configure updated.

git-svn-id: file:///svn/unbound/branches/beta-0.7@762 be551aaa-1e26-0410-a405-d3ace91eadb9

.gitattributes

@@ -1 +0,0 @@
-testdata/*.[0-9] linguist-documentation

.gitignore

@@ -1,39 +0,0 @@
-*.lo
-*.o
-/.libs/
-/Makefile
-/autom4te.cache/
-/config.h
-/config.log
-/config.status
-/dnstap/dnstap_config.h
-/dnscrypt/dnscrypt_config.h
-/doc/example.conf
-/doc/libunbound.3
-/doc/unbound-anchor.8
-/doc/unbound-checkconf.8
-/doc/unbound-control.8
-/doc/unbound-host.1
-/doc/unbound.8
-/doc/unbound.conf.5
-/libtool
-/libunbound.la
-/smallapp/unbound-control-setup.sh
-/unbound
-/unbound-anchor
-/unbound-checkconf
-/unbound-control
-/unbound-control-setup
-/unbound-host
-/unbound.h
-/asynclook
-/delayer
-/lock-verify
-/memstats
-/perf
-/petal
-/pktview
-/streamtcp
-/testbound
-/unittest
-

LICENSE

@@ -18,13 +18,13 @@ be used to endorse or promote products derived from this software without
 specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
-TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.

README

@@ -1,9 +1,9 @@
 Unbound README
 * ./configure && make && make install
-* You can use libevent if you want. libevent is useful when using 
-  many (10000) outgoing ports. By default max 256 ports are opened at
-  the same time and the builtin alternative is equally capable and a 
-  little faster.
+* on BSDs and Solaris use gmake (GNU make).
+* If it complains that no libevent can be found; libevent is useful when
+  using many (10000) outgoing ports. By default 16 ports are used and the
+  builtin alternative is equally capable.
 * More detailed README, README.svn, README.tests in doc directory
 * manual pages can be found in doc directory, and are installed, unbound(8).
 * example configuration file doc/example.conf

ac_pkg_swig.m4

@@ -1,133 +0,0 @@
-# ===========================================================================
-#              http://autoconf-archive.cryp.to/ac_pkg_swig.html
-# ===========================================================================
-#
-# SYNOPSIS
-#
-#   AC_PROG_SWIG([major.minor.micro])
-#
-# DESCRIPTION
-#
-#   This macro searches for a SWIG installation on your system. If found you
-#   should call SWIG via $(SWIG). You can use the optional first argument to
-#   check if the version of the available SWIG is greater than or equal to
-#   the value of the argument. It should have the format: N[.N[.N]] (N is a
-#   number between 0 and 999. Only the first N is mandatory.)
-#
-#   If the version argument is given (e.g. 1.3.17), AC_PROG_SWIG checks that
-#   the swig package is this version number or higher.
-#
-#   In configure.in, use as:
-#
-#     AC_PROG_SWIG(1.3.17)
-#     SWIG_ENABLE_CXX
-#     SWIG_MULTI_MODULE_SUPPORT
-#     SWIG_PYTHON
-#
-# LAST MODIFICATION
-#
-#   2008-04-12
-#
-# COPYLEFT
-#
-#   Copyright (c) 2008 Sebastian Huber <sebastian-huber@web.de>
-#   Copyright (c) 2008 Alan W. Irwin <irwin@beluga.phys.uvic.ca>
-#   Copyright (c) 2008 Rafael Laboissiere <rafael@laboissiere.net>
-#   Copyright (c) 2008 Andrew Collier <colliera@ukzn.ac.za>
-#
-#   This program is free software; you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation; either version 2 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Macro Archive. When you make and
-#   distribute a modified version of the Autoconf Macro, you may extend this
-#   special exception to the GPL to apply to your modified version as well.
-
-AC_DEFUN([AC_PROG_SWIG],[
-        AC_PATH_PROG([SWIG],[swig])
-        if test -z "$SWIG" ; then
-                AC_MSG_WARN([cannot find 'swig' program. You should look at http://www.swig.org])
-                SWIG='echo "Error: SWIG is not installed. You should look at http://www.swig.org" ; false'
-        elif test -n "$1" ; then
-                AC_MSG_CHECKING([for SWIG version])
-                [swig_version=`$SWIG -version 2>&1 | grep 'SWIG Version' | sed 's/.*\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*/\1/g'`]
-                AC_MSG_RESULT([$swig_version])
-                if test -n "$swig_version" ; then
-                        # Calculate the required version number components
-                        [required=$1]
-                        [required_major=`echo $required | sed 's/[^0-9].*//'`]
-                        if test -z "$required_major" ; then
-                                [required_major=0]
-                        fi
-                        [required=`echo $required | sed 's/[0-9]*[^0-9]//'`]
-                        [required_minor=`echo $required | sed 's/[^0-9].*//'`]
-                        if test -z "$required_minor" ; then
-                                [required_minor=0]
-                        fi
-                        [required=`echo $required | sed 's/[0-9]*[^0-9]//'`]
-                        [required_patch=`echo $required | sed 's/[^0-9].*//'`]
-                        if test -z "$required_patch" ; then
-                                [required_patch=0]
-                        fi
-                        # Calculate the available version number components
-                        [available=$swig_version]
-                        [available_major=`echo $available | sed 's/[^0-9].*//'`]
-                        if test -z "$available_major" ; then
-                                [available_major=0]
-                        fi
-                        [available=`echo $available | sed 's/[0-9]*[^0-9]//'`]
-                        [available_minor=`echo $available | sed 's/[^0-9].*//'`]
-                        if test -z "$available_minor" ; then
-                                [available_minor=0]
-                        fi
-                        [available=`echo $available | sed 's/[0-9]*[^0-9]//'`]
-                        [available_patch=`echo $available | sed 's/[^0-9].*//'`]
-                        if test -z "$available_patch" ; then
-                                [available_patch=0]
-                        fi
-			[badversion=0]
-			if test $available_major -lt $required_major ; then
-				[badversion=1]
-			fi
-                        if test $available_major -eq $required_major \
-                                -a $available_minor -lt $required_minor ; then
-				[badversion=1]
-			fi
-                        if test $available_major -eq $required_major \
-                                -a $available_minor -eq $required_minor \
-                                -a $available_patch -lt $required_patch ; then
-				[badversion=1]
-			fi
-			if test $badversion -eq 1 ; then
-                                AC_MSG_WARN([SWIG version >= $1 is required.  You have $swig_version.  You should look at http://www.swig.org])
-                                SWIG='echo "Error: SWIG version >= $1 is required.  You have '"$swig_version"'.  You should look at http://www.swig.org" ; false'
-                        else
-                                AC_MSG_NOTICE([SWIG executable is '$SWIG'])
-                                SWIG_LIB=`$SWIG -swiglib`
-                                AC_MSG_NOTICE([SWIG library directory is '$SWIG_LIB'])
-                        fi
-                else
-                        AC_MSG_WARN([cannot determine SWIG version])
-                        SWIG='echo "Error: Cannot determine SWIG version.  You should look at http://www.swig.org" ; false'
-                fi
-        fi
-        AC_SUBST([SWIG_LIB])
-])

acx_pthread.m4

@@ -0,0 +1,280 @@
+##### http://autoconf-archive.cryp.to/acx_pthread.html
+#
+# SYNOPSIS
+#
+#   ACX_PTHREAD([ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]])
+#
+# DESCRIPTION
+#
+#   This macro figures out how to build C programs using POSIX threads.
+#   It sets the PTHREAD_LIBS output variable to the threads library and
+#   linker flags, and the PTHREAD_CFLAGS output variable to any special
+#   C compiler flags that are needed. (The user can also force certain
+#   compiler flags/libs to be tested by setting these environment
+#   variables.)
+#
+#   Also sets PTHREAD_CC to any special C compiler that is needed for
+#   multi-threaded programs (defaults to the value of CC otherwise).
+#   (This is necessary on AIX to use the special cc_r compiler alias.)
+#
+#   NOTE: You are assumed to not only compile your program with these
+#   flags, but also link it with them as well. e.g. you should link
+#   with $PTHREAD_CC $CFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS
+#   $LIBS
+#
+#   If you are only building threads programs, you may wish to use
+#   these variables in your default LIBS, CFLAGS, and CC:
+#
+#          LIBS="$PTHREAD_LIBS $LIBS"
+#          CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+#          CC="$PTHREAD_CC"
+#
+#   In addition, if the PTHREAD_CREATE_JOINABLE thread-attribute
+#   constant has a nonstandard name, defines PTHREAD_CREATE_JOINABLE to
+#   that name (e.g. PTHREAD_CREATE_UNDETACHED on AIX).
+#
+#   ACTION-IF-FOUND is a list of shell commands to run if a threads
+#   library is found, and ACTION-IF-NOT-FOUND is a list of commands to
+#   run it if it is not found. If ACTION-IF-FOUND is not specified, the
+#   default action will define HAVE_PTHREAD.
+#
+#   Please let the authors know if this macro fails on any platform, or
+#   if you have any other suggestions or comments. This macro was based
+#   on work by SGJ on autoconf scripts for FFTW (http://www.fftw.org/)
+#   (with help from M. Frigo), as well as ac_pthread and hb_pthread
+#   macros posted by Alejandro Forero Cuervo to the autoconf macro
+#   repository. We are also grateful for the helpful feedback of
+#   numerous users.
+#
+# LAST MODIFICATION
+#
+#   2006-05-29
+#
+# COPYLEFT
+#
+#   Copyright (c) 2006 Steven G. Johnson <stevenj@alum.mit.edu>
+#
+#   This program is free software; you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation; either version 2 of the
+#   License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful, but
+#   WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+#   General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program; if not, write to the Free Software
+#   Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+#   02111-1307, USA.
+#
+#   As a special exception, the respective Autoconf Macro's copyright
+#   owner gives unlimited permission to copy, distribute and modify the
+#   configure scripts that are the output of Autoconf when processing
+#   the Macro. You need not follow the terms of the GNU General Public
+#   License when using or distributing such scripts, even though
+#   portions of the text of the Macro appear in them. The GNU General
+#   Public License (GPL) does govern all other use of the material that
+#   constitutes the Autoconf Macro.
+#
+#   This special exception to the GPL applies to versions of the
+#   Autoconf Macro released by the Autoconf Macro Archive. When you
+#   make and distribute a modified version of the Autoconf Macro, you
+#   may extend this special exception to the GPL to apply to your
+#   modified version as well.
+
+AC_DEFUN([ACX_PTHREAD], [
+AC_REQUIRE([AC_CANONICAL_HOST])
+AC_LANG_SAVE
+AC_LANG_C
+acx_pthread_ok=no
+
+# We used to check for pthread.h first, but this fails if pthread.h
+# requires special compiler flags (e.g. on True64 or Sequent).
+# It gets checked for in the link test anyway.
+
+# First of all, check if the user has set any of the PTHREAD_LIBS,
+# etcetera environment variables, and if threads linking works using
+# them:
+if test x"$PTHREAD_LIBS$PTHREAD_CFLAGS" != x; then
+        save_CFLAGS="$CFLAGS"
+        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+        save_LIBS="$LIBS"
+        LIBS="$PTHREAD_LIBS $LIBS"
+        AC_MSG_CHECKING([for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS])
+        AC_TRY_LINK_FUNC(pthread_join, acx_pthread_ok=yes)
+        AC_MSG_RESULT($acx_pthread_ok)
+        if test x"$acx_pthread_ok" = xno; then
+                PTHREAD_LIBS=""
+                PTHREAD_CFLAGS=""
+        fi
+        LIBS="$save_LIBS"
+        CFLAGS="$save_CFLAGS"
+fi
+
+# We must check for the threads library under a number of different
+# names; the ordering is very important because some systems
+# (e.g. DEC) have both -lpthread and -lpthreads, where one of the
+# libraries is broken (non-POSIX).
+
+# Create a list of thread flags to try.  Items starting with a "-" are
+# C compiler flags, and other items are library names, except for "none"
+# which indicates that we try without any flags at all, and "pthread-config"
+# which is a program returning the flags for the Pth emulation library.
+
+acx_pthread_flags="pthreads none -Kthread -kthread lthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"
+
+# The ordering *is* (sometimes) important.  Some notes on the
+# individual items follow:
+
+# pthreads: AIX (must check this before -lpthread)
+# none: in case threads are in libc; should be tried before -Kthread and
+#       other compiler flags to prevent continual compiler warnings
+# -Kthread: Sequent (threads in libc, but -Kthread needed for pthread.h)
+# -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able)
+# lthread: LinuxThreads port on FreeBSD (also preferred to -pthread)
+# -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads)
+# -pthreads: Solaris/gcc
+# -mthreads: Mingw32/gcc, Lynx/gcc
+# -mt: Sun Workshop C (may only link SunOS threads [-lthread], but it
+#      doesn't hurt to check since this sometimes defines pthreads too;
+#      also defines -D_REENTRANT)
+#      ... -mt is also the pthreads flag for HP/aCC
+# pthread: Linux, etcetera
+# --thread-safe: KAI C++
+# pthread-config: use pthread-config program (for GNU Pth library)
+
+case "${host_cpu}-${host_os}" in
+        *solaris*)
+
+        # On Solaris (at least, for some versions), libc contains stubbed
+        # (non-functional) versions of the pthreads routines, so link-based
+        # tests will erroneously succeed.  (We need to link with -pthreads/-mt/
+        # -lpthread.)  (The stubs are missing pthread_cleanup_push, or rather
+        # a function called by this macro, so we could check for that, but
+        # who knows whether they'll stub that too in a future libc.)  So,
+        # we'll just look for -pthreads and -lpthread first:
+
+        acx_pthread_flags="-pthreads pthread -mt -pthread $acx_pthread_flags"
+        ;;
+esac
+
+if test x"$acx_pthread_ok" = xno; then
+for flag in $acx_pthread_flags; do
+
+        case $flag in
+                none)
+                AC_MSG_CHECKING([whether pthreads work without any flags])
+                ;;
+
+                -*)
+                AC_MSG_CHECKING([whether pthreads work with $flag])
+                PTHREAD_CFLAGS="$flag"
+                ;;
+
+		pthread-config)
+		AC_CHECK_PROG(acx_pthread_config, pthread-config, yes, no)
+		if test x"$acx_pthread_config" = xno; then continue; fi
+		PTHREAD_CFLAGS="`pthread-config --cflags`"
+		PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
+		;;
+
+                *)
+                AC_MSG_CHECKING([for the pthreads library -l$flag])
+                PTHREAD_LIBS="-l$flag"
+                ;;
+        esac
+
+        save_LIBS="$LIBS"
+        save_CFLAGS="$CFLAGS"
+        LIBS="$PTHREAD_LIBS $LIBS"
+        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+
+        # Check for various functions.  We must include pthread.h,
+        # since some functions may be macros.  (On the Sequent, we
+        # need a special flag -Kthread to make this header compile.)
+        # We check for pthread_join because it is in -lpthread on IRIX
+        # while pthread_create is in libc.  We check for pthread_attr_init
+        # due to DEC craziness with -lpthreads.  We check for
+        # pthread_cleanup_push because it is one of the few pthread
+        # functions on Solaris that doesn't have a non-functional libc stub.
+        # We try pthread_create on general principles.
+        AC_TRY_LINK([#include <pthread.h>],
+                    [pthread_t th; pthread_join(th, 0);
+                     pthread_attr_init(0); pthread_cleanup_push(0, 0);
+                     pthread_create(0,0,0,0); pthread_cleanup_pop(0); ],
+                    [acx_pthread_ok=yes])
+
+        LIBS="$save_LIBS"
+        CFLAGS="$save_CFLAGS"
+
+        AC_MSG_RESULT($acx_pthread_ok)
+        if test "x$acx_pthread_ok" = xyes; then
+                break;
+        fi
+
+        PTHREAD_LIBS=""
+        PTHREAD_CFLAGS=""
+done
+fi
+
+# Various other checks:
+if test "x$acx_pthread_ok" = xyes; then
+        save_LIBS="$LIBS"
+        LIBS="$PTHREAD_LIBS $LIBS"
+        save_CFLAGS="$CFLAGS"
+        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+
+        # Detect AIX lossage: JOINABLE attribute is called UNDETACHED.
+	AC_MSG_CHECKING([for joinable pthread attribute])
+	attr_name=unknown
+	for attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
+	    AC_TRY_LINK([#include <pthread.h>], [int attr=$attr; return attr;],
+                        [attr_name=$attr; break])
+	done
+        AC_MSG_RESULT($attr_name)
+        if test "$attr_name" != PTHREAD_CREATE_JOINABLE; then
+            AC_DEFINE_UNQUOTED(PTHREAD_CREATE_JOINABLE, $attr_name,
+                               [Define to necessary symbol if this constant
+                                uses a non-standard name on your system.])
+        fi
+
+        AC_MSG_CHECKING([if more special flags are required for pthreads])
+        flag=no
+        case "${host_cpu}-${host_os}" in
+            *-aix* | *-freebsd* | *-darwin*) flag="-D_THREAD_SAFE";;
+            *solaris* | *-osf* | *-hpux*) flag="-D_REENTRANT";;
+        esac
+        AC_MSG_RESULT(${flag})
+        if test "x$flag" != xno; then
+            PTHREAD_CFLAGS="$flag $PTHREAD_CFLAGS"
+        fi
+
+        LIBS="$save_LIBS"
+        CFLAGS="$save_CFLAGS"
+
+        # More AIX lossage: must compile with xlc_r or cc_r
+	if test x"$GCC" != xyes; then
+          AC_CHECK_PROGS(PTHREAD_CC, xlc_r cc_r, ${CC})
+        else
+          PTHREAD_CC=$CC
+	fi
+else
+        PTHREAD_CC="$CC"
+fi
+
+AC_SUBST(PTHREAD_LIBS)
+AC_SUBST(PTHREAD_CFLAGS)
+AC_SUBST(PTHREAD_CC)
+
+# Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
+if test x"$acx_pthread_ok" = xyes; then
+        ifelse([$1],,AC_DEFINE(HAVE_PTHREAD,1,[Define if you have POSIX threads libraries and header files.]),[$1])
+        :
+else
+        acx_pthread_ok=no
+        $2
+fi
+AC_LANG_RESTORE
+])dnl ACX_PTHREAD

acx_python.m4

@@ -1,114 +0,0 @@
-AC_DEFUN([AC_PYTHON_DEVEL],[
-        #
-        # Allow the use of a (user set) custom python version
-        #
-        AC_ARG_VAR([PYTHON_VERSION],[The installed Python
-                version to use, for example '2.3'. This string
-                will be appended to the Python interpreter
-                canonical name.])
-
-        AC_PATH_PROG([PYTHON],[python[$PYTHON_VERSION]])
-        if test -z "$PYTHON"; then
-           AC_MSG_ERROR([Cannot find python$PYTHON_VERSION in your system path])
-           PYTHON_VERSION=""
-        fi
-
-        if test -z "$PYTHON_VERSION"; then
-		PYTHON_VERSION=`$PYTHON -c "import sys; \
-			print(sys.version.split()[[0]])"`
-	fi
-
-        #
-        # Check if you have distutils, else fail
-        #
-        AC_MSG_CHECKING([for the distutils Python package])
-        if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then
-                AC_MSG_RESULT([yes])
-        else
-                AC_MSG_RESULT([no])
-                AC_MSG_ERROR([cannot import Python module "distutils".
-Please check your Python installation. The error was:
-$ac_distutils_result])
-                PYTHON_VERSION=""
-        fi
-
-        #
-        # Check for Python include path
-        #
-        AC_MSG_CHECKING([for Python include path])
-        if test -z "$PYTHON_CPPFLAGS"; then
-                python_path=`$PYTHON -c "import distutils.sysconfig; \
-                        print(distutils.sysconfig.get_python_inc());"`
-                if test -n "${python_path}"; then
-                        python_path="-I$python_path"
-                fi
-                PYTHON_CPPFLAGS=$python_path
-        fi
-        AC_MSG_RESULT([$PYTHON_CPPFLAGS])
-        AC_SUBST([PYTHON_CPPFLAGS])
-
-        #
-        # Check for Python library path
-        #
-        AC_MSG_CHECKING([for Python library path])
-        if test -z "$PYTHON_LDFLAGS"; then
-                PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
-                        print('-L'+get_config_var('LIBDIR')+' -L'+get_config_var('LIBDEST')+' '+get_config_var('BLDLIBRARY'));"`
-        fi
-        AC_MSG_RESULT([$PYTHON_LDFLAGS])
-        AC_SUBST([PYTHON_LDFLAGS])
-
-        #
-        # Check for site packages
-        #
-        AC_MSG_CHECKING([for Python site-packages path])
-        if test -z "$PYTHON_SITE_PKG"; then
-                PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
-                        print(distutils.sysconfig.get_python_lib(1,0));"`
-        fi
-        AC_MSG_RESULT([$PYTHON_SITE_PKG])
-        AC_SUBST([PYTHON_SITE_PKG])
-
-        #
-        # final check to see if everything compiles alright
-        #
-        AC_MSG_CHECKING([consistency of all components of python development environment])
-        AC_LANG_PUSH([C])
-        # save current global flags
-        ac_save_LIBS="$LIBS"
-        ac_save_CPPFLAGS="$CPPFLAGS"
-
-        LIBS="$LIBS $PYTHON_LDFLAGS"
-        CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
-        AC_TRY_LINK([
-                #include <Python.h>
-        ],[
-                Py_Initialize();
-        ],[pythonexists=yes],[pythonexists=no])
-
-        AC_MSG_RESULT([$pythonexists])
-
-        if test ! "$pythonexists" = "yes"; then
-           AC_MSG_ERROR([
-  Could not link test program to Python. Maybe the main Python library has been
-  installed in some non-standard library path. If so, pass it to configure,
-  via the LDFLAGS environment variable.
-  Example: ./configure LDFLAGS="-L/usr/non-standard-path/python/lib"
-  ============================================================================
-   ERROR!
-   You probably have to install the development version of the Python package
-   for your distribution.  The exact name of this package varies among them.
-  ============================================================================
-           ])
-          PYTHON_VERSION=""
-        fi
-        AC_LANG_POP
-        # turn back to default flags
-        CPPFLAGS="$ac_save_CPPFLAGS"
-        LIBS="$ac_save_LIBS"
-
-        #
-        # all done!
-        #
-])
-

ax_pthread.m4

@@ -1,332 +0,0 @@
-# ===========================================================================
-#        http://www.gnu.org/software/autoconf-archive/ax_pthread.html
-# ===========================================================================
-#
-# SYNOPSIS
-#
-#   AX_PTHREAD([ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]])
-#
-# DESCRIPTION
-#
-#   This macro figures out how to build C programs using POSIX threads. It
-#   sets the PTHREAD_LIBS output variable to the threads library and linker
-#   flags, and the PTHREAD_CFLAGS output variable to any special C compiler
-#   flags that are needed. (The user can also force certain compiler
-#   flags/libs to be tested by setting these environment variables.)
-#
-#   Also sets PTHREAD_CC to any special C compiler that is needed for
-#   multi-threaded programs (defaults to the value of CC otherwise). (This
-#   is necessary on AIX to use the special cc_r compiler alias.)
-#
-#   NOTE: You are assumed to not only compile your program with these flags,
-#   but also link it with them as well. e.g. you should link with
-#   $PTHREAD_CC $CFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS
-#
-#   If you are only building threads programs, you may wish to use these
-#   variables in your default LIBS, CFLAGS, and CC:
-#
-#     LIBS="$PTHREAD_LIBS $LIBS"
-#     CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
-#     CC="$PTHREAD_CC"
-#
-#   In addition, if the PTHREAD_CREATE_JOINABLE thread-attribute constant
-#   has a nonstandard name, defines PTHREAD_CREATE_JOINABLE to that name
-#   (e.g. PTHREAD_CREATE_UNDETACHED on AIX).
-#
-#   Also HAVE_PTHREAD_PRIO_INHERIT is defined if pthread is found and the
-#   PTHREAD_PRIO_INHERIT symbol is defined when compiling with
-#   PTHREAD_CFLAGS.
-#
-#   ACTION-IF-FOUND is a list of shell commands to run if a threads library
-#   is found, and ACTION-IF-NOT-FOUND is a list of commands to run it if it
-#   is not found. If ACTION-IF-FOUND is not specified, the default action
-#   will define HAVE_PTHREAD.
-#
-#   Please let the authors know if this macro fails on any platform, or if
-#   you have any other suggestions or comments. This macro was based on work
-#   by SGJ on autoconf scripts for FFTW (http://www.fftw.org/) (with help
-#   from M. Frigo), as well as ac_pthread and hb_pthread macros posted by
-#   Alejandro Forero Cuervo to the autoconf macro repository. We are also
-#   grateful for the helpful feedback of numerous users.
-#
-#   Updated for Autoconf 2.68 by Daniel Richard G.
-#
-# LICENSE
-#
-#   Copyright (c) 2008 Steven G. Johnson <stevenj@alum.mit.edu>
-#   Copyright (c) 2011 Daniel Richard G. <skunk@iSKUNK.ORG>
-#
-#   This program is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation, either version 3 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Archive. When you make and distribute a
-#   modified version of the Autoconf Macro, you may extend this special
-#   exception to the GPL to apply to your modified version as well.
-
-#serial 21
-
-AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD])
-AC_DEFUN([AX_PTHREAD], [
-AC_REQUIRE([AC_CANONICAL_HOST])
-AC_LANG_PUSH([C])
-ax_pthread_ok=no
-
-# We used to check for pthread.h first, but this fails if pthread.h
-# requires special compiler flags (e.g. on True64 or Sequent).
-# It gets checked for in the link test anyway.
-
-# First of all, check if the user has set any of the PTHREAD_LIBS,
-# etcetera environment variables, and if threads linking works using
-# them:
-if test x"$PTHREAD_LIBS$PTHREAD_CFLAGS" != x; then
-        save_CFLAGS="$CFLAGS"
-        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
-        save_LIBS="$LIBS"
-        LIBS="$PTHREAD_LIBS $LIBS"
-        AC_MSG_CHECKING([for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS])
-        AC_TRY_LINK_FUNC([pthread_join], [ax_pthread_ok=yes])
-        AC_MSG_RESULT([$ax_pthread_ok])
-        if test x"$ax_pthread_ok" = xno; then
-                PTHREAD_LIBS=""
-                PTHREAD_CFLAGS=""
-        fi
-        LIBS="$save_LIBS"
-        CFLAGS="$save_CFLAGS"
-fi
-
-# We must check for the threads library under a number of different
-# names; the ordering is very important because some systems
-# (e.g. DEC) have both -lpthread and -lpthreads, where one of the
-# libraries is broken (non-POSIX).
-
-# Create a list of thread flags to try.  Items starting with a "-" are
-# C compiler flags, and other items are library names, except for "none"
-# which indicates that we try without any flags at all, and "pthread-config"
-# which is a program returning the flags for the Pth emulation library.
-
-ax_pthread_flags="pthreads none -Kthread -kthread lthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"
-
-# The ordering *is* (sometimes) important.  Some notes on the
-# individual items follow:
-
-# pthreads: AIX (must check this before -lpthread)
-# none: in case threads are in libc; should be tried before -Kthread and
-#       other compiler flags to prevent continual compiler warnings
-# -Kthread: Sequent (threads in libc, but -Kthread needed for pthread.h)
-# -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able)
-# lthread: LinuxThreads port on FreeBSD (also preferred to -pthread)
-# -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads)
-# -pthreads: Solaris/gcc
-# -mthreads: Mingw32/gcc, Lynx/gcc
-# -mt: Sun Workshop C (may only link SunOS threads [-lthread], but it
-#      doesn't hurt to check since this sometimes defines pthreads too;
-#      also defines -D_REENTRANT)
-#      ... -mt is also the pthreads flag for HP/aCC
-# pthread: Linux, etcetera
-# --thread-safe: KAI C++
-# pthread-config: use pthread-config program (for GNU Pth library)
-
-case ${host_os} in
-        solaris*)
-
-        # On Solaris (at least, for some versions), libc contains stubbed
-        # (non-functional) versions of the pthreads routines, so link-based
-        # tests will erroneously succeed.  (We need to link with -pthreads/-mt/
-        # -lpthread.)  (The stubs are missing pthread_cleanup_push, or rather
-        # a function called by this macro, so we could check for that, but
-        # who knows whether they'll stub that too in a future libc.)  So,
-        # we'll just look for -pthreads and -lpthread first:
-
-        ax_pthread_flags="-pthreads pthread -mt -pthread $ax_pthread_flags"
-        ;;
-
-        darwin*)
-        ax_pthread_flags="-pthread $ax_pthread_flags"
-        ;;
-esac
-
-# Clang doesn't consider unrecognized options an error unless we specify
-# -Werror. We throw in some extra Clang-specific options to ensure that
-# this doesn't happen for GCC, which also accepts -Werror.
-
-AC_MSG_CHECKING([if compiler needs -Werror to reject unknown flags])
-save_CFLAGS="$CFLAGS"
-ax_pthread_extra_flags="-Werror"
-CFLAGS="$CFLAGS $ax_pthread_extra_flags -Wunknown-warning-option -Wsizeof-array-argument"
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([int foo(void);],[foo()])],
-                  [AC_MSG_RESULT([yes])],
-                  [ax_pthread_extra_flags=
-                   AC_MSG_RESULT([no])])
-CFLAGS="$save_CFLAGS"
-
-if test x"$ax_pthread_ok" = xno; then
-for flag in $ax_pthread_flags; do
-
-        case $flag in
-                none)
-                AC_MSG_CHECKING([whether pthreads work without any flags])
-                ;;
-
-                -*)
-                AC_MSG_CHECKING([whether pthreads work with $flag])
-                PTHREAD_CFLAGS="$flag"
-                ;;
-
-                pthread-config)
-                AC_CHECK_PROG([ax_pthread_config], [pthread-config], [yes], [no])
-                if test x"$ax_pthread_config" = xno; then continue; fi
-                PTHREAD_CFLAGS="`pthread-config --cflags`"
-                PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
-                ;;
-
-                *)
-                AC_MSG_CHECKING([for the pthreads library -l$flag])
-                PTHREAD_LIBS="-l$flag"
-                ;;
-        esac
-
-        save_LIBS="$LIBS"
-        save_CFLAGS="$CFLAGS"
-        LIBS="$PTHREAD_LIBS $LIBS"
-        CFLAGS="$CFLAGS $PTHREAD_CFLAGS $ax_pthread_extra_flags"
-
-        # Check for various functions.  We must include pthread.h,
-        # since some functions may be macros.  (On the Sequent, we
-        # need a special flag -Kthread to make this header compile.)
-        # We check for pthread_join because it is in -lpthread on IRIX
-        # while pthread_create is in libc.  We check for pthread_attr_init
-        # due to DEC craziness with -lpthreads.  We check for
-        # pthread_cleanup_push because it is one of the few pthread
-        # functions on Solaris that doesn't have a non-functional libc stub.
-        # We try pthread_create on general principles.
-        AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <pthread.h>
-                        static void routine(void *a) { *((int*)a) = 0; }
-                        static void *start_routine(void *a) { return a; }],
-                       [pthread_t th; pthread_attr_t attr;
-                        pthread_create(&th, 0, start_routine, 0);
-                        pthread_join(th, 0);
-                        pthread_attr_init(&attr);
-                        pthread_cleanup_push(routine, 0);
-                        pthread_cleanup_pop(0) /* ; */])],
-                [ax_pthread_ok=yes],
-                [])
-
-        LIBS="$save_LIBS"
-        CFLAGS="$save_CFLAGS"
-
-        AC_MSG_RESULT([$ax_pthread_ok])
-        if test "x$ax_pthread_ok" = xyes; then
-                break;
-        fi
-
-        PTHREAD_LIBS=""
-        PTHREAD_CFLAGS=""
-done
-fi
-
-# Various other checks:
-if test "x$ax_pthread_ok" = xyes; then
-        save_LIBS="$LIBS"
-        LIBS="$PTHREAD_LIBS $LIBS"
-        save_CFLAGS="$CFLAGS"
-        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
-
-        # Detect AIX lossage: JOINABLE attribute is called UNDETACHED.
-        AC_MSG_CHECKING([for joinable pthread attribute])
-        attr_name=unknown
-        for attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
-            AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <pthread.h>],
-                           [int attr = $attr; return attr /* ; */])],
-                [attr_name=$attr; break],
-                [])
-        done
-        AC_MSG_RESULT([$attr_name])
-        if test "$attr_name" != PTHREAD_CREATE_JOINABLE; then
-            AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE], [$attr_name],
-                               [Define to necessary symbol if this constant
-                                uses a non-standard name on your system.])
-        fi
-
-        AC_MSG_CHECKING([if more special flags are required for pthreads])
-        flag=no
-        case ${host_os} in
-            aix* | freebsd* | darwin*) flag="-D_THREAD_SAFE";;
-            osf* | hpux*) flag="-D_REENTRANT";;
-            solaris*)
-            if test "$GCC" = "yes"; then
-                flag="-D_REENTRANT"
-            else
-                # TODO: What about Clang on Solaris?
-                flag="-mt -D_REENTRANT"
-            fi
-            ;;
-        esac
-        AC_MSG_RESULT([$flag])
-        if test "x$flag" != xno; then
-            PTHREAD_CFLAGS="$flag $PTHREAD_CFLAGS"
-        fi
-
-        AC_CACHE_CHECK([for PTHREAD_PRIO_INHERIT],
-            [ax_cv_PTHREAD_PRIO_INHERIT], [
-                AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <pthread.h>]],
-                                                [[int i = PTHREAD_PRIO_INHERIT;]])],
-                    [ax_cv_PTHREAD_PRIO_INHERIT=yes],
-                    [ax_cv_PTHREAD_PRIO_INHERIT=no])
-            ])
-        AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes"],
-            [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.])])
-
-        LIBS="$save_LIBS"
-        CFLAGS="$save_CFLAGS"
-
-        # More AIX lossage: compile with *_r variant
-        if test "x$GCC" != xyes; then
-            case $host_os in
-                aix*)
-                AS_CASE(["x/$CC"],
-                  [x*/c89|x*/c89_128|x*/c99|x*/c99_128|x*/cc|x*/cc128|x*/xlc|x*/xlc_v6|x*/xlc128|x*/xlc128_v6],
-                  [#handle absolute path differently from PATH based program lookup
-                   AS_CASE(["x$CC"],
-                     [x/*],
-                     [AS_IF([AS_EXECUTABLE_P([${CC}_r])],[PTHREAD_CC="${CC}_r"])],
-                     [AC_CHECK_PROGS([PTHREAD_CC],[${CC}_r],[$CC])])])
-                ;;
-            esac
-        fi
-fi
-
-test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"
-
-AC_SUBST([PTHREAD_LIBS])
-AC_SUBST([PTHREAD_CFLAGS])
-AC_SUBST([PTHREAD_CC])
-
-# Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
-if test x"$ax_pthread_ok" = xyes; then
-        ifelse([$1],,[AC_DEFINE([HAVE_PTHREAD],[1],[Define if you have POSIX threads libraries and header files.])],[$1])
-        :
-else
-        ax_pthread_ok=no
-        $2
-fi
-AC_LANG_POP
-])dnl AX_PTHREAD

cachedb/cachedb.c

@@ -1,809 +0,0 @@
-/*
- * cachedb/cachedb.c - cache from a database external to the program module
- *
- * Copyright (c) 2016, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains a module that uses an external database to cache
- * dns responses.
- */
-
-#include "config.h"
-#ifdef USE_CACHEDB
-#include "cachedb/cachedb.h"
-#include "cachedb/redis.h"
-#include "util/regional.h"
-#include "util/net_help.h"
-#include "util/config_file.h"
-#include "util/data/msgreply.h"
-#include "util/data/msgencode.h"
-#include "services/cache/dns.h"
-#include "validator/val_neg.h"
-#include "validator/val_secalgo.h"
-#include "iterator/iter_utils.h"
-#include "sldns/parseutil.h"
-#include "sldns/wire2str.h"
-#include "sldns/sbuffer.h"
-
-/* header file for htobe64 */
-#ifdef HAVE_ENDIAN_H
-#  include <endian.h>
-#endif
-#ifdef HAVE_SYS_ENDIAN_H
-#  include <sys/endian.h>
-#endif
-#ifdef HAVE_LIBKERN_OSBYTEORDER_H
-/* In practice this is specific to MacOS X.  We assume it doesn't have
-* htobe64/be64toh but has alternatives with a different name. */
-#  include <libkern/OSByteOrder.h>
-#  define htobe64(x) OSSwapHostToBigInt64(x)
-#  define be64toh(x) OSSwapBigToHostInt64(x)
-#endif
-
-/** the unit test testframe for cachedb, its module state contains
- * a cache for a couple queries (in memory). */
-struct testframe_moddata {
-	/** lock for mutex */
-	lock_basic_type lock;
-	/** key for single stored data element, NULL if none */
-	char* stored_key;
-	/** data for single stored data element, NULL if none */
-	uint8_t* stored_data;
-	/** length of stored data */
-	size_t stored_datalen;
-};
-
-static int
-testframe_init(struct module_env* env, struct cachedb_env* cachedb_env)
-{
-	struct testframe_moddata* d;
-	(void)env;
-	verbose(VERB_ALGO, "testframe_init");
-	d = (struct testframe_moddata*)calloc(1,
-		sizeof(struct testframe_moddata));
-	cachedb_env->backend_data = (void*)d;
-	if(!cachedb_env->backend_data) {
-		log_err("out of memory");
-		return 0;
-	}
-	lock_basic_init(&d->lock);
-	lock_protect(&d->lock, d, sizeof(*d));
-	return 1;
-}
-
-static void
-testframe_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
-{
-	struct testframe_moddata* d = (struct testframe_moddata*)
-		cachedb_env->backend_data;
-	(void)env;
-	verbose(VERB_ALGO, "testframe_deinit");
-	if(!d)
-		return;
-	lock_basic_destroy(&d->lock);
-	free(d->stored_key);
-	free(d->stored_data);
-	free(d);
-}
-
-static int
-testframe_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
-	char* key, struct sldns_buffer* result_buffer)
-{
-	struct testframe_moddata* d = (struct testframe_moddata*)
-		cachedb_env->backend_data;
-	(void)env;
-	verbose(VERB_ALGO, "testframe_lookup of %s", key);
-	lock_basic_lock(&d->lock);
-	if(d->stored_key && strcmp(d->stored_key, key) == 0) {
-		if(d->stored_datalen > sldns_buffer_capacity(result_buffer)) {
-			lock_basic_unlock(&d->lock);
-			return 0; /* too large */
-		}
-		verbose(VERB_ALGO, "testframe_lookup found %d bytes",
-			(int)d->stored_datalen);
-		sldns_buffer_clear(result_buffer);
-		sldns_buffer_write(result_buffer, d->stored_data,
-			d->stored_datalen);
-		sldns_buffer_flip(result_buffer);
-		lock_basic_unlock(&d->lock);
-		return 1;
-	}
-	lock_basic_unlock(&d->lock);
-	return 0;
-}
-
-static void
-testframe_store(struct module_env* env, struct cachedb_env* cachedb_env,
-	char* key, uint8_t* data, size_t data_len)
-{
-	struct testframe_moddata* d = (struct testframe_moddata*)
-		cachedb_env->backend_data;
-	(void)env;
-	lock_basic_lock(&d->lock);
-	verbose(VERB_ALGO, "testframe_store %s (%d bytes)", key, (int)data_len);
-
-	/* free old data element (if any) */
-	free(d->stored_key);
-	d->stored_key = NULL;
-	free(d->stored_data);
-	d->stored_data = NULL;
-	d->stored_datalen = 0;
-
-	d->stored_data = memdup(data, data_len);
-	if(!d->stored_data) {
-		lock_basic_unlock(&d->lock);
-		log_err("out of memory");
-		return;
-	}
-	d->stored_datalen = data_len;
-	d->stored_key = strdup(key);
-	if(!d->stored_key) {
-		free(d->stored_data);
-		d->stored_data = NULL;
-		d->stored_datalen = 0;
-		lock_basic_unlock(&d->lock);
-		return;
-	}
-	lock_basic_unlock(&d->lock);
-	/* (key,data) successfully stored */
-}
-
-/** The testframe backend is for unit tests */
-static struct cachedb_backend testframe_backend = { "testframe",
-	testframe_init, testframe_deinit, testframe_lookup, testframe_store
-};
-
-/** find a particular backend from possible backends */
-static struct cachedb_backend*
-cachedb_find_backend(const char* str)
-{
-#ifdef USE_REDIS
-	if(strcmp(str, redis_backend.name) == 0)
-		return &redis_backend;
-#endif
-	if(strcmp(str, testframe_backend.name) == 0)
-		return &testframe_backend;
-	/* TODO add more backends here */
-	return NULL;
-}
-
-/** apply configuration to cachedb module 'global' state */
-static int
-cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
-{
-	const char* backend_str = cfg->cachedb_backend;
-
-	/* If unspecified we use the in-memory test DB. */
-	if(!backend_str)
-		backend_str = "testframe";
-	cachedb_env->backend = cachedb_find_backend(backend_str);
-	if(!cachedb_env->backend) {
-		log_err("cachedb: cannot find backend name '%s'", backend_str);
-		return 0;
-	}
-
-	/* TODO see if more configuration needs to be applied or not */
-	return 1;
-}
-
-int 
-cachedb_init(struct module_env* env, int id)
-{
-	struct cachedb_env* cachedb_env = (struct cachedb_env*)calloc(1,
-		sizeof(struct cachedb_env));
-	if(!cachedb_env) {
-		log_err("malloc failure");
-		return 0;
-	}
-	env->modinfo[id] = (void*)cachedb_env;
-	if(!cachedb_apply_cfg(cachedb_env, env->cfg)) {
-		log_err("cachedb: could not apply configuration settings.");
-		return 0;
-	}
-	/* see if a backend is selected */
-	if(!cachedb_env->backend || !cachedb_env->backend->name)
-		return 1;
-	if(!(*cachedb_env->backend->init)(env, cachedb_env)) {
-		log_err("cachedb: could not init %s backend",
-			cachedb_env->backend->name);
-		return 0;
-	}
-	cachedb_env->enabled = 1;
-	return 1;
-}
-
-void 
-cachedb_deinit(struct module_env* env, int id)
-{
-	struct cachedb_env* cachedb_env;
-	if(!env || !env->modinfo[id])
-		return;
-	cachedb_env = (struct cachedb_env*)env->modinfo[id];
-	/* free contents */
-	/* TODO */
-	if(cachedb_env->enabled) {
-		(*cachedb_env->backend->deinit)(env, cachedb_env);
-	}
-
-	free(cachedb_env);
-	env->modinfo[id] = NULL;
-}
-
-/** new query for cachedb */
-static int
-cachedb_new(struct module_qstate* qstate, int id)
-{
-	struct cachedb_qstate* iq = (struct cachedb_qstate*)regional_alloc(
-		qstate->region, sizeof(struct cachedb_qstate));
-	qstate->minfo[id] = iq;
-	if(!iq) 
-		return 0;
-	memset(iq, 0, sizeof(*iq));
-	/* initialise it */
-	/* TODO */
-
-	return 1;
-}
-
-/**
- * Return an error
- * @param qstate: our query state
- * @param id: module id
- * @param rcode: error code (DNS errcode).
- * @return: 0 for use by caller, to make notation easy, like:
- * 	return error_response(..). 
- */
-static int
-error_response(struct module_qstate* qstate, int id, int rcode)
-{
-	verbose(VERB_QUERY, "return error response %s", 
-		sldns_lookup_by_id(sldns_rcodes, rcode)?
-		sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??");
-	qstate->return_rcode = rcode;
-	qstate->return_msg = NULL;
-	qstate->ext_state[id] = module_finished;
-	return 0;
-}
-
-/**
- * Hash the query name, type, class and dbacess-secret into lookup buffer.
- * @param qstate: query state with query info
- * 	and env->cfg with secret.
- * @param buf: returned buffer with hash to lookup
- * @param len: length of the buffer.
- */
-static void
-calc_hash(struct module_qstate* qstate, char* buf, size_t len)
-{
-	uint8_t clear[1024];
-	size_t clen = 0;
-	uint8_t hash[CACHEDB_HASHSIZE/8];
-	const char* hex = "0123456789ABCDEF";
-	const char* secret = qstate->env->cfg->cachedb_secret ?
-		qstate->env->cfg->cachedb_secret : "default";
-	size_t i;
-
-	/* copy the hash info into the clear buffer */
-	if(clen + qstate->qinfo.qname_len < sizeof(clear)) {
-		memmove(clear+clen, qstate->qinfo.qname,
-			qstate->qinfo.qname_len);
-		clen += qstate->qinfo.qname_len;
-	}
-	if(clen + 4 < sizeof(clear)) {
-		uint16_t t = htons(qstate->qinfo.qtype);
-		uint16_t c = htons(qstate->qinfo.qclass);
-		memmove(clear+clen, &t, 2);
-		memmove(clear+clen+2, &c, 2);
-		clen += 4;
-	}
-	if(secret && secret[0] && clen + strlen(secret) < sizeof(clear)) {
-		memmove(clear+clen, secret, strlen(secret));
-		clen += strlen(secret);
-	}
-	
-	/* hash the buffer */
-	secalgo_hash_sha256(clear, clen, hash);
-	memset(clear, 0, clen);
-
-	/* hex encode output for portability (some online dbs need
-	 * no nulls, no control characters, and so on) */
-	log_assert(len >= sizeof(hash)*2 + 1);
-	(void)len;
-	for(i=0; i<sizeof(hash); i++) {
-		buf[i*2] = hex[(hash[i]&0xf0)>>4];
-		buf[i*2+1] = hex[hash[i]&0x0f];
-	}
-	buf[sizeof(hash)*2] = 0;
-}
-
-/** convert data from return_msg into the data buffer */
-static int
-prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
-{
-	uint64_t timestamp, expiry;
-	size_t oldlim;
-	struct edns_data edns;
-	memset(&edns, 0, sizeof(edns));
-	edns.edns_present = 1;
-	edns.bits = EDNS_DO;
-	edns.ext_rcode = 0;
-	edns.edns_version = EDNS_ADVERTISED_VERSION;
-	edns.udp_size = EDNS_ADVERTISED_SIZE;
-
-	if(!qstate->return_msg || !qstate->return_msg->rep)
-		return 0;
-	/* We don't store the reply if its TTL is 0 unless serve-expired is
-	 * enabled.  Such a reply won't be reusable and simply be a waste for
-	 * the backend.  It's also compatible with the default behavior of
-	 * dns_cache_store_msg(). */
-	if(qstate->return_msg->rep->ttl == 0 &&
-		!qstate->env->cfg->serve_expired)
-		return 0;
-	if(verbosity >= VERB_ALGO)
-		log_dns_msg("cachedb encoding", &qstate->return_msg->qinfo,
-	                qstate->return_msg->rep);
-	if(!reply_info_answer_encode(&qstate->return_msg->qinfo,
-		qstate->return_msg->rep, 0, qstate->query_flags,
-		buf, 0, 1, qstate->env->scratch, 65535, &edns, 1, 0))
-		return 0;
-
-	/* TTLs in the return_msg are relative to time(0) so we have to
-	 * store that, we also store the smallest ttl in the packet+time(0)
-	 * as the packet expiry time */
-	/* qstate->return_msg->rep->ttl contains that relative shortest ttl */
-	timestamp = (uint64_t)*qstate->env->now;
-	expiry = timestamp + (uint64_t)qstate->return_msg->rep->ttl;
-	timestamp = htobe64(timestamp);
-	expiry = htobe64(expiry);
-	oldlim = sldns_buffer_limit(buf);
-	if(oldlim + sizeof(timestamp)+sizeof(expiry) >=
-		sldns_buffer_capacity(buf))
-		return 0; /* doesn't fit. */
-	sldns_buffer_set_limit(buf, oldlim + sizeof(timestamp)+sizeof(expiry));
-	sldns_buffer_write_at(buf, oldlim, &timestamp, sizeof(timestamp));
-	sldns_buffer_write_at(buf, oldlim+sizeof(timestamp), &expiry,
-		sizeof(expiry));
-
-	return 1;
-}
-
-/** check expiry, return true if matches OK */
-static int
-good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
-{
-	uint64_t expiry;
-	/* the expiry time is the last bytes of the buffer */
-	if(sldns_buffer_limit(buf) < sizeof(expiry))
-		return 0;
-	sldns_buffer_read_at(buf, sldns_buffer_limit(buf)-sizeof(expiry),
-		&expiry, sizeof(expiry));
-	expiry = be64toh(expiry);
-
-	if((time_t)expiry < *qstate->env->now &&
-		!qstate->env->cfg->serve_expired)
-		return 0;
-
-	return 1;
-}
-
-/* Adjust the TTL of the given RRset by 'subtract'.  If 'subtract' is
- * negative, set the TTL to 0. */
-static void
-packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
-{
-        size_t i;
-        size_t total = data->count + data->rrsig_count;
-	if(subtract >= 0 && data->ttl > subtract)
-		data->ttl -= subtract;
-	else	data->ttl = 0;
-        for(i=0; i<total; i++) {
-		if(subtract >= 0 && data->rr_ttl[i] > subtract)
-                	data->rr_ttl[i] -= subtract;
-                else	data->rr_ttl[i] = 0;
-	}
-}
-
-/* Adjust the TTL of a DNS message and its RRs by 'adjust'.  If 'adjust' is
- * negative, set the TTLs to 0. */
-static void
-adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
-{
-	size_t i;
-	if(adjust >= 0 && msg->rep->ttl > adjust)
-		msg->rep->ttl -= adjust;
-	else	msg->rep->ttl = 0;
-	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
-
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		packed_rrset_ttl_subtract((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, adjust);
-	}
-}
-
-/** convert dns message in buffer to return_msg */
-static int
-parse_data(struct module_qstate* qstate, struct sldns_buffer* buf)
-{
-	struct msg_parse* prs;
-	struct edns_data edns;
-	uint64_t timestamp, expiry;
-	time_t adjust;
-	size_t lim = sldns_buffer_limit(buf);
-	if(lim < LDNS_HEADER_SIZE+sizeof(timestamp)+sizeof(expiry))
-		return 0; /* too short */
-
-	/* remove timestamp and expiry from end */
-	sldns_buffer_read_at(buf, lim-sizeof(expiry), &expiry, sizeof(expiry));
-	sldns_buffer_read_at(buf, lim-sizeof(expiry)-sizeof(timestamp),
-		&timestamp, sizeof(timestamp));
-	expiry = be64toh(expiry);
-	timestamp = be64toh(timestamp);
-
-	/* parse DNS packet */
-	regional_free_all(qstate->env->scratch);
-	prs = (struct msg_parse*)regional_alloc(qstate->env->scratch,
-		sizeof(struct msg_parse));
-	if(!prs)
-		return 0; /* out of memory */
-	memset(prs, 0, sizeof(*prs));
-	memset(&edns, 0, sizeof(edns));
-	sldns_buffer_set_limit(buf, lim - sizeof(expiry)-sizeof(timestamp));
-	if(parse_packet(buf, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) {
-		sldns_buffer_set_limit(buf, lim);
-		return 0;
-	}
-	if(parse_extract_edns(prs, &edns, qstate->env->scratch) !=
-		LDNS_RCODE_NOERROR) {
-		sldns_buffer_set_limit(buf, lim);
-		return 0;
-	}
-
-	qstate->return_msg = dns_alloc_msg(buf, prs, qstate->region);
-	sldns_buffer_set_limit(buf, lim);
-	if(!qstate->return_msg)
-		return 0;
-	
-	qstate->return_rcode = LDNS_RCODE_NOERROR;
-
-	/* see how much of the TTL expired, and remove it */
-	if(*qstate->env->now <= (time_t)timestamp) {
-		verbose(VERB_ALGO, "cachedb msg adjust by zero");
-		return 1; /* message from the future (clock skew?) */
-	}
-	adjust = *qstate->env->now - (time_t)timestamp;
-	if(qstate->return_msg->rep->ttl < adjust) {
-		verbose(VERB_ALGO, "cachedb msg expired");
-		/* If serve-expired is enabled, we still use an expired message
-		 * setting the TTL to 0. */
-		if(qstate->env->cfg->serve_expired)
-			adjust = -1;
-		else
-			return 0; /* message expired */
-	}
-	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
-	adjust_msg_ttl(qstate->return_msg, adjust);
-
-	/* Similar to the unbound worker, if serve-expired is enabled and
-	 * the msg would be considered to be expired, mark the state so a
-	 * refetch will be scheduled.  The comparison between 'expiry' and
-	 * 'now' should be redundant given how these values were calculated,
-	 * but we check it just in case as does good_expiry_and_qinfo(). */
-	if(qstate->env->cfg->serve_expired &&
-		(adjust == -1 || (time_t)expiry < *qstate->env->now)) {
-		qstate->need_refetch = 1;
-	}
-
-	return 1;
-}
-
-/**
- * Lookup the qstate.qinfo in extcache, store in qstate.return_msg.
- * return true if lookup was successful.
- */
-static int
-cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie)
-{
-	char key[(CACHEDB_HASHSIZE/8)*2+1];
-	calc_hash(qstate, key, sizeof(key));
-
-	/* call backend to fetch data for key into scratch buffer */
-	if( !(*ie->backend->lookup)(qstate->env, ie, key,
-		qstate->env->scratch_buffer)) {
-		return 0;
-	}
-
-	/* check expiry date and check if query-data matches */
-	if( !good_expiry_and_qinfo(qstate, qstate->env->scratch_buffer) ) {
-		return 0;
-	}
-
-	/* parse dns message into return_msg */
-	if( !parse_data(qstate, qstate->env->scratch_buffer) ) {
-		return 0;
-	}
-	return 1;
-}
-
-/**
- * Store the qstate.return_msg in extcache for key qstate.info
- */
-static void
-cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie)
-{
-	char key[(CACHEDB_HASHSIZE/8)*2+1];
-	calc_hash(qstate, key, sizeof(key));
-
-	/* prepare data in scratch buffer */
-	if(!prep_data(qstate, qstate->env->scratch_buffer))
-		return;
-	
-	/* call backend */
-	(*ie->backend->store)(qstate->env, ie, key,
-		sldns_buffer_begin(qstate->env->scratch_buffer),
-		sldns_buffer_limit(qstate->env->scratch_buffer));
-}
-
-/**
- * See if unbound's internal cache can answer the query
- */
-static int
-cachedb_intcache_lookup(struct module_qstate* qstate)
-{
-	struct dns_msg* msg;
-	msg = dns_cache_lookup(qstate->env, qstate->qinfo.qname,
-		qstate->qinfo.qname_len, qstate->qinfo.qtype,
-		qstate->qinfo.qclass, qstate->query_flags,
-		qstate->region, qstate->env->scratch,
-		1 /* no partial messages with only a CNAME */
-		);
-	if(!msg && qstate->env->neg_cache &&
-		iter_qname_indicates_dnssec(qstate->env, &qstate->qinfo)) {
-		/* lookup in negative cache; may result in 
-		 * NOERROR/NODATA or NXDOMAIN answers that need validation */
-		msg = val_neg_getmsg(qstate->env->neg_cache, &qstate->qinfo,
-			qstate->region, qstate->env->rrset_cache,
-			qstate->env->scratch_buffer,
-			*qstate->env->now, 1/*add SOA*/, NULL,
-			qstate->env->cfg);
-	}
-	if(!msg)
-		return 0;
-	/* this is the returned msg */
-	qstate->return_rcode = LDNS_RCODE_NOERROR;
-	qstate->return_msg = msg;
-	return 1;
-}
-
-/**
- * Store query into the internal cache of unbound.
- */
-static void
-cachedb_intcache_store(struct module_qstate* qstate)
-{
-	uint32_t store_flags = qstate->query_flags;
-
-	if(qstate->env->cfg->serve_expired)
-		store_flags |= DNSCACHE_STORE_ZEROTTL;
-	if(!qstate->return_msg)
-		return;
-	(void)dns_cache_store(qstate->env, &qstate->qinfo,
-		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
-		qstate->region, store_flags);
-}
-
-/**
- * Handle a cachedb module event with a query
- * @param qstate: query state (from the mesh), passed between modules.
- * 	contains qstate->env module environment with global caches and so on.
- * @param iq: query state specific for this module.  per-query.
- * @param ie: environment specific for this module.  global.
- * @param id: module id.
- */
-static void
-cachedb_handle_query(struct module_qstate* qstate,
-	struct cachedb_qstate* ATTR_UNUSED(iq),
-	struct cachedb_env* ie, int id)
-{
-	/* check if we are enabled, and skip if so */
-	if(!ie->enabled) {
-		/* pass request to next module */
-		qstate->ext_state[id] = module_wait_module;
-		return;
-	}
-
-	if(qstate->blacklist || qstate->no_cache_lookup) {
-		/* cache is blacklisted or we are instructed from edns to not look */
-		/* pass request to next module */
-		qstate->ext_state[id] = module_wait_module;
-		return;
-	}
-
-	/* lookup inside unbound's internal cache */
-	if(cachedb_intcache_lookup(qstate)) {
-		if(verbosity >= VERB_ALGO) {
-			if(qstate->return_msg->rep)
-				log_dns_msg("cachedb internal cache lookup",
-					&qstate->return_msg->qinfo,
-					qstate->return_msg->rep);
-			else log_info("cachedb internal cache lookup: rcode %s",
-				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)?
-				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)->name:"??");
-		}
-		/* we are done with the query */
-		qstate->ext_state[id] = module_finished;
-		return;
-	}
-
-	/* ask backend cache to see if we have data */
-	if(cachedb_extcache_lookup(qstate, ie)) {
-		if(verbosity >= VERB_ALGO)
-			log_dns_msg(ie->backend->name,
-				&qstate->return_msg->qinfo,
-				qstate->return_msg->rep);
-		/* store this result in internal cache */
-		cachedb_intcache_store(qstate);
-		/* we are done with the query */
-		qstate->ext_state[id] = module_finished;
-		return;
-	}
-
-	/* no cache fetches */
-	/* pass request to next module */
-	qstate->ext_state[id] = module_wait_module;
-}
-
-/**
- * Handle a cachedb module event with a response from the iterator.
- * @param qstate: query state (from the mesh), passed between modules.
- * 	contains qstate->env module environment with global caches and so on.
- * @param iq: query state specific for this module.  per-query.
- * @param ie: environment specific for this module.  global.
- * @param id: module id.
- */
-static void
-cachedb_handle_response(struct module_qstate* qstate,
-	struct cachedb_qstate* ATTR_UNUSED(iq), struct cachedb_env* ie, int id)
-{
-	/* check if we are not enabled or instructed to not cache, and skip */
-	if(!ie->enabled || qstate->no_cache_store) {
-		/* we are done with the query */
-		qstate->ext_state[id] = module_finished;
-		return;
-	}
-
-	/* store the item into the backend cache */
-	cachedb_extcache_store(qstate, ie);
-
-	/* we are done with the query */
-	qstate->ext_state[id] = module_finished;
-}
-
-void 
-cachedb_operate(struct module_qstate* qstate, enum module_ev event, int id,
-	struct outbound_entry* outbound)
-{
-	struct cachedb_env* ie = (struct cachedb_env*)qstate->env->modinfo[id];
-	struct cachedb_qstate* iq = (struct cachedb_qstate*)qstate->minfo[id];
-	verbose(VERB_QUERY, "cachedb[module %d] operate: extstate:%s event:%s", 
-		id, strextstate(qstate->ext_state[id]), strmodulevent(event));
-	if(iq) log_query_info(VERB_QUERY, "cachedb operate: query", 
-		&qstate->qinfo);
-
-	/* perform cachedb state machine */
-	if((event == module_event_new || event == module_event_pass) && 
-		iq == NULL) {
-		if(!cachedb_new(qstate, id)) {
-			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-			return;
-		}
-		iq = (struct cachedb_qstate*)qstate->minfo[id];
-	}
-	if(iq && (event == module_event_pass || event == module_event_new)) {
-		cachedb_handle_query(qstate, iq, ie, id);
-		return;
-	}
-	if(iq && (event == module_event_moddone)) {
-		cachedb_handle_response(qstate, iq, ie, id);
-		return;
-	}
-	if(iq && outbound) {
-		/* cachedb does not need to process responses at this time
-		 * ignore it.
-		cachedb_process_response(qstate, iq, ie, id, outbound, event);
-		*/
-		return;
-	}
-	if(event == module_event_error) {
-		verbose(VERB_ALGO, "got called with event error, giving up");
-		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-		return;
-	}
-	if(!iq && (event == module_event_moddone)) {
-		/* during priming, module done but we never started */
-		qstate->ext_state[id] = module_finished;
-		return;
-	}
-
-	log_err("bad event for cachedb");
-	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-}
-
-void
-cachedb_inform_super(struct module_qstate* ATTR_UNUSED(qstate),
-	int ATTR_UNUSED(id), struct module_qstate* ATTR_UNUSED(super))
-{
-	/* cachedb does not use subordinate requests at this time */
-	verbose(VERB_ALGO, "cachedb inform_super was called");
-}
-
-void 
-cachedb_clear(struct module_qstate* qstate, int id)
-{
-	struct cachedb_qstate* iq;
-	if(!qstate)
-		return;
-	iq = (struct cachedb_qstate*)qstate->minfo[id];
-	if(iq) {
-		/* free contents of iq */
-		/* TODO */
-	}
-	qstate->minfo[id] = NULL;
-}
-
-size_t 
-cachedb_get_mem(struct module_env* env, int id)
-{
-	struct cachedb_env* ie = (struct cachedb_env*)env->modinfo[id];
-	if(!ie)
-		return 0;
-	return sizeof(*ie); /* TODO - more mem */
-}
-
-/**
- * The cachedb function block 
- */
-static struct module_func_block cachedb_block = {
-	"cachedb",
-	&cachedb_init, &cachedb_deinit, &cachedb_operate,
-	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
-};
-
-struct module_func_block* 
-cachedb_get_funcblock(void)
-{
-	return &cachedb_block;
-}
-#endif /* USE_CACHEDB */

cachedb/cachedb.h

@@ -1,112 +0,0 @@
-/*
- * cachedb/cachedb.h - cache from a database external to the program module
- *
- * Copyright (c) 2016, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains a module that uses an external database to cache
- * dns responses.
- */
-#include "util/module.h"
-struct cachedb_backend;
-
-/**
- * The global variable environment contents for the cachedb
- * Shared between threads, this represents long term information.
- * Like database connections.
- */
-struct cachedb_env {
-	/** true is cachedb is enabled, the backend is turned on */
-	int enabled;
-
-	/** the backend routines */
-	struct cachedb_backend* backend;
-
-	/** backend specific data here */
-	void* backend_data;
-};
-
-/**
- * Per query state for the cachedb module.
- */
-struct cachedb_qstate {
-	int todo;
-};
-
-/**
- * Backend call routines
- */
-struct cachedb_backend {
-	/** backend name */
-	const char* name;
-
-	/** Init(env, cachedb_env): false on setup failure */
-	int (*init)(struct module_env*, struct cachedb_env*);
-
-	/** Deinit - close db for program exit */
-	void (*deinit)(struct module_env*, struct cachedb_env*);
-
-	/** Lookup (env, cachedb_env, key, result_buffer): true if found */
-	int (*lookup)(struct module_env*, struct cachedb_env*, char*,
-		struct sldns_buffer*);
-	
-	/** Store (env, cachedb_env, key, data, data_len) */
-	void (*store)(struct module_env*, struct cachedb_env*, char*,
-		uint8_t*, size_t);
-};
-
-#define CACHEDB_HASHSIZE 256 /* bit hash */
-
-/** Init the cachedb module */
-int cachedb_init(struct module_env* env, int id);
-/** Deinit the cachedb module */
-void cachedb_deinit(struct module_env* env, int id);
-/** Operate on an event on a query (in qstate). */
-void cachedb_operate(struct module_qstate* qstate, enum module_ev event,
-	int id, struct outbound_entry* outbound);
-/** Subordinate query done, inform this super request of its conclusion */
-void cachedb_inform_super(struct module_qstate* qstate, int id,
-	struct module_qstate* super);
-/** clear the cachedb query-specific contents out of qstate */
-void cachedb_clear(struct module_qstate* qstate, int id);
-/** return memory estimate for cachedb module */
-size_t cachedb_get_mem(struct module_env* env, int id);
-
-/**
- * Get the function block with pointers to the cachedb functions
- * @return the function block for "cachedb".
- */
-struct module_func_block* cachedb_get_funcblock(void);
-

