Author: cy
Date: Mon Aug 24 18:14:04 2020
New Revision: 364721
URL: https://svnweb.freebsd.org/changeset/base/364721

Log:
  MFV 364468:
  
  Update unbound 1.10.1 --> 1.11.0.
  
  MFH:          1 month

Added:
  head/contrib/unbound/README-Travis.md
     - copied unchanged from r364468, vendor/unbound/dist/README-Travis.md
  head/contrib/unbound/contrib/android/
     - copied from r364468, vendor/unbound/dist/contrib/android/
  head/contrib/unbound/contrib/ios/
     - copied from r364468, vendor/unbound/dist/contrib/ios/
  head/contrib/unbound/dnstap/dnstap_fstrm.c
     - copied unchanged from r364468, vendor/unbound/dist/dnstap/dnstap_fstrm.c
  head/contrib/unbound/dnstap/dnstap_fstrm.h
     - copied unchanged from r364468, vendor/unbound/dist/dnstap/dnstap_fstrm.h
  head/contrib/unbound/dnstap/dtstream.c
     - copied unchanged from r364468, vendor/unbound/dist/dnstap/dtstream.c
  head/contrib/unbound/dnstap/dtstream.h
     - copied unchanged from r364468, vendor/unbound/dist/dnstap/dtstream.h
  head/contrib/unbound/dnstap/unbound-dnstap-socket.c
     - copied unchanged from r364468, 
vendor/unbound/dist/dnstap/unbound-dnstap-socket.c
  head/contrib/unbound/dynlibmod/
     - copied from r364468, vendor/unbound/dist/dynlibmod/
Modified:
  head/contrib/unbound/.github/FUNDING.yml
  head/contrib/unbound/.travis.yml
  head/contrib/unbound/Makefile.in
  head/contrib/unbound/acx_python.m4
  head/contrib/unbound/cachedb/cachedb.c
  head/contrib/unbound/cachedb/cachedb.h
  head/contrib/unbound/cachedb/redis.c
  head/contrib/unbound/config.guess
  head/contrib/unbound/config.h.in
  head/contrib/unbound/config.sub
  head/contrib/unbound/configure
  head/contrib/unbound/configure.ac
  head/contrib/unbound/contrib/aaaa-filter-iterator.patch
  head/contrib/unbound/contrib/fastrpz.patch
  head/contrib/unbound/contrib/libunbound.pc.in
  head/contrib/unbound/contrib/unbound.service.in
  head/contrib/unbound/daemon/acl_list.c
  head/contrib/unbound/daemon/daemon.c
  head/contrib/unbound/daemon/remote.c
  head/contrib/unbound/daemon/unbound.c
  head/contrib/unbound/daemon/worker.c
  head/contrib/unbound/dns64/dns64.c
  head/contrib/unbound/dnstap/dnstap.c
  head/contrib/unbound/dnstap/dnstap.h
  head/contrib/unbound/dnstap/dnstap.m4
  head/contrib/unbound/doc/Changelog
  head/contrib/unbound/doc/README
  head/contrib/unbound/doc/example.conf.in
  head/contrib/unbound/doc/libunbound.3.in
  head/contrib/unbound/doc/unbound-anchor.8.in
  head/contrib/unbound/doc/unbound-checkconf.8.in
  head/contrib/unbound/doc/unbound-control.8.in
  head/contrib/unbound/doc/unbound-host.1.in
  head/contrib/unbound/doc/unbound.8.in
  head/contrib/unbound/doc/unbound.conf.5.in
  head/contrib/unbound/edns-subnet/subnetmod.c
  head/contrib/unbound/edns-subnet/subnetmod.h
  head/contrib/unbound/iterator/iter_utils.c
  head/contrib/unbound/iterator/iterator.c
  head/contrib/unbound/iterator/iterator.h
  head/contrib/unbound/libunbound/libworker.c
  head/contrib/unbound/libunbound/unbound.h
  head/contrib/unbound/respip/respip.c
  head/contrib/unbound/services/authzone.c
  head/contrib/unbound/services/authzone.h
  head/contrib/unbound/services/listen_dnsport.c
  head/contrib/unbound/services/listen_dnsport.h
  head/contrib/unbound/services/localzone.c
  head/contrib/unbound/services/mesh.c
  head/contrib/unbound/services/modstack.c
  head/contrib/unbound/services/outside_network.c
  head/contrib/unbound/services/outside_network.h
  head/contrib/unbound/services/rpz.c
  head/contrib/unbound/services/rpz.h
  head/contrib/unbound/sldns/parseutil.c
  head/contrib/unbound/smallapp/unbound-anchor.c
  head/contrib/unbound/smallapp/unbound-checkconf.c
  head/contrib/unbound/smallapp/unbound-control-setup.sh.in
  head/contrib/unbound/smallapp/unbound-control.c
  head/contrib/unbound/smallapp/worker_cb.c
  head/contrib/unbound/util/config_file.c
  head/contrib/unbound/util/config_file.h
  head/contrib/unbound/util/configlexer.lex
  head/contrib/unbound/util/configparser.y
  head/contrib/unbound/util/fptr_wlist.c
  head/contrib/unbound/util/iana_ports.inc
  head/contrib/unbound/util/mini_event.h
  head/contrib/unbound/util/net_help.c
  head/contrib/unbound/util/net_help.h
  head/contrib/unbound/util/netevent.c
  head/contrib/unbound/util/netevent.h
  head/contrib/unbound/util/shm_side/shm_main.c
  head/contrib/unbound/util/ub_event.c
  head/contrib/unbound/validator/val_secalgo.c
  head/contrib/unbound/validator/val_sigcrypt.c
Directory Properties:
  head/contrib/unbound/   (props changed)

Modified: head/contrib/unbound/.github/FUNDING.yml
==============================================================================
--- head/contrib/unbound/.github/FUNDING.yml    Mon Aug 24 18:13:44 2020        
(r364720)
+++ head/contrib/unbound/.github/FUNDING.yml    Mon Aug 24 18:14:04 2020        
(r364721)
@@ -1,12 +1,2 @@
-# These are supported funding model platforms
-
-github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, 
user2]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., 
npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., 
cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
+github: [NLnetLabs]
 custom: ['https://nlnetlabs.nl/funding/']

