Imported Upstream version 4.0.0

.version

@@ -1 +1 @@
-4.0.0-rc1
+4.0.0

Makefile.am

@@ -46,6 +46,7 @@ EXTRA_DIST = \
 	effective_tld_names.dat \
 	epollmplexer.cc \
 	kqueuemplexer.cc \
+	lua_hpp.mk \
 	malloctrace.cc malloctrace.hh \
 	mtasker.cc \
 	mtasker_fcontext.cc mtasker_ucontext.cc \
@@ -99,12 +100,14 @@ pdns_recursor_SOURCES = \
 	opensslsigners.cc opensslsigners.hh \
 	pdns_recursor.cc \
 	pdnsexception.hh \
+	protobuf.cc protobuf.hh \
 	pubsuffix.hh pubsuffix.cc \
 	qtype.hh qtype.cc \
 	randomhelper.cc \
 	rcpgenerator.cc rcpgenerator.hh \
 	rec-carbon.cc \
 	rec-lua-conf.hh rec-lua-conf.cc \
+	rec-protobuf.cc rec-protobuf.hh \
 	rec_channel.cc rec_channel.hh \
 	rec_channel_rec.cc \
 	recpacketcache.cc recpacketcache.hh \
@@ -133,6 +136,12 @@ pdns_recursor_SOURCES = \
 	ws-recursor.cc ws-recursor.hh \
 	zoneparser-tng.cc zoneparser-tng.hh
 
+if !HAVE_LUA_HPP
+BUILT_SOURCES += lua.hpp
+nodist_pdns_recursor_SOURCES = lua.hpp
+CLEANFILES += lua.hpp
+endif
+
 pdns_recursor_LDADD = \
 	$(YAHTTP_LIBS) \
 	$(JSON11_LIBS) \
@@ -250,3 +259,7 @@ systemdsystemunit_DATA = \
 	pdns-recursor.service \
 	pdns-recursor@.service
 endif
+
+if !HAVE_LUA_HPP
+include lua_hpp.mk
+endif

Makefile.in

@@ -82,37 +82,40 @@ host_triplet = @host@
 @LUA_TRUE@am__append_1 = $(LUA_CFLAGS)
 sbin_PROGRAMS = pdns_recursor$(EXEEXT)
 bin_PROGRAMS = rec_control$(EXEEXT)
-@BOTAN110_TRUE@am__append_2 = \
+@HAVE_LUA_HPP_FALSE@am__append_2 = lua.hpp
+@HAVE_LUA_HPP_FALSE@am__append_3 = lua.hpp
+@BOTAN110_TRUE@am__append_4 = \
 @BOTAN110_TRUE@	botan110signers.cc
 
-@BOTAN110_TRUE@am__append_3 = $(BOTAN110_LIBS)
-@MALLOC_TRACE_TRUE@am__append_4 = \
+@BOTAN110_TRUE@am__append_5 = $(BOTAN110_LIBS)
+@MALLOC_TRACE_TRUE@am__append_6 = \
 @MALLOC_TRACE_TRUE@	malloctrace.cc \
 @MALLOC_TRACE_TRUE@	malloctrace.hh
 
-@MALLOC_TRACE_TRUE@am__append_5 = -rdynamic
-@LUA_TRUE@am__append_6 = $(LUA_LIBS)
-@HAVE_FREEBSD_TRUE@am__append_7 = kqueuemplexer.cc
-@HAVE_LINUX_TRUE@am__append_8 = epollmplexer.cc
-@HAVE_SOLARIS_TRUE@am__append_9 = \
+@MALLOC_TRACE_TRUE@am__append_7 = -rdynamic
+@LUA_TRUE@am__append_8 = $(LUA_LIBS)
+@HAVE_FREEBSD_TRUE@am__append_9 = kqueuemplexer.cc
+@HAVE_LINUX_TRUE@am__append_10 = epollmplexer.cc
+@HAVE_SOLARIS_TRUE@am__append_11 = \
 @HAVE_SOLARIS_TRUE@	devpollmplexer.cc \
 @HAVE_SOLARIS_TRUE@	portsmplexer.cc
 
-@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_10 = dnsmessage.pb.cc
-@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_11 = $(PROTOBUF_LIBS)
-subdir = .
-DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \
-	$(top_srcdir)/configure $(am__configure_deps) \
-	$(srcdir)/config.h.in $(top_srcdir)/build-aux/depcomp \
-	$(dist_man_MANS) COPYING README build-aux/compile \
-	build-aux/config.guess build-aux/config.sub build-aux/depcomp \
-	build-aux/install-sh build-aux/missing build-aux/ltmain.sh \
+@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_12 = dnsmessage.pb.cc
+@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_13 = $(PROTOBUF_LIBS)
+DIST_COMMON = $(srcdir)/lua_hpp.mk $(srcdir)/Makefile.in \
+	$(srcdir)/Makefile.am $(top_srcdir)/configure \
+	$(am__configure_deps) $(srcdir)/config.h.in \
+	$(top_srcdir)/build-aux/depcomp $(dist_man_MANS) COPYING \
+	README build-aux/compile build-aux/config.guess \
+	build-aux/config.sub build-aux/depcomp build-aux/install-sh \
+	build-aux/missing build-aux/ltmain.sh \
 	$(top_srcdir)/build-aux/compile \
 	$(top_srcdir)/build-aux/config.guess \
 	$(top_srcdir)/build-aux/config.sub \
 	$(top_srcdir)/build-aux/install-sh \
 	$(top_srcdir)/build-aux/ltmain.sh \
 	$(top_srcdir)/build-aux/missing
+subdir = .
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps =  \
 	$(top_srcdir)/m4/ax_arg_default_enable_disable.m4 \
@@ -123,6 +126,8 @@ am__aclocal_m4_deps =  \
 	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
 	$(top_srcdir)/m4/pdns_check_clock_gettime.m4 \
 	$(top_srcdir)/m4/pdns_check_curl.m4 \
+	$(top_srcdir)/m4/pdns_check_lua_hpp.m4 \
+	$(top_srcdir)/m4/pdns_check_network_libs.m4 \
 	$(top_srcdir)/m4/pdns_check_os.m4 \
 	$(top_srcdir)/m4/pdns_check_pandoc.m4 \
 	$(top_srcdir)/m4/pdns_check_ragel.m4 \
@@ -166,9 +171,10 @@ am__pdns_recursor_SOURCES_DIST = arguments.cc base32.cc base32.hh \
 	misc.cc mplexer.hh mtasker.hh mtasker_context.cc \
 	mtasker_context.hh namespaces.hh nsecrecords.cc \
 	opensslsigners.cc opensslsigners.hh pdns_recursor.cc \
-	pdnsexception.hh pubsuffix.hh pubsuffix.cc qtype.hh qtype.cc \
-	randomhelper.cc rcpgenerator.cc rcpgenerator.hh rec-carbon.cc \
-	rec-lua-conf.hh rec-lua-conf.cc rec_channel.cc rec_channel.hh \
+	pdnsexception.hh protobuf.cc protobuf.hh pubsuffix.hh \
+	pubsuffix.cc qtype.hh qtype.cc randomhelper.cc rcpgenerator.cc \
+	rcpgenerator.hh rec-carbon.cc rec-lua-conf.hh rec-lua-conf.cc \
+	rec-protobuf.cc rec-protobuf.hh rec_channel.cc rec_channel.hh \
 	rec_channel_rec.cc recpacketcache.cc recpacketcache.hh \
 	recursor_cache.cc recursor_cache.hh reczones.cc \
 	remote_logger.cc remote_logger.hh resolver.hh resolver.cc \
@@ -199,9 +205,10 @@ am_pdns_recursor_OBJECTS = arguments.$(OBJEXT) base32.$(OBJEXT) \
 	lua-recursor4.$(OBJEXT) lwres.$(OBJEXT) misc.$(OBJEXT) \
 	mtasker_context.$(OBJEXT) nsecrecords.$(OBJEXT) \
 	opensslsigners.$(OBJEXT) pdns_recursor.$(OBJEXT) \
-	pubsuffix.$(OBJEXT) qtype.$(OBJEXT) randomhelper.$(OBJEXT) \
-	rcpgenerator.$(OBJEXT) rec-carbon.$(OBJEXT) \
-	rec-lua-conf.$(OBJEXT) rec_channel.$(OBJEXT) \
+	protobuf.$(OBJEXT) pubsuffix.$(OBJEXT) qtype.$(OBJEXT) \
+	randomhelper.$(OBJEXT) rcpgenerator.$(OBJEXT) \
+	rec-carbon.$(OBJEXT) rec-lua-conf.$(OBJEXT) \
+	rec-protobuf.$(OBJEXT) rec_channel.$(OBJEXT) \
 	rec_channel_rec.$(OBJEXT) recpacketcache.$(OBJEXT) \
 	recursor_cache.$(OBJEXT) reczones.$(OBJEXT) \
 	remote_logger.$(OBJEXT) resolver.$(OBJEXT) \
@@ -596,11 +603,9 @@ AM_LDFLAGS = \
 	$(THREADFLAGS)
 
