Merge branch 'develop' of github.com:getdnsapi/getdns into develop

configure.ac

@@ -392,7 +392,14 @@ case "$enable_ecdsa" in
       ;;
 esac
 
-
+AC_ARG_ENABLE(draft-dnssec-roadblock-avoidance, AC_HELP_STRING([--enable-draft-dnssec-roadblock-avoidance], [Enable experimental dnssec roadblock avoidance]))
+case "$enable_draft_dnssec_roadblock_avoidance" in
+	yes)
+		AC_DEFINE_UNQUOTED([DNSSEC_ROADBLOCK_AVOIDANCE], [1], [Define this to enable the experimental draft dnssec roadblock avoidance.])
+		;;
+	no|*)
+		;;
+esac
 
 AC_ARG_ENABLE(draft-edns-cookies, AC_HELP_STRING([--enable-draft-edns-cookies], [Enable experimental edns cookies]))
 case "$enable_draft_edns_cookies" in

src/Makefile.in

@@ -117,7 +117,7 @@ install:	libgetdns.la
 	$(INSTALL) -m 755 -d $(DESTDIR)$(includedir)
 	$(INSTALL) -m 755 -d $(DESTDIR)$(includedir)/getdns
 	$(INSTALL) -m 644 getdns/getdns.h $(DESTDIR)$(includedir)/getdns/getdns.h
-	$(INSTALL) -m 644 $(srcdir)/getdns/getdns_extra.h $(DESTDIR)$(includedir)/getdns/getdns_extra.h
+	$(INSTALL) -m 644 getdns/getdns_extra.h $(DESTDIR)$(includedir)/getdns/getdns_extra.h
 	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)
 	$(LIBTOOL) --mode=install cp libgetdns.la $(DESTDIR)$(libdir)
 	if test $(have_libevent) = 1 ; then $(INSTALL) -m 644 $(srcdir)/getdns/getdns_ext_libevent.h $(DESTDIR)$(includedir)/getdns/ ; $(LIBTOOL) --mode=install cp $(EXTENSION_LIBEVENT_LIB) $(DESTDIR)$(libdir) ; fi

src/context.c

@@ -2176,13 +2176,35 @@ ub_setup_stub(struct ub_ctx *ctx, getdns_context *context)
 }
 #endif
 
+
 static getdns_return_t
-_getdns_ns_dns_setup(struct getdns_context *context)
+ub_setup_recursing(struct ub_ctx *ctx, getdns_context *context)
 {
 #ifdef HAVE_LIBUNBOUND
 	_getdns_rr_iter rr_spc, *rr;
 	char ta_str[8192];
 #endif
+
+	/* TODO: use the root servers via root hints file */
+	(void) ub_ctx_set_fwd(ctx, NULL);
+	if (!context->unbound_ta_set && context->trust_anchors) {
+		for ( rr = _getdns_rr_iter_init( &rr_spc
+		                               , context->trust_anchors
+		                               , context->trust_anchors_len)
+		    ; rr ; rr = _getdns_rr_iter_next(rr) ) {
+
+			(void) gldns_wire2str_rr_buf(rr->pos,
+			    rr->nxt - rr->pos, ta_str, sizeof(ta_str));
+			(void) ub_ctx_add_ta(ctx, ta_str);
+		}
+		context->unbound_ta_set = 1;
+	}
+	return GETDNS_RETURN_GOOD;
+}
+
+static getdns_return_t
+_getdns_ns_dns_setup(struct getdns_context *context)
+{
 	assert(context);
 
 	switch (context->resolution_type) {
@@ -2190,31 +2212,20 @@ _getdns_ns_dns_setup(struct getdns_context *context)
 		if (!context->upstreams || !context->upstreams->count)
 			return GETDNS_RETURN_GENERIC_ERROR;
 #ifdef STUB_NATIVE_DNSSEC
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+		return ub_setup_recursing(context->unbound_ctx, context);
+#else
 		return GETDNS_RETURN_GOOD;
+#endif
 #else
 		return ub_setup_stub(context->unbound_ctx, context);
 #endif
 
