16 files changed, 293 insertions, 114 deletions

diff --git a/libunbound/libunbound.c b/libunbound/libunbound.c
index 78d31968ac61..91a663a773cb 100644
--- a/libunbound/libunbound.c
+++ b/libunbound/libunbound.c
@@ -363,6 +363,26 @@ ub_ctx_add_ta_file(struct ub_ctx* ctx, const char* fname)
 	return UB_NOERROR;
 }
 
+int ub_ctx_add_ta_autr(struct ub_ctx* ctx, const char* fname)
+{
+	char* dup = strdup(fname);
+	if(!dup) return UB_NOMEM;
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		free(dup);
+		return UB_AFTERFINAL;
+	}
+	if(!cfg_strlist_insert(&ctx->env->cfg->auto_trust_anchor_file_list,
+		dup)) {
+		lock_basic_unlock(&ctx->cfglock);
+		free(dup);
+		return UB_NOMEM;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
 int 
 ub_ctx_trustedkeys(struct ub_ctx* ctx, const char* fname)
 {
@@ -959,7 +979,7 @@ ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
 				parse++;
 			addr = parse;
 			/* skip [0-9a-fA-F.:]*, i.e. IP4 and IP6 address */
-			while(isxdigit(*parse) || *parse=='.' || *parse==':')
+			while(isxdigit((unsigned char)*parse) || *parse=='.' || *parse==':')
 				parse++;
 			/* terminate after the address, remove newline */
 			*parse = 0;
@@ -1031,7 +1051,7 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 		/* format: <addr> spaces <name> spaces <name> ... */
 		addr = parse;
 		/* skip addr */
-		while(isxdigit(*parse) || *parse == '.' || *parse == ':')
+		while(isxdigit((unsigned char)*parse) || *parse == '.' || *parse == ':')
 			parse++;
 		if(*parse == '\n' || *parse == 0)
 			continue;
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index 4869f0bc004e..e388e7956c81 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -48,12 +48,14 @@
 #include "libunbound/libworker.h"
 #include "libunbound/context.h"
 #include "libunbound/unbound.h"
+#include "libunbound/worker.h"
 #include "libunbound/unbound-event.h"
 #include "services/outside_network.h"
 #include "services/mesh.h"
 #include "services/localzone.h"
 #include "services/cache/rrset.h"
 #include "services/outbound_list.h"
+#include "util/fptr_wlist.h"
 #include "util/module.h"
 #include "util/regional.h"
 #include "util/random.h"
@@ -231,7 +233,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct event_base* eb)
 		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
 		ports, numports, cfg->unwanted_threshold,
 		&libworker_alloc_cleanup, w, cfg->do_udp, w->sslctx,
-		cfg->delay_close);
+		cfg->delay_close, NULL);
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
 	}
@@ -819,8 +821,9 @@ void libworker_alloc_cleanup(void* arg)
 
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
         uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t* zone, size_t zonelen, struct module_qstate* q)
+	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* zone, size_t zonelen,
+	struct module_qstate* q)
 {
 	struct libworker* w = (struct libworker*)q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -829,7 +832,7 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(w->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
+		qnamelen, qtype, qclass, flags, dnssec, want_dnssec, nocaps,
 		q->env->cfg->tcp_upstream, q->env->cfg->ssl_upstream, addr,
 		addrlen, zone, zonelen, libworker_handle_service_reply, e,
 		w->back->udp_buff);
@@ -951,8 +954,9 @@ struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname),
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
 	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
-	struct sockaddr_storage* ATTR_UNUSED(addr), 
-	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
+	int ATTR_UNUSED(nocaps), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
+	size_t ATTR_UNUSED(zonelen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;
diff --git a/libunbound/libworker.h b/libunbound/libworker.h
index 134cc5070144..0103b5d8898d 100644
--- a/libunbound/libworker.h
+++ b/libunbound/libworker.h
@@ -41,8 +41,8 @@
  * and if in the background continues until exit, if in the foreground
  * returns from the procedure when done.
  */
-#ifndef LIBUNBOUND_WORKER_H
-#define LIBUNBOUND_WORKER_H
+#ifndef LIBUNBOUND_LIBWORKER_H
+#define LIBUNBOUND_LIBWORKER_H
 #include "util/data/packed_rrset.h"
 struct ub_ctx;
 struct ub_result;
@@ -136,56 +136,6 @@ void libworker_delete_event(struct libworker* w);
 /** cleanup the cache to remove all rrset IDs from it, arg is libworker */
 void libworker_alloc_cleanup(void* arg);
 