Modified: head/contrib/unbound/.travis.yml
==============================================================================
--- head/contrib/unbound/.travis.yml    Mon Aug 24 18:13:44 2020        
(r364720)
+++ head/contrib/unbound/.travis.yml    Mon Aug 24 18:14:04 2020        
(r364721)
@@ -1,7 +1,8 @@
-sudo: false
 language: c
-compiler:
-  - gcc
+
+git:
+  depth: 5
+
 addons:
   apt:
     packages:
@@ -9,8 +10,335 @@ addons:
     - libevent-dev
     - libexpat-dev
     - clang
+  homebrew:
+    packages:
+      - openssl
+      - libevent
+      - expat
+    update: true
+
+jobs:
+  include:
+    - os: linux
+      name: GCC on Linux, Amd64
+      compiler: gcc
+      arch: amd64
+      env:
+        - CONFIG_OPTS="--enable-debug --disable-flto"
+    - os: linux
+      name: Clang on Linux, Amd64
+      compiler: clang
+      arch: amd64
+      env:
+        - CONFIG_OPTS="--enable-debug --disable-flto"
+    - os: osx
+      name: Clang on OS X, Amd64
+      compiler: clang
+      arch: amd64
+      env:
+        - TEST_OSX=yes
+        - CONFIG_OPTS="--enable-debug --disable-flto 
--with-ssl=/usr/local/opt/openssl/"
+    - os: linux
+      name: Libevent, GCC on Linux, Amd64
+      compiler: gcc
+      arch: amd64
+      env:
+        - TEST_LIBEVENT=yes
+        - CONFIG_OPTS="--with-libevent"
+    - os: linux
+      name: Libevent, Clang on Linux, Amd64
+      compiler: clang
+      arch: amd64
+      env:
+        - TEST_LIBEVENT=yes
+        - CONFIG_OPTS="--with-libevent"
+    - os: osx
+      name: Libevent, Clang on OS X, Amd64
+      compiler: clang
+      arch: amd64
+      env:
+        - TEST_OSX=yes
+        - TEST_LIBEVENT=yes
+        - CONFIG_OPTS="--with-ssl=/usr/local/opt/openssl/ 
--with-libevent=/usr/local/opt/libevent/"
+    - os: linux
+      name: UBsan, GCC on Linux, Amd64
+      compiler: gcc
+      arch: amd64
+      dist: bionic
+      env:
+        - TEST_UBSAN=yes
+    - os: linux
+      name: UBsan, Clang on Linux, Amd64
+      compiler: clang
+      arch: amd64
+      dist: bionic
+      env:
+        - TEST_UBSAN=yes
+    - os: linux
+      name: Asan, GCC on Linux, Amd64
+      compiler: gcc
+      arch: amd64
+      dist: bionic
+      env:
+        - TEST_ASAN=yes
+    - os: linux
+      name: Asan, Clang on Linux, Amd64
+      compiler: clang
+      arch: amd64
+      dist: bionic
+      env:
+        - TEST_ASAN=yes
+    - os: linux
+      name: GCC on Linux, Aarch64
+      compiler: gcc
+      arch: arm64
+      dist: bionic
+      env:
+        - CONFIG_OPTS="--enable-debug --disable-flto"
+    - os: linux
+      name: Clang on Linux, Aarch64
+      compiler: clang
+      arch: arm64
+      dist: bionic
+      env:
+        - CONFIG_OPTS="--enable-debug --disable-flto"
+    - os: linux
+      name: GCC on Linux, PowerPC64
+      compiler: gcc
+      arch: ppc64le
+      dist: bionic
+      env:
+        - CONFIG_OPTS="--enable-debug --disable-flto"
+    - os: linux
+      name: Clang on Linux, PowerPC64
+      compiler: clang
+      arch: ppc64le
+      dist: bionic
+      env:
+        - CONFIG_OPTS="--enable-debug --disable-flto"
+    - os: linux
+      name: GCC on Linux, s390x
+      compiler: gcc
+      arch: s390x
+      dist: bionic
+      env:
+        - CONFIG_OPTS="--enable-debug --disable-flto"
+    - os: linux
+      name: Clang on Linux, s390x
+      compiler: clang
+      arch: s390x
+      dist: bionic
+      env:
+        - CONFIG_OPTS="--enable-debug --disable-flto"
+    - os: osx
+      osx_image: xcode10
+      name: Apple iPhone on iOS, armv7
+      compiler: clang
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=armv7-apple-ios
+        - OPENSSL_HOST=ios-cross
+        - IOS_SDK=iPhoneOS
+        - IOS_CPU=armv7s
+        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+    - os: osx
+      osx_image: xcode10
+      name: Apple iPhone on iOS, arm64
+      compiler: clang
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=aarch64-apple-ios
+        - OPENSSL_HOST=ios64-cross
+        - IOS_SDK=iPhoneOS
+        - IOS_CPU=arm64
+        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+    - os: osx
+      osx_image: xcode10
+      name: Apple TV on iOS, arm64
+      compiler: clang
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=aarch64-apple-ios
+        - OPENSSL_HOST=ios64-cross
+        - IOS_SDK=AppleTVOS
+        - IOS_CPU=arm64
+        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+    - os: osx
+      osx_image: xcode10
+      name: Apple Watch on iOS, armv7
+      compiler: clang
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=armv7-apple-ios
+        - OPENSSL_HOST=ios-cross
+        - IOS_SDK=WatchOS
+        - IOS_CPU=armv7k
+        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+    - os: osx
+      osx_image: xcode10
+      name: iPhoneSimulator on OS X, i386
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=i386-apple-ios
+        - OPENSSL_HOST=iphoneos-cross
+        - IOS_CPU=i386
+        - IOS_SDK=iPhoneSimulator
+        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+    - os: osx
+      osx_image: xcode10
+      name: iPhoneSimulator on OS X, x86_64
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=x86_64-apple-ios
+        - OPENSSL_HOST=iphoneos-cross
+        - IOS_CPU=x86_64
+        - IOS_SDK=iPhoneSimulator
+        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+    - os: osx
+      osx_image: xcode10
+      name: AppleTVSimulator on OS X, x86_64
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=x86_64-apple-ios
+        - OPENSSL_HOST=iphoneos-cross
+        - IOS_CPU=x86_64
+        - IOS_SDK=AppleTVSimulator
+        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+    - os: osx
+      osx_image: xcode10
+      name: WatchSimulator on OS X, i386
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=i386-apple-ios
+        - OPENSSL_HOST=iphoneos-cross
+        - IOS_CPU=i386
+        - IOS_SDK=WatchSimulator
+        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+    - os: linux
+      name: Android armv7a, Linux, Amd64
+      compiler: clang
+      arch: amd64
+      dist: bionic
+      env:
+        - TEST_ANDROID=yes
+        - AUTOTOOLS_HOST=armv7a-linux-androideabi
+        - OPENSSL_HOST=android-arm
+        - ANDROID_CPU=armv7a
+        - ANDROID_API=23
+        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
+        - ANDROID_SDK_ROOT="$HOME/android-sdk"
+        - ANDROID_NDK_ROOT="$HOME/android-ndk"
+    - os: linux
+      name: Android aarch64, Linux, Amd64
+      compiler: clang
+      arch: amd64
+      dist: bionic
+      env:
+        - TEST_ANDROID=yes
+        - AUTOTOOLS_HOST=aarch64-linux-android
+        - OPENSSL_HOST=android-arm64
+        - ANDROID_CPU=aarch64
+        - ANDROID_API=23
+        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
+        - ANDROID_SDK_ROOT="$HOME/android-sdk"
+        - ANDROID_NDK_ROOT="$HOME/android-ndk"
+    - os: linux
+      name: Android x86, Linux, Amd64
+      compiler: clang
+      arch: amd64
+      dist: bionic
+      env:
+        - TEST_ANDROID=yes
+        - AUTOTOOLS_HOST=i686-linux-android
+        - OPENSSL_HOST=android-x86
+        - ANDROID_CPU=x86
+        - ANDROID_API=23
+        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
+        - ANDROID_SDK_ROOT="$HOME/android-sdk"
+        - ANDROID_NDK_ROOT="$HOME/android-ndk"
+    - os: linux
+      name: Android x86_64, Linux, Amd64
+      compiler: clang
+      arch: amd64
+      dist: bionic
+      env:
+        - TEST_ANDROID=yes
+        - AUTOTOOLS_HOST=x86_64-linux-android
+        - OPENSSL_HOST=android-x86_64
+        - ANDROID_CPU=x86_64
+        - ANDROID_API=23
+        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
+        - ANDROID_SDK_ROOT="$HOME/android-sdk"
+        - ANDROID_NDK_ROOT="$HOME/android-ndk"
+
+  allow_failures:
+    - os: linux
+      name: Android armv7a, Linux, Amd64
+    - os: linux
+      name: Android aarch64, Linux, Amd64
+    - os: linux
+      name: Android x86, Linux, Amd64
+    - os: linux
+      name: Android x86_64, Linux, Amd64
+
+before_script:
+  - |
+    if [ "$TEST_ANDROID" = "yes" ]; then
+      ./contrib/android/install_tools.sh
+    elif [ "$TEST_IOS" = "yes" ]; then
+      ./contrib/ios/install_tools.sh
+    fi
+
+# The Travis docs say to avoid calling exit in the script. It leads to
+# some code duplication to avoid failures in cross-compiles. Also see
+# https://docs.travis-ci.com/user/job-lifecycle/ in the Travis docs.
 script:
-  - ./configure --enable-debug --disable-flto
-  - make
-  - make test
-  - (cd testdata/clang-analysis.tdir; bash clang-analysis.test)
+  - |
+    if [ "$TEST_UBSAN" = "yes" ]; then
+      export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=undefined 
-fno-sanitize-recover"
+      ./configure
+      make -j 2
+      make test
+    elif [ "$TEST_ASAN" = "yes" ]; then
+      export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address"
+      ./configure
+      make -j 2
+      make test
+    elif [ "$TEST_IOS" = "yes" ]; then
+      export AUTOTOOLS_BUILD="$(./config.guess)"
+      export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"
+      source ./contrib/ios/setenv_ios.sh
+      ./contrib/ios/install_openssl.sh
+      ./contrib/ios/install_expat.sh
+      ./configure \
+        --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
+        --prefix="$IOS_PREFIX" \
+        --with-ssl="$IOS_PREFIX" --disable-gost \
+        --with-libexpat="$IOS_PREFIX";
+      make -j 2
+      make install
+    elif [ "$TEST_ANDROID" = "yes" ]; then
+      export AUTOTOOLS_BUILD="$(./config.guess)"
+      export PKG_CONFIG_PATH="$ANDROID_PREFIX/lib/pkgconfig"
+      ./contrib/android/install_ndk.sh
+      source ./contrib/android/setenv_android.sh
+      ./contrib/android/install_openssl.sh
+      ./contrib/android/install_expat.sh
+      ./configure \
+        --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
+        --prefix="$ANDROID_PREFIX" \
+        --with-ssl="$ANDROID_PREFIX" --disable-gost \
+        --with-libexpat="$ANDROID_PREFIX";
+      make -j 2
+      make install
+    elif [ "$TEST_OSX" = "yes" ]; then
+      ./configure --enable-debug --disable-flto 
--with-ssl=/usr/local/opt/openssl/
+      make -j 2
+      make test
+      (cd testdata/clang-analysis.tdir; bash clang-analysis.test)
+    else
+      ./configure ${CONFIG_OPTS}
+      make -j 2
+      make test
+      (cd testdata/clang-analysis.tdir; bash clang-analysis.test)
+    fi