 ACLOCAL_AMFLAGS = -I m4
-BUILT_SOURCES = htmlfiles.h $(am__append_10)
-CLEANFILES = htmlfiles.h \
-	dnsmessage.pb.cc \
-	dnsmessage.pb.h
-
+BUILT_SOURCES = htmlfiles.h $(am__append_2) $(am__append_12)
+CLEANFILES = htmlfiles.h dnsmessage.pb.cc dnsmessage.pb.h \
+	$(am__append_3)
 SUBDIRS = ext
 EXTRA_DIST = \
 	NOTICE \
@@ -615,6 +620,7 @@ EXTRA_DIST = \
 	effective_tld_names.dat \
 	epollmplexer.cc \
 	kqueuemplexer.cc \
+	lua_hpp.mk \
 	malloctrace.cc malloctrace.hh \
 	mtasker.cc \
 	mtasker_fcontext.cc mtasker_ucontext.cc \
@@ -640,9 +646,10 @@ pdns_recursor_SOURCES = arguments.cc base32.cc base32.hh base64.cc \
 	misc.cc mplexer.hh mtasker.hh mtasker_context.cc \
 	mtasker_context.hh namespaces.hh nsecrecords.cc \
 	opensslsigners.cc opensslsigners.hh pdns_recursor.cc \
-	pdnsexception.hh pubsuffix.hh pubsuffix.cc qtype.hh qtype.cc \
-	randomhelper.cc rcpgenerator.cc rcpgenerator.hh rec-carbon.cc \
-	rec-lua-conf.hh rec-lua-conf.cc rec_channel.cc rec_channel.hh \
+	pdnsexception.hh protobuf.cc protobuf.hh pubsuffix.hh \
+	pubsuffix.cc qtype.hh qtype.cc randomhelper.cc rcpgenerator.cc \
+	rcpgenerator.hh rec-carbon.cc rec-lua-conf.hh rec-lua-conf.cc \
+	rec-protobuf.cc rec-protobuf.hh rec_channel.cc rec_channel.hh \
 	rec_channel_rec.cc recpacketcache.cc recpacketcache.hh \
 	recursor_cache.cc recursor_cache.hh reczones.cc \
 	remote_logger.cc remote_logger.hh resolver.hh resolver.cc \
@@ -654,15 +661,16 @@ pdns_recursor_SOURCES = arguments.cc base32.cc base32.hh base64.cc \
 	validate.cc validate.hh validate-recursor.cc \
 	validate-recursor.hh version.cc version.hh webserver.cc \
 	webserver.hh ws-api.cc ws-api.hh ws-recursor.cc ws-recursor.hh \
-	zoneparser-tng.cc zoneparser-tng.hh $(am__append_2) \
-	$(am__append_4) $(am__append_7) $(am__append_8) \
-	$(am__append_9)
+	zoneparser-tng.cc zoneparser-tng.hh $(am__append_4) \
+	$(am__append_6) $(am__append_9) $(am__append_10) \
+	$(am__append_11)
+@HAVE_LUA_HPP_FALSE@nodist_pdns_recursor_SOURCES = lua.hpp
+@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@nodist_pdns_recursor_SOURCES = dnsmessage.pb.cc dnsmessage.pb.h
 pdns_recursor_LDADD = $(YAHTTP_LIBS) $(JSON11_LIBS) $(OPENSSL_LIBS) \
 	$(BOOST_CONTEXT_LIBS) $(SYSTEMD_LIBS) $(RT_LIBS) \
-	$(am__append_3) $(am__append_6) $(am__append_11)
+	$(am__append_5) $(am__append_8) $(am__append_13)
 pdns_recursor_LDFLAGS = $(AM_LDFLAGS) $(OPENSSL_LDFLAGS) \
-	$(am__append_5)
-@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@nodist_pdns_recursor_SOURCES = dnsmessage.pb.cc dnsmessage.pb.h
+	$(am__append_7)
 rec_control_SOURCES = \
 	arguments.cc arguments.hh \
 	dnsname.hh dnsname.cc \
@@ -694,7 +702,7 @@ all: $(BUILT_SOURCES) config.h
 .SUFFIXES: .cc .lo .o .obj
 am--refresh: Makefile
 	@:
-$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am $(srcdir)/lua_hpp.mk $(am__configure_deps)
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
@@ -717,6 +725,7 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe)'; \
 	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe);; \
 	esac;
+$(srcdir)/lua_hpp.mk:
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
 	$(SHELL) ./config.status --recheck
@@ -888,12 +897,14 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/opensslsigners.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pdns_recursor.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/portsmplexer.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protobuf.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pubsuffix.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qtype.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/randomhelper.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rcpgenerator.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rec-carbon.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rec-lua-conf.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rec-protobuf.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rec_channel.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rec_channel_rec.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rec_control.Po@am__quote@
@@ -1508,6 +1519,12 @@ recursor.conf-dist: pdns_recursor
 @HAVE_SYSTEMD_TRUE@	$(AM_V_GEN)sed -e 's!/pdns_recursor!& --config-name=%i!' \
 @HAVE_SYSTEMD_TRUE@	  -e 's!Recursor!& %i!' \
 @HAVE_SYSTEMD_TRUE@	  < $< > $@
+@HAVE_LUA_HPP_FALSE@lua.hpp:
+@HAVE_LUA_HPP_FALSE@	$(AM_V_GEN)echo 'extern "C" {' > $@
+@HAVE_LUA_HPP_FALSE@	@echo '#include "lua.h"' >> $@
+@HAVE_LUA_HPP_FALSE@	@echo '#include "lualib.h"' >> $@
+@HAVE_LUA_HPP_FALSE@	@echo '#include "lauxlib.h"' >> $@
+@HAVE_LUA_HPP_FALSE@	@echo '}' >> $@
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.

aclocal.m4

@@ -1373,6 +1373,8 @@ m4_include([m4/ltversion.m4])
 m4_include([m4/lt~obsolete.m4])
 m4_include([m4/pdns_check_clock_gettime.m4])
 m4_include([m4/pdns_check_curl.m4])
+m4_include([m4/pdns_check_lua_hpp.m4])
+m4_include([m4/pdns_check_network_libs.m4])
 m4_include([m4/pdns_check_os.m4])
 m4_include([m4/pdns_check_pandoc.m4])
 m4_include([m4/pdns_check_ragel.m4])

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for pdns-recursor 4.0.0-rc1.
+# Generated by GNU Autoconf 2.69 for pdns-recursor 4.0.0.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@@ -587,8 +587,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='pdns-recursor'
 PACKAGE_TARNAME='pdns-recursor'
-PACKAGE_VERSION='4.0.0-rc1'
-PACKAGE_STRING='pdns-recursor 4.0.0-rc1'
+PACKAGE_VERSION='4.0.0'
+PACKAGE_STRING='pdns-recursor 4.0.0'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -665,6 +665,8 @@ BOTAN110_LIBS
 BOTAN110_CFLAGS
 BOTAN110_FALSE
 BOTAN110_TRUE
+HAVE_LUA_HPP_FALSE
+HAVE_LUA_HPP_TRUE
 LUA_FALSE
 LUA_TRUE
 LUA_LIBS
@@ -1419,7 +1421,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures pdns-recursor 4.0.0-rc1 to adapt to many kinds of systems.
+\`configure' configures pdns-recursor 4.0.0 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1489,7 +1491,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of pdns-recursor 4.0.0-rc1:";;
+     short | recursive ) echo "Configuration of pdns-recursor 4.0.0:";;
    esac
   cat <<\_ACEOF
 
@@ -1643,7 +1645,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-pdns-recursor configure 4.0.0-rc1
+pdns-recursor configure 4.0.0
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2242,7 +2244,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by pdns-recursor $as_me 4.0.0-rc1, which was
+It was created by pdns-recursor $as_me 4.0.0, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3105,7 +3107,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='pdns-recursor'
- VERSION='4.0.0-rc1'
+ VERSION='4.0.0'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -15798,7 +15800,7 @@ ac_compiler_gnu=$ac_cv_cxx_compiler_gnu
   THREADFLAGS=""
 
   case "$host_os" in
-  solaris2.10)
+  solaris2.1*)
     LIBS="-lposix4 -lpthread $LIBS"
     CXXFLAGS="-D_REENTRANT $CXXFLAGS"
     have_solaris="yes"
@@ -15867,6 +15869,232 @@ fi
 
 
 
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing inet_aton" >&5
+$as_echo_n "checking for library containing inet_aton... " >&6; }
+if ${ac_cv_search_inet_aton+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char inet_aton ();
+int
+main ()
+{
+return inet_aton ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' resolv; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_cxx_try_link "$LINENO"; then :
+  ac_cv_search_inet_aton=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_inet_aton+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_inet_aton+:} false; then :
+
+else
+  ac_cv_search_inet_aton=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_aton" >&5
+$as_echo "$ac_cv_search_inet_aton" >&6; }
+ac_res=$ac_cv_search_inet_aton
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing gethostbyname" >&5
+$as_echo_n "checking for library containing gethostbyname... " >&6; }
+if ${ac_cv_search_gethostbyname+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char gethostbyname ();
+int
+main ()
+{
+return gethostbyname ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' nsl; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_cxx_try_link "$LINENO"; then :
+  ac_cv_search_gethostbyname=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_gethostbyname+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_gethostbyname+:} false; then :
+
+else
+  ac_cv_search_gethostbyname=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_gethostbyname" >&5
+$as_echo "$ac_cv_search_gethostbyname" >&6; }
+ac_res=$ac_cv_search_gethostbyname
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing socket" >&5
+$as_echo_n "checking for library containing socket... " >&6; }
+if ${ac_cv_search_socket+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char socket ();
+int
+main ()
+{
+return socket ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' socket; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_cxx_try_link "$LINENO"; then :
+  ac_cv_search_socket=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_socket+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_socket+:} false; then :
+
+else
+  ac_cv_search_socket=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_socket" >&5
+$as_echo "$ac_cv_search_socket" >&6; }
+ac_res=$ac_cv_search_socket
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing gethostent" >&5
+$as_echo_n "checking for library containing gethostent... " >&6; }
+if ${ac_cv_search_gethostent+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char gethostent ();
+int
+main ()
+{
+return gethostent ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' nsl; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_cxx_try_link "$LINENO"; then :
+  ac_cv_search_gethostent=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_gethostent+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_gethostent+:} false; then :
+
+else
+  ac_cv_search_gethostent=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_gethostent" >&5
+$as_echo "$ac_cv_search_gethostent" >&6; }
+ac_res=$ac_cv_search_gethostent
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+
+
 # Boost Context was introduced in 1.51 (Aug 2012), but there was an immediate
 # API break in 1.52 (Nov 2012), so we only support that, and later.
 
