New upstream version 4.1.0~rc3

.version

@@ -1 +1 @@
-4.1.0-alpha1
+4.1.0-rc3

Makefile.am

@@ -1,6 +1,6 @@
 JSON11_LIBS = $(top_srcdir)/ext/json11/libjson11.la
 
-AM_CPPFLAGS = $(LUA_CFLAGS) $(YAHTTP_CFLAGS) $(BOOST_CPPFLAGS) $(BOTAN110_CFLAGS) $(NET_SNMP_CFLAGS) $(SANITIZER_FLAGS) -O3 -Wall -pthread -DSYSCONFDIR=\"${sysconfdir}\" $(SYSTEMD_CFLAGS)
+AM_CPPFLAGS = $(LUA_CFLAGS) $(YAHTTP_CFLAGS) $(BOOST_CPPFLAGS) $(BOTAN_CFLAGS) $(LIBSODIUM_CFLAGS) $(NET_SNMP_CFLAGS) $(SANITIZER_FLAGS) -O3 -Wall -pthread -DSYSCONFDIR=\"${sysconfdir}\" $(SYSTEMD_CFLAGS)
 
 AM_CPPFLAGS += \
 	-I$(top_srcdir)/ext/json11 \
@@ -38,7 +38,7 @@ endif
 EXTRA_DIST = \
 	NOTICE \
 	.version \
-	botan110signers.cc \
+	botansigners.cc \
 	build-aux/gen-version \
 	contrib/* \
 	devpollmplexer.cc \
@@ -206,6 +206,7 @@ testrunner_SOURCES = \
 	ixfr.cc ixfr.hh \
 	logger.cc logger.hh \
 	misc.cc misc.hh \
+	mtasker_context.cc \
 	negcache.hh negcache.cc \
 	namespaces.hh \
 	nsecrecords.cc \
@@ -237,11 +238,13 @@ testrunner_SOURCES = \
 	test-iputils_hh.cc \
 	test-ixfr_cc.cc \
 	test-misc_hh.cc \
+	test-mtasker.cc \
 	test-nmtree.cc \
 	test-negcache_cc.cc \
 	test-rcpgenerator_cc.cc \
 	test-recpacketcache_cc.cc \
 	test-recursorcache_cc.cc \
+	test-signers.cc \
 	test-syncres_cc.cc \
 	test-tsig.cc \
 	testrunner.cc \
@@ -253,18 +256,23 @@ testrunner_SOURCES = \
 
 testrunner_LDFLAGS = \
 	$(AM_LDFLAGS) \
+	$(BOOST_CONTEXT_LDFLAGS) \
 	$(BOOST_UNIT_TEST_FRAMEWORK_LDFLAGS) \
 	$(LIBCRYPTO_LDFLAGS)
 
 testrunner_LDADD = \
+	$(BOOST_CONTEXT_LIBS) \
 	$(BOOST_UNIT_TEST_FRAMEWORK_LIBS) \
 	$(LIBCRYPTO_LIBS) \
 	$(RT_LIBS)
 
-if BOTAN110
+if BOTAN
 pdns_recursor_SOURCES += \
-	botan110signers.cc
-pdns_recursor_LDADD += $(BOTAN110_LIBS)
+	botansigners.cc
+pdns_recursor_LDADD += $(BOTAN_LIBS)
+testrunner_SOURCES += \
+	botansigners.cc
+testrunner_LDADD += $(BOTAN_LIBS)
 endif
 
 if LIBSODIUM

Makefile.in

@@ -87,37 +87,41 @@ TESTS = test_libcrypto $(am__EXEEXT_1)
 @UNIT_TESTS_TRUE@am__append_2 = testrunner
 @HAVE_LUA_HPP_FALSE@am__append_3 = lua.hpp
 @HAVE_LUA_HPP_FALSE@am__append_4 = lua.hpp
-@BOTAN110_TRUE@am__append_5 = \
-@BOTAN110_TRUE@	botan110signers.cc
+@BOTAN_TRUE@am__append_5 = \
+@BOTAN_TRUE@	botansigners.cc
 
-@BOTAN110_TRUE@am__append_6 = $(BOTAN110_LIBS)
-@LIBSODIUM_TRUE@am__append_7 = \
-@LIBSODIUM_TRUE@	sodiumsigners.cc
+@BOTAN_TRUE@am__append_6 = $(BOTAN_LIBS)
+@BOTAN_TRUE@am__append_7 = \
+@BOTAN_TRUE@	botansigners.cc
 
-@LIBSODIUM_TRUE@am__append_8 = $(LIBSODIUM_LIBS)
+@BOTAN_TRUE@am__append_8 = $(BOTAN_LIBS)
 @LIBSODIUM_TRUE@am__append_9 = \
 @LIBSODIUM_TRUE@	sodiumsigners.cc
 
 @LIBSODIUM_TRUE@am__append_10 = $(LIBSODIUM_LIBS)
-@LIBDECAF_TRUE@am__append_11 = \
+@LIBSODIUM_TRUE@am__append_11 = \
+@LIBSODIUM_TRUE@	sodiumsigners.cc
+
+@LIBSODIUM_TRUE@am__append_12 = $(LIBSODIUM_LIBS)
+@LIBDECAF_TRUE@am__append_13 = \
 @LIBDECAF_TRUE@	decafsigners.cc
 
-@LIBDECAF_TRUE@am__append_12 = $(LIBDECAF_LIBS)
-@MALLOC_TRACE_TRUE@am__append_13 = \
+@LIBDECAF_TRUE@am__append_14 = $(LIBDECAF_LIBS)
+@MALLOC_TRACE_TRUE@am__append_15 = \
 @MALLOC_TRACE_TRUE@	malloctrace.cc \
 @MALLOC_TRACE_TRUE@	malloctrace.hh
 
-@MALLOC_TRACE_TRUE@am__append_14 = -rdynamic
-@LUA_TRUE@am__append_15 = $(LUA_LIBS)
-@HAVE_FREEBSD_TRUE@am__append_16 = kqueuemplexer.cc
-@HAVE_LINUX_TRUE@am__append_17 = epollmplexer.cc
-@HAVE_SOLARIS_TRUE@am__append_18 = \
+@MALLOC_TRACE_TRUE@am__append_16 = -rdynamic
+@LUA_TRUE@am__append_17 = $(LUA_LIBS)
+@HAVE_FREEBSD_TRUE@am__append_18 = kqueuemplexer.cc
+@HAVE_LINUX_TRUE@am__append_19 = epollmplexer.cc
+@HAVE_SOLARIS_TRUE@am__append_20 = \
 @HAVE_SOLARIS_TRUE@	devpollmplexer.cc \
 @HAVE_SOLARIS_TRUE@	portsmplexer.cc
 
