From 70febee658b78b76d618dd0de67a1902a1f354af Mon Sep 17 00:00:00 2001
From: Peter Conrad <cyrano@quisquis.de>
Date: Wed, 14 Oct 2020 16:41:24 +0200
Subject: [PATCH 1/4] Added testcase for duplicate NSEC3 RRs in response

---
 test/a-49 |  7 +++++++
 test/data | 15 +++++++++++++++
 test/q-49 |  2 ++
 3 files changed, 24 insertions(+)
 create mode 100644 test/a-49
 create mode 100644 test/q-49

diff --git a/test/a-49 b/test/a-49
new file mode 100644
index 0000000..823507d
--- /dev/null
+++ b/test/a-49
@@ -0,0 +1,7 @@
+<SIZE> bytes, 1+0+4+1 records, response, authoritative, nxdomain
+query: A kyle.dnssec.vip
+authority: dnssec.vip 3600 SOA ns1.dnssec.vip root.dnssec.vip <TIME> 3600 300 3600000 3600
+authority: dnssec.vip 3600 RRSIG SOA 7 2 3600 <TIME> <TIME> 44495 dnssec.vip <SIG>
+authority: tvf7qha0g0bkodf3aqmobmg02fnq7fd9.dnssec.vip 3600 NSEC3 1 0 1 AABBCCDDEEFF nhevdbebnkql94o57238pse2mi7dci9q A NS SOA MX RRSIG DNSKEY NSEC3PARAM
+authority: tvf7qha0g0bkodf3aqmobmg02fnq7fd9.dnssec.vip 3600 RRSIG NSEC3 7 3 3600 <TIME> <TIME> 44495 dnssec.vip <SIG>
+additional: . 0 OPT 512 0 0 8000
diff --git a/test/data b/test/data
index b787748..5287d25 100644
--- a/test/data
+++ b/test/data
@@ -89,3 +89,18 @@ Zbug-202005.xx:ns1.bug-202005.xx:bugs.bug-202005.xx:1081539377:3600:300:3600000:
 
 +*.bug-202005.xx:1.2.3.4
 +www.bug-202005.xx:1.2.3.5
+
+# dnssec.vip zone
+Zdnssec.vip:ns1.dnssec.vip:root.dnssec.vip:1081539377:3600:300:3600000:3600:3600::
+&dnssec.vip:192.0.2.1:ns1.dnssec.vip:3600
+&dnssec.vip:192.0.2.2:ns2.dnssec.vip:3600
+@dnssec.vip::aspmx.l.google.com:1:3600
+#Kdnssec.vip:256:3:7:AwEAAZvSuWicF6oQ8QarGTQ84GDgYD3c12nrz/K2PQ98eCy0SKOZ+p4662QxkUGTmrxoUSGVlPp2arYXNs5AVf+ggt9zpb+ZSLV18Z152kAA6iHXVrwTbUZX1Eg4IqxzrSX2/jqs2dqQF7dDZcNV7xNpKfKDTW5J5d7vbkhcM8/xxb1p:3600::
+#Kdnssec.vip:257:3:7:AwEAAdBi/kUytR/v7iW9h9qsgtuj5BSDEvE5djja8UEdFLqThQEJ0bnptExEoS8acYQYhLiufAEfp7no0bV2wcS6jR9cIRS0iZ/NNaPeG04U9HDz1VXiZ9xIsifw6feJlHEUAWMxtq7KF2Kyn3jOz05o08zk5XcIQnBDZiPw96bQfDlxMiM8umPWh8iZa6VmzQJ9bbouyoAppm/9O+ha7lCdMUbvIcKLoYVaVyK+pI2vHH4RaqrGUcposqi4hzJzOZvCU5FtJ+4uWGV+rleTmgR+YWS1gwfbNtaGIQacCAcSDA184TwKuUmHoHdBcrond7eyZGMVbKTbQ/MpiRI56uHd2bxqurBc6NmEsG9r3IZs+TsTvnkQVPksho39gcifpt/NKJ0uN01ZNUUvWQIZREm1UB/uR2hFWJ1hCvPkI08B5AbxIeRc8cb864PJHw2zye0wi6Ey0CHJK04KZLU+f6s80v7TsWmy/1gIMQMrDmiClkJQ/oFddCgisi/SgGbiaIkm5HUgEzBkTnZRluWwgZHVmJHI9I1Vwnyh3NReJo0IIRE90QGrOzA9l/op938f96E1ucFze28OzffhuLCQmmsrMXrKHnqg3K7vV+yk2v7vHec2GoKPuDwg5Lc6O1jOfx2AtoK0OC8Aj3XztynbzjdjJscxZr+C4JeN25pl8ilBT0Zp:3600::
+#Pdnssec.vip:1:0:1::aabbccddeeff:3600::
+
++dnssec.vip:10.10.10.10:3600
+
+&eu.dnssec.vip::ns1.dnssec.vip:3600
+&eu.dnssec.vip::ns2.dnssec.vip:3600
+#Deu.dnssec.vip:25431:13:2:9C1764AA937206F1395F2D3C84291D60E740A614CF09C0EF720F20E9463314FA:3600::
diff --git a/test/q-49 b/test/q-49
new file mode 100644
index 0000000..ed34f08
--- /dev/null
+++ b/test/q-49
@@ -0,0 +1,2 @@
+kyle. dnssec.vip a -s
+# Triplicate NSEC3 response

From 377cc7479ff01cf1000d7193819776b0fbcfe6fa Mon Sep 17 00:00:00 2001
From: Peter Conrad <cyrano@quisquis.de>
Date: Wed, 14 Oct 2020 17:32:07 +0200
Subject: [PATCH 2/4] Fix for duplicate NSEC3 responses

