Imported Upstream version 0.9upstream/0.9

author: Ondřej Surý <ondrej@sury.org> 2012-01-16 09:06:06 +0100
committer: Ondřej Surý <ondrej@sury.org> 2012-01-16 09:06:06 +0100
commit: 008d2859f102613c5a1d064c97e5dc7ea753faa2 (patch)
tree: 3c86cc7ea7616be45fc1aa6179967af62beef1ad
parent: 24569f087c5ea054a9199d7532dbbc98dd760ab5 (diff)
download: knot-008d2859f102613c5a1d064c97e5dc7ea753faa2.tar.gz
59 files changed, 5121 insertions, 2619 deletions
diff --git a/KNOWN_ISSUES b/KNOWN_ISSUES
index b2da935..1a42844 100644
--- a/KNOWN_ISSUES
+++ b/KNOWN_ISSUES
@@ -4,7 +4,6 @@ Features not supported
 Here is a list of the most notable features that are not supported in the 
 current version of Knot.
 
-* TSIG
 * NSID (RFC5001)
 * RRSet rotation
 * Root zone support
diff --git a/Knot.files b/Knot.files
index 001186d..e60b931 100644
--- a/Knot.files
+++ b/Knot.files
@@ -50,7 +50,7 @@ src/libknot/util/utils.h
 src/libknot/util/utils.c
 src/libknot/util/descriptor.h
 src/libknot/util/descriptor.c
-src/libknot/util/error.c
+src/libknot/util/libknot_error.c
 src/libknot/util/error.h
 src/libknot/zone/zonedb.h
 src/libknot/zone/zonedb.c
@@ -251,3 +251,11 @@ src/libknot/tsig.h
 src/libknot/tsig.c
 src/libknot/tsig-op.c
 src/libknot/tsig-op.h
+src/libknot/util/conv.c
+src/libknot/util/conv.h
+src/tests/libknot/libknot/tsig_tests.h
+src/tests/libknot/libknot/tsig_tests.c
+src/knot/zone/semantic-check.c
+src/knot/zone/semantic-check.h
+src/tests/xfr_tests.h
+src/tests/xfr_tests.c
diff --git a/RELNOTES b/RELNOTES
index a948f15..147f9c2 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,3 +1,20 @@
+v0.9 - Jan 13, 2012
+-------------------
+
+New features:
+        * TSIG support in both client and server.
+        * Use of sendmmsg() on Linux 3.0+ (improves performance).
+
+Bugfixes:
+        * Knot was not accepting AXFR-style IXFR with first SOA in a separate 
+          packet (i.e. from Power DNS).
+        * Wrong SOA TTL in negative answers.
+        * Wrong max packet size for outgoing transfers (was causing the 
+          packets to be malformed).
+        * Wrong handling of WKS record in zone compiler.
+        * Problems with zone bootstrapping.
+
+
 v0.8.1 - Dec 1, 2011
 --------------------
 
diff --git a/src/Makefile.am b/src/Makefile.am
index 7c86e3f..f8d81e5 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1,5 +1,5 @@
 ACLOCAL_AMFLAGS = -I ../m4
-libexec_PROGRAMS = knot-zcompile unittests unittests-zcompile unittests-libknot-realdata unittests-libknot
+libexec_PROGRAMS = knot-zcompile unittests unittests-zcompile unittests-libknot-realdata unittests-libknot unittests-xfr
 sbin_PROGRAMS = knotc knotd
 MANPAGES = knotc.8 knotd.8
 man8_MANS = knotc.8 knotd.8
@@ -66,8 +66,8 @@ unittests_SOURCES =				\
 	tests/common/skiplist_tests.h		\
 	tests/common/slab_tests.c		\
 	tests/common/slab_tests.h		\
-        tests/common/fdset_tests.c		\
-        tests/common/fdset_tests.h		\
+	tests/common/fdset_tests.c		\
+	tests/common/fdset_tests.h		\
 	tests/knot/conf_tests.c			\
 	tests/knot/conf_tests.h			\
 	tests/knot/dthreads_tests.c		\
@@ -116,9 +116,11 @@ unittests_libknot_SOURCES =			\
 	tests/libknot/libknot/rdata_tests.h	\
 	tests/libknot/libknot/rrset_tests.c	\
 	tests/libknot/libknot/rrset_tests.h	\
+	tests/libknot/libknot/tsig_tests.c	\
+	tests/libknot/libknot/tsig_tests.h	\
 	tests/libknot/libknot/zone_tests.c	\
 	tests/libknot/libknot/zone_tests.h	\
-	tests/libknot/libknot/zone_tree_tests.h\
+	tests/libknot/libknot/zone_tree_tests.h	\
 	tests/libknot/libknot/zone_tree_tests.c	\
 	tests/libknot/libknot/zonedb_tests.c	\
 	tests/libknot/libknot/zonedb_tests.h	\
@@ -135,6 +137,10 @@ unittests_zcompile_SOURCES =			\
 	zcompile/parser-descriptor.c		\
 	zcompile/tests/unittests_zp_main.c
 
+unittests_xfr_SOURCES = 			\
+	tests/xfr_tests.c		\
+	tests/xfr_tests.h
+
 nodist_unittests_SOURCES =			\
 	tests/libknot/parsed_data.rc		\
 	tests/libknot/raw_data_queries.rc	\
@@ -153,6 +159,8 @@ libknot_la_SOURCES =				\
 	libknot/util/debug.c			\
 	libknot/util/debug.h			\
 	libknot/util/utils.h			\
+	libknot/util/conv.h			\
+	libknot/util/conv.c			\
 	libknot/util/descriptor.c		\
 	libknot/util/tolower.h			\
 	libknot/util/tolower.c			\
@@ -294,6 +302,8 @@ libknotd_la_SOURCES =				\
 	knot/server/zones.h				\
 	knot/zone/zone-load.c			\
 	knot/zone/zone-load.h			\
+	knot/zone/semantic-check.c		\
+	knot/zone/semantic-check.h		\
 	knot/zone/zone-dump.c			\
 	knot/zone/zone-dump-text.c			\
 	knot/zone/zone-dump-text.h			\
@@ -309,6 +319,7 @@ unittests_LDADD = libknotd.la libknots.la @LIBOBJS@
 unittests_zcompile_LDADD = libknot.la libknots.la libknotd.la @LIBOBJS@
 unittests_libknot_LDADD = libknot.la libknots.la @LIBOBJS@
 unittests_libknot_realdata_LDADD = libknot.la libknots.la @LIBOBJS@
+unittests_xfr_LDADD = libknotd.la libknot.la libknots.la @LIBOBJS@
 
 # automake complains on % rules:
 #   `%'-style pattern rules are a GNU make extension
diff --git a/src/Makefile.in b/src/Makefile.in
index efbd2d9..d144a8d 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -37,7 +37,8 @@ build_triplet = @build@
 host_triplet = @host@
 libexec_PROGRAMS = knot-zcompile$(EXEEXT) unittests$(EXEEXT) \
 	unittests-zcompile$(EXEEXT) \
-	unittests-libknot-realdata$(EXEEXT) unittests-libknot$(EXEEXT)
+	unittests-libknot-realdata$(EXEEXT) unittests-libknot$(EXEEXT) \
+	unittests-xfr$(EXEEXT)
 sbin_PROGRAMS = knotc$(EXEEXT) knotd$(EXEEXT)
 subdir = src
 DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in \
@@ -59,7 +60,7 @@ CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
 LTLIBRARIES = $(noinst_LTLIBRARIES)
 libknot_la_LIBADD =
-am_libknot_la_OBJECTS = libknot_error.lo utils.lo debug.lo \
+am_libknot_la_OBJECTS = libknot_error.lo utils.lo debug.lo conv.lo \
 	descriptor.lo tolower.lo query.lo response.lo packet.lo \
 	zone.lo zone-contents.lo zone-tree.lo zonedb.lo node.lo \
 	dname-table.lo hash-functions.lo cuckoo-hash-table.lo \
@@ -72,7 +73,8 @@ am_libknotd_la_OBJECTS = gatherer.lo stat.lo log.lo error.lo \
 	libknotd_la-cf-parse.lo libknotd_la-cf-lex.lo conf.lo \
 	logconf.lo process.lo dthreads.lo journal.lo socket.lo \
 	server.lo udp-handler.lo tcp-handler.lo xfr-handler.lo \
-	zones.lo notify.lo zone-load.lo zone-dump.lo zone-dump-text.lo
+	zones.lo notify.lo zone-load.lo semantic-check.lo zone-dump.lo \
+	zone-dump-text.lo
 libknotd_la_OBJECTS = $(am_libknotd_la_OBJECTS)
 libknots_la_DEPENDENCIES = @LIBOBJS@
 am_libknots_la_OBJECTS = slab.lo malloc.lo tap.lo lists.lo base32.lo \
@@ -113,8 +115,9 @@ am_unittests_libknot_OBJECTS = cuckoo_tests.$(OBJEXT) \
 	packet_tests.$(OBJEXT) query_tests.$(OBJEXT) \
 	edns_tests.$(OBJEXT) node_tests.$(OBJEXT) \
 	rdata_tests.$(OBJEXT) rrset_tests.$(OBJEXT) \
-	zone_tests.$(OBJEXT) zone_tree_tests.$(OBJEXT) \
-	zonedb_tests.$(OBJEXT) unittests_libknot.$(OBJEXT)
+	tsig_tests.$(OBJEXT) zone_tests.$(OBJEXT) \
+	zone_tree_tests.$(OBJEXT) zonedb_tests.$(OBJEXT) \
+	unittests_libknot.$(OBJEXT)
 unittests_libknot_OBJECTS = $(am_unittests_libknot_OBJECTS)
 unittests_libknot_DEPENDENCIES = libknot.la libknots.la @LIBOBJS@
 am_unittests_libknot_realdata_OBJECTS =  \
@@ -130,6 +133,10 @@ unittests_libknot_realdata_OBJECTS =  \
 	$(am_unittests_libknot_realdata_OBJECTS)
 unittests_libknot_realdata_DEPENDENCIES = libknot.la libknots.la \
 	@LIBOBJS@ $(am__empty)
+am_unittests_xfr_OBJECTS = xfr_tests.$(OBJEXT)
+unittests_xfr_OBJECTS = $(am_unittests_xfr_OBJECTS)
+unittests_xfr_DEPENDENCIES = libknotd.la libknot.la libknots.la \
+	@LIBOBJS@ $(am__empty)
 am_unittests_zcompile_OBJECTS = zcompile-error.$(OBJEXT) \
 	zparser.$(OBJEXT) zlexer.$(OBJEXT) zcompile.$(OBJEXT) \
 	parser-util.$(OBJEXT) parser-descriptor.$(OBJEXT) \
@@ -163,13 +170,13 @@ SOURCES = $(libknot_la_SOURCES) $(libknotd_la_SOURCES) \
 	$(libknots_la_SOURCES) $(knot_zcompile_SOURCES) \
 	$(knotc_SOURCES) $(knotd_SOURCES) $(unittests_SOURCES) \
 	$(nodist_unittests_SOURCES) $(unittests_libknot_SOURCES) \
-	$(unittests_libknot_realdata_SOURCES) \
+	$(unittests_libknot_realdata_SOURCES) $(unittests_xfr_SOURCES) \
 	$(unittests_zcompile_SOURCES)
 DIST_SOURCES = $(libknot_la_SOURCES) $(libknotd_la_SOURCES) \
 	$(libknots_la_SOURCES) $(knot_zcompile_SOURCES) \
 	$(knotc_SOURCES) $(knotd_SOURCES) $(unittests_SOURCES) \
 	$(unittests_libknot_SOURCES) \
-	$(unittests_libknot_realdata_SOURCES) \
+	$(unittests_libknot_realdata_SOURCES) $(unittests_xfr_SOURCES) \
 	$(unittests_zcompile_SOURCES)
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
 am__vpath_adj = case $$p in \
@@ -383,8 +390,8 @@ unittests_SOURCES = \
 	tests/common/skiplist_tests.h		\
 	tests/common/slab_tests.c		\
 	tests/common/slab_tests.h		\
-        tests/common/fdset_tests.c		\
-        tests/common/fdset_tests.h		\
+	tests/common/fdset_tests.c		\
+	tests/common/fdset_tests.h		\
 	tests/knot/conf_tests.c			\
 	tests/knot/conf_tests.h			\
 	tests/knot/dthreads_tests.c		\
@@ -433,9 +440,11 @@ unittests_libknot_SOURCES = \
 	tests/libknot/libknot/rdata_tests.h	\
 	tests/libknot/libknot/rrset_tests.c	\
 	tests/libknot/libknot/rrset_tests.h	\
+	tests/libknot/libknot/tsig_tests.c	\
+	tests/libknot/libknot/tsig_tests.h	\
 	tests/libknot/libknot/zone_tests.c	\
 	tests/libknot/libknot/zone_tests.h	\
-	tests/libknot/libknot/zone_tree_tests.h\
+	tests/libknot/libknot/zone_tree_tests.h	\
 	tests/libknot/libknot/zone_tree_tests.c	\
 	tests/libknot/libknot/zonedb_tests.c	\
 	tests/libknot/libknot/zonedb_tests.h	\
@@ -452,6 +461,10 @@ unittests_zcompile_SOURCES = \
 	zcompile/parser-descriptor.c		\
 	zcompile/tests/unittests_zp_main.c
 
+unittests_xfr_SOURCES = \
+	tests/xfr_tests.c		\
+	tests/xfr_tests.h
+
 nodist_unittests_SOURCES = \
 	tests/libknot/parsed_data.rc		\
 	tests/libknot/raw_data_queries.rc	\
@@ -469,6 +482,8 @@ libknot_la_SOURCES = \
 	libknot/util/debug.c			\
 	libknot/util/debug.h			\
 	libknot/util/utils.h			\
+	libknot/util/conv.h			\
+	libknot/util/conv.c			\
 	libknot/util/descriptor.c		\
 	libknot/util/tolower.h			\
 	libknot/util/tolower.c			\
@@ -610,6 +625,8 @@ libknotd_la_SOURCES = \
 	knot/server/zones.h				\
 	knot/zone/zone-load.c			\
 	knot/zone/zone-load.h			\
+	knot/zone/semantic-check.c		\
+	knot/zone/semantic-check.h		\
 	knot/zone/zone-dump.c			\
 	knot/zone/zone-dump-text.c			\
 	knot/zone/zone-dump-text.h			\
@@ -625,6 +642,7 @@ unittests_LDADD = libknotd.la libknots.la @LIBOBJS@
 unittests_zcompile_LDADD = libknot.la libknots.la libknotd.la @LIBOBJS@
 unittests_libknot_LDADD = libknot.la libknots.la @LIBOBJS@
 unittests_libknot_realdata_LDADD = libknot.la libknots.la @LIBOBJS@
+unittests_xfr_LDADD = libknotd.la libknot.la libknots.la @LIBOBJS@
 all: $(BUILT_SOURCES) config.h
 	$(MAKE) $(AM_MAKEFLAGS) all-am
 
@@ -806,6 +824,9 @@ unittests-libknot$(EXEEXT): $(unittests_libknot_OBJECTS) $(unittests_libknot_DEP
 unittests-libknot-realdata$(EXEEXT): $(unittests_libknot_realdata_OBJECTS) $(unittests_libknot_realdata_DEPENDENCIES) 
 	@rm -f unittests-libknot-realdata$(EXEEXT)
 	$(LINK) $(unittests_libknot_realdata_OBJECTS) $(unittests_libknot_realdata_LDADD) $(LIBS)
+unittests-xfr$(EXEEXT): $(unittests_xfr_OBJECTS) $(unittests_xfr_DEPENDENCIES) 
+	@rm -f unittests-xfr$(EXEEXT)
+	$(LINK) $(unittests_xfr_OBJECTS) $(unittests_xfr_LDADD) $(LIBS)
 unittests-zcompile$(EXEEXT): $(unittests_zcompile_OBJECTS) $(unittests_zcompile_DEPENDENCIES) 
 	@rm -f unittests-zcompile$(EXEEXT)
 	$(LINK) $(unittests_zcompile_OBJECTS) $(unittests_zcompile_LDADD) $(LIBS)
@@ -824,6 +845,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/changesets.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/conf.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/conf_tests.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/conv.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/crc.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/cuckoo-hash-table.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/cuckoo_tests.Po@am__quote@
@@ -893,6 +915,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rrset.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rrset_tests.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rrset_tests_realdata.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/semantic-check.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/server.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/server_tests.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/skip-list.Plo@am__quote@
@@ -907,6 +930,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tolower.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tsig-op.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tsig.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tsig_tests.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/udp-handler.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/unittests_libknot.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/unittests_libknot_realdata.Po@am__quote@
@@ -916,6 +940,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/utils.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xfr-handler.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xfr-in.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xfr_tests.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/zcompile-error.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/zcompile.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/zcompile_main.Po@am__quote@
@@ -977,6 +1002,13 @@ debug.lo: libknot/util/debug.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o debug.lo `test -f 'libknot/util/debug.c' || echo '$(srcdir)/'`libknot/util/debug.c
 
+conv.lo: libknot/util/conv.c
+@am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT conv.lo -MD -MP -MF $(DEPDIR)/conv.Tpo -c -o conv.lo `test -f 'libknot/util/conv.c' || echo '$(srcdir)/'`libknot/util/conv.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/conv.Tpo $(DEPDIR)/conv.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='libknot/util/conv.c' object='conv.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o conv.lo `test -f 'libknot/util/conv.c' || echo '$(srcdir)/'`libknot/util/conv.c
+
 descriptor.lo: libknot/util/descriptor.c
 @am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT descriptor.lo -MD -MP -MF $(DEPDIR)/descriptor.Tpo -c -o descriptor.lo `test -f 'libknot/util/descriptor.c' || echo '$(srcdir)/'`libknot/util/descriptor.c
 @am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/descriptor.Tpo $(DEPDIR)/descriptor.Plo
@@ -1271,6 +1303,13 @@ zone-load.lo: knot/zone/zone-load.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o zone-load.lo `test -f 'knot/zone/zone-load.c' || echo '$(srcdir)/'`knot/zone/zone-load.c
 
+semantic-check.lo: knot/zone/semantic-check.c
+@am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT semantic-check.lo -MD -MP -MF $(DEPDIR)/semantic-check.Tpo -c -o semantic-check.lo `test -f 'knot/zone/semantic-check.c' || echo '$(srcdir)/'`knot/zone/semantic-check.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/semantic-check.Tpo $(DEPDIR)/semantic-check.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='knot/zone/semantic-check.c' object='semantic-check.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o semantic-check.lo `test -f 'knot/zone/semantic-check.c' || echo '$(srcdir)/'`knot/zone/semantic-check.c
+
 zone-dump.lo: knot/zone/zone-dump.c
 @am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT zone-dump.lo -MD -MP -MF $(DEPDIR)/zone-dump.Tpo -c -o zone-dump.lo `test -f 'knot/zone/zone-dump.c' || echo '$(srcdir)/'`knot/zone/zone-dump.c
 @am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/zone-dump.Tpo $(DEPDIR)/zone-dump.Plo
@@ -1845,6 +1884,20 @@ rrset_tests.obj: tests/libknot/libknot/rrset_tests.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rrset_tests.obj `if test -f 'tests/libknot/libknot/rrset_tests.c'; then $(CYGPATH_W) 'tests/libknot/libknot/rrset_tests.c'; else $(CYGPATH_W) '$(srcdir)/tests/libknot/libknot/rrset_tests.c'; fi`
 
+tsig_tests.o: tests/libknot/libknot/tsig_tests.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT tsig_tests.o -MD -MP -MF $(DEPDIR)/tsig_tests.Tpo -c -o tsig_tests.o `test -f 'tests/libknot/libknot/tsig_tests.c' || echo '$(srcdir)/'`tests/libknot/libknot/tsig_tests.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/tsig_tests.Tpo $(DEPDIR)/tsig_tests.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='tests/libknot/libknot/tsig_tests.c' object='tsig_tests.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o tsig_tests.o `test -f 'tests/libknot/libknot/tsig_tests.c' || echo '$(srcdir)/'`tests/libknot/libknot/tsig_tests.c
+
+tsig_tests.obj: tests/libknot/libknot/tsig_tests.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT tsig_tests.obj -MD -MP -MF $(DEPDIR)/tsig_tests.Tpo -c -o tsig_tests.obj `if test -f 'tests/libknot/libknot/tsig_tests.c'; then $(CYGPATH_W) 'tests/libknot/libknot/tsig_tests.c'; else $(CYGPATH_W) '$(srcdir)/tests/libknot/libknot/tsig_tests.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/tsig_tests.Tpo $(DEPDIR)/tsig_tests.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='tests/libknot/libknot/tsig_tests.c' object='tsig_tests.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o tsig_tests.obj `if test -f 'tests/libknot/libknot/tsig_tests.c'; then $(CYGPATH_W) 'tests/libknot/libknot/tsig_tests.c'; else $(CYGPATH_W) '$(srcdir)/tests/libknot/libknot/tsig_tests.c'; fi`
+
 zone_tests.o: tests/libknot/libknot/zone_tests.c
 @am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT zone_tests.o -MD -MP -MF $(DEPDIR)/zone_tests.Tpo -c -o zone_tests.o `test -f 'tests/libknot/libknot/zone_tests.c' || echo '$(srcdir)/'`tests/libknot/libknot/zone_tests.c
 @am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/zone_tests.Tpo $(DEPDIR)/zone_tests.Po
@@ -2055,6 +2108,20 @@ unittests_libknot_realdata.obj: tests/libknot/realdata/unittests_libknot_realdat
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o unittests_libknot_realdata.obj `if test -f 'tests/libknot/realdata/unittests_libknot_realdata.c'; then $(CYGPATH_W) 'tests/libknot/realdata/unittests_libknot_realdata.c'; else $(CYGPATH_W) '$(srcdir)/tests/libknot/realdata/unittests_libknot_realdata.c'; fi`
 
+xfr_tests.o: tests/xfr_tests.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT xfr_tests.o -MD -MP -MF $(DEPDIR)/xfr_tests.Tpo -c -o xfr_tests.o `test -f 'tests/xfr_tests.c' || echo '$(srcdir)/'`tests/xfr_tests.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/xfr_tests.Tpo $(DEPDIR)/xfr_tests.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='tests/xfr_tests.c' object='xfr_tests.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o xfr_tests.o `test -f 'tests/xfr_tests.c' || echo '$(srcdir)/'`tests/xfr_tests.c
+
+xfr_tests.obj: tests/xfr_tests.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT xfr_tests.obj -MD -MP -MF $(DEPDIR)/xfr_tests.Tpo -c -o xfr_tests.obj `if test -f 'tests/xfr_tests.c'; then $(CYGPATH_W) 'tests/xfr_tests.c'; else $(CYGPATH_W) '$(srcdir)/tests/xfr_tests.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/xfr_tests.Tpo $(DEPDIR)/xfr_tests.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='tests/xfr_tests.c' object='xfr_tests.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o xfr_tests.obj `if test -f 'tests/xfr_tests.c'; then $(CYGPATH_W) 'tests/xfr_tests.c'; else $(CYGPATH_W) '$(srcdir)/tests/xfr_tests.c'; fi`
+
 unittests_zp_main.o: zcompile/tests/unittests_zp_main.c
 @am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT unittests_zp_main.o -MD -MP -MF $(DEPDIR)/unittests_zp_main.Tpo -c -o unittests_zp_main.o `test -f 'zcompile/tests/unittests_zp_main.c' || echo '$(srcdir)/'`zcompile/tests/unittests_zp_main.c
 @am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/unittests_zp_main.Tpo $(DEPDIR)/unittests_zp_main.Po
diff --git a/src/common/WELL1024a.c b/src/common/WELL1024a.c
index dddf75e..0d1526b 100644
--- a/src/common/WELL1024a.c
+++ b/src/common/WELL1024a.c
@@ -10,6 +10,7 @@
 #include <string.h>
 #include <stdlib.h>
 #include <time.h>
+#include <sys/time.h>
 #include <stdio.h>
 