cachedb/redis.c

@@ -1,283 +0,0 @@
-/*
- * cachedb/redis.c - cachedb redis module
- *
- * Copyright (c) 2018, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains a module that uses the redis database to cache
- * dns responses.
- */
-
-#include "config.h"
-#ifdef USE_CACHEDB
-#include "cachedb/redis.h"
-#include "cachedb/cachedb.h"
-#include "util/alloc.h"
-#include "util/config_file.h"
-#include "sldns/sbuffer.h"
-
-#ifdef USE_REDIS
-#include "hiredis/hiredis.h"
-
-struct redis_moddata {
-	redisContext** ctxs;	/* thread-specific redis contexts */
-	int numctxs;		/* number of ctx entries */
-	const char* server_host; /* server's IP address or host name */
-	int server_port;	 /* server's TCP port */
-	struct timeval timeout;	 /* timeout for connection setup and commands */
-};
-
-static redisContext*
-redis_connect(const struct redis_moddata* moddata)
-{
-	redisContext* ctx;
-
-	ctx = redisConnectWithTimeout(moddata->server_host,
-		moddata->server_port, moddata->timeout);
-	if(!ctx || ctx->err) {
-		const char *errstr = "out of memory";
-		if(ctx)
-			errstr = ctx->errstr;
-		log_err("failed to connect to redis server: %s", errstr);
-		goto fail;
-	}
-	if(redisSetTimeout(ctx, moddata->timeout) != REDIS_OK) {
-		log_err("failed to set redis timeout");
-		goto fail;
-	}
-	return ctx;
-
-  fail:
-	if(ctx)
-		redisFree(ctx);
-	return NULL;
-}
-
-static int
-redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
-{
-	int i;
-	struct redis_moddata* moddata = NULL;
-
-	verbose(VERB_ALGO, "redis_init");
-
-	moddata = calloc(1, sizeof(struct redis_moddata));
-	if(!moddata) {
-		log_err("out of memory");
-		return 0;
-	}
-	moddata->numctxs = env->cfg->num_threads;
-	moddata->ctxs = calloc(env->cfg->num_threads, sizeof(redisContext*));
-	if(!moddata->ctxs) {
-		log_err("out of memory");
-		free(moddata);
-		return 0;
-	}
-	/* note: server_host is a shallow reference to configured string.
-	 * we don't have to free it in this module. */
-	moddata->server_host = env->cfg->redis_server_host;
-	moddata->server_port = env->cfg->redis_server_port;
-	moddata->timeout.tv_sec = env->cfg->redis_timeout / 1000;
-	moddata->timeout.tv_usec = (env->cfg->redis_timeout % 1000) * 1000;
-	for(i = 0; i < moddata->numctxs; i++)
-		moddata->ctxs[i] = redis_connect(moddata);
-	cachedb_env->backend_data = moddata;
-	return 1;
-}
-
-static void
-redis_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
-{
-	struct redis_moddata* moddata = (struct redis_moddata*)
-		cachedb_env->backend_data;
-	(void)env;
-
-	verbose(VERB_ALGO, "redis_deinit");
-
-	if(!moddata)
-		return;
-	if(moddata->ctxs) {
-		int i;
-		for(i = 0; i < moddata->numctxs; i++) {
-			if(moddata->ctxs[i])
-				redisFree(moddata->ctxs[i]);
-		}
-		free(moddata->ctxs);
-	}
-	free(moddata);
-}
-
-/*
- * Send a redis command and get a reply.  Unified so that it can be used for
- * both SET and GET.  If 'data' is non-NULL the command is supposed to be
- * SET and GET otherwise, but the implementation of this function is agnostic
- * about the semantics (except for logging): 'command', 'data', and 'data_len'
- * are opaquely passed to redisCommand().
- * This function first checks whether a connection with a redis server has
- * been established; if not it tries to set up a new one.
- * It returns redisReply returned from redisCommand() or NULL if some low
- * level error happens.  The caller is responsible to check the return value,
- * if it's non-NULL, it has to free it with freeReplyObject().
- */
-static redisReply*
-redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
-	const char* command, const uint8_t* data, size_t data_len)
-{
-	redisContext* ctx;
-	redisReply* rep;
-	struct redis_moddata* d = (struct redis_moddata*)
-		cachedb_env->backend_data;
-
-	/* We assume env->alloc->thread_num is a unique ID for each thread
-	 * in [0, num-of-threads).  We could treat it as an error condition
-	 * if the assumption didn't hold, but it seems to be a fundamental
-	 * assumption throughout the unbound architecture, so we simply assert
-	 * it. */
-	log_assert(env->alloc->thread_num < d->numctxs);
-	ctx = d->ctxs[env->alloc->thread_num];
-
-	/* If we've not established a connection to the server or we've closed
-	 * it on a failure, try to re-establish a new one.   Failures will be
-	 * logged in redis_connect(). */
-	if(!ctx) {
-		ctx = redis_connect(d);
-		d->ctxs[env->alloc->thread_num] = ctx;
-	}
-	if(!ctx)
-		return NULL;
-
-	/* Send the command and get a reply, synchronously. */
-	rep = (redisReply*)redisCommand(ctx, command, data, data_len);
-	if(!rep) {
-		/* Once an error as a NULL-reply is returned the context cannot
-		 * be reused and we'll need to set up a new connection. */
-		log_err("redis_command: failed to receive a reply, "
-			"closing connection: %s", ctx->errstr);
-		redisFree(ctx);
-		d->ctxs[env->alloc->thread_num] = NULL;
-		return NULL;
-	}
-
-	/* Check error in reply to unify logging in that case.
-	 * The caller may perform context-dependent checks and logging. */
-	if(rep->type == REDIS_REPLY_ERROR)
-		log_err("redis: %s resulted in an error: %s",
-			data ? "set" : "get", rep->str);
-
-	return rep;
-}
-
-static int
-redis_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
-	char* key, struct sldns_buffer* result_buffer)
-{
-	redisReply* rep;
-	char cmdbuf[4+(CACHEDB_HASHSIZE/8)*2+1]; /* "GET " + key */
-	int n;
-	int ret = 0;
-
-	verbose(VERB_ALGO, "redis_lookup of %s", key);
-
-	n = snprintf(cmdbuf, sizeof(cmdbuf), "GET %s", key);
-	if(n < 0 || n >= (int)sizeof(cmdbuf)) {
-		log_err("redis_lookup: unexpected failure to build command");
-		return 0;
-	}
-
-	rep = redis_command(env, cachedb_env, cmdbuf, NULL, 0);
-	if(!rep)
-		return 0;
-	switch (rep->type) {
-	case REDIS_REPLY_NIL:
-		verbose(VERB_ALGO, "redis_lookup: no data cached");
-		break;
-	case REDIS_REPLY_STRING:
-		verbose(VERB_ALGO, "redis_lookup found %d bytes",
-			(int)rep->len);
-		if((size_t)rep->len > sldns_buffer_capacity(result_buffer)) {
-			log_err("redis_lookup: replied data too long: %lu",
-				(size_t)rep->len);
-			break;
-		}
-		sldns_buffer_clear(result_buffer);
-		sldns_buffer_write(result_buffer, rep->str, rep->len);
-		sldns_buffer_flip(result_buffer);
-		ret = 1;
-		break;
-	case REDIS_REPLY_ERROR:
-		break;		/* already logged */
-	default:
-		log_err("redis_lookup: unexpected type of reply for (%d)",
-			rep->type);
-		break;
-	}
-	freeReplyObject(rep);
-	return ret;
-}
-
-static void
-redis_store(struct module_env* env, struct cachedb_env* cachedb_env,
-	char* key, uint8_t* data, size_t data_len)
-{
-	redisReply* rep;
-	char cmdbuf[4+(CACHEDB_HASHSIZE/8)*2+3+1]; /* "SET " + key + " %b" */
-	int n;
-
-	verbose(VERB_ALGO, "redis_store %s (%d bytes)", key, (int)data_len);
-
-	/* build command to set to a binary safe string */
-	n = snprintf(cmdbuf, sizeof(cmdbuf), "SET %s %%b", key);
-	if(n < 0 || n >= (int)sizeof(cmdbuf)) {
-		log_err("redis_store: unexpected failure to build command");
-		return;
-	}
-
-	rep = redis_command(env, cachedb_env, cmdbuf, data, data_len);
-	if(rep) {
-		verbose(VERB_ALGO, "redis_store set completed");
-		if(rep->type != REDIS_REPLY_STATUS &&
-			rep->type != REDIS_REPLY_ERROR) {
-			log_err("redis_store: unexpected type of reply (%d)",
-				rep->type);
-		}
-		freeReplyObject(rep);
-	}
-}
-
-struct cachedb_backend redis_backend = { "redis",
-	redis_init, redis_deinit, redis_lookup, redis_store
-};
-#endif	/* USE_REDIS */
-#endif /* USE_CACHEDB */

cachedb/redis.h

@@ -1,45 +0,0 @@
-/*
- * cachedb/redis.h - cachedb redis module
- *
- * Copyright (c) 2018, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains a module that uses the redis database to cache
- * dns responses.
- */
-
-/** the redis backend definition, contains callable functions
- * and name string */
-extern struct cachedb_backend redis_backend;

checkconf/unbound-checkconf.c

@@ -0,0 +1,198 @@
+/*
+ * checkconf/unbound-checkconf.c - config file checker for unbound.conf file.
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * The config checker checks for syntax and other errors in the unbound.conf
+ * file, and can be used to check for errors before the server is started
+ * or sigHUPped.
+ * Exit status 1 means an error.
+ */
+
+#include "config.h"
+#include "util/log.h"
+#include "util/config_file.h"
+#include "util/module.h"
+#include "util/net_help.h"
+#include "util/regional.h"
+#include "iterator/iterator.h"
+#include "validator/validator.h"
+#include <pwd.h>
+
+/** Give checkconf usage, and exit (1). */
+static void
+usage()
+{
+	printf("Usage:	unbound-checkconf [file]\n");
+	printf("	Checks unbound configuration file for errors.\n");
+	printf("file	if omitted %s is used.\n", CONFIGFILE);
+	printf("-h	show this usage help.\n");
+	printf("Version %s\n", PACKAGE_VERSION);
+	printf("BSD licensed, see LICENSE in source package for details.\n");
+	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+	exit(1);
+}
+
+/** check if module works with config */
+static void
+check_mod(struct config_file* cfg, struct module_func_block* fb)
+{
+	struct module_env env;
+	memset(&env, 0, sizeof(env));
+	env.cfg = cfg;
+	env.scratch = regional_create();
+	env.scratch_buffer = ldns_buffer_new(BUFSIZ);
+	if(!env.scratch || !env.scratch_buffer)
+		fatal_exit("out of memory");
+	if(!(*fb->init)(&env, 0)) {
+		fatal_exit("bad config for %s module", fb->name);
+	}
+	(*fb->deinit)(&env, 0);
+	ldns_buffer_free(env.scratch_buffer);
+	regional_destroy(env.scratch);
+}
+
+/** check configuration for errors */
+static void
+morechecks(struct config_file* cfg)
+{
+	int i;
+	struct sockaddr_storage a;
+	socklen_t alen;
+	for(i=0; i<cfg->num_ifs; i++) {
+		if(!ipstrtoaddr(cfg->ifs[i], UNBOUND_DNS_PORT, &a, &alen)) {
+			fatal_exit("cannot parse interface specified as '%s'",
+				cfg->ifs[i]);
+		}
+	}
+	for(i=0; i<cfg->num_out_ifs; i++) {
+		if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, 
+			&a, &alen)) {
+			fatal_exit("cannot parse outgoing-interface "
+				"specified as '%s'", cfg->out_ifs[i]);
+		}
+	}
+
+	if(cfg->verbosity < 0)
+		fatal_exit("verbosity value < 0");
+	if(cfg->num_threads < 0 || cfg->num_threads > 10000)
+		fatal_exit("num_threads value weird");
+	if(!cfg->do_ip4 && !cfg->do_ip6)
+		fatal_exit("ip4 and ip6 are both disabled, pointless");
+	if(!cfg->do_udp && !cfg->do_tcp)
+		fatal_exit("udp and tcp are both disabled, pointless");
+
+	if(cfg->chrootdir && strncmp(cfg->chrootdir, cfg->directory,
+		strlen(cfg->chrootdir)) != 0)
+		fatal_exit("working directory %s not in chrootdir %s",
+			cfg->directory, cfg->chrootdir);
+	if(cfg->chrootdir && cfg->pidfile && cfg->pidfile[0] &&
+		strncmp(cfg->chrootdir, cfg->pidfile,
+			strlen(cfg->chrootdir)) != 0)
+		fatal_exit("pid file %s not in chrootdir %s",
+			cfg->pidfile, cfg->chrootdir);
+	if(cfg->chrootdir && cfg->logfile && cfg->logfile[0] &&
+		strncmp(cfg->chrootdir, cfg->logfile,
+			strlen(cfg->chrootdir)) != 0)
+		fatal_exit("log file %s not in chrootdir %s",
+			cfg->logfile, cfg->chrootdir);
+	
+	if(strcmp(cfg->module_conf, "iterator") != 0 &&
+		strcmp(cfg->module_conf, "validator iterator") != 0) {
+		fatal_exit("module conf %s is not known to work",
+			cfg->module_conf);
+	}
+
+	if(cfg->username && cfg->username[0]) {
+		struct passwd *pwd;
+		if((pwd = getpwnam(cfg->username)) == NULL)
+			fatal_exit("user '%s' does not exist.", cfg->username);
+		endpwent();
+	}
+}
+
+/** check config file */
+static void
+checkconf(char* cfgfile)
+{
+	struct config_file* cfg = config_create();
+	if(!cfg)
+		fatal_exit("out of memory");
+	if(!config_read(cfg, cfgfile)) {
+		/* config_read prints messages to stderr */
+		config_delete(cfg);
+		exit(1);
+	}
+	morechecks(cfg);
+	check_mod(cfg, iter_get_funcblock());
+	check_mod(cfg, val_get_funcblock());
+	config_delete(cfg);
+	printf("unbound-checkconf: no errors in %s\n", cfgfile);
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** Main routine for checkconf */
+int main(int argc, char* argv[])
+{
+	int c;
+	char* f;
+	log_ident_set("unbound-checkconf");
+	log_init(NULL, 0, NULL);
+	checklock_start();
+	/* parse the options */
+	while( (c=getopt(argc, argv, "h")) != -1) {
+		switch(c) {
+		case '?':
+		case 'h':
+		default:
+			usage();
+		}
+	}
+	argc -= optind;
+	argv += optind;
+	if(argc != 0 && argc != 1)
+		usage();
+	if(argc == 1)
+		f = argv[0];
+	else	f = CONFIGFILE;
+	checkconf(f);
+	checklock_stop();
+	return 0;
+}

checkconf/worker_cb.c

@@ -0,0 +1,109 @@
+/*
+ * checkconf/worker_cb.c - fake callback routines to make fptr_wlist work
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains fake callback functions, so that the symbols exist
+ * and the fptr_wlist continues to work even if the daemon/worker is not
+ * linked into the resulting program.
+ */
+#include "config.h"
+#include "util/log.h"
+struct comm_reply;
+struct comm_point;
+struct module_qstate;
+
+int worker_handle_control_cmd(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+int worker_handle_request(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(repinfo))
+{
+	log_assert(0);
+	return 0;
+}
+
+int worker_handle_reply(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
+{
+	log_assert(0);
+}
+
+int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
+	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
+	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
+{
+	log_assert(0);
+	return 0;
+}
+
+struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
+	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
+	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
+	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
+{
+	log_assert(0);
+	return 0;
+}
+
+void 
+worker_alloc_cleanup(void* ATTR_UNUSED(arg))
+{
+	log_assert(0);
+}

compat/arc4_lock.c

@@ -1,82 +0,0 @@
-/* arc4_lock.c - global lock for arc4random
-*
- * Copyright (c) 2014, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "config.h"
-#define LOCKRET(func) func
-#ifdef ENABLE_LOCK_CHECKS
-#undef ENABLE_LOCK_CHECKS
-#endif
-#include "util/locks.h"
-
-void _ARC4_LOCK(void);
-void _ARC4_UNLOCK(void);
-
-#ifdef THREADS_DISABLED
-void _ARC4_LOCK(void)
-{
-}
-
-void _ARC4_UNLOCK(void)
-{
-}
-
-void _ARC4_LOCK_DESTROY(void)
-{
-}
-#else /* !THREADS_DISABLED */
-
-static lock_quick_type arc4lock;
-static int arc4lockinit = 0;
-
-void _ARC4_LOCK(void)
-{
-	if(!arc4lockinit) {
-		arc4lockinit = 1;
-		lock_quick_init(&arc4lock);
-	}
-	lock_quick_lock(&arc4lock);
-}
-
-void _ARC4_UNLOCK(void)
-{
-	lock_quick_unlock(&arc4lock);
-}
-
-void _ARC4_LOCK_DESTROY(void)
-{
-	if(arc4lockinit) {
-		arc4lockinit = 0;
-		lock_quick_destroy(&arc4lock);
-	}
-}
-#endif /* THREADS_DISABLED */

compat/arc4random.c

@@ -1,305 +0,0 @@
-/*      $OpenBSD: arc4random.c,v 1.41 2014/07/12 13:24:54 deraadt Exp $ */
-
-/*
- * Copyright (c) 1996, David Mazieres <dm@uun.org>
- * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
- * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-#include "config.h"
-
-/*
- * ChaCha based random number generator for OpenBSD.
- */
-
-#include <fcntl.h>
-#include <limits.h>
-#include <signal.h>
-#ifdef HAVE_STDINT_H
-#include <stdint.h>
-#endif
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/time.h>
-#ifndef UB_ON_WINDOWS
-#include <sys/mman.h>
-#endif
-
-#define KEYSTREAM_ONLY
-#include "chacha_private.h"
-
-#define arc4_min(a, b) ((a) < (b) ? (a) : (b))
-#ifdef __GNUC__
-#define inline __inline
-#else				/* !__GNUC__ */
-#define inline
-#endif				/* !__GNUC__ */
-#ifndef MAP_ANON
-#define MAP_ANON MAP_ANONYMOUS
-#endif
-
-#define KEYSZ	32
-#define IVSZ	8
-#define BLOCKSZ	64
-#define RSBUFSZ	(16*BLOCKSZ)
-
-/* Marked MAP_INHERIT_ZERO, so zero'd out in fork children. */
-static struct {
-	size_t		rs_have;	/* valid bytes at end of rs_buf */
-	size_t		rs_count;	/* bytes till reseed */
-} *rs;
-
-/* Preserved in fork children. */
-static struct {
-	chacha_ctx	rs_chacha;	/* chacha context for random keystream */
-	u_char		rs_buf[RSBUFSZ];	/* keystream blocks */
-} *rsx;
-
-static inline void _rs_rekey(u_char *dat, size_t datlen);
-
-/*
- * Basic sanity checking; wish we could do better.
- */
-static int
-fallback_gotdata(char *buf, size_t len)
-{
-	char	any_set = 0;
-	size_t	i;
-
-	for (i = 0; i < len; ++i)
-		any_set |= buf[i];
-	if (any_set == 0)
-		return -1;
-	return 0;
-}
-
-/* fallback for getentropy in case libc returns failure */
-static int
-fallback_getentropy_urandom(void *buf, size_t len)
-{
-	size_t i;
-	int fd, flags;
-	int save_errno = errno;
-
-start:
-
-	flags = O_RDONLY;
-#ifdef O_NOFOLLOW
-	flags |= O_NOFOLLOW;
-#endif
-#ifdef O_CLOEXEC
-	flags |= O_CLOEXEC;
-#endif
-	fd = open("/dev/urandom", flags, 0);
-	if (fd == -1) {
-		if (errno == EINTR)
-			goto start;
-		goto nodevrandom;
-	}
-#ifndef O_CLOEXEC
-#  ifdef HAVE_FCNTL
-	fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
-#  endif
-#endif
-	for (i = 0; i < len; ) {
-		size_t wanted = len - i;
-		ssize_t ret = read(fd, (char*)buf + i, wanted);
-
-		if (ret == -1) {
-			if (errno == EAGAIN || errno == EINTR)
-				continue;
-			close(fd);
-			goto nodevrandom;
-		}
-		i += ret;
-	}
-	close(fd);
-	if (fallback_gotdata(buf, len) == 0) {
-		errno = save_errno;
-		return 0;		/* satisfied */
-	}
-nodevrandom:
-	errno = EIO;
-	return -1;
-}
-
-static inline void
-_rs_init(u_char *buf, size_t n)
-{
-	if (n < KEYSZ + IVSZ)
-		return;
-
-	if (rs == NULL) {
-#ifndef UB_ON_WINDOWS
-		if ((rs = mmap(NULL, sizeof(*rs), PROT_READ|PROT_WRITE,
-		    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
-			abort();
-#ifdef MAP_INHERIT_ZERO
-		if (minherit(rs, sizeof(*rs), MAP_INHERIT_ZERO) == -1)
-			abort();
-#endif
-#else /* WINDOWS */
-		rs = malloc(sizeof(*rs));
-		if(!rs)
-			abort();
-#endif
-	}
-	if (rsx == NULL) {
-#ifndef UB_ON_WINDOWS
-		if ((rsx = mmap(NULL, sizeof(*rsx), PROT_READ|PROT_WRITE,
-		    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
-			abort();
-#else /* WINDOWS */
-		rsx = malloc(sizeof(*rsx));
-		if(!rsx)
-			abort();
-#endif
-	}
-
-	chacha_keysetup(&rsx->rs_chacha, buf, KEYSZ * 8, 0);
-	chacha_ivsetup(&rsx->rs_chacha, buf + KEYSZ);
-}
-
-static void
-_rs_stir(void)
-{
-	u_char rnd[KEYSZ + IVSZ];
-
-	if (getentropy(rnd, sizeof rnd) == -1) {
-		if(errno != ENOSYS ||
-			fallback_getentropy_urandom(rnd, sizeof rnd) == -1) {
-#ifdef SIGKILL
-			raise(SIGKILL);
-#else
-			exit(9); /* windows */
-#endif
-		}
-	}
-
-	if (!rs)
-		_rs_init(rnd, sizeof(rnd));
-	else
-		_rs_rekey(rnd, sizeof(rnd));
-	explicit_bzero(rnd, sizeof(rnd));	/* discard source seed */
-
-	/* invalidate rs_buf */
-	rs->rs_have = 0;
-	memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
-
-	rs->rs_count = 1600000;
-}
-
-static inline void
-_rs_stir_if_needed(size_t len)
-{
-#ifndef MAP_INHERIT_ZERO
-	static pid_t _rs_pid = 0;
-	pid_t pid = getpid();
-
-	/* If a system lacks MAP_INHERIT_ZERO, resort to getpid() */
-	if (_rs_pid == 0 || _rs_pid != pid) {
-		_rs_pid = pid;
-		if (rs)
-			rs->rs_count = 0;
-	}
-#endif
-	if (!rs || rs->rs_count <= len)
-		_rs_stir();
-	if (rs->rs_count <= len)
-		rs->rs_count = 0;
-	else
-		rs->rs_count -= len;
-}
-
-static inline void
-_rs_rekey(u_char *dat, size_t datlen)
-{
-#ifndef KEYSTREAM_ONLY
-	memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
-#endif
-	/* fill rs_buf with the keystream */
-	chacha_encrypt_bytes(&rsx->rs_chacha, rsx->rs_buf,
-	    rsx->rs_buf, sizeof(rsx->rs_buf));
-	/* mix in optional user provided data */
-	if (dat) {
-		size_t i, m;
-
-		m = arc4_min(datlen, KEYSZ + IVSZ);
-		for (i = 0; i < m; i++)
-			rsx->rs_buf[i] ^= dat[i];
-	}
-	/* immediately reinit for backtracking resistance */
-	_rs_init(rsx->rs_buf, KEYSZ + IVSZ);
-	memset(rsx->rs_buf, 0, KEYSZ + IVSZ);
-	rs->rs_have = sizeof(rsx->rs_buf) - KEYSZ - IVSZ;
-}
-
-static inline void
-_rs_random_buf(void *_buf, size_t n)
-{
-	u_char *buf = (u_char *)_buf;
-	u_char *keystream;
-	size_t m;
-
-	_rs_stir_if_needed(n);
-	while (n > 0) {
-		if (rs->rs_have > 0) {
-			m = arc4_min(n, rs->rs_have);
-			keystream = rsx->rs_buf + sizeof(rsx->rs_buf)
-			    - rs->rs_have;
-			memcpy(buf, keystream, m);
-			memset(keystream, 0, m);
-			buf += m;
-			n -= m;
-			rs->rs_have -= m;
-		}
-		if (rs->rs_have == 0)
-			_rs_rekey(NULL, 0);
-	}
-}
-
-static inline void
-_rs_random_u32(uint32_t *val)
-{
-	u_char *keystream;
-	_rs_stir_if_needed(sizeof(*val));
-	if (rs->rs_have < sizeof(*val))
-		_rs_rekey(NULL, 0);
-	keystream = rsx->rs_buf + sizeof(rsx->rs_buf) - rs->rs_have;
-	memcpy(val, keystream, sizeof(*val));
-	memset(keystream, 0, sizeof(*val));
-	rs->rs_have -= sizeof(*val);
-}
-
-uint32_t
-arc4random(void)
-{
-	uint32_t val;
-
-	_ARC4_LOCK();
-	_rs_random_u32(&val);
-	_ARC4_UNLOCK();
-	return val;
-}
-
-void
-arc4random_buf(void *buf, size_t n)
-{
-	_ARC4_LOCK();
-	_rs_random_buf(buf, n);
-	_ARC4_UNLOCK();
-}

compat/arc4random_uniform.c

@@ -1,57 +0,0 @@
-/*      $OpenBSD: arc4random_uniform.c,v 1.1 2014/07/12 13:24:54 deraadt Exp $  */
-
-/*
- * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include "config.h"
-#include <sys/types.h>
-#include <stdlib.h>
-
-/*
- * Calculate a uniformly distributed random number less than upper_bound
- * avoiding "modulo bias".
- *
- * Uniformity is achieved by generating new random numbers until the one
- * returned is outside the range [0, 2**32 % upper_bound).  This
- * guarantees the selected random number will be inside
- * [2**32 % upper_bound, 2**32) which maps back to [0, upper_bound)
- * after reduction modulo upper_bound.
- */
-uint32_t
-arc4random_uniform(uint32_t upper_bound)
-{
-	uint32_t r, min;
-
-	if (upper_bound < 2)
-		return 0;
-
-	/* 2**32 % x == (2**32 - x) % x */
-	min = -upper_bound % upper_bound;
-
-	/*
-	 * This could theoretically loop forever but each retry has
-	 * p > 0.5 (worst case, usually far better) of selecting a
-	 * number inside the range we need, so it should rarely need
-	 * to re-roll.
-	 */
-	for (;;) {
-		r = arc4random();
-		if (r >= min)
-			break;
-	}
-
-	return r % upper_bound;
-}

compat/chacha_private.h

@@ -1,222 +0,0 @@
-/*
-chacha-merged.c version 20080118
-D. J. Bernstein
-Public domain.
-*/
-
-/* $OpenBSD: chacha_private.h,v 1.2 2013/10/04 07:02:27 djm Exp $ */
-
-typedef unsigned char u8;
-typedef unsigned int u32;
-
-typedef struct
-{
-  u32 input[16]; /* could be compressed */
-} chacha_ctx;
-
-#define U8C(v) (v##U)
-#define U32C(v) (v##U)
-
-#define U8V(v) ((u8)(v) & U8C(0xFF))
-#define U32V(v) ((u32)(v) & U32C(0xFFFFFFFF))
-
-#define ROTL32(v, n) \
-  (U32V((v) << (n)) | ((v) >> (32 - (n))))
-
-#define U8TO32_LITTLE(p) \
-  (((u32)((p)[0])      ) | \
-   ((u32)((p)[1]) <<  8) | \
-   ((u32)((p)[2]) << 16) | \
-   ((u32)((p)[3]) << 24))
-
-#define U32TO8_LITTLE(p, v) \
-  do { \
-    (p)[0] = U8V((v)      ); \
-    (p)[1] = U8V((v) >>  8); \
-    (p)[2] = U8V((v) >> 16); \
-    (p)[3] = U8V((v) >> 24); \
-  } while (0)
-
-#define ROTATE(v,c) (ROTL32(v,c))
-#define XOR(v,w) ((v) ^ (w))
-#define PLUS(v,w) (U32V((v) + (w)))
-#define PLUSONE(v) (PLUS((v),1))
-
-#define QUARTERROUND(a,b,c,d) \
-  a = PLUS(a,b); d = ROTATE(XOR(d,a),16); \
-  c = PLUS(c,d); b = ROTATE(XOR(b,c),12); \
-  a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
-  c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
-
-static const char sigma[16] = "expand 32-byte k";
-static const char tau[16] = "expand 16-byte k";
-
-static void
-chacha_keysetup(chacha_ctx *x,const u8 *k,u32 kbits,u32 ATTR_UNUSED(ivbits))
-{
-  const char *constants;
-
-  x->input[4] = U8TO32_LITTLE(k + 0);
-  x->input[5] = U8TO32_LITTLE(k + 4);
-  x->input[6] = U8TO32_LITTLE(k + 8);
-  x->input[7] = U8TO32_LITTLE(k + 12);
-  if (kbits == 256) { /* recommended */
-    k += 16;
-    constants = sigma;
-  } else { /* kbits == 128 */
-    constants = tau;
-  }
-  x->input[8] = U8TO32_LITTLE(k + 0);
-  x->input[9] = U8TO32_LITTLE(k + 4);
-  x->input[10] = U8TO32_LITTLE(k + 8);
-  x->input[11] = U8TO32_LITTLE(k + 12);
-  x->input[0] = U8TO32_LITTLE(constants + 0);
-  x->input[1] = U8TO32_LITTLE(constants + 4);
-  x->input[2] = U8TO32_LITTLE(constants + 8);
-  x->input[3] = U8TO32_LITTLE(constants + 12);
-}
-
-static void
-chacha_ivsetup(chacha_ctx *x,const u8 *iv)
-{
-  x->input[12] = 0;
-  x->input[13] = 0;
-  x->input[14] = U8TO32_LITTLE(iv + 0);
-  x->input[15] = U8TO32_LITTLE(iv + 4);
-}
-
-static void
-chacha_encrypt_bytes(chacha_ctx *x,const u8 *m,u8 *c,u32 bytes)
-{
-  u32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
-  u32 j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
-  u8 *ctarget = NULL;
-  u8 tmp[64];
-  u_int i;
-
-  if (!bytes) return;
-
-  j0 = x->input[0];
-  j1 = x->input[1];
-  j2 = x->input[2];
-  j3 = x->input[3];
-  j4 = x->input[4];
-  j5 = x->input[5];
-  j6 = x->input[6];
-  j7 = x->input[7];
-  j8 = x->input[8];
-  j9 = x->input[9];
-  j10 = x->input[10];
-  j11 = x->input[11];
-  j12 = x->input[12];
-  j13 = x->input[13];
-  j14 = x->input[14];
-  j15 = x->input[15];
-
-  for (;;) {
-    if (bytes < 64) {
-      for (i = 0;i < bytes;++i) tmp[i] = m[i];
-      m = tmp;
-      ctarget = c;
-      c = tmp;
-    }
-    x0 = j0;
-    x1 = j1;
-    x2 = j2;
-    x3 = j3;
-    x4 = j4;
-    x5 = j5;
-    x6 = j6;
-    x7 = j7;
-    x8 = j8;
-    x9 = j9;
-    x10 = j10;
-    x11 = j11;
-    x12 = j12;
-    x13 = j13;
-    x14 = j14;
-    x15 = j15;
-    for (i = 20;i > 0;i -= 2) {
-      QUARTERROUND( x0, x4, x8,x12)
-      QUARTERROUND( x1, x5, x9,x13)
-      QUARTERROUND( x2, x6,x10,x14)
-      QUARTERROUND( x3, x7,x11,x15)
-      QUARTERROUND( x0, x5,x10,x15)
-      QUARTERROUND( x1, x6,x11,x12)
-      QUARTERROUND( x2, x7, x8,x13)
-      QUARTERROUND( x3, x4, x9,x14)
-    }
-    x0 = PLUS(x0,j0);
-    x1 = PLUS(x1,j1);
-    x2 = PLUS(x2,j2);
-    x3 = PLUS(x3,j3);
-    x4 = PLUS(x4,j4);
-    x5 = PLUS(x5,j5);
-    x6 = PLUS(x6,j6);
-    x7 = PLUS(x7,j7);
-    x8 = PLUS(x8,j8);
-    x9 = PLUS(x9,j9);
-    x10 = PLUS(x10,j10);
-    x11 = PLUS(x11,j11);
-    x12 = PLUS(x12,j12);
-    x13 = PLUS(x13,j13);
-    x14 = PLUS(x14,j14);
-    x15 = PLUS(x15,j15);
-
-#ifndef KEYSTREAM_ONLY
-    x0 = XOR(x0,U8TO32_LITTLE(m + 0));
-    x1 = XOR(x1,U8TO32_LITTLE(m + 4));
-    x2 = XOR(x2,U8TO32_LITTLE(m + 8));
-    x3 = XOR(x3,U8TO32_LITTLE(m + 12));
-    x4 = XOR(x4,U8TO32_LITTLE(m + 16));
-    x5 = XOR(x5,U8TO32_LITTLE(m + 20));
-    x6 = XOR(x6,U8TO32_LITTLE(m + 24));
-    x7 = XOR(x7,U8TO32_LITTLE(m + 28));
-    x8 = XOR(x8,U8TO32_LITTLE(m + 32));
-    x9 = XOR(x9,U8TO32_LITTLE(m + 36));
-    x10 = XOR(x10,U8TO32_LITTLE(m + 40));
-    x11 = XOR(x11,U8TO32_LITTLE(m + 44));
-    x12 = XOR(x12,U8TO32_LITTLE(m + 48));
-    x13 = XOR(x13,U8TO32_LITTLE(m + 52));
-    x14 = XOR(x14,U8TO32_LITTLE(m + 56));
-    x15 = XOR(x15,U8TO32_LITTLE(m + 60));
-#endif
-
-    j12 = PLUSONE(j12);
-    if (!j12) {
-      j13 = PLUSONE(j13);
-      /* stopping at 2^70 bytes per nonce is user's responsibility */
-    }
-
-    U32TO8_LITTLE(c + 0,x0);
-    U32TO8_LITTLE(c + 4,x1);
-    U32TO8_LITTLE(c + 8,x2);
-    U32TO8_LITTLE(c + 12,x3);
-    U32TO8_LITTLE(c + 16,x4);
-    U32TO8_LITTLE(c + 20,x5);
-    U32TO8_LITTLE(c + 24,x6);
-    U32TO8_LITTLE(c + 28,x7);
-    U32TO8_LITTLE(c + 32,x8);
-    U32TO8_LITTLE(c + 36,x9);
-    U32TO8_LITTLE(c + 40,x10);
-    U32TO8_LITTLE(c + 44,x11);
-    U32TO8_LITTLE(c + 48,x12);
-    U32TO8_LITTLE(c + 52,x13);
-    U32TO8_LITTLE(c + 56,x14);
-    U32TO8_LITTLE(c + 60,x15);
-
-    if (bytes <= 64) {
-      if (bytes < 64) {
-        for (i = 0;i < bytes;++i) ctarget[i] = c[i];
-      }
-      x->input[12] = j12;
-      x->input[13] = j13;
-      return;
-    }
-    bytes -= 64;
-    c += 64;
-#ifndef KEYSTREAM_ONLY
-    m += 64;
-#endif
-  }
-}

compat/ctime_r.c

@@ -1,42 +0,0 @@
-/* taken from ldns 1.6.1 */
-#include "config.h"
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-#include "util/locks.h"
-
-/** the lock for ctime buffer */
-static lock_basic_type ctime_lock;
-/** has it been inited */
-static int ctime_r_init = 0;
-
-/** cleanup ctime_r on exit */
-static void
-ctime_r_cleanup(void)
-{
-	if(ctime_r_init) {
-		ctime_r_init = 0;
-		lock_basic_destroy(&ctime_lock);
-	}
-}
-
-char *ctime_r(const time_t *timep, char *buf)
-{
-	char* result;
-	if(!ctime_r_init) {
-		/* still small race where this init can be done twice,
-		 * which is mostly harmless */
-		ctime_r_init = 1;
-		lock_basic_init(&ctime_lock);
-		atexit(&ctime_r_cleanup);
-	}
-	lock_basic_lock(&ctime_lock);
-	result = ctime(timep);
-	if(buf && result) {
-		if(strlen(result) > 10 && result[7]==' ' && result[8]=='0')
-			result[8]=' '; /* fix error in windows ctime */
-		strcpy(buf, result);
-	}
-	lock_basic_unlock(&ctime_lock);
-	return result;
-}

compat/explicit_bzero.c

@@ -1,26 +0,0 @@
-/*	$OpenBSD: explicit_bzero.c,v 1.3 2014/06/21 02:34:26 matthew Exp $ */
-/*
- * Public domain.
- * Written by Matthew Dempsky.
- */
-#include "config.h"
-#include <string.h>
-
-#ifdef HAVE_ATTR_WEAK
-__attribute__((weak)) void
-#else
-void
-#endif
-__explicit_bzero_hook(void *ATTR_UNUSED(buf), size_t ATTR_UNUSED(len))
-{
-}
-
-void
-explicit_bzero(void *buf, size_t len)
-{
-#ifdef UB_ON_WINDOWS
-	SecureZeroMemory(buf, len);
-#endif
-	memset(buf, 0, len);
-	__explicit_bzero_hook(buf, len);
-}

compat/fake-rfc2553.c

@@ -120,10 +120,12 @@ addrinfo *malloc_ai(int port, u_long addr, const struct addrinfo *hints)
 {
 	struct addrinfo *ai;
 
-	ai = calloc(1, sizeof(*ai) + sizeof(struct sockaddr_in));
+	ai = malloc(sizeof(*ai) + sizeof(struct sockaddr_in));
 	if (ai == NULL)
 		return (NULL);
 	
+	memset(ai, '\0', sizeof(*ai) + sizeof(struct sockaddr_in));
+	
 	ai->ai_addr = (struct sockaddr *)(ai + 1);
 	/* XXX -- ssh doesn't use sa_len */
 	ai->ai_addrlen = sizeof(struct sockaddr_in);

compat/fake-rfc2553.h

@@ -149,23 +149,23 @@ struct addrinfo {
 #ifdef getaddrinfo
 # undef getaddrinfo
 #endif
-#define getaddrinfo(a,b,c,d)	(getaddrinfo_unbound(a,b,c,d))
+#define getaddrinfo(a,b,c,d)	(ssh_getaddrinfo(a,b,c,d))
 int getaddrinfo(const char *, const char *, 
     const struct addrinfo *, struct addrinfo **);
 #endif /* !HAVE_GETADDRINFO */
 
 #if !defined(HAVE_GAI_STRERROR) && !defined(HAVE_CONST_GAI_STRERROR_PROTO)
-#define gai_strerror(a)		(gai_strerror_unbound(a))
+#define gai_strerror(a)		(ssh_gai_strerror(a))
 char *gai_strerror(int);
 #endif /* !HAVE_GAI_STRERROR */
 
 #ifndef HAVE_FREEADDRINFO
-#define freeaddrinfo(a)		(freeaddrinfo_unbound(a))
+#define freeaddrinfo(a)		(ssh_freeaddrinfo(a))
 void freeaddrinfo(struct addrinfo *);
 #endif /* !HAVE_FREEADDRINFO */
 
 #ifndef HAVE_GETNAMEINFO
-#define getnameinfo(a,b,c,d,e,f,g) (getnameinfo_unbound(a,b,c,d,e,f,g))
+#define getnameinfo(a,b,c,d,e,f,g) (ssh_getnameinfo(a,b,c,d,e,f,g))
 int getnameinfo(const struct sockaddr *, size_t, char *, size_t, 
     char *, size_t, int);
 #endif /* !HAVE_GETNAMEINFO */

compat/getentropy_linux.c

@@ -1,560 +0,0 @@
-/*	$OpenBSD: getentropy_linux.c,v 1.20 2014/07/12 15:43:49 beck Exp $	*/
-
-/*
- * Copyright (c) 2014 Theo de Raadt <deraadt@openbsd.org>
- * Copyright (c) 2014 Bob Beck <beck@obtuse.com>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-#include "config.h"
-
-/*
-#define	_POSIX_C_SOURCE 199309L
-#define	_GNU_SOURCE     1
-*/
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/ioctl.h>
-#include <sys/resource.h>
-#include <sys/syscall.h>
-#ifdef HAVE_SYS_SYSCTL_H
-#include <sys/sysctl.h>
-#endif
-#include <sys/statvfs.h>
-#include <sys/socket.h>
-#include <sys/mount.h>
-#include <sys/mman.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <termios.h>
-#include <fcntl.h>
-#include <signal.h>
-#include <string.h>
-#include <errno.h>
-#include <unistd.h>
-#include <time.h>
-
-#if defined(HAVE_SSL)
-#include <openssl/sha.h>
-#elif defined(HAVE_NETTLE)
-#include <nettle/sha.h>
-#endif
-
-#include <linux/types.h>
-#include <linux/random.h>
-#include <linux/sysctl.h>
-#ifdef HAVE_GETAUXVAL
-#include <sys/auxv.h>
-#endif
-#include <sys/vfs.h>
-#ifndef MAP_ANON
-#define MAP_ANON MAP_ANONYMOUS
-#endif
-
-#define REPEAT 5
-#define min(a, b) (((a) < (b)) ? (a) : (b))
-
-#define HX(a, b) \
-	do { \
-		if ((a)) \
-			HD(errno); \
-		else \
-			HD(b); \
-	} while (0)
-
-#if defined(HAVE_SSL)
-#define CRYPTO_SHA512_CTX		SHA512_CTX
-#define CRYPTO_SHA512_INIT(x)		SHA512_Init(x)
-#define CRYPTO_SHA512_FINAL(r, c)	SHA512_Final(r, c)
-#define HR(x, l) (SHA512_Update(&ctx, (char *)(x), (l)))
-#define HD(x)	 (SHA512_Update(&ctx, (char *)&(x), sizeof (x)))
-#define HF(x)    (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))
-#elif defined(HAVE_NETTLE)
-#define CRYPTO_SHA512_CTX		struct sha512_ctx
-#define CRYPTO_SHA512_INIT(x)		sha512_init(x)
-#define CRYPTO_SHA512_FINAL(r, c)	sha512_digest(c, SHA512_DIGEST_SIZE, r)
-#define HR(x, l) (sha512_update(&ctx, (l), (uint8_t *)(x)))
-#define HD(x)	 (sha512_update(&ctx, sizeof (x), (uint8_t *)&(x)))
-#define HF(x)    (sha512_update(&ctx, sizeof (void*), (uint8_t *)&(x)))
-#endif
-
-int	getentropy(void *buf, size_t len);
-
-#ifdef CAN_REFERENCE_MAIN
-extern int main(int, char *argv[]);
-#endif
-static int gotdata(char *buf, size_t len);
-#if defined(SYS_getrandom) && defined(__NR_getrandom)
-static int getentropy_getrandom(void *buf, size_t len);
-#endif
-static int getentropy_urandom(void *buf, size_t len);
-#ifdef SYS__sysctl
-static int getentropy_sysctl(void *buf, size_t len);
-#endif
-static int getentropy_fallback(void *buf, size_t len);
-
-int
-getentropy(void *buf, size_t len)
-{
-	int ret = -1;
-
-	if (len > 256) {
-		errno = EIO;
-		return -1;
-	}
-
-#if defined(SYS_getrandom) && defined(__NR_getrandom)
-	/*
-	 * Try descriptor-less getrandom()
-	 */
-	ret = getentropy_getrandom(buf, len);
-	if (ret != -1)
-		return (ret);
-	if (errno != ENOSYS)
-		return (-1);
-#endif
-
-	/*
-	 * Try to get entropy with /dev/urandom
-	 *
-	 * This can fail if the process is inside a chroot or if file
-	 * descriptors are exhausted.
-	 */
-	ret = getentropy_urandom(buf, len);
-	if (ret != -1)
-		return (ret);
-
-#ifdef SYS__sysctl
-	/*
-	 * Try to use sysctl CTL_KERN, KERN_RANDOM, RANDOM_UUID.
-	 * sysctl is a failsafe API, so it guarantees a result.  This
-	 * should work inside a chroot, or when file descriptors are
-	 * exhausted.
-	 *
-	 * However this can fail if the Linux kernel removes support
-	 * for sysctl.  Starting in 2007, there have been efforts to
-	 * deprecate the sysctl API/ABI, and push callers towards use
-	 * of the chroot-unavailable fd-using /proc mechanism --
-	 * essentially the same problems as /dev/urandom.
-	 *
-	 * Numerous setbacks have been encountered in their deprecation
-	 * schedule, so as of June 2014 the kernel ABI still exists on
-	 * most Linux architectures. The sysctl() stub in libc is missing
-	 * on some systems.  There are also reports that some kernels
-	 * spew messages to the console.
-	 */
-	ret = getentropy_sysctl(buf, len);
-	if (ret != -1)
-		return (ret);
-#endif /* SYS__sysctl */
-
-	/*
-	 * Entropy collection via /dev/urandom and sysctl have failed.
-	 *
-	 * No other API exists for collecting entropy.  See the large
-	 * comment block above.
-	 *
-	 * We have very few options:
-	 *     - Even syslog_r is unsafe to call at this low level, so
-	 *	 there is no way to alert the user or program.
-	 *     - Cannot call abort() because some systems have unsafe
-	 *	 corefiles.
-	 *     - Could raise(SIGKILL) resulting in silent program termination.
-	 *     - Return EIO, to hint that arc4random's stir function
-	 *       should raise(SIGKILL)
-	 *     - Do the best under the circumstances....
-	 *
-	 * This code path exists to bring light to the issue that Linux
-	 * does not provide a failsafe API for entropy collection.
-	 *
-	 * We hope this demonstrates that Linux should either retain their
-	 * sysctl ABI, or consider providing a new failsafe API which
-	 * works in a chroot or when file descriptors are exhausted.
-	 */
-#undef FAIL_INSTEAD_OF_TRYING_FALLBACK
-#ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
-	raise(SIGKILL);
-#endif
-	ret = getentropy_fallback(buf, len);
-	if (ret != -1)
-		return (ret);
-
-	errno = EIO;
-	return (ret);
-}
-
-/*
- * Basic sanity checking; wish we could do better.
- */
-static int
-gotdata(char *buf, size_t len)
-{
-	char	any_set = 0;
-	size_t	i;
-
-	for (i = 0; i < len; ++i)
-		any_set |= buf[i];
-	if (any_set == 0)
-		return -1;
-	return 0;
-}
-
-#if defined(SYS_getrandom) && defined(__NR_getrandom)
-static int
-getentropy_getrandom(void *buf, size_t len)
-{
-	int pre_errno = errno;
-	int ret;
-	if (len > 256)
-		return (-1);
-	do {
-		ret = syscall(SYS_getrandom, buf, len, 0);
-	} while (ret == -1 && errno == EINTR);
-
-	if (ret != (int)len)
-		return (-1);
-	errno = pre_errno;
-	return (0);
-}
-#endif
-
-static int
-getentropy_urandom(void *buf, size_t len)
-{
-	struct stat st;
-	size_t i;
-	int fd, cnt, flags;
-	int save_errno = errno;
-
-start:
-
-	flags = O_RDONLY;
-#ifdef O_NOFOLLOW
-	flags |= O_NOFOLLOW;
-#endif
-#ifdef O_CLOEXEC
-	flags |= O_CLOEXEC;
-#endif
-	fd = open("/dev/urandom", flags, 0);
-	if (fd == -1) {
-		if (errno == EINTR)
-			goto start;
-		goto nodevrandom;
-	}
-#ifndef O_CLOEXEC
-	fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
-#endif
-
-	/* Lightly verify that the device node looks sane */
-	if (fstat(fd, &st) == -1 || !S_ISCHR(st.st_mode)) {
-		close(fd);
-		goto nodevrandom;
-	}
-	if (ioctl(fd, RNDGETENTCNT, &cnt) == -1) {
-		close(fd);
-		goto nodevrandom;
-	}
-	for (i = 0; i < len; ) {
-		size_t wanted = len - i;
-		ssize_t ret = read(fd, (char*)buf + i, wanted);
-
-		if (ret == -1) {
-			if (errno == EAGAIN || errno == EINTR)
-				continue;
-			close(fd);
-			goto nodevrandom;
-		}
-		i += ret;
-	}
-	close(fd);
-	if (gotdata(buf, len) == 0) {
-		errno = save_errno;
-		return 0;		/* satisfied */
-	}
-nodevrandom:
-	errno = EIO;
-	return -1;
-}
-
-#ifdef SYS__sysctl
-static int
-getentropy_sysctl(void *buf, size_t len)
-{
-	static int mib[] = { CTL_KERN, KERN_RANDOM, RANDOM_UUID };
-	size_t i;
-	int save_errno = errno;
-
-	for (i = 0; i < len; ) {
-		size_t chunk = min(len - i, 16);
-
-		/* SYS__sysctl because some systems already removed sysctl() */
-		struct __sysctl_args args = {
-			.name = mib,
-			.nlen = 3,
-			.oldval = (char *)buf + i,
-			.oldlenp = &chunk,
-		};
-		if (syscall(SYS__sysctl, &args) != 0)
-			goto sysctlfailed;
-		i += chunk;
-	}
-	if (gotdata(buf, len) == 0) {
-		errno = save_errno;
-		return (0);			/* satisfied */
-	}
-sysctlfailed:
-	errno = EIO;
-	return -1;
-}
-#endif /* SYS__sysctl */
-
-static int cl[] = {
-	CLOCK_REALTIME,
-#ifdef CLOCK_MONOTONIC
-	CLOCK_MONOTONIC,
-#endif
-#ifdef CLOCK_MONOTONIC_RAW
-	CLOCK_MONOTONIC_RAW,
-#endif
-#ifdef CLOCK_TAI
-	CLOCK_TAI,
-#endif
-#ifdef CLOCK_VIRTUAL
-	CLOCK_VIRTUAL,
-#endif
-#ifdef CLOCK_UPTIME
-	CLOCK_UPTIME,
-#endif
-#ifdef CLOCK_PROCESS_CPUTIME_ID
-	CLOCK_PROCESS_CPUTIME_ID,
-#endif
-#ifdef CLOCK_THREAD_CPUTIME_ID
-	CLOCK_THREAD_CPUTIME_ID,
-#endif
-};
-
-static int
-getentropy_fallback(void *buf, size_t len)
-{
-	uint8_t results[SHA512_DIGEST_LENGTH];
-	int save_errno = errno, e, pgs = getpagesize(), faster = 0, repeat;
-	static int cnt;
-	struct timespec ts;
-	struct timeval tv;
-	struct rusage ru;
-	sigset_t sigset;
-	struct stat st;
-	CRYPTO_SHA512_CTX ctx;
-	static pid_t lastpid;
-	pid_t pid;
-	size_t i, ii, m;
-	char *p;
-
-	pid = getpid();
-	if (lastpid == pid) {
-		faster = 1;
-		repeat = 2;
-	} else {
-		faster = 0;
-		lastpid = pid;
-		repeat = REPEAT;
-	}
-	for (i = 0; i < len; ) {
-		int j;
-		CRYPTO_SHA512_INIT(&ctx);
-		for (j = 0; j < repeat; j++) {
-			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
-			if (e != -1) {
-				cnt += (int)tv.tv_sec;
-				cnt += (int)tv.tv_usec;
-			}
-
-			for (ii = 0; ii < sizeof(cl)/sizeof(cl[0]); ii++)
-				HX(clock_gettime(cl[ii], &ts) == -1, ts);
-
-			HX((pid = getpid()) == -1, pid);
-			HX((pid = getsid(pid)) == -1, pid);
-			HX((pid = getppid()) == -1, pid);
-			HX((pid = getpgid(0)) == -1, pid);
-			HX((e = getpriority(0, 0)) == -1, e);
-
-			if (!faster) {
-				ts.tv_sec = 0;
-				ts.tv_nsec = 1;
-				(void) nanosleep(&ts, NULL);
-			}
-
-			HX(sigpending(&sigset) == -1, sigset);
-			HX(sigprocmask(SIG_BLOCK, NULL, &sigset) == -1,
-			    sigset);
-
-#ifdef CAN_REFERENCE_MAIN
-			HF(main);		/* an addr in program */
-#endif
-			HF(getentropy);	/* an addr in this library */
-			HF(printf);		/* an addr in libc */
-			p = (char *)&p;
-			HD(p);		/* an addr on stack */
-			p = (char *)&errno;
-			HD(p);		/* the addr of errno */
-
-			if (i == 0) {
-				struct sockaddr_storage ss;
-				struct statvfs stvfs;
-				struct termios tios;
-				struct statfs stfs;
-				socklen_t ssl;
-				off_t off;
-
-				/*
-				 * Prime-sized mappings encourage fragmentation;
-				 * thus exposing some address entropy.
-				 */
-				struct mm {
-					size_t	npg;
-					void	*p;
-				} mm[] =	 {
-					{ 17, MAP_FAILED }, { 3, MAP_FAILED },
-					{ 11, MAP_FAILED }, { 2, MAP_FAILED },
-					{ 5, MAP_FAILED }, { 3, MAP_FAILED },
-					{ 7, MAP_FAILED }, { 1, MAP_FAILED },
-					{ 57, MAP_FAILED }, { 3, MAP_FAILED },
-					{ 131, MAP_FAILED }, { 1, MAP_FAILED },
-				};
-
-				for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
-					HX(mm[m].p = mmap(NULL,
-					    mm[m].npg * pgs,
-					    PROT_READ|PROT_WRITE,
-					    MAP_PRIVATE|MAP_ANON, -1,
-					    (off_t)0), mm[m].p);
-					if (mm[m].p != MAP_FAILED) {
-						size_t mo;
-
-						/* Touch some memory... */
-						p = mm[m].p;
-						mo = cnt %
-						    (mm[m].npg * pgs - 1);
-						p[mo] = 1;
-						cnt += (int)((long)(mm[m].p)
-						    / pgs);
-					}
-
-					/* Check cnts and times... */
-					for (ii = 0; ii < sizeof(cl)/sizeof(cl[0]);
-					    ii++) {
-						HX((e = clock_gettime(cl[ii],
-						    &ts)) == -1, ts);
-						if (e != -1)
-							cnt += (int)ts.tv_nsec;
-					}
-
-					HX((e = getrusage(RUSAGE_SELF,
-					    &ru)) == -1, ru);
-					if (e != -1) {
-						cnt += (int)ru.ru_utime.tv_sec;
-						cnt += (int)ru.ru_utime.tv_usec;
-					}
-				}
-
-				for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
-					if (mm[m].p != MAP_FAILED)
-						munmap(mm[m].p, mm[m].npg * pgs);
-					mm[m].p = MAP_FAILED;
-				}
-
-				HX(stat(".", &st) == -1, st);
-				HX(statvfs(".", &stvfs) == -1, stvfs);
-				HX(statfs(".", &stfs) == -1, stfs);
-
-				HX(stat("/", &st) == -1, st);
-				HX(statvfs("/", &stvfs) == -1, stvfs);
-				HX(statfs("/", &stfs) == -1, stfs);
-
-				HX((e = fstat(0, &st)) == -1, st);
-				if (e == -1) {
-					if (S_ISREG(st.st_mode) ||
-					    S_ISFIFO(st.st_mode) ||
-					    S_ISSOCK(st.st_mode)) {
-						HX(fstatvfs(0, &stvfs) == -1,
-						    stvfs);
-						HX(fstatfs(0, &stfs) == -1,
-						    stfs);
-						HX((off = lseek(0, (off_t)0,
-						    SEEK_CUR)) < 0, off);
-					}
-					if (S_ISCHR(st.st_mode)) {
-						HX(tcgetattr(0, &tios) == -1,
-						    tios);
-					} else if (S_ISSOCK(st.st_mode)) {
-						memset(&ss, 0, sizeof ss);
-						ssl = sizeof(ss);
-						HX(getpeername(0,
-						    (void *)&ss, &ssl) == -1,
-						    ss);
-					}
-				}
-
-				HX((e = getrusage(RUSAGE_CHILDREN,
-				    &ru)) == -1, ru);
-				if (e != -1) {
-					cnt += (int)ru.ru_utime.tv_sec;
-					cnt += (int)ru.ru_utime.tv_usec;
-				}
-			} else {
-				/* Subsequent hashes absorb previous result */
-				HD(results);
-			}
-
-			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
-			if (e != -1) {
-				cnt += (int)tv.tv_sec;
-				cnt += (int)tv.tv_usec;
-			}
-
-			HD(cnt);
-		}
-#ifdef HAVE_GETAUXVAL
-#  ifdef AT_RANDOM
-		/* Not as random as you think but we take what we are given */
-		p = (char *) getauxval(AT_RANDOM);
-		if (p)
-			HR(p, 16);
-#  endif
-#  ifdef AT_SYSINFO_EHDR
-		p = (char *) getauxval(AT_SYSINFO_EHDR);
-		if (p)
-			HR(p, pgs);
-#  endif
-#  ifdef AT_BASE
-		p = (char *) getauxval(AT_BASE);
-		if (p)
-			HD(p);
-#  endif
-#endif /* HAVE_GETAUXVAL */
-
-		CRYPTO_SHA512_FINAL(results, &ctx);
-		memcpy((char*)buf + i, results, min(sizeof(results), len - i));
-		i += min(sizeof(results), len - i);
-	}
-	memset(results, 0, sizeof results);
-	if (gotdata(buf, len) == 0) {
-		errno = save_errno;
-		return 0;		/* satisfied */
-	}
-	errno = EIO;
-	return -1;
-}

compat/getentropy_osx.c

@@ -1,432 +0,0 @@
-/*	$OpenBSD: getentropy_osx.c,v 1.3 2014/07/12 14:48:00 deraadt Exp $	*/
-
-/*
- * Copyright (c) 2014 Theo de Raadt <deraadt@openbsd.org>
- * Copyright (c) 2014 Bob Beck <beck@obtuse.com>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/ioctl.h>
-#include <sys/resource.h>
-#include <sys/syscall.h>
-#include <sys/sysctl.h>
-#include <sys/statvfs.h>
-#include <sys/socket.h>
-#include <sys/mount.h>
-#include <sys/mman.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <termios.h>
-#include <fcntl.h>
-#include <signal.h>
-#include <string.h>
-#include <errno.h>
-#include <unistd.h>
-#include <time.h>
-#include <mach/mach_time.h>
-#include <mach/mach_host.h>
-#include <mach/host_info.h>
-#include <sys/socketvar.h>
-#include <sys/vmmeter.h>
-#include <netinet/in.h>
-#include <netinet/tcp.h>
-#include <netinet/udp.h>
-#include <netinet/ip_var.h>
-#include <netinet/tcp_var.h>
-#include <netinet/udp_var.h>
-#include <CommonCrypto/CommonDigest.h>
-#define SHA512_Update(a, b, c)	(CC_SHA512_Update((a), (b), (c)))
-#define SHA512_Init(xxx) (CC_SHA512_Init((xxx)))
-#define SHA512_Final(xxx, yyy) (CC_SHA512_Final((xxx), (yyy)))
-#define SHA512_CTX CC_SHA512_CTX
-#define SHA512_DIGEST_LENGTH CC_SHA512_DIGEST_LENGTH
-
-#define REPEAT 5
-#define min(a, b) (((a) < (b)) ? (a) : (b))
-
-#define HX(a, b) \
-	do { \
-		if ((a)) \
-			HD(errno); \
-		else \
-			HD(b); \
-	} while (0)
-
-#define HR(x, l) (SHA512_Update(&ctx, (char *)(x), (l)))
-#define HD(x)	 (SHA512_Update(&ctx, (char *)&(x), sizeof (x)))
-#define HF(x)    (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))
-
-int	getentropy(void *buf, size_t len);
-
-#ifdef CAN_REFERENCE_MAIN
-extern int main(int, char *argv[]);
-#endif
-static int gotdata(char *buf, size_t len);
-static int getentropy_urandom(void *buf, size_t len);
-static int getentropy_fallback(void *buf, size_t len);
-
-int
-getentropy(void *buf, size_t len)
-{
-	int ret = -1;
-
-	if (len > 256) {
-		errno = EIO;
-		return -1;
-	}
-
-	/*
-	 * Try to get entropy with /dev/urandom
-	 *
-	 * This can fail if the process is inside a chroot or if file
-	 * descriptors are exhausted.
-	 */
-	ret = getentropy_urandom(buf, len);
-	if (ret != -1)
-		return (ret);
-
-	/*
-	 * Entropy collection via /dev/urandom and sysctl have failed.
-	 *
-	 * No other API exists for collecting entropy, and we have
-	 * no failsafe way to get it on OSX that is not sensitive
-	 * to resource exhaustion.
-	 *
-	 * We have very few options:
-	 *     - Even syslog_r is unsafe to call at this low level, so
-	 *	 there is no way to alert the user or program.
-	 *     - Cannot call abort() because some systems have unsafe
-	 *	 corefiles.
-	 *     - Could raise(SIGKILL) resulting in silent program termination.
-	 *     - Return EIO, to hint that arc4random's stir function
-	 *       should raise(SIGKILL)
-	 *     - Do the best under the circumstances....
-	 *
-	 * This code path exists to bring light to the issue that OSX
-	 * does not provide a failsafe API for entropy collection.
-	 *
-	 * We hope this demonstrates that OSX should consider
-	 * providing a new failsafe API which works in a chroot or
-	 * when file descriptors are exhausted.
-	 */
-#undef FAIL_INSTEAD_OF_TRYING_FALLBACK
-#ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
-	raise(SIGKILL);
-#endif
-	ret = getentropy_fallback(buf, len);
-	if (ret != -1)
-		return (ret);
-
-	errno = EIO;
-	return (ret);
-}
-
-/*
- * Basic sanity checking; wish we could do better.
- */
-static int
-gotdata(char *buf, size_t len)
-{
-	char	any_set = 0;
-	size_t	i;
-
-	for (i = 0; i < len; ++i)
-		any_set |= buf[i];
-	if (any_set == 0)
-		return -1;
-	return 0;
-}
-
-static int
-getentropy_urandom(void *buf, size_t len)
-{
-	struct stat st;
-	size_t i;
-	int fd, flags;
-	int save_errno = errno;
-
-start:
-
-	flags = O_RDONLY;
-#ifdef O_NOFOLLOW
-	flags |= O_NOFOLLOW;
-#endif
-#ifdef O_CLOEXEC
-	flags |= O_CLOEXEC;
-#endif
-	fd = open("/dev/urandom", flags, 0);
-	if (fd == -1) {
-		if (errno == EINTR)
-			goto start;
-		goto nodevrandom;
-	}
-#ifndef O_CLOEXEC
-	fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
-#endif
-
-	/* Lightly verify that the device node looks sane */
-	if (fstat(fd, &st) == -1 || !S_ISCHR(st.st_mode)) {
-		close(fd);
-		goto nodevrandom;
-	}
-	for (i = 0; i < len; ) {
-		size_t wanted = len - i;
-		ssize_t ret = read(fd, (char*)buf + i, wanted);
-
-		if (ret == -1) {
-			if (errno == EAGAIN || errno == EINTR)
-				continue;
-			close(fd);
-			goto nodevrandom;
-		}
-		i += ret;
-	}
-	close(fd);
-	if (gotdata(buf, len) == 0) {
-		errno = save_errno;
-		return 0;		/* satisfied */
-	}
-nodevrandom:
-	errno = EIO;
-	return -1;
-}
-
-static int tcpmib[] = { CTL_NET, AF_INET, IPPROTO_TCP, TCPCTL_STATS };
-static int udpmib[] = { CTL_NET, AF_INET, IPPROTO_UDP, UDPCTL_STATS };
-static int ipmib[] = { CTL_NET, AF_INET, IPPROTO_IP, IPCTL_STATS };
-static int kmib[] = { CTL_KERN, KERN_USRSTACK };
-static int hwmib[] = { CTL_HW, HW_USERMEM };
-
-static int
-getentropy_fallback(void *buf, size_t len)
-{
-	uint8_t results[SHA512_DIGEST_LENGTH];
-	int save_errno = errno, e, pgs = getpagesize(), faster = 0, repeat;
-	static int cnt;
-	struct timespec ts;
-	struct timeval tv;
-	struct rusage ru;
-	sigset_t sigset;
-	struct stat st;
-	SHA512_CTX ctx;
-	static pid_t lastpid;
-	pid_t pid;
-	size_t i, ii, m;
-	char *p;
-	struct tcpstat tcpstat;
-	struct udpstat udpstat;
-	struct ipstat ipstat;
-	u_int64_t mach_time;
-	unsigned int idata;
-	void *addr;
-
-	pid = getpid();
-	if (lastpid == pid) {
-		faster = 1;
-		repeat = 2;
-	} else {
-		faster = 0;
-		lastpid = pid;
-		repeat = REPEAT;
-	}
-	for (i = 0; i < len; ) {
-		int j;
-		SHA512_Init(&ctx);
-		for (j = 0; j < repeat; j++) {
-			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
-			if (e != -1) {
-				cnt += (int)tv.tv_sec;
-				cnt += (int)tv.tv_usec;
-			}
-
-			mach_time = mach_absolute_time();
-			HD(mach_time);
-
-			ii = sizeof(addr);
-			HX(sysctl(kmib, sizeof(kmib) / sizeof(kmib[0]),
-			    &addr, &ii, NULL, 0) == -1, addr);
-
-			ii = sizeof(idata);
-			HX(sysctl(hwmib, sizeof(hwmib) / sizeof(hwmib[0]),
-			    &idata, &ii, NULL, 0) == -1, idata);
-
-			ii = sizeof(tcpstat);
-			HX(sysctl(tcpmib, sizeof(tcpmib) / sizeof(tcpmib[0]),
-			    &tcpstat, &ii, NULL, 0) == -1, tcpstat);
-
-			ii = sizeof(udpstat);
-			HX(sysctl(udpmib, sizeof(udpmib) / sizeof(udpmib[0]),
-			    &udpstat, &ii, NULL, 0) == -1, udpstat);
-
-			ii = sizeof(ipstat);
-			HX(sysctl(ipmib, sizeof(ipmib) / sizeof(ipmib[0]),
-			    &ipstat, &ii, NULL, 0) == -1, ipstat);
-
-			HX((pid = getpid()) == -1, pid);
-			HX((pid = getsid(pid)) == -1, pid);
-			HX((pid = getppid()) == -1, pid);
-			HX((pid = getpgid(0)) == -1, pid);
-			HX((e = getpriority(0, 0)) == -1, e);
-
-			if (!faster) {
-				ts.tv_sec = 0;
-				ts.tv_nsec = 1;
-				(void) nanosleep(&ts, NULL);
-			}
-
-			HX(sigpending(&sigset) == -1, sigset);
-			HX(sigprocmask(SIG_BLOCK, NULL, &sigset) == -1,
-			    sigset);
-
-#ifdef CAN_REFERENCE_MAIN
-			HF(main);		/* an addr in program */
-#endif
-			HF(getentropy);	/* an addr in this library */
-			HF(printf);		/* an addr in libc */
-			p = (char *)&p;
-			HD(p);		/* an addr on stack */
-			p = (char *)&errno;
-			HD(p);		/* the addr of errno */
-
-			if (i == 0) {
-				struct sockaddr_storage ss;
-				struct statvfs stvfs;
-				struct termios tios;
-				struct statfs stfs;
-				socklen_t ssl;
-				off_t off;
-
-				/*
-				 * Prime-sized mappings encourage fragmentation;
-				 * thus exposing some address entropy.
-				 */
-				struct mm {
-					size_t	npg;
-					void	*p;
-				} mm[] =	 {
-					{ 17, MAP_FAILED }, { 3, MAP_FAILED },
-					{ 11, MAP_FAILED }, { 2, MAP_FAILED },
-					{ 5, MAP_FAILED }, { 3, MAP_FAILED },
-					{ 7, MAP_FAILED }, { 1, MAP_FAILED },
-					{ 57, MAP_FAILED }, { 3, MAP_FAILED },
-					{ 131, MAP_FAILED }, { 1, MAP_FAILED },
-				};
-
-				for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
-					HX(mm[m].p = mmap(NULL,
-					    mm[m].npg * pgs,
-					    PROT_READ|PROT_WRITE,
-					    MAP_PRIVATE|MAP_ANON, -1,
-					    (off_t)0), mm[m].p);
-					if (mm[m].p != MAP_FAILED) {
-						size_t mo;
-
-						/* Touch some memory... */
-						p = mm[m].p;
-						mo = cnt %
-						    (mm[m].npg * pgs - 1);
-						p[mo] = 1;
-						cnt += (int)((long)(mm[m].p)
-						    / pgs);
-					}
-
-					/* Check cnts and times... */
-					mach_time = mach_absolute_time();
-					HD(mach_time);
-					cnt += (int)mach_time;
-
-					HX((e = getrusage(RUSAGE_SELF,
-					    &ru)) == -1, ru);
-					if (e != -1) {
-						cnt += (int)ru.ru_utime.tv_sec;
-						cnt += (int)ru.ru_utime.tv_usec;
-					}
-				}
-
-				for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
-					if (mm[m].p != MAP_FAILED)
-						munmap(mm[m].p, mm[m].npg * pgs);
-					mm[m].p = MAP_FAILED;
-				}
-
-				HX(stat(".", &st) == -1, st);
-				HX(statvfs(".", &stvfs) == -1, stvfs);
-				HX(statfs(".", &stfs) == -1, stfs);
-
-				HX(stat("/", &st) == -1, st);
-				HX(statvfs("/", &stvfs) == -1, stvfs);
-				HX(statfs("/", &stfs) == -1, stfs);
-
-				HX((e = fstat(0, &st)) == -1, st);
-				if (e == -1) {
-					if (S_ISREG(st.st_mode) ||
-					    S_ISFIFO(st.st_mode) ||
-					    S_ISSOCK(st.st_mode)) {
-						HX(fstatvfs(0, &stvfs) == -1,
-						    stvfs);
-						HX(fstatfs(0, &stfs) == -1,
-						    stfs);
-						HX((off = lseek(0, (off_t)0,
-						    SEEK_CUR)) < 0, off);
-					}
-					if (S_ISCHR(st.st_mode)) {
-						HX(tcgetattr(0, &tios) == -1,
-						    tios);
-					} else if (S_ISSOCK(st.st_mode)) {
-						memset(&ss, 0, sizeof ss);
-						ssl = sizeof(ss);
-						HX(getpeername(0,
-						    (void *)&ss, &ssl) == -1,
-						    ss);
-					}
-				}
-
-				HX((e = getrusage(RUSAGE_CHILDREN,
-				    &ru)) == -1, ru);
-				if (e != -1) {
-					cnt += (int)ru.ru_utime.tv_sec;
-					cnt += (int)ru.ru_utime.tv_usec;
-				}
-			} else {
-				/* Subsequent hashes absorb previous result */
-				HD(results);
-			}
-
-			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
-			if (e != -1) {
-				cnt += (int)tv.tv_sec;
-				cnt += (int)tv.tv_usec;
-			}
-
-			HD(cnt);
-		}
-
-		SHA512_Final(results, &ctx);
-		memcpy((char*)buf + i, results, min(sizeof(results), len - i));
-		i += min(sizeof(results), len - i);
-	}
-	memset(results, 0, sizeof results);
-	if (gotdata(buf, len) == 0) {
-		errno = save_errno;
-		return 0;		/* satisfied */
-	}
-	errno = EIO;
-	return -1;
-}