-@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_19 = dnsmessage.pb.cc
-@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_20 = $(PROTOBUF_LIBS)
-@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_21 = $(PROTOBUF_LIBS)
+@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_21 = dnsmessage.pb.cc
+@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_22 = $(PROTOBUF_LIBS)
+@HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@am__append_23 = $(PROTOBUF_LIBS)
 DIST_COMMON = $(srcdir)/lua_hpp.mk $(srcdir)/Makefile.in \
 	$(srcdir)/Makefile.am $(top_srcdir)/configure \
 	$(am__configure_deps) $(srcdir)/config.h.in \
@@ -212,10 +216,10 @@ am__pdns_recursor_SOURCES_DIST = arguments.cc ascii.hh base32.cc \
 	validate-recursor.cc validate-recursor.hh version.cc \
 	version.hh webserver.cc webserver.hh ws-api.cc ws-api.hh \
 	ws-recursor.cc ws-recursor.hh zoneparser-tng.cc \
-	zoneparser-tng.hh botan110signers.cc sodiumsigners.cc \
+	zoneparser-tng.hh botansigners.cc sodiumsigners.cc \
 	decafsigners.cc malloctrace.cc malloctrace.hh kqueuemplexer.cc \
 	epollmplexer.cc devpollmplexer.cc portsmplexer.cc
-@BOTAN110_TRUE@am__objects_1 = botan110signers.$(OBJEXT)
+@BOTAN_TRUE@am__objects_1 = botansigners.$(OBJEXT)
 @LIBSODIUM_TRUE@am__objects_2 = sodiumsigners.$(OBJEXT)
 @LIBDECAF_TRUE@am__objects_3 = decafsigners.$(OBJEXT)
 @MALLOC_TRACE_TRUE@am__objects_4 = malloctrace.$(OBJEXT)
@@ -255,7 +259,7 @@ am_pdns_recursor_OBJECTS = arguments.$(OBJEXT) base32.$(OBJEXT) \
 pdns_recursor_OBJECTS = $(am_pdns_recursor_OBJECTS) \
 	$(nodist_pdns_recursor_OBJECTS)
 am__DEPENDENCIES_1 =
-@BOTAN110_TRUE@am__DEPENDENCIES_2 = $(am__DEPENDENCIES_1)
+@BOTAN_TRUE@am__DEPENDENCIES_2 = $(am__DEPENDENCIES_1)
 @LIBSODIUM_TRUE@am__DEPENDENCIES_3 = $(am__DEPENDENCIES_1)
 @LIBDECAF_TRUE@am__DEPENDENCIES_4 = $(am__DEPENDENCIES_1)
 @LUA_TRUE@am__DEPENDENCIES_5 = $(am__DEPENDENCIES_1)
@@ -289,8 +293,8 @@ am__testrunner_SOURCES_DIST = arguments.cc base32.cc base64.cc \
 	ednsoptions.cc ednsoptions.hh ednssubnet.cc ednssubnet.hh \
 	filterpo.cc filterpo.hh gettime.cc gettime.hh gss_context.cc \
 	gss_context.hh iputils.cc iputils.hh ixfr.cc ixfr.hh logger.cc \
-	logger.hh misc.cc misc.hh negcache.hh negcache.cc \
-	namespaces.hh nsecrecords.cc pdnsexception.hh \
+	logger.hh misc.cc misc.hh mtasker_context.cc negcache.hh \
+	negcache.cc namespaces.hh nsecrecords.cc pdnsexception.hh \
 	opensslsigners.cc opensslsigners.hh protobuf.cc protobuf.hh \
 	qtype.cc qtype.hh randomhelper.cc rcpgenerator.cc \
 	rec-protobuf.cc rec-protobuf.hh recpacketcache.cc \
@@ -301,12 +305,13 @@ am__testrunner_SOURCES_DIST = arguments.cc base32.cc base64.cc \
 	test-dnsrecordcontent.cc test-dns_random_hh.cc \
 	test-dnsname_cc.cc test-dnsparser_hh.cc test-dnsrecords_cc.cc \
 	test-ednsoptions_cc.cc test-iputils_hh.cc test-ixfr_cc.cc \
-	test-misc_hh.cc test-nmtree.cc test-negcache_cc.cc \
-	test-rcpgenerator_cc.cc test-recpacketcache_cc.cc \
-	test-recursorcache_cc.cc test-syncres_cc.cc test-tsig.cc \
-	testrunner.cc tsigverifier.cc tsigverifier.hh unix_utility.cc \
-	validate.cc validate.hh validate-recursor.cc \
-	validate-recursor.hh zoneparser-tng.cc zoneparser-tng.hh \
+	test-misc_hh.cc test-mtasker.cc test-nmtree.cc \
+	test-negcache_cc.cc test-rcpgenerator_cc.cc \
+	test-recpacketcache_cc.cc test-recursorcache_cc.cc \
+	test-signers.cc test-syncres_cc.cc test-tsig.cc testrunner.cc \
+	tsigverifier.cc tsigverifier.hh unix_utility.cc validate.cc \
+	validate.hh validate-recursor.cc validate-recursor.hh \
+	zoneparser-tng.cc zoneparser-tng.hh botansigners.cc \
 	sodiumsigners.cc
 am_testrunner_OBJECTS = arguments.$(OBJEXT) base32.$(OBJEXT) \
 	base64.$(OBJEXT) dns.$(OBJEXT) dns_random.$(OBJEXT) \
@@ -315,32 +320,35 @@ am_testrunner_OBJECTS = arguments.$(OBJEXT) base32.$(OBJEXT) \
 	ednscookies.$(OBJEXT) ednsoptions.$(OBJEXT) \
 	ednssubnet.$(OBJEXT) filterpo.$(OBJEXT) gettime.$(OBJEXT) \
 	gss_context.$(OBJEXT) iputils.$(OBJEXT) ixfr.$(OBJEXT) \
-	logger.$(OBJEXT) misc.$(OBJEXT) negcache.$(OBJEXT) \
-	nsecrecords.$(OBJEXT) opensslsigners.$(OBJEXT) \
-	protobuf.$(OBJEXT) qtype.$(OBJEXT) randomhelper.$(OBJEXT) \
-	rcpgenerator.$(OBJEXT) rec-protobuf.$(OBJEXT) \
-	recpacketcache.$(OBJEXT) recursor_cache.$(OBJEXT) \
-	responsestats.$(OBJEXT) sillyrecords.$(OBJEXT) \
-	syncres.$(OBJEXT) test-arguments_cc.$(OBJEXT) \
-	test-base32_cc.$(OBJEXT) test-base64_cc.$(OBJEXT) \
-	test-dnsrecordcontent.$(OBJEXT) test-dns_random_hh.$(OBJEXT) \
-	test-dnsname_cc.$(OBJEXT) test-dnsparser_hh.$(OBJEXT) \
-	test-dnsrecords_cc.$(OBJEXT) test-ednsoptions_cc.$(OBJEXT) \
-	test-iputils_hh.$(OBJEXT) test-ixfr_cc.$(OBJEXT) \
-	test-misc_hh.$(OBJEXT) test-nmtree.$(OBJEXT) \
+	logger.$(OBJEXT) misc.$(OBJEXT) mtasker_context.$(OBJEXT) \
+	negcache.$(OBJEXT) nsecrecords.$(OBJEXT) \
+	opensslsigners.$(OBJEXT) protobuf.$(OBJEXT) qtype.$(OBJEXT) \
+	randomhelper.$(OBJEXT) rcpgenerator.$(OBJEXT) \
+	rec-protobuf.$(OBJEXT) recpacketcache.$(OBJEXT) \
+	recursor_cache.$(OBJEXT) responsestats.$(OBJEXT) \
+	sillyrecords.$(OBJEXT) syncres.$(OBJEXT) \
+	test-arguments_cc.$(OBJEXT) test-base32_cc.$(OBJEXT) \
+	test-base64_cc.$(OBJEXT) test-dnsrecordcontent.$(OBJEXT) \
+	test-dns_random_hh.$(OBJEXT) test-dnsname_cc.$(OBJEXT) \
+	test-dnsparser_hh.$(OBJEXT) test-dnsrecords_cc.$(OBJEXT) \
+	test-ednsoptions_cc.$(OBJEXT) test-iputils_hh.$(OBJEXT) \
+	test-ixfr_cc.$(OBJEXT) test-misc_hh.$(OBJEXT) \
+	test-mtasker.$(OBJEXT) test-nmtree.$(OBJEXT) \
 	test-negcache_cc.$(OBJEXT) test-rcpgenerator_cc.$(OBJEXT) \
 	test-recpacketcache_cc.$(OBJEXT) \
-	test-recursorcache_cc.$(OBJEXT) test-syncres_cc.$(OBJEXT) \
-	test-tsig.$(OBJEXT) testrunner.$(OBJEXT) \
-	tsigverifier.$(OBJEXT) unix_utility.$(OBJEXT) \
-	validate.$(OBJEXT) validate-recursor.$(OBJEXT) \
-	zoneparser-tng.$(OBJEXT) $(am__objects_2)
+	test-recursorcache_cc.$(OBJEXT) test-signers.$(OBJEXT) \
+	test-syncres_cc.$(OBJEXT) test-tsig.$(OBJEXT) \
+	testrunner.$(OBJEXT) tsigverifier.$(OBJEXT) \
+	unix_utility.$(OBJEXT) validate.$(OBJEXT) \
+	validate-recursor.$(OBJEXT) zoneparser-tng.$(OBJEXT) \
+	$(am__objects_1) $(am__objects_2)
 @HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@nodist_testrunner_OBJECTS =  \
 @HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@	dnsmessage.pb.$(OBJEXT)
 testrunner_OBJECTS = $(am_testrunner_OBJECTS) \
 	$(nodist_testrunner_OBJECTS)
 testrunner_DEPENDENCIES = $(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1) \
-	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_3) \
+	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_2) $(am__DEPENDENCIES_3) \
 	$(am__DEPENDENCIES_6)
 testrunner_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CXX $(AM_LIBTOOLFLAGS) \
 	$(LIBTOOLFLAGS) --mode=link $(CXXLD) $(AM_CXXFLAGS) \
@@ -698,9 +706,10 @@ distcleancheck_listfiles = find . -type f -print
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_CPPFLAGS = $(LUA_CFLAGS) $(YAHTTP_CFLAGS) $(BOOST_CPPFLAGS) \
-	$(BOTAN110_CFLAGS) $(NET_SNMP_CFLAGS) $(SANITIZER_FLAGS) -O3 \
-	-Wall -pthread -DSYSCONFDIR=\"${sysconfdir}\" \
-	$(SYSTEMD_CFLAGS) -I$(top_srcdir)/ext/json11 \
+	$(BOTAN_CFLAGS) $(LIBSODIUM_CFLAGS) $(NET_SNMP_CFLAGS) \
+	$(SANITIZER_FLAGS) -O3 -Wall -pthread \
+	-DSYSCONFDIR=\"${sysconfdir}\" $(SYSTEMD_CFLAGS) \
+	-I$(top_srcdir)/ext/json11 \
 	-I$(top_srcdir)/ext/rapidjson/include $(YAHTTP_CFLAGS) \
 	$(LIBCRYPTO_INCLUDES) $(am__append_1)
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
@@ -724,8 +733,8 @@ BOOST_THREAD_LIBS = @BOOST_THREAD_LIBS@
 BOOST_UNIT_TEST_FRAMEWORK_LDFLAGS = @BOOST_UNIT_TEST_FRAMEWORK_LDFLAGS@
 BOOST_UNIT_TEST_FRAMEWORK_LDPATH = @BOOST_UNIT_TEST_FRAMEWORK_LDPATH@
 BOOST_UNIT_TEST_FRAMEWORK_LIBS = @BOOST_UNIT_TEST_FRAMEWORK_LIBS@
-BOTAN110_CFLAGS = @BOTAN110_CFLAGS@
-BOTAN110_LIBS = @BOTAN110_LIBS@
+BOTAN_CFLAGS = @BOTAN_CFLAGS@
+BOTAN_LIBS = @BOTAN_LIBS@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
@@ -887,14 +896,14 @@ AM_LDFLAGS = \
 