 #include "WELL1024a.h"
@@ -87,11 +88,27 @@ double tls_rand()
 		/* Initialize seed from system PRNG generator. */
 		unsigned init[WELL1024_WIDTH];
 		FILE *fp = fopen("/dev/urandom", "r");
-		for (unsigned i = 0; i < WELL1024_WIDTH; ++i) {
-			int rc = fread(&init[i], sizeof(unsigned), 1, fp);
-			rc = rc;
+		if (fp == NULL) {
+			fp = fopen("/dev/random", "r");
+		}
+		if (fp == NULL) {
+			fprintf(stderr, "error: PRNG: cannot seed from "
+				"/dev/urandom, seeding from local time\n");
+			struct timeval tv;
+			if (gettimeofday(&tv, NULL) == 0) {
+				memcpy(init, &tv, sizeof(struct timeval));
+			} else {
+				/* Last resort. */
+				time_t tm = time(NULL);
+				memcpy(init, &tm, sizeof(time_t));
+			}
+		} else {
+			for (unsigned i = 0; i < WELL1024_WIDTH; ++i) {
+				int rc = fread(&init[i], sizeof(unsigned), 1, fp);
+				rc = rc;
+			}
+			fclose(fp);
 		}
-		fclose(fp);
 
 		/* Initialize PRNG state. */
 		s = InitWELLRNG1024a(init);
diff --git a/src/common/acl.c b/src/common/acl.c
index e73c4dd..a1c3a6e 100644
--- a/src/common/acl.c
+++ b/src/common/acl.c
@@ -62,18 +62,14 @@ static int acl_compare(void *k1, void *k2)
 	if (a1->len == sizeof(struct sockaddr_in6)) {
 
 		/* Compare address. */
-		/*! \todo Maybe use memcmp()? */
-		ldiff = 0;
-		const unsigned int *a6 = (const unsigned int *)&a1->addr6.sin6_addr;
-		const unsigned int *b6 = (const unsigned int *)&a2->addr6.sin6_addr;
-		for (int i = 0; i <  (sizeof(struct in6_addr)/ sizeof(int)) ; ++i) {
-			ldiff = a6[i] - b6[i];
-			if (ldiff < 0) {
-				return -1;
-			}
-			if (ldiff > 0) {
-				return 1;
-			}
+		ldiff = memcmp(&a1->addr6.sin6_addr,
+		               &a2->addr6.sin6_addr,
+		               sizeof(struct in6_addr));
+		if (ldiff < 0) {
+			return -1;
+		} 
+		if (ldiff > 0) {
+			return 1;
 		}
 
 		/* Port = 0 means any port match. */
@@ -138,38 +134,43 @@ void acl_delete(acl_t **acl)
 	*acl = 0;
 }
 
-int acl_create(acl_t *acl, const sockaddr_t* addr, acl_rule_t rule)
+int acl_create(acl_t *acl, const sockaddr_t* addr, acl_rule_t rule, void *val)
 {
-	if (!acl || !addr || rule < 0) {
+	if (!acl || !addr) {
 		return ACL_ERROR;
 	}
 
 	/* Insert into skip list. */
-	sockaddr_t *key = malloc(sizeof(sockaddr_t));
-	memcpy(key, addr, sizeof(sockaddr_t));
+	acl_key_t *key = malloc(sizeof(acl_key_t));
+	memcpy(&key->addr, addr, sizeof(sockaddr_t));
+	sockaddr_update(&key->addr);
+	key->rule = rule;
+	key->val = val;
 
-	skip_insert(acl->rules, key, (void*)((ssize_t)rule + 1), 0);
+	skip_insert(acl->rules, &key->addr, key, 0);
 
 	return ACL_ACCEPT;
 }
 
-int acl_match(acl_t *acl, sockaddr_t* addr)
+int acl_match(acl_t *acl, const sockaddr_t* addr, acl_key_t **key)
 {
 	if (!acl || !addr) {
 		return ACL_ERROR;
 	}
 
-	/* Return default rule if not found.
-	 * Conversion to the same length integer is made,
-	 * but we can be sure, that the value range is within <-1,1>.
-	 */
-	ssize_t val = ((ssize_t)skip_find(acl->rules, addr)) - 1;
-	if (val < 0) {
+    acl_key_t *found = skip_find(acl->rules, (void*)addr);
+	
+	/* Set stored value if exists. */
+	if (key != 0) {
+		*key = found;
+	}
+	
+	/* Return appropriate rule. */
+	if (!found) {
 		return acl->default_rule;
 	}
 
-	/* Return stored rule if found. */
-	return (int)val;
+	return found->rule;
 }
 
 int acl_truncate(acl_t *acl)
@@ -179,7 +180,7 @@ int acl_truncate(acl_t *acl)
 	}
 
 	/* Destroy all rules. */
-	skip_destroy_list(&acl->rules, free, 0);
+	skip_destroy_list(&acl->rules, 0, free);
 
 	return ACL_ACCEPT;
 }
diff --git a/src/common/acl.h b/src/common/acl.h
index c79db7f..1b7e97f 100644
--- a/src/common/acl.h
+++ b/src/common/acl.h
@@ -42,11 +42,18 @@ typedef enum acl_rule_t {
 
 /*! \brief ACL structure. */
 typedef struct acl_t {
-	acl_rule_t default_rule;
-	skip_list_t *rules;
-	const char name[];
+	acl_rule_t default_rule; /*!< \brief Default rule. */
+	skip_list_t *rules;      /*!< \brief Data container. */
+	const char name[];       /*!< \brief ACL semantic name. */
 } acl_t;
 
+/*! \brief Single ACL value. */
+typedef struct acl_key_t {
+	sockaddr_t addr; /*!< \brief Address for comparison. */
+	acl_rule_t rule; /*!< \brief Rule for address. */
+	void *val;       /*!< \brief Associated value (or NULL). */
+} acl_key_t;
+
 /*!
  * \brief Create a new ACL.
  *
@@ -71,25 +78,27 @@ void acl_delete(acl_t **acl);
  * \todo Support address subnets.
  *
  * \param acl Pointer to ACL instance.
- * \param addr IP address (will be duplicated).
- * \param rule Rule.
+ * \param addr IP address.
+ * \param rule Rule for given address.
+ * \param val Value to be stored for given address (or NULL).
  *
  * \retval ACL_ACCEPT if successful.
  * \retval ACP_ERROR on error.
  */
-int acl_create(acl_t *acl, const sockaddr_t* addr, acl_rule_t rule);
+int acl_create(acl_t *acl, const sockaddr_t* addr, acl_rule_t rule, void *val);
 
 /*!
  * \brief Match address against ACL.
  *
  * \param acl Pointer to ACL instance.
  * \param addr IP address.
+ * \param key Set to related key or NULL if not found.
  *
- * \retval ACL_ACCEPT if the address is accepted.
- * \retval ACL_DENY if the address is not accepted.
+ * \retval Address rule if the address is accepted.
+ * \retval Default rule if the address is not accepted.
  * \retval ACP_ERROR on error.
  */
-int acl_match(acl_t *acl, sockaddr_t* addr);
+int acl_match(acl_t *acl, const sockaddr_t* addr, acl_key_t **key);
 
 /*!
  * \brief Truncate ACL.
diff --git a/src/common/errors.c b/src/common/errors.c
index f1e650d..3b770e9 100644
--- a/src/common/errors.c
+++ b/src/common/errors.c
@@ -64,6 +64,7 @@ int _map_errno(int fallback_value, int arg0, ...)
 		/* Error code matches with mapped. */
 		if (c == errno) {
 			/* Return negative value of the code. */
+			va_end(ap);
 			return -abs(c);
 		}
 	}
diff --git a/src/common/evsched.c b/src/common/evsched.c
index 4e56028..c4a6786 100644
--- a/src/common/evsched.c
+++ b/src/common/evsched.c
@@ -187,7 +187,7 @@ int evsched_event_finished(evsched_t *s)
 
 int evsched_schedule(evsched_t *s, event_t *ev, uint32_t dt)
 {
-	if (!s || !ev || dt < 0) {
+	if (!s || !ev) {
 		return -1;
 	}
 
@@ -276,12 +276,12 @@ int evsched_cancel(evsched_t *s, event_t *ev)
 		return -1;
 	}
 
-	/* Lock calendar. */
-	pthread_mutex_lock(&s->mx);
-
 	/* Make sure not running. */
 	pthread_mutex_lock(&s->rl);
 
+	/* Lock calendar. */
+	pthread_mutex_lock(&s->mx);
+
 	/* Find in list. */
 	event_t *n = 0;
 	int found = 0;
@@ -297,13 +297,13 @@ int evsched_cancel(evsched_t *s, event_t *ev)
 		rem_node(&ev->n);
 	}
 
-	/* Enable running events. */
-	pthread_mutex_unlock(&s->rl);
-
 	/* Unlock calendar. */
 	pthread_cond_signal(&s->notify);
 	pthread_mutex_unlock(&s->mx);
 
+	/* Enable running events. */
+	pthread_mutex_unlock(&s->rl);
+
 	return 0;
 }
 
diff --git a/src/common/fdset_kqueue.c b/src/common/fdset_kqueue.c
index c7199ae..b0daa33 100644
--- a/src/common/fdset_kqueue.c
+++ b/src/common/fdset_kqueue.c
@@ -14,8 +14,6 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include <config.h>
-
 #ifdef HAVE_KQUEUE
 
 #include <stdint.h>
diff --git a/src/common/libtap/tap.c b/src/common/libtap/tap.c
index 61e0528..8b660fe 100644
--- a/src/common/libtap/tap.c
+++ b/src/common/libtap/tap.c
@@ -51,38 +51,41 @@ vstrdupf (const char *fmt, va_list args) {
 }
 
 int
-vok_at_loc (const char *file, int line, int test, const char *fmt,
+vok_at_loc (const char *file, int line, int test, int verbose, const char *fmt,
             va_list args)
 {
-    char *name = vstrdupf(fmt, args);
-    printf("%sok %d", test ? "" : "not ", ++current_test);
-    if (*name)
-        printf(" - %s", name);
-    if (todo_mesg) {
-        printf(" # TODO");
-        if (*todo_mesg)
-            printf(" %s", todo_mesg);
+    if (verbose) {
+	    char *name = vstrdupf(fmt, args);
+	    printf("%sok %d", test ? "" : "not ", ++current_test);
+	    if (*name)
+	        printf(" - %s", name);
+	    if (todo_mesg) {
+	        printf(" # TODO");
+	        if (*todo_mesg)
+	            printf(" %s", todo_mesg);
+	    }
+	    printf("\n");
+	    if (!test) {
+	        if (*name)
+	            diag("  Failed%s test '%s'\n  at %s line %d.",
+	                todo_mesg ? " (TODO)" : "", name, file, line);
+	        else
+	            diag("  Failed%s test at %s line %d.",
+	                todo_mesg ? " (TODO)" : "", file, line);
+	        if (!todo_mesg)
+	            failed_tests++;
+	    
+	    free(name);
+	}
     }
-    printf("\n");
-    if (!test) {
-        if (*name)
-            diag("  Failed%s test '%s'\n  at %s line %d.",
-                todo_mesg ? " (TODO)" : "", name, file, line);
-        else
-            diag("  Failed%s test at %s line %d.",
-                todo_mesg ? " (TODO)" : "", file, line);
-        if (!todo_mesg)
-            failed_tests++;
-    }
-    free(name);
     return test;
 }
 
 int
-ok_at_loc (const char *file, int line, int test, const char *fmt, ...) {
+ok_at_loc (const char *file, int line, int verbose, int test, const char *fmt, ...) {
     va_list args;
     va_start(args, fmt);
-    vok_at_loc(file, line, test, fmt, args);
+    vok_at_loc(file, line, test, verbose, fmt, args);
     va_end(args);
     return test;
 }
@@ -102,7 +105,7 @@ is_at_loc (const char *file, int line, const char *got, const char *expected,
     int test = eq(got, expected);
     va_list args;
     va_start(args, fmt);
-    vok_at_loc(file, line, test, fmt, args);
+    vok_at_loc(file, line, test, 1, fmt, args);
     va_end(args);
     if (!test) {
         diag("         got: '%s'", got);
@@ -113,12 +116,13 @@ is_at_loc (const char *file, int line, const char *got, const char *expected,
 
 int
 isnt_at_loc (const char *file, int line, const char *got, const char *expected,
+             int verbose,
              const char *fmt, ...)
 {
     int test = ne(got, expected);
     va_list args;
     va_start(args, fmt);
-    vok_at_loc(file, line, test, fmt, args);
+    vok_at_loc(file, line, test, verbose, fmt, args);
     va_end(args);
     if (!test) {
         diag("         got: '%s'", got);
@@ -152,7 +156,7 @@ cmp_ok_at_loc (const char *file, int line, int a, const char *op, int b,
              : diag("unrecognized operator '%s'", op);
     va_list args;
     va_start(args, fmt);
-    vok_at_loc(file, line, test, fmt, args);
+    vok_at_loc(file, line, test, 1, fmt, args);
     va_end(args);
     if (!test) {
         diag("    %d", a);
@@ -278,7 +282,7 @@ tap_test_died (int status) {
 
 int
 like_at_loc (int for_match, const char *file, int line, const char *got,
-             const char *expected, const char *fmt, ...)
+             const char *expected, int verbose, const char *fmt, ...)
 {
     int test;
     regex_t re;
@@ -295,7 +299,7 @@ like_at_loc (int for_match, const char *file, int line, const char *got,
     test = for_match ? !err : err;
     va_list args;
     va_start(args, fmt);
-    vok_at_loc(file, line, test, fmt, args);
+    vok_at_loc(file, line, test, verbose, fmt, args);
     va_end(args);
     if (!test) {
         if (for_match) {
diff --git a/src/common/libtap/tap.h b/src/common/libtap/tap.h
index 2e89b90..4522fbb 100644
--- a/src/common/libtap/tap.h
+++ b/src/common/libtap/tap.h
@@ -22,17 +22,17 @@
 #include <stdarg.h>
 
 #define NO_PLAN          -1
-#define ok(...)          ok_at_loc(__FILE__, __LINE__, __VA_ARGS__, NULL)
+#define ok(...)          ok_at_loc(__FILE__, __LINE__, 1, __VA_ARGS__, NULL)
 #define pass(...)        ok(1, ## __VA_ARGS__)
 #define fail(...)        ok(0, ## __VA_ARGS__)
 #define is(...)          is_at_loc(__FILE__, __LINE__, __VA_ARGS__, NULL)
 #define isnt(...)        isnt_at_loc(__FILE__, __LINE__, __VA_ARGS__, NULL)
 #define cmp_ok(...)      cmp_ok_at_loc(__FILE__, __LINE__, __VA_ARGS__, NULL)
 
-int     vok_at_loc      (const char *file, int line, int test, const char *fmt,
+int     vok_at_loc      (const char *file, int line, int test, int verbose, const char *fmt,
                          va_list args);
 void    plan            (int tests);
-int     ok_at_loc       (const char *file, int line, int test, const char *fmt,
+int     ok_at_loc       (const char *file, int line, int test, int verbose, const char *fmt,
                          ...);
 int     diag            (const char *fmt, ...);
 int     note            (const char *fmt, ...);
@@ -41,9 +41,10 @@ void    skippy          (int n, const char *fmt, ...);
 void    ctodo           (int ignore, const char *fmt, ...);
 void    cendtodo        (void);
 int     is_at_loc       (const char *file, int line, const char *got,
-                         const char *expected, const char *fmt, ...);
+                         const char *expected,
+                         const char *fmt, ...);
 int     isnt_at_loc     (const char *file, int line, const char *got,
-                         const char *expected, const char *fmt, ...);
+                         const char *expected, int verbose, const char *fmt, ...);
 int     cmp_ok_at_loc   (const char *file, int line, int a, const char *op,
                          int b, const char *fmt, ...);
 
@@ -55,6 +56,7 @@ int     cmp_ok_at_loc   (const char *file, int line, int a, const char *op,
 #define unlike(...) like_at_loc(0, __FILE__, __LINE__, __VA_ARGS__, NULL)
 int     like_at_loc     (int for_match, const char *file, int line,
                          const char *got, const char *expected,
+                         int verbose,
                          const char *fmt, ...);
 #endif
 
@@ -64,8 +66,9 @@ int     like_at_loc     (int for_match, const char *file, int line,
 #define todo(...)        ctodo(0, ## __VA_ARGS__, NULL)
 #define endtodo          cendtodo()
 
-#define dies_ok(code, ...)  dies_ok_common(code, 1, ## __VA_ARGS__)
-#define lives_ok(code, ...) dies_ok_common(code, 0, ## __VA_ARGS__)
+#define dies_ok(code, ...)  dies_ok_common(code, 1, 1, ## __VA_ARGS__)
+#define lives_ok(code, ...) dies_ok_common(code, 0, 1, ## __VA_ARGS__)
+#define lives_ok_silent(code, ...) dies_ok_common(code, 0, 0, ## __VA_ARGS__)
 
 #ifdef _WIN32
 #define dies_ok_common(...) \
@@ -75,7 +78,7 @@ int     like_at_loc     (int for_match, const char *file, int line,
 #include <sys/types.h>
 #include <sys/wait.h>
 int tap_test_died (int status);
-#define dies_ok_common(code, for_death, ...)                \
+#define dies_ok_common(code, for_death, verbose, ...)                \
     do {                                                    \
         tap_test_died(1);                                   \
         int cpid = fork();                                  \
@@ -95,7 +98,7 @@ int tap_test_died (int status);
         }                                                   \
         int it_died = tap_test_died(0);                     \
         if (!it_died) {code}                                \
-        ok(for_death ? it_died : !it_died, ## __VA_ARGS__); \
+        ok_at_loc(__FILE__, __LINE__, verbose, for_death ? it_died : !it_died, ## __VA_ARGS__); \
     } while (0)
 #endif
 #endif
diff --git a/src/knot/conf/cf-parse.y b/src/knot/conf/cf-parse.y
index d793865..9939540 100644
--- a/src/knot/conf/cf-parse.y
+++ b/src/knot/conf/cf-parse.y
@@ -282,30 +282,39 @@ system:
 keys:
    KEYS '{'
  | keys TEXT TSIG_ALGO_NAME TEXT ';' {
+     /* Check algorithm length. */
+     if (tsig_alg_digest_length($3.alg) == 0) {
+        cf_error(scanner, "unsupported digest algorithm");
+     }
+     
      /* Normalize to FQDN */
      char *fqdn = $2.t;
-     if (fqdn[strlen(fqdn) - 1] != '.') {
-        char* tmp = malloc(strlen(fqdn) + 1 + 1); /* '.', '\0' */
-	if (!tmp) {
+     size_t fqdnl = strlen(fqdn);
+     if (fqdn[fqdnl - 1] != '.') {
+        /*! \todo Oddly, it requires memory aligned to 4B */
+        fqdnl = ((fqdnl + 2)/4+1)*4; /* '.', '\0' */
+        char* tmpdn = malloc(fqdnl); 
+	if (!tmpdn) {
 	   cf_error(scanner, "out of memory when allocating string");
 	   free(fqdn);
-	   fqdn = 0;
+	   fqdn = NULL;
+	   fqdnl = 0;
 	} else {
-	   strcpy(tmp, fqdn);
-	   strcat(tmp, ".");
+	   strncpy(tmpdn, fqdn, fqdnl);
+	   strncat(tmpdn, ".", 1);
 	   free(fqdn);
-	   fqdn = tmp;
+	   fqdn = tmpdn;
+	   fqdnl = strlen(fqdn);
 	}
      }
 
-     if (!conf_key_exists(scanner, fqdn)) {
-         knot_dname_t *dname = knot_dname_new_from_str(fqdn, strlen(fqdn), 0);
+     if (fqdn != NULL && !conf_key_exists(scanner, fqdn)) {
+         knot_dname_t *dname = knot_dname_new_from_str(fqdn, fqdnl, 0);
 	 if (!dname) {
 	     char buf[512];
              snprintf(buf, sizeof(buf), "key name '%s' not in valid domain "
 	                                "name format", fqdn);
              cf_error(scanner, buf);
-	     free(fqdn);
 	     free($4.t);
 	 } else {
              conf_key_t *k = malloc(sizeof(conf_key_t));
@@ -315,12 +324,12 @@ keys:
              k->k.secret = $4.t;
              add_tail(&new_config->keys, &k->n);
              ++new_config->key_count;
-	     free(fqdn);
 	 }
      } else {
-         free(fqdn);
          free($4.t);
      }
+     
+     free(fqdn);
 }
 
 remote_start:
@@ -387,6 +396,7 @@ remote:
      } else {
         conf_key_add(scanner, &this_remote->key, $3.t);
      }
+     free($3.t);
    }
  ;
 
@@ -469,20 +479,28 @@ zone_start: TEXT {
    this_zone->notify_retries = 0; // Default policy applies
    this_zone->ixfr_fslimit = -1; // Default policy applies
    this_zone->dbsync_timeout = -1; // Default policy applies
-   this_zone->name = $1.t;
 
    // Append mising dot to ensure FQDN
-   size_t nlen = strlen(this_zone->name);
-   if (this_zone->name[nlen - 1] != '.') {
-     this_zone->name = realloc(this_zone->name, nlen + 1 + 1);
-     strcat(this_zone->name, ".");
+   char *name = $1.t;
+   size_t nlen = strlen(name);
+   if (name[nlen - 1] != '.') {
+      this_zone->name = malloc(nlen + 2);
+      if (this_zone->name != NULL) {
+	memcpy(this_zone->name, name, nlen);
+	this_zone->name[nlen] = '.';
+	this_zone->name[nlen + 1] = '\0';
+     }
+     free(name);
+   } else {
+      this_zone->name = name; /* Already FQDN */
    }
 
    /* Check domain name. */
-   knot_dname_t *dn = knot_dname_new_from_str(this_zone->name,
-                                                  nlen + 1,
-                                                  0);
-   if (dn == 0) {
+   knot_dname_t *dn = NULL;
+   if (this_zone->name != NULL) {
+      dn = knot_dname_new_from_str(this_zone->name, nlen + 1, 0);
+   }
+   if (dn == NULL) {
      free(this_zone->name);
      free(this_zone);
      cf_error(scanner, "invalid zone origin");
diff --git a/src/knot/conf/conf.c b/src/knot/conf/conf.c
index 4e2d665..636901b 100644
--- a/src/knot/conf/conf.c
+++ b/src/knot/conf/conf.c
@@ -207,6 +207,7 @@ static int conf_process(conf_t *conf)
 	conf->pidfile = strcdup(conf->storage, "/" PID_FILE);
 
 	// Postprocess zones
+	int ret = KNOTD_EOK;
 	node *n = 0;
 	WALK_LIST (n, conf->zones) {
 		conf_zone_t *zone = (conf_zone_t*)n;
@@ -240,33 +241,48 @@ static int conf_process(conf_t *conf)
 		zone->file = strcpath(zone->file);
 
 		// Create zone db filename
+		size_t zname_len = strlen(zone->name);
 		size_t stor_len = strlen(conf->storage);
-		size_t size = stor_len + strlen(zone->name) + 4; // db/,\0
+		size_t size = stor_len + zname_len + 4; // db/,\0
 		char *dest = malloc(size);
-		strcpy(dest, conf->storage);
+		if (dest == NULL) {
+			zone->db = NULL; /* Not enough memory. */
+			ret = KNOTD_ENOMEM; /* Error report. */
+			continue;
+		}
+		
+		/* Since we have already allocd dest to accomodate
+		 * storage/zname length strcpy is safe. */
+		strncpy(dest, conf->storage, stor_len + 1);
 		if (conf->storage[stor_len - 1] != '/') {
-			strcat(dest, "/");
+			strncat(dest, "/", 1);
 		}
 
-		strcat(dest, zone->name);
-		strcat(dest, "db");
+		strncat(dest, zone->name, zname_len);
+		strncat(dest, "db", 2);
 		zone->db = dest;
 