 	case GETDNS_RESOLUTION_RECURSING:
 #ifdef HAVE_LIBUNBOUND
-		/* TODO: use the root servers via root hints file */
+		return ub_setup_recursing(context->unbound_ctx, context);
-		(void) ub_ctx_set_fwd(context->unbound_ctx, NULL);
-		if (!context->unbound_ta_set && context->trust_anchors) {
-			for ( rr = _getdns_rr_iter_init( &rr_spc
-						, context->trust_anchors
-						, context->trust_anchors_len)
-			    ; rr ; rr = _getdns_rr_iter_next(rr) ) {
-
-				(void) gldns_wire2str_rr_buf(rr->pos,
-				    rr->nxt - rr->pos, ta_str, sizeof(ta_str));
-				(void) ub_ctx_add_ta(
-				    context->unbound_ctx, ta_str);
-			}
-			context->unbound_ta_set = 1;
-		}
-		return GETDNS_RETURN_GOOD;
 #else
-		return GETDNS_RETURN_GENERIC_ERROR;
+		return GETDNS_RETURN_NOT_IMPLEMENTED;
 #endif
 	}
 	return GETDNS_RETURN_BAD_CONTEXT;
@@ -2234,7 +2245,7 @@ _getdns_context_prepare_for_resolution(struct getdns_context *context,
 
 	/* Transport can in theory be set per query in stub mode */
 	if (context->resolution_type == GETDNS_RESOLUTION_STUB && 
-		tls_is_in_transports_list(context) == 1) {
+	    tls_is_in_transports_list(context) == 1) {
 		if (context->tls_ctx == NULL) {
 #ifdef HAVE_TLS_v1_2
 			/* Create client context, use TLS v1.2 only for now */

src/dict.c

@@ -981,6 +981,7 @@ getdns_pp_dict(gldns_buffer * buf, size_t indent,
 			if (!json &&
 			    (strcmp(item->node.key, "type") == 0  ||
 			     strcmp(item->node.key, "type_covered") == 0 ||
+				 strcmp(item->node.key, "query_type") == 0 || 
 			     strcmp(item->node.key, "qtype") == 0) &&
 			    (strval = _getdns_rr_type_name(item->i.data.n))) {
 				if (gldns_buffer_printf(
@@ -994,6 +995,7 @@ getdns_pp_dict(gldns_buffer * buf, size_t indent,
 			     strcmp(item->node.key, "status") == 0 ||
 			     strcmp(item->node.key, "append_name") == 0 ||
 			     strcmp(item->node.key, "follow_redirects") == 0 ||
+				 strcmp(item->node.key, "transport") == 0 ||
 			     strcmp(item->node.key, "resolution_type") == 0) &&
 			    (strval =
 			     _getdns_get_const_info(item->i.data.n)->name)) {

src/dnssec.c

@@ -1108,6 +1108,15 @@ static void add_question2val_chain(struct mem_funcs *mf,
 /*************  Schedule Queries to Provision Validation Chain ***************
  *****************************************************************************/
 
+static getdns_dict *CD_extension(getdns_dns_req *dnsreq)
+{
+	return !dnsreq->dnssec_roadblock_avoidance
+	     ? dnssec_ok_checking_disabled
+	     : !dnsreq->avoid_dnssec_roadblocks
+	     ? dnssec_ok_checking_disabled_roadblock_avoidance
+	     : dnssec_ok_checking_disabled_avoid_roadblocks;
+}
+
 static void check_chain_complete(chain_head *chain);
 static void val_chain_node_soa_cb(getdns_dns_req *dnsreq);
 static void val_chain_sched_soa_node(chain_node *node)
@@ -1127,7 +1136,7 @@ static void val_chain_sched_soa_node(chain_node *node)
 