Modified: head/contrib/unbound/Makefile.in
==============================================================================
--- head/contrib/unbound/Makefile.in    Mon Aug 24 18:13:44 2020        
(r364720)
+++ head/contrib/unbound/Makefile.in    Mon Aug 24 18:14:04 2020        
(r364721)
@@ -25,6 +25,7 @@ DNSTAP_SRC=@DNSTAP_SRC@
 DNSTAP_OBJ=@DNSTAP_OBJ@
 DNSCRYPT_SRC=@DNSCRYPT_SRC@
 DNSCRYPT_OBJ=@DNSCRYPT_OBJ@
+WITH_DYNLIBMODULE=@WITH_DYNLIBMODULE@
 WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
 WITH_PYUNBOUND=@WITH_PYUNBOUND@
 PY_MAJOR_VERSION=@PY_MAJOR_VERSION@
@@ -77,7 +78,7 @@ LINT=splint
 LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t 
-Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 
-D__gnuc_va_list=va_list -formatcode
 #-Dglob64=glob -Dglobfree64=globfree
 # compat with openssl linux edition.
-LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned 
int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray 
-D"ENGINE=unsigned" -D"RSA=unsigned" -D"DSA=unsigned" -D"EVP_PKEY=unsigned" 
-D"EVP_MD=unsigned" -D"SSL=unsigned" -D"SSL_CTX=unsigned" -D"X509=unsigned" 
-D"RC4_KEY=unsigned" -D"EVP_MD_CTX=unsigned" -D"ECDSA_SIG=DSA_SIG" 
-Dfstrm_res=int
+LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned 
int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray 
-D"ENGINE=unsigned" -D"RSA=unsigned" -D"DSA=unsigned" -D"EVP_PKEY=unsigned" 
-D"EVP_MD=unsigned" -D"SSL=unsigned" -D"SSL_CTX=unsigned" -D"X509=unsigned" 
-D"RC4_KEY=unsigned" -D"EVP_MD_CTX=unsigned" -D"ECDSA_SIG=DSA_SIG"
 # compat with NetBSD
 LINTFLAGS+=@NETBSD_LINTFLAGS@
 # compat with OpenBSD
@@ -87,6 +88,12 @@ LINTFLAGS+="-D__uint16_t=uint16_t" "-DEVP_PKEY_ASN1_ME
 
