update windows icon, larger and with transparency.

git-svn-id: file:///svn/unbound/tags/release-1.8.2@5011 be551aaa-1e26-0410-a405-d3ace91eadb9
release 1.8.2 tag
2026-08-17 21:25:50 +02:00 · 2018-12-04 08:25:57 +00:00 · 2018-12-04 08:24:35 +00:00 · 2018-11-29 08:45:05 +00:00 · 2018-11-29 08:27:47 +00:00 · 2018-11-29 08:27:22 +00:00
79 changed files with 6349 additions and 4871 deletions
@@ -36,4 +36,7 @@
 /streamtcp
 /testbound
 /unittest
+/contrib/libunbound.pc
+/contrib/unbound.service
+/contrib/unbound.socket

@@ -663,6 +663,9 @@
 /* Define as the return type of signal handlers (`int' or `void'). */
 #undef RETSIGTYPE

+/* if REUSEPORT is enabled by default */
+#undef REUSEPORT_DEFAULT
+
 /* default rootkey location */
 #undef ROOT_ANCHOR_FILE

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.8.1.
+# Generated by GNU Autoconf 2.69 for unbound 1.8.2.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.8.1'
-PACKAGE_STRING='unbound 1.8.1'
+PACKAGE_VERSION='1.8.2'
+PACKAGE_STRING='unbound 1.8.2'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''

@@ -1440,7 +1440,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures unbound 1.8.1 to adapt to many kinds of systems.
+\`configure' configures unbound 1.8.2 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1505,7 +1505,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.8.1:";;
+     short | recursive ) echo "Configuration of unbound 1.8.2:";;
   esac
  cat <<\_ACEOF

@@ -1722,7 +1722,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-unbound configure 1.8.1
+unbound configure 1.8.2
 generated by GNU Autoconf 2.69

 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2431,7 +2431,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by unbound $as_me 1.8.1, which was
+It was created by unbound $as_me 1.8.2, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  $ $0 $@
@@ -2783,11 +2783,11 @@ UNBOUND_VERSION_MAJOR=1

 UNBOUND_VERSION_MINOR=8

-UNBOUND_VERSION_MICRO=1
+UNBOUND_VERSION_MICRO=2


 LIBUNBOUND_CURRENT=8
-LIBUNBOUND_REVISION=1
+LIBUNBOUND_REVISION=2
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2852,6 +2852,7 @@ LIBUNBOUND_AGE=0
 # 1.7.3 had 7:11:5
 # 1.8.0 had 8:0:0 # changes the event callback function signature
 # 1.8.1 had 8:1:0
+# 1.8.2 had 8:2:0

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -15966,6 +15967,17 @@ fi
 done


+# check if we can use SO_REUSEPORT
+if echo "$host" | grep -i -e linux -e dragonfly >/dev/null; then
+
+$as_echo "#define REUSEPORT_DEFAULT 1" >>confdefs.h
+
+else
+
+$as_echo "#define REUSEPORT_DEFAULT 0" >>confdefs.h
+
+fi
+
 # set memory allocation checking if requested
 # Check whether --enable-alloc-checks was given.
 if test "${enable_alloc_checks+set}" = set; then :
@@ -21134,7 +21146,7 @@ _ACEOF



-version=1.8.1
+version=1.8.2

 date=`date +'%b %e, %Y'`

@@ -21653,7 +21665,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.8.1, which was
+This file was extended by unbound $as_me 1.8.2, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -21719,7 +21731,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.8.1
+unbound config.status 1.8.2
 configured by $0, generated by GNU Autoconf 2.69,
  with options \\"\$ac_cs_config\\"

@@ -11,14 +11,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[8])
-m4_define([VERSION_MICRO],[1])
+m4_define([VERSION_MICRO],[2])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=8
-LIBUNBOUND_REVISION=1
+LIBUNBOUND_REVISION=2
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -83,6 +83,7 @@ LIBUNBOUND_AGE=0
 # 1.7.3 had 7:11:5
 # 1.8.0 had 8:0:0 # changes the event callback function signature
 # 1.8.1 had 8:1:0
+# 1.8.2 had 8:2:0

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -461,6 +462,13 @@ ACX_CHECK_NONBLOCKING_BROKEN
 ACX_MKDIR_ONE_ARG
 AC_CHECK_FUNCS([strptime],[AC_CHECK_STRPTIME_WORKS],[AC_LIBOBJ([strptime])])

+# check if we can use SO_REUSEPORT
+if echo "$host" | grep -i -e linux -e dragonfly >/dev/null; then
+	AC_DEFINE(REUSEPORT_DEFAULT, 1, [if REUSEPORT is enabled by default])
+else
+	AC_DEFINE(REUSEPORT_DEFAULT, 0, [if REUSEPORT is enabled by default])
+fi
+
 # set memory allocation checking if requested
 AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
 	[ enable to memory allocation statistics, for debug purposes ]), 
@@ -1,15 +1,11 @@
 Description: based on the included patch contrib/fastrpz.patch
 Author: fastrpz@farsightsecurity.com
 ---
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+Index: unboundfastrpz/Makefile.in
 ===================================================================
-RCS file: ./RCS/Makefile.in,v
-retrieving revision 1.1
-Index: unbound-1.7.0~rc1/Makefile.in
-===================================================================
--- unbound-1.7.0~rc1.orig/Makefile.in
-+++ unbound-1.7.0~rc1/Makefile.in
-@@ -23,6 +23,8 @@ CHECKLOCK_SRC=testcode/checklocks.c
+--- unboundfastrpz/Makefile.in	(revision 4987)
+++ unboundfastrpz/Makefile.in	(working copy)
+@@ -23,6 +23,8 @@
 CHECKLOCK_OBJ=@CHECKLOCK_OBJ@
 DNSTAP_SRC=@DNSTAP_SRC@
 DNSTAP_OBJ=@DNSTAP_OBJ@
@@ -18,7 +14,7 @@ Index: unbound-1.7.0~rc1/Makefile.in
 DNSCRYPT_SRC=@DNSCRYPT_SRC@
 DNSCRYPT_OBJ=@DNSCRYPT_OBJ@
 WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
-@@ -125,7 +127,7 @@ validator/val_sigcrypt.c validator/val_u
+@@ -126,7 +128,7 @@
 edns-subnet/edns-subnet.c edns-subnet/subnetmod.c \
 edns-subnet/addrtree.c edns-subnet/subnet-whitelist.c \
 cachedb/cachedb.c cachedb/redis.c respip/respip.c $(CHECKLOCK_SRC) \
@@ -27,16 +23,16 @@ Index: unbound-1.7.0~rc1/Makefile.in
 COMMON_OBJ_WITHOUT_NETCALL=dns.lo infra.lo rrset.lo dname.lo msgencode.lo \
 as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
 iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
-@@ -137,7 +139,7 @@ slabhash.lo timehist.lo tube.lo winsock_
+@@ -139,7 +141,7 @@
 validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
- val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo authzone.lo\
+ val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo redis.lo authzone.lo \
 $(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
 -$(IPSECMOD_OBJ) respip.lo
 +$(FASTRPZ_OBJ) $(IPSECMOD_OBJ) respip.lo
 COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
 outside_network.lo
 COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
-@@ -400,6 +402,11 @@ dnscrypt.lo dnscrypt.o: $(srcdir)/dnscry
+@@ -405,6 +407,11 @@
 	$(srcdir)/util/config_file.h $(srcdir)/util/log.h \
 	$(srcdir)/util/netevent.h
 
@@ -48,11 +44,11 @@ Index: unbound-1.7.0~rc1/Makefile.in
 # Python Module
 pythonmod.lo pythonmod.o: $(srcdir)/pythonmod/pythonmod.c config.h \
 	pythonmod/interface.h \
-Index: unbound-1.7.0~rc1/config.h.in
+Index: unboundfastrpz/config.h.in
 ===================================================================
--- unbound-1.7.0~rc1.orig/config.h.in
-+++ unbound-1.7.0~rc1/config.h.in
-@@ -1228,4 +1228,11 @@ void *unbound_stat_realloc_log(void *ptr
+--- unboundfastrpz/config.h.in	(revision 4987)
+++ unboundfastrpz/config.h.in	(working copy)
+@@ -1275,4 +1275,11 @@
 /** the version of unbound-control that this software implements */
 #define UNBOUND_CONTROL_VERSION 1
 
@@ -65,11 +61,11 @@ Index: unbound-1.7.0~rc1/config.h.in
 +#undef FASTRPZ_LIB_OPEN
 +/** turn on fastrpz response policy zones */
 +#undef ENABLE_FASTRPZ
-Index: unbound-1.7.0~rc1/configure.ac
+Index: unboundfastrpz/configure.ac
 ===================================================================
--- unbound-1.7.0~rc1.orig/configure.ac
-+++ unbound-1.7.0~rc1/configure.ac
-@@ -6,6 +6,7 @@ sinclude(ax_pthread.m4)
+--- unboundfastrpz/configure.ac	(revision 4987)
+++ unboundfastrpz/configure.ac	(working copy)
+@@ -6,6 +6,7 @@
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 sinclude(dnstap/dnstap.m4)
@@ -77,7 +73,7 @@ Index: unbound-1.7.0~rc1/configure.ac
 sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
-@@ -1453,6 +1454,9 @@ case "$enable_ipsecmod" in
+@@ -1573,6 +1574,9 @@
 		;;
 esac
 
@@ -87,11 +83,11 @@ Index: unbound-1.7.0~rc1/configure.ac
 AC_MSG_CHECKING([if ${MAKE:-make} supports $< with implicit rule in scope])
 # on openBSD, the implicit rule make $< work.
 # on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
-Index: unbound-1.7.0~rc1/daemon/daemon.c
+Index: unboundfastrpz/daemon/daemon.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/daemon/daemon.c
-+++ unbound-1.7.0~rc1/daemon/daemon.c
-@@ -90,6 +90,9 @@
+--- unboundfastrpz/daemon/daemon.c	(revision 4987)
+++ unboundfastrpz/daemon/daemon.c	(working copy)
+@@ -91,6 +91,9 @@
 #include "sldns/keyraw.h"
 #include "respip/respip.h"
 #include <signal.h>
@@ -101,7 +97,7 @@ Index: unbound-1.7.0~rc1/daemon/daemon.c
 
 #ifdef HAVE_SYSTEMD
 #include <systemd/sd-daemon.h>
-@@ -461,6 +464,14 @@ daemon_create_workers(struct daemon* dae
+@@ -462,6 +465,14 @@
 		fatal_exit("dnstap enabled in config but not built with dnstap support");
 #endif
 	}
@@ -116,9 +112,9 @@ Index: unbound-1.7.0~rc1/daemon/daemon.c
 	for(i=0; i<daemon->num; i++) {
 		if(!(daemon->workers[i] = worker_create(daemon, i,
 			shufport+numport*i/daemon->num, 
-@@ -710,6 +721,9 @@ daemon_cleanup(struct daemon* daemon)
- #ifdef USE_DNSCRYPT
+@@ -719,6 +730,9 @@
 	dnsc_delete(daemon->dnscenv);
+ 	daemon->dnscenv = NULL;
 #endif
 +#ifdef ENABLE_FASTRPZ
 +	rpz_delete(&daemon->rpz_clist, &daemon->rpz_client);
@@ -126,11 +122,11 @@ Index: unbound-1.7.0~rc1/daemon/daemon.c
 	daemon->cfg = NULL;
 }
 
-Index: unbound-1.7.0~rc1/daemon/daemon.h
+Index: unboundfastrpz/daemon/daemon.h
 ===================================================================
--- unbound-1.7.0~rc1.orig/daemon/daemon.h
-+++ unbound-1.7.0~rc1/daemon/daemon.h
-@@ -134,6 +134,11 @@ struct daemon {
+--- unboundfastrpz/daemon/daemon.h	(revision 4987)
+++ unboundfastrpz/daemon/daemon.h	(working copy)
+@@ -136,6 +136,11 @@
 	/** the dnscrypt environment */
 	struct dnsc_env* dnscenv;
 #endif
@@ -142,11 +138,11 @@ Index: unbound-1.7.0~rc1/daemon/daemon.h
 };
 
 /**
-Index: unbound-1.7.0~rc1/daemon/worker.c
+Index: unboundfastrpz/daemon/worker.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/daemon/worker.c
-+++ unbound-1.7.0~rc1/daemon/worker.c
-@@ -74,6 +74,9 @@
+--- unboundfastrpz/daemon/worker.c	(revision 4987)
+++ unboundfastrpz/daemon/worker.c	(working copy)
+@@ -75,6 +75,9 @@
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
 #include "sldns/sbuffer.h"
@@ -156,7 +152,7 @@ Index: unbound-1.7.0~rc1/daemon/worker.c
 #include "sldns/wire2str.h"
 #include "util/shm_side/shm_main.h"
 #include "dnscrypt/dnscrypt.h"
-@@ -527,8 +530,27 @@ answer_norec_from_cache(struct worker* w
+@@ -533,8 +536,27 @@
 			/* not secure */
 			secure = 0;
 			break;
@@ -182,9 +178,9 @@ Index: unbound-1.7.0~rc1/daemon/worker.c
 +	}
 +#endif
 	/* return this delegation from the cache */
+ 	edns_bak = *edns;
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
- 	edns->udp_size = EDNS_ADVERTISED_SIZE;
-@@ -689,6 +711,23 @@ answer_from_cache(struct worker* worker,
+@@ -702,6 +724,23 @@
 			secure = 0;
 		}
 	} else	secure = 0;
@@ -206,9 +202,9 @@ Index: unbound-1.7.0~rc1/daemon/worker.c
 +        }
 +#endif
 
+ 	edns_bak = *edns;
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
- 	edns->udp_size = EDNS_ADVERTISED_SIZE;
-@@ -1291,6 +1330,15 @@ worker_handle_request(struct comm_point*
+@@ -1407,6 +1446,15 @@
 		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
 			&repinfo->addr, repinfo->addrlen);
 		goto send_reply;
@@ -224,7 +220,7 @@ Index: unbound-1.7.0~rc1/daemon/worker.c
 	}
 
 	/* If we've found a local alias, replace the qname with the alias
-@@ -1339,12 +1387,21 @@ lookup_cache:
+@@ -1455,12 +1503,21 @@
 		h = query_info_hash(lookup_qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
 		if((e=slabhash_lookup(worker->env.msg_cache, h, lookup_qinfo, 0))) {
 			/* answer from cache - we have acquired a readlock on it */
@@ -248,7 +244,7 @@ Index: unbound-1.7.0~rc1/daemon/worker.c
 				/* prefetch it if the prefetch TTL expired.
 				 * Note that if there is more than one pass
 				 * its qname must be that used for cache
-@@ -1398,11 +1455,19 @@ lookup_cache:
+@@ -1514,11 +1571,19 @@
 			lock_rw_unlock(&e->lock);
 		}
 		if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
@@ -270,11 +266,11 @@ Index: unbound-1.7.0~rc1/daemon/worker.c
 				goto send_reply;
 			}
 			verbose(VERB_ALGO, "answer norec from cache -- "
-Index: unbound-1.7.0~rc1/doc/unbound.conf.5.in
+Index: unboundfastrpz/doc/unbound.conf.5.in
 ===================================================================
--- unbound-1.7.0~rc1.orig/doc/unbound.conf.5.in
-+++ unbound-1.7.0~rc1/doc/unbound.conf.5.in
-@@ -1705,6 +1705,81 @@ It must be /96 or shorter.  The default
+--- unboundfastrpz/doc/unbound.conf.5.in	(revision 4987)
+++ unboundfastrpz/doc/unbound.conf.5.in	(working copy)
+@@ -1745,6 +1745,81 @@
 used by dns64 processing instead.  Can be entered multiple times, list a
 new domain for which it applies, one per line.  Applies also to names
 underneath the name given.
@@ -356,10 +352,10 @@ Index: unbound-1.7.0~rc1/doc/unbound.conf.5.in
 .SS "DNSCrypt Options"
 .LP
 The
-Index: unbound-1.7.0~rc1/fastrpz/librpz.h
+Index: unboundfastrpz/fastrpz/librpz.h
 ===================================================================
--- /dev/null
-+++ unbound-1.7.0~rc1/fastrpz/librpz.h
+--- unboundfastrpz/fastrpz/librpz.h	(nonexistent)
+++ unboundfastrpz/fastrpz/librpz.h	(working copy)
@@ -0,0 +1,957 @@
 +/*
 + * Define the interface from a DNS resolver to the Response Policy Zone
@@ -1318,11 +1314,11 @@ Index: unbound-1.7.0~rc1/fastrpz/librpz.h
 +#endif /* LIBRPZ_LIB_OPEN */
 +
 +#endif /* LIBRPZ_H */
-Index: unbound-1.7.0~rc1/fastrpz/rpz.c
+Index: unboundfastrpz/fastrpz/rpz.c
 ===================================================================
--- /dev/null
-+++ unbound-1.7.0~rc1/fastrpz/rpz.c
-@@ -0,0 +1,1357 @@
+--- unboundfastrpz/fastrpz/rpz.c	(nonexistent)
+++ unboundfastrpz/fastrpz/rpz.c	(working copy)
+@@ -0,0 +1,1352 @@
 +/*
 + * fastrpz/rpz.c - interface to the fastrpz response policy zone library
 + *
@@ -1438,8 +1434,6 @@ Index: unbound-1.7.0~rc1/fastrpz/rpz.c
 +static void
 +log_fnc(librpz_log_level_t level, void* ATTR_UNUSED(ctx), const char* buf)
 +{
-+	char label_buf[sizeof("rpz ")+8];
-+
 +	/* Setting librpz_log_level overrides the unbound "verbose" level. */
 +	if(level > LIBRPZ_LOG_TRACE1 &&
 +	   level <= librpz->log_level_val(LIBRPZ_LOG_INVALID))
@@ -1949,12 +1943,9 @@ Index: unbound-1.7.0~rc1/fastrpz/rpz.c
 +	case st_ck_ns:
 +		/* An NSDNAME or NSIP check failed for lack of cached data. */
 +		return false;
-+#pragma clang diagnostic push
-+#pragma clang diagnostic ignored "-Wunreachable-code"
 +	default:
 +		fatal_exit("impossible RPZ state %d in rpz_worker_cache()",
 +			   rpz->st);
-+#pragma clang diagnostic pop
 +	}
 +
 +	/* Wait for a trigger. */
@@ -2680,10 +2671,10 @@ Index: unbound-1.7.0~rc1/fastrpz/rpz.c
 +}
 +
 +#endif /* ENABLE_FASTRPZ */
-Index: unbound-1.7.0~rc1/fastrpz/rpz.h
+Index: unboundfastrpz/fastrpz/rpz.h
 ===================================================================
--- /dev/null
-+++ unbound-1.7.0~rc1/fastrpz/rpz.h
+--- unboundfastrpz/fastrpz/rpz.h	(nonexistent)
+++ unboundfastrpz/fastrpz/rpz.h	(working copy)
@@ -0,0 +1,138 @@
 +/*
 + * fastrpz/rpz.h - interface to the fastrpz response policy zone library
@@ -2823,10 +2814,10 @@ Index: unbound-1.7.0~rc1/fastrpz/rpz.h
 +
 +#endif /* ENABLE_FASTRPZ */
 +#endif /* UNBOUND_FASTRPZ_RPZ_H */
-Index: unbound-1.7.0~rc1/fastrpz/rpz.m4
+Index: unboundfastrpz/fastrpz/rpz.m4
 ===================================================================
--- /dev/null
-+++ unbound-1.7.0~rc1/fastrpz/rpz.m4
+--- unboundfastrpz/fastrpz/rpz.m4	(nonexistent)
+++ unboundfastrpz/fastrpz/rpz.m4	(working copy)
@@ -0,0 +1,64 @@
 +# fastrpz/rpz.m4
 +
@@ -2892,10 +2883,10 @@ Index: unbound-1.7.0~rc1/fastrpz/rpz.m4
 +    AC_MSG_WARN([[dlopen and librpz.so needed for fastrpz]])
 +  fi
 +])
-Index: unbound-1.7.0~rc1/iterator/iterator.c
+Index: unboundfastrpz/iterator/iterator.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/iterator/iterator.c
-+++ unbound-1.7.0~rc1/iterator/iterator.c
+--- unboundfastrpz/iterator/iterator.c	(revision 4987)
+++ unboundfastrpz/iterator/iterator.c	(working copy)
@@ -68,6 +68,9 @@
 #include "sldns/str2wire.h"
 #include "sldns/parseutil.h"
@@ -2904,9 +2895,9 @@ Index: unbound-1.7.0~rc1/iterator/iterator.c
 +#include "fastrpz/rpz.h"
 +#endif
 
- int 
- iter_init(struct module_env* env, int id)
-@@ -511,6 +514,23 @@ handle_cname_response(struct module_qsta
+ /* in msec */
+ int UNKNOWN_SERVER_NICENESS = 376;
+@@ -551,6 +554,23 @@
 		if(ntohs(r->rk.type) == LDNS_RR_TYPE_CNAME &&
 			query_dname_compare(*mname, r->rk.dname) == 0 &&
 			!iter_find_rrset_in_prepend_answer(iq, r)) {
@@ -2930,7 +2921,7 @@ Index: unbound-1.7.0~rc1/iterator/iterator.c
 			/* Add this relevant CNAME rrset to the prepend list.*/
 			if(!iter_add_prepend_answer(qstate, iq, r))
 				return 0;
-@@ -519,6 +539,9 @@ handle_cname_response(struct module_qsta
+@@ -559,6 +579,9 @@
 
 		/* Other rrsets in the section are ignored. */
 	}
@@ -2940,7 +2931,7 @@ Index: unbound-1.7.0~rc1/iterator/iterator.c
 	/* add authority rrsets to authority prepend, for wildcarded CNAMEs */
 	for(i=msg->rep->an_numrrsets; i<msg->rep->an_numrrsets +
 		msg->rep->ns_numrrsets; i++) {
-@@ -1148,6 +1171,7 @@ processInitRequest(struct module_qstate*
+@@ -1195,6 +1218,7 @@
 	uint8_t* delname;
 	size_t delnamelen;
 	struct dns_msg* msg = NULL;
@@ -2948,7 +2939,7 @@ Index: unbound-1.7.0~rc1/iterator/iterator.c
 
 	log_query_info(VERB_DETAIL, "resolving", &qstate->qinfo);
 	/* check effort */
-@@ -1223,8 +1247,7 @@ processInitRequest(struct module_qstate*
+@@ -1281,8 +1305,7 @@
 	}
 	if(msg) {
 		/* handle positive cache response */
@@ -2958,7 +2949,7 @@ Index: unbound-1.7.0~rc1/iterator/iterator.c
 		if(verbosity >= VERB_ALGO) {
 			log_dns_msg("msg from cache lookup", &msg->qinfo, 
 				msg->rep);
-@@ -1232,7 +1255,22 @@ processInitRequest(struct module_qstate*
+@@ -1290,7 +1313,22 @@
 				(int)msg->rep->ttl, 
 				(int)msg->rep->prefetch_ttl);
 		}
@@ -2981,7 +2972,7 @@ Index: unbound-1.7.0~rc1/iterator/iterator.c
 		if(type == RESPONSE_TYPE_CNAME) {
 			uint8_t* sname = 0;
 			size_t slen = 0;
-@@ -2552,6 +2590,62 @@ processQueryResponse(struct module_qstat
+@@ -2695,6 +2733,62 @@
 			sock_list_insert(&qstate->reply_origin, 
 				&qstate->reply->addr, qstate->reply->addrlen, 
 				qstate->region);
@@ -3041,10 +3032,10 @@ Index: unbound-1.7.0~rc1/iterator/iterator.c
 +			}
 +		}
 +#endif
- 		if(iq->minimisation_state != DONOT_MINIMISE_STATE) {
+ 		if(iq->minimisation_state != DONOT_MINIMISE_STATE
+ 			&& !(iq->chase_flags & BIT_RD)) {
 			if(FLAGS_GET_RCODE(iq->response->rep->flags) != 
- 				LDNS_RCODE_NOERROR) {
-@@ -3273,12 +3367,44 @@ processFinished(struct module_qstate* qs
+@@ -3441,6 +3535,10 @@
 		 * but only if we did recursion. The nonrecursion referral
 		 * from cache does not need to be stored in the msg cache. */
 		if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) {
@@ -3055,6 +3046,7 @@ Index: unbound-1.7.0~rc1/iterator/iterator.c
 			iter_dns_store(qstate->env, &qstate->qinfo, 
 				iq->response->rep, 0, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS,
+@@ -3447,6 +3545,34 @@
 				qstate->region, qstate->query_flags);
 		}
 	}
@@ -3089,11 +3081,11 @@ Index: unbound-1.7.0~rc1/iterator/iterator.c
 	qstate->return_rcode = LDNS_RCODE_NOERROR;
 	qstate->return_msg = iq->response;
 	return 0;
-Index: unbound-1.7.0~rc1/iterator/iterator.h
+Index: unboundfastrpz/iterator/iterator.h
 ===================================================================
--- unbound-1.7.0~rc1.orig/iterator/iterator.h
-+++ unbound-1.7.0~rc1/iterator/iterator.h
-@@ -383,6 +383,16 @@ struct iter_qstate {
+--- unboundfastrpz/iterator/iterator.h	(revision 4987)
+++ unboundfastrpz/iterator/iterator.h	(working copy)
+@@ -386,6 +386,16 @@
 	 */
 	int minimise_count;
 
@@ -3110,11 +3102,11 @@ Index: unbound-1.7.0~rc1/iterator/iterator.h
 	/**
 	 * Count number of time-outs. Used to prevent resolving failures when
 	 * the QNAME minimisation QTYPE is blocked. */
-Index: unbound-1.7.0~rc1/services/cache/dns.c
+Index: unboundfastrpz/services/cache/dns.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/services/cache/dns.c
-+++ unbound-1.7.0~rc1/services/cache/dns.c
-@@ -876,6 +876,14 @@ dns_cache_store(struct module_env* env,
+--- unboundfastrpz/services/cache/dns.c	(revision 4987)
+++ unboundfastrpz/services/cache/dns.c	(working copy)
+@@ -939,6 +939,14 @@
 	struct regional* region, uint32_t flags)
 {
 	struct reply_info* rep = NULL;
@@ -3129,11 +3121,11 @@ Index: unbound-1.7.0~rc1/services/cache/dns.c
 	/* alloc, malloc properly (not in region, like msg is) */
 	rep = reply_info_copy(msgrep, env->alloc, NULL);
 	if(!rep)
-Index: unbound-1.7.0~rc1/services/mesh.c
+Index: unboundfastrpz/services/mesh.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/services/mesh.c
-+++ unbound-1.7.0~rc1/services/mesh.c
-@@ -59,6 +59,9 @@
+--- unboundfastrpz/services/mesh.c	(revision 4987)
+++ unboundfastrpz/services/mesh.c	(working copy)
+@@ -60,6 +60,9 @@
 #include "sldns/wire2str.h"
 #include "services/localzone.h"
 #include "util/data/dname.h"
@@ -3143,7 +3135,7 @@ Index: unbound-1.7.0~rc1/services/mesh.c
 #include "respip/respip.h"
 