 ACLOCAL_AMFLAGS = -I m4
 BUILT_SOURCES = htmlfiles.h dnslabeltext.cc $(am__append_3) \
-	$(am__append_19)
+	$(am__append_21)
 CLEANFILES = htmlfiles.h dnsmessage.pb.cc dnsmessage.pb.h \
 	$(am__append_4)
 SUBDIRS = ext
 EXTRA_DIST = \
 	NOTICE \
 	.version \
-	botan110signers.cc \
+	botansigners.cc \
 	build-aux/gen-version \
 	contrib/* \
 	devpollmplexer.cc \
@@ -950,17 +959,17 @@ pdns_recursor_SOURCES = arguments.cc ascii.hh base32.cc base32.hh \
 	validate-recursor.cc validate-recursor.hh version.cc \
 	version.hh webserver.cc webserver.hh ws-api.cc ws-api.hh \
 	ws-recursor.cc ws-recursor.hh zoneparser-tng.cc \
-	zoneparser-tng.hh $(am__append_5) $(am__append_7) \
-	$(am__append_11) $(am__append_13) $(am__append_16) \
-	$(am__append_17) $(am__append_18)
+	zoneparser-tng.hh $(am__append_5) $(am__append_9) \
+	$(am__append_13) $(am__append_15) $(am__append_18) \
+	$(am__append_19) $(am__append_20)
 @HAVE_LUA_HPP_FALSE@nodist_pdns_recursor_SOURCES = lua.hpp
 @HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@nodist_pdns_recursor_SOURCES = dnsmessage.pb.cc dnsmessage.pb.h
 pdns_recursor_LDADD = $(YAHTTP_LIBS) $(JSON11_LIBS) $(LIBCRYPTO_LIBS) \
 	$(BOOST_CONTEXT_LIBS) $(NET_SNMP_LIBS) $(SYSTEMD_LIBS) \
-	$(RT_LIBS) $(am__append_6) $(am__append_8) $(am__append_12) \
-	$(am__append_15) $(am__append_20)
+	$(RT_LIBS) $(am__append_6) $(am__append_10) $(am__append_14) \
+	$(am__append_17) $(am__append_22)
 pdns_recursor_LDFLAGS = $(AM_LDFLAGS) $(LIBCRYPTO_LDFLAGS) \
-	$(BOOST_CONTEXT_LDFLAGS) $(am__append_14)
+	$(BOOST_CONTEXT_LDFLAGS) $(am__append_16)
 testrunner_SOURCES = arguments.cc base32.cc base64.cc base64.hh dns.cc \
 	dns.hh dns_random.cc dns_random.hh dnslabeltext.cc dnsname.cc \
 	dnsname.hh dnsparser.hh dnsparser.cc dnsrecords.cc \
@@ -969,31 +978,34 @@ testrunner_SOURCES = arguments.cc base32.cc base64.cc base64.hh dns.cc \
 	ednssubnet.cc ednssubnet.hh filterpo.cc filterpo.hh gettime.cc \
 	gettime.hh gss_context.cc gss_context.hh iputils.cc iputils.hh \
 	ixfr.cc ixfr.hh logger.cc logger.hh misc.cc misc.hh \
-	negcache.hh negcache.cc namespaces.hh nsecrecords.cc \
-	pdnsexception.hh opensslsigners.cc opensslsigners.hh \
-	protobuf.cc protobuf.hh qtype.cc qtype.hh randomhelper.cc \
-	rcpgenerator.cc rec-protobuf.cc rec-protobuf.hh \
-	recpacketcache.cc recpacketcache.hh recursor_cache.cc \
-	recursor_cache.hh responsestats.cc root-dnssec.hh \
-	sillyrecords.cc sholder.hh sstuff.hh syncres.cc syncres.hh \
-	test-arguments_cc.cc test-base32_cc.cc test-base64_cc.cc \
-	test-common.hh test-dnsrecordcontent.cc test-dns_random_hh.cc \
-	test-dnsname_cc.cc test-dnsparser_hh.cc test-dnsrecords_cc.cc \
-	test-ednsoptions_cc.cc test-iputils_hh.cc test-ixfr_cc.cc \
-	test-misc_hh.cc test-nmtree.cc test-negcache_cc.cc \
+	mtasker_context.cc negcache.hh negcache.cc namespaces.hh \
+	nsecrecords.cc pdnsexception.hh opensslsigners.cc \
+	opensslsigners.hh protobuf.cc protobuf.hh qtype.cc qtype.hh \
+	randomhelper.cc rcpgenerator.cc rec-protobuf.cc \
+	rec-protobuf.hh recpacketcache.cc recpacketcache.hh \
+	recursor_cache.cc recursor_cache.hh responsestats.cc \
+	root-dnssec.hh sillyrecords.cc sholder.hh sstuff.hh syncres.cc \
+	syncres.hh test-arguments_cc.cc test-base32_cc.cc \
+	test-base64_cc.cc test-common.hh test-dnsrecordcontent.cc \
+	test-dns_random_hh.cc test-dnsname_cc.cc test-dnsparser_hh.cc \
+	test-dnsrecords_cc.cc test-ednsoptions_cc.cc \
+	test-iputils_hh.cc test-ixfr_cc.cc test-misc_hh.cc \
+	test-mtasker.cc test-nmtree.cc test-negcache_cc.cc \
 	test-rcpgenerator_cc.cc test-recpacketcache_cc.cc \
-	test-recursorcache_cc.cc test-syncres_cc.cc test-tsig.cc \
-	testrunner.cc tsigverifier.cc tsigverifier.hh unix_utility.cc \
-	validate.cc validate.hh validate-recursor.cc \
+	test-recursorcache_cc.cc test-signers.cc test-syncres_cc.cc \
+	test-tsig.cc testrunner.cc tsigverifier.cc tsigverifier.hh \
+	unix_utility.cc validate.cc validate.hh validate-recursor.cc \
 	validate-recursor.hh zoneparser-tng.cc zoneparser-tng.hh \
-	$(am__append_9)
+	$(am__append_7) $(am__append_11)
 testrunner_LDFLAGS = \
 	$(AM_LDFLAGS) \
+	$(BOOST_CONTEXT_LDFLAGS) \
 	$(BOOST_UNIT_TEST_FRAMEWORK_LDFLAGS) \
 	$(LIBCRYPTO_LDFLAGS)
 
-testrunner_LDADD = $(BOOST_UNIT_TEST_FRAMEWORK_LIBS) $(LIBCRYPTO_LIBS) \
-	$(RT_LIBS) $(am__append_10) $(am__append_21)
+testrunner_LDADD = $(BOOST_CONTEXT_LIBS) \
+	$(BOOST_UNIT_TEST_FRAMEWORK_LIBS) $(LIBCRYPTO_LIBS) $(RT_LIBS) \
+	$(am__append_8) $(am__append_12) $(am__append_23)
 @HAVE_PROTOBUF_TRUE@@HAVE_PROTOC_TRUE@nodist_testrunner_SOURCES = dnsmessage.pb.cc dnsmessage.pb.h
 rec_control_SOURCES = \
 	arguments.cc arguments.hh \
@@ -1203,7 +1215,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/arguments.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/base32.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/base64.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/botan110signers.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/botansigners.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decafsigners.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/devpollmplexer.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dns.Po@am__quote@
@@ -1275,11 +1287,13 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-iputils_hh.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-ixfr_cc.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-misc_hh.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-mtasker.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-negcache_cc.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-nmtree.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-rcpgenerator_cc.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-recpacketcache_cc.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-recursorcache_cc.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-signers.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-syncres_cc.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test-tsig.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/testrunner.Po@am__quote@

README

@@ -43,11 +43,14 @@ To compile from a git checkout, install pandoc, ragel, automake and autoconf.
 Then run
 
 ```
+$ cd pdns/pdns/recursordist/
 $ ./bootstrap
 $ ./configure
 $ make
 ```
 
+On macOS, you may need to `brew install openssl` and set `PKG_CONFIG_PATH=/usr/local/opt/openssl/lib/pkgconfig` during configure.
+
 Lua scripting
 -------------
 To benefit from Lua scripting, as described on https://doc.powerdns.com/md/recursor/scripting/

aclocal.m4

@@ -323,43 +323,6 @@ AC_DEFUN([AM_AUX_DIR_EXPAND],
 am_aux_dir=`cd "$ac_aux_dir" && pwd`
 ])
 
-# AM_COND_IF                                            -*- Autoconf -*-
-
-# Copyright (C) 2008-2013 Free Software Foundation, Inc.
-#
-# This file is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# _AM_COND_IF
-# _AM_COND_ELSE
-# _AM_COND_ENDIF
-# --------------
-# These macros are only used for tracing.
-m4_define([_AM_COND_IF])
-m4_define([_AM_COND_ELSE])
-m4_define([_AM_COND_ENDIF])
-
-# AM_COND_IF(COND, [IF-TRUE], [IF-FALSE])
-# ---------------------------------------
-# If the shell condition COND is true, execute IF-TRUE, otherwise execute
-# IF-FALSE.  Allow automake to learn about conditional instantiating macros
-# (the AC_CONFIG_FOOS).
-AC_DEFUN([AM_COND_IF],
-[m4_ifndef([_AM_COND_VALUE_$1],
-	   [m4_fatal([$0: no such condition "$1"])])dnl
-_AM_COND_IF([$1])dnl
-if test -z "$$1_TRUE"; then :
-  m4_n([$2])[]dnl
-m4_ifval([$3],
-[_AM_COND_ELSE([$1])dnl
-else
-  $3
-])dnl
-_AM_COND_ENDIF([$1])dnl
-fi[]dnl
-])
-
 # AM_CONDITIONAL                                            -*- Autoconf -*-
 
 # Copyright (C) 1997-2013 Free Software Foundation, Inc.

arguments.cc

@@ -120,7 +120,7 @@ string ArgvMap::helpstring(string prefix)
       i!=helpmap.end();
       i++)
     {
-      if(!prefix.empty() && i->first.find(prefix)) // only print items with prefix
+      if(!prefix.empty() && i->first.find(prefix) != 0) // only print items with prefix
         continue;
 
       help+="  --";
@@ -304,18 +304,18 @@ void ArgvMap::parseOne(const string &arg, const string &parseOnly, bool lax)
   string::size_type pos;
   bool incremental = false;
 