 INSTALL=$(SHELL) $(srcdir)/install-sh
 
+DYNLIBMOD_SRC=dynlibmod/dynlibmod.c
+DYNLIBMOD_OBJ=@DYNLIBMOD_OBJ@
+DYNLIBMOD_HEADER=@DYNLIBMOD_HEADER@
+DYNLIBMOD_EXTRALIBS=@DYNLIBMOD_EXTRALIBS@
+
+
 #pythonmod.c is not here, it is mentioned by itself in its own rules,
 #makedepend fails on missing interface.h otherwise.
 PYTHONMOD_SRC=pythonmod/pythonmod_utils.c
@@ -140,7 +147,7 @@ autotrust.lo val_anchor.lo rpz.lo \
 validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
 val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo redis.lo 
authzone.lo \
 $(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
-$(IPSECMOD_OBJ) $(IPSET_OBJ) respip.lo
+$(IPSECMOD_OBJ) $(IPSET_OBJ) $(DYNLIBMOD_OBJ) respip.lo
 COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo 
listen_dnsport.lo \
 outside_network.lo
 COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
@@ -219,7 +226,7 @@ MEMSTATS_OBJ_LINK=$(MEMSTATS_OBJ) worker_cb.lo $(COMMO
 $(SLDNS_OBJ)
 ASYNCLOOK_SRC=testcode/asynclook.c
 ASYNCLOOK_OBJ=asynclook.lo
-ASYNCLOOK_OBJ_LINK=$(ASYNCLOOK_OBJ) log.lo locks.lo $(COMPAT_OBJ) 
@ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ@
+ASYNCLOOK_OBJ_LINK=$(ASYNCLOOK_OBJ) log.lo locks.lo $(CHECKLOCK_OBJ) 
$(COMPAT_OBJ) @ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ@
 STREAMTCP_SRC=testcode/streamtcp.c
 STREAMTCP_OBJ=streamtcp.lo
 STREAMTCP_OBJ_LINK=$(STREAMTCP_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) \
@@ -233,6 +240,10 @@ DELAYER_OBJ_LINK=$(DELAYER_OBJ) worker_cb.lo $(COMMON_
 $(SLDNS_OBJ)
 IPSET_SRC=@IPSET_SRC@
 IPSET_OBJ=@IPSET_OBJ@
+DNSTAP_SOCKET_SRC=dnstap/unbound-dnstap-socket.c
+DNSTAP_SOCKET_OBJ=unbound-dnstap-socket.lo
+DNSTAP_SOCKET_OBJ_LINK=$(DNSTAP_SOCKET_OBJ) $(COMMON_OBJ) \
+$(COMPAT_OBJ) $(SLDNS_OBJ)
 LIBUNBOUND_SRC=libunbound/context.c libunbound/libunbound.c \
 libunbound/libworker.c
 LIBUNBOUND_OBJ=context.lo libunbound.lo libworker.lo ub_event_pluggable.lo
@@ -259,7 +270,7 @@ ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
        $(TESTBOUND_SRC) $(LOCKVERIFY_SRC) $(PKTVIEW_SRC) \
        $(MEMSTATS_SRC) $(CHECKCONF_SRC) $(LIBUNBOUND_SRC) $(HOST_SRC) \
        $(ASYNCLOOK_SRC) $(STREAMTCP_SRC) $(PERF_SRC) $(DELAYER_SRC) \
-       $(CONTROL_SRC) $(UBANCHOR_SRC) $(PETAL_SRC) \
+       $(CONTROL_SRC) $(UBANCHOR_SRC) $(PETAL_SRC) $(DNSTAP_SOCKET_SRC)\
        $(PYTHONMOD_SRC) $(PYUNBOUND_SRC) $(WIN_DAEMON_THE_SRC) \
        $(SVCINST_SRC) $(SVCUNINST_SRC) $(ANCHORUPD_SRC) $(SLDNS_SRC)
 
@@ -267,7 +278,7 @@ ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \
        $(TESTBOUND_OBJ) $(LOCKVERIFY_OBJ) $(PKTVIEW_OBJ) \
        $(MEMSTATS_OBJ) $(CHECKCONF_OBJ) $(LIBUNBOUND_OBJ) $(HOST_OBJ) \
        $(ASYNCLOOK_OBJ) $(STREAMTCP_OBJ) $(PERF_OBJ) $(DELAYER_OBJ) \
-       $(CONTROL_OBJ) $(UBANCHOR_OBJ) $(PETAL_OBJ) \
+       $(CONTROL_OBJ) $(UBANCHOR_OBJ) $(PETAL_OBJ) $(DNSTAP_SOCKET_OBJ)\
        $(COMPAT_OBJ) $(PYUNBOUND_OBJ) \
        $(SVCINST_OBJ) $(SVCUNINST_OBJ) $(ANCHORUPD_OBJ) $(SLDNS_OBJ)
 
@@ -306,6 +317,7 @@ rsrc_unbound_checkconf.o:   $(srcdir)/winrc/rsrc_unbound
 TEST_BIN=asynclook$(EXEEXT) delayer$(EXEEXT) \
        lock-verify$(EXEEXT) memstats$(EXEEXT) perf$(EXEEXT) \
        petal$(EXEEXT) pktview$(EXEEXT) streamtcp$(EXEEXT) \
+       unbound-dnstap-socket$(EXEEXT) \
        testbound$(EXEEXT) unittest$(EXEEXT)
 tests: all $(TEST_BIN)
 
@@ -315,7 +327,7 @@ longcheck: longtest
 test:  unittest$(EXEEXT) testbound$(EXEEXT)
        ./unittest$(EXEEXT)
        ./testbound$(EXEEXT) -s
-       for x in $(srcdir)/testdata/*.rpl; do echo -n "$$x "; if 
./testbound$(EXEEXT) -p $$x >/dev/null 2>&1; then echo OK; else echo failed; 
exit 1; fi done
+       for x in $(srcdir)/testdata/*.rpl; do printf "%s" "$$x "; if 
./testbound$(EXEEXT) -p $$x >/dev/null 2>&1; then echo OK; else echo failed; 
exit 1; fi done
        @echo test OK
 
 longtest:      tests
@@ -328,13 +340,13 @@ libunbound.la:    $(LIBUNBOUND_OBJ_LINK)
        $(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) -rpath $(libdir) 
$(SSLLIB) $(LIBS)
 
 unbound$(EXEEXT):      $(DAEMON_OBJ_LINK) libunbound.la
-       $(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 unbound-checkconf$(EXEEXT):    $(CHECKCONF_OBJ_LINK) libunbound.la
-       $(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 unbound-control$(EXEEXT):      $(CONTROL_OBJ_LINK) libunbound.la
-       $(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 unbound-host$(EXEEXT): $(HOST_OBJ_LINK) libunbound.la
        $(LINK) -o $@ $(HOST_OBJ_LINK) -L. -L.libs -lunbound $(SSLLIB) $(LIBS)
@@ -352,34 +364,34 @@ anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ_LINK) libunbo
        $(LINK) -o $@ $(ANCHORUPD_OBJ_LINK) -L. -L.libs -lunbound $(LIBS)
 
 unittest$(EXEEXT):     $(UNITTEST_OBJ_LINK)
-       $(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 testbound$(EXEEXT):    $(TESTBOUND_OBJ_LINK)
-       $(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 lock-verify$(EXEEXT):  $(LOCKVERIFY_OBJ_LINK)
-       $(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 petal$(EXEEXT):        $(PETAL_OBJ_LINK)
        $(LINK) -o $@ $(PETAL_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 pktview$(EXEEXT):      $(PKTVIEW_OBJ_LINK)
-       $(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 memstats$(EXEEXT):     $(MEMSTATS_OBJ_LINK)
-       $(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 asynclook$(EXEEXT):    $(ASYNCLOOK_OBJ_LINK) libunbound.la
        $(LINK) -o $@ $(ASYNCLOOK_OBJ_LINK) -L. -L.libs -lunbound $(SSLLIB) 
$(LIBS)
 
 streamtcp$(EXEEXT):    $(STREAMTCP_OBJ_LINK)
-       $(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 perf$(EXEEXT): $(PERF_OBJ_LINK)
-       $(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
 
 delayer$(EXEEXT):      $(DELAYER_OBJ_LINK)
-       $(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS)
+       $(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
 
 signit$(EXEEXT):       testcode/signit.c
        $(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ -o $@ 
testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)
@@ -401,7 +413,13 @@ dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h: $(srcdir)/d
        @-if test ! -d dnstap; then $(INSTALL) -d dnstap; fi
        $(PROTOC_C) --c_out=. --proto_path=$(srcdir) 
$(srcdir)/dnstap/dnstap.proto
 