 /** subtract timers and the values do not overflow or become negative */
-@@ -1050,6 +1053,13 @@ mesh_send_reply(struct mesh_state* m, in
+@@ -1057,6 +1060,13 @@
 	else	secure = 0;
 	if(!rep && rcode == LDNS_RCODE_NOERROR)
 		rcode = LDNS_RCODE_SERVFAIL;
@@ -3157,7 +3149,7 @@ Index: unbound-1.7.0~rc1/services/mesh.c
 	/* send the reply */
 	/* We don't reuse the encoded answer if either the previous or current
 	 * response has a local alias.  We could compare the alias records
-@@ -1199,6 +1209,7 @@ struct mesh_state* mesh_area_find(struct
+@@ -1230,6 +1240,7 @@
 	key.s.is_valrec = valrec;
 	key.s.qinfo = *qinfo;
 	key.s.query_flags = qflags;
@@ -3165,7 +3157,7 @@ Index: unbound-1.7.0~rc1/services/mesh.c
 	/* We are searching for a similar mesh state when we DO want to
 	 * aggregate the state. Thus unique is set to NULL. (default when we
 	 * desire aggregation).*/
-@@ -1245,6 +1256,10 @@ int mesh_state_add_reply(struct mesh_sta
+@@ -1276,6 +1287,10 @@
 	if(!r)
 		return 0;
 	r->query_reply = *rep;
@@ -3176,11 +3168,11 @@ Index: unbound-1.7.0~rc1/services/mesh.c
 	r->edns = *edns;
 	if(edns->opt_list) {
 		r->edns.opt_list = edns_opt_copy_region(edns->opt_list,
-Index: unbound-1.7.0~rc1/util/config_file.c
+Index: unboundfastrpz/util/config_file.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/util/config_file.c
-+++ unbound-1.7.0~rc1/util/config_file.c
-@@ -1323,6 +1323,8 @@ config_delete(struct config_file* cfg)
+--- unboundfastrpz/util/config_file.c	(revision 4987)
+++ unboundfastrpz/util/config_file.c	(working copy)
+@@ -1401,6 +1401,8 @@
 	free(cfg->dnstap_socket_path);
 	free(cfg->dnstap_identity);
 	free(cfg->dnstap_version);
@@ -3189,11 +3181,11 @@ Index: unbound-1.7.0~rc1/util/config_file.c
 	config_deldblstrlist(cfg->ratelimit_for_domain);
 	config_deldblstrlist(cfg->ratelimit_below_domain);
 #ifdef USE_IPSECMOD
-Index: unbound-1.7.0~rc1/util/config_file.h
+Index: unboundfastrpz/util/config_file.h
 ===================================================================
--- unbound-1.7.0~rc1.orig/util/config_file.h
-+++ unbound-1.7.0~rc1/util/config_file.h
-@@ -431,6 +431,11 @@ struct config_file {
+--- unboundfastrpz/util/config_file.h	(revision 4987)
+++ unboundfastrpz/util/config_file.h	(working copy)
+@@ -480,6 +480,11 @@
 	/** true to disable DNSSEC lameness check in iterator */
 	int disable_dnssec_lame_check;
 
@@ -3205,11 +3197,11 @@ Index: unbound-1.7.0~rc1/util/config_file.h
 	/** ratelimit for ip addresses. 0 is off, otherwise qps (unless overridden) */
 	int ip_ratelimit;
 	/** number of slabs for ip_ratelimit cache */
-Index: unbound-1.7.0~rc1/util/configlexer.lex
+Index: unboundfastrpz/util/configlexer.lex
 ===================================================================
--- unbound-1.7.0~rc1.orig/util/configlexer.lex
-+++ unbound-1.7.0~rc1/util/configlexer.lex
-@@ -412,6 +412,10 @@ dnstap-log-forwarder-query-messages{COLO
+--- unboundfastrpz/util/configlexer.lex	(revision 4987)
+++ unboundfastrpz/util/configlexer.lex	(working copy)
+@@ -434,6 +434,10 @@
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
 dnstap-log-forwarder-response-messages{COLON}	{
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
@@ -3220,11 +3212,11 @@ Index: unbound-1.7.0~rc1/util/configlexer.lex
 disable-dnssec-lame-check{COLON} { YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
 ip-ratelimit{COLON}		{ YDVAR(1, VAR_IP_RATELIMIT) }
 ratelimit{COLON}		{ YDVAR(1, VAR_RATELIMIT) }
-Index: unbound-1.7.0~rc1/util/configparser.y
+Index: unboundfastrpz/util/configparser.y
 ===================================================================
--- unbound-1.7.0~rc1.orig/util/configparser.y
-+++ unbound-1.7.0~rc1/util/configparser.y
-@@ -124,6 +124,7 @@ extern struct config_parser_state* cfg_p
+--- unboundfastrpz/util/configparser.y	(revision 4987)
+++ unboundfastrpz/util/configparser.y	(working copy)
+@@ -125,6 +125,7 @@
 %token VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES
 %token VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES
 %token VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES
@@ -3232,7 +3224,7 @@ Index: unbound-1.7.0~rc1/util/configparser.y
 %token VAR_RESPONSE_IP_TAG VAR_RESPONSE_IP VAR_RESPONSE_IP_DATA
 %token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
 %token VAR_DISABLE_DNSSEC_LAME_CHECK
-@@ -158,7 +159,7 @@ extern struct config_parser_state* cfg_p
+@@ -168,7 +169,7 @@
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -3241,7 +3233,7 @@ Index: unbound-1.7.0~rc1/util/configparser.y
 	forwardstart contents_forward | pythonstart contents_py | 
 	rcstart contents_rc | dtstart contents_dt | viewstart contents_view |
 	dnscstart contents_dnsc | cachedbstart contents_cachedb |
-@@ -2384,6 +2385,50 @@ dt_dnstap_log_forwarder_response_message
+@@ -2639,6 +2640,50 @@
 			(strcmp($2, "yes")==0);
 	}
 	;
@@ -3292,11 +3284,11 @@ Index: unbound-1.7.0~rc1/util/configparser.y
 pythonstart: VAR_PYTHON
 	{ 
 		OUTYY(("\nP(python:)\n")); 
-Index: unbound-1.7.0~rc1/util/data/msgencode.c
+Index: unboundfastrpz/util/data/msgencode.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/util/data/msgencode.c
-+++ unbound-1.7.0~rc1/util/data/msgencode.c
-@@ -585,6 +585,35 @@ insert_section(struct reply_info* rep, s
+--- unboundfastrpz/util/data/msgencode.c	(revision 4987)
+++ unboundfastrpz/util/data/msgencode.c	(working copy)
+@@ -590,6 +590,35 @@
 	return RETVAL_OK;
 }
 
@@ -3332,7 +3324,7 @@ Index: unbound-1.7.0~rc1/util/data/msgencode.c
 /** store query section in wireformat buffer, return RETVAL */
 static int
 insert_query(struct query_info* qinfo, struct compress_tree_node** tree, 
-@@ -750,6 +779,19 @@ reply_info_encode(struct query_info* qin
+@@ -753,6 +782,19 @@
 			return 0;
 		}
 		sldns_buffer_write_u16_at(buffer, 10, arcount);
@@ -3352,13 +3344,13 @@ Index: unbound-1.7.0~rc1/util/data/msgencode.c
 	}
 	sldns_buffer_flip(buffer);
 	return 1;
-Index: unbound-1.7.0~rc1/util/data/packed_rrset.c
+Index: unboundfastrpz/util/data/packed_rrset.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/util/data/packed_rrset.c
-+++ unbound-1.7.0~rc1/util/data/packed_rrset.c
-@@ -254,6 +254,10 @@ sec_status_to_string(enum sec_status s)
- 	case sec_status_indeterminate: 	return "sec_status_indeterminate";
+--- unboundfastrpz/util/data/packed_rrset.c	(revision 4987)
+++ unboundfastrpz/util/data/packed_rrset.c	(working copy)
+@@ -255,6 +255,10 @@
 	case sec_status_insecure: 	return "sec_status_insecure";
+ 	case sec_status_secure_sentinel_fail: 	return "sec_status_secure_sentinel_fail";
 	case sec_status_secure: 	return "sec_status_secure";
 +#ifdef ENABLE_FASTRPZ
 +	case sec_status_rpz_rewritten: 	return "sec_status_rpz_rewritten";
@@ -3367,12 +3359,12 @@ Index: unbound-1.7.0~rc1/util/data/packed_rrset.c
 	}
 	return "unknown_sec_status_value";
 }
-Index: unbound-1.7.0~rc1/util/data/packed_rrset.h
+Index: unboundfastrpz/util/data/packed_rrset.h
 ===================================================================
--- unbound-1.7.0~rc1.orig/util/data/packed_rrset.h
-+++ unbound-1.7.0~rc1/util/data/packed_rrset.h
-@@ -189,7 +189,15 @@ enum sec_status {
- 	sec_status_insecure,
+--- unboundfastrpz/util/data/packed_rrset.h	(revision 4987)
+++ unboundfastrpz/util/data/packed_rrset.h	(working copy)
+@@ -193,7 +193,15 @@
+ 	sec_status_secure_sentinel_fail,
 	/** SECURE means that the object (RRset or message) validated 
 	 * according to local policy. */
 -	sec_status_secure
@@ -3388,11 +3380,11 @@ Index: unbound-1.7.0~rc1/util/data/packed_rrset.h
 };
 
 /**
-Index: unbound-1.7.0~rc1/util/netevent.c
+Index: unboundfastrpz/util/netevent.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/util/netevent.c
-+++ unbound-1.7.0~rc1/util/netevent.c
-@@ -54,6 +54,9 @@
+--- unboundfastrpz/util/netevent.c	(revision 4987)
+++ unboundfastrpz/util/netevent.c	(working copy)
+@@ -56,6 +56,9 @@
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
 #endif
@@ -3402,7 +3394,7 @@ Index: unbound-1.7.0~rc1/util/netevent.c
 
 /* -------- Start of local definitions -------- */
 /** if CMSG_ALIGN is not defined on this platform, a workaround */
-@@ -585,6 +588,9 @@ comm_point_udp_ancil_callback(int fd, sh
+@@ -588,6 +591,9 @@
 	struct cmsghdr* cmsg;
 #endif /* S_SPLINT_S */
 
@@ -3412,7 +3404,7 @@ Index: unbound-1.7.0~rc1/util/netevent.c
 	rep.c = (struct comm_point*)arg;
 	log_assert(rep.c->type == comm_udp);
 
-@@ -674,6 +680,9 @@ comm_point_udp_callback(int fd, short ev
+@@ -677,6 +683,9 @@
 	int i;
 	struct sldns_buffer *buffer;
 
@@ -3422,7 +3414,7 @@ Index: unbound-1.7.0~rc1/util/netevent.c
 	rep.c = (struct comm_point*)arg;
 	log_assert(rep.c->type == comm_udp);
 
-@@ -717,6 +726,9 @@ comm_point_udp_callback(int fd, short ev
+@@ -720,6 +729,9 @@
 			(void)comm_point_send_udp_msg(rep.c, buffer,
 				(struct sockaddr*)&rep.addr, rep.addrlen);
 		}
@@ -3432,7 +3424,7 @@ Index: unbound-1.7.0~rc1/util/netevent.c
 		if(!rep.c || rep.c->fd != fd) /* commpoint closed to -1 or reused for
 		another UDP port. Note rep.c cannot be reused with TCP fd. */
 			break;
-@@ -2956,6 +2968,9 @@ comm_point_send_reply(struct comm_reply
+@@ -3035,6 +3047,9 @@
 		comm_point_start_listening(repinfo->c, -1,
 			repinfo->c->tcp_timeout_msec);
 	}
@@ -3442,7 +3434,7 @@ Index: unbound-1.7.0~rc1/util/netevent.c
 }
 
 void 
-@@ -2965,6 +2980,9 @@ comm_point_drop_reply(struct comm_reply*
+@@ -3044,6 +3059,9 @@
 		return;
 	log_assert(repinfo && repinfo->c);
 	log_assert(repinfo->c->type != comm_tcp_accept);
@@ -3452,7 +3444,7 @@ Index: unbound-1.7.0~rc1/util/netevent.c
 	if(repinfo->c->type == comm_udp)
 		return;
 	reclaim_tcp_handler(repinfo->c);
-@@ -2984,6 +3002,9 @@ comm_point_start_listening(struct comm_p
+@@ -3063,6 +3081,9 @@
 {
 	verbose(VERB_ALGO, "comm point start listening %d", 
 		c->fd==-1?newfd:c->fd);
@@ -3462,11 +3454,11 @@ Index: unbound-1.7.0~rc1/util/netevent.c
 	if(c->type == comm_tcp_accept && !c->tcp_free) {
 		/* no use to start listening no free slots. */
 		return;
-Index: unbound-1.7.0~rc1/util/netevent.h
+Index: unboundfastrpz/util/netevent.h
 ===================================================================
--- unbound-1.7.0~rc1.orig/util/netevent.h
-+++ unbound-1.7.0~rc1/util/netevent.h
-@@ -119,6 +119,10 @@ struct comm_reply {
+--- unboundfastrpz/util/netevent.h	(revision 4987)
+++ unboundfastrpz/util/netevent.h	(working copy)
+@@ -120,6 +120,10 @@
 	/** return type 0 (none), 4(IP4), 6(IP6) */
 	int srctype;
 	/* DnsCrypt context */
@@ -3477,11 +3469,11 @@ Index: unbound-1.7.0~rc1/util/netevent.h
 #ifdef USE_DNSCRYPT
 	uint8_t client_nonce[crypto_box_HALF_NONCEBYTES];
 	uint8_t nmkey[crypto_box_BEFORENMBYTES];
-Index: unbound-1.7.0~rc1/validator/validator.c
+Index: unboundfastrpz/validator/validator.c
 ===================================================================
--- unbound-1.7.0~rc1.orig/validator/validator.c
-+++ unbound-1.7.0~rc1/validator/validator.c
-@@ -2688,6 +2688,12 @@ ds_response_to_ke(struct module_qstate*
+--- unboundfastrpz/validator/validator.c	(revision 4987)
+++ unboundfastrpz/validator/validator.c	(working copy)
+@@ -2755,6 +2755,12 @@
 			default:
 				/* NSEC proof did not work, try next */
 				break;
@@ -3494,7 +3486,7 @@ Index: unbound-1.7.0~rc1/validator/validator.c
 		}
 
 		sec = nsec3_prove_nods(qstate->env, ve, 
-@@ -2721,6 +2727,12 @@ ds_response_to_ke(struct module_qstate*
+@@ -2788,6 +2794,12 @@
 			default:
 				/* NSEC3 proof did not work */
 				break;
@@ -3507,4 +3499,3 @@ Index: unbound-1.7.0~rc1/validator/validator.c
 		}
 
 		/* Apparently, no available NSEC/NSEC3 proved NODATA, so 
-
@@ -1428,6 +1428,28 @@ do_view_data_add(RES* ssl, struct worker* worker, char* arg)
 	lock_rw_unlock(&v->lock);
 }

+/** Add new RR data from stdin to view */
+static void
+do_view_datas_add(RES* ssl, struct worker* worker, char* arg)
+{
+	struct view* v;
+	v = views_find_view(worker->daemon->views,
+		arg, 1 /* get write lock*/);
+	if(!v) {
+		ssl_printf(ssl,"no view with name: %s\n", arg);
+		return;
+	}
+	if(!v->local_zones) {
+		if(!(v->local_zones = local_zones_create())){
+			lock_rw_unlock(&v->lock);
+			ssl_printf(ssl,"error out of memory\n");
+			return;
+		}
+	}
+	do_datas_add(ssl, v->local_zones);
+	lock_rw_unlock(&v->lock);
+}
+
 /** Remove RR data from view */
 static void
 do_view_data_remove(RES* ssl, struct worker* worker, char* arg)
@@ -2456,7 +2478,7 @@ do_auth_zone_reload(RES* ssl, struct worker* worker, char* arg)
 		(void)ssl_printf(ssl, "error no auth-zone %s\n", arg);
 		return;
 	}
-	if(!auth_zone_read_zonefile(z)) {
+	if(!auth_zone_read_zonefile(z, worker->env.cfg)) {
 		lock_rw_unlock(&z->lock);
 		(void)ssl_printf(ssl, "error failed to read %s\n", arg);
 		return;
@@ -2963,6 +2985,8 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 		do_view_data_remove(ssl, worker, skipwhite(p+22));
 	} else if(cmdcmp(p, "view_local_data", 15)) {
 		do_view_data_add(ssl, worker, skipwhite(p+15));
+	} else if(cmdcmp(p, "view_local_datas", 16)) {
+		do_view_datas_add(ssl, worker, skipwhite(p+16));
 	} else if(cmdcmp(p, "flush_zone", 10)) {
 		do_flush_zone(ssl, worker, skipwhite(p+10));
 	} else if(cmdcmp(p, "flush_type", 10)) {
@@ -1802,8 +1802,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	alloc_set_id_cleanup(&worker->alloc, &worker_alloc_cleanup, worker);
 	worker->env = *worker->daemon->env;
 	comm_base_timept(worker->base, &worker->env.now, &worker->env.now_tv);
-	if(worker->thread_num == 0)
-		log_set_time(worker->env.now);
 	worker->env.worker = worker;
 	worker->env.worker_base = worker->base;
 	worker->env.send_query = &worker_send_query;
@@ -1909,7 +1907,6 @@ worker_delete(struct worker* worker)
 	comm_timer_delete(worker->env.probe_timer);
 	free(worker->ports);
 	if(worker->thread_num == 0) {
-		log_set_time(NULL);
 #ifdef UB_ON_WINDOWS
 		wsvc_desetup_worker(worker);
 #endif /* UB_ON_WINDOWS */
@@ -70,12 +70,9 @@ static const char DEFAULT_DNS64_PREFIX[] = "64:ff9b::/96";
 #define MAX_PTR_QNAME_IPV4 30

 /**
- * Per-query module-specific state. This is usually a dynamically-allocated
- * structure, but in our case we only need to store one variable describing the
- * state the query is in. So we repurpose the minfo pointer by storing an
- * integer in there.
+ * State of DNS64 processing for a query.
 */
-enum dns64_qstate {
+enum dns64_state {
    DNS64_INTERNAL_QUERY,    /**< Internally-generated query, no DNS64
                                  processing. */
    DNS64_NEW_QUERY,         /**< Query for which we're the first module in
@@ -84,6 +81,19 @@ enum dns64_qstate {
                                  for which this sub-query is finished. */
 };

+/**
+ * Per-query module-specific state.  For the DNS64 module.
+ */
+struct dns64_qstate {
+	/** State of the DNS64 module. */
+	enum dns64_state state;
+	/** If the dns64 module started with no_cache bool set in the qstate,
+	 * a message to tell it to not modify the cache contents, then this
+	 * is true.  The dns64 module is then free to modify that flag for
+	 * its own purposes.
+	 * Otherwise, it is false, the dns64 module was not told to no_cache */
+	int started_no_cache_store;
+};

 /******************************************************************************
 *                                                                            *
@@ -470,7 +480,7 @@ handle_ipv6_ptr(struct module_qstate* qstate, int id)
    if (subq) {
        subq->curmod = id;
        subq->ext_state[id] = module_state_initial;
-        subq->minfo[id] = NULL;
+	subq->minfo[id] = NULL;
    }

    return module_wait_subquery;
@@ -540,7 +550,8 @@ dns64_always_synth_for_qname(struct module_qstate* qstate, int id)
 static enum module_ext_state
 handle_event_pass(struct module_qstate* qstate, int id)
 {
-	if ((uintptr_t)qstate->minfo[id] == DNS64_NEW_QUERY
+	struct dns64_qstate* iq = (struct dns64_qstate*)qstate->minfo[id];
+	if (iq && iq->state == DNS64_NEW_QUERY
            && qstate->qinfo.qtype == LDNS_RR_TYPE_PTR
            && qstate->qinfo.qname_len == 74
            && !strcmp((char*)&qstate->qinfo.qname[64], "\03ip6\04arpa"))
@@ -548,12 +559,12 @@ handle_event_pass(struct module_qstate* qstate, int id)
        return handle_ipv6_ptr(qstate, id);

 	if (qstate->env->cfg->dns64_synthall &&
-	    (uintptr_t)qstate->minfo[id] == DNS64_NEW_QUERY
+	    iq && iq->state == DNS64_NEW_QUERY
 	    && qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)
 		return generate_type_A_query(qstate, id);

 	if(dns64_always_synth_for_qname(qstate, id) &&
-	    (uintptr_t)qstate->minfo[id] == DNS64_NEW_QUERY
+	    iq && iq->state == DNS64_NEW_QUERY
 	    && !(qstate->query_flags & BIT_CD)
 	    && qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) {
 		verbose(VERB_ALGO, "dns64: ignore-aaaa and synthesize anyway");
@@ -561,7 +572,7 @@ handle_event_pass(struct module_qstate* qstate, int id)
 	}

 	/* We are finished when our sub-query is finished. */
-	if ((uintptr_t)qstate->minfo[id] == DNS64_SUBQUERY_FINISHED)
+	if (iq && iq->state == DNS64_SUBQUERY_FINISHED)
 		return module_finished;

 	/* Otherwise, pass request to next module. */
@@ -582,6 +593,7 @@ handle_event_pass(struct module_qstate* qstate, int id)
 static enum module_ext_state
 handle_event_moddone(struct module_qstate* qstate, int id)
 {
+	struct dns64_qstate* iq = (struct dns64_qstate*)qstate->minfo[id];
    /*
     * In many cases we have nothing special to do. From most to least common:
     *
@@ -593,7 +605,7 @@ handle_event_moddone(struct module_qstate* qstate, int id)
     *        synthesize in (sec 5.1.2 of RFC6147).
     *   - A successful AAAA query with an answer.
     */
-	if((enum dns64_qstate)qstate->minfo[id] != DNS64_INTERNAL_QUERY
+	if((!iq || iq->state != DNS64_INTERNAL_QUERY)
            && qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA
 	    && !(qstate->query_flags & BIT_CD)
 	    && !(qstate->return_msg &&
@@ -604,7 +616,7 @@ handle_event_moddone(struct module_qstate* qstate, int id)
 		 * So, this is a AAAA noerror/nodata answer */
 		return generate_type_A_query(qstate, id);

-	if((enum dns64_qstate)qstate->minfo[id] != DNS64_INTERNAL_QUERY
+	if((!iq || iq->state != DNS64_INTERNAL_QUERY)
 	    && qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA
 	    && !(qstate->query_flags & BIT_CD)
 	    && dns64_always_synth_for_qname(qstate, id)) {
@@ -614,6 +626,12 @@ handle_event_moddone(struct module_qstate* qstate, int id)
 		return generate_type_A_query(qstate, id);
 	}

+	/* Store the response in cache. */
+	if ( (!iq || !iq->started_no_cache_store) &&
+		!dns_cache_store(qstate->env, &qstate->qinfo, qstate->return_msg->rep,
+		0, 0, 0, NULL, qstate->query_flags))
+		log_err("out of memory");
+
 	/* do nothing */
 	return module_finished;
 }
@@ -634,6 +652,7 @@ void
 dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 		struct outbound_entry* outbound)
 {
+	struct dns64_qstate* iq;
 	(void)outbound;
 	verbose(VERB_QUERY, "dns64[module %d] operate: extstate:%s event:%s",
 			id, strextstate(qstate->ext_state[id]),
@@ -643,7 +662,12 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 	switch(event) {
 		case module_event_new:
 			/* Tag this query as being new and fall through. */
-			qstate->minfo[id] = (void*)DNS64_NEW_QUERY;
+			iq = (struct dns64_qstate*)regional_alloc(
+				qstate->region, sizeof(*iq));
+			qstate->minfo[id] = iq;
+			iq->state = DNS64_NEW_QUERY;
+			iq->started_no_cache_store = qstate->no_cache_store;
+			qstate->no_cache_store = 1;
  			/* fallthrough */
 		case module_event_pass:
 			qstate->ext_state[id] = handle_event_pass(qstate, id);
@@ -655,6 +679,11 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			qstate->ext_state[id] = module_finished;
 			break;
 	}
+	if(qstate->ext_state[id] == module_finished) {
+		iq = (struct dns64_qstate*)qstate->minfo[id];
+		if(iq && iq->state != DNS64_INTERNAL_QUERY)
+			qstate->no_cache_store = iq->started_no_cache_store;
+	}
 }

 static void
@@ -867,9 +896,10 @@ dns64_adjust_ptr(struct module_qstate* qstate, struct module_qstate* super)
     * initial query's domain name.
     */
    answer = reply_find_answer_rrset(&qstate->qinfo, super->return_msg->rep);
-    log_assert(answer);
-    answer->rk.dname = super->qinfo.qname;
-    answer->rk.dname_len = super->qinfo.qname_len;
+    if(answer) {
+	    answer->rk.dname = super->qinfo.qname;
+	    answer->rk.dname_len = super->qinfo.qname_len;
+    }
 }

 /**
@@ -885,6 +915,7 @@ void
 dns64_inform_super(struct module_qstate* qstate, int id,
 		struct module_qstate* super)
 {
+	struct dns64_qstate* super_dq = (struct dns64_qstate*)super->minfo[id];
 	log_query_info(VERB_ALGO, "dns64: inform_super, sub is",
 		       &qstate->qinfo);
 	log_query_info(VERB_ALGO, "super is", &super->qinfo);
@@ -893,15 +924,21 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	 * Signal that the sub-query is finished, no matter whether we are
 	 * successful or not. This lets the state machine terminate.
 	 */
-	super->minfo[id] = (void*)DNS64_SUBQUERY_FINISHED;
+	if(!super_dq) {
+		super_dq = (struct dns64_qstate*)regional_alloc(qstate->region,
+			sizeof(*super_dq));
+		super->minfo[id] = super_dq;
+		memset(super_dq, 0, sizeof(*super_dq));
+		super_dq->started_no_cache_store = super->no_cache_store;
+	}
+	super_dq->state = DNS64_SUBQUERY_FINISHED;

 	/* If there is no successful answer, we're done. */
 	if (qstate->return_rcode != LDNS_RCODE_NOERROR
 	    || !qstate->return_msg
-	    || !qstate->return_msg->rep
-	    || !reply_find_answer_rrset(&qstate->qinfo,
-					qstate->return_msg->rep))
+	    || !qstate->return_msg->rep) {
 		return;
+	}

 	/* Use return code from A query in response to client. */
 	if (super->return_rcode != LDNS_RCODE_NOERROR)
@@ -916,7 +953,7 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	}