-  if(!arg.find("--") && (pos=arg.find("+="))!=string::npos) // this is a --port+=25 case
+  if(arg.find("--") == 0 && (pos=arg.find("+="))!=string::npos) // this is a --port+=25 case
   {
     var=arg.substr(2,pos-2);
     val=arg.substr(pos+2);
     incremental = true;
   }
-  else if(!arg.find("--") && (pos=arg.find("="))!=string::npos)  // this is a --port=25 case
+  else if(arg.find("--") == 0 && (pos=arg.find("="))!=string::npos)  // this is a --port=25 case
   {
     var=arg.substr(2,pos-2);
     val=arg.substr(pos+1);
   }
-  else if(!arg.find("--") && (arg.find("=")==string::npos))  // this is a --daemon case
+  else if(arg.find("--") == 0 && (arg.find("=")==string::npos))  // this is a --daemon case
   {
     var=arg.substr(2);
     val="";
@@ -376,7 +376,7 @@ void ArgvMap::preParse(int &argc, char **argv, const string &arg)
 {
   for(int n=1;n<argc;n++) {
     string varval=argv[n];
-    if(!varval.find("--"+arg))
+    if(varval.find("--"+arg) == 0)
       parseOne(argv[n]);
   }
 }

botan110signers.cc → botansigners.cc

@@ -22,9 +22,10 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
-#include <botan/botan.h>
+#include <botan/auto_rng.h>
 #include <botan/gost_3410.h>
 #include <botan/gost_3411.h>
+#include <botan/pubkey.h>
 #include "dnssecinfra.hh"
 
 using namespace Botan;
@@ -43,15 +44,14 @@ class GOSTDNSCryptoKeyEngine : public DNSCryptoKeyEngine
 {
 public:
   explicit GOSTDNSCryptoKeyEngine(unsigned int algorithm) : DNSCryptoKeyEngine(algorithm) {}
-  // XXX FIXME NEEDS COPY CONSTRUCTOR SO WE DON'T SHARE KEYS
   ~GOSTDNSCryptoKeyEngine(){}
   void create(unsigned int bits) override;
-  string getName() const override { return "Botan 1.10 GOST"; }
+  string getName() const override { return "Botan 2 GOST"; }
   storvector_t convertToISCVector() const override;
   std::string getPubKeyHash() const override;
-  std::string sign(const std::string& hash) const override;
-  std::string hash(const std::string& hash) const override;
-  bool verify(const std::string& hash, const std::string& signature) const override;
+  std::string sign(const std::string& msg) const override;
+  std::string hash(const std::string& msg) const override;
+  bool verify(const std::string& msg, const std::string& signature) const override;
   std::string getPublicKeyString() const override;
   int getBits() const override;
   void fromISCMap(DNSKEYRecordContent& drc, std::map<std::string, std::string>& content) override;
@@ -65,6 +65,11 @@ public:
   }
 
 private:
+  static EC_Group getParams()
+  {
+    return EC_Group("gost_256A");
+  }
+
   shared_ptr<GOST_3410_PrivateKey> d_key;
   shared_ptr<GOST_3410_PublicKey> d_pubkey;
 };
@@ -80,8 +85,7 @@ private:
 void GOSTDNSCryptoKeyEngine::create(unsigned int bits)
 {
   AutoSeeded_RNG rng;
-  EC_Domain_Params params("1.2.643.2.2.35.1");
-  d_key = shared_ptr<GOST_3410_PrivateKey>(new GOST_3410_PrivateKey(rng, params));
+  d_key = std::make_shared<GOST_3410_PrivateKey>(rng, getParams());
 }
 
 int GOSTDNSCryptoKeyEngine::getBits() const
@@ -98,17 +102,17 @@ int GOSTDNSCryptoKeyEngine::getBits() const
 
 DNSCryptoKeyEngine::storvector_t GOSTDNSCryptoKeyEngine::convertToISCVector() const
 { 
-  storvector_t storvect;
-  storvect.push_back(make_pair("Algorithm", "12 (ECC-GOST)"));
-  
-  unsigned char asn1Prefix[]=
+  static const unsigned char asn1Prefix[]=
   {0x30, 0x45, 0x02, 0x01, 0x00, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 
    0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 
    0x2a, 0x85, 0x03, 0x02, 0x02, 0x1e, 0x01, 0x04, 0x22, 0x04, 0x20}; // this is DER, fixed for a 32 byte key
 
-  SecureVector<byte> buffer=BigInt::encode(d_key->private_value());
-  string gostasn1((const char*)asn1Prefix, sizeof(asn1Prefix));
-  gostasn1.append((const char*)&*buffer.begin(), (const char*)&*buffer.end());
+  storvector_t storvect;
+  storvect.push_back(make_pair("Algorithm", "12 (ECC-GOST)"));
+
+  auto buffer = BigInt::encode(d_key->private_value());
+  string gostasn1(reinterpret_cast<const char*>(asn1Prefix), sizeof(asn1Prefix));
+  gostasn1.append(buffer.begin(), buffer.end());
   storvect.push_back(make_pair("GostAsn1", gostasn1));
   return storvect;
 }
@@ -135,22 +139,21 @@ void GOSTDNSCryptoKeyEngine::fromISCMap(DNSKEYRecordContent& drc, std::map<std::
   
   BigInt bigint((byte*)rawKey.c_str(), rawKey.size());
  
-  EC_Group params("1.2.643.2.2.35.1");
   AutoSeeded_RNG rng;
-  d_key=shared_ptr<GOST_3410_PrivateKey>(new GOST_3410_PrivateKey(rng, params, bigint));
+  d_key=std::make_shared<GOST_3410_PrivateKey>(rng, getParams(), bigint);
   
   //cerr<<"Is the just imported key on the curve? " << d_key->public_point().on_the_curve()<<endl;
   //cerr<<"Is the just imported key zero? " << d_key->public_point().is_zero()<<endl;
   
   const BigInt&x = d_key->private_value();
-  SecureVector<byte> buffer=BigInt::encode(x);
+  auto buffer = BigInt::encode(x);
  // cerr<<"And out again! "<<makeHexDump(string((const char*)buffer.begin(), (const char*)buffer.end()))<<endl;
 }
 namespace {
 
 BigInt decode_le(const byte msg[], size_t msg_len)
    {
-   SecureVector<byte> msg_le(msg, msg_len);
+   Botan::secure_vector<byte> msg_le(msg, msg + msg_len);
 
    for(size_t i = 0; i != msg_le.size() / 2; ++i)
       std::swap(msg_le[i], msg_le[msg_le.size()-1-i]);
@@ -166,28 +169,29 @@ void GOSTDNSCryptoKeyEngine::fromPublicKeyString(const std::string& input)
   x=decode_le((const byte*)input.c_str(), input.length()/2);
   y=decode_le((const byte*)input.c_str() + input.length()/2, input.length()/2);
 
-  EC_Domain_Params params("1.2.643.2.2.35.1");
+  auto params = getParams();
   PointGFp point(params.get_curve(), x,y);
-  d_pubkey = shared_ptr<GOST_3410_PublicKey>(new GOST_3410_PublicKey(params, point));
+  d_pubkey = std::make_shared<GOST_3410_PublicKey>(params, point);
   d_key.reset();
 }
 
 std::string GOSTDNSCryptoKeyEngine::getPubKeyHash() const
 {
   const BigInt&x = d_key->private_value();
-  SecureVector<byte> buffer=BigInt::encode(x);
-  return string((const char*)buffer.begin(), (const char*)buffer.end());
+  auto buffer = BigInt::encode(x);
+  return string(buffer.begin(), buffer.end());
 }
 
 std::string GOSTDNSCryptoKeyEngine::getPublicKeyString() const
 {
-  const BigInt&x =d_key->public_point().get_affine_x();
-  const BigInt&y =d_key->public_point().get_affine_y();
+  std::shared_ptr<GOST_3410_PublicKey> pk = d_pubkey ? d_pubkey : d_key;
+  const BigInt&x =pk->public_point().get_affine_x();
+  const BigInt&y =pk->public_point().get_affine_y();
   
   size_t part_size = std::max(x.bytes(), y.bytes());
  
-  MemoryVector<byte> bits(2*part_size);
- 
+  std::vector<byte> bits(2*part_size);
+
   x.binary_encode(&bits[part_size - x.bytes()]);
   y.binary_encode(&bits[2*part_size - y.bytes()]);
 
@@ -198,7 +202,7 @@ std::string GOSTDNSCryptoKeyEngine::getPublicKeyString() const
     std::swap(bits[part_size+i], bits[2*part_size-1-i]);
   }
  
-  return string((const char*)bits.begin(), (const char*)bits.end());
+  return string(bits.begin(), bits.end());
 }
 
 /*
@@ -210,50 +214,27 @@ std::string GOSTDNSCryptoKeyEngine::getPublicKeyString() const
 
 std::string GOSTDNSCryptoKeyEngine::sign(const std::string& msg) const
 {
-  GOST_3410_Signature_Operation ops(*d_key);
   AutoSeeded_RNG rng;
-  
-  string hash= this->hash(msg);
-  
-  SecureVector<byte> signature=ops.sign((byte*)hash.c_str(), hash.length(), rng);
-
-#if BOTAN_VERSION_CODE <= BOTAN_VERSION_CODE_FOR(1,9,12)  // see http://bit.ly/gTytUf
-  string reversed((const char*)signature.begin()+ signature.size()/2, signature.size()/2);
-  reversed.append((const char*)signature.begin(), signature.size()/2);
-  return reversed;
-#else  
-  return string((const char*)signature.begin(), (const char*) signature.end());
-#endif
+  PK_Signer signer(*d_key, rng, "Raw");
+  signer.update(hash(msg));
+  auto signature = signer.signature(rng);
+  return string(signature.begin(), signature.end());
 }
 
 std::string GOSTDNSCryptoKeyEngine::hash(const std::string& orig) const
 {
-  SecureVector<byte> result;
-  
   GOST_34_11 hasher;
-  result= hasher.process(orig);
-  return string((const char*)result.begin(), (const char*) result.end());
+  auto result = hasher.process(orig);
+  return string(result.begin(), result.end());
 }
 
 
 bool GOSTDNSCryptoKeyEngine::verify(const std::string& message, const std::string& signature) const
 {
-  string hash = this->hash(message);
-  GOST_3410_PublicKey* pk;
-  if(d_pubkey) {
-    pk =d_pubkey.get();
-  }
-  else
-    pk = d_key.get();
-    
-  GOST_3410_Verification_Operation ops(*pk);
-#if BOTAN_VERSION_CODE <= BOTAN_VERSION_CODE_FOR(1,9,12)  // see http://bit.ly/gTytUf
-  string rsignature(signature.substr(32));
-  rsignature.append(signature.substr(0,32));
-  return ops.verify ((byte*)hash.c_str(), hash.length(), (byte*)rsignature.c_str(), rsignature.length());
-#else
-  return ops.verify ((byte*)hash.c_str(), hash.length(), (byte*)signature.c_str(), signature.length());
-#endif
+  std::shared_ptr<GOST_3410_PublicKey> pk = d_pubkey ? d_pubkey : d_key;
+  PK_Verifier verifier(*pk, "Raw");
+  verifier.update(hash(message));
+  return verifier.check_signature(reinterpret_cast<const uint8_t*>(signature.c_str()), signature.size());
 }
 