@@ -16227,12 +16455,14 @@ fi
 
 if test "x$PROTOBUF_LIBS" != "x" -a x"$PROTOC" != "x"; then :
   # The protobuf code needs boost::uuid, which is available from 1.42 onward
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Bumping minimal Boost requirement to 1.42. To keep the requirement at 1.35, disable protobuf support" >&5
+$as_echo "$as_me: WARNING: Bumping minimal Boost requirement to 1.42. To keep the requirement at 1.35, disable protobuf support" >&2;}
   boost_required_version=1.42
 
 fi
 
 
-echo "$as_me: this is boost.m4 serial 25" >&5
+echo "$as_me: this is boost.m4 serial 26 PowerDNS modified" >&5
 boost_save_IFS=$IFS
 boost_version_req=$boost_required_version
 IFS=.
@@ -16388,6 +16618,7 @@ boost-lib-version = BOOST_LIB_VERSION
 _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
   grep -v '#' |
+  grep -v '^[[:space:]]*$' |
   tr -d '\r' |
   tr -s '\n' ' ' |
   $SED -n -e "/^boost-lib-version = /{s///;s/[\" ]//g;p;q;}" >conftest.i 2>&1; then :
@@ -17326,6 +17557,19 @@ CPPFLAGS=$boost_thread_save_CPPFLAGS
     { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the Boost context library actually links..." >&5
 $as_echo "$as_me: checking whether the Boost context library actually links..." >&6;}
     if test x"$boost_cv_inc_path" = xno; then
+   :
+else
+ac_ext=cpp
+ac_cpp='$CXXCPP $CPPFLAGS'
+ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CXX -o conftest$ac_exeext $CXXFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_cxx_compiler_gnu
+boost_save_CPPFLAGS=$CPPFLAGS
+CPPFLAGS="$CPPFLAGS $BOOST_CPPFLAGS"
+ac_fn_cxx_check_header_mongrel "$LINENO" "boost/context/fcontext.hpp" "ac_cv_header_boost_context_fcontext_hpp" "$ac_includes_default"
+if test "x$ac_cv_header_boost_context_fcontext_hpp" = xyes; then :
+
+      if test x"$boost_cv_inc_path" = xno; then
   { $as_echo "$as_me:${as_lineno-$LINENO}: Boost not available, not searching for the Boost context library" >&5
 $as_echo "$as_me: Boost not available, not searching for the Boost context library" >&6;}
 else
@@ -17602,6 +17846,20 @@ $as_echo "#define HAVE_BOOST_CONTEXT 1" >>confdefs.h
     BOOST_CONTEXT_LIBS=$boost_cv_lib_context_LIBS
     ;;
 esac
+CPPFLAGS=$boost_save_CPPFLAGS
+ac_ext=cpp
+ac_cpp='$CXXCPP $CPPFLAGS'
+ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CXX -o conftest$ac_exeext $CXXFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_cxx_compiler_gnu
+fi
+
+
+else
+   :
+fi
+
+
 CPPFLAGS=$boost_save_CPPFLAGS
 ac_ext=cpp
 ac_cpp='$CXXCPP $CPPFLAGS'
@@ -17631,6 +17889,7 @@ $as_echo "$as_me: MTasker will use System V ucontexts for context switching" >&6
 
 
 
+
   { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable reproducible builds." >&5
 $as_echo_n "checking whether to enable reproducible builds.... " >&6; }
   # Check whether --enable-reproducible was given.
@@ -17653,13 +17912,17 @@ $as_echo "#define REPRODUCIBLE 1" >>confdefs.h
 else
 
     build_user=$(id -u -n)
-    if  test x"$host_os" = "xSunOS" ; then
+
+    case "$host_os" in
+    solaris2.1* | SunOS)
       build_host_host=$(hostname)
       build_host_domain=$(domainname)
       build_host="$build_host_host.$build_host_domain"
-    else
+      ;;
+    *)
       build_host=$(hostname -f || hostname || echo 'localhost')
-    fi
+      ;;
+    esac
 
 cat >>confdefs.h <<_ACEOF
 #define BUILD_HOST "$build_user@$build_host"
@@ -17991,7 +18254,8 @@ $as_echo "not found" >&6; }
 
 fi
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LUAPC" >&5
+
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LUAPC" >&5
 $as_echo "$LUAPC" >&6; }
 
 fi
@@ -18010,6 +18274,28 @@ fi
 fi
 
 
+
+  if test "x$LUAPC" != "x" -o "x$LUAJITPC" != "x" ; then :
+
+    ac_fn_cxx_check_header_mongrel "$LINENO" "lua.hpp" "ac_cv_header_lua_hpp" "$ac_includes_default"
+if test "x$ac_cv_header_lua_hpp" = xyes; then :
+   have_lua_hpp=y
+fi
+
+
+
+fi
+   if  test x"$have_lua_hpp" = "xy" ; then
+  HAVE_LUA_HPP_TRUE=
+  HAVE_LUA_HPP_FALSE='#'
+else
+  HAVE_LUA_HPP_TRUE='#'
+  HAVE_LUA_HPP_FALSE=
+fi
+
+
+
+
   { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable verbose logging" >&5
 $as_echo_n "checking whether to enable verbose logging... " >&6; }
 
@@ -19658,6 +19944,10 @@ if test -z "${LUA_TRUE}" && test -z "${LUA_FALSE}"; then
   as_fn_error $? "conditional \"LUA\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
 fi
+if test -z "${HAVE_LUA_HPP_TRUE}" && test -z "${HAVE_LUA_HPP_FALSE}"; then
+  as_fn_error $? "conditional \"HAVE_LUA_HPP\" was never defined.
+Usually this means the macro was only invoked conditionally." "$LINENO" 5
+fi
 if test -z "${BOTAN110_TRUE}" && test -z "${BOTAN110_FALSE}"; then
   as_fn_error $? "conditional \"BOTAN110\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
@@ -20075,7 +20365,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by pdns-recursor $as_me 4.0.0-rc1, which was
+This file was extended by pdns-recursor $as_me 4.0.0, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -20141,7 +20431,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-pdns-recursor config.status 4.0.0-rc1
+pdns-recursor config.status 4.0.0
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -22211,34 +22501,41 @@ $as_echo "$as_me: CXXFLAGS: $CXXFLAGS" >&6;}
 $as_echo "$as_me: LDFLAGS: $LDFLAGS" >&6;}
 { $as_echo "$as_me:${as_lineno-$LINENO}: LIBS: $LIBS" >&5
 $as_echo "$as_me: LIBS: $LIBS" >&6;}
-{ $as_echo "$as_me:${as_lineno-$LINENO}: " >&5
-$as_echo "$as_me: " >&6;}
 { $as_echo "$as_me:${as_lineno-$LINENO}: BOOST_CPPFLAGS: $BOOST_CPPFLAGS" >&5
 $as_echo "$as_me: BOOST_CPPFLAGS: $BOOST_CPPFLAGS" >&6;}
 { $as_echo "$as_me:${as_lineno-$LINENO}: " >&5
 $as_echo "$as_me: " >&6;}
+{ $as_echo "$as_me:${as_lineno-$LINENO}: Features enabled" >&5
+$as_echo "$as_me: Features enabled" >&6;}
+{ $as_echo "$as_me:${as_lineno-$LINENO}: ----------------" >&5
+$as_echo "$as_me: ----------------" >&6;}
 if test "x$LUAPC" != "x"; then :
-  { $as_echo "$as_me:${as_lineno-$LINENO}: Lua support: $LUAPC" >&5
-$as_echo "$as_me: Lua support: $LUAPC" >&6;}
+  { $as_echo "$as_me:${as_lineno-$LINENO}: Lua: $LUAPC" >&5
+$as_echo "$as_me: Lua: $LUAPC" >&6;}
+else
+  if test "x$LUAJITPC" != "x"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: LuaJit: $LUAJITPC" >&5
+$as_echo "$as_me: LuaJit: $LUAJITPC" >&6;}
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: Lua support: no" >&5
-$as_echo "$as_me: Lua support: no" >&6;}
+  { $as_echo "$as_me:${as_lineno-$LINENO}: Lua/LuaJit: no" >&5
+$as_echo "$as_me: Lua/LuaJit: no" >&6;}
+fi
 