 	/* Store the generated response in cache. */
-	if (!super->no_cache_store &&
+	if ( (!super_dq || !super_dq->started_no_cache_store) &&
 		!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
 		0, 0, 0, NULL, super->query_flags))
 		log_err("out of memory");
@@ -772,12 +772,13 @@ key_get_es_version(uint8_t version[2])
        const char *name;
    };

+    const int num_versions = 2;
    struct es_version es_versions[] = {
        {{0x00, 0x01}, "X25519-XSalsa20Poly1305"},
        {{0x00, 0x02}, "X25519-XChacha20Poly1305"},
    };
    int i;
-    for(i=0; i < (int)sizeof(es_versions); i++){
+    for(i=0; i < num_versions; i++){
        if(es_versions[i].es_version[0] == version[0] &&
           es_versions[i].es_version[1] == version[1]){
            return es_versions[i].name;
@@ -39,6 +39,10 @@
 #include "config.h"
 #include <string.h>
 #include <sys/time.h>
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
+#include <errno.h>
 #include "sldns/sbuffer.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
@@ -118,6 +122,18 @@ dt_msg_init(const struct dt_env *env,
 	}
 }

+/* check that the socket file can be opened and exists, print error if not */
+static void
+check_socket_file(const char* socket_path)
+{
+	struct stat statbuf;
+	memset(&statbuf, 0, sizeof(statbuf));
+	if(stat(socket_path, &statbuf) < 0) {
+		log_warn("could not open dnstap-socket-path: %s, %s",
+			socket_path, strerror(errno));
+	}
+}
+
 struct dt_env *
 dt_create(const char *socket_path, unsigned num_workers)
 {
@@ -134,6 +150,7 @@ dt_create(const char *socket_path, unsigned num_workers)
 		socket_path);
 	log_assert(socket_path != NULL);
 	log_assert(num_workers > 0);
+	check_socket_file(socket_path);

 	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
 	if (!env)
@@ -1,5 +1,123 @@
+29 November 2018: Wouter
+	- iana portlist updated.
+	- Fix chroot auth-zone fix to remove chroot prefix.
+
+28 November 2018: Wouter
+	- Fix leak in chroot fix for auth-zone.
+	- Fix clang analysis for outside directory build test.
+
+27 November 2018: Wouter
+	- Fix DNS64 to not store intermediate results in cache, this avoids
+	  other threads from picking up the wrong data.  The module restores
+	  the previous no_cache_store setting when the the module is finished.
+	- Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work.
+	- New and better fix for Fix #4193: Fix that prefetch failure does
+	  not overwrite valid cache entry with SERVFAIL.
+	- auth-zone give SERVFAIL when expired, fallback activates when
+	  expired, and this is documented in the man page.
+	- stat count SERVFAIL downstream auth-zone queries for expired zones.
+	- Put new logos into windows installer.
+	- Fix windows compile for new rrset roundrobin fix.
+	- Update contrib fastrpz patch for latest release.
+
+26 November 2018: Wouter
+	- Fix to not set GLOB_NOSORT so the unbound.conf include: files are
+	  sorted and in a predictable order.
+	- Fix #4193: Fix that prefetch failure does not overwrite valid cache
+	  entry with SERVFAIL.
+	- Add unbound-control view_local_datas command, like local_datas.
+	- Fix that unbound-control can send file for view_local_datas.
+
+22 November 2018: Wouter
+	- With ./configure --with-pyunbound --with-pythonmodule
+	  PYTHON_VERSION=3.6 or with 2.7 unbound can compile and unit tests
+	  succeed for the python module.
+	- pythonmod logs the python error and traceback on failure.
+	- ignore debug python module for test in doxygen output.
+	- review fixes for python module.
+	- Fix #4209: Crash in libunbound when called from getdns.
+	- auth zone zonefiles can be in a chroot, the chroot directory
+	  components are removed before use.
+	- Fix that empty zonefile means the zonefile is not set and not used.
+	- make depend.
+
+21 November 2018: Wouter
+	- Scrub NS records from NODATA responses as well.
+
+20 November 2018: Wouter
+	- Scrub NS records from NXDOMAIN responses to stop fragmentation
+	  poisoning of the cache.
+	- Add patch from Jan Vcelak for pythonmod,
+	  add sockaddr_storage getters, add support for query callbacks,
+	  allow raw address access via comm_reply and update API documentation.
+	- Removed compile warnings in pythonmod sockaddr routines.
+
+19 November 2018: Wouter
+	- Support SO_REUSEPORT_LB in FreeBSD 12 with the so-reuseport: yes
+	  option in unbound.conf.
+
+6 November 2018: Ralph
+	- Bugfix min-client-subnet-ipv6
+
+25 October 2018: Ralph
+	- Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options.
+
+25 October 2018: Wouter
+	- Fix #4191: NXDOMAIN vs SERVFAIL during dns64 PTR query.
+	- Fix #4190: Please create a "ANY" deny option, adds the option
+	  deny-any: yes in unbound.conf.  This responds with an empty message
+	  to queries of type ANY.
+	- Fix #4141: More randomness to rrset-roundrobin.
+	- Fix #4132: Openness/closeness of RANGE intervals in rpl files.
+	- Fix #4126: RTT_band too low on VSAT links with 600+ms latency,
+	  adds the option unknown-server-time-limit to unbound.conf that
+	  can be increased to avoid the problem.
+	- remade makefile dependencies.
+	- Fix #4152: Logs shows wrong time when using log-time-ascii: yes.
+
+24 October 2018: Ralph
+	- Add markdel function to ECS slabhash.
+	- Limit ECS scope returned to client to the scope used for caching.
+	- Make lint like previous #4154 fix.
+
+22 October 2018: Wouter
+	- Fix #4192: unbound-control-setup generates keys not readable by
+	  group.
+	- check that the dnstap socket file can be opened and exists, print
+	  error if not.
+	- Fix #4154: make ECS_MAX_TREESIZE configurable, with
+	  the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options.
+
+22 October 2018: Ralph
+	- Change fast-server-num default to 3.
+
+8 October 2018: Ralph
+	- Add fast-server-permil and fast-server-num options.
+	- Deprecate low-rtt and low-rtt-permil options.
+
+8 October 2018: Wouter
+	- Squelch log of failed to tcp initiate after TCP Fastopen failure.
+
+5 October 2018: Wouter
+	- Squelch EADDRNOTAVAIL errors when the interface goes away,
+	  this omits 'can't assign requested address' errors unless
+	  verbosity is set to a high value.
+	- Set default for so-reuseport to no for FreeBSD.  It is enabled
+	  by default for Linux and DragonFlyBSD.  The setting can 
+	  be configured in unbound.conf to override the default.
+	- iana port update.
+
+2 October 2018: Wouter
+	- updated contrib/fastrpz.patch to apply for this version
+	- dnscrypt.c removed sizeof to get array bounds.
+	- Fix testlock code to set noreturn on error routine.
+	- Remove unused variable from contrib fastrpz/rpz.c and
+	  remove unused diagnostic pragmas that themselves generate warnings
+	- clang analyze test is used only when assertions are enabled.
+
 1 October 2018: Wouter
-	- tag for release 1.8.1rc1.
+	- tag for release 1.8.1rc1.  Became release 1.8.1 on 8 oct, with
+	  fastrpz.patch fix included.  Trunk has 1.8.2 in development.

 27 September 2018: Wouter
 	- Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, fixes
@@ -145,6 +145,10 @@ server:
 	# msec to wait before close of port on timeout UDP. 0 disables.
 	# delay-close: 0

+	# msec for waiting for an unknown server to reply.  Increase if you
+	# are behind a slow satellite link, to eg. 1128.
+	# unknown-server-time-limit: 376
+
 	# the amount of memory to use for the RRset cache.
 	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# rrset-cache-size: 4m
@@ -449,6 +453,9 @@ server:
 	# if yes, perform key lookups adjacent to normal lookups.
 	# prefetch-key: no

+	# deny queries of type ANY with an empty response.
+	# deny-any: no
+
 	# if yes, Unbound rotates RRSet order in response.
 	# rrset-roundrobin: no

@@ -757,12 +764,12 @@ server:
 	# Limit the number of connections simultaneous from a netblock
 	# tcp-connection-limit: 192.0.2.0/24 12

-	# what is considered a low rtt (ping time for upstream server), in msec
-	# low-rtt: 45
-	# select low rtt this many times out of 1000. 0 means the fast server
-	# select is disabled.  prefetches are not sped up.
-	# low-rtt-permil: 0
-
+	# select from the fastest servers this many times out of 1000. 0 means
+	# the fast server select is disabled. prefetches are not sped up.
+	# fast-server-permil: 0
+	# the number of servers that will be used in the fast server selection.
+	# fast-server-num: 3
+	
 	# Specific options for ipsecmod. unbound needs to be configured with
 	# --enable-ipsecmod for these to take effect.
 	#
@@ -322,6 +322,9 @@ serial check).  And then the zone is transferred for a newer zone version.
 .TP
 .B view_local_data_remove \fIview\fR \fIname
 \fIlocal_data_remove\fR for given view.
+.TP
+.B view_local_datas \fIview\fR
+Add a list of \fIlocal_data\fR for given view from stdin.  Like local_datas.
 .SH "EXIT CODE"
 The unbound\-control program exits with status code 1 on error, 0 on success.
 .SH "SET UP"
@@ -253,6 +253,12 @@ eg. 1500 msec.  When timeouts happen you need extra sockets, it checks
 the ID and remote IP of packets, and unwanted packets are added to the
 unwanted packet counter.
 .TP
+.B unknown\-server\-time\-limit: \fI<msec>
+The wait time in msec for waiting for an unknown server to reply.
+Increase this if you are behind a slow satellite link, to eg. 1128.
+That would then avoid re\-querying every initial query because it times out.
+Default is 376 msec.
+.TP
 .B so\-rcvbuf: \fI<number>
 If not 0, then set the SO_RCVBUF socket option to get more buffer
 space on UDP port 53 incoming queries.  So that short spikes on busy
@@ -848,12 +854,18 @@ keep the cache up to date.  Default is no.  Turning it on gives about
 10 percent more traffic and load on the machine, but popular items do
 not expire from the cache.
 .TP
-.B prefetch-key: \fI<yes or no>
+.B prefetch\-key: \fI<yes or no>
 If yes, fetch the DNSKEYs earlier in the validation process, when a DS
 record is encountered.  This lowers the latency of requests.  It does use
 a little more CPU.  Also if the cache is set to 0, it is no use. Default is no.
 .TP
-.B rrset-roundrobin: \fI<yes or no>
+.B deny\-any: \fI<yes or no>
+If yes, deny queries of type ANY with an empty response.  Default is no.
+If disabled, unbound responds with a short list of resource records if some
+can be found in the cache and makes the upstream type ANY query if there
+are none.
+.TP
+.B rrset\-roundrobin: \fI<yes or no>
 If yes, Unbound rotates RRSet order in response (the random number is taken
 from the query ID, for speed and thread safety).  Default is no.
 .TP
@@ -1391,22 +1403,20 @@ This can make ordinary queries complete (if repeatedly queried for),
 and enter the cache, whilst also mitigating the traffic flow by the
 factor given.
 .TP 5
-.B low\-rtt: \fI<msec time>
-Set the time in millisecond that is considere a low ping time for fast
-server selection with the low\-rtt\-permil option, that turns this on or off.
-The default is 45 msec, a number from IPv6 quick response documents.
+.B fast\-server\-permil: \fI<number>
+Specify how many times out of 1000 to pick from the set of fastest servers.
+0 turns the feature off.  A value of 900 would pick from the fastest
+servers 90 percent of the time, and would perform normal exploration of random
+servers for the remaining time. When prefetch is enabled (or serve\-expired),
+such prefetches are not sped up, because there is no one waiting for it, and it
+presents a good moment to perform server exploration. The
+\fBfast\-server\-num\fR option can be used to specify the size of the fastest
+servers set. The default for fast\-server\-permil is 0.
 .TP 5
-.B low\-rtt\-permil: \fI<number>
-Specify how many times out of 1000 to pick the fast server from the low
-rtt band.  0 turns the feature off.  A value of 900 would pick the fast
-server when such fast servers are available 90 percent of the time, and
-the remaining time perform normal exploration of random servers.
-When prefetch is enabled (or serve\-expired), such prefetches are not
-sped up, because there is no one waiting for it, and it presents a good
-moment to perform server exploration.  The low\-rtt option can be used
-to specify which servers are picked for fast server selection, servers
-with a ping roundtrip time below that value are considered.
-The default for low\-rtt\-permil is 0.
+.B fast\-server\-num: \fI<number>
+Set the number of servers that should be used for fast server selection. Only
+use the fastest specified number of servers with the fast\-server\-permil
+option, that turns this on or off. The default is to use the fastest 3 servers.
 .SS "Remote Control Options"
 In the
 .B remote\-control:
@@ -1604,6 +1614,13 @@ lookups of that data.
 Authority zones can be read from zonefile.  And can be kept updated via
 AXFR and IXFR.  After update the zonefile is rewritten.  The update mechanism
 uses the SOA timer values and performs SOA UDP queries to detect zone changes.
+.LP
+If the update fetch fails, the timers in the SOA record are used to time
+another fetch attempt.  Until the SOA expiry timer is reached.  Then the
+zone is expired.  When a zone is expired, queries are SERVFAIL, and
+any new serial number is accepted from the master (even if older), and if
+fallback is enabled, the fallback activates to fetch from the upstream instead
+of the SERVFAIL.
 .TP
 .B name: \fI<zone name>
 Name of the authority zone.
@@ -1843,6 +1860,24 @@ to expose to third parties for IPv6.  Defaults to 56.
 .B max\-client\-subnet\-ipv4: \fI<number>\fR
 Specifies the maximum prefix length of the client source address we are willing
 to expose to third parties for IPv4. Defaults to 24.
+.TP
+.B min\-client\-subnet\-ipv6: \fI<number>\fR
+Specifies the minimum prefix length of the IPv6 source mask we are willing to
+accept in queries. Shorter source masks result in REFUSED answers. Source mask
+of 0 is always accepted. Default is 0.
+.TP
+.B min\-client\-subnet\-ipv4: \fI<number>\fR
+Specifies the minimum prefix length of the IPv4 source mask we are willing to
+accept in queries. Shorter source masks result in REFUSED answers. Source mask 
+of 0 is always accepted. Default is 0.
+.TP
+.B max\-ecs\-tree\-size\-ipv4: \fI<number>\fR
+Specifies the maximum number of subnets ECS answers kept in the ECS radix tree.
+This number applies for each qname/qclass/qtype tuple. Defaults to 100.
+.TP
+.B max\-ecs\-tree\-size\-ipv6: \fI<number>\fR
+Specifies the maximum number of subnets ECS answers kept in the ECS radix tree.
+This number applies for each qname/qclass/qtype tuple. Defaults to 100.
 .SS "Opportunistic IPsec Support Module Options"
 .LP
 The IPsec module must be configured in the \fBmodule\-config:\fR "ipsecmod
@@ -612,17 +612,22 @@ RECURSIVE              = YES

 EXCLUDE                = ./build \
                         ./compat \
+			 ./contrib \
                         util/configparser.c \
                         util/configparser.h \
                         util/configlexer.c \
                         util/locks.h \
+                         pythonmod/doc \
+                         pythonmod/examples \
                         pythonmod/unboundmodule.py \
                         pythonmod/interface.h \
-                         pythonmod/examples/resgen.py \
-                         pythonmod/examples/resmod.py \
-                         pythonmod/examples/resip.py \
+                         pythonmod/ubmodule-msg.py \
+                         pythonmod/ubmodule-tst.py \
+			 unboundmodule.py \
                         libunbound/python/unbound.py \
                         libunbound/python/libunbound_wrap.c \
+                         libunbound/python/doc \
+                         libunbound/python/examples \
                         ./ldns-src \
 			 doc/control_proto_spec.txt \
 			 doc/requirements.txt
@@ -119,7 +119,7 @@ node_size(const struct addrtree *tree, const struct addrnode *n)

 struct addrtree * 
 addrtree_create(addrlen_t max_depth, void (*delfunc)(void *, void *), 
-	size_t (*sizefunc)(void *), void *env, unsigned int max_node_count)
+	size_t (*sizefunc)(void *), void *env, uint32_t max_node_count)
 {
 	struct addrtree *tree;
 	log_assert(delfunc != NULL);
@@ -66,10 +66,10 @@ struct addrtree {
 	struct addrnode *root;
 	/** Number of elements in the tree (not always equal to number of 
 	 * nodes) */
-	unsigned int node_count;
+	uint32_t node_count;
 	/** Maximum number of allowed nodes, will be enforced by LRU list.
 	 * Excluding the root node, 0 for unlimited */
-	unsigned int max_node_count;
+	uint32_t max_node_count;
 	/** Size of tree in bytes */
 	size_t size_bytes;
 	/** Maximum prefix length we are willing to cache. */
@@ -137,7 +137,7 @@ size_t addrtree_size(const struct addrtree *tree);
 */
 struct addrtree * 
 addrtree_create(addrlen_t max_depth, void (*delfunc)(void *, void *), 
-	size_t (*sizefunc)(void *), void *env, unsigned int max_node_count);
+	size_t (*sizefunc)(void *), void *env, uint32_t max_node_count);

 /** 
 * Free tree and all nodes below.
@@ -55,8 +55,7 @@
 #include "util/config_file.h"
 #include "util/data/msgreply.h"
 #include "sldns/sbuffer.h"
-
-#define ECS_MAX_TREESIZE 100
+#include "iterator/iter_utils.h"

 /** externally called */
 void 
@@ -93,6 +92,7 @@ subnet_new_qstate(struct module_qstate *qstate, int id)
 		return 0;
 	qstate->minfo[id] = sq;
 	memset(sq, 0, sizeof(*sq));
+	sq->started_no_cache_store = qstate->no_cache_store;
 	return 1;
 }

@@ -150,7 +150,9 @@ int ecs_whitelist_check(struct query_info* qinfo,

 	/* Cache by default, might be disabled after parsing EDNS option
 	 * received from nameserver. */
-	qstate->no_cache_store = 0;
+	if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo)) {
+		qstate->no_cache_store = 0;
+	}

 	if(sq->ecs_server_out.subnet_validdata && ((sq->subnet_downstream &&
 		qstate->env->cfg->client_subnet_always_forward) ||
@@ -177,6 +179,14 @@ int ecs_whitelist_check(struct query_info* qinfo,
 }


+void
+subnet_markdel(void* key)
+{
+	struct msgreply_entry *e = (struct msgreply_entry*)key;
+	e->key.qtype = 0;
+	e->key.qclass = 0;
+}
+
 int
 subnetmod_init(struct module_env *env, int id)
 {
@@ -193,6 +203,7 @@ subnetmod_init(struct module_env *env, int id)
 		HASH_DEFAULT_STARTARRAY, env->cfg->msg_cache_size,
 		msg_cache_sizefunc, query_info_compare, query_entry_delete,
 		subnet_data_delete, NULL);
+	slabhash_setmarkdel(sn_env->subnet_msg_cache, &subnet_markdel);
 	if(!sn_env->subnet_msg_cache) {
 		log_err("subnet: could not create cache");
 		free(sn_env);
@@ -291,13 +302,13 @@ get_tree(struct subnet_msg_cache_data *data, struct ecs_data *edns,
 		if (!data->tree4)
 			data->tree4 = addrtree_create(
 				cfg->max_client_subnet_ipv4, &delfunc,
-				&sizefunc, env, ECS_MAX_TREESIZE);
+				&sizefunc, env, cfg->max_ecs_tree_size_ipv4);
 		tree = data->tree4;
 	} else {
 		if (!data->tree6)
 			data->tree6 = addrtree_create(
 				cfg->max_client_subnet_ipv6, &delfunc,
-				&sizefunc, env, ECS_MAX_TREESIZE);
+				&sizefunc, env, cfg->max_ecs_tree_size_ipv6);
 		tree = data->tree6;
 	}
 	return tree;
@@ -487,9 +498,11 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		 * is still usefull to put it in the edns subnet cache for
 		 * when a client explicitly asks for subnet specific answer. */
 		verbose(VERB_QUERY, "subnet: Authority indicates no support");
-		lock_rw_wrlock(&sne->biglock);
-		update_cache(qstate, id);
-		lock_rw_unlock(&sne->biglock);
+		if(!sq->started_no_cache_store) {
+			lock_rw_wrlock(&sne->biglock);
+			update_cache(qstate, id);
+			lock_rw_unlock(&sne->biglock);
+		}
 		if (sq->subnet_downstream)
 			cp_edns_bad_response(c_out, c_in);
 		return module_finished;
@@ -515,7 +528,9 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 	}

 	lock_rw_wrlock(&sne->biglock);
-	update_cache(qstate, id);
+	if(!sq->started_no_cache_store) {
+		update_cache(qstate, id);
+	}
 	sne->num_msg_nocache++;
 	lock_rw_unlock(&sne->biglock);
 	
@@ -526,6 +541,19 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		c_out->subnet_source_mask = c_in->subnet_source_mask;
 		memcpy(&c_out->subnet_addr, &c_in->subnet_addr, INET6_SIZE);
 		c_out->subnet_scope_mask = s_in->subnet_scope_mask;
+		/* Limit scope returned to client to scope used for caching. */
+		if(c_out->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4) {
+			if(c_out->subnet_scope_mask >
+				qstate->env->cfg->max_client_subnet_ipv4) {
+				c_out->subnet_scope_mask =
+					qstate->env->cfg->max_client_subnet_ipv4;
+			}
+		}
+		else if(c_out->subnet_scope_mask >
+				qstate->env->cfg->max_client_subnet_ipv6) {
+				c_out->subnet_scope_mask =
+					qstate->env->cfg->max_client_subnet_ipv6;
+		}
 		c_out->subnet_validdata = 1;
 	}
 	return module_finished;
@@ -697,6 +725,17 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			return;
 		}

+		/* Limit to minimum allowed source mask */
+		if(sq->ecs_client_in.subnet_source_mask != 0 && (
+			(sq->ecs_client_in.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4 &&
+			 sq->ecs_client_in.subnet_source_mask < qstate->env->cfg->min_client_subnet_ipv4) ||
+			(sq->ecs_client_in.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6 &&
+			 sq->ecs_client_in.subnet_source_mask < qstate->env->cfg->min_client_subnet_ipv6))) {
+				qstate->return_rcode = LDNS_RCODE_REFUSED;
+				qstate->ext_state[id] = module_finished;
+				return;
+		}
+
 		lock_rw_wrlock(&sne->biglock);
 		if (lookup_and_reply(qstate, id, sq)) {
 			sne->num_msg_cache++;
@@ -753,6 +792,7 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			ecs_opt_list_append(&sq->ecs_client_out,
 				&qstate->edns_opts_front_out, qstate);
 		}
+		qstate->no_cache_store = sq->started_no_cache_store;
 		return;
 	}
 	if(sq && outbound) {
@@ -83,6 +83,8 @@ struct subnet_qstate {
 	struct ecs_data	ecs_server_out;
 	int subnet_downstream;
 	int subnet_sent;
+	/** has the subnet module been started with no_cache_store? */
+	int started_no_cache_store;
 };

 void subnet_data_delete(void* d, void* ATTR_UNUSED(arg));
@@ -131,4 +133,7 @@ int ecs_edns_back_parsed(struct module_qstate* qstate, int id, void* cbargs);
 int ecs_query_response(struct module_qstate* qstate, struct dns_msg* response,
 	int id, void* cbargs);

+/** mark subnet msg to be deleted */
+void subnet_markdel(void* key);
+
 #endif /* SUBNETMOD_H */
@@ -316,6 +316,18 @@ sub_of_pkt(sldns_buffer* pkt, uint8_t* zone, uint8_t* comprname)
 	return dname_subdomain_c(zone, buf);
 }

+/** Check if there are SOA records in the authority section (negative) */
+static int
+soa_in_auth(struct msg_parse* msg)
+{
+	struct rrset_parse* rrset;
+	for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
+		if(rrset->type == LDNS_RR_TYPE_SOA &&
+			rrset->section == LDNS_SECTION_AUTHORITY) 
+			return 1;
+	return 0;
+}
+
 /**
 * This routine normalizes a response. This includes removing "irrelevant"
 * records from the answer and additional sections and (re)synthesizing
@@ -497,6 +509,19 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
+			/* we don't want NS sets for NXDOMAIN answers,
+			 * because they could contain poisonous contents,
+			 * from. eg. fragmentation attacks, inserted after
+			 * long RRSIGs in the packet get to the packet
+			 * border and such */
+			/* also for NODATA answers */
+			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN ||
+			   (FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR
+			    && soa_in_auth(msg) && msg->an_rrsets == 0)) {
+				remove_rrset("normalize: removing irrelevant "
+					"RRset:", pkt, msg, prev, &rrset);
+				continue;
+			}
 			if(nsset == NULL) {
 				nsset = rrset;
 			} else {
@@ -595,18 +620,6 @@ store_rrset(sldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, now);
 }

-/** Check if there are SOA records in the authority section (negative) */
-static int
-soa_in_auth(struct msg_parse* msg)
-{
-	struct rrset_parse* rrset;
-	for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
-		if(rrset->type == LDNS_RR_TYPE_SOA &&
-			rrset->section == LDNS_SECTION_AUTHORITY) 
-			return 1;
-	return 0;
-}
- 
 /**
 * Check if right hand name in NSEC is within zone
 * @param rrset: the NSEC rrset
@@ -282,10 +282,13 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 static int
 iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
 	uint8_t* name, size_t namelen, uint16_t qtype, time_t now, 
-	struct delegpt* dp, int* best_rtt, struct sock_list* blacklist)
+	struct delegpt* dp, int* best_rtt, struct sock_list* blacklist,
+	size_t* num_suitable_results)
 {
 	int got_it = 0;
 	struct delegpt_addr* a;
+	*num_suitable_results = 0;
+
 	if(dp->bogus)
 		return 0; /* NS bogus, all bogus, nothing found */
 	for(a=dp->result_list; a; a = a->next_result) {
@@ -301,11 +304,58 @@ iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
 			} else if(a->sel_rtt < *best_rtt) {
 				*best_rtt = a->sel_rtt;
 			}
+			(*num_suitable_results)++;
 		}
 	}
 	return got_it;
 }