+unbound-dnstap-socket$(EXEEXT):        $(DNSTAP_SOCKET_OBJ_LINK)
+       $(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SSLLIB) $(LIBS) 
$(DYNLIBMOD_EXTRALIBS)
+
 dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h
+dtstream.lo dtstream.o: $(srcdir)/dnstap/dtstream.c config.h 
$(srcdir)/dnstap/dtstream.h
+dnstap_fstrm.lo dnstap_fstrm.o: $(srcdir)/dnstap/dnstap_fstrm.c config.h 
$(srcdir)/dnstap/dnstap_fstrm.h
+unbound-dnstap-socket.lo unbound-dnstap-socket.o: 
$(srcdir)/dnstap/unbound-dnstap-socket.c config.h $(srcdir)/dnstap/dtstream.h
 
 # dnscrypt
 dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
@@ -455,6 +473,7 @@ clean:
        rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) 
unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup 
libunbound.la unbound.h
        rm -f $(ALL_SRC:.c=.lint)
        rm -f _unbound.la libunbound/python/libunbound_wrap.c 
libunbound/python/unbound.py pythonmod/interface.h pythonmod/unboundmodule.py
+       rm -f libunbound.a
        rm -rf autom4te.cache .libs build doc/html doc/xml
 
 distclean: clean
@@ -629,6 +648,7 @@ depend:
                        -e 
's?$$(srcdir)/pythonmod/pythonmod.h?$$(PYTHONMOD_HEADER)?g' \
                        -e 's?$$(srcdir)/edns-subnet/subnetmod.h 
$$(srcdir)/edns-subnet/subnet-whitelist.h $$(srcdir)/edns-subnet/edns-subnet.h 
$$(srcdir)/edns-subnet/addrtree.h?$$(SUBNET_HEADER)?g' \
                        -e 's?$$(srcdir)/ipsecmod/ipsecmod.h 
$$(srcdir)/ipsecmod/ipsecmod-whitelist.h?$$(IPSECMOD_HEADER)?g' \
+                       -e 
's?$$(srcdir)/dynlibmod/dynlibmod.h?$$(DYNLIBMOD_HEADER)?g' \
                        -e 's!\(.*\)\.o[ :]*!\1.lo \1.o: !g' \
                        > $(DEPEND_TMP)
        cp $(DEPEND_TARGET) $(DEPEND_TMP2)
@@ -796,12 +816,13 @@ modstack.lo modstack.o: $(srcdir)/services/modstack.c 
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h 
$(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h 
$(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/fptr_wlist.h 
$(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/rpz.h 
$(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h 
$(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h 
$(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h 
$(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h 
$(srcdir)/validator/val_utils.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h 
$(srcdir)/dns64/dns64.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h 
$(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/respip/respip.h 
$(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h 
$(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/edns-subnet/addrtree.h 
$(srcdir)/edns-subnet/edns-subnet.h \
+ $(srcdir)/ipset/ipset.h $(srcdir)/dynlibmod/dynlibmod.h
 view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h 
$(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/localzone.h 
$(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h 
$(srcdir)/util/data/msgreply.h \
@@ -886,21 +907,23 @@ authzone.lo authzone.o: $(srcdir)/services/authzone.c 
  $(srcdir)/validator/val_secalgo.h
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h 
$(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h 
$(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h 
$(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h 
$(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h 
$(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h 
$(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h 
$(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h 
$(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/outside_network.h  $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h 
$(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h 
$(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h 
$(srcdir)/validator/val_anchor.h \
- $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_sigcrypt.h 
$(srcdir)/validator/val_kentry.h \
- $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h 
$(srcdir)/libunbound/libworker.h \
- $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h 
$(srcdir)/libunbound/unbound-event.h \
- $(srcdir)/libunbound/worker.h
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h 
$(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h 
$(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h 
$(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h 
$(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
+ $(srcdir)/services/outside_network.h  $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h 
$(srcdir)/services/authzone.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h 
$(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h 
$(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h 
$(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h 
$(srcdir)/validator/val_nsec3.h \
+ $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h 
$(srcdir)/validator/val_neg.h \
+ $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h 
$(srcdir)/libunbound/context.h \
+ $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h 
$(srcdir)/libunbound/unbound-event.h \
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h 
$(srcdir)/util/config_file.h $(srcdir)/respip/respip.h \
+ $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h 
$(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/net_help.h \
+ $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h 
$(srcdir)/ipset/ipset.h \
+ $(srcdir)/dynlibmod/dynlibmod.h
 locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h 
$(srcdir)/util/log.h
 log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h 
$(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
 mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h 
$(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
@@ -1108,7 +1131,32 @@ respip.lo respip.o: $(srcdir)/respip/respip.c config.h
  $(srcdir)/util/regional.h
 checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h 
$(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/checklocks.h
+dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h 
$(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h 
$(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/locks.h $(srcdir)/dnstap/dnstap.h \
+ dnstap/dnstap.pb-c.h
+dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h \
+ 
+dynlibmod.lo dynlibmod.o: $(srcdir)/dynlibmod/dynlibmod.c config.h 
$(srcdir)/dynlibmod/dynlibmod.h \
+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h 
$(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h 
$(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h\
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/fptr_wlist.h 
$(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h 
$(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h 
$(srcdir)/sldns/wire2str.h
+dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h 
$(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h 
$(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h 
$(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/storage/lookup3.h
 ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h
+ipset.lo ipset.o: $(srcdir)/ipset/ipset.c config.h $(srcdir)/ipset/ipset.h 
$(srcdir)/util/module.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h 
$(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h 
$(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h 
$(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h 
$(srcdir)/sldns/parseutil.h
 ipsecmod-whitelist.lo ipsecmod-whitelist.o: 
$(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h
 unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h 
$(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h 
$(srcdir)/testcode/unitmain.h \