 /*
@@ -271,11 +252,7 @@ struct LoaderStruct
 {
   LoaderStruct()
   {
-    new Botan::LibraryInitializer("thread_safe=true");
-    // this leaks, but is fine
-    Botan::global_state().set_default_allocator("malloc"); // the other Botan allocator slows down for us
-
     DNSCryptoKeyEngine::report(12, &GOSTDNSCryptoKeyEngine::maker);
   }
-} loaderBotan110;
+} loaderBotan2;
 }

config.h.in

@@ -3,6 +3,9 @@
 /* Set to the user and host that builds PowerDNS */
 #undef BUILD_HOST
 
+/* Define to 1 if you have the `accept4' function. */
+#undef HAVE_ACCEPT4
+
 /* Defined if the requested minimum BOOST version is satisfied */
 #undef HAVE_BOOST
 
@@ -33,8 +36,8 @@
 /* Defined if the Boost unit_test_framework library is available */
 #undef HAVE_BOOST_UNIT_TEST_FRAMEWORK
 
-/* Define to 1 if you have botan 1.10 */
-#undef HAVE_BOTAN110
+/* Define to 1 if you have botan */
+#undef HAVE_BOTAN
 
 /* Define to 1 if you have clock_gettime */
 #undef HAVE_CLOCK_GETTIME
@@ -53,6 +56,10 @@
    if you don't. */
 #undef HAVE_DECL_NID_X9_62_PRIME256V1
 
+/* Define to 1 if you have the declaration of `snmp_select_info2', and to 0 if
+   you don't. */
+#undef HAVE_DECL_SNMP_SELECT_INFO2
+
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
@@ -86,6 +93,9 @@
 /* Define to 1 if you have pthread_setaffinity_np */
 #undef HAVE_PTHREAD_SETAFFINITY_NP
 
+/* Define to 1 if you have the `recvmmsg' function. */
+#undef HAVE_RECVMMSG
+
 /* Define to 1 if you have the <sanitizer/common_interface_defs.h> header
    file. */
 #undef HAVE_SANITIZER_COMMON_INTERFACE_DEFS_H
@@ -96,6 +106,9 @@
 /* Define to 1 if __sanitizer_finish_switch_fiber takes three pointers */
 #undef HAVE_SANITIZER_FINISH_SWITCH_FIBER_THREE_PTRS
 
+/* Define to 1 if you have the `sendmmsg' function. */
+#undef HAVE_SENDMMSG
+
 /* Define to 1 if you have the <stdint.h> header file. */
 #undef HAVE_STDINT_H
 

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for pdns-recursor 4.1.0-alpha1.
+# Generated by GNU Autoconf 2.69 for pdns-recursor 4.1.0-rc3.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@@ -587,8 +587,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='pdns-recursor'
 PACKAGE_TARNAME='pdns-recursor'
-PACKAGE_VERSION='4.1.0-alpha1'
-PACKAGE_STRING='pdns-recursor 4.1.0-alpha1'
+PACKAGE_VERSION='4.1.0-rc3'
+PACKAGE_STRING='pdns-recursor 4.1.0-rc3'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -668,17 +668,17 @@ NET_SNMP_CFLAGS
 LIBDECAF_LIBS
 LIBDECAF_FALSE
 LIBDECAF_TRUE
-LIBSODIUM_LIBS
-LIBSODIUM_CFLAGS
 LIBSODIUM_FALSE
 LIBSODIUM_TRUE
+LIBSODIUM_LIBS
+LIBSODIUM_CFLAGS
 LIBCRYPTO_LDFLAGS
 LIBCRYPTO_LIBS
 LIBCRYPTO_INCLUDES
-BOTAN110_LIBS
-BOTAN110_CFLAGS
-BOTAN110_FALSE
-BOTAN110_TRUE
+BOTAN_LIBS
+BOTAN_CFLAGS
+BOTAN_FALSE
+BOTAN_TRUE
 HAVE_LUA_HPP_FALSE
 HAVE_LUA_HPP_TRUE
 LUA_FALSE
@@ -865,7 +865,7 @@ enable_reproducible
 with_luajit
 with_lua
 enable_verbose_logging
-enable_botan1_10
+enable_botan
 with_libcrypto
 enable_libsodium
 enable_libdecaf
@@ -902,8 +902,8 @@ PROTOBUF_LIBS
 BOOST_ROOT
 LUA_CFLAGS
 LUA_LIBS
-BOTAN110_CFLAGS
-BOTAN110_LIBS
+BOTAN_CFLAGS
+BOTAN_LIBS
 LIBSODIUM_CFLAGS
 LIBSODIUM_LIBS
 SYSTEMD_CFLAGS
@@ -1448,7 +1448,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures pdns-recursor 4.1.0-alpha1 to adapt to many kinds of systems.
+\`configure' configures pdns-recursor 4.1.0-rc3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1518,7 +1518,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of pdns-recursor 4.1.0-alpha1:";;
+     short | recursive ) echo "Configuration of pdns-recursor 4.1.0-rc3:";;
    esac
   cat <<\_ACEOF
 
@@ -1549,8 +1549,8 @@ Optional Features:
                           [default=no]
   --enable-verbose-logging
                           enable verbose logging [default=no]
-  --enable-botan1.10      use Botan 1.10 [default=no]
-  --enable-libsodium      use libsodium [default=no]
+  --enable-botan          use Botan [default=no]
+  --enable-libsodium      use libsodium [default=auto]
   --enable-libdecaf       use libdecaf [default=no]
   --disable-hardening     disable compiler security checks [default=no]
   --enable-asan           enable AddressSanitizer [default=no]
@@ -1560,7 +1560,8 @@ Optional Features:
   --enable-ubsan          enable Undefined Behaviour Sanitizer [default=no]
   --enable-malloc-trace   enable malloc-trace [default=no]
   --enable-valgrind       enable Valgrind support [default=no]
-  --enable-systemd        Enable systemd support (default is DISABLED)
+  --enable-systemd        Enable systemd support (default is DISABLED, but
+                          will be enabled when libraries are found)
 
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
@@ -1603,10 +1604,9 @@ Some influential environment variables:
   BOOST_ROOT  Location of Boost installation
   LUA_CFLAGS  C compiler flags for LUA, overriding pkg-config
   LUA_LIBS    linker flags for LUA, overriding pkg-config
-  BOTAN110_CFLAGS
-              C compiler flags for BOTAN110, overriding pkg-config
-  BOTAN110_LIBS
-              linker flags for BOTAN110, overriding pkg-config
+  BOTAN_CFLAGS
+              C compiler flags for BOTAN, overriding pkg-config
+  BOTAN_LIBS  linker flags for BOTAN, overriding pkg-config
   LIBSODIUM_CFLAGS
               C compiler flags for LIBSODIUM, overriding pkg-config
   LIBSODIUM_LIBS
@@ -1682,7 +1682,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-pdns-recursor configure 4.1.0-alpha1
+pdns-recursor configure 4.1.0-rc3
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2159,52 +2159,6 @@ fi
 
 } # ac_fn_cxx_try_link
 
-# ac_fn_cxx_check_decl LINENO SYMBOL VAR INCLUDES
-# -----------------------------------------------
-# Tests whether SYMBOL is declared in INCLUDES, setting cache variable VAR
-# accordingly.
-ac_fn_cxx_check_decl ()
-{
-  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  as_decl_name=`echo $2|sed 's/ *(.*//'`
-  as_decl_use=`echo $2|sed -e 's/(/((/' -e 's/)/) 0&/' -e 's/,/) 0& (/g'`
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $as_decl_name is declared" >&5
-$as_echo_n "checking whether $as_decl_name is declared... " >&6; }
-if eval \${$3+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-$4
-int
-main ()
-{
-#ifndef $as_decl_name
-#ifdef __cplusplus
-  (void) $as_decl_use;
-#else
-  (void) $as_decl_name;
-#endif
-#endif
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_cxx_try_compile "$LINENO"; then :
-  eval "$3=yes"
-else
-  eval "$3=no"
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-eval ac_res=\$$3
-	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-
-} # ac_fn_cxx_check_decl
-
 # ac_fn_cxx_check_func LINENO FUNC VAR
 # ------------------------------------
 # Tests whether FUNC exists, setting the cache variable VAR accordingly
@@ -2271,11 +2225,57 @@ $as_echo "$ac_res" >&6; }
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_cxx_check_func
+
+# ac_fn_cxx_check_decl LINENO SYMBOL VAR INCLUDES
+# -----------------------------------------------
+# Tests whether SYMBOL is declared in INCLUDES, setting cache variable VAR
+# accordingly.
+ac_fn_cxx_check_decl ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  as_decl_name=`echo $2|sed 's/ *(.*//'`
+  as_decl_use=`echo $2|sed -e 's/(/((/' -e 's/)/) 0&/' -e 's/,/) 0& (/g'`
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $as_decl_name is declared" >&5
+$as_echo_n "checking whether $as_decl_name is declared... " >&6; }
+if eval \${$3+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+$4
+int
+main ()
+{
+#ifndef $as_decl_name
+#ifdef __cplusplus
+  (void) $as_decl_use;
+#else
+  (void) $as_decl_name;
+#endif
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_cxx_try_compile "$LINENO"; then :
+  eval "$3=yes"
+else
+  eval "$3=no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+eval ac_res=\$$3
+	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+$as_echo "$ac_res" >&6; }
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+
+} # ac_fn_cxx_check_decl
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by pdns-recursor $as_me 4.1.0-alpha1, which was
+It was created by pdns-recursor $as_me 4.1.0-rc3, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3138,7 +3138,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='pdns-recursor'
- VERSION='4.1.0-alpha1'
+ VERSION='4.1.0-rc3'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -15907,7 +15907,7 @@ $as_echo "#define NEED_INET_NTOP_PROTO /**/" >>confdefs.h
     have_linux="yes"
     ;;
   darwin*)
-    CXXFLAGS="-D__APPLE_USE_RFC_3542 -D_XOPEN_SOURCE $CXXFLAGS"
+    CXXFLAGS="-D__APPLE_USE_RFC_3542 -D_XOPEN_SOURCE -D_DARWIN_C_SOURCE $CXXFLAGS"
     ;;
   freebsd*)
     THREADFLAGS="-pthread"
@@ -15945,7 +15945,7 @@ fi
 
 
   case "$host" in
-  mips* | powerpc* )
+  mips* | powerpc-* )
     { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -latomic" >&5
 $as_echo_n "checking whether the linker accepts -latomic... " >&6; }
     LDFLAGS="-latomic $LDFLAGS"
@@ -16201,6 +16201,18 @@ if test "$ac_res" != no; then :
 
 fi
 
+  for ac_func in recvmmsg sendmmsg accept4
+do :
+  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
+ac_fn_cxx_check_func "$LINENO" "$ac_func" "$as_ac_var"
+if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+done
+
 