compat/getentropy_solaris.c

@@ -1,441 +0,0 @@
-/*	$OpenBSD: getentropy_solaris.c,v 1.3 2014/07/12 14:46:31 deraadt Exp $	*/
-
-/*
- * Copyright (c) 2014 Theo de Raadt <deraadt@openbsd.org>
- * Copyright (c) 2014 Bob Beck <beck@obtuse.com>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/ioctl.h>
-#include <sys/resource.h>
-#include <sys/syscall.h>
-#include <sys/statvfs.h>
-#include <sys/socket.h>
-#include <sys/mount.h>
-#include <sys/mman.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <stdlib.h>
-#ifdef HAVE_STDINT_H
-#include <stdint.h>
-#endif
-#include <stdio.h>
-#include <termios.h>
-#include <fcntl.h>
-#include <signal.h>
-#include <string.h>
-#include <errno.h>
-#include <unistd.h>
-#include <time.h>
-#ifdef HAVE_SYS_SHA2_H
-#include <sys/sha2.h>
-#define SHA512_Init SHA512Init
-#define SHA512_Update SHA512Update
-#define SHA512_Final SHA512Final
-#else
-#include "openssl/sha.h"
-#endif
-
-#include <sys/vfs.h>
-#include <sys/statfs.h>
-#include <sys/loadavg.h>
-
-#define REPEAT 5
-#define min(a, b) (((a) < (b)) ? (a) : (b))
-
-#define HX(a, b) \
-	do { \
-		if ((a)) \
-			HD(errno); \
-		else \
-			HD(b); \
-	} while (0)
-
-#define HR(x, l) (SHA512_Update(&ctx, (char *)(x), (l)))
-#define HD(x)	 (SHA512_Update(&ctx, (char *)&(x), sizeof (x)))
-#define HF(x)	 (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))
-
-int	getentropy(void *buf, size_t len);
-
-#ifdef CAN_REFERENCE_MAIN
-extern int main(int, char *argv[]);
-#endif
-static int gotdata(char *buf, size_t len);
-static int getentropy_urandom(void *buf, size_t len, const char *path,
-    int devfscheck);
-static int getentropy_fallback(void *buf, size_t len);
-
-int
-getentropy(void *buf, size_t len)
-{
-	int ret = -1;
-
-	if (len > 256) {
-		errno = EIO;
-		return -1;
-	}
-
-	/*
-	 * Try to get entropy with /dev/urandom
-	 *
-	 * Solaris provides /dev/urandom as a symbolic link to
-	 * /devices/pseudo/random@0:urandom which is provided by
-	 * a devfs filesystem.  Best practice is to use O_NOFOLLOW,
-	 * so we must try the unpublished name directly.
-	 *
-	 * This can fail if the process is inside a chroot which lacks
-	 * the devfs mount, or if file descriptors are exhausted.
-	 */
-	ret = getentropy_urandom(buf, len,
-	    "/devices/pseudo/random@0:urandom", 1);
-	if (ret != -1)
-		return (ret);
-
-	/*
-	 * Unfortunately, chroot spaces on Solaris are sometimes setup
-	 * with direct device node of the well-known /dev/urandom name
-	 * (perhaps to avoid dragging all of devfs into the space).
-	 *
-	 * This can fail if the process is inside a chroot or if file
-	 * descriptors are exhausted.
-	 */
-	ret = getentropy_urandom(buf, len, "/dev/urandom", 0);
-	if (ret != -1)
-		return (ret);
-
-	/*
-	 * Entropy collection via /dev/urandom has failed.
-	 *
-	 * No other API exists for collecting entropy, and we have
-	 * no failsafe way to get it on Solaris that is not sensitive
-	 * to resource exhaustion.
-	 *
-	 * We have very few options:
-	 *     - Even syslog_r is unsafe to call at this low level, so
-	 *	 there is no way to alert the user or program.
-	 *     - Cannot call abort() because some systems have unsafe
-	 *	 corefiles.
-	 *     - Could raise(SIGKILL) resulting in silent program termination.
-	 *     - Return EIO, to hint that arc4random's stir function
-	 *       should raise(SIGKILL)
-	 *     - Do the best under the circumstances....
-	 *
-	 * This code path exists to bring light to the issue that Solaris
-	 * does not provide a failsafe API for entropy collection.
-	 *
-	 * We hope this demonstrates that Solaris should consider
-	 * providing a new failsafe API which works in a chroot or
-	 * when file descriptors are exhausted.
-	 */
-#undef FAIL_INSTEAD_OF_TRYING_FALLBACK
-#ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
-	raise(SIGKILL);
-#endif
-	ret = getentropy_fallback(buf, len);
-	if (ret != -1)
-		return (ret);
-
-	errno = EIO;
-	return (ret);
-}
-
-/*
- * Basic sanity checking; wish we could do better.
- */
-static int
-gotdata(char *buf, size_t len)
-{
-	char	any_set = 0;
-	size_t	i;
-
-	for (i = 0; i < len; ++i)
-		any_set |= buf[i];
-	if (any_set == 0)
-		return -1;
-	return 0;
-}
-
-static int
-getentropy_urandom(void *buf, size_t len, const char *path, int devfscheck)
-{
-	struct stat st;
-	size_t i;
-	int fd, flags;
-	int save_errno = errno;
-
-start:
-
-	flags = O_RDONLY;
-#ifdef O_NOFOLLOW
-	flags |= O_NOFOLLOW;
-#endif
-#ifdef O_CLOEXEC
-	flags |= O_CLOEXEC;
-#endif
-	fd = open(path, flags, 0);
-	if (fd == -1) {
-		if (errno == EINTR)
-			goto start;
-		goto nodevrandom;
-	}
-#ifndef O_CLOEXEC
-	fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
-#endif
-
-	/* Lightly verify that the device node looks sane */
-	if (fstat(fd, &st) == -1 || !S_ISCHR(st.st_mode) ||
-	    (devfscheck && (strcmp(st.st_fstype, "devfs") != 0))) {
-		close(fd);
-		goto nodevrandom;
-	}
-	for (i = 0; i < len; ) {
-		size_t wanted = len - i;
-		ssize_t ret = read(fd, (char*)buf + i, wanted);
-
-		if (ret == -1) {
-			if (errno == EAGAIN || errno == EINTR)
-				continue;
-			close(fd);
-			goto nodevrandom;
-		}
-		i += ret;
-	}
-	close(fd);
-	if (gotdata(buf, len) == 0) {
-		errno = save_errno;
-		return 0;		/* satisfied */
-	}
-nodevrandom:
-	errno = EIO;
-	return -1;
-}
-
-static const int cl[] = {
-	CLOCK_REALTIME,
-#ifdef CLOCK_MONOTONIC
-	CLOCK_MONOTONIC,
-#endif
-#ifdef CLOCK_MONOTONIC_RAW
-	CLOCK_MONOTONIC_RAW,
-#endif
-#ifdef CLOCK_TAI
-	CLOCK_TAI,
-#endif
-#ifdef CLOCK_VIRTUAL
-	CLOCK_VIRTUAL,
-#endif
-#ifdef CLOCK_UPTIME
-	CLOCK_UPTIME,
-#endif
-#ifdef CLOCK_PROCESS_CPUTIME_ID
-	CLOCK_PROCESS_CPUTIME_ID,
-#endif
-#ifdef CLOCK_THREAD_CPUTIME_ID
-	CLOCK_THREAD_CPUTIME_ID,
-#endif
-};
-
-static int
-getentropy_fallback(void *buf, size_t len)
-{
-	uint8_t results[SHA512_DIGEST_LENGTH];
-	int save_errno = errno, e, pgs = getpagesize(), faster = 0, repeat;
-	static int cnt;
-	struct timespec ts;
-	struct timeval tv;
-	double loadavg[3];
-	struct rusage ru;
-	sigset_t sigset;
-	struct stat st;
-	SHA512_CTX ctx;
-	static pid_t lastpid;
-	pid_t pid;
-	size_t i, ii, m;
-	char *p;
-
-	pid = getpid();
-	if (lastpid == pid) {
-		faster = 1;
-		repeat = 2;
-	} else {
-		faster = 0;
-		lastpid = pid;
-		repeat = REPEAT;
-	}
-	for (i = 0; i < len; ) {
-		int j;
-		SHA512_Init(&ctx);
-		for (j = 0; j < repeat; j++) {
-			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
-			if (e != -1) {
-				cnt += (int)tv.tv_sec;
-				cnt += (int)tv.tv_usec;
-			}
-
-			for (ii = 0; ii < sizeof(cl)/sizeof(cl[0]); ii++)
-				HX(clock_gettime(cl[ii], &ts) == -1, ts);
-
-			HX((pid = getpid()) == -1, pid);
-			HX((pid = getsid(pid)) == -1, pid);
-			HX((pid = getppid()) == -1, pid);
-			HX((pid = getpgid(0)) == -1, pid);
-			HX((e = getpriority(0, 0)) == -1, e);
-			HX((getloadavg(loadavg, 3) == -1), loadavg);
-
-			if (!faster) {
-				ts.tv_sec = 0;
-				ts.tv_nsec = 1;
-				(void) nanosleep(&ts, NULL);
-			}
-
-			HX(sigpending(&sigset) == -1, sigset);
-			HX(sigprocmask(SIG_BLOCK, NULL, &sigset) == -1,
-			    sigset);
-
-#ifdef CAN_REFERENCE_MAIN
-			HF(main);		/* an addr in program */
-#endif
-			HF(getentropy);	/* an addr in this library */
-			HF(printf);		/* an addr in libc */
-			p = (char *)&p;
-			HD(p);		/* an addr on stack */
-			p = (char *)&errno;
-			HD(p);		/* the addr of errno */
-
-			if (i == 0) {
-				struct sockaddr_storage ss;
-				struct statvfs stvfs;
-				struct termios tios;
-				socklen_t ssl;
-				off_t off;
-
-				/*
-				 * Prime-sized mappings encourage fragmentation;
-				 * thus exposing some address entropy.
-				 */
-				struct mm {
-					size_t	npg;
-					void	*p;
-				} mm[] =	 {
-					{ 17, MAP_FAILED }, { 3, MAP_FAILED },
-					{ 11, MAP_FAILED }, { 2, MAP_FAILED },
-					{ 5, MAP_FAILED }, { 3, MAP_FAILED },
-					{ 7, MAP_FAILED }, { 1, MAP_FAILED },
-					{ 57, MAP_FAILED }, { 3, MAP_FAILED },
-					{ 131, MAP_FAILED }, { 1, MAP_FAILED },
-				};
-
-				for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
-					HX(mm[m].p = mmap(NULL,
-					    mm[m].npg * pgs,
-					    PROT_READ|PROT_WRITE,
-					    MAP_PRIVATE|MAP_ANON, -1,
-					    (off_t)0), mm[m].p);
-					if (mm[m].p != MAP_FAILED) {
-						size_t mo;
-
-						/* Touch some memory... */
-						p = mm[m].p;
-						mo = cnt %
-						    (mm[m].npg * pgs - 1);
-						p[mo] = 1;
-						cnt += (int)((long)(mm[m].p)
-						    / pgs);
-					}
-
-					/* Check cnts and times... */
-					for (ii = 0; ii < sizeof(cl)/sizeof(cl[0]);
-					    ii++) {
-						HX((e = clock_gettime(cl[ii],
-						    &ts)) == -1, ts);
-						if (e != -1)
-							cnt += (int)ts.tv_nsec;
-					}
-
-					HX((e = getrusage(RUSAGE_SELF,
-					    &ru)) == -1, ru);
-					if (e != -1) {
-						cnt += (int)ru.ru_utime.tv_sec;
-						cnt += (int)ru.ru_utime.tv_usec;
-					}
-				}
-
-				for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
-					if (mm[m].p != MAP_FAILED)
-						munmap(mm[m].p, mm[m].npg * pgs);
-					mm[m].p = MAP_FAILED;
-				}
-
-				HX(stat(".", &st) == -1, st);
-				HX(statvfs(".", &stvfs) == -1, stvfs);
-
-				HX(stat("/", &st) == -1, st);
-				HX(statvfs("/", &stvfs) == -1, stvfs);
-
-				HX((e = fstat(0, &st)) == -1, st);
-				if (e == -1) {
-					if (S_ISREG(st.st_mode) ||
-					    S_ISFIFO(st.st_mode) ||
-					    S_ISSOCK(st.st_mode)) {
-						HX(fstatvfs(0, &stvfs) == -1,
-						    stvfs);
-						HX((off = lseek(0, (off_t)0,
-						    SEEK_CUR)) < 0, off);
-					}
-					if (S_ISCHR(st.st_mode)) {
-						HX(tcgetattr(0, &tios) == -1,
-						    tios);
-					} else if (S_ISSOCK(st.st_mode)) {
-						memset(&ss, 0, sizeof ss);
-						ssl = sizeof(ss);
-						HX(getpeername(0,
-						    (void *)&ss, &ssl) == -1,
-						    ss);
-					}
-				}
-
-				HX((e = getrusage(RUSAGE_CHILDREN,
-				    &ru)) == -1, ru);
-				if (e != -1) {
-					cnt += (int)ru.ru_utime.tv_sec;
-					cnt += (int)ru.ru_utime.tv_usec;
-				}
-			} else {
-				/* Subsequent hashes absorb previous result */
-				HD(results);
-			}
-
-			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
-			if (e != -1) {
-				cnt += (int)tv.tv_sec;
-				cnt += (int)tv.tv_usec;
-			}
-
-			HD(cnt);
-		}
-		SHA512_Final(results, &ctx);
-		memcpy((char*)buf + i, results, min(sizeof(results), len - i));
-		i += min(sizeof(results), len - i);
-	}
-	memset(results, 0, sizeof results);
-	if (gotdata(buf, len) == 0) {
-		errno = save_errno;
-		return 0;		/* satisfied */
-	}
-	errno = EIO;
-	return -1;
-}

compat/getentropy_win.c

@@ -1,56 +0,0 @@
-/*	$OpenBSD$	*/
-
-/*
- * Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org> 
- * Copyright (c) 2014, Bob Beck <beck@obtuse.com>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <windows.h>
-#include <errno.h>
-#include <stdint.h>
-#include <sys/types.h>
-#include <wincrypt.h>
-#include <process.h>
-
-int	getentropy(void *buf, size_t len);
-
-/*
- * On Windows, CryptGenRandom is supposed to be a well-seeded
- * cryptographically strong random number generator.
- */
-int
-getentropy(void *buf, size_t len)
-{
-	HCRYPTPROV provider;
-
-	if (len > 256) {
-		errno = EIO;
-		return -1;
-	}
-
-	if (CryptAcquireContext(&provider, NULL, NULL, PROV_RSA_FULL,
-	    CRYPT_VERIFYCONTEXT) == 0)
-		goto fail;
-	if (CryptGenRandom(provider, len, buf) == 0) {
-		CryptReleaseContext(provider, 0);
-		goto fail;
-	}
-	CryptReleaseContext(provider, 0);
-	return (0);
-
-fail:
-	errno = EIO;
-	return (-1);
-}

compat/gmtime_r.c

@@ -1,107 +0,0 @@
-/*
- * Taken from FreeBSD src / lib / libc / stdtime / localtime.c 1.43 revision.
- * localtime.c 7.78.
- * tzfile.h 1.8
- * adapted to be replacement gmtime_r.
- */
-#include "config.h"
-
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-
-#define MONSPERYEAR 12
-#define DAYSPERNYEAR 365
-#define DAYSPERLYEAR 366
-#define SECSPERMIN 60
-#define SECSPERHOUR (60*60)
-#define SECSPERDAY (24*60*60)
-#define DAYSPERWEEK 7
-#define TM_SUNDAY	0
-#define TM_MONDAY	1
-#define TM_TUESDAY	2
-#define TM_WEDNESDAY	3
-#define TM_THURSDAY	4
-#define TM_FRIDAY	5
-#define TM_SATURDAY	6
-
-#define TM_YEAR_BASE	1900
-
-#define EPOCH_YEAR	1970
-#define EPOCH_WDAY	TM_THURSDAY
-
-#define isleap(y) (((y) % 4) == 0 && (((y) % 100) != 0 || ((y) % 400) == 0))
-
-static const int	mon_lengths[2][MONSPERYEAR] = {
-	{ 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 },
-	{ 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }
-};
-
-static const int	year_lengths[2] = {
-	DAYSPERNYEAR, DAYSPERLYEAR
-};
-
-static void
-timesub(timep, offset, tmp)
-const time_t * const			timep;
-const long				offset;
-struct tm * const		tmp;
-{
-	long			days;
-	long			rem;
-	long			y;
-	int			yleap;
-	const int *		ip;
-
-	days = *timep / SECSPERDAY;
-	rem = *timep % SECSPERDAY;
-	rem += (offset);
-	while (rem < 0) {
-		rem += SECSPERDAY;
-		--days;
-	}
-	while (rem >= SECSPERDAY) {
-		rem -= SECSPERDAY;
-		++days;
-	}
-	tmp->tm_hour = (int) (rem / SECSPERHOUR);
-	rem = rem % SECSPERHOUR;
-	tmp->tm_min = (int) (rem / SECSPERMIN);
-	/*
-	** A positive leap second requires a special
-	** representation.  This uses "... ??:59:60" et seq.
-	*/
-	tmp->tm_sec = (int) (rem % SECSPERMIN) ;
-	tmp->tm_wday = (int) ((EPOCH_WDAY + days) % DAYSPERWEEK);
-	if (tmp->tm_wday < 0)
-		tmp->tm_wday += DAYSPERWEEK;
-	y = EPOCH_YEAR;
-#define LEAPS_THRU_END_OF(y)	((y) / 4 - (y) / 100 + (y) / 400)
-	while (days < 0 || days >= (long) year_lengths[yleap = isleap(y)]) {
-		long	newy;
-
-		newy = y + days / DAYSPERNYEAR;
-		if (days < 0)
-			--newy;
-		days -= (newy - y) * DAYSPERNYEAR +
-			LEAPS_THRU_END_OF(newy - 1) -
-			LEAPS_THRU_END_OF(y - 1);
-		y = newy;
-	}
-	tmp->tm_year = y - TM_YEAR_BASE;
-	tmp->tm_yday = (int) days;
-	ip = mon_lengths[yleap];
-	for (tmp->tm_mon = 0; days >= (long) ip[tmp->tm_mon]; ++(tmp->tm_mon))
-		days = days - (long) ip[tmp->tm_mon];
-	tmp->tm_mday = (int) (days + 1);
-	tmp->tm_isdst = 0;
-}
-
-/*
-* Re-entrant version of gmtime.
-*/
-struct tm * gmtime_r(const time_t* timep, struct tm *tm)
-{
-	timesub(timep, 0L, tm);
-	return tm;
-}

compat/inet_aton.c

@@ -56,12 +56,8 @@
 
 #include <sys/types.h>
 #include <sys/param.h>
-#ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
-#endif
 #include <ctype.h>
 
 #if 0
@@ -103,7 +99,7 @@ inet_aton(const char *cp, struct in_addr *addr)
 		 * Values are specified as for C:
 		 * 0x=hex, 0=octal, isdigit=decimal.
 		 */
-		if (!isdigit((unsigned char)c))
+		if (!isdigit(c))
 			return (0);
 		val = 0; base = 10;
 		if (c == '0') {
@@ -114,12 +110,12 @@ inet_aton(const char *cp, struct in_addr *addr)
 				base = 8;
 		}
 		for (;;) {
-			if (isascii((unsigned char)c) && isdigit((unsigned char)c)) {
+			if (isascii(c) && isdigit(c)) {
 				val = (val * base) + (c - '0');
 				c = *++cp;
-			} else if (base == 16 && isascii((unsigned char)c) && isxdigit((unsigned char)c)) {
+			} else if (base == 16 && isascii(c) && isxdigit(c)) {
 				val = (val << 4) |
-					(c + 10 - (islower((unsigned char)c) ? 'a' : 'A'));
+					(c + 10 - (islower(c) ? 'a' : 'A'));
 				c = *++cp;
 			} else
 				break;
@@ -141,7 +137,7 @@ inet_aton(const char *cp, struct in_addr *addr)
 	/*
 	 * Check for trailing characters.
 	 */
-	if (c != '\0' && (!isascii((unsigned char)c) || !isspace((unsigned char)c)))
+	if (c != '\0' && (!isascii(c) || !isspace(c)))
 		return (0);
 	/*
 	 * Concoct the address according to

compat/inet_ntop.c

@@ -23,12 +23,8 @@
 
 #include <sys/param.h>
 #include <sys/types.h>
-#ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
-#endif
 #include <string.h>
 #include <errno.h>
 #include <stdio.h>
@@ -66,11 +62,7 @@ inet_ntop(int af, const void *src, char *dst, size_t size)
 	case AF_INET6:
 		return (inet_ntop6(src, dst, size));
 	default:
-#ifdef EAFNOSUPPORT
 		errno = EAFNOSUPPORT;
-#else
-		errno = ENOSYS;
-#endif
 		return (NULL);
 	}
 	/* NOTREACHED */
@@ -135,9 +127,7 @@ inet_ntop6(const u_char *src, char *dst, size_t size)
 	for (i = 0; i < IN6ADDRSZ; i++)
 		words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3));
 	best.base = -1;
-	best.len = 0;
 	cur.base = -1;
-	cur.len = 0;
 	for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
 		if (words[i] == 0) {
 			if (cur.base == -1)

compat/inet_pton.c

@@ -70,11 +70,7 @@ inet_pton(af, src, dst)
 	case AF_INET6:
 		return (inet_pton6(src, dst));
 	default:
-#ifdef EAFNOSUPPORT
 		errno = EAFNOSUPPORT;
-#else
-		errno = ENOSYS;
-#endif
 		return (-1);
 	}
 	/* NOTREACHED */

compat/isblank.c

@@ -1,45 +0,0 @@
-/* isblank - compatibility implementation of isblank
- *
- * Copyright (c) 2015, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-/* return true for a blank character: space or tab */
-int isblank(int c);
-
-/* implementation of isblank. unsigned char is the argument */
-int
-isblank(int c)
-{
-	return (c==' ' || c=='\t');
-}

compat/malloc.c

@@ -1,8 +1,11 @@
 /* Just a replacement, if the original malloc is not
    GNU-compliant. See autoconf documentation. */
 
-#include "config.h"
+#if HAVE_CONFIG_H
+#include <config.h>
+#endif
 #undef malloc
+
 #include <sys/types.h>
 
 void *malloc ();
@@ -11,7 +14,7 @@ void *malloc ();
    If N is zero, allocate a 1-byte block.  */
 
 void *
-rpl_malloc_unbound (size_t n)
+rpl_malloc (size_t n)
 {
   if (n == 0)
     n = 1;

compat/memcmp.c

@@ -1,25 +0,0 @@
-/*
- *	memcmp.c: memcmp compat implementation.
- *
- *	Copyright (c) 2010, NLnet Labs. All rights reserved.
- *
- * See LICENSE for the license.
-*/
-
-#include <config.h>
-
-int memcmp(const void *x, const void *y, size_t n);
-
-int memcmp(const void *x, const void *y, size_t n)
-{
-	const uint8_t* x8 = (const uint8_t*)x;
-	const uint8_t* y8 = (const uint8_t*)y;
-	size_t i;
-	for(i=0; i<n; i++) {
-		if(x8[i] < y8[i])
-			return -1;
-		else if(x8[i] > y8[i])
-			return 1;
-	}
-	return 0;
-}

compat/memcmp.h

@@ -1,16 +0,0 @@
-/*
- *	memcmp.h: undef memcmp for compat.
- *
- *	Copyright (c) 2012, NLnet Labs. All rights reserved.
- *
- * See LICENSE for the license.
-*/
-#ifndef COMPAT_MEMCMP_H
-#define COMPAT_MEMCMP_H
-
-#ifdef memcmp
-/* undef here otherwise autoheader messes it up in config.h */
-#  undef memcmp
-#endif
-
-#endif /* COMPAT_MEMCMP_H */

compat/memmove.c

@@ -28,7 +28,7 @@ void *memmove(void *dest, const void *src, size_t n)
 			to[i] = from[i];
 		return dest;
 	}
-	if (from > to && from-to < (int)n) {
+	if (from > to  && from-to < (int)n) {
 		/* to overlaps with from */
 		/*        <from......>   */
 		/*  <to........>         */

compat/reallocarray.c

@@ -1,42 +0,0 @@
-/*	$OpenBSD: reallocarray.c,v 1.1 2014/05/08 21:43:49 deraadt Exp $	*/
-/*
- * Copyright (c) 2008 Otto Moerbeek <otto@drijf.net>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include "config.h"
-#include <sys/types.h>
-#include <errno.h>
-#ifdef HAVE_STDINT_H
-#include <stdint.h>
-#endif
-#include <limits.h>
-#include <stdlib.h>
-
-/*
- * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX
- * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW
- */
-#define MUL_NO_OVERFLOW	((size_t)1 << (sizeof(size_t) * 4))
-
-void *
-reallocarray(void *optr, size_t nmemb, size_t size)
-{
-	if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
-	    nmemb > 0 && SIZE_MAX / nmemb < size) {
-		errno = ENOMEM;
-		return NULL;
-	}
-	return realloc(optr, size * nmemb);
-}

compat/sha512.c

@@ -1,477 +0,0 @@
-/*
- * FILE:	sha2.c
- * AUTHOR:	Aaron D. Gifford - http://www.aarongifford.com/
- * 
- * Copyright (c) 2000-2001, Aaron D. Gifford
- * All rights reserved.
- *
- * Modified by Jelte Jansen to fit in ldns, and not clash with any
- * system-defined SHA code.
- * Changes:
- * - Renamed (external) functions and constants to fit ldns style
- * - Removed _End and _Data functions
- * - Added ldns_shaX(data, len, digest) convenience functions
- * - Removed prototypes of _Transform functions and made those static
- * Modified by Wouter, and trimmed, to provide SHA512 for getentropy_fallback.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the copyright holder nor the names of contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTOR(S) BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * $Id: sha2.c,v 1.1 2001/11/08 00:01:51 adg Exp adg $
- */
-#include "config.h"
-
-#include <string.h>	/* memcpy()/memset() or bcopy()/bzero() */
-#include <assert.h>	/* assert() */
-
-/* do we have sha512 header defs */
-#ifndef SHA512_DIGEST_LENGTH
-#define SHA512_BLOCK_LENGTH		128
-#define SHA512_DIGEST_LENGTH		64
-#define SHA512_DIGEST_STRING_LENGTH	(SHA512_DIGEST_LENGTH * 2 + 1)
-typedef struct _SHA512_CTX {
-	uint64_t	state[8];
-	uint64_t	bitcount[2];
-	uint8_t	buffer[SHA512_BLOCK_LENGTH];
-} SHA512_CTX;
-#endif /* do we have sha512 header defs */
-
-void SHA512_Init(SHA512_CTX*);
-void SHA512_Update(SHA512_CTX*, void*, size_t);
-void SHA512_Final(uint8_t[SHA512_DIGEST_LENGTH], SHA512_CTX*);
-unsigned char *SHA512(void *data, unsigned int data_len, unsigned char *digest);
-
-
-/*** SHA-256/384/512 Machine Architecture Definitions *****************/
-/*
- * BYTE_ORDER NOTE:
- *
- * Please make sure that your system defines BYTE_ORDER.  If your
- * architecture is little-endian, make sure it also defines
- * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are
- * equivalent.
- *
- * If your system does not define the above, then you can do so by
- * hand like this:
- *
- *   #define LITTLE_ENDIAN 1234
- *   #define BIG_ENDIAN    4321
- *
- * And for little-endian machines, add:
- *
- *   #define BYTE_ORDER LITTLE_ENDIAN 
- *
- * Or for big-endian machines:
- *
- *   #define BYTE_ORDER BIG_ENDIAN
- *
- * The FreeBSD machine this was written on defines BYTE_ORDER
- * appropriately by including <sys/types.h> (which in turn includes
- * <machine/endian.h> where the appropriate definitions are actually
- * made).
- */
-#if !defined(BYTE_ORDER) || (BYTE_ORDER != LITTLE_ENDIAN && BYTE_ORDER != BIG_ENDIAN)
-#error Define BYTE_ORDER to be equal to either LITTLE_ENDIAN or BIG_ENDIAN
-#endif
-
-typedef uint8_t  sha2_byte;	/* Exactly 1 byte */
-typedef uint32_t sha2_word32;	/* Exactly 4 bytes */
-#ifdef S_SPLINT_S
-typedef unsigned long long sha2_word64; /* lint 8 bytes */
-#else
-typedef uint64_t sha2_word64;	/* Exactly 8 bytes */
-#endif
-
-/*** SHA-256/384/512 Various Length Definitions ***********************/
-#define SHA512_SHORT_BLOCK_LENGTH	(SHA512_BLOCK_LENGTH - 16)
-
-
-/*** ENDIAN REVERSAL MACROS *******************************************/
-#if BYTE_ORDER == LITTLE_ENDIAN
-#define REVERSE32(w,x)	{ \
-	sha2_word32 tmp = (w); \
-	tmp = (tmp >> 16) | (tmp << 16); \
-	(x) = ((tmp & 0xff00ff00UL) >> 8) | ((tmp & 0x00ff00ffUL) << 8); \
-}
-#ifndef S_SPLINT_S
-#define REVERSE64(w,x)	{ \
-	sha2_word64 tmp = (w); \
-	tmp = (tmp >> 32) | (tmp << 32); \
-	tmp = ((tmp & 0xff00ff00ff00ff00ULL) >> 8) | \
-	      ((tmp & 0x00ff00ff00ff00ffULL) << 8); \
-	(x) = ((tmp & 0xffff0000ffff0000ULL) >> 16) | \
-	      ((tmp & 0x0000ffff0000ffffULL) << 16); \
-}
-#else /* splint */
-#define REVERSE64(w,x) /* splint */
-#endif /* splint */
-#endif /* BYTE_ORDER == LITTLE_ENDIAN */
-
-/*
- * Macro for incrementally adding the unsigned 64-bit integer n to the
- * unsigned 128-bit integer (represented using a two-element array of
- * 64-bit words):
- */
-#define ADDINC128(w,n)	{ \
-	(w)[0] += (sha2_word64)(n); \
-	if ((w)[0] < (n)) { \
-		(w)[1]++; \
-	} \
-}
-#ifdef S_SPLINT_S
-#undef ADDINC128
-#define ADDINC128(w,n) /* splint */
-#endif
-
-/*
- * Macros for copying blocks of memory and for zeroing out ranges
- * of memory.  Using these macros makes it easy to switch from
- * using memset()/memcpy() and using bzero()/bcopy().
- *
- * Please define either SHA2_USE_MEMSET_MEMCPY or define
- * SHA2_USE_BZERO_BCOPY depending on which function set you
- * choose to use:
- */
-#if !defined(SHA2_USE_MEMSET_MEMCPY) && !defined(SHA2_USE_BZERO_BCOPY)
-/* Default to memset()/memcpy() if no option is specified */
-#define	SHA2_USE_MEMSET_MEMCPY	1
-#endif
-#if defined(SHA2_USE_MEMSET_MEMCPY) && defined(SHA2_USE_BZERO_BCOPY)
-/* Abort with an error if BOTH options are defined */
-#error Define either SHA2_USE_MEMSET_MEMCPY or SHA2_USE_BZERO_BCOPY, not both!
-#endif
-
-#ifdef SHA2_USE_MEMSET_MEMCPY
-#define MEMSET_BZERO(p,l)	memset((p), 0, (l))
-#define MEMCPY_BCOPY(d,s,l)	memcpy((d), (s), (l))
-#endif
-#ifdef SHA2_USE_BZERO_BCOPY
-#define MEMSET_BZERO(p,l)	bzero((p), (l))
-#define MEMCPY_BCOPY(d,s,l)	bcopy((s), (d), (l))
-#endif
-
-
-/*** THE SIX LOGICAL FUNCTIONS ****************************************/
-/*
- * Bit shifting and rotation (used by the six SHA-XYZ logical functions:
- *
- *   NOTE:  The naming of R and S appears backwards here (R is a SHIFT and
- *   S is a ROTATION) because the SHA-256/384/512 description document
- *   (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this
- *   same "backwards" definition.
- */
-/* Shift-right (used in SHA-256, SHA-384, and SHA-512): */
-#define R(b,x) 		((x) >> (b))
-/* 64-bit Rotate-right (used in SHA-384 and SHA-512): */
-#define S64(b,x)	(((x) >> (b)) | ((x) << (64 - (b))))
-
-/* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */
-#define Ch(x,y,z)	(((x) & (y)) ^ ((~(x)) & (z)))
-#define Maj(x,y,z)	(((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
-
-/* Four of six logical functions used in SHA-384 and SHA-512: */
-#define Sigma0_512(x)	(S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x)))
-#define Sigma1_512(x)	(S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x)))
-#define sigma0_512(x)	(S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7,   (x)))
-#define sigma1_512(x)	(S64(19, (x)) ^ S64(61, (x)) ^ R( 6,   (x)))
-
-/*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/
-/* Hash constant words K for SHA-384 and SHA-512: */
-static const sha2_word64 K512[80] = {
-	0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL,
-	0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL,
-	0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
-	0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL,
-	0xd807aa98a3030242ULL, 0x12835b0145706fbeULL,
-	0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
-	0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL,
-	0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL,
-	0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
-	0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL,
-	0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL,
-	0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
-	0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL,
-	0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL,
-	0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
-	0x06ca6351e003826fULL, 0x142929670a0e6e70ULL,
-	0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL,
-	0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
-	0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL,
-	0x81c2c92e47edaee6ULL, 0x92722c851482353bULL,
-	0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
-	0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL,
-	0xd192e819d6ef5218ULL, 0xd69906245565a910ULL,
-	0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
-	0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL,
-	0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL,
-	0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
-	0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL,
-	0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL,
-	0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
-	0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL,
-	0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL,
-	0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
-	0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL,
-	0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL,
-	0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
-	0x28db77f523047d84ULL, 0x32caab7b40c72493ULL,
-	0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL,
-	0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
-	0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL
-};
-
-/* initial hash value H for SHA-512 */
-static const sha2_word64 sha512_initial_hash_value[8] = {
-	0x6a09e667f3bcc908ULL,
-	0xbb67ae8584caa73bULL,
-	0x3c6ef372fe94f82bULL,
-	0xa54ff53a5f1d36f1ULL,
-	0x510e527fade682d1ULL,
-	0x9b05688c2b3e6c1fULL,
-	0x1f83d9abfb41bd6bULL,
-	0x5be0cd19137e2179ULL
-};
-
-typedef union _ldns_sha2_buffer_union {
-        uint8_t*  theChars;
-        uint64_t* theLongs;
-} ldns_sha2_buffer_union;
-
-/*** SHA-512: *********************************************************/
-void SHA512_Init(SHA512_CTX* context) {
-	if (context == (SHA512_CTX*)0) {
-		return;
-	}
-	MEMCPY_BCOPY(context->state, sha512_initial_hash_value, SHA512_DIGEST_LENGTH);
-	MEMSET_BZERO(context->buffer, SHA512_BLOCK_LENGTH);
-	context->bitcount[0] = context->bitcount[1] =  0;
-}
-
-static void SHA512_Transform(SHA512_CTX* context,
-                                  const sha2_word64* data) {
-	sha2_word64	a, b, c, d, e, f, g, h, s0, s1;
-	sha2_word64	T1, T2, *W512 = (sha2_word64*)context->buffer;
-	int		j;
-
-	/* initialize registers with the prev. intermediate value */
-	a = context->state[0];
-	b = context->state[1];
-	c = context->state[2];
-	d = context->state[3];
-	e = context->state[4];
-	f = context->state[5];
-	g = context->state[6];
-	h = context->state[7];
-
-	j = 0;
-	do {
-#if BYTE_ORDER == LITTLE_ENDIAN
-		/* Convert TO host byte order */
-		REVERSE64(*data++, W512[j]);
-		/* Apply the SHA-512 compression function to update a..h */
-		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j];
-#else /* BYTE_ORDER == LITTLE_ENDIAN */
-		/* Apply the SHA-512 compression function to update a..h with copy */
-		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + (W512[j] = *data++);
-#endif /* BYTE_ORDER == LITTLE_ENDIAN */
-		T2 = Sigma0_512(a) + Maj(a, b, c);
-		h = g;
-		g = f;
-		f = e;
-		e = d + T1;
-		d = c;
-		c = b;
-		b = a;
-		a = T1 + T2;
-
-		j++;
-	} while (j < 16);
-
-	do {
-		/* Part of the message block expansion: */
-		s0 = W512[(j+1)&0x0f];
-		s0 = sigma0_512(s0);
-		s1 = W512[(j+14)&0x0f];
-		s1 =  sigma1_512(s1);
-
-		/* Apply the SHA-512 compression function to update a..h */
-		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] +
-		     (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0);
-		T2 = Sigma0_512(a) + Maj(a, b, c);
-		h = g;
-		g = f;
-		f = e;
-		e = d + T1;
-		d = c;
-		c = b;
-		b = a;
-		a = T1 + T2;
-
-		j++;
-	} while (j < 80);
-
-	/* Compute the current intermediate hash value */
-	context->state[0] += a;
-	context->state[1] += b;
-	context->state[2] += c;
-	context->state[3] += d;
-	context->state[4] += e;
-	context->state[5] += f;
-	context->state[6] += g;
-	context->state[7] += h;
-
-	/* Clean up */
-	a = b = c = d = e = f = g = h = T1 = T2 = 0;
-}
-
-void SHA512_Update(SHA512_CTX* context, void *datain, size_t len) {
-	size_t freespace, usedspace;
-	const sha2_byte* data = (const sha2_byte*)datain;
-
-	if (len == 0) {
-		/* Calling with no data is valid - we do nothing */
-		return;
-	}
-
-	/* Sanity check: */
-	assert(context != (SHA512_CTX*)0 && data != (sha2_byte*)0);
-
-	usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
-	if (usedspace > 0) {
-		/* Calculate how much free space is available in the buffer */
-		freespace = SHA512_BLOCK_LENGTH - usedspace;
-
-		if (len >= freespace) {
-			/* Fill the buffer completely and process it */
-			MEMCPY_BCOPY(&context->buffer[usedspace], data, freespace);
-			ADDINC128(context->bitcount, freespace << 3);
-			len -= freespace;
-			data += freespace;
-			SHA512_Transform(context, (sha2_word64*)context->buffer);
-		} else {
-			/* The buffer is not yet full */
-			MEMCPY_BCOPY(&context->buffer[usedspace], data, len);
-			ADDINC128(context->bitcount, len << 3);
-			/* Clean up: */
-			usedspace = freespace = 0;
-			return;
-		}
-	}
-	while (len >= SHA512_BLOCK_LENGTH) {
-		/* Process as many complete blocks as we can */
-		SHA512_Transform(context, (sha2_word64*)data);
-		ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3);
-		len -= SHA512_BLOCK_LENGTH;
-		data += SHA512_BLOCK_LENGTH;
-	}
-	if (len > 0) {
-		/* There's left-overs, so save 'em */
-		MEMCPY_BCOPY(context->buffer, data, len);
-		ADDINC128(context->bitcount, len << 3);
-	}
-	/* Clean up: */
-	usedspace = freespace = 0;
-}
-
-static void SHA512_Last(SHA512_CTX* context) {
-	size_t usedspace;
-	ldns_sha2_buffer_union cast_var;
-
-	usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
-#if BYTE_ORDER == LITTLE_ENDIAN
-	/* Convert FROM host byte order */
-	REVERSE64(context->bitcount[0],context->bitcount[0]);
-	REVERSE64(context->bitcount[1],context->bitcount[1]);
-#endif
-	if (usedspace > 0) {
-		/* Begin padding with a 1 bit: */
-		context->buffer[usedspace++] = 0x80;
-
-		if (usedspace <= SHA512_SHORT_BLOCK_LENGTH) {
-			/* Set-up for the last transform: */
-			MEMSET_BZERO(&context->buffer[usedspace], SHA512_SHORT_BLOCK_LENGTH - usedspace);
-		} else {
-			if (usedspace < SHA512_BLOCK_LENGTH) {
-				MEMSET_BZERO(&context->buffer[usedspace], SHA512_BLOCK_LENGTH - usedspace);
-			}
-			/* Do second-to-last transform: */
-			SHA512_Transform(context, (sha2_word64*)context->buffer);
-
-			/* And set-up for the last transform: */
-			MEMSET_BZERO(context->buffer, SHA512_BLOCK_LENGTH - 2);
-		}
-	} else {
-		/* Prepare for final transform: */
-		MEMSET_BZERO(context->buffer, SHA512_SHORT_BLOCK_LENGTH);
-
-		/* Begin padding with a 1 bit: */
-		*context->buffer = 0x80;
-	}
-	/* Store the length of input data (in bits): */
-	cast_var.theChars = context->buffer;
-	cast_var.theLongs[SHA512_SHORT_BLOCK_LENGTH / 8] = context->bitcount[1];
-	cast_var.theLongs[SHA512_SHORT_BLOCK_LENGTH / 8 + 1] = context->bitcount[0];
-
-	/* final transform: */
-	SHA512_Transform(context, (sha2_word64*)context->buffer);
-}
-
-void SHA512_Final(sha2_byte digest[], SHA512_CTX* context) {
-	sha2_word64	*d = (sha2_word64*)digest;
-
-	/* Sanity check: */
-	assert(context != (SHA512_CTX*)0);
-
-	/* If no digest buffer is passed, we don't bother doing this: */
-	if (digest != (sha2_byte*)0) {
-		SHA512_Last(context);
-
-		/* Save the hash data for output: */
-#if BYTE_ORDER == LITTLE_ENDIAN
-		{
-			/* Convert TO host byte order */
-			int	j;
-			for (j = 0; j < 8; j++) {
-				REVERSE64(context->state[j],context->state[j]);
-				*d++ = context->state[j];
-			}
-		}
-#else
-		MEMCPY_BCOPY(d, context->state, SHA512_DIGEST_LENGTH);
-#endif
-	}
-
-	/* Zero out state data */
-	MEMSET_BZERO(context, sizeof(SHA512_CTX));
-}
-
-unsigned char *
-SHA512(void *data, unsigned int data_len, unsigned char *digest)
-{
-    SHA512_CTX ctx;
-    SHA512_Init(&ctx);
-    SHA512_Update(&ctx, data, data_len);
-    SHA512_Final(digest, &ctx);
-    return digest;
-}

compat/strlcat.c

@@ -1,73 +0,0 @@
-/* compat/strlcat.c */
-
-/*-
- * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* OPENBSD ORIGINAL: lib/libc/string/strlcat.c */
-
-#include "config.h"
-#ifndef HAVE_STRLCAT
-
-#include <sys/types.h>
-#include <string.h>
-
-/*
- * Appends src to string dst of size siz (unlike strncat, siz is the
- * full size of dst, not space left).  At most siz-1 characters
- * will be copied.  Always NUL terminates (unless siz <= strlen(dst)).
- * Returns strlen(src) + MIN(siz, strlen(initial dst)).
- * If retval >= siz, truncation occurred.
- */
-size_t
-strlcat(char *dst, const char *src, size_t siz)
-{
-	char *d = dst;
-	const char *s = src;
-	size_t n = siz;
-	size_t dlen;
-
-	/* Find the end of dst and adjust bytes left but don't go past end */
-	while (n-- != 0 && *d != '\0')
-		d++;
-	dlen = d - dst;
-	n = siz - dlen;
-
-	if (n == 0)
-		return(dlen + strlen(s));
-	while (*s != '\0') {
-		if (n != 1) {
-			*d++ = *s;
-			n--;
-		}
-		s++;
-	}
-	*d = '\0';
-
-	return(dlen + (s - src));	/* count does not include NUL */
-}
-
-#endif /* !HAVE_STRLCAT */

compat/strptime.c

@@ -1,345 +0,0 @@
-/** strptime workaround (for oa macos leopard)
-  * This strptime follows the man strptime (2001-11-12)
-  *		conforming to SUSv2, POSIX.1-2001
-  *
-  * This very simple version of strptime has no:
-  * - E alternatives
-  * - O alternatives
-  * - Glibc additions
-  * - Does not process week numbers
-  * - Does not properly processes year day
-  *
-  * LICENSE
-  * Copyright (c) 2008, NLnet Labs, Matthijs Mekking
-  * All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions are met:
-  * * Redistributions of source code must retain the above copyright notice,
-  *     this list of conditions and the following disclaimer.
-  * * Redistributions in binary form must reproduce the above copyright
-  *   notice, this list of conditions and the following disclaimer in the
-  *   documentation and/or other materials provided with the distribution.
-  * * Neither the name of NLnetLabs nor the names of its
-  *   contributors may be used to endorse or promote products derived from this
-  *   software without specific prior written permission.
-  *
-  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-  * POSSIBILITY OF SUCH DAMAGE.
- **/
-
-#include "config.h"
-
-#ifndef HAVE_CONFIG_H
-#include <time.h>
-#endif
-
-#ifndef STRPTIME_WORKS
-
-#define TM_YEAR_BASE 1900
-
-#include <ctype.h>
-#include <string.h>
-
-static const char *abb_weekdays[] = {
-	"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", NULL
-};
-static const char *full_weekdays[] = {
-	"Sunday", "Monday", "Tuesday", "Wednesday",
-	"Thursday", "Friday", "Saturday", NULL
-};
-static const char *abb_months[] = {
-	"Jan", "Feb", "Mar", "Apr", "May", "Jun",
-	"Jul", "Aug", "Sep", "Oct", "Nov", "Dec", NULL
-};
-static const char *full_months[] = {
-	"January", "February", "March", "April", "May", "June",
-	"July", "August", "September", "October", "November", "December", NULL
-};
-static const char *ampm[] = {
-    "am", "pm", NULL
-};
-
-static int
-match_string(const char **buf, const char **strs)
-{
-	int i = 0;
-
-	for (i = 0; strs[i] != NULL; i++) {
-		int len = strlen(strs[i]);
-		if (strncasecmp (*buf, strs[i], len) == 0) {
-			*buf += len;
-			return i;
-		}
-	}
-	return -1;
-}
-
-static int
-str2int(const char **buf, int max)
-{
-	int ret=0, count=0;
-
-	while (*buf[0] != '\0' && isdigit((unsigned char)*buf[0]) && count<max) {
-		ret = ret*10 + (*buf[0] - '0');
-		(*buf)++;
-		count++;
-	}
-
-	if (!count)
-		return -1;
-	return ret;
-}
-
-/** Converts the character string s to values which are stored in tm
-  * using the format specified by format
- **/
-char *
-unbound_strptime(const char *s, const char *format, struct tm *tm)
-{
-	int c, ret;
-	int split_year = 0;
-
-	while ((c = *format) != '\0') {
-		/* whitespace, literal or format */
-		if (isspace((unsigned char)c)) { /* whitespace */
-			/** whitespace matches zero or more whitespace characters in the
-			  * input string.
-			 **/
-			while (isspace((unsigned char)*s))
-				s++;
-		}
-		else if (c == '%') { /* format */
-			format++;
-			c = *format;
-			switch (c) {
-				case '%': /* %% is converted to % */
-					if (*s != c) {
-						return NULL;
-					}
-					s++;
-					break;
-				case 'a': /* weekday name, abbreviated or full */
-				case 'A':
-					ret = match_string(&s, full_weekdays);
-					if (ret < 0)
-						ret = match_string(&s, abb_weekdays);
-					if (ret < 0) {
-						return NULL;
-					}
-					tm->tm_wday = ret;
-					break;
-				case 'b': /* month name, abbreviated or full */
-				case 'B':
-				case 'h':
-					ret = match_string(&s, full_months);
-					if (ret < 0)
-						ret = match_string(&s, abb_months);
-					if (ret < 0) {
-						return NULL;
-					}
-					tm->tm_mon = ret;
-					break;
-				case 'c': /* date and time representation */
-					if (!(s = unbound_strptime(s, "%x %X", tm))) {
-						return NULL;
-					}
-					break;
-				case 'C': /* century number */
-					ret = str2int(&s, 2);
-					if (ret < 0 || ret > 99) { /* must be in [00,99] */
-						return NULL;
-					}
-
-					if (split_year)	{
-						tm->tm_year = ret*100 + (tm->tm_year%100);
-					}
-					else {
-						tm->tm_year = ret*100 - TM_YEAR_BASE;
-						split_year = 1;
-					}
-					break;
-				case 'd': /* day of month */
-				case 'e':
-					ret = str2int(&s, 2);
-					if (ret < 1 || ret > 31) { /* must be in [01,31] */
-						return NULL;
-					}
-					tm->tm_mday = ret;
-					break;
-				case 'D': /* equivalent to %m/%d/%y */
-					if (!(s = unbound_strptime(s, "%m/%d/%y", tm))) {
-						return NULL;
-					}
-					break;
-				case 'H': /* hour */
-					ret = str2int(&s, 2);
-					if (ret < 0 || ret > 23) { /* must be in [00,23] */
-						return NULL;
-					}
-					tm->tm_hour = ret;
-					break;
-				case 'I': /* 12hr clock hour */
-					ret = str2int(&s, 2);
-					if (ret < 1 || ret > 12) { /* must be in [01,12] */
-						return NULL;
-					}
-					if (ret == 12) /* actually [0,11] */
-						ret = 0;
-					tm->tm_hour = ret;
-					break;
-				case 'j': /* day of year */
-					ret = str2int(&s, 2);
-					if (ret < 1 || ret > 366) { /* must be in [001,366] */
-						return NULL;
-					}
-					tm->tm_yday = ret;
-					break;
-				case 'm': /* month */
-					ret = str2int(&s, 2);
-					if (ret < 1 || ret > 12) { /* must be in [01,12] */
-						return NULL;
-					}
-					/* months go from 0-11 */
-					tm->tm_mon = (ret-1);
-					break;
-				case 'M': /* minute */
-					ret = str2int(&s, 2);
-					if (ret < 0 || ret > 59) { /* must be in [00,59] */
-						return NULL;
-					}
-					tm->tm_min = ret;
-					break;
-				case 'n': /* arbitrary whitespace */
-				case 't':
-					while (isspace((unsigned char)*s))
-						s++;
-					break;
-				case 'p': /* am pm */
-					ret = match_string(&s, ampm);
-					if (ret < 0) {
-						return NULL;
-					}
-					if (tm->tm_hour < 0 || tm->tm_hour > 11) { /* %I */
-						return NULL;
-					}
-
-					if (ret == 1) /* pm */
-						tm->tm_hour += 12;
-					break;
-				case 'r': /* equivalent of %I:%M:%S %p */
-					if (!(s = unbound_strptime(s, "%I:%M:%S %p", tm))) {
-						return NULL;
-					}
-					break;
-				case 'R': /* equivalent of %H:%M */
-					if (!(s = unbound_strptime(s, "%H:%M", tm))) {
-						return NULL;
-					}
-					break;
-				case 'S': /* seconds */
-					ret = str2int(&s, 2);
-					/* 60 may occur for leap seconds */
-					/* earlier 61 was also allowed */
-					if (ret < 0 || ret > 60) { /* must be in [00,60] */
-						return NULL;
-					}
-					tm->tm_sec = ret;
-					break;
-				case 'T': /* equivalent of %H:%M:%S */
-					if (!(s = unbound_strptime(s, "%H:%M:%S", tm))) {
-						return NULL;
-					}
-					break;
-				case 'U': /* week number, with the first Sun of Jan being w1 */
-					ret = str2int(&s, 2);
-					if (ret < 0 || ret > 53) { /* must be in [00,53] */
-						return NULL;
-					}
-					/** it is hard (and not necessary for nsd) to determine time
-					  * data from week number.
-					 **/
-					break;
-				case 'w': /* day of week */
-					ret = str2int(&s, 1);
-					if (ret < 0 || ret > 6) { /* must be in [0,6] */
-						return NULL;
-					}
-					tm->tm_wday = ret;
-					break;
-				case 'W': /* week number, with the first Mon of Jan being w1 */
-					ret = str2int(&s, 2);
-					if (ret < 0 || ret > 53) { /* must be in [00,53] */
-						return NULL;
-					}
-					/** it is hard (and not necessary for nsd) to determine time
-					  * data from week number.
-					 **/
-					break;
-				case 'x': /* date format */
-					if (!(s = unbound_strptime(s, "%m/%d/%y", tm))) {
-						return NULL;
-					}
-					break;
-				case 'X': /* time format */
-					if (!(s = unbound_strptime(s, "%H:%M:%S", tm))) {
-						return NULL;
-					}
-					break;
-				case 'y': /* last two digits of a year */
-					ret = str2int(&s, 2);
-					if (ret < 0 || ret > 99) { /* must be in [00,99] */
-						return NULL;
-					}
-					if (split_year) {
-						tm->tm_year = ((tm->tm_year/100) * 100) + ret;
-					}
-					else {
-						split_year = 1;
-
-						/** currently:
-						  * if in [0,68] we are in 21th century,
-						  * if in [69,99] we are in 20th century.
-						 **/
-						if (ret < 69) /* 2000 */
-							ret += 100;
-						tm->tm_year = ret;
-					}
-					break;
-				case 'Y': /* year */
-					ret = str2int(&s, 4);
-					if (ret < 0 || ret > 9999) {
-						return NULL;
-					}
-					tm->tm_year = ret - TM_YEAR_BASE;
-					break;
-				case '\0':
-				default: /* unsupported, cannot match format */
-					return NULL;
-					break;
-			}
-		}
-		else { /* literal */
-			/* if input cannot match format, return NULL */
-			if (*s != c)
-				return NULL;
-			s++;
-		}
-
-		format++;
-	}
-
-	/* return pointer to remainder of s */
-	return (char*) s;
-}
-
-#endif /* STRPTIME_WORKS */

compat/strsep.c

@@ -1,65 +0,0 @@
-/** 
- * strsep implementation for compatibility.
- *
-  * LICENSE
-  * Copyright (c) 2016, NLnet Labs
-  * All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions are met:
-  * * Redistributions of source code must retain the above copyright notice,
-  *     this list of conditions and the following disclaimer.
-  * * Redistributions in binary form must reproduce the above copyright
-  *   notice, this list of conditions and the following disclaimer in the
-  *   documentation and/or other materials provided with the distribution.
-  * * Neither the name of NLnetLabs nor the names of its
-  *   contributors may be used to endorse or promote products derived from this
-  *   software without specific prior written permission.
-  *
-  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-  * POSSIBILITY OF SUCH DAMAGE.
- **/
-
-#include "config.h"
-
-/** see if character is in the delimiter array */
-static int
-in_delim(char c, const char* delim)
-{
-	const char* p;
-	if(!delim)
-		return 0;
-	for(p=delim; *p; p++) {
-		if(*p == c)
-			return 1;
-	}
-	return 0;
-}
-
-char *strsep(char **stringp, const char *delim)
-{
-	char* s;
-	char* orig;
-	if(stringp == NULL || *stringp == NULL)
-		return NULL;
-	orig = *stringp;
-	s = *stringp;
-	while(*s && !in_delim(*s, delim))
-		s++;
-	if(*s) {
-		*s = 0;
-		*stringp = s+1;
-	} else {
-		*stringp = NULL;
-	}
-	return orig;
-}

config.sub

@@ -1,40 +1,44 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2016 Free Software Foundation, Inc.
+#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
+#   Inc.
 
-timestamp='2016-09-05'
+timestamp='2006-09-20'
 
-# This file is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
+# This file is (in principle) common to ALL GNU software.
+# The presence of a machine in this file suggests that SOME GNU software
+# can handle that machine.  It does not imply ALL GNU software can.
+#
+# This file is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
 # (at your option) any later version.
 #
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# General Public License for more details.
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
+# 02110-1301, USA.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that
-# program.  This Exception is an additional permission under section 7
-# of the GNU General Public License, version 3 ("GPLv3").
+# the same distribution terms that you use for the rest of that program.
 
 
-# Please send patches to <config-patches@gnu.org>.
+# Please send patches to <config-patches@gnu.org>.  Submit a context
+# diff and a properly formatted ChangeLog entry.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
 # Supply the specified configuration type as an argument.
 # If it is invalid, we print an error message on stderr and exit with code 1.
 # Otherwise, we print the canonical config type on stdout and succeed.
 
-# You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
-
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
 # that are meaningful with *any* GNU software.
@@ -53,7 +57,8 @@ timestamp='2016-09-05'
 me=`echo "$0" | sed -e 's,.*/,,'`
 
 usage="\
-Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS
+Usage: $0 [OPTION] CPU-MFR-OPSYS
+       $0 [OPTION] ALIAS
 
 Canonicalize a configuration name.
 