Copied: head/contrib/unbound/README-Travis.md (from r364468, 
vendor/unbound/dist/README-Travis.md)
==============================================================================
--- /dev/null   00:00:00 1970   (empty, because file is newly added)
+++ head/contrib/unbound/README-Travis.md       Mon Aug 24 18:14:04 2020        
(r364721, copy of r364468, vendor/unbound/dist/README-Travis.md)
@@ -0,0 +1,278 @@
+# Travis Testing
+
+Unbound 1.10 and above leverage Travis CI to increase coverage of compilers 
and platforms. Compilers include Clang and GCC; while platforms include 
Android, iOS, Linux, and OS X on AMD64, Aarch64, PowerPC and s390x hardware.
+
+Android is tested on armv7a, aarch64, x86 and x86_64. The Android recipes 
build and install OpenSSL and Expat, and then builds Unbound. The testing is 
tailored for Android NDK-r19 and above, and includes NDK-r20 and NDK-r21. Mips 
and Mips64 are not tested because they are no longer supported under current 
NDKs.
+
+iOS is tested for iPhoneOS, WatchOS, AppleTVOS, iPhoneSimulator, 
AppleTVSimulator and WatchSimulator. The testing uses Xcode 10 on OS X 10.13.
+
+The Unbound Travis configuration file `.travis.yml` does not use top-level 
keys like `os:` and `compiler:` so there is no matrix expansion. Instead 
Unbound specifies the exact job to run under the `jobs:` and `include:` keys.
+
+## Typical recipe
+
+A typical recipe tests Clang and GCC on various hardware. The hardware 
includes AMD64, Aarch64, PowerPC and s390x. PowerPC is a little-endian 
platform, and s390x is a big-endian platform. There are pairs of recipes that 
are similar to the following.
+
+```
+- os: linux
+  name: GCC on Linux, Aarch64
+  compiler: gcc
+  arch: arm64
+  dist: bionic
+- os: linux
+  name: Clang on Linux, Aarch64
+  compiler: clang
+  arch: arm64
+  dist: bionic
+```
+
+OS X provides a single recipe to test Clang. GCC is not tested because GCC is 
an alias for Clang.
+
+## Sanitizer builds
+
+Two sanitizer builds are tested using Clang and GCC, for a total of four 
builds. The first sanitizer is Undefined Behavior sanitizer (UBsan), and the 
second is Address sanitizer (Asan). The sanitizers are only run on AMD64 
hardware. Note the environment includes `TEST_UBSAN=yes` or `TEST_ASAN=yes` for 
the sanitizer builds.
+
+The recipes are similar to the following.
+
+```
+- os: linux
+  name: UBsan, GCC on Linux, Amd64
+  compiler: gcc
+  arch: amd64
+  dist: bionic
+  env: TEST_UBSAN=yes
+- os: linux
+  name: UBsan, Clang on Linux, Amd64
+  compiler: clang
+  arch: amd64
+  dist: bionic
+  env: TEST_UBSAN=yes
+```
+
+When the Travis script encounters a sanitizer it uses different `CFLAGS` and 
configuration string.
+
+```
+if [ "$TEST_UBSAN" = "yes" ]; then
+  export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=undefined -fno-sanitize-recover"
+  ./configure
+  make -j 2
+  make test
+elif [ "$TEST_ASAN" = "yes" ]; then
+  export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address"
+  ./configure
+  make -j 2
+  make test
+...
+```
+
+## Android builds
+
+Travis tests Android builds for the armv7a, aarch64, x86 and x86_64 
architectures. The builds are trickier than other builds for several reasons. 
The testing requires installation of the Android NDK and SDK, it requires a 
cross-compile, and requires OpenSSL and Expat prerequisites. The Android 
cross-compiles also require care to set the Autotools triplet, the OpenSSL 
triplet, the toolchain path, the tool variables, and the sysroot. The 
discussion below detail the steps of the Android recipes.
+
+### Android job
+
+The first step sets environmental variables for the cross-compile using the 
Travis job. A typical job with variables is shown below.
+
+```
+- os: linux
+  name: Android armv7a, Linux, Amd64
+  compiler: clang
+  arch: amd64
+  dist: bionic
+  env:
+    - TEST_ANDROID=yes
+    - AUTOTOOLS_HOST=armv7a-linux-androideabi
+    - OPENSSL_HOST=android-arm
+    - ANDROID_CPU=armv7a
+    - ANDROID_API=23
+    - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
+    - ANDROID_SDK_ROOT="$HOME/android-sdk"
+    - ANDROID_NDK_ROOT="$HOME/android-ndk"
+```
+
+### ANDROID_NDK_ROOT
+
+The second step for Android is to set the environmental variables 
`ANDROID_NDK_ROOT` and `ANDROID_SDK_ROOT`. This is an important step because 
the NDK and SDK use the variables internally to locate their own tools. Also 
see [Recommended NDK 
Directory?](https://groups.google.com/forum/#!topic/android-ndk/qZjhOaynHXc) on 
the android-ndk mailing list. (Many folks miss this step, or use incorrect 
variables like `ANDROID_NDK_HOME` or `ANDROID_SDK_HOME`).
+
+If you are working from a developer machine you probably already have the 
necessary tools installed. You should ensure `ANDROID_NDK_ROOT` and 
`ANDROID_SDK_ROOT` are set properly.
+
+### Tool installation
+
+The second step installs tools needed for OpenSSL, Expat and Unbound. This 
step is handled in by the script `contrib/android/install_tools.sh`. The tools 
include curl, tar, zip, unzip and java.
+
+```
+before_script:
+  - |
+    if [ "$TEST_ANDROID" = "yes" ]; then
+      ./contrib/android/install_tools.sh
+    elif [ "$TEST_IOS" = "yes" ]; then
+      ./contrib/ios/install_tools.sh
+    fi
+```
+
+### NDK installation
+
+The third step installs the NDK and SDK. This step is handled in by the script 
`contrib/android/install_ndk.sh`. The script uses `ANDROID_NDK_ROOT` and 
`ANDROID_SDK_ROOT` to place the NDK and SDK in the `$HOME` directory.
+
+If you are working from a developer machine you probably already have a NDK 
and SDK installed.
+
+### Android environment
+
+The fourth step sets the Android cross-compile environment using the script 
`contrib/android/setenv_android.sh`. The script is `sourced` so the variables 
in the script are available to the calling shell. The script sets variables 
like `CC`, `CXX`, `AS` and `AR`; sets `CFLAGS` and `CXXFLAGS`; sets a `sysroot` 
so Android headers and libraries are found; and adds the path to the toolchain 
to `PATH`.
+
+`contrib/android/setenv_android.sh` knows which toolchain and architecture to 
select by inspecting environmental variables set by Travis for the job. In 
particular, the variables `ANDROID_CPU` and `ANDROID_API` tell 
`contrib/android/setenv_android.sh` which tools and libraries to select.
+
+The `contrib/android/setenv_android.sh` script specifies the tools in a `case` 
statement like the following. There is a case for each of the architectures 
armv7a, aarch64, x86 and x86_64.
+
+```
+armv8a|aarch64|arm64|arm64-v8a)
+  CC="aarch64-linux-android$ANDROID_API-clang"
+  CXX="aarch64-linux-android$ANDROID_API-clang++"
+  LD="aarch64-linux-android-ld"
+  AS="aarch64-linux-android-as"
+  AR="aarch64-linux-android-ar"
+  RANLIB="aarch64-linux-android-ranlib"
+  STRIP="aarch64-linux-android-strip"
+
+  CFLAGS="-funwind-tables -fexceptions"
+  CXXFLAGS="-funwind-tables -fexceptions -frtti"
+```
+
+### OpenSSL and Expat
+
+The fifth step builds OpenSSL and Expat. OpenSSL and Expat are built for 
Android using the scripts `contrib/android/install_openssl.sh` and 
`contrib/android/install_expat.sh`. The scripts download, configure and install 
the latest release version of the libraries. The libraries are configured with 
`--prefix="$ANDROID_PREFIX"` so the headers are placed in 
`$ANDROID_PREFIX/include` directory, and the libraries are placed in the 
`$ANDROID_PREFIX/lib` directory.
+
+`ANDROID_PREFIX` is the value `$HOME/android$ANDROID_API-$ANDROID_CPU`. The 
libraries will be installed in `$HOME/android23-armv7a`, 
`$HOME/android23-aarch64`, etc. For Autotools projects, the appropriate 
`PKG_CONFIG_PATH` is exported. `PKG_CONFIG_PATH` is the userland equivalent to 
sysroot, and allows Autotools to find non-system headers and libraries for an 
architecture. Typical `PKG_CONFIG_PATH` are 
`$HOME/android23-armv7a/lib/pkgconfig` and 
`$HOME/android23-aarch64/lib/pkgconfig`.
+
+OpenSSL also uses a custom configuration file called `15-android.conf`. It is 
a copy of the OpenSSL's project file and located at 
`contrib/android/15-android.conf`. The Unbound version is copied to the OpenSSL 
source files after unpacking the OpenSSL distribution. The Unbound version has 
legacy NDK support removed and some other fixes, like `ANDROID_NDK_ROOT` 
awareness. The changes mean Unbound's `15-android.conf` will only work with 
Unbound, with NDK-r19 and above, and a properly set environment.
+
+OpenSSL is configured with `no-engine`. If you want to include OpenSSL engines 
then edit `contrib/android/install_openssl.sh` and remove the config option.
+
+### Android build
+
+Finally, once OpenSSL and Expat are built, then the Travis script configures 
and builds Unbound. The recipe looks as follows.
+
+```
+elif [ "$TEST_ANDROID" = "yes" ]; then
+  export AUTOTOOLS_BUILD="$(./config.guess)"
+  export PKG_CONFIG_PATH="$ANDROID_PREFIX/lib/pkgconfig"
+  ./contrib/android/install_ndk.sh
+  source ./contrib/android/setenv_android.sh
+  ./contrib/android/install_openssl.sh
+  ./contrib/android/install_expat.sh
+  ./configure \
+    --build="$AUTOTOOLS_BUILD" \
+    --host="$AUTOTOOLS_HOST" \
+    --prefix="$ANDROID_PREFIX" \
+    --with-ssl="$ANDROID_PREFIX" \
+    --with-libexpat="$ANDROID_PREFIX" \
+    --disable-gost;
+  make -j 2
+  make install
+```
+
+Travis only smoke tests an Android build using a compile, link and install. 
The self tests are not run. TODO: figure out how to fire up an emulator, push 
the tests to the device and run them.
+
+### Android flags
+
+`contrib/android/setenv_android.sh` uses specific flags for `CFLAGS` and 
`CXXFLAGS`. They are taken from `ndk-build`, so we consider them the official 
flag set. It is important to use the same flags across projects to avoid subtle 
problems due to mixing and matching different flags.
+
+`CXXFLAGS` includes `-fexceptions` and `-frtti` because exceptions and runtime 
type info are disabled by default. `CFLAGS` include `-funwind-tables` and 
`-fexceptions` to ensure C++ exceptions pass through C code, if needed. Also 
see `docs/CPLUSPLUS-SUPPORT.html` in the NDK docs.
+
+To inspect the flags used by `ndk-build` for a platform clone ASOP's 
[ndk-samples](https://github.com/android/ndk-samples/tree/master/hello-jni) and 
build the `hello-jni` project. Use the `V=1` flag to see the full compiler 
output from `ndk-build`.
+
+## iOS builds
+
+Travis tests iOS builds for the armv7a, armv7s and aarch64 architectures for 
iPhoneOS, AppleTVOS and WatchOS. iPhoneOS is tested using both 32-bit builds 
(iPhones) and 64-bit builds (iPads). Travis also tests compiles against the 
simulators. The builds are trickier than other builds for several reasons. The 
testing requires a cross-compile, and requires OpenSSL and Expat prerequisites. 
The iOS cross-compiles also require care to set the Autotools triplet, the 
OpenSSL triplet, the toolchain path, the tool variables, and the sysroot. The 
discussion below detail the steps of the iOS recipes.
+
+### iOS job
+
+The first step sets environmental variables for the cross-compile using the 
Travis job. A typical job with variables is shown below.
+
+```
+- os: osx
+  osx_image: xcode10
+  name: Apple iPhone on iOS, armv7
+  compiler: clang
+  env:
+    - TEST_IOS=yes
+    - AUTOTOOLS_HOST=armv7-apple-ios
+    - OPENSSL_HOST=ios-cross
+    - IOS_SDK=iPhoneOS
+    - IOS_CPU=armv7s
+    - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+```
+
+### Tool installation
+
+The second step installs tools needed for OpenSSL, Expat and Unbound. This 
step is handled in by the script `contrib/ios/install_tools.sh`. The tools 
include autotools, curl and perl. The installation happens at the 
`before_script:` stage of Travis.
+
+```
+before_script:
+  - |
+    if [ "$TEST_ANDROID" = "yes" ]; then
+      ./contrib/android/install_tools.sh
+    elif [ "$TEST_IOS" = "yes" ]; then
+      ./contrib/ios/install_tools.sh
+    fi
+```
+
+### iOS environment
+
+The third step sets the iOS cross-compile environment using the script 
`contrib/ios/setenv_ios.sh`. The script is `sourced` so the variables in the 
script are available to the calling shell. The script sets variables like `CC`, 
`CXX`, `AS` and `AR`; sets `CFLAGS` and `CXXFLAGS`; sets a `sysroot` so iOS 
headers and libraries are found; and adds the path to the toolchain to `PATH`.
+
+`contrib/ios/setenv_ios.sh` knows which toolchain and architecture to select 
by inspecting environmental variables set by Travis for the job. In particular, 
the variables `IOS_SDK` and `IOS_CPU` tell `contrib/ios/setenv_ios.sh` which 
tools and libraries to select.
+
+The `contrib/ios/setenv_ios.sh` script specifies the tools to use during the 
cross-compile. For Apple SDKs, the tool names are the same as a desktop. There 
are no special prefixes for the mobile tools.
+
+```
+CPP=cpp
+CC=clang
+CXX=clang++
+LD=ld
+AS=as
+AR=ar
+RANLIB=ranlib
+STRIP=strip
+```
+
+If you are working from a developer machine you probably already have the 
necessary tools installed.
+
+### OpenSSL and Expat
+
+The fourth step builds OpenSSL and Expat. OpenSSL and Expat are built for iOS 
using the scripts `contrib/ios/install_openssl.sh` and 
`contrib/ios/install_expat.sh`. The scripts download, configure and install the 
latest release version of the libraries. The libraries are configured with 
`--prefix="$IOS_PREFIX"` so the headers are placed in `$IOS_PREFIX/include` 
directory, and the libraries are placed in the `$IOS_PREFIX/lib` directory.
+
+`IOS_PREFIX` is the value `$HOME/$IOS_SDK-$IOS_CPU`. The scheme handles both 
iOS SDKs and cpu architectures so the pair recieves a unique installation 
directory. The libraries will be installed in `$HOME/iPhoneOS-armv7s`, 
`$HOME/iPhoneOS-arm64`, `$HOME/iPhoneSimulator-i386`, etc. For Autotools 
projects, the appropriate `PKG_CONFIG_PATH` is exported.
+
+`PKG_CONFIG_PATH` is an important variable. It is the userland equivalent to 
sysroot, and allows Autotools to find non-system headers and libraries for an 
architecture. Typical `PKG_CONFIG_PATH` are 
`$HOME/iPhoneOS-armv7s/lib/pkgconfig` and `$HOME/iPhoneOS-arm64/lib/pkgconfig`.
+
+OpenSSL also uses a custom configuration file called `15-ios.conf`. It is a 
copy of the OpenSSL's project file and located at `contrib/ios/15-ios.conf`. 
The Unbound version is copied to the OpenSSL source files after unpacking the 
OpenSSL distribution. The changes mean Unbound's `15-ios.conf` will only work 
with Unbound and a properly set environment.
+
+OpenSSL is configured with `no-engine`. Engines require dynamic loading so 
engines are disabled permanently in `15-ios.conf`.
+
+### iOS build
+
+Finally, once OpenSSL and Expat are built, then the Travis script configures 
and builds Unbound. The full recipe looks as follows.
+
+```
+elif [ "$TEST_IOS" = "yes" ]; then
+  export AUTOTOOLS_BUILD="$(./config.guess)"
+  export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"
+  source ./contrib/ios/setenv_ios.sh
+  ./contrib/ios/install_openssl.sh
+  ./contrib/ios/install_expat.sh
+  ./configure \
+    --build="$AUTOTOOLS_BUILD" \
+    --host="$AUTOTOOLS_HOST" \
+    --prefix="$IOS_PREFIX" \
+    --with-ssl="$IOS_PREFIX" \
+    --with-libexpat="$IOS_PREFIX" \
+    --disable-gost;
+  make -j 2
+  make install
+```
+
+Travis only smoke tests an iOS build using a compile, link and install. The 
self tests are not run. TODO: figure out how to fire up an simulator, push the 
tests to the device and run them.
+
+### iOS flags
+
+`contrib/ios/setenv_ios.sh` uses specific flags for `CFLAGS` and `CXXFLAGS`. 
They are taken from Xcode, so we consider them the official flag set. It is 
important to use the same flags across projects to avoid subtle problems due to 
mixing and matching different flags.