 
 # Boost Context was introduced in 1.51 (Aug 2012), but there was an immediate
@@ -16860,6 +16872,10 @@ ac_compiler_gnu=$ac_cv_cxx_compiler_gnu
   # I'm not sure about my test for `il' (be careful: Intel's ICC pre-defines
   # the same defines as GCC's).
   for i in \
+    "defined __GNUC__ && __GNUC__ == 7 && __GNUC_MINOR__ == 2 && !defined __ICC && \
+  (defined WIN32 || defined WINNT || defined _WIN32 || defined __WIN32 \
+         || defined __WIN32__ || defined __WINNT || defined __WINNT__) @ mgw72" \
+    "defined __GNUC__ && __GNUC__ == 7 && __GNUC_MINOR__ == 2 && !defined __ICC @ gcc72" \
     "defined __GNUC__ && __GNUC__ == 7 && __GNUC_MINOR__ == 1 && !defined __ICC && \
   (defined WIN32 || defined WINNT || defined _WIN32 || defined __WIN32 \
          || defined __WIN32__ || defined __WINNT || defined __WINNT__) @ mgw71" \
@@ -19112,45 +19128,44 @@ $as_echo "$enable_verbose_logging" >&6; }
 
 # Crypto libraries
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we will be linking in Botan 1.10" >&5
-$as_echo_n "checking whether we will be linking in Botan 1.10... " >&6; }
-  # Check whether --enable-botan1.10 was given.
-if test "${enable_botan1_10+set}" = set; then :
-  enableval=$enable_botan1_10; enable_botan110=$enableval
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we will be linking in Botan 2.x" >&5
+$as_echo_n "checking whether we will be linking in Botan 2.x... " >&6; }
+  # Check whether --enable-botan was given.
+if test "${enable_botan+set}" = set; then :
+  enableval=$enable_botan; enable_botan=$enableval
 else
-  enable_botan110=no
+  enable_botan=no
 
 fi
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_botan110" >&5
-$as_echo "$enable_botan110" >&6; }
-   if test "x$enable_botan110" != "xno"; then
-  BOTAN110_TRUE=
-  BOTAN110_FALSE='#'
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_botan" >&5
+$as_echo "$enable_botan" >&6; }
+   if test "x$enable_botan" != "xno"; then
+  BOTAN_TRUE=
+  BOTAN_FALSE='#'
 else
-  BOTAN110_TRUE='#'
-  BOTAN110_FALSE=
+  BOTAN_TRUE='#'
+  BOTAN_FALSE=
 fi
 
 
-
-  if test "x$enable_botan110" != "xno"; then :
+  if test "x$enable_botan" != "xno"; then :
 
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for BOTAN110" >&5
-$as_echo_n "checking for BOTAN110... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for BOTAN" >&5
+$as_echo_n "checking for BOTAN... " >&6; }
 
-if test -n "$BOTAN110_CFLAGS"; then
-    pkg_cv_BOTAN110_CFLAGS="$BOTAN110_CFLAGS"
+if test -n "$BOTAN_CFLAGS"; then
+    pkg_cv_BOTAN_CFLAGS="$BOTAN_CFLAGS"
  elif test -n "$PKG_CONFIG"; then
     if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"botan-1.10\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "botan-1.10") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"botan-2\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "botan-2") 2>&5
   ac_status=$?
   $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-  pkg_cv_BOTAN110_CFLAGS=`$PKG_CONFIG --cflags "botan-1.10" 2>/dev/null`
+  pkg_cv_BOTAN_CFLAGS=`$PKG_CONFIG --cflags "botan-2" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
   pkg_failed=yes
@@ -19158,16 +19173,16 @@ fi
  else
     pkg_failed=untried
 fi
-if test -n "$BOTAN110_LIBS"; then
-    pkg_cv_BOTAN110_LIBS="$BOTAN110_LIBS"
+if test -n "$BOTAN_LIBS"; then
+    pkg_cv_BOTAN_LIBS="$BOTAN_LIBS"
  elif test -n "$PKG_CONFIG"; then
     if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"botan-1.10\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "botan-1.10") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"botan-2\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "botan-2") 2>&5
   ac_status=$?
   $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-  pkg_cv_BOTAN110_LIBS=`$PKG_CONFIG --libs "botan-1.10" 2>/dev/null`
+  pkg_cv_BOTAN_LIBS=`$PKG_CONFIG --libs "botan-2" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
   pkg_failed=yes
@@ -19188,27 +19203,27 @@ else
         _pkg_short_errors_supported=no
 fi
         if test $_pkg_short_errors_supported = yes; then
-	        BOTAN110_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "botan-1.10" 2>&1`
+	        BOTAN_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "botan-2" 2>&1`
         else
-	        BOTAN110_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "botan-1.10" 2>&1`
+	        BOTAN_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "botan-2" 2>&1`
         fi
 	# Put the nasty error message in config.log where it belongs
-	echo "$BOTAN110_PKG_ERRORS" >&5
+	echo "$BOTAN_PKG_ERRORS" >&5
 
-	as_fn_error $? "Could not find botan 1.10" "$LINENO" 5
+	as_fn_error $? "Could not find botan" "$LINENO" 5
 
 elif test $pkg_failed = untried; then
      	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-	as_fn_error $? "Could not find botan 1.10" "$LINENO" 5
+	as_fn_error $? "Could not find botan" "$LINENO" 5
 
 else
-	BOTAN110_CFLAGS=$pkg_cv_BOTAN110_CFLAGS
-	BOTAN110_LIBS=$pkg_cv_BOTAN110_LIBS
+	BOTAN_CFLAGS=$pkg_cv_BOTAN_CFLAGS
+	BOTAN_LIBS=$pkg_cv_BOTAN_LIBS
         { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
 
-$as_echo "#define HAVE_BOTAN110 1" >>confdefs.h
+$as_echo "#define HAVE_BOTAN 1" >>confdefs.h
 
 fi
 
@@ -19510,22 +19525,15 @@ $as_echo_n "checking whether we will be linking in libsodium... " >&6; }
 if test "${enable_libsodium+set}" = set; then :
   enableval=$enable_libsodium; enable_libsodium=$enableval
 else
-  enable_libsodium=no
+  enable_libsodium=auto
 fi
 
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_libsodium" >&5
 $as_echo "$enable_libsodium" >&6; }
 
-   if test "x$enable_libsodium" != "xno"; then
-  LIBSODIUM_TRUE=
-  LIBSODIUM_FALSE='#'
-else
-  LIBSODIUM_TRUE='#'
-  LIBSODIUM_FALSE=
-fi
-
+  if test "x$enable_libsodium" != "xno"; then :
 
-  if test -z "$LIBSODIUM_TRUE"; then :
+    if test "x$enable_libsodium" = "xyes" -o "x$enable_libsodium" = "xauto"; then :
 
 
 pkg_failed=no
@@ -19586,15 +19594,11 @@ fi
 	# Put the nasty error message in config.log where it belongs
 	echo "$LIBSODIUM_PKG_ERRORS" >&5
 
-
-      as_fn_error $? "libsodium requested but not available" "$LINENO" 5
-
+	 :
 elif test $pkg_failed = untried; then
      	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-
-      as_fn_error $? "libsodium requested but not available" "$LINENO" 5
-
+	 :
 else
 	LIBSODIUM_CFLAGS=$pkg_cv_LIBSODIUM_CFLAGS
 	LIBSODIUM_LIBS=$pkg_cv_LIBSODIUM_LIBS
@@ -19604,11 +19608,11 @@ $as_echo "yes" >&6; }
 
 $as_echo "#define HAVE_LIBSODIUM 1" >>confdefs.h
 
-      save_CFLAGS=$CFLAGS
-      save_LIBS=$LIBS
-      CFLAGS="$LIBSODIUM_CFLAGS $CFLAGS"
-      LIBS="$LIBSODIUM_LIBS $LIBS"
-      for ac_func in crypto_box_easy_afternm
+        save_CFLAGS=$CFLAGS
+        save_LIBS=$LIBS
+        CFLAGS="$LIBSODIUM_CFLAGS $CFLAGS"
+        LIBS="$LIBSODIUM_LIBS $LIBS"
+        for ac_func in crypto_box_easy_afternm
 do :
   ac_fn_cxx_check_func "$LINENO" "crypto_box_easy_afternm" "ac_cv_func_crypto_box_easy_afternm"
 if test "x$ac_cv_func_crypto_box_easy_afternm" = xyes; then :
@@ -19619,8 +19623,27 @@ _ACEOF
 fi
 done
 