 fi
 if test "x$PROTOBUF_LIBS" != "x" -a x"$PROTOC" != "x"; then :
-  { $as_echo "$as_me:${as_lineno-$LINENO}: Protobuf support: yes" >&5
-$as_echo "$as_me: Protobuf support: yes" >&6;}
+  { $as_echo "$as_me:${as_lineno-$LINENO}: Protobuf: yes" >&5
+$as_echo "$as_me: Protobuf: yes" >&6;}
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: Protobuf support: no" >&5
-$as_echo "$as_me: Protobuf support: no" >&6;}
+  { $as_echo "$as_me:${as_lineno-$LINENO}: Protobuf: no" >&5
+$as_echo "$as_me: Protobuf: no" >&6;}
 
 fi
-if test "x$systemd" != "x"; then :
-  { $as_echo "$as_me:${as_lineno-$LINENO}: systemd support: yes" >&5
-$as_echo "$as_me: systemd support: yes" >&6;}
+if test "x$systemd" != "xn"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: systemd: yes" >&5
+$as_echo "$as_me: systemd: yes" >&6;}
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: systemd support: no" >&5
-$as_echo "$as_me: systemd support: no" >&6;}
+  { $as_echo "$as_me:${as_lineno-$LINENO}: systemd: no" >&5
+$as_echo "$as_me: systemd: no" >&6;}
 
 fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: " >&5

configure.ac

@@ -38,6 +38,7 @@ AX_CXX_COMPILE_STDCXX_11([ext], [mandatory])
 AC_PROG_LIBTOOL
 
 PDNS_CHECK_OS
+PDNS_CHECK_NETWORK_LIBS
 
 # Boost Context was introduced in 1.51 (Aug 2012), but there was an immediate
 # API break in 1.52 (Nov 2012), so we only support that, and later.
@@ -53,7 +54,9 @@ AC_DEFUN([PDNS_SELECT_CONTEXT_IMPL], [
       LDFLAGS="$LDFLAGS $BOOST_THREAD_LDFLAGS"
     fi
     AC_MSG_NOTICE([checking whether the Boost context library actually links...])
-    BOOST_FIND_LIB([context], [$1], [boost/context/fcontext.hpp], [[]])
+    BOOST_FIND_HEADER([boost/context/fcontext.hpp], [ : ], [
+      BOOST_FIND_LIB([context], [$1], [boost/context/fcontext.hpp], [[]])
+    ])
     case $boost_cv_lib_context in
       (yes)
         AC_MSG_NOTICE([MTasker will use the Boost context library for context switching])
@@ -76,7 +79,8 @@ boost_required_version=1.35
 PDNS_WITH_PROTOBUF
 AS_IF([test "x$PROTOBUF_LIBS" != "x" -a x"$PROTOC" != "x"],
   # The protobuf code needs boost::uuid, which is available from 1.42 onward
-  [boost_required_version=1.42]
+  [AC_MSG_WARN([Bumping minimal Boost requirement to 1.42. To keep the requirement at 1.35, disable protobuf support])
+  boost_required_version=1.42]
 )
 
 BOOST_REQUIRE([$boost_required_version])
@@ -88,6 +92,7 @@ PDNS_WITH_LUAJIT
 AS_IF([test "x$with_luajit" = "xno"], [
   PDNS_WITH_LUA
 ])
+PDNS_CHECK_LUA_HPP
 
 PDNS_ENABLE_VERBOSE_LOGGING
 
@@ -172,19 +177,22 @@ AC_MSG_NOTICE([CPPFLAGS: $CPPFLAGS])
 AC_MSG_NOTICE([CXXFLAGS: $CXXFLAGS])
 AC_MSG_NOTICE([LDFLAGS: $LDFLAGS])
 AC_MSG_NOTICE([LIBS: $LIBS])
-AC_MSG_NOTICE([])
 AC_MSG_NOTICE([BOOST_CPPFLAGS: $BOOST_CPPFLAGS])
 AC_MSG_NOTICE([])
+AC_MSG_NOTICE([Features enabled])
+AC_MSG_NOTICE([----------------])
 AS_IF([test "x$LUAPC" != "x"],
-  [AC_MSG_NOTICE([Lua support: $LUAPC])],
-  [AC_MSG_NOTICE([Lua support: no])]
-)
+  [AC_MSG_NOTICE([Lua: $LUAPC])],
+  [AS_IF([test "x$LUAJITPC" != "x"],
+    [AC_MSG_NOTICE([LuaJit: $LUAJITPC])],
+    [AC_MSG_NOTICE([Lua/LuaJit: no])])
+])
 AS_IF([test "x$PROTOBUF_LIBS" != "x" -a x"$PROTOC" != "x"],
-  [AC_MSG_NOTICE([Protobuf support: yes])],
-  [AC_MSG_NOTICE([Protobuf support: no])]
+  [AC_MSG_NOTICE([Protobuf: yes])],
+  [AC_MSG_NOTICE([Protobuf: no])]
 )
-AS_IF([test "x$systemd" != "x"],
-  [AC_MSG_NOTICE([systemd support: yes])],
-  [AC_MSG_NOTICE([systemd support: no])]
+AS_IF([test "x$systemd" != "xn"],
+  [AC_MSG_NOTICE([systemd: yes])],
+  [AC_MSG_NOTICE([systemd: no])]
 )
 AC_MSG_NOTICE([])

dnsmessage.proto

@@ -43,6 +43,8 @@ message PBDNSMessage {
     repeated DNSRR rrs = 2;
     optional string appliedPolicy = 3;
     repeated string tags = 4;
+    optional uint32 queryTimeSec = 5;
+    optional uint32 queryTimeUsec = 6;
   }
 
   optional DNSResponse response = 13;

dnsname.cc

@@ -14,7 +14,7 @@
 
 std::ostream & operator<<(std::ostream &os, const DNSName& d)
 {
-  return os <<d.toString();
+  return os <<d.toLogString();
 }
 
 DNSName::DNSName(const char* p)
@@ -157,15 +157,7 @@ std::string DNSName::toLogString() const
     return "(empty)";
   }
 
- if(isRoot())
-    return ".";
-
-  std::string ret;
-  for(const auto& s : getRawLabels()) {
-    ret+= escapeLabel(s) + ".";
-  }
-
-  return ret;
+  return toStringRootDot();
 }
 
 std::string DNSName::toDNSString() const
@@ -200,8 +192,12 @@ bool DNSName::isPartOf(const DNSName& parent) const
     return false;
 
   // this is slightly complicated since we can't start from the end, since we can't see where a label begins/ends then
-  for(auto us=d_storage.cbegin(); us<d_storage.cend() && std::distance(us,d_storage.cend()) >= static_cast<unsigned int>(parent.d_storage.size()); us+=*us+1) {
-    if (std::distance(us,d_storage.cend()) == static_cast<unsigned int>(parent.d_storage.size())) {
+  for(auto us=d_storage.cbegin(); us<d_storage.cend(); us+=*us+1) {
+    auto distance = std::distance(us,d_storage.cend());
+    if (distance < 0 || static_cast<size_t>(distance) < parent.d_storage.size()) {
+      break;
+    }
+    if (static_cast<size_t>(distance) == parent.d_storage.size()) {
       auto p = parent.d_storage.cbegin();
       for(; us != d_storage.cend(); ++us, ++p) {
         if(dns2_tolower(*p) != dns2_tolower(*us))
@@ -260,7 +256,7 @@ void DNSName::appendRawLabel(const char* start, unsigned int length)
     throw std::range_error("no such thing as an empty label to append");
   if(length > 63)
     throw std::range_error("label too long to append");
-  if(d_storage.size() + length > 254) // reserve two bytes, one for length and one for the root label
+  if(d_storage.size() + length > 254) // reserve one byte for the label length
     throw std::range_error("name too long to append");
 
   if(d_storage.empty()) {
@@ -279,7 +275,7 @@ void DNSName::prependRawLabel(const std::string& label)
     throw std::range_error("no such thing as an empty label to prepend");
   if(label.size() > 63)
     throw std::range_error("label too long to prepend");
-  if(d_storage.size() + label.size() > 254) // reserve two bytes, one for length and one for the root label
+  if(d_storage.size() + label.size() > 254) // reserve one byte for the label length
     throw std::range_error("name too long to prepend");
 
   if(d_storage.empty())

dnsname.hh

@@ -8,8 +8,8 @@
 
 #include <boost/version.hpp>
 
-// it crashes on OSX..
-#if BOOST_VERSION >= 104800 && ! defined( __APPLE__ )
+// it crashes on OSX and doesn't compile on OpenBSD
+#if BOOST_VERSION >= 104800 && ! defined( __APPLE__ ) && ! defined(__OpenBSD__)
 #include <boost/container/string.hpp>
 #endif
 
@@ -78,7 +78,7 @@ public:
   }
   DNSName& operator+=(const DNSName& rhs)
   {
-    if(d_storage.size() + rhs.d_storage.size() > 256) // reserve one byte for the root label
+    if(d_storage.size() + rhs.d_storage.size() > 256) // one extra byte for the second root label
       throw std::range_error("name too long");
     if(rhs.empty())
       return *this;
@@ -103,7 +103,7 @@ public:
   inline bool canonCompare(const DNSName& rhs) const;
   bool slowCanonCompare(const DNSName& rhs) const;  
 