---
 djbdns-1.05-dnssec.patch | 299 ++++++++++++++++++++++-----------------
 1 file changed, 170 insertions(+), 129 deletions(-)

diff --git a/djbdns-1.05-dnssec.patch b/djbdns-1.05-dnssec.patch
index f2a53a1..136b239 100644
--- a/djbdns-1.05-dnssec.patch
+++ b/djbdns-1.05-dnssec.patch
@@ -12,9 +12,10 @@ GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-diff -rNU3 djbdns-1.05.tds-base/axfrdns.c djbdns-1.05.tinydnssec/axfrdns.c
---- djbdns-1.05.tds-base/axfrdns.c	2012-12-06 22:45:38.000000000 +0100
-+++ djbdns-1.05.tinydnssec/axfrdns.c	2012-12-06 22:39:13.000000000 +0100
+diff --git a/axfrdns.c b/axfrdns.c
+index 85723c9..9fd6f9c 100644
+--- a/axfrdns.c
++++ b/axfrdns.c
 @@ -23,6 +23,7 @@
  #include "response.h"
  #include "ip6.h"
@@ -23,7 +24,7 @@ diff -rNU3 djbdns-1.05.tds-base/axfrdns.c djbdns-1.05.tinydnssec/axfrdns.c
  
  extern int respond(char *,char *,char *);
  
-@@ -346,6 +347,9 @@
+@@ -346,6 +347,9 @@ int main()
      if (byte_diff(qclass,2,DNS_C_IN) && byte_diff(qclass,2,DNS_C_ANY))
        strerr_die2x(111,FATAL,"bogus query: bad class");
  
@@ -33,21 +34,23 @@ diff -rNU3 djbdns-1.05.tds-base/axfrdns.c djbdns-1.05.tinydnssec/axfrdns.c
      qlog(ip,port,header,zone,qtype," ");
  
      if (byte_equal(qtype,2,DNS_T_AXFR)) {
-diff -rNU3 djbdns-1.05.tds-base/base32hex.c djbdns-1.05.tinydnssec/base32hex.c
---- djbdns-1.05.tds-base/base32hex.c	1970-01-01 01:00:00.000000000 +0100
-+++ djbdns-1.05.tinydnssec/base32hex.c	2012-12-06 22:39:13.000000000 +0100
+diff --git a/base32hex.c b/base32hex.c
+new file mode 100644
+index 0000000..354c043
+--- /dev/null
++++ b/base32hex.c
 @@ -0,0 +1,79 @@
 +/* (C) 2012 Peter Conrad <conrad@quisquis.de>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 3 as
 + * published by the Free Software Foundation.
-+ * 
++ *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
-+ * 
++ *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
@@ -116,21 +119,23 @@ diff -rNU3 djbdns-1.05.tds-base/base32hex.c djbdns-1.05.tinydnssec/base32hex.c
 +}
 +
 +#endif
-diff -rNU3 djbdns-1.05.tds-base/base32hex.h djbdns-1.05.tinydnssec/base32hex.h
---- djbdns-1.05.tds-base/base32hex.h	1970-01-01 01:00:00.000000000 +0100
-+++ djbdns-1.05.tinydnssec/base32hex.h	2012-12-06 22:39:13.000000000 +0100
+diff --git a/base32hex.h b/base32hex.h
+new file mode 100644
+index 0000000..0ea92ab
+--- /dev/null
++++ b/base32hex.h
 @@ -0,0 +1,23 @@
 +/* (C) 2012 Peter Conrad <conrad@quisquis.de>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 3 as
 + * published by the Free Software Foundation.
-+ * 
++ *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
-+ * 
++ *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
@@ -143,9 +148,10 @@ diff -rNU3 djbdns-1.05.tds-base/base32hex.h djbdns-1.05.tinydnssec/base32hex.h
 +extern unsigned int base32hex(char *out, uint8_t *in, unsigned int len);
 +
 +#endif
-diff -rNU3 djbdns-1.05.tds-base/dns.h djbdns-1.05.tinydnssec/dns.h
---- djbdns-1.05.tds-base/dns.h	2012-12-06 22:45:38.000000000 +0100
-+++ djbdns-1.05.tinydnssec/dns.h	2012-12-06 22:39:13.000000000 +0100
+diff --git a/dns.h b/dns.h
+index 5398e2b..c9689a2 100644
+--- a/dns.h
++++ b/dns.h
 @@ -20,8 +20,17 @@
  #define DNS_T_SIG "\0\30"
  #define DNS_T_KEY "\0\31"
@@ -164,21 +170,23 @@ diff -rNU3 djbdns-1.05.tds-base/dns.h djbdns-1.05.tinydnssec/dns.h
  
  struct dns_transmit {
    char *query; /* 0, or dynamically allocated */
-diff -rNU3 djbdns-1.05.tds-base/edns0.c djbdns-1.05.tinydnssec/edns0.c
---- djbdns-1.05.tds-base/edns0.c	1970-01-01 01:00:00.000000000 +0100
-+++ djbdns-1.05.tinydnssec/edns0.c	2012-12-06 22:39:13.000000000 +0100
+diff --git a/edns0.c b/edns0.c
+new file mode 100644
+index 0000000..0505f06
+--- /dev/null
++++ b/edns0.c
 @@ -0,0 +1,45 @@
 +/* (C) 2012 Peter Conrad <conrad@quisquis.de>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 3 as
 + * published by the Free Software Foundation.
-+ * 
++ *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
-+ * 
++ *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
@@ -213,21 +221,23 @@ diff -rNU3 djbdns-1.05.tds-base/edns0.c djbdns-1.05.tinydnssec/edns0.c
 +  }
 +  return pos;
 +}
-diff -rNU3 djbdns-1.05.tds-base/edns0.h djbdns-1.05.tinydnssec/edns0.h
---- djbdns-1.05.tds-base/edns0.h	1970-01-01 01:00:00.000000000 +0100
-+++ djbdns-1.05.tinydnssec/edns0.h	2012-12-06 22:39:13.000000000 +0100
+diff --git a/edns0.h b/edns0.h
+new file mode 100644
+index 0000000..514bfd0
+--- /dev/null
++++ b/edns0.h
 @@ -0,0 +1,22 @@
 +/* (C) 2012 Peter Conrad <conrad@quisquis.de>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 3 as
 + * published by the Free Software Foundation.
-+ * 
++ *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
-+ * 
++ *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
@@ -239,10 +249,11 @@ diff -rNU3 djbdns-1.05.tds-base/edns0.h djbdns-1.05.tinydnssec/edns0.h
 +extern unsigned int check_edns0(const char *, const char *, const int, unsigned int);
 +
 +#endif
-diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
---- djbdns-1.05.tds-base/Makefile	2012-12-06 22:45:45.000000000 +0100
-+++ djbdns-1.05.tinydnssec/Makefile	2012-12-07 11:07:23.000000000 +0100
-@@ -53,10 +53,10 @@
+diff --git a/Makefile b/Makefile
+index a141bf8..fe27543 100644
+--- a/Makefile
++++ b/Makefile
+@@ -53,10 +53,10 @@ iopause.h taia.h tai.h uint64.h taia.h
  axfrdns: \
  load axfrdns.o iopause.o droproot.o tdlookup.o response.o qlog.o \
  prot.o timeoutread.o timeoutwrite.o clientloc.o dns.a libtai.a alloc.a env.a \
@@ -255,7 +266,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  
  axfrdns-conf: \
  load axfrdns-conf.o generic-conf.o auto_home.o buffer.a unix.a byte.a
-@@ -76,6 +76,10 @@
+@@ -76,6 +76,10 @@ dns.h stralloc.h iopause.h taia.h tai.h taia.h scan.h qlog.h uint16.h \
  response.h uint32.h clientloc.h
  	./compile axfrdns.c
  