-      CFLAGS=$save_CFLAGS
-      LIBS=$save_LIBS
+        CFLAGS=$save_CFLAGS
+        LIBS=$save_LIBS
+
+fi
+
+fi
+
+fi
+   if test "x$LIBSODIUM_LIBS" != "x"; then
+  LIBSODIUM_TRUE=
+  LIBSODIUM_FALSE='#'
+else
+  LIBSODIUM_TRUE='#'
+  LIBSODIUM_FALSE=
+fi
+
+  if test "x$enable_libsodium" = "xyes"; then :
+
+    if test x"$LIBSODIUM_LIBS" = "x"; then :
+
+      as_fn_error $? "libsodium requested but libraries were not found" "$LINENO" 5
 
 fi
 
@@ -19816,6 +19839,30 @@ $as_echo "no" >&6; }
 fi
 
 
+      ac_fn_cxx_check_decl "$LINENO" "snmp_select_info2" "ac_cv_have_decl_snmp_select_info2" "$ac_includes_default
+          #include <net-snmp/net-snmp-config.h>
+          #include <net-snmp/definitions.h>
+          #include <net-snmp/types.h>
+          #include <net-snmp/utilities.h>
+          #include <net-snmp/config_api.h>
+          #include <net-snmp/session_api.h>
+
+"
+if test "x$ac_cv_have_decl_snmp_select_info2" = xyes; then :
+  ac_have_decl=1
+else
+  ac_have_decl=0
+fi
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_SNMP_SELECT_INFO2 $ac_have_decl
+_ACEOF
+if test $ac_have_decl = 1; then :
+   :
+else
+   :
+fi
+
 
 fi
 
@@ -21388,8 +21435,8 @@ if test -z "${HAVE_LUA_HPP_TRUE}" && test -z "${HAVE_LUA_HPP_FALSE}"; then
   as_fn_error $? "conditional \"HAVE_LUA_HPP\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
 fi
-if test -z "${BOTAN110_TRUE}" && test -z "${BOTAN110_FALSE}"; then
-  as_fn_error $? "conditional \"BOTAN110\" was never defined.
+if test -z "${BOTAN_TRUE}" && test -z "${BOTAN_FALSE}"; then
+  as_fn_error $? "conditional \"BOTAN\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
 fi
 if test -z "${LIBSODIUM_TRUE}" && test -z "${LIBSODIUM_FALSE}"; then
@@ -21821,7 +21868,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by pdns-recursor $as_me 4.1.0-alpha1, which was
+This file was extended by pdns-recursor $as_me 4.1.0-rc3, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -21887,7 +21934,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-pdns-recursor config.status 4.1.0-alpha1
+pdns-recursor config.status 4.1.0-rc3
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -23995,6 +24042,14 @@ else
   { $as_echo "$as_me:${as_lineno-$LINENO}: libdecaf ed25519 and ed448: no" >&5
 $as_echo "$as_me: libdecaf ed25519 and ed448: no" >&6;}
 
+fi
+if test "x$BOTAN_LIBS" != "x"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: Botan gost: yes" >&5
+$as_echo "$as_me: Botan gost: yes" >&6;}
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: Botan gost: no" >&5
+$as_echo "$as_me: Botan gost: no" >&6;}
+
 fi
 if test "x$PROTOBUF_LIBS" != "x" -a x"$PROTOC" != "x"; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: Protobuf: yes" >&5

configure.ac

@@ -217,6 +217,10 @@ AS_IF([test "x$LIBDECAF_LIBS" != "x"],
   [AC_MSG_NOTICE([libdecaf ed25519 and ed448: yes])],
   [AC_MSG_NOTICE([libdecaf ed25519 and ed448: no])]
 )
+AS_IF([test "x$BOTAN_LIBS" != "x"],
+  [AC_MSG_NOTICE([Botan gost: yes])],
+  [AC_MSG_NOTICE([Botan gost: no])]
+)
 AS_IF([test "x$PROTOBUF_LIBS" != "x" -a x"$PROTOC" != "x"],
   [AC_MSG_NOTICE([Protobuf: yes])],
   [AC_MSG_NOTICE([Protobuf: no])]

contrib/dns64.lua

@@ -6,6 +6,11 @@ function nodata ( dq )
     return false
   end  --  only AAAA records
 
+  -- don't fake AAAA records if DNSSEC validation failed
+  if dq.validationState == pdns.validationstates.Bogus then
+     return false
+  end
+
   dq.followupFunction = "getFakeAAAARecords"
   dq.followupPrefix = prefix
   dq.followupName = dq.qname

devpollmplexer.cc

@@ -35,7 +35,6 @@
 #include "misc.hh"
 #include "syncres.hh"
 
-#include "namespaces.hh"
 #include "namespaces.hh"
 
 class DevPollFDMultiplexer : public FDMultiplexer
@@ -47,7 +46,7 @@ public:
     close(d_devpollfd);
   }
 
-  virtual int run(struct timeval* tv);
+  virtual int run(struct timeval* tv, int timeout=500);
 
   virtual void addFD(callbackmap_t& cbmap, int fd, callbackfunc_t toDo, const funcparam_t& parameter);
   virtual void removeFD(callbackmap_t& cbmap, int fd);
@@ -113,7 +112,7 @@ void DevPollFDMultiplexer::removeFD(callbackmap_t& cbmap, int fd)
   }
 }
 
-int DevPollFDMultiplexer::run(struct timeval* now)
+int DevPollFDMultiplexer::run(struct timeval* now, int timeout)
 {
   if(d_inrun) {
     throw FDMultiplexerException("FDMultiplexer::run() is not reentrant!\n");
@@ -121,7 +120,7 @@ int DevPollFDMultiplexer::run(struct timeval* now)
   struct dvpoll dvp;
   dvp.dp_nfds = d_readCallbacks.size() + d_writeCallbacks.size();
   dvp.dp_fds = new pollfd[dvp.dp_nfds];
-  dvp.dp_timeout = 500;
+  dvp.dp_timeout = timeout;
   int ret=ioctl(d_devpollfd, DP_POLL, &dvp); 
   gettimeofday(now,0); // MANDATORY!
   
@@ -151,7 +150,7 @@ int DevPollFDMultiplexer::run(struct timeval* now)
   }
   delete[] dvp.dp_fds;
   d_inrun=false;
-  return 0;
+  return ret;
 }
 
 #if 0

dnsmessage.proto

@@ -36,6 +36,14 @@ message PBDNSMessage {
     UDP = 1;                                    // User Datagram Protocol (RFC 768)
     TCP = 2;                                    // Transmission Control Protocol (RFC 793)
   }
+  enum PolicyType {
+    UNKNOWN = 1;                                // No policy applied, or unknown type
+    QNAME = 2;                                  // Policy matched on the QName
+    CLIENTIP = 3;                               // Policy matched on the client IP
+    RESPONSEIP = 4;                             // Policy matched on one of the IPs contained in the answer
+    NSDNAME = 5;                                // Policy matched on the name of one nameserver involved
+    NSIP = 6;                                   // Policy matched on the IP of one nameserver involved
+  }
   required Type type = 1;
   optional bytes messageId = 2;                 // UUID, shared by the query and the response
   optional bytes serverIdentity = 3;            // UUID of the server emitting the protobuf message
@@ -69,10 +77,12 @@ message PBDNSMessage {
     repeated string tags = 4;                   // Additional tags
     optional uint32 queryTimeSec = 5;           // Time of the corresponding query reception (seconds since epoch)
     optional uint32 queryTimeUsec = 6;          // Time of the corresponding query reception (additional micro-seconds)
+    optional PolicyType appliedPolicyType = 7;  // Type of the filtering policy (RPZ or Lua) applied
   }
 
   optional DNSResponse response = 13;
   optional bytes originalRequestorSubnet = 14;  // EDNS Client Subnet value
   optional string requestorId = 15;             // Username of the requestor
   optional bytes initialRequestId = 16;         // UUID of the incoming query that initiated this outgoing query or incoming response
+  optional bytes deviceId = 17;     		// Device ID of the requestor (could be mac address IP address or e.g. IMEI)
 }

dnsname.cc

@@ -253,6 +253,27 @@ void DNSName::makeUsRelative(const DNSName& zone)
     clear();
 }
 
+DNSName DNSName::getCommonLabels(const DNSName& other) const
+{
+  DNSName result;
+
+  const std::vector<std::string> ours = getRawLabels();
+  const std::vector<std::string> others = other.getRawLabels();
+
+  for (size_t pos = 0; ours.size() > pos && others.size() > pos; pos++) {
+    const std::string& ourLabel = ours.at(ours.size() - pos - 1);
+    const std::string& otherLabel = others.at(others.size() - pos - 1);
+
+    if (!pdns_iequals(ourLabel, otherLabel)) {
+      break;
+    }
+
+    result.prependRawLabel(ourLabel);
+  }
+
+  return result;
+}
+
 DNSName DNSName::labelReverse() const
 {
   DNSName ret;

dnsname.hh

@@ -94,6 +94,7 @@ public:
     }
   }
   void makeUsRelative(const DNSName& zone);
+  DNSName getCommonLabels(const DNSName& other) const; //!< Return the list of common labels from the top, for example 'c.d' for 'a.b.c.d' and 'x.y.c.d'
   DNSName labelReverse() const;
   bool isWildcard() const;
   bool isHostname() const;

dnspacket.hh

@@ -21,14 +21,6 @@
  */
 #ifndef DNSPACKET_HH
 
-#if __GNUC__ == 2
-#if __GNUC_MINOR__ < 95
-        #error Your compiler is too old! Try g++ 3.3 or higher
-#else
-        #warning There are known problems with PowerDNS binaries compiled by gcc version 2.95 and 2.96!
-#endif
-#endif
-
 #define DNSPACKET_HH
 