 	if (! node->soa_req &&
 	    ! _getdns_general_loop(context, loop, name, GETDNS_RRTYPE_SOA,
-	    dnssec_ok_checking_disabled, node, &dnsreq, NULL,
+	    CD_extension(node->chains->netreq->owner), node, &dnsreq, NULL,
 	    val_chain_node_soa_cb))
 
 		node->soa_req     = dnsreq->netreqs[0];
@@ -1174,13 +1183,15 @@ static void val_chain_sched_node(chain_node *node)
 
 	if (! node->dnskey_req /* not scheduled */ &&
 	    ! _getdns_general_loop(context, loop, name, GETDNS_RRTYPE_DNSKEY,
-	    dnssec_ok_checking_disabled, node, &dnsreq, NULL, val_chain_node_cb))
+	    CD_extension(node->chains->netreq->owner),
+	    node, &dnsreq, NULL, val_chain_node_cb))
 
 		node->dnskey_req     = dnsreq->netreqs[0];
 
 	if (! node->ds_req && node->parent /* not root */ &&
 	    ! _getdns_general_loop(context, loop, name, GETDNS_RRTYPE_DS,
-	    dnssec_ok_checking_disabled, node, &dnsreq, NULL, val_chain_node_cb))
+	    CD_extension(node->chains->netreq->owner),
+	    node, &dnsreq, NULL, val_chain_node_cb))
 
 		node->ds_req = dnsreq->netreqs[0];
 }
@@ -1216,7 +1227,8 @@ static void val_chain_sched_ds_node(chain_node *node)
 
 	if (! node->ds_req && node->parent /* not root */ &&
 	    ! _getdns_general_loop(context, loop, name, GETDNS_RRTYPE_DS,
-	    dnssec_ok_checking_disabled, node, &ds_req, NULL, val_chain_node_cb))
+	    CD_extension(node->chains->netreq->owner),
+	    node, &ds_req, NULL, val_chain_node_cb))
 
 		node->ds_req = ds_req->netreqs[0];
 }
@@ -3088,6 +3100,25 @@ static void check_chain_complete(chain_head *chain)
 		    chain, rrset_iter_init( &tas_iter
 		                          , context->trust_anchors
 		                          , context->trust_anchors_len));
+#endif
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+	if (   dnsreq->dnssec_roadblock_avoidance
+	    && dnsreq->netreqs[0]->dnssec_status == GETDNS_DNSSEC_BOGUS) {
+
+		getdns_return_t r = GETDNS_RETURN_GOOD;
+		getdns_network_req **netreq_p, *netreq;
+
+		dnsreq->avoid_dnssec_roadblocks = 1;
+
+		for ( netreq_p = dnsreq->netreqs
+		    ; !r && (netreq = *netreq_p)
+		    ; netreq_p++) {
+
+			netreq->state = NET_REQ_NOT_SENT;
+			(void) _getdns_submit_netreq(netreq);
+		}
+		return;
+	}
 #endif
 	val_chain_list = dnsreq->dnssec_return_validation_chain
 		? getdns_list_create_with_context(context) : NULL;

src/general.c

@@ -90,10 +90,16 @@ _getdns_check_dns_req_complete(getdns_dns_req *dns_req)
 	else if (! results_found)
 		_getdns_call_user_callback(dns_req, NULL);
 	else if (dns_req->dnssec_return_validation_chain
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+	    || (   dns_req->dnssec_roadblock_avoidance 
+	       && !dns_req->avoid_dnssec_roadblocks)
+#endif
+
 #ifdef STUB_NATIVE_DNSSEC
 	    || (dns_req->context->resolution_type == GETDNS_RESOLUTION_STUB
 	        && (dns_req->dnssec_return_status ||
-	            dns_req->dnssec_return_only_secure))
+	            dns_req->dnssec_return_only_secure
+	           ))
 #endif
 	    )
 		_getdns_get_validation_chain(dns_req);
@@ -128,24 +134,29 @@ ub_resolve_callback(void* arg, int err, struct ub_result* ub_res)
 #endif
 