@@ -266,7 +277,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  buffer.a: \
  makelib buffer.o buffer_1.o buffer_2.o buffer_copy.o buffer_get.o \
  buffer_put.o strerr_die.o strerr_sys.o
-@@ -454,10 +458,11 @@
+@@ -454,10 +458,11 @@ gen_alloc.h iopause.h taia.h tai.h uint64.h taia.h ip6.h
  
  dnsq: \
  load dnsq.o iopause.o printrecord.o printpacket.o parsetype.o dns.a \
@@ -280,7 +291,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  
  dnsq.o: \
  compile dnsq.c uint16.h strerr.h buffer.h scan.h str.h byte.h error.h \
-@@ -467,10 +472,11 @@
+@@ -467,10 +472,11 @@ gen_alloc.h parsetype.h dns.h stralloc.h iopause.h taia.h
  
  dnsqr: \
  load dnsqr.o iopause.o printrecord.o printpacket.o parsetype.o dns.a \
@@ -294,7 +305,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  
  dnsqr.o: \
  compile dnsqr.c uint16.h strerr.h buffer.h scan.h str.h byte.h \
-@@ -480,10 +486,10 @@
+@@ -480,10 +486,10 @@ gen_alloc.h parsetype.h dns.h stralloc.h iopause.h taia.h
  
  dnstrace: \
  load dnstrace.o dd.o iopause.o printrecord.o parsetype.o dns.a env.a \
@@ -307,7 +318,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  
  dnstrace.o: \
  compile dnstrace.c uint16.h uint32.h fmt.h str.h byte.h ip4.h \
-@@ -514,6 +520,10 @@
+@@ -514,6 +520,10 @@ droproot.o: \
  compile droproot.c env.h scan.h prot.h strerr.h
  	./compile droproot.c
  
@@ -318,7 +329,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  env.a: \
  makelib env.o
  	./makelib env.a env.o
-@@ -689,10 +699,10 @@
+@@ -689,10 +699,10 @@ iopause.h taia.h tai.h uint64.h taia.h uint16.h parsetype.h
  
  pickdns: \
  load pickdns.o server.o iopause.o response.o droproot.o qlog.o prot.o dns.a \
@@ -331,7 +342,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  
  pickdns-conf: \
  load pickdns-conf.o generic-conf.o auto_home.o buffer.a unix.a byte.a
-@@ -725,15 +735,19 @@
+@@ -725,15 +735,19 @@ response.h uint32.h
  printpacket.o: \
  compile printpacket.c uint16.h uint32.h error.h byte.h dns.h \
  stralloc.h gen_alloc.h iopause.h taia.h tai.h uint64.h taia.h \
@@ -353,7 +364,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  prog: \
  dnscache-conf dnscache walldns-conf walldns rbldns-conf rbldns \
  rbldns-data pickdns-conf pickdns pickdns-data tinydns-conf tinydns \
-@@ -767,10 +781,10 @@
+@@ -767,10 +781,10 @@ gen_alloc.h iopause.h taia.h tai.h uint64.h taia.h
  
  rbldns: \
  load rbldns.o server.o iopause.o response.o dd.o droproot.o qlog.o prot.o dns.a \
@@ -366,7 +377,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  
  rbldns-conf: \
  load rbldns-conf.o generic-conf.o auto_home.o buffer.a unix.a byte.a
-@@ -840,7 +854,7 @@
+@@ -840,7 +854,7 @@ server.o: \
  compile server.c byte.h case.h env.h buffer.h strerr.h ip4.h uint16.h \
  ndelay.h socket.h uint16.h droproot.h qlog.h uint16.h response.h \
  uint32.h dns.h stralloc.h gen_alloc.h iopause.h taia.h tai.h uint64.h \
@@ -375,7 +386,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  	./compile server.c
  
  setup: \
-@@ -931,6 +945,10 @@
+@@ -931,6 +945,10 @@ tryn2i.c choose compile load socket.lib haven2i.h1 haven2i.h2
  	cp /dev/null haven2i.h
  	./choose cL tryn2i haven2i.h1 haven2i.h2 socket > haven2i.h
  
@@ -386,7 +397,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  str_chr.o: \
  compile str_chr.c str.h
  	./compile str_chr.c
-@@ -1072,7 +1090,7 @@
+@@ -1072,7 +1090,7 @@ compile taia_uint.c taia.h tai.h uint64.h
  tdlookup.o: \
  compile tdlookup.c uint16.h open.h tai.h uint64.h cdb.h uint32.h \
  byte.h case.h dns.h stralloc.h gen_alloc.h iopause.h taia.h tai.h \
@@ -395,7 +406,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  	./compile tdlookup.c
  
  timeoutread.o: \
-@@ -1088,10 +1106,10 @@
+@@ -1088,10 +1106,10 @@ timeoutwrite.h
  tinydns: \
  load tinydns.o server.o iopause.o droproot.o tdlookup.o response.o qlog.o \
  prot.o clientloc.o dns.a libtai.a env.a cdb.a alloc.a buffer.a unix.a byte.a \
@@ -408,7 +419,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  
  tinydns-conf: \
  load tinydns-conf.o generic-conf.o auto_home.o buffer.a unix.a byte.a
-@@ -1126,11 +1144,12 @@
+@@ -1126,11 +1144,12 @@ dns.h stralloc.h iopause.h taia.h tai.h uint64.h taia.h
  	./compile tinydns-edit.c
  