+/** compare two rtts, return -1, 0 or 1 */
+static int
+rtt_compare(const void* x, const void* y)
+{
+	if(*(int*)x == *(int*)y)
+		return 0;
+	if(*(int*)x > *(int*)y)
+		return 1;
+	return -1;
+}
+
+/** get RTT for the Nth fastest server */
+static int
+nth_rtt(struct delegpt_addr* result_list, size_t num_results, size_t n)
+{
+	int rtt_band;
+	size_t i;
+	int* rtt_list, *rtt_index;
+	
+	if(num_results < 1 || n >= num_results) {
+		return -1;
+	}
+
+	rtt_list = calloc(num_results, sizeof(int));
+	if(!rtt_list) {
+		log_err("malloc failure: allocating rtt_list");
+		return -1;
+	}
+	rtt_index = rtt_list;
+
+	for(i=0; i<num_results && result_list; i++) {
+		if(result_list->sel_rtt != -1) {
+			*rtt_index = result_list->sel_rtt;
+			rtt_index++;
+		}
+		result_list=result_list->next_result;
+	}
+	qsort(rtt_list, num_results, sizeof(*rtt_list), rtt_compare);
+
+	log_assert(n > 0);
+	rtt_band = rtt_list[n-1];
+	free(rtt_list);
+
+	return rtt_band;
+}
+
 /** filter the address list, putting best targets at front,
 * returns number of best targets (or 0, no suitable targets) */
 static int
@@ -314,12 +364,13 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 	struct delegpt* dp, int* selected_rtt, int open_target, 
 	struct sock_list* blacklist, time_t prefetch)
 {
-	int got_num = 0, low_rtt = 0, swap_to_front, rtt_band = RTT_BAND;
+	int got_num = 0, low_rtt = 0, swap_to_front, rtt_band = RTT_BAND, nth;
+	size_t num_results;
 	struct delegpt_addr* a, *n, *prev=NULL;

 	/* fillup sel_rtt and find best rtt in the bunch */
 	got_num = iter_fill_rtt(iter_env, env, name, namelen, qtype, now, dp, 
-		&low_rtt, blacklist);
+		&low_rtt, blacklist, &num_results);
 	if(got_num == 0) 
 		return 0;
 	if(low_rtt >= USEFUL_SERVER_TOP_TIMEOUT &&
@@ -329,14 +380,19 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 			     return 0 to force the caller to fetch more */
 	}

-	if(env->cfg->low_rtt_permil != 0 && prefetch == 0 &&
-		low_rtt < env->cfg->low_rtt &&
-		ub_random_max(env->rnd, 1000) < env->cfg->low_rtt_permil) {
+	if(env->cfg->fast_server_permil != 0 && prefetch == 0 &&
+		num_results > env->cfg->fast_server_num &&
+		ub_random_max(env->rnd, 1000) < env->cfg->fast_server_permil) {
 		/* the query is not prefetch, but for a downstream client,
-		 * there is a low_rtt (fast) server.  We choose that x% of the
-		 * time */
-		/* pick rtt numbers from 0..LOWBAND_RTT */
-		rtt_band = env->cfg->low_rtt - low_rtt;
+		 * there are more servers available then the fastest N we want
+		 * to choose from. Limit our choice to the fastest servers. */
+		nth = nth_rtt(dp->result_list, num_results,
+			env->cfg->fast_server_num);
+		if(nth > 0) {
+			rtt_band = nth - low_rtt;
+			if(rtt_band > RTT_BAND)
+				rtt_band = RTT_BAND;
+		}
 	}

 	got_num = 0;
@@ -1210,3 +1266,50 @@ int iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp)
 		return 0;
 	return 1;
 }
+
+int
+iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf)
+{
+	struct iter_hints_stub *stub;
+	struct delegpt *dp;
+
+	/* Check for stub. */
+	stub = hints_lookup_stub(qstate->env->hints, qinf->qname,
+	    qinf->qclass, NULL);
+	dp = forwards_lookup(qstate->env->fwds, qinf->qname, qinf->qclass);
+
+	/* see if forward or stub is more pertinent */
+	if(stub && stub->dp && dp) {
+		if(dname_strict_subdomain(dp->name, dp->namelabs,
+			stub->dp->name, stub->dp->namelabs)) {
+			stub = NULL; /* ignore stub, forward is lower */
+		} else {
+			dp = NULL; /* ignore forward, stub is lower */
+		}
+	}
+
+	/* check stub */
+	if (stub != NULL && stub->dp != NULL) {
+		if(stub->dp->no_cache) {
+			char qname[255+1];
+			char dpname[255+1];
+			dname_str(qinf->qname, qname);
+			dname_str(stub->dp->name, dpname);
+			verbose(VERB_ALGO, "stub for %s %s has no_cache", qname, dpname);
+		}
+		return (stub->dp->no_cache);
+	}
+
+	/* Check for forward. */
+	if (dp) {
+		if(dp->no_cache) {
+			char qname[255+1];
+			char dpname[255+1];
+			dname_str(qinf->qname, qname);
+			dname_str(dp->name, dpname);
+			verbose(VERB_ALGO, "forward for %s %s has no_cache", qname, dpname);
+		}
+		return (dp->no_cache);
+	}
+	return 0;
+}
@@ -369,4 +369,13 @@ int iter_ds_toolow(struct dns_msg* msg, struct delegpt* dp);
 */
 int iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp);

+/** 
+ * Lookup if no_cache is set in stub or fwd.
+ * @param qstate: query state with env with hints and fwds.
+ * @param qinf: query name to lookup for.
+ * @return true if no_cache is set in stub or fwd.
+ */
+int iter_stub_fwd_no_cache(struct module_qstate *qstate,
+	struct query_info *qinf);
+
 #endif /* ITERATOR_ITER_UTILS_H */
@@ -69,6 +69,9 @@
 #include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"

+/* in msec */
+int UNKNOWN_SERVER_NICENESS = 376;
+
 int 
 iter_init(struct module_env* env, int id)
 {
@@ -324,6 +327,29 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 			/* serving expired contents, but nothing is cached
 			 * at all, so the servfail cache entry is useful
 			 * (stops waste of time on this servfail NORR_TTL) */
+		} else {
+			/* don't overwrite existing (non-expired) data in
+			 * cache with a servfail */
+			struct msgreply_entry* msg;
+			if((msg=msg_cache_lookup(qstate->env,
+				qstate->qinfo.qname, qstate->qinfo.qname_len,
+				qstate->qinfo.qtype, qstate->qinfo.qclass,
+				qstate->query_flags, *qstate->env->now, 0))
+				!= NULL) {
+				struct reply_info* rep = (struct reply_info*)
+					msg->entry.data;
+				if(FLAGS_GET_RCODE(rep->flags) ==
+					LDNS_RCODE_NOERROR ||
+					FLAGS_GET_RCODE(rep->flags) ==
+					LDNS_RCODE_NXDOMAIN) {
+					/* we have a good entry,
+					 * don't overwrite */
+					lock_rw_unlock(&msg->entry.lock);
+					return error_response(qstate, id, rcode);
+				}
+				lock_rw_unlock(&msg->entry.lock);
+			}
+			
 		}
 		memset(&err, 0, sizeof(err));
 		err.flags = (uint16_t)(BIT_QR | BIT_RA);
@@ -1144,53 +1170,6 @@ forward_request(struct module_qstate* qstate, struct iter_qstate* iq)
 	return 1;
 }

-static int
-iter_stub_fwd_no_cache(struct module_qstate *qstate, struct iter_qstate *iq)
-{
-	struct iter_hints_stub *stub;
-	struct delegpt *dp;
-
-	/* Check for stub. */
-	stub = hints_lookup_stub(qstate->env->hints, iq->qchase.qname,
-	    iq->qchase.qclass, iq->dp);
-	dp = forwards_lookup(qstate->env->fwds, iq->qchase.qname, iq->qchase.qclass);
-
-	/* see if forward or stub is more pertinent */
-	if(stub && stub->dp && dp) {
-		if(dname_strict_subdomain(dp->name, dp->namelabs,
-			stub->dp->name, stub->dp->namelabs)) {
-			stub = NULL; /* ignore stub, forward is lower */
-		} else {
-			dp = NULL; /* ignore forward, stub is lower */
-		}
-	}
-
-	/* check stub */
-	if (stub != NULL && stub->dp != NULL) {
-		if(stub->dp->no_cache) {
-			char qname[255+1];
-			char dpname[255+1];
-			dname_str(iq->qchase.qname, qname);
-			dname_str(stub->dp->name, dpname);
-			verbose(VERB_ALGO, "stub for %s %s has no_cache", qname, dpname);
-		}
-		return (stub->dp->no_cache);
-	}
-
-	/* Check for forward. */
-	if (dp) {
-		if(dp->no_cache) {
-			char qname[255+1];
-			char dpname[255+1];
-			dname_str(iq->qchase.qname, qname);
-			dname_str(dp->name, dpname);
-			verbose(VERB_ALGO, "forward for %s %s has no_cache", qname, dpname);
-		}
-		return (dp->no_cache);
-	}
-	return 0;
-}
-
 /** 
 * Process the initial part of the request handling. This state roughly
 * corresponds to resolver algorithms steps 1 (find answer in cache) and 2
@@ -1268,7 +1247,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* This either results in a query restart (CNAME cache response), a
 	 * terminating response (ANSWER), or a cache miss (null). */
 	
-	if (iter_stub_fwd_no_cache(qstate, iq)) {
+	if (iter_stub_fwd_no_cache(qstate, &iq->qchase)) {
 		/* Asked to not query cache. */
 		verbose(VERB_ALGO, "no-cache set, going to the network");
 		qstate->no_cache_lookup = 1;
@@ -83,7 +83,7 @@ struct rbtree_type;
 /** how nice is a server without further information, in msec 
 * Equals rtt initial timeout value.
 */
-#define UNKNOWN_SERVER_NICENESS 376
+extern int UNKNOWN_SERVER_NICENESS;
 /** maximum timeout before a host is deemed unsuitable, in msec. 
 * After host_ttl this will be timed out and the host will be tried again. 
 * Equals RTT_MAX_TIMEOUT
@@ -657,8 +657,8 @@ libworker_event_done_cb(void* arg, int rcode, sldns_buffer* buf,
 			sec = 1;
 		else if(s == sec_status_secure)
 			sec = 2;
-		(*cb)(cb_arg, rcode, (void*)sldns_buffer_begin(buf),
-			(int)sldns_buffer_limit(buf), sec, why_bogus, was_ratelimited);
+		(*cb)(cb_arg, rcode, (buf?(void*)sldns_buffer_begin(buf):NULL),
+			(buf?(int)sldns_buffer_limit(buf):0), sec, why_bogus, was_ratelimited);
 	}
 }

@@ -103,42 +103,67 @@ Inplace callbacks
    :param opt_list_out: :class:`edns_option`. EDNS option list to append options to.
    :param region: :class:`regional`

-.. function:: register_inplace_cb_reply(py_cb, env)
+.. function:: inplace_cb_query(qinfo, flags, qstate, addr, zone, region)
+
+    Function prototype for callback functions used in
+    `register_inplace_cb_query`_.
+
+    :param qinfo: :class:`query_info`
+    :param flags: query flags (integer)
+    :param qstate: :class:`module_qstate`
+    :param addr: :class:`sockaddr_storage`
+    :param zone: zone name in wire format (bytes)
+    :param region: :class:`regional`
+
+.. function:: register_inplace_cb_reply(py_cb, env, id)

    Register py_cb as an inplace reply callback function.

    :param py_cb: Python function that follows `inplace_cb_reply`_'s prototype. **Must** be callable.
    :param env: :class:`module_env`
+    :param id: Module ID.
    :return: True on success, False otherwise
    :rtype: boolean

-.. function:: register_inplace_cb_reply_cache(py_cb, env)
+.. function:: register_inplace_cb_reply_cache(py_cb, env, id)

    Register py_cb as an inplace reply_cache callback function.

    :param py_cb: Python function that follows `inplace_cb_reply`_'s prototype. **Must** be callable.
    :param env: :class:`module_env`
+    :param id: Module ID.
    :return: True on success, False otherwise
    :rtype: boolean

-.. function:: register_inplace_cb_reply_local(py_cb, env)
+.. function:: register_inplace_cb_reply_local(py_cb, env, id)

    Register py_cb as an inplace reply_local callback function.

    :param py_cb: Python function that follows `inplace_cb_reply`_'s prototype. **Must** be callable.
    :param env: :class:`module_env`
+    :param id: Module ID.
    :return: True on success, False otherwise
    :rtype: boolean

-.. function:: register_inplace_cb_reply_servfail(py_cb, env)
+.. function:: register_inplace_cb_reply_servfail(py_cb, env, id)

    Register py_cb as an inplace reply_servfail callback function.

    :param py_cb: Python function that follows `inplace_cb_reply`_'s prototype. **Must** be callable.
    :param env: :class:`module_env`
+    :param id: Module ID.
    :return: True on success, False otherwise
    :rtype: boolean

+.. function:: register_inplace_cb_query(py_cb, env, id)
+
+    Register py_cb as an inplace query callback function.
+
+    :param py_cb: Python function that follows `inplace_cb_query`_'s prototype. **Must** be callable.
+    :param env: :class:`module_env`
+    :param id: Module ID.
+    :return: True on success, False otherwise
+    :rtype: boolean

 Logging
 -------
@@ -514,3 +514,33 @@ pythonmod_qstate
 	
 	   Here you can keep your own private data (each thread has own data object).

+sockaddr_storage
+-------------------------
+
+.. class:: sockaddr_storage
+
+   The :class:`sockaddr_storage` provides these data attributes:
+
+   .. attribute:: family
+
+      Address family name as a string. Possible values are `ip4`, `ip6`, and `unix`.
+
+   .. attribute:: addr
+
+      Address in presentation format.
+
+   .. attribute:: raw_addr
+
+      Address in network wire format.
+
+   .. attribute:: port
+
+      Port number. Invalid for Unix address.
+
+   .. attribute:: flowinfo
+
+      Flow info value. Valid only for IPv6 address.
+
+   .. attribute:: scope_id
+
+      Scope ID value. Valid only for IPv6 address.
@@ -247,6 +247,25 @@ def inplace_servfail_callback(qinfo, qstate, rep, rcode, edns, opt_list_out,
    return True


+def inplace_query_callback(qinfo, flags, qstate, addr, zone, region, **kwargs):
+    """
+    Function that will be registered as an inplace callback function.
+    It will be called before sending a query to a backend server.
+
+    :param qinfo: query_info struct;
+    :param flags: flags of the query;
+    :param qstate: module qstate. opt_lists are available here;
+    :param addr: struct sockaddr_storage. Address of the backend server;
+    :param zone: zone name in binary;
+    :param region: region to allocate temporary data. Needs to be used when we
+                   want to append a new option to opt_lists.
+    :param **kwargs: Dictionary that may contain parameters added in a future
+                     release.
+    """
+    log_info("python: outgoing query to {}@{}".format(addr.addr, addr.port))
+    return True
+
+
 def init_standard(id, env):
    """
    New version of the init function.
@@ -281,6 +300,11 @@ def init_standard(id, env):
    if not register_inplace_cb_reply_servfail(inplace_servfail_callback, env, id):
        return False

+    # Register the inplace_query_callback function as an inplace callback
+    # before sending a query to a backend server.
+    if not register_inplace_cb_query(inplace_query_callback, env, id):
+        return False
+
    return True


@@ -12,6 +12,8 @@
   #include <sys/socket.h>
   #include <netinet/in.h>
   #include <arpa/inet.h>
+   #include <netdb.h>
+   #include <sys/un.h>
   #include <stdarg.h>
   #include "config.h"
   #include "util/log.h"
@@ -43,15 +45,21 @@

     i = 0;
     while (i < len) {
-        i += name[i] + 1;
+        i += ((unsigned int)name[i]) + 1;
        cnt++;
     }

     list = PyList_New(cnt);
     i = 0; cnt = 0;
     while (i < len) {
-        PyList_SetItem(list, cnt, PyBytes_FromStringAndSize(name + i + 1, name[i]));
-        i += name[i] + 1;
+        char buf[LDNS_MAX_LABELLEN+1];
+        if(((unsigned int)name[i])+1 <= (unsigned int)sizeof(buf) &&
+                i+(int)((unsigned int)name[i]) < len) {
+                memmove(buf, name + i + 1, (unsigned int)name[i]);
+                buf[(unsigned int)name[i]] = 0;
+                PyList_SetItem(list, cnt, PyString_FromString(buf));
+        }
+        i += ((unsigned int)name[i]) + 1;
        cnt++;
     }
     return list;
@@ -159,11 +167,11 @@ struct query_info {
 %}

 %inline %{
-   PyObject* dnameAsStr(const char* dname) {
+   PyObject* dnameAsStr(PyObject* dname) {
       char buf[LDNS_MAX_DOMAINLEN+1];
       buf[0] = '\0';
-       dname_str((uint8_t*)dname, buf);
-       return PyBytes_FromString(buf);
+       dname_str((uint8_t*)PyBytes_AsString(dname), buf);
+       return PyString_FromString(buf);
   }
 %}

@@ -426,6 +434,164 @@ struct dns_msg {
   %}
 }

+/* ************************************************************************************ *
+   Structure sockaddr_storage
+ * ************************************************************************************ */
+
+struct sockaddr_storage {};
+
+%inline %{
+    static size_t _sockaddr_storage_len(const struct sockaddr_storage *ss) {
+        if (ss == NULL) {
+            return 0;
+        }
+
+        switch (ss->ss_family) {
+        case AF_INET:  return sizeof(struct sockaddr_in);
+        case AF_INET6: return sizeof(struct sockaddr_in6);
+        case AF_UNIX:  return sizeof(struct sockaddr_un);
+        default:
+            return 0;
+        }
+    }
+
+    PyObject *_sockaddr_storage_family(const struct sockaddr_storage *ss) {
+        if (ss == NULL) {
+            return Py_None;
+        }
+
+        switch (ss->ss_family) {
+        case AF_INET:  return PyUnicode_FromString("ip4");
+        case AF_INET6: return PyUnicode_FromString("ip6");
+        case AF_UNIX:  return PyUnicode_FromString("unix");
+        default:
+            return Py_None;
+        }
+    }
+
+    PyObject *_sockaddr_storage_addr(const struct sockaddr_storage *ss) {
+        const struct sockaddr *sa;
+        size_t sa_len;
+        char name[NI_MAXHOST] = {0};
+
+        if (ss == NULL) {
+            return Py_None;
+        }
+
+        sa = (struct sockaddr *)ss;
+        sa_len = _sockaddr_storage_len(ss);
+        if (sa_len == 0) {
+            return Py_None;
+        }
+
+        if (getnameinfo(sa, sa_len, name, sizeof(name), NULL, 0, NI_NUMERICHOST) != 0) {
+            return Py_None;
+        }
+
+        return PyUnicode_FromString(name);
+    }
+
+    PyObject *_sockaddr_storage_raw_addr(const struct sockaddr_storage *ss) {
+        size_t sa_len;
+
+        if (ss == NULL) {
+            return Py_None;
+        }
+
+        sa_len = _sockaddr_storage_len(ss);
+        if (sa_len == 0) {
+            return Py_None;
+        }
+
+        if (ss->ss_family == AF_INET) {
+            const struct sockaddr_in *sa = (struct sockaddr_in *)ss;
+            const struct in_addr *raw = (struct in_addr *)&sa->sin_addr;
+            return PyBytes_FromStringAndSize((const char *)raw, sizeof(*raw));
+        }
+
+        if (ss->ss_family == AF_INET6) {
+            const struct sockaddr_in6 *sa = (struct sockaddr_in6 *)ss;
+            const struct in6_addr *raw = (struct in6_addr *)&sa->sin6_addr;
+            return PyBytes_FromStringAndSize((const char *)raw, sizeof(*raw));
+        }
+
+        if (ss->ss_family == AF_UNIX) {
+            const struct sockaddr_un *sa = (struct sockaddr_un *)ss;
+            return PyBytes_FromString(sa->sun_path);
+        }
+
+        return Py_None;
+    }
+
+    PyObject *_sockaddr_storage_port(const struct sockaddr_storage *ss) {
+        if (ss == NULL) {
+            return Py_None;
+        }
+
+        if (ss->ss_family == AF_INET) {
+            const struct sockaddr_in *sa4 = (struct sockaddr_in *)ss;
+            return PyInt_FromLong(ntohs(sa4->sin_port));
+        }
+
+        if (ss->ss_family == AF_INET6) {
+            const struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)ss;
+            return PyInt_FromLong(ntohs(sa6->sin6_port));
+        }
+
+        return Py_None;
+    }
+
+    PyObject *_sockaddr_storage_flowinfo(const struct sockaddr_storage *ss) {
+        const struct sockaddr_in6 *sa6;
+
+        if (ss == NULL || ss->ss_family != AF_INET6) {
+            return Py_None;
+        }
+
+        sa6 = (struct sockaddr_in6 *)ss;
+        return PyInt_FromLong(ntohl(sa6->sin6_flowinfo));
+    }
+
+    PyObject *_sockaddr_storage_scope_id(const struct sockaddr_storage *ss) {
+        const struct sockaddr_in6 *sa6;
+
+        if (ss == NULL || ss->ss_family != AF_INET6) {
+            return Py_None;
+        }
+
+        sa6 = (struct sockaddr_in6 *)ss;
+        return PyInt_FromLong(ntohl(sa6->sin6_scope_id));
+    }
+%}
+
+%extend sockaddr_storage {
+   %pythoncode %{
+        def _family_get(self): return _sockaddr_storage_family(self)
+        __swig_getmethods__["family"] = _family_get
+        if _newclass: family = _swig_property(_family_get)
+
+        def _addr_get(self): return _sockaddr_storage_addr(self)
+        __swig_getmethods__["addr"] = _addr_get
+        if _newclass: addr = _swig_property(_addr_get)
+
+        def _raw_addr_get(self): return _sockaddr_storage_raw_addr(self)
+        __swig_getmethods__["raw_addr"] = _raw_addr_get
+        if _newclass: raw_addr = _swig_property(_raw_addr_get)
+
+        def _port_get(self): return _sockaddr_storage_port(self)
+        __swig_getmethods__["port"] = _port_get
+        if _newclass: port = _swig_property(_port_get)
+
+        def _flowinfo_get(self): return _sockaddr_storage_flowinfo(self)
+        __swig_getmethods__["flowinfo"] = _flowinfo_get
+        if _newclass: flowinfo = _swig_property(_flowinfo_get)
+
+        def _scope_id_get(self): return _sockaddr_storage_scope_id(self)
+        __swig_getmethods__["scope_id"] = _scope_id_get
+        if _newclass: scope_id = _swig_property(_scope_id_get)
+   %}
+}
+
 /* ************************************************************************************ *
   Structure mesh_state
 * ************************************************************************************ */
@@ -438,52 +604,22 @@ struct mesh_reply {
   struct comm_reply query_reply;
 };

+%rename(_addr) comm_reply::addr;
 struct comm_reply {
-
+   struct sockaddr_storage addr;
 };

-%inline %{
-
-  PyObject* _comm_reply_addr_get(struct comm_reply* reply) {
-     char dest[64];
-     reply_addr2str(reply, dest, 64);
-     if (dest[0] == 0)
-        return Py_None;
-     return PyBytes_FromString(dest);
-  }
-
-  PyObject* _comm_reply_family_get(struct comm_reply* reply) {
-
-        int af = (int)((struct sockaddr_in*) &(reply->addr))->sin_family;
-
-        switch(af) {
-           case AF_INET: return PyBytes_FromString("ip4");
-           case AF_INET6: return PyBytes_FromString("ip6");
-           case AF_UNIX: return PyBytes_FromString("unix");
-        }
-
-        return Py_None;
-  }
-
-  PyObject* _comm_reply_port_get(struct comm_reply* reply) {
-     uint16_t port;
-     port = ntohs(((struct sockaddr_in*)&(reply->addr))->sin_port);
-     return PyInt_FromLong(port);
-  }
-
-%}
-
 %extend comm_reply {
   %pythoncode %{
-        def _addr_get(self): return _comm_reply_addr_get(self)
+        def _addr_get(self): return _sockaddr_storage_addr(self._addr)
        __swig_getmethods__["addr"] = _addr_get
        if _newclass:addr = _swig_property(_addr_get)

-        def _port_get(self): return _comm_reply_port_get(self)
+        def _port_get(self): return _sockaddr_storage_port(self._addr)
        __swig_getmethods__["port"] = _port_get
        if _newclass:port = _swig_property(_port_get)

-        def _family_get(self): return _comm_reply_family_get(self)
+        def _family_get(self): return _sockaddr_storage_family(self._addr)
        __swig_getmethods__["family"] = _family_get
        if _newclass:family = _swig_property(_family_get)
   %}
@@ -1081,7 +1217,7 @@ int checkList(PyObject *l)
       for (i=0; i < PyList_Size(l); i++)
       {
           item = PyList_GetItem(l, i);
-           if (!PyBytes_Check(item))
+           if (!PyBytes_Check(item) && !PyUnicode_Check(item))
              return 0;
       }
       return 1;
@@ -1096,23 +1232,40 @@ int pushRRList(sldns_buffer* qb, PyObject *l, uint32_t default_ttl, int qsec,
    PyObject* item;
    int i;
    size_t len;
+    char* s;
+    PyObject* ascstr;

    for (i=0; i < PyList_Size(l); i++)
    {
+        ascstr = NULL;
        item = PyList_GetItem(l, i);
+        if(PyObject_TypeCheck(item, &PyBytes_Type)) {
+                s = PyBytes_AsString(item);
+        } else {
+                ascstr = PyUnicode_AsASCIIString(item);
+                s = PyBytes_AsString(ascstr);
+        }

        len = sldns_buffer_remaining(qb);
        if(qsec) {
-                if(sldns_str2wire_rr_question_buf(PyBytes_AsString(item),
+                if(sldns_str2wire_rr_question_buf(s,
                        sldns_buffer_current(qb), &len, NULL, NULL, 0, NULL, 0)
-                        != 0)
+                        != 0) {
+                        if(ascstr)
+                            Py_DECREF(ascstr);
                        return 0;
+                }
        } else {
-                if(sldns_str2wire_rr_buf(PyBytes_AsString(item),
+                if(sldns_str2wire_rr_buf(s,
                        sldns_buffer_current(qb), &len, NULL, default_ttl,
-                        NULL, 0, NULL, 0) != 0)
+                        NULL, 0, NULL, 0) != 0) {
+                        if(ascstr)
+                            Py_DECREF(ascstr);
                        return 0;
+                }
        }
+        if(ascstr)
+            Py_DECREF(ascstr);
        sldns_buffer_skip(qb, len);

        sldns_buffer_write_u16_at(qb, count_offset,
@@ -1437,6 +1590,54 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
        return python_inplace_cb_register(inplace_cb_reply_servfail,
                py_cb, env, id);
    }
+
+    int python_inplace_cb_query_generic(
+        struct query_info* qinfo, uint16_t flags, struct module_qstate* qstate,
+        struct sockaddr_storage* addr, socklen_t addrlen,
+        uint8_t* zone, size_t zonelen, struct regional* region, int id,
+        void* python_callback)
+    {
+        int res = 0;
+        PyObject *func = python_callback;
+
+        PyGILState_STATE gstate = PyGILState_Ensure();
+
+        PyObject *py_qinfo = SWIG_NewPointerObj((void*) qinfo, SWIGTYPE_p_query_info, 0);
+        PyObject *py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
+        PyObject *py_addr = SWIG_NewPointerObj((void *) addr, SWIGTYPE_p_sockaddr_storage, 0);
+        PyObject *py_zone = PyBytes_FromStringAndSize((const char *)zone, zonelen);
+        PyObject *py_region = SWIG_NewPointerObj((void*) region, SWIGTYPE_p_regional, 0);
+
+        PyObject *py_args = Py_BuildValue("(OiOOOO)", py_qinfo, flags, py_qstate, py_addr, py_zone, py_region);
+        PyObject *py_kwargs = Py_BuildValue("{}");
+        PyObject *result = PyObject_Call(func, py_args, py_kwargs);
+        if (result) {
+            res = PyInt_AsLong(result);
+        }
+
+        Py_XDECREF(py_qinfo);
+        Py_XDECREF(py_qstate);
+        Py_XDECREF(py_addr);
+        Py_XDECREF(py_zone);
+        Py_XDECREF(py_region);
+
+        Py_XDECREF(py_args);
+        Py_XDECREF(py_kwargs);
+        Py_XDECREF(result);
+
+        PyGILState_Release(gstate);
+
+        return res;
+    }
+
+    static int register_inplace_cb_query(PyObject* py_cb,
+        struct module_env* env, int id)
+    {
+        int ret = inplace_cb_register(python_inplace_cb_query_generic,
+                inplace_cb_query, (void*) py_cb, env, id);
+        if (ret) Py_INCREF(py_cb);
+        return ret;
+    }
 %}
 /* C declarations */
 int inplace_cb_register(void* cb, enum inplace_cb_list_type type, void* cbarg,
@@ -1451,3 +1652,5 @@ static int register_inplace_cb_reply_local(PyObject* py_cb,
    struct module_env* env, int id);
 static int register_inplace_cb_reply_servfail(PyObject* py_cb,
    struct module_env* env, int id);
+static int register_inplace_cb_query(PyObject *py_cb,
+    struct module_env* env, int id);
@@ -110,6 +110,136 @@ struct pythonmod_qstate {
 #include "pythonmod/interface.h"
 #endif