-/**
- * Worker service routine to send serviced queries to authoritative servers.
- * @param qname: query name. (host order)
- * @param qnamelen: length in bytes of qname, including trailing 0.
- * @param qtype: query type. (host order)
- * @param qclass: query class. (host order)
- * @param flags: host order flags word, with opcode and CD bit.
- * @param dnssec: if set, EDNS record will have DO bit set.
- * @param want_dnssec: signatures needed.
- * @param addr: where to.
- * @param addrlen: length of addr.
- * @param zone: delegation point name.
- * @param zonelen: length of zone name wireformat dname.
- * @param q: wich query state to reactivate upon return.
- * @return: false on failure (memory or socket related). no query was
- *      sent.
- */
-struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
-        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t* zone, size_t zonelen, struct module_qstate* q);
-
-/** process incoming replies from the network */
-int libworker_handle_reply(struct comm_point* c, void* arg, int error,
-        struct comm_reply* reply_info);
-
-/** process incoming serviced query replies from the network */
-int libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
-        struct comm_reply* reply_info);
-
-/** handle control command coming into server */
-void libworker_handle_control_cmd(struct tube* tube, uint8_t* msg, size_t len,
-	int err, void* arg);
-
-/** handle opportunity to write result back */
-void libworker_handle_result_write(struct tube* tube, uint8_t* msg, size_t len,
-	int err, void* arg);
-
-/** mesh callback with fg results */
-void libworker_fg_done_cb(void* arg, int rcode, struct sldns_buffer* buf, 
-	enum sec_status s, char* why_bogus);
-
-/** mesh callback with bg results */
-void libworker_bg_done_cb(void* arg, int rcode, struct sldns_buffer* buf, 
-	enum sec_status s, char* why_bogus);
-
-/** mesh callback with event results */
-void libworker_event_done_cb(void* arg, int rcode, struct sldns_buffer* buf, 
-	enum sec_status s, char* why_bogus);
-
 /** 
  * fill result from parsed message, on error fills servfail 
  * @param res: is clear at start, filled in at end.
@@ -198,4 +148,4 @@ void libworker_event_done_cb(void* arg, int rcode, struct sldns_buffer* buf,
 void libworker_enter_result(struct ub_result* res, struct sldns_buffer* buf,
 	struct regional* temp, enum sec_status msg_security);
 
-#endif /* LIBUNBOUND_WORKER_H */
+#endif /* LIBUNBOUND_LIBWORKER_H */
diff --git a/libunbound/python/examples/async-lookup.py b/libunbound/python/examples/async-lookup.py
index 52a2d3c75c51..cbb8ea02d29a 100644
--- a/libunbound/python/examples/async-lookup.py
+++ b/libunbound/python/examples/async-lookup.py
@@ -39,9 +39,9 @@ ctx = unbound.ub_ctx()
 ctx.resolvconf("/etc/resolv.conf")
 
 def call_back(my_data,status,result):
-    print "Call_back:", my_data
+    print("Call_back:", my_data)
     if status == 0 and result.havedata:
-        print "Result:", result.data.address_list
+        print("Result:", result.data.address_list)
         my_data['done_flag'] = True
 
 
@@ -53,4 +53,4 @@ while (status == 0) and (not my_data['done_flag']):
     time.sleep(0.1)
 
 if (status != 0):
-    print "Resolve error:", unbound.ub_strerror(status)
+    print("Resolve error:", unbound.ub_strerror(status))
diff --git a/libunbound/python/examples/dns-lookup.py b/libunbound/python/examples/dns-lookup.py
index 2821ed3ba363..b3f4008fdd91 100644
--- a/libunbound/python/examples/dns-lookup.py
+++ b/libunbound/python/examples/dns-lookup.py
@@ -39,6 +39,6 @@ ctx.resolvconf("/etc/resolv.conf")
 
 status, result = ctx.resolve("www.nic.cz", unbound.RR_TYPE_A, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result:", result.data.address_list
+    print("Result:", result.data.address_list)
 elif status != 0:
-    print "Error:", unbound.ub_strerror(status)
+    print("Error:", unbound.ub_strerror(status))
diff --git a/libunbound/python/examples/dnssec-valid.py b/libunbound/python/examples/dnssec-valid.py
index 3e05ddd7a28e..5c3cad9e9036 100644
--- a/libunbound/python/examples/dnssec-valid.py
+++ b/libunbound/python/examples/dnssec-valid.py
@@ -48,12 +48,12 @@ if os.path.isfile("keys"):
 status, result = ctx.resolve("www.nic.cz", RR_TYPE_A, RR_CLASS_IN)
 if status == 0 and result.havedata:
 