  tinydns-get: \
@@ -424,7 +435,7 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  
  tinydns-get.o: \
  compile tinydns-get.c str.h byte.h scan.h exit.h stralloc.h \
-@@ -1198,10 +1217,10 @@
+@@ -1198,10 +1217,10 @@ compile utime.c scan.h exit.h
  
  walldns: \
  load walldns.o server.o iopause.o response.o droproot.o qlog.o prot.o dd.o \
@@ -437,16 +448,17 @@ diff -rNU3 djbdns-1.05.tds-base/Makefile djbdns-1.05.tinydnssec/Makefile
  
  walldns-conf: \
  load walldns-conf.o generic-conf.o auto_home.o buffer.a unix.a byte.a
-@@ -1227,4 +1246,4 @@
+@@ -1227,4 +1246,4 @@ trysa6.c choose compile sockaddr_in6.h1 sockaddr_in6.h2 haveip6.h
  	./choose c trysa6 sockaddr_in6.h1 sockaddr_in6.h2 > sockaddr_in6.h
  
  clean:
 -	rm -f `cat TARGETS`
 +	rm -f `cat TARGETS` data data.cdb test/[ot]*
-diff -rNU3 djbdns-1.05.tds-base/parsetype.c djbdns-1.05.tinydnssec/parsetype.c
---- djbdns-1.05.tds-base/parsetype.c	2001-02-11 22:11:45.000000000 +0100
-+++ djbdns-1.05.tinydnssec/parsetype.c	2012-12-06 22:39:13.000000000 +0100
-@@ -24,6 +24,8 @@
+diff --git a/parsetype.c b/parsetype.c
+index 167aaa4..b3bc332 100644
+--- a/parsetype.c
++++ b/parsetype.c
+@@ -24,6 +24,8 @@ int parsetype(char *s,char type[2])
    else if (case_equals(s,"key")) byte_copy(type,2,DNS_T_KEY);
    else if (case_equals(s,"aaaa")) byte_copy(type,2,DNS_T_AAAA);
    else if (case_equals(s,"axfr")) byte_copy(type,2,DNS_T_AXFR);
@@ -455,9 +467,10 @@ diff -rNU3 djbdns-1.05.tds-base/parsetype.c djbdns-1.05.tinydnssec/parsetype.c
    else
      return 0;
  
-diff -rNU3 djbdns-1.05.tds-base/printpacket.c djbdns-1.05.tinydnssec/printpacket.c
---- djbdns-1.05.tds-base/printpacket.c	2001-02-11 22:11:45.000000000 +0100
-+++ djbdns-1.05.tinydnssec/printpacket.c	2012-12-06 22:39:13.000000000 +0100
+diff --git a/printpacket.c b/printpacket.c
+index 7571e08..b13c4b1 100644
+--- a/printpacket.c
++++ b/printpacket.c
 @@ -5,6 +5,7 @@
  #include "dns.h"
  #include "printrecord.h"
@@ -466,7 +479,15 @@ diff -rNU3 djbdns-1.05.tds-base/printpacket.c djbdns-1.05.tinydnssec/printpacket
  
  static char *d;
  
-@@ -67,8 +68,7 @@
+@@ -19,7 +20,6 @@ unsigned int printpacket_cat(stralloc *out,char *buf,unsigned int len)
+   uint16 numglue;
+   unsigned int pos;
+   char data[12];
+-  uint16 type;
+ 
+   pos = dns_packet_copy(buf,len,0,data,12); if (!pos) return 0;
+ 
+@@ -67,8 +67,7 @@ unsigned int printpacket_cat(stralloc *out,char *buf,unsigned int len)
        X("weird class")
      }
      else {
@@ -476,9 +497,10 @@ diff -rNU3 djbdns-1.05.tds-base/printpacket.c djbdns-1.05.tinydnssec/printpacket
        X(" ")
        if (!dns_domain_todot_cat(out,d)) return 0;
      }
-diff -rNU3 djbdns-1.05.tds-base/printrecord.c djbdns-1.05.tinydnssec/printrecord.c
---- djbdns-1.05.tds-base/printrecord.c	2012-12-06 22:45:38.000000000 +0100
-+++ djbdns-1.05.tinydnssec/printrecord.c	2012-12-06 22:39:13.000000000 +0100
+diff --git a/printrecord.c b/printrecord.c
+index 4bc7c3e..4cc744d 100644
+--- a/printrecord.c
++++ b/printrecord.c
 @@ -5,9 +5,25 @@
  #include "dns.h"
  #include "printrecord.h"
@@ -505,7 +527,7 @@ diff -rNU3 djbdns-1.05.tds-base/printrecord.c djbdns-1.05.tinydnssec/printrecord
  unsigned int printrecord_cat(stralloc *out,const char *buf,unsigned int len,unsigned int pos,const char *q,const char qtype[2])
  {
    const char *x;
-@@ -18,6 +34,7 @@
+@@ -18,6 +34,7 @@ unsigned int printrecord_cat(stralloc *out,const char *buf,unsigned int len,unsi
    unsigned int newpos;
    int i;
    unsigned char ch;
@@ -513,7 +535,7 @@ diff -rNU3 djbdns-1.05.tds-base/printrecord.c djbdns-1.05.tinydnssec/printrecord
  
    pos = dns_packet_getname(buf,len,pos,&d); if (!pos) return 0;
    pos = dns_packet_copy(buf,len,pos,misc,10); if (!pos) return 0;
-@@ -33,15 +50,20 @@
+@@ -33,15 +50,20 @@ unsigned int printrecord_cat(stralloc *out,const char *buf,unsigned int len,unsi
  
    if (!dns_domain_todot_cat(out,d)) return 0;
    if (!stralloc_cats(out," ")) return 0;
@@ -539,7 +561,7 @@ diff -rNU3 djbdns-1.05.tds-base/printrecord.c djbdns-1.05.tinydnssec/printrecord
    if (byte_equal(misc,2,DNS_T_NS)) x = " NS ";
    if (byte_equal(misc,2,DNS_T_PTR)) x = " PTR ";
    if (byte_equal(misc,2,DNS_T_CNAME)) x = " CNAME ";
-@@ -92,12 +114,111 @@
+@@ -92,12 +114,111 @@ unsigned int printrecord_cat(stralloc *out,const char *buf,unsigned int len,unsi
      stringlen=ip6_fmt(ip6str,misc);
      if (!stralloc_catb(out,ip6str,stringlen)) return 0;
    }
@@ -652,7 +674,7 @@ diff -rNU3 djbdns-1.05.tds-base/printrecord.c djbdns-1.05.tinydnssec/printrecord
        pos = dns_packet_copy(buf,len,pos,misc,1); if (!pos) return 0;
        if ((misc[0] >= 33) && (misc[0] <= 126) && (misc[0] != '\\')) {
          if (!stralloc_catb(out,misc,1)) return 0;
-@@ -111,7 +232,6 @@
+@@ -111,7 +232,6 @@ unsigned int printrecord_cat(stralloc *out,const char *buf,unsigned int len,unsi
          if (!stralloc_catb(out,misc,4)) return 0;
        }
      }
@@ -660,21 +682,23 @@ diff -rNU3 djbdns-1.05.tds-base/printrecord.c djbdns-1.05.tinydnssec/printrecord
  
    if (!stralloc_cats(out,"\n")) return 0;
    if (pos != newpos) { errno = error_proto; return 0; }
-diff -rNU3 djbdns-1.05.tds-base/printtype.c djbdns-1.05.tinydnssec/printtype.c
---- djbdns-1.05.tds-base/printtype.c	1970-01-01 01:00:00.000000000 +0100
-+++ djbdns-1.05.tinydnssec/printtype.c	2012-12-06 22:39:13.000000000 +0100
+diff --git a/printtype.c b/printtype.c
+new file mode 100644
+index 0000000..ca8c0a3
+--- /dev/null
++++ b/printtype.c
 @@ -0,0 +1,47 @@
 +/* (C) 2012 Peter Conrad <conrad@quisquis.de>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 3 as
 + * published by the Free Software Foundation.
-+ * 
++ *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
-+ * 
++ *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
@@ -711,21 +735,23 @@ diff -rNU3 djbdns-1.05.tds-base/printtype.c djbdns-1.05.tinydnssec/printtype.c
 +  uint16_unpack_big(type,&u16);
 +  return stralloc_catulong0(out,u16,0);
 +}
-diff -rNU3 djbdns-1.05.tds-base/printtype.h djbdns-1.05.tinydnssec/printtype.h
---- djbdns-1.05.tds-base/printtype.h	1970-01-01 01:00:00.000000000 +0100
-+++ djbdns-1.05.tinydnssec/printtype.h	2012-12-06 22:39:13.000000000 +0100
+diff --git a/printtype.h b/printtype.h
+new file mode 100644
+index 0000000..a8b3888
+--- /dev/null
++++ b/printtype.h
 @@ -0,0 +1,23 @@
 +/* (C) 2012 Peter Conrad <conrad@quisquis.de>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 3 as
 + * published by the Free Software Foundation.
-+ * 
++ *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
-+ * 
++ *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
@@ -738,9 +764,10 @@ diff -rNU3 djbdns-1.05.tds-base/printtype.h djbdns-1.05.tinydnssec/printtype.h
 +extern int printtype(stralloc *, const char *);
 +
 +#endif
-diff -rNU3 djbdns-1.05.tds-base/response.c djbdns-1.05.tinydnssec/response.c
---- djbdns-1.05.tds-base/response.c	2001-02-11 22:11:45.000000000 +0100
-+++ djbdns-1.05.tinydnssec/response.c	2012-12-06 22:39:13.000000000 +0100
+diff --git a/response.c b/response.c
+index ba90c89..32b14e7 100644
+--- a/response.c
++++ b/response.c
 @@ -5,6 +5,8 @@
  
  char response[65535];
@@ -750,9 +777,10 @@ diff -rNU3 djbdns-1.05.tds-base/response.c djbdns-1.05.tinydnssec/response.c
  static unsigned int tctarget;
  
  #define NAMES 100
-diff -rNU3 djbdns-1.05.tds-base/response.h djbdns-1.05.tinydnssec/response.h
---- djbdns-1.05.tds-base/response.h	2001-02-11 22:11:45.000000000 +0100
-+++ djbdns-1.05.tinydnssec/response.h	2012-12-06 22:39:13.000000000 +0100
+diff --git a/response.h b/response.h
+index 206b1d4..14a4a1e 100644
+--- a/response.h
++++ b/response.h
 @@ -5,6 +5,8 @@
  
  extern char response[];
@@ -762,15 +790,16 @@ diff -rNU3 djbdns-1.05.tds-base/response.h djbdns-1.05.tinydnssec/response.h
  
  extern int response_query(const char *,const char *,const char *);
  extern void response_nxdomain(void);
-diff -rNU3 djbdns-1.05.tds-base/server.c djbdns-1.05.tinydnssec/server.c
---- djbdns-1.05.tds-base/server.c	2012-12-06 22:45:38.000000000 +0100
-+++ djbdns-1.05.tinydnssec/server.c	2012-12-06 22:39:13.000000000 +0100
+diff --git a/server.c b/server.c
+index d52ce87..b754265 100644
+--- a/server.c
++++ b/server.c
 @@ -1,3 +1,4 @@
 +#include "edns0.h"
  #include "byte.h"
  #include "case.h"
  #include "env.h"
-@@ -63,6 +64,9 @@
+@@ -63,6 +64,9 @@ static int doit(void)
    if (header[2] & 126) goto NOTIMP;
    if (byte_equal(qtype,2,DNS_T_AXFR)) goto NOTIMP;
  
@@ -780,7 +809,7 @@ diff -rNU3 djbdns-1.05.tds-base/server.c djbdns-1.05.tinydnssec/server.c
    case_lowerb(q,dns_domain_length(q));
    if (!respond(q,qtype,ip)) {
      qlog(ip,port,header,q,qtype," - ");
-@@ -168,7 +172,7 @@
+@@ -168,7 +172,7 @@ int main()
  	len = socket_recv6(udp53[i],buf,sizeof buf,ip,&port,&ifid);
  	if (len < 0) continue;
  	if (!doit()) continue;
@@ -789,9 +818,11 @@ diff -rNU3 djbdns-1.05.tds-base/server.c djbdns-1.05.tinydnssec/server.c
  	socket_send6(udp53[i],response,response_len,ip,port,ifid);
  	/* may block for buffer space; if it fails, too bad */
        }
-diff -rNU3 djbdns-1.05.tds-base/sha1.c djbdns-1.05.tinydnssec/sha1.c
---- djbdns-1.05.tds-base/sha1.c	1970-01-01 01:00:00.000000000 +0100
-+++ djbdns-1.05.tinydnssec/sha1.c	2012-12-06 22:39:13.000000000 +0100
+diff --git a/sha1.c b/sha1.c
+new file mode 100644
+index 0000000..df446b5
+--- /dev/null
++++ b/sha1.c
 @@ -0,0 +1,385 @@
 +/*
 +SHA-1 in C
@@ -881,7 +912,7 @@ diff -rNU3 djbdns-1.05.tds-base/sha1.c djbdns-1.05.tinydnssec/sha1.c
 +  34AA973C D4C4DAA4 F61EEB2B DBAD2731 6534016F
 +*/
 +
-+/* #define SHA1HANDSOFF  */
++#define SHA1HANDSOFF
 +
 +#ifdef HAVE_CONFIG_H
 +#include "config.h"
@@ -1041,9 +1072,9 @@ diff -rNU3 djbdns-1.05.tds-base/sha1.c djbdns-1.05.tinydnssec/sha1.c
 +        finalcount[i] = (unsigned char)((context->count[(i >= 4 ? 0 : 1)]
 +         >> ((3-(i & 3)) * 8) ) & 255);  /* Endian independent */
 +    }
-+    SHA1_Update(context, (uint8_t *)"\200", 1);
++    SHA1_Update(context, (const uint8_t *)"\200", 1);
 +    while ((context->count[0] & 504) != 448) {
-+        SHA1_Update(context, (uint8_t *)"\0", 1);
++        SHA1_Update(context, (const uint8_t *)"\0", 1);
 +    }
 +    SHA1_Update(context, finalcount, 8);  /* Should cause a SHA1_Transform() */
 +    for (i = 0; i < SHA1_DIGEST_SIZE; i++) {
@@ -1178,9 +1209,11 @@ diff -rNU3 djbdns-1.05.tds-base/sha1.c djbdns-1.05.tinydnssec/sha1.c
 +    return(0);
 +}
 +#endif /* TEST */
-diff -rNU3 djbdns-1.05.tds-base/sha1.h djbdns-1.05.tinydnssec/sha1.h
---- djbdns-1.05.tds-base/sha1.h	1970-01-01 01:00:00.000000000 +0100
-+++ djbdns-1.05.tinydnssec/sha1.h	2012-12-06 22:39:13.000000000 +0100
+diff --git a/sha1.h b/sha1.h
+new file mode 100644
+index 0000000..aff51bc
+--- /dev/null
++++ b/sha1.h
 @@ -0,0 +1,29 @@
 +/* public api for steve reid's public domain SHA-1 implementation */
 +/* this file is in the public domain */
@@ -1211,10 +1244,11 @@ diff -rNU3 djbdns-1.05.tds-base/sha1.h djbdns-1.05.tinydnssec/sha1.h
 +#endif
 +
 +#endif /* __SHA1_H */
-diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
---- djbdns-1.05.tds-base/TARGETS	2012-12-06 22:45:38.000000000 +0100
-+++ djbdns-1.05.tinydnssec/TARGETS	2012-12-06 22:39:13.000000000 +0100
-@@ -240,3 +240,8 @@
+diff --git a/TARGETS b/TARGETS
+index 8e8e457..252d7d2 100644
+--- a/TARGETS
++++ b/TARGETS
+@@ -240,3 +240,8 @@ scan_xlong.o
  socket_accept6.o
  socket_connect6.o
  socket_tcp6.o
@@ -1223,8 +1257,10 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
 +base32hex.o
 +printtype.o
 +edns0.o
---- djbdns-1.05.orig/tdlookup.c	2020-05-31 12:26:32.153583322 +0200
-+++ djbdns-1.05/tdlookup.c	2020-05-31 11:59:14.367285275 +0200
+diff --git a/tdlookup.c b/tdlookup.c
+index b760340..690d362 100644
+--- a/tdlookup.c
++++ b/tdlookup.c
 @@ -10,6 +10,9 @@
  #include "response.h"
  #include "ip6.h"
@@ -1235,7 +1271,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  
  static int want(const char *owner,const char type[2])
  {
-@@ -34,7 +37,7 @@
+@@ -34,7 +37,7 @@ static int want(const char *owner,const char type[2])
  }
  
  static char *d1;
@@ -1244,7 +1280,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  static char clientloc[2];
  static struct tai now;
  static struct cdb c;
-@@ -44,6 +47,8 @@
+@@ -44,6 +47,8 @@ static uint32 dlen;
  static unsigned int dpos;
  static char type[2];
  static uint32 ttl;
@@ -1253,7 +1289,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  
  static int find(char *d,int flagwild)
  {
-@@ -105,6 +110,122 @@
+@@ -105,6 +110,124 @@ static int doname(void)
    return response_addname(d1);
  }
  
@@ -1261,6 +1297,8 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
 +{
 +int r;
 +
++  if (!want(hashName, DNS_T_NSEC3)) return 1;
++
 +  cdb_findstart(&c);
 +  while (r = find(hashName,0)) {
 +    if (r == -1) return 0;
@@ -1376,7 +1414,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  static int doit(char *q,char qtype[2])
  {
    unsigned int bpos;
-@@ -118,6 +239,8 @@
+@@ -118,6 +241,8 @@ static int doit(char *q,char qtype[2])
    int r;
    int flagns;
    int flagauthoritative;
@@ -1385,7 +1423,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
    char x[20];
    uint16 u16;
    char addr[8][4];
-@@ -132,18 +255,28 @@
+@@ -132,18 +257,28 @@ static int doit(char *q,char qtype[2])
    for (;;) {
      flagns = 0;
      flagauthoritative = 0;
@@ -1416,7 +1454,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
    if (!flagauthoritative) {
      response[2] &= ~4;
      goto AUTHORITY; /* q is in a child zone */
-@@ -152,7 +285,11 @@
+@@ -152,7 +287,11 @@ static int doit(char *q,char qtype[2])
  
    flaggavesoa = 0;
    flagfound = 0;
@@ -1429,7 +1467,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  
    for (;;) {
      addrnum = addr6num = 0;
-@@ -162,8 +299,26 @@
+@@ -162,8 +301,26 @@ static int doit(char *q,char qtype[2])
        if (r == -1) return 0;
        flagfound = 1;
        if (flaggavesoa && byte_equal(type,2,DNS_T_SOA)) continue;
@@ -1458,7 +1496,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	addrttl = ttl;
  	i = dns_random(addrnum + 1);
  	if (i < 8) {
-@@ -174,7 +329,7 @@
+@@ -174,7 +331,7 @@ static int doit(char *q,char qtype[2])
  	if (addrnum < 1000000) ++addrnum;
  	continue;
        }
@@ -1467,7 +1505,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	addr6ttl = ttl;
  	i = dns_random(addr6num + 1);
  	if (i < 8) {
-@@ -188,6 +343,9 @@
+@@ -188,6 +345,9 @@ static int doit(char *q,char qtype[2])
        if (!response_rstart(q,type,ttl)) return 0;
        if (byte_equal(type,2,DNS_T_NS) || byte_equal(type,2,DNS_T_CNAME) || byte_equal(type,2,DNS_T_PTR)) {
  	if (!doname()) return 0;
@@ -1477,7 +1515,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
        }
        else if (byte_equal(type,2,DNS_T_MX)) {
  	if (!dobytes(2)) return 0;
-@@ -199,6 +357,13 @@
+@@ -199,6 +359,13 @@ static int doit(char *q,char qtype[2])
  	if (!dobytes(20)) return 0;
          flaggavesoa = 1;
        }
@@ -1491,7 +1529,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
        else
          if (!response_addbytes(data + dpos,dlen - dpos)) return 0;
        response_rfinish(RESPONSE_ANSWER);
-@@ -219,10 +384,24 @@
+@@ -219,10 +386,24 @@ static int doit(char *q,char qtype[2])
      if (flagfound) break;
      if (wild == control) break;
      if (!*wild) break; /* impossible */
@@ -1516,7 +1554,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
    if (!flagfound)
      response_nxdomain();
  
-@@ -230,22 +409,49 @@
+@@ -230,22 +411,49 @@ static int doit(char *q,char qtype[2])
    AUTHORITY:
    aupos = response_len;
  
@@ -1578,7 +1616,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
        cdb_findstart(&c);
        while (r = find(control,0)) {
          if (r == -1) return 0;
-@@ -254,10 +460,33 @@
+@@ -254,10 +462,33 @@ static int doit(char *q,char qtype[2])
  	  if (!doname()) return 0;
            response_rfinish(RESPONSE_AUTHORITY);
          }
@@ -1612,7 +1650,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  
    bpos = anpos;
    while (bpos < arpos) {
-@@ -265,25 +494,33 @@
+@@ -265,25 +496,33 @@ static int doit(char *q,char qtype[2])
      bpos = dns_packet_copy(response,arpos,bpos,x,10); if (!bpos) return 0;
      if (byte_equal(x,2,DNS_T_NS) || byte_equal(x,2,DNS_T_MX)) {
        if (byte_equal(x,2,DNS_T_NS)) {
@@ -1653,7 +1691,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
          }
        }
      }
-@@ -291,10 +528,10 @@
+@@ -291,10 +530,10 @@ static int doit(char *q,char qtype[2])
      bpos += u16;
    }
  
@@ -1666,7 +1704,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
        byte_zero(response + RESPONSE_AUTHORITY,2);
        response_len = aupos;
      }
-@@ -316,6 +553,9 @@
+@@ -316,6 +555,9 @@ int respond(char *q,char qtype[2],char ip[16])
    cdb_init(&c,fd);
  
    r = doit(q,qtype);
@@ -1676,9 +1714,11 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  
    cdb_free(&c);
    close(fd);
---- djbdns-1.05.orig/tinydns-data.c	2020-05-31 12:26:32.153583322 +0200
-+++ djbdns-1.05/tinydns-data.c	2020-05-31 11:49:26.624848116 +0200
-@@ -155,14 +155,15 @@
+diff --git a/tinydns-data.c b/tinydns-data.c
+index a509b21..b1859f0 100644
+--- a/tinydns-data.c
++++ b/tinydns-data.c
+@@ -155,14 +155,15 @@ void rr_start(const char type[2],unsigned long ttl,const char ttd[8],const char
    rr_add(buf,4);
    rr_add(ttd,8);
  }
@@ -1696,7 +1736,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
    if (cdb_make_add(&cdb,key.s,key.len,result.s,result.len) == -1)
      die_datatmp();
  }
-@@ -295,7 +296,7 @@
+@@ -295,7 +296,7 @@ int main()
  	if (!dns_domain_fromdot(&d2,f[2].s,f[2].len)) nomem();
  	rr_addname(d2);
  	rr_add(soa,20);
@@ -1705,7 +1745,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	break;
  
        case '.': case '&':
-@@ -319,17 +320,17 @@
+@@ -319,17 +320,17 @@ int main()
  	  rr_add("\12hostmaster",11);
  	  rr_addname(d1);
  	  rr_add(defaultsoa,20);
@@ -1726,7 +1766,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	}
  
  	break;
-@@ -346,13 +347,13 @@
+@@ -346,13 +347,13 @@ int main()
  	if (ip4_scan(f[1].s,ip)) {
  	  rr_start(DNS_T_A,ttl,ttd,loc);
  	  rr_add(ip,4);
@@ -1742,7 +1782,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	  }
  	}
  	break;
-@@ -368,18 +369,18 @@
+@@ -368,18 +369,18 @@ int main()
  	if (ip6_scan_flat(f[1].s,ip6)) {
  	  rr_start(DNS_T_AAAA,ttl,ttd,loc);
  	  rr_add(ip6,16);
@@ -1764,7 +1804,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	  }
  	}
  	break;
-@@ -406,12 +407,12 @@
+@@ -406,12 +407,12 @@ int main()
  	uint16_pack_big(buf,u);
  	rr_add(buf,2);
  	rr_addname(d2);
@@ -1779,7 +1819,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	}
  	break;
  
-@@ -428,7 +429,7 @@
+@@ -428,7 +429,7 @@ int main()
  	else
  	  rr_start(DNS_T_PTR,ttl,ttd,loc);
  	rr_addname(d2);
@@ -1788,7 +1828,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	break;
  
        case '\'':
-@@ -444,14 +445,14 @@
+@@ -444,14 +445,14 @@ int main()
  	i = 0;
  	while (i < f[1].len) {
  	  k = f[1].len - i;
@@ -1805,7 +1845,7 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	break;
  
        case ':':
-@@ -483,7 +484,7 @@
+@@ -483,7 +484,7 @@ int main()
  
  	rr_start(type,ttl,ttd,loc);
  	rr_add(f[2].s,f[2].len);
@@ -1814,10 +1854,11 @@ diff -rNU3 djbdns-1.05.tds-base/TARGETS djbdns-1.05.tinydnssec/TARGETS
  	break;
  
        default:
-diff -rNU3 djbdns-1.05.tds-base/tinydns-get.c djbdns-1.05.tinydnssec/tinydns-get.c
---- djbdns-1.05.tds-base/tinydns-get.c	2001-02-11 22:11:45.000000000 +0100
-+++ djbdns-1.05.tinydnssec/tinydns-get.c	2012-12-06 22:39:13.000000000 +0100
-@@ -19,7 +19,7 @@
+diff --git a/tinydns-get.c b/tinydns-get.c
+index 56edb13..d17305d 100644
+--- a/tinydns-get.c
++++ b/tinydns-get.c
+@@ -20,7 +20,7 @@ extern int respond(char *,char *,char *);
  
  void usage(void)
  {
@@ -1826,7 +1867,7 @@ diff -rNU3 djbdns-1.05.tds-base/tinydns-get.c djbdns-1.05.tinydnssec/tinydns-get
  }
  void oops(void)
  {
-@@ -39,6 +39,14 @@
+@@ -40,6 +40,14 @@ int main(int argc,char **argv)
    if (!*argv) usage();
  
    if (!*++argv) usage();

From 2f1583e09ed74999e65af6aff1502329fe975dab Mon Sep 17 00:00:00 2001
From: Peter Conrad <conrad@quisquis.de>
Date: Wed, 14 Oct 2020 18:01:00 +0200
Subject: [PATCH 3/4] Preparing release

---
 INSTALL.tinydnssec | 2 +-
 README.tinydnssec  | 2 +-
 html/install.html  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/INSTALL.tinydnssec b/INSTALL.tinydnssec
index 265d3f4..017463a 100644
--- a/INSTALL.tinydnssec
+++ b/INSTALL.tinydnssec
@@ -20,7 +20,7 @@ Build
 1. Download and unpack the original djbdns sources from
    http://cr.yp.to/djbdns/install.html .
 2. Download and apply the patches listed above.
-3. Download and unpack http://tinydnssec.org/tinydnssec-1.05-1.5.tar.bz2 in
+3. Download and unpack http://tinydnssec.org/tinydnssec-1.05-1.8.tar.bz2 in
    the top-level source directory.
 4. Apply djbdns-1.05-dnssec.patch.
 5. Install as per usual instructions (see http://cr.yp.to/djbdns/install.html ).
diff --git a/README.tinydnssec b/README.tinydnssec
index b68a6c8..94b906c 100644
--- a/README.tinydnssec
+++ b/README.tinydnssec
@@ -109,7 +109,7 @@ update:
 LICENSE
 -------
 
-(C) 2012,2015,2017,2019 Peter Conrad <conrad@quisquis.de>
+(C) 2012,2015,2017,2019,2020 Peter Conrad <conrad@quisquis.de>
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License version 3 as
diff --git a/html/install.html b/html/install.html
index fdc2a6b..607f59b 100644
--- a/html/install.html
+++ b/html/install.html
@@ -37,7 +37,7 @@ <h2>Build</h2>
 <ol>
 <li>Download and unpack the <a href="http://cr.yp.to/djbdns/install.html">original djbdns sources</a>.</li>
 <li>Download and apply the patches listed above.</li>
-<li>Download and unpack <a href="tinydnssec-1.05-1.5.tar.gz">tinydnssec</a> in
+<li>Download and unpack <a href="tinydnssec-1.05-1.8.tar.gz">tinydnssec</a> in
     the top-level source directory.</li>
 <li>Apply djbdns-1.05-dnssec.patch.</li>
 <li>Install as per
@@ -72,7 +72,7 @@ <h2>Test</h2>
 <h2>License information</h2>
 
 <p>
-(C) 2012,2015,2017,2019 Peter Conrad
+(C) 2012,2015,2017,2019,2020 Peter Conrad
 </p>
 <p>
 This program is free software: you can redistribute it and/or modify

From 861835c0907bb52b5fcf2d0990d11676b52300b3 Mon Sep 17 00:00:00 2001
From: Peter Conrad <conrad@quisquis.de>
Date: Wed, 14 Oct 2020 18:13:32 +0200
Subject: [PATCH 4/4] Fixed link to ipv6 patch

---
 INSTALL.tinydnssec | 2 +-
 html/install.html  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/INSTALL.tinydnssec b/INSTALL.tinydnssec
index 017463a..4289383 100644
--- a/INSTALL.tinydnssec
+++ b/INSTALL.tinydnssec
@@ -7,7 +7,7 @@ Requirements
 This patch is *not* against stock djbdns. Here's the minimal set of patches
 to install before the tinydnssec patch applies:
 
-1. http://www.fefe.de/dns/djbdns-1.05-test28.diff.bz2
+1. http://www.fefe.de/dns/djbdns-1.05-test28.diff.xz
    Unfortunately, fefe refuses to name a license for this patch, which means
    that I cannot redistribute it.
 
diff --git a/html/install.html b/html/install.html
index 607f59b..1ea2405 100644
--- a/html/install.html
+++ b/html/install.html
@@ -25,7 +25,7 @@ <h2>Requirements</h2>
 to install before the tinydnssec patch applies:
 </p>
 <ol>
-<li><a href="http://www.fefe.de/dns/">http://www.fefe.de/dns/</a>djbdns-1.05-test28.diff.bz2<br>
+<li><a href="http://www.fefe.de/dns/">http://www.fefe.de/dns/</a>djbdns-1.05-test28.diff.xz<br>
    Unfortunately, fefe refuses to name a license for this patch, which means
    that I cannot redistribute it.</li>