+/** log python error */
+static void
+log_py_err(void)
+{
+	char *result = NULL;
+	const char* iomod = "cStringIO";
+	PyObject *modStringIO = NULL;
+	PyObject *modTB = NULL;
+	PyObject *obFuncStringIO = NULL;
+	PyObject *obStringIO = NULL;
+	PyObject *obFuncTB = NULL;
+	PyObject *argsTB = NULL;
+	PyObject *obResult = NULL;
+	PyObject *ascstr = NULL;
+	PyObject *exc_typ, *exc_val, *exc_tb;
+
+	/* Fetch the error state now before we cruch it */
+	/* exc val contains the error message
+	 * exc tb contains stack traceback and other info. */
+	PyErr_Fetch(&exc_typ, &exc_val, &exc_tb);
+	PyErr_NormalizeException(&exc_typ, &exc_val, &exc_tb);
+
+	/* Import the modules we need - cStringIO and traceback */
+	modStringIO = PyImport_ImportModule("cStringIO");
+	if (modStringIO==NULL) {
+		/* python 1.4 and before */
+		modStringIO = PyImport_ImportModule("StringIO");
+		iomod = "StringIO";
+	}
+	if (modStringIO==NULL) {
+		/* python 3 */
+		modStringIO = PyImport_ImportModule("io");
+		iomod = "io";
+	}
+	if (modStringIO==NULL) {
+		log_err("pythonmod: cannot print exception, "
+			"cannot ImportModule cStringIO or StringIO or io");
+		goto cleanup;
+	}
+	modTB = PyImport_ImportModule("traceback");
+	if (modTB==NULL) {
+		log_err("pythonmod: cannot print exception, "
+			"cannot ImportModule traceback");
+		goto cleanup;
+	}
+
+	/* Construct a cStringIO object */
+	obFuncStringIO = PyObject_GetAttrString(modStringIO, "StringIO");
+	if (obFuncStringIO==NULL) {
+		log_err("pythonmod: cannot print exception, "
+			"cannot GetAttrString %s.StringIO", iomod);
+		goto cleanup;
+	}
+	obStringIO = PyObject_CallObject(obFuncStringIO, NULL);
+	if (obStringIO==NULL) {
+		log_err("pythonmod: cannot print exception, "
+			"cannot call %s.StringIO()", iomod);
+		goto cleanup;
+	}
+
+	/* Get the traceback.print_exception function, and call it. */
+	obFuncTB = PyObject_GetAttrString(modTB, "print_exception");
+	if (obFuncTB==NULL) {
+		log_err("pythonmod: cannot print exception, "
+			"cannot GetAttrString traceback.print_exception");
+		goto cleanup;
+	}
+	argsTB = Py_BuildValue("OOOOO", (exc_typ ? exc_typ : Py_None),
+		(exc_val ? exc_val : Py_None), (exc_tb  ? exc_tb  : Py_None),
+		Py_None, obStringIO);
+	if (argsTB==NULL) {
+		log_err("pythonmod: cannot print exception, "
+			"cannot BuildValue for print_exception");
+		goto cleanup;
+	}
+
+	obResult = PyObject_CallObject(obFuncTB, argsTB);
+	if (obResult==NULL) {
+		PyErr_Print();
+		log_err("pythonmod: cannot print exception, "
+			"call traceback.print_exception() failed");
+		goto cleanup;
+	}
+
+	/* Now call the getvalue() method in the StringIO instance */
+	Py_DECREF(obFuncStringIO);
+	obFuncStringIO = PyObject_GetAttrString(obStringIO, "getvalue");
+	if (obFuncStringIO==NULL) {
+		log_err("pythonmod: cannot print exception, "
+			"cannot GetAttrString StringIO.getvalue");
+		goto cleanup;
+	}
+	Py_DECREF(obResult);
+	obResult = PyObject_CallObject(obFuncStringIO, NULL);
+	if (obResult==NULL) {
+		log_err("pythonmod: cannot print exception, "
+			"call StringIO.getvalue() failed");
+		goto cleanup;
+	}
+
+	/* And it should be a string all ready to go - duplicate it. */
+	if (!PyString_Check(obResult) && !PyUnicode_Check(obResult)) {
+		log_err("pythonmod: cannot print exception, "
+			"StringIO.getvalue() result did not String_Check"
+			" or Unicode_Check");
+		goto cleanup;
+	}
+	if(PyString_Check(obResult)) {
+		result = PyString_AsString(obResult);
+	} else {
+		ascstr = PyUnicode_AsASCIIString(obResult);
+		result = PyBytes_AsString(ascstr);
+	}
+	log_err("pythonmod: python error: %s", result);
+
+cleanup:
+	Py_XDECREF(modStringIO);
+	Py_XDECREF(modTB);
+	Py_XDECREF(obFuncStringIO);
+	Py_XDECREF(obStringIO);
+	Py_XDECREF(obFuncTB);
+	Py_XDECREF(argsTB);
+	Py_XDECREF(obResult);
+	Py_XDECREF(ascstr);
+
+	/* clear the exception, by not restoring it */
+	/* Restore the exception state */
+	/* PyErr_Restore(exc_typ, exc_val, exc_tb); */
+}
+
 int pythonmod_init(struct module_env* env, int id)
 {
   /* Initialize module */
@@ -193,13 +323,26 @@ int pythonmod_init(struct module_env* env, int id)

   /* TODO: deallocation of pe->... if an error occurs */

-   if (PyRun_SimpleFile(script_py, pe->fname) < 0)
-   {
+   if (PyRun_SimpleFile(script_py, pe->fname) < 0) {
      log_err("pythonmod: can't parse Python script %s", pe->fname);
+      /* print the error to logs too, run it again */
+      fseek(script_py, 0, SEEK_SET);
+      /* we don't run the file, like this, because then side-effects
+       *    s = PyRun_File(script_py, pe->fname, Py_file_input, 
+       *        PyModule_GetDict(PyImport_AddModule("__main__")), pe->dict);
+       * could happen (again). Instead we parse the file again to get
+       * the error string in the logs, for when the daemon has stderr
+       * removed.  SimpleFile run already printed to stderr, for then
+       * this is called from unbound-checkconf or unbound -dd the user
+       * has a nice formatted error.
+      */
+      /* ignore the NULL return of _node, it is NULL due to the parse failure
+       * that we are expecting */
+      (void)PyParser_SimpleParseFile(script_py, pe->fname, Py_file_input);
+      log_py_err();
      PyGILState_Release(gil);
      return 0;
   }
-
   fclose(script_py);

   if ((pe->func_init = PyDict_GetItemString(pe->dict, "init_standard")) == NULL)
@@ -244,7 +387,7 @@ int pythonmod_init(struct module_env* env, int id)
   if (PyErr_Occurred())
   {
      log_err("pythonmod: Exception occurred in function init");
-      PyErr_Print();
+      log_py_err();
      Py_XDECREF(res);
      Py_XDECREF(py_init_arg);
      PyGILState_Release(gil);
@@ -274,7 +417,7 @@ void pythonmod_deinit(struct module_env* env, int id)
      res = PyObject_CallFunction(pe->func_deinit, "i", id);
      if (PyErr_Occurred()) {
         log_err("pythonmod: Exception occurred in function deinit");
-         PyErr_Print();
+         log_py_err();
      }
      /* Free result if any */
      Py_XDECREF(res);
@@ -312,7 +455,7 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
   if (PyErr_Occurred())
   {
      log_err("pythonmod: Exception occurred in function inform_super");
-      PyErr_Print();
+      log_py_err();
      qstate->ext_state[id] = module_error;
   }
   else if ((res == NULL)  || (!PyObject_IsTrue(res)))
@@ -353,7 +496,7 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
   if (PyErr_Occurred())
   {
      log_err("pythonmod: Exception occurred in function operate, event: %s", strmodulevent(event));
-      PyErr_Print();
+      log_py_err();
      qstate->ext_state[id] = module_error;
   }
   else if ((res == NULL)  || (!PyObject_IsTrue(res)))
@@ -74,4 +74,12 @@ int python_inplace_cb_reply_generic(struct query_info* qinfo,
 	struct edns_data* edns, struct edns_option** opt_list_out,
 	struct comm_reply* repinfo, struct regional* region, int id,
 	void* python_callback);
+
+/** Declared here for fptr_wlist access. The definition is in interface.i. */
+int python_inplace_cb_query_generic(
+        struct query_info* qinfo, uint16_t flags, struct module_qstate* qstate,
+        struct sockaddr_storage* addr, socklen_t addrlen,
+        uint8_t* zone, size_t zonelen, struct regional* region, int id,
+        void* python_callback);
+
 #endif /* PYTHONMOD_H */
@@ -1450,11 +1450,13 @@ az_remove_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen,
 *	The lineno is set at 1 and then increased by the function.
 * @param fname: file name.
 * @param depth: recursion depth for includes
+ * @param cfg: config for chroot.
 * returns false on failure, has printed an error message
 */
 static int
 az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
-	struct sldns_file_parse_state* state, char* fname, int depth)
+	struct sldns_file_parse_state* state, char* fname, int depth,
+	struct config_file* cfg)
 {
 	size_t rr_len, dname_len;
 	int status;
@@ -1480,6 +1482,11 @@ az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
 				/* skip spaces */
 				while(*incfile == ' ' || *incfile == '\t')
 					incfile++;
+				/* adjust for chroot on include file */
+				if(cfg->chrootdir && cfg->chrootdir[0] &&
+					strncmp(incfile, cfg->chrootdir,
+						strlen(cfg->chrootdir)) == 0)
+					incfile += strlen(cfg->chrootdir);
 				incfile = strdup(incfile);
 				if(!incfile) {
 					log_err("malloc failure");
@@ -1490,7 +1497,7 @@ az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
 				inc = fopen(incfile, "r");
 				if(!inc) {
 					log_err("%s:%d cannot open include "
-						"file %s: %s", z->zonefile,
+						"file %s: %s", fname,
 						lineno_orig, incfile,
 						strerror(errno));
 					free(incfile);
@@ -1498,7 +1505,7 @@ az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
 				}
 				/* recurse read that file now */
 				if(!az_parse_file(z, inc, rr, rrbuflen,
-					state, incfile, depth+1)) {
+					state, incfile, depth+1, cfg)) {
 					log_err("%s:%d cannot parse include "
 						"file %s", fname,
 						lineno_orig, incfile);
@@ -1538,30 +1545,36 @@ az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
 }

 int
-auth_zone_read_zonefile(struct auth_zone* z)
+auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 {
 	uint8_t rr[LDNS_RR_BUF_SIZE];
 	struct sldns_file_parse_state state;
+	char* zfilename;
 	FILE* in;
 	if(!z || !z->zonefile || z->zonefile[0]==0)
 		return 1; /* no file, or "", nothing to read */
+	
+	zfilename = z->zonefile;
+	if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename,
+		cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
+		zfilename += strlen(cfg->chrootdir);
 	if(verbosity >= VERB_ALGO) {
 		char nm[255+1];
 		dname_str(z->name, nm);
-		verbose(VERB_ALGO, "read zonefile %s for %s", z->zonefile, nm);
+		verbose(VERB_ALGO, "read zonefile %s for %s", zfilename, nm);
 	}
-	in = fopen(z->zonefile, "r");
+	in = fopen(zfilename, "r");
 	if(!in) {
 		char* n = sldns_wire2str_dname(z->name, z->namelen);
 		if(z->zone_is_slave && errno == ENOENT) {
 			/* we fetch the zone contents later, no file yet */
 			verbose(VERB_ALGO, "no zonefile %s for %s",
-				z->zonefile, n?n:"error");
+				zfilename, n?n:"error");
 			free(n);
 			return 1;
 		}
 		log_err("cannot open zonefile %s for %s: %s",
-			z->zonefile, n?n:"error", strerror(errno));
+			zfilename, n?n:"error", strerror(errno));
 		free(n);
 		return 0;
 	}
@@ -1579,10 +1592,10 @@ auth_zone_read_zonefile(struct auth_zone* z)
 		state.origin_len = z->namelen;
 	}
 	/* parse the (toplevel) file */
-	if(!az_parse_file(z, in, rr, sizeof(rr), &state, z->zonefile, 0)) {
+	if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) {
 		char* n = sldns_wire2str_dname(z->name, z->namelen);
 		log_err("error parsing zonefile %s for %s",
-			z->zonefile, n?n:"error");
+			zfilename, n?n:"error");
 		free(n);
 		fclose(in);
 		return 0;
@@ -1710,13 +1723,13 @@ int auth_zone_write_file(struct auth_zone* z, const char* fname)

 /** read all auth zones from file (if they have) */
 static int
-auth_zones_read_zones(struct auth_zones* az)
+auth_zones_read_zones(struct auth_zones* az, struct config_file* cfg)
 {
 	struct auth_zone* z;
 	lock_rw_wrlock(&az->lock);
 	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
 		lock_rw_wrlock(&z->lock);
-		if(!auth_zone_read_zonefile(z)) {
+		if(!auth_zone_read_zonefile(z, cfg)) {
 			lock_rw_unlock(&z->lock);
 			lock_rw_unlock(&az->lock);
 			return 0;
@@ -1953,7 +1966,7 @@ int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 		}
 	}
 	az_delete_deleted_zones(az);
-	if(!auth_zones_read_zones(az))
+	if(!auth_zones_read_zones(az, cfg))
 		return 0;
 	if(setup) {
 		if(!auth_zones_setup_zones(az))
@@ -2828,7 +2841,7 @@ az_generate_any_answer(struct auth_zone* z, struct regional* region,
 		if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
 		added++;
 	}
-	if(added == 0 && node->rrsets) {
+	if(added == 0 && node && node->rrsets) {
 		if(!msg_add_rrset_an(z, region, msg, node,
 			node->rrsets)) return 0;
 	}
@@ -3163,6 +3176,11 @@ int auth_zones_lookup(struct auth_zones* az, struct query_info* qinfo,
 		*fallback = 1;
 		return 0;
 	}
+	if(z->zone_expired) {
+		*fallback = z->fallback_enabled;
+		lock_rw_unlock(&z->lock);
+		return 0;
+	}
 	/* see what answer that zone would generate */
 	r = auth_zone_generate_answer(z, qinfo, region, msg, fallback);
 	lock_rw_unlock(&z->lock);
@@ -3250,6 +3268,19 @@ int auth_zones_answer(struct auth_zones* az, struct module_env* env,
 		lock_rw_unlock(&z->lock);
 		return 0;
 	}
+	if(z->zone_expired) {
+		if(z->fallback_enabled) {
+			lock_rw_unlock(&z->lock);
+			return 0;
+		}
+		lock_rw_unlock(&z->lock);
+		lock_rw_wrlock(&az->lock);
+		az->num_query_down++;
+		lock_rw_unlock(&az->lock);
+		auth_error_encode(qinfo, env, edns, repinfo, buf, temp,
+			LDNS_RCODE_SERVFAIL);
+		return 1;
+	}

 	/* answer it from zone z */
 	r = auth_zone_generate_answer(z, qinfo, temp, &msg, &fallback);
@@ -4773,8 +4804,10 @@ auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname)
 static void
 xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
 {
+	struct config_file* cfg = env->cfg;
 	struct auth_zone* z;
 	char tmpfile[1024];
+	char* zfilename;
 	lock_basic_unlock(&xfr->lock);

 	/* get lock again, so it is a readlock and concurrently queries
@@ -4792,20 +4825,24 @@ xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
 	lock_basic_lock(&xfr->lock);
 	lock_rw_unlock(&env->auth_zones->lock);

-	if(z->zonefile == NULL) {
+	if(z->zonefile == NULL || z->zonefile[0] == 0) {
 		lock_rw_unlock(&z->lock);
 		/* no write needed, no zonefile set */
 		return;
 	}
+	zfilename = z->zonefile;
+	if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename,
+		cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
+		zfilename += strlen(cfg->chrootdir);

 	/* write to tempfile first */
-	if((size_t)strlen(z->zonefile) + 16 > sizeof(tmpfile)) {
+	if((size_t)strlen(zfilename) + 16 > sizeof(tmpfile)) {
 		verbose(VERB_ALGO, "tmpfilename too long, cannot update "
-			" zonefile %s", z->zonefile);
+			" zonefile %s", zfilename);
 		lock_rw_unlock(&z->lock);
 		return;
 	}
-	snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", z->zonefile,
+	snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", zfilename,
 		(unsigned)getpid());
 	if(xfr->task_transfer->master->http) {
 		/* use the stored chunk list to write them */
@@ -4818,8 +4855,8 @@ xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
 		lock_rw_unlock(&z->lock);
 		return;
 	}
-	if(rename(tmpfile, z->zonefile) < 0) {
-		log_err("could not rename(%s, %s): %s", tmpfile, z->zonefile,
+	if(rename(tmpfile, zfilename) < 0) {
+		log_err("could not rename(%s, %s): %s", tmpfile, zfilename,
 			strerror(errno));
 		unlink(tmpfile);
 		lock_rw_unlock(&z->lock);
@@ -599,7 +599,7 @@ int auth_zones_startprobesequence(struct auth_zones* az,
 	struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t dclass);

 /** read auth zone from zonefile. caller must lock zone. false on failure */
-int auth_zone_read_zonefile(struct auth_zone* z);
+int auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg);

 /** find serial number of zone or false if none (no SOA record) */
 int auth_zone_get_serial(struct auth_zone* z, uint32_t* serial);
@@ -721,6 +721,17 @@ fill_any(struct module_env* env,
 	int i, num=6; /* number of RR types to look up */
 	log_assert(lookup[num] == 0);

+	if(env->cfg->deny_any) {
+		/* return empty message */
+		msg = dns_msg_create(qname, qnamelen, qtype, qclass,
+			region, 0);
+		if(!msg) {
+			return NULL;
+		}
+		msg->rep->security = sec_status_indeterminate;
+		return msg;
+	}
+
 	for(i=0; i<num; i++) {
 		/* look up this RR for inclusion in type ANY response */
 		struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
@@ -247,6 +247,26 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		}
 #endif /* SO_REUSEADDR */
 #ifdef SO_REUSEPORT
+#  ifdef SO_REUSEPORT_LB
+		/* on FreeBSD 12 we have SO_REUSEPORT_LB that does loadbalance
+		 * like SO_REUSEPORT on Linux.  This is what the users want
+		 * with the config option in unbound.conf; if we actually
+		 * need local address and port reuse they'll also need to
+		 * have SO_REUSEPORT set for them, assume it was _LB they want.
+		 */
+		if (reuseport && *reuseport &&
+		    setsockopt(s, SOL_SOCKET, SO_REUSEPORT_LB, (void*)&on,
+			(socklen_t)sizeof(on)) < 0) {
+#ifdef ENOPROTOOPT
+			if(errno != ENOPROTOOPT || verbosity >= 3)
+				log_warn("setsockopt(.. SO_REUSEPORT_LB ..) failed: %s",
+					strerror(errno));
+#endif
+			/* this option is not essential, we can continue */
+			*reuseport = 0;
+		}
+#  else /* no SO_REUSEPORT_LB */
+
 		/* try to set SO_REUSEPORT so that incoming
 		 * queries are distributed evenly among the receiving threads.
 		 * Each thread must have its own socket bound to the same port,
@@ -263,6 +283,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			/* this option is not essential, we can continue */
 			*reuseport = 0;
 		}
+#  endif /* SO_REUSEPORT_LB */
 #else
 		(void)reuseport;
 #endif /* defined(SO_REUSEPORT) */
@@ -565,7 +586,11 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		if(family==AF_INET6 && errno==EINVAL)
 			*noproto = 1;
 		else if(errno != EADDRINUSE &&
-			!(errno == EACCES && verbosity < 4 && !listen)) {
+			!(errno == EACCES && verbosity < 4 && !listen)
+#ifdef EADDRNOTAVAIL
+			&& !(errno == EADDRNOTAVAIL && verbosity < 4 && !listen)
+#endif
+			) {
 			log_err_addr("can't bind socket", strerror(errno),
 				(struct sockaddr_storage*)addr, addrlen);
 		}
@@ -1876,7 +1876,7 @@ serviced_tcp_initiate(struct serviced_query* sq, sldns_buffer* buff)
 	if(!sq->pending) {
 		/* delete from tree so that a retry by above layer does not
 		 * clash with this entry */
-		log_err("serviced_tcp_initiate: failed to send tcp query");
+		verbose(VERB_ALGO, "serviced_tcp_initiate: failed to send tcp query");
 		serviced_callbacks(sq, NETEVENT_CLOSED, NULL, NULL);
 	}
 }
@@ -148,8 +148,8 @@ test -f $CTL_BASE.pem || error "could not create $CTL_BASE.pem"
 # echo "empty password is used, simply click OK on the password dialog box."
 # openssl pkcs12 -export -in $CTL_BASE"_trust.pem" -inkey $CTL_BASE.key -name "unbound remote control client cert" -out $CTL_BASE"_browser.pfx" -password "pass:" || error "could not create browser certificate"

-# remove unused permissions
-chmod o-rw $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key
+# set desired permissions
+chmod 0640 $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key

 # remove crap
 rm -f request.cfg
@@ -154,6 +154,8 @@ usage(void)
 	printf("  view_local_zone view name type  	add local-zone in view\n");
 	printf("  view_local_zone_remove view name  	remove local-zone in view\n");
 	printf("  view_local_data view RR...		add local-data in view\n");
+	printf("  view_local_datas view 		add list of local-data to view\n");
+	printf("  					one entry per line read from stdin\n");
 	printf("  view_local_data_remove view name  	remove local-data in view\n");
 	printf("Version %s\n", PACKAGE_VERSION);
 	printf("BSD licensed, see LICENSE in source package for details.\n");
@@ -717,9 +719,10 @@ go_cmd(SSL* ssl, int fd, int quiet, int argc, char* argv[])
 	if(argc == 1 && strcmp(argv[0], "load_cache") == 0) {
 		send_file(ssl, fd, stdin, buf, sizeof(buf));
 	}
-	else if(argc == 1 && (strcmp(argv[0], "local_zones") == 0 ||
+	else if(argc >= 1 && (strcmp(argv[0], "local_zones") == 0 ||
 		strcmp(argv[0], "local_zones_remove") == 0 ||
 		strcmp(argv[0], "local_datas") == 0 ||
+		strcmp(argv[0], "view_local_datas") == 0 ||
 		strcmp(argv[0], "local_datas_remove") == 0)) {
 		send_file(ssl, fd, stdin, buf, sizeof(buf));
 		send_eof(ssl, fd);
@@ -71,6 +71,9 @@ static pid_t check_lock_pid;

 /** print all possible debug info on the state of the system */
 static void total_debug_info(void);
+/** print pretty lock error and exit (decl for NORETURN attribute) */
+static void lock_error(struct checked_lock* lock, const char* func,
+	const char* file, int line, const char* err) ATTR_NORETURN;

 /** print pretty lock error and exit */
 static void lock_error(struct checked_lock* lock, 
@@ -236,6 +236,8 @@ static void adjustline(char* line, struct entry* e,
 			e->copy_query = 1;
 		} else if(str_keyword(&parse, "copy_ednsdata_assume_clientsubnet")) {
 			e->copy_ednsdata_assume_clientsubnet = 1;
+		} else if(str_keyword(&parse, "increment_ecs_scope")) {
+			e->increment_ecs_scope = 1;
 		} else if(str_keyword(&parse, "sleep=")) {
 			e->sleeptime = (unsigned int) strtol(parse, (char**)&parse, 10);
 			while(isspace((unsigned char)*parse)) 
@@ -274,6 +276,7 @@ static struct entry* new_entry(void)
 	e->copy_id = 0;
 	e->copy_query = 0;
 	e->copy_ednsdata_assume_clientsubnet = 0;
+	e->increment_ecs_scope = 0;
 	e->sleeptime = 0;
 	e->next = NULL;
 	return e;
@@ -1593,6 +1596,9 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
 		if(walk_qlen >= 15 && walk_plen >= 15) {
 			walk_p[15] = walk_q[14];
 		}	
+		if(match->increment_ecs_scope) {
+			walk_p[15]++;
+		}
 	}

 	if(match->sleeptime > 0) {
@@ -208,6 +208,8 @@ struct entry {
 	/** copy ednsdata to reply, assume it is clientsubnet and
 	 * adjust scopemask to match sourcemask */
 	uint8_t copy_ednsdata_assume_clientsubnet;
+	/** increment the ECS scope copied from the sourcemask by one */
+	uint8_t increment_ecs_scope;
 	/** in seconds */
 	unsigned int sleeptime; 

@@ -42,6 +42,7 @@
 #include "testcode/unitmain.h"
 #include "util/regional.h"
 #include "util/net_help.h"
+#include "util/config_file.h"
 #include "util/data/msgreply.h"
 #include "services/cache/dns.h"
 #include "sldns/str2wire.h"
@@ -522,6 +523,7 @@ addzone(struct auth_zones* az, const char* name, char* fname)
 	struct auth_zone* z;
 	size_t nmlen;
 	uint8_t* nm = sldns_str2wire_dname(name, &nmlen);
+	struct config_file* cfg;
 	if(!nm) fatal_exit("out of memory");
 	lock_rw_wrlock(&az->lock);
 	z = auth_zone_create(az, nm, nmlen, LDNS_RR_CLASS_IN);
@@ -529,12 +531,16 @@ addzone(struct auth_zones* az, const char* name, char* fname)
 	if(!z) fatal_exit("cannot find zone");
 	auth_zone_set_zonefile(z, fname);
 	z->for_upstream = 1;
+	cfg = config_create();
+	free(cfg->chrootdir);
+	cfg->chrootdir = NULL;

-	if(!auth_zone_read_zonefile(z)) {
+	if(!auth_zone_read_zonefile(z, cfg)) {
 		fatal_exit("parse failure for auth zone %s", name);
 	}
 	lock_rw_unlock(&z->lock);
 	free(nm);
+	config_delete(cfg);
 	return z;
 }

@@ -158,7 +158,7 @@ static void consistency_test(void)
 {
 	addrlen_t l;
 	time_t i;
-	unsigned int count;
+	uint32_t count;
 	addrkey_t *k;
 	struct addrtree* t;
 	struct module_env env;
@@ -19,7 +19,7 @@ SCENARIO_BEGIN Test validator with blacked key entry for DS and further queries
 ; until the key entry expires.

 ; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 193.0.14.129 
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -47,7 +47,7 @@ ENTRY_END
 RANGE_END

 ; a.gtld-servers.net.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 192.5.6.30
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -116,7 +116,7 @@ ENTRY_END
 RANGE_END

 ; ns.example.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.3.4
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -228,7 +228,7 @@ ENTRY_END
 RANGE_END

 ; ns.blabla.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.3.5
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -336,7 +336,7 @@ ENTRY_END
 RANGE_END

 ; ns.sub.example.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.4.6
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -402,7 +402,7 @@ ENTRY_END
 RANGE_END

 ; ns.foo.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.4.7
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -19,7 +19,7 @@ SCENARIO_BEGIN Test validator with blacked key entry and further queries
 ; until the key entry expires.

 ; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 193.0.14.129 
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -47,7 +47,7 @@ ENTRY_END
 RANGE_END

 ; a.gtld-servers.net.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 192.5.6.30
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -116,7 +116,7 @@ ENTRY_END
 RANGE_END

 ; ns.example.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.3.4
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -228,7 +228,7 @@ ENTRY_END
 RANGE_END

 ; ns.blabla.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.3.5
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -336,7 +336,7 @@ ENTRY_END
 RANGE_END

 ; ns.sub.example.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.4.6
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -402,7 +402,7 @@ ENTRY_END
 RANGE_END

 ; ns.foo.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.4.7
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -18,7 +18,7 @@ SCENARIO_BEGIN Test validator with blacklist prime gives bad key entry
 ; comes from an 'expired signatures' name server.

 ; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 193.0.14.129 
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -46,7 +46,7 @@ ENTRY_END
 RANGE_END

 ; a.gtld-servers.net.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 192.5.6.30
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -96,7 +96,7 @@ ENTRY_END
 RANGE_END

 ; ns.example.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.3.4
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -177,7 +177,7 @@ ENTRY_END
 RANGE_END

 ; ns.blabla.com.
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 1.2.3.5
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -6,11 +6,21 @@
 # common functions
 . ../common.sh

+PRE="../.."
 if test ! -x "`which clang 2>&1`"; then
 	echo "No clang in path"
 	exit 0
 fi
 #echo "have clang"
+# test if assertions are enabled
+if grep "^#define UNBOUND_DEBUG" $PRE/config.h >/dev/null; then
+	:
+else
+	echo "UNBOUND_DEBUG is not enabled, skip test"
+	# no unbound debug means no assertions, and clang analyzer uses
+	# the assertions to make inferences.
+	exit 0
+fi

 # read value from Makefile
 # $1: result variable name
@@ -23,7 +33,6 @@ read_value () {
 	#echo $1"="'"'"`eval echo '$'$1`"'"'
 }

-PRE="../.."
 # read some values from the Makefile
 read_value srcdir '^srcdir=' $PRE/Makefile
 read_value CPPFLAGS '^CPPFLAGS=' $PRE/Makefile
@@ -41,7 +50,9 @@ compatfiles=`echo "$LIBOBJS" | sed -e 's?..LIBOBJDIR.?compat/?g' -e 's/.U.o/.c/g
 if test "$WITH_PYTHONMODULE" = "yes"; then PYTHONMOD_SRC="pythonmod/*.c"; fi
 if test ! -z "$WINAPPS"; then WIN_SRC="winrc/*.c"; fi

-cd $PRE; cd $srcdir
+cd $PRE;
+odir=`pwd`
+cd $srcdir
 # check the files in the srcdir
 fail="no"
 for x in cachedb/*.c daemon/*.c dns64/*.c $DNSCRYPT_SRC $DNSTAP_SRC edns-subnet/*.c ipsecmod/*.c iterator/*.c libunbound/*.c $PYTHONMOD_SRC respip/*.c services/*.c services/*/*.c sldns/*.c smallapp/*.c util/*.c util/*/*.c validator/*.c $WIN_SRC $compatfiles testcode/*.c; do
@@ -51,7 +62,8 @@ for x in cachedb/*.c daemon/*.c dns64/*.c $DNSCRYPT_SRC $DNSTAP_SRC edns-subnet/
 	echo clang --analyze $CPPFLAGS $x
 	plist=`basename $x .c`.plist
 	rm -rf $plist
-	clang --analyze $CPPFLAGS $x 2>&1 | tee tmp.$$
+	#echo "(cd $odir; clang --analyze $CPPFLAGS $srcdir/$x 2>&1 ) | tee tmp.$$"
+	(cd "$odir"; clang --analyze $CPPFLAGS $srcdir/$x 2>&1 ) | tee tmp.$$
 	if grep -e warning -e error tmp.$$ >/dev/null; then
 		fail="yes"
 		fails="$fails $x"
@@ -0,0 +1,78 @@
+; This is a comment.
+; config options go here.
+forward-zone: name: "." forward-addr: 216.0.0.1
+	forward-no-cache: yes
+CONFIG_END
+
+SCENARIO_BEGIN Forward with no_cache set
+RANGE_BEGIN 0 10
+	ENTRY_BEGIN
+	MATCH opcode qtype qname
+	ADJUST copy_id
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+www.example.com. IN A
+	SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+	SECTION AUTHORITY
+www.example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+ns.example.com. IN A 10.20.30.50
+	ENTRY_END
+RANGE_END
+RANGE_BEGIN 200 300
+RANGE_END
+
+RANGE_BEGIN 20 100
+	ENTRY_BEGIN
+	MATCH opcode qtype qname
+	ADJUST copy_id
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+www.example.com. IN A
+	SECTION ANSWER
+www.example.com. IN A 10.20.30.44
+	SECTION AUTHORITY
+www.example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+ns.example.com. IN A 10.20.30.50
+	ENTRY_END
+RANGE_END
+RANGE_BEGIN 200 300
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+REPLY QR RD RA
+MATCH opcode qname qtype all
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+ENTRY_END
+
+; make some time pass but not enough to timeout a cached record
+STEP 10 TIME_PASSES ELAPSE 10
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+STEP 24 CHECK_ANSWER
+ENTRY_BEGIN
+REPLY QR RD RA
+MATCH opcode qname qtype all
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.44
+ENTRY_END
+SCENARIO_END
@@ -241,9 +241,9 @@ SECTION ANSWER
 SECTION AUTHORITY
 ; at TTL 5 because TTL is capped at min-ttl of 5 in rdata of SOA
 example.com.	5 IN SOA	a. b. 1 2 3 4 5
-example.com.	1800 IN NS	ns.example.com.
+;example.com.	1800 IN NS	ns.example.com.
 SECTION ADDITIONAL
-ns.example.com.	1800 	IN 	A	1.2.3.4
+;ns.example.com.	1800 	IN 	A	1.2.3.4
 ENTRY_END

 ; after another 1900 seconds the domain must have timed out.
@@ -288,9 +288,9 @@ SECTION ANSWER
 SECTION AUTHORITY
 ; at TTL 5 because TTL capped at ttl of minttl in rdata of SOA.
 example.com.	5 IN SOA	a. b. 1 2 3 4 5
-example.com.	3600 IN NS	nsb.example.com.
+;example.com.	3600 IN NS	nsb.example.com.
 SECTION ADDITIONAL
-nsb.example.com.	3600 	IN 	A	1.2.3.4
+;nsb.example.com.	3600 	IN 	A	1.2.3.4
 ENTRY_END

 STEP 62 QUERY 
@@ -310,9 +310,9 @@ SECTION ANSWER
 SECTION AUTHORITY
 ; at TTL 5 because TTL capped at ttl of minttl in rdata of SOA.
 example.com.	5 IN SOA	a. b. 1 2 3 4 5
-example.com.	1800 IN NS	nsb.example.com.
+;example.com.	1800 IN NS	nsb.example.com.
 SECTION ADDITIONAL
-nsb.example.com.	3600 	IN 	A	1.2.3.4
+;nsb.example.com.	3600 	IN 	A	1.2.3.4
 ENTRY_END

 ; after another 1900 seconds the domain must have timed out.
@@ -109,8 +109,8 @@ ENTRY_END

 RANGE_END

-; the working version, until time 50.
-RANGE_BEGIN 0 50
+; the working version, until time 49.
+RANGE_BEGIN 0 49
 	ADDRESS 1.2.3.44
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -220,7 +220,7 @@ RANGE_END

 ; Broken.   Does not respond to anything (servfail instead
 ; of timeouts since this is easier to encode in .rpl file format).
-RANGE_BEGIN 0 50
+RANGE_BEGIN 0 49
 	ADDRESS 1.2.3.55
 ENTRY_BEGIN
 MATCH opcode 
@@ -110,8 +110,8 @@ ENTRY_END

 RANGE_END

-; the working version, until time 50.
-RANGE_BEGIN 0 50
+; the working version, until time 49.
+RANGE_BEGIN 0 49
 	ADDRESS 1.2.3.44
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -221,7 +221,7 @@ RANGE_END

 ; Broken.   Does not respond to anything (servfail instead
 ; of timeouts since this is easier to encode in .rpl file format).
-RANGE_BEGIN 0 50
+RANGE_BEGIN 0 49
 	ADDRESS 1.2.3.55
 ENTRY_BEGIN
 MATCH opcode 
@@ -19,7 +19,7 @@ SCENARIO_BEGIN Test validator with DS introduction for .net
 ; after introduction of a .NET DS in the root for a running validator.

 ; K.ROOT-SERVERS.NET. (before .net DS introduction)
-RANGE_BEGIN 0 100
+RANGE_BEGIN 0 99
 	ADDRESS 193.0.14.129 
 ENTRY_BEGIN
 MATCH opcode qtype qname
@@ -19,9 +19,13 @@ fi
 #echo export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:../../.libs:."
 #export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:../../.libs:."

+if grep "PY_MAJOR_VERSION=3" $PRE/Makefile; then
+	PYTHON="python3"; else PYTHON="python2"; fi
+if test ! -x `which $PYTHON` 2>&1; then PYTHON="python"; fi
+
 # do the test
 echo "> pylib.lookup.py www.example.com."
-./pylib.lookup.py www.example.com. | tee outfile
+$PYTHON pylib.lookup.py www.example.com. | tee outfile

 echo "> cat logfiles"
 cat fwd.log
@@ -59,12 +59,15 @@ def setTTL(qstate, ttl):

 def dataHex(data, prefix=""):
    res = ""
-    for i in range(0, (len(data)+15)/16):
+    for i in range(0, int((len(data)+15)/16)):
        res += "%s0x%02X | " % (prefix, i*16)
-        d = map(lambda x:ord(x), data[i*16:i*16+17])
+        if type(data[0]) == type(1):
+            d = map(lambda x:int(x), data[i*16:i*16+17])
+        else:
+            d = map(lambda x:ord(x), data[i*16:i*16+17])
        for ch in d:
            res += "%02X " % ch
-        for i in range(0,17-len(d)):
+        for i in range(0,17-len(data[i*16:i*16+17])):
            res += "   "
        res += "| "
        for ch in d:
@@ -76,35 +79,35 @@ def dataHex(data, prefix=""):
    return res

 def printReturnMsg(qstate):
-    print "Return MSG rep   :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (qstate.return_msg.rep.flags, qstate.return_msg.rep.qdcount,qstate.return_msg.rep.security, qstate.return_msg.rep.ttl)
-    print "           qinfo :: qname:",qstate.return_msg.qinfo.qname_list, qstate.return_msg.qinfo.qname_str, "type:",qstate.return_msg.qinfo.qtype_str, "class:",qstate.return_msg.qinfo.qclass_str
+    print ("Return MSG rep   :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (qstate.return_msg.rep.flags, qstate.return_msg.rep.qdcount, qstate.return_msg.rep.security, qstate.return_msg.rep.ttl))
+    print ("           qinfo :: qname:",qstate.return_msg.qinfo.qname_list, qstate.return_msg.qinfo.qname_str, "type:",qstate.return_msg.qinfo.qtype_str, "class:",qstate.return_msg.qinfo.qclass_str)
    if (qstate.return_msg.rep):
-        print "RRSets:",qstate.return_msg.rep.rrset_count
+        print ("RRSets:",qstate.return_msg.rep.rrset_count)
        prevkey = None
        for i in range(0,qstate.return_msg.rep.rrset_count):
            r = qstate.return_msg.rep.rrsets[i]
            rk = r.rk
-            print i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags,
-            print "type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class)
+            print (i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags)
+            print ("type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class))

            d = r.entry.data
-            print "    RRDatas:",d.count+d.rrsig_count
+            print ("    RRDatas:",d.count+d.rrsig_count)
            for j in range(0,d.count+d.rrsig_count):
-                print "    ",j,":","TTL=",d.rr_ttl[j],"RR data:"
-                print dataHex(d.rr_data[j],"         ")
+                print ("    ",j,":","TTL=",d.rr_ttl[j],"RR data:")
+                print (dataHex(d.rr_data[j],"         "))


 def operate(id, event, qstate, qdata):
    log_info("pythonmod: operate called, id: %d, event:%s" % (id, strmodulevent(event)))
-    #print "pythonmod: per query data", qdata
+    #print ("pythonmod: per query data", qdata)

-    print "Query:", ''.join(map(lambda x:chr(max(32,ord(x))),qstate.qinfo.qname)), qstate.qinfo.qname_list, qstate.qinfo.qname_str,
-    print "Type:",qstate.qinfo.qtype_str,"(%d)" % qstate.qinfo.qtype,
-    print "Class:",qstate.qinfo.qclass_str,"(%d)" % qstate.qinfo.qclass
-    print
+    print ("Query:", qstate.qinfo.qname, qstate.qinfo.qname_list, qstate.qinfo.qname_str)
+    print ("Type:",qstate.qinfo.qtype_str,"(%d)" % qstate.qinfo.qtype)
+    print ("Class:",qstate.qinfo.qclass_str,"(%d)" % qstate.qinfo.qclass)
+    print ()

    if (event == MODULE_EVENT_NEW or event == MODULE_EVENT_PASS) and (qstate.qinfo.qname_str.endswith("www2.example.com.")):
-        print qstate.qinfo.qname_str
+        print (qstate.qinfo.qname_str)

        qstate.ext_state[id] = MODULE_FINISHED 

@@ -121,6 +124,7 @@ def operate(id, event, qstate, qdata):
        if (qstate.qinfo.qtype == RR_TYPE_TXT) or (qstate.qinfo.qtype == RR_TYPE_ANY):
            msg.answer.append("%s 10 IN TXT path=/" % qstate.qinfo.qname_str)

+        print(msg.answer)
        if not msg.set_return_msg(qstate):
            qstate.ext_state[id] = MODULE_ERROR 
            return True
@@ -59,12 +59,15 @@ def setTTL(qstate, ttl):

 def dataHex(data, prefix=""):
    res = ""
-    for i in range(0, (len(data)+15)/16):
+    for i in range(0, int((len(data)+15)/16)):
        res += "%s0x%02X | " % (prefix, i*16)
-        d = map(lambda x:ord(x), data[i*16:i*16+17])
+        if type(data[0]) == type(1):
+            d = map(lambda x:int(x), data[i*16:i*16+17])
+        else:
+            d = map(lambda x:ord(x), data[i*16:i*16+17])
        for ch in d:
-            res += "%02X " % ch
-        for i in range(0,17-len(d)):
+            res += "%02X " % int(ch)
+        for i in range(0,17-len(data[i*16:i*16+17])):
            res += "   "
        res += "| "
        for ch in d:
@@ -76,43 +79,43 @@ def dataHex(data, prefix=""):
    return res

 def printReturnMsg(qstate):
-    print "Return MSG rep   :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (qstate.return_msg.rep.flags, qstate.return_msg.rep.qdcount,qstate.return_msg.rep.security, qstate.return_msg.rep.ttl)
-    print "           qinfo :: qname:",qstate.return_msg.qinfo.qname_list, qstate.return_msg.qinfo.qname_str, "type:",qstate.return_msg.qinfo.qtype_str, "class:",qstate.return_msg.qinfo.qclass_str
+    print ("Return MSG rep   :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (qstate.return_msg.rep.flags, qstate.return_msg.rep.qdcount, qstate.return_msg.rep.security, qstate.return_msg.rep.ttl))
+    print ("           qinfo :: qname:",qstate.return_msg.qinfo.qname_list, qstate.return_msg.qinfo.qname_str, "type:",qstate.return_msg.qinfo.qtype_str, "class:",qstate.return_msg.qinfo.qclass_str)
    if (qstate.return_msg.rep):
-        print "RRSets:",qstate.return_msg.rep.rrset_count
+        print ("RRSets:",qstate.return_msg.rep.rrset_count)
        prevkey = None
        for i in range(0,qstate.return_msg.rep.rrset_count):
            r = qstate.return_msg.rep.rrsets[i]
            rk = r.rk
-            print i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags,
-            print "type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class)
+            print (i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags)
+            print ("type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class))

            d = r.entry.data
-            print "    RRDatas:",d.count+d.rrsig_count
+            print ("    RRDatas:",d.count+d.rrsig_count)
            for j in range(0,d.count+d.rrsig_count):
-                print "    ",j,":","TTL=",d.rr_ttl[j],"RR data:"
-                print dataHex(d.rr_data[j],"         ")
+                print ("    ",j,":","TTL=",d.rr_ttl[j],"RR data:")
+                print (dataHex(d.rr_data[j],"         "))


 def operate(id, event, qstate, qdata):
    log_info("pythonmod: operate called, id: %d, event:%s" % (id, strmodulevent(event)))
-    #print "pythonmod: per query data", qdata
+    #print ("pythonmod: per query data", qdata)

-    print "Query:", ''.join(map(lambda x:chr(max(32,ord(x))),qstate.qinfo.qname)), qstate.qinfo.qname_list, qstate.qinfo.qname_str,
-    print "Type:",qstate.qinfo.qtype_str,"(%d)" % qstate.qinfo.qtype,
-    print "Class:",qstate.qinfo.qclass_str,"(%d)" % qstate.qinfo.qclass
-    print
+    print ("Query:", qstate.qinfo.qname, qstate.qinfo.qname_list, qstate.qinfo.qname_str)
+    print ("Type:",qstate.qinfo.qtype_str,"(%d)" % qstate.qinfo.qtype)
+    print ("Class:",qstate.qinfo.qclass_str,"(%d)" % qstate.qinfo.qclass)
+    print ()

    if (event == MODULE_EVENT_NEW or event == MODULE_EVENT_PASS) and (qstate.qinfo.qname_str.endswith("example.com.")):
-        print qstate.qinfo.qname_str
+        print (qstate.qinfo.qname_str)

        qstate.ext_state[id] = MODULE_FINISHED 

-	# eat time
-	y = 20
-	for z in range(2, 10000):
-		y = y*2 - z/2
-		y = y/2 + z
+        # eat time
+        y = 20
+        for z in range(2, 10000):
+                y = y*2 - z/2
+                y = y/2 + z

        msg = DNSMessage(qstate.qinfo.qname_str, RR_TYPE_A, RR_CLASS_IN, PKT_QR | PKT_RA | PKT_AA) #, 300)
        #msg.authority.append("xxx.seznam.cz. 10 IN A 192.168.1.1")
@@ -22,3 +22,83 @@ SECTION ANSWER
 www2	IN	A	10.20.30.40
 ENTRY_END

+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www4	IN	A
+SECTION ANSWER
+www4	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www5	IN	A
+SECTION ANSWER
+www5	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NXDOMAIN
+ADJUST copy_id
+SECTION QUESTION
+www6	IN	A
+SECTION AUTHORITY
+example.com.		3600	IN	SOA	a. b. 2018100719 7200 3600 1209600 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NXDOMAIN
+ADJUST copy_id
+SECTION QUESTION
+www7	IN	A
+SECTION AUTHORITY
+example.com.		3600	IN	SOA	a. b. 2018100719 7200 3600 1209600 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NXDOMAIN
+ADJUST copy_id
+SECTION QUESTION
+www8	IN	A
+SECTION AUTHORITY
+example.com.		3600	IN	SOA	a. b. 2018100719 7200 3600 1209600 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NXDOMAIN
+ADJUST copy_id
+SECTION QUESTION
+www9	IN	A
+SECTION AUTHORITY
+example.com.		3600	IN	SOA	a. b. 2018100719 7200 3600 1209600 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NXDOMAIN
+ADJUST copy_id
+SECTION QUESTION
+www10	IN	A
+SECTION AUTHORITY
+example.com.		3600	IN	SOA	a. b. 2018100719 7200 3600 1209600 3600
+ENTRY_END
+
@@ -145,6 +145,29 @@ RANGE_BEGIN 0 100
 			ns.example.com.		IN 	A	1.2.3.4
 	ENTRY_END

+	; client send /17, we return /18
+	ENTRY_BEGIN
+		MATCH opcode qtype qname ednsdata
+		ADJUST copy_id copy_ednsdata_assume_clientsubnet increment_ecs_scope
+		REPLY QR NOERROR
+		SECTION QUESTION
+			www.example.com. IN TXT
+		SECTION ANSWER
+			www.example.com. IN TXT "longer scope"
+		SECTION AUTHORITY
+			example.com.	IN NS	ns.example.com.
+		SECTION ADDITIONAL
+			HEX_EDNSDATA_BEGIN
+							; client is 127.1.0.1
+				00 08 		; OPC
+				00 07 		; option length
+				00 01 		; Family
+				11 00 		; source mask, scopemask
+				7f 01 00   	; address
+			HEX_EDNSDATA_END
+			ns.example.com.		IN 	A	1.2.3.4
+	ENTRY_END
+
 RANGE_END

 STEP 1 QUERY
@@ -229,5 +252,46 @@ ENTRY_BEGIN
 		ns.example.com.		IN 	A	1.2.3.4
 ENTRY_END

+STEP 21 QUERY
+ENTRY_BEGIN
+	HEX_ANSWER_BEGIN;
+		00 00 01 00 00 01 00 00		;ID 0
+		00 00 00 01 03 77 77 77		; www.example.com TXT? (DO)
+		07 65 78 61 6d 70 6c 65 
+		03 63 6f 6d 00 00 10 00
+		01 00 00 29 10 00 00 00 
+		80 00 00 0b
+		
+		00 08 00 07			; OPC, optlen
+		00 01 11 00			; ip4, scope 17, source 0
+		7f 01 00  			;127.1.0.0/17
+	HEX_ANSWER_END
+ENTRY_END
+
+
+
+; server returns /18, since we cache the result to max-client-subnet-ipv4 (/17),
+; the initial answer returned to the client should also be capped to /17.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ednsdata
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		www.example.com. IN TXT
+	SECTION ANSWER
+		www.example.com. IN TXT "longer scope"
+	SECTION AUTHORITY
+		example.com.	IN NS	ns.example.com.
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+						; client is 127.1.0.1
+			00 08 		; OPC
+			00 07 		; option length
+			00 01 		; Family
+			11 11 		; source mask, scopemask
+			7f 01 00 	; address
+		HEX_EDNSDATA_END
+		ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END