Modified: head/contrib/unbound/acx_python.m4
==============================================================================
--- head/contrib/unbound/acx_python.m4  Mon Aug 24 18:13:44 2020        
(r364720)
+++ head/contrib/unbound/acx_python.m4  Mon Aug 24 18:14:04 2020        
(r364721)
@@ -58,6 +58,11 @@ $ac_distutils_result])
         AC_MSG_RESULT([$PYTHON_LDFLAGS])
         AC_SUBST([PYTHON_LDFLAGS])
 
+        if test -z "$PYTHON_LIBDIR"; then
+                PYTHON_LIBDIR=`$PYTHON -c "from distutils.sysconfig import *; \
+                        print(get_config_var('LIBDIR'));"`
+        fi
+
         #
         # Check for site packages
         #

Modified: head/contrib/unbound/cachedb/cachedb.c
==============================================================================
--- head/contrib/unbound/cachedb/cachedb.c      Mon Aug 24 18:13:44 2020        
(r364720)
+++ head/contrib/unbound/cachedb/cachedb.c      Mon Aug 24 18:14:04 2020        
(r364721)
@@ -160,7 +160,7 @@ testframe_lookup(struct module_env* env, struct cached
 
 static void
 testframe_store(struct module_env* env, struct cachedb_env* cachedb_env,
-       char* key, uint8_t* data, size_t data_len)
+       char* key, uint8_t* data, size_t data_len, time_t ATTR_UNUSED(ttl))
 {
        struct testframe_moddata* d = (struct testframe_moddata*)
                cachedb_env->backend_data;
@@ -606,7 +606,8 @@ cachedb_extcache_store(struct module_qstate* qstate, s
        /* call backend */
        (*ie->backend->store)(qstate->env, ie, key,
                sldns_buffer_begin(qstate->env->scratch_buffer),
-               sldns_buffer_limit(qstate->env->scratch_buffer));
+               sldns_buffer_limit(qstate->env->scratch_buffer),
+               qstate->return_msg->rep->ttl);
 }
 
 /**

Modified: head/contrib/unbound/cachedb/cachedb.h
==============================================================================
--- head/contrib/unbound/cachedb/cachedb.h      Mon Aug 24 18:13:44 2020        
(r364720)
+++ head/contrib/unbound/cachedb/cachedb.h      Mon Aug 24 18:14:04 2020        
(r364721)
@@ -84,7 +84,7 @@ struct cachedb_backend {
        
        /** Store (env, cachedb_env, key, data, data_len) */
        void (*store)(struct module_env*, struct cachedb_env*, char*,
-               uint8_t*, size_t);
+               uint8_t*, size_t, time_t);
 };
 
 #define CACHEDB_HASHSIZE 256 /* bit hash */

Modified: head/contrib/unbound/cachedb/redis.c
==============================================================================
--- head/contrib/unbound/cachedb/redis.c        Mon Aug 24 18:13:44 2020        
(r364720)
+++ head/contrib/unbound/cachedb/redis.c        Mon Aug 24 18:14:04 2020        
(r364721)
@@ -59,6 +59,9 @@ struct redis_moddata {
        struct timeval timeout;  /* timeout for connection setup and commands */
 };
 
+static redisReply* redis_command(struct module_env*, struct cachedb_env*,
+       const char*, const uint8_t*, size_t);
+
 static redisContext*
 redis_connect(const struct redis_moddata* moddata)
 {
@@ -114,6 +117,33 @@ redis_init(struct module_env* env, struct cachedb_env*
        for(i = 0; i < moddata->numctxs; i++)
                moddata->ctxs[i] = redis_connect(moddata);
        cachedb_env->backend_data = moddata;
+       if(env->cfg->redis_expire_records) {
+               redisReply* rep = NULL;
+               int redis_reply_type = 0;
+               /** check if setex command is supported */
+               rep = redis_command(env, cachedb_env,
+                       "SETEX __UNBOUND_REDIS_CHECK__ 1 none", NULL, 0);
+               if(!rep) {
+                       /** init failed, no response from redis server*/
+                       log_err("redis_init: failed to init redis, the "

*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"

Reply via email to