 		// Create IXFR db filename
 		stor_len = strlen(conf->storage);
-		size = stor_len + strlen(zone->name) + 9; // diff.db/,\0
+		size = stor_len + zname_len + 9; // diff.db/,\0
 		dest = malloc(size);
-		strcpy(dest, conf->storage);
+		if (dest == NULL) {
+			zone->ixfr_db = NULL; /* Not enough memory. */
+			ret = KNOTD_ENOMEM; /* Error report. */
+			continue;
+		}
+		strncpy(dest, conf->storage, stor_len + 1);
 		if (conf->storage[stor_len - 1] != '/') {
-			strcat(dest, "/");
+			strncat(dest, "/", 1);
 		}
 
-		strcat(dest, zone->name);
-		strcat(dest, "diff.db");
+		const char *dbext = "diff.db";
+		strncat(dest, zone->name, zname_len);
+		strncat(dest, dbext, strlen(dbext));
 		zone->ixfr_db = dest;
 	}
 
-	return 0;
+	return ret;
 }
 
 /*
@@ -384,10 +400,6 @@ static int conf_strparser(conf_t *conf, const char *src)
 	// {
 	// Hook new configuration
 	new_config = conf;
-	if (src == 0) {
-		pthread_mutex_unlock(&_parser_lock);
-		return KNOTD_ENOENT;
-	}
 
 	// Parse config
 	_parser_res = KNOTD_EOK;
@@ -662,18 +674,19 @@ int conf_open(const char* path)
 char* strcdup(const char *s1, const char *s2)
 {
 	if (!s1 || !s2) {
-		return 0;
+		return NULL;
 	}
 	
 	size_t slen = strlen(s1);
-	size_t nlen = slen + strlen(s2) + 1;
+	size_t s2len = strlen(s2);
+	size_t nlen = slen + s2len + 1;
 	char* dst = malloc(nlen);
-	if (!dst) {
-		return 0;
+	if (dst == NULL) {
+		return NULL;
 	}
 
 	memcpy(dst, s1, slen);
-	strcpy(dst + slen, s2); // With trailing '\0'
+	strncpy(dst + slen, s2, s2len + 1); // With trailing '\0'
 	return dst;
 }
 
@@ -681,7 +694,7 @@ char* strcpath(char *path)
 {
 	// NULL path
 	if (!path) {
-		return 0;
+		return NULL;
 	}
 	
 	// Remote trailing slash
@@ -691,23 +704,41 @@ char* strcpath(char *path)
 	}
 
 	// Expand '~'
-	char* tild_p = strchr(path,'~');
-	if (tild_p != 0) {
+	char* remainder = strchr(path,'~');
+	if (remainder != NULL) {
 		// Get full path
-		char *tild_exp = getenv("HOME");
-		size_t tild_len = strlen(tild_exp);
+		char *tild_exp_unsafe = getenv("HOME");
+		if (tild_exp_unsafe == NULL) {
+			return NULL;
+		}
+		// Sanitize
+		size_t tild_len = strlen(tild_exp_unsafe);
+		char *tild_exp = malloc(tild_len);
+		if (tild_exp == NULL) {
+			return NULL;
+		}
+		strncpy(tild_exp, tild_exp_unsafe, tild_len + 1);
 		if (tild_exp[tild_len - 1] == '/') {
 			tild_exp[--tild_len] = '\0';
 		}
 
 		// Expand
 		char *npath = malloc(plen + tild_len + 1);
+		if (npath == NULL) {
+			free(tild_exp);
+			return NULL;
+		}
 		npath[0] = '\0';
-		strncpy(npath, path, (size_t)(tild_p - path));
-		strcat(npath, tild_exp);
-		strcat(npath, tild_p + 1);
+		strncpy(npath, path, (size_t)(remainder - path));
+		strncat(npath, tild_exp, tild_len);
+		
+		// Append remainder
+		++remainder;
+		size_t remainder_len = strlen(remainder);
+		strncat(npath, remainder, remainder_len);
 		free(path);
 		path = npath;
+		free(tild_exp);
 	}
 
 	return path;
diff --git a/src/knot/ctl/knotc_main.c b/src/knot/ctl/knotc_main.c
index 16c3863..f472303 100644
--- a/src/knot/ctl/knotc_main.c
+++ b/src/knot/ctl/knotc_main.c
@@ -29,7 +29,6 @@
 #include "knot/other/error.h"
 #include "knot/ctl/process.h"
 #include "knot/conf/conf.h"
-#include "knot/conf/logconf.h"
 #include "knot/zone/zone-load.h"
 
 /*! \brief Controller constants. */
diff --git a/src/knot/main.c b/src/knot/main.c
index 4091055..d4e10b9 100644
--- a/src/knot/main.c
+++ b/src/knot/main.c
@@ -24,7 +24,6 @@
 #include "knot/common.h"
 #include "knot/other/error.h"
 #include "knot/server/server.h"
-#include "zcompile/zcompile.h"
 #include "knot/ctl/process.h"
 #include "knot/conf/conf.h"
 #include "knot/conf/logconf.h"
@@ -123,6 +122,7 @@ int main(int argc, char **argv)
 
 	// Register service and signal handler
 	struct sigaction emptyset;
+	memset(&emptyset, 0, sizeof(struct sigaction));
 	emptyset.sa_handler = interrupt_handle;
 	sigemptyset(&emptyset.sa_mask);
 	emptyset.sa_flags = 0;
@@ -172,7 +172,7 @@ int main(int argc, char **argv)
 
 		// Append ending slash
 		if (cwbuf[cwbuflen - 1] != '/') {
-			cwbuf = strcat(cwbuf, "/");
+			cwbuf = strncat(cwbuf, "/", 1);
 		}
 
 		// Assemble path to config file
@@ -263,7 +263,7 @@ int main(int argc, char **argv)
 			if (sig_req_reload) {
 				log_server_info("Reloading configuration...\n");
 				sig_req_reload = 0;
-				int cf_ret = cf_ret = conf_open(config_fn);
+				int cf_ret = conf_open(config_fn);
 				switch (cf_ret) {
 				case KNOTD_EOK:
 					log_server_info("Configuration "
diff --git a/src/knot/other/debug.h b/src/knot/other/debug.h
index aa80373..8b01c85 100644
--- a/src/knot/other/debug.h
+++ b/src/knot/other/debug.h
@@ -37,7 +37,7 @@
 //#define KNOTD_THREADS_DEBUG
 //#define KNOTD_JOURNAL_DEBUG
 //#define KNOTD_NET_DEBUG
-//#define KNOTD_ZONES_DEBUG
+#define KNOTD_ZONES_DEBUG
 //#define KNOTD_XFR_DEBUG
 //#define KNOTD_NOTIFY_DEBUG
 //#define KNOTD_ZDUMP_DEBUG
diff --git a/src/knot/other/log.c b/src/knot/other/log.c
index 9318d5f..00bcea3 100644
--- a/src/knot/other/log.c
+++ b/src/knot/other/log.c
@@ -260,8 +260,11 @@ int log_msg(logsrc_t src, int level, const char *msg, ...)
 
 	/* Prepend prefix. */
 	int plen = strlen(prefix);
+	if (plen > buflen) {
+		return KNOTD_ENOMEM;
+	}
 	if (plen > 0) {
-		strcpy(buf, prefix);
+		strncpy(buf, prefix, plen + 1);
 		buf += plen;
 		buflen -= plen;
 	}
diff --git a/src/knot/server/dthreads.c b/src/knot/server/dthreads.c
index 9707e57..9d1e69d 100644
--- a/src/knot/server/dthreads.c
+++ b/src/knot/server/dthreads.c
@@ -571,7 +571,10 @@ int dt_resize(dt_unit_t *unit, int size)
 		}
 
 		pthread_join(thread->_thr, 0);
+		/* Thread is already joined and flagged, but anyway... */
+		lock_thread_rw(thread);
 		thread->state = ThreadJoined;
+		unlock_thread_rw(thread);
 
 		// Delete thread
 		dt_delete_thread(&thread);
@@ -711,7 +714,9 @@ int dt_join(dt_unit_t *unit)
 				pthread_join(thread->_thr, 0);
 				dbg_dt("dthreads: [%p] %s: reclaimed\n",
 				         thread, __func__);
+				lock_thread_rw(thread);
 				thread->state = ThreadJoined;
+				unlock_thread_rw(thread);
 			} else {
 				unlock_thread_rw(thread);
 			}
@@ -812,19 +817,19 @@ int dt_setprio(dthread_t *thread, int prio)
 	int ret = pthread_attr_setschedpolicy(&thread->_attr, policy);
 
 	// Update priority
-	if (ret >= 0) {
+	if (ret == 0) {
 		struct sched_param sp;
 		sp.sched_priority = prio;
 		ret = pthread_attr_setschedparam(&thread->_attr, &sp);
 	}
 
 	/* Map error codes. */
-	if (ret < 0) {
+	if (ret != 0) {
 		dbg_dt("dthreads: [%p] %s(%d): failed",
 		       thread, __func__, prio);
 
 		/* Map "not supported". */
-		if (ret == ENOTSUP) {
+		if (errno == ENOTSUP) {
 			return KNOTD_ENOTSUP;
 		}
 
@@ -927,7 +932,9 @@ int dt_compact(dt_unit_t *unit)
 			pthread_join(thread->_thr, 0);
 			dbg_dt("dthreads: [%p] %s: thread reclaimed\n",
 			       thread, __func__);
+			lock_thread_rw(thread);
 			thread->state = ThreadJoined;
+			unlock_thread_rw(thread);
 		} else {
 			unlock_thread_rw(thread);
 		}
diff --git a/src/knot/server/journal.c b/src/knot/server/journal.c
index 651f0f3..438332a 100644
--- a/src/knot/server/journal.c
+++ b/src/knot/server/journal.c
@@ -232,17 +232,11 @@ journal_t* journal_open(const char *fn, size_t fslimit, uint16_t bflags)
 	fl.l_len = 0;
 	fl.l_pid = getpid();
 
-	/* Check file. */
-	struct stat st;
-	if (stat(fn, &st) < 0) {
-		return 0;
-	}
-
-	/* Open journal file for r/w. */
+	/* Open journal file for r/w (returns error if not exists). */
 	int fd = open(fn, O_RDWR);
 	if (fd < 0) {
 		dbg_journal("journal: failed to open file '%s'\n", fn);
-		return 0;
+		return NULL;
 	}
 	
 	/* Attempt to lock. */
@@ -266,18 +260,28 @@ journal_t* journal_open(const char *fn, size_t fslimit, uint16_t bflags)
 	/* Read maximum number of entries. */
 	uint16_t max_nodes = 512;
 	if (!sfread(&max_nodes, sizeof(uint16_t), fd)) {
+		dbg_journal_detail("journal: cannot read max_nodes\n");
 		fcntl(fd, F_SETLK, &fl);
 		close(fd);
-		return 0;
+		return NULL;
+	}
+	
+	/* Check max_nodes, but this is riddiculous. */
+	if (max_nodes == 0) {
+		dbg_journal_detail("journal: max_nodes is invalid\n");
+		fcntl(fd, F_SETLK, &fl);
+		close(fd);
+		return NULL;
 	}
 
 	/* Allocate journal structure. */
 	const size_t node_len = sizeof(journal_node_t);
 	journal_t *j = malloc(sizeof(journal_t) + max_nodes * node_len);
 	if (!j) {
+		dbg_journal_detail("journal: cannot allocate journal\n");
 		fcntl(fd, F_SETLK, &fl);
 		close(fd);
-		return 0;
+		return NULL;
 	}
 	j->qhead = j->qtail = 0;
 	j->fd = fd;
@@ -286,34 +290,57 @@ journal_t* journal_open(const char *fn, size_t fslimit, uint16_t bflags)
 
 	/* Load node queue state. */
 	if (!sfread(&j->qhead, sizeof(uint16_t), fd)) {
+		dbg_journal_detail("journal: cannot read qhead\n");
 		fcntl(fd, F_SETLK, &fl);
 		close(fd);
 		free(j);
-		return 0;
+		return NULL;
 	}
 
 	/* Load queue tail. */
 	if (!sfread(&j->qtail, sizeof(uint16_t), fd)) {
+		dbg_journal_detail("journal: cannot read qtail\n");
 		fcntl(fd, F_SETLK, &fl);
 		close(fd);
 		free(j);
-		return 0;
+		return NULL;
+	}
+	
+	/* Check head + tail */
+	if (j->qtail > max_nodes || j->qhead > max_nodes) {
+		dbg_journal_detail("journal: queue pointers corrupted\n");
+		fcntl(fd, F_SETLK, &fl);
+		close(fd);
+		free(j);
+		return NULL;
 	}
 
 	/* Load empty segment descriptor. */
 	if (!sfread(&j->free, node_len, fd)) {
+		dbg_journal_detail("journal: cannot read free segment ptr\n");
 		fcntl(fd, F_SETLK, &fl);
 		close(fd);
 		free(j);
-		return 0;
+		return NULL;
 	}
 
 	/* Read journal descriptors table. */
 	if (!sfread(&j->nodes, max_nodes * node_len, fd)) {
+		dbg_journal_detail("journal: cannot read node table\n");
 		fcntl(fd, F_SETLK, &fl);
 		close(fd);
 		free(j);
-		return 0;
+		return NULL;
+	}
+	
+	/* Get journal file size. */
+	struct stat st;
+	if (stat(fn, &st) < 0) {
+		dbg_journal_detail("journal: cannot get journal fsize\n");
+		fcntl(fd, F_SETLK, &fl);
+		close(fd);
+		free(j);
+		return NULL;
 	}
 
 	/* Set file size. */
@@ -346,7 +373,7 @@ journal_t* journal_open(const char *fn, size_t fslimit, uint16_t bflags)
 			fcntl(fd, F_SETLK, &fl);
 			close(fd);
 			free(j);
-			return 0;
+			return NULL;
 		}
 	}
 
diff --git a/src/knot/server/notify.c b/src/knot/server/notify.c
index 3966b26..8736372 100644
--- a/src/knot/server/notify.c
+++ b/src/knot/server/notify.c
@@ -123,13 +123,23 @@ int notify_create_response(knot_packet_t *request, uint8_t *buffer,
 	CHECK_ALLOC_LOG(response, KNOTD_ENOMEM);
 
 	/* Set maximum packet size. */
-	knot_packet_set_max_size(response, *size);
-	knot_response_init_from_query(response, request);
+	int rc = knot_packet_set_max_size(response, *size);
+	if (rc == KNOT_EOK) {
+		rc = knot_response_init_from_query(response, request);
+	}
+	
+	/* Aggregated result check. */
+	if (rc != KNOT_EOK) {
+		dbg_notify("%s: failed to init response packet: %s",
+			   "notify_create_response", knot_strerror(rc));
+		knot_packet_free(&response);
+		return KNOTD_EINVAL;
+	}
 
 	// TODO: copy the SOA in Answer section
 	uint8_t *wire = NULL;
 	size_t wire_size = 0;
-	int rc = knot_packet_to_wire(response, &wire, &wire_size);
+	rc = knot_packet_to_wire(response, &wire, &wire_size);
 	if (rc != KNOT_EOK) {
 		knot_packet_free(&response);
 		return rc;
@@ -178,7 +188,7 @@ static int notify_check_and_schedule(knot_nameserver_t *nameserver,
 	/* Check ACL for notify-in. */
 	zonedata_t *zd = (zonedata_t *)knot_zone_data(zone);
 	if (from) {
-		if (acl_match(zd->notify_in, from) == ACL_DENY) {
+		if (acl_match(zd->notify_in, from, 0) == ACL_DENY) {
 			/* rfc1996: Ignore request and report incident. */
 			char straddr[SOCKADDR_STRLEN];
 			sockaddr_tostr(from, straddr, sizeof(straddr));
@@ -230,8 +240,7 @@ int notify_process_request(knot_nameserver_t *ns,
 
 	dbg_notify("notify: parsing rest of the packet\n");
 	if (notify->parsed < notify->size) {
-		ret = knot_packet_parse_rest(notify);
-		if (ret != KNOT_EOK) {
+		if (knot_packet_parse_rest(notify) != KNOT_EOK) {
 			dbg_notify("notify: failed to parse NOTIFY query\n");
 			knot_ns_error_response(ns, knot_packet_id(notify),
 					       KNOT_RCODE_FORMERR, buffer,
@@ -310,6 +319,7 @@ int notify_process_response(knot_nameserver_t *nameserver,
 	if (!match) {
 		log_server_notice("No pending NOTIFY query found for ID=%u\n",
 			 pkt_id);
+		pthread_mutex_unlock(&zd->lock);
 		return KNOTD_ERROR;
 	}
 
diff --git a/src/knot/server/server.c b/src/knot/server/server.c
index 80db35d..6b61d61 100644
--- a/src/knot/server/server.c
+++ b/src/knot/server/server.c
@@ -32,10 +32,8 @@
 #include "libknot/nameserver/name-server.h"
 #include "knot/stat/stat.h"
 #include "libknot/zone/zonedb.h"
-#include "knot/zone/zone-load.h"
 #include "libknot/dname.h"
 #include "knot/conf/conf.h"
-#include "knot/server/zones.h"
 
 /*! \brief Event scheduler loop. */
 static int evsched_run(dthread_t *thread)
@@ -50,11 +48,6 @@ static int evsched_run(dthread_t *thread)
 	event_t *ev = 0;
 	while((ev = evsched_next(s))) {
 
-		/* Error. */
-		if (!ev) {
-			return KNOTD_ERROR;
-		}
-
 		/* Process termination event. */
 		if (ev->type == EVSCHED_TERM) {
 			evsched_event_finished(s);
@@ -128,26 +121,31 @@ static void server_remove_iface(iface_t *iface)
 static int server_init_iface(iface_t *new_if, conf_iface_t *cfg_if)
 {
 	/* Initialize interface. */
+	int ret = 0;
+	int sock = 0;
 	char errbuf[128];
 	int opt = 1024 * 1024;
 	int snd_opt = 1024 * 1024;
 	memset(new_if, 0, sizeof(iface_t));
 
 	/* Create UDP socket. */
-	int sock = socket_create(cfg_if->family, SOCK_DGRAM);
-	if (sock <= 0) {
+	ret = socket_create(cfg_if->family, SOCK_DGRAM);
+	if (ret < 0) {
 		strerror_r(errno, errbuf, sizeof(errbuf));
 		log_server_error("Could not create UDP socket: %s.\n",
 				 errbuf);
-		return sock;
+		return ret;
+	} else {
+		sock = ret;
 	}
-	if (socket_bind(sock, cfg_if->family,
-	                cfg_if->address, cfg_if->port) < 0) {
+	
+	ret = socket_bind(sock, cfg_if->family, cfg_if->address, cfg_if->port);
+	if (ret < 0) {
 		socket_close(sock);
 		log_server_error("Could not bind to "
 		                 "UDP interface %s port %d.\n",
 		                 cfg_if->address, cfg_if->port);
-		return knot_map_errno(EACCES, EINVAL, ENOMEM);
+		return ret;
 	}
 
 	new_if->fd[UDP_ID] = sock;
@@ -163,14 +161,15 @@ static int server_init_iface(iface_t *new_if, conf_iface_t *cfg_if)
 	}
 
 	/* Create TCP socket. */
-	int ret = 0;
-	sock = socket_create(cfg_if->family, SOCK_STREAM);
-	if (sock <= 0) {
+	ret = socket_create(cfg_if->family, SOCK_STREAM);
+	if (ret < 0) {
 		socket_close(new_if->fd[UDP_ID]);
 		strerror_r(errno, errbuf, sizeof(errbuf));
 		log_server_error("Could not create TCP socket: %s.\n",
 				 errbuf);
-		return sock;
+		return ret;
+	} else {
+		sock = ret;
 	}
 
 	ret = socket_bind(sock, cfg_if->family, cfg_if->address, cfg_if->port);
@@ -357,7 +356,7 @@ static int server_bind_handlers(server_t *server)
 			h->iface = iface;
 
 			/* Save pointer. */
-			rcu_set_pointer(&iface->handler[UDP_ID], h);
+			iface->handler[UDP_ID] = h;  /* No need for cmpxchg */
 			dbg_server("server: creating UDP socket handlers for '%s:%d'\n",
 			             iface->addr, iface->port);
 
@@ -372,7 +371,7 @@ static int server_bind_handlers(server_t *server)
 			h->iface = iface;
 
 			/* Save pointer. */
-			rcu_set_pointer(&iface->handler[TCP_ID], h);
+			iface->handler[TCP_ID] = h; /* No need for cmpxchg */
 			dbg_server("server: creating TCP socket handlers for '%s:%d'\n",
 			             iface->addr, iface->port);
 		}
diff --git a/src/knot/server/socket.c b/src/knot/server/socket.c
index d3dd664..67f4a5f 100644
--- a/src/knot/server/socket.c
+++ b/src/knot/server/socket.c
@@ -78,17 +78,14 @@ int socket_connect(int fd, const char *addr, unsigned short port)
 
 	/* Connect. */
 	ret = -1;
-	if (addr) {
-		ret = connect(fd, saddr, addrlen);
-		if (ret < 0) {
-			ret = knot_map_errno(EACCES, EADDRINUSE, EAGAIN,
-			                     ECONNREFUSED, EISCONN);
-		}
-	} else {
-		ret = KNOTD_EINVAL;
+	ret = connect(fd, saddr, addrlen);
+	if (ret < 0) {
+		ret = knot_map_errno(EACCES, EADDRINUSE, EAGAIN,
+		                     ECONNREFUSED, EISCONN);
 	}
 
 
+
 	/* Free addresses. */
 	freeaddrinfo(res);
 
diff --git a/src/knot/server/tcp-handler.c b/src/knot/server/tcp-handler.c
index db58fef..2fdc354 100644
--- a/src/knot/server/tcp-handler.c
+++ b/src/knot/server/tcp-handler.c
@@ -28,14 +28,17 @@
 #include "common/sockaddr.h"
 #include "common/skip-list.h"
 #include "common/fdset.h"
+#include "common/WELL1024a.h"
 #include "knot/common.h"
 #include "knot/server/tcp-handler.h"
 #include "knot/server/xfr-handler.h"
+#include "knot/server/zones.h"
 #include "libknot/nameserver/name-server.h"
 #include "knot/other/error.h"
-#include "knot/stat/stat.h"
 #include "libknot/util/wire.h"
-#include "knot/server/zones.h"
+
+/* Defines */
+#define TCP_BUFFER_SIZE 65535 /*! Do not change, as it is used for maximum DNS/TCP packet size. */
 
 /*! \brief TCP worker data. */
 typedef struct tcp_worker_t {
@@ -47,6 +50,14 @@ typedef struct tcp_worker_t {
 /*
  * Forward decls.
  */
+#define TCP_THROTTLE_LO 10 /*!< Minimum recovery time on errors. */
+#define TCP_THROTTLE_HI 50 /*!< Maximum recovery time on errors. */
+
+/*! \brief Calculate TCP throttle time (random). */
+static inline int tcp_throttle() {
+	//(TCP_THROTTLE_LO + (int)(tls_rand() * TCP_THROTTLE_HI));
+	return (rand() % TCP_THROTTLE_HI) + TCP_THROTTLE_LO; 
+}
 
 /*! \brief Wrapper for TCP send. */
 static int xfr_send_cb(int session, sockaddr_t *addr, uint8_t *msg, size_t msglen)
@@ -63,7 +74,7 @@ static int xfr_send_cb(int session, sockaddr_t *addr, uint8_t *msg, size_t msgle
  * \param w Associated I/O event.
  * \param revents Returned events.
  */
-static void tcp_handle(tcp_worker_t *w, int fd)
+static void tcp_handle(tcp_worker_t *w, int fd, uint8_t *qbuf, size_t qbuf_maxlen)
 {
 	if (fd < 0 || !w || !w->ioh) {
 		dbg_net("tcp: tcp_handle(%p, %d) - invalid parameters\n", w, fd);
@@ -86,8 +97,6 @@ static void tcp_handle(tcp_worker_t *w, int fd)
 	}
 