 #include <cstdio>

dnsparser.cc

@@ -732,13 +732,13 @@ void ageDNSPacket(char* packet, size_t length, uint32_t seconds)
     return;
   try 
   {
-    dnsheader dh;
-    memcpy((void*)&dh, (const dnsheader*)packet, sizeof(dh));
-    uint64_t numrecords = ntohs(dh.ancount) + ntohs(dh.nscount) + ntohs(dh.arcount);
+    const dnsheader* dh = reinterpret_cast<const dnsheader*>(packet);
+    const uint64_t dqcount = ntohs(dh->qdcount);
+    const uint64_t numrecords = ntohs(dh->ancount) + ntohs(dh->nscount) + ntohs(dh->arcount);
     DNSPacketMangler dpm(packet, length);
 
     uint64_t n;
-    for(n=0; n < ntohs(dh.qdcount) ; ++n) {
+    for(n=0; n < dqcount; ++n) {
       dpm.skipLabel();
       /* type and class */
       dpm.skipBytes(4);

dnsrecords.cc

@@ -45,18 +45,29 @@ void DNSResourceRecord::setContent(const string &cont) {
 
 string DNSResourceRecord::getZoneRepresentation(bool noDot) const {
   ostringstream ret;
+  vector<string> parts;
+  string last;
+
   switch(qtype.getCode()) {
     case QType::SRV:
     case QType::MX:
+      stringtok(parts, content);
+      if (!parts.size())
+        return "";
+      last = *parts.rbegin();
+      ret << content;
+      if (last == ".")
+        break;
+      if (*(last.rbegin()) != '.' && !noDot)
+        ret << ".";
+      break;
     case QType::CNAME:
     case QType::DNAME:
     case QType::NS:
     case QType::PTR:
-      if (*(content.rbegin()) != '.') {
-        ret<<content;
-        if(!noDot)
-          ret<<".";
-      }
+      ret<<content;
+      if (*(content.rbegin()) != '.' && !noDot)
+        ret<<".";
       break;
     default:
       ret<<content;

dnssecinfra.cc

@@ -457,7 +457,7 @@ DSRecordContent makeDSFromDNSKey(const DNSName& qname, const DNSKEYRecordContent
 }
 
 
-DNSKEYRecordContent makeDNSKEYFromDNSCryptoKeyEngine(const std::shared_ptr<DNSCryptoKeyEngine> pk, uint8_t algorithm, uint16_t flags)
+static DNSKEYRecordContent makeDNSKEYFromDNSCryptoKeyEngine(const std::shared_ptr<DNSCryptoKeyEngine> pk, uint8_t algorithm, uint16_t flags)
 {
   DNSKEYRecordContent drc;
 
@@ -498,6 +498,36 @@ string hashQNameWithSalt(const std::string& salt, unsigned int iterations, const
   return toHash;
 }
 
+void incrementHash(std::string& raw) // I wonder if this is correct, cmouse? ;-)
+{
+  if(raw.empty())
+    return;
+
+  for(string::size_type pos=raw.size(); pos; ) {
+    --pos;
+    unsigned char c = (unsigned char)raw[pos];
+    ++c;
+    raw[pos] = (char) c;
+    if(c)
+      break;
+  }
+}
+
+void decrementHash(std::string& raw) // I wonder if this is correct, cmouse? ;-)
+{
+  if(raw.empty())
+    return;
+
+  for(string::size_type pos=raw.size(); pos; ) {
+    --pos;
+    unsigned char c = (unsigned char)raw[pos];
+    --c;
+    raw[pos] = (char) c;
+    if(c != 0xff)
+      break;
+  }
+}
+
 DNSKEYRecordContent DNSSECPrivateKey::getDNSKEY() const
 {
   return makeDNSKEYFromDNSCryptoKeyEngine(getKey(), d_algorithm, d_flags);

dnssecinfra.hh

@@ -106,7 +106,10 @@ class DNSCryptoKeyEngine
 
 struct DNSSECPrivateKey
 {
-  uint16_t getTag();
+  uint16_t getTag() const
+  {
+    return getDNSKEY().getTag();
+  }
   
   const shared_ptr<DNSCryptoKeyEngine> getKey() const
   {
@@ -155,6 +158,9 @@ uint32_t getStartOfWeek();
 string hashQNameWithSalt(const NSEC3PARAMRecordContent& ns3prc, const DNSName& qname);
 string hashQNameWithSalt(const std::string& salt, unsigned int iterations, const DNSName& qname);
 
+void incrementHash(std::string& raw);
+void decrementHash(std::string& raw);
+
 void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const std::set<DNSName>& authMap, vector<DNSZoneRecord>& rrs);
 
 void addTSIG(DNSPacketWriter& pw, TSIGRecordContent& trc, const DNSName& tsigkeyname, const string& tsigsecret, const string& tsigprevious, bool timersonly);

dnsseckeeper.hh

@@ -181,6 +181,7 @@ public:
   bool checkKeys(const DNSName& zname);
 
   bool getNSEC3PARAM(const DNSName& zname, NSEC3PARAMRecordContent* n3p=0, bool* narrow=0);
+  bool checkNSEC3PARAM(const NSEC3PARAMRecordContent& ns3p, string& msg);
   bool setNSEC3PARAM(const DNSName& zname, const NSEC3PARAMRecordContent& n3p, const bool& narrow=false);
   bool unsetNSEC3PARAM(const DNSName& zname);
   void clearAllCaches();
@@ -209,6 +210,8 @@ public:
   
   void getFromMeta(const DNSName& zname, const std::string& key, std::string& value);
   void getSoaEdit(const DNSName& zname, std::string& value);
+  bool unSecureZone(const DNSName& zone, std::string& error, std::string& info);
+  bool rectifyZone(const DNSName& zone, std::string& error, std::string& info, bool doTransaction);
 private:
 
 
@@ -284,7 +287,7 @@ uint32_t localtime_format_YYYYMMDDSS(time_t t, uint32_t seq);
 uint32_t calculateEditSOA(const DNSZoneRecord& rr, const string& kind);
 uint32_t calculateEditSOA(const SOAData& sd, const string& kind);
 bool editSOA(DNSSECKeeper& dk, const DNSName& qname, DNSPacket* dp);
-bool editSOARecord(DNSZoneRecord& rr, const string& kind, const DNSName& qname);
+bool editSOARecord(DNSZoneRecord& rr, const string& kind);
 // for SOA-EDIT-DNSUPDATE/API
 uint32_t calculateIncreaseSOA(SOAData sd, const string& increaseKind, const string& editKind);
 bool increaseSOARecord(DNSResourceRecord& rr, const string& increaseKind, const string& editKind);

effective_tld_names.dat

@@ -399,24 +399,34 @@ tv.bo
 // br : http://registro.br/dominio/categoria.html
 // Submitted by registry <fneves@registro.br>
 br
+abc.br
 adm.br
 adv.br
 agr.br
+aju.br
 am.br
+aparecida.br
 arq.br
 art.br
 ato.br
 b.br
 belem.br
+bhz.br
 bio.br
 blog.br
 bmd.br
+boavista.br
+bsb.br
+campinas.br
+caxias.br
 cim.br
 cng.br
 cnt.br
 com.br
+contagem.br
 coop.br
 cri.br
+cuiaba.br
 def.br
 ecn.br
 eco.br
@@ -427,14 +437,17 @@ esp.br
 etc.br
 eti.br
 far.br
+feira.br
 flog.br
 floripa.br
 fm.br
 fnd.br
+fortal.br
 fot.br
 fst.br
 g12.br
 ggf.br
+goiania.br
 gov.br
 // gov.br 26 states + df https://en.wikipedia.org/wiki/States_of_Brazil
 ac.gov.br
@@ -464,42 +477,65 @@ sc.gov.br
 se.gov.br
 sp.gov.br
 to.gov.br
+gru.br
 imb.br
 ind.br
 inf.br
+jab.br
 jampa.br
+jdf.br
+joinville.br
 jor.br
 jus.br
 leg.br
 lel.br
+londrina.br
+macapa.br
+maceio.br
 mat.br
 med.br
 mil.br
+morena.br
 mp.br
 mus.br
+natal.br
 net.br
+niteroi.br
 *.nom.br
 not.br
 ntr.br
 odo.br
 org.br
+osasco.br
+palmas.br
 poa.br
 ppg.br
 pro.br
 psc.br
 psi.br
+pvh.br
 qsl.br
 radio.br
 rec.br
 recife.br
+ribeirao.br
+rio.br
+riobranco.br
+salvador.br
+sampa.br
+sjc.br
 slg.br
+slz.br
+sorocaba.br
 srv.br
 taxi.br
 teo.br
+the.br
 tmp.br
 trd.br
 tur.br
 tv.br
+udi.br
 vet.br
 vix.br
 vlog.br
@@ -6472,6 +6508,17 @@ lib.wy.us
 pvt.k12.ma.us
 chtr.k12.ma.us
 paroch.k12.ma.us
+// Merit Network, Inc. maintains the registry for =~ /(k12|cc|lib).mi.us/ and the following
+//    see also: http://domreg.merit.edu
+//    see also: whois -h whois.domreg.merit.edu help
+ann-arbor.mi.us
+cog.mi.us
+dst.mi.us
+eaton.mi.us
+gen.mi.us
+mus.mi.us
+tec.mi.us
+washtenaw.mi.us
 
 // uy : http://www.nic.org.uy/
 uy
@@ -7473,9 +7520,6 @@ cheap
 // chintai : 2015-06-11 CHINTAI Corporation
 chintai
 
-// chloe : 2014-10-16 Richemont DNS Inc.
-chloe
-
 // christmas : 2013-11-21 Uniregistry, Corp.
 christmas
 
@@ -8346,9 +8390,6 @@ how
 // hsbc : 2014-10-24 HSBC Holdings PLC
 hsbc
 
-// htc : 2015-04-02 HTC corporation
-htc
-
 // hughes : 2015-07-30 Hughes Satellite Systems Corporation
 hughes
 
@@ -8802,12 +8843,6 @@ mattel
 // mba : 2015-04-02 Lone Hollow, LLC
 mba
 
-// mcd : 2015-07-30 McDonald’s Corporation
-mcd
-
-// mcdonalds : 2015-07-30 McDonald’s Corporation