 
-static getdns_return_t
+getdns_return_t
-submit_network_request(getdns_network_req *netreq)
+_getdns_submit_netreq(getdns_network_req *netreq)
 {
 	getdns_return_t r;
 	getdns_dns_req *dns_req = netreq->owner;
 	char name[1024];
 
-	if (dns_req->context->resolution_type == GETDNS_RESOLUTION_RECURSING
+
-	    /* TODO: Until DNSSEC with the new async stub resolver is finished,
+#ifdef STUB_NATIVE_DNSSEC
-	     *       use unbound when we need DNSSEC.
+# ifdef DNSSEC_ROADBLOCK_AVOIDANCE
-	     */
+
-#ifndef STUB_NATIVE_DNSSEC
+	if ((dns_req->context->resolution_type == GETDNS_RESOLUTION_RECURSING
+	    && !dns_req->dnssec_roadblock_avoidance)
+	    ||  dns_req->avoid_dnssec_roadblocks) {
+# else
+	if ( dns_req->context->resolution_type == GETDNS_RESOLUTION_RECURSING) {
+# endif
+#else
+	if ( dns_req->context->resolution_type == GETDNS_RESOLUTION_RECURSING
 	    || dns_req->dnssec_return_status
 	    || dns_req->dnssec_return_only_secure
-	    || dns_req->dnssec_return_validation_chain
+	    || dns_req->dnssec_return_validation_chain) {
 #endif
-	    ) {
-
 		/* schedule the timeout */
 		if (! dns_req->timeout.timeout_cb) {
 			dns_req->timeout.userarg    = dns_req;
@@ -217,7 +228,7 @@ getdns_general_ns(getdns_context *context, getdns_eventloop *loop,
 		for ( netreq_p = req->netreqs
 		    ; !r && (netreq = *netreq_p)
 		    ; netreq_p++)
-			r = submit_network_request(netreq);
+			r = _getdns_submit_netreq(netreq);
 
 	else for (i = 0; i < context->namespace_count; i++) {
 		if (context->namespaces[i] == GETDNS_NAMESPACE_LOCALNAMES) {
@@ -239,7 +250,7 @@ getdns_general_ns(getdns_context *context, getdns_eventloop *loop,
 			for ( netreq_p = req->netreqs
 			    ; !r && (netreq = *netreq_p)
 			    ; netreq_p++)
-				r = submit_network_request(netreq);
+				r = _getdns_submit_netreq(netreq);
 			break;
 		} else
 			r = GETDNS_RETURN_BAD_CONTEXT;

src/general.h

@@ -44,6 +44,8 @@
 
 void _getdns_call_user_callback(getdns_dns_req *, getdns_dict *);
 void _getdns_check_dns_req_complete(getdns_dns_req *dns_req);
+getdns_return_t _getdns_submit_netreq(getdns_network_req *netreq);
+
 
 getdns_return_t
 _getdns_general_loop(getdns_context *context, getdns_eventloop *loop,

src/request-internal.c

@@ -48,6 +48,21 @@ getdns_dict  dnssec_ok_checking_disabled_spc = {
 };
 getdns_dict *dnssec_ok_checking_disabled = &dnssec_ok_checking_disabled_spc;
 
+getdns_dict  dnssec_ok_checking_disabled_roadblock_avoidance_spc = {
+	{ RBTREE_NULL, 0, (int (*)(const void *, const void *)) strcmp },
+	{ 0 }
+};
+getdns_dict *dnssec_ok_checking_disabled_roadblock_avoidance
+    = &dnssec_ok_checking_disabled_roadblock_avoidance_spc;
+
+getdns_dict  dnssec_ok_checking_disabled_avoid_roadblocks_spc = {
+	{ RBTREE_NULL, 0, (int (*)(const void *, const void *)) strcmp },
+	{ 0 }
+};
+getdns_dict *dnssec_ok_checking_disabled_avoid_roadblocks
+    = &dnssec_ok_checking_disabled_avoid_roadblocks_spc;
+
+
 static int
 is_extension_set(getdns_dict *extensions, const char *extension)
 {
@@ -56,7 +71,9 @@ is_extension_set(getdns_dict *extensions, const char *extension)
 