 	/* Receive data. */
-	uint8_t qbuf[65535]; /*! \todo This may be problematic. */
-	size_t qbuf_maxlen = sizeof(qbuf);
 	int n = tcp_recv(fd, qbuf, qbuf_maxlen, &addr);
 	if (n <= 0) {
 		dbg_net("tcp: client on fd=%d disconnected\n", fd);
@@ -134,7 +143,8 @@ static void tcp_handle(tcp_worker_t *w, int fd)
 
 	/* Query types. */
 	case KNOT_QUERY_NORMAL:
-		res = knot_ns_answer_normal(ns, packet, qbuf, &resp_len);
+		//res = knot_ns_answer_normal(ns, packet, qbuf, &resp_len);
+		res = zones_normal_query_answer(ns, packet, &addr, qbuf, &resp_len);
 		break;
 	case KNOT_QUERY_IXFR:
 		res = xfr_request_init(&xfr, XFR_TYPE_IOUT, XFR_FLAG_TCP, packet);
@@ -228,9 +238,21 @@ static int tcp_accept(int fd)
 
 	/* Evaluate connection. */
 	if (incoming < 0) {
-		if (errno != EINTR) {
+		int en = errno;
+		if (en != EINTR) {
 			log_server_error("Cannot accept connection "
 					 "(%d).\n", errno);
+			if (en == EMFILE || en == ENFILE ||
+			    en == ENOBUFS || en == ENOMEM) {
+				int throttle = tcp_throttle();
+				log_server_error("Throttling TCP connection pool"
+				                 " for %d seconds because of "
+				                 "too many open descriptors "
+				                 "or lack of memory.\n",
+				                 throttle);
+				sleep(throttle);
+			}
+			
 		}
 	} else {
 		dbg_net("tcp: accepted connection fd=%d\n", incoming);
@@ -242,16 +264,16 @@ static int tcp_accept(int fd)
 tcp_worker_t* tcp_worker_create()
 {
 	tcp_worker_t *w = malloc(sizeof(tcp_worker_t));
-	if (!w) {
+	if (w == NULL) {
 		dbg_net("tcp: out of memory when creating worker\n");
-		return 0;
+		return NULL;
 	}
 	
 	/* Create signal pipes. */
 	memset(w, 0, sizeof(tcp_worker_t));
 	if (pipe(w->pipe) < 0) {
 		free(w);
-		return 0;
+		return NULL;
 	}
 	
 	/* Create fdset. */
@@ -260,6 +282,7 @@ tcp_worker_t* tcp_worker_create()
 		close(w->pipe[0]);
 		close(w->pipe[1]);
 		free(w);
+		return NULL;
 	}
 	
 	fdset_add(w->fdset, w->pipe[0], OS_EV_READ);
@@ -361,13 +384,14 @@ int tcp_loop_master(dthread_t *thread)
 {
 	iohandler_t *handler = (iohandler_t *)thread->data;
 	dt_unit_t *unit = thread->unit;
-	tcp_worker_t **workers = handler->data;
 
 	/* Check socket. */
-	if (!handler || handler->fd < 0 || !workers) {
+	if (!handler || handler->fd < 0 || handler->data == NULL) {
 		dbg_net("tcp: failed to initialize master thread\n");
 		return KNOTD_EINVAL;
 	}
+	
+	tcp_worker_t **workers = handler->data;
 
 	/* Accept connections. */
 	int id = 0;
@@ -407,6 +431,13 @@ int tcp_loop_worker(dthread_t *thread)
 	if (!w) {
 		return KNOTD_EINVAL;
 	}
+	
+	/* Allocate buffer for requests. */
+	uint8_t *qbuf = malloc(TCP_BUFFER_SIZE);
+	if (qbuf == NULL) {
+		dbg_net("tcp: failed to allocate buffers for TCP worker\n");
+		return KNOTD_EINVAL;
+	}
 
 	/* Accept clients. */
 	dbg_net_verb("tcp: worker %p started\n", w);
@@ -443,7 +474,7 @@ int tcp_loop_worker(dthread_t *thread)
 				fdset_add(w->fdset, client, OS_EV_READ);
 			} else {
 				/* Handle other events. */
-				tcp_handle(w, it.fd);
+				tcp_handle(w, it.fd, qbuf, TCP_BUFFER_SIZE);
 			}
 			
 			/* Check if next exists. */
@@ -455,6 +486,7 @@ int tcp_loop_worker(dthread_t *thread)
 	}
 
 	/* Stop whole unit. */
+	free(qbuf);
 	dbg_net_verb("tcp: worker %p finished\n", w);
 	tcp_worker_free(w);
 	return KNOTD_EOK;
diff --git a/src/knot/server/udp-handler.c b/src/knot/server/udp-handler.c
index f7ae550..b202669 100644
--- a/src/knot/server/udp-handler.c
+++ b/src/knot/server/udp-handler.c
@@ -14,6 +14,11 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE /* Required for RTLD_DEFAULT. */
+#endif
+
+#include <dlfcn.h>
 #include <config.h>
 #include <time.h>
 #include <unistd.h>
@@ -21,6 +26,7 @@
 #include <arpa/inet.h>
 #include <sys/socket.h>
 #include <sys/poll.h>
+#include <sys/syscall.h>
 #include <netinet/in.h>
 #include <string.h>
 #include <assert.h>
@@ -39,6 +45,14 @@
 #include "knot/server/zones.h"
 #include "knot/server/notify.h"
 
+/* Check for sendmmsg syscall. */
+#ifdef SYS_sendmmsg
+#define ENABLE_SENDMMSG 1
+#endif
+
+/*! \brief Pointer to selected UDP master implementation. */
+static int (*_udp_master)(dthread_t *, stat_t *) = 0;
+
 ///*! \brief Wrapper for UDP send. */
 //static int xfr_send_udp(int session, sockaddr_t *addr, uint8_t *msg, size_t msglen)
 //{
@@ -96,8 +110,10 @@ int udp_handle(int fd, uint8_t *qbuf, size_t qbuflen, size_t *resp_len,
 	
 	/* Query types. */
 	case KNOT_QUERY_NORMAL:
-		res = knot_ns_answer_normal(ns, packet, qbuf,
-					      resp_len);
+		res = zones_normal_query_answer(ns, packet, addr, qbuf,
+		                                resp_len);
+//		res = knot_ns_answer_normal(ns, packet, qbuf,
+//					      resp_len);
 		break;
 	case KNOT_QUERY_AXFR:
 		/* RFC1034, p.28 requires reliable transfer protocol.
@@ -133,8 +149,10 @@ int udp_handle(int fd, uint8_t *qbuf, size_t qbuflen, size_t *resp_len,
 		 * IXFR/UDP.
 		 */
 		knot_packet_set_qtype(packet, KNOT_RRTYPE_SOA);
-		res = knot_ns_answer_normal(ns, packet, qbuf,
-		                            resp_len);
+		res = zones_normal_query_answer(ns, packet, addr,
+		                                qbuf, resp_len);
+//		res = knot_ns_answer_normal(ns, packet, qbuf,
+//		                            resp_len);
 		break;
 //		/* Process IXFR over UDP. */
 //		res = xfr_request_init(&xfr, XFR_TYPE_IOUT, XFR_FLAG_UDP, packet);
@@ -192,8 +210,12 @@ int udp_handle(int fd, uint8_t *qbuf, size_t qbuflen, size_t *resp_len,
 static inline int udp_master_recvfrom(dthread_t *thread, stat_t *thread_stat)
 {
 	iohandler_t *h = (iohandler_t *)thread->data;
+	if (h == NULL || h->server == NULL || h->server->nameserver == NULL) {
+		dbg_net("udp: invalid parameters for udp_master_recvfrom\n");
+		return KNOTD_EINVAL;
+	}
+	
 	knot_nameserver_t *ns = h->server->nameserver;
-	int sock = dup(h->fd);
 
 	sockaddr_t addr;
 	if (sockaddr_init(&addr, h->type) != KNOTD_EOK) {
@@ -203,6 +225,7 @@ static inline int udp_master_recvfrom(dthread_t *thread, stat_t *thread_stat)
 		return KNOTD_ENOTSUP;
 	}
 	
+	int sock = dup(h->fd);
 	uint8_t qbuf[SOCKET_MTU_SZ];
 	struct msghdr msg;
 	memset(&msg, 0, sizeof(struct msghdr));
@@ -271,6 +294,66 @@ static inline int udp_master_recvfrom(dthread_t *thread, stat_t *thread_stat)
 
 #ifdef ENABLE_RECVMMSG
 #ifdef MSG_WAITFORONE
+
+/*! \brief Pointer to selected UDP send implementation. */
+static int (*_send_mmsg)(int, sockaddr_t *, struct mmsghdr *, size_t) = 0;
+
+/*!
+ * \brief Send multiple packets.
+ * 
+ * Basic, sendto() based implementation.
+ */
+int udp_sendto(int sock, sockaddr_t * addrs, struct mmsghdr *msgs, size_t count)
+{
+	for (unsigned i = 0; i < count; ++i) {
+		
+		const size_t resp_len = msgs[i].msg_len;
+		if (resp_len > 0) {
+			dbg_net("udp: on fd=%d, sending answer size=%zd.\n",
+			        sock, resp_len);
+
+			// Send datagram
+			sockaddr_t *addr = addrs + i;
+			struct iovec *cvec = msgs[i].msg_hdr.msg_iov;
+			int res = sendto(sock, cvec->iov_base, resp_len,
+					 0, addr->ptr, addr->len);
+
+			// Check result
+			if (res != (int)resp_len) {
+				dbg_net("udp: sendto(): failed: %d - %d.\n",
+				        res, errno);
+			}
+		}
+	}
+	
+	return KNOTD_EOK;
+}
+
+#ifdef ENABLE_SENDMMSG
+/*! \brief sendmmsg() syscall interface. */
+static inline int sendmmsg(int fd, struct mmsghdr *mmsg, unsigned vlen,
+                           unsigned flags)
+{
+	return syscall(SYS_sendmmsg, fd, mmsg, vlen, flags, NULL);
+}
+
+/*!
+ * \brief Send multiple packets.
+ * 
+ * sendmmsg() implementation.
+ */
+int udp_sendmmsg(int sock, sockaddr_t *_, struct mmsghdr *msgs, size_t count)
+{
+	UNUSED(_);
+	dbg_net("udp: sending multiple responses\n");
+	if (sendmmsg(sock, msgs, count, 0) < 0) {
+		return KNOTD_ERROR;
+	}
+	
+	return KNOTD_EOK;
+}
+#endif
+
 static inline int udp_master_recvmmsg(dthread_t *thread, stat_t *thread_stat)
 {
 	iohandler_t *h = (iohandler_t *)thread->data;
@@ -330,32 +413,20 @@ static inline int udp_master_recvmmsg(dthread_t *thread, stat_t *thread_stat)
 			                 addrs + i, ns);
 			if (ret == KNOTD_EOK) {
 				msgs[i].msg_len = resp_len;
+				iov[i].iov_len = resp_len;
 			} else {
 				msgs[i].msg_len = 0;
+				iov[i].iov_len = 0;
 			}
 			
 		}
 
 		/* Gather results. */
-		/*! \todo Implement with sendmmsg() when it's ready. */
+		_send_mmsg(sock, addrs, msgs, n);
+		
+		/* Reset iov buffer size. */
 		for (unsigned i = 0; i < n; ++i) {
-			const size_t resp_len = msgs[i].msg_len;
-			if (resp_len > 0) {
-				dbg_net("udp: on fd=%d, sending answer size=%zd.\n",
-				        sock, resp_len);
-
-				// Send datagram
-				sockaddr_t *addr = addrs + i;
-				struct iovec *cvec = msgs[i].msg_hdr.msg_iov;
-				int res = sendto(sock, cvec->iov_base, resp_len,
-						 0, addr->ptr, addr->len);
-
-				// Check result
-				if (res != (int)resp_len) {
-					dbg_net("udp: sendto(): failed: %d - %d.\n",
-					        res, errno);
-				}
-			}
+			iov[i].iov_len = SOCKET_MTU_SZ;
 		}
 	}
 
@@ -370,6 +441,33 @@ static inline int udp_master_recvmmsg(dthread_t *thread, stat_t *thread_stat)
 #endif
 #endif
 
+/*! \brief Initialize UDP master routine on run-time. */
+void __attribute__ ((constructor)) udp_master_init()
+{
+	/* Initialize defaults. */
+	_udp_master = udp_master_recvfrom;
+
+	/* Optimized functions. */
+#ifdef ENABLE_RECVMMSG
+#ifdef MSG_WAITFORONE
+	/* Check for recvmmsg() support. */
+	if (dlsym(RTLD_DEFAULT, "recvmmsg") != 0) {
+		_udp_master = udp_master_recvmmsg;
+	}
+	
+	/* Check for sendmmsg() support. */
+#ifdef ENABLE_SENDMMSG
+	_send_mmsg = udp_sendto;
+	sendmmsg(0, 0, 0, 0); /* Just check if syscall exists */
+	if (errno != ENOSYS) {
+		_send_mmsg = udp_sendmmsg;
+	}
+#endif /* ENABLE_SENDMMSG */
+#endif /* MSG_WAITFORONE */
+#endif /* ENABLE_RECVMMSG */
+}
+	
+	
 int udp_master(dthread_t *thread)
 {
 	iohandler_t *handler = (iohandler_t *)thread->data;
@@ -384,7 +482,6 @@ int udp_master(dthread_t *thread)
 	/* Set socket options. */
 	int flag = 1;
 #ifndef DISABLE_IPV6
-#
 	if (handler->type == AF_INET6) {
 		/* Disable dual-stack for performance reasons. */
 		setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &flag, sizeof(flag));
@@ -416,20 +513,8 @@ int udp_master(dthread_t *thread)
 	/* Execute proper handler. */
 	dbg_net_verb("udp: thread started (worker %p).\n", thread);
 	int ret = KNOTD_EOK;
-
-#ifdef ENABLE_RECVMMSG
 	
-/* Check if MSG_WAITFORONE is supported. */
-#ifdef MSG_WAITFORONE
-	ret = udp_master_recvmmsg(thread, thread_stat);
-#else /* Don't have MSG_WAITFORONE */
-	ret = udp_master_recvfrom(thread, thread_stat);
-#endif
-	
-#else /* Don't have ENABLE_RECVMMSG */
-	ret = udp_master_recvfrom(thread, thread_stat);
-#endif
-
+	ret = _udp_master(thread, thread_stat);
 
 	stat_free(thread_stat);
 	dbg_net_verb("udp: worker %p finished.\n", thread);
diff --git a/src/knot/server/xfr-handler.c b/src/knot/server/xfr-handler.c
index 45817cb..cec3f53 100644
--- a/src/knot/server/xfr-handler.c
+++ b/src/knot/server/xfr-handler.c
@@ -17,7 +17,6 @@
 #include <config.h>
 #include <unistd.h>
 #include <fcntl.h>
-#include <errno.h>
 #include <netinet/tcp.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
@@ -40,6 +39,10 @@
 #include "libknot/util/error.h"
 #include "libknot/tsig-op.h"
 #include "common/evsched.h"
+#include "common/WELL1024a.h"
+
+/* Constants */
+#define XFR_BUFFER_SIZE 65535 /*! Do not change this - maximum value for UDP packet length. */
 
 void xfr_interrupt(xfrhandler_t *h)
 {
@@ -220,8 +223,12 @@ static int xfr_xfrin_cleanup(xfrworker_t *w, knot_ns_xfr_t *data)
 	switch(data->type) {
 	case XFR_TYPE_AIN:
 		if (data->data) {
+			xfrin_constructed_zone_t *constr_zone = 
+					(xfrin_constructed_zone_t *)data->data;
 			knot_zone_contents_deep_free(
-					(knot_zone_contents_t **)&data->data, 0);
+					&(constr_zone->contents), 0);
+			xfrin_free_orphan_rrsigs(&(constr_zone->rrsigs));
+			free(data->data);
 			data->data = 0;
 		}
 		break;
@@ -261,6 +268,7 @@ static int xfr_xfrin_finalize(xfrworker_t *w, knot_ns_xfr_t *data)
 //	}
 	
 	int ret = KNOTD_EOK;
+	knot_changesets_t *chs = NULL;
 	
 	switch(data->type) {
 	case XFR_TYPE_AIN:
@@ -307,7 +315,7 @@ static int xfr_xfrin_finalize(xfrworker_t *w, knot_ns_xfr_t *data)
 			}
 		}
 		/* Free changesets, but not the data. */
-		knot_changesets_t *chs = (knot_changesets_t *)data->data;
+		chs = (knot_changesets_t *)data->data;
 		knot_free_changesets(&chs);
 		/* CLEANUP */
 //		free(chs->sets);
@@ -336,14 +344,14 @@ static int xfr_xfrin_finalize(xfrworker_t *w, knot_ns_xfr_t *data)
 static int xfr_prepare_tsig(knot_ns_xfr_t *xfr, knot_key_t *key)
 {
 	int ret = KNOT_EOK;
-	xfr->tsig_key = 0; /*key;*/ /*!< \todo [TSIG] DISABLED */
-//	xfr->tsig_size = tsig_wire_maxsize(key);
-//	xfr->digest_max_size = tsig_alg_digest_length(
-//				key->algorithm);
-//	xfr->digest = malloc(xfr->digest_max_size);
-//	memset(xfr->digest, 0 , xfr->digest_max_size);
-//	dbg_xfr("xfr: found TSIG key (MAC len=%zu), adding to transfer\n",
-//		xfr->digest_max_size);
+	xfr->tsig_key = key;
+	xfr->tsig_size = tsig_wire_maxsize(key);
+	xfr->digest_max_size = tsig_alg_digest_length(
+				key->algorithm);
+	xfr->digest = malloc(xfr->digest_max_size);
+	memset(xfr->digest, 0 , xfr->digest_max_size);
+	dbg_xfr("xfr: found TSIG key (MAC len=%zu), adding to transfer\n",
+		xfr->digest_max_size);
 	
 	return ret;
 }
@@ -353,108 +361,149 @@ static int xfr_prepare_tsig(knot_ns_xfr_t *xfr, knot_key_t *key)
  */
 static int xfr_check_tsig(knot_ns_xfr_t *xfr, knot_rcode_t *rcode)
 {
-	/*!< \todo [TSIG] DISABLED */
-	return knot_packet_parse_rest(xfr->query);
-	
-//	/* Parse rest of the packet. */
-//	int ret = KNOT_EOK;
-//	knot_packet_t *qry = xfr->query;
-//	knot_key_t *key = 0;
-//	const knot_rrset_t *tsig_rr = 0;
-//	ret = knot_packet_parse_rest(qry);
-//	if (ret == KNOT_EOK) {
+	/* Parse rest of the packet. */
+	int ret = KNOT_EOK;
+	knot_packet_t *qry = xfr->query;
+	knot_key_t *key = 0;
+	const knot_rrset_t *tsig_rr = 0;
+	ret = knot_packet_parse_rest(qry);
+	if (ret == KNOT_EOK) {
 		
-//		/* Find TSIG key name from query. */
-//		const knot_dname_t* kname = 0;
-//		int tsig_pos = knot_packet_additional_rrset_count(qry) - 1;
-//		if (tsig_pos >= 0) {
-//			tsig_rr = knot_packet_additional_rrset(qry, tsig_pos);
-//			if (knot_rrset_type(tsig_rr) == KNOT_RRTYPE_TSIG) {
-//				dbg_xfr("xfr: found TSIG in AR\n");
-//				kname = knot_rrset_owner(tsig_rr);
-//				ret = KNOT_TSIG_EBADKEY;
-//			}
-//		}
-//		if (!kname) {
-//			dbg_xfr("xfr: TSIG not found in AR\n");
-//		}
-
-//		/* Find configured key for claimed key name. */
-//		conf_key_t *ck = 0;
-//		WALK_LIST(ck, conf()->keys) {
-//			if (!kname) {
-//				break;
-//			}
-//			/* Compare stored keys to claimed. */
-//			if (knot_dname_compare(ck->k.name,
-//					       kname) == 0) {
-//				dbg_xfr("xfr: found claimed "
-//					"TSIG key for "
-//					"comparison\n");
-//				key = &ck->k;
-//				break;
-//			}
-//		}
-
-//		/* Validate with TSIG. */
-//		if (key) {
-//			/* Prepare variables for TSIG */
-//			xfr_prepare_tsig(xfr, key);
+		/* Find TSIG key name from query. */
+		const knot_dname_t* kname = 0;
+		int tsig_pos = knot_packet_additional_rrset_count(qry) - 1;
+		if (tsig_pos >= 0) {
+			tsig_rr = knot_packet_additional_rrset(qry, tsig_pos);
+			if (knot_rrset_type(tsig_rr) == KNOT_RRTYPE_TSIG) {
+				dbg_xfr("xfr: found TSIG in AR\n");
+				kname = knot_rrset_owner(tsig_rr);
+			} else {
+				tsig_rr = 0;
+			}
+		}
+		if (!kname) {
+			dbg_xfr("xfr: TSIG not found in AR\n");
+			char *name = knot_dname_to_str(
+						knot_zone_name(xfr->zone));
+			log_answer_warning("Unauthorized request for XFR '%s/"
+                               "OUT'. (TSIG)\n", name);
+			free(name);
+
+			// return REFUSED
+			xfr->tsig_key = 0;
+			*rcode = KNOT_RCODE_REFUSED;
+			return KNOT_EXFRREFUSED;
+		}
+		if (tsig_rr) {
+			tsig_algorithm_t alg = tsig_rdata_alg(tsig_rr);
+			if (tsig_alg_digest_length(alg) == 0) {
+				log_server_info("Unsupported digest algorithm "
+				                "requested, treating as "
+				                "bad key.\n");
+				/*! \todo [TSIG] It is unclear from RFC if I
+				 *               should treat is as a bad key
+				 *               or some other error.
+				 */
+				*rcode = KNOT_RCODE_NOTAUTH;
+				xfr->tsig_key = NULL;
+				xfr->tsig_rcode = KNOT_TSIG_RCODE_BADKEY;
+				xfr->tsig_prev_time_signed =
+				                tsig_rdata_time_signed(tsig_rr);
+				return KNOT_TSIG_EBADKEY;
+			}
+		}
+
+		/* Evaluate configured key for claimed key name.*/
+		key = xfr->tsig_key; /* Expects already set key (check_zone) */
+		xfr->tsig_key = 0;
+		if (key && kname && knot_dname_compare(key->name, kname) == 0) {
+			dbg_xfr("xfr: found claimed TSIG key for comparison\n");
+		} else {
+			/*! \todo These ifs are redundant. */
+			*rcode = KNOT_RCODE_NOTAUTH;
+			/* TSIG is mandatory if configured for interface. */
+			if (key && !kname) {
+				dbg_xfr("xfr: TSIG key is mandatory for "
+				        "this interface\n");
+				ret = KNOT_TSIG_EBADKEY;
+				xfr->tsig_rcode = KNOT_TSIG_RCODE_BADKEY;
+			}
 			