@@ -67,7 +72,8 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright 1992-2016 Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
+Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -114,18 +120,12 @@ esac
 # Here we must recognize all the valid KERNEL-OS combinations.
 maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
-  nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
-  linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
-  knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \
-  kopensolaris*-gnu* | cloudabi*-eabi* | \
+  nto-qnx* | linux-gnu* | linux-dietlibc | linux-newlib* | linux-uclibc* | \
+  uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* | \
   storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
     ;;
-  android-linux)
-    os=-linux-android
-    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
-    ;;
   *)
     basic_machine=`echo $1 | sed 's/-[^-]*$//'`
     if [ $basic_machine != $1 ]
@@ -148,13 +148,10 @@ case $os in
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis | -knuth | -cray | -microblaze*)
+	-apple | -axis | -knuth | -cray)
 		os=
 		basic_machine=$1
 		;;
-	-bluegene*)
-		os=-cnk
-		;;
 	-sim | -cisco | -oki | -wec | -winbond)
 		os=
 		basic_machine=$1
@@ -169,10 +166,10 @@ case $os in
 		os=-chorusos
 		basic_machine=$1
 		;;
-	-chorusrdb)
-		os=-chorusrdb
+ 	-chorusrdb)
+ 		os=-chorusrdb
 		basic_machine=$1
-		;;
+ 		;;
 	-hiux*)
 		os=-hiuxwe2
 		;;
@@ -217,12 +214,6 @@ case $os in
 	-isc*)
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
-	-lynx*178)
-		os=-lynxos178
-		;;
-	-lynx*5)
-		os=-lynxos5
-		;;
 	-lynx*)
 		os=-lynxos
 		;;
@@ -247,91 +238,59 @@ case $basic_machine in
 	# Some are omitted here because they have special meanings below.
 	1750a | 580 \
 	| a29k \
-	| aarch64 | aarch64_be \
 	| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \
 	| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
 	| am33_2.0 \
-	| arc | arceb \
-	| arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \
-	| avr | avr32 \
-	| ba \
-	| be32 | be64 \
+	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr | avr32 \
 	| bfin \
-	| c4x | c8051 | clipper \
+	| c4x | clipper \
 	| d10v | d30v | dlx | dsp16xx \
-	| e2k | epiphany \
-	| fido | fr30 | frv | ft32 \
+	| fr30 | frv \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
-	| hexagon \
 	| i370 | i860 | i960 | ia64 \
 	| ip2k | iq2000 \
-	| k1om \
-	| le32 | le64 \
-	| lm32 \
 	| m32c | m32r | m32rle | m68000 | m68k | m88k \
-	| maxq | mb | microblaze | microblazeel | mcore | mep | metag \
+	| maxq | mb | microblaze | mcore \
 	| mips | mipsbe | mipseb | mipsel | mipsle \
 	| mips16 \
 	| mips64 | mips64el \
-	| mips64octeon | mips64octeonel \
-	| mips64orion | mips64orionel \
-	| mips64r5900 | mips64r5900el \
 	| mips64vr | mips64vrel \
+	| mips64orion | mips64orionel \
 	| mips64vr4100 | mips64vr4100el \
 	| mips64vr4300 | mips64vr4300el \
 	| mips64vr5000 | mips64vr5000el \
 	| mips64vr5900 | mips64vr5900el \
 	| mipsisa32 | mipsisa32el \
 	| mipsisa32r2 | mipsisa32r2el \
-	| mipsisa32r6 | mipsisa32r6el \
 	| mipsisa64 | mipsisa64el \
 	| mipsisa64r2 | mipsisa64r2el \
-	| mipsisa64r6 | mipsisa64r6el \
 	| mipsisa64sb1 | mipsisa64sb1el \
 	| mipsisa64sr71k | mipsisa64sr71kel \
-	| mipsr5900 | mipsr5900el \
 	| mipstx39 | mipstx39el \
 	| mn10200 | mn10300 \
-	| moxie \
 	| mt \
 	| msp430 \
-	| nds32 | nds32le | nds32be \
-	| nios | nios2 | nios2eb | nios2el \
+	| nios | nios2 \
 	| ns16k | ns32k \
-	| open8 | or1k | or1knd | or32 \
+	| or32 \
 	| pdp10 | pdp11 | pj | pjl \
-	| powerpc | powerpc64 | powerpc64le | powerpcle \
+	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
 	| pyramid \
-	| riscv32 | riscv64 \
-	| rl78 | rx \
 	| score \
-	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[234]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
+	| sh | sh[1234] | sh[24]a | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
 	| sh64 | sh64le \
 	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
 	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
-	| spu \
-	| tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \
-	| ubicom32 \
-	| v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \
-	| visium \
+	| spu | strongarm \
+	| tahoe | thumb | tic4x | tic80 | tron \
+	| v850 | v850e \
 	| we32k \
-	| x86 | xc16x | xstormy16 | xtensa \
-	| z8k | z80)
+	| x86 | xc16x | xscale | xscalee[bl] | xstormy16 | xtensa \
+	| z8k)
 		basic_machine=$basic_machine-unknown
 		;;
-	c54x)
-		basic_machine=tic54x-unknown
-		;;
-	c55x)
-		basic_machine=tic55x-unknown
-		;;
-	c6x)
-		basic_machine=tic6x-unknown
-		;;
-	leon|leon[3-9])
-		basic_machine=sparc-$basic_machine
-		;;
-	m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
+	m6811 | m68hc11 | m6812 | m68hc12)
+		# Motorola 68HC11/12.
 		basic_machine=$basic_machine-unknown
 		os=-none
 		;;
@@ -341,21 +300,6 @@ case $basic_machine in
 		basic_machine=mt-unknown
 		;;
 
-	strongarm | thumb | xscale)
-		basic_machine=arm-unknown
-		;;
-	xgate)
-		basic_machine=$basic_machine-unknown
-		os=-none
-		;;
-	xscaleeb)
-		basic_machine=armeb-unknown
-		;;
-
-	xscaleel)
-		basic_machine=armel-unknown
-		;;
-
 	# We use `pc' rather than `unknown'
 	# because (1) that's what they normally are, and
 	# (2) the word "unknown" tends to confuse beginning users.
@@ -370,89 +314,64 @@ case $basic_machine in
 	# Recognize the basic CPU types with company name.
 	580-* \
 	| a29k-* \
-	| aarch64-* | aarch64_be-* \
 	| alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \
 	| alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \
-	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \
+	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* \
 	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
 	| avr-* | avr32-* \
-	| ba-* \
-	| be32-* | be64-* \
 	| bfin-* | bs2000-* \
-	| c[123]* | c30-* | [cjt]90-* | c4x-* \
-	| c8051-* | clipper-* | craynv-* | cydra-* \
+	| c[123]* | c30-* | [cjt]90-* | c4x-* | c54x-* | c55x-* | c6x-* \
+	| clipper-* | craynv-* | cydra-* \
 	| d10v-* | d30v-* | dlx-* \
-	| e2k-* | elxsi-* \
-	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
+	| elxsi-* \
+	| f30[01]-* | f700-* | fr30-* | frv-* | fx80-* \
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
-	| hexagon-* \
 	| i*86-* | i860-* | i960-* | ia64-* \
 	| ip2k-* | iq2000-* \
-	| k1om-* \
-	| le32-* | le64-* \
-	| lm32-* \
 	| m32c-* | m32r-* | m32rle-* \
 	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
-	| microblaze-* | microblazeel-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* \
 	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
 	| mips16-* \
 	| mips64-* | mips64el-* \
-	| mips64octeon-* | mips64octeonel-* \
-	| mips64orion-* | mips64orionel-* \
-	| mips64r5900-* | mips64r5900el-* \
 	| mips64vr-* | mips64vrel-* \
+	| mips64orion-* | mips64orionel-* \
 	| mips64vr4100-* | mips64vr4100el-* \
 	| mips64vr4300-* | mips64vr4300el-* \
 	| mips64vr5000-* | mips64vr5000el-* \
 	| mips64vr5900-* | mips64vr5900el-* \
 	| mipsisa32-* | mipsisa32el-* \
 	| mipsisa32r2-* | mipsisa32r2el-* \
-	| mipsisa32r6-* | mipsisa32r6el-* \
 	| mipsisa64-* | mipsisa64el-* \
 	| mipsisa64r2-* | mipsisa64r2el-* \
-	| mipsisa64r6-* | mipsisa64r6el-* \
 	| mipsisa64sb1-* | mipsisa64sb1el-* \
 	| mipsisa64sr71k-* | mipsisa64sr71kel-* \
-	| mipsr5900-* | mipsr5900el-* \
 	| mipstx39-* | mipstx39el-* \
 	| mmix-* \
 	| mt-* \
 	| msp430-* \
-	| nds32-* | nds32le-* | nds32be-* \
-	| nios-* | nios2-* | nios2eb-* | nios2el-* \
+	| nios-* | nios2-* \
 	| none-* | np1-* | ns16k-* | ns32k-* \
-	| open8-* \
-	| or1k*-* \
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
-	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
+	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
 	| pyramid-* \
-	| riscv32-* | riscv64-* \
-	| rl78-* | romp-* | rs6000-* | rx-* \
-	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
+	| romp-* | rs6000-* \
+	| sh-* | sh[1234]-* | sh[24]a-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
 	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
 	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
 	| sparclite-* \
-	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \
-	| tahoe-* \
+	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | strongarm-* | sv1-* | sx?-* \
+	| tahoe-* | thumb-* \
 	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
-	| tile*-* \
 	| tron-* \
-	| ubicom32-* \
-	| v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \
-	| vax-* \
-	| visium-* \
+	| v850-* | v850e-* | vax-* \
 	| we32k-* \
-	| x86-* | x86_64-* | xc16x-* | xps100-* \
-	| xstormy16-* | xtensa*-* \
+	| x86-* | x86_64-* | xc16x-* | xps100-* | xscale-* | xscalee[bl]-* \
+	| xstormy16-* | xtensa-* \
 	| ymp-* \
-	| z8k-* | z80-*)
-		;;
-	# Recognize the basic CPU types without company name, with glob match.
-	xtensa*)
-		basic_machine=$basic_machine-unknown
+	| z8k-*)
 		;;
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
@@ -470,7 +389,7 @@ case $basic_machine in
 		basic_machine=a29k-amd
 		os=-udi
 		;;
-	abacus)
+    	abacus)
 		basic_machine=abacus-unknown
 		;;
 	adobe68k)
@@ -516,13 +435,6 @@ case $basic_machine in
 		basic_machine=m68k-apollo
 		os=-bsd
 		;;
-	aros)
-		basic_machine=i386-pc
-		os=-aros
-		;;
-	asmjs)
-		basic_machine=asmjs-unknown
-		;;
 	aux)
 		basic_machine=m68k-apple
 		os=-aux
@@ -531,35 +443,10 @@ case $basic_machine in
 		basic_machine=ns32k-sequent
 		os=-dynix
 		;;
-	blackfin)
-		basic_machine=bfin-unknown
-		os=-linux
-		;;
-	blackfin-*)
-		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
-	bluegene*)
-		basic_machine=powerpc-ibm
-		os=-cnk
-		;;
-	c54x-*)
-		basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	c55x-*)
-		basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	c6x-*)
-		basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
 	c90)
 		basic_machine=c90-cray
 		os=-unicos
 		;;
-	cegcc)
-		basic_machine=arm-unknown
-		os=-cegcc
-		;;
 	convex-c1)
 		basic_machine=c1-convex
 		os=-bsd
@@ -588,8 +475,8 @@ case $basic_machine in
 		basic_machine=craynv-cray
 		os=-unicosmp
 		;;
-	cr16 | cr16-*)
-		basic_machine=cr16-unknown
+	cr16c)
+		basic_machine=cr16c-unknown
 		os=-elf
 		;;
 	crds | unos)
@@ -627,10 +514,6 @@ case $basic_machine in
 		basic_machine=m88k-motorola
 		os=-sysv3
 		;;
-	dicos)
-		basic_machine=i686-pc
-		os=-dicos
-		;;
 	djgpp)
 		basic_machine=i586-pc
 		os=-msdosdjgpp
@@ -643,14 +526,6 @@ case $basic_machine in
 		basic_machine=m68k-bull
 		os=-sysv3
 		;;
-	e500v[12])
-		basic_machine=powerpc-unknown
-		os=$os"spe"
-		;;
-	e500v[12]-*)
-		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=$os"spe"
-		;;
 	ebmon29k)
 		basic_machine=a29k-amd
 		os=-ebmon
@@ -754,6 +629,7 @@ case $basic_machine in
 	i370-ibm* | ibm*)
 		basic_machine=i370-ibm
 		;;
+# I'm not sure what "Sysv32" means.  Should this be sysv3.2?
 	i*86v32)
 		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv32
@@ -792,17 +668,6 @@ case $basic_machine in
 		basic_machine=m68k-isi
 		os=-sysv
 		;;
-	leon-*|leon[3-9]-*)
-		basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'`
-		;;
-	m68knommu)
-		basic_machine=m68k-unknown
-		os=-linux
-		;;
-	m68knommu-*)
-		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
 	m88k-omron*)
 		basic_machine=m88k-omron
 		;;
@@ -814,21 +679,10 @@ case $basic_machine in
 		basic_machine=ns32k-utek
 		os=-sysv
 		;;
-	microblaze*)
-		basic_machine=microblaze-xilinx
-		;;
-	mingw64)
-		basic_machine=x86_64-pc
-		os=-mingw64
-		;;
 	mingw32)
-		basic_machine=i686-pc
+		basic_machine=i386-pc
 		os=-mingw32
 		;;
-	mingw32ce)
-		basic_machine=arm-unknown
-		os=-mingw32ce
-		;;
 	miniframe)
 		basic_machine=m68000-convergent
 		;;
@@ -850,10 +704,6 @@ case $basic_machine in
 		basic_machine=powerpc-unknown
 		os=-morphos
 		;;
-	moxiebox)
-		basic_machine=moxie-unknown
-		os=-moxiebox
-		;;
 	msdos)
 		basic_machine=i386-pc
 		os=-msdos
@@ -861,18 +711,10 @@ case $basic_machine in
 	ms1-*)
 		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
 		;;
-	msys)
-		basic_machine=i686-pc
-		os=-msys
-		;;
 	mvs)
 		basic_machine=i370-ibm
 		os=-mvs
 		;;
-	nacl)
-		basic_machine=le32-unknown
-		os=-nacl
-		;;
 	ncr3000)
 		basic_machine=i486-ncr
 		os=-sysv4
@@ -937,12 +779,6 @@ case $basic_machine in
 	np1)
 		basic_machine=np1-gould
 		;;
-	neo-tandem)
-		basic_machine=neo-tandem
-		;;
-	nse-tandem)
-		basic_machine=nse-tandem
-		;;
 	nsr-tandem)
 		basic_machine=nsr-tandem
 		;;
@@ -973,14 +809,6 @@ case $basic_machine in
 		basic_machine=i860-intel
 		os=-osf
 		;;
-	parisc)
-		basic_machine=hppa-unknown
-		os=-linux
-		;;
-	parisc-*)
-		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
 	pbd)
 		basic_machine=sparc-tti
 		;;
@@ -1025,12 +853,11 @@ case $basic_machine in
 		;;
 	power)	basic_machine=power-ibm
 		;;
-	ppc | ppcbe)	basic_machine=powerpc-unknown
+	ppc)	basic_machine=powerpc-unknown
 		;;
-	ppc-* | ppcbe-*)
-		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
+	ppc-*)	basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	ppcle | powerpclittle)
+	ppcle | powerpclittle | ppc-le | powerpc-little)
 		basic_machine=powerpcle-unknown
 		;;
 	ppcle-* | powerpclittle-*)
@@ -1040,7 +867,7 @@ case $basic_machine in
 		;;
 	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	ppc64le | powerpc64little)
+	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
 		basic_machine=powerpc64le-unknown
 		;;
 	ppc64le-* | powerpc64little-*)
@@ -1053,11 +880,7 @@ case $basic_machine in
 		basic_machine=i586-unknown
 		os=-pw32
 		;;
-	rdos | rdos64)
-		basic_machine=x86_64-pc
-		os=-rdos
-		;;
-	rdos32)
+	rdos)
 		basic_machine=i386-pc
 		os=-rdos
 		;;
@@ -1102,9 +925,6 @@ case $basic_machine in
 		basic_machine=sh-hitachi
 		os=-hms
 		;;
-	sh5el)
-		basic_machine=sh5le-unknown
-		;;
 	sh64)
 		basic_machine=sh64-unknown
 		;;
@@ -1126,9 +946,6 @@ case $basic_machine in
 		basic_machine=i860-stratus
 		os=-sysv4
 		;;
-	strongarm-* | thumb-*)
-		basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
 	sun2)
 		basic_machine=m68000-sun
 		;;
@@ -1185,9 +1002,17 @@ case $basic_machine in
 		basic_machine=t90-cray
 		os=-unicos
 		;;
-	tile*)
-		basic_machine=$basic_machine-unknown
-		os=-linux-gnu
+	tic54x | c54x*)
+		basic_machine=tic54x-unknown
+		os=-coff
+		;;
+	tic55x | c55x*)
+		basic_machine=tic55x-unknown
+		os=-coff
+		;;
+	tic6x | c6x*)
+		basic_machine=tic6x-unknown
+		os=-coff
 		;;
 	tx39)
 		basic_machine=mipstx39-unknown
@@ -1256,9 +1081,6 @@ case $basic_machine in
 	xps | xps100)
 		basic_machine=xps100-honeywell
 		;;
-	xscale-* | xscalee[bl]-*)
-		basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'`
-		;;
 	ymp)
 		basic_machine=ymp-cray
 		os=-unicos
@@ -1267,10 +1089,6 @@ case $basic_machine in
 		basic_machine=z8k-unknown
 		os=-sim
 		;;
-	z80-*-coff)
-		basic_machine=z80-unknown
-		os=-sim
-		;;
 	none)
 		basic_machine=none-none
 		os=-none
@@ -1309,7 +1127,7 @@ case $basic_machine in
 	we32k)
 		basic_machine=we32k-att
 		;;
-	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
+	sh[1234] | sh[24]a | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
 	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
@@ -1356,12 +1174,9 @@ esac
 if [ x"$os" != x"" ]
 then
 case $os in
-	# First match some system type aliases
-	# that might get confused with valid system types.
+        # First match some system type aliases
+        # that might get confused with valid system types.
 	# -solaris* is a basic system type, with this one exception.
-	-auroraux)
-		os=-auroraux
-		;;
 	-solaris1 | -solaris1.*)
 		os=`echo $os | sed -e 's|solaris1|sunos4|'`
 		;;
@@ -1382,32 +1197,29 @@ case $os in
 	# Each alternative MUST END IN A *, to match a version number.
 	# -sysv* is not here because it comes later, after sysvr4.
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
-	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
-	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
-	      | -sym* | -kopensolaris* | -plan9* \
+	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\
+	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* | -aros* | -cloudabi* | -sortix* \
+	      | -aos* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
 	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
-	      | -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
+	      | -openbsd* | -solidbsd* \
 	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* | -cegcc* \
-	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -midipix* | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
-	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
-	      | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
+	      | -chorusos* | -chorusrdb* \
+	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
+	      | -mingw32* | -linux-gnu* | -linux-newlib* | -linux-uclibc* \
+	      | -uxpv* | -beos* | -mpeix* | -udk* \
 	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
 	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
 	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
-	      | -onefs* | -tirtos* | -phoenix*)
+	      | -skyos* | -haiku* | -rdos* | -toppers*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1446,7 +1258,7 @@ case $os in
 	-opened*)
 		os=-openedition
 		;;
-	-os400*)
+        -os400*)
 		os=-os400
 		;;
 	-wince*)
@@ -1495,7 +1307,7 @@ case $os in
 	-sinix*)
 		os=-sysv4
 		;;
-	-tpf*)
+        -tpf*)
 		os=-tpf
 		;;
 	-triton*)
@@ -1531,16 +1343,12 @@ case $os in
 	-aros*)
 		os=-aros
 		;;
+	-kaos*)
+		os=-kaos
+		;;
 	-zvmoe)
 		os=-zvmoe
 		;;
-	-dicos*)
-		os=-dicos
-		;;
-	-nacl*)
-		;;
-	-ios)
-		;;
 	-none)
 		;;
 	*)
@@ -1563,10 +1371,10 @@ else
 # system, and we'll never get to this point.
 
 case $basic_machine in
-	score-*)
+        score-*)
 		os=-elf
 		;;
-	spu-*)
+        spu-*)
 		os=-elf
 		;;
 	*-acorn)
@@ -1578,23 +1386,8 @@ case $basic_machine in
 	arm*-semi)
 		os=-aout
 		;;
-	c4x-* | tic4x-*)
-		os=-coff
-		;;
-	c8051-*)
-		os=-elf
-		;;
-	hexagon-*)
-		os=-elf
-		;;
-	tic54x-*)
-		os=-coff
-		;;
-	tic55x-*)
-		os=-coff
-		;;
-	tic6x-*)
-		os=-coff
+        c4x-* | tic4x-*)
+        	os=-coff
 		;;
 	# This must come before the *-dec entry.
 	pdp10-*)
@@ -1614,13 +1407,13 @@ case $basic_machine in
 		;;
 	m68000-sun)
 		os=-sunos3
+		# This also exists in the configure program, but was not the
+		# default.
+		# os=-sunos4
 		;;
 	m68*-cisco)
 		os=-aout
 		;;
-	mep-*)
-		os=-elf
-		;;
 	mips*-cisco)
 		os=-elf
 		;;
@@ -1645,7 +1438,7 @@ case $basic_machine in
 	*-ibm)
 		os=-aix
 		;;
-	*-knuth)
+    	*-knuth)
 		os=-mmixware
 		;;
 	*-wec)
@@ -1750,7 +1543,7 @@ case $basic_machine in
 			-sunos*)
 				vendor=sun
 				;;
-			-cnk*|-aix*)
+			-aix*)
 				vendor=ibm
 				;;
 			-beos*)

contrib/README

@@ -1,40 +0,0 @@
-These files are contributed to unbound, and are not part of the official
-distribution but may be helpful.
-
-* rc_d_unbound: FreeBSD compatible /etc/rc.d script.
-* parseunbound.pl: perl script to run from cron that parses statistics from
-	the log file and stores them.
-* unbound.spec and unbound.init: RPM specfile and Linux rc.d initfile.
-* update-anchor.sh: shell script that uses unbound-host to update a set
-	of trust anchor files. Run from cron twice a month.
-* unbound_munin_ : plugin for munin statistics report
-* unbound_cacti.tar.gz : setup files for cacti statistics report
-* selinux: the .fc and .te files for SElinux protection of the unbound daemon
-* unbound.plist: launchd configuration file for MacOSX.
-* build-unbound-localzone-from-hosts.pl: perl script to turn /etc/hosts into
-	a local-zone and local-data include file for unbound.conf.
-* unbound-host.nagios.patch: makes unbound-host return status that fits right
-	in with the nagios monitoring framework.  Contributed by Migiel de Vos.
-* patch_rsamd5_enable.diff: this patch enables RSAMD5 validation (otherwise
-  it is treated as insecure).  The RSAMD5 algorithm is deprecated (RFC6725).
-* create_unbound_ad_servers.sh: shell script to enter anti-ad server lists.
-* create_unbound_ad_servers.cmd: windows script to enter anti-ad server lists.
-* unbound_cache.sh: shell script to save and load the cache.
-* unbound_cache.cmd: windows script to save and load the cache.
-* warmup.sh: shell script to warm up DNS cache by your own MRU domains.
-* warmup.cmd: windows script to warm up DNS cache by your own MRU domains.
-* aaaa-filter-iterator.patch: adds config option aaaa-filter: yes that
-  works like the BIND feature (removes AAAA records unless AAAA-only domain).
-  Useful for certain 'broken IPv6 default route' scenarios.
-  Patch from Stephane Lapie for ASAHI Net.
-* unbound_smf22.tar.gz: Solaris SMF installation/removal scripts.
-  Contributed by Yuri Voinov.
-* unbound.socket and unbound.service: systemd files for unbound, install them
-  in /usr/lib/systemd/system.  Contributed by Sami Kerola and Pavel Odintsov.
-* redirect-bogus.patch: Return configured address for bogus A and AAAA answers,
-  instead of SERVFAIL. Contributed by SIDN.
-* fastrpz.patch: fastrpz support from Farsight Security.
-* libunbound.so.conf: ltrace.conf file, see ltrace.conf(5), for libunbound.
-* unbound-querycachedb.py: utility to show data stored in cachedb backend
-  for a particular query name and type.  It requires dnspython and (for
-  redis backend) redis Python modules.

contrib/aaaa-filter-iterator.patch

@@ -1,413 +0,0 @@
-Index: trunk/doc/unbound.conf.5.in
-===================================================================
---- trunk/doc/unbound.conf.5.in	(revision 4357)
-+++ trunk/doc/unbound.conf.5.in	(working copy)
-@@ -701,6 +701,13 @@
- this option in enabled. Only use if you know what you are doing.
- This option only has effect when qname-minimisation is enabled. Default is off.
- .TP
-+.B aaaa\-filter: \fI<yes or no>
-+Activate behavior similar to BIND's AAAA-filter.
-+This forces the dropping of all AAAA records, unless in the case of
-+explicit AAAA queries, when no A records have been confirmed.
-+This also causes an additional A query to be sent for each AAAA query.
-+This breaks DNSSEC!
-+.TP
- .B private\-address: \fI<IP address or subnet>
- Give IPv4 of IPv6 addresses or classless subnets. These are addresses
- on your private network, and are not allowed to be returned for
-Index: trunk/iterator/iter_scrub.c
-===================================================================
---- trunk/iterator/iter_scrub.c	(revision 4357)
-+++ trunk/iterator/iter_scrub.c	(working copy)
-@@ -617,6 +617,32 @@
- }
- 
- /**
-+ * ASN: Lookup A records from rrset cache.
-+ * @param qinfo: the question originally asked.
-+ * @param env: module environment with config and cache.
-+ * @param ie: iterator environment with private address data.
-+ * @return 0 if no A record found, 1 if A record found.
-+ */
-+static int
-+asn_lookup_a_record_from_cache(struct query_info* qinfo,
-+	struct module_env* env, struct iter_env* ATTR_UNUSED(ie))
-+{
-+	struct ub_packed_rrset_key* akey;
-+
-+	/* get cached A records for queried name */
-+	akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname,
-+		qinfo->qname_len, LDNS_RR_TYPE_A, qinfo->qclass,
-+		0, *env->now, 0);
-+	if(akey) { /* we had some. */
-+		log_rrset_key(VERB_ALGO, "ASN-AAAA-filter: found A record",
-+			      akey);
-+		lock_rw_unlock(&akey->entry.lock);
-+		return 1;
-+	}
-+	return 0;
-+}
-+
-+/**
-  * Given a response event, remove suspect RRsets from the response.
-  * "Suspect" rrsets are potentially poison. Note that this routine expects
-  * the response to be in a "normalized" state -- that is, all "irrelevant"
-@@ -635,6 +661,7 @@
- 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
- 	struct iter_env* ie)
- {
-+	int found_a_record = 0; /* ASN: do we have a A record? */
- 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
- 		do not trust the normalized additional-A-AAAA any more */
- 	struct rrset_parse* rrset, *prev;
-@@ -670,6 +697,13 @@
- 		rrset = rrset->rrset_all_next;
- 	}
- 
-+	/* ASN: Locate any A record we can find */
-+	if((ie->aaaa_filter) && (qinfo->qtype == LDNS_RR_TYPE_AAAA)) {
-+		found_a_record = asn_lookup_a_record_from_cache(qinfo,
-+			env, ie);
-+	}
-+	/* ASN: End of added code */
-+
- 	/* At this point, we brutally remove ALL rrsets that aren't 
- 	 * children of the originating zone. The idea here is that, 
- 	 * as far as we know, the server that we contacted is ONLY 
-@@ -680,6 +714,24 @@
- 	prev = NULL;
- 	rrset = msg->rrset_first;
- 	while(rrset) {
-+
-+		/* ASN: For AAAA records only... */
-+		if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) {
-+			/* ASN: If this is not a AAAA query, then remove AAAA
-+			 * records, no questions asked. If this IS a AAAA query
-+			 * then remove AAAA records if we have an A record.
-+			 * Otherwise, leave things be. */
-+			if((qinfo->qtype != LDNS_RR_TYPE_AAAA) ||
-+				(found_a_record)) {
-+				remove_rrset("ASN-AAAA-filter: removing AAAA "
-+					"for record", pkt, msg, prev, &rrset);
-+				continue;
-+			}
-+			log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
-+				"keep AAAA for", zonename,
-+				LDNS_RR_TYPE_AAAA, qinfo->qclass);
-+		}
-+		/* ASN: End of added code */
- 
- 		/* remove private addresses */
- 		if( (rrset->type == LDNS_RR_TYPE_A || 
-Index: trunk/iterator/iter_utils.c
-===================================================================
---- trunk/iterator/iter_utils.c	(revision 4357)
-+++ trunk/iterator/iter_utils.c	(working copy)
-@@ -175,6 +175,7 @@
- 	}
- 	iter_env->supports_ipv6 = cfg->do_ip6;
- 	iter_env->supports_ipv4 = cfg->do_ip4;
-+	iter_env->aaaa_filter = cfg->aaaa_filter;
- 	return 1;
- }
- 
-Index: trunk/iterator/iterator.c
-===================================================================
---- trunk/iterator/iterator.c	(revision 4357)
-+++ trunk/iterator/iterator.c	(working copy)
-@@ -1847,6 +1847,53 @@
- 
- 	return 0;
- }
-+
-+/**
-+ * ASN: This event state was added as an intermediary step between
-+ * QUERYTARGETS_STATE and the next step, in order to cast a subquery for the
-+ * purpose of caching A records for the queried name.
-+ * 
-+ * @param qstate: query state.
-+ * @param iq: iterator query state.
-+ * @param ie: iterator shared global environment.
-+ * @param id: module id.
-+ * @return true if the event requires more request processing immediately,
-+ *         false if not. This state only returns true when it is generating
-+ *         a SERVFAIL response because the query has hit a dead end.
-+ */
-+static int
-+asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
-+	struct iter_env* ATTR_UNUSED(ie), int id)
-+{
-+	struct module_qstate* subq = NULL;
-+
-+	log_assert(iq->fetch_a_for_aaaa == 0);
-+
-+	/* flag the query properly in order to not loop */
-+	iq->fetch_a_for_aaaa = 1;
-+
-+	/* re-throw same query, but with a different type */
-+	if(!generate_sub_request(iq->qchase.qname,
-+        	iq->qchase.qname_len, LDNS_RR_TYPE_A,
-+		iq->qchase.qclass, qstate, id, iq,
-+		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
-+		log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: failed "
-+			"preloading of A record for",
-+			iq->qchase.qname, LDNS_RR_TYPE_A,
-+			iq->qchase.qclass);
-+		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-+	}
-+	log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
-+		"preloading records in cache for",
-+		iq->qchase.qname, LDNS_RR_TYPE_A,
-+		iq->qchase.qclass);
-+
-+	/* set this query as waiting */
-+	qstate->ext_state[id] = module_wait_subquery;
-+	/* at this point break loop */
-+	return 0;
-+}
-+/* ASN: End of added code */
- 	
- /** 
-  * This is the request event state where the request will be sent to one of
-@@ -1894,6 +1941,13 @@
- 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
- 	}
- 	
-+	/* ASN: If we have a AAAA query, then also query for A records */
-+	if((ie->aaaa_filter) && (iq->qchase.qtype == LDNS_RR_TYPE_AAAA) &&
-+		(iq->fetch_a_for_aaaa == 0)) {
-+		return next_state(iq, ASN_FETCH_A_FOR_AAAA_STATE);
-+	}
-+	/* ASN: End of added code */
-+
- 	/* Make sure we have a delegation point, otherwise priming failed
- 	 * or another failure occurred */
- 	if(!iq->dp) {
-@@ -3095,6 +3149,61 @@
- 	return 0;
- }
- 
-+/** 
-+ * ASN: Do final processing on responses to A queries originated from AAAA
-+ * queries. Events reach this state after the iterative resolution algorithm
-+ * terminates.
-+ * This is required down the road to decide whether to scrub AAAA records
-+ * from the results or not.
-+ *
-+ * @param qstate: query state.
-+ * @param id: module id.
-+ * @param forq: super query state.
-+ */
-+static void
-+asn_processAAAAResponse(struct module_qstate* qstate, int id,
-+	struct module_qstate* super)
-+{
-+	/*struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];*/
-+	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
-+	struct delegpt_ns* dpns = NULL;
-+	int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
-+
-+	log_assert(super_iq->fetch_a_for_aaaa > 0);
-+
-+	/* let super go to evaluation of targets after this */
-+	super_iq->state = QUERYTARGETS_STATE;
-+
-+	log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse",
-+		&qstate->qinfo);
-+	log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse super",
-+		&super->qinfo);
-+
-+	if(super_iq->dp)
-+		dpns = delegpt_find_ns(super_iq->dp,
-+			qstate->qinfo.qname, qstate->qinfo.qname_len);
-+	if (!dpns) {
-+		/* not interested */
-+		verbose(VERB_ALGO, "ASN-AAAA-filter: subq: %s, but parent not "
-+			"interested%s", (error ? "error, but" : "success"),
-+			(super_iq->dp ? "anymore" : " (was reset)"));
-+		log_query_info(VERB_ALGO, "ASN-AAAA-filter: superq", &super->qinfo);
-+		if(super_iq->dp && error)
-+			delegpt_log(VERB_ALGO, super_iq->dp);
-+		return;
-+	} else if (error) {
-+		verbose(VERB_ALGO, "ASN-AAAA-filter: mark as failed, "
-+			"and go to target query.");
-+		/* see if the failure did get (parent-lame) info */
-+		if(!cache_fill_missing(super->env,
-+			super_iq->qchase.qclass, super->region,
-+			super_iq->dp))
-+		log_err("ASN-AAAA-filter: out of memory adding missing");
-+		dpns->resolved = 1; /* mark as failed */
-+	}
-+}
-+/* ASN: End of added code */
-+
- /*
-  * Return priming query results to interested super querystates.
-  * 
-@@ -3114,6 +3223,9 @@
- 	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
- 		super->minfo[id])->state == DSNS_FIND_STATE)
- 		processDSNSResponse(qstate, id, super);
-+	else if (super->qinfo.qtype == LDNS_RR_TYPE_AAAA && ((struct iter_qstate*)
-+		super->minfo[id])->state == ASN_FETCH_A_FOR_AAAA_STATE)
-+		asn_processAAAAResponse(qstate, id, super);
- 	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
- 		error_supers(qstate, id, super);
- 	else if(qstate->is_priming)
-@@ -3151,6 +3263,9 @@
- 			case INIT_REQUEST_3_STATE:
- 				cont = processInitRequest3(qstate, iq, id);
- 				break;
-+			case ASN_FETCH_A_FOR_AAAA_STATE:
-+				cont = asn_processQueryAAAA(qstate, iq, ie, id);
-+				break;
- 			case QUERYTARGETS_STATE:
- 				cont = processQueryTargets(qstate, iq, ie, id);
- 				break;
-@@ -3460,6 +3575,8 @@
- 		return "INIT REQUEST STATE (stage 2)";
- 	case INIT_REQUEST_3_STATE:
- 		return "INIT REQUEST STATE (stage 3)";
-+	case ASN_FETCH_A_FOR_AAAA_STATE:
-+		return "ASN_FETCH_A_FOR_AAAA_STATE";
- 	case QUERYTARGETS_STATE :
- 		return "QUERY TARGETS STATE";
- 	case PRIME_RESP_STATE :
-@@ -3484,6 +3601,7 @@
- 		case INIT_REQUEST_STATE :
- 		case INIT_REQUEST_2_STATE :
- 		case INIT_REQUEST_3_STATE :
-+		case ASN_FETCH_A_FOR_AAAA_STATE :
- 		case QUERYTARGETS_STATE :
- 		case COLLECT_CLASS_STATE :
- 			return 0;
-Index: trunk/iterator/iterator.h
-===================================================================
---- trunk/iterator/iterator.h	(revision 4357)
-+++ trunk/iterator/iterator.h	(working copy)
-@@ -130,6 +130,9 @@
- 	 */
- 	int* target_fetch_policy;
- 
-+	/** ASN: AAAA-filter flag */
-+	int aaaa_filter;
-+
- 	/** lock on ratelimit counter */
- 	lock_basic_type queries_ratelimit_lock;
- 	/** number of queries that have been ratelimited */
-@@ -182,6 +185,14 @@
- 	INIT_REQUEST_3_STATE,
- 
- 	/**
-+	 * This state is responsible for intercepting AAAA queries,
-+	 * and launch a A subquery on the same target, to populate the
-+	 * cache with A records, so the AAAA filter scrubbing logic can
-+	 * work.
-+	 */
-+	ASN_FETCH_A_FOR_AAAA_STATE,
-+
-+	/**
- 	 * Each time a delegation point changes for a given query or a 
- 	 * query times out and/or wakes up, this state is (re)visited. 
- 	 * This state is responsible for iterating through a list of 
-@@ -364,6 +375,13 @@
- 	 * be used when creating the state. A higher one will be attempted.
- 	 */
- 	int refetch_glue;
-+
-+	/**
-+	 * ASN: This is a flag that, if true, means that this query is
-+	 * for fetching A records to populate cache and determine if we must
-+	 * return AAAA records or not.
-+	 */
-+	int fetch_a_for_aaaa;
- 
- 	/** list of pending queries to authoritative servers. */
- 	struct outbound_list outlist;
-Index: trunk/pythonmod/interface.i
-===================================================================
---- trunk/pythonmod/interface.i	(revision 4357)
-+++ trunk/pythonmod/interface.i	(working copy)
-@@ -851,6 +851,7 @@
-    int harden_dnssec_stripped;
-    int harden_referral_path;
-    int use_caps_bits_for_id;
-+   int aaaa_filter; /* ASN */
-    struct config_strlist* private_address;
-    struct config_strlist* private_domain;
-    size_t unwanted_threshold;
-Index: trunk/util/config_file.c
-===================================================================
---- trunk/util/config_file.c	(revision 4357)
-+++ trunk/util/config_file.c	(working copy)
-@@ -195,6 +195,7 @@
- 	cfg->harden_referral_path = 0;
- 	cfg->harden_algo_downgrade = 0;
- 	cfg->use_caps_bits_for_id = 0;
-+	cfg->aaaa_filter = 0; /* ASN: default is disabled */
- 	cfg->caps_whitelist = NULL;
- 	cfg->private_address = NULL;
- 	cfg->private_domain = NULL;
-Index: trunk/util/config_file.h
-===================================================================
---- trunk/util/config_file.h	(revision 4357)
-+++ trunk/util/config_file.h	(working copy)
-@@ -209,6 +209,8 @@
- 	int harden_algo_downgrade;
- 	/** use 0x20 bits in query as random ID bits */
- 	int use_caps_bits_for_id;
-+	/** ASN: enable AAAA filter? */
-+	int aaaa_filter;
- 	/** 0x20 whitelist, domains that do not use capsforid */
- 	struct config_strlist* caps_whitelist;
- 	/** strip away these private addrs from answers, no DNS Rebinding */
-Index: trunk/util/configlexer.lex
-===================================================================
---- trunk/util/configlexer.lex	(revision 4357)
-+++ trunk/util/configlexer.lex	(working copy)
-@@ -279,6 +279,7 @@
- use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
- caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
- unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
-+aaaa-filter{COLON}		{ YDVAR(1, VAR_AAAA_FILTER) }
- private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
- private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
- prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
-Index: trunk/util/configparser.y
-===================================================================
---- trunk/util/configparser.y	(revision 4357)
-+++ trunk/util/configparser.y	(working copy)
-@@ -95,6 +95,7 @@
- %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
- %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
- %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
-+%token VAR_AAAA_FILTER
- %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
- %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
- %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -203,6 +204,7 @@
- 	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
- 	server_harden_referral_path | server_private_address |
- 	server_private_domain | server_extended_statistics | 
-+	server_aaaa_filter |
- 	server_local_data_ptr | server_jostle_timeout | 
- 	server_unwanted_reply_threshold | server_log_time_ascii | 
- 	server_domain_insecure | server_val_sig_skew_min | 
-@@ -1183,6 +1185,15 @@
- 		OUTYY(("P(server_caps_whitelist:%s)\n", $2));
- 		if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, $2))
- 			yyerror("out of memory");
-+	}
-+	;
-+server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
-+	{
-+		OUTYY(("P(server_aaaa_filter:%s)\n", $2));
-+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-+			yyerror("expected yes or no.");
-+		else cfg_parser->cfg->aaaa_filter = (strcmp($2, "yes")==0);
-+		free($2);
- 	}
- 	;
- server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG

contrib/build-unbound-localzone-from-hosts.pl

@@ -1,67 +0,0 @@
-#!/usr/bin/perl -WT
-
-use strict;
-use warnings;
-
-my $hostsfile = '/etc/hosts';
-my $localzonefile = '/etc/unbound/localzone.conf.new';
-
-my $localzone = 'example.com';
-
-open( HOSTS,"<${hostsfile}" ) or die( "Could not open ${hostsfile}: $!" );
-open( ZONE,">${localzonefile}" ) or die( "Could not open ${localzonefile}: $!" );
-
-print ZONE "server:\n\n";
-print ZONE "local-zone: \"${localzone}\" transparent\n\n";
-
-my %ptrhash;
-
-while ( my $hostline = <HOSTS> ) {
-
-	# Skip comments
-	if ( $hostline !~ "^#" and $hostline !~ '^\s+$' ) {
-
-		my @entries = split( /\s+/, $hostline );
-
-		my $ip;
-
-		my $count = 0;
-		foreach my $entry ( @entries ) {
-			if ( $count == 0 ) {
-				$ip = $entry;
-			} else {
-
-				if ( $count == 1) {
-
-					# Only return localhost for 127.0.0.1 and ::1
-					if ( ($ip ne '127.0.0.1' and $ip ne '::1') or $entry =~ 'localhost' ) {
-						if ( ! defined $ptrhash{$ip} ) {
-							$ptrhash{$ip} = $entry;
-							print ZONE "local-data-ptr: \"$ip $entry\"\n";
-						}
-					}
-
-				}
-
-				# Use AAAA for IPv6 addresses
-				my $a = 'A';
-				if ( $ip =~ ':' ) {
-					$a = 'AAAA';
-				}
-
-				print ZONE "local-data: \"$entry ${a} $ip\"\n";
-
-			}
-			$count++;
-		}
-		print ZONE "\n";
-
-
-	}
-}
-
-
-
-
-__END__
-

contrib/create_unbound_ad_servers.cmd

@@ -1,33 +0,0 @@
-@Echo off
-rem Convert the Yoyo.org anti-ad server listing
-rem into an unbound dns spoof redirection list.
-rem Written by Y.Voinov (c) 2014
-
-rem Note: Wget required!
-
-rem Variables
-set prefix="C:\Program Files (x86)"
-set dst_dir=%prefix%\Unbound
-set work_dir=%TEMP%
-set list_addr="http://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml&showintro=1&startdate%5Bday%5D=&startdate%5Bmonth%5D=&startdate%5Byear%5D="
-
-rem Check Wget installed
-for /f "delims=" %%a in ('where wget') do @set wget=%%a
-if /I "%wget%"=="" echo Wget not found. If installed, add path to PATH environment variable. & exit 1
-echo Wget found: %wget%
-
-"%wget%" -O %work_dir%\yoyo_ad_servers %list_addr%
-
-del /Q /F /S %dst_dir%\unbound_ad_servers
-
-for /F "eol=; tokens=*" %%a in (%work_dir%\yoyo_ad_servers) do (
-echo local-zone: %%a redirect>>%dst_dir%\unbound_ad_servers
-echo local-data: "%%a A 127.0.0.1">>%dst_dir%\unbound_ad_servers
-)
-
-echo Done.
-rem  then add an include line to your unbound.conf pointing to the full path of
-rem  the unbound_ad_servers file:
-rem
-rem   include: $dst_dir/unbound_ad_servers
-rem

contrib/create_unbound_ad_servers.sh

@@ -1,39 +0,0 @@
-#!/bin/sh
-#
-# Convert the Yoyo.org anti-ad server listing
-# into an unbound dns spoof redirection list.
-# Modified by Y.Voinov (c) 2014
-
-# Note: Wget required!
-
-# Variables
-dst_dir="/etc/opt/csw/unbound"
-work_dir="/tmp"
-list_addr="http://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml&showintro=1&startdate%5Bday%5D=&startdate%5Bmonth%5D=&startdate%5Byear%5D="
-
-# OS commands
-CAT=`which cat`
-ECHO=`which echo`
-WGET=`which wget`
-
-# Check Wget installed
-if [ ! -f $WGET ]; then
- echo "Wget not found. Exiting..."
- exit 1
-fi
-
-$WGET -O $work_dir/yoyo_ad_servers "$list_addr" && \
-$CAT $work_dir/yoyo_ad_servers | \
-while read line ; \
- do \
-   $ECHO "local-zone: \"$line\" redirect" ;\
-   $ECHO "local-data: \"$line A 127.0.0.1\"" ;\
- done > \
-$dst_dir/unbound_ad_servers
-
-echo "Done."
-#  then add an include line to your unbound.conf pointing to the full path of
-#  the unbound_ad_servers file:
-#
-#   include: $dst_dir/unbound_ad_servers
-#

contrib/libunbound.pc.in

@@ -1,13 +0,0 @@
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@
-includedir=@includedir@
-
-Name: unbound
-Description: Library with validating, recursive, and caching DNS resolver
-URL: http://www.unbound.net
-Version: @PACKAGE_VERSION@
-Requires: @PC_LIBEVENT_DEPENDENCY@ @PC_PY_DEPENDENCY@
-Libs: -L${libdir} -lunbound -lssl -lcrypto
-Libs.private: @SSLLIB@ @LIBS@
-Cflags: -I${includedir} 

contrib/libunbound.so.conf

@@ -1,41 +0,0 @@
-# See ltrace.conf(5) for description of syntax of this file.
-typedef ub_type = enum(TYPE_A=1,TYPE_NS=2,TYPE_SOA=6,TYPE_MX=15,TYPE_TXT=16,TYPE_AAAA=28,TYPE_DS=43,TYPE_DNSKEY=48,TYPE_TLSA=52,TYPE_ANY=255);
-typedef ub_class = enum(CLASS_IN=1,CLASS_CH=3,CLASS_NONE=254,CLASS_ANY=255);
-typedef ub_rcode = enum(RCODE_NOERROR,RCODE_FORMERR,RCODE_SERVFAIL,RCODE_NXDOMAIN,RCODE_NOTIMPL,RCODE_REFUSED,RCODE_YXDOMAIN,RCODE_YXRRSET,RCODE_NXRRSET,RCODE_NOTAUTH,RCODE_NOTZONE);
-typedef ub_havedata = enum(no_data, have_data);
-typedef ub_nxdomain = enum(name_exists, nxdomain);
-typedef ub_secure = enum(not_secure, secure);
-typedef ub_bogus = enum(not_bogus, bogus);
-typedef ub_result = struct(string, ub_type, ub_class, array(void*,zero)*, array(int,zero)*, string, ub_rcode, void*, int, ub_havedata, ub_nxdomain, ub_secure, ub_bogus, string, int);
-typedef ub_ctx = void;
-ub_ctx* ub_ctx_create(void);
-void ub_ctx_delete(ub_ctx*);
-int ub_ctx_set_option(ub_ctx*, string, string);
-int ub_ctx_get_option(ub_ctx*, string, +string*);
-int ub_ctx_config(ub_ctx*, string);
-int ub_ctx_set_fwd(ub_ctx*, string);
-int ub_ctx_set_stub(ub_ctx*, string, string, bool(int));
-int ub_ctx_resolvconf(ub_ctx*, string);
-int ub_ctx_hosts(ub_ctx*, string);
-int ub_ctx_add_ta(ub_ctx*, string);
-int ub_ctx_add_ta_file(ub_ctx*, string);
-int ub_ctx_add_ta_autr(ub_ctx*, string);
-int ub_ctx_trustedkeys(ub_ctx*, string);
-int ub_ctx_debugout(ub_ctx*, void*);
-int ub_ctx_debuglevel(ub_ctx*, int);
-int ub_ctx_async(ub_ctx*, bool(int));
-int ub_poll(ub_ctx*);
-int ub_wait(ub_ctx*);
-int ub_fd(ub_ctx*);
-int ub_process(ub_ctx*);
-int ub_resolve(ub_ctx*, string, ub_type, ub_class, +ub_result**);
-int ub_resolve_async(ub_ctx*, string, ub_type, ub_class, void*, void*, +int*);
-int ub_cancel(ub_ctx*, int);
-void ub_resolve_free(ub_result*);
-string ub_strerror(int);
-int ub_ctx_print_local_zones(ub_ctx*);
-int ub_ctx_zone_add(ub_ctx*, string, string);
-int ub_ctx_zone_remove(ub_ctx*, string);
-int ub_ctx_data_add(ub_ctx*, string);
-int ub_ctx_data_remove(ub_ctx*, string);
-string ub_version(void);

contrib/parseunbound.pl

@@ -1,140 +0,0 @@
-#!/usr/local/bin/perl -w
-#
-# Script to parse the output from the unbound namedaemon.
-# Unbound supports a threading model, and outputs a multiline log-blob for
-# every thread.
-#
-# This script should parse all threads of the once, and store it
-# in a local cached file for speedy results when queried lots.
-#
-use strict;
-use POSIX qw(SEEK_END);
-use Storable;
-use FileHandle;
-use Carp qw(croak carp);
-use constant UNBOUND_CACHE => "/var/tmp/unbound-cache.stor";
-
-my $run_from_cron = @ARGV && $ARGV[0] eq "--cron" && shift;
-my $DEBUG = -t STDERR;
-
-# NB. VERY IMPORTANTES: set this when running this script.
-my $numthreads = 4;
-
-### if cache exists, read it in. and is newer than 3 minutes
-if ( -r UNBOUND_CACHE ) {
-    my $result = retrieve(UNBOUND_CACHE);
-    if (-M _ < 3/24/60 && !$run_from_cron ) {
-        print STDERR "Cached results:\n" if $DEBUG;
-        print join("\n", @$result), "\n";
-        exit;
-    }
-}
-my $logfile = shift or die "Usage: parseunbound.pl --cron unboundlogfile";
-my $in = new FileHandle $logfile or die "Cannot open $logfile: $!\n";
-
-# there is a special key 'thread' that indicates the thread. its not used, but returned anyway.
-my @records = ('thread', 'queries', 'cachehits', 'recursions', 'recursionavg',
-        'outstandingmax', 'outstandingavg', 'outstandingexc',
-        'median25', 'median50', 'median75',
-        'us_0', 'us_1', 'us_2', 'us_4', 'us_8', 'us_16', 'us_32',
-        'us_64', 'us_128', 'us_256', 'us_512', 'us_1024', 'us_2048',
-        'us_4096', 'us_8192', 'us_16384', 'us_32768', 'us_65536',
-        'us_131072', 'us_262144', 'us_524288', 's_1', 's_2', 's_4',
-        's_8', 's_16', 's_32', 's_64', 's_128', 's_256', 's_512');
-# Stats hash containing one or more keys. for every thread, 1 key.
-my %allstats = (); # key="$threadid", stats={key => value}
-my %startstats = (); # when we got a queries entry for this thread
-my %donestats = (); # same, but only when we got a histogram entry for it
-# stats hash contains name/value pairs of the actual numbers for that thread.
-my $offset = 0;
-my $inthread=0;
-my $inpid;
-
-# We should continue looping untill we meet these conditions:
-# a) more total queries than the previous run (which defaults to 0) AND
-# b) parsed all $numthreads threads in the log.
-my $numqueries = $previousresult ? $previousresult->[1] : 0;
-
-# Main loop
-while ( scalar keys %startstats < $numthreads || scalar keys %donestats < $numthreads) {
-    $offset += 10000;
-    if ( $offset > -s $logfile or $offset > 10_000_000 ) {
-        die "Cannot find stats in $logfile\n";
-    }
-    $in->seek(-$offset, SEEK_END) or croak "cannot seek $logfile: $!\n";
-
-    for my $line ( <$in> ) {
-        chomp($line);
-
-        #[1208777234] unbound[6705:0] 
-        if ($line =~ m/^\[\d+\] unbound\[\d+:(\d+)\]/) {
-            $inthread = $1;
-            if ($inthread + 1 > $numthreads) {
-                die "Hey. lazy. change \$numthreads in this script to ($inthread)\n";
-            }
-        }
-        # this line doesn't contain a pid:thread. skip.
-        else {
-            next;
-        }
-
-        if ( $line =~ m/info: server stats for thread \d+: (\d+) queries, (\d+) answers from cache, (\d+) recursions/ ) {
-            $startstats{$inthread} = 1;
-            $allstats{$inthread}->{thread} = $inthread;
-            $allstats{$inthread}->{queries} = $1;
-            $allstats{$inthread}->{cachehits} = $2;
-            $allstats{$inthread}->{recursions} = $3;
-        }
-        elsif ( $line =~ m/info: server stats for thread (\d+): requestlist max (\d+) avg ([0-9\.]+) exceeded (\d+)/ ) {
-            $allstats{$inthread}->{outstandingmax} = $2;
-            $allstats{$inthread}->{outstandingavg} = int($3); # This is a float; rrdtool only handles ints.
-            $allstats{$inthread}->{outstandingexc} = $4;
-        }
-        elsif ( $line =~ m/info: average recursion processing time ([0-9\.]+) sec/ ) {
-            $allstats{$inthread}->{recursionavg} = int($1 * 1000); # change sec to millisec.
-        }
-        elsif ( $line =~ m/info: histogram of recursion processing times/ ) {
-            next;
-        }
-        elsif ( $line =~ m/info: \[25%\]=([0-9\.]+) median\[50%\]=([0-9\.]+) \[75%\]=([0-9\.]+)/ ) {
-            $allstats{$inthread}->{median25} = int($1 * 1000000); # change seconds to usec
-            $allstats{$inthread}->{median50} = int($2 * 1000000);
-            $allstats{$inthread}->{median75} = int($3 * 1000000);
-        }
-        elsif ( $line =~ m/info: lower\(secs\) upper\(secs\) recursions/ ) {
-            # since after this line we're unsure if we get these numbers
-            # at all, we should consider this marker as the end of the
-            # block. Chances that we're parsing a file halfway written
-            # at this stage are small. Bold statement.
-            $donestats{$inthread} = 1;
-            next;
-        }
-        elsif ( $line =~ m/info:\s+(\d+)\.(\d+)\s+(\d+)\.(\d+)\s+(\d+)/ ) {
-            my ($froms, $fromus, $toms, $tous, $counter) = ($1, $2, $3, $4, $5);
-            my $prefix = '';
-            if ($froms > 0) {
-                $allstats{$inthread}->{'s_' . int($froms)} = $counter;
-            } else {
-                $allstats{$inthread}->{'us_' . int($fromus)} = $counter;
-            }
-        }
-    }
-}
-
-my @result;
-# loop on the records we want to store
-for my $key ( @records ) {
-    my $sum = 0;
-    # these are the different threads parsed
-    foreach my $thread ( 0 .. $numthreads - 1 ) {
-        $sum += ($allstats{$thread}->{$key} || 0);
-    }
-    print STDERR "$key = " . $sum . "\n" if $DEBUG;
-    push @result, $sum;
-}
-print join("\n", @result), "\n";
-store \@result, UNBOUND_CACHE;
-
-if ($DEBUG) {
-    print STDERR "Threads: " . (scalar keys %allstats) . "\n";
-}

contrib/patch_rsamd5_enable.diff

@@ -1,22 +0,0 @@
-Index: validator/val_secalgo.c
-===================================================================
---- validator/val_secalgo.c	(revision 2759)
-+++ validator/val_secalgo.c	(working copy)
-@@ -153,7 +153,7 @@
- 	switch(id) {
- 	case LDNS_RSAMD5:
- 		/* RFC 6725 deprecates RSAMD5 */
--		return 0;
-+		return 1;
- 	case LDNS_DSA:
- 	case LDNS_DSA_NSEC3:
- 	case LDNS_RSASHA1:
-@@ -617,7 +617,7 @@
- 	switch(id) {
- 	case LDNS_RSAMD5:
- 		/* RFC 6725 deprecates RSAMD5 */
--		return 0;
-+		return 1;
- 	case LDNS_DSA:
- 	case LDNS_DSA_NSEC3:
- 	case LDNS_RSASHA1:

contrib/rc_d_unbound

@@ -1,25 +0,0 @@
-#!/bin/sh
-#
-# unbound freebsd startup rc.d script, modified from the named script.
-# uses the default unbound installation path and pidfile location.
-# copy this to /etc/rc.d/unbound
-# and put unbound_enable="YES" into rc.conf
-#
-
-# PROVIDE: unbound
-# REQUIRE: SERVERS cleanvar
-# KEYWORD: shutdown
-
-. /etc/rc.subr
-
-name="unbound"
-rcvar=`set_rcvar`
-
-load_rc_config $name
-
-command="/usr/local/sbin/unbound"
-pidfile=${unbound_pidfile:-"/usr/local/etc/unbound/unbound.pid"}
-command_args=${unbound_flags:-"-c /usr/local/etc/unbound/unbound.conf"}
-extra_commands="reload"
-
-run_rc_command "$1"

contrib/redirect-bogus.patch

@@ -1,344 +0,0 @@
-Index: daemon/worker.c
-===================================================================
---- daemon/worker.c	(revision 4191)
-+++ daemon/worker.c	(working copy)
-@@ -663,8 +663,21 @@
- 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, rep,
- 			LDNS_RCODE_SERVFAIL, edns, worker->scratchpad))
- 			goto bail_out;
--		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
--			qinfo, id, flags, edns);
-+		if (qinfo->qtype == LDNS_RR_TYPE_A &&
-+			worker->env.cfg->redirect_bogus_ipv4) {
-+			/* BAD cached */
-+			fixed_address_encode(repinfo->c->buffer,
-+				LDNS_RCODE_NOERROR, qinfo, id, flags, edns,
-+				worker->env.cfg->redirect_bogus_ipv4);
-+		} else if (qinfo->qtype == LDNS_RR_TYPE_AAAA &&
-+			worker->env.cfg->redirect_bogus_ipv6) {
-+			fixed_address_encode(repinfo->c->buffer,
-+				LDNS_RCODE_NOERROR, qinfo, id, flags, edns,
-+				worker->env.cfg->redirect_bogus_ipv6);
-+		} else {
-+			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
-+ 			qinfo, id, flags, edns);
-+		}
- 		rrset_array_unlock_touch(worker->env.rrset_cache, 
- 			worker->scratchpad, rep->ref, rep->rrset_count);
- 		if(worker->stats.extended) {
-Index: doc/unbound.conf.5.in
-===================================================================
---- doc/unbound.conf.5.in	(revision 4191)
-+++ doc/unbound.conf.5.in	(working copy)
-@@ -1244,6 +1244,18 @@
- This can make ordinary queries complete (if repeatedly queried for),
- and enter the cache, whilst also mitigating the traffic flow by the
- factor given.
-+.TP 5
-+.B redirect-bogus-ipv4: \fI<IPv4 address>
-+Set a fixed address for DNSSEC failures that are cached
-+Instead of responding to A queries with SERVFAIL, respond
-+with NOERROR and the address specified here
-+The TTL of the response will be 5 seconds
-+.TP 5
-+.B redirect-bogus-ipv6: \fI<IPv4 address>
-+Set a fixed address for DNSSEC failures that are cached
-+Instead of responding to AAAA queries with SERVFAIL, respond
-+with NOERROR and the address specified here
-+The TTL of the response will be 5 seconds
- .SS "Remote Control Options"
- In the
- .B remote\-control:
-Index: services/mesh.c
-===================================================================
---- services/mesh.c	(revision 4191)
-+++ services/mesh.c	(working copy)
-@@ -1006,6 +1006,7 @@
- 	struct timeval end_time;
- 	struct timeval duration;
- 	int secure;
-+	int bogus_override = 0;
- 	/* Copy the client's EDNS for later restore, to make sure the edns
- 	 * compare is with the correct edns options. */
- 	struct edns_data edns_bak = r->edns;
-@@ -1016,6 +1017,7 @@
- 		rcode = LDNS_RCODE_SERVFAIL;
- 		if(m->s.env->cfg->stat_extended) 
- 			m->s.env->mesh->ans_bogus++;
-+		bogus_override = 1;
- 	}
- 	if(rep && rep->security == sec_status_secure)
- 		secure = 1;
-@@ -1047,17 +1049,34 @@
- 	} else if(rcode) {
- 		m->s.qinfo.qname = r->qname;
- 		m->s.qinfo.local_alias = r->local_alias;
--		if(rcode == LDNS_RCODE_SERVFAIL) {
--			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
--				rep, rcode, &r->edns, m->s.region))
--					r->edns.opt_list = NULL;
--		} else { 
--			if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
--				&r->edns, m->s.region))
--					r->edns.opt_list = NULL;
-+		if(bogus_override && m->s.qinfo.qtype == LDNS_RR_TYPE_A &&
-+			m->s.env->cfg->redirect_bogus_ipv4) {
-+			fixed_address_encode(r->query_reply.c->buffer,
-+				LDNS_RCODE_NOERROR, &m->s.qinfo, r->qid,
-+				r->qflags, &r->edns,
-+				m->s.env->cfg->redirect_bogus_ipv4);
-+		} else if(bogus_override &&
-+			m->s.qinfo.qtype == LDNS_RR_TYPE_AAAA &&
-+			m->s.env->cfg->redirect_bogus_ipv6) {
-+			fixed_address_encode(r->query_reply.c->buffer,
-+				LDNS_RCODE_NOERROR, &m->s.qinfo, r->qid,
-+				r->qflags, &r->edns,
-+				m->s.env->cfg->redirect_bogus_ipv6);
-+		} else {
-+			if(rcode == LDNS_RCODE_SERVFAIL) {
-+				if(!inplace_cb_reply_servfail_call(m->s.env,
-+					&m->s.qinfo, &m->s,
-+					rep, rcode, &r->edns, m->s.region))
-+						r->edns.opt_list = NULL;
-+			} else { 
-+				if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo,
-+					&m->s, rep, rcode, &r->edns,
-+					m->s.region))
-+						r->edns.opt_list = NULL;
-+			}
-+			error_encode(r->query_reply.c->buffer, rcode,
-+				&m->s.qinfo, r->qid, r->qflags, &r->edns);
- 		}
--		error_encode(r->query_reply.c->buffer, rcode, &m->s.qinfo,
--			r->qid, r->qflags, &r->edns);
- 		comm_point_send_reply(&r->query_reply);
- 	} else {
- 		size_t udp_size = r->edns.udp_size;
-Index: util/config_file.c
-===================================================================
---- util/config_file.c	(revision 4191)
-+++ util/config_file.c	(working copy)
-@@ -273,6 +273,8 @@
- 	cfg->ratelimit_factor = 10;
- 	cfg->qname_minimisation = 0;
- 	cfg->qname_minimisation_strict = 0;
-+	cfg->redirect_bogus_ipv4 = NULL;
-+	cfg->redirect_bogus_ipv6 = NULL;
- 	cfg->shm_enable = 0;
- 	cfg->shm_key = 11777;
- 	cfg->dnscrypt = 0;
-@@ -602,6 +604,10 @@
- 		}
- 		oi[cfg->num_out_ifs++] = d;
- 		cfg->out_ifs = oi;
-+	} else if (strcmp(opt, "redirect-bogus-ipv4:") == 0) {
-+		cfg->redirect_bogus_ipv4 = strdup(val);
-+	} else if (strcmp(opt, "redirect-bogus-ipv6:") == 0) {
-+		cfg->redirect_bogus_ipv6 = strdup(val);
- 	} else {
- 		/* unknown or unsupported (from the set_option interface):
- 		 * interface, outgoing-interface, access-control,
-@@ -1250,6 +1256,12 @@
- 	free(cfg->dnstap_version);
- 	config_deldblstrlist(cfg->ratelimit_for_domain);
- 	config_deldblstrlist(cfg->ratelimit_below_domain);
-+	if (cfg->redirect_bogus_ipv4) {
-+		free(cfg->redirect_bogus_ipv4);
-+	}
-+	if (cfg->redirect_bogus_ipv6) {
-+		free(cfg->redirect_bogus_ipv6);
-+	}
- #ifdef USE_IPSECMOD
- 	free(cfg->ipsecmod_hook);
- 	config_delstrlist(cfg->ipsecmod_whitelist);
-Index: util/config_file.h
-===================================================================
---- util/config_file.h	(revision 4191)
-+++ util/config_file.h	(working copy)
-@@ -444,6 +444,9 @@
- 	/** minimise QNAME in strict mode, minimise according to RFC.
- 	 *  Do not apply fallback */
- 	int qname_minimisation_strict;
-+	/** construct fake responses for DNSSEC failures */
-+	char *redirect_bogus_ipv4;
-+	char *redirect_bogus_ipv6;
- 	/** SHM data - true if shm is enabled */
- 	int shm_enable;
- 	/** SHM data - key for the shm */
-Index: util/configlexer.lex
-===================================================================
---- util/configlexer.lex	(revision 4191)
-+++ util/configlexer.lex	(working copy)
-@@ -410,6 +410,8 @@
- response-ip-tag{COLON}		{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
- response-ip{COLON}		{ YDVAR(2, VAR_RESPONSE_IP) }
- response-ip-data{COLON}		{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
-+redirect-bogus-ipv4{COLON}	{ YDVAR(1, VAR_REDIRECT_BOGUS_IPV4) }
-+redirect-bogus-ipv6{COLON}	{ YDVAR(1, VAR_REDIRECT_BOGUS_IPV6) }
- dnscrypt{COLON}			{ YDVAR(0, VAR_DNSCRYPT) }
- dnscrypt-enable{COLON}		{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
- dnscrypt-port{COLON}		{ YDVAR(1, VAR_DNSCRYPT_PORT) }
-Index: util/configparser.y
-===================================================================
---- util/configparser.y	(revision 4191)
-+++ util/configparser.y	(working copy)
-@@ -44,6 +44,7 @@
- #include <stdlib.h>
- #include <assert.h>
- 
-+#include "sldns/str2wire.h"
- #include "util/configyyrename.h"
- #include "util/config_file.h"
- #include "util/net_help.h"
-@@ -141,6 +142,7 @@
- %token VAR_ACCESS_CONTROL_TAG_DATA VAR_VIEW VAR_ACCESS_CONTROL_VIEW
- %token VAR_VIEW_FIRST VAR_SERVE_EXPIRED VAR_FAKE_DSA VAR_FAKE_SHA1
- %token VAR_LOG_IDENTITY VAR_HIDE_TRUSTANCHOR VAR_TRUST_ANCHOR_SIGNALING
-+%token VAR_REDIRECT_BOGUS_IPV4 VAR_REDIRECT_BOGUS_IPV6
- %token VAR_USE_SYSTEMD VAR_SHM_ENABLE VAR_SHM_KEY
- %token VAR_DNSCRYPT VAR_DNSCRYPT_ENABLE VAR_DNSCRYPT_PORT VAR_DNSCRYPT_PROVIDER
- %token VAR_DNSCRYPT_SECRET_KEY VAR_DNSCRYPT_PROVIDER_CERT
-@@ -228,6 +230,7 @@
- 	server_access_control_tag_data | server_access_control_view |
- 	server_qname_minimisation_strict | server_serve_expired |
- 	server_fake_dsa | server_log_identity | server_use_systemd |
-+	server_redirect_bogus_ipv4 | server_redirect_bogus_ipv6 |
- 	server_response_ip_tag | server_response_ip | server_response_ip_data |
- 	server_shm_enable | server_shm_key | server_fake_sha1 |
- 	server_hide_trustanchor | server_trust_anchor_signaling |
-@@ -1873,6 +1876,34 @@
- 	#endif
- 	}
- 	;
-+server_redirect_bogus_ipv4: VAR_REDIRECT_BOGUS_IPV4 STRING_ARG
-+	{
-+		uint8_t data[4];
-+		size_t data_len = 4;
-+		OUTYY(("P(name:%s)\n", $2));
-+		if(cfg_parser->cfg->redirect_bogus_ipv4) {
-+			yyerror("redirect-bogus-ipv4, can only use one address");
-+		}
-+		if(sldns_str2wire_a_buf($2, data, &data_len) != LDNS_WIREPARSE_ERR_OK) {
-+			yyerror("redirect-bogus-ipv4, not a valid IPv4 address");
-+		}
-+		free(cfg_parser->cfg->redirect_bogus_ipv4);
-+		cfg_parser->cfg->redirect_bogus_ipv4 = $2;
-+	}
-+server_redirect_bogus_ipv6: VAR_REDIRECT_BOGUS_IPV6 STRING_ARG
-+	{
-+		uint8_t data[16];
-+		size_t data_len = 16;
-+		OUTYY(("P(name:%s)\n", $2));
-+		if(cfg_parser->cfg->redirect_bogus_ipv6) {
-+			yyerror("redirect-bogus-ipv6, can only use one address");
-+		}
-+		if(sldns_str2wire_aaaa_buf($2, data, &data_len) != LDNS_WIREPARSE_ERR_OK) {
-+			yyerror("redirect-bogus-ipv6, not a valid IPv6 address");
-+		}
-+		free(cfg_parser->cfg->redirect_bogus_ipv6);
-+		cfg_parser->cfg->redirect_bogus_ipv6 = $2;
-+	}
- stub_name: VAR_NAME STRING_ARG
- 	{
- 		OUTYY(("P(name:%s)\n", $2));
-Index: util/data/msgencode.c
-===================================================================
---- util/data/msgencode.c	(revision 4191)
-+++ util/data/msgencode.c	(working copy)
-@@ -48,6 +48,7 @@
- #include "util/regional.h"
- #include "util/net_help.h"
- #include "sldns/sbuffer.h"
-+#include "sldns/str2wire.h"
- #include "services/localzone.h"
- 
- /** return code that means the function ran out of memory. negative so it does
-@@ -914,3 +915,63 @@
- 		attach_edns_record(buf, &es);
- 	}
- }
-+
-+void 
-+fixed_address_encode(sldns_buffer* buf, int r, struct query_info* qinfo,
-+	uint16_t qid, uint16_t qflags, struct edns_data* edns, char* data)
-+{
-+	uint16_t flags;
-+	uint8_t addr_data[16];
-+	size_t addr_len = 16;
-+	if (qinfo->qtype == LDNS_RR_TYPE_A) {
-+		sldns_str2wire_a_buf(data, addr_data, &addr_len);
-+	} else if (qinfo->qtype == LDNS_RR_TYPE_AAAA) {
-+		sldns_str2wire_aaaa_buf(data, addr_data, &addr_len);
-+	} else {
-+		return error_encode(buf, LDNS_RCODE_NOERROR, qinfo, qid, qflags, edns);
-+	}
-+	sldns_buffer_clear(buf);
-+	sldns_buffer_write(buf, &qid, sizeof(uint16_t));
-+	flags = (uint16_t)(BIT_QR | BIT_RA | r); /* QR and retcode*/
-+	flags |= (qflags & (BIT_RD|BIT_CD)); /* copy RD and CD bit */
-+	sldns_buffer_write_u16(buf, flags);
-+	if(qinfo) flags = 1;
-+	else	flags = 0;
-+	sldns_buffer_write_u16(buf, flags);
-+	sldns_buffer_write_u16(buf, 1);
-+	flags = 0;
-+	sldns_buffer_write(buf, &flags, sizeof(uint16_t));
-+	sldns_buffer_write(buf, &flags, sizeof(uint16_t));
-+	if(qinfo) {
-+		// query
-+		if(sldns_buffer_current(buf) == qinfo->qname)
-+			sldns_buffer_skip(buf, (ssize_t)qinfo->qname_len);
-+		else	sldns_buffer_write(buf, qinfo->qname, qinfo->qname_len);
-+		sldns_buffer_write_u16(buf, qinfo->qtype);
-+		sldns_buffer_write_u16(buf, qinfo->qclass);
-+		// faked answer
-+		if(sldns_buffer_current(buf) == qinfo->qname)
-+			sldns_buffer_skip(buf, (ssize_t)qinfo->qname_len);
-+		else	sldns_buffer_write(buf, qinfo->qname, qinfo->qname_len);
-+		sldns_buffer_write_u16(buf, qinfo->qtype);
-+		sldns_buffer_write_u16(buf, qinfo->qclass);
-+		sldns_buffer_write_u16(buf, 0);
-+		// TTL. Should we make this configurable too?
-+		sldns_buffer_write_u16(buf, 5);
-+		sldns_buffer_write_u16(buf, addr_len);
-+		sldns_buffer_write(buf, addr_data, addr_len);
-+		fflush(stderr);
-+	}
-+	sldns_buffer_flip(buf);
-+	if(edns) {
-+		struct edns_data es = *edns;
-+		es.edns_version = EDNS_ADVERTISED_VERSION;
-+		es.udp_size = EDNS_ADVERTISED_SIZE;
-+		es.ext_rcode = 0;
-+		es.bits &= EDNS_DO;
-+		if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) >
-+			edns->udp_size)
-+			return;
-+		attach_edns_record(buf, &es);
-+	}
-+}
-Index: util/data/msgencode.h
-===================================================================
---- util/data/msgencode.h	(revision 4191)
-+++ util/data/msgencode.h	(working copy)
-@@ -128,4 +128,20 @@
- void error_encode(struct sldns_buffer* pkt, int r, struct query_info* qinfo,
- 	uint16_t qid, uint16_t qflags, struct edns_data* edns);
- 
-+/**
-+ * Encode a fixed address response.
-+ * This is a fake answer to either an A or AAA query
-+ *
-+ * It will answer with that address
-+ *
-+ * @param pkt: where to store the packet.
-+ * @param r: RCODE value to encode.
-+ * @param qinfo: if not NULL, the query is included.
-+ * @param qid: query ID to set in packet. network order.
-+ * @param qflags: original query flags (to copy RD and CD bits). host order.
-+ * @param edns: if not NULL, this is the query edns info,
-+ * 	and an edns reply is attached. Only attached if EDNS record fits reply.
-+ */
-+void fixed_address_encode(struct sldns_buffer* pkt, int r, struct query_info* qinfo,
-+	uint16_t qid, uint16_t qflags, struct edns_data* edns, char* address);
- #endif /* UTIL_DATA_MSGENCODE_H */

contrib/selinux/unbound.fc

@@ -1,4 +0,0 @@
-/etc/unbound(/.*)?			system_u:object_r:unbound_conf_t:s0
-/etc/rc\.d/init\.d/unbound	--	system_u:object_r:unbound_initrc_exec_t:s0
-/usr/sbin/unbound		--	system_u:object_r:unbound_exec_t:s0
-/var/run/unbound(/.*)?			system_u:object_r:unbound_var_run_t:s0

contrib/selinux/unbound.te

@@ -1,42 +0,0 @@
-policy_module(unbound, 0.1.0)
-
-type unbound_t;
-type unbound_conf_t;
-type unbound_exec_t;
-type unbound_initrc_exec_t;
-type unbound_var_run_t;
-
-init_daemon_domain(unbound_t, unbound_exec_t)
-init_script_file(unbound_initrc_exec_t)
-
-role system_r types unbound_t;
-
-# XXX
-# unbound-{checkconf,control} are not protected. Do we need protect them?
-
-# Unbound daemon
-
-auth_use_nsswitch(unbound_t)
-dev_read_urand(unbound_t)
-corenet_all_recvfrom_unlabeled(unbound_t)
-corenet_tcp_bind_all_nodes(unbound_t)
-corenet_tcp_bind_dns_port(unbound_t)
-corenet_tcp_bind_rndc_port(unbound_t)
-corenet_udp_bind_all_nodes(unbound_t)
-corenet_udp_bind_all_unreserved_ports(unbound_t)
-corenet_udp_bind_dns_port(unbound_t)
-files_read_etc_files(unbound_t)
-files_pid_file(unbound_var_run_t)
-files_type(unbound_conf_t)
-libs_use_ld_so(unbound_t)
-libs_use_shared_libs(unbound_t)
-logging_send_syslog_msg(unbound_t)
-manage_files_pattern(unbound_t, unbound_var_run_t, unbound_var_run_t)
-miscfiles_read_localization(unbound_t)
-read_files_pattern(unbound_t, unbound_conf_t, unbound_conf_t)
-
-allow unbound_t self:capability { setuid chown net_bind_service setgid dac_override };
-allow unbound_t self:tcp_socket create_stream_socket_perms;
-allow unbound_t self:udp_socket create_socket_perms;
-
-###################################################