 	if (! extensions)
 		return 0;
-	else if (extensions == dnssec_ok_checking_disabled)
+	else if (extensions == dnssec_ok_checking_disabled
+	    || extensions == dnssec_ok_checking_disabled_roadblock_avoidance
+	    || extensions == dnssec_ok_checking_disabled_avoid_roadblocks)
 		return 0;
 
 	r = getdns_dict_get_int(extensions, extension, &value);
@@ -115,6 +132,11 @@ network_req_init(getdns_network_req *net_req, getdns_dns_req *owner,
 	net_req->response_len = 0;
         net_req->base_query_option_sz = opt_options_size;
 
+	/* Some fields to record info for return_call_debugging */
+	net_req->debug_start_time = 0;
+	net_req->debug_end_time = 0;
+	net_req->debug_tls_auth_status = 0;
+
 	net_req->wire_data_sz = wire_data_sz;
 	if (max_query_sz) {
 		/* first two bytes will contain query length (for tcp) */
@@ -291,10 +313,24 @@ _getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop,
 	    =  is_extension_set(extensions, "dnssec_return_validation_chain");
 	int edns_cookies
 	    =  is_extension_set(extensions, "edns_cookies");
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+	int avoid_dnssec_roadblocks
+	    =  (extensions == dnssec_ok_checking_disabled_avoid_roadblocks);
+	int dnssec_roadblock_avoidance
+	    = is_extension_set(extensions, "dnssec_roadblock_avoidance")
+	    || (extensions == dnssec_ok_checking_disabled_roadblock_avoidance)
+	    || avoid_dnssec_roadblocks;
+#endif
 
 	int dnssec_extension_set = dnssec_return_status
 	    || dnssec_return_only_secure || dnssec_return_validation_chain
-	    || (extensions == dnssec_ok_checking_disabled);
+	    || (extensions == dnssec_ok_checking_disabled)
+	    || (extensions == dnssec_ok_checking_disabled_roadblock_avoidance)
+	    || (extensions == dnssec_ok_checking_disabled_avoid_roadblocks)
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+	    || dnssec_roadblock_avoidance
+#endif
+	    ;
 
 	uint32_t edns_do_bit;
 	int      edns_maximum_udp_payload_size;
@@ -329,7 +365,9 @@ _getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop,
 	size_t max_query_sz, max_response_sz, netreq_sz, dnsreq_base_sz;
 	uint8_t *region;
 	
-	if (extensions == dnssec_ok_checking_disabled)
+	if (extensions == dnssec_ok_checking_disabled ||
+	    extensions == dnssec_ok_checking_disabled_roadblock_avoidance ||
+	    extensions == dnssec_ok_checking_disabled_avoid_roadblocks)
 		extensions = NULL;
 
 	have_add_opt_parameters = getdns_dict_get_dict(extensions,
@@ -376,7 +414,12 @@ _getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop,
 	    ? edns_maximum_udp_payload_size : 512;
 
 	/* (x + 7) / 8 * 8 to align on 8 byte boundries */
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+	if (context->resolution_type == GETDNS_RESOLUTION_RECURSING
+	    && (!dnssec_roadblock_avoidance || avoid_dnssec_roadblocks)) 
+#else
 	if (context->resolution_type == GETDNS_RESOLUTION_RECURSING)
+#endif
 		max_query_sz = 0;
 	else {
 		for (i = 0; i < noptions; i++) {
@@ -438,9 +481,15 @@ _getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop,
 	result->dnssec_return_only_secure      = dnssec_return_only_secure;
 	result->dnssec_return_validation_chain = dnssec_return_validation_chain;
 	result->edns_cookies                   = edns_cookies;
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+	result->dnssec_roadblock_avoidance     = dnssec_roadblock_avoidance;
+	result->avoid_dnssec_roadblocks        = avoid_dnssec_roadblocks;
+#endif
 	result->edns_client_subnet_private     = context->edns_client_subnet_private;
 	result->tls_query_padding_blocksize    = context->tls_query_padding_blocksize;
-
+	result->return_call_debugging
+		= is_extension_set(extensions, "return_call_debugging");
+	
 	/* will be set by caller */
 	result->user_pointer = NULL;
 	result->user_callback = NULL;

src/stub.c

@@ -1207,6 +1207,19 @@ stub_tls_write(getdns_upstream *upstream, getdns_tcp_state *tcp,
 	return STUB_TCP_ERROR;
 }
 