 SCENARIO_END
@@ -59,6 +59,7 @@
 #include "services/cache/infra.h"
 #include "sldns/wire2str.h"
 #include "sldns/parseutil.h"
+#include "iterator/iterator.h"
 #ifdef HAVE_GLOB_H
 # include <glob.h>
 #endif
@@ -152,6 +153,7 @@ config_create(void)
 	cfg->max_negative_ttl = 3600;
 	cfg->prefetch = 0;
 	cfg->prefetch_key = 0;
+	cfg->deny_any = 0;
 	cfg->infra_cache_slabs = 4;
 	cfg->infra_cache_numhosts = 10000;
 	cfg->infra_cache_min_rtt = 50;
@@ -167,8 +169,8 @@ config_create(void)
 	if(!(cfg->logfile = strdup(""))) goto error_exit;
 	if(!(cfg->pidfile = strdup(PIDFILE))) goto error_exit;
 	if(!(cfg->target_fetch_policy = strdup("3 2 1 0 0"))) goto error_exit;
-	cfg->low_rtt_permil = 0;
-	cfg->low_rtt = 45;
+	cfg->fast_server_permil = 0;
+	cfg->fast_server_num = 3;
 	cfg->donotqueryaddrs = NULL;
 	cfg->donotquery_localhost = 1;
 	cfg->root_hints = NULL;
@@ -177,7 +179,7 @@ config_create(void)
 	cfg->if_automatic = 0;
 	cfg->so_rcvbuf = 0;
 	cfg->so_sndbuf = 0;
-	cfg->so_reuseport = 1;
+	cfg->so_reuseport = REUSEPORT_DEFAULT;
 	cfg->ip_transparent = 0;
 	cfg->ip_freebind = 0;
 	cfg->num_ifs = 0;
@@ -194,6 +196,10 @@ config_create(void)
 	cfg->client_subnet_always_forward = 0;
 	cfg->max_client_subnet_ipv4 = 24;
 	cfg->max_client_subnet_ipv6 = 56;
+	cfg->min_client_subnet_ipv4 = 0;
+	cfg->min_client_subnet_ipv6 = 0;
+	cfg->max_ecs_tree_size_ipv4 = 100;
+	cfg->max_ecs_tree_size_ipv6 = 100;
 #endif
 	cfg->views = NULL;
 	cfg->acls = NULL;
@@ -258,6 +264,7 @@ config_create(void)
 	cfg->control_use_cert = 1;
 	cfg->minimal_responses = 1;
 	cfg->rrset_roundrobin = 0;
+	cfg->unknown_server_time_limit = 376;
 	cfg->max_udp_size = 4096;
 	if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key"))) 
 		goto error_exit;
@@ -498,6 +505,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_POW2("rrset-cache-slabs:", rrset_cache_slabs)
 	else S_YNO("prefetch:", prefetch)
 	else S_YNO("prefetch-key:", prefetch_key)
+	else S_YNO("deny-any:", deny_any)
 	else if(strcmp(opt, "cache-max-ttl:") == 0)
 	{ IS_NUMBER_OR_ZERO; cfg->max_ttl = atoi(val); MAX_TTL=(time_t)cfg->max_ttl;}
 	else if(strcmp(opt, "cache-max-negative-ttl:") == 0)
@@ -573,6 +581,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_MEMSIZE("neg-cache-size:", neg_cache_size)
 	else S_YNO("minimal-responses:", minimal_responses)
 	else S_YNO("rrset-roundrobin:", rrset_roundrobin)
+	else S_NUMBER_OR_ZERO("unknown-server-time-limit:", unknown_server_time_limit)
 	else S_STRLIST("local-data:", local_data)
 	else S_YNO("unblock-lan-zones:", unblock_lan_zones)
 	else S_YNO("insecure-lan-zones:", insecure_lan_zones)
@@ -642,9 +651,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_POW2("ratelimit-slabs:", ratelimit_slabs)
 	else S_NUMBER_OR_ZERO("ip-ratelimit-factor:", ip_ratelimit_factor)
 	else S_NUMBER_OR_ZERO("ratelimit-factor:", ratelimit_factor)
-	else S_NUMBER_OR_ZERO("low-rtt:", low_rtt)
-	else S_NUMBER_OR_ZERO("low-rtt-pct:", low_rtt_permil)
-	else S_NUMBER_OR_ZERO("low-rtt-permil:", low_rtt_permil)
+	else S_SIZET_NONZERO("fast-server-num:", fast_server_num)
+	else S_NUMBER_OR_ZERO("fast-server-permil:", fast_server_permil)
 	else S_YNO("qname-minimisation:", qname_minimisation)
 	else S_YNO("qname-minimisation-strict:", qname_minimisation_strict)
 #ifdef USE_IPSECMOD
@@ -683,7 +691,9 @@ int config_set_option(struct config_file* cfg, const char* opt,
 		 * ratelimit-for-domain, ratelimit-below-domain,
 		 * local-zone-tag, access-control-view,
 		 * send-client-subnet, client-subnet-always-forward,
-		 * max-client-subnet-ipv4, max-client-subnet-ipv6, ipsecmod_hook,
+		 * max-client-subnet-ipv4, max-client-subnet-ipv6,
+		 * min-client-subnet-ipv4, min-client-subnet-ipv6,
+		 * max-ecs-tree-size-ipv4, max-ecs-tree-size-ipv6, ipsecmod_hook,
 		 * ipsecmod_whitelist. */
 		return 0;
 	}
@@ -880,6 +890,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_DEC(opt, "rrset-cache-slabs", rrset_cache_slabs)
 	else O_YNO(opt, "prefetch-key", prefetch_key)
 	else O_YNO(opt, "prefetch", prefetch)
+	else O_YNO(opt, "deny-any", deny_any)
 	else O_DEC(opt, "cache-max-ttl", max_ttl)
 	else O_DEC(opt, "cache-max-negative-ttl", max_negative_ttl)
 	else O_DEC(opt, "cache-min-ttl", min_ttl)
@@ -977,11 +988,16 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_UNS(opt, "val-override-date", val_date_override)
 	else O_YNO(opt, "minimal-responses", minimal_responses)
 	else O_YNO(opt, "rrset-roundrobin", rrset_roundrobin)
+	else O_DEC(opt, "unknown-server-time-limit", unknown_server_time_limit)
 #ifdef CLIENT_SUBNET
 	else O_LST(opt, "send-client-subnet", client_subnet)
 	else O_LST(opt, "client-subnet-zone", client_subnet_zone)
 	else O_DEC(opt, "max-client-subnet-ipv4", max_client_subnet_ipv4)
 	else O_DEC(opt, "max-client-subnet-ipv6", max_client_subnet_ipv6)
+	else O_DEC(opt, "min-client-subnet-ipv4", min_client_subnet_ipv4)
+	else O_DEC(opt, "min-client-subnet-ipv6", min_client_subnet_ipv6)
+	else O_DEC(opt, "max-ecs-tree-size-ipv4", max_ecs_tree_size_ipv4)
+	else O_DEC(opt, "max-ecs-tree-size-ipv6", max_ecs_tree_size_ipv6)
 	else O_YNO(opt, "client-subnet-always-forward:",
 		client_subnet_always_forward)
 #endif
@@ -1036,9 +1052,8 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_LS2(opt, "ratelimit-below-domain", ratelimit_below_domain)
 	else O_DEC(opt, "ip-ratelimit-factor", ip_ratelimit_factor)
 	else O_DEC(opt, "ratelimit-factor", ratelimit_factor)
-	else O_DEC(opt, "low-rtt", low_rtt)
-	else O_DEC(opt, "low-rtt-pct", low_rtt_permil)
-	else O_DEC(opt, "low-rtt-permil", low_rtt_permil)
+	else O_DEC(opt, "fast-server-num", fast_server_num)
+	else O_DEC(opt, "fast-server-permil", fast_server_permil)
 	else O_DEC(opt, "val-sig-skew-min", val_sig_skew_min)
 	else O_DEC(opt, "val-sig-skew-max", val_sig_skew_max)
 	else O_YNO(opt, "qname-minimisation", qname_minimisation)
@@ -1888,6 +1903,7 @@ config_apply(struct config_file* config)
 	EDNS_ADVERTISED_SIZE = (uint16_t)config->edns_buffer_size;
 	MINIMAL_RESPONSES = config->minimal_responses;
 	RRSET_ROUNDROBIN = config->rrset_roundrobin;
+	UNKNOWN_SERVER_NICENESS = config->unknown_server_time_limit;
 	log_set_time_asc(config->log_time_ascii);
 	autr_permit_small_holddown = config->permit_small_holddown;
 }
@@ -159,10 +159,11 @@ struct config_file {

 	/** the target fetch policy for the iterator */
 	char* target_fetch_policy;
-	/** percent*10, how many times in 1000 to pick low rtt destinations */
-	int low_rtt_permil;
-	/** what time in msec is a low rtt destination */
-	int low_rtt;
+	/** percent*10, how many times in 1000 to pick from the fastest
+	 * destinations */
+	int fast_server_permil;
+	/** number of fastest server to select from */
+	size_t fast_server_num;

 	/** automatic interface for incoming messages. Uses ipv6 remapping,
 	 * and recvmsg/sendmsg ancillary data to detect interfaces, boolean */
@@ -214,6 +215,12 @@ struct config_file {
 	/** Subnet length we are willing to give up privacy for */
 	uint8_t max_client_subnet_ipv4;
 	uint8_t max_client_subnet_ipv6;
+	/** Minimum subnet length we are willing to answer */
+	uint8_t min_client_subnet_ipv4;
+	uint8_t min_client_subnet_ipv6;
+	/** Max number of nodes in the ECS radix tree */
+	uint32_t max_ecs_tree_size_ipv4;
+	uint32_t max_ecs_tree_size_ipv6;
 #endif
 	/** list of access control entries, linked list */
 	struct config_str2list* acls;
@@ -257,6 +264,8 @@ struct config_file {
 	int prefetch;
 	/** if prefetching of DNSKEYs should be performed. */
 	int prefetch_key;
+	/** deny queries of type ANY with an empty answer */
+	int deny_any;

 	/** chrootdir, if not "" or chroot will be done */
 	char* chrootdir;
@@ -428,6 +437,9 @@ struct config_file {
 	/* RRSet roundrobin */
 	int rrset_roundrobin;

+	/* wait time for unknown server in msec */
+	int unknown_server_time_limit;
+
 	/* maximum UDP response size */
 	size_t max_udp_size;

@@ -120,9 +120,8 @@ static void config_start_include_glob(const char* filename)
 #ifdef GLOB_ERR
 			| GLOB_ERR
 #endif
-#ifdef GLOB_NOSORT
-			| GLOB_NOSORT
-#endif
+			 /* do not set GLOB_NOSORT so the results are sorted
+			    and in a predictable order. */
 #ifdef GLOB_BRACE
 			| GLOB_BRACE
 #endif
@@ -296,6 +295,7 @@ private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
 private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
 prefetch{COLON}			{ YDVAR(1, VAR_PREFETCH) }
+deny-any{COLON}			{ YDVAR(1, VAR_DENY_ANY) }
 stub-zone{COLON}		{ YDVAR(0, VAR_STUB_ZONE) }
 name{COLON}			{ YDVAR(1, VAR_NAME) }
 stub-addr{COLON}		{ YDVAR(1, VAR_STUB_ADDR) }
@@ -331,6 +331,10 @@ client-subnet-always-forward{COLON} { YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD)
 client-subnet-opcode{COLON}	{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
 max-client-subnet-ipv4{COLON}	{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
 max-client-subnet-ipv6{COLON}	{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
+min-client-subnet-ipv4{COLON}	{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
+min-client-subnet-ipv6{COLON}	{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
+max-ecs-tree-size-ipv4{COLON}	{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
+max-ecs-tree-size-ipv6{COLON}	{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
 hide-identity{COLON}		{ YDVAR(1, VAR_HIDE_IDENTITY) }
 hide-version{COLON}		{ YDVAR(1, VAR_HIDE_VERSION) }
 hide-trustanchor{COLON}		{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
@@ -399,6 +403,7 @@ python{COLON}			{ YDVAR(0, VAR_PYTHON) }
 domain-insecure{COLON}		{ YDVAR(1, VAR_DOMAIN_INSECURE) }
 minimal-responses{COLON}	{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
 rrset-roundrobin{COLON}		{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
+unknown-server-time-limit{COLON} { YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
 max-udp-size{COLON}		{ YDVAR(1, VAR_MAX_UDP_SIZE) }
 dns64-prefix{COLON}		{ YDVAR(1, VAR_DNS64_PREFIX) }
 dns64-synthall{COLON}		{ YDVAR(1, VAR_DNS64_SYNTHALL) }
@@ -441,8 +446,10 @@ ratelimit-below-domain{COLON}	{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
 ip-ratelimit-factor{COLON}		{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
 ratelimit-factor{COLON}		{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
 low-rtt{COLON}			{ YDVAR(1, VAR_LOW_RTT) }
-low-rtt-pct{COLON}		{ YDVAR(1, VAR_LOW_RTT_PERMIL) }
-low-rtt-permil{COLON}		{ YDVAR(1, VAR_LOW_RTT_PERMIL) }
+fast-server-num{COLON}		{ YDVAR(1, VAR_FAST_SERVER_NUM) }
+low-rtt-pct{COLON}		{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+low-rtt-permil{COLON}		{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+fast-server-permil{COLON}	{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 response-ip-tag{COLON}		{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
 response-ip{COLON}		{ YDVAR(2, VAR_RESPONSE_IP) }
 response-ip-data{COLON}		{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
@@ -228,74 +228,82 @@ extern int yydebug;
    VAR_CLIENT_SUBNET_OPCODE = 438,
    VAR_MAX_CLIENT_SUBNET_IPV4 = 439,
    VAR_MAX_CLIENT_SUBNET_IPV6 = 440,
-    VAR_CAPS_WHITELIST = 441,
-    VAR_CACHE_MAX_NEGATIVE_TTL = 442,
-    VAR_PERMIT_SMALL_HOLDDOWN = 443,
-    VAR_QNAME_MINIMISATION = 444,
-    VAR_QNAME_MINIMISATION_STRICT = 445,
-    VAR_IP_FREEBIND = 446,
-    VAR_DEFINE_TAG = 447,
-    VAR_LOCAL_ZONE_TAG = 448,
-    VAR_ACCESS_CONTROL_TAG = 449,
-    VAR_LOCAL_ZONE_OVERRIDE = 450,
-    VAR_ACCESS_CONTROL_TAG_ACTION = 451,
-    VAR_ACCESS_CONTROL_TAG_DATA = 452,
-    VAR_VIEW = 453,
-    VAR_ACCESS_CONTROL_VIEW = 454,
-    VAR_VIEW_FIRST = 455,
-    VAR_SERVE_EXPIRED = 456,
-    VAR_SERVE_EXPIRED_TTL = 457,
-    VAR_SERVE_EXPIRED_TTL_RESET = 458,
-    VAR_FAKE_DSA = 459,
-    VAR_FAKE_SHA1 = 460,
-    VAR_LOG_IDENTITY = 461,
-    VAR_HIDE_TRUSTANCHOR = 462,
-    VAR_TRUST_ANCHOR_SIGNALING = 463,
-    VAR_AGGRESSIVE_NSEC = 464,
-    VAR_USE_SYSTEMD = 465,
-    VAR_SHM_ENABLE = 466,
-    VAR_SHM_KEY = 467,
-    VAR_ROOT_KEY_SENTINEL = 468,
-    VAR_DNSCRYPT = 469,
-    VAR_DNSCRYPT_ENABLE = 470,
-    VAR_DNSCRYPT_PORT = 471,
-    VAR_DNSCRYPT_PROVIDER = 472,
-    VAR_DNSCRYPT_SECRET_KEY = 473,
-    VAR_DNSCRYPT_PROVIDER_CERT = 474,
-    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 475,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 476,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 477,
-    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 478,
-    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 479,
-    VAR_IPSECMOD_ENABLED = 480,
-    VAR_IPSECMOD_HOOK = 481,
-    VAR_IPSECMOD_IGNORE_BOGUS = 482,
-    VAR_IPSECMOD_MAX_TTL = 483,
-    VAR_IPSECMOD_WHITELIST = 484,
-    VAR_IPSECMOD_STRICT = 485,
-    VAR_CACHEDB = 486,
-    VAR_CACHEDB_BACKEND = 487,
-    VAR_CACHEDB_SECRETSEED = 488,
-    VAR_CACHEDB_REDISHOST = 489,
-    VAR_CACHEDB_REDISPORT = 490,
-    VAR_CACHEDB_REDISTIMEOUT = 491,
-    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 492,
-    VAR_FOR_UPSTREAM = 493,
-    VAR_AUTH_ZONE = 494,
-    VAR_ZONEFILE = 495,
-    VAR_MASTER = 496,
-    VAR_URL = 497,
-    VAR_FOR_DOWNSTREAM = 498,
-    VAR_FALLBACK_ENABLED = 499,
-    VAR_TLS_ADDITIONAL_PORT = 500,
-    VAR_LOW_RTT = 501,
-    VAR_LOW_RTT_PERMIL = 502,
-    VAR_ALLOW_NOTIFY = 503,
-    VAR_TLS_WIN_CERT = 504,
-    VAR_TCP_CONNECTION_LIMIT = 505,
-    VAR_FORWARD_NO_CACHE = 506,
-    VAR_STUB_NO_CACHE = 507,
-    VAR_LOG_SERVFAIL = 508
+    VAR_MIN_CLIENT_SUBNET_IPV4 = 441,
+    VAR_MIN_CLIENT_SUBNET_IPV6 = 442,
+    VAR_MAX_ECS_TREE_SIZE_IPV4 = 443,
+    VAR_MAX_ECS_TREE_SIZE_IPV6 = 444,
+    VAR_CAPS_WHITELIST = 445,
+    VAR_CACHE_MAX_NEGATIVE_TTL = 446,
+    VAR_PERMIT_SMALL_HOLDDOWN = 447,
+    VAR_QNAME_MINIMISATION = 448,
+    VAR_QNAME_MINIMISATION_STRICT = 449,
+    VAR_IP_FREEBIND = 450,
+    VAR_DEFINE_TAG = 451,
+    VAR_LOCAL_ZONE_TAG = 452,
+    VAR_ACCESS_CONTROL_TAG = 453,
+    VAR_LOCAL_ZONE_OVERRIDE = 454,
+    VAR_ACCESS_CONTROL_TAG_ACTION = 455,
+    VAR_ACCESS_CONTROL_TAG_DATA = 456,
+    VAR_VIEW = 457,
+    VAR_ACCESS_CONTROL_VIEW = 458,
+    VAR_VIEW_FIRST = 459,
+    VAR_SERVE_EXPIRED = 460,
+    VAR_SERVE_EXPIRED_TTL = 461,
+    VAR_SERVE_EXPIRED_TTL_RESET = 462,
+    VAR_FAKE_DSA = 463,
+    VAR_FAKE_SHA1 = 464,
+    VAR_LOG_IDENTITY = 465,
+    VAR_HIDE_TRUSTANCHOR = 466,
+    VAR_TRUST_ANCHOR_SIGNALING = 467,
+    VAR_AGGRESSIVE_NSEC = 468,
+    VAR_USE_SYSTEMD = 469,
+    VAR_SHM_ENABLE = 470,
+    VAR_SHM_KEY = 471,
+    VAR_ROOT_KEY_SENTINEL = 472,
+    VAR_DNSCRYPT = 473,
+    VAR_DNSCRYPT_ENABLE = 474,
+    VAR_DNSCRYPT_PORT = 475,
+    VAR_DNSCRYPT_PROVIDER = 476,
+    VAR_DNSCRYPT_SECRET_KEY = 477,
+    VAR_DNSCRYPT_PROVIDER_CERT = 478,
+    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 479,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 480,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 481,
+    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 482,
+    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 483,
+    VAR_IPSECMOD_ENABLED = 484,
+    VAR_IPSECMOD_HOOK = 485,
+    VAR_IPSECMOD_IGNORE_BOGUS = 486,
+    VAR_IPSECMOD_MAX_TTL = 487,
+    VAR_IPSECMOD_WHITELIST = 488,
+    VAR_IPSECMOD_STRICT = 489,
+    VAR_CACHEDB = 490,
+    VAR_CACHEDB_BACKEND = 491,
+    VAR_CACHEDB_SECRETSEED = 492,
+    VAR_CACHEDB_REDISHOST = 493,
+    VAR_CACHEDB_REDISPORT = 494,
+    VAR_CACHEDB_REDISTIMEOUT = 495,
+    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 496,
+    VAR_FOR_UPSTREAM = 497,
+    VAR_AUTH_ZONE = 498,
+    VAR_ZONEFILE = 499,
+    VAR_MASTER = 500,
+    VAR_URL = 501,
+    VAR_FOR_DOWNSTREAM = 502,
+    VAR_FALLBACK_ENABLED = 503,
+    VAR_TLS_ADDITIONAL_PORT = 504,
+    VAR_LOW_RTT = 505,
+    VAR_LOW_RTT_PERMIL = 506,
+    VAR_FAST_SERVER_PERMIL = 507,
+    VAR_FAST_SERVER_NUM = 508,
+    VAR_ALLOW_NOTIFY = 509,
+    VAR_TLS_WIN_CERT = 510,
+    VAR_TCP_CONNECTION_LIMIT = 511,
+    VAR_FORWARD_NO_CACHE = 512,
+    VAR_STUB_NO_CACHE = 513,
+    VAR_LOG_SERVFAIL = 514,
+    VAR_DENY_ANY = 515,
+    VAR_UNKNOWN_SERVER_TIME_LIMIT = 516
  };
 #endif
 /* Tokens.  */
@@ -482,74 +490,82 @@ extern int yydebug;
 #define VAR_CLIENT_SUBNET_OPCODE 438
 #define VAR_MAX_CLIENT_SUBNET_IPV4 439
 #define VAR_MAX_CLIENT_SUBNET_IPV6 440
-#define VAR_CAPS_WHITELIST 441
-#define VAR_CACHE_MAX_NEGATIVE_TTL 442
-#define VAR_PERMIT_SMALL_HOLDDOWN 443
-#define VAR_QNAME_MINIMISATION 444
-#define VAR_QNAME_MINIMISATION_STRICT 445
-#define VAR_IP_FREEBIND 446
-#define VAR_DEFINE_TAG 447
-#define VAR_LOCAL_ZONE_TAG 448
-#define VAR_ACCESS_CONTROL_TAG 449
-#define VAR_LOCAL_ZONE_OVERRIDE 450
-#define VAR_ACCESS_CONTROL_TAG_ACTION 451
-#define VAR_ACCESS_CONTROL_TAG_DATA 452
-#define VAR_VIEW 453
-#define VAR_ACCESS_CONTROL_VIEW 454
-#define VAR_VIEW_FIRST 455
-#define VAR_SERVE_EXPIRED 456
-#define VAR_SERVE_EXPIRED_TTL 457
-#define VAR_SERVE_EXPIRED_TTL_RESET 458
-#define VAR_FAKE_DSA 459
-#define VAR_FAKE_SHA1 460
-#define VAR_LOG_IDENTITY 461
-#define VAR_HIDE_TRUSTANCHOR 462
-#define VAR_TRUST_ANCHOR_SIGNALING 463
-#define VAR_AGGRESSIVE_NSEC 464
-#define VAR_USE_SYSTEMD 465
-#define VAR_SHM_ENABLE 466
-#define VAR_SHM_KEY 467
-#define VAR_ROOT_KEY_SENTINEL 468
-#define VAR_DNSCRYPT 469
-#define VAR_DNSCRYPT_ENABLE 470
-#define VAR_DNSCRYPT_PORT 471
-#define VAR_DNSCRYPT_PROVIDER 472
-#define VAR_DNSCRYPT_SECRET_KEY 473
-#define VAR_DNSCRYPT_PROVIDER_CERT 474
-#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 475
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 476
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 477
-#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 478
-#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 479
-#define VAR_IPSECMOD_ENABLED 480
-#define VAR_IPSECMOD_HOOK 481
-#define VAR_IPSECMOD_IGNORE_BOGUS 482
-#define VAR_IPSECMOD_MAX_TTL 483
-#define VAR_IPSECMOD_WHITELIST 484
-#define VAR_IPSECMOD_STRICT 485
-#define VAR_CACHEDB 486
-#define VAR_CACHEDB_BACKEND 487
-#define VAR_CACHEDB_SECRETSEED 488
-#define VAR_CACHEDB_REDISHOST 489
-#define VAR_CACHEDB_REDISPORT 490
-#define VAR_CACHEDB_REDISTIMEOUT 491
-#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 492
-#define VAR_FOR_UPSTREAM 493
-#define VAR_AUTH_ZONE 494
-#define VAR_ZONEFILE 495
-#define VAR_MASTER 496
-#define VAR_URL 497
-#define VAR_FOR_DOWNSTREAM 498
-#define VAR_FALLBACK_ENABLED 499
-#define VAR_TLS_ADDITIONAL_PORT 500
-#define VAR_LOW_RTT 501
-#define VAR_LOW_RTT_PERMIL 502
-#define VAR_ALLOW_NOTIFY 503
-#define VAR_TLS_WIN_CERT 504
-#define VAR_TCP_CONNECTION_LIMIT 505
-#define VAR_FORWARD_NO_CACHE 506
-#define VAR_STUB_NO_CACHE 507
-#define VAR_LOG_SERVFAIL 508
+#define VAR_MIN_CLIENT_SUBNET_IPV4 441
+#define VAR_MIN_CLIENT_SUBNET_IPV6 442
+#define VAR_MAX_ECS_TREE_SIZE_IPV4 443
+#define VAR_MAX_ECS_TREE_SIZE_IPV6 444
+#define VAR_CAPS_WHITELIST 445
+#define VAR_CACHE_MAX_NEGATIVE_TTL 446
+#define VAR_PERMIT_SMALL_HOLDDOWN 447
+#define VAR_QNAME_MINIMISATION 448
+#define VAR_QNAME_MINIMISATION_STRICT 449
+#define VAR_IP_FREEBIND 450
+#define VAR_DEFINE_TAG 451
+#define VAR_LOCAL_ZONE_TAG 452
+#define VAR_ACCESS_CONTROL_TAG 453
+#define VAR_LOCAL_ZONE_OVERRIDE 454
+#define VAR_ACCESS_CONTROL_TAG_ACTION 455
+#define VAR_ACCESS_CONTROL_TAG_DATA 456
+#define VAR_VIEW 457
+#define VAR_ACCESS_CONTROL_VIEW 458
+#define VAR_VIEW_FIRST 459
+#define VAR_SERVE_EXPIRED 460
+#define VAR_SERVE_EXPIRED_TTL 461
+#define VAR_SERVE_EXPIRED_TTL_RESET 462
+#define VAR_FAKE_DSA 463
+#define VAR_FAKE_SHA1 464
+#define VAR_LOG_IDENTITY 465
+#define VAR_HIDE_TRUSTANCHOR 466
+#define VAR_TRUST_ANCHOR_SIGNALING 467
+#define VAR_AGGRESSIVE_NSEC 468
+#define VAR_USE_SYSTEMD 469
+#define VAR_SHM_ENABLE 470
+#define VAR_SHM_KEY 471
+#define VAR_ROOT_KEY_SENTINEL 472
+#define VAR_DNSCRYPT 473
+#define VAR_DNSCRYPT_ENABLE 474
+#define VAR_DNSCRYPT_PORT 475
+#define VAR_DNSCRYPT_PROVIDER 476
+#define VAR_DNSCRYPT_SECRET_KEY 477
+#define VAR_DNSCRYPT_PROVIDER_CERT 478
+#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 479
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 480
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 481
+#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 482
+#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 483
+#define VAR_IPSECMOD_ENABLED 484
+#define VAR_IPSECMOD_HOOK 485
+#define VAR_IPSECMOD_IGNORE_BOGUS 486
+#define VAR_IPSECMOD_MAX_TTL 487
+#define VAR_IPSECMOD_WHITELIST 488
+#define VAR_IPSECMOD_STRICT 489
+#define VAR_CACHEDB 490
+#define VAR_CACHEDB_BACKEND 491
+#define VAR_CACHEDB_SECRETSEED 492
+#define VAR_CACHEDB_REDISHOST 493
+#define VAR_CACHEDB_REDISPORT 494
+#define VAR_CACHEDB_REDISTIMEOUT 495
+#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 496
+#define VAR_FOR_UPSTREAM 497
+#define VAR_AUTH_ZONE 498
+#define VAR_ZONEFILE 499
+#define VAR_MASTER 500
+#define VAR_URL 501
+#define VAR_FOR_DOWNSTREAM 502
+#define VAR_FALLBACK_ENABLED 503
+#define VAR_TLS_ADDITIONAL_PORT 504
+#define VAR_LOW_RTT 505
+#define VAR_LOW_RTT_PERMIL 506
+#define VAR_FAST_SERVER_PERMIL 507
+#define VAR_FAST_SERVER_NUM 508
+#define VAR_ALLOW_NOTIFY 509
+#define VAR_TLS_WIN_CERT 510
+#define VAR_TCP_CONNECTION_LIMIT 511
+#define VAR_FORWARD_NO_CACHE 512
+#define VAR_STUB_NO_CACHE 513
+#define VAR_LOG_SERVFAIL 514
+#define VAR_DENY_ANY 515
+#define VAR_UNKNOWN_SERVER_TIME_LIMIT 516

 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -560,7 +576,7 @@ union YYSTYPE

 	char*	str;