-    print "Result:", result.data.address_list
+    print("Result:", result.data.address_list)
 
     if result.secure:
-        print "Result is secure"
+        print("Result is secure")
     elif result.bogus:
-        print "Result is bogus"
+        print("Result is bogus")
     else:
-        print "Result is insecure"
+        print("Result is insecure")
 
diff --git a/libunbound/python/examples/dnssec_test.py b/libunbound/python/examples/dnssec_test.py
index 138e19b51a12..0d62b9ff2154 100644
--- a/libunbound/python/examples/dnssec_test.py
+++ b/libunbound/python/examples/dnssec_test.py
@@ -3,27 +3,27 @@ from unbound import ub_ctx, RR_TYPE_A, RR_TYPE_RRSIG, RR_TYPE_NSEC, RR_TYPE_NSEC
 import ldns
 
 def dnssecParse(domain, rrType=RR_TYPE_A):
-    print "Resolving domain", domain
+    print("Resolving domain", domain)
     s, r = resolver.resolve(domain)
-    print "status: %s, secure: %s, rcode: %s, havedata: %s, answer_len; %s" % (s, r.secure, r.rcode_str, r.havedata, r.answer_len)
+    print("status: %s, secure: %s, rcode: %s, havedata: %s, answer_len; %s" % (s, r.secure, r.rcode_str, r.havedata, r.answer_len))
     
     s, pkt = ldns.ldns_wire2pkt(r.packet)
     if s != 0:
         raise RuntimeError("Error parsing DNS packet")
 
     rrsigs = pkt.rr_list_by_type(RR_TYPE_RRSIG, ldns.LDNS_SECTION_ANSWER)
-    print "RRSIGs from answer:", rrsigs
+    print("RRSIGs from answer:", rrsigs)
     
     rrsigs = pkt.rr_list_by_type(RR_TYPE_RRSIG, ldns.LDNS_SECTION_AUTHORITY)
-    print "RRSIGs from authority:", rrsigs
+    print("RRSIGs from authority:", rrsigs)
     
     nsecs = pkt.rr_list_by_type(RR_TYPE_NSEC, ldns.LDNS_SECTION_AUTHORITY)
-    print "NSECs:", nsecs
+    print("NSECs:", nsecs)
     
     nsec3s = pkt.rr_list_by_type(RR_TYPE_NSEC3, ldns.LDNS_SECTION_AUTHORITY)
-    print "NSEC3s:", nsec3s
+    print("NSEC3s:", nsec3s)
     
-    print "---"
+    print("---")
 
 
 resolver = ub_ctx()
diff --git a/libunbound/python/examples/example8-1.py b/libunbound/python/examples/example8-1.py
index 6816da0c2df2..ca868e510685 100644
--- a/libunbound/python/examples/example8-1.py
+++ b/libunbound/python/examples/example8-1.py
@@ -40,22 +40,22 @@ ctx.resolvconf("/etc/resolv.conf")
 
 status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_MX, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result:"
-    print "      raw data:", result.data
+    print("Result:")
+    print("      raw data:", result.data)
     for k in result.data.mx_list:
-        print "      priority:%d address:%s" % k
+        print("      priority:%d address:%s" % k)
 
 status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_A, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result:"
-    print "      raw data:", result.data
+    print("Result:")
+    print("      raw data:", result.data)
     for k in result.data.address_list:
-        print "      address:%s" % k
+        print("      address:%s" % k)
 
 status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_NS, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result:"
-    print "      raw data:", result.data
+    print("Result:")
+    print("      raw data:", result.data)
     for k in result.data.domain_list:
-        print "      host: %s" % k
+        print("      host: %s" % k)
 
diff --git a/libunbound/python/examples/idn-lookup.py b/libunbound/python/examples/idn-lookup.py
index 7cfdc9e9479c..2170637d32b0 100644
--- a/libunbound/python/examples/idn-lookup.py
+++ b/libunbound/python/examples/idn-lookup.py
@@ -43,20 +43,20 @@ ctx.resolvconf("/etc/resolv.conf")
 #The unicode IDN string is automatically converted (if necessary)
 status, result = ctx.resolve(u"www.háčkyčárky.cz", unbound.RR_TYPE_A, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result:"
-    print "      raw data:", result.data
+    print("Result:")
+    print("      raw data:", result.data)
     for k in result.data.address_list:
-        print "      address:%s" % k
+        print("      address:%s" % k)
 