-//			/* Copy MAC from query. */
-//			dbg_xfr("xfr: validating TSIG from query\n");
-//			const uint8_t* mac = tsig_rdata_mac(tsig_rr);
-//			size_t mac_len = tsig_rdata_mac_length(tsig_rr);
-//			if (mac_len > xfr->digest_max_size) {
-//				ret = KNOT_EMALF;
-//				dbg_xfr("xfr: MAC length %zu exceeds digest "
-//					"maximum size %zu\n",
-//					mac_len, xfr->digest_max_size);
-//			} else {
-//				memcpy(xfr->digest, mac, mac_len);
-//				xfr->digest_size = mac_len;
-				
-//				/* Check query TSIG. */
-//				ret = knot_tsig_server_check(
-//						tsig_rr,
-//						knot_packet_wireformat(qry),
-//						knot_packet_size(qry),
-//						key);
-//				dbg_xfr("knot_tsig_server_check() returned %s\n",
-//					knot_strerror(ret));
-//			}
+			/* Configured, but doesn't match. */
+			if (kname) {
+				dbg_xfr("xfr: no claimed key configured, "
+				        "treating as bad key\n");
+				ret = KNOT_TSIG_EBADKEY;
+				xfr->tsig_rcode = KNOT_TSIG_RCODE_BADKEY;
+			}
+			
+			key = 0; /* Invalidate, ret already set to BADKEY */
+		}
+
+		/* Validate with TSIG. */
+		if (key) {
+			/* Prepare variables for TSIG */
+			xfr_prepare_tsig(xfr, key);
 			
-//			/* Evaluate TSIG check results. */
-//			switch(ret) {
-//			case KNOT_EOK:
-//				*rcode = KNOT_RCODE_NOERROR;
-//				break;
-//			case KNOT_TSIG_EBADKEY:
-//			case KNOT_TSIG_EBADSIG:
-//				// delete the TSIG key so that the error
-//				// response is not signed
-//				xfr->tsig_key = NULL;
-//			case KNOT_TSIG_EBADTIME:
-//				/*! \note [TSIG] Set TSIG rcode in TSIG RR. */
+			/* Copy MAC from query. */
+			dbg_xfr("xfr: validating TSIG from query\n");
+			const uint8_t* mac = tsig_rdata_mac(tsig_rr);
+			size_t mac_len = tsig_rdata_mac_length(tsig_rr);
+			if (mac_len > xfr->digest_max_size) {
+				ret = KNOT_EMALF;
+				dbg_xfr("xfr: MAC length %zu exceeds digest "
+					"maximum size %zu\n",
+					mac_len, xfr->digest_max_size);
+			} else {
+				memcpy(xfr->digest, mac, mac_len);
+				xfr->digest_size = mac_len;
 				
-//				*rcode = KNOT_RCODE_NOTAUTH; 
-//				break;
-//			case KNOT_EMALF:
-//				*rcode = KNOT_RCODE_FORMERR;
-//				break;
-//			default:
-//				*rcode = KNOT_RCODE_SERVFAIL;
-//			}
-//		} else {
-//			dbg_xfr("xfr: no claimed key configured, "
-//				"treating as bad key\n");
-//		}
-//	} else {
-//		dbg_xfr("xfr: failed to parse rest of the packet\n");
-//		*rcode = KNOT_RCODE_FORMERR;
-//	}
+				/* Check query TSIG. */
+				ret = knot_tsig_server_check(
+						tsig_rr,
+						knot_packet_wireformat(qry),
+						knot_packet_size(qry),
+						key);
+				dbg_xfr("knot_tsig_server_check() returned %s\n",
+					knot_strerror(ret));
+			}
+			
+			/* Evaluate TSIG check results. */
+			switch(ret) {
+			case KNOT_EOK:
+				*rcode = KNOT_RCODE_NOERROR;
+				break;
+			case KNOT_TSIG_EBADKEY:
+				xfr->tsig_rcode = KNOT_TSIG_RCODE_BADKEY;
+				xfr->tsig_key = NULL;
+				*rcode = KNOT_RCODE_NOTAUTH;
+				break;
+			case KNOT_TSIG_EBADSIG:
+				xfr->tsig_rcode = KNOT_TSIG_RCODE_BADSIG;
+				xfr->tsig_key = NULL;
+				*rcode = KNOT_RCODE_NOTAUTH;
+				break;
+			case KNOT_TSIG_EBADTIME:
+				xfr->tsig_rcode = KNOT_TSIG_RCODE_BADTIME;
+				// store the time signed from the query
+				assert(tsig_rr != NULL);
+				xfr->tsig_prev_time_signed =
+				                tsig_rdata_time_signed(tsig_rr);
+				*rcode = KNOT_RCODE_NOTAUTH;
+				break;
+			case KNOT_EMALF:
+				*rcode = KNOT_RCODE_FORMERR;
+				break;
+			default:
+				*rcode = KNOT_RCODE_SERVFAIL;
+			}
+		}
+	} else {
+		dbg_xfr("xfr: failed to parse rest of the packet\n");
+		*rcode = KNOT_RCODE_FORMERR;
+	}
 	
-//	return ret;
+	return ret;
 }
 
 /*!
@@ -466,14 +515,11 @@ static int xfr_check_tsig(knot_ns_xfr_t *xfr, knot_rcode_t *rcode)
  * \param fd Associated file descriptor.
  * \param data Transfer data.
  */
-int xfr_process_event(xfrworker_t *w, int fd, knot_ns_xfr_t *data)
+int xfr_process_event(xfrworker_t *w, int fd, knot_ns_xfr_t *data, uint8_t *buf, size_t buflen)
 {
-	/* Buffer for answering. */
-	uint8_t buf[65535];
-
 	/* Update xfer state. */
 	data->wire = buf;
-	data->wire_size = sizeof(buf);
+	data->wire_size = buflen;
 
 	/* Handle SOA/NOTIFY responses. */
 	if (data->type == XFR_TYPE_NOTIFY || data->type == XFR_TYPE_SOA) {
@@ -482,18 +528,13 @@ int xfr_process_event(xfrworker_t *w, int fd, knot_ns_xfr_t *data)
 
 	/* Read DNS/TCP packet. */
 	int ret = 0;
-	int rcvd = tcp_recv(fd, buf, sizeof(buf), 0);
+	int rcvd = tcp_recv(fd, buf, buflen, 0);
 	data->wire_size = rcvd;
 	if (rcvd <= 0) {
 		data->wire_size = 0;
 		ret = KNOT_ECONN;
 	} else {
 
-	/*!
-	 * \todo [TSIG] Somewhere before this fetch the query digest and the TSIG
-	 *       associated with this transfer and save them to 'data'.
-	 */
-
 		/* Process incoming packet. */
 		switch(data->type) {
 		case XFR_TYPE_AIN:
@@ -510,7 +551,7 @@ int xfr_process_event(xfrworker_t *w, int fd, knot_ns_xfr_t *data)
 
 	/* AXFR-style IXFR. */
 	if (ret == KNOT_ENOIXFR) {
-		dbg_xfr("xfr: Fallback to AXFR/IN.\n");
+		log_server_notice("IXFR/IN - Fallback to AXFR/IN.\n");
 		assert(data->type == XFR_TYPE_IIN);
 		data->type = XFR_TYPE_AIN;
 		ret = knot_ns_process_axfrin(w->ns, data);
@@ -529,15 +570,15 @@ int xfr_process_event(xfrworker_t *w, int fd, knot_ns_xfr_t *data)
 	knot_zone_t *zone = (knot_zone_t *)data->zone;
 	if (zone && data->type == XFR_TYPE_IIN && ret == KNOT_EXFRREFUSED) {
 		log_server_notice("IXFR/IN failed, attempting to use "
-				  "AXFR/IN instead.\n");
-		size_t bufsize = sizeof(buf);
-		data->wire_size = sizeof(buf); /* Reset maximum bufsize */
+		                  "AXFR/IN instead.\n");
+		size_t bufsize = buflen;
+		data->wire_size = buflen; /* Reset maximum bufsize */
 		ret = xfrin_create_axfr_query(zone->name, data,
-					      &bufsize, 1);
+		                              &bufsize, 1);
 		/* Send AXFR/IN query. */
-		if (ret == KNOTD_EOK) {
+		if (ret == KNOT_EOK) {
 			ret = data->send(data->session, &data->addr,
-					 data->wire, bufsize);
+			                 data->wire, bufsize);
 			/* Switch to AIN type XFR and return now. */
 			if (ret == bufsize) {
 				data->type = XFR_TYPE_AIN;
@@ -547,13 +588,19 @@ int xfr_process_event(xfrworker_t *w, int fd, knot_ns_xfr_t *data)
 	}
 
 	/* Handle errors. */
-	if (ret < 0 && ret != KNOT_ENOXFR) {
+	if (ret == KNOT_ENOXFR) {
+		log_server_warning("%cXFR/IN request finished - %s\n",
+		                   data->type == XFR_TYPE_AIN ? 'A' : 'I',
+		                   knot_strerror(ret));
+	} else if (ret < 0) {
 		log_server_error("%cXFR/IN request failed - %s\n",
 		                 data->type == XFR_TYPE_AIN ? 'A' : 'I',
 		                 knot_strerror(ret));
 	}
 
+
 	/* Check finished zone. */
+	int result = KNOTD_EOK;
 	if (xfer_finished) {
 		
 		knot_zone_t *zone = (knot_zone_t *)data->zone;
@@ -566,17 +613,17 @@ int xfr_process_event(xfrworker_t *w, int fd, knot_ns_xfr_t *data)
 			
 			/* AXFR bootstrap timeout. */
 			rcu_read_lock();
-			if (!knot_zone_contents(zone) && data->type == XFR_TYPE_AIN) {
+			if (ret != KNOTD_EOK && data->type == XFR_TYPE_AIN) {
 				/* Schedule request (60 - 90s random delay). */
 				int tmr_s = AXFR_BOOTSTRAP_RETRY;
-				tmr_s += (30.0 * 1000) * (rand() / (RAND_MAX + 1.0));
+				tmr_s += (30.0 * 1000) * (tls_rand());
 				zd->xfr_in.bootstrap_retry = tmr_s;
 				log_zone_info("Another attempt to AXFR bootstrap "
 				              "zone '%s' in %d seconds.\n",
 				              zorigin, tmr_s/1000);
 			}
 			rcu_read_unlock();
-			
+
 			/* Update timers. */
 			server_t *server = (server_t *)knot_ns_get_data(w->ns);
 			zones_timers_update(zone, zd->conf, server->sched);
@@ -599,12 +646,10 @@ int xfr_process_event(xfrworker_t *w, int fd, knot_ns_xfr_t *data)
 		}
 		
 		/* Disconnect. */
-		ret = KNOTD_ECONNREFUSED; /* Make it disconnect. */
-	} else {
-		ret = KNOTD_EOK;
+		result = KNOTD_ECONNREFUSED; /* Make it disconnect. */
 	}
 
-	return ret;
+	return result;
 }
 
 /*! \todo Document me.
@@ -649,6 +694,7 @@ static int xfr_client_start(xfrworker_t *w, knot_ns_xfr_t *data)
 	if (data->session <= 0) {
 		int fd = socket_create(data->addr.family, SOCK_STREAM);
 		if (fd < 0) {
+			pthread_mutex_unlock(&zd->xfr_in.lock);
 			log_server_warning("Failed to create socket "
 					   "(type=%s, family=%s).\n",
 					   "SOCK_STREAM",
@@ -658,6 +704,7 @@ static int xfr_client_start(xfrworker_t *w, knot_ns_xfr_t *data)
 		}
 		ret = connect(fd, data->addr.ptr, data->addr.len);
 		if (ret < 0) {
+			pthread_mutex_unlock(&zd->xfr_in.lock);
 			log_server_warning("Failed to connect to %cXFR master "
 					   "at %s:%d.\n",
 					   data->type == XFR_TYPE_AIN ? 'A' : 'I',
@@ -665,8 +712,7 @@ static int xfr_client_start(xfrworker_t *w, knot_ns_xfr_t *data)
 			if (!knot_zone_contents(zone)) {
 				/* Reschedule request (120 - 240s random delay). */
 				int tmr_s = AXFR_BOOTSTRAP_RETRY * 2; /* Malus x2 */
-				tmr_s += (int)((120.0 * 1000) * 
-				               (rand() / (RAND_MAX + 1.0)));
+				tmr_s += (int)((120.0 * 1000) * tls_rand());
 				event_t *ev = zd->xfr_in.timer;
 				if (ev) {
 					evsched_cancel(ev->parent, ev);
@@ -690,16 +736,14 @@ static int xfr_client_start(xfrworker_t *w, knot_ns_xfr_t *data)
 	rcu_read_lock();
 	const knot_zone_contents_t *contents = knot_zone_contents(zone);
 	if (!contents && data->type == XFR_TYPE_IIN) {
+		pthread_mutex_unlock(&zd->xfr_in.lock);
 		rcu_read_unlock();
 		log_server_warning("Failed start IXFR on zone with no "
 				   "contents\n");
 		return KNOTD_ERROR;
 	}
-	
-	/*! \todo [TSIG] Somewhere before this determine if the server should
-	 *               use TSIG for this transfer and set appropriate fields
-	 *               in 'data'.
-	 */
+
+	/* Prepare TSIG key if set. */
 	int add_tsig = 0;
 	if (data->tsig_key) {
 		if (xfr_prepare_tsig(data, data->tsig_key) == KNOT_EOK) {
@@ -708,7 +752,7 @@ static int xfr_client_start(xfrworker_t *w, knot_ns_xfr_t *data)
 			if (data->tsig_data) {
 				dbg_xfr("xfr: using TSIG for XFR/IN\n");
 				add_tsig = 1;
-				data->tsig_data_size = data_bufsize;
+				data->tsig_data_size = 0;
 			} else {
 				dbg_xfr("xfr: failed to allocate TSIG data "
 					"buffer (%zu kB)\n",
@@ -727,15 +771,16 @@ static int xfr_client_start(xfrworker_t *w, knot_ns_xfr_t *data)
 		ret = xfrin_create_ixfr_query(contents, data, &bufsize, add_tsig);
 		break;
 	default:
-		ret = KNOTD_EINVAL;
+		ret = KNOT_EBADARG;
 		break;
 	}
 
 	/* Handle errors. */
 	if (ret != KNOT_EOK) {
+		pthread_mutex_unlock(&zd->xfr_in.lock);
 		dbg_xfr("xfr: failed to create XFR query type %d: %s\n",
 		        data->type, knot_strerror(ret));
-		return ret;
+		return KNOTD_ERROR;
 	}
 
 	/* Unlock zone contents. */
@@ -822,8 +867,8 @@ xfrhandler_t *xfr_create(size_t thrcount, knot_nameserver_t *ns)
 {
 	/* Create XFR handler data. */
 	xfrhandler_t *data = malloc(sizeof(xfrhandler_t));
-	if (!data) {
-		return 0;
+	if (data == NULL) {
+		return NULL;
 	}
 	memset(data, 0, sizeof(xfrhandler_t));
 	
@@ -836,18 +881,19 @@ xfrhandler_t *xfr_create(size_t thrcount, knot_nameserver_t *ns)
 	
 	/* Initialize threads. */
 	data->workers = malloc(thrcount * sizeof(xfrhandler_t*));
-	if(data->workers == 0) {
+	if(data->workers == NULL) {
 		pthread_mutex_destroy(&data->rr_mx);
 		free(data);
+		return NULL;
 	}
 	
 	/* Create threading unit. */
 	dt_unit_t *unit = dt_create(thrcount);
-	if (!unit) {
+	if (unit == NULL) {
 		pthread_mutex_destroy(&data->rr_mx);
 		free(data->workers);
 		free(data);
-		return 0;
+		return NULL;
 	}
 	data->unit = unit;
 	
@@ -870,7 +916,7 @@ xfrhandler_t *xfr_create(size_t thrcount, knot_nameserver_t *ns)
 		free(data->workers);
 		free(data->unit);
 		free(data);
-		return 0;
+		return NULL;
 	}
 	
 	/* Assign worker threads. */
@@ -994,6 +1040,8 @@ static int xfr_process_request(xfrworker_t *w, uint8_t *buf, size_t buflen)
 	const char *req_type = "";
 	knot_rcode_t rcode = 0;
 	char *zname = "(unknown)";
+	uint32_t serial_from = 0;
+	uint32_t serial_to = 0;
 
 	/* XFR request state tracking. */
 	int init_failed = 0;
@@ -1025,7 +1073,7 @@ static int xfr_process_request(xfrworker_t *w, uint8_t *buf, size_t buflen)
 		}
 
 		/* Check TSIG. */
-		if (!init_failed) {
+		if (!init_failed && xfr.tsig_key != NULL) {
 			ret = xfr_check_tsig(&xfr, &rcode);
 			init_failed = (ret != KNOT_EOK);
 			errstr = knot_strerror(ret);
@@ -1041,6 +1089,18 @@ static int xfr_process_request(xfrworker_t *w, uint8_t *buf, size_t buflen)
 			                  r_addr, r_port,
 			                  errstr);
 		} else {
+			/* Prepare place for TSIG data */
+			xfr.tsig_data = malloc(KNOT_NS_TSIG_DATA_MAX_SIZE);
+			if (xfr.tsig_data) {
+				dbg_xfr("xfr: TSIG data allocated: %zu.\n",
+					KNOT_NS_TSIG_DATA_MAX_SIZE);
+				xfr.tsig_data_size = 0;
+			} else {
+				dbg_xfr("xfr: failed to allocate TSIG data "
+					"buffer (%zu kB)\n",
+					KNOT_NS_TSIG_DATA_MAX_SIZE / 1024);
+			}
+
 			ret = knot_ns_answer_axfr(w->ns, &xfr);
 			dbg_xfr("xfr: ns_answer_axfr() = %d.\n", ret);
 			if (ret != KNOTD_EOK) {
@@ -1051,6 +1111,10 @@ static int xfr_process_request(xfrworker_t *w, uint8_t *buf, size_t buflen)
 				                zname,
 				                r_addr, r_port);
 			}
+
+			/* Free allocated data. */
+			free(xfr.tsig_data);
+			xfr.tsig_data = NULL;
 		}
 		
 		if (xfr.digest) {
@@ -1060,7 +1124,10 @@ static int xfr_process_request(xfrworker_t *w, uint8_t *buf, size_t buflen)
 		}
 		free(xfr.query->wireformat);
 		xfr.query->wireformat = 0;
-		knot_packet_free(&xfr.query); /* Free query. */
+		knot_packet_free(&xfr.query);  /* Free query. */
+		xfr.query = NULL;
+		knot_packet_free(&xfr.response);  /* Free response. */
+		xfr.response = NULL;
 		
 		if (qname != NULL) {
 			free(zname);
@@ -1086,15 +1153,12 @@ static int xfr_process_request(xfrworker_t *w, uint8_t *buf, size_t buflen)
 		}
 
 		/* Check TSIG. */
-		if (!init_failed) {
+		if (!init_failed && xfr.tsig_key != NULL) {
 			ret = xfr_check_tsig(&xfr, &rcode);
 			init_failed = (ret != KNOT_EOK);
 			errstr = knot_strerror(ret);
 		}
 		
-		uint32_t serial_from = 0;
-		uint32_t serial_to = 0;
-		
 		// Check serial differeces
 		if (!init_failed) {
 			dbg_xfr_verb("Loading serials for IXFR.\n");
@@ -1131,51 +1195,87 @@ static int xfr_process_request(xfrworker_t *w, uint8_t *buf, size_t buflen)
 				errstr = knotd_strerror(ret);
 			}
 		}
-		
+
 		/* Evaluate progress and answer if passed. */
 		if (init_failed) {
 			knot_ns_xfr_send_error(w->ns, &xfr, rcode);
 			log_server_notice("IXFR transfer of zone '%s/OUT' "
-			                  "%s:%d failed: %s\n",
-			                  zname,
-			                  r_addr, r_port,
-			                  errstr);
+					  "%s:%d failed: %s\n",
+					  zname,
+					  r_addr, r_port,
+					  errstr);
 			ret = KNOTD_ERROR;
 		} else {
+			/* Prepare place for TSIG data */
+			xfr.tsig_data = malloc(KNOT_NS_TSIG_DATA_MAX_SIZE);
+			if (xfr.tsig_data) {
+				dbg_xfr("xfr: TSIG data allocated: %zu.\n",
+					KNOT_NS_TSIG_DATA_MAX_SIZE);
+				xfr.tsig_data_size = 0;
+			} else {
+				dbg_xfr("xfr: failed to allocate TSIG data "
+					"buffer (%zu kB)\n",
+					KNOT_NS_TSIG_DATA_MAX_SIZE / 1024);
+			}
+
 			ret = knot_ns_answer_ixfr(w->ns, &xfr);
 			dbg_xfr("xfr: ns_answer_ixfr() = %d.\n", ret);
-			if (ret != KNOTD_EOK) {
+			if (ret != KNOT_EOK) {
+				errstr = knot_strerror(ret);
+				log_server_notice("IXFR transfer of zone '%s/OUT' "
+						  "%s:%d failed: %s\n",
+						  zname,
+						  r_addr, r_port,
+						  errstr);
 				socket_close(xfr.session);
 			} else {
-				log_server_info("IXFR transfer of zone '%s/OUT'"
-						" - not enough data in journal,"
-						" fallback to AXFR.\n",
-						zname);
-				xfr.type = XFR_TYPE_AOUT;
-				xfr_request(w->master, &xfr);
-				return KNOTD_EOK;
+				log_server_info("IXFR transfer of zone '%s/OUT' "
+						"to %s:%d successful.\n",
+						zname,
+						r_addr, r_port);
 			}
+
+			/* Free allocated data. */
+			free(xfr.tsig_data);
+			xfr.tsig_data = NULL;
 		}
+
+		/* Cleanup. */
 		if (xfr.digest) {
 			free(xfr.digest);
-			xfr.digest = 0;
+			xfr.digest = NULL;
 			xfr.digest_max_size = 0;
 		}
-		free(xfr.query->wireformat);
-		knot_packet_free(&xfr.query); /* Free query. */
+		free(xfr.query->wireformat);   /* Free wireformat. */
+		xfr.query->wireformat = NULL;
+		knot_packet_free(&xfr.query);  /* Free query. */
+		xfr.query = NULL;
+		knot_packet_free(&xfr.response);  /* Free response. */
+		xfr.response = NULL;
+		
+		if (xfr.data != NULL) {  /* Free changesets. */
+			knot_free_changesets((knot_changesets_t **)
+			                     (&xfr.data));
+		}
 		
-		if (qname) {
+		if (zname) {
 			free(zname);
 		}
 		
 		break;
 	case XFR_TYPE_AIN:
 		req_type = "AXFR/IN";
-	case XFR_TYPE_IIN:
-		if (xfr.type == XFR_TYPE_IIN) {
-			req_type = "IXFR/IN";
-		}
+		ret = xfr_client_start(w, &xfr);
 		
+		/* Report. */
+		if (ret != KNOTD_EOK && ret != KNOTD_EACCES) {
+			log_server_error("%s request from %s:%d failed: %s\n",
+			                 req_type, r_addr, r_port,
+			                 knotd_strerror(ret));
+		}
+		break;
+	case XFR_TYPE_IIN:
+		req_type = "IXFR/IN";
 		ret = xfr_client_start(w, &xfr);
 		
 		/* Report. */
@@ -1228,7 +1328,13 @@ int xfr_worker(dthread_t *thread)
 	}
 
 	/* Buffer for answering. */
-	uint8_t buf[65535];
+	size_t buflen = XFR_BUFFER_SIZE;
+	uint8_t* buf = malloc(buflen);
+	if (buf == NULL) {
+		dbg_xfr("xfr: failed to allocate buffer for XFR worker\n");
+		return KNOTD_ENOMEM;
+	}
+	
 
 	/* Accept requests. */
 	int ret = 0;
@@ -1263,7 +1369,7 @@ int xfr_worker(dthread_t *thread)
 			if (it.fd == rfd) {
 				dbg_xfr_verb("xfr: worker=%p processing request\n",
 				             w);
-				ret = xfr_process_request(w, buf, sizeof(buf));
+				ret = xfr_process_request(w, buf, buflen);
 				if (ret == KNOTD_ENOTRUNNING) {
 					break;
 				}
@@ -1275,7 +1381,7 @@ int xfr_worker(dthread_t *thread)
 				dbg_xfr_verb("xfr: worker=%p processing event on "
 				             "fd=%d data=%p.\n",
 				             w, it.fd, data);
-				ret = xfr_process_event(w, it.fd, data);
+				ret = xfr_process_event(w, it.fd, data, buf, buflen);
 				if (ret != KNOTD_EOK) {
 					xfr_free_task(data);
 				}
@@ -1290,6 +1396,7 @@ int xfr_worker(dthread_t *thread)
 
