications written in
+Python.

pythonmod/doc/modules/config.rst

@@ -311,7 +311,7 @@ config_file
    
    .. attribute:: local_data
    
-      Local data RRs configged.
+      Local data RRs configured.
 
    .. attribute:: remote_control_enable
    

pythonmod/doc/modules/env.rst

@@ -68,7 +68,7 @@ Module event
    
 .. data:: module_event_error
 
-   Error occured.
+   Error occurred.
 
 Security status
 ~~~~~~~~~~~~~~~~

pythonmod/doc/modules/functions.rst

@@ -7,25 +7,26 @@ Network
 .. function:: ntohs(netshort)
 
    This subroutine converts values between the host and network byte order. 
-   Specifically, **ntohs()** converts 16-bit quantities from network byte order to host byte order.
-   
+   Specifically, **ntohs()** converts 16-bit quantities from network byte order
+   to host byte order.
+
    :param netshort: 16-bit short addr
    :rtype: converted addr
-   
-   
+
+
 Cache
 -----
 
 .. function:: storeQueryInCache(qstate, qinfo, msgrep, is_referral)
 
    Store pending query in local cache.
-   
+
    :param qstate: :class:`module_qstate`
    :param qinfo: :class:`query_info`
    :param msgrep: :class:`reply_info`
    :param is_referal: integer
    :rtype: boolean
-   
+
 .. function:: invalidateQueryInCache(qstate, qinfo)
 
    Invalidate record in local cache.
@@ -34,6 +35,111 @@ Cache
    :param qinfo: :class:`query_info`
 
 
+EDNS options
+------------
+
+.. function:: register_edns_option(env, code, bypass_cache_stage=False, no_aggregation=False)
+
+    Register EDNS option code.
+
+    :param env: :class:`module_env`
+    :param code: option code(integer)
+    :param bypass_cache_stage: whether to bypass the cache response stage
+    :param no_aggregation: whether this query should be unique
+    :return: ``1`` if successful, ``0`` otherwise
+    :rtype: integer
+
+.. function:: edns_opt_list_find(list, code)
+
+    Find the EDNS option code in the EDNS option list.
+
+    :param list: linked list of :class:`edns_option`
+    :param code: option code (integer)
+    :return: the edns option if found or None
+    :rtype: :class:`edns_option` or None
+
+.. function:: edns_opt_list_remove(list, code);
+
+    Remove an ENDS option code from the list.
+    .. note:: All :class:`edns_option` with the code will be removed
+
+    :param list: linked list of :class:`edns_option`
+    :param code: option code (integer)
+    :return: ``1`` if at least one :class:`edns_option` was removed, ``0`` otherwise
+    :rtype: integer
+
+.. function:: edns_opt_list_append(list, code, data, region)
+
+    Append given EDNS option code with data to the list.
+
+    :param list: linked list of :class:`edns_option`
+    :param code: option code (integer)
+    :param data: EDNS data. **Must** be a :class:`bytearray`
+    :param region: :class:`regional`
+
+.. function:: edns_opt_list_is_empty(list)
+
+    Check if an EDNS option list is empty.
+
+    :param list: linked list of :class:`edns_option`
+    :return: ``1`` if list is empty, ``0`` otherwise
+    :rtype: integer
+
+
+Inplace callbacks
+-----------------
+
+.. function:: inplace_cb_reply(qinfo, qstate, rep, rcode, edns, opt_list_out, region)
+
+    Function prototype for callback functions used in
+    `register_inplace_cb_reply`_, `register_inplace_cb_reply_cache`_,
+    `register_inplace_cb_reply_local` and `register_inplace_cb_reply_servfail`.
+
+    :param qinfo: :class:`query_info`
+    :param qstate: :class:`module_qstate`
+    :param rep: :class:`reply_info`
+    :param rcode: return code (integer), check ``RCODE_`` constants.
+    :param edns: :class:`edns_data`
+    :param opt_list_out: :class:`edns_option`. EDNS option list to append options to.
+    :param region: :class:`regional`
+
+.. function:: register_inplace_cb_reply(py_cb, env)
+
+    Register py_cb as an inplace reply callback function.
+
+    :param py_cb: Python function that follows `inplace_cb_reply`_'s prototype. **Must** be callable.
+    :param env: :class:`module_env`
+    :return: True on success, False otherwise
+    :rtype: boolean
+
+.. function:: register_inplace_cb_reply_cache(py_cb, env)
+
+    Register py_cb as an inplace reply_cache callback function.
+
+    :param py_cb: Python function that follows `inplace_cb_reply`_'s prototype. **Must** be callable.
+    :param env: :class:`module_env`
+    :return: True on success, False otherwise
+    :rtype: boolean
+
+.. function:: register_inplace_cb_reply_local(py_cb, env)
+
+    Register py_cb as an inplace reply_local callback function.
+
+    :param py_cb: Python function that follows `inplace_cb_reply`_'s prototype. **Must** be callable.
+    :param env: :class:`module_env`
+    :return: True on success, False otherwise
+    :rtype: boolean
+
+.. function:: register_inplace_cb_reply_servfail(py_cb, env)
+
+    Register py_cb as an inplace reply_servfail callback function.
+
+    :param py_cb: Python function that follows `inplace_cb_reply`_'s prototype. **Must** be callable.
+    :param env: :class:`module_env`
+    :return: True on success, False otherwise
+    :rtype: boolean
+
+
 Logging
 -------
 
@@ -71,50 +177,51 @@ Logging
    :param msg: string desc to accompany the hexdump.
    :param data: data to dump in hex format.
    :param length: length of data.
-   
+
 .. function:: log_dns_msg(str, qinfo, reply)
 
    Log DNS message.
-   
+
    :param str: string message
    :param qinfo: :class:`query_info`
    :param reply: :class:`reply_info`
-   
+
 .. function:: log_query_info(verbosity_value, str, qinf)
 
    Log query information.
-   
+
    :param verbosity_value: see constants
    :param str: string message
    :param qinf: :class:`query_info`
-   
+
 .. function:: regional_log_stats(r)
 
    Log regional statistics.
-   
+
    :param r: :class:`regional`
 
+
 Debugging
 ---------
 
 .. function:: strextstate(module_ext_state)
 
    Debug utility, module external qstate to string.
-   
+
    :param module_ext_state: the state value.
    :rtype: descriptive string.
 
 .. function:: strmodulevent(module_event)
 
    Debug utility, module event to string.
-   
+
    :param module_event: the module event value.
    :rtype: descriptive string.
-   
+
 .. function:: ldns_rr_type2str(atype)
 
    Convert RR type to string.
-   
+
 .. function:: ldns_rr_class2str(aclass)
 
    Convert RR class to string.

pythonmod/doc/modules/struct.rst

@@ -6,55 +6,94 @@ module_qstate
 
 .. class:: module_qstate
 
-   Module state, per query.
-   
-   This class provides these data attributes:
-   
-   .. attribute:: qinfo
-   
-      (:class:`query_info`) Informations about query being answered. Name, RR type, RR class.
-   
-   .. attribute:: query_flags
-   
-      (uint16) Flags for query. See QF_BIT\_ predefined constants.
-      
-   .. attribute:: is_priming
-   
-      If this is a (stub or root) priming query (with hints).
-   
-   .. attribute:: reply
-   
-      comm_reply contains server replies.
-      
-   .. attribute:: return_msg
-   
-      (:class:`dns_msg`) The reply message, with message for client and calling module (read-only attribute).
-		Note that if you want to create of modify return_msg you should use :class:`DNSMessage`.
-      
-   .. attribute:: return_rcode
-   
-      The rcode, in case of error, instead of a reply message. Determines whether the return_msg contains reply.
-   
-   .. attribute:: region
-   
-      Region for this query. Cleared when query process finishes.
-   
-   .. attribute:: curmod
-   
-      Which module is executing.
-      
-   .. attribute:: ext_state[]
-   
-      Module states.
-      
-   .. attribute:: env
-   
-      Environment for this query.
-      
-   .. attribute:: mesh_info
-   
-      Mesh related information for this query.
+    Module state, per query.
 
+    This class provides these data attributes:
+
+    .. attribute:: qinfo
+
+        (:class:`query_info`) Informations about query being answered. Name, RR type, RR class.
+
+    .. attribute:: query_flags
+
+        (uint16) Flags for query. See QF_BIT\_ predefined constants.
+
+    .. attribute:: is_priming
+
+        If this is a (stub or root) priming query (with hints).
+
+    .. attribute:: reply
+
+        comm_reply contains server replies.
+
+    .. attribute:: return_msg
+
+        (:class:`dns_msg`) The reply message, with message for client and calling module (read-only attribute).
+        Note that if you want to create of modify return_msg you should use :class:`DNSMessage`.
+
+    .. attribute:: return_rcode
+
+        The rcode, in case of error, instead of a reply message. Determines whether the return_msg contains reply.
+
+    .. attribute:: region
+
+        Region for this query. Cleared when query process finishes.
+
+    .. attribute:: curmod
+
+        Which module is executing.
+
+    .. attribute:: ext_state[]
+
+        Module states.
+
+    .. attribute:: env
+
+        Environment for this query.
+
+    .. attribute:: mesh_info
+
+        Mesh related information for this query.
+
+    .. attribute:: edns_opts_front_in
+
+        Incoming EDNS options from the front end.
+
+    .. attribute:: edns_opts_front_in_iter
+
+        Iterator for `edns_opts_front_in`.
+
+    .. attribute:: edns_opts_back_out
+
+        Outgoing EDNS options to the back end.
+
+    .. attribute:: edns_opts_back_out_iter
+
+        Iterator for `edns_opts_back_out`.
+
+    .. attribute:: edns_opts_back_in
+
+        Incoming EDNS options from the back end.
+
+    .. attribute:: edns_opts_back_in_iter
+
+        Iterator for `ends_opts_back_in`.
+
+    .. attribute:: edns_opts_front_out
+
+        Outgoing EDNS options to the front end.
+
+    .. attribute:: edns_opts_front_out_iter
+
+        Iterator for `edns_opts_front_out`.
+
+    .. attribute:: no_cache_lookup
+
+        Flag to indicate whether modules should answer from the cache.
+
+    .. attribute:: no_cache_store
+
+        Flag to indicate whether modules should store answer in the cache.
 
 query_info
 ----------------
@@ -94,7 +133,57 @@ query_info
    .. attribute:: qclass_str
    
       The ``qclass`` in display presentation format (string).
-   
+
+edns_data
+---------
+
+.. class:: edns_data
+
+    This class represents the EDNS information parsed/encoded from/to a packet. It provides these data attributes:
+
+    .. attribute:: edns_present
+
+        If EDNS OPT record is present.
+
+    .. attribute:: ext_rcode
+
+        Extended RCODE.
+
+    .. attribute:: edns_version
+
+        The EDNS version number.
+
+    .. attribute:: bits
+
+        The EDNS bits field from ttl (host order): Z.
+
+    .. attribute:: udp_size
+
+        UDP reassembly size.
+
+    .. attribute:: opt_list
+
+        The EDNS option list.
+
+    .. attribute:: opt_list_iter
+
+        Iterator for `opt_list`.
+
+edns_option
+-----------
+
+.. class:: edns_option
+
+    This class represents an EDNS option (code, data) found in EDNS option lists. It provides these data attributes:
+
+    .. attribute:: code
+
+    The EDNS option code.
+
+    .. attribute:: data
+
+    The EDNS option data.
+
 reply_info
 --------------------
 
@@ -347,12 +436,12 @@ DNSMessage
    
    .. method:: __init__(self, rr_name, rr_type, rr_class = RR_CLASS_IN, query_flags = 0, default_ttl = 0)
    
-      Prepares an answer (DNS packet) from qiven information. Query flags are combination of PKT_xx contants.
+      Prepares an answer (DNS packet) from given information. Query flags are combination of PKT_xx constants.
       
    .. method:: set_return_msg(self, qstate)
    
       This method fills qstate return message according to the given informations. 
-		It takes lists of RRs in each section of answer, created necessray RRsets in wire format and store the result in :attr:`qstate.return_msg`.
+		It takes lists of RRs in each section of answer, created necessary RRsets in wire format and store the result in :attr:`qstate.return_msg`.
 		Returns 1 if OK.
    
    .. attribute:: rr_name

pythonmod/doc/usecase.rst

@@ -9,7 +9,7 @@ Synchronized with database engine, for example *MySQL*.
 
 Firewall control
 ----------------
-Control firewall (e.g. enable incomming SSH connection) with DNS query signed with private key. 
+Control firewall (e.g. enable incoming SSH connection) with DNS query signed with private key. 
 So firewall can blocks every service during normal operation.
 
 Scriptable DNS-based blacklist (DNS-BL_)