-#if BOOST_VERSION >= 104800 && ! defined( __APPLE__ )
+#if BOOST_VERSION >= 104800 && ! defined( __APPLE__ ) && ! defined(__OpenBSD__)
   typedef boost::container::string string_t;
 #else
   typedef std::string string_t;

dnssecinfra.cc

@@ -365,7 +365,8 @@ string getMessageForRRSET(const DNSName& qname, const RRSIGRecordContent& rrc, v
     toHash.append((char*)&tmp, 2);
     uint32_t ttl=htonl(rrc.d_originalttl);
     toHash.append((char*)&ttl, 4);
-    string rdata=add->serialize(DNSName("."), true, true); 
+    // for NSEC signatures, we should not lowercase the rdata section
+    string rdata=add->serialize(DNSName("."), true, (add->getType() == QType::NSEC) ? false : true);  // RFC 6840, 5.1
     tmp=htons(rdata.length());
     toHash.append((char*)&tmp, 2);
     toHash.append(rdata);

effective_tld_names.dat

@@ -267,18 +267,14 @@ name.az
 pro.az
 biz.az
 
-// ba : https://en.wikipedia.org/wiki/.ba
+// ba : http://nic.ba/users_data/files/pravilnik_o_registraciji.pdf
 ba
-org.ba
-net.ba
+com.ba
 edu.ba
 gov.ba
 mil.ba
-unsa.ba
-unbi.ba
-co.ba
-com.ba
-rs.ba
+net.ba
+org.ba
 
 // bb : https://en.wikipedia.org/wiki/.bb
 bb
@@ -2549,7 +2545,6 @@ hitoyoshi.kumamoto.jp
 kamiamakusa.kumamoto.jp
 kashima.kumamoto.jp
 kikuchi.kumamoto.jp
-kosa.kumamoto.jp
 kumamoto.kumamoto.jp
 mashiki.kumamoto.jp
 mifune.kumamoto.jp
@@ -10632,6 +10627,10 @@ zuerich
 // ===BEGIN PRIVATE DOMAINS===
 // (Note: these are in alphabetical order by company name)
 
+// Agnat sp. z o.o. : https://domena.pl
+// Submitted by Przemyslaw Plewa <it-admin@domena.pl>
+beep.pl
+
 // Alces Software Ltd : http://alces-software.com
 // Submitted by Mark J. Titorenko <mark.titorenko@alces-software.com>
 *.compute.estate
@@ -10642,24 +10641,24 @@ zuerich
 cloudfront.net
 
 // Amazon Elastic Compute Cloud: https://aws.amazon.com/ec2/
-// Submitted by Luke Wells <lawells@amazon.com>
+// Submitted by Philip Allchin <pallchin@amazon.com>
+compute.amazonaws.com
 ap-northeast-1.compute.amazonaws.com
 ap-northeast-2.compute.amazonaws.com
 ap-southeast-1.compute.amazonaws.com
 ap-southeast-2.compute.amazonaws.com
-cn-north-1.compute.amazonaws.cn
-compute-1.amazonaws.com
-compute.amazonaws.cn
-compute.amazonaws.com
 eu-central-1.compute.amazonaws.com
 eu-west-1.compute.amazonaws.com
 sa-east-1.compute.amazonaws.com
-us-east-1.amazonaws.com
 us-gov-west-1.compute.amazonaws.com
 us-west-1.compute.amazonaws.com
 us-west-2.compute.amazonaws.com
+compute-1.amazonaws.com
 z-1.compute-1.amazonaws.com
 z-2.compute-1.amazonaws.com
+us-east-1.amazonaws.com
+compute.amazonaws.com.cn
+cn-north-1.compute.amazonaws.com.cn
 
 // Amazon Elastic Beanstalk : https://aws.amazon.com/elasticbeanstalk/
 // Submitted by Adam Stein <astein@amazon.com>
@@ -10693,6 +10692,13 @@ s3.eu-central-1.amazonaws.com
 // Submitted by Thomas Orozco <thomas@aptible.com>
 on-aptible.com
 
+// Association potager.org : https://potager.org/
+// Submitted by Lunar <jardiniers@potager.org>
+pimienta.org
+poivron.org
+potager.org
+sweetpepper.org
+
 // AVM : https://avm.de
 // Submitted by Andreas Weise <a.weise@avm.de>
 myfritz.net
@@ -10701,6 +10707,14 @@ myfritz.net
 // Submitted by Adrian <adrian@betainabox.com>
 betainabox.com
 
+// Boxfuse : https://boxfuse.com
+// Submitted by Axel Fontaine <axel@boxfuse.com>
+boxfuse.io
+
+// callidomus: https://www.callidomus.com/
+// Submitted by Marcus Popp <admin@callidomus.com>
+mycd.eu
+
 // CentralNic : http://www.centralnic.com/names/domains
 // Submitted by registry <gavin.brown@centralnic.com>
 ae.org
@@ -10755,10 +10769,18 @@ co.com
 // c.la : http://www.c.la/
 c.la
 
+// certmgr.org : https://certmgr.org
+// Submitted by B. Blechschmidt <hostmaster@certmgr.org>
+certmgr.org
+
 // Citrix : https://citrix.com
 // Submitted by Alex Stoddard <alex.stoddard@citrix.com>
 xenapponazure.com
 
+// ClearVox : http://www.clearvox.nl/
+// Submitted by Leon Rowland <leon@clearvox.nl>
+virtueeldomein.nl
+
 // cloudControl : https://www.cloudcontrol.com/
 // Submitted by Tobias Wilken <tw@cloudcontrol.com>
 cloudcontrolled.com
@@ -10787,6 +10809,14 @@ co.no
 // Submitted by Damien Tournoud <damien@commerceguys.com>
 *.platform.sh
 
+// Craynic, s.r.o. : http://www.craynic.com/
+// Submitted by Ales Krajnik <ales.krajnik@craynic.com>
+realm.cz
+
+// Cryptonomic : https://cryptonomic.net/
+// Submitted by Andrew Cady <public-suffix-list@cryptonomic.net>
+*.cryptonomic.net
+
 // Cupcake : https://cupcake.io/
 // Submitted by Jonathan Rudenberg <jonathan@cupcake.io>
 cupcake.is
@@ -10824,6 +10854,11 @@ dreamhosters.com
 // Submitted by Ricardo Padilha <rpadilha@drobo.com>
 mydrobo.com
 
+// Drud Holdings, LLC. : https://www.drud.com/
+// Submitted by Kevin Bridges <kevin@drud.com>
+drud.io
+drud.us
+
 // DuckDNS : http://www.duckdns.org/
 // Submitted by Richard Harper <richard@duckdns.org>
 duckdns.org
@@ -11181,6 +11216,13 @@ tr.eu.org
 uk.eu.org
 us.eu.org
 
+// Evennode : http://www.evennode.com/
+// Submitted by Michal Kralik <support@evennode.com>
+eu-1.evennode.com
+eu-2.evennode.com
+us-1.evennode.com
+us-2.evennode.com
+
 // Facebook, Inc.
 // Submitted by Peter Ruibal <public-suffix@fb.com>
 apps.fbsbx.com
@@ -11193,6 +11235,10 @@ global.ssl.fastly.net
 a.prod.fastly.net
 global.prod.fastly.net
 
+// Featherhead : https://featherhead.xyz/
+// Submitted by Simon Menke <simon@featherhead.xyz>
+fhapp.xyz
+
 // Firebase, Inc.
 // Submitted by Chris Raynor <chris@firebase.com>
 firebaseapp.com
@@ -11321,6 +11367,14 @@ withyoutube.com
 // Hashbang : https://hashbang.sh
 hashbang.sh
 
+// Hasura : https://hasura.io
+// Submitted by Shahidh K Muhammed <shahidh@hasura.io>
+hasura-app.io
+
+// Hepforge : https://www.hepforge.org
+// Submitted by David Grellscheid <admin@hepforge.org>
+hepforge.org
+
 // Heroku : https://www.heroku.com/
 // Submitted by Tom Maher <tmaher@heroku.com>
 herokuapp.com
@@ -11334,6 +11388,15 @@ iki.fi
 biz.at
 info.at
 
+// Magento Commerce
+// Submitted by Damien Tournoud <dtournoud@magento.cloud>
+*.magentosite.cloud
+
+// Meteor Development Group : https://www.meteor.com/hosting
+// Submitted by Pierre Carrier <pierre@meteor.com>
+meteorapp.com
+eu.meteorapp.com
+
 // Michau Enterprises Limited : http://www.co.pl/
 co.pl
 
@@ -11534,12 +11597,21 @@ hzc.io
 // Submitted by Asheesh Laroia <asheesh@sandstorm.io>
 sandcats.io
 
+// SBE network solutions GmbH : https://www.sbe.de/
+// Submitted by Norman Meilick <nm@sbe.de>
+logoip.de
+logoip.com
+
 // Service Online LLC : http://drs.ua/
 // Submitted by Serhii Bulakh <support@drs.ua>
 biz.ua
 co.ua
 pp.ua
 
+// Shopblocks : http://www.shopblocks.com/
+// Submitted by Alex Bowers <alex@shopblocks.com>
+myshopblocks.com
+
 // SinaAppEngine : http://sae.sina.com.cn/
 // Submitted by SinaAppEngine <saesupport@sinacloud.com>
 sinaapp.com
@@ -11552,6 +11624,10 @@ bounty-full.com
 alpha.bounty-full.com
 beta.bounty-full.com
 
+// SpaceKit : https://www.spacekit.io/
+// Submitted by Reza Akhavan <spacekit.io@gmail.com>
+spacekit.io
+
 // Synology, Inc. : https://www.synology.com/
 // Submitted by Rony Weng <ronyweng@synology.com>
 diskstation.me
@@ -11575,11 +11651,15 @@ gdynia.pl
 med.pl
 sopot.pl
 