contrib/unbound-host.nagios.patch

@@ -1,134 +0,0 @@
-Index: smallapp/unbound-host.c
-===================================================================
---- smallapp/unbound-host.c	(revision 2115)
-+++ smallapp/unbound-host.c	(working copy)
-@@ -62,9 +62,18 @@
- #include "libunbound/unbound.h"
- #include <ldns/ldns.h>
- 
-+/** status variable ala nagios */
-+#define FINAL_STATUS_OK		0
-+#define FINAL_STATUS_WARNING	1
-+#define FINAL_STATUS_CRITICAL	2
-+#define FINAL_STATUS_UNKNOWN	3
-+
- /** verbosity for unbound-host app */
- static int verb = 0;
- 
-+/** variable to determine final output */
-+static int final_status = FINAL_STATUS_UNKNOWN;
-+
- /** Give unbound-host usage, and exit (1). */
- static void
- usage()
-@@ -93,7 +102,7 @@
- 	printf("Version %s\n", PACKAGE_VERSION);
- 	printf("BSD licensed, see LICENSE in source package for details.\n");
- 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
--	exit(1);
-+	exit(FINAL_STATUS_UNKNOWN);
- }
- 
- /** determine if str is ip4 and put into reverse lookup format */
-@@ -138,7 +147,7 @@
- 	*res = strdup(buf);
- 	if(!*res) {
- 		fprintf(stderr, "error: out of memory\n");
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- 	return 1;
- }
-@@ -158,7 +167,7 @@
- 	}
- 	if(!res) {
- 		fprintf(stderr, "error: out of memory\n");
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- 	return res;
- }
-@@ -172,7 +181,7 @@
- 		if(r == 0 && strcasecmp(t, "TYPE0") != 0 && 
- 			strcmp(t, "") != 0) {
- 			fprintf(stderr, "error unknown type %s\n", t);
--			exit(1);
-+			exit(FINAL_STATUS_UNKNOWN);
- 		}
- 		return r;
- 	}
-@@ -191,7 +200,7 @@
- 		if(r == 0 && strcasecmp(c, "CLASS0") != 0 && 
- 			strcmp(c, "") != 0) {
- 			fprintf(stderr, "error unknown class %s\n", c);
--			exit(1);
-+			exit(FINAL_STATUS_UNKNOWN);
- 		}
- 		return r;
- 	}
-@@ -207,6 +216,19 @@
- 	return "(insecure)";
- }
- 
-+/** update the final status for the exit code */
-+void
-+update_final_status(struct ub_result* result)
-+{
-+	if (final_status == FINAL_STATUS_UNKNOWN || final_status == FINAL_STATUS_OK) {
-+		if (result->secure) final_status = FINAL_STATUS_OK;
-+		else if (result->bogus) final_status = FINAL_STATUS_CRITICAL;
-+		else final_status = FINAL_STATUS_WARNING;
-+	}
-+	else if (final_status == FINAL_STATUS_WARNING && result->bogus)
-+		final_status = FINAL_STATUS_CRITICAL;
-+}
-+
- /** nice string for type */
- static void
- pretty_type(char* s, size_t len, int t)
-@@ -353,7 +375,7 @@
- 				} else {
- 					fprintf(stderr, "could not parse "
- 						"reply packet to ANY query\n");
--					exit(1);
-+					exit(FINAL_STATUS_UNKNOWN);
- 				}
- 				ldns_pkt_free(p);
- 
-@@ -388,9 +410,10 @@
- 	ret = ub_resolve(ctx, q, t, c, &result);
- 	if(ret != 0) {
- 		fprintf(stderr, "resolve error: %s\n", ub_strerror(ret));
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- 	pretty_output(q, t, c, result, docname);
-+	update_final_status(result);
- 	ret = result->nxdomain;
- 	ub_resolve_free(result);
- 	return ret;
-@@ -427,7 +450,7 @@
- {
- 	if(r != 0) {
- 		fprintf(stderr, "error: %s\n", ub_strerror(r));
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- }
- 
-@@ -448,7 +471,7 @@
- 	ctx = ub_ctx_create();
- 	if(!ctx) {
- 		fprintf(stderr, "error: out of memory\n");
--		exit(1);
-+		exit(FINAL_STATUS_UNKNOWN);
- 	}
- 
- 	/* parse the options */
-@@ -509,5 +532,5 @@
- 		usage();
- 
- 	lookup(ctx, argv[0], qtype, qclass);
--	return 0;
-+	return final_status;
- }

contrib/unbound-querycachedb.py

@@ -1,77 +0,0 @@
-#!/usr/bin/env python
-
-import hashlib
-import sys
-import struct
-import socket
-import time
-from optparse import OptionParser
-
-import dns.message
-import dns.name
-import dns.rdataclass
-import dns.rdatatype
-
-def _calc_hashkey(qname, secret, qtype):
-    qclass = 'IN'           # CLASS is fixed for simplicity
-    hobj = hashlib.sha256()
-    hobj.update(dns.name.from_text(qname).to_wire())
-    hobj.update(struct.pack('HH',
-                            socket.htons(dns.rdatatype.from_text(qtype)),
-                            socket.htons(dns.rdataclass.from_text(qclass))))
-    hobj.update(secret)
-    return hobj.hexdigest().upper()
-
-def _redis_get(options, key):
-    import redis
-    return redis.Redis(options.address, int(options.port)).get(key)
-
-def _dump_value(options, qname, key, value):
-    print(';; query=%s/IN/%s' % (qname, options.qtype))
-    print(';; key=%s' % key)
-    if value is None:
-        print(';; no value')
-        return
-    if len(value) < 16:
-        print(';; broken value, short length: %d' % len(value))
-        return
-    now = int(time.time())
-    timestamp = struct.unpack('!Q', value[-16:-8])[0]
-    expire = struct.unpack('!Q', value[-8:])[0]
-    print(';; Now=%d, TimeStamp=%d, Expire=%d, TTL=%d' %
-          (now, timestamp, expire, max(expire - now, 0)))
-    print(dns.message.from_wire(value[:-16]))
-
-def main():
-    parser = OptionParser(usage='usage: %prog [options] query_name')
-    parser.add_option("-a", "--address", dest="address", action="store",
-                      default='127.0.0.1', help="backend-server address",
-                      metavar='ADDRESS')
-    parser.add_option("-b", "--backend", dest="backend", action="store",
-                      default='redis', help="backend name",
-                      metavar='BACKEND')
-    parser.add_option("-p", "--port", dest="port", action="store",
-                      default='6379', help="backend-server port",
-                      metavar='PORT')
-    parser.add_option("-s", "--secret", dest="secret", action="store",
-                      default='default', help="secret seed", metavar='SECRET')
-    parser.add_option("-t", "--qtype", dest="qtype", action="store",
-                      default='A', help="query RR type", metavar='QTYPE')
-
-    (options, args) = parser.parse_args()
-    if len(args) < 1:
-        parser.error('qname is missing')
-    if options.backend == 'redis':
-        get_func = _redis_get
-    else:
-        raise Exception('unknown backend name: %s\n' % options.backend)
-    key = _calc_hashkey(args[0], options.secret, options.qtype)
-    value = get_func(options, key)
-    _dump_value(options, args[0], key, value)
-
-if __name__ == '__main__':
-    try:
-        main()
-    except Exception as e:
-        sys.stderr.write('%s\n' % e)
-        exit(1)

contrib/unbound.init

@@ -1,139 +0,0 @@
-#!/bin/sh
-#
-# unbound	This shell script takes care of starting and stopping
-#		unbound (DNS server).
-#
-# chkconfig:   - 14 86
-# description:	unbound is a Domain Name Server (DNS) \
-#		that is used to resolve host names to IP addresses.
-
-### BEGIN INIT INFO
-# Provides: $named unbound
-# Required-Start: $network $local_fs
-# Required-Stop: $network $local_fs
-# Should-Start: $syslog
-# Should-Stop: $syslog
-# Short-Description: unbound recursive Domain Name Server.
-# Description:  unbound is a Domain Name Server (DNS) 
-#		that is used to resolve host names to IP addresses.
-### END INIT INFO
-
-# Source function library.
-. /etc/rc.d/init.d/functions
-
-exec="/usr/sbin/unbound"
-prog="unbound"
-config="/var/unbound/unbound.conf"
-pidfile="/var/unbound/unbound.pid"
-rootdir="/var/unbound"
-
-[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
-
-lockfile=/var/lock/subsys/$prog
-
-start() {
-    [ -x $exec ] || exit 5
-    [ -f $config ] || exit 6
-    echo -n $"Starting $prog: "
-
-    # setup root jail
-    if [ -s /etc/localtime ]; then 
-	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
-	if [ ! -e ${rootdir}/etc/localtime ] || /usr/bin/cmp -s /etc/localtime ${rootdir}/etc/localtime; then
-	    cp -fp /etc/localtime ${rootdir}/etc/localtime
-	fi;
-    fi;
-    if [ -s /etc/resolv.conf ]; then
-	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
-	if [ ! -e ${rootdir}/etc/resolv.conf ] || /usr/bin/cmp -s /etc/resolv.conf ${rootdir}/etc/resolv.conf; then
-	    cp -fp /etc/resolv.conf ${rootdir}/etc/resolv.conf
-	fi;
-    fi;
-    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
-	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
-	[ -e ${rootdir}/dev/log ] || touch ${rootdir}/dev/log
-	mount --bind -n /dev/log ${rootdir}/dev/log >/dev/null 2>&1;
-    fi;
-    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
-	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
-	[ -e ${rootdir}/dev/random ] || touch ${rootdir}/dev/random
-	mount --bind -n /dev/random ${rootdir}/dev/random >/dev/null 2>&1;
-    fi;
-
-    # if not running, start it up here
-    daemon $exec
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && touch $lockfile
-    return $retval
-}
-
-stop() {
-    echo -n $"Stopping $prog: "
-    # stop it here, often "killproc $prog"
-    killproc -p $pidfile $prog
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && rm -f $lockfile
-    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
-	umount ${rootdir}/dev/log >/dev/null 2>&1
-    fi;
-    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
-	umount ${rootdir}/dev/random >/dev/null 2>&1
-    fi;
-    return $retval
-}
-
-restart() {
-    stop
-    start
-}
-
-reload() {
-    kill -HUP `cat $pidfile`
-}
-
-force_reload() {
-    restart
-}
-
-rh_status() {
-    # run checks to determine if the service is running or use generic status
-    status -p $pidfile $prog
-}
-
-rh_status_q() {
-    rh_status -p $pidfile >/dev/null 2>&1
-}
-
-case "$1" in
-    start)
-        rh_status_q && exit 0
-        $1
-        ;;
-    stop)
-        rh_status_q || exit 0
-        $1
-        ;;
-    restart)
-        $1
-        ;;
-    reload)
-        rh_status_q || exit 7
-        $1
-        ;;
-    force-reload)
-        force_reload
-        ;;
-    status)
-        rh_status
-        ;;
-    condrestart|try-restart)
-        rh_status_q || exit 0
-        restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
-        exit 2
-esac
-exit $?

contrib/unbound.init_fedora

@@ -1,119 +0,0 @@
-#!/bin/sh
-#
-# unbound	This shell script takes care of starting and stopping
-#		unbound (DNS server).
-#
-# chkconfig:   - 14 86
-# description:	unbound is a Domain Name Server (DNS) \
-#		that is used to resolve host names to IP addresses.
-
-### BEGIN INIT INFO
-# Provides: unbound
-# Required-Start: $network $local_fs
-# Required-Stop: $network $local_fs
-# Should-Start: $syslog
-# Should-Stop: $syslog
-# Short-Description: unbound recursive Domain Name Server.
-# Description:  unbound is a Domain Name Server (DNS) 
-#		that is used to resolve host names to IP addresses.
-### END INIT INFO
-
-# Source function library.
-. /etc/rc.d/init.d/functions
-
-exec="/usr/sbin/unbound"
-config="/var/lib/unbound/unbound.conf"
-rootdir="/var/lib/unbound"
-pidfile="/var/run/unbound/unbound.pid"
-
-[ -e /etc/sysconfig/unbound ] && . /etc/sysconfig/unbound
-
-lockfile=/var/lock/subsys/unbound
-
-start() {
-    [ -x $exec ] || exit 5
-    [ -f $config ] || exit 6
-    echo -n $"Starting unbound: "
-
-	if [ ! -e ${rootdir}/etc/resolv.conf ] || /usr/bin/cmp -s /etc/resolv.conf ${rootdir}/etc/resolv.conf; then
-	    cp -fp /etc/resolv.conf ${rootdir}/etc/resolv.conf
-	fi;
-	if [ ! -e ${rootdir}/etc/localtime ] || /usr/bin/cmp -s /etc/localtime ${rootdir}/etc/localtime; then
-	    cp -fp /etc/localtime ${rootdir}/etc/localtime
-	fi;
-	mount --bind -n /dev/log ${rootdir}/dev/log >/dev/null 2>&1;
-	mount --bind -n /dev/random ${rootdir}/dev/random >/dev/null 2>&1;
-	mount --bind -n /var/run/unbound ${rootdir}/var/run/unbound >/dev/null 2>&1;
-
-    # if not running, start it up here
-    daemon $exec
-    retval=$?
-    [ $retval -eq 0 ] && touch $lockfile
-    echo
-}
-
-stop() {
-    echo -n $"Stopping unbound: "
-    # stop it here, often "killproc unbound"
-    killproc -p $pidfile unbound
-    retval=$?
-    [ $retval -eq 0 ] && rm -f $lockfile
-    for mountfile in /dev/log /dev/random /etc/localtime /etc/resolv.conf /var/run/unbound
-    do
-    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}''${mountfile}'' /proc/mounts; then
-	umount ${rootdir}$mountfile >/dev/null 2>&1
-    fi;
-    done
-    echo
-}
-
-restart() {
-    stop
-    start
-}
-
-reload() {
-    kill -HUP `cat $pidfile`
-}
-
-force_reload() {
-    restart
-}
-
-rh_status() {
-    # run checks to determine if the service is running or use generic status
-    status -p $pidfile unbound
-}
-
-rh_status_q() {
-    rh_status -p $pidfile >/dev/null 2>&1
-}
-
-case "$1" in
-    start)
-        start
-        ;;
-    stop)
-        stop
-        ;;
-    restart)
-        restart
-        ;;
-    reload)
-        reload
-        ;;
-    force-reload)
-        force_reload
-        ;;
-    status)
-        rh_status
-        ;;
-    condrestart|try-restart)
-        rh_status_q || exit 0
-        restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
-        exit 2
-esac
-exit $?

contrib/unbound.plist

@@ -1,42 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd >
-<plist version="1.0">
-<!-- 
-Unbound plist file for use by MacOSX launchd(8) using launchctl(1).
-Copy this file to /Library/LaunchDaemons.  Launchd keeps unbound running.
-
-Setup your unbound.conf with the following additional settings.
-server:
-	do-daemonize: no
-	username: ""
-	chroot: ""
-	directory: ""
-These actions are performed by launchd (for the option values, see below).
-
--->
-<dict>
-	<key>Label</key>
-	<string>unbound</string>
-
-	<key>ProgramArguments</key>
-	<array>
-		<string>unbound</string>
-	</array>
-
-	<key>UserName</key>
-	<string>unbound</string>
-
-	<key>RootDirectory</key>
-	<string>/usr/local/etc/unbound</string>
-
-	<key>WorkingDirectory</key>
-	<string>/usr/local/etc/unbound</string>
-
-	<key>KeepAlive</key>
-	<true/>
-
-	<key>RunAtLoad</key>
-	<true/>
-
-</dict>
-</plist>

contrib/unbound.service.in

@@ -1,28 +0,0 @@
-[Unit]
-Description=Validating, recursive, and caching DNS resolver
-Documentation=man:unbound(8)
-
-[Install]
-WantedBy=multi-user.target
-
-[Service]
-ExecReload=/bin/kill -HUP $MAINPID
-ExecStart=@UNBOUND_SBIN_DIR@/unbound
-NotifyAccess=main
-Type=notify
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT
-MemoryDenyWriteExecute=true
-NoNewPrivileges=true
-PrivateDevices=true
-PrivateTmp=true
-ProtectHome=true
-ProtectControlGroups=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectSystem=strict
-ReadWritePaths=@UNBOUND_SYSCONF_DIR@ @UNBOUND_LOCALSTATE_DIR@ /run @UNBOUND_RUN_DIR@
-RestrictAddressFamilies=AF_INET AF_UNIX
-RestrictRealtime=true
-SystemCallArchitectures=native
-SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
-

contrib/unbound.socket.in

@@ -1,6 +0,0 @@
-[Socket]
-ListenDatagram=127.0.0.1:1153
-ListenStream=127.0.0.1:1153
-# ListenStream=@UNBOUND_RUN_DIR@/control
-[Install]
-WantedBy=sockets.target

contrib/unbound.spec

@@ -1,112 +0,0 @@
-Summary: Validating, recursive, and caching DNS resolver
-Name: unbound
-Version: 1.4.18
-Release: 1%{?dist}
-License: BSD
-Url: http://www.nlnetlabs.nl/unbound/
-Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
-#Source1: unbound.init
-Group: System Environment/Daemons
-Requires: ldns
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel, expat-devel, ldns-devel
-
-%description
-Unbound is a validating, recursive, and caching DNS resolver.
-
-The C implementation of Unbound is developed and maintained by NLnet
-Labs. It is based on ideas and algorithms taken from a java prototype
-developed by Verisign labs, Nominet, Kirei and ep.net.
-
-Unbound is designed as a set of modular components, so that also
-DNSSEC (secure DNS) validation and stub-resolvers (that do not run
-as a server, but are linked into an application) are easily possible.
-
-The source code is under a BSD License.
-
-%prep
-%setup -q
-
-# configure with /var/unbound/unbound.conf so that all default chroot, 
-# pidfile and config file are in /var/unbound, ready for chroot jail set up.
-%configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath
-
-%build
-#%{__make} %{?_smp_mflags}
-make
-
-%install
-rm -rf %{buildroot}
-%{__make} DESTDIR=%{buildroot} install
-install -d 0700 %{buildroot}%{_localstatedir}/%{name}
-install -d 0755 %{buildroot}%{_initrddir}
-install -m 0755 contrib/unbound.init %{buildroot}%{_initrddir}/unbound
-# add symbolic link from /etc/unbound.conf -> /var/unbound/unbound.conf
-ln -s %{_localstatedir}/unbound/unbound.conf %{buildroot}%{_sysconfdir}/unbound.conf 
-# remove static library from install (fedora packaging guidelines)
-rm -f %{buildroot}%{_libdir}/libunbound.a %{buildroot}%{_libdir}/libunbound.la
-
-%clean
-rm -rf ${RPM_BUILD_ROOT}
-
-%files
-%defattr(-,root,root,-)
-%doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
-%attr(0755,root,root) %{_initrddir}/%{name}
-%attr(0700,%{name},%{name}) %dir %{_localstatedir}/%{name}
-%attr(0644,%{name},%{name}) %config(noreplace) %{_localstatedir}/%{name}/unbound.conf
-%attr(0644,%{name},%{name}) %config(noreplace) %{_sysconfdir}/unbound.conf
-%{_sbindir}/*
-%{_mandir}/*/*
-%{_includedir}/*
-%{_libdir}/libunbound*
-
-%pre
-getent group unbound >/dev/null || groupadd -r unbound
-getent passwd unbound >/dev/null || \
-useradd -r -g unbound -d /var/unbound -s /sbin/nologin \
-    -c "unbound name daemon" unbound
-exit 0
-
-%post
-# This adds the proper /etc/rc*.d links for the script
-/sbin/chkconfig --add %{name}
-
-%preun
-if [ $1 -eq 0 ]; then
-	/sbin/service %{name} stop >/dev/null 2>&1
-	/sbin/chkconfig --del %{name}
-	# remove root jail 
-	rm -f /var/unbound/dev/log /var/unbound/dev/random /var/unbound/etc/localtime /var/unbound/etc/resolv.conf >/dev/null 2>&1
-	rmdir /var/unbound/dev >/dev/null 2>&1 || :
-	rmdir /var/unbound/etc >/dev/null 2>&1 || :
-	rmdir /var/unbound >/dev/null 2>&1 || :
-fi
-
-%postun
-if [ "$1" -ge "1" ]; then
-	/sbin/service %{name} condrestart >/dev/null 2>&1 || :
-fi
-
-%changelog
-* Thu Jul 13 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
-- ldns required and ldns-devel required for build, no more ldns-builtin.
-
-* Thu Mar 17 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
-- removed --disable-gost, assume recent openssl on the destination platform.
-
-* Wed Mar 16 2011 Harold Jones <hajones@verisign.com> - 1.4.8
-- Bump version number to latest
-- Add expat-devel to BuildRequires
-- Added --disable-gost for building on CentOS 5.x
-- Added --with-ldns-builtin for CentOS 5.x
-
-* Thu May 22 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.0.0
-- contrib changes from Patrick Vande Walle.
-
-* Thu Apr 25 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.12
-- Using parts from ports collection entry by Jaap Akkerhuis.
-- Using Fedoraproject wiki guidelines.
-
-* Wed Apr 23 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.11
-- Initial version.

contrib/unbound.spec_fedora

@@ -1,433 +0,0 @@
-# not ready yet
-%{?!with_python:      %global with_python      1}
-
-%if %{with_python}
-%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
-%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
-%endif
-
-Summary: Validating, recursive, and caching DNS(SEC) resolver
-Name: unbound
-Version: 1.4.13
-Release: 1%{?dist}
-License: BSD
-Url: http://www.nlnetlabs.nl/unbound/
-Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
-Source1: unbound.init
-Source2: unbound.conf
-Source3: unbound.munin
-Source4: unbound_munin_
-Source5: root.key
-Patch1: unbound-1.2-glob.patch
-
-Group: System Environment/Daemons
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel , ldns-devel >= 1.5.0, 
-BuildRequires: libevent-devel expat-devel
-%if %{with_python}
-BuildRequires:  python-devel swig
-%endif
-# Required for SVN versions
-# BuildRequires: bison
-
-Requires(post): chkconfig
-Requires(preun): chkconfig
-Requires(preun): initscripts
-Requires(postun): initscripts
-Requires: ldns >= 1.5.0
-Requires(pre): shadow-utils
-
-Obsoletes:      dnssec-conf < 1.27-2
-Provides:       dnssec-conf = 1.27-1
-
-%description
-Unbound is a validating, recursive, and caching DNS(SEC) resolver.
-
-The C implementation of Unbound is developed and maintained by NLnet
-Labs. It is based on ideas and algorithms taken from a java prototype
-developed by Verisign labs, Nominet, Kirei and ep.net.
-
-Unbound is designed as a set of modular components, so that also
-DNSSEC (secure DNS) validation and stub-resolvers (that do not run
-as a server, but are linked into an application) are easily possible.
-
-%package munin
-Summary: Plugin for the munin / munin-node monitoring package
-Group:     System Environment/Daemons
-Requires: munin-node
-Requires: %{name} = %{version}-%{release}, bc
-
-%description munin
-Plugin for the munin / munin-node monitoring package
-
-%package devel
-Summary: Development package that includes the unbound header files
-Group: Development/Libraries
-Requires: %{name}-libs = %{version}-%{release}, openssl-devel, ldns-devel
-
-%description devel
-The devel package contains the unbound library and the include files
-
-%package libs
-Summary: Libraries used by the unbound server and client applications
-Group: Applications/System
-Requires(post): /sbin/ldconfig
-Requires(postun): /sbin/ldconfig
-Requires: openssl 
-
-%description libs
-Contains libraries used by the unbound server and client applications
-
-%if %{with_python}
-%package python
-Summary: Python modules and extensions for unbound
-Group: Applications/System
-Requires: %{name}-libs = %{version}-%{release}
-
-%description python
-Python modules and extensions for unbound
-%endif
-
-%prep
-%setup -q 
-%patch1 -p1
-
-%build
-%configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
-            --disable-rpath --disable-static \
-            --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \
-            --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \
-%if %{with_python}
-            --with-pythonmodule --with-pyunbound \
-%endif
-            --enable-sha2 --disable-gost
-%{__make} %{?_smp_mflags}
-
-%install
-rm -rf %{buildroot}
-%{__make} DESTDIR=%{buildroot} install
-install -d 0755 %{buildroot}%{_initrddir}
-install -m 0755 %{SOURCE1} %{buildroot}%{_initrddir}/unbound
-install -m 0755 %{SOURCE2} %{buildroot}%{_sysconfdir}/unbound
-# Install munin plugin and its softlinks
-install -d 0755 %{buildroot}%{_sysconfdir}/munin/plugin-conf.d
-install -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/munin/plugin-conf.d/unbound
-install -d 0755 %{buildroot}%{_datadir}/munin/plugins/
-install -m 0755 %{SOURCE4} %{buildroot}%{_datadir}/munin/plugins/unbound
-for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unbound_munin_by_type unbound_munin_by_class unbound_munin_by_opcode unbound_munin_by_rcode unbound_munin_by_flags unbound_munin_histogram; do
-    ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin
-done 
-
-# install root and DLV key
-install -m 0644 %{SOURCE5} %{SOURCE6} %{buildroot}%{_sysconfdir}/unbound/
-
-# remove static library from install (fedora packaging guidelines)
-rm %{buildroot}%{_libdir}/*.la
-%if %{with_python}
-rm %{buildroot}%{python_sitearch}/*.la
-%endif
-
-mkdir -p %{buildroot}%{_localstatedir}/run/unbound
-
-%clean
-rm -rf ${RPM_BUILD_ROOT}
-
-%files 
-%defattr(-,root,root,-)
-%doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
-%attr(0755,root,root) %{_initrddir}/%{name}
-%attr(0755,root,root) %dir %{_sysconfdir}/%{name}
-%ghost %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/root.key
-%{_sbindir}/*
-%{_mandir}/*/*
-
-%if %{with_python}
-%files python
-%defattr(-,root,root,-)
-%{python_sitearch}/*
-%doc libunbound/python/examples/*
-%doc pythonmod/examples/*
-%endif
-
-%files munin
-%defattr(-,root,root,-)
-%config(noreplace) %{_sysconfdir}/munin/plugin-conf.d/unbound
-%{_datadir}/munin/plugins/unbound*
-
-%files devel
-%defattr(-,root,root,-)
-%{_libdir}/libunbound.so
-%{_includedir}/unbound.h
-%doc README
-
-%files libs
-%defattr(-,root,root,-)
-%{_libdir}/libunbound.so.*
-%doc doc/README doc/LICENSE
-
-%pre
-getent group unbound >/dev/null || groupadd -r unbound
-getent passwd unbound >/dev/null || \
-useradd -r -g unbound -d %{_sysconfdir}/unbound -s /sbin/nologin \
--c "Unbound DNS resolver" unbound
-exit 0
-
-%post
-/sbin/chkconfig --add %{name}
-
-%post libs -p /sbin/ldconfig
-
-%preun
-if [ "$1" -eq 0 ]; then
-        /sbin/service %{name} stop >/dev/null 2>&1
-        /sbin/chkconfig --del %{name} 
-fi
-
-%postun 
-if [ "$1" -ge "1" ]; then
-  /sbin/service %{name} condrestart >/dev/null 2>&1 || :
-fi
-
-%postun libs -p /sbin/ldconfig
-
-%changelog
-* Tue Sep 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.13-1
-- Updated to 1.4.13
-- Fix install location of pythonmod from sitelib to sitearch
-- Removed patches merged in by upstream
-- Removed versioned openssl dep, it differs per branch
- 
-* Mon Aug 08 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-3
-- Added pythonmod docs and examples
-- Fix for python module load in the server (Tom Hendrikx)
-- No longer enable --enable-debug as it causes degraded  performance
-  under load.
-
-* Mon Jul 18 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-1
-- Updated to 1.4.12
-
-* Sun Jul 03 2011 Paul Wouters <paul@xelerance.com> - 1.4.11-1
-- Updated to 1.4.11
-- removed integrated CVE patch
-- updated stock unbound.conf for new options introduced
-
-* Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.10-1
-- Added ghost for /var/run/unbound (bz#656710)
-
-* Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-3
-- rebuilt
-
-* Wed May 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-2
-- Applied patch for CVE-2011-1922 DoS vulnerability
-
-* Sun Mar 27 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-1
-- Updated to 1.4.9
-
-* Sat Feb 12 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-2
-- rebuilt
-
-* Tue Jan 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-1
-- Updated to 1.4.8
-- Enable root key for DNSSEC
-- Fix unbound-munin to use proper file (could cause excessive logging)
-- Build unbound-python per default
-- Disable gost as Fedora/EPEL does not allow ECC and has mangled openssl
-
-* Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-4
-- Revert last build - it was on the wrong branch
-
-* Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-3
-- Disable do-ipv6 per default - causes severe degradation on non-ipv6 machines
-  (see comments in inbound.conf)
-
-* Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-2
-- Bump release - forgot to upload the new tar ball.
-
-* Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-1
-- Upgraded to 1.4.5
-
-* Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-2
-- Added accidentally omitted svn patches to cvs 
-
-* Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-1
-- Upgraded to 1.4.4 with svn patches
-- Obsolete dnssec-conf to ensure it is de-installed
-
-* Thu Mar 11 2010 Paul Wouters <paul@xelerance.com> - 1.4.3-1
-- Update to 1.4.3 that fixes 64bit crasher
-
-* Tue Mar 09 2010 Paul Wouters <paul@xelerance.com> - 1.4.2-1
-- Updated to 1.4.2 
-- Updated unbound.conf with new options
-- Enabled pre-fetching DNSKEY records (DNSSEC speedup)
-- Enabled re-fetching popular records before they expire
-- Enabled logging of DNSSEC validation errors
-
-* Mon Mar 01 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-5
-- Overriding -D_GNU_SOURCE is no longer needed. This fixes DSO issues
-  with pthreads
-
-* Wed Feb 24 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-3
-- Change make/configure lines to attempt to fix -lphtread linking issue
-
-* Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
-- Removed dependency for dnssec-conf
-- Added ISC DLV key (formerly in dnssec-conf)
-- Fixup old DLV locations in unbound.conf file via %%post
-- Fix parent child disagreement handling and no-ipv6 present [svn r1953]
-
-* Tue Jan 05 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-1
-- Updated to 1.4.1
-- Changed %%define to %%global
-
-* Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-2
-- Bump version
-
-* Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-1
-- Upgraded to 1.3.4. Security fix with validating NSEC3 records
-
-* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.3.3-2
-- rebuilt with new openssl
-
-* Mon Aug 17 2009 Paul Wouters <paul@xelerance.com> - 1.3.3-1
-- Updated to 1.3.3
-
-* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.0-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
-
-* Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-2
-- Added missing glob patch to cvs
-- Place python macros within the %%with_python check
-
-* Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-1
-- Updated to 1.3.0
-- Added unbound-python sub package. disabled for now
-- Patch from svn to fix DLV lookups
-- Patches from svn to detect wrong truncated response from BIND 9.6.1 with
-  minimal-responses)
-- Added Default-Start and Default-Stop to unbound.init
-- Re-enabled --enable-sha2
-- Re-enabled glob.patch
-
-* Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-7
-- unbound-iterator.patch was not committed
-
-* Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-6
-- Fix for https://bugzilla.redhat.com/show_bug.cgi?id=499793
-
-* Tue Mar 17 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-5
-- Use --nocheck to avoid giving an error on missing unbound-remote certs/keys
-
-* Tue Mar 10 2009 Adam Tkac <atkac redhat com> - 1.2.1-4
-- enable DNSSEC only if it is enabled in sysconfig/dnssec
-
-* Mon Mar 09 2009 Adam Tkac <atkac redhat com> - 1.2.1-3
-- add DNSSEC support to initscript and enabled it per default
-- add requires dnssec-conf
-
-* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
-
-* Tue Feb 10 2009 Paul Wouters <paul@xelerance.com - 1.2.1-1
-- updated to 1.2.1
-
-* Sun Jan 18 2009 Tomas Mraz <tmraz@redhat.com> - 1.2.0-2
-- rebuild with new openssl
-
-* Wed Jan 14 2009 Paul Wouters <paul@xelerance.com - 1.2.0-1
-- Updated to 1.2.0
-- Added dependency on minimum SSL for CVE-2008-5077
-- Added dependency on bc for unbound-munin
-- Added minimum requirement of libevent 1.4.5. Crashes with older versions
-  (note: libevent is stale in EL-4 and not in EL-5, needs fixing there)
-- Removed dependency on selinux-policy (will get used when available)
-- Enable options as per draft-wijngaards-dnsext-resolver-side-mitigation-00.txt
-- Enable unwanted-reply-threshold to mitigate against a Kaminsky attack
-- Enable val-clean-additional to drop addition unsigned data from signed
-  response.
-- Removed patches (got merged into upstream)
-
-* Mon Jan  5 2009 Paul Wouters <paul@xelerance.com> - 1.1.1-7
-- Modified scandir patch to silently fail when wildcard matches nothing
-- Patch to allow unbound-checkconf to find empty wildcard matches
-
-* Mon Jan  5 2009 Paul Wouters <paul@xelerance.com> - 1.1.1-6
-- Added scandir patch for trusted-keys-file: option, which
-  is used to load multiple dnssec keys in bind file format
-
-* Mon Dec  8 2008 Paul Wouters <paul@xelerance.com> - 1.1.1-4
-- Added Requires: for selinux-policy >= 3.5.13-33 for proper SElinux rules.
-
-* Mon Dec  1 2008 Paul Wouters <paul@xelerance.com> - 1.1.1-3
-- We did not own the /etc/unbound directory (#474020)
-- Fixed cvs anomalies
-
-* Fri Nov 28 2008 Adam Tkac <atkac redhat com> - 1.1.1-2
-- removed all obsolete chroot related stuff
-- label control certs after generation correctly
-
-* Thu Nov 20 2008 Paul Wouters <paul@xelerance.com> - 1.1.1-1
-- Updated to unbound 1.1.1 which fixes a crasher and
-  addresses nlnetlabs bug #219
-
-* Wed Nov 19 2008 Paul Wouters <paul@xelerance.com> - 1.1.0-3
-- Remove the chroot, obsoleted by SElinux
-- Add additional munin plugin links supported by unbound plugin
-- Move configuration directory from /var/lib/unbound to /etc/unbound
-- Modified unbound.init and unbound.conf to account for chroot changes
-- Updated unbound.conf with new available options
-- Enabled dns-0x20 protection per default
-
-* Wed Nov 19 2008 Adam Tkac <atkac redhat com> - 1.1.0-2
-- unbound-1.1.0-log_open.patch
-  - make sure log is opened before chroot call
-  - tracked as http://www.nlnetlabs.nl/bugs/show_bug.cgi?id=219
-- removed /dev/log and /var/run/unbound and /etc/resolv.conf from
-  chroot, not needed
-- don't mount files in chroot, it causes problems during updates
-- fixed typo in default config file
-
-* Fri Nov 14 2008 Paul Wouters <paul@xelerance.com> - 1.1.0-1
-- Updated to version 1.1.0
-- Updated unbound.conf's statistics options and remote-control
-  to work properly for munin
-- Added unbound-munin package
-- Generate unbound remote-control  key/certs on first startup
-- Required ldns is now 1.4.0
-
-* Wed Oct 22 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-5
-- Only call ldconfig in -libs package
-- Move configure into build section
-- devel subpackage should only depend on libs subpackage
-
-* Tue Oct 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-4
-- Fix CFLAGS getting lost in build
-- Don't enable interface-automatic:yes because that
-  causes unbound to listen on 0.0.0.0 instead of 127.0.0.1
-
-* Sun Oct 19 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-3
-- Split off unbound-libs, make build verbose 
-
-* Thu Oct  9 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-2
-- FSB compliance, chroot fixes, initscript fixes
-
-* Thu Sep 11 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-1
-- Upgraded to 1.0.2
-
-* Wed Jul 16 2008 Paul Wouters <paul@xelerance.com> - 1.0.1-1
-- upgraded to new release
-
-* Wed May 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.0-2
-- Build against ldns-1.3.0
-
-* Wed May 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.0-1
-- Split of -devel package, fixed dependencies, make rpmlint happy
-
-* Thu Apr 25 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.12
-- Using parts from ports collection entry by Jaap Akkerhuis.
-- Using Fedoraproject wiki guidelines.
-
-* Wed Apr 23 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.11
-- Initial version.

contrib/unbound_cache.cmd

@@ -1,105 +0,0 @@
-@echo off
-rem --------------------------------------------------------------
-rem -- DNS cache save/load script
-rem --
-rem -- Version 1.2
-rem -- By Yuri Voinov (c) 2014
-rem --------------------------------------------------------------
-
-rem Variables
-set prefix="C:\Program Files (x86)"
-set program_path=%prefix%\Unbound
-set uc=%program_path%\unbound-control.exe
-set fname="unbound_cache.dmp"
-
-rem Check Unbound installed
-if exist %uc% goto start
-echo Unbound control not found. Exiting...
-exit 1
-
-:start
-
-rem arg1 - command (optional)
-rem arg2 - file name (optional)
-set arg1=%1
-set arg2=%2
-
-if /I "%arg1%" == "-h" goto help
-
-if "%arg1%" == "" (
-echo Loading cache from %program_path%\%fname%
-dir /a %program_path%\%fname%
-type %program_path%\%fname%|%uc% load_cache
-goto end
-)
-
-if defined %arg2% (goto Not_Defined) else (goto Defined)
-
-rem If file not specified; use default dump file
-:Not_defined
-if /I "%arg1%" == "-s" (
-echo Saving cache to %program_path%\%fname%
-%uc% dump_cache>%program_path%\%fname%
-dir /a %program_path%\%fname%
-echo ok
-goto end
-)
-
-if /I "%arg1%" == "-l" (
-echo Loading cache from %program_path%\%fname%
-dir /a %program_path%\%fname%
-type %program_path%\%fname%|%uc% load_cache
-goto end
-)
-
-if /I "%arg1%" == "-r" (
-echo Saving cache to %program_path%\%fname%
-dir /a %program_path%\%fname%
-%uc% dump_cache>%program_path%\%fname%
-echo ok
-echo Loading cache from %program_path%\%fname%
-type %program_path%\%fname%|%uc% load_cache
-goto end
-)
-
-rem If file name specified; use this filename
-:Defined
-if /I "%arg1%" == "-s" (
-echo Saving cache to %arg2%
-%uc% dump_cache>%arg2%
-dir /a %arg2%
-echo ok
-goto end
-)
-
-if /I "%arg1%" == "-l" (
-echo Loading cache from %arg2%
-dir /a %arg2%
-type %arg2%|%uc% load_cache
-goto end
-)
-
-if /I "%arg1%" == "-r" (
-echo Saving cache to %arg2%
-dir /a %arg2%
-%uc% dump_cache>%arg2%
-echo ok
-echo Loading cache from %arg2%
-type %arg2%|%uc% load_cache
-goto end
-)
-
-:help
-echo Usage: unbound_cache.cmd [-s] or [-l] or [-r] or [-h] [filename]
-echo.
-echo l - Load - default mode. Warming up Unbound DNS cache from saved file. cache-ttl must be high value.
-echo s - Save - save Unbound DNS cache contents to plain file with domain names.
-echo r - Reload - reloadind new cache entries and refresh existing cache
-echo h - this screen.
-echo filename - file to save/load dumped cache. If not specified, %program_path%\%fname% will be used instead.
-echo Note: Run without any arguments will be in default mode.
-echo       Also, unbound-control must be configured.
-exit 1
-
-:end
-exit 0

contrib/unbound_cache.sh

@@ -1,174 +0,0 @@
-#!/sbin/sh
-
-# --------------------------------------------------------------
-# -- DNS cache save/load script
-# --
-# -- Version 1.2
-# -- By Yuri Voinov (c) 2006, 2014
-# --------------------------------------------------------------
-#
-# ident   "@(#)unbound_cache.sh     1.2     14/10/30 YV"
-#
-
-#############
-# Variables #
-#############
-
-# Installation base dir
-CONF="/etc/opt/csw/unbound"
-BASE="/opt/csw"
-
-# Unbound binaries
-UC="$BASE/sbin/unbound-control"
-FNAME="unbound_cache.dmp"
-
-# OS utilities
-BASENAME=`which basename`
-CAT=`which cat`
-CUT=`which cut`
-ECHO=`which echo`
-EXPR=`which expr`
-GETOPT=`which getopt`
-ID=`which id`
-LS=`which ls`
-
-###############
-# Subroutines #
-###############
-
-usage_note ()
-{
-# Script usage note
- $ECHO "Usage: `$BASENAME $0` [-s] or [-l] or [-r] or [-h] [filename]"
- $ECHO .
- $ECHO "l - Load - default mode. Warming up Unbound DNS cache from saved file. cache-ttl must be high value."
- $ECHO "s - Save - save Unbound DNS cache contents to plain file with domain names."
- $ECHO "r - Reload - reloadind new cache entries and refresh existing cache"
- $ECHO "h - this screen."
- $ECHO "filename - file to save/load dumped cache. If not specified, $CONF/$FNAME will be used instead."
- $ECHO "Note: Run without any arguments will be in default mode."
- $ECHO "      Also, unbound-control must be configured."
- exit 0
-}
-
-root_check ()
-{
- if [ ! `$ID | $CUT -f1 -d" "` = "uid=0(root)" ]; then
-  $ECHO "ERROR: You must be super-user to run this script."
-  exit 1
- fi
-}
-
-check_uc ()
-{
- if [ ! -f "$UC" ]; then
-  $ECHO .
-  $ECHO "ERROR: $UC not found. Exiting..."
-  exit 1
- fi
-}
-
-check_saved_file ()
-{
- filename=$1
- if [ ! -z "$filename" -a ! -f "$filename" ]; then
-  $ECHO .
-  $ECHO "ERROR: File $filename does not exists. Save it first."
-  exit 1
- elif [ ! -f "$CONF/$FNAME" ]; then
-  $ECHO .
-  $ECHO "ERROR: File $CONF/$FNAME does not exists. Save it first."
-  exit 1
- fi
-}
-
-save_cache ()
-{
- # Save unbound cache
- filename=$1
- if [ -z "$filename" ]; then
-  $ECHO "Saving cache in $CONF/$FNAME..."
-  $UC dump_cache>$CONF/$FNAME
-  $LS -lh $CONF/$FNAME
- else
-  $ECHO "Saving cache in $filename..."
-  $UC dump_cache>$filename
-  $LS -lh $filename
- fi
- $ECHO "ok"
-}
-
-load_cache ()
-{
- # Load saved cache contents and warmup cache
- filename=$1
- if [ -z "$filename" ]; then
-  $ECHO "Loading cache from saved $CONF/$FNAME..."
-  $LS -lh $CONF/$FNAME
-  check_saved_file $filename
-  $CAT $CONF/$FNAME|$UC load_cache
- else
-  $ECHO "Loading cache from saved $filename..."
-  $LS -lh $filename
-  check_saved_file $filename
-  $CAT $filename|$UC load_cache
- fi
-}
-
-reload_cache ()
-{
- # Reloading and refresh existing cache and saved dump
- filename=$1
- save_cache $filename
- load_cache $filename
-}
-
-##############
-# Main block #
-##############
-
-# Root check
-root_check
-
-# Check unbound-control
-check_uc
-
-# Check command-line arguments
-if [ "x$*" = "x" ]; then
- # If arguments list empty,load cache by default
- load_cache
-else
- arg_list=$*
- # Parse command line
- set -- `$GETOPT sSlLrRhH: $arg_list` || {
-  usage_note 1>&2
- }
-
- # Read arguments
- for i in $arg_list
-  do
-   case $i in
-    -s | -S) save="1";;
-    -l | -L) save="0";;
-    -r | -R) save="2";;
-    -h | -H | \?) usage_note;;
-    *) shift
-       file=$1
-       break;;
-   esac
-   shift
-  done
-
- # Remove trailing --
- shift `$EXPR $OPTIND - 1`
-fi
-
-if [ "$save" = "1" ]; then
- save_cache $file
-elif [ "$save" = "0" ]; then
- load_cache $file
-elif [ "$save" = "2" ]; then
- reload_cache $file
-fi
-
-exit 0

contrib/unbound_munin_

@@ -1,559 +0,0 @@
-#!/bin/sh
-#
-# plugin for munin to monitor usage of unbound servers.
-# To install copy this to /usr/local/share/munin/plugins/unbound_munin_
-# and use munin-node-configure (--suggest, --shell).
-#
-# (C) 2008 W.C.A. Wijngaards.  BSD Licensed.
-#
-# To install; enable statistics and unbound-control in unbound.conf
-#	server:		extended-statistics: yes
-#			statistics-cumulative: no
-#			statistics-interval: 0
-#	remote-control:	control-enable: yes
-# Run the command unbound-control-setup to generate the key files.
-#
-# Environment variables for this script
-#	statefile	- where to put temporary statefile.
-#	unbound_conf	- where the unbound.conf file is located.
-#	unbound_control	- where to find unbound-control executable.
-#	spoof_warn	- what level to warn about spoofing
-#	spoof_crit	- what level to crit about spoofing
-#
-# You can set them in your munin/plugin-conf.d/plugins.conf file
-# with:
-# [unbound*]
-# user root
-# env.statefile /usr/local/var/munin/plugin-state/unbound-state
-# env.unbound_conf /usr/local/etc/unbound/unbound.conf
-# env.unbound_control /usr/local/sbin/unbound-control
-# env.spoof_warn 1000
-# env.spoof_crit 100000
-#
-# This plugin can create different graphs depending on what name
-# you link it as (with ln -s) into the plugins directory
-# You can link it multiple times.
-# If you are only a casual user, the _hits and _by_type are most interesting,
-# possibly followed by _by_rcode.
-#
-#	unbound_munin_hits	- base volume, cache hits, unwanted traffic
-#	unbound_munin_queue	- to monitor the internal requestlist
-#	unbound_munin_memory	- memory usage
-#	unbound_munin_by_type	- incoming queries by type
-#	unbound_munin_by_class	- incoming queries by class
-#	unbound_munin_by_opcode	- incoming queries by opcode
-#	unbound_munin_by_rcode	- answers by rcode, validation status
-#	unbound_munin_by_flags	- incoming queries by flags
-#	unbound_munin_histogram	- histogram of query resolving times
-#
-# Magic markers - optional - used by installation scripts and
-# munin-config:  (originally contrib family but munin-node-configure ignores it)
-#
-#%# family=auto
-#%# capabilities=autoconf suggest
-
-# POD documentation
-: <<=cut
-=head1 NAME
-
-unbound_munin_ - Munin plugin to monitor the Unbound DNS resolver.
-
-=head1 APPLICABLE SYSTEMS
-
-System with unbound daemon.
-
-=head1 CONFIGURATION
-
-  [unbound*]
-  user root
-  env.statefile /usr/local/var/munin/plugin-state/unbound-state
-  env.unbound_conf /usr/local/etc/unbound/unbound.conf
-  env.unbound_control /usr/local/sbin/unbound-control
-  env.spoof_warn 1000
-  env.spoof_crit 100000
-
-Use the .env settings to override the defaults.
-
-=head1 USAGE
-
-Can be used to present different graphs. Use ln -s for that name in
-the plugins directory to enable the graph.
-unbound_munin_hits	- base volume, cache hits, unwanted traffic
-unbound_munin_queue	- to monitor the internal requestlist
-unbound_munin_memory	- memory usage
-unbound_munin_by_type	- incoming queries by type
-unbound_munin_by_class	- incoming queries by class
-unbound_munin_by_opcode	- incoming queries by opcode
-unbound_munin_by_rcode	- answers by rcode, validation status
-unbound_munin_by_flags	- incoming queries by flags
-unbound_munin_histogram - histogram of query resolving times
-
-=head1 AUTHOR
-
-Copyright 2008 W.C.A. Wijngaards
-
-=head1 LICENSE
-
-BSD
-
-=cut
-
-state=${statefile:-/usr/local/var/munin/plugin-state/unbound-state}
-conf=${unbound_conf:-/usr/local/etc/unbound/unbound.conf}
-ctrl=${unbound_control:-/usr/local/sbin/unbound-control}
-warn=${spoof_warn:-1000}
-crit=${spoof_crit:-100000}
-lock=$state.lock
-
-# number of seconds between polling attempts.
-# makes the statefile hang around for at least this many seconds,
-# so that multiple links of this script can share the results.
-lee=55
-
-# to keep things within 19 characters
-ABBREV="-e s/total/t/ -e s/thread/t/ -e s/num/n/ -e s/query/q/ -e s/answer/a/ -e s/unwanted/u/ -e s/requestlist/ql/ -e s/type/t/ -e s/class/c/ -e s/opcode/o/ -e s/rcode/r/ -e s/edns/e/ -e s/mem/m/ -e s/cache/c/ -e s/mod/m/"
-
-# get value from $1 into return variable $value
-get_value ( ) {
-	value="`grep '^'$1'=' $state | sed -e 's/^.*=//'`"
-	if test "$value"x = ""x; then
-		value="0"
-	fi
-}
-
-# download the state from the unbound server.
-get_state ( ) {
-	# obtain lock for fetching the state
-	# because there is a race condition in fetching and writing to file
-
-	# see if the lock is stale, if so, take it 
-	if test -f $lock ; then
-		pid="`cat $lock 2>&1`"
-		kill -0 "$pid" >/dev/null 2>&1
-		if test $? -ne 0 -a "$pid" != $$ ; then
-			echo $$ >$lock
-		fi
-	fi
-
-	i=0
-	while test ! -f $lock || test "`cat $lock 2>&1`" != $$; do
-		while test -f $lock; do
-			# wait
-			i=`expr $i + 1`
-			if test $i -gt 1000; then
-				sleep 1;
-			fi
-			if test $i -gt 1500; then
-				echo "error locking $lock" "=" `cat $lock`
-				rm -f $lock
-				exit 1
-			fi
-		done
-		# try to get it
-		if echo $$ >$lock ; then : ; else break; fi
-	done
-	# do not refetch if the file exists and only LEE seconds old
-	if test -f $state; then
-		now=`date +%s`
-		get_value "time.now"
-		value="`echo $value | sed -e 's/\..*$//'`"
-		if test $now -lt `expr $value + $lee`; then
-			rm -f $lock
-			return
-		fi
-	fi
-	$ctrl -c $conf stats > $state
-	if test $? -ne 0; then
-		echo "error retrieving data from unbound server"
-		rm -f $lock
-		exit 1
-	fi
-	rm -f $lock
-}
-
-if test "$1" = "autoconf" ; then
-	if test ! -f $conf; then
-		echo no "($conf does not exist)"
-		exit 1
-	fi
-	if test ! -d `dirname $state`; then
-		echo no "(`dirname $state` directory does not exist)"
-		exit 1
-	fi
-	echo yes
-	exit 0
-fi
-
-if test "$1" = "suggest" ; then
-	echo "hits"
-	echo "queue"
-	echo "memory"
-	echo "by_type"
-	echo "by_class"
-	echo "by_opcode"
-	echo "by_rcode"
-	echo "by_flags"
-	echo "histogram"
-	exit 0
-fi
-
-# determine my type, by name
-id=`echo $0 | sed -e 's/^.*unbound_munin_//'`
-if test "$id"x = ""x; then
-	# some default to keep people sane.
-	id="hits"
-fi
-
-# if $1 exists in statefile, config is echoed with label $2
-exist_config ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	if grep '^'$1'=' $state >/dev/null 2>&1; then
-		echo "$mn.label $2"
-		echo "$mn.min 0"
-		echo "$mn.type ABSOLUTE"
-	fi
-}
-
-# print label and min 0 for a name $1 in unbound format
-p_config ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	echo $mn.label "$2"
-	echo $mn.min 0
-	echo $mn.type $3
-}
-
-if test "$1" = "config" ; then
-	if test ! -f $state; then
-		get_state
-	fi
-	case $id in
-	hits)
-		echo "graph_title Unbound DNS traffic and cache hits"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / \${graph_period}"
-		echo "graph_scale no"
-		echo "graph_category DNS"
-		for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
-			sed -e 's/=.*//'`; do
-			exist_config $x "queries handled by `basename $x .num.queries`"
-		done
-		p_config "total.num.queries" "total queries from clients" "ABSOLUTE"
-		p_config "total.num.cachehits" "cache hits" "ABSOLUTE"
-		p_config "total.num.prefetch" "cache prefetch" "ABSOLUTE"
-		p_config "num.query.tcp" "TCP queries" "ABSOLUTE"
-		p_config "num.query.tcpout" "TCP out queries" "ABSOLUTE"
-		p_config "num.query.ipv6" "IPv6 queries" "ABSOLUTE"
-		p_config "unwanted.queries" "queries that failed acl" "ABSOLUTE"
-		p_config "unwanted.replies" "unwanted or unsolicited replies" "ABSOLUTE"
-		echo "u_replies.warning $warn"
-		echo "u_replies.critical $crit"
-		echo "graph_info DNS queries to the recursive resolver. The unwanted replies could be innocent duplicate packets, late replies, or spoof threats."
-		;;
-	queue)
-		echo "graph_title Unbound requestlist size"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel number of queries"
-		echo "graph_scale no"
-		echo "graph_category DNS"
-		p_config "total.requestlist.avg" "Average size of queue on insert" "GAUGE"
-		p_config "total.requestlist.max" "Max size of queue (in 5 min)" "GAUGE"
-		p_config "total.requestlist.overwritten" "Number of queries replaced by new ones" "GAUGE"
-		p_config "total.requestlist.exceeded" "Number of queries dropped due to lack of space" "GAUGE"
-		echo "graph_info The queries that did not hit the cache and need recursion service take up space in the requestlist. If there are too many queries, first queries get overwritten, and at last resort dropped."
-		;;
-	memory)
-		echo "graph_title Unbound memory usage"
-		echo "graph_args --base 1024 -l 0"
-		echo "graph_vlabel memory used in bytes"
-		echo "graph_category DNS"
-		p_config "mem.cache.rrset" "RRset cache memory" "GAUGE"
-		p_config "mem.cache.message" "Message cache memory" "GAUGE"
-		p_config "mem.mod.iterator" "Iterator module memory" "GAUGE"
-		p_config "mem.mod.validator" "Validator module and key cache memory" "GAUGE"
-		p_config "msg.cache.count" "msg cache count" "GAUGE"
-		p_config "rrset.cache.count" "rrset cache count" "GAUGE"
-		p_config "infra.cache.count" "infra cache count" "GAUGE"
-		p_config "key.cache.count" "key cache count" "GAUGE"
-		echo "graph_info The memory used by unbound."
-		;;
-	by_type)
-		echo "graph_title Unbound DNS queries by type"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / \${graph_period}"
-		echo "graph_scale no"
-		echo "graph_category DNS"
-		for x in `grep "^num.query.type" $state`; do
-			nm=`echo $x | sed -e 's/=.*$//'`
-			tp=`echo $nm | sed -e s/num.query.type.//`
-			p_config "$nm" "$tp" "ABSOLUTE"
-		done
-		echo "graph_info queries by DNS RR type queried for"
-		;;
-	by_class)
-		echo "graph_title Unbound DNS queries by class"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / \${graph_period}"
-		echo "graph_scale no"
-		echo "graph_category DNS"
-		for x in `grep "^num.query.class" $state`; do
-			nm=`echo $x | sed -e 's/=.*$//'`
-			tp=`echo $nm | sed -e s/num.query.class.//`
-			p_config "$nm" "$tp" "ABSOLUTE"
-		done
-		echo "graph_info queries by DNS RR class queried for."
-		;;
-	by_opcode)
-		echo "graph_title Unbound DNS queries by opcode"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / \${graph_period}"
-		echo "graph_scale no"
-		echo "graph_category DNS"
-		for x in `grep "^num.query.opcode" $state`; do
-			nm=`echo $x | sed -e 's/=.*$//'`
-			tp=`echo $nm | sed -e s/num.query.opcode.//`
-			p_config "$nm" "$tp" "ABSOLUTE"
-		done
-		echo "graph_info queries by opcode in the query packet."
-		;;
-	by_rcode)
-		echo "graph_title Unbound DNS answers by return code"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel answer packets / \${graph_period}"
-		echo "graph_scale no"
-		echo "graph_category DNS"
-		for x in `grep "^num.answer.rcode" $state`; do
-			nm=`echo $x | sed -e 's/=.*$//'`
-			tp=`echo $nm | sed -e s/num.answer.rcode.//`
-			p_config "$nm" "$tp" "ABSOLUTE"
-		done
-		p_config "num.answer.secure" "answer secure" "ABSOLUTE"
-		p_config "num.answer.bogus" "answer bogus" "ABSOLUTE"
-		p_config "num.rrset.bogus" "num rrsets marked bogus" "ABSOLUTE"
-		echo "graph_info answers sorted by return value. rrsets bogus is the number of rrsets marked bogus per \${graph_period} by the validator"
-		;;
-	by_flags)
-		echo "graph_title Unbound DNS incoming queries by flags"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / \${graph_period}"
-		echo "graph_scale no"
-		echo "graph_category DNS"
-		p_config "num.query.flags.QR" "QR (query reply) flag" "ABSOLUTE"
-		p_config "num.query.flags.AA" "AA (auth answer) flag" "ABSOLUTE"
-		p_config "num.query.flags.TC" "TC (truncated) flag" "ABSOLUTE"
-		p_config "num.query.flags.RD" "RD (recursion desired) flag" "ABSOLUTE"
-		p_config "num.query.flags.RA" "RA (rec avail) flag" "ABSOLUTE"
-		p_config "num.query.flags.Z" "Z (zero) flag" "ABSOLUTE"
-		p_config "num.query.flags.AD" "AD (auth data) flag" "ABSOLUTE"
-		p_config "num.query.flags.CD" "CD (check disabled) flag" "ABSOLUTE"
-		p_config "num.query.edns.present" "EDNS OPT present" "ABSOLUTE"
-		p_config "num.query.edns.DO" "DO (DNSSEC OK) flag" "ABSOLUTE"
-		echo "graph_info This graphs plots the flags inside incoming queries. For example, if QR, AA, TC, RA, Z flags are set, the query can be rejected. RD, AD, CD and DO are legitimately set by some software."
-		;;
-	histogram)
-		echo "graph_title Unbound DNS histogram of reply time"
-		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / \${graph_period}"
-		echo "graph_scale no"
-		echo "graph_category DNS"
-		echo hcache.label "cache hits"
-		echo hcache.min 0
-		echo hcache.type ABSOLUTE
-		echo hcache.draw AREA
-		echo hcache.colour 999999
-		echo h64ms.label "0 msec - 66 msec"
-		echo h64ms.min 0
-		echo h64ms.type ABSOLUTE
-		echo h64ms.draw STACK
-		echo h64ms.colour 0000FF
-		echo h128ms.label "66 msec - 131 msec"
-		echo h128ms.min 0
-		echo h128ms.type ABSOLUTE
-		echo h128ms.colour 1F00DF
-		echo h128ms.draw STACK
-		echo h256ms.label "131 msec - 262 msec"
-		echo h256ms.min 0
-		echo h256ms.type ABSOLUTE
-		echo h256ms.draw STACK
-		echo h256ms.colour 3F00BF
-		echo h512ms.label "262 msec - 524 msec"
-		echo h512ms.min 0
-		echo h512ms.type ABSOLUTE
-		echo h512ms.draw STACK
-		echo h512ms.colour 5F009F
-		echo h1s.label "524 msec - 1 sec"
-		echo h1s.min 0
-		echo h1s.type ABSOLUTE
-		echo h1s.draw STACK
-		echo h1s.colour 7F007F
-		echo h2s.label "1 sec - 2 sec"
-		echo h2s.min 0
-		echo h2s.type ABSOLUTE
-		echo h2s.draw STACK
-		echo h2s.colour 9F005F
-		echo h4s.label "2 sec - 4 sec"
-		echo h4s.min 0
-		echo h4s.type ABSOLUTE
-		echo h4s.draw STACK
-		echo h4s.colour BF003F
-		echo h8s.label "4 sec - 8 sec"
-		echo h8s.min 0
-		echo h8s.type ABSOLUTE
-		echo h8s.draw STACK
-		echo h8s.colour DF001F
-		echo h16s.label "8 sec - ..."
-		echo h16s.min 0
-		echo h16s.type ABSOLUTE
-		echo h16s.draw STACK
-		echo h16s.colour FF0000
-		echo "graph_info Histogram of the reply times for queries."
-		;;
-	esac
-
-	exit 0
-fi
-
-# do the stats itself
-get_state
-
-# get the time elapsed
-get_value "time.elapsed"
-if test $value = 0 || test $value = "0.000000"; then
-	echo "error: time elapsed 0 or could not retrieve data"
-	exit 1
-fi
-elapsed="$value"
-
-# print value for $1
-print_value ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	get_value $1
-	echo "$mn.value" $value
-}
-
-# print value if line already found in $2
-print_value_line ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	value="`echo $2 | sed -e 's/^.*=//'`"
-	echo "$mn.value" $value
-}
-
-
-case $id in
-hits)
-	for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
-		sed -e 's/=.*//'` total.num.queries \
-		total.num.cachehits total.num.prefetch num.query.tcp \
-		num.query.tcpout num.query.ipv6 unwanted.queries \
-		unwanted.replies; do
-		if grep "^"$x"=" $state >/dev/null 2>&1; then
-			print_value $x
-		fi
-	done
-	;;
-queue)
-	for x in total.requestlist.avg total.requestlist.max \
-		total.requestlist.overwritten total.requestlist.exceeded; do
-		print_value $x
-	done
-	;;
-memory)
-	for x in mem.cache.rrset mem.cache.message mem.mod.iterator \
-		mem.mod.validator msg.cache.count rrset.cache.count \
-		infra.cache.count key.cache.count; do
-		print_value $x
-	done
-	;;
-by_type)
-	for x in `grep "^num.query.type" $state`; do
-		nm=`echo $x | sed -e 's/=.*$//'`
-		print_value_line $nm $x
-	done
-	;;
-by_class)
-	for x in `grep "^num.query.class" $state`; do
-		nm=`echo $x | sed -e 's/=.*$//'`
-		print_value_line $nm $x
-	done
-	;;
-by_opcode)
-	for x in `grep "^num.query.opcode" $state`; do
-		nm=`echo $x | sed -e 's/=.*$//'`
-		print_value_line $nm $x
-	done
-	;;
-by_rcode)
-	for x in `grep "^num.answer.rcode" $state`; do
-		nm=`echo $x | sed -e 's/=.*$//'`
-		print_value_line $nm $x
-	done
-	print_value "num.answer.secure"
-	print_value "num.answer.bogus"
-	print_value "num.rrset.bogus"
-	;;
-by_flags)
-	for x in num.query.flags.QR num.query.flags.AA num.query.flags.TC num.query.flags.RD num.query.flags.RA num.query.flags.Z num.query.flags.AD num.query.flags.CD num.query.edns.present num.query.edns.DO; do
-		print_value $x
-	done
-	;;
-histogram)
-	get_value total.num.cachehits
-	echo hcache.value $value
-	r=0
-	for x in histogram.000000.000000.to.000000.000001 \
-		histogram.000000.000001.to.000000.000002 \
-		histogram.000000.000002.to.000000.000004 \
-		histogram.000000.000004.to.000000.000008 \
-		histogram.000000.000008.to.000000.000016 \
-		histogram.000000.000016.to.000000.000032 \
-		histogram.000000.000032.to.000000.000064 \
-		histogram.000000.000064.to.000000.000128 \
-		histogram.000000.000128.to.000000.000256 \
-		histogram.000000.000256.to.000000.000512 \
-		histogram.000000.000512.to.000000.001024 \
-		histogram.000000.001024.to.000000.002048 \
-		histogram.000000.002048.to.000000.004096 \
-		histogram.000000.004096.to.000000.008192 \
-		histogram.000000.008192.to.000000.016384 \
-		histogram.000000.016384.to.000000.032768 \
-		histogram.000000.032768.to.000000.065536; do
-		get_value $x
-		r=`expr $r + $value`
-	done
-	echo h64ms.value $r
-	get_value histogram.000000.065536.to.000000.131072
-	echo h128ms.value $value
-	get_value histogram.000000.131072.to.000000.262144
-	echo h256ms.value $value
-	get_value histogram.000000.262144.to.000000.524288
-	echo h512ms.value $value
-	get_value histogram.000000.524288.to.000001.000000
-	echo h1s.value $value
-	get_value histogram.000001.000000.to.000002.000000
-	echo h2s.value $value
-	get_value histogram.000002.000000.to.000004.000000
-	echo h4s.value $value
-	get_value histogram.000004.000000.to.000008.000000
-	echo h8s.value $value
-	r=0
-	for x in histogram.000008.000000.to.000016.000000 \
-		histogram.000016.000000.to.000032.000000 \
-		histogram.000032.000000.to.000064.000000 \
-		histogram.000064.000000.to.000128.000000 \
-		histogram.000128.000000.to.000256.000000 \
-		histogram.000256.000000.to.000512.000000 \
-		histogram.000512.000000.to.001024.000000 \
-		histogram.001024.000000.to.002048.000000 \
-		histogram.002048.000000.to.004096.000000 \
-		histogram.004096.000000.to.008192.000000 \
-		histogram.008192.000000.to.016384.000000 \
-		histogram.016384.000000.to.032768.000000 \
-		histogram.032768.000000.to.065536.000000 \
-		histogram.065536.000000.to.131072.000000 \
-		histogram.131072.000000.to.262144.000000 \
-		histogram.262144.000000.to.524288.000000; do
-		get_value $x
-		r=`expr $r + $value`
-	done
-	echo h16s.value $r
-	;;
-esac

contrib/update-anchor.sh

@@ -1,158 +0,0 @@
-#!/bin/sh
-# update-anchor.sh, update a trust anchor.
-# Copyright 2008, W.C.A. Wijngaards
-# This file is BSD licensed, see doc/LICENSE.
-
-# which validating lookup to use.
-ubhost=unbound-host
-
-usage ( )
-{
-	echo "usage: update-anchor [-r hs] [-b] <zone name> <trust anchor file>"
-	echo "    performs an update of trust anchor file"
-	echo "    the trust anchor file is overwritten with the latest keys"
-	echo "    the trust anchor file should contain only keys for one zone"
-	echo "    -b causes keyfile to be made in bind format."
-	echo "       without -b the file is made in unbound format."
-	echo "    "
-	echo "alternate:"
-	echo "    update-anchor [-r hints] [-b] -d directory"
-	echo "    update all <zone>.anchor files in the directory."
-	echo "    "
-	echo "    name the files br.anchor se.anchor ..., and include them in"
-	echo "    the validating resolver config file."
-	echo "    put keys for the root in a file with the name root.anchor."
-	echo ""
-	echo "-r root.hints	use different root hints. Strict option order."
-	echo ""
-	echo "Exit code 0 means anchors updated, 1 no changes, others are errors."
-	exit 2
-}
-
-if test $# -eq 0; then
-	usage
-fi
-bindformat="no"
-filearg='-f'
-roothints=""
-if test X"$1" = "X-r"; then
-	shift
-	roothints="$1"
-	shift
-fi
-if test X"$1" = "X-b"; then
-	shift
-	bindformat="yes"
-	filearg='-F'
-fi
-if test $# -ne 2; then
-	echo "arguments wrong."
-	usage
-fi
-
-do_update ( ) {
-	# arguments: <zonename> <keyfile>
-	zonename="$1"
-	keyfile="$2"
-	tmpfile="/tmp/update-anchor.$$"
-	tmp2=$tmpfile.2
-	tmp3=$tmpfile.3
-	rh=""
-	if test -n "$roothints"; then
-		echo "server: root-hints: '$roothints'" > $tmp3
-		rh="-C $tmp3"
-	fi
-	$ubhost -v $rh $filearg "$keyfile" -t DNSKEY "$zonename" >$tmpfile
-	if test $? -ne 0; then
-		rm -f $tmpfile
-		echo "Error: Could not update zone $zonename anchor file $keyfile"
-		echo "Cause: $ubhost lookup failed" 
-		echo "    (Is the domain decommissioned? Is connectivity lost?)"
-		return 2
-	fi
-
-	# has the lookup been DNSSEC validated?
-	if grep '(secure)$' $tmpfile >/dev/null 2>&1; then
-		:
-	else
-		rm -f $tmpfile
-		echo "Error: Could not update zone $zonename anchor file $keyfile"
-		echo "Cause: result of lookup was not secure" 
-		echo "    (keys too far out of date? domain changed ownership? need root hints?)"
-		return 3
-	fi
-
-	if test $bindformat = "yes"; then
-		# are there any KSK keys on board?
-		echo 'trusted-keys {' > "$tmp2"
-		if grep ' has DNSKEY record 257' $tmpfile >/dev/null 2>&1; then
-			# store KSK keys in anchor file
-			grep '(secure)$' $tmpfile | \
-			grep ' has DNSKEY record 257' | \
-			sed -e 's/ (secure)$/";/' | \
-			sed -e 's/ has DNSKEY record \([0-9]*\) \([0-9]*\) \([0-9]*\) /. \1 \2 \3 "/' | \
-			sed -e 's/^\.\././' | sort >> "$tmp2"
-		else
-			# store all keys in the anchor file
-			grep '(secure)$' $tmpfile | \
-			sed -e 's/ (secure)$/";/' | \
-			sed -e 's/ has DNSKEY record \([0-9]*\) \([0-9]*\) \([0-9]*\) /. \1 \2 \3 "/' | \
-			sed -e 's/^\.\././' | sort >> "$tmp2"
-		fi
-		echo '};' >> "$tmp2"
-	else #not bindformat
-		# are there any KSK keys on board?
-		if grep ' has DNSKEY record 257' $tmpfile >/dev/null 2>&1; then
-			# store KSK keys in anchor file
-			grep '(secure)$' $tmpfile | \
-			grep ' has DNSKEY record 257' | \
-			sed -e 's/ (secure)$//' | \
-			sed -e 's/ has DNSKEY record /. IN DNSKEY /' | \
-			sed -e 's/^\.\././' | sort > "$tmp2"
-		else
-			# store all keys in the anchor file
-			grep '(secure)$' $tmpfile | \
-			sed -e 's/ (secure)$//' | \
-			sed -e 's/ has DNSKEY record /. IN DNSKEY /' | \
-			sed -e 's/^\.\././' | sort > "$tmp2"
-		fi
-	fi # endif-bindformat
-
-	# copy over if changed
-	diff $tmp2 $keyfile >/dev/null 2>&1
-	if test $? -eq 1; then   # 0 means no change, 2 means trouble.
-		cat $tmp2 > $keyfile
-		no_updated=0
-		echo "$zonename key file $keyfile updated."
-	else
-		echo "$zonename key file $keyfile unchanged."
-	fi
-
-	rm -f $tmpfile $tmp2 $tmp3
-}
-
-no_updated=1
-if test X"$1" = "X-d"; then
-	tdir="$2"
-	echo "start updating in $2"
-	for x in $tdir/*.anchor; do
-		if test `basename "$x"` = "root.anchor"; then
-			zname="."
-		else
-			zname=`basename "$x" .anchor`
-		fi
-		do_update "$zname" "$x"
-	done
-	echo "done updating in $2"
-else
-	# regular invocation
-	if test X"$1" = "X."; then
-		zname="$1"
-	else
-		# strip trailing dot from zone name
-		zname="`echo $1 | sed -e 's/\.$//'`"
-	fi
-	kfile="$2"
-	do_update $zname $kfile
-fi
-exit $no_updated

contrib/validation-reporter.sh

@@ -1,117 +0,0 @@
-#!/bin/sh
-# validation reporter - reports validation failures to a collection server.
-# Copyright NLnet Labs, 2010
-# BSD license.
-
-
-###
-# Here is the configuration for the validation reporter
-# it greps the failure lines out of the log and sends them to a server.
-
-# The pidfile for the reporter daemon.
-pidfile="/var/run/validation-reporter.pid"
-
-# The logfile to watch for logged validation failures.
-logfile="/var/log/unbound.log"
-
-# how to notify the upstream 
-# nc is netcat, it sends tcp to given host port.  It makes a tcp connection
-# and writes one log-line to it (grepped from the logfile).
-# the notify command can be: "nc the.server.name.org 1234"
-# the listening daemon could be:  nc -lk 127.0.0.1 1234 >> outputfile &
-notify_cmd="nc localhost 1234"
-
-
-###
-# Below this line is the code for the validation reporter,
-# first the daemon itself, then the controller for the daemon.
-reporter_daemon() {
-	trap "rm -f \"$pidfile\"" EXIT
-	tail -F $logfile | grep --line-buffered "unbound.*info: validation failure" | \
-	while read x; do
-		echo "$x" | $notify_cmd
-	done
-}
-
-
-###
-# controller for daemon.
-start_daemon() {
-	echo "starting reporter"
-	nohup $0 rundaemon </dev/null >/dev/null 2>&1 &
-	echo $! > "$pidfile"
-}
-
-kill_daemon() {
-	echo "stopping reporter"
-	if test -s "$pidfile"; then
-		kill `cat "$pidfile"`
-		# check it is really dead
-		if kill -0 `cat "$pidfile"` >/dev/null 2>&1; then
-			sleep 1
-			while kill -0 `cat "$pidfile"` >/dev/null 2>&1; do
-				kill `cat "$pidfile"` >/dev/null 2>&1
-				echo "waiting for reporter to stop"
-				sleep 1
-			done
-		fi
-	fi
-}
-
-get_status_daemon() {
-	if test -s "$pidfile"; then
-		if kill -0 `cat "$pidfile"`; then
-			return 0;
-		fi
-	fi
-	return 1;
-}
-
-restart_daemon() {
-	kill_daemon
-	start_daemon
-}
-
-condrestart_daemon() {
-	if get_status_daemon; then
-		echo "reporter ("`cat "$pidfile"`") is running"
-		exit 0
-	fi
-	start_daemon
-	exit 0
-}
-
-status_daemon() {
-	if get_status_daemon; then
-		echo "reporter ("`cat "$pidfile"`") is running"
-		exit 0
-	fi
-	echo "reporter is not running"
-	exit 1
-}
-
-case "$1" in
-	rundaemon)
-		reporter_daemon
-	;;
-	start)
-		start_daemon
-	;;
-	stop)
-		kill_daemon
-	;;
-	restart)
-		restart_daemon
-	;;
-	condrestart)
-		condrestart_daemon
-	;;
-	status)
-		status_daemon
-	;;
-	*)
-		echo "Usage: $0 {start|stop|restart|condrestart|status}"
-		exit 2
-	;;
-esac
-exit $?