+static uint64_t
+_getdns_get_time_as_uintt64() {
+	
+	struct timeval tv;
+	uint64_t       now;
+	
+	if (gettimeofday(&tv, NULL)) {
+		return 0;
+	}
+	now = tv.tv_sec * 1000000 + tv.tv_usec;
+	return now;
+}
+
 /**************************/
 /* UDP callback functions */
 /**************************/
@@ -1268,6 +1281,7 @@ stub_udp_read_cb(void *userarg)
 	netreq->response_len = read;
 	dnsreq->upstreams->current = 0;
 done:
+	netreq->debug_end_time = _getdns_get_time_as_uintt64();
 	netreq->state = NET_REQ_FINISHED;
 	_getdns_check_dns_req_complete(dnsreq);
 }
@@ -1282,6 +1296,7 @@ stub_udp_write_cb(void *userarg)
 
 	GETDNS_CLEAR_EVENT(dnsreq->loop, &netreq->event);
 
+	netreq->debug_start_time = _getdns_get_time_as_uintt64();
 	netreq->query_id = arc4random();
 	GLDNS_ID_SET(netreq->query, netreq->query_id);
 	if (netreq->opt) {
@@ -1347,7 +1362,7 @@ stub_tcp_read_cb(void *userarg)
 		    netreq->tcp.read_pos - netreq->tcp.read_buf;
 		netreq->tcp.read_buf = NULL;
 		dnsreq->upstreams->current = 0;
-
+		netreq->debug_end_time = _getdns_get_time_as_uintt64();
 		stub_cleanup(netreq);
 		close(netreq->fd);
 		_getdns_check_dns_req_complete(dnsreq);
@@ -1360,7 +1375,7 @@ stub_tcp_write_cb(void *userarg)
 	getdns_network_req *netreq = (getdns_network_req *)userarg;
 	getdns_dns_req *dnsreq = netreq->owner;
 	int q;
-
+	netreq->debug_start_time = _getdns_get_time_as_uintt64();
 	switch ((q = stub_tcp_write(netreq->fd, &netreq->tcp, netreq))) {
 	case STUB_TCP_AGAIN:
 		return;
@@ -1453,7 +1468,7 @@ upstream_read_cb(void *userarg)
 			    getdns_eventloop_event_init(&upstream->event, upstream,
 			     NULL, upstream_write_cb, NULL));
 		}
-
+		netreq->debug_end_time = _getdns_get_time_as_uintt64();
 		/* This also reschedules events for the upstream*/
 		stub_cleanup(netreq);
 
@@ -1480,7 +1495,10 @@ upstream_write_cb(void *userarg)
 	getdns_network_req *netreq = upstream->write_queue;
 	getdns_dns_req *dnsreq = netreq->owner;
 	int q;
-
+	
+	/* TODO: think about TCP AGAIN */
+	netreq->debug_start_time = _getdns_get_time_as_uintt64();
+	
 	DEBUG_STUB("--- WRITE: %s: %p TYPE: %d\n", __FUNCTION__, netreq,
 	           netreq->request_type);
 	if (tls_requested(netreq) && tls_should_write(upstream))
@@ -1510,6 +1528,8 @@ upstream_write_cb(void *userarg)
 		return;
 
 	default:
+		/* Need this because auth status is reset on connection clode */
+		netreq->debug_tls_auth_status = netreq->upstream->tls_auth_failed;
 		upstream->writes_done++;
 		netreq->query_id = (uint16_t) q;
 		/* Unqueue the netreq from the write_queue */

src/types-internal.h

@@ -226,6 +226,11 @@ typedef struct getdns_network_req
 	/* Network requests scheduled to write after me */
 	struct getdns_network_req *write_queue_tail;
 