 
 	/* Stop whole unit. */
+	free(buf);
 	dbg_xfr_verb("xfr: worker=%p finished.\n", w);
 	thread->data = 0;
 	return KNOTD_EOK;
diff --git a/src/knot/server/zones.c b/src/knot/server/zones.c
index 4456dac..bd23c7d 100644
--- a/src/knot/server/zones.c
+++ b/src/knot/server/zones.c
@@ -17,6 +17,7 @@
 #include <sys/stat.h>
 
 #include "common/lists.h"
+#include "common/WELL1024a.h"
 #include "libknot/dname.h"
 #include "libknot/util/wire.h"
 #include "knot/zone/zone-dump-text.h"
@@ -35,6 +36,8 @@
 #include "knot/zone/zone-dump.h"
 #include "libknot/nameserver/name-server.h"
 #include "libknot/updates/changesets.h"
+#include "libknot/tsig-op.h"
+#include "libknot/packet/response.h"
 
 static const size_t XFRIN_CHANGESET_BINARY_SIZE = 100;
 static const size_t XFRIN_CHANGESET_BINARY_STEP = 100;
@@ -367,11 +370,9 @@ static int zones_refresh_ev(event_t *e)
 		xfr_req.zone = zone;
 		
 		/* Select TSIG key. */
-		/*!< \todo [TSIG] DISABLED */
-		xfr_req.tsig_key = 0;
-//		if (zd->xfr_in.tsig_key.name) {
-//			xfr_req.tsig_key = &zd->xfr_in.tsig_key;
-//		}
+		if (zd->xfr_in.tsig_key.name) {
+			xfr_req.tsig_key = &zd->xfr_in.tsig_key;
+		}
 
 		/* Unlock zone contents. */
 		rcu_read_unlock();
@@ -382,11 +383,11 @@ static int zones_refresh_ev(event_t *e)
 			dbg_zones("zones: already bootstrapping '%s'\n",
 			          zd->conf->name);
 			return KNOTD_EOK;
-		} else {
-			log_zone_info("Attempting to bootstrap zone %s from master\n",
-			              zd->conf->name);
-			pthread_mutex_unlock(&zd->xfr_in.lock);
 		}
+
+		log_zone_info("Attempting to bootstrap zone %s from master\n",
+			      zd->conf->name);
+		pthread_mutex_unlock(&zd->xfr_in.lock);
 		
 		return xfr_request(zd->server->xfr_h, &xfr_req);
 	}
@@ -427,29 +428,37 @@ static int zones_refresh_ev(event_t *e)
 		int sock = socket_create(master->family, SOCK_DGRAM);
 
 		/* Send query. */
-		ret = -1;
+		ret = KNOTD_ERROR;
 		if (sock > -1) {
-			ret = sendto(sock, qbuf, buflen, 0,
-				     master->ptr, master->len);
+			int sent = sendto(sock, qbuf, buflen, 0,
+			                  master->ptr, master->len);
+		
+			/* Store ID of the awaited response. */
+			if (sent == buflen) {
+				ret = KNOTD_EOK;
+			} else {
+				socket_close(sock);
+				sock = -1;
+			}
 		}
-
-		/* Store ID of the awaited response. */
-		if (ret == buflen) {
+		
+		/* Check result. */
+		if (ret == KNOTD_EOK) {
 			zd->xfr_in.next_id = knot_wire_get_id(qbuf);
 			dbg_zones("zones: expecting SOA response "
 			          "ID=%d for '%s'\n",
 			          zd->xfr_in.next_id, zd->conf->name);
+			
+			/* Watch socket. */
+			knot_ns_xfr_t req;
+			memset(&req, 0, sizeof(req));
+			req.session = sock;
+			req.type = XFR_TYPE_SOA;
+			req.zone = zone;
+			memcpy(&req.addr, master, sizeof(sockaddr_t));
+			sockaddr_update(&req.addr);
+			xfr_request(zd->server->xfr_h, &req);
 		}
-
-		/* Watch socket. */
-		knot_ns_xfr_t req;
-		memset(&req, 0, sizeof(req));
-		req.session = sock;
-		req.type = XFR_TYPE_SOA;
-		req.zone = zone;
-		memcpy(&req.addr, master, sizeof(sockaddr_t));
-		sockaddr_update(&req.addr);
-		xfr_request(zd->server->xfr_h, &req);
 	} else {
 		ret = KNOTD_ERROR;
 	}
@@ -612,7 +621,7 @@ static int zones_zonefile_sync_ev(event_t *e)
 	if (ret == KNOTD_EOK) {
 		log_zone_info("Applied differences of '%s' to zonefile.\n",
 		              zd->conf->name);
-	} else {
+	} else if (ret != KNOTD_ERANGE) {
 		log_zone_warning("Failed to apply differences of '%s' "
 		                 "to zonefile.\n",
 		                 zd->conf->name);
@@ -666,7 +675,7 @@ static int zones_set_acl(acl_t **acl, list* acl_list)
 
 		/* Load rule. */
 		if (ret > 0) {
-			acl_create(*acl, &addr, ACL_ACCEPT);
+			acl_create(*acl, &addr, ACL_ACCEPT, cfg_if);
 		}
 	}
 
@@ -752,12 +761,17 @@ static int zones_load_zone(knot_zonedb_t *zonedb, const char *zone_name,
 		if (zone) {
 			/* save the timestamp from the zone db file */
 			struct stat s;
-			stat(filename, &s);
-			knot_zone_set_version(zone, s.st_mtime);
-
-			if (knot_zonedb_add_zone(zonedb, zone) != 0){
+			if (stat(filename, &s) < 0) {
+				dbg_zones("zones: failed to stat() zone db, "
+					  "something is seriously wrong\n");
 				knot_zone_deep_free(&zone, 0);
 				zone = 0;
+			} else {
+				knot_zone_set_version(zone, s.st_mtime);
+				if (knot_zonedb_add_zone(zonedb, zone) != 0){
+					knot_zone_deep_free(&zone, 0);
+					zone = 0;
+				}
 			}
 		}
 
@@ -1031,10 +1045,10 @@ static int zones_load_changesets(const knot_zone_t *zone,
 	dbg_xfr_detail("xfr: Journal entries read.\n");
 
 	/* Unpack binary data. */
-	ret = zones_changesets_from_binary(dst);
-	if (ret != KNOT_EOK) {
+	int unpack_ret = zones_changesets_from_binary(dst);
+	if (unpack_ret != KNOT_EOK) {
 		dbg_xfr("xfr: failed to unpack changesets "
-		        "from binary, %s\n", knot_strerror(ret));
+		        "from binary, %s\n", knot_strerror(unpack_ret));
 		return KNOTD_ERROR;
 	}
 
@@ -1099,12 +1113,12 @@ static int zones_journal_apply(knot_zone_t *zone)
 			log_server_info("Applying '%zu' changesets from journal "
 			                "to zone '%s'.\n",
 			                chsets->count, zd->conf->name);
-			ret = xfrin_apply_changesets_to_zone(zone, chsets);
-			if (ret != KNOT_EOK) {
+			int apply_ret = xfrin_apply_changesets_to_zone(zone, chsets);
+			if (apply_ret != KNOT_EOK) {
 				log_server_error("Failed to apply changesets to "
 				                 "'%s' - %s\n",
 				                 zd->conf->name,
-				                 knot_strerror(ret));
+				                 knot_strerror(apply_ret));
 				ret = KNOTD_ERROR;
 			}
 		}
@@ -1263,7 +1277,6 @@ static int zones_insert_zones(knot_nameserver_t *ns,
 				log_server_error("Error adding known zone '%s' to"
 				                 " the new database - %s\n",
 				                 z->name, knot_strerror(ret));
-				ret = KNOTD_ERROR;
 			} else {
 				++inserted;
 			}
@@ -1296,12 +1309,12 @@ static int zones_insert_zones(knot_nameserver_t *ns,
 					     cfg_if->family,
 					     cfg_if->address,
 					     cfg_if->port);
-				/*!< \todo [TSIG] DISABLED */
-//				if (cfg_if->key) {
-//					memcpy(&zd->xfr_in.tsig_key,
-//					       cfg_if->key,
-//					       sizeof(knot_key_t));
-//				}
+
+				if (cfg_if->key) {
+					memcpy(&zd->xfr_in.tsig_key,
+					       cfg_if->key,
+					       sizeof(knot_key_t));
+				}
 
 				dbg_zones("zones: using %s:%d as XFR master "
 				          "for '%s'\n",
@@ -1374,6 +1387,180 @@ dbg_zones_exec(
 }
 
 /*----------------------------------------------------------------------------*/
+
+static int zones_verify_tsig_query(const knot_packet_t *query,
+                                   const knot_rrset_t *tsig_rr,
+                                   const knot_key_t *key,
+                                   knot_rcode_t *rcode, uint16_t *tsig_rcode,
+                                   uint64_t *tsig_prev_time_signed)
+{
+	assert(tsig_rr != NULL);
+	assert(key != NULL);
+	assert(rcode != NULL);
+	assert(tsig_rcode != NULL);
+
+	/*
+	 * 1) Check if we support the requested algorithm.
+	 */
+	tsig_algorithm_t alg = tsig_rdata_alg(tsig_rr);
+	if (tsig_alg_digest_length(alg) == 0) {
+		log_answer_info("Unsupported digest algorithm "
+		                "requested, treating as bad key\n");
+		/*! \todo [TSIG] It is unclear from RFC if I
+		 *               should treat is as a bad key
+		 *               or some other error.
+		 */
+		*rcode = KNOT_RCODE_NOTAUTH;
+		*tsig_rcode = KNOT_TSIG_RCODE_BADKEY;
+		return KNOT_TSIG_EBADKEY;
+	}
+
+	const knot_dname_t *kname = knot_rrset_owner(tsig_rr);
+	assert(kname != NULL);
+
+	/*
+	 * 2) Find the particular key used by the TSIG.
+	 */
+	if (key && kname && knot_dname_compare(key->name, kname) == 0) {
+		dbg_zones_verb("Found claimed TSIG key for comparison\n");
+	} else {
+		*rcode = KNOT_RCODE_NOTAUTH;
+		*tsig_rcode = KNOT_TSIG_RCODE_BADKEY;
+		return KNOT_TSIG_EBADKEY;
+	}
+
+	/*
+	 * 3) Validate the query with TSIG.
+	 */
+	/* Prepare variables for TSIG */
+	/*! \todo These need to be saved to the response somehow. */
+	//size_t tsig_size = tsig_wire_maxsize(key);
+	size_t digest_max_size = tsig_alg_digest_length(key->algorithm);
+	//size_t digest_size = 0;
+	//uint64_t tsig_prev_time_signed = 0;
+	//uint8_t *digest = (uint8_t *)malloc(digest_max_size);
+	//memset(digest, 0 , digest_max_size);
+
+	/* Copy MAC from query. */
+	dbg_zones_verb("Validating TSIG from query\n");
+
+	//const uint8_t* mac = tsig_rdata_mac(tsig_rr);
+	size_t mac_len = tsig_rdata_mac_length(tsig_rr);
+
+	int ret = KNOT_EOK;
+
+	if (mac_len > digest_max_size) {
+		*rcode = KNOT_RCODE_FORMERR;
+		dbg_zones("MAC length %zu exceeds digest "
+		       "maximum size %zu\n", mac_len, digest_max_size);
+		return KNOT_EMALF;
+	} else {
+		//memcpy(digest, mac, mac_len);
+		//digest_size = mac_len;
+
+		/* Check query TSIG. */
+		ret = knot_tsig_server_check(tsig_rr,
+		                             knot_packet_wireformat(query),
+		                             knot_packet_size(query), key);
+		dbg_zones_verb("knot_tsig_server_check() returned %s\n",
+		               knot_strerror(ret));
+
+		/* Evaluate TSIG check results. */
+		switch(ret) {
+		case KNOT_EOK:
+			*rcode = KNOT_RCODE_NOERROR;
+			break;
+		case KNOT_TSIG_EBADKEY:
+			*tsig_rcode = KNOT_TSIG_RCODE_BADKEY;
+			*rcode = KNOT_RCODE_NOTAUTH;
+			break;
+		case KNOT_TSIG_EBADSIG:
+			*tsig_rcode = KNOT_TSIG_RCODE_BADSIG;
+			*rcode = KNOT_RCODE_NOTAUTH;
+			break;
+		case KNOT_TSIG_EBADTIME:
+			*tsig_rcode = KNOT_TSIG_RCODE_BADTIME;
+			// store the time signed from the query
+			*tsig_prev_time_signed = tsig_rdata_time_signed(tsig_rr);
+			*rcode = KNOT_RCODE_NOTAUTH;
+			break;
+		case KNOT_EMALF:
+			*rcode = KNOT_RCODE_FORMERR;
+			break;
+		default:
+			*rcode = KNOT_RCODE_SERVFAIL;
+		}
+	}
+
+	return ret;
+}
+
+/*----------------------------------------------------------------------------*/
+
+static int zones_check_tsig_query(const knot_zone_t *zone,
+                                  knot_packet_t *query,
+                                  const sockaddr_t *addr,
+                                  knot_rcode_t *rcode,
+                                  uint16_t *tsig_rcode,
+                                  knot_key_t **tsig_key_zone,
+                                  uint64_t *tsig_prev_time_signed)
+{
+	assert(zone != NULL);
+	assert(query != NULL);
+	assert(rcode != NULL);
+	assert(tsig_key_zone != NULL);
+
+	knot_rrset_t *tsig = NULL;
+
+	if (knot_packet_additional_rrset_count(query) > 0) {
+		/*! \todo warning */
+		tsig = knot_packet_additional_rrset(query,
+		                 knot_packet_additional_rrset_count(query) - 1);
+		if (knot_rrset_type(tsig) == KNOT_RRTYPE_TSIG) {
+			dbg_zones_verb("found TSIG in normal query\n");
+        } else {
+            tsig = NULL; /* Invalidate if not TSIG RRTYPE. */
+        }
+	}
+
+	if (tsig == NULL) {
+		// no TSIG, this is completely valid
+		*tsig_rcode = 0;
+		return KNOT_EOK;
+	}
+
+	// if there is some TSIG in the query, find the TSIG associated with
+	// the zone
+	//knot_key_t *tsig_key_zone = NULL;
+
+	dbg_zones_verb("Checking zone and ACL.\n");
+	int ret = zones_query_check_zone(zone, addr, tsig_key_zone, rcode);
+
+	/*! \todo What if there is TSIG, but no key is configured? */
+
+	if (ret == KNOTD_EOK) {
+		if (*tsig_key_zone != NULL) {
+			// everything OK, so check TSIG
+			dbg_zones_verb("Verifying TSIG.\n");
+			ret = zones_verify_tsig_query(query, tsig, *tsig_key_zone,
+			                              rcode, tsig_rcode,
+			                              tsig_prev_time_signed);
+		} else {
+			dbg_zones_verb("No key configured for zone.\n");
+			// no key configured for zone, return BADKEY
+			*tsig_rcode = KNOT_TSIG_RCODE_BADKEY;
+			*rcode = KNOT_RCODE_NOTAUTH;
+			ret = KNOT_TSIG_EBADKEY;
+		}
+	}
+
+	// save TSIG RR to query structure
+	knot_packet_set_tsig(query, tsig);
+
+	return ret;
+}
+
+/*----------------------------------------------------------------------------*/
 /* API functions                                                              */
 /*----------------------------------------------------------------------------*/
 
@@ -1414,8 +1601,8 @@ int zones_update_db_from_config(const conf_t *conf, knot_nameserver_t *ns,
 		log_server_warning("Not all the zones were loaded.\n");
 	}
 
-	dbg_zones_detail("zones: old db in nameserver: %p, old db stored: %p, new db: %p\n",
-	                 ns->zone_db, *db_old, db_new);
+	dbg_zones_detail("zones: old db in nameserver: %p, old db stored: %p, "
+	                 "new db: %p\n", ns->zone_db, *db_old, db_new);
 
 	/* Switch the databases. */
 	(void)rcu_xchg_pointer(&ns->zone_db, db_new);
@@ -1452,6 +1639,7 @@ int zones_zonefile_sync(knot_zone_t *zone)
 	}
 
 	/* Fetch zone data. */
+	int ret = KNOTD_EOK;
 	zonedata_t *zd = (zonedata_t *)zone->data;
 
 	/* Lock zone data. */
@@ -1471,6 +1659,7 @@ int zones_zonefile_sync(knot_zone_t *zone)
 	soa_rr = knot_rrset_rdata(soa_rrs);
 	int64_t serial_ret = knot_rdata_soa_serial(soa_rr);
 	if (serial_ret < 0) {
+		pthread_mutex_unlock(&zd->lock);
 		return KNOTD_EINVAL;
 	}
 	uint32_t serial_to = (uint32_t)serial_ret;
@@ -1499,11 +1688,52 @@ int zones_zonefile_sync(knot_zone_t *zone)
 	} else {
 		dbg_zones_verb("zones: '%s' zonefile is in sync "
 		               "with differences\n", zd->conf->name);
+		ret = KNOTD_ERANGE;
 	}
 
 	/* Unlock zone data. */
 	pthread_mutex_unlock(&zd->lock);
 
+	return ret;
+}
+
+/*----------------------------------------------------------------------------*/
+
+int zones_query_check_zone(const knot_zone_t *zone, const sockaddr_t *addr,
+                           knot_key_t **tsig_key, knot_rcode_t *rcode)
+{
+	if (addr == NULL || tsig_key == NULL || rcode == NULL) {
+		dbg_zones_verb("Wrong arguments.\n");
+		*rcode = KNOT_RCODE_SERVFAIL;
+		return KNOTD_EINVAL;
+	}
+
+	/* Check zone data. */
+	const zonedata_t *zd = (const zonedata_t *)knot_zone_data(zone);
+	if (zd == NULL) {
+		dbg_zones("zones: invalid zone data for zone %p\n", zone);
+		*rcode = KNOT_RCODE_SERVFAIL;
+		return KNOTD_ERROR;
+	}
+
+	/* Check xfr-out ACL */
+	acl_key_t *match = NULL;
+	if (acl_match(zd->xfr_out, addr, &match) == ACL_DENY) {
+		log_answer_warning("Unauthorized query or request for XFR "
+		                   "'%s/OUT'.\n", zd->conf->name);
+		*rcode = KNOT_RCODE_REFUSED;
+		return KNOTD_EACCES;
+	} else {
+		dbg_zones("zones: authorized query or request for XFR "
+		          "'%s/OUT'. match=%p\n", zd->conf->name, match);
+		if (match) {
+			/* Save configured TSIG key for comparison. */
+			conf_iface_t *iface = (conf_iface_t*)(match->val);
+			dbg_zones_detail("iface=%p, iface->key=%p\n",
+					 iface, iface->key);
+			*tsig_key = iface->key;
+		}
+	}
 	return KNOTD_EOK;
 }
 
@@ -1512,7 +1742,6 @@ int zones_zonefile_sync(knot_zone_t *zone)
 int zones_xfr_check_zone(knot_ns_xfr_t *xfr, knot_rcode_t *rcode)
 {
 	if (xfr == NULL || rcode == NULL) {
-		*rcode = KNOT_RCODE_SERVFAIL;
 		return KNOTD_EINVAL;
 	}
 
@@ -1521,33 +1750,239 @@ int zones_xfr_check_zone(knot_ns_xfr_t *xfr, knot_rcode_t *rcode)
 		*rcode = KNOT_RCODE_REFUSED;
 		return KNOTD_EACCES;
 	}
-	
-	/* Check zone data. */
-	zonedata_t *zd = (zonedata_t *)xfr->zone->data;
-	if (zd == NULL) {
-		dbg_zones("zones: invalid zone data for zone %p\n", xfr->zone);
-		*rcode = KNOT_RCODE_SERVFAIL;
-		return KNOTD_ERROR;
-	}
-	
+
 	/* Check zone contents. */
 	if (knot_zone_contents(xfr->zone) == NULL) {
-		dbg_zones("zones: invalid zone contents for zone %p\n", xfr->zone);
+		dbg_zones("zones: invalid zone contents for zone %p\n",
+		          xfr->zone);
 		*rcode = KNOT_RCODE_SERVFAIL;
 		return KNOTD_EEXPIRED;
 	}
 