-// TownNews.com domains : http://www.townnews.com
+// TownNews.com : http://www.townnews.com
 // Submitted by Dustin Ward <dward@townnews.com>
 bloxcms.com
 townnews-staging.com
 
+// TuxFamily : http://tuxfamily.org
+// Submitted by TuxFamily administrators <adm@staff.tuxfamily.org>
+tuxfamily.org
+
 // UDR Limited : http://www.udr.hk.com
 // Submitted by registry <hostmaster@udr.hk.com>
 hk.com

ext/Makefile.in

@@ -89,6 +89,8 @@ am__aclocal_m4_deps =  \
 	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
 	$(top_srcdir)/m4/pdns_check_clock_gettime.m4 \
 	$(top_srcdir)/m4/pdns_check_curl.m4 \
+	$(top_srcdir)/m4/pdns_check_lua_hpp.m4 \
+	$(top_srcdir)/m4/pdns_check_network_libs.m4 \
 	$(top_srcdir)/m4/pdns_check_os.m4 \
 	$(top_srcdir)/m4/pdns_check_pandoc.m4 \
 	$(top_srcdir)/m4/pdns_check_ragel.m4 \

ext/json11/Makefile.in

@@ -91,6 +91,8 @@ am__aclocal_m4_deps =  \
 	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
 	$(top_srcdir)/m4/pdns_check_clock_gettime.m4 \
 	$(top_srcdir)/m4/pdns_check_curl.m4 \
+	$(top_srcdir)/m4/pdns_check_lua_hpp.m4 \
+	$(top_srcdir)/m4/pdns_check_network_libs.m4 \
 	$(top_srcdir)/m4/pdns_check_os.m4 \
 	$(top_srcdir)/m4/pdns_check_pandoc.m4 \
 	$(top_srcdir)/m4/pdns_check_ragel.m4 \

ext/luawrapper/include/LuaContext.hpp

@@ -1345,10 +1345,13 @@ private:
                     // an exception_ptr was pushed on the stack
                     // rethrowing it with an additional ExecutionErrorException
                     try {
-                        std::rethrow_exception(readTopAndPop<std::exception_ptr>(state, std::move(errorCode)));
+                        if (const auto exp = readTopAndPop<std::exception_ptr>(state, std::move(errorCode))) {
+                            std::rethrow_exception(exp);
+                        }
                     } catch(...) {
                         std::throw_with_nested(ExecutionErrorException{"Exception thrown by a callback function called by Lua"});
                     }
+                    throw ExecutionErrorException{"Unknown Lua error"};
                 }
             }
         }

ext/yahttp/Makefile.in

@@ -89,6 +89,8 @@ am__aclocal_m4_deps =  \
 	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
 	$(top_srcdir)/m4/pdns_check_clock_gettime.m4 \
 	$(top_srcdir)/m4/pdns_check_curl.m4 \
+	$(top_srcdir)/m4/pdns_check_lua_hpp.m4 \
+	$(top_srcdir)/m4/pdns_check_network_libs.m4 \
 	$(top_srcdir)/m4/pdns_check_os.m4 \
 	$(top_srcdir)/m4/pdns_check_pandoc.m4 \
 	$(top_srcdir)/m4/pdns_check_ragel.m4 \

ext/yahttp/yahttp/Makefile.in

@@ -91,6 +91,8 @@ am__aclocal_m4_deps =  \
 	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
 	$(top_srcdir)/m4/pdns_check_clock_gettime.m4 \
 	$(top_srcdir)/m4/pdns_check_curl.m4 \
+	$(top_srcdir)/m4/pdns_check_lua_hpp.m4 \
+	$(top_srcdir)/m4/pdns_check_network_libs.m4 \
 	$(top_srcdir)/m4/pdns_check_os.m4 \
 	$(top_srcdir)/m4/pdns_check_pandoc.m4 \
 	$(top_srcdir)/m4/pdns_check_ragel.m4 \

incfiles

@@ -1,18 +1,21 @@
 #!/bin/sh
 
+export LC_ALL=C.UTF-8
+export LANG=C.UTF-8
+
 if [ -n "$1" ]
 then
 	DIR=$1/
 fi
 
-for a in $(find ${DIR}html -type f | grep -v \~)
+for a in $(find ${DIR}html -type f | grep -v \~ | sort)
 do
 	c=$(echo $a | sed s:${DIR}html/:: | tr "/.-" "___")
 	echo "INCBIN(${c}, \"$a\");"
 done
 
 echo "map<string,string> g_urlmap={"
-for a in $(find ${DIR}html -type f | grep -v \~)
+for a in $(find ${DIR}html -type f | grep -v \~ | sort)
 do
 	b=$(echo $a | sed s:${DIR}html/::g)
 	c=$(echo $b | tr "/.-" "___")

iputils.hh

@@ -306,7 +306,7 @@ public:
   {
     d_network = network;
     
-    if(bits == 0xff)
+    if(bits > 128)
       bits = (network.sin4.sin_family == AF_INET) ? 32 : 128;
     
     d_bits = bits;
@@ -398,6 +398,29 @@ public:
   {
     return d_network;
   }
+  const ComboAddress getMaskedNetwork() const
+  {
+    ComboAddress result(d_network);
+    if(isIpv4()) {
+      result.sin4.sin_addr.s_addr = htonl(ntohl(result.sin4.sin_addr.s_addr) & d_mask);
+    }
+    else if(isIpv6()) {
+      size_t idx;
+      uint8_t bytes=d_bits/8;
+      uint8_t *us=(uint8_t*) &result.sin6.sin6_addr.s6_addr;
+      uint8_t bits= d_bits % 8;
+      uint8_t mask= (uint8_t) ~(0xFF>>bits);
+
+      if (bytes < sizeof(result.sin6.sin6_addr.s6_addr)) {
+        us[bytes] &= mask;
+      }
+
+      for(idx = bytes + 1; idx < sizeof(result.sin6.sin6_addr.s6_addr); ++idx) {
+        us[idx] = 0;
+      }
+    }
+    return result;
+  }
   int getBits() const
   {
     return d_bits;

logger.cc

@@ -231,7 +231,7 @@ Logger& Logger::operator<<(ostream & (&)(ostream &))
 
 Logger& Logger::operator<<(const DNSName &d)
 {
-  *this<<d.toString();
+  *this<<d.toLogString();
 
   return *this;
 }

lua-recursor4.cc

@@ -14,28 +14,27 @@ RecursorLua4::RecursorLua4(const std::string &fname)
   throw std::runtime_error("Attempt to load a Lua script in a PowerDNS binary without Lua support");
 }
 
-bool RecursorLua4::nxdomain(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& ret, int& res, bool* variable)
+bool RecursorLua4::nxdomain(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& ret, int& res, bool* variable)
 {
   return false;
 }
 
-bool RecursorLua4::nodata(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& ret, int& res, bool* variable)
+bool RecursorLua4::nodata(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& ret, int& res, bool* variable)
 {
   return false;
 }
 
-bool RecursorLua4::postresolve(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& ret, int& res, bool* variable)
+bool RecursorLua4::postresolve(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& ret, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& res, bool* variable)
 {
   return false;
 }
 
-
-bool RecursorLua4::preresolve(const ComboAddress& remote, const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& ret, const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, int& res, bool* variable)
+bool RecursorLua4::preresolve(const ComboAddress& remote, const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& ret, const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& res, bool* variable)
 {
   return false;
 }
 
-bool RecursorLua4::preoutquery(const ComboAddress& remote, const ComboAddress& local,const DNSName& query, const QType& qtype, vector<DNSRecord>& ret, int& res)
+bool RecursorLua4::preoutquery(const ComboAddress& remote, const ComboAddress& local,const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& ret, int& res)
 {
   return false;
 }
@@ -45,7 +44,7 @@ bool RecursorLua4::ipfilter(const ComboAddress& remote, const ComboAddress& loca
   return false;
 }
 
-int RecursorLua4::gettag(const ComboAddress& remote, const Netmask& ednssubnet, const ComboAddress& local, const DNSName& qname, uint16_t qtype)
+int RecursorLua4::gettag(const ComboAddress& remote, const Netmask& ednssubnet, const ComboAddress& local, const DNSName& qname, uint16_t qtype, std::vector<std::string>* policyTags)
 {
   return 0;
 }
@@ -303,6 +302,7 @@ RecursorLua4::RecursorLua4(const std::string& fname)
   d_lw->registerFunction<bool(DNSName::*)()>("chopOff", [](DNSName&dn ) { return dn.chopOff(); });
   d_lw->registerMember("qname", &DNSQuestion::qname);
   d_lw->registerMember("qtype", &DNSQuestion::qtype);
+  d_lw->registerMember("isTcp", &DNSQuestion::isTcp);
   d_lw->registerMember("localaddr", &DNSQuestion::local);
   d_lw->registerMember("remoteaddr", &DNSQuestion::remote);
   d_lw->registerMember("rcode", &DNSQuestion::rcode);
@@ -343,18 +343,22 @@ RecursorLua4::RecursorLua4(const std::string& fname)
   d_lw->registerFunction("getRecords", &DNSQuestion::getRecords);
   d_lw->registerFunction("setRecords", &DNSQuestion::setRecords);
 