 status, result = ctx.resolve(u"háčkyčárky.cz", unbound.RR_TYPE_MX, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result:"
-    print "      raw data:", result.data
+    print("Result:")
+    print("      raw data:", result.data)
     for k in result.data.mx_list_idn:
-        print "      priority:%d address:%s" % k
+        print("      priority:%d address:%s" % k)
 
 status, result = ctx.resolve(unbound.reverse('217.31.204.66')+'.in-addr.arpa', unbound.RR_TYPE_PTR, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result.data:", result.data
+    print("Result.data:", result.data)
     for k in result.data.domain_list_idn:
-        print "      dname:%s" % k
+        print("      dname:%s" % k)
diff --git a/libunbound/python/examples/mx-lookup.py b/libunbound/python/examples/mx-lookup.py
index cdcd1b166b45..f83f690f85ac 100644
--- a/libunbound/python/examples/mx-lookup.py
+++ b/libunbound/python/examples/mx-lookup.py
@@ -40,14 +40,14 @@ ctx.resolvconf("/etc/resolv.conf")
 
 status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_MX, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result:"
-    print "      raw data:", result.data
+    print("Result:")
+    print("      raw data:", result.data)
     for k in result.data.mx_list:
-        print "      priority:%d address:%s" % k
+        print("      priority:%d address:%s" % k)
 
 status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_A, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result:"
-    print "      raw data:", result.data
+    print("Result:")
+    print("      raw data:", result.data)
     for k in result.data.address_list:
-        print "      address:%s" % k
+        print("      address:%s" % k)
diff --git a/libunbound/python/examples/ns-lookup.py b/libunbound/python/examples/ns-lookup.py
index f9eafb28aa3c..bcd51de6dfd6 100644
--- a/libunbound/python/examples/ns-lookup.py
+++ b/libunbound/python/examples/ns-lookup.py
@@ -40,8 +40,8 @@ ctx.resolvconf("/etc/resolv.conf")
 
 status, result = ctx.resolve("vutbr.cz", unbound.RR_TYPE_NS, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result:"
-    print "      raw data:", result.data
+    print("Result:")
+    print("      raw data:", result.data)
     for k in result.data.domain_list:
-        print "      host: %s" % k
+        print("      host: %s" % k)
 
diff --git a/libunbound/python/examples/reverse-lookup.py b/libunbound/python/examples/reverse-lookup.py
index 4d3e0bb36dff..7e06844ec6a9 100644
--- a/libunbound/python/examples/reverse-lookup.py
+++ b/libunbound/python/examples/reverse-lookup.py
@@ -39,5 +39,5 @@ ctx.resolvconf("/etc/resolv.conf")
 
 status, result = ctx.resolve(unbound.reverse("74.125.43.147") + ".in-addr.arpa.", unbound.RR_TYPE_PTR, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print "Result.data:", result.data, result.data.domain_list
+    print("Result.data:", result.data, result.data.domain_list)
 
diff --git a/libunbound/python/libunbound.i b/libunbound/python/libunbound.i
index 4f9279957fac..313c74862f4d 100644
--- a/libunbound/python/libunbound.i
+++ b/libunbound/python/libunbound.i
@@ -44,6 +44,15 @@
 
 %pythoncode %{
    import encodings.idna
+
+   # Ensure compatibility with older python versions
+   if 'bytes' not in vars():
+       bytes = str
+
+   def ord(s):
+       if isinstance(s, int):
+           return s
+       return __builtins__.ord(s)
 %}
 
 //%include "doc.i"
@@ -559,10 +568,10 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
                :returns: * (int) 0 if OK, else error.
                          * (:class:`ub_result`) the result data is returned in a newly allocated result structure. May be None on return, return value is set to an error in that case (out of memory).
             """
-            if isinstance(name, unicode): #probably IDN
-                return _unbound.ub_resolve(self,idn2dname(name),rrtype,rrclass)
-            else:
+            if isinstance(name, bytes): #probably IDN
                 return _unbound.ub_resolve(self,name,rrtype,rrclass)
+            else:
+                return _unbound.ub_resolve(self,idn2dname(name),rrtype,rrclass)
             #parameters: struct ub_ctx *,char *,int,int,
             #retvals: int,struct ub_result **
 
@@ -597,10 +606,10 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
                         * `result` - the result structure. The result may be None, in that case err is set.
 