-	// Check xfr-out ACL
-	if (acl_match(zd->xfr_out, &xfr->addr) == ACL_DENY) {
-		log_answer_warning("Unauthorized request for XFR '%s/OUT'.\n",
-		                   zd->conf->name);
-		*rcode = KNOT_RCODE_REFUSED;
-		return KNOTD_EACCES;
+	return zones_query_check_zone(xfr->zone, &xfr->addr, &xfr->tsig_key,
+	                              rcode);
+}
+
+/*----------------------------------------------------------------------------*/
+
+int zones_normal_query_answer(knot_nameserver_t *nameserver,
+                              knot_packet_t *query, const sockaddr_t *addr,
+                              uint8_t *resp_wire, size_t *rsize)
+{
+	rcu_read_lock();
+
+	knot_packet_t *resp = NULL;
+	const knot_zone_t *zone = NULL;
+
+	dbg_zones_verb("Preparing response structure.\n");
+	int ret = knot_ns_prep_normal_response(nameserver, query, &resp, &zone);
+
+	// check for TSIG in the query
+	if (knot_packet_additional_rrset_count(query) > 0) {
+		/*! \todo warning */
+		const knot_rrset_t *tsig = knot_packet_additional_rrset(query,
+		                 knot_packet_additional_rrset_count(query) - 1);
+		if (knot_rrset_type(tsig) == KNOT_RRTYPE_TSIG) {
+			dbg_zones_verb("found TSIG in normal query\n");
+			knot_packet_set_tsig(query, tsig);
+		}
+	}
+
+	knot_rcode_t rcode = 0;
+
+	switch (ret) {
+	case KNOT_EOK:
+		rcode = KNOT_RCODE_NOERROR;
+		break;
+	case KNOT_EMALF:
+		// no TSIG signing in this case
+		rcode = KNOT_RCODE_FORMERR;
+		break;
+	default:
+		// no TSIG signing in this case
+		rcode = KNOT_RCODE_SERVFAIL;
+		break;
+	}
+
+	if (zone == NULL && knot_packet_tsig(query) == NULL) {
+		/*! \todo If there is TSIG, this should be probably handled
+		 *        as a key error.
+		 */
+		rcode = KNOT_RCODE_REFUSED;
+	}
+
+	assert(resp != NULL);
+
+	if (rcode != KNOT_RCODE_NOERROR) {
+		dbg_zones_verb("Failed preparing response structure: %s.\n",
+		               knot_strerror(rcode));
+		knot_ns_error_response(nameserver, knot_packet_id(query),
+		                       rcode, resp_wire, rsize);
 	} else {
-		dbg_zones("zones: authorized XFR '%s/OUT'\n",
-		          zd->conf->name);
+		/*
+		 * Now we have zone. Verify TSIG if it is in the packet.
+		 */
+		assert(rcode == KNOT_RCODE_NOERROR);
+		uint16_t tsig_rcode = 0;
+		knot_key_t *tsig_key_zone = NULL;
+        uint64_t tsig_prev_time_signed = 0; /*! \todo Verify, as it was uninitialized! */
+
+		size_t answer_size = *rsize;
+		int ret = KNOT_EOK;
+
+		if (zone == NULL) {
+			assert(knot_packet_tsig(query) != NULL);
+			// treat as BADKEY error
+			rcode = KNOT_RCODE_NOTAUTH;
+			tsig_rcode = KNOT_TSIG_RCODE_BADKEY;
+			ret = KNOT_TSIG_EBADKEY;
+		} else {
+			dbg_zones_verb("Checking TSIG in query.\n");
+			ret = zones_check_tsig_query(zone, query, addr,
+			                             &rcode, &tsig_rcode,
+			                             &tsig_key_zone,
+			                             &tsig_prev_time_signed);
+		}
+
+		if (ret == KNOT_EOK) {
+			dbg_zones_verb("TSIG check successful. Answering "
+			               "query.\n");
+			assert(tsig_rcode == 0);
+
+			// reserve place for the TSIG
+			if (tsig_key_zone != NULL) {
+				size_t tsig_max_size =
+				         tsig_wire_maxsize(tsig_key_zone);
+				knot_packet_set_tsig_size(resp, tsig_max_size);
+			}
+			ret = knot_ns_answer_normal(nameserver, zone, resp,
+			                            resp_wire, &answer_size);
+
+			dbg_zones_detail("rsize = %zu\n", *rsize);
+			dbg_zones_detail("answer_size = %zu\n", answer_size);
+
+			assert(ret == KNOT_EOK);
+
+			// sign the message
+			if (tsig_key_zone != NULL) {
+				dbg_zones_verb("Signing message with TSIG.\n");
+				// TODO check
+				//*rsize = answer_size;
+
+				const knot_rrset_t *tsig =
+				      knot_packet_tsig(knot_packet_query(resp));
+
+				size_t digest_max_size =
+				                tsig_alg_digest_length(
+				                      tsig_key_zone->algorithm);
+				uint8_t *digest = (uint8_t *)malloc(
+				                        digest_max_size);
+				if (digest == NULL) {
+					knot_packet_free(&resp);
+					rcu_read_unlock();
+					return KNOT_ENOMEM;
+				}
+				size_t digest_size = digest_max_size;
+
+				ret = knot_tsig_sign(resp_wire, &answer_size,
+				               *rsize, tsig_rdata_mac(tsig),
+				               tsig_rdata_mac_length(tsig),
+				               digest, &digest_size,
+				               tsig_key_zone, tsig_rcode,
+				               tsig_prev_time_signed);
+				
+				free(digest);
+
+				dbg_zones_detail("answer_size = %zu\n",
+				                 answer_size);
+
+				if (ret != KNOT_EOK) {
+					dbg_zones_verb("Failed to sign message:"
+					            "%s\n", knot_strerror(ret));
+					rcode = KNOT_RCODE_SERVFAIL;
+				} else {
+					*rsize = answer_size;
+				}
+			} else {
+				*rsize = answer_size;
+			}
+		} else {
+			dbg_zones_verb("Failed TSIG check: %s, TSIG err: %u.\n",
+			               knot_strerror(ret), tsig_rcode);
+
+			if (tsig_rcode != 0) {
+				dbg_zones_verb("Sending TSIG error.\n");
+				// first, convert the response to wire format
+				answer_size = *rsize;
+				knot_response_set_rcode(resp, rcode);
+
+				ret = ns_response_to_wire(resp, resp_wire,
+				                          &answer_size);
+
+				dbg_zones_detail("Packet to wire returned %d\n",
+				                 ret);
+
+				// then add the TSIG to the wire format
+				if (ret == KNOT_EOK &&
+				    tsig_rcode != KNOT_TSIG_RCODE_BADTIME) {
+					dbg_zones_verb("Adding TSIG.\n");
+					ret = knot_tsig_add(resp_wire,
+					                    &answer_size,
+					                    *rsize, tsig_rcode,
+					                     knot_packet_tsig(
+					                            query));
+
+					*rsize = answer_size;
+
+				} else if (tsig_rcode
+				           == KNOT_TSIG_RCODE_BADTIME) {
+					dbg_zones_verb("Signing error resp.\n");
+					//*rsize = answer_size;
+
+					const knot_rrset_t *tsig =
+					      knot_packet_tsig(
+					          knot_packet_query(resp));
+
+					size_t digest_max_size =
+					           tsig_alg_digest_length(
+					              tsig_key_zone->algorithm);
+					uint8_t *digest = (uint8_t *)malloc(
+					                       digest_max_size);
+					if (digest == NULL) {
+						knot_packet_free(&resp);
+						rcu_read_unlock();
+						return KNOT_ENOMEM;
+					}
+					size_t digest_size = digest_max_size;
+
+					ret = knot_tsig_sign(resp_wire,
+					    &answer_size, *rsize,
+					    tsig_rdata_mac(tsig),
+					    tsig_rdata_mac_length(tsig),
+					    digest, &digest_size, tsig_key_zone,
+					    tsig_rcode, tsig_prev_time_signed);
+
+					*rsize = answer_size;
+				} else {
+					dbg_zones_verb("Failed.\n");
+					rcode = KNOT_RCODE_SERVFAIL;
+				}
+			}
+			// in other case the RCODE is set and ret != KNOT_EOK
+			// and a normal error is returned below
+		}
+
+		if (ret != KNOT_EOK) {
+			knot_ns_error_response_full(nameserver, resp,
+			                            rcode, resp_wire,
+			                            rsize);
+		}
 	}
-	return KNOTD_EOK;
+
+	knot_packet_free(&resp);
+	rcu_read_unlock();
+
+	return KNOT_EOK;
 }
 
 /*----------------------------------------------------------------------------*/
@@ -1647,12 +2082,9 @@ int zones_process_response(knot_nameserver_t *nameserver,
 		xfr_req.type = zones_transfer_to_use(contents);
 		
 		/* Select TSIG key. */
-		/*!< \todo [TSIG] DISABLED */
-		xfr_req.tsig_key = 0;
-		/* CLEANUP */
-//		if (zd->xfr_in.tsig_key.name) {
-//			xfr_req.tsig_key = &zd->xfr_in.tsig_key;
-//		}
+		if (zd->xfr_in.tsig_key.name) {
+			xfr_req.tsig_key = &zd->xfr_in.tsig_key;
+		}
 
 		/* Unlock zone contents. */
 		rcu_read_unlock();
@@ -1767,39 +2199,34 @@ static int zones_dump_xfr_zone_text(knot_zone_contents_t *zone,
 	char *new_zonefile = zones_find_free_filename(zonefile);
 
 	if (new_zonefile == NULL) {
-		dbg_zones("zones: failed to find free filename for temporary "
-		          "storage of the zone text file.\n");
+		log_zone_warning("Failed to find filename for temporary "
+		                 "storage of the transferred zone.\n");
 		return KNOTD_ERROR;	/*! \todo New error code? */
 	}
 
 	int rc = zone_dump_text(zone, new_zonefile);
 
 	if (rc != KNOTD_EOK) {
-		dbg_zones("Failed to save the zone to text zone file '%s'.\n",
-		          new_zonefile);
+		log_zone_warning("Failed to save the transferred zone to '%s'.\n",
+		                 new_zonefile);
 		free(new_zonefile);
 		return KNOTD_ERROR;
 	}
 
 	/*! \todo this would also need locking as well. */
-	struct stat s;
-	rc = stat(zonefile, &s);
-	if (rc < 0 || remove(zonefile) == 0) {
-		if (rename(new_zonefile, zonefile) != 0) {
-			dbg_zones("Failed to replace old zonefile '%s'' with new"
-			          " zone file '%s'.\n", zonefile, new_zonefile);
-			/*! \todo with proper locking, this shouldn't happen,
-			 *        revise it later on.
-			 */
-			zone_dump_text(zone, zonefile);
-			return KNOTD_ERROR;
-		}
-	} else {
-		dbg_zones("zones: failed to replace old zonefile '%s'.\n",
-		          zonefile);
+	remove(zonefile); /* Don't care, as the rename will trigger the error. */
+	if (rename(new_zonefile, zonefile) != 0) {
+		log_zone_warning("Failed to replace old zone file '%s'' with a new"
+		                 " zone file '%s'.\n", zonefile, new_zonefile);
+		/*! \todo with proper locking, this shouldn't happen,
+		 *        revise it later on.
+		 */
+		zone_dump_text(zone, zonefile);
+		free(new_zonefile);
 		return KNOTD_ERROR;
 	}
 
+
 	free(new_zonefile);
 	return KNOTD_EOK;
 }
@@ -1944,7 +2371,7 @@ static int zones_changeset_rrset_to_binary(uint8_t **data, size_t *size,
 	uint8_t *binary = NULL;
 	size_t actual_size = 0;
 	int ret = knot_zdump_rrset_serialize(rrset, &binary, &actual_size);
-	if (ret != KNOT_EOK) {
+	if (ret != KNOT_EOK || binary == NULL) {
 		return KNOTD_ERROR;  /*! \todo Other code? */
 	}
 
@@ -2094,7 +2521,7 @@ int zones_store_changesets(knot_ns_xfr_t *xfr)
 				             "of '%s'\n",
 				             zd->conf->name);
 				ret = zones_zonefile_sync(zone);
-				if (ret != KNOTD_EOK) {
+				if (ret != KNOTD_EOK && ret != KNOTD_ERANGE) {
 					continue;
 				}
 
@@ -2166,6 +2593,7 @@ int zones_xfr_load_changesets(knot_ns_xfr_t *xfr, uint32_t serial_from,
 	if (ret != KNOTD_EOK) {
 		dbg_zones_verb("Loading changesets failed: %s\n",
 		               knotd_strerror(ret));
+		knot_free_changesets(&chgsets);
 		return ret;
 	}
 	
@@ -2291,7 +2719,7 @@ int zones_timers_update(knot_zone_t *zone, conf_zone_t *cfzone, evsched_t *sch)
 		ev->timeout = cfzone->notify_timeout;
 
 		/* Schedule request (30 - 60s random delay). */
-		int tmr_s = 30 + (int)(30.0 * (rand() / (RAND_MAX + 1.0)));
+		int tmr_s = 30 + (int)(30.0 * tls_rand());
 		pthread_mutex_lock(&zd->lock);
 		ev->timer = evsched_schedule_cb(sch, zones_notify_send, ev,
 						tmr_s * 1000);
diff --git a/src/knot/server/zones.h b/src/knot/server/zones.h
index 525a78a..9fcab7d 100644
--- a/src/knot/server/zones.h
+++ b/src/knot/server/zones.h
@@ -123,14 +123,31 @@ int zones_update_db_from_config(const conf_t *conf, knot_nameserver_t *ns,
  * \param zone Evaluated zone.
  *
  * \retval KNOTD_EOK if successful.
+ * \retval KNOTD_ERANGE if zonefile is in sync with journal.
  * \retval KNOTD_EINVAL on invalid parameter.
  * \retval KNOTD_ERROR on unspecified error during processing.
  */
 int zones_zonefile_sync(knot_zone_t *zone);
 
+/*!
+ * \todo Document me.
+ */
+int zones_query_check_zone(const knot_zone_t *zone, const sockaddr_t *addr,
+                           knot_key_t **tsig_key, knot_rcode_t *rcode);
+
+/*!
+ * \todo Document me.
+ */
 int zones_xfr_check_zone(knot_ns_xfr_t *xfr, knot_rcode_t *rcode);
 
 /*!
+ * \todo Document me.
+ */
+int zones_normal_query_answer(knot_nameserver_t *nameserver,
+                              knot_packet_t *query, const sockaddr_t *addr,
+                              uint8_t *response_wire, size_t *rsize);
+
+/*!
  * \brief Processes normal response packet.
  *
  * \param nameserver Name server structure to provide the needed data.
diff --git a/src/knot/zone/semantic-check.c b/src/knot/zone/semantic-check.c
new file mode 100644
index 0000000..3ca38a2
--- /dev/null
+++ b/src/knot/zone/semantic-check.c
@@ -0,0 +1,1244 @@
+#include <stdlib.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+
+#include "knot/common.h"
+#include "knot/other/error.h"
+#include "libknot/libknot.h"
+#include "common/base32hex.h"
+#include "common/crc.h"
+
+#include "semantic-check.h"
+
+static const uint MAX_CNAME_CYCLE_DEPTH = 15;
+
+err_handler_t *handler_new(char log_cname, char log_glue,
+				  char log_rrsigs, char log_nsec,
+				  char log_nsec3)
+{
+	err_handler_t *handler = malloc(sizeof(err_handler_t));
+	CHECK_ALLOC_LOG(handler, NULL);
+
+	/* It should be initialized, but to be safe */
+	memset(handler->errors, 0, sizeof(uint) * (-ZC_ERR_ALLOC + 1));
+
+	handler->options.log_cname = log_cname;
+	handler->options.log_glue = log_glue;
+	handler->options.log_rrsigs = log_rrsigs;
+	handler->options.log_nsec = log_nsec;
+	handler->options.log_nsec3 = log_nsec3;
+
+	return handler;
+}
+
+/*!
+ * \brief Prints error message with node information.
+ *
+ * \note If \a node is NULL, only total number of errors is printed.
+ *
+ * \param handler Error handler.
+ * \param node Node with semantic error in it.
+ * \param error Type of error.
+ */
+static void log_error_from_node(err_handler_t *handler,
+				const knot_node_t *node,
+				uint error)
+{
+	if (node != NULL) {
+		char *name =
+			knot_dname_to_str(knot_node_owner(node));
+		fprintf(stderr, "Semantic warning in node: %s: ", name);
+		fprintf(stderr, "%s", error_messages[-error]);
+		free(name);
+	} else {
+		fprintf(stderr, "Total number of warnings is: %d for error: %s",
+			handler->errors[-error],
+			error_messages[-error]);
+	}
+}
+
+int err_handler_handle_error(err_handler_t *handler,
+				    const knot_node_t *node,
+				    uint error)
+{
+	assert(handler && node);
+	if ((error != 0) &&
+	    (error > ZC_ERR_GLUE_GENERAL_ERROR)) {
+		return ZC_ERR_UNKNOWN;
+	}
+
+	if (error == ZC_ERR_ALLOC) {
+		ERR_ALLOC_FAILED;
+		return ZC_ERR_ALLOC;
+	}
+
+	/* missing SOA can only occur once, so there
+	 * needn't to be an option for it */
+
+	if ((error != 0) &&
+	    (error < ZC_ERR_GENERIC_GENERAL_ERROR)) {
+		/* The two errors before SOA were handled */
+		log_error_from_node(handler, node, error);
+
+	} else if ((error < ZC_ERR_RRSIG_GENERAL_ERROR) &&
+		   ((handler->errors[-error] == 0) ||
+		   (handler->options.log_rrsigs))) {
+
+		log_error_from_node(handler, node, error);
+
+	} else if ((error > ZC_ERR_RRSIG_GENERAL_ERROR) &&
+		   (error < ZC_ERR_NSEC_GENERAL_ERROR) &&
+		   ((handler->errors[-error] == 0) ||
+		    (handler->options.log_nsec))) {
+
+		log_error_from_node(handler, node, error);
+
+	} else if ((error > ZC_ERR_NSEC_GENERAL_ERROR) &&
+		   (error < ZC_ERR_NSEC3_GENERAL_ERROR) &&
+		   ((handler->errors[-error] == 0) ||
+		    (handler->options.log_nsec3))) {
+
+		log_error_from_node(handler, node, error);
+
+	} else if ((error > ZC_ERR_NSEC3_GENERAL_ERROR) &&
+		   (error < ZC_ERR_CNAME_GENERAL_ERROR) &&
+		   ((handler->errors[-error] == 0) ||
+		    (handler->options.log_cname))) {
+
+		log_error_from_node(handler, node, error);
+
+	} else if ((error > ZC_ERR_CNAME_GENERAL_ERROR) &&
+		   (error < ZC_ERR_GLUE_GENERAL_ERROR) &&
+		    handler->options.log_glue) {
+
+		log_error_from_node(handler, node, error);
+
+	}
+
+	handler->errors[-error]++;
+
+	return KNOT_EOK;
+}
+
+void err_handler_log_all(err_handler_t *handler)
+{
+	if (handler == NULL) {
+		return;
+	}
+
+	for (int i = ZC_ERR_ALLOC; i < ZC_ERR_GLUE_GENERAL_ERROR; i++) {
+		if (handler->errors[-i] > 0) {
+			log_error_from_node(handler, NULL, i);
+		}
+	}
+}
+
+
+/*!
+ * \brief Semantic check - CNAME cycles. Uses constant value with maximum
+ *        allowed CNAME chain depth.
+ *
+ * \param zone Zone containing the RRSet.
+ * \param rrset RRSet to be tested.
+ *
+ * \retval KNOT_EOK when there is no cycle.
+ * \retval ZC_ERR_CNAME_CYCLE when cycle is present.
+ */
+static int check_cname_cycles_in_zone(knot_zone_contents_t *zone,
+				      const knot_rrset_t *rrset)
+{
+	const knot_rrset_t *next_rrset = rrset;
+	assert(rrset);
+	const knot_rdata_t *tmp_rdata = knot_rrset_rdata(next_rrset);
+	const knot_node_t *next_node = NULL;
+
+	uint i = 0;
+
+	assert(tmp_rdata);
+
+	const knot_dname_t *next_dname =
+		knot_rdata_cname_name(tmp_rdata);
+
+	assert(next_dname);
+
+	while (i < MAX_CNAME_CYCLE_DEPTH && next_dname != NULL) {
+		next_node = knot_zone_contents_get_node(zone, next_dname);
+		if (next_node == NULL) {
+			next_node =
+				knot_zone_contents_get_nsec3_node(zone, next_dname);
+		}
+
+		if (next_node != NULL) {
+			next_rrset = knot_node_rrset(next_node,
+						       KNOT_RRTYPE_CNAME);
+			if (next_rrset != NULL) {
+				next_dname =
+				knot_rdata_cname_name(next_rrset->rdata);
+			} else {
+				next_node = NULL;
+				next_dname = NULL;
+			}
+		} else {
+			next_dname = NULL;
+		}
+		i++;
+	}
+
+	/* even if the length is 0, i will be 1 */
+	if (i >= MAX_CNAME_CYCLE_DEPTH) {
+		return ZC_ERR_CNAME_CYCLE;
+	}
+
+	return KNOT_EOK;
+}
+
+/*!
+ * \brief Return raw data from rdata item structure (without length).
+ *
+ * \param item Item to get rdata from.
+ * \return uint16_t * raw data without length.
+ */
+static inline uint16_t *rdata_item_data(const knot_rdata_item_t *item)
+{
+	return (uint16_t *)(item->raw_data + 1);
+}
+
+/*!
+ * \brief Returns type covered field from RRSIG RRSet's rdata.
+ *
+ * \param rdata RRSIG rdata.
+ * \return uint16_t Type covered.
+ */
+uint16_t type_covered_from_rdata(const knot_rdata_t *rdata)
+{
+	return ntohs(*(uint16_t *) rdata_item_data(&(rdata->items[0])));
+}
+
+/*!
+ * \brief Check whether DNSKEY rdata are valid.
+ *
+ * \param rdata DNSKEY rdata to be checked.
+ *
+ * \retval KNOT_EOK when rdata are OK.
+ * \retval ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER when rdata are not OK.
+ */
+static int check_dnskey_rdata(const knot_rdata_t *rdata)
+{
+	/* check that Zone key bit it set - position 7 in net order */
+	/*! \todo FIXME: endian? I swear I've fixed this already, it was 7 i guesss*/
+	uint16_t mask = 1 << 8; //0b0000000100000000;
+
+	uint16_t flags =
+		knot_wire_read_u16((uint8_t *)rdata_item_data
+				     (knot_rdata_item(rdata, 0)));
+
+	if (flags & mask) {
+		return KNOT_EOK;
+	} else {
+		/* This error does not exactly fit, but it's better
+		 * than a new one */
+		return ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER;
+	}
+}
+
+/*!
+ * \brief Calculates keytag for RSA/SHA algorithm.
+ *
+ * \param key Key wireformat.
+ * \param keysize Wireformat size.
+ *
+ * \return uint16_t Calculated keytag.
+ */
+static uint16_t keytag_1(uint8_t *key, uint16_t keysize)
+{
+	uint16_t ac = 0;
+	if (keysize > 4) {
+		memmove(&ac, key + keysize - 3, 2);
+	}
+
+	ac = ntohs(ac);
+	return ac;
+}
+
+/*!
+ * \brief Calculates keytag from key wire.
+ *
+ * \param key Key wireformat.
+ * \param keysize Wireformat size.
+ *
+ * \return uint16_t Calculated keytag.
+ */
+static uint16_t keytag(uint8_t *key, uint16_t keysize )
+{
+	uint32_t ac = 0; /* assumed to be 32 bits or larger */
+
+	/* algorithm RSA/SHA */
+	if (key[3] == 1) {
+		return keytag_1(key, keysize);
+	} else {
+		for(int i = 0; i < keysize; i++) {
+			ac += (i & 1) ? key[i] : key[i] << 8;
+		}
+
+		ac += (ac >> 16) & 0xFFFF;
+		return (uint16_t)ac & 0xFFFF;
+	}
+}
+
+/*!
+ * \brief Returns size of raw data item.
+ *
+ * \param item Raw data item.
+ *
+ * \return uint16_t Size of raw data item.
+ */
+static inline uint16_t rdata_item_size(const knot_rdata_item_t *item)
+{
+	return item->raw_data[0];
+}
+
+/*!
+ * \brief Converts DNSKEY rdata to wireformat.
+ *
+ * \param rdata DNSKEY rdata to be converted.
+ * \param wire Created wire.
+ * \param size Size of created wire.
+ *
+ * \retval KNOT_EOK on success.
+ * \retval KNOT_ENOMEM on memory error.
+ */
+static int dnskey_to_wire(const knot_rdata_t *rdata, uint8_t **wire,
+			  uint *size)
+{
+	assert(*wire == NULL);
+	/* flags + algorithm + protocol + keysize */
+	*size = 2 + 1 + 1 + knot_rdata_item(rdata, 3)->raw_data[0];
+	*wire = malloc(sizeof(uint8_t) * *size);
+	CHECK_ALLOC_LOG(*wire, KNOT_ENOMEM);
+
+	/* copy the wire octet by octet */
+
+	/* TODO check if we really have that many items */
+	if (rdata->count < 4) {
+		return KNOT_ERROR;
+	}
+
+	(*wire)[0] = ((uint8_t *)(knot_rdata_item(rdata, 0)->raw_data))[2];
+	(*wire)[1] = ((uint8_t *)(knot_rdata_item(rdata, 0)->raw_data))[3];
+
+	(*wire)[2] = ((uint8_t *)(knot_rdata_item(rdata, 1)->raw_data))[2];
+	(*wire)[3] = ((uint8_t *)(knot_rdata_item(rdata, 2)->raw_data))[2];
+
+	memcpy(*wire + 4, knot_rdata_item(rdata, 3)->raw_data + 1,
+	       knot_rdata_item(rdata, 3)->raw_data[0]);
+
+	return KNOT_EOK;
+}
+
+/*!
+ * \brief Semantic check - RRSIG rdata.
+ *
+ * \param rdata_rrsig RRSIG rdata to be checked.
+ * \param rrset RRSet containing the rdata.
+ * \param dnskey_rrset RRSet containing zone's DNSKEY
+ *
+ * \retval KNOT_EOK if rdata are OK.
+ *
+ * \return Appropriate error code if error was found.
+ */
+static int check_rrsig_rdata(const knot_rdata_t *rdata_rrsig,
+			     const knot_rrset_t *rrset,
+			     const knot_rrset_t *dnskey_rrset)
+{
+	if (rdata_rrsig == NULL) {
+		return ZC_ERR_RRSIG_NO_RRSIG;
+	}
+
+	if (type_covered_from_rdata(rdata_rrsig) !=
+	    knot_rrset_type(rrset)) {
+		/* zoneparser would not let this happen
+		 * but to be on the safe side
+		 */
+		return ZC_ERR_RRSIG_RDATA_TYPE_COVERED;
+	}
+
+	/* label number at the 2nd index should be same as owner's */
+	uint16_t *raw_data =
+		rdata_item_data(knot_rdata_item(rdata_rrsig, 2));
+
+	uint8_t labels_rdata = ((uint8_t *)raw_data)[0];
+
+	int tmp = knot_dname_label_count(knot_rrset_owner(rrset)) -
+		  labels_rdata;
+
+	if (tmp != 0) {
+		/* if name has wildcard, label must not be included */
+		if (!knot_dname_is_wildcard(knot_rrset_owner(rrset))) {
+			return ZC_ERR_RRSIG_RDATA_LABELS;
+		} else {
+			if (abs(tmp) != 1) {
+				return ZC_ERR_RRSIG_RDATA_LABELS;
+			}
+		}
+	}
+
+	/* check original TTL */
+	uint32_t original_ttl =
+		knot_wire_read_u32((uint8_t *)rdata_item_data(
+				     knot_rdata_item(rdata_rrsig, 3)));
+
+	if (original_ttl != knot_rrset_ttl(rrset)) {
+		return ZC_ERR_RRSIG_RDATA_TTL;
+	}
+
+	/* signer's name is same as in the zone apex */
+	knot_dname_t *signer_name =
+		knot_rdata_item(rdata_rrsig, 7)->dname;
+
+	/* dnskey is in the apex node */
+	if (knot_dname_compare(signer_name,
+				 knot_rrset_owner(dnskey_rrset)) != 0) {
+		return ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER;
+	}
+
+	/* Compare algorithm, key tag and signer's name with DNSKEY rrset
+	 * one of the records has to match. Signer name has been checked
+	 * before */
+	char match = 0;
+	const knot_rdata_t *tmp_dnskey_rdata =
+		knot_rrset_rdata(dnskey_rrset);
+	do {
+		uint8_t alg =
+		((uint8_t *)(knot_rdata_item(rdata_rrsig, 1)->raw_data))[2];
+		uint8_t alg_dnskey =
+		((uint8_t *)(knot_rdata_item(tmp_dnskey_rdata,
+					       2)->raw_data))[2];
+
+		raw_data = rdata_item_data(knot_rdata_item(rdata_rrsig, 6));
+		uint16_t key_tag_rrsig =
+			knot_wire_read_u16((uint8_t *)raw_data);
+
+/*		raw_data =
+			rdata_item_data(knot_rdata_item(
+					tmp_dnskey_rdata, 3));
+
+		uint16_t raw_length = rdata_item_size(knot_rdata_item(
+						     tmp_dnskey_rdata, 3)); */
+
+		uint8_t *dnskey_wire = NULL;
+		uint dnskey_wire_size = 0;
+
+		int ret = 0;
+		if ((ret = dnskey_to_wire(tmp_dnskey_rdata, &dnskey_wire,
+				   &dnskey_wire_size)) != KNOT_EOK) {
+			return ret;
+		}
+
+		uint16_t key_tag_dnskey =
+			keytag(dnskey_wire, dnskey_wire_size);
+
+		free(dnskey_wire);
+
+		match = (alg == alg_dnskey) &&
+			(key_tag_rrsig == key_tag_dnskey) &&
+			!check_dnskey_rdata(tmp_dnskey_rdata);
+
+	} while (!match &&
+		 ((tmp_dnskey_rdata =
+			knot_rrset_rdata_next(dnskey_rrset,
+						tmp_dnskey_rdata))
+		!= NULL));
+
+	if (!match) {
+		return ZC_ERR_RRSIG_RDATA_SIGNED_WRONG;
+	}
+
+	return KNOT_EOK;
+}
+
+/*!
+ * \brief Semantic check - RRSet's RRSIG.
+ *
+ * \param rrset RRSet containing RRSIG.
+ * \param dnskey_rrset
+ * \param nsec3 NSEC3 active.
+ *
+ * \retval KNOT_EOK on success.
+ *
+ * \return Appropriate error code if error was found.
+ */
+static int check_rrsig_in_rrset(const knot_rrset_t *rrset,
+				const knot_rrset_t *dnskey_rrset,
+				char nsec3)
+{
+	assert(dnskey_rrset && rrset);
+
+	const knot_rrset_t *rrsigs = knot_rrset_rrsigs(rrset);
+
+	if (rrsigs == NULL) {
+		return ZC_ERR_RRSIG_NO_RRSIG;
+	}
+
+	/* signed rrsig - nonsense */
+	if (knot_rrset_rrsigs(rrsigs) != NULL) {
+		return ZC_ERR_RRSIG_SIGNED;
+	}
+
+	/* Different owner, class, ttl */
+
+	if (knot_dname_compare(knot_rrset_owner(rrset),
+				 knot_rrset_owner(rrsigs)) != 0) {
+		return ZC_ERR_RRSIG_OWNER;
+	}
+
+	if (knot_rrset_class(rrset) != knot_rrset_class(rrsigs)) {
+		return ZC_ERR_RRSIG_CLASS;
+	}
+
+	if (knot_rrset_ttl(rrset) != knot_rrset_ttl(rrset)) {
+		return ZC_ERR_RRSIG_TTL;
+	}
+
+	/* Check whether all rrsets have their rrsigs */
+	const knot_rdata_t *tmp_rdata = knot_rrset_rdata(rrset);
+	const knot_rdata_t *tmp_rrsig_rdata = knot_rrset_rdata(rrsigs);
+
+	assert(tmp_rdata);
+	assert(tmp_rrsig_rdata);
+	int ret = 0;
+	char all_signed = tmp_rdata && tmp_rrsig_rdata;
+	do {
+		if ((ret = check_rrsig_rdata(tmp_rrsig_rdata,
+					     rrset,
+					     dnskey_rrset)) != 0) {
+			return ret;
+		}
+
+		all_signed = tmp_rdata && tmp_rrsig_rdata;
+	} while (((tmp_rdata = knot_rrset_rdata_next(rrset, tmp_rdata))
+		!= NULL) &&
+		((tmp_rrsig_rdata =
+			knot_rrset_rdata_next(rrsigs, tmp_rrsig_rdata))
+		!= NULL));
+
+	if (!all_signed) {
+		return ZC_ERR_RRSIG_NOT_ALL;
+	}
+
+	return KNOT_EOK;
+}
+
+/*!
+ * \brief Returns bit on index from array in network order. Taken from NSD.
+ *
+ * \param bits Array in network order.
+ * \param index Index to return from array.
+ *
+ * \return int Bit on given index.
+ */
+static int get_bit(uint8_t *bits, size_t index)
+{
+	/*
+	 * The bits are counted from left to right, so bit #0 is the
+	 * leftmost bit.
+	 */
+	return bits[index / 8] & (1 << (7 - index % 8));
+}
+
+/*!
+ * \brief Converts NSEC bitmap to array of integers. (Inspired by NSD code)
+ *
+ * \param item Item containing the bitmap.
+ * \param array Array to be created.
+ * \param count Count of items in array.
+ *
+ * \retval KNOT_OK on success.
+ * \retval KNOT_NOMEM on memory error.
+ */
+static int rdata_nsec_to_type_array(const knot_rdata_item_t *item,
+			      uint16_t **array,
+			      uint *count)
+{
+	assert(*array == NULL);
+
+	uint8_t *data = (uint8_t *)rdata_item_data(item);
+
+	int increment = 0;
+	*count = 0;
+
+	for (int i = 0; i < rdata_item_size(item); i += increment) {
+		increment = 0;
+		uint8_t window = data[i];
+		increment++;
+
+		uint8_t bitmap_size = data[i + increment];
+		increment++;
+
+		uint8_t *bitmap =
+			malloc(sizeof(uint8_t) * (bitmap_size));
+		if (bitmap == NULL) {
+			ERR_ALLOC_FAILED;
+			free(*array);
+			return KNOT_ENOMEM;
+		}
+
+		memcpy(bitmap, data + i + increment,
+		       bitmap_size);
+
+		increment += bitmap_size;
+
+		for (int j = 0; j < bitmap_size * 8; j++) {
+			if (get_bit(bitmap, j)) {
+				(*count)++;
+				void *tmp = realloc(*array,
+						    sizeof(uint16_t) *
+						    *count);
+				if (tmp == NULL) {
+					ERR_ALLOC_FAILED;
+					free(bitmap);
+					free(*array);
+					return KNOT_ENOMEM;
+				}
+				*array = tmp;
+				(*array)[*count - 1] = j + window * 256;
+			}
+		}
+		free(bitmap);
+	}
+
+	return KNOT_EOK;
+}
+
+/* should write error, not return values !!! */
+
+/*!
+ * \brief Semantic check - check node's NSEC node.
+ *
+ * \param zone Current zone.
+ * \param node Node to be checked.
+ * \param handler Error handler
+ *
+ * \retval KNOT_EOK if no error was found.
+ *
+ * \return Appropriate error code if error was found.
+ */
+static int check_nsec3_node_in_zone(knot_zone_contents_t *zone, knot_node_t *node,
+                                    err_handler_t *handler)
+{
+	assert(handler);
+	const knot_node_t *nsec3_node = knot_node_nsec3_node(node, 0);
+
+	if (nsec3_node == NULL) {
+		/* I know it's probably not what RFCs say, but it will have to
+		 * do for now. */
+		if (knot_node_rrset(node, KNOT_RRTYPE_DS) != NULL) {
+			err_handler_handle_error(handler, node,
+					ZC_ERR_NSEC3_UNSECURED_DELEGATION);
+		} else {
+			/* Unsecured delegation, check whether it is part of
+			 * opt-out span */
+			const knot_node_t *nsec3_previous;
+			const knot_node_t *nsec3_node;
+
+			if (knot_zone_contents_find_nsec3_for_name(zone,
+						knot_node_owner(node),
+						&nsec3_node,
+						&nsec3_previous, 0) != 0) {
+				err_handler_handle_error(handler, node,
+						 ZC_ERR_NSEC3_NOT_FOUND);
+			}
+
+			if (nsec3_node == NULL) {
+				/* Probably should not ever happen */
+				return ZC_ERR_NSEC3_NOT_FOUND;
+			}
+
+			assert(nsec3_previous);
+
+			const knot_rrset_t *previous_rrset =
+				knot_node_rrset(nsec3_previous,
+						  KNOT_RRTYPE_NSEC3);
+
+			assert(previous_rrset);
+
+			/* check for Opt-Out flag */
+			uint8_t flags =
+		((uint8_t *)(previous_rrset->rdata->items[1].raw_data))[2];
+
+			uint8_t opt_out_mask = 1;
+
+			if (!(flags & opt_out_mask)) {
+				err_handler_handle_error(handler, node,
+					ZC_ERR_NSEC3_UNSECURED_DELEGATION_OPT);
+			}
+		}
+	}
+
+	const knot_rrset_t *nsec3_rrset =
+		knot_node_rrset(nsec3_node, KNOT_RRTYPE_NSEC3);
+
+	assert(nsec3_rrset);
+
+	const knot_rrset_t *soa_rrset =
+		knot_node_rrset(knot_zone_contents_apex(zone),
+	                        KNOT_RRTYPE_SOA);
+	assert(soa_rrset);
+
+	uint32_t minimum_ttl =
+		knot_wire_read_u32((uint8_t *)
+		rdata_item_data(
+		knot_rdata_item(
+		knot_rrset_rdata(
+		knot_node_rrset(
+		knot_zone_contents_apex(zone), KNOT_RRTYPE_SOA)), 6)));
+	/* Are those getters even worth this?
+	 * Now I have no idea what this code does. */
+
+	if (knot_rrset_ttl(nsec3_rrset) != minimum_ttl) {
+			err_handler_handle_error(handler, node,
+						 ZC_ERR_NSEC3_RDATA_TTL);
+	}
+
+	/* check that next dname is in the zone */
+	uint8_t *next_dname_decoded = NULL;
+	size_t real_size = 0;
+
+	if (((real_size = base32hex_encode_alloc(((char *)
+		rdata_item_data(&(nsec3_rrset->rdata->items[4]))) + 1,
+		rdata_item_size(&nsec3_rrset->rdata->items[4]) - 1,
+		(char **)&next_dname_decoded)) <= 0) ||
+		(next_dname_decoded == NULL)) {
+		fprintf(stderr, "Could not encode base32 string!\n");
+		return KNOT_ERROR;
+	}
+
+	/* This is why we allocate maximum length of decoded string + 1 */
+	memmove(next_dname_decoded + 1, next_dname_decoded, real_size);
+	next_dname_decoded[0] = real_size;
+
+	/* Local allocation, will be discarded. */
+	knot_dname_t *next_dname =
+		knot_dname_new_from_wire(next_dname_decoded,
+					   real_size + 1, NULL);
+	CHECK_ALLOC_LOG(next_dname, KNOT_ENOMEM);
+
+	free(next_dname_decoded);
+
+	if (knot_dname_cat(next_dname,
+		     knot_node_owner(knot_zone_contents_apex(zone))) == NULL) {
+		fprintf(stderr, "Could not concatenate dnames!\n");
+		return KNOT_ERROR;
+
+	}
+
+	if (knot_zone_contents_find_nsec3_node(zone, next_dname) == NULL) {
+		err_handler_handle_error(handler, node,
+					 ZC_ERR_NSEC3_RDATA_CHAIN);
+	}
+
+	/* Directly discard. */
+	knot_dname_free(&next_dname);
+
+	/* This is probably not sufficient, but again, it is covered in
+	 * zone load time */
+
+	uint count;
+	uint16_t *array = NULL;
+	if (rdata_nsec_to_type_array(
+	    knot_rdata_item(
+	    knot_rrset_rdata(nsec3_rrset), 5),
+	    &array, &count) != 0) {
+			err_handler_handle_error(handler, node,
+						 ZC_ERR_ALLOC);
+			return KNOT_ERROR;
+	}
+
+	uint16_t type = 0;
+	for (int j = 0; j < count; j++) {
+		/* test for each type's presence */
+		type = array[j];
+		if (type == KNOT_RRTYPE_RRSIG) {
+		       continue;
+		}
+		if (knot_node_rrset(node,
+				      type) == NULL) {
+			err_handler_handle_error(handler, node,
+						 ZC_ERR_NSEC3_RDATA_BITMAP);
+			break;
+/*			char *name =
+				knot_dname_to_str(
+			log_zone_error("Node %s does "
+					"not contain RRSet of type %s "
+					"but NSEC bitmap says "
+					"it does!\n", name,
+					knot_rrtype_to_string(type));
+			free(name); */
+		}
+	}
+
+	free(array);
+
+	return KNOT_EOK;
+}
+
+/*!
+ * \brief Run semantic checks for node without DNSSEC-related types.
+ *
+ * \param zone Current zone.
+ * \param node Node to be checked.
+ * \param do_checks Level of checks to be done.
+ * \param handler Error handler.
+ *
+ * \retval KNOT_EOK if no error was found.
+ *
+ * \return Appropriate error code if error was found.
+ */
+static int semantic_checks_plain(knot_zone_contents_t *zone,
+				 knot_node_t *node,
+				 char do_checks,
+				 err_handler_t *handler)
+{
+	assert(handler);
+	const knot_rrset_t *cname_rrset =
+			knot_node_rrset(node, KNOT_RRTYPE_CNAME);
+	if (cname_rrset != NULL) {
+		if (check_cname_cycles_in_zone(zone, cname_rrset) !=
+				KNOT_EOK) {
+			err_handler_handle_error(handler, node,
+						 ZC_ERR_CNAME_CYCLE);
+		}
+
+		/* No DNSSEC and yet there is more than one rrset in node */
+		if (do_checks == 1 &&
+		                knot_node_rrset_count(node) != 1) {
+			err_handler_handle_error(handler, node,
+			                         ZC_ERR_CNAME_EXTRA_RECORDS);
+		} else if (knot_node_rrset_count(node) != 1) {
+			/* With DNSSEC node can contain RRSIG or NSEC */
+			if (!(knot_node_rrset(node, KNOT_RRTYPE_RRSIG) ||
+			      knot_node_rrset(node, KNOT_RRTYPE_NSEC)) ||
+			    knot_node_rrset_count(node) > 3) {
+				err_handler_handle_error(handler, node,
+				ZC_ERR_CNAME_EXTRA_RECORDS_DNSSEC);
+			}
+		}
+
+		if (knot_rrset_rdata(cname_rrset)->next !=
+		                knot_rrset_rdata(cname_rrset)) {
+			err_handler_handle_error(handler, node,
+			                         ZC_ERR_CNAME_MULTIPLE);
+		}
+	}
+
+	const knot_rrset_t *dname_rrset =
+		knot_node_rrset(node, KNOT_RRTYPE_DNAME);
+	if (dname_rrset != NULL) {
+		if (check_cname_cycles_in_zone(zone, dname_rrset) !=
+				KNOT_EOK) {
+			err_handler_handle_error(handler, node,
+						 ZC_ERR_DNAME_CYCLE);
+		}
+
+		if (knot_node_rrset(node, KNOT_RRTYPE_CNAME)) {
+			err_handler_handle_error(handler, node,
+			                         ZC_ERR_DNAME_EXTRA_RECORDS);
+		}
+
+		if (knot_rrset_rdata(dname_rrset)->next !=
+		    knot_rrset_rdata(dname_rrset)) {
+			err_handler_handle_error(handler, node,
+			                         ZC_ERR_DNAME_MULTIPLE);
+		}
+	}
+
+	/* check for glue records at zone cuts */
+	if (knot_node_is_deleg_point(node)) {
+		const knot_rrset_t *ns_rrset =
+				knot_node_rrset(node, KNOT_RRTYPE_NS);
+		assert(ns_rrset);
+		//FIXME this should be an error as well ! (i guess)
+
+		const knot_dname_t *ns_dname =
+				knot_rdata_get_item(knot_rrset_rdata
+						      (ns_rrset), 0)->dname;
+
+		assert(ns_dname);
+
+		const knot_node_t *glue_node =
+				knot_zone_contents_find_node(zone, ns_dname);
+
+		if (knot_dname_is_subdomain(ns_dname,
+			      knot_node_owner(knot_zone_contents_apex(zone)))) {
+			if (glue_node == NULL) {
+				err_handler_handle_error(handler, node,
+							 ZC_ERR_GLUE_NODE);
+			} else {
+				if ((knot_node_rrset(glue_node,
+					       KNOT_RRTYPE_A) == NULL) &&
+				    (knot_node_rrset(glue_node,
+					       KNOT_RRTYPE_AAAA) == NULL)) {
+					err_handler_handle_error(handler, node,
+							 ZC_ERR_GLUE_RECORD);
+				}
+			}
+		}
+	}
+	return KNOT_EOK;
+}
+
+/*!
+ * \brief Run semantic checks for node without DNSSEC-related types.
+ *
+ * \param zone Current zone.
+ * \param node Node to be checked.
+ * \param first_node First node in canonical order.
+ * \param last_node Last node in canonical order.
+ * \param handler Error handler.
+ * \param nsec3 NSEC3 used.
+ *
+ * \retval KNOT_EOK if no error was found.
+ *
+ * \return Appropriate error code if error was found.
+ */
+static int semantic_checks_dnssec(knot_zone_contents_t *zone,
+				  knot_node_t *node,
+				  knot_node_t *first_node,
+				  knot_node_t **last_node,
+				  err_handler_t *handler,
+				  char nsec3)
+{
+	assert(handler);
+	assert(node);
+	char auth = !knot_node_is_non_auth(node);
+	char deleg = knot_node_is_deleg_point(node);
+	uint rrset_count = knot_node_rrset_count(node);
+	const knot_rrset_t **rrsets = knot_node_rrsets(node);
+	const knot_rrset_t *dnskey_rrset =
+		knot_node_rrset(knot_zone_contents_apex(zone),
+				  KNOT_RRTYPE_DNSKEY);
+
+	int ret = 0;
+
+	for (int i = 0; i < rrset_count; i++) {
+		const knot_rrset_t *rrset = rrsets[i];
+		if (auth && !deleg &&
+		    (ret = check_rrsig_in_rrset(rrset, dnskey_rrset,
+						nsec3)) != 0) {
+		  /* CLEANUP */
+/*			log_zone_error("RRSIG %d node %s\n", ret,
+				       knot_dname_to_str(node->owner));*/
+
+			err_handler_handle_error(handler, node, ret);
+		}
+
+		if (!nsec3 && auth) {
+			/* check for NSEC record */
+			const knot_rrset_t *nsec_rrset =
+					knot_node_rrset(node,
+							  KNOT_RRTYPE_NSEC);
+
+			if (nsec_rrset == NULL) {
+				err_handler_handle_error(handler, node,
+							 ZC_ERR_NO_NSEC);
+				/* CLEANUP */
+/*				char *name =
+					knot_dname_to_str(node->owner);
+				log_zone_error("Missing NSEC in node: "
+					       "%s\n", name);
+				free(name);
+				return; */
+			} else {
+
+				/* check NSEC/NSEC3 bitmap */
+
+				uint count;
+
+				uint16_t *array = NULL;
+
+				if (rdata_nsec_to_type_array(
+						knot_rdata_item(
+						knot_rrset_rdata(nsec_rrset),
+						1),
+						&array, &count) != 0) {
+					err_handler_handle_error(handler,
+								 NULL,
+								 ZC_ERR_ALLOC);
+					return ZC_ERR_ALLOC; /* ... */
+					/*return; */
+				}
+
+				uint16_t type = 0;
+				for (int j = 0; j < count; j++) {
+					/* test for each type's presence */
+					type = array[j];
+					if (type == KNOT_RRTYPE_RRSIG) {
+						continue;
+					}
+					if (knot_node_rrset(node,
+							      type) == NULL) {
+					err_handler_handle_error(
+						handler,
+						node,
+						ZC_ERR_NSEC_RDATA_BITMAP);
+					/* CLEANUP */
+	/*					char *name =
+						knot_dname_to_str(
+						knot_node_owner(node));
+
+						log_zone_error("Node %s does "
+						"not contain RRSet of type %s "
+						"but NSEC bitmap says "
+					       "it does!\n", name,
+					       knot_rrtype_to_string(type));
+
+					free(name); */
+					}
+				}
+				free(array);
+			}
+
+			/* Test that only one record is in the
+				 * NSEC RRSet */
+
+			if ((nsec_rrset != NULL) &&
+			    knot_rrset_rdata(nsec_rrset)->next !=
+			    knot_rrset_rdata(nsec_rrset)) {
+				err_handler_handle_error(handler,
+						 node,
+						 ZC_ERR_NSEC_RDATA_MULTIPLE);
+				/* CLEANUP */
+/*				char *name =
+					knot_dname_to_str(
+					knot_node_owner(node));
+				log_zone_error("Node %s contains more "
+					       "than one NSEC "
+					       "record!\n", name);
+				knot_rrset_dump(nsec_rrset, 0);
+				free(name); */
+			}
+
+			/*
+			 * Test that NSEC chain is coherent.
+			 * We have already checked that every
+			 * authoritative node contains NSEC record
+			 * so checking should only be matter of testing
+			 * the next link in each node.
+			 */
+
+			if (nsec_rrset != NULL) {
+				knot_dname_t *next_domain =
+					knot_rdata_item(
+					knot_rrset_rdata(nsec_rrset),
+					0)->dname;
+
+				assert(next_domain);
+
+				if (knot_zone_contents_find_node(zone, next_domain) ==
+				    NULL) {
+					err_handler_handle_error(handler,
+						node,
+						ZC_ERR_NSEC_RDATA_CHAIN);
+					/* CLEANUP */
+/*					log_zone_error("NSEC chain is not "
+						       "coherent!\n"); */
+				}
+
+				if (knot_dname_compare(next_domain,
+				    knot_node_owner(knot_zone_contents_apex(zone)))
+					== 0) {
+					/* saving the last node */
+					*last_node = node;
+				}
+
+			}
+		} else if (nsec3 && (auth || deleg)) { /* nsec3 */
+			int ret = check_nsec3_node_in_zone(zone, node,
+			                                   handler);
+			if (ret != KNOT_EOK) {
+				free(rrsets);
+				return ret;
+			}
+		}
+	}
+	free(rrsets);
+
+	return KNOT_EOK;
+}
+
+/*!
+ * \brief Function called by zone traversal function. Used to call
+ *        knot_zone_save_enclosers.
+ *
+ * \param node Node to be searched.
+ * \param data Arguments.
+ */
+static void do_checks_in_tree(knot_node_t *node, void *data)
+{