contrib/warmup.cmd

@@ -1,153 +0,0 @@
-@echo off
-
-rem --------------------------------------------------------------
-rem -- Warm up DNS cache script by your own MRU domains or from
-rem -- file when it specified as script argument.
-rem --
-rem -- Version 1.1
-rem -- By Yuri Voinov (c) 2014
-rem --------------------------------------------------------------
-
-rem DNS host address
-set address="127.0.0.1"
-
-rem Check dig installed
-for /f "delims=" %%a in ('where dig') do @set dig=%%a
-if /I "%dig%"=="" echo Dig not found. If installed, add path to PATH environment variable. & exit 1
-echo Dig found: %dig%
-
-set arg=%1%
-
-if defined %arg% (goto builtin) else (goto from_file)
-
-:builtin
-echo Warming up cache by MRU domains...
-for %%a in (
-2gis.ru
-admir.kz
-adobe.com
-agent.mail.ru
-aimp.ru
-akamai.com
-akamai.net
-almaty.tele2.kz
-aol.com
-apple.com
-arin.com
-artlebedev.ru
-auto.mail.ru
-beeline.kz
-bing.com
-blogspot.com
-comodo.com
-dnscrypt.org
-drive.google.com
-drive.mail.ru
-facebook.com
-farmanager.com
-fb.com
-firefox.com
-forum.farmanager.com
-gazeta.ru
-getsharex.com
-gismeteo.ru
-google.com
-google.kz
-google.ru
-googlevideo.com
-goto.kz
-iana.org
-icq.com
-imap.mail.ru
-instagram.com
-intel.com
-irr.kz
-java.com
-kaspersky.com
-kaspersky.ru
-kcell.kz
-krisha.kz
-lady.mail.ru
-lenta.ru
-libreoffice.org
-linkedin.com
-livejournal.com
-mail.google.com
-mail.ru
-microsoft.com
-mozilla.org
-mra.mail.ru
-munin-monitoring.org
-my.mail.ru
-news.bbcimg.co.uk
-news.mail.ru
-newsimg.bbc.net.uk
-nvidia.com
-odnoklassniki.ru
-ok.ru
-opencsw.org
-opendns.com
-opendns.org
-opennet.ru
-opera.com
-oracle.com
-peerbet.ru
-piriform.com
-plugring.farmanager.com
-privoxy.org
-qip.ru
-raidcall.com
-rambler.ru
-reddit.com
-ru.wikipedia.org
-shallalist.de
-skype.com
-snob.ru
-squid-cache.org
-squidclamav.darold.net
-squidguard.org
-ssl.comodo.com
-ssl.verisign.com
-symantec.com
-symantecliveupdate.com
-tele2.kz
-tengrinews.kz
-thunderbird.com
-torproject.org
-torstatus.blutmagie.de
-translate.google.com
-unbound.net
-verisign.com
-vk.com
-vk.me
-vk.ru
-vkontakte.com
-vkontakte.ru
-vlc.org
-watsapp.net
-weather.mail.ru
-windowsupdate.com
-www.baidu.com
-www.bbc.co.uk
-www.internic.net
-www.opennet.ru
-www.topgear.com
-ya.ru
-yahoo.com
-yandex.com
-yandex.ru
-youtube.com
-ytimg.com
-) do "%dig%" %%a @%address% 1>nul 2>nul
-goto end
-
-:from_file
-echo Warming up cache from %1% file...
-%dig% -f %arg% @%address% 1>nul 2>nul 
-
-:end
-echo Saving cache...
-if exist unbound_cache.cmd unbound_cache.cmd -s
-echo Done.
-
-exit 0

contrib/warmup.sh

@@ -1,150 +0,0 @@
-#!/bin/sh
-
-# --------------------------------------------------------------
-# -- Warm up DNS cache script by your own MRU domains or from
-# -- file when it specified as script argument.
-# --
-# -- Version 1.1
-# -- By Yuri Voinov (c) 2014
-# --------------------------------------------------------------
-
-# Default DNS host address
-address="127.0.0.1"
-
-cat=`which cat`
-dig=`which dig`
-
-if [ -z "$1" ]; then
-echo "Warming up cache by MRU domains..."
-$dig -f - @$address >/dev/null 2>&1 <<EOT
-2gis.ru
-admir.kz
-adobe.com
-agent.mail.ru
-aimp.ru
-akamai.com
-akamai.net
-almaty.tele2.kz
-aol.com
-apple.com
-arin.com
-artlebedev.ru
-auto.mail.ru
-beeline.kz
-bing.com
-blogspot.com
-clamav.net
-comodo.com
-dnscrypt.org
-drive.google.com
-drive.mail.ru
-facebook.com
-farmanager.com
-fb.com
-firefox.com
-forum.farmanager.com
-gazeta.ru
-getsharex.com
-gismeteo.ru
-google.com
-google.kz
-google.ru
-googlevideo.com
-goto.kz
-iana.org
-icq.com
-imap.mail.ru
-instagram.com
-instagram.com
-intel.com
-irr.kz
-java.com
-kaspersky.com
-kaspersky.ru
-kcell.kz
-krisha.kz
-lady.mail.ru
-lenta.ru
-libreoffice.org
-linkedin.com
-livejournal.com
-mail.google.com
-mail.ru
-microsoft.com
-mozilla.org
-mra.mail.ru
-munin-monitoring.org
-my.mail.ru
-news.bbcimg.co.uk
-news.mail.ru
-newsimg.bbc.net.uk
-nvidia.com
-odnoklassniki.ru
-ok.ru
-opencsw.org
-opendns.com
-opendns.org
-opennet.ru
-opera.com
-oracle.com
-peerbet.ru
-piriform.com
-plugring.farmanager.com
-privoxy.org
-qip.ru
-raidcall.com
-rambler.ru
-reddit.com
-ru.wikipedia.org
-shallalist.de
-skype.com
-snob.ru
-squid-cache.org
-squidclamav.darold.net
-squidguard.org
-ssl.comodo.com
-ssl.verisign.com
-symantec.com
-symantecliveupdate.com
-tele2.kz
-tengrinews.kz
-thunderbird.com
-torproject.org
-torstatus.blutmagie.de
-translate.google.com
-unbound.net
-verisign.com
-vk.com
-vk.me
-vk.ru
-vkontakte.com
-vkontakte.ru
-vlc.org
-watsapp.net
-weather.mail.ru
-windowsupdate.com
-www.baidu.com
-www.bbc.co.uk
-www.internic.net
-www.opennet.ru
-www.topgear.com
-ya.ru
-yahoo.com
-yandex.com
-yandex.ru
-youtube.com
-ytimg.com
-EOT
-else
- echo "Warming up cache from $1 file..."
- $cat $1 | $dig -f - @$address >/dev/null 2>&1 
-fi
-
-echo "Done."
-
-echo "Saving cache..."
-script=`which unbound_cache.sh`
-[ -f "$script" ] && $script -s
-echo "Done."
-
-exit 0

daemon/acl_list.c

@@ -1,489 +0,0 @@
-/*
- * daemon/acl_list.h - client access control storage for the server.
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file helps the server keep out queries from outside sources, that
- * should not be answered.
- */
-#include "config.h"
-#include "daemon/acl_list.h"
-#include "util/regional.h"
-#include "util/log.h"
-#include "util/config_file.h"
-#include "util/net_help.h"
-#include "services/localzone.h"
-#include "sldns/str2wire.h"
-
-struct acl_list* 
-acl_list_create(void)
-{
-	struct acl_list* acl = (struct acl_list*)calloc(1,
-		sizeof(struct acl_list));
-	if(!acl)
-		return NULL;
-	acl->region = regional_create();
-	if(!acl->region) {
-		acl_list_delete(acl);
-		return NULL;
-	}
-	return acl;
-}
-
-void 
-acl_list_delete(struct acl_list* acl)
-{
-	if(!acl) 
-		return;
-	regional_destroy(acl->region);
-	free(acl);
-}
-
-/** insert new address into acl_list structure */
-static struct acl_addr*
-acl_list_insert(struct acl_list* acl, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int net, enum acl_access control, 
-	int complain_duplicates)
-{
-	struct acl_addr* node = regional_alloc_zero(acl->region,
-		sizeof(struct acl_addr));
-	if(!node)
-		return NULL;
-	node->control = control;
-	if(!addr_tree_insert(&acl->tree, &node->node, addr, addrlen, net)) {
-		if(complain_duplicates)
-			verbose(VERB_QUERY, "duplicate acl address ignored.");
-	}
-	return node;
-}
-
-/** apply acl_list string */
-static int
-acl_list_str_cfg(struct acl_list* acl, const char* str, const char* s2,
-	int complain_duplicates)
-{
-	struct sockaddr_storage addr;
-	int net;
-	socklen_t addrlen;
-	enum acl_access control;
-	if(strcmp(s2, "allow") == 0)
-		control = acl_allow;
-	else if(strcmp(s2, "deny") == 0)
-		control = acl_deny;
-	else if(strcmp(s2, "refuse") == 0)
-		control = acl_refuse;
-	else if(strcmp(s2, "deny_non_local") == 0)
-		control = acl_deny_non_local;
-	else if(strcmp(s2, "refuse_non_local") == 0)
-		control = acl_refuse_non_local;
-	else if(strcmp(s2, "allow_snoop") == 0)
-		control = acl_allow_snoop;
-	else if(strcmp(s2, "allow_setrd") == 0)
-		control = acl_allow_setrd;
-	else {
-		log_err("access control type %s unknown", str);
-		return 0;
-	}
-	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
-		log_err("cannot parse access control: %s %s", str, s2);
-		return 0;
-	}
-	if(!acl_list_insert(acl, &addr, addrlen, net, control, 
-		complain_duplicates)) {
-		log_err("out of memory");
-		return 0;
-	}
-	return 1;
-}
-
-/** find or create node (NULL on parse or error) */
-static struct acl_addr*
-acl_find_or_create(struct acl_list* acl, const char* str)
-{
-	struct acl_addr* node;
-	struct sockaddr_storage addr;
-	int net;
-	socklen_t addrlen;
-	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
-		log_err("cannot parse netblock: %s", str);
-		return NULL;
-	}
-	/* find or create node */
-	if(!(node=(struct acl_addr*)addr_tree_find(&acl->tree, &addr,
-		addrlen, net))) {
-		/* create node, type 'allow' since otherwise tags are
-		 * pointless, can override with specific access-control: cfg */
-		if(!(node=(struct acl_addr*)acl_list_insert(acl, &addr,
-			addrlen, net, acl_allow, 1))) {
-			log_err("out of memory");
-			return NULL;
-		}
-	}
-	return node;
-}
-
-/** apply acl_tag string */
-static int
-acl_list_tags_cfg(struct acl_list* acl, const char* str, uint8_t* bitmap,
-	size_t bitmaplen)
-{
-	struct acl_addr* node;
-	if(!(node=acl_find_or_create(acl, str)))
-		return 0;
-	node->taglen = bitmaplen;
-	node->taglist = regional_alloc_init(acl->region, bitmap, bitmaplen);
-	if(!node->taglist) {
-		log_err("out of memory");
-		return 0;
-	}
-	return 1;
-}
-
-/** apply acl_view string */
-static int
-acl_list_view_cfg(struct acl_list* acl, const char* str, const char* str2,
-	struct views* vs)
-{
-	struct acl_addr* node;
-	if(!(node=acl_find_or_create(acl, str)))
-		return 0;
-	node->view = views_find_view(vs, str2, 0 /* get read lock*/);
-	if(!node->view) {
-		log_err("no view with name: %s", str2);
-		return 0;
-	}
-	lock_rw_unlock(&node->view->lock);
-	return 1;
-}
-
-/** apply acl_tag_action string */
-static int
-acl_list_tag_action_cfg(struct acl_list* acl, struct config_file* cfg,
-	const char* str, const char* tag, const char* action)
-{
-	struct acl_addr* node;
-	int tagid;
-	enum localzone_type t;
-	if(!(node=acl_find_or_create(acl, str)))
-		return 0;
-	/* allocate array if not yet */
-	if(!node->tag_actions) {
-		node->tag_actions = (uint8_t*)regional_alloc_zero(acl->region,
-			sizeof(*node->tag_actions)*cfg->num_tags);
-		if(!node->tag_actions) {
-			log_err("out of memory");
-			return 0;
-		}
-		node->tag_actions_size = (size_t)cfg->num_tags;
-	}
-	/* parse tag */
-	if((tagid=find_tag_id(cfg, tag)) == -1) {
-		log_err("cannot parse tag (define-tag it): %s %s", str, tag);
-		return 0;
-	}
-	if((size_t)tagid >= node->tag_actions_size) {
-		log_err("tagid too large for array %s %s", str, tag);
-		return 0;
-	}
-	if(!local_zone_str2type(action, &t)) {
-		log_err("cannot parse access control action type: %s %s %s",
-			str, tag, action);
-		return 0;
-	}
-	node->tag_actions[tagid] = (uint8_t)t;
-	return 1;
-}
-
-/** check wire data parse */
-static int
-check_data(const char* data, const struct config_strlist* head)
-{
-	char buf[65536];
-	uint8_t rr[LDNS_RR_BUF_SIZE];
-	size_t len = sizeof(rr);
-	int res;
-	/* '.' is sufficient for validation, and it makes the call to
-	 * sldns_wirerr_get_type() simpler below. */
-	snprintf(buf, sizeof(buf), "%s %s", ".", data);
-	res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600, NULL, 0,
-		NULL, 0);
-
-	/* Reject it if we would end up having CNAME and other data (including
-	 * another CNAME) for the same tag. */
-	if(res == 0 && head) {
-		const char* err_data = NULL;
-
-		if(sldns_wirerr_get_type(rr, len, 1) == LDNS_RR_TYPE_CNAME) {
-			/* adding CNAME while other data already exists. */
-			err_data = data;
-		} else {
-			snprintf(buf, sizeof(buf), "%s %s", ".", head->str);
-			len = sizeof(rr);
-			res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600,
-				NULL, 0, NULL, 0);
-			if(res != 0) {
-				/* This should be impossible here as head->str
-				 * has been validated, but we check it just in
-				 * case. */
-				return 0;
-			}
-			if(sldns_wirerr_get_type(rr, len, 1) ==
-				LDNS_RR_TYPE_CNAME) /* already have CNAME */
-				err_data = head->str;
-		}
-		if(err_data) {
-			log_err("redirect tag data '%s' must not coexist with "
-				"other data.", err_data);
-			return 0;
-		}
-	}
-	if(res == 0)
-		return 1;
-	log_err("rr data [char %d] parse error %s",
-		(int)LDNS_WIREPARSE_OFFSET(res)-13,
-		sldns_get_errorstr_parse(res));
-	return 0;
-}
-
-/** apply acl_tag_data string */
-static int
-acl_list_tag_data_cfg(struct acl_list* acl, struct config_file* cfg,
-	const char* str, const char* tag, const char* data)
-{
-	struct acl_addr* node;
-	int tagid;
-	char* dupdata;
-	if(!(node=acl_find_or_create(acl, str)))
-		return 0;
-	/* allocate array if not yet */
-	if(!node->tag_datas) {
-		node->tag_datas = (struct config_strlist**)regional_alloc_zero(
-			acl->region, sizeof(*node->tag_datas)*cfg->num_tags);
-		if(!node->tag_datas) {
-			log_err("out of memory");
-			return 0;
-		}
-		node->tag_datas_size = (size_t)cfg->num_tags;
-	}
-	/* parse tag */
-	if((tagid=find_tag_id(cfg, tag)) == -1) {
-		log_err("cannot parse tag (define-tag it): %s %s", str, tag);
-		return 0;
-	}
-	if((size_t)tagid >= node->tag_datas_size) {
-		log_err("tagid too large for array %s %s", str, tag);
-		return 0;
-	}
-
-	/* check data? */
-	if(!check_data(data, node->tag_datas[tagid])) {
-		log_err("cannot parse access-control-tag data: %s %s '%s'",
-			str, tag, data);
-		return 0;
-	}
-
-	dupdata = regional_strdup(acl->region, data);
-	if(!dupdata) {
-		log_err("out of memory");
-		return 0;
-	}
-	if(!cfg_region_strlist_insert(acl->region,
-		&(node->tag_datas[tagid]), dupdata)) {
-		log_err("out of memory");
-		return 0;
-	}
-	return 1;
-}
-
-/** read acl_list config */
-static int 
-read_acl_list(struct acl_list* acl, struct config_file* cfg)
-{
-	struct config_str2list* p;
-	for(p = cfg->acls; p; p = p->next) {
-		log_assert(p->str && p->str2);
-		if(!acl_list_str_cfg(acl, p->str, p->str2, 1))
-			return 0;
-	}
-	return 1;
-}
-
-/** read acl tags config */
-static int 
-read_acl_tags(struct acl_list* acl, struct config_file* cfg)
-{
-	struct config_strbytelist* np, *p = cfg->acl_tags;
-	cfg->acl_tags = NULL;
-	while(p) {
-		log_assert(p->str && p->str2);
-		if(!acl_list_tags_cfg(acl, p->str, p->str2, p->str2len)) {
-			config_del_strbytelist(p);
-			return 0;
-		}
-		/* free the items as we go to free up memory */
-		np = p->next;
-		free(p->str);
-		free(p->str2);
-		free(p);
-		p = np;
-	}
-	return 1;
-}
-
-/** read acl view config */
-static int 
-read_acl_view(struct acl_list* acl, struct config_file* cfg, struct views* v)
-{
-	struct config_str2list* np, *p = cfg->acl_view;
-	cfg->acl_view = NULL;
-	while(p) {
-		log_assert(p->str && p->str2);
-		if(!acl_list_view_cfg(acl, p->str, p->str2, v)) {
-			return 0;
-		}
-		/* free the items as we go to free up memory */
-		np = p->next;
-		free(p->str);
-		free(p->str2);
-		free(p);
-		p = np;
-	}
-	return 1;
-}
-
-/** read acl tag actions config */
-static int 
-read_acl_tag_actions(struct acl_list* acl, struct config_file* cfg)
-{
-	struct config_str3list* p, *np;
-	p = cfg->acl_tag_actions;
-	cfg->acl_tag_actions = NULL;
-	while(p) {
-		log_assert(p->str && p->str2 && p->str3);
-		if(!acl_list_tag_action_cfg(acl, cfg, p->str, p->str2,
-			p->str3)) {
-			config_deltrplstrlist(p);
-			return 0;
-		}
-		/* free the items as we go to free up memory */
-		np = p->next;
-		free(p->str);
-		free(p->str2);
-		free(p->str3);
-		free(p);
-		p = np;
-	}
-	return 1;
-}
-
-/** read acl tag datas config */
-static int 
-read_acl_tag_datas(struct acl_list* acl, struct config_file* cfg)
-{
-	struct config_str3list* p, *np;
-	p = cfg->acl_tag_datas;
-	cfg->acl_tag_datas = NULL;
-	while(p) {
-		log_assert(p->str && p->str2 && p->str3);
-		if(!acl_list_tag_data_cfg(acl, cfg, p->str, p->str2, p->str3)) {
-			config_deltrplstrlist(p);
-			return 0;
-		}
-		/* free the items as we go to free up memory */
-		np = p->next;
-		free(p->str);
-		free(p->str2);
-		free(p->str3);
-		free(p);
-		p = np;
-	}
-	return 1;
-}
-
-int 
-acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
-	struct views* v)
-{
-	regional_free_all(acl->region);
-	addr_tree_init(&acl->tree);
-	if(!read_acl_list(acl, cfg))
-		return 0;
-	if(!read_acl_view(acl, cfg, v))
-		return 0;
-	if(!read_acl_tags(acl, cfg))
-		return 0;
-	if(!read_acl_tag_actions(acl, cfg))
-		return 0;
-	if(!read_acl_tag_datas(acl, cfg))
-		return 0;
-	/* insert defaults, with '0' to ignore them if they are duplicates */
-	if(!acl_list_str_cfg(acl, "0.0.0.0/0", "refuse", 0))
-		return 0;
-	if(!acl_list_str_cfg(acl, "127.0.0.0/8", "allow", 0))
-		return 0;
-	if(cfg->do_ip6) {
-		if(!acl_list_str_cfg(acl, "::0/0", "refuse", 0))
-			return 0;
-		if(!acl_list_str_cfg(acl, "::1", "allow", 0))
-			return 0;
-		if(!acl_list_str_cfg(acl, "::ffff:127.0.0.1", "allow", 0))
-			return 0;
-	}
-	addr_tree_init_parents(&acl->tree);
-	return 1;
-}
-
-enum acl_access 
-acl_get_control(struct acl_addr* acl)
-{
-	if(acl) return acl->control;
-	return acl_deny;
-}
-
-struct acl_addr*
-acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
-        socklen_t addrlen)
-{
-	return (struct acl_addr*)addr_tree_lookup(&acl->tree,
-		addr, addrlen);
-}
-
-size_t 
-acl_list_get_mem(struct acl_list* acl)
-{
-	if(!acl) return 0;
-	return sizeof(*acl) + regional_get_mem(acl->region);
-}

daemon/acl_list.h

@@ -1,157 +0,0 @@
-/*
- * daemon/acl_list.h - client access control storage for the server.
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file keeps track of the list of clients that are allowed to 
- * access the server.
- */
-
-#ifndef DAEMON_ACL_LIST_H
-#define DAEMON_ACL_LIST_H
-#include "util/storage/dnstree.h"
-#include "services/view.h"
-struct config_file;
-struct regional;
-
-/**
- * Enumeration of access control options for an address range.
- * Allow or deny access.
- */
-enum acl_access {
-	/** disallow any access whatsoever, drop it */
-	acl_deny = 0,
-	/** disallow access, send a polite 'REFUSED' reply */
-	acl_refuse,
-	/** disallow any access to zones that aren't local, drop it */
-	acl_deny_non_local,
-	/** disallow access to zones that aren't local, 'REFUSED' reply */
-	acl_refuse_non_local,
-	/** allow full access for recursion (+RD) queries */
-	acl_allow,
-	/** allow full access for all queries, recursion and cache snooping */
-	acl_allow_snoop,
-	/** allow full access for recursion queries and set RD flag regardless of request */
-	acl_allow_setrd
-};
-
-/**
- * Access control storage structure
- */
-struct acl_list {
-	/** regional for allocation */
-	struct regional* region;
-	/** 
-	 * Tree of the addresses that are allowed/blocked.
-	 * contents of type acl_addr.
-	 */
-	rbtree_type tree;
-};
-
-/**
- *
- * An address span with access control information
- */
-struct acl_addr {
-	/** node in address tree */
-	struct addr_tree_node node;
-	/** access control on this netblock */
-	enum acl_access control;
-	/** tag bitlist */
-	uint8_t* taglist;
-	/** length of the taglist (in bytes) */
-	size_t taglen;
-	/** array per tagnumber of localzonetype(in one byte). NULL if none. */
-	uint8_t* tag_actions;
-	/** size of the tag_actions_array */
-	size_t tag_actions_size;
-	/** array per tagnumber, with per tag a list of rdata strings.
-	 * NULL if none.  strings are like 'A 127.0.0.1' 'AAAA ::1' */
-	struct config_strlist** tag_datas;
-	/** size of the tag_datas array */
-	size_t tag_datas_size;
-	/* view element, NULL if none */
-	struct view* view;
-};
-
-/**
- * Create acl structure 
- * @return new structure or NULL on error.
- */
-struct acl_list* acl_list_create(void);
-
-/**
- * Delete acl structure.
- * @param acl: to delete.
- */
-void acl_list_delete(struct acl_list* acl);
-
-/**
- * Process access control config.
- * @param acl: where to store.
- * @param cfg: config options.
- * @param v: views structure
- * @return 0 on error.
- */
-int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
-	struct views* v);
-
-/**
- * Lookup access control status for acl structure.
- * @param acl: structure for acl storage.
- * @return: what to do with message from this address.
- */
-enum acl_access acl_get_control(struct acl_addr* acl);
-
-/**
- * Lookup address to see its acl structure
- * @param acl: structure for address storage.
- * @param addr: address to check
- * @param addrlen: length of addr.
- * @return: acl structure from this address.
- */
-struct acl_addr*
-acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
-        socklen_t addrlen);
-
-/**
- * Get memory used by acl structure.
- * @param acl: structure for address storage.
- * @return bytes in use.
- */
-size_t acl_list_get_mem(struct acl_list* acl);
-
-#endif /* DAEMON_ACL_LIST_H */

daemon/cachedump.c

@@ -1,899 +0,0 @@
-/*
- * daemon/cachedump.c - dump the cache to text format.
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains functions to read and write the cache(s)
- * to text format.
- */
-#include "config.h"
-#include <openssl/ssl.h>
-#include "daemon/cachedump.h"
-#include "daemon/remote.h"
-#include "daemon/worker.h"
-#include "services/cache/rrset.h"
-#include "services/cache/dns.h"
-#include "services/cache/infra.h"
-#include "util/data/msgreply.h"
-#include "util/regional.h"
-#include "util/net_help.h"
-#include "util/data/dname.h"
-#include "iterator/iterator.h"
-#include "iterator/iter_delegpt.h"
-#include "iterator/iter_utils.h"
-#include "iterator/iter_fwd.h"
-#include "iterator/iter_hints.h"
-#include "sldns/sbuffer.h"
-#include "sldns/wire2str.h"
-#include "sldns/str2wire.h"
-
-/** dump one rrset zonefile line */
-static int
-dump_rrset_line(SSL* ssl, struct ub_packed_rrset_key* k, time_t now, size_t i)
-{
-	char s[65535];
-	if(!packed_rr_to_string(k, i, now, s, sizeof(s))) {
-		return ssl_printf(ssl, "BADRR\n");
-	}
-	return ssl_printf(ssl, "%s", s);
-}
-
-/** dump rrset key and data info */
-static int
-dump_rrset(SSL* ssl, struct ub_packed_rrset_key* k, 
-	struct packed_rrset_data* d, time_t now)
-{
-	size_t i;
-	/* rd lock held by caller */
-	if(!k || !d) return 1;
-	if(k->id == 0) return 1; /* deleted */
-	if(d->ttl < now) return 1; /* expired */
-
-	/* meta line */
-	if(!ssl_printf(ssl, ";rrset%s " ARG_LL "d %u %u %d %d\n",
-		(k->rk.flags & PACKED_RRSET_NSEC_AT_APEX)?" nsec_apex":"",
-		(long long)(d->ttl - now),
-		(unsigned)d->count, (unsigned)d->rrsig_count,
-		(int)d->trust, (int)d->security
-		)) 
-		return 0;
-	for(i=0; i<d->count + d->rrsig_count; i++) {
-		if(!dump_rrset_line(ssl, k, now, i))
-			return 0;
-	}
-	return 1;
-}
-
-/** dump lruhash rrset cache */
-static int
-dump_rrset_lruhash(SSL* ssl, struct lruhash* h, time_t now)
-{
-	struct lruhash_entry* e;
-	/* lruhash already locked by caller */
-	/* walk in order of lru; best first */
-	for(e=h->lru_start; e; e = e->lru_next) {
-		lock_rw_rdlock(&e->lock);
-		if(!dump_rrset(ssl, (struct ub_packed_rrset_key*)e->key,
-			(struct packed_rrset_data*)e->data, now)) {
-			lock_rw_unlock(&e->lock);
-			return 0;
-		}
-		lock_rw_unlock(&e->lock);
-	}
-	return 1;
-}
-
-/** dump rrset cache */
-static int
-dump_rrset_cache(SSL* ssl, struct worker* worker)
-{
-	struct rrset_cache* r = worker->env.rrset_cache;
-	size_t slab;
-	if(!ssl_printf(ssl, "START_RRSET_CACHE\n")) return 0;
-	for(slab=0; slab<r->table.size; slab++) {
-		lock_quick_lock(&r->table.array[slab]->lock);
-		if(!dump_rrset_lruhash(ssl, r->table.array[slab],
-			*worker->env.now)) {
-			lock_quick_unlock(&r->table.array[slab]->lock);
-			return 0;
-		}
-		lock_quick_unlock(&r->table.array[slab]->lock);
-	}
-	return ssl_printf(ssl, "END_RRSET_CACHE\n");
-}
-
-/** dump message to rrset reference */
-static int
-dump_msg_ref(SSL* ssl, struct ub_packed_rrset_key* k)
-{
-	char* nm, *tp, *cl;
-	nm = sldns_wire2str_dname(k->rk.dname, k->rk.dname_len);
-	tp = sldns_wire2str_type(ntohs(k->rk.type));
-	cl = sldns_wire2str_class(ntohs(k->rk.rrset_class));
-	if(!nm || !cl || !tp) {
-		free(nm);
-		free(tp);
-		free(cl);
-		return ssl_printf(ssl, "BADREF\n");
-	}
-	if(!ssl_printf(ssl, "%s %s %s %d\n", nm, cl, tp, (int)k->rk.flags)) {
-		free(nm);
-		free(tp);
-		free(cl);
-		return 0;
-	}
-	free(nm);
-	free(tp);
-	free(cl);
-
-	return 1;
-}
-
-/** dump message entry */
-static int
-dump_msg(SSL* ssl, struct query_info* k, struct reply_info* d, 
-	time_t now)
-{
-	size_t i;
-	char* nm, *tp, *cl;
-	if(!k || !d) return 1;
-	if(d->ttl < now) return 1; /* expired */
-	
-	nm = sldns_wire2str_dname(k->qname, k->qname_len);
-	tp = sldns_wire2str_type(k->qtype);
-	cl = sldns_wire2str_class(k->qclass);
-	if(!nm || !tp || !cl) {
-		free(nm);
-		free(tp);
-		free(cl);
-		return 1; /* skip this entry */
-	}
-	if(!rrset_array_lock(d->ref, d->rrset_count, now)) {
-		/* rrsets have timed out or do not exist */
-		free(nm);
-		free(tp);
-		free(cl);
-		return 1; /* skip this entry */
-	}
-	
-	/* meta line */
-	if(!ssl_printf(ssl, "msg %s %s %s %d %d " ARG_LL "d %d %u %u %u\n",
-			nm, cl, tp,
-			(int)d->flags, (int)d->qdcount, 
-			(long long)(d->ttl-now), (int)d->security,
-			(unsigned)d->an_numrrsets, 
-			(unsigned)d->ns_numrrsets,
-			(unsigned)d->ar_numrrsets)) {
-		free(nm);
-		free(tp);
-		free(cl);
-		rrset_array_unlock(d->ref, d->rrset_count);
-		return 0;
-	}
-	free(nm);
-	free(tp);
-	free(cl);
-	
-	for(i=0; i<d->rrset_count; i++) {
-		if(!dump_msg_ref(ssl, d->rrsets[i])) {
-			rrset_array_unlock(d->ref, d->rrset_count);
-			return 0;
-		}
-	}
-	rrset_array_unlock(d->ref, d->rrset_count);
-
-	return 1;
-}
-
-/** copy msg to worker pad */
-static int
-copy_msg(struct regional* region, struct lruhash_entry* e, 
-	struct query_info** k, struct reply_info** d)
-{
-	struct reply_info* rep = (struct reply_info*)e->data;
-	if(rep->rrset_count > RR_COUNT_MAX)
-		return 0; /* to protect against integer overflow */
-	*d = (struct reply_info*)regional_alloc_init(region, e->data,
-		sizeof(struct reply_info) + 
-		sizeof(struct rrset_ref) * (rep->rrset_count-1) +
-		sizeof(struct ub_packed_rrset_key*) * rep->rrset_count);
-	if(!*d)
-		return 0;
-	(*d)->rrsets = (struct ub_packed_rrset_key**)(void *)(
-		(uint8_t*)(&((*d)->ref[0])) + 
-		sizeof(struct rrset_ref) * rep->rrset_count);
-	*k = (struct query_info*)regional_alloc_init(region, 
-		e->key, sizeof(struct query_info));
-	if(!*k)
-		return 0;
-	(*k)->qname = regional_alloc_init(region, 
-		(*k)->qname, (*k)->qname_len);
-	return (*k)->qname != NULL;
-}
-
-/** dump lruhash msg cache */
-static int
-dump_msg_lruhash(SSL* ssl, struct worker* worker, struct lruhash* h)
-{
-	struct lruhash_entry* e;
-	struct query_info* k;
-	struct reply_info* d;
-
-	/* lruhash already locked by caller */
-	/* walk in order of lru; best first */
-	for(e=h->lru_start; e; e = e->lru_next) {
-		regional_free_all(worker->scratchpad);
-		lock_rw_rdlock(&e->lock);
-		/* make copy of rrset in worker buffer */
-		if(!copy_msg(worker->scratchpad, e, &k, &d)) {
-			lock_rw_unlock(&e->lock);
-			return 0;
-		}
-		lock_rw_unlock(&e->lock);
-		/* release lock so we can lookup the rrset references 
-		 * in the rrset cache */
-		if(!dump_msg(ssl, k, d, *worker->env.now)) {
-			return 0;
-		}
-	}
-	return 1;
-}
-
-/** dump msg cache */
-static int
-dump_msg_cache(SSL* ssl, struct worker* worker)
-{
-	struct slabhash* sh = worker->env.msg_cache;
-	size_t slab;
-	if(!ssl_printf(ssl, "START_MSG_CACHE\n")) return 0;
-	for(slab=0; slab<sh->size; slab++) {
-		lock_quick_lock(&sh->array[slab]->lock);
-		if(!dump_msg_lruhash(ssl, worker, sh->array[slab])) {
-			lock_quick_unlock(&sh->array[slab]->lock);
-			return 0;
-		}
-		lock_quick_unlock(&sh->array[slab]->lock);
-	}
-	return ssl_printf(ssl, "END_MSG_CACHE\n");
-}
-
-int
-dump_cache(SSL* ssl, struct worker* worker)
-{
-	if(!dump_rrset_cache(ssl, worker))
-		return 0;
-	if(!dump_msg_cache(ssl, worker))
-		return 0;
-	return ssl_printf(ssl, "EOF\n");
-}
-
-/** read a line from ssl into buffer */
-static int
-ssl_read_buf(SSL* ssl, sldns_buffer* buf)
-{
-	return ssl_read_line(ssl, (char*)sldns_buffer_begin(buf), 
-		sldns_buffer_capacity(buf));
-}
-
-/** check fixed text on line */
-static int
-read_fixed(SSL* ssl, sldns_buffer* buf, const char* str)
-{
-	if(!ssl_read_buf(ssl, buf)) return 0;
-	return (strcmp((char*)sldns_buffer_begin(buf), str) == 0);
-}
-
-/** load an RR into rrset */
-static int
-load_rr(SSL* ssl, sldns_buffer* buf, struct regional* region,
-	struct ub_packed_rrset_key* rk, struct packed_rrset_data* d,
-	unsigned int i, int is_rrsig, int* go_on, time_t now)
-{
-	uint8_t rr[LDNS_RR_BUF_SIZE];
-	size_t rr_len = sizeof(rr), dname_len = 0;
-	int status;
-
-	/* read the line */
-	if(!ssl_read_buf(ssl, buf))
-		return 0;
-	if(strncmp((char*)sldns_buffer_begin(buf), "BADRR\n", 6) == 0) {
-		*go_on = 0;
-		return 1;
-	}
-	status = sldns_str2wire_rr_buf((char*)sldns_buffer_begin(buf), rr,
-		&rr_len, &dname_len, 3600, NULL, 0, NULL, 0);
-	if(status != 0) {
-		log_warn("error cannot parse rr: %s: %s",
-			sldns_get_errorstr_parse(status),
-			(char*)sldns_buffer_begin(buf));
-		return 0;
-	}
-	if(is_rrsig && sldns_wirerr_get_type(rr, rr_len, dname_len)
-		!= LDNS_RR_TYPE_RRSIG) {
-		log_warn("error expected rrsig but got %s",
-			(char*)sldns_buffer_begin(buf));
-		return 0;
-	}
-
-	/* convert ldns rr into packed_rr */
-	d->rr_ttl[i] = (time_t)sldns_wirerr_get_ttl(rr, rr_len, dname_len) + now;
-	sldns_buffer_clear(buf);
-	d->rr_len[i] = sldns_wirerr_get_rdatalen(rr, rr_len, dname_len)+2;
-	d->rr_data[i] = (uint8_t*)regional_alloc_init(region, 
-		sldns_wirerr_get_rdatawl(rr, rr_len, dname_len), d->rr_len[i]);
-	if(!d->rr_data[i]) {
-		log_warn("error out of memory");
-		return 0;
-	}
-
-	/* if first entry, fill the key structure */
-	if(i==0) {
-		rk->rk.type = htons(sldns_wirerr_get_type(rr, rr_len, dname_len));
-		rk->rk.rrset_class = htons(sldns_wirerr_get_class(rr, rr_len, dname_len));
-		rk->rk.dname_len = dname_len;
-		rk->rk.dname = regional_alloc_init(region, rr, dname_len);
-		if(!rk->rk.dname) {
-			log_warn("error out of memory");
-			return 0;
-		}
-	}
-
-	return 1;
-}
-
-/** move entry into cache */
-static int
-move_into_cache(struct ub_packed_rrset_key* k, 
-	struct packed_rrset_data* d, struct worker* worker)
-{
-	struct ub_packed_rrset_key* ak;
-	struct packed_rrset_data* ad;
-	size_t s, i, num = d->count + d->rrsig_count;
-	struct rrset_ref ref;
-	uint8_t* p;
-
-	ak = alloc_special_obtain(&worker->alloc);
-	if(!ak) {
-		log_warn("error out of memory");
-		return 0;
-	}
-	ak->entry.data = NULL;
-	ak->rk = k->rk;
-	ak->entry.hash = rrset_key_hash(&k->rk);
-	ak->rk.dname = (uint8_t*)memdup(k->rk.dname, k->rk.dname_len);
-	if(!ak->rk.dname) {
-		log_warn("error out of memory");
-		ub_packed_rrset_parsedelete(ak, &worker->alloc);
-		return 0;
-	}
-	s = sizeof(*ad) + (sizeof(size_t) + sizeof(uint8_t*) + 
-		sizeof(time_t))* num;
-	for(i=0; i<num; i++)
-		s += d->rr_len[i];
-	ad = (struct packed_rrset_data*)malloc(s);
-	if(!ad) {
-		log_warn("error out of memory");
-		ub_packed_rrset_parsedelete(ak, &worker->alloc);
-		return 0;
-	}
-	p = (uint8_t*)ad;
-	memmove(p, d, sizeof(*ad));
-	p += sizeof(*ad);
-	memmove(p, &d->rr_len[0], sizeof(size_t)*num);
-	p += sizeof(size_t)*num;
-	memmove(p, &d->rr_data[0], sizeof(uint8_t*)*num);
-	p += sizeof(uint8_t*)*num;
-	memmove(p, &d->rr_ttl[0], sizeof(time_t)*num);
-	p += sizeof(time_t)*num;
-	for(i=0; i<num; i++) {
-		memmove(p, d->rr_data[i], d->rr_len[i]);
-		p += d->rr_len[i];
-	}
-	packed_rrset_ptr_fixup(ad);
-
-	ak->entry.data = ad;
-
-	ref.key = ak;
-	ref.id = ak->id;
-	(void)rrset_cache_update(worker->env.rrset_cache, &ref,
-		&worker->alloc, *worker->env.now);
-	return 1;
-}
-
-/** load an rrset entry */
-static int
-load_rrset(SSL* ssl, sldns_buffer* buf, struct worker* worker)
-{
-	char* s = (char*)sldns_buffer_begin(buf);
-	struct regional* region = worker->scratchpad;
-	struct ub_packed_rrset_key* rk;
-	struct packed_rrset_data* d;
-	unsigned int rr_count, rrsig_count, trust, security;
-	long long ttl;
-	unsigned int i;
-	int go_on = 1;
-	regional_free_all(region);
-
-	rk = (struct ub_packed_rrset_key*)regional_alloc_zero(region, 
-		sizeof(*rk));
-	d = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*d));
-	if(!rk || !d) {
-		log_warn("error out of memory");
-		return 0;
-	}
-
-	if(strncmp(s, ";rrset", 6) != 0) {
-		log_warn("error expected ';rrset' but got %s", s);
-		return 0;
-	}
-	s += 6;
-	if(strncmp(s, " nsec_apex", 10) == 0) {
-		s += 10;
-		rk->rk.flags |= PACKED_RRSET_NSEC_AT_APEX;
-	}
-	if(sscanf(s, " " ARG_LL "d %u %u %u %u", &ttl, &rr_count, &rrsig_count,
-		&trust, &security) != 5) {
-		log_warn("error bad rrset spec %s", s);
-		return 0;
-	}
-	if(rr_count == 0 && rrsig_count == 0) {
-		log_warn("bad rrset without contents");
-		return 0;
-	}
-	if(rr_count > RR_COUNT_MAX || rrsig_count > RR_COUNT_MAX) {
-		log_warn("bad rrset with too many rrs");
-		return 0;
-	}
-	d->count = (size_t)rr_count;
-	d->rrsig_count = (size_t)rrsig_count;
-	d->security = (enum sec_status)security;
-	d->trust = (enum rrset_trust)trust;
-	d->ttl = (time_t)ttl + *worker->env.now;
-
-	d->rr_len = regional_alloc_zero(region, 
-		sizeof(size_t)*(d->count+d->rrsig_count));
-	d->rr_ttl = regional_alloc_zero(region, 
-		sizeof(time_t)*(d->count+d->rrsig_count));
-	d->rr_data = regional_alloc_zero(region, 
-		sizeof(uint8_t*)*(d->count+d->rrsig_count));
-	if(!d->rr_len || !d->rr_ttl || !d->rr_data) {
-		log_warn("error out of memory");
-		return 0;
-	}
-	
-	/* read the rr's themselves */
-	for(i=0; i<rr_count; i++) {
-		if(!load_rr(ssl, buf, region, rk, d, i, 0, 
-			&go_on, *worker->env.now)) {
-			log_warn("could not read rr %u", i);
-			return 0;
-		}
-	}
-	for(i=0; i<rrsig_count; i++) {
-		if(!load_rr(ssl, buf, region, rk, d, i+rr_count, 1, 
-			&go_on, *worker->env.now)) {
-			log_warn("could not read rrsig %u", i);
-			return 0;
-		}
-	}
-	if(!go_on) {
-		/* skip this entry */
-		return 1;
-	}
-
-	return move_into_cache(rk, d, worker);
-}
-
-/** load rrset cache */
-static int
-load_rrset_cache(SSL* ssl, struct worker* worker)
-{
-	sldns_buffer* buf = worker->env.scratch_buffer;
-	if(!read_fixed(ssl, buf, "START_RRSET_CACHE")) return 0;
-	while(ssl_read_buf(ssl, buf) && 
-		strcmp((char*)sldns_buffer_begin(buf), "END_RRSET_CACHE")!=0) {
-		if(!load_rrset(ssl, buf, worker))
-			return 0;
-	}
-	return 1;
-}
-
-/** read qinfo from next three words */
-static char*
-load_qinfo(char* str, struct query_info* qinfo, struct regional* region)
-{
-	/* s is part of the buf */
-	char* s = str;
-	uint8_t rr[LDNS_RR_BUF_SIZE];
-	size_t rr_len = sizeof(rr), dname_len = 0;
-	int status;
-
-	/* skip three words */
-	s = strchr(str, ' ');
-	if(s) s = strchr(s+1, ' ');
-	if(s) s = strchr(s+1, ' ');
-	if(!s) {
-		log_warn("error line too short, %s", str);
-		return NULL;
-	}
-	s[0] = 0;
-	s++;
-
-	/* parse them */
-	status = sldns_str2wire_rr_question_buf(str, rr, &rr_len, &dname_len,
-		NULL, 0, NULL, 0);
-	if(status != 0) {
-		log_warn("error cannot parse: %s %s",
-			sldns_get_errorstr_parse(status), str);
-		return NULL;
-	}
-	qinfo->qtype = sldns_wirerr_get_type(rr, rr_len, dname_len);
-	qinfo->qclass = sldns_wirerr_get_class(rr, rr_len, dname_len);
-	qinfo->qname_len = dname_len;
-	qinfo->qname = (uint8_t*)regional_alloc_init(region, rr, dname_len);
-	qinfo->local_alias = NULL;
-	if(!qinfo->qname) {
-		log_warn("error out of memory");
-		return NULL;
-	}
-
-	return s;
-}
-
-/** load a msg rrset reference */
-static int
-load_ref(SSL* ssl, sldns_buffer* buf, struct worker* worker, 
-	struct regional *region, struct ub_packed_rrset_key** rrset, 
-	int* go_on)
-{
-	char* s = (char*)sldns_buffer_begin(buf);
-	struct query_info qinfo;
-	unsigned int flags;
-	struct ub_packed_rrset_key* k;
-
-	/* read line */
-	if(!ssl_read_buf(ssl, buf))
-		return 0;
-	if(strncmp(s, "BADREF", 6) == 0) {
-		*go_on = 0; /* its bad, skip it and skip message */
-		return 1;
-	}
-
-	s = load_qinfo(s, &qinfo, region);
-	if(!s) {
-		return 0;
-	}
-	if(sscanf(s, " %u", &flags) != 1) {
-		log_warn("error cannot parse flags: %s", s);
-		return 0;
-	}
-
-	/* lookup in cache */
-	k = rrset_cache_lookup(worker->env.rrset_cache, qinfo.qname,
-		qinfo.qname_len, qinfo.qtype, qinfo.qclass,
-		(uint32_t)flags, *worker->env.now, 0);
-	if(!k) {
-		/* not found or expired */
-		*go_on = 0;
-		return 1;
-	}
-
-	/* store in result */
-	*rrset = packed_rrset_copy_region(k, region, *worker->env.now);
-	lock_rw_unlock(&k->entry.lock);
-
-	return (*rrset != NULL);
-}
-
-/** load a msg entry */
-static int
-load_msg(SSL* ssl, sldns_buffer* buf, struct worker* worker)
-{
-	struct regional* region = worker->scratchpad;
-	struct query_info qinf;
-	struct reply_info rep;
-	char* s = (char*)sldns_buffer_begin(buf);
-	unsigned int flags, qdcount, security, an, ns, ar;
-	long long ttl;
-	size_t i;
-	int go_on = 1;
-
-	regional_free_all(region);
-
-	if(strncmp(s, "msg ", 4) != 0) {
-		log_warn("error expected msg but got %s", s);
-		return 0;
-	}
-	s += 4;
-	s = load_qinfo(s, &qinf, region);
-	if(!s) {
-		return 0;
-	}
-
-	/* read remainder of line */
-	if(sscanf(s, " %u %u " ARG_LL "d %u %u %u %u", &flags, &qdcount, &ttl, 
-		&security, &an, &ns, &ar) != 7) {
-		log_warn("error cannot parse numbers: %s", s);
-		return 0;
-	}
-	rep.flags = (uint16_t)flags;
-	rep.qdcount = (uint16_t)qdcount;
-	rep.ttl = (time_t)ttl;
-	rep.prefetch_ttl = PREFETCH_TTL_CALC(rep.ttl);
-	rep.security = (enum sec_status)security;
-	if(an > RR_COUNT_MAX || ns > RR_COUNT_MAX || ar > RR_COUNT_MAX) {
-		log_warn("error too many rrsets");
-		return 0; /* protect against integer overflow in alloc */
-	}
-	rep.an_numrrsets = (size_t)an;
-	rep.ns_numrrsets = (size_t)ns;
-	rep.ar_numrrsets = (size_t)ar;
-	rep.rrset_count = (size_t)an+(size_t)ns+(size_t)ar;
-	rep.rrsets = (struct ub_packed_rrset_key**)regional_alloc_zero(
-		region, sizeof(struct ub_packed_rrset_key*)*rep.rrset_count);
-
-	/* fill repinfo with references */
-	for(i=0; i<rep.rrset_count; i++) {
-		if(!load_ref(ssl, buf, worker, region, &rep.rrsets[i], 
-			&go_on)) {
-			return 0;
-		}
-	}
-
-	if(!go_on) 
-		return 1; /* skip this one, not all references satisfied */
-
-	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL, flags)) {
-		log_warn("error out of memory");
-		return 0;
-	}
-	return 1;
-}
-
-/** load msg cache */
-static int
-load_msg_cache(SSL* ssl, struct worker* worker)
-{
-	sldns_buffer* buf = worker->env.scratch_buffer;
-	if(!read_fixed(ssl, buf, "START_MSG_CACHE")) return 0;
-	while(ssl_read_buf(ssl, buf) && 
-		strcmp((char*)sldns_buffer_begin(buf), "END_MSG_CACHE")!=0) {
-		if(!load_msg(ssl, buf, worker))
-			return 0;
-	}
-	return 1;
-}
-
-int
-load_cache(SSL* ssl, struct worker* worker)
-{
-	if(!load_rrset_cache(ssl, worker))
-		return 0;
-	if(!load_msg_cache(ssl, worker))
-		return 0;
-	return read_fixed(ssl, worker->env.scratch_buffer, "EOF");
-}
-
-/** print details on a delegation point */
-static void
-print_dp_details(SSL* ssl, struct worker* worker, struct delegpt* dp)
-{
-	char buf[257];
-	struct delegpt_addr* a;
-	int lame, dlame, rlame, rto, edns_vs, to, delay,
-		tA = 0, tAAAA = 0, tother = 0;
-	long long entry_ttl;
-	struct rtt_info ri;
-	uint8_t edns_lame_known;
-	for(a = dp->target_list; a; a = a->next_target) {
-		addr_to_str(&a->addr, a->addrlen, buf, sizeof(buf));
-		if(!ssl_printf(ssl, "%-16s\t", buf))
-			return;
-		if(a->bogus) {
-			if(!ssl_printf(ssl, "Address is BOGUS. ")) 
-				return;
-		}
-		/* lookup in infra cache */
-		delay=0;
-		entry_ttl = infra_get_host_rto(worker->env.infra_cache,
-			&a->addr, a->addrlen, dp->name, dp->namelen,
-			&ri, &delay, *worker->env.now, &tA, &tAAAA, &tother);
-		if(entry_ttl == -2 && ri.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
-			if(!ssl_printf(ssl, "expired, rto %d msec, tA %d "
-				"tAAAA %d tother %d.\n", ri.rto, tA, tAAAA,
-				tother))
-				return;
-			continue;
-		}
-		if(entry_ttl == -1 || entry_ttl == -2) {
-			if(!ssl_printf(ssl, "not in infra cache.\n"))
-				return;
-			continue; /* skip stuff not in infra cache */
-		}
-
-		/* uses type_A because most often looked up, but other
-		 * lameness won't be reported then */
-		if(!infra_get_lame_rtt(worker->env.infra_cache, 
-			&a->addr, a->addrlen, dp->name, dp->namelen,
-			LDNS_RR_TYPE_A, &lame, &dlame, &rlame, &rto,
-			*worker->env.now)) {
-			if(!ssl_printf(ssl, "not in infra cache.\n"))
-				return;
-			continue; /* skip stuff not in infra cache */
-		}
-		if(!ssl_printf(ssl, "%s%s%s%srto %d msec, ttl " ARG_LL "d, "
-			"ping %d var %d rtt %d, tA %d, tAAAA %d, tother %d",
-			lame?"LAME ":"", dlame?"NoDNSSEC ":"",
-			a->lame?"AddrWasParentSide ":"",
-			rlame?"NoAuthButRecursive ":"", rto, entry_ttl,
-			ri.srtt, ri.rttvar, rtt_notimeout(&ri),
-			tA, tAAAA, tother))
-			return;
-		if(delay)
-			if(!ssl_printf(ssl, ", probedelay %d", delay))
-				return;
-		if(infra_host(worker->env.infra_cache, &a->addr, a->addrlen,
-			dp->name, dp->namelen, *worker->env.now, &edns_vs,
-			&edns_lame_known, &to)) {
-			if(edns_vs == -1) {
-				if(!ssl_printf(ssl, ", noEDNS%s.",
-					edns_lame_known?" probed":" assumed"))
-					return;
-			} else {
-				if(!ssl_printf(ssl, ", EDNS %d%s.", edns_vs,
-					edns_lame_known?" probed":" assumed"))
-					return;
-			}
-		}
-		if(!ssl_printf(ssl, "\n"))
-			return;
-	}
-}
-
-/** print main dp info */
-static void
-print_dp_main(SSL* ssl, struct delegpt* dp, struct dns_msg* msg)
-{
-	size_t i, n_ns, n_miss, n_addr, n_res, n_avail;
-
-	/* print the dp */
-	if(msg)
-	    for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
-		struct packed_rrset_data* d = 
-			(struct packed_rrset_data*)k->entry.data;
-		if(d->security == sec_status_bogus) {
-			if(!ssl_printf(ssl, "Address is BOGUS:\n"))
-				return;
-		}
-		if(!dump_rrset(ssl, k, d, 0))
-			return;
-	    }
-	delegpt_count_ns(dp, &n_ns, &n_miss);
-	delegpt_count_addr(dp, &n_addr, &n_res, &n_avail);
-	/* since dp has not been used by iterator, all are available*/
-	if(!ssl_printf(ssl, "Delegation with %d names, of which %d "
-		"can be examined to query further addresses.\n"
-		"%sIt provides %d IP addresses.\n", 
-		(int)n_ns, (int)n_miss, (dp->bogus?"It is BOGUS. ":""),
-		(int)n_addr))
-		return;
-}
-
-int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
-	size_t nmlen, int ATTR_UNUSED(nmlabs))
-{
-	/* deep links into the iterator module */
-	struct delegpt* dp;
-	struct dns_msg* msg;
-	struct regional* region = worker->scratchpad;
-	char b[260];
-	struct query_info qinfo;
-	struct iter_hints_stub* stub;
-	regional_free_all(region);
-	qinfo.qname = nm;
-	qinfo.qname_len = nmlen;
-	qinfo.qtype = LDNS_RR_TYPE_A;
-	qinfo.qclass = LDNS_RR_CLASS_IN;
-	qinfo.local_alias = NULL;
-
-	dname_str(nm, b);
-	if(!ssl_printf(ssl, "The following name servers are used for lookup "
-		"of %s\n", b)) 
-		return 0;
-	
-	dp = forwards_lookup(worker->env.fwds, nm, qinfo.qclass);
-	if(dp) {
-		if(!ssl_printf(ssl, "forwarding request:\n"))
-			return 0;
-		print_dp_main(ssl, dp, NULL);
-		print_dp_details(ssl, worker, dp);
-		return 1;
-	}
-	
-	while(1) {
-		dp = dns_cache_find_delegation(&worker->env, nm, nmlen, 
-			qinfo.qtype, qinfo.qclass, region, &msg, 
-			*worker->env.now);
-		if(!dp) {
-			return ssl_printf(ssl, "no delegation from "
-				"cache; goes to configured roots\n");
-		}
-		/* go up? */
-		if(iter_dp_is_useless(&qinfo, BIT_RD, dp)) {
-			print_dp_main(ssl, dp, msg);
-			print_dp_details(ssl, worker, dp);
-			if(!ssl_printf(ssl, "cache delegation was "
-				"useless (no IP addresses)\n"))
-				return 0;
-			if(dname_is_root(nm)) {
-				/* goes to root config */
-				return ssl_printf(ssl, "no delegation from "
-					"cache; goes to configured roots\n");
-			} else {
-				/* useless, goes up */
-				nm = dp->name;
-				nmlen = dp->namelen;
-				dname_remove_label(&nm, &nmlen);
-				dname_str(nm, b);
-				if(!ssl_printf(ssl, "going up, lookup %s\n", b))
-					return 0;
-				continue;
-			}
-		} 
-		stub = hints_lookup_stub(worker->env.hints, nm, qinfo.qclass,
-			dp);
-		if(stub) {
-			if(stub->noprime) {
-				if(!ssl_printf(ssl, "The noprime stub servers "
-					"are used:\n"))
-					return 0;
-			} else {
-				if(!ssl_printf(ssl, "The stub is primed "
-						"with servers:\n"))
-					return 0;
-			}
-			print_dp_main(ssl, stub->dp, NULL);
-			print_dp_details(ssl, worker, stub->dp);
-		} else {
-			print_dp_main(ssl, dp, msg);
-			print_dp_details(ssl, worker, dp);
-		}
-		break;
-	}
-
-	return 1;
-}

daemon/cachedump.h

@@ -1,107 +0,0 @@
-/*
- * daemon/cachedump.h - dump the cache to text format.
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains functions to read and write the cache(s)
- * to text format.
- *
- * The format of the file is as follows:
- * [RRset cache]
- * [Message cache]
- * EOF		-- fixed string "EOF" before end of the file.
- *
- * The RRset cache is:
- * START_RRSET_CACHE
- * [rrset]*
- * END_RRSET_CACHE
- *
- * rrset is:
- * ;rrset [nsec_apex] TTL rr_count rrsig_count trust security
- * resource records, one per line, in zonefile format
- * rrsig records, one per line, in zonefile format
- * If the text conversion fails, BADRR is printed on the line.
- *
- * The Message cache is:
- * START_MSG_CACHE
- * [msg]*
- * END_MSG_CACHE
- *
- * msg is:
- * msg name class type flags qdcount ttl security an ns ar
- * list of rrset references, one per line. If conversion fails, BADREF
- * reference is:
- * name class type flags
- *
- * Expired cache entries are not printed.
- */
-
-#ifndef DAEMON_DUMPCACHE_H
-#define DAEMON_DUMPCACHE_H
-struct worker;
-
-/**
- * Dump cache(s) to text
- * @param ssl: to print to
- * @param worker: worker that is available (buffers, etc) and has 
- * 	ptrs to the caches.
- * @return false on ssl print error.
- */
-int dump_cache(SSL* ssl, struct worker* worker);
-
-/**
- * Load cache(s) from text 
- * @param ssl: to read from 
- * @param worker: worker that is available (buffers, etc) and has 
- * 	ptrs to the caches.
- * @return false on ssl error.
- */
-int load_cache(SSL* ssl, struct worker* worker);
-
-/**
- * Print the delegation used to lookup for this name.
- * @param ssl: to read from 
- * @param worker: worker that is available (buffers, etc) and has 
- * 	ptrs to the caches.
- * @param nm: name to lookup
- * @param nmlen: length of name.
- * @param nmlabs: labels in name.
- * @return false on ssl error.
- */
-int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
-	size_t nmlen, int nmlabs);
-
-#endif /* DAEMON_DUMPCACHE_H */

daemon/daemon.c

@@ -21,16 +21,16 @@
  * specific prior written permission.
  * 
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
  */
 
 /**
@@ -40,75 +40,26 @@
  */
 
 #include "config.h"
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
-
-#ifdef HAVE_OPENSSL_CONF_H
-#include <openssl/conf.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
-
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-#include <sys/time.h>
-
-#ifdef HAVE_NSS
-/* nss3 */
-#include "nss.h"
-#endif
-
 #include "daemon/daemon.h"
 #include "daemon/worker.h"
-#include "daemon/remote.h"
-#include "daemon/acl_list.h"
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/data/msgreply.h"
-#include "util/shm_side/shm_main.h"
-#include "util/storage/lookup3.h"
 #include "util/storage/slabhash.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
-#include "services/localzone.h"
-#include "services/view.h"
-#include "services/modstack.h"
-#include "services/authzone.h"
 #include "util/module.h"
-#include "util/random.h"
-#include "util/tube.h"
-#include "util/net_help.h"
-#include "sldns/keyraw.h"
-#include "respip/respip.h"
+#include "iterator/iterator.h"
+#include "validator/validator.h"
+#include "util/fptr_wlist.h"
 #include <signal.h>
 
-#ifdef HAVE_SYSTEMD
-#include <systemd/sd-daemon.h>
-#endif
-
 /** How many quit requests happened. */
 static int sig_record_quit = 0;
 /** How many reload requests happened. */
 static int sig_record_reload = 0;
 
-#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
-/** cleaner ssl memory freeup */
-static void* comp_meth = NULL;
-#endif
-#ifdef LEX_HAS_YYLEX_DESTROY
-/** remove buffers for parsing and init */
-int ub_c_lex_destroy(void);
-#endif
-
 /** used when no other sighandling happens, so we don't die
   * when multiple signals in quick succession are sent to us. 
   * @param sig: signal number.
@@ -117,35 +68,22 @@ int ub_c_lex_destroy(void);
 static RETSIGTYPE record_sigh(int sig)
 {
 #ifdef LIBEVENT_SIGNAL_PROBLEM
-	/* cannot log, verbose here because locks may be held */
-	/* quit on signal, no cleanup and statistics, 
-	   because installed libevent version is not threadsafe */
+	verbose(VERB_OPS, "quit on signal, no cleanup and statistics, "
+		"because installed libevent version is not threadsafe");
 	exit(0);
 #endif 
 	switch(sig)
 	{
 		case SIGTERM:
-#ifdef SIGQUIT
 		case SIGQUIT:
-#endif
-#ifdef SIGBREAK
-		case SIGBREAK:
-#endif
 		case SIGINT:
 			sig_record_quit++;
 			break;
-#ifdef SIGHUP
 		case SIGHUP:
 			sig_record_reload++;
 			break;
-#endif
-#ifdef SIGPIPE
-		case SIGPIPE:
-			break;
-#endif
 		default:
-			/* ignoring signal */
-			break;
+			log_err("ignoring signal %d", sig);
 	}
 }
 
@@ -154,23 +92,12 @@ static RETSIGTYPE record_sigh(int sig)
  * Stores signals to replay later.
  */
 static void
-signal_handling_record(void)
+signal_handling_record()
 {
 	if( signal(SIGTERM, record_sigh) == SIG_ERR ||
-#ifdef SIGQUIT
 		signal(SIGQUIT, record_sigh) == SIG_ERR ||
-#endif
-#ifdef SIGBREAK
-		signal(SIGBREAK, record_sigh) == SIG_ERR ||
-#endif
-#ifdef SIGHUP
-		signal(SIGHUP, record_sigh) == SIG_ERR ||
-#endif
-#ifdef SIGPIPE
-		signal(SIGPIPE, SIG_IGN) == SIG_ERR ||
-#endif
-		signal(SIGINT, record_sigh) == SIG_ERR
-		)
+		signal(SIGINT, record_sigh) == SIG_ERR ||
+		signal(SIGHUP, record_sigh) == SIG_ERR)
 		log_err("install sighandler: %s", strerror(errno));
 }
 
@@ -181,17 +108,8 @@ signal_handling_record(void)
 static void
 signal_handling_playback(struct worker* wrk)
 {
-#ifdef SIGHUP
-	if(sig_record_reload) {
-# ifdef HAVE_SYSTEMD
-		sd_notify(0, "RELOADING=1");
-# endif
+	if(sig_record_reload)
 		worker_sighandler(SIGHUP, wrk);
-# ifdef HAVE_SYSTEMD
-		sd_notify(0, "READY=1");
-# endif
-	}
-#endif
 	if(sig_record_quit)
 		worker_sighandler(SIGTERM, wrk);
 	sig_record_quit = 0;
@@ -199,96 +117,23 @@ signal_handling_playback(struct worker* wrk)
 }
 
 struct daemon* 
-daemon_init(void)
+daemon_init()
 {
 	struct daemon* daemon = (struct daemon*)calloc(1, 
 		sizeof(struct daemon));
-#ifdef USE_WINSOCK
-	int r;
-	WSADATA wsa_data;
-#endif
 	if(!daemon)
 		return NULL;
-#ifdef USE_WINSOCK
-	r = WSAStartup(MAKEWORD(2,2), &wsa_data);
-	if(r != 0) {
-		fatal_exit("could not init winsock. WSAStartup: %s",
-			wsa_strerror(r));
-	}
-#endif /* USE_WINSOCK */
 	signal_handling_record();
 	checklock_start();
-#ifdef HAVE_SSL
-#  ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
-#  endif
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
-	ERR_load_SSL_strings();
-#endif
-#  ifdef USE_GOST
-	(void)sldns_key_EVP_load_gost_id();
-#  endif
-#  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
-	OpenSSL_add_all_algorithms();
-#  else
-	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
-		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
-#  endif
-#  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
-	/* grab the COMP method ptr because openssl leaks it */
-	comp_meth = (void*)SSL_COMP_get_compression_methods();
-#  endif
-#  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
-	(void)SSL_library_init();
-#  else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
-#  endif
-#  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
-	if(!ub_openssl_lock_init())
-		fatal_exit("could not init openssl locks");
-#  endif
-#elif defined(HAVE_NSS)
-	if(NSS_NoDB_Init(NULL) != SECSuccess)
-		fatal_exit("could not init NSS");
-#endif /* HAVE_SSL or HAVE_NSS */
-#ifdef HAVE_TZSET
-	/* init timezone info while we are not chrooted yet */
-	tzset();
-#endif
-	/* open /dev/random if needed */
-	ub_systemseed((unsigned)time(NULL)^(unsigned)getpid()^0xe67);
 	daemon->need_to_exit = 0;
-	modstack_init(&daemon->mods);
+	daemon->num_modules = 0;
 	if(!(daemon->env = (struct module_env*)calloc(1, 
 		sizeof(*daemon->env)))) {
 		free(daemon);
 		return NULL;
 	}
-	/* init edns_known_options */
-	if(!edns_known_options_init(daemon->env)) {
-		free(daemon->env);
-		free(daemon);
-		return NULL;
-	}
 	alloc_init(&daemon->superalloc, NULL, 0);
-	daemon->acl = acl_list_create();
-	if(!daemon->acl) {
-		edns_known_options_delete(daemon->env);
-		free(daemon->env);
-		free(daemon);
-		return NULL;
-	}
-	if(gettimeofday(&daemon->time_boot, NULL) < 0)
-		log_err("gettimeofday: %s", strerror(errno));
-	daemon->time_last_stat = daemon->time_boot;
-	if((daemon->env->auth_zones = auth_zones_create()) == 0) {
-		acl_list_delete(daemon->acl);
-		edns_known_options_delete(daemon->env);
-		free(daemon->env);
-		free(daemon);
-		return NULL;
-	}
 	return daemon;	
 }
 
@@ -296,203 +141,186 @@ int
 daemon_open_shared_ports(struct daemon* daemon)
 {
 	log_assert(daemon);
-	if(daemon->cfg->port != daemon->listening_port) {
-		size_t i;
-		struct listen_port* p0;
-		daemon->reuseport = 0;
-		/* free and close old ports */
-		if(daemon->ports != NULL) {
-			for(i=0; i<daemon->num_ports; i++)
-				listening_ports_free(daemon->ports[i]);
-			free(daemon->ports);
-			daemon->ports = NULL;
+	if(daemon->cfg->port == daemon->listening_port)
+		return 1;
+	listening_ports_free(daemon->ports);
+	if(!(daemon->ports=listening_ports_open(daemon->cfg)))
+		return 0;
+	daemon->listening_port = daemon->cfg->port;
+	return 1;
+}
+
+/** count number of modules (words) in the string */
+static int
+count_modules(const char* s)
+{
+	int num = 0;
+	if(!s)
+		return 0;
+	while(*s) {
+		/* skip whitespace */
+		while(*s && isspace((int)*s))
+			s++;
+		if(*s && !isspace((int)*s)) {
+			/* skip identifier */
+			num++;
+			while(*s && !isspace((int)*s))
+				s++;
 		}
-		/* see if we want to reuseport */
-#ifdef SO_REUSEPORT
-		if(daemon->cfg->so_reuseport && daemon->cfg->num_threads > 0)
-			daemon->reuseport = 1;
-#endif
-		/* try to use reuseport */
-		p0 = listening_ports_open(daemon->cfg, &daemon->reuseport);
-		if(!p0) {
-			listening_ports_free(p0);
-			return 0;
-		}
-		if(daemon->reuseport) {
-			/* reuseport was successful, allocate for it */
-			daemon->num_ports = (size_t)daemon->cfg->num_threads;
-		} else {
-			/* do the normal, singleportslist thing,
-			 * reuseport not enabled or did not work */
-			daemon->num_ports = 1;
-		}
-		if(!(daemon->ports = (struct listen_port**)calloc(
-			daemon->num_ports, sizeof(*daemon->ports)))) {
-			listening_ports_free(p0);
-			return 0;
-		}
-		daemon->ports[0] = p0;
-		if(daemon->reuseport) {
-			/* continue to use reuseport */
-			for(i=1; i<daemon->num_ports; i++) {
-				if(!(daemon->ports[i]=
-					listening_ports_open(daemon->cfg,
-						&daemon->reuseport))
-					|| !daemon->reuseport ) {
-					for(i=0; i<daemon->num_ports; i++)
-						listening_ports_free(daemon->ports[i]);
-					free(daemon->ports);
-					daemon->ports = NULL;
-					return 0;
-				}
-			}
-		}
-		daemon->listening_port = daemon->cfg->port;
 	}
-	if(!daemon->cfg->remote_control_enable && daemon->rc_port) {
-		listening_ports_free(daemon->rc_ports);
-		daemon->rc_ports = NULL;
-		daemon->rc_port = 0;
+	return num;
+}
+
+/**
+ * Get funcblock for module name
+ * @param str: string with module name. Advanced to next value on success.
+ * @return funcblock or NULL on error.
+ */
+static struct module_func_block*
+daemon_module_factory(const char** str)
+{
+	/* these are the modules available */
+	int num = 2;
+	const char* names[] = {"iterator", "validator", NULL};
+	struct module_func_block* (*fb[])(void) = 
+		{&iter_get_funcblock, &val_get_funcblock, NULL};
+
+	int i;
+	const char* s = *str;
+	while(*s && isspace((int)*s))
+		s++;
+	for(i=0; i<num; i++) {
+		if(strncmp(names[i], s, strlen(names[i])) == 0) {
+			s += strlen(names[i]);
+			*str = s;
+			return (*fb[i])();
+		}
 	}
-	if(daemon->cfg->remote_control_enable && 
-		daemon->cfg->control_port != daemon->rc_port) {
-		listening_ports_free(daemon->rc_ports);
-		if(!(daemon->rc_ports=daemon_remote_open_ports(daemon->cfg)))
+	return NULL;
+}
+
+/**
+ * Read config file module settings and set up the modfunc block
+ * @param daemon: the daemon.
+ * @return false on error
+ */
+static int
+daemon_config_modules(struct daemon* daemon)
+{
+	const char* str = daemon->cfg->module_conf;
+	int i;
+	verbose(VERB_DETAIL, "module config: \"%s\"", str);
+	daemon->num_modules = count_modules(str);
+	if(daemon->num_modules == 0) {
+		log_err("error: no modules specified");
+		return 0;
+	}
+	if(daemon->num_modules > MAX_MODULE) {
+		log_err("error: too many modules (%d max %d)",
+			daemon->num_modules, MAX_MODULE);
+		return 0;
+	}
+	daemon->modfunc = (struct module_func_block**)calloc((size_t)
+		daemon->num_modules, sizeof(struct module_func_block*));
+	if(!daemon->modfunc) {
+		log_err("out of memory");
+		return 0;
+	}
+	for(i=0; i<daemon->num_modules; i++) {
+		daemon->modfunc[i] = daemon_module_factory(&str);
+		if(!daemon->modfunc[i]) {
+			log_err("Unknown value for first module in: '%s'",
+				str);
 			return 0;
-		daemon->rc_port = daemon->cfg->control_port;
+		}
 	}
 	return 1;
 }
 
 /**
- * Setup modules. setup module stack.
+ * Desetup the modules, deinit, delete.
+ * @param daemon: the daemon.
+ */
+static void
+daemon_desetup_modules(struct daemon* daemon)
+{
+	int i;
+	for(i=0; i<daemon->num_modules; i++) {
+		log_assert(fptr_whitelist_mod_deinit(
+			daemon->modfunc[i]->deinit));
+		(*daemon->modfunc[i]->deinit)(daemon->env, i);
+	}
+	daemon->num_modules = 0;
+	free(daemon->modfunc);
+	daemon->modfunc = 0;
+}
+
+/**
+ * Setup modules. Assigns ids and calls module_init.
  * @param daemon: the daemon
  */
 static void daemon_setup_modules(struct daemon* daemon)
 {
+	int i;
+	if(daemon->num_modules != 0)
+		daemon_desetup_modules(daemon);
+	/* fixed setup of the modules */
+	if(!daemon_config_modules(daemon)) {
+		fatal_exit("failed to setup modules");
+	}
 	daemon->env->cfg = daemon->cfg;
 	daemon->env->alloc = &daemon->superalloc;
 	daemon->env->worker = NULL;
 	daemon->env->need_to_validate = 0; /* set by module init below */
-	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf, 
-		daemon->env)) {
-		fatal_exit("failed to setup modules");
-	}
-	log_edns_known_options(VERB_ALGO, daemon->env);
-}
-
-/**
- * Obtain allowed port numbers, concatenate the list, and shuffle them
- * (ready to be handed out to threads).
- * @param daemon: the daemon. Uses rand and cfg.
- * @param shufport: the portlist output.
- * @return number of ports available.
- */
-static int daemon_get_shufport(struct daemon* daemon, int* shufport)
-{
-	int i, n, k, temp;
-	int avail = 0;
-	for(i=0; i<65536; i++) {
-		if(daemon->cfg->outgoing_avail_ports[i]) {
-			shufport[avail++] = daemon->cfg->
-				outgoing_avail_ports[i];
+	for(i=0; i<daemon->num_modules; i++) {
+		log_info("init module %d: %s", i, daemon->modfunc[i]->name);
+		log_assert(fptr_whitelist_mod_init(daemon->modfunc[i]->init));
+		if(!(*daemon->modfunc[i]->init)(daemon->env, i)) {
+			fatal_exit("module init for module %s failed",
+				daemon->modfunc[i]->name);
 		}
 	}
-	if(avail == 0)
-		fatal_exit("no ports are permitted for UDP, add "
-			"with outgoing-port-permit");
-        /* Knuth shuffle */
-	n = avail;
-	while(--n > 0) {
-		k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */
-		temp = shufport[k];
-		shufport[k] = shufport[n];
-		shufport[n] = temp;
-	}
-	return avail;
 }
 
 /**
  * Allocate empty worker structures. With backptr and thread-number,
  * from 0..numthread initialised. Used as user arguments to new threads.
- * Creates the daemon random generator if it does not exist yet.
- * The random generator stays existing between reloads with a unique state.
  * @param daemon: the daemon with (new) config settings.
  */
 static void 
 daemon_create_workers(struct daemon* daemon)
 {
-	int i, numport;
-	int* shufport;
+	int i;
 	log_assert(daemon && daemon->cfg);
-	if(!daemon->rand) {
-		unsigned int seed = (unsigned int)time(NULL) ^ 
-			(unsigned int)getpid() ^ 0x438;
-		daemon->rand = ub_initstate(seed, NULL);
-		if(!daemon->rand)
-			fatal_exit("could not init random generator");
-		hash_set_raninit((uint32_t)ub_random(daemon->rand));
-	}
-	shufport = (int*)calloc(65536, sizeof(int));
-	if(!shufport)
-		fatal_exit("out of memory during daemon init");
-	numport = daemon_get_shufport(daemon, shufport);
-	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
-	
-	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
-	if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
-		log_warn("cannot reduce num-threads to %d because so-reuseport "
-			"so continuing with %d threads.", (int)daemon->num,
-			(int)daemon->num_ports);
-		daemon->num = (int)daemon->num_ports;
-	}
+	daemon->num = daemon->cfg->num_threads;
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
-	if(!daemon->workers)
-		fatal_exit("out of memory during daemon init");
-	if(daemon->cfg->dnstap) {
-#ifdef USE_DNSTAP
-		daemon->dtenv = dt_create(daemon->cfg->dnstap_socket_path,
-			(unsigned int)daemon->num);
-		if (!daemon->dtenv)
-			fatal_exit("dt_create failed");
-		dt_apply_cfg(daemon->dtenv, daemon->cfg);
-#else
-		fatal_exit("dnstap enabled in config but not built with dnstap support");
-#endif
-	}
 	for(i=0; i<daemon->num; i++) {
-		if(!(daemon->workers[i] = worker_create(daemon, i,
-			shufport+numport*i/daemon->num, 
-			numport*(i+1)/daemon->num - numport*i/daemon->num)))
-			/* the above is not ports/numthr, due to rounding */
+		if(!(daemon->workers[i] = worker_create(daemon, i)))
 			fatal_exit("could not create worker");
 	}
-	free(shufport);
 }
 
-#ifdef THREADS_DISABLED
 /**
  * Close all pipes except for the numbered thread.
  * @param daemon: daemon to close pipes in.
  * @param thr: thread number 0..num-1 of thread to skip.
  */
-static void close_other_pipes(struct daemon* daemon, int thr)
+void close_other_pipes(struct daemon* daemon, int thr)
 {
 	int i;
 	for(i=0; i<daemon->num; i++)
 		if(i!=thr) {
-			if(i==0) {
-				/* only close read part, need to write stats */
-				tube_close_read(daemon->workers[i]->cmd);
-			} else {
-				/* complete close channel to others */
-				tube_delete(daemon->workers[i]->cmd);
-				daemon->workers[i]->cmd = NULL;
+			if(daemon->workers[i]->cmd_send_fd != -1) {
+				close(daemon->workers[i]->cmd_send_fd);
+				daemon->workers[i]->cmd_send_fd = -1;
+			}
+			if(daemon->workers[i]->cmd_recv_fd != -1) {
+				close(daemon->workers[i]->cmd_recv_fd);
+				daemon->workers[i]->cmd_recv_fd = -1;
 			}
 		}
 }
-#endif /* THREADS_DISABLED */
 
 /**
  * Function to start one thread. 
@@ -503,22 +331,15 @@ static void*
 thread_start(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
-	int port_num = 0;
 	log_thread_set(&worker->thread_num);
 	ub_thread_blocksigs();
-#ifdef THREADS_DISABLED
+#if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	/* close pipe ends used by main */
-	tube_close_write(worker->cmd);
+	close(worker->cmd_send_fd);
+	worker->cmd_send_fd = -1;
 	close_other_pipes(worker->daemon, worker->thread_num);
 #endif
-#ifdef SO_REUSEPORT
-	if(worker->daemon->cfg->so_reuseport)
-		port_num = worker->thread_num % worker->daemon->num_ports;
-	else
-		port_num = 0;
-#endif
-	if(!worker_init(worker, worker->daemon->cfg,
-			worker->daemon->ports[port_num], 0))
+	if(!worker_init(worker, worker->daemon->cfg, worker->daemon->ports, 0))
 		fatal_exit("Could not initialize thread");
 
 	worker_work(worker);
@@ -539,9 +360,10 @@ daemon_start_others(struct daemon* daemon)
 	for(i=1; i<daemon->num; i++) {
 		ub_thread_create(&daemon->workers[i]->thr_id,
 			thread_start, daemon->workers[i]);
-#ifdef THREADS_DISABLED
+#if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 		/* close pipe end of child */
-		tube_close_read(daemon->workers[i]->cmd);
+		close(daemon->workers[i]->cmd_recv_fd);
+		daemon->workers[i]->cmd_recv_fd = -1;
 #endif /* no threads */
 	}
 }
@@ -559,7 +381,8 @@ daemon_stop_others(struct daemon* daemon)
 	/* skip i=0, is this thread */
 	/* use i=0 buffer for sending cmds; because we are #0 */
 	for(i=1; i<daemon->num; i++) {
-		worker_send_cmd(daemon->workers[i], worker_cmd_quit);
+		worker_send_cmd(daemon->workers[i], 
+			daemon->workers[0]->front->udp_buff, worker_cmd_quit);
 	}
 	/* wait for them to quit */
 	for(i=1; i<daemon->num; i++) {
@@ -573,69 +396,15 @@ daemon_stop_others(struct daemon* daemon)
 void 
 daemon_fork(struct daemon* daemon)
 {
-	int have_view_respip_cfg = 0;
-
 	log_assert(daemon);
-	if(!(daemon->views = views_create()))
-		fatal_exit("Could not create views: out of memory");
-	/* create individual views and their localzone/data trees */
-	if(!views_apply_cfg(daemon->views, daemon->cfg))
-		fatal_exit("Could not set up views");
-
-	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->views))
-		fatal_exit("Could not setup access control list");
-	if(daemon->cfg->dnscrypt) {
-#ifdef USE_DNSCRYPT
-		daemon->dnscenv = dnsc_create();
-		if (!daemon->dnscenv)
-			fatal_exit("dnsc_create failed");
-		dnsc_apply_cfg(daemon->dnscenv, daemon->cfg);
-#else
-		fatal_exit("dnscrypt enabled in config but unbound was not built with "
-				   "dnscrypt support");
-#endif
-	}
-	/* create global local_zones */
-	if(!(daemon->local_zones = local_zones_create()))
-		fatal_exit("Could not create local zones: out of memory");
-	if(!local_zones_apply_cfg(daemon->local_zones, daemon->cfg))
-		fatal_exit("Could not set up local zones");
-
-	/* process raw response-ip configuration data */
-	if(!(daemon->respip_set = respip_set_create()))
-		fatal_exit("Could not create response IP set");
-	if(!respip_global_apply_cfg(daemon->respip_set, daemon->cfg))
-		fatal_exit("Could not set up response IP set");
-	if(!respip_views_apply_cfg(daemon->views, daemon->cfg,
-		&have_view_respip_cfg))
-		fatal_exit("Could not set up per-view response IP sets");
-	daemon->use_response_ip = !respip_set_is_empty(daemon->respip_set) ||
-		have_view_respip_cfg;
-	
-	/* read auth zonefiles */
-	if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1))
-		fatal_exit("auth_zones could not be setup");
 
 	/* setup modules */
 	daemon_setup_modules(daemon);
 
-	/* response-ip-xxx options don't work as expected without the respip
-	 * module.  To avoid run-time operational surprise we reject such
-	 * configuration. */
-	if(daemon->use_response_ip &&
-		modstack_find(&daemon->mods, "respip") < 0)
-		fatal_exit("response-ip options require respip module");
-
 	/* first create all the worker structures, so we can pass
 	 * them to the newly created threads. 
 	 */
 	daemon_create_workers(daemon);
-
-#if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
-	/* in libev the first inited base gets signals */
-	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1))
-		fatal_exit("Could not initialize main thread");
-#endif
 	
 	/* Now create the threads and init the workers.
 	 * By the way, this is thread #0 (the main thread).
@@ -643,35 +412,19 @@ daemon_fork(struct daemon* daemon)
 	daemon_start_others(daemon);
 
 	/* Special handling for the main thread. This is the thread
-	 * that handles signals and remote control.
+	 * that handles signals.
 	 */
-#if !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
-	/* libevent has the last inited base get signals (or any base) */
-	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1))
+	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports, 1))
 		fatal_exit("Could not initialize main thread");
-#endif
 	signal_handling_playback(daemon->workers[0]);
 
-	if (!shm_main_init(daemon))
-		log_warn("SHM has failed");
-
 	/* Start resolver service on main thread. */
-#ifdef HAVE_SYSTEMD
-	sd_notify(0, "READY=1");
-#endif
 	log_info("start of service (%s).", PACKAGE_STRING);
 	worker_work(daemon->workers[0]);
-#ifdef HAVE_SYSTEMD
-	sd_notify(0, "STOPPING=1");
-#endif
-	log_info("service stopped (%s).", PACKAGE_STRING);
 
 	/* we exited! a signal happened! Stop other threads */
 	daemon_stop_others(daemon);
 
-	/* Shutdown SHM */
-	shm_main_shutdown(daemon);
-
 	daemon->need_to_exit = daemon->workers[0]->need_to_exit;
 }
 
@@ -686,136 +439,41 @@ daemon_cleanup(struct daemon* daemon)
 	log_thread_set(NULL);
 	/* clean up caches because
 	 * a) RRset IDs will be recycled after a reload, causing collisions
-	 * b) validation config can change, thus rrset, msg, keycache clear */
+	 * b) validation config can change, thus rrset, msg, keycache clear 
+	 * The infra cache is kept, the timing and edns info is still valid */
 	slabhash_clear(&daemon->env->rrset_cache->table);
 	slabhash_clear(daemon->env->msg_cache);
-	local_zones_delete(daemon->local_zones);
-	daemon->local_zones = NULL;
-	respip_set_delete(daemon->respip_set);
-	daemon->respip_set = NULL;
-	views_delete(daemon->views);
-	daemon->views = NULL;
-	if(daemon->env->auth_zones)
-		auth_zones_cleanup(daemon->env->auth_zones);
-	/* key cache is cleared by module desetup during next daemon_fork() */
-	daemon_remote_clear(daemon->rc);
+	/* key cache is cleared by module desetup during next daemon_init() */
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
 	free(daemon->workers);
 	daemon->workers = NULL;
 	daemon->num = 0;
-	alloc_clear_special(&daemon->superalloc);
-#ifdef USE_DNSTAP
-	dt_delete(daemon->dtenv);
-	daemon->dtenv = NULL;
-#endif
-#ifdef USE_DNSCRYPT
-	dnsc_delete(daemon->dnscenv);
-	daemon->dnscenv = NULL;
-#endif
 	daemon->cfg = NULL;
 }
 
 void 
 daemon_delete(struct daemon* daemon)
 {
-	size_t i;
 	if(!daemon)
 		return;
-	modstack_desetup(&daemon->mods, daemon->env);
-	daemon_remote_delete(daemon->rc);
-	for(i = 0; i < daemon->num_ports; i++)
-		listening_ports_free(daemon->ports[i]);
-	free(daemon->ports);
-	listening_ports_free(daemon->rc_ports);
+	daemon_desetup_modules(daemon);
+	listening_ports_free(daemon->ports);
 	if(daemon->env) {
 		slabhash_delete(daemon->env->msg_cache);
 		rrset_cache_delete(daemon->env->rrset_cache);
 		infra_delete(daemon->env->infra_cache);
-		edns_known_options_delete(daemon->env);
-		auth_zones_delete(daemon->env->auth_zones);
 	}
-	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
-	acl_list_delete(daemon->acl);
-	free(daemon->chroot);
 	free(daemon->pidfile);
 	free(daemon->env);
-#ifdef HAVE_SSL
-	SSL_CTX_free((SSL_CTX*)daemon->listen_sslctx);
-	SSL_CTX_free((SSL_CTX*)daemon->connect_sslctx);
-#endif
 	free(daemon);
-#ifdef LEX_HAS_YYLEX_DESTROY
-	/* lex cleanup */
-	ub_c_lex_destroy();
-#endif
 	/* libcrypto cleanup */
-#ifdef HAVE_SSL
-#  if defined(USE_GOST) && defined(HAVE_LDNS_KEY_EVP_UNLOAD_GOST)
-	sldns_key_EVP_unload_gost();
-#  endif
-#  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
-#    ifndef S_SPLINT_S
-#      if OPENSSL_VERSION_NUMBER < 0x10100000
-	sk_SSL_COMP_pop_free(comp_meth, (void(*)())CRYPTO_free);
-#      endif
-#    endif
-#  endif
-#  ifdef HAVE_OPENSSL_CONFIG
+	/* CONF_modules_unload(1); */
 	EVP_cleanup();
-#  if OPENSSL_VERSION_NUMBER < 0x10100000
-	ENGINE_cleanup();
-#  endif
-	CONF_modules_free();
-#  endif
-#  ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
+	/* ENGINE_cleanup(); */
 	CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
-#  endif
-#  ifdef HAVE_ERR_FREE_STRINGS
+	ERR_remove_state(0);
 	ERR_free_strings();
-#  endif
-#  if OPENSSL_VERSION_NUMBER < 0x10100000
-	RAND_cleanup();
-#  endif
-#  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
-	ub_openssl_lock_delete();
-#  endif
-#ifndef HAVE_ARC4RANDOM
-	_ARC4_LOCK_DESTROY();
-#endif
-#elif defined(HAVE_NSS)
-	NSS_Shutdown();
-#endif /* HAVE_SSL or HAVE_NSS */
 	checklock_stop();
-#ifdef USE_WINSOCK
-	if(WSACleanup() != 0) {
-		log_err("Could not WSACleanup: %s", 
-			wsa_strerror(WSAGetLastError()));
-	}
-#endif
-}
-
-void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg)
-{
-        daemon->cfg = cfg;
-	config_apply(cfg);
-	if(!daemon->env->msg_cache ||
-	   cfg->msg_cache_size != slabhash_get_size(daemon->env->msg_cache) ||
-	   cfg->msg_cache_slabs != daemon->env->msg_cache->size) {
-		slabhash_delete(daemon->env->msg_cache);
-		daemon->env->msg_cache = slabhash_create(cfg->msg_cache_slabs,
-			HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size,
-			msgreply_sizefunc, query_info_compare,
-			query_entry_delete, reply_info_delete, NULL);
-		if(!daemon->env->msg_cache) {
-			fatal_exit("malloc failure updating config settings");
-		}
-	}
-	if((daemon->env->rrset_cache = rrset_cache_adjust(
-		daemon->env->rrset_cache, cfg, &daemon->superalloc)) == 0)
-		fatal_exit("malloc failure updating config settings");
-	if((daemon->env->infra_cache = infra_adjust(daemon->env->infra_cache,
-		cfg))==0)
-		fatal_exit("malloc failure updating config settings");
 }

daemon/daemon.h

@@ -21,16 +21,16 @@
  * specific prior written permission.
  * 
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
  */
 
 /**
@@ -44,30 +44,12 @@
 
 #include "util/locks.h"
 #include "util/alloc.h"
-#include "services/modstack.h"
 struct config_file;
 struct worker;
 struct listen_port;
 struct slabhash;
 struct module_env;
 struct rrset_cache;
-struct acl_list;
-struct local_zones;
-struct views;
-struct ub_randstate;
-struct daemon_remote;
-struct respip_set;
-struct shm_main_info;
-
-#include "dnstap/dnstap_config.h"
-#ifdef USE_DNSTAP
-struct dt_env;
-#endif
-
-#include "dnscrypt/dnscrypt_config.h"
-#ifdef USE_DNSCRYPT
-struct dnsc_env;
-#endif
 
 /**
  * Structure holding worker list.
@@ -76,71 +58,33 @@ struct dnsc_env;
 struct daemon {
 	/** The config settings */
 	struct config_file* cfg;
-	/** the chroot dir in use, NULL if none */
-	char* chroot;
 	/** pidfile that is used */
 	char* pidfile;
 	/** port number that has ports opened. */
 	int listening_port;
-	/** array of listening ports, opened.  Listening ports per worker,
-	 * or just one element[0] shared by the worker threads. */
-	struct listen_port** ports;
-	/** size of ports array */
-	size_t num_ports;
-	/** reuseport is enabled if true */
-	int reuseport;
-	/** port number for remote that has ports opened. */
-	int rc_port;
-	/** listening ports for remote control */
-	struct listen_port* rc_ports;
-	/** remote control connections management (for first worker) */
-	struct daemon_remote* rc;
-	/** ssl context for listening to dnstcp over ssl, and connecting ssl */
-	void* listen_sslctx, *connect_sslctx;
+	/** listening ports, opened, to be shared by threads */
+	struct listen_port* ports;
 	/** num threads allocated */
 	int num;
 	/** the worker entries */
 	struct worker** workers;
 	/** do we need to exit unbound (or is it only a reload?) */
 	int need_to_exit;
-	/** master random table ; used for port div between threads on reload*/
-	struct ub_randstate* rand;
 	/** master allocation cache */
 	struct alloc_cache superalloc;
 	/** the module environment master value, copied and changed by threads*/
 	struct module_env* env;
-	/** stack of module callbacks */
-	struct module_stack mods;
-	/** access control, which client IPs are allowed to connect */
-	struct acl_list* acl;
-	/** local authority zones */
-	struct local_zones* local_zones;
-	/** last time of statistics printout */
-	struct timeval time_last_stat;
-	/** time when daemon started */
-	struct timeval time_boot;
-	/** views structure containing view tree */
-	struct views* views;
-#ifdef USE_DNSTAP
-	/** the dnstap environment master value, copied and changed by threads*/
-	struct dt_env* dtenv;
-#endif
-	struct shm_main_info* shm_info;
-	/** response-ip set with associated actions and tags. */
-	struct respip_set* respip_set;
-	/** some response-ip tags or actions are configured if true */
-	int use_response_ip;
-#ifdef USE_DNSCRYPT
-	/** the dnscrypt environment */
-	struct dnsc_env* dnscenv;
-#endif
+	/** number of modules active, ids from 0 to num-1. */
+	int num_modules;
+	/** the module callbacks, array of num_modules length */
+	struct module_func_block** modfunc;
 };
 
 /**
  * Initialize daemon structure.
  * @return: The daemon structure, or NULL on error.
  */
-struct daemon* daemon_init(void);
+struct daemon* daemon_init();
 
 /**
  * Open shared listening ports (if needed).
@@ -170,11 +114,4 @@ void daemon_cleanup(struct daemon* daemon);
  */
 void daemon_delete(struct daemon* daemon);
 
-/**
- * Apply config settings.
- * @param daemon: the daemon.
- * @param cfg: new config settings.
- */
-void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg);
-
 #endif /* DAEMON_H */

daemon/remote.h

@@ -1,191 +0,0 @@
-/*
- * daemon/remote.h - remote control for the unbound daemon.
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains the remote control functionality for the daemon.
- * The remote control can be performed using either the commandline
- * unbound-control tool, or a SSLv3/TLS capable web browser. 
- * The channel is secured using SSLv3 or TLSv1, and certificates.
- * Both the server and the client(control tool) have their own keys.
- */
-
-#ifndef DAEMON_REMOTE_H
-#define DAEMON_REMOTE_H
-#ifdef HAVE_OPENSSL_SSL_H
-#include "openssl/ssl.h"
-#endif
-struct config_file;
-struct listen_list;
-struct listen_port;
-struct worker;
-struct comm_reply;
-struct comm_point;
-struct daemon_remote;
-
-/** number of milliseconds timeout on incoming remote control handshake */
-#define REMOTE_CONTROL_TCP_TIMEOUT 120000
-
-/**
- * a busy control command connection, SSL state
- */
-struct rc_state {
-	/** the next item in list */
-	struct rc_state* next;
-	/** the commpoint */
-	struct comm_point* c;
-	/** in the handshake part */
-	enum { rc_none, rc_hs_read, rc_hs_write } shake_state;
-#ifdef HAVE_SSL
-	/** the ssl state */
-	SSL* ssl;
-#endif
-	/** the rc this is part of */
-	struct daemon_remote* rc;
-};
-
-/**
- * The remote control tool state.
- * The state is only created for the first thread, other threads
- * are called from this thread.  Only the first threads listens to
- * the control port.  The other threads do not, but are called on the
- * command channel(pipe) from the first thread.
- */
-struct daemon_remote {
-	/** the worker for this remote control */
-	struct worker* worker;
-	/** commpoints for accepting remote control connections */
-	struct listen_list* accept_list;
-	/* if certificates are used */
-	int use_cert;
-	/** number of active commpoints that are handling remote control */
-	int active;
-	/** max active commpoints */
-	int max_active;
-	/** current commpoints busy; should be a short list, malloced */
-	struct rc_state* busy_list;
-#ifdef HAVE_SSL
-	/** the SSL context for creating new SSL streams */
-	SSL_CTX* ctx;
-#endif
-};
-
-/**
- * Create new remote control state for the daemon.
- * @param cfg: config file with key file settings.
- * @return new state, or NULL on failure.
- */
-struct daemon_remote* daemon_remote_create(struct config_file* cfg);
-
-/**
- * remote control state to delete.
- * @param rc: state to delete.
- */
-void daemon_remote_delete(struct daemon_remote* rc);
-
-/**
- * remote control state to clear up. Busy and accept points are closed.
- * Does not delete the rc itself, or the ssl context (with its keys).
- * @param rc: state to clear.
- */
-void daemon_remote_clear(struct daemon_remote* rc);
-
-/**
- * Open and create listening ports for remote control.
- * @param cfg: config options.
- * @return list of ports or NULL on failure.
- *	can be freed with listening_ports_free().
- */
-struct listen_port* daemon_remote_open_ports(struct config_file* cfg);
-
-/**
- * Setup comm points for accepting remote control connections.
- * @param rc: state
- * @param ports: already opened ports.
- * @param worker: worker with communication base. and links to command channels.
- * @return false on error.
- */
-int daemon_remote_open_accept(struct daemon_remote* rc, 
-	struct listen_port* ports, struct worker* worker);
-
-/**
- * Stop accept handlers for TCP (until enabled again)
- * @param rc: state
- */
-void daemon_remote_stop_accept(struct daemon_remote* rc);
-
-/**
- * Stop accept handlers for TCP (until enabled again)
- * @param rc: state
- */
-void daemon_remote_start_accept(struct daemon_remote* rc);
-
-/**
- * Handle nonthreaded remote cmd execution.
- * @param worker: this worker (the remote worker).
- */
-void daemon_remote_exec(struct worker* worker);
-
-#ifdef HAVE_SSL
-/** 
- * Print fixed line of text over ssl connection in blocking mode
- * @param ssl: print to
- * @param text: the text.
- * @return false on connection failure.
- */
-int ssl_print_text(SSL* ssl, const char* text);
-
-/** 
- * printf style printing to the ssl connection
- * @param ssl: the SSL connection to print to. Blocking.
- * @param format: printf style format string.
- * @return success or false on a network failure.
- */
-int ssl_printf(SSL* ssl, const char* format, ...)
-        ATTR_FORMAT(printf, 2, 3);
-
-/**
- * Read until \n is encountered
- * If SSL signals EOF, the string up to then is returned (without \n).
- * @param ssl: the SSL connection to read from. blocking.
- * @param buf: buffer to read to.
- * @param max: size of buffer.
- * @return false on connection failure.
- */
-int ssl_read_line(SSL* ssl, char* buf, size_t max);
-#endif /* HAVE_SSL */
-
-#endif /* DAEMON_REMOTE_H */

daemon/stats.c

@@ -21,16 +21,16 @@
  * specific prior written permission.
  * 
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
  */
 
 /**
@@ -40,427 +40,33 @@
  * numbers. These 'statistics' may be of interest to the operator.
  */
 #include "config.h"
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-#include <sys/time.h>
-#include <sys/types.h>
 #include "daemon/stats.h"
 #include "daemon/worker.h"
-#include "daemon/daemon.h"
 #include "services/mesh.h"
-#include "services/outside_network.h"
-#include "services/listen_dnsport.h"
-#include "util/config_file.h"
-#include "util/tube.h"
-#include "util/timehist.h"
-#include "util/net_help.h"
-#include "validator/validator.h"
-#include "iterator/iterator.h"
-#include "sldns/sbuffer.h"
-#include "services/cache/rrset.h"
-#include "services/cache/infra.h"
-#include "services/authzone.h"
-#include "validator/val_kcache.h"
-#include "validator/val_neg.h"
 
-/** add timers and the values do not overflow or become negative */
-static void
-stats_timeval_add(long long* d_sec, long long* d_usec, long long add_sec, long long add_usec)
+void server_stats_init(struct server_stats* stats)
 {
-#ifndef S_SPLINT_S
-	(*d_sec) += add_sec;
-	(*d_usec) += add_usec;
-	if((*d_usec) > 1000000) {
-		(*d_usec) -= 1000000;
-		(*d_sec)++;
-	}
-#endif
+	memset(stats, 0, sizeof(stats));
 }
 
-void server_stats_init(struct ub_server_stats* stats, struct config_file* cfg)
-{
-	memset(stats, 0, sizeof(*stats));
-	stats->extended = cfg->stat_extended;
-}
-
-void server_stats_querymiss(struct ub_server_stats* stats, struct worker* worker)
+void server_stats_querymiss(struct server_stats* stats, struct worker* worker)
 {
 	stats->num_queries_missed_cache++;
 	stats->sum_query_list_size += worker->env.mesh->all.count;
-	if((long long)worker->env.mesh->all.count > stats->max_query_list_size)
-		stats->max_query_list_size = (long long)worker->env.mesh->all.count;
+	if(worker->env.mesh->all.count > stats->max_query_list_size)
+		stats->max_query_list_size = worker->env.mesh->all.count;
 }
 
-void server_stats_prefetch(struct ub_server_stats* stats, struct worker* worker)
+void server_stats_log(struct server_stats* stats, int threadnum)
 {
-	stats->num_queries_prefetch++;
-	/* changes the query list size so account that, like a querymiss */
-	stats->sum_query_list_size += worker->env.mesh->all.count;
-	if((long long)worker->env.mesh->all.count > stats->max_query_list_size)
-		stats->max_query_list_size = (long long)worker->env.mesh->all.count;
-}
-
-void server_stats_log(struct ub_server_stats* stats, struct worker* worker,
-	int threadnum)
-{
-	log_info("server stats for thread %d: %u queries, "
-		"%u answers from cache, %u recursions, %u prefetch, %u rejected by "
-		"ip ratelimiting",
+	log_info("server stats for thread %d: %u queries, %u from cache", 
 		threadnum, (unsigned)stats->num_queries, 
 		(unsigned)(stats->num_queries - 
-			stats->num_queries_missed_cache),
-		(unsigned)stats->num_queries_missed_cache,
-		(unsigned)stats->num_queries_prefetch,
-		(unsigned)stats->num_queries_ip_ratelimited);
+			stats->num_queries_missed_cache));
 	log_info("server stats for thread %d: requestlist max %u avg %g "
-		"exceeded %u jostled %u", threadnum,
-		(unsigned)stats->max_query_list_size,
-		(stats->num_queries_missed_cache+stats->num_queries_prefetch)?
+		"exceeded %u", threadnum, (unsigned)stats->max_query_list_size,
+		stats->num_queries_missed_cache?
 			(double)stats->sum_query_list_size/
-			(double)(stats->num_queries_missed_cache+
-			stats->num_queries_prefetch) : 0.0,
-		(unsigned)worker->env.mesh->stats_dropped,
-		(unsigned)worker->env.mesh->stats_jostled);
-}
-
-/** Set the neg cache stats. */
-static void
-set_neg_cache_stats(struct worker* worker, struct ub_server_stats* svr,
-	int reset)
-{
-	int m = modstack_find(&worker->env.mesh->mods, "validator");
-	struct val_env* ve;
-	struct val_neg_cache* neg;
-	if(m == -1)
-		return;
-	ve = (struct val_env*)worker->env.modinfo[m];
-	if(!ve->neg_cache)
-		return;
-	neg = ve->neg_cache;
-	lock_basic_lock(&neg->lock);
-	svr->num_neg_cache_noerror = (long long)neg->num_neg_cache_noerror;
-	svr->num_neg_cache_nxdomain = (long long)neg->num_neg_cache_nxdomain;
-	if(reset && !worker->env.cfg->stat_cumulative) {
-		neg->num_neg_cache_noerror = 0;
-		neg->num_neg_cache_nxdomain = 0;
-	}
-	lock_basic_unlock(&neg->lock);
-}
-
-/** get rrsets bogus number from validator */
-static size_t
-get_rrset_bogus(struct worker* worker, int reset)
-{
-	int m = modstack_find(&worker->env.mesh->mods, "validator");
-	struct val_env* ve;
-	size_t r;
-	if(m == -1)
-		return 0;
-	ve = (struct val_env*)worker->env.modinfo[m];
-	lock_basic_lock(&ve->bogus_lock);
-	r = ve->num_rrset_bogus;
-	if(reset && !worker->env.cfg->stat_cumulative)
-		ve->num_rrset_bogus = 0;
-	lock_basic_unlock(&ve->bogus_lock);
-	return r;
-}
-
-/** get number of ratelimited queries from iterator */
-static size_t
-get_queries_ratelimit(struct worker* worker, int reset)
-{
-	int m = modstack_find(&worker->env.mesh->mods, "iterator");
-	struct iter_env* ie;
-	size_t r;
-	if(m == -1)
-		return 0;
-	ie = (struct iter_env*)worker->env.modinfo[m];
-	lock_basic_lock(&ie->queries_ratelimit_lock);
-	r = ie->num_queries_ratelimited;
-	if(reset && !worker->env.cfg->stat_cumulative)
-		ie->num_queries_ratelimited = 0;
-	lock_basic_unlock(&ie->queries_ratelimit_lock);
-	return r;
-}
-
-#ifdef USE_DNSCRYPT
-/** get the number of shared secret cache miss */
-static size_t
-get_dnscrypt_cache_miss(struct worker* worker, int reset)
-{
-	size_t r;
-	struct dnsc_env* de = worker->daemon->dnscenv;
-	if(!de) return 0;
-
-	lock_basic_lock(&de->shared_secrets_cache_lock);
-	r = de->num_query_dnscrypt_secret_missed_cache;
-	if(reset && !worker->env.cfg->stat_cumulative)
-		de->num_query_dnscrypt_secret_missed_cache = 0;
-	lock_basic_unlock(&de->shared_secrets_cache_lock);
-	return r;
-}
-
-/** get the number of replayed queries */
-static size_t
-get_dnscrypt_replay(struct worker* worker, int reset)
-{
-	size_t r;
-	struct dnsc_env* de = worker->daemon->dnscenv;
-
-	lock_basic_lock(&de->nonces_cache_lock);
-	r = de->num_query_dnscrypt_replay;
-	if(reset && !worker->env.cfg->stat_cumulative)
-		de->num_query_dnscrypt_replay = 0;
-	lock_basic_unlock(&de->nonces_cache_lock);
-	return r;
-}
-#endif /* USE_DNSCRYPT */
-
-void
-server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
-{
-	int i;
-	struct listen_list* lp;
-
-	s->svr = worker->stats;
-	s->mesh_num_states = (long long)worker->env.mesh->all.count;
-	s->mesh_num_reply_states = (long long)worker->env.mesh->num_reply_states;
-	s->mesh_jostled = (long long)worker->env.mesh->stats_jostled;
-	s->mesh_dropped = (long long)worker->env.mesh->stats_dropped;
-	s->mesh_replies_sent = (long long)worker->env.mesh->replies_sent;
-	s->mesh_replies_sum_wait_sec = (long long)worker->env.mesh->replies_sum_wait.tv_sec;
-	s->mesh_replies_sum_wait_usec = (long long)worker->env.mesh->replies_sum_wait.tv_usec;
-	s->mesh_time_median = timehist_quartile(worker->env.mesh->histogram,
-		0.50);
-
-	/* add in the values from the mesh */
-	s->svr.ans_secure += (long long)worker->env.mesh->ans_secure;
-	s->svr.ans_bogus += (long long)worker->env.mesh->ans_bogus;
-	s->svr.ans_rcode_nodata += (long long)worker->env.mesh->ans_nodata;
-	for(i=0; i<16; i++)
-		s->svr.ans_rcode[i] += (long long)worker->env.mesh->ans_rcode[i];
-	timehist_export(worker->env.mesh->histogram, s->svr.hist, 
-		NUM_BUCKETS_HIST);
-	/* values from outside network */
-	s->svr.unwanted_replies = (long long)worker->back->unwanted_replies;
-	s->svr.qtcp_outgoing = (long long)worker->back->num_tcp_outgoing;
-
-	/* get and reset validator rrset bogus number */
-	s->svr.rrset_bogus = (long long)get_rrset_bogus(worker, reset);
-
-	/* get and reset iterator query ratelimit number */
-	s->svr.queries_ratelimited = (long long)get_queries_ratelimit(worker, reset);
-
-	/* get cache sizes */
-	s->svr.msg_cache_count = (long long)count_slabhash_entries(worker->env.msg_cache);
-	s->svr.rrset_cache_count = (long long)count_slabhash_entries(&worker->env.rrset_cache->table);
-	s->svr.infra_cache_count = (long long)count_slabhash_entries(worker->env.infra_cache->hosts);
-	if(worker->env.key_cache)
-		s->svr.key_cache_count = (long long)count_slabhash_entries(worker->env.key_cache->slab);
-	else	s->svr.key_cache_count = 0;
-
-#ifdef USE_DNSCRYPT
-	if(worker->daemon->dnscenv) {
-		s->svr.num_query_dnscrypt_secret_missed_cache =
-			(long long)get_dnscrypt_cache_miss(worker, reset);
-		s->svr.shared_secret_cache_count = (long long)count_slabhash_entries(
-			worker->daemon->dnscenv->shared_secrets_cache);
-		s->svr.nonce_cache_count = (long long)count_slabhash_entries(
-			worker->daemon->dnscenv->nonces_cache);
-		s->svr.num_query_dnscrypt_replay =
-			(long long)get_dnscrypt_replay(worker, reset);
-	} else {
-		s->svr.num_query_dnscrypt_secret_missed_cache = 0;
-		s->svr.shared_secret_cache_count = 0;
-		s->svr.nonce_cache_count = 0;
-		s->svr.num_query_dnscrypt_replay = 0;
-	}
-#else
-	s->svr.num_query_dnscrypt_secret_missed_cache = 0;
-	s->svr.shared_secret_cache_count = 0;
-	s->svr.nonce_cache_count = 0;
-	s->svr.num_query_dnscrypt_replay = 0;
-#endif /* USE_DNSCRYPT */
-	if(worker->env.auth_zones) {
-		if(reset && !worker->env.cfg->stat_cumulative) {
-			lock_rw_wrlock(&worker->env.auth_zones->lock);
-		} else {
-			lock_rw_rdlock(&worker->env.auth_zones->lock);
-		}
-		s->svr.num_query_authzone_up = (long long)worker->env.
-			auth_zones->num_query_up;
-		s->svr.num_query_authzone_down = (long long)worker->env.
-			auth_zones->num_query_down;
-		if(reset && !worker->env.cfg->stat_cumulative) {
-			worker->env.auth_zones->num_query_up = 0;
-			worker->env.auth_zones->num_query_down = 0;
-		}
-		lock_rw_unlock(&worker->env.auth_zones->lock);
-	}
-
-	/* Set neg cache usage numbers */
-	set_neg_cache_stats(worker, &s->svr, reset);
-
-	/* get tcp accept usage */
-	s->svr.tcp_accept_usage = 0;
-	for(lp = worker->front->cps; lp; lp = lp->next) {
-		if(lp->com->type == comm_tcp_accept)
-			s->svr.tcp_accept_usage += (long long)lp->com->cur_tcp_count;
-	}
-
-	if(reset && !worker->env.cfg->stat_cumulative) {
-		worker_stats_clear(worker);
-	}
-}
-
-void server_stats_obtain(struct worker* worker, struct worker* who,
-	struct ub_stats_info* s, int reset)
-{
-	uint8_t *reply = NULL;
-	uint32_t len = 0;
-	if(worker == who) {
-		/* just fill it in */
-		server_stats_compile(worker, s, reset);
-		return;
-	}
-	/* communicate over tube */
-	verbose(VERB_ALGO, "write stats cmd");
-	if(reset)
-		worker_send_cmd(who, worker_cmd_stats);
-	else 	worker_send_cmd(who, worker_cmd_stats_noreset);
-	verbose(VERB_ALGO, "wait for stats reply");
-	if(!tube_read_msg(worker->cmd, &reply, &len, 0))
-		fatal_exit("failed to read stats over cmd channel");
-	if(len != (uint32_t)sizeof(*s))
-		fatal_exit("stats on cmd channel wrong length %d %d",
-			(int)len, (int)sizeof(*s));
-	memcpy(s, reply, (size_t)len);
-	free(reply);
-}
-
-void server_stats_reply(struct worker* worker, int reset)
-{
-	struct ub_stats_info s;
-	server_stats_compile(worker, &s, reset);
-	verbose(VERB_ALGO, "write stats replymsg");
-	if(!tube_write_msg(worker->daemon->workers[0]->cmd, 
-		(uint8_t*)&s, sizeof(s), 0))
-		fatal_exit("could not write stat values over cmd channel");
-}
-
-void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
-{
-	total->svr.num_queries += a->svr.num_queries;
-	total->svr.num_queries_ip_ratelimited += a->svr.num_queries_ip_ratelimited;
-	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
-	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
-	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
-#ifdef USE_DNSCRYPT
-	total->svr.num_query_dnscrypt_crypted += a->svr.num_query_dnscrypt_crypted;
-	total->svr.num_query_dnscrypt_cert += a->svr.num_query_dnscrypt_cert;
-	total->svr.num_query_dnscrypt_cleartext += \
-		a->svr.num_query_dnscrypt_cleartext;
-	total->svr.num_query_dnscrypt_crypted_malformed += \
-		a->svr.num_query_dnscrypt_crypted_malformed;
-#endif /* USE_DNSCRYPT */
-	/* the max size reached is upped to higher of both */
-	if(a->svr.max_query_list_size > total->svr.max_query_list_size)
-		total->svr.max_query_list_size = a->svr.max_query_list_size;
-
-	if(a->svr.extended) {
-		int i;
-		total->svr.qtype_big += a->svr.qtype_big;
-		total->svr.qclass_big += a->svr.qclass_big;
-		total->svr.qtcp += a->svr.qtcp;
-		total->svr.qtcp_outgoing += a->svr.qtcp_outgoing;
-		total->svr.qipv6 += a->svr.qipv6;
-		total->svr.qbit_QR += a->svr.qbit_QR;
-		total->svr.qbit_AA += a->svr.qbit_AA;
-		total->svr.qbit_TC += a->svr.qbit_TC;
-		total->svr.qbit_RD += a->svr.qbit_RD;
-		total->svr.qbit_RA += a->svr.qbit_RA;
-		total->svr.qbit_Z += a->svr.qbit_Z;
-		total->svr.qbit_AD += a->svr.qbit_AD;
-		total->svr.qbit_CD += a->svr.qbit_CD;
-		total->svr.qEDNS += a->svr.qEDNS;
-		total->svr.qEDNS_DO += a->svr.qEDNS_DO;
-		total->svr.ans_rcode_nodata += a->svr.ans_rcode_nodata;
-		total->svr.zero_ttl_responses += a->svr.zero_ttl_responses;
-		total->svr.ans_secure += a->svr.ans_secure;
-		total->svr.ans_bogus += a->svr.ans_bogus;
-		total->svr.unwanted_replies += a->svr.unwanted_replies;
-		total->svr.unwanted_queries += a->svr.unwanted_queries;
-		total->svr.tcp_accept_usage += a->svr.tcp_accept_usage;
-		for(i=0; i<UB_STATS_QTYPE_NUM; i++)
-			total->svr.qtype[i] += a->svr.qtype[i];
-		for(i=0; i<UB_STATS_QCLASS_NUM; i++)
-			total->svr.qclass[i] += a->svr.qclass[i];
-		for(i=0; i<UB_STATS_OPCODE_NUM; i++)
-			total->svr.qopcode[i] += a->svr.qopcode[i];
-		for(i=0; i<UB_STATS_RCODE_NUM; i++)
-			total->svr.ans_rcode[i] += a->svr.ans_rcode[i];
-		for(i=0; i<NUM_BUCKETS_HIST; i++)
-			total->svr.hist[i] += a->svr.hist[i];
-	}
-
-	total->mesh_num_states += a->mesh_num_states;
-	total->mesh_num_reply_states += a->mesh_num_reply_states;
-	total->mesh_jostled += a->mesh_jostled;
-	total->mesh_dropped += a->mesh_dropped;
-	total->mesh_replies_sent += a->mesh_replies_sent;
-	stats_timeval_add(&total->mesh_replies_sum_wait_sec, &total->mesh_replies_sum_wait_usec, a->mesh_replies_sum_wait_sec, a->mesh_replies_sum_wait_usec);
-	/* the medians are averaged together, this is not as accurate as
-	 * taking the median over all of the data, but is good and fast
-	 * added up here, division later*/
-	total->mesh_time_median += a->mesh_time_median;
-}
-
-void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
-	uint16_t qtype, uint16_t qclass, struct edns_data* edns,
-	struct comm_reply* repinfo)
-{
-	uint16_t flags = sldns_buffer_read_u16_at(c->buffer, 2);
-	if(qtype < UB_STATS_QTYPE_NUM)
-		stats->qtype[qtype]++;
-	else	stats->qtype_big++;
-	if(qclass < UB_STATS_QCLASS_NUM)
-		stats->qclass[qclass]++;
-	else	stats->qclass_big++;
-	stats->qopcode[ LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) ]++;
-	if(c->type != comm_udp)
-		stats->qtcp++;
-	if(repinfo && addr_is_ip6(&repinfo->addr, repinfo->addrlen))
-		stats->qipv6++;
-	if( (flags&BIT_QR) )
-		stats->qbit_QR++;
-	if( (flags&BIT_AA) )
-		stats->qbit_AA++;
-	if( (flags&BIT_TC) )
-		stats->qbit_TC++;
-	if( (flags&BIT_RD) )
-		stats->qbit_RD++;
-	if( (flags&BIT_RA) )
-		stats->qbit_RA++;
-	if( (flags&BIT_Z) )
-		stats->qbit_Z++;
-	if( (flags&BIT_AD) )
-		stats->qbit_AD++;
-	if( (flags&BIT_CD) )
-		stats->qbit_CD++;
-	if(edns->edns_present) {
-		stats->qEDNS++;
-		if( (edns->bits & EDNS_DO) )
-			stats->qEDNS_DO++;
-	}
-}
-
-void server_stats_insrcode(struct ub_server_stats* stats, sldns_buffer* buf)
-{
-	if(stats->extended && sldns_buffer_limit(buf) != 0) {
-		int r = (int)LDNS_RCODE_WIRE( sldns_buffer_begin(buf) );
-		stats->ans_rcode[r] ++;
-		if(r == 0 && LDNS_ANCOUNT( sldns_buffer_begin(buf) ) == 0)
-			stats->ans_rcode_nodata ++;
-	}
+			stats->num_queries_missed_cache : 0.0,
+		(unsigned)stats->num_query_list_exceeded);
 }

daemon/stats.h

@@ -21,16 +21,16 @@
  * specific prior written permission.
  * 
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
  */
 
 /**
@@ -42,88 +42,36 @@
 
 #ifndef DAEMON_STATS_H
 #define DAEMON_STATS_H
-#include "util/timehist.h"
 struct worker;
-struct config_file;
-struct comm_point;
-struct comm_reply;
-struct edns_data;
-struct sldns_buffer;
 
-/* stats struct */
-#include "libunbound/unbound.h"
+/** per worker statistics */
+struct server_stats {
+	/** number of queries from clients received. */
+	size_t num_queries;
+	/** number of queries that had a cache-miss. */
+	size_t num_queries_missed_cache;
+
+	/**
+	 * Sum of the querylistsize of the worker for 
+	 * every query that missed cache. To calculate average.
+	 */
+	size_t sum_query_list_size;
+	/** max value of query list size reached. */
+	size_t max_query_list_size;
+	/** number of times that the query_list_size was insufficient */
+	size_t num_query_list_exceeded;
+};
 
 /** 
  * Initialize server stats to 0.
  * @param stats: what to init (this is alloced by the caller).
- * @param cfg: with extended statistics option.
  */
-void server_stats_init(struct ub_server_stats* stats, struct config_file* cfg);
+void server_stats_init(struct server_stats* stats);
 
 /** add query if it missed the cache */
-void server_stats_querymiss(struct ub_server_stats* stats, struct worker* worker);
-
-/** add query if was cached and also resulted in a prefetch */
-void server_stats_prefetch(struct ub_server_stats* stats, struct worker* worker);
+void server_stats_querymiss(struct server_stats* stats, struct worker* worker);
 
 /** display the stats to the log */
-void server_stats_log(struct ub_server_stats* stats, struct worker* worker,
-	int threadnum);
-
-/**
- * Obtain the stats info for a given thread. Uses pipe to communicate.
- * @param worker: the worker that is executing (the first worker).
- * @param who: on who to get the statistics info.
- * @param s: the stats block to fill in.
- * @param reset: if stats can be reset.
- */
-void server_stats_obtain(struct worker* worker, struct worker* who,
-	struct ub_stats_info* s, int reset);
-
-/**
- * Compile stats into structure for this thread worker.
- * Also clears the statistics counters (if that is set by config file).
- * @param worker: the worker to compile stats for, also the executing worker.
- * @param s: stats block.
- * @param reset: if true, depending on config stats are reset.
- * 	if false, statistics are not reset.
- */
-void server_stats_compile(struct worker* worker, struct ub_stats_info* s, 
-	int reset);
-
-/**
- * Send stats over comm tube in reply to query cmd
- * @param worker: this worker.
- * @param reset: if true, depending on config stats are reset.
- * 	if false, statistics are not reset.
- */
-void server_stats_reply(struct worker* worker, int reset);
-
-/**
- * Addup stat blocks.
- * @param total: sum of the two entries.
- * @param a: to add to it.
- */
-void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a);
-
-/**
- * Add stats for this query
- * @param stats: the stats
- * @param c: commpoint with type and buffer.
- * @param qtype: query type
- * @param qclass: query class
- * @param edns: edns record
- * @param repinfo: reply info with remote address
- */
-void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
-	uint16_t qtype, uint16_t qclass, struct edns_data* edns, 
-	struct comm_reply* repinfo);
-
-/**
- * Add rcode for this query.
- * @param stats: the stats
- * @param buf: buffer with rcode. If buffer is length0: not counted.
- */
-void server_stats_insrcode(struct ub_server_stats* stats, struct sldns_buffer* buf);
+void server_stats_log(struct server_stats* stats, int threadnum);
 
 #endif /* DAEMON_STATS_H */

daemon/unbound.c

@@ -21,16 +21,16 @@
  * specific prior written permission.
  * 
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
  *
  */
 
@@ -41,60 +41,26 @@
  */
 
 #include "config.h"
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-#include <sys/time.h>
 #include "util/log.h"
 #include "daemon/daemon.h"
-#include "daemon/remote.h"
 #include "util/config_file.h"
 #include "util/storage/slabhash.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
-#include "util/fptr_wlist.h"
 #include "util/data/msgreply.h"
 #include "util/module.h"
-#include "util/net_help.h"
-#include "util/ub_event.h"
 #include <signal.h>
 #include <fcntl.h>
-#include <openssl/crypto.h>
-#ifdef HAVE_PWD_H
 #include <pwd.h>
-#endif
-#ifdef HAVE_GRP_H
-#include <grp.h>
-#endif
-
-#ifndef S_SPLINT_S
-/* splint chokes on this system header file */
-#ifdef HAVE_SYS_RESOURCE_H
 #include <sys/resource.h>
-#endif
-#endif /* S_SPLINT_S */
-#ifdef HAVE_LOGIN_CAP_H
-#include <login_cap.h>
-#endif
 
-#ifdef UB_ON_WINDOWS
-#  include "winrc/win_svc.h"
-#endif
-
-#ifdef HAVE_NSS
-/* nss3 */
-#  include "nss.h"
-#endif
+/** global debug value to keep track of heap memory allocation */
+void* unbound_start_brk = 0;
 
 /** print usage. */
-static void usage(void)
+static void usage()
 {
-	const char** m;
-	const char *evnm="event", *evsys="", *evmethod="";
-	time_t t;
-	struct timeval now;
-	struct ub_event_base* base;
 	printf("usage:  unbound [options]\n");
 	printf("	start unbound daemon DNS resolver.\n");
 	printf("-h	this help\n");
@@ -102,106 +68,32 @@ static void usage(void)
 	printf("	file format is described in unbound.conf(5).\n");
 	printf("-d	do not fork into the background.\n");
 	printf("-v	verbose (more times to increase verbosity)\n");
-#ifdef UB_ON_WINDOWS
-	printf("-w opt	windows option: \n");
-	printf("   	install, remove - manage the services entry\n");
-	printf("   	service - used to start from services control panel\n");
-#endif
 	printf("Version %s\n", PACKAGE_VERSION);
-	base = ub_default_event_base(0,&t,&now);
-	ub_get_event_sys(base, &evnm, &evsys, &evmethod);
-	printf("linked libs: %s %s (it uses %s), %s\n", 
-		evnm, evsys, evmethod,
-#ifdef HAVE_SSL
-#  ifdef SSLEAY_VERSION
-		SSLeay_version(SSLEAY_VERSION)
-#  else
-		OpenSSL_version(OPENSSL_VERSION)
-#  endif
-#elif defined(HAVE_NSS)
-		NSS_GetVersion()
-#elif defined(HAVE_NETTLE)
-		"nettle"
-#endif
-		);
-	printf("linked modules:");
-	for(m = module_list_avail(); *m; m++)
-		printf(" %s", *m);
-	printf("\n");
-#ifdef USE_DNSCRYPT
-	printf("DNSCrypt feature available\n");
-#endif
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
-	ub_event_base_free(base);
 }
 
-#ifndef unbound_testbound
-int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
-{
-        log_assert(0);
-        return 0;
-}
-#endif
-
 /** check file descriptor count */
 static void
 checkrlimits(struct config_file* cfg)
 {
-#ifndef S_SPLINT_S
-#ifdef HAVE_GETRLIMIT
-	/* list has number of ports to listen to, ifs number addresses */
-	int list = ((cfg->do_udp?1:0) + (cfg->do_tcp?1 + 
+	int list = ((cfg->do_ip4?1:0) + (cfg->do_ip6?1:0)) * 
+		((cfg->do_udp?1:0) + (cfg->do_tcp?1 + 
 			(int)cfg->incoming_num_tcp:0));
-	size_t listen_ifs = (size_t)(cfg->num_ifs==0?
-		((cfg->do_ip4 && !cfg->if_automatic?1:0) + 
-		 (cfg->do_ip6?1:0)):cfg->num_ifs);
-	size_t listen_num = list*listen_ifs;
-	size_t outudpnum = (size_t)cfg->outgoing_num_ports;
-	size_t outtcpnum = cfg->outgoing_num_tcp;
+	size_t ifs = (size_t)(cfg->num_ifs==0?1:cfg->num_ifs);
+	size_t listen_num = list*ifs;
+	size_t out_ifs = (size_t)(cfg->num_out_ifs==0?1:cfg->num_out_ifs);
+	size_t outnum = cfg->outgoing_num_ports*out_ifs + cfg->outgoing_num_tcp;
 	size_t misc = 4; /* logfile, pidfile, stdout... */
-	size_t perthread_noudp = listen_num + outtcpnum + 
-		2/*cmdpipe*/ + 2/*libevent*/ + misc; 
-	size_t perthread = perthread_noudp + outudpnum;
-
+	size_t perthread = listen_num + outnum + 2/*cmdpipe*/ + 2/*libevent*/
+		+ misc; 
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	int numthread = 1; /* it forks */
 #else
-	int numthread = (cfg->num_threads?cfg->num_threads:1);
+	int numthread = cfg->num_threads;
 #endif
 	size_t total = numthread * perthread + misc;
-	size_t avail;
 	struct rlimit rlim;
-
-	if(total > 1024 && 
-		strncmp(ub_event_get_version(), "mini-event", 10) == 0) {
-		log_warn("too many file descriptors requested. The builtin"
-			"mini-event cannot handle more than 1024. Config "
-			"for less fds or compile with libevent");
-		if(numthread*perthread_noudp+15 > 1024)
-			fatal_exit("too much tcp. not enough fds.");
-		cfg->outgoing_num_ports = (int)((1024 
-			- numthread*perthread_noudp 
-			- 10 /* safety margin */) /numthread);
-		log_warn("continuing with less udp ports: %u",
-			cfg->outgoing_num_ports);
-		total = 1024;
-	}
-	if(perthread > 64 && 
-		strncmp(ub_event_get_version(), "winsock-event", 13) == 0) {
-		log_err("too many file descriptors requested. The winsock"
-			" event handler cannot handle more than 64 per "
-			" thread. Config for less fds");
-		if(perthread_noudp+2 > 64)
-			fatal_exit("too much tcp. not enough fds.");
-		cfg->outgoing_num_ports = (int)((64 
-			- perthread_noudp 
-			- 2/* safety margin */));
-		log_warn("continuing with less udp ports: %u",
-			cfg->outgoing_num_ports);
-		total = numthread*(perthread_noudp+
-			(size_t)cfg->outgoing_num_ports)+misc;
-	}
 	if(getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
 		log_warn("getrlimit: %s", strerror(errno));
 		return;
@@ -209,73 +101,46 @@ checkrlimits(struct config_file* cfg)
 	if(rlim.rlim_cur == (rlim_t)RLIM_INFINITY)
 		return;
 	if((size_t)rlim.rlim_cur < total) {
-		avail = (size_t)rlim.rlim_cur;
-		rlim.rlim_cur = (rlim_t)(total + 10);
-		rlim.rlim_max = (rlim_t)(total + 10);
-#ifdef HAVE_SETRLIMIT
-		if(setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
-			log_warn("setrlimit: %s", strerror(errno));
-#endif
-			log_warn("cannot increase max open fds from %u to %u",
-				(unsigned)avail, (unsigned)total+10);
-			/* check that calculation below does not underflow,
-			 * with 15 as margin */
-			if(numthread*perthread_noudp+15 > avail)
-				fatal_exit("too much tcp. not enough fds.");
-			cfg->outgoing_num_ports = (int)((avail 
-				- numthread*perthread_noudp 
-				- 10 /* safety margin */) /numthread);
-			log_warn("continuing with less udp ports: %u",
-				cfg->outgoing_num_ports);
-			log_warn("increase ulimit or decrease threads, "
-				"ports in config to remove this warning");
-			return;
-#ifdef HAVE_SETRLIMIT
-		}
-#endif
-		verbose(VERB_ALGO, "increased limit(open files) from %u to %u",
-			(unsigned)avail, (unsigned)total+10);
+		log_err("Not enough sockets available. Increase "
+			"ulimit(open files).");
+		log_err("or decrease number of threads, outgoing num ports, "
+			"outgoing num tcp or number of interfaces");
+		log_err("estimate %u fds high mark, %u available", 
+			(unsigned)total, (unsigned)rlim.rlim_cur);
+		fatal_exit("Not enough file descriptors available");
 	}
-#else	
-	(void)cfg;
-#endif /* HAVE_GETRLIMIT */
-#endif /* S_SPLINT_S */
-}
-
-/** set default logfile identity based on value from argv[0] at startup **/
-static void
-log_ident_set_fromdefault(struct config_file* cfg,
-	const char *log_default_identity)
-{
-	if(cfg->log_identity == NULL || cfg->log_identity[0] == 0)
-		log_ident_set(log_default_identity);
-	else
-		log_ident_set(cfg->log_identity);
 }
 
 /** set verbosity, check rlimits, cache settings */
 static void
 apply_settings(struct daemon* daemon, struct config_file* cfg, 
-	int cmdline_verbose, int debug_mode, const char* log_default_identity)
+	int cmdline_verbose)
 {
 	/* apply if they have changed */
+	daemon->cfg = cfg;
 	verbosity = cmdline_verbose + cfg->verbosity;
-	if (debug_mode > 1) {
-		cfg->use_syslog = 0;
-		free(cfg->logfile);
-		cfg->logfile = NULL;
+	config_apply(cfg);
+	if(!daemon->env->msg_cache ||
+	   cfg->msg_cache_size != slabhash_get_size(daemon->env->msg_cache) ||
+	   cfg->msg_cache_slabs != daemon->env->msg_cache->size) {
+		slabhash_delete(daemon->env->msg_cache);
+		daemon->env->msg_cache = slabhash_create(cfg->msg_cache_slabs, 
+			HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size, 
+			msgreply_sizefunc, query_info_compare,
+			query_entry_delete, reply_info_delete, NULL);
+		if(!daemon->env->msg_cache) {
+			fatal_exit("malloc failure updating config settings");
+		}
 	}
-	daemon_apply_cfg(daemon, cfg);
+	if((daemon->env->rrset_cache = rrset_cache_adjust(
+		daemon->env->rrset_cache, cfg, &daemon->superalloc)) == 0)
+		fatal_exit("malloc failure updating config settings");
+	if((daemon->env->infra_cache = infra_adjust(daemon->env->infra_cache, 
+		cfg))==0)
+		fatal_exit("malloc failure updating config settings");
 	checkrlimits(cfg);
-
-	if (cfg->use_systemd && cfg->do_daemonize) {
-		log_warn("use-systemd and do-daemonize should not be enabled at the same time");
-	}
-
-	log_ident_set_fromdefault(cfg, log_default_identity);
 }
 
-#ifdef HAVE_KILL
 /** Read existing pid from pidfile. 
  * @param file: file name of pid file.
  * @return: the pid from the file or -1 if none.
@@ -343,52 +208,46 @@ writepid (const char* pidfile, pid_t pid)
 
 /**
  * check old pid file.
- * @param pidfile: the file name of the pid file.
- * @param inchroot: if pidfile is inchroot and we can thus expect to
- *	be able to delete it.
+ * @param cfg: the config settings
  */
 static void
-checkoldpid(char* pidfile, int inchroot)
+checkoldpid(struct config_file* cfg)
 {
 	pid_t old;
-	if((old = readpid(pidfile)) != -1) {
+	char* file = cfg->pidfile;
+	if(cfg->chrootdir && cfg->chrootdir[0] &&
+		strncmp(file, cfg->chrootdir, strlen(cfg->chrootdir))==0) {
+		file += strlen(cfg->chrootdir);
+	}
+	if((old = readpid(file)) != -1) {
 		/* see if it is still alive */
 		if(kill(old, 0) == 0 || errno == EPERM)
 			log_warn("unbound is already running as pid %u.", 
 				(unsigned)old);
-		else	if(inchroot)
-			log_warn("did not exit gracefully last time (%u)", 
+		else	log_warn("did not exit gracefully last time (%u)", 
 				(unsigned)old);
 	}
 }
-#endif /* HAVE_KILL */
 
 /** detach from command line */
 static void
-detach(void)
+detach(struct config_file* cfg)
 {
-#if defined(HAVE_DAEMON) && !defined(DEPRECATED_DAEMON)
-	/* use POSIX daemon(3) function */
-	if(daemon(1, 0) != 0)
-		fatal_exit("daemon failed: %s", strerror(errno));
-#else /* no HAVE_DAEMON */
-#ifdef HAVE_FORK
 	int fd;
 	/* Take off... */
 	switch (fork()) {
 		case 0:
 			break;
 		case -1:
+			unlink(cfg->pidfile);
 			fatal_exit("fork failed: %s", strerror(errno));
 		default:
 			/* exit interactive session */
 			exit(0);
 	}
 	/* detach */
-#ifdef HAVE_SETSID
 	if(setsid() == -1)
 		fatal_exit("setsid() failed: %s", strerror(errno));
-#endif
 	if ((fd = open("/dev/null", O_RDWR, 0)) != -1) {
 		(void)dup2(fd, STDIN_FILENO);
 		(void)dup2(fd, STDOUT_FILENO);
@@ -396,206 +255,70 @@ detach(void)
 		if (fd > 2)
 			(void)close(fd);
 	}
-#endif /* HAVE_FORK */
-#endif /* HAVE_DAEMON */
 }
 
-/** daemonize, drop user privileges and chroot if needed */
+/** daemonize, drop user priviliges and chroot if needed */
 static void
-perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
-	const char** cfgfile, int need_pidfile)
+do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
 {
-#ifdef HAVE_KILL
-	int pidinchroot;
-#endif
-#ifdef HAVE_GETPWNAM
-	struct passwd *pwd = NULL;
+	uid_t uid;
+	gid_t gid;
+	/* initialize, but not to 0 (root) */
+	memset(&uid, -12, sizeof(uid));
+	memset(&gid, -12, sizeof(gid));
+	log_assert(cfg);
 
+	/* daemonize last to be able to print error to user */
+	if(cfg->directory && cfg->directory[0]) {
+		if(chdir(cfg->directory)) {
+			fatal_exit("Could not chdir to %s: %s",
+				cfg->directory, strerror(errno));
+		}
+		verbose(VERB_DETAIL, "chdir to %s", cfg->directory);
+	}
 	if(cfg->username && cfg->username[0]) {
+		struct passwd *pwd;
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
-		/* endpwent below, in case we need pwd for setusercontext */
+		uid = pwd->pw_uid;
+		gid = pwd->pw_gid;
+		endpwent();
 	}
-#endif
-#ifdef UB_ON_WINDOWS
-	w_config_adjust_directory(cfg);
-#endif
-
-	/* read ssl keys while superuser and outside chroot */
-#ifdef HAVE_SSL
-	if(!(daemon->rc = daemon_remote_create(cfg)))
-		fatal_exit("could not set up remote-control");
-	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
-		if(!(daemon->listen_sslctx = listen_sslctx_create(
-			cfg->ssl_service_key, cfg->ssl_service_pem, NULL)))
-			fatal_exit("could not set up listen SSL_CTX");
-	}
-	if(!(daemon->connect_sslctx = connect_sslctx_create(NULL, NULL,
-		cfg->tls_cert_bundle, cfg->tls_win_cert)))
-		fatal_exit("could not set up connect SSL_CTX");
-#endif
-
-	/* init syslog (as root) if needed, before daemonize, otherwise
-	 * a fork error could not be printed since daemonize closed stderr.*/
-	if(cfg->use_syslog) {
-		log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
-	}
-	/* if using a logfile, we cannot open it because the logfile would
-	 * be created with the wrong permissions, we cannot chown it because
-	 * we cannot chown system logfiles, so we do not open at all.
-	 * So, using a logfile, the user does not see errors unless -d is
-	 * given to unbound on the commandline. */
-
-#ifdef HAVE_KILL
-	/* true if pidfile is inside chrootdir, or nochroot */
-	pidinchroot = need_pidfile && (!(cfg->chrootdir && cfg->chrootdir[0]) ||
-				(cfg->chrootdir && cfg->chrootdir[0] &&
-				strncmp(cfg->pidfile, cfg->chrootdir,
-				strlen(cfg->chrootdir))==0));
-
-	/* check old pid file before forking */
-	if(cfg->pidfile && cfg->pidfile[0] && need_pidfile) {
-		/* calculate position of pidfile */
-		if(cfg->pidfile[0] == '/')
-			daemon->pidfile = strdup(cfg->pidfile);
-		else	daemon->pidfile = fname_after_chroot(cfg->pidfile, 
-				cfg, 1);
-		if(!daemon->pidfile)
-			fatal_exit("pidfile alloc: out of memory");
-		checkoldpid(daemon->pidfile, pidinchroot);
-	}
-#endif
-
-	/* daemonize because pid is needed by the writepid func */
-	if(!debug_mode && cfg->do_daemonize) {
-		detach();
-	}
-
-	/* write new pidfile (while still root, so can be outside chroot) */
-#ifdef HAVE_KILL
-	if(cfg->pidfile && cfg->pidfile[0] && need_pidfile) {
-		writepid(daemon->pidfile, getpid());
-		if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1 &&
-			pidinchroot) {
-#  ifdef HAVE_CHOWN
-			if(chown(daemon->pidfile, cfg_uid, cfg_gid) == -1) {
-				verbose(VERB_QUERY, "cannot chown %u.%u %s: %s",
-					(unsigned)cfg_uid, (unsigned)cfg_gid,
-					daemon->pidfile, strerror(errno));
-			}
-#  endif /* HAVE_CHOWN */
-		}
-	}
-#else
-	(void)daemon;
-	(void)need_pidfile;
-#endif /* HAVE_KILL */
-
-	/* Set user context */
-#ifdef HAVE_GETPWNAM
-	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
-#ifdef HAVE_SETUSERCONTEXT
-		/* setusercontext does initgroups, setuid, setgid, and
-		 * also resource limits from login config, but we
-		 * still call setresuid, setresgid to be sure to set all uid*/
-		if(setusercontext(NULL, pwd, cfg_uid, (unsigned)
-			LOGIN_SETALL & ~LOGIN_SETUSER & ~LOGIN_SETGROUP) != 0)
-			log_warn("unable to setusercontext %s: %s",
-				cfg->username, strerror(errno));
-#endif /* HAVE_SETUSERCONTEXT */
-	}
-#endif /* HAVE_GETPWNAM */
-
-	/* box into the chroot */
-#ifdef HAVE_CHROOT
 	if(cfg->chrootdir && cfg->chrootdir[0]) {
-		if(chdir(cfg->chrootdir)) {
-			fatal_exit("unable to chdir to chroot %s: %s",
-				cfg->chrootdir, strerror(errno));
-		}
-		verbose(VERB_QUERY, "chdir to %s", cfg->chrootdir);
 		if(chroot(cfg->chrootdir))
 			fatal_exit("unable to chroot to %s: %s", 
 				cfg->chrootdir, strerror(errno));
-		if(chdir("/"))
-			fatal_exit("unable to chdir to / in chroot %s: %s",
-				cfg->chrootdir, strerror(errno));
-		verbose(VERB_QUERY, "chroot to %s", cfg->chrootdir);
-		if(strncmp(*cfgfile, cfg->chrootdir, 
-			strlen(cfg->chrootdir)) == 0) 
-			(*cfgfile) += strlen(cfg->chrootdir);
-
-		/* adjust stored pidfile for chroot */
-		if(daemon->pidfile && daemon->pidfile[0] && 
-			strncmp(daemon->pidfile, cfg->chrootdir,
-			strlen(cfg->chrootdir))==0) {
-			char* old = daemon->pidfile;
-			daemon->pidfile = strdup(old+strlen(cfg->chrootdir));
-			free(old);
-			if(!daemon->pidfile)
-				log_err("out of memory in pidfile adjust");
-		}
-		daemon->chroot = strdup(cfg->chrootdir);
-		if(!daemon->chroot)
-			log_err("out of memory in daemon chroot dir storage");
+		verbose(VERB_DETAIL, "chroot to %s", cfg->chrootdir);
 	}
-#else
-	(void)cfgfile;
-#endif
-	/* change to working directory inside chroot */
-	if(cfg->directory && cfg->directory[0]) {
-		char* dir = cfg->directory;
-		if(cfg->chrootdir && cfg->chrootdir[0] &&
-			strncmp(dir, cfg->chrootdir, 
-			strlen(cfg->chrootdir)) == 0)
-			dir += strlen(cfg->chrootdir);
-		if(dir[0]) {
-			if(chdir(dir)) {
-				fatal_exit("Could not chdir to %s: %s",
-					dir, strerror(errno));
-			}
-			verbose(VERB_QUERY, "chdir to %s", dir);
-		}
-	}
-
-	/* drop permissions after chroot, getpwnam, pidfile, syslog done*/
-#ifdef HAVE_GETPWNAM
-	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
-#  ifdef HAVE_INITGROUPS
-		if(initgroups(cfg->username, cfg_gid) != 0)
-			log_warn("unable to initgroups %s: %s",
-				cfg->username, strerror(errno));
-#  endif /* HAVE_INITGROUPS */
-#  ifdef HAVE_ENDPWENT
-		endpwent();
-#  endif
-
-#ifdef HAVE_SETRESGID
-		if(setresgid(cfg_gid,cfg_gid,cfg_gid) != 0)
-#elif defined(HAVE_SETREGID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setregid(cfg_gid,cfg_gid) != 0)
-#else /* use setgid */
-		if(setgid(cfg_gid) != 0)
-#endif /* HAVE_SETRESGID */
+	if(cfg->username && cfg->username[0]) {
+		if(setgid(gid) != 0)
 			fatal_exit("unable to set group id of %s: %s", 
 				cfg->username, strerror(errno));
-#ifdef HAVE_SETRESUID
-		if(setresuid(cfg_uid,cfg_uid,cfg_uid) != 0)
-#elif defined(HAVE_SETREUID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setreuid(cfg_uid,cfg_uid) != 0)
-#else /* use setuid */
-		if(setuid(cfg_uid) != 0)
-#endif /* HAVE_SETRESUID */
+		if(setuid(uid) != 0)
 			fatal_exit("unable to set user id of %s: %s", 
 				cfg->username, strerror(errno));
-		verbose(VERB_QUERY, "drop user privileges, run as %s", 
+		verbose(VERB_DETAIL, "drop user privileges, run as %s", 
 			cfg->username);
 	}
-#endif /* HAVE_GETPWNAM */
-	/* file logging inited after chroot,chdir,setuid is done so that 
-	 * it would succeed on SIGHUP as well */
-	if(!cfg->use_syslog)
-		log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
+	/* check old pid file before forking */
+	if(cfg->pidfile && cfg->pidfile[0]) {
+		checkoldpid(cfg);
+	}
+
+	/* init logfile just before fork */
+	log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
+	if(!debug_mode && cfg->do_daemonize) {
+		detach(cfg);
+	}
+	if(cfg->pidfile && cfg->pidfile[0]) {
+		char* pf = cfg->pidfile;
+		if(cfg->chrootdir && cfg->chrootdir[0] &&
+			strncmp(pf, cfg->chrootdir, strlen(cfg->chrootdir))==0)
+			pf += strlen(cfg->chrootdir);
+		writepid(pf, getpid());
+		if(!(daemon->pidfile = strdup(pf)))
+			log_err("pidf: malloc failed");
+	}
 }
 
 /**
@@ -604,47 +327,35 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
  * @param cmdline_verbose: verbosity resulting from commandline -v.
  *    These increase verbosity as specified in the config file.
  * @param debug_mode: if set, do not daemonize.
- * @param log_default_identity: Default identity to report in logs
- * @param need_pidfile: if false, no pidfile is checked or created.
  */
 static void 
-run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char* log_default_identity, int need_pidfile)
+run_daemon(char* cfgfile, int cmdline_verbose, int debug_mode)
 {
 	struct config_file* cfg = NULL;
 	struct daemon* daemon = NULL;
-	int done_setup = 0;
+	int done_chroot = 0;
 
 	if(!(daemon = daemon_init()))
 		fatal_exit("alloc failure");
 	while(!daemon->need_to_exit) {
-		if(done_setup)
-			verbose(VERB_OPS, "Restart of %s.", PACKAGE_STRING);
-		else	verbose(VERB_OPS, "Start of %s.", PACKAGE_STRING);
+		if(done_chroot)
+			log_info("Restart of %s.", PACKAGE_STRING);
+		else	log_info("Start of %s.", PACKAGE_STRING);
 
 		/* config stuff */
 		if(!(cfg = config_create()))
 			fatal_exit("Could not alloc config defaults");
-		if(!config_read(cfg, cfgfile, daemon->chroot)) {
-			if(errno != ENOENT)
-				fatal_exit("Could not read config file: %s",
-					cfgfile);
-			log_warn("Continuing with default config settings");
-		}
-		apply_settings(daemon, cfg, cmdline_verbose, debug_mode, log_default_identity);
-		if(!done_setup)
-			config_lookup_uid(cfg);
+		if(!config_read(cfg, cfgfile))
+			fatal_exit("Could not read config file: %s", cfgfile);
+		apply_settings(daemon, cfg, cmdline_verbose);
 	
 		/* prepare */
 		if(!daemon_open_shared_ports(daemon))
 			fatal_exit("could not open ports");
-		if(!done_setup) { 
-			perform_setup(daemon, cfg, debug_mode, &cfgfile, need_pidfile);
-			done_setup = 1; 
-		} else {
-			/* reopen log after HUP to facilitate log rotation */
-			if(!cfg->use_syslog)
-				log_init(cfg->logfile, 0, cfg->chrootdir);
-		}
+		if(!done_chroot) { 
+			do_chroot(daemon, cfg, debug_mode); 
+			done_chroot = 1; 
+		} else log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
 		/* work */
 		daemon_fork(daemon);
 
@@ -654,17 +365,8 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char*
 		config_delete(cfg);
 	}
 	verbose(VERB_ALGO, "Exit cleanup.");
-	/* this unlink may not work if the pidfile is located outside
-	 * of the chroot/workdir or we no longer have permissions */
-	if(daemon->pidfile) {
-		int fd;
-		/* truncate pidfile */
-		fd = open(daemon->pidfile, O_WRONLY | O_TRUNC, 0644);
-		if(fd != -1)
-			close(fd);
-		/* delete pidfile */
+	if(daemon->pidfile)
 		unlink(daemon->pidfile);
-	}
 	daemon_delete(daemon);
 }
 
@@ -683,41 +385,26 @@ int
 main(int argc, char* argv[])
 {
 	int c;
-	const char* cfgfile = CONFIGFILE;
-	const char* winopt = NULL;
-	const char* log_ident_default;
+	char* cfgfile = CONFIGFILE;
 	int cmdline_verbose = 0;
 	int debug_mode = 0;
-	int need_pidfile = 1;
 
-#ifdef UB_ON_WINDOWS
-	int cmdline_cfg = 0;
-#endif
+	/* take debug snapshot of heap */
+	unbound_start_brk = sbrk(0);
 
 	log_init(NULL, 0, NULL);
-	log_ident_default = strrchr(argv[0],'/')?strrchr(argv[0],'/')+1:argv[0];
-	log_ident_set(log_ident_default);
 	/* parse the options */
-	while( (c=getopt(argc, argv, "c:dhpvw:")) != -1) {
+	while( (c=getopt(argc, argv, "c:dhv")) != -1) {
 		switch(c) {
 		case 'c':
 			cfgfile = optarg;
-#ifdef UB_ON_WINDOWS
-			cmdline_cfg = 1;
-#endif
 			break;
 		case 'v':
-			cmdline_verbose++;
+			cmdline_verbose ++;
 			verbosity++;
 			break;
-		case 'p':
-			need_pidfile = 0;
-			break;
 		case 'd':
-			debug_mode++;
-			break;
-		case 'w':
-			winopt = optarg;
+			debug_mode = 1;
 			break;
 		case '?':
 		case 'h':
@@ -729,26 +416,12 @@ main(int argc, char* argv[])
 	argc -= optind;
 	argv += optind;
 
-	if(winopt) {
-#ifdef UB_ON_WINDOWS
-		wsvc_command_option(winopt, cfgfile, cmdline_verbose, 
-			cmdline_cfg);
-#else
-		fatal_exit("option not supported");
-#endif
-	}
-
 	if(argc != 0) {
 		usage();
 		return 1;
 	}
 
-	run_daemon(cfgfile, cmdline_verbose, debug_mode, log_ident_default, need_pidfile);
+	run_daemon(cfgfile, cmdline_verbose, debug_mode);
 	log_init(NULL, 0, NULL); /* close logfile */
-#ifndef unbound_testbound
-	if(log_get_lock()) {
-		lock_quick_destroy((lock_quick_type*)log_get_lock());
-	}
-#endif
 	return 0;
 }

daemon/worker.h

@@ -21,16 +21,16 @@
  * specific prior written permission.
  * 
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
  */
 
 /**
@@ -43,7 +43,7 @@
 #ifndef DAEMON_WORKER_H
 #define DAEMON_WORKER_H
 
-#include "libunbound/worker.h"
+#include "config.h"
 #include "util/netevent.h"
 #include "util/locks.h"
 #include "util/alloc.h"
@@ -51,7 +51,6 @@
 #include "util/data/msgparse.h"
 #include "daemon/stats.h"
 #include "util/module.h"
-#include "dnstap/dnstap.h"
 struct listen_dnsport;
 struct outside_network;
 struct config_file;
@@ -59,20 +58,14 @@ struct daemon;
 struct listen_port;
 struct ub_randstate;
 struct regional;
-struct tube;
-struct daemon_remote;
-struct query_info;
+
+/** size of table used for random numbers. large to be more secure. */
+#define RND_STATE_SIZE 256
 
 /** worker commands */
 enum worker_commands {
 	/** make the worker quit */
-	worker_cmd_quit,
-	/** obtain statistics */
-	worker_cmd_stats,
-	/** obtain statistics without statsclear */
-	worker_cmd_stats_noreset,
-	/** execute remote control command */
-	worker_cmd_remote
+	worker_cmd_quit
 };
 
 /**
@@ -85,29 +78,24 @@ struct worker {
 	/** global shared daemon structure */
 	struct daemon* daemon;
 	/** thread id */
-	ub_thread_type thr_id;
-	/** pipe, for commands for this worker */
-	struct tube* cmd;
+	ub_thread_t thr_id;
+	/** fd 0 of socketpair, write commands for worker to this one */
+	int cmd_send_fd;
+	/** fd 1 of socketpair, worker listens on this one */
+	int cmd_recv_fd;
 	/** the event base this worker works with */
 	struct comm_base* base;
 	/** the frontside listening interface where request events come in */
 	struct listen_dnsport* front;
 	/** the backside outside network interface to the auth servers */
 	struct outside_network* back;
-	/** ports to be used by this worker. */
-	int* ports;
-	/** number of ports for this worker */
-	int numports;
 	/** the signal handler */
 	struct comm_signal* comsig;
 	/** commpoint to listen to commands. */
 	struct comm_point* cmd_com;
-	/** timer for statistics */
-	struct comm_timer* stat_timer;
-	/** ratelimit for errors, time value */
-	time_t err_limit_time;
-	/** ratelimit for errors, packet count */
-	unsigned int err_limit_count;
+
+	/** number of requests that can be handled by this worker */
+	size_t request_size;
 
 	/** random() table for this worker. */
 	struct ub_randstate* rndstate;
@@ -116,17 +104,12 @@ struct worker {
 	/** allocation cache for this thread */
 	struct alloc_cache alloc;
 	/** per thread statistics */
-	struct ub_server_stats stats;
+	struct server_stats stats;
 	/** thread scratch regional */
 	struct regional* scratchpad;
 
 	/** module environment passed to modules, changed for this thread */
 	struct module_env env;
-
-#ifdef USE_DNSTAP
-	/** dnstap environment, changed for this thread */
-	struct dt_env dtenv;
-#endif
 };
 
 /**
@@ -134,11 +117,9 @@ struct worker {
  * with backpointers only. Use worker_init on it later.
  * @param daemon: the daemon that this worker thread is part of.
  * @param id: the thread number from 0.. numthreads-1.
- * @param ports: the ports it is allowed to use, array.
- * @param n: the number of ports.
  * @return: the new worker or NULL on alloc failure.
  */
-struct worker* worker_create(struct daemon* daemon, int id, int* ports, int n);
+struct worker* worker_create(struct daemon* daemon, int id);
 
 /**
  * Initialize worker.
@@ -165,14 +146,75 @@ void worker_delete(struct worker* worker);
 /**
  * Send a command to a worker. Uses blocking writes.
  * @param worker: worker to send command to.
+ * @param buffer: an empty buffer to use.
  * @param cmd: command to send.
  */
-void worker_send_cmd(struct worker* worker, enum worker_commands cmd);
+void worker_send_cmd(struct worker* worker, ldns_buffer* buffer,
+        enum worker_commands cmd);
 
 /**
- * Init worker stats - includes server_stats_init, outside network and mesh.
- * @param worker: the worker to init
+ * Worker signal handler function. User argument is the worker itself.
+ * @param sig: signal number.
+ * @param arg: the worker (main worker) that handles signals.
  */
-void worker_stats_clear(struct worker* worker);
+void worker_sighandler(int sig, void* arg);
+
+/**
+ * Worker service routine to send udp messages for modules.
+ * @param pkt: packet to send.
+ * @param addr: where to.
+ * @param addrlen: length of addr.
+ * @param timeout: seconds to wait until timeout.
+ * @param q: wich query state to reactivate upon return.
+ * @param use_tcp: true to use TCP, false for UDP.
+ * @return: false on failure (memory or socket related). no query was
+ *      sent.
+ */
+int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
+	socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp);
+
+/**
+ * Worker service routine to send serviced queries to authoritative servers.
+ * @param qname: query name. (host order)
+ * @param qnamelen: length in bytes of qname, including trailing 0.
+ * @param qtype: query type. (host order)
+ * @param qclass: query class. (host order)
+ * @param flags: host order flags word, with opcode and CD bit.
+ * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param addr: where to.
+ * @param addrlen: length of addr.
+ * @param q: wich query state to reactivate upon return.
+ * @return: false on failure (memory or socket related). no query was
+ *      sent.
+ */
+struct outbound_entry* worker_send_query(uint8_t* qname, size_t qnamelen, 
+	uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
+	struct sockaddr_storage* addr, socklen_t addrlen,
+	struct module_qstate* q);
+
+/** 
+ * process control messages from the main thread. 
+ * @param c: comm point to read from.
+ * @param arg: worker.
+ * @param error: error status of comm point.
+ * @param reply_info: not used.
+ */
+int worker_handle_control_cmd(struct comm_point* c, void* arg, int error, 
+	struct comm_reply* reply_info);
+
+/** handles callbacks from listening event interface */
+int worker_handle_request(struct comm_point* c, void* arg, int error,
+	struct comm_reply* repinfo);
+
+/** process incoming replies from the network */
+int worker_handle_reply(struct comm_point* c, void* arg, int error, 
+	struct comm_reply* reply_info);
+
+/** process incoming serviced query replies from the network */
+int worker_handle_service_reply(struct comm_point* c, void* arg, int error, 
+	struct comm_reply* reply_info);
+
+/** cleanup the cache to remove all rrset IDs from it, arg is worker */
+void worker_alloc_cleanup(void* arg);
 
 #endif /* DAEMON_WORKER_H */

dns64/dns64.c

@@ -1,859 +0,0 @@
-/*
- * dns64/dns64.c - DNS64 module
- *
- * Copyright (c) 2009, Viagénie. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of Viagénie nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains a module that performs DNS64 query processing.
- */
-
-#include "config.h"
-#include "dns64/dns64.h"
-#include "services/cache/dns.h"
-#include "services/cache/rrset.h"
-#include "util/config_file.h"
-#include "util/data/msgreply.h"
-#include "util/fptr_wlist.h"
-#include "util/net_help.h"
-#include "util/regional.h"
-
-/******************************************************************************
- *                                                                            *
- *                             STATIC CONSTANTS                               *
- *                                                                            *
- ******************************************************************************/
-
-/**
- * This is the default DNS64 prefix that is used whent he dns64 module is listed
- * in module-config but when the dns64-prefix variable is not present.
- */
-static const char DEFAULT_DNS64_PREFIX[] = "64:ff9b::/96";
-
-/**
- * Maximum length of a domain name in a PTR query in the .in-addr.arpa tree.
- */
-#define MAX_PTR_QNAME_IPV4 30
-
-/**
- * Per-query module-specific state. This is usually a dynamically-allocated
- * structure, but in our case we only need to store one variable describing the
- * state the query is in. So we repurpose the minfo pointer by storing an
- * integer in there.
- */
-enum dns64_qstate {
-    DNS64_INTERNAL_QUERY,    /**< Internally-generated query, no DNS64
-                                  processing. */
-    DNS64_NEW_QUERY,         /**< Query for which we're the first module in
-                                  line. */
-    DNS64_SUBQUERY_FINISHED  /**< Query for which we generated a sub-query, and
-                                  for which this sub-query is finished. */
-};
-
-
-/******************************************************************************
- *                                                                            *
- *                                 STRUCTURES                                 *
- *                                                                            *
- ******************************************************************************/
-
-/**
- * This structure contains module configuration information. One instance of
- * this structure exists per instance of the module. Normally there is only one
- * instance of the module.
- */
-struct dns64_env {
-    /**
-     * DNS64 prefix address. We're using a full sockaddr instead of just an
-     * in6_addr because we can reuse Unbound's generic string parsing functions.
-     * It will always contain a sockaddr_in6, and only the sin6_addr member will
-     * ever be used.
-     */
-    struct sockaddr_storage prefix_addr;
-
-    /**
-     * This is always sizeof(sockaddr_in6).
-     */
-    socklen_t prefix_addrlen;
-
-    /**
-     * This is the CIDR length of the prefix. It needs to be between 0 and 96.
-     */
-    int prefix_net;
-};
-
-
-/******************************************************************************
- *                                                                            *
- *                             UTILITY FUNCTIONS                              *
- *                                                                            *
- ******************************************************************************/
-
-/**
- * Generic macro for swapping two variables.
- *
- * \param t Type of the variables. (e.g. int)
- * \param a First variable.
- * \param b Second variable.
- *
- * \warning Do not attempt something foolish such as swap(int,a++,b++)!
- */
-#define swap(t,a,b) do {t x = a; a = b; b = x;} while(0)
-
-/**
- * Reverses a string.
- *
- * \param begin Points to the first character of the string.
- * \param end   Points one past the last character of the string.
- */
-static void
-reverse(char* begin, char* end)
-{
-    while ( begin < --end ) {
-        swap(char, *begin, *end);
-        ++begin;
-    }
-}
-
-/**
- * Convert an unsigned integer to a string. The point of this function is that
- * of being faster than sprintf().
- *
- * \param n The number to be converted.
- * \param s The result will be written here. Must be large enough, be careful!
- *
- * \return The number of characters written.
- */
-static int
-uitoa(unsigned n, char* s)
-{
-    char* ss = s;
-    do {
-        *ss++ = '0' + n % 10;
-    } while (n /= 10);
-    reverse(s, ss);
-    return ss - s;
-}
-
-/**
- * Extract an IPv4 address embedded in the IPv6 address \a ipv6 at offset \a
- * offset (in bits). Note that bits are not necessarily aligned on bytes so we
- * need to be careful.
- *
- * \param ipv6   IPv6 address represented as a 128-bit array in big-endian
- *               order.
- * \param offset Index of the MSB of the IPv4 address embedded in the IPv6
- *               address.
- */
-static uint32_t
-extract_ipv4(const uint8_t ipv6[16], const int offset)
-{
-    uint32_t ipv4 = (uint32_t)ipv6[offset/8+0] << (24 + (offset%8))
-                  | (uint32_t)ipv6[offset/8+1] << (16 + (offset%8))
-                  | (uint32_t)ipv6[offset/8+2] << ( 8 + (offset%8))
-                  | (uint32_t)ipv6[offset/8+3] << ( 0 + (offset%8));
-    if (offset/8+4 < 16)
-        ipv4 |= (uint32_t)ipv6[offset/8+4] >> (8 - offset%8);
-    return ipv4;
-}
-
-/**
- * Builds the PTR query name corresponding to an IPv4 address. For example,
- * given the number 3,464,175,361, this will build the string
- * "\03206\03123\0231\011\07in-addr\04arpa".
- *
- * \param ipv4 IPv4 address represented as an unsigned 32-bit number.
- * \param ptr  The result will be written here. Must be large enough, be
- *             careful!
- *
- * \return The number of characters written.
- */
-static size_t
-ipv4_to_ptr(uint32_t ipv4, char ptr[MAX_PTR_QNAME_IPV4])
-{
-    static const char IPV4_PTR_SUFFIX[] = "\07in-addr\04arpa";
-    int i;
-    char* c = ptr;
-
-    for (i = 0; i < 4; ++i) {
-        *c = uitoa((unsigned int)(ipv4 % 256), c + 1);
-        c += *c + 1;
-        ipv4 /= 256;
-    }
-
-    memmove(c, IPV4_PTR_SUFFIX, sizeof(IPV4_PTR_SUFFIX));
-
-    return c + sizeof(IPV4_PTR_SUFFIX) - ptr;
-}
-
-/**
- * Converts an IPv6-related domain name string from a PTR query into an IPv6
- * address represented as a 128-bit array.
- *
- * \param ptr  The domain name. (e.g. "\011[...]\010\012\016\012\03ip6\04arpa")
- * \param ipv6 The result will be written here, in network byte order.
- *
- * \return 1 on success, 0 on failure.
- */
-static int
-ptr_to_ipv6(const char* ptr, uint8_t ipv6[16])
-{
-    int i;
-
-    for (i = 0; i < 64; i++) {
-        int x;
-
-        if (ptr[i++] != 1)
-            return 0;
-
-        if (ptr[i] >= '0' && ptr[i] <= '9') {
-            x = ptr[i] - '0';
-        } else if (ptr[i] >= 'a' && ptr[i] <= 'f') {
-            x = ptr[i] - 'a' + 10;
-        } else if (ptr[i] >= 'A' && ptr[i] <= 'F') {
-            x = ptr[i] - 'A' + 10;
-        } else {
-            return 0;
-        }
-
-        ipv6[15-i/4] |= x << (2 * ((i-1) % 4));
-    }
-
-    return 1;
-}
-
-/**
- * Synthesize an IPv6 address based on an IPv4 address and the DNS64 prefix.
- *
- * \param prefix_addr DNS64 prefix address.
- * \param prefix_net  CIDR length of the DNS64 prefix. Must be between 0 and 96.
- * \param a           IPv4 address.
- * \param aaaa        IPv6 address. The result will be written here.
- */
-static void
-synthesize_aaaa(const uint8_t prefix_addr[16], int prefix_net,
-        const uint8_t a[4], uint8_t aaaa[16])
-{
-    memcpy(aaaa, prefix_addr, 16);
-    aaaa[prefix_net/8+0] |= a[0] >> (0+prefix_net%8);
-    aaaa[prefix_net/8+1] |= a[0] << (8-prefix_net%8);
-    aaaa[prefix_net/8+1] |= a[1] >> (0+prefix_net%8);
-    aaaa[prefix_net/8+2] |= a[1] << (8-prefix_net%8);
-    aaaa[prefix_net/8+2] |= a[2] >> (0+prefix_net%8);
-    aaaa[prefix_net/8+3] |= a[2] << (8-prefix_net%8);
-    aaaa[prefix_net/8+3] |= a[3] >> (0+prefix_net%8);
-    if (prefix_net/8+4 < 16)  /* <-- my beautiful symmetry is destroyed! */
-    aaaa[prefix_net/8+4] |= a[3] << (8-prefix_net%8);
-}
-
-
-/******************************************************************************
- *                                                                            *
- *                           DNS64 MODULE FUNCTIONS                           *
- *                                                                            *
- ******************************************************************************/
-
-/**
- * This function applies the configuration found in the parsed configuration
- * file \a cfg to this instance of the dns64 module. Currently only the DNS64
- * prefix (a.k.a. Pref64) is configurable.
- *
- * \param dns64_env Module-specific global parameters.
- * \param cfg       Parsed configuration file.
- */
-static int
-dns64_apply_cfg(struct dns64_env* dns64_env, struct config_file* cfg)
-{
-    verbose(VERB_ALGO, "dns64-prefix: %s", cfg->dns64_prefix);
-    if (!netblockstrtoaddr(cfg->dns64_prefix ? cfg->dns64_prefix :
-                DEFAULT_DNS64_PREFIX, 0, &dns64_env->prefix_addr,
-                &dns64_env->prefix_addrlen, &dns64_env->prefix_net)) {
-        log_err("cannot parse dns64-prefix netblock: %s", cfg->dns64_prefix);
-        return 0;
-    }
-    if (!addr_is_ip6(&dns64_env->prefix_addr, dns64_env->prefix_addrlen)) {
-        log_err("dns64_prefix is not IPv6: %s", cfg->dns64_prefix);
-        return 0;
-    }
-    if (dns64_env->prefix_net < 0 || dns64_env->prefix_net > 96) {
-        log_err("dns64-prefix length it not between 0 and 96: %s",
-                cfg->dns64_prefix);
-        return 0;
-    }
-    return 1;
-}
-
-/**
- * Initializes this instance of the dns64 module.
- *
- * \param env Global state of all module instances.
- * \param id  This instance's ID number.
- */
-int
-dns64_init(struct module_env* env, int id)
-{
-    struct dns64_env* dns64_env =
-        (struct dns64_env*)calloc(1, sizeof(struct dns64_env));
-    if (!dns64_env) {
-        log_err("malloc failure");
-        return 0;
-    }
-	env->modinfo[id] = (void*)dns64_env;
-    if (!dns64_apply_cfg(dns64_env, env->cfg)) {
-        log_err("dns64: could not apply configuration settings.");
-        return 0;
-    }
-    return 1;
-}
-
-/**
- * Deinitializes this instance of the dns64 module.
- *
- * \param env Global state of all module instances.
- * \param id  This instance's ID number.
- */
-void
-dns64_deinit(struct module_env* env, int id)
-{
-    if (!env)
-        return;
-    free(env->modinfo[id]);
-    env->modinfo[id] = NULL;
-}
-
-/**
- * Handle PTR queries for IPv6 addresses. If the address belongs to the DNS64
- * prefix, we must do a PTR query for the corresponding IPv4 address instead.
- *
- * \param qstate Query state structure.
- * \param id     This module instance's ID number.
- *
- * \return The new state of the query.
- */
-static enum module_ext_state
-handle_ipv6_ptr(struct module_qstate* qstate, int id)
-{
-    struct dns64_env* dns64_env = (struct dns64_env*)qstate->env->modinfo[id];
-    struct module_qstate* subq = NULL;
-    struct query_info qinfo;
-    struct sockaddr_in6 sin6;
-
-    /* Convert the PTR query string to an IPv6 address. */
-    memset(&sin6, 0, sizeof(sin6));
-    sin6.sin6_family = AF_INET6;
-    if (!ptr_to_ipv6((char*)qstate->qinfo.qname, sin6.sin6_addr.s6_addr))
-        return module_wait_module;  /* Let other module handle this. */
-
-    /*
-     * If this IPv6 address is not part of our DNS64 prefix, then we don't need
-     * to do anything. Let another module handle the query.
-     */
-    if (addr_in_common((struct sockaddr_storage*)&sin6, 128,
-                &dns64_env->prefix_addr, dns64_env->prefix_net,
-                (socklen_t)sizeof(sin6)) != dns64_env->prefix_net)
-        return module_wait_module;
-
-    verbose(VERB_ALGO, "dns64: rewrite PTR record");
-
-    /*
-     * Create a new PTR query info for the domain name corresponding to the IPv4
-     * address corresponding to the IPv6 address corresponding to the original
-     * PTR query domain name.
-     */
-    qinfo = qstate->qinfo;
-    if (!(qinfo.qname = regional_alloc(qstate->region, MAX_PTR_QNAME_IPV4)))
-        return module_error;
-    qinfo.qname_len = ipv4_to_ptr(extract_ipv4(sin6.sin6_addr.s6_addr,
-                dns64_env->prefix_net), (char*)qinfo.qname);
-
-    /* Create the new sub-query. */
-    fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0, 0,
-                &subq))
-        return module_error;
-    if (subq) {
-        subq->curmod = id;
-        subq->ext_state[id] = module_state_initial;
-        subq->minfo[id] = NULL;
-    }
-
-    return module_wait_subquery;
-}
-
-static enum module_ext_state
-generate_type_A_query(struct module_qstate* qstate, int id)
-{
-	struct module_qstate* subq = NULL;
-	struct query_info qinfo;
-
-	verbose(VERB_ALGO, "dns64: query A record");
-
-	/* Create a new query info. */
-	qinfo = qstate->qinfo;
-	qinfo.qtype = LDNS_RR_TYPE_A;
-
-	/* Start the sub-query. */
-	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0,
-				       0, &subq))
-	{
-		verbose(VERB_ALGO, "dns64: sub-query creation failed");
-		return module_error;
-	}
-	if (subq) {
-		subq->curmod = id;
-		subq->ext_state[id] = module_state_initial;
-		subq->minfo[id] = NULL;
-	}
-
-	return module_wait_subquery;
-}
-
-/**
- * Handles the "pass" event for a query. This event is received when a new query
- * is received by this module. The query may have been generated internally by
- * another module, in which case we don't want to do any special processing
- * (this is an interesting discussion topic),  or it may be brand new, e.g.
- * received over a socket, in which case we do want to apply DNS64 processing.
- *
- * \param qstate A structure representing the state of the query that has just
- *               received the "pass" event.
- * \param id     This module's instance ID.
- *
- * \return The new state of the query.
- */
-static enum module_ext_state
-handle_event_pass(struct module_qstate* qstate, int id)
-{
-	if ((uintptr_t)qstate->minfo[id] == DNS64_NEW_QUERY
-            && qstate->qinfo.qtype == LDNS_RR_TYPE_PTR
-            && qstate->qinfo.qname_len == 74
-            && !strcmp((char*)&qstate->qinfo.qname[64], "\03ip6\04arpa"))
-        /* Handle PTR queries for IPv6 addresses. */
-        return handle_ipv6_ptr(qstate, id);
-
-	if (qstate->env->cfg->dns64_synthall &&
-	    (uintptr_t)qstate->minfo[id] == DNS64_NEW_QUERY
-	    && qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)
-		return generate_type_A_query(qstate, id);
-
-	/* We are finished when our sub-query is finished. */
-	if ((uintptr_t)qstate->minfo[id] == DNS64_SUBQUERY_FINISHED)
-		return module_finished;
-
-	/* Otherwise, pass request to next module. */
-	verbose(VERB_ALGO, "dns64: pass to next module");
-	return module_wait_module;
-}
-
-/**
- * Handles the "done" event for a query. We need to analyze the response and
- * maybe issue a new sub-query for the A record.
- *
- * \param qstate A structure representing the state of the query that has just
- *               received the "pass" event.
- * \param id     This module's instance ID.
- *
- * \return The new state of the query.
- */
-static enum module_ext_state
-handle_event_moddone(struct module_qstate* qstate, int id)
-{
-    /*
-     * In many cases we have nothing special to do. From most to least common:
-     *
-     *   - An internal query.
-     *   - A query for a record type other than AAAA.
-     *   - CD FLAG was set on querier
-     *   - An AAAA query for which an error was returned.(qstate.return_rcode)
-     *     -> treated as servfail thus synthesize (sec 5.1.3 6147), thus
-     *        synthesize in (sec 5.1.2 of RFC6147).
-     *   - A successful AAAA query with an answer.
-     */
-	if ( (enum dns64_qstate)qstate->minfo[id] == DNS64_INTERNAL_QUERY
-            || qstate->qinfo.qtype != LDNS_RR_TYPE_AAAA
-	    || (qstate->query_flags & BIT_CD)
-	    || (qstate->return_msg &&
-		    qstate->return_msg->rep &&
-		    reply_find_answer_rrset(&qstate->qinfo,
-			    qstate->return_msg->rep)))
-		return module_finished;
-
-    /* So, this is a AAAA noerror/nodata answer */
-	return generate_type_A_query(qstate, id);
-}
-
-/**
- * This is the module's main() function. It gets called each time a query
- * receives an event which we may need to handle. We respond by updating the
- * state of the query.
- *
- * \param qstate   Structure containing the state of the query.
- * \param event    Event that has just been received.
- * \param id       This module's instance ID.
- * \param outbound State of a DNS query on an authoritative server. We never do
- *                 our own queries ourselves (other modules do it for us), so
- *                 this is unused.
- */
-void
-dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
-		struct outbound_entry* outbound)
-{
-	(void)outbound;
-	verbose(VERB_QUERY, "dns64[module %d] operate: extstate:%s event:%s",
-			id, strextstate(qstate->ext_state[id]),
-			strmodulevent(event));
-	log_query_info(VERB_QUERY, "dns64 operate: query", &qstate->qinfo);
-
-	switch(event) {
-		case module_event_new:
-			/* Tag this query as being new and fall through. */
-			qstate->minfo[id] = (void*)DNS64_NEW_QUERY;
-  			/* fallthrough */
-		case module_event_pass:
-			qstate->ext_state[id] = handle_event_pass(qstate, id);
-			break;
-		case module_event_moddone:
-			qstate->ext_state[id] = handle_event_moddone(qstate, id);
-			break;
-		default:
-			qstate->ext_state[id] = module_finished;
-			break;
-	}
-}
-
-static void
-dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk, 
-		      const struct packed_rrset_data* fd, 
-		      struct ub_packed_rrset_key *dk, 
-		      struct packed_rrset_data **dd_out, struct regional *region, 
-		      struct dns64_env* dns64_env )
-{
-	struct packed_rrset_data *dd;
-	size_t i;
-	/*
-	 * Create synthesized AAAA RR set data. We need to allocated extra memory
-	 * for the RRs themselves. Each RR has a length, TTL, pointer to wireformat
-	 * data, 2 bytes of data length, and 16 bytes of IPv6 address.
-	 */
-	if(fd->count > RR_COUNT_MAX) {
-		*dd_out = NULL;
-		return; /* integer overflow protection in alloc */
-	}
-	if (!(dd = *dd_out = regional_alloc(region,
-		  sizeof(struct packed_rrset_data)
-		  + fd->count * (sizeof(size_t) + sizeof(time_t) +
-			     sizeof(uint8_t*) + 2 + 16)))) {
-		log_err("out of memory");
-		return;
-	}
-
-	/* Copy attributes from A RR set. */
-	dd->ttl = fd->ttl;
-	dd->count = fd->count;
-	dd->rrsig_count = 0;
-	dd->trust = fd->trust;
-	dd->security = fd->security;
-
-	/*
-	 * Synthesize AAAA records. Adjust pointers in structure.
-	 */
-	dd->rr_len =
-	    (size_t*)((uint8_t*)dd + sizeof(struct packed_rrset_data));
-	dd->rr_data = (uint8_t**)&dd->rr_len[dd->count];
-	dd->rr_ttl = (time_t*)&dd->rr_data[dd->count];
-	for(i = 0; i < fd->count; ++i) {
-		if (fd->rr_len[i] != 6 || fd->rr_data[i][0] != 0
-		    || fd->rr_data[i][1] != 4) {
-			*dd_out = NULL;
-			return;
-		}
-		dd->rr_len[i] = 18;
-		dd->rr_data[i] =
-		    (uint8_t*)&dd->rr_ttl[dd->count] + 18*i;
-		dd->rr_data[i][0] = 0;
-		dd->rr_data[i][1] = 16;
-		synthesize_aaaa(
-				((struct sockaddr_in6*)&dns64_env->prefix_addr)->sin6_addr.s6_addr,
-				dns64_env->prefix_net, &fd->rr_data[i][2],
-				&dd->rr_data[i][2] );
-		dd->rr_ttl[i] = fd->rr_ttl[i];
-	}
-
-	/*
-	 * Create synthesized AAAA RR set key. This is mostly just bookkeeping,
-	 * nothing interesting here.
-	 */
-	if(!dk) {
-		log_err("no key");
-		*dd_out = NULL;
-		return;
-	}
-
-	dk->rk.dname = (uint8_t*)regional_alloc_init(region,
-		     fk->rk.dname, fk->rk.dname_len);
-
-	if(!dk->rk.dname) {
-		log_err("out of memory");
-		*dd_out = NULL;
-		return;
-	}
-
-	dk->rk.type = htons(LDNS_RR_TYPE_AAAA);
-	memset(&dk->entry, 0, sizeof(dk->entry));
-	dk->entry.key = dk;
-	dk->entry.hash = rrset_key_hash(&dk->rk);
-	dk->entry.data = dd;
-
-}
-
-/**
- * Synthesize an AAAA RR set from an A sub-query's answer and add it to the
- * original empty response.
- *
- * \param id     This module's instance ID.
- * \param super  Original AAAA query.
- * \param qstate A query.
- */
-static void
-dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate)
-{
-	struct dns64_env* dns64_env = (struct dns64_env*)super->env->modinfo[id];
-	struct reply_info *rep, *cp;
-	size_t i, s;
-	struct packed_rrset_data* fd, *dd;
-	struct ub_packed_rrset_key* fk, *dk;
-
-	verbose(VERB_ALGO, "converting A answers to AAAA answers");
-
-	log_assert(super->region);
-	log_assert(qstate->return_msg);
-	log_assert(qstate->return_msg->rep);
-
-	/* If dns64-synthall is enabled, return_msg is not initialized */
-	if(!super->return_msg) {
-		super->return_msg = (struct dns_msg*)regional_alloc(
-		    super->region, sizeof(struct dns_msg));
-		if(!super->return_msg)
-			return;
-		memset(super->return_msg, 0, sizeof(*super->return_msg));
-		super->return_msg->qinfo = super->qinfo;
-	}
-
-	rep = qstate->return_msg->rep;
-
-	/*
-	 * Build the actual reply.
-	 */
-	cp = construct_reply_info_base(super->region, rep->flags, rep->qdcount,
-		rep->ttl, rep->prefetch_ttl, rep->an_numrrsets, rep->ns_numrrsets,
-		rep->ar_numrrsets, rep->rrset_count, rep->security);
-	if(!cp)
-		return;
-
-	/* allocate ub_key structures special or not */
-	if(!reply_info_alloc_rrset_keys(cp, NULL, super->region)) {
-		return;
-	}
-
-	/* copy everything and replace A by AAAA */
-	for(i=0; i<cp->rrset_count; i++) {
-		fk = rep->rrsets[i];
-		dk = cp->rrsets[i];
-		fd = (struct packed_rrset_data*)fk->entry.data;
-		dk->rk = fk->rk;
-		dk->id = fk->id;
-
-		if(i<rep->an_numrrsets && fk->rk.type == htons(LDNS_RR_TYPE_A)) {
-			/* also sets dk->entry.hash */
-			dns64_synth_aaaa_data(fk, fd, dk, &dd, super->region, dns64_env);
-			if(!dd)
-				return;
-			/* Delete negative AAAA record from cache stored by
-			 * the iterator module */
-			rrset_cache_remove(super->env->rrset_cache, dk->rk.dname, 
-					   dk->rk.dname_len, LDNS_RR_TYPE_AAAA, 
-					   LDNS_RR_CLASS_IN, 0);
-		} else {
-			dk->entry.hash = fk->entry.hash;
-			dk->rk.dname = (uint8_t*)regional_alloc_init(super->region,
-				fk->rk.dname, fk->rk.dname_len);
-
-			if(!dk->rk.dname)
-				return;
-
-			s = packed_rrset_sizeof(fd);
-			dd = (struct packed_rrset_data*)regional_alloc_init(
-				super->region, fd, s);
-
-			if(!dd)
-				return;
-		}
-
-		packed_rrset_ptr_fixup(dd);
-		dk->entry.data = (void*)dd;
-	}
-
-	/* Commit changes. */
-	super->return_msg->rep = cp;
-}
-
-/**
- * Generate a response for the original IPv6 PTR query based on an IPv4 PTR
- * sub-query's response.
- *
- * \param qstate IPv4 PTR sub-query.
- * \param super  Original IPv6 PTR query.
- */
-static void
-dns64_adjust_ptr(struct module_qstate* qstate, struct module_qstate* super)
-{
-    struct ub_packed_rrset_key* answer;
-
-    verbose(VERB_ALGO, "adjusting PTR reply");
-
-    /* Copy the sub-query's reply to the parent. */
-    if (!(super->return_msg = (struct dns_msg*)regional_alloc(super->region,
-                    sizeof(struct dns_msg))))
-        return;
-    super->return_msg->qinfo = super->qinfo;
-    super->return_msg->rep = reply_info_copy(qstate->return_msg->rep, NULL,
-            super->region);
-
-    /*
-     * Adjust the domain name of the answer RR set so that it matches the
-     * initial query's domain name.
-     */
-    answer = reply_find_answer_rrset(&qstate->qinfo, super->return_msg->rep);
-    log_assert(answer);
-    answer->rk.dname = super->qinfo.qname;
-    answer->rk.dname_len = super->qinfo.qname_len;
-}
-
-/**
- * This function is called when a sub-query finishes to inform the parent query.
- *
- * We issue two kinds of sub-queries: PTR and A.
- *
- * \param qstate State of the sub-query.
- * \param id     This module's instance ID.
- * \param super  State of the super-query.
- */
-void
-dns64_inform_super(struct module_qstate* qstate, int id,
-		struct module_qstate* super)
-{
-	log_query_info(VERB_ALGO, "dns64: inform_super, sub is",
-		       &qstate->qinfo);
-	log_query_info(VERB_ALGO, "super is", &super->qinfo);
-
-	/*
-	 * Signal that the sub-query is finished, no matter whether we are
-	 * successful or not. This lets the state machine terminate.
-	 */
-	super->minfo[id] = (void*)DNS64_SUBQUERY_FINISHED;
-
-	/* If there is no successful answer, we're done. */
-	if (qstate->return_rcode != LDNS_RCODE_NOERROR
-	    || !qstate->return_msg
-	    || !qstate->return_msg->rep
-	    || !reply_find_answer_rrset(&qstate->qinfo,
-					qstate->return_msg->rep))
-		return;
-
-	/* Use return code from A query in response to client. */
-	if (super->return_rcode != LDNS_RCODE_NOERROR)
-		super->return_rcode = qstate->return_rcode;
-
-	/* Generate a response suitable for the original query. */
-	if (qstate->qinfo.qtype == LDNS_RR_TYPE_A) {
-		dns64_adjust_a(id, super, qstate);
-	} else {
-		log_assert(qstate->qinfo.qtype == LDNS_RR_TYPE_PTR);
-		dns64_adjust_ptr(qstate, super);
-	}
-
-	/* Store the generated response in cache. */
-	if (!super->no_cache_store &&
-		!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-		0, 0, 0, NULL, super->query_flags))
-		log_err("out of memory");
-}
-
-/**
- * Clear module-specific data from query state. Since we do not allocate memory,
- * it's just a matter of setting a pointer to NULL.
- *
- * \param qstate Query state.
- * \param id     This module's instance ID.
- */
-void
-dns64_clear(struct module_qstate* qstate, int id)
-{
-    qstate->minfo[id] = NULL;
-}
-
-/**
- * Returns the amount of global memory that this module uses, not including
- * per-query data.
- *
- * \param env Module environment.
- * \param id  This module's instance ID.
- */
-size_t
-dns64_get_mem(struct module_env* env, int id)
-{
-    struct dns64_env* dns64_env = (struct dns64_env*)env->modinfo[id];
-    if (!dns64_env)
-        return 0;
-    return sizeof(*dns64_env);
-}
-
-/**
- * The dns64 function block.
- */
-static struct module_func_block dns64_block = {
-	"dns64",
-	&dns64_init, &dns64_deinit, &dns64_operate, &dns64_inform_super,
-	&dns64_clear, &dns64_get_mem
-};
-
-/**
- * Function for returning the above function block.
- */
-struct module_func_block *
-dns64_get_funcblock(void)
-{
-	return &dns64_block;
-}

dns64/dns64.h

@@ -1,71 +0,0 @@
-/*
- * dns64/dns64.h - DNS64 module
- *
- * Copyright (c) 2009, Viagénie. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file contains a module that performs DNS64 query processing.
- */
-
-#ifndef DNS64_DNS64_H
-#define DNS64_DNS64_H
-#include "util/module.h"
-
-/**
- * Get the dns64 function block.
- * @return: function block with function pointers to dns64 methods.
- */
-struct module_func_block *dns64_get_funcblock(void);
-
-/** dns64 init */
-int dns64_init(struct module_env* env, int id);
-
-/** dns64 deinit */
-void dns64_deinit(struct module_env* env, int id);
-
-/** dns64 operate on a query */
-void dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
-		struct outbound_entry* outbound);
-
-void dns64_inform_super(struct module_qstate* qstate, int id,
-    struct module_qstate* super);
-
-/** dns64 cleanup query state */
-void dns64_clear(struct module_qstate* qstate, int id);
-
-/** dns64 alloc size routine */
-size_t dns64_get_mem(struct module_env* env, int id);
-
-#endif /* DNS64_DNS64_H */

dnscrypt/cert.h

@@ -1,32 +0,0 @@
-#ifndef UNBOUND_DNSCRYPT_CERT_H
-#define UNBOUND_DNSCRYPT_CERT_H
-
-/**
- * \file
- * certificate type for dnscrypt for use in other header files
- */
-
-#include <sodium.h>
-#define CERT_MAGIC_CERT "DNSC"
-#define CERT_MAJOR_VERSION 1
-#define CERT_MINOR_VERSION 0
-#define CERT_OLD_MAGIC_HEADER "7PYqwfzt"
-
-#define CERT_FILE_EXPIRE_DAYS 365
-
-struct SignedCert {
-    uint8_t magic_cert[4];
-    uint8_t version_major[2];
-    uint8_t version_minor[2];
-
-    // Signed Content
-    uint8_t signed_content[64];
-    uint8_t server_publickey[crypto_box_PUBLICKEYBYTES];
-    uint8_t magic_query[8];
-    uint8_t serial[4];
-    uint8_t ts_begin[4];
-    uint8_t ts_end[4];
-};
-
-
-#endif

dnscrypt/dnscrypt.h

@@ -1,175 +0,0 @@
-#ifndef UNBOUND_DNSCRYPT_H
-#define UNBOUND_DNSCRYPT_H
-
-/**
- * \file
- * dnscrypt functions for encrypting DNS packets.
- */
-
-#include "dnscrypt/dnscrypt_config.h"
-#ifdef USE_DNSCRYPT
-
-#define DNSCRYPT_MAGIC_HEADER_LEN 8U
-#define DNSCRYPT_MAGIC_RESPONSE  "r6fnvWj8"
-
-#ifndef DNSCRYPT_MAX_PADDING
-# define DNSCRYPT_MAX_PADDING 256U
-#endif
-#ifndef DNSCRYPT_BLOCK_SIZE
-# define DNSCRYPT_BLOCK_SIZE 64U
-#endif
-#ifndef DNSCRYPT_MIN_PAD_LEN
-# define DNSCRYPT_MIN_PAD_LEN 8U
-#endif
-
-#define crypto_box_HALF_NONCEBYTES (crypto_box_NONCEBYTES / 2U)
-
-#include "config.h"
-#include "dnscrypt/cert.h"
-#include "util/locks.h"
-
-#define DNSCRYPT_QUERY_HEADER_SIZE \
-    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_PUBLICKEYBYTES + crypto_box_HALF_NONCEBYTES + crypto_box_MACBYTES)
-#define DNSCRYPT_RESPONSE_HEADER_SIZE \
-    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_NONCEBYTES + crypto_box_MACBYTES)
-
-#define DNSCRYPT_REPLY_HEADER_SIZE \
-    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_HALF_NONCEBYTES * 2 + crypto_box_MACBYTES)
-
-struct sldns_buffer;
-struct config_file;
-struct comm_reply;
-struct slabhash;
-
-typedef struct KeyPair_ {
-    uint8_t crypt_publickey[crypto_box_PUBLICKEYBYTES];
-    uint8_t crypt_secretkey[crypto_box_SECRETKEYBYTES];
-} KeyPair;
-
-typedef struct cert_ {
-    uint8_t magic_query[DNSCRYPT_MAGIC_HEADER_LEN];
-    uint8_t es_version[2];
-    KeyPair *keypair;
-} dnsccert;
-
-struct dnsc_env {
-	struct SignedCert *signed_certs;
-	struct SignedCert **rotated_certs;
-	dnsccert *certs;
-	size_t signed_certs_count;
-	size_t rotated_certs_count;
-	uint8_t provider_publickey[crypto_sign_ed25519_PUBLICKEYBYTES];
-	uint8_t provider_secretkey[crypto_sign_ed25519_SECRETKEYBYTES];
-	KeyPair *keypairs;
-	size_t keypairs_count;
-	uint64_t nonce_ts_last;
-	unsigned char hash_key[crypto_shorthash_KEYBYTES];
-	char * provider_name;
-
-    /** Caches */
-	struct slabhash *shared_secrets_cache;
-	/** lock on shared secret cache counters */
-	lock_basic_type shared_secrets_cache_lock;
-	/** number of misses from shared_secrets_cache */
-	size_t num_query_dnscrypt_secret_missed_cache;
-
-	/** slabhash keeping track of nonce/cient pk/server sk pairs. */
-	struct slabhash *nonces_cache;
-	/** lock on nonces_cache, used to avoid race condition in updating the hash */
-	lock_basic_type nonces_cache_lock;
-	/** number of replayed queries */
-	size_t num_query_dnscrypt_replay;
-};
-
-struct dnscrypt_query_header {
-    uint8_t magic_query[DNSCRYPT_MAGIC_HEADER_LEN];
-    uint8_t publickey[crypto_box_PUBLICKEYBYTES];
-    uint8_t nonce[crypto_box_HALF_NONCEBYTES];
-    uint8_t mac[crypto_box_MACBYTES];
-};
-
-/**
- * Initialize DNSCrypt environment.
- * Initialize sodium library and allocate the dnsc_env structure.
- * \return an uninitialized struct dnsc_env.
- */
-struct dnsc_env * dnsc_create(void);
-
-/**
- * Apply configuration.
- * Read certificates and secret keys from configuration. Initialize hashkey and
- * provider name as well as loading cert TXT records.
- * In case of issue applying configuration, this function fatals.
- * \param[in] env the struct dnsc_env to populate.
- * \param[in] cfg the config_file struct with dnscrypt options.
- * \return 0 on success.
- */
-int dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg);
-
-/**
- * Delete DNSCrypt environment
- *
- */
-void dnsc_delete(struct dnsc_env *env);
-
-/**
- * handle a crypted dnscrypt request.
- * Determine wether or not a query is coming over the dnscrypt listener and
- * attempt to uncurve it or detect if it is a certificate query.
- * return 0 in case of failure.
- */
-int dnsc_handle_curved_request(struct dnsc_env* dnscenv,
-                               struct comm_reply* repinfo);
-/**
- * handle an unencrypted dnscrypt request.
- * Determine wether or not a query is going over the dnscrypt channel and
- * attempt to curve it unless it was not crypted like when  it is a
- * certificate query.
- * \return 0 in case of failure.
- */
-
-int dnsc_handle_uncurved_request(struct comm_reply *repinfo);
-
-/**
- * Computes the size of the shared secret cache entry.
- */
-size_t dnsc_shared_secrets_sizefunc(void *k, void *d);
-
-/**
- * Compares two shared secret cache keys.
- */
-int dnsc_shared_secrets_compfunc(void *m1, void *m2);
-
-/**
- * Function to delete a shared secret cache key.
- */
-void dnsc_shared_secrets_delkeyfunc(void *k, void* arg);
-
-/**
- * Function to delete a share secret cache value.
- */
-void dnsc_shared_secrets_deldatafunc(void* d, void* arg);
-
-/**
- * Computes the size of the nonce cache entry.
- */
-size_t dnsc_nonces_sizefunc(void *k, void *d);
-
-/**
- * Compares two nonce cache keys.
- */
-int dnsc_nonces_compfunc(void *m1, void *m2);
-
-/**
- * Function to delete a nonce cache key.
- */
-void dnsc_nonces_delkeyfunc(void *k, void* arg);
-
-/**
- * Function to delete a nonce cache value.
- */
-void dnsc_nonces_deldatafunc(void* d, void* arg);
-
-
-#endif /* USE_DNSCRYPT */
-#endif

dnscrypt/dnscrypt.m4

@@ -1,44 +0,0 @@
-# dnscrypt.m4
-
-# dnsc_DNSCRYPT([action-if-true], [action-if-false])
-# --------------------------------------------------------------------------
-# Check for required dnscrypt libraries and add dnscrypt configure args.
-AC_DEFUN([dnsc_DNSCRYPT],
-[
-  AC_ARG_ENABLE([dnscrypt],
-    AS_HELP_STRING([--enable-dnscrypt],
-                   [Enable dnscrypt support (requires libsodium)]),
-    [opt_dnscrypt=$enableval], [opt_dnscrypt=no])
-
-  if test "x$opt_dnscrypt" != "xno"; then
-    AC_ARG_WITH([libsodium], AC_HELP_STRING([--with-libsodium=path],
-    	[Path where libsodium is installed, for dnscrypt]), [
-	CFLAGS="$CFLAGS -I$withval/include"
-	LDFLAGS="$LDFLAGS -L$withval/lib"
-    ])
-    AC_SEARCH_LIBS([sodium_init], [sodium], [],
-      AC_MSG_ERROR([The sodium library was not found. Please install sodium!]))
-    AC_SEARCH_LIBS([crypto_box_curve25519xchacha20poly1305_beforenm], [sodium],
-        [
-            AC_SUBST([ENABLE_DNSCRYPT_XCHACHA20], [1])
-            AC_DEFINE(
-                [USE_DNSCRYPT_XCHACHA20], [1],
-                [Define to 1 to enable dnscrypt with xchacha20 support])
-        ],
-        [
-            AC_SUBST([ENABLE_DNSCRYPT_XCHACHA20], [0])
-        ])
-    AC_SEARCH_LIBS([sodium_set_misuse_handler], [sodium],
-        [
-            AC_DEFINE(
-                [SODIUM_MISUSE_HANDLER], [1],
-                [Define to 1 if libsodium supports sodium_set_misuse_handler])
-        ],
-        [
-        ])
-    $1
-  else
-    AC_SUBST([ENABLE_DNSCRYPT_XCHACHA20], [0])
-    $2
-  fi
-])