-  d_lw->registerFunction<void(DNSQuestion::*)(const std::string&)>("addPolicyTag", [](DNSQuestion& dq, const std::string& tag) { dq.policyTags.push_back(tag); });
+  d_lw->registerFunction<void(DNSQuestion::*)(const std::string&)>("addPolicyTag", [](DNSQuestion& dq, const std::string& tag) { if (dq.policyTags) { dq.policyTags->push_back(tag); } });
   d_lw->registerFunction<void(DNSQuestion::*)(const std::vector<std::pair<int, std::string> >&)>("setPolicyTags", [](DNSQuestion& dq, const std::vector<std::pair<int, std::string> >& tags) {
-      dq.policyTags.clear();
-      for (const auto& tag : tags) {
-        dq.policyTags.push_back(tag.second);
+      if (dq.policyTags) {
+        dq.policyTags->clear();
+        for (const auto& tag : tags) {
+          dq.policyTags->push_back(tag.second);
+        }
       }
     });
   d_lw->registerFunction<std::vector<std::pair<int, std::string> >(DNSQuestion::*)()>("getPolicyTags", [](const DNSQuestion& dq) {
       std::vector<std::pair<int, std::string> > ret;
-      int count = 1;
-      for (const auto& tag : dq.policyTags) {
-        ret.push_back({count++, tag});
+      if (dq.policyTags) {
+        int count = 1;
+        for (const auto& tag : *dq.policyTags) {
+          ret.push_back({count++, tag});
+        }
       }
       return ret;
     });
@@ -448,29 +452,29 @@ RecursorLua4::RecursorLua4(const std::string& fname)
   d_gettag = d_lw->readVariable<boost::optional<gettag_t>>("gettag").get_value_or(0);
 }
 
-bool RecursorLua4::preresolve(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable)
+bool RecursorLua4::preresolve(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable)
 {
-  return genhook(d_preresolve, remote, local, query, qtype, res, ednsOpts, tag, appliedPolicy, policyTags, ret, variable);
+  return genhook(d_preresolve, remote, local, query, qtype, isTcp, res, ednsOpts, tag, appliedPolicy, policyTags, ret, variable);
 }
 
-bool RecursorLua4::nxdomain(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, int& ret, bool* variable)
+bool RecursorLua4::nxdomain(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, int& ret, bool* variable)
 {
-  return genhook(d_nxdomain, remote, local, query, qtype, res, 0, 0, nullptr, nullptr, ret, variable);
+  return genhook(d_nxdomain, remote, local, query, qtype, isTcp, res, 0, 0, nullptr, nullptr, ret, variable);
 }
 
-bool RecursorLua4::nodata(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, int& ret, bool* variable)
+bool RecursorLua4::nodata(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, int& ret, bool* variable)
 {
-  return genhook(d_nodata, remote, local, query, qtype, res, 0, 0, nullptr, nullptr, ret, variable);
+  return genhook(d_nodata, remote, local, query, qtype, isTcp, res, 0, 0, nullptr, nullptr, ret, variable);
 }
 
-bool RecursorLua4::postresolve(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable)
+bool RecursorLua4::postresolve(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable)
 {
-  return genhook(d_postresolve, remote, local, query, qtype, res, 0, 0, appliedPolicy, policyTags, ret, variable);
+  return genhook(d_postresolve, remote, local, query, qtype, isTcp, res, 0, 0, appliedPolicy, policyTags, ret, variable);
 }
 
-bool RecursorLua4::preoutquery(const ComboAddress& ns, const ComboAddress& requestor, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, int& ret)
+bool RecursorLua4::preoutquery(const ComboAddress& ns, const ComboAddress& requestor, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, int& ret)
 {
-  return genhook(d_preoutquery, ns, requestor, query, qtype, res, 0, 0, nullptr, nullptr, ret, 0);
+  return genhook(d_preoutquery, ns, requestor, query, qtype, isTcp, res, 0, 0, nullptr, nullptr, ret, 0);
 }
 
 bool RecursorLua4::ipfilter(const ComboAddress& remote, const ComboAddress& local, const struct dnsheader& dh)
@@ -480,14 +484,25 @@ bool RecursorLua4::ipfilter(const ComboAddress& remote, const ComboAddress& loca
   return false; // don't block
 }
 
-int RecursorLua4::gettag(const ComboAddress& remote, const Netmask& ednssubnet, const ComboAddress& local, const DNSName& qname, uint16_t qtype)
+int RecursorLua4::gettag(const ComboAddress& remote, const Netmask& ednssubnet, const ComboAddress& local, const DNSName& qname, uint16_t qtype, std::vector<std::string>* policyTags)
 {
-  if(d_gettag)
-    return d_gettag(remote, ednssubnet, local, qname, qtype);
+  if(d_gettag) {
+    auto ret = d_gettag(remote, ednssubnet, local, qname, qtype);
+
+    if (policyTags) {
+      const auto& tags = std::get<1>(ret);
+      if (tags) {
+        for (const auto& tag : *tags) {
+          policyTags->push_back(tag.second);
+        }
+      }
+    }
+    return std::get<0>(ret);
+  }
   return 0;
 }
 
-bool RecursorLua4::genhook(luacall_t& func, const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype,  vector<DNSRecord>& res, const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable)
+bool RecursorLua4::genhook(luacall_t& func, const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable)
 {
   if(!func)
     return false;
@@ -500,8 +515,10 @@ bool RecursorLua4::genhook(luacall_t& func, const ComboAddress& remote,const Com
   dq->records = res;
   dq->tag = tag;
   dq->ednsOptions = ednsOpts;
+  dq->isTcp = isTcp;
+  dq->policyTags = policyTags;
   bool handled=func(dq);
-  if(variable) *variable |= dq->variable; // could still be set to indicate this *name* is variable
+  if(variable) *variable |= dq->variable; // could still be set to indicate this *name* is variable, even if not 'handled'
 
   if(handled) {
 loop:;
@@ -536,9 +553,6 @@ loop:;
     if (appliedPolicy) {
       *appliedPolicy=dq->appliedPolicy;
     }
-    if (policyTags) {
-      *policyTags = dq->policyTags;
-    }
   }
 
 

lua-recursor4.hh

@@ -4,6 +4,10 @@
 #include "namespaces.hh"
 #include "dnsrecords.hh"
 #include <unordered_map>
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 string GenUDPQueryResponse(const ComboAddress& dest, const string& query);
 
 class LuaContext;
@@ -11,22 +15,24 @@ class LuaContext;
 class RecursorLua4 : public boost::noncopyable
 {
 private:
+#ifdef HAVE_LUA
   std::unique_ptr<LuaContext> d_lw; // this is way on top because it must get destroyed _last_
+#endif
 
 public:
   explicit RecursorLua4(const std::string& fname);
   ~RecursorLua4(); // this is so unique_ptr works with an incomplete type
-  bool preresolve(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable);
-  bool nxdomain(const ComboAddress& remote, const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, int& ret, bool* variable);
-  bool nodata(const ComboAddress& remote, const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, int& ret, bool* variable);
-  bool postresolve(const ComboAddress& remote, const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable);
+  bool preresolve(const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable);
+  bool nxdomain(const ComboAddress& remote, const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, int& ret, bool* variable);
+  bool nodata(const ComboAddress& remote, const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, int& ret, bool* variable);
+  bool postresolve(const ComboAddress& remote, const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable);
 
-  bool preoutquery(const ComboAddress& ns, const ComboAddress& requestor, const DNSName& query, const QType& qtype, vector<DNSRecord>& res, int& ret);
+  bool preoutquery(const ComboAddress& ns, const ComboAddress& requestor, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res, int& ret);
   bool ipfilter(const ComboAddress& remote, const ComboAddress& local, const struct dnsheader&);
 
-  int gettag(const ComboAddress& remote, const Netmask& ednssubnet, const ComboAddress& local, const DNSName& query, uint16_t qtype);
+  int gettag(const ComboAddress& remote, const Netmask& ednssubnet, const ComboAddress& local, const DNSName& query, uint16_t qtype, std::vector<std::string>* policyTags);
 
-  typedef std::function<int(ComboAddress, Netmask, ComboAddress, DNSName, uint16_t)> gettag_t;
+  typedef std::function<std::tuple<int,boost::optional<std::unordered_map<int,string> > >(ComboAddress, Netmask, ComboAddress, DNSName, uint16_t)> gettag_t;
   gettag_t d_gettag; // public so you can query if we have this hooked
 
 private:
@@ -61,12 +67,13 @@ private:
     DNSName followupName;
 
     string appliedPolicy;
-    std::vector<std::string> policyTags;
+    std::vector<std::string>* policyTags;
+    bool isTcp;
   };
 
   typedef std::function<bool(std::shared_ptr<DNSQuestion>)> luacall_t;
   luacall_t d_preresolve, d_nxdomain, d_nodata, d_postresolve, d_preoutquery, d_postoutquery;
-  bool genhook(luacall_t& func, const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, vector<DNSRecord>& res,  const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable);
+  bool genhook(luacall_t& func, const ComboAddress& remote,const ComboAddress& local, const DNSName& query, const QType& qtype, bool isTcp, vector<DNSRecord>& res,  const vector<pair<uint16_t,string> >* ednsOpts, unsigned int tag, std::string* appliedPolicy, std::vector<std::string>* policyTags, int& ret, bool* variable);
   typedef std::function<bool(ComboAddress,ComboAddress, struct dnsheader)> ipfilter_t;
   ipfilter_t d_ipfilter;
 };

lua_hpp.mk

@@ -0,0 +1,6 @@
+lua.hpp:
+	$(AM_V_GEN)echo 'extern "C" {' > $@
+	@echo '#include "lua.h"' >> $@
+	@echo '#include "lualib.h"' >> $@
+	@echo '#include "lauxlib.h"' >> $@
+	@echo '}' >> $@

lwres.cc

@@ -79,7 +79,7 @@ int asyncresolve(const ComboAddress& ip, const DNSName& domain, int type, bool d
 
   string ping;
   bool weWantEDNSSubnet=false;
-  if(EDNS0Level && !doTCP) {
+  if(EDNS0Level) { 
     DNSPacketWriter::optvect_t opts;
     if(srcmask) {
       EDNSSubnetOpts eo;

m4/boost.m4

@@ -22,7 +22,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 m4_define([_BOOST_SERIAL], [m4_translit([
-# serial 25
+# serial 26 PowerDNS modified
 ], [#
 ], [])])
 
@@ -86,9 +86,10 @@ dnl boost-lib-version =
 dnl # 2 "conftest.cc" 3
 dnl                    "1_56"
 dnl
-dnl So get rid of the # lines, and glue the remaining ones together.
+dnl So get rid of the # and empty lines, and glue the remaining ones together.
 (eval "$ac_cpp conftest.$ac_ext") 2>&AS_MESSAGE_LOG_FD |
   grep -v '#' |
+  grep -v '^[[[:space:]]]*$' |
   tr -d '\r' |
   tr -s '\n' ' ' |
   $SED -n -e "$1" >conftest.i 2>&1],
@@ -548,6 +549,13 @@ BOOST_DEFUN([Asio],
 BOOST_FIND_HEADER([boost/asio.hpp])])
 
 
+# BOOST_ASSIGN()
+# -------------
+# Look for Boost.Assign
+BOOST_DEFUN([Assign],
+[BOOST_FIND_HEADER([boost/assign.hpp])])
+
+
 # BOOST_BIND()
 # ------------
 # Look for Boost.Bind.

m4/pdns_check_lua_hpp.m4

@@ -0,0 +1,8 @@
+AC_DEFUN([PDNS_CHECK_LUA_HPP],[
+  AC_REQUIRE([PDNS_WITH_LUA])
+  AC_REQUIRE([PDNS_WITH_LUAJIT])
+  AS_IF([test "x$LUAPC" != "x" -o "x$LUAJITPC" != "x" ], [
+    AC_CHECK_HEADER([lua.hpp], [ have_lua_hpp=y ])
+  ])
+  AM_CONDITIONAL([HAVE_LUA_HPP], [ test x"$have_lua_hpp" = "xy" ])
+])

m4/pdns_check_network_libs.m4

@@ -0,0 +1,7 @@
+AC_DEFUN([PDNS_CHECK_NETWORK_LIBS],[
+  AC_SEARCH_LIBS([inet_aton], [resolv])
+  AC_SEARCH_LIBS([gethostbyname], [nsl])
+  AC_SEARCH_LIBS([socket], [socket])
+  AC_SEARCH_LIBS([gethostent], [nsl])
+])
+

m4/pdns_check_os.m4

@@ -2,7 +2,7 @@ AC_DEFUN([PDNS_CHECK_OS],[
   THREADFLAGS=""
 
   case "$host_os" in
-  solaris2.10)
+  solaris2.1*)
     LIBS="-lposix4 -lpthread $LIBS"
     CXXFLAGS="-D_REENTRANT $CXXFLAGS"
     have_solaris="yes"

m4/pdns_enable_reproducible.m4

@@ -1,4 +1,5 @@
 AC_DEFUN([PDNS_ENABLE_REPRODUCIBLE], [
+  AC_REQUIRE([PDNS_CHECK_OS])
   AC_MSG_CHECKING([whether to enable reproducible builds.])
   AC_ARG_ENABLE([reproducible],
     AS_HELP_STRING([--enable-reproducible],
@@ -12,13 +13,17 @@ AC_DEFUN([PDNS_ENABLE_REPRODUCIBLE], [
     AC_DEFINE([REPRODUCIBLE], [1], [Define to 1 for reproducible builds])
   ],[
     build_user=$(id -u -n)
-    if [ test x"$host_os" = "xSunOS" ]; then
+
+    case "$host_os" in
+    solaris2.1* | SunOS)
       build_host_host=$(hostname)
       build_host_domain=$(domainname)
       build_host="$build_host_host.$build_host_domain"
-    else
+      ;;
+    *)
       build_host=$(hostname -f || hostname || echo 'localhost')
-    fi
+      ;;
+    esac
     AC_DEFINE_UNQUOTED([BUILD_HOST], ["$build_user@$build_host"], [Set to the user and host that builds PowerDNS])
   ])
 ])

m4/pdns_with_lua.m4

@@ -28,9 +28,9 @@ AC_DEFUN([PDNS_WITH_LUA],[
       AS_IF([test "x$with_lua" = "xyes"],
         [AC_MSG_ERROR([cannot find lua])],
         [AC_MSG_RESULT([not found])]
-      )],
-      [AC_MSG_RESULT([$LUAPC])]
-    )
-  ])
+      )],[
+        AC_MSG_RESULT([$LUAPC])
+      ])
+    ])
   AM_CONDITIONAL([LUA], [test "x$with_lua" = "xyes"])
 ])

misc.cc

@@ -826,6 +826,9 @@ Regex::Regex(const string &expr)
     throw PDNSException("Regular expression did not compile");
 }
 
+// if you end up here because valgrind told you were are doing something wrong
+// with msgh->msg_controllen, please refer to https://github.com/PowerDNS/pdns/pull/3962
+// first.
 void addCMsgSrcAddr(struct msghdr* msgh, void* cmsgbuf, const ComboAddress* source, int itfIndex)
 {
   struct cmsghdr *cmsg = NULL;
@@ -845,7 +848,6 @@ void addCMsgSrcAddr(struct msghdr* msgh, void* cmsgbuf, const ComboAddress* sour
     memset(pkt, 0, sizeof(*pkt));
     pkt->ipi6_addr = source->sin6.sin6_addr;
     pkt->ipi6_ifindex = itfIndex;
-    msgh->msg_controllen = cmsg->cmsg_len; // makes valgrind happy and is slightly better style
   }
   else {
 #ifdef IP_PKTINFO
@@ -863,7 +865,6 @@ void addCMsgSrcAddr(struct msghdr* msgh, void* cmsgbuf, const ComboAddress* sour
     memset(pkt, 0, sizeof(*pkt));
     pkt->ipi_spec_dst = source->sin4.sin_addr;
     pkt->ipi_ifindex = itfIndex;
-    msgh->msg_controllen = cmsg->cmsg_len;
 #endif
 #ifdef IP_SENDSRCADDR
     struct in_addr *in;
@@ -878,7 +879,6 @@ void addCMsgSrcAddr(struct msghdr* msgh, void* cmsgbuf, const ComboAddress* sour
 
     in = (struct in_addr *) CMSG_DATA(cmsg);
     *in = source->sin4.sin_addr;
-    msgh->msg_controllen = cmsg->cmsg_len;
 #endif
   }
 }

opensslsigners.cc

@@ -12,6 +12,8 @@
 #include "dnssecinfra.hh"
 
 
+/* pthread locking */
+
 static pthread_mutex_t *openssllocks;
 
 extern "C" {
@@ -44,7 +46,6 @@ void openssl_thread_setup()
 
 void openssl_thread_cleanup()
 {
-  cout<<"Thread cleanup!"<<endl;
   CRYPTO_set_locking_callback(NULL);
 
   for (int i=0; i<CRYPTO_num_locks(); i++) {

opensslsigners.hh

@@ -8,4 +8,6 @@
 /* pthread locking */
 void openssl_thread_setup();
 void openssl_thread_cleanup();
+
+/* seeding PRNG */
 void openssl_seed();

pdns_recursor.cc

@@ -33,6 +33,7 @@
 #include "recpacketcache.hh"
 #include "utility.hh"
 #include "dns_random.hh"
+#include "opensslsigners.hh"
 #include <iostream>
 #include <errno.h>
 #include <boost/static_assert.hpp>
@@ -83,11 +84,7 @@ extern SortList g_sortlist;
 #include "ednsoptions.hh"
 #include "gettime.hh"
 
-#ifdef HAVE_PROTOBUF
-#include <boost/uuid/uuid.hpp>
-#include <boost/uuid/uuid_generators.hpp>
-#include "dnsmessage.pb.h"
-#endif
+#include "rec-protobuf.hh"
 
 #ifdef HAVE_SYSTEMD
 #include <systemd/sd-daemon.h>
@@ -199,7 +196,7 @@ struct DNSComboWriter {
   ComboAddress d_remote, d_local;
 #ifdef HAVE_PROTOBUF
   boost::uuids::uuid d_uuid;
-  Netmask ednssubnet;
+  Netmask d_ednssubnet;
 #endif
   bool d_tcp;
   int d_socket;
@@ -207,6 +204,7 @@ struct DNSComboWriter {
   string d_query;
   shared_ptr<TCPConnection> d_tcpConnection;
   vector<pair<uint16_t, string> > d_ednsOpts;
+  std::vector<std::string> d_policyTags;
 };
 
 
@@ -605,7 +603,7 @@ void updateResponseStats(int res, const ComboAddress& remote, unsigned int packe
 static string makeLoginfo(DNSComboWriter* dc)
 try
 {