+	/* Some fields to record info for return_call_debugging */
+	uint64_t                    debug_start_time;
+	uint64_t                    debug_end_time;
+	size_t                      debug_tls_auth_status;
+
 	/* When more space is needed for the wire_data response than is
 	 * available in wire_data[], it will be allocated seperately.
 	 * response will then not point to wire_data anymore.
@@ -250,6 +255,8 @@ typedef struct getdns_network_req
 	size_t   wire_data_sz;
 	uint8_t  wire_data[];
 
+
+	
 } getdns_network_req;
 
 /**
@@ -274,9 +281,14 @@ typedef struct getdns_dns_req {
 	int dnssec_return_status;
 	int dnssec_return_only_secure;
 	int dnssec_return_validation_chain;
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+	int dnssec_roadblock_avoidance;
+	int avoid_dnssec_roadblocks;
+#endif
 	int edns_cookies;
 	int edns_client_subnet_private;
 	uint16_t tls_query_padding_blocksize;
+	int return_call_debugging;
 
 	/* Internally used by return_validation_chain */
 	int dnssec_ok_checking_disabled;
@@ -352,6 +364,8 @@ typedef struct getdns_dns_req {
 /* utility methods */
 
 extern getdns_dict *dnssec_ok_checking_disabled;
+extern getdns_dict *dnssec_ok_checking_disabled_roadblock_avoidance;
+extern getdns_dict *dnssec_ok_checking_disabled_avoid_roadblocks;
 
 /* dns request utils */
 getdns_dns_req *_getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop,

src/util-internal.c

@@ -38,6 +38,7 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <ctype.h>
+#include "config.h"
 #include "getdns/getdns.h"
 #include "dict.h"
 #include "list.h"
@@ -63,6 +64,9 @@ static getdns_extension_format extformats[] = {
 	{"dnssec_return_only_secure", t_int},
 	{"dnssec_return_status", t_int},
 	{"dnssec_return_validation_chain", t_int},
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+	{"dnssec_roadblock_avoidance", t_int},
+#endif
 #ifdef EDNS_COOKIES
 	{"edns_cookies", t_int},
 #endif
@@ -671,6 +675,69 @@ success:
 	return result;
 }
 