-#line 564 "util/configparser.h" /* yacc.c:1909  */
+#line 580 "util/configparser.h" /* yacc.c:1909  */
 };

 typedef union YYSTYPE YYSTYPE;
@@ -135,6 +135,8 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_SEND_CLIENT_SUBNET VAR_CLIENT_SUBNET_ZONE
 %token VAR_CLIENT_SUBNET_ALWAYS_FORWARD VAR_CLIENT_SUBNET_OPCODE
 %token VAR_MAX_CLIENT_SUBNET_IPV4 VAR_MAX_CLIENT_SUBNET_IPV6
+%token VAR_MIN_CLIENT_SUBNET_IPV4 VAR_MIN_CLIENT_SUBNET_IPV6
+%token VAR_MAX_ECS_TREE_SIZE_IPV4 VAR_MAX_ECS_TREE_SIZE_IPV6
 %token VAR_CAPS_WHITELIST VAR_CACHE_MAX_NEGATIVE_TTL VAR_PERMIT_SMALL_HOLDDOWN
 %token VAR_QNAME_MINIMISATION VAR_QNAME_MINIMISATION_STRICT VAR_IP_FREEBIND
 %token VAR_DEFINE_TAG VAR_LOCAL_ZONE_TAG VAR_ACCESS_CONTROL_TAG
@@ -159,8 +161,10 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM VAR_FOR_UPSTREAM
 %token VAR_AUTH_ZONE VAR_ZONEFILE VAR_MASTER VAR_URL VAR_FOR_DOWNSTREAM
 %token VAR_FALLBACK_ENABLED VAR_TLS_ADDITIONAL_PORT VAR_LOW_RTT VAR_LOW_RTT_PERMIL
+%token VAR_FAST_SERVER_PERMIL VAR_FAST_SERVER_NUM
 %token VAR_ALLOW_NOTIFY VAR_TLS_WIN_CERT VAR_TCP_CONNECTION_LIMIT
-%token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL
+%token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL VAR_DENY_ANY
+%token VAR_UNKNOWN_SERVER_TIME_LIMIT

 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -237,6 +241,8 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_client_subnet_zone | server_client_subnet_always_forward |
 	server_client_subnet_opcode |
 	server_max_client_subnet_ipv4 | server_max_client_subnet_ipv6 |
+	server_min_client_subnet_ipv4 | server_min_client_subnet_ipv6 |
+	server_max_ecs_tree_size_ipv4 | server_max_ecs_tree_size_ipv6 |
 	server_caps_whitelist | server_cache_max_negative_ttl |
 	server_permit_small_holddown | server_qname_minimisation |
 	server_ip_freebind | server_define_tag | server_local_zone_tag |
@@ -255,8 +261,9 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_ipsecmod_whitelist | server_ipsecmod_strict |
 	server_udp_upstream_without_downstream | server_aggressive_nsec |
 	server_tls_cert_bundle | server_tls_additional_port | server_low_rtt |
-	server_low_rtt_permil | server_tls_win_cert |
-	server_tcp_connection_limit | server_log_servfail
+	server_fast_server_permil | server_fast_server_num  | server_tls_win_cert |
+	server_tcp_connection_limit | server_log_servfail | server_deny_any |
+	server_unknown_server_time_limit
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -493,6 +500,70 @@ server_max_client_subnet_ipv6: VAR_MAX_CLIENT_SUBNET_IPV6 STRING_ARG
 		free($2);
 	}
 	;
+server_min_client_subnet_ipv4: VAR_MIN_CLIENT_SUBNET_IPV4 STRING_ARG
+	{
+	#ifdef CLIENT_SUBNET
+		OUTYY(("P(min_client_subnet_ipv4:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("IPv4 subnet length expected");
+		else if (atoi($2) > 32)
+			cfg_parser->cfg->min_client_subnet_ipv4 = 32;
+		else if (atoi($2) < 0)
+			cfg_parser->cfg->min_client_subnet_ipv4 = 0;
+		else cfg_parser->cfg->min_client_subnet_ipv4 = (uint8_t)atoi($2);
+	#else
+		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+	#endif
+		free($2);
+	}
+	;
+server_min_client_subnet_ipv6: VAR_MIN_CLIENT_SUBNET_IPV6 STRING_ARG
+	{
+	#ifdef CLIENT_SUBNET
+		OUTYY(("P(min_client_subnet_ipv6:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("Ipv6 subnet length expected");
+		else if (atoi($2) > 128)
+			cfg_parser->cfg->min_client_subnet_ipv6 = 128;
+		else if (atoi($2) < 0)
+			cfg_parser->cfg->min_client_subnet_ipv6 = 0;
+		else cfg_parser->cfg->min_client_subnet_ipv6 = (uint8_t)atoi($2);
+	#else
+		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+	#endif
+		free($2);
+	}
+	;
+server_max_ecs_tree_size_ipv4: VAR_MAX_ECS_TREE_SIZE_IPV4 STRING_ARG
+	{
+	#ifdef CLIENT_SUBNET
+		OUTYY(("P(max_ecs_tree_size_ipv4:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("IPv4 ECS tree size expected");
+		else if (atoi($2) < 0)
+			cfg_parser->cfg->max_ecs_tree_size_ipv4 = 0;
+		else cfg_parser->cfg->max_ecs_tree_size_ipv4 = (uint32_t)atoi($2);
+	#else
+		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+	#endif
+		free($2);
+	}
+	;
+server_max_ecs_tree_size_ipv6: VAR_MAX_ECS_TREE_SIZE_IPV6 STRING_ARG
+	{
+	#ifdef CLIENT_SUBNET
+		OUTYY(("P(max_ecs_tree_size_ipv6:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("IPv6 ECS tree size expected");
+		else if (atoi($2) < 0)
+			cfg_parser->cfg->max_ecs_tree_size_ipv6 = 0;
+		else cfg_parser->cfg->max_ecs_tree_size_ipv6 = (uint32_t)atoi($2);
+	#else
+		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+	#endif
+		free($2);
+	}
+	;
 server_interface: VAR_INTERFACE STRING_ARG
 	{
 		OUTYY(("P(server_interface:%s)\n", $2));
@@ -1342,6 +1413,15 @@ server_prefetch_key: VAR_PREFETCH_KEY STRING_ARG
 		free($2);
 	}
 	;
+server_deny_any: VAR_DENY_ANY STRING_ARG
+	{
+		OUTYY(("P(server_deny_any:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->deny_any = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_unwanted_reply_threshold: VAR_UNWANTED_REPLY_THRESHOLD STRING_ARG
 	{
 		OUTYY(("P(server_unwanted_reply_threshold:%s)\n", $2));
@@ -1718,6 +1798,13 @@ server_rrset_roundrobin: VAR_RRSET_ROUNDROBIN STRING_ARG
 		free($2);
 	}
 	;
+server_unknown_server_time_limit: VAR_UNKNOWN_SERVER_TIME_LIMIT STRING_ARG
+	{
+		OUTYY(("P(server_unknown_server_time_limit:%s)\n", $2));
+		cfg_parser->cfg->unknown_server_time_limit = atoi($2);
+		free($2);
+	}
+	;
 server_max_udp_size: VAR_MAX_UDP_SIZE STRING_ARG
 	{
 		OUTYY(("P(server_max_udp_size:%s)\n", $2));
@@ -1974,19 +2061,25 @@ server_ratelimit_factor: VAR_RATELIMIT_FACTOR STRING_ARG
 	;
 server_low_rtt: VAR_LOW_RTT STRING_ARG 
 	{ 
-		OUTYY(("P(server_low_rtt:%s)\n", $2)); 
-		if(atoi($2) == 0 && strcmp($2, "0") != 0)
-			yyerror("number expected");
-		else cfg_parser->cfg->low_rtt = atoi($2);
+		OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n"));
 		free($2);
 	}
 	;
-server_low_rtt_permil: VAR_LOW_RTT_PERMIL STRING_ARG 
+server_fast_server_num: VAR_FAST_SERVER_NUM STRING_ARG 
 	{ 
-		OUTYY(("P(server_low_rtt_permil:%s)\n", $2)); 
+		OUTYY(("P(server_fast_server_num:%s)\n", $2)); 
+		if(atoi($2) <= 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->fast_server_num = atoi($2);
+		free($2);
+	}
+	;
+server_fast_server_permil: VAR_FAST_SERVER_PERMIL STRING_ARG 
+	{ 
+		OUTYY(("P(server_fast_server_permil:%s)\n", $2)); 
 		if(atoi($2) == 0 && strcmp($2, "0") != 0)
 			yyerror("number expected");
-		else cfg_parser->cfg->low_rtt_permil = atoi($2);
+		else cfg_parser->cfg->fast_server_permil = atoi($2);
 		free($2);
 	}
 	;
@@ -50,6 +50,11 @@
 #include "sldns/sbuffer.h"
 #include "services/localzone.h"

+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <sys/time.h>
+
 /** return code that means the function ran out of memory. negative so it does
 * not conflict with DNS rcodes. */
 #define RETVAL_OUTMEM	-2
@@ -672,7 +677,7 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep,
 	}
 	/* roundrobin offset. using query id for random number.  With ntohs
 	 * for different roundrobins for sequential id client senders. */
-	rr_offset = RRSET_ROUNDROBIN?ntohs(id):0;
+	rr_offset = RRSET_ROUNDROBIN?ntohs(id)+(timenow?timenow:time(NULL)):0;

 	/* "prepend" any local alias records in the answer section if this
 	 * response is supposed to be authoritative.  Currently it should
@@ -303,6 +303,9 @@ fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_type fptr)
 {
 	if(fptr == NULL) return 1;
 	else if(fptr == &rrset_markdel) return 1;
+#ifdef CLIENT_SUBNET
+	else if(fptr == &subnet_markdel) return 1;
+#endif
 	return 0;
 }

@@ -561,9 +564,12 @@ int fptr_whitelist_inplace_cb_query(inplace_cb_query_func_type* fptr)
 #ifdef CLIENT_SUBNET
 	if(fptr == &ecs_whitelist_check)
 		return 1;
-#else
-	(void)fptr;
 #endif
+#ifdef WITH_PYTHONMODULE
+        if(fptr == &python_inplace_cb_query_generic)
+                return 1;
+#endif
+	(void)fptr;
 	return 0;
 }

@@ -4796,10 +4796,12 @@
 8206,
 8207,
 8208,
+8211,
 8230,
 8231,
 8232,
 8243,
+8266,
 8276,
 8280,
 8282,
@@ -78,8 +78,6 @@ static const char* ident="unbound";
 /** are we using syslog(3) to log to */
 static int logging_to_syslog = 0;
 #endif /* HAVE_SYSLOG_H */
-/** time to print in log, if NULL, use time(2) */
-static time_t* log_now = NULL;
 /** print time in UTC or in secondsfrom1970 */
 static int log_time_asc = 0;

@@ -181,11 +179,6 @@ void log_ident_set(const char* id)
 	ident = id;
 }

-void log_set_time(time_t* t)
-{
-	log_now = t;
-}
-
 void log_set_time_asc(int use_asc)
 {
 	log_time_asc = use_asc;
@@ -255,9 +248,7 @@ log_vmsg(int pri, const char* type,
 		lock_quick_unlock(&log_lock);
 		return;
 	}
-	if(log_now)
-		now = (time_t)*log_now;
-	else	now = (time_t)time(NULL);
+	now = (time_t)time(NULL);
 #if defined(HAVE_STRFTIME) && defined(HAVE_LOCALTIME_R) 
 	if(log_time_asc && strftime(tmbuf, sizeof(tmbuf), "%b %d %H:%M:%S",
 		localtime_r(&now, &tm))%(sizeof(tmbuf)) != 0) {
@@ -112,13 +112,6 @@ int log_thread_get(void);
 */
 void log_ident_set(const char* id);

-/**
- * Set the time value to print in log entries.
- * @param t: the point is copied and used to find the time.
- * 	if NULL, time(2) is used.
- */
-void log_set_time(time_t* t);
-
 /**
 * Set if the time value is printed ascii or decimal in log entries.
 * @param use_asc: if true, ascii is printed, otherwise decimal.
Author	SHA1	Message	Date
Wouter Wijngaards	d29c1f06af	update windows icon, larger and with transparency. git-svn-id: file:///svn/unbound/tags/release-1.8.2@5011 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-12-04 08:25:57 +00:00
Wouter Wijngaards	f1be0186ae	release 1.8.2 tag git-svn-id: file:///svn/unbound/tags/release-1.8.2@5010 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-12-04 08:24:35 +00:00
Wouter Wijngaards	2195bf506a	tag 1.8.2rc1 git-svn-id: file:///svn/unbound/tags/release-1.8.2rc1@4993 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-29 08:45:05 +00:00
Wouter Wijngaards	63dcbe3d75	- Fix chroot auth-zone fix to remove chroot prefix. git-svn-id: file:///svn/unbound/trunk@4992 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-29 08:27:47 +00:00
Wouter Wijngaards	fb342b73d3	- iana portlist updated. git-svn-id: file:///svn/unbound/trunk@4991 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-29 08:27:22 +00:00
Wouter Wijngaards	cccb5094a4	- Fix clang analysis for outside directory build test. git-svn-id: file:///svn/unbound/trunk@4990 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-28 13:34:31 +00:00
Wouter Wijngaards	3330d5296c	- Fix leak in chroot fix for auth-zone. git-svn-id: file:///svn/unbound/trunk@4989 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-28 12:37:52 +00:00
Wouter Wijngaards	f95f98b12a	- Update contrib fastrpz patch for latest release. git-svn-id: file:///svn/unbound/trunk@4988 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 15:47:52 +00:00
Wouter Wijngaards	7bb6358540	Better fix. git-svn-id: file:///svn/unbound/trunk@4987 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 13:46:44 +00:00
Wouter Wijngaards	ca33c52086	- Fix windows compile for new rrset roundrobin fix. git-svn-id: file:///svn/unbound/trunk@4986 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 13:35:29 +00:00
Wouter Wijngaards	aba3ba738f	- Put new logos into windows installer. git-svn-id: file:///svn/unbound/trunk@4985 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 13:24:40 +00:00
Wouter Wijngaards	60da4369a4	- stat count SERVFAIL downstream auth-zone queries for expired zones. git-svn-id: file:///svn/unbound/trunk@4984 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 12:42:59 +00:00
Wouter Wijngaards	b04e84ab9e	- auth-zone give SERVFAIL when expired, fallback activates when expired, and this is documented in the man page. git-svn-id: file:///svn/unbound/trunk@4983 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 12:31:37 +00:00
Wouter Wijngaards	d96de4c222	- New and better fix for Fix #4193 : Fix that prefetch failure does not overwrite valid cache entry with SERVFAIL. git-svn-id: file:///svn/unbound/trunk@4982 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 10:56:45 +00:00
Wouter Wijngaards	0ff5c52657	- Fix #4208 : 'stub-no-cache' and 'forward-no-cache' not work. git-svn-id: file:///svn/unbound/trunk@4981 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 10:29:14 +00:00
Wouter Wijngaards	f532367412	Review fix. git-svn-id: file:///svn/unbound/trunk@4980 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 09:05:00 +00:00
Wouter Wijngaards	94996b8a29	- Fix DNS64 to not store intermediate results in cache, this avoids other threads from picking up the wrong data. The module restores the previous no_cache_store setting when the the module is finished. git-svn-id: file:///svn/unbound/trunk@4979 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-27 08:43:38 +00:00
Wouter Wijngaards	59e6f149a7	- Fix that unbound-control can send file for view_local_datas. git-svn-id: file:///svn/unbound/trunk@4978 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-26 13:55:36 +00:00
Wouter Wijngaards	470806b097	- Add unbound-control view_local_datas command, like local_datas. git-svn-id: file:///svn/unbound/trunk@4977 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-26 13:37:23 +00:00
Wouter Wijngaards	8fcc82171a	- Fix #4193 : Fix that prefetch failure does not overwrite valid cache entry with SERVFAIL. git-svn-id: file:///svn/unbound/trunk@4976 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-26 10:25:50 +00:00
Wouter Wijngaards	4d5b32ee59	- Fix to not set GLOB_NOSORT so the unbound.conf include: files are sorted and in a predictable order. git-svn-id: file:///svn/unbound/trunk@4975 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-26 09:54:34 +00:00
Wouter Wijngaards	816aa50dfc	- make depend. git-svn-id: file:///svn/unbound/trunk@4974 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-22 15:57:15 +00:00
Wouter Wijngaards	068c52d8f5	- Fix that empty zonefile means the zonefile is not set and not used. git-svn-id: file:///svn/unbound/trunk@4973 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-22 15:55:18 +00:00
Wouter Wijngaards	692caffe2c	- auth zone zonefiles can be in a chroot, the chroot directory components are removed before use. git-svn-id: file:///svn/unbound/trunk@4972 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-22 15:51:09 +00:00
Wouter Wijngaards	c97bb52d77	- Fix #4209 : Crash in libunbound when called from getdns. git-svn-id: file:///svn/unbound/trunk@4971 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-22 15:07:30 +00:00
Wouter Wijngaards	438634b718	nicer python error log errors. git-svn-id: file:///svn/unbound/trunk@4970 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-22 13:47:37 +00:00
Wouter Wijngaards	d21cb609a8	- review fixes for python module. git-svn-id: file:///svn/unbound/trunk@4969 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-22 13:31:21 +00:00
Wouter Wijngaards	668c0627c0	Fix compare signed with unsigned in python interface for pythonmod git-svn-id: file:///svn/unbound/trunk@4968 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-22 13:07:37 +00:00
Wouter Wijngaards	de0b6da9f4	- ignore debug python module for test in doxygen output. git-svn-id: file:///svn/unbound/trunk@4967 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-22 13:05:26 +00:00
Wouter Wijngaards	5853f90076	- With ./configure --with-pyunbound --with-pythonmodule PYTHON_VERSION=3.6 or with 2.7 unbound can compile and unit tests succeed for the python module. - pythonmod logs the python error and traceback on failure. git-svn-id: file:///svn/unbound/trunk@4966 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-22 13:01:29 +00:00
Wouter Wijngaards	022d5131b3	Fixup. git-svn-id: file:///svn/unbound/trunk@4965 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-21 06:44:24 +00:00
Wouter Wijngaards	7458729d28	- Scrub NS records from NODATA responses as well. git-svn-id: file:///svn/unbound/trunk@4964 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-21 06:37:00 +00:00
Wouter Wijngaards	7acf6a4a66	- Removed compile warnings in pythonmod sockaddr routines. git-svn-id: file:///svn/unbound/trunk@4963 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-20 12:28:09 +00:00
Wouter Wijngaards	04d73b9192	- Add patch from Jan Vcelak for pythonmod, add sockaddr_storage getters, add support for query callbacks, allow raw address access via comm_reply and update API documentation. git-svn-id: file:///svn/unbound/trunk@4962 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-20 12:24:40 +00:00
Wouter Wijngaards	f7e99131b9	- Scrub NS records from NXDOMAIN responses to stop fragmentation poisoning of the cache. git-svn-id: file:///svn/unbound/trunk@4961 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-20 09:44:40 +00:00
Wouter Wijngaards	069b0b8c90	- Support SO_REUSEPORT_LB in FreeBSD 12 with the so-reuseport: yes option in unbound.conf. git-svn-id: file:///svn/unbound/trunk@4960 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-19 09:36:27 +00:00
Ralph Dolmans	1ff7a89433	- added contrib config files to gitignore git-svn-id: file:///svn/unbound/trunk@4959 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-14 09:51:31 +00:00
Ralph Dolmans	640d1cf929	- Bugfix min-client-subnet-ipv6 git-svn-id: file:///svn/unbound/trunk@4958 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-11-06 09:44:10 +00:00
Wouter Wijngaards	c9955f9fdf	- Fix #4152 : Logs shows wrong time when using log-time-ascii: yes. git-svn-id: file:///svn/unbound/trunk@4957 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 13:52:13 +00:00
Wouter Wijngaards	9a877e0e9a	- remade makefile dependencies. (note the make depend just done). git-svn-id: file:///svn/unbound/trunk@4956 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 09:31:25 +00:00
Wouter Wijngaards	6b49224c85	make depend git-svn-id: file:///svn/unbound/trunk@4955 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 09:30:57 +00:00
Wouter Wijngaards	fd5e4e6019	- Fix #4126 : RTT_band too low on VSAT links with 600+ms latency, adds the option unknown-server-time-limit to unbound.conf that can be increased to avoid the problem. git-svn-id: file:///svn/unbound/trunk@4954 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 09:21:41 +00:00
Wouter Wijngaards	8e2a100460	- Fix #4132 : Openness/closeness of RANGE intervals in rpl files. git-svn-id: file:///svn/unbound/trunk@4953 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 09:01:53 +00:00
Ralph Dolmans	359dcc3c5c	Document min-client-subnet-ipv4/6 default value git-svn-id: file:///svn/unbound/trunk@4952 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 08:55:55 +00:00
Ralph Dolmans	6021341118	- Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options. git-svn-id: file:///svn/unbound/trunk@4951 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 08:53:50 +00:00
Wouter Wijngaards	d5922830d0	- Fix #4141 : More randomness to rrset-roundrobin. git-svn-id: file:///svn/unbound/trunk@4950 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 08:26:40 +00:00
Wouter Wijngaards	23505d30a5	- Fix #4190 : Please create a "ANY" deny option, adds the option deny-any: yes in unbound.conf. This responds with an empty message to queries of type ANY. git-svn-id: file:///svn/unbound/trunk@4949 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 08:07:37 +00:00
Wouter Wijngaards	0f83653e76	Move rcode code back. git-svn-id: file:///svn/unbound/trunk@4948 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 07:49:49 +00:00
Wouter Wijngaards	20f0e8ad55	- Fix #4191 : NXDOMAIN vs SERVFAIL during dns64 PTR query. git-svn-id: file:///svn/unbound/trunk@4947 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-25 07:45:00 +00:00
Ralph Dolmans	140a165ab2	- Add markdel function to ECS slabhash. - Limit ECS scope returned to client to the scope used for caching. - Make lint like previous #4154 fix. git-svn-id: file:///svn/unbound/trunk@4946 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-24 13:50:18 +00:00
Wouter Wijngaards	5fec1c8b1f	- Fix #4154 : make ECS_MAX_TREESIZE configurable, with the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options. git-svn-id: file:///svn/unbound/trunk@4945 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-22 14:54:28 +00:00
Wouter Wijngaards	6bd4060ae0	portability. git-svn-id: file:///svn/unbound/trunk@4944 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-22 10:19:30 +00:00
Wouter Wijngaards	84a8415357	- check that the dnstap socket file can be opened and exists, print error if not. git-svn-id: file:///svn/unbound/trunk@4943 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-22 10:17:38 +00:00
Wouter Wijngaards	6429b5c298	- Fix #4192 : unbound-control-setup generates keys not readable by group. git-svn-id: file:///svn/unbound/trunk@4942 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-22 10:07:13 +00:00
Ralph Dolmans	6b5e7d78e3	- Change fast-server-num default to 3. git-svn-id: file:///svn/unbound/trunk@4941 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-22 09:36:36 +00:00
Ralph Dolmans	a8b2c64cbf	More lint pleasing git-svn-id: file:///svn/unbound/trunk@4940 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-08 16:38:25 +00:00
Ralph Dolmans	9268f0db50	Please lint by using proper types git-svn-id: file:///svn/unbound/trunk@4939 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-08 16:33:04 +00:00
Ralph Dolmans	02bd3e2ff1	- Add fast-server-permil and fast-server-num options. - Deprecate low-rtt and low-rtt-permil options. git-svn-id: file:///svn/unbound/trunk@4938 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-08 16:03:46 +00:00
Wouter Wijngaards	2d28fba3bf	- Squelch log of failed to tcp initiate after TCP Fastopen failure. git-svn-id: file:///svn/unbound/trunk@4937 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-08 13:27:53 +00:00
Wouter Wijngaards	19aed2dcb1	Trunk has 1.8.2 in development. git-svn-id: file:///svn/unbound/trunk@4936 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-08 12:09:44 +00:00
Wouter Wijngaards	eed1e0789a	- fastrpz.patch fix included. git-svn-id: file:///svn/unbound/trunk@4935 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-08 10:33:09 +00:00
Wouter Wijngaards	837565c505	- iana port update. git-svn-id: file:///svn/unbound/trunk@4933 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-05 15:18:08 +00:00
Wouter Wijngaards	fece182cf5	- Set default for so-reuseport to no for FreeBSD. It is enabled by default for Linux and DragonFlyBSD. The setting can be configured in unbound.conf to override the default. git-svn-id: file:///svn/unbound/trunk@4932 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-05 15:07:19 +00:00
Wouter Wijngaards	945452bff4	- Squelch EADDRNOTAVAIL errors when the interface goes away, this omits 'can't assign requested address' errors unless verbosity is set to a high value. git-svn-id: file:///svn/unbound/trunk@4931 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-05 06:29:05 +00:00
Wouter Wijngaards	1c08a2ba55	- clang analyze test is used only when assertions are enabled. git-svn-id: file:///svn/unbound/trunk@4930 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 12:42:50 +00:00
Wouter Wijngaards	d967ceb98b	Remove that fix, analyzer is for debug with assertions. - Fix clang analyzer for optimize compile analysis. git-svn-id: file:///svn/unbound/trunk@4929 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 12:32:33 +00:00
Wouter Wijngaards	a3c3e13b2f	remove unused diagnostic pragmas that themselves generate warnings git-svn-id: file:///svn/unbound/trunk@4928 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 12:17:40 +00:00
Wouter Wijngaards	83a186f6cc	Remove unused diagnostic pragmas that themselves generate warnings git-svn-id: file:///svn/unbound/trunk@4927 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 12:17:11 +00:00
Wouter Wijngaards	2598f9bb18	line fixup git-svn-id: file:///svn/unbound/trunk@4926 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 12:13:19 +00:00
Wouter Wijngaards	ba28c48efc	Remove unused variable from contrib fastrpz/rpz.c git-svn-id: file:///svn/unbound/trunk@4925 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 12:12:29 +00:00
Wouter Wijngaards	98234d1017	- updated contrib/fastrpz.patch to apply for this version git-svn-id: file:///svn/unbound/trunk@4924 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 12:00:06 +00:00
Wouter Wijngaards	99a92b3483	- Fix testlock code to set noreturn on error routine. git-svn-id: file:///svn/unbound/trunk@4923 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 10:53:40 +00:00
Wouter Wijngaards	c85ff492d0	- Fix clang analyzer for optimize compile analysis. git-svn-id: file:///svn/unbound/trunk@4922 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 10:51:05 +00:00
Wouter Wijngaards	b09cfb8fb1	- dnscrypt.c removed sizeof to get array bounds. git-svn-id: file:///svn/unbound/trunk@4921 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 10:47:12 +00:00
Wouter Wijngaards	966a958ca5	Fixup fastrpz.patch git-svn-id: file:///svn/unbound/trunk@4920 be551aaa-1e26-0410-a405-d3ace91eadb9	2018-10-02 10:34:00 +00:00