             """
-            if isinstance(name, unicode): #probably IDN
-                return _unbound._ub_resolve_async(self,idn2dname(name),rrtype,rrclass,mydata,callback)
-            else:
+            if isinstance(name, bytes): #probably IDN
                 return _unbound._ub_resolve_async(self,name,rrtype,rrclass,mydata,callback)
+            else:
+                return _unbound._ub_resolve_async(self,idn2dname(name),rrtype,rrclass,mydata,callback)
             #parameters: struct ub_ctx *,char *,int,int,void *,ub_callback_t,
             #retvals: int, int
 
@@ -689,7 +698,8 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
          idx = ofs
          while (idx < slen):
             complen = ord(s[idx])
-            res.append(s[idx+1:idx+1+complen])
+            # In python 3.x `str()` converts the string to unicode which is the expected text string type
+            res.append(str(s[idx+1:idx+1+complen]))
             idx += complen + 1
 
          return res
@@ -764,13 +774,13 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
      
      list = PyList_New(cnt);
      for (i=0;i<cnt;i++) 
-         PyList_SetItem(list, i, PyString_FromStringAndSize(result->data[i],result->len[i]));
+         PyList_SetItem(list, i, PyBytes_FromStringAndSize(result->data[i],result->len[i]));
      
      return list;
   }
 
   PyObject* _packet() {
-      return PyString_FromStringAndSize($self->answer_packet, $self->answer_len);
+      return PyBytes_FromStringAndSize($self->answer_packet, $self->answer_len);
   }
   
  %pythoncode %{
diff --git a/libunbound/ubsyms.def b/libunbound/ubsyms.def
index 866c1764cf7a..ff3d9587b7cd 100644
--- a/libunbound/ubsyms.def
+++ b/libunbound/ubsyms.def
@@ -8,6 +8,7 @@ ub_ctx_set_fwd
 ub_ctx_resolvconf
 ub_ctx_hosts
 ub_ctx_add_ta
+ub_ctx_add_ta_autr
 ub_ctx_add_ta_file
 ub_ctx_trustedkeys
 ub_ctx_debugout
diff --git a/libunbound/unbound.h b/libunbound/unbound.h
index 86bd3bfb444d..567f48271e3e 100644
--- a/libunbound/unbound.h
+++ b/libunbound/unbound.h
@@ -357,6 +357,21 @@ int ub_ctx_add_ta(struct ub_ctx* ctx, const char* ta);
 int ub_ctx_add_ta_file(struct ub_ctx* ctx, const char* fname);
 
 /**
+ * Add trust anchor to the give context that is tracked with RFC5011
+ * automated trust anchor maintenance.  The file is written to when the
+ * trust anchor is changed.
+ * Pass the name of a file that was output from eg. unbound-anchor,
+ * or you can start it by providing a trusted DNSKEY or DS record on one
+ * line in the file.
+ * @param ctx: context.
+ *	At this time it is only possible to add trusted keys before the
+ *	first resolve is done.
+ * @param fname: filename of file with trust anchor.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_add_ta_autr(struct ub_ctx* ctx, const char* fname);
+
+/**
  * Add trust anchors to the given context.
  * Pass the name of a bind-style config file with trusted-keys{}.
  * @param ctx: context.
@@ -508,7 +523,7 @@ void ub_resolve_free(struct ub_result* result);
 
 /** 
  * Convert error value to a human readable string.
- * @param err: error code from one of the ub_val* functions.
+ * @param err: error code from one of the libunbound functions.
  * @return pointer to constant text string, zero terminated.
  */
 const char* ub_strerror(int err);
diff --git a/libunbound/worker.h b/libunbound/worker.h
new file mode 100644
index 000000000000..824012a01848
--- /dev/null
+++ b/libunbound/worker.h
@@ -0,0 +1,179 @@
+/*
+ * libunbound/worker.h - prototypes for worker methods.
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file declares the methods any worker has to implement.
+ */
+
+#ifndef LIBUNBOUND_WORKER_H
+#define LIBUNBOUND_WORKER_H
+
+#include "ldns/sbuffer.h"
+#include "util/data/packed_rrset.h" /* for enum sec_status */
+struct comm_reply;
+struct comm_point;
+struct module_qstate;
+struct tube;
+
+/**
+ * Worker service routine to send serviced queries to authoritative servers.
+ * @param qname: query name. (host order)
+ * @param qnamelen: length in bytes of qname, including trailing 0.
+ * @param qtype: query type. (host order)
+ * @param qclass: query class. (host order)
+ * @param flags: host order flags word, with opcode and CD bit.
+ * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
+ * @param nocaps: ignore capsforid(if in config), do not perturb qname.
+ * @param addr: where to.
+ * @param addrlen: length of addr.
+ * @param zone: delegation point name.
+ * @param zonelen: length of zone name wireformat dname.
+ * @param q: wich query state to reactivate upon return.
+ * @return: false on failure (memory or socket related). no query was
+ *      sent.
+ */
+struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
+        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
+	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* zone, size_t zonelen,
+	struct module_qstate* q);
+
+/** process incoming replies from the network */
+int libworker_handle_reply(struct comm_point* c, void* arg, int error,
+        struct comm_reply* reply_info);
+
+/** process incoming serviced query replies from the network */
+int libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
+        struct comm_reply* reply_info);
+
+/** handle control command coming into server */
+void libworker_handle_control_cmd(struct tube* tube, uint8_t* msg, size_t len,
+	int err, void* arg);
+
+/** mesh callback with fg results */
+void libworker_fg_done_cb(void* arg, int rcode, sldns_buffer* buf, 
+	enum sec_status s, char* why_bogus);
+
+/** mesh callback with bg results */
+void libworker_bg_done_cb(void* arg, int rcode, sldns_buffer* buf, 
+	enum sec_status s, char* why_bogus);
+
+/** mesh callback with event results */
+void libworker_event_done_cb(void* arg, int rcode, struct sldns_buffer* buf, 
+	enum sec_status s, char* why_bogus);
+
+/**
+ * Worker signal handler function. User argument is the worker itself.
+ * @param sig: signal number.
+ * @param arg: the worker (main worker) that handles signals.
+ */
+void worker_sighandler(int sig, void* arg);
+
+/**
+ * Worker service routine to send serviced queries to authoritative servers.
+ * @param qname: query name. (host order)
+ * @param qnamelen: length in bytes of qname, including trailing 0.
+ * @param qtype: query type. (host order)
+ * @param qclass: query class. (host order)
+ * @param flags: host order flags word, with opcode and CD bit.
+ * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
+ * @param nocaps: ignore capsforid(if in config), do not perturb qname.
+ * @param addr: where to.
+ * @param addrlen: length of addr.
+ * @param zone: wireformat dname of the zone.
+ * @param zonelen: length of zone name.
+ * @param q: wich query state to reactivate upon return.
+ * @return: false on failure (memory or socket related). no query was
+ *      sent.
+ */
+struct outbound_entry* worker_send_query(uint8_t* qname, size_t qnamelen, 
+	uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
+	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* zone, size_t zonelen,
+	struct module_qstate* q);
+
+/** 
+ * process control messages from the main thread. Frees the control 
+ * command message.
+ * @param tube: tube control message came on.
+ * @param msg: message contents.  Is freed.
+ * @param len: length of message.
+ * @param error: if error (NETEVENT_*) happened.
+ * @param arg: user argument
+ */
+void worker_handle_control_cmd(struct tube* tube, uint8_t* msg, size_t len,
+	int error, void* arg);
+
+/** handles callbacks from listening event interface */
+int worker_handle_request(struct comm_point* c, void* arg, int error,
+	struct comm_reply* repinfo);
+
+/** process incoming replies from the network */
+int worker_handle_reply(struct comm_point* c, void* arg, int error, 
+	struct comm_reply* reply_info);
+
+/** process incoming serviced query replies from the network */
+int worker_handle_service_reply(struct comm_point* c, void* arg, int error, 
+	struct comm_reply* reply_info);
+
+/** cleanup the cache to remove all rrset IDs from it, arg is worker */
+void worker_alloc_cleanup(void* arg);
+
+/** statistics timer callback handler */
+void worker_stat_timer_cb(void* arg);
+
+/** probe timer callback handler */
+void worker_probe_timer_cb(void* arg);
+
+/** start accept callback handler */
+void worker_start_accept(void* arg);
+
+/** stop accept callback handler */
+void worker_stop_accept(void* arg);
+
+/** handle remote control accept callbacks */
+int remote_accept_callback(struct comm_point*, void*, int, struct comm_reply*);
+
+/** handle remote control data callbacks */
+int remote_control_callback(struct comm_point*, void*, int, struct comm_reply*);
+
+/** routine to printout option values over SSL */
+void  remote_get_opt_ssl(char* line, void* arg);
+
+#endif /* LIBUNBOUND_WORKER_H */