+getdns_dict *
+_getdns_create_call_debugging_dict(
+    getdns_context *context, getdns_network_req *netreq)
+{
+	getdns_bindata  qname;
+	getdns_dict    *netreq_debug;
+	getdns_dict    *address_debug = NULL;
+
+	assert(netreq);
+
+	/* It is the responsibility of the caller to free this */
+	if (!(netreq_debug = getdns_dict_create_with_context(context)))
+		return NULL;
+
+	qname.data = netreq->owner->name;
+	qname.size = netreq->owner->name_len;
+
+	if (getdns_dict_set_bindata(netreq_debug, "query_name", &qname) ||
+	    getdns_dict_set_int( netreq_debug, "query_type"
+	                       , netreq->request_type ) ||
+
+	    /* Safe, because uint32_t facilitates RRT's of almost 50 days*/
+	    getdns_dict_set_int(netreq_debug, "run_time/ms",
+		    (uint32_t)(( netreq->debug_end_time
+	                       - netreq->debug_start_time)/1000))) {
+
+		getdns_dict_destroy(netreq_debug);
+		return NULL;
+
+	} else if (!netreq->upstream)
+
+		/* Nothing more for full recursion */
+		return netreq_debug;
+
+
+	/* Stub resolver debug data */
+	_getdns_sockaddr_to_dict(
+	    context, &netreq->upstream->addr, &address_debug);
+
+	if (getdns_dict_set_dict(netreq_debug, "query_to", address_debug) ||
+	    getdns_dict_set_int( netreq_debug, "transport"
+	                       , netreq->upstream->transport)) {
+
+		getdns_dict_destroy(address_debug);
+		getdns_dict_destroy(netreq_debug);
+		return NULL;
+	}
+	getdns_dict_destroy(address_debug);
+
+	if (netreq->upstream->transport != GETDNS_TRANSPORT_TLS)
+		return netreq_debug;
+	
+	/* Only include the auth status if TLS was used */
+	if (getdns_dict_util_set_string(netreq_debug, "tls_auth_status",
+	    netreq->debug_tls_auth_status == 0 ?
+	    "OK: Hostname matched valid cert":"FAILED: Server not validated")){
+
+		getdns_dict_destroy(netreq_debug);
+		return NULL;
+	}
+	return netreq_debug;
+}
+
 getdns_dict *
 _getdns_create_getdns_response(getdns_dns_req *completed_request)
 {
@@ -678,12 +745,14 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request)
 	getdns_list *just_addrs = NULL;
 	getdns_list *replies_full;
 	getdns_list *replies_tree;
+	getdns_list *call_debugging = NULL;
 	getdns_network_req *netreq, **netreq_p;
 	int rrsigs_in_answer = 0;
 	getdns_dict *reply;
 	getdns_bindata *canonical_name = NULL;
 	int nreplies = 0, nanswers = 0, nsecure = 0, ninsecure = 0, nbogus = 0;
     	getdns_bindata full_data;
+	getdns_dict   *netreq_debug;
 
 	/* info (bools) about dns_req */
 	int dnssec_return_status;
@@ -696,7 +765,11 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request)
 		return NULL;
 
 	dnssec_return_status = completed_request->dnssec_return_status ||
-	                       completed_request->dnssec_return_only_secure;
+	                       completed_request->dnssec_return_only_secure
+#ifdef DNSSEC_ROADBLOCK_AVOIDANCE
+	                    || completed_request->dnssec_roadblock_avoidance
+#endif
+	                       ;
 
 	if (completed_request->netreqs[0]->request_type == GETDNS_RRTYPE_A ||
 	    completed_request->netreqs[0]->request_type == GETDNS_RRTYPE_AAAA)
@@ -713,6 +786,10 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request)
 	if (!(replies_tree = getdns_list_create_with_context(context)))
 		goto error_free_replies_full;
 
+	if (completed_request->return_call_debugging &&
+	    !(call_debugging = getdns_list_create_with_context(context)))
+		goto error_free_replies_full;
+
 	for ( netreq_p = completed_request->netreqs
 	    ; (netreq = *netreq_p) ; netreq_p++) {
 
@@ -769,6 +846,21 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request)
     			getdns_dict_destroy(reply);
 			goto error;
 		}
+		
+		if (call_debugging) {
+			if (!(netreq_debug =
+			   _getdns_create_call_debugging_dict(context,netreq)))
+				goto error;
+
+			if (_getdns_list_append_dict(
+			    call_debugging, netreq_debug)) {
+
+				getdns_dict_destroy(netreq_debug);
+				goto error;
+			}
+			getdns_dict_destroy(netreq_debug);
+		}
+
     		getdns_dict_destroy(reply);
 
     		/* buffer */
@@ -781,6 +873,10 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request)
 		goto error;
 	getdns_list_destroy(replies_tree);
 
+	if (call_debugging &&
+	    getdns_dict_set_list(result, "call_debugging", call_debugging))
+	    goto error_free_call_debugging;
+
 	if (getdns_dict_set_list(result, "replies_full", replies_full))
 		goto error_free_replies_full;
 	getdns_list_destroy(replies_full);
@@ -804,6 +900,8 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request)
 error:
 	/* cleanup */
 	getdns_list_destroy(replies_tree);
+error_free_call_debugging:
+	getdns_list_destroy(call_debugging);
 error_free_replies_full:
 	getdns_list_destroy(replies_full);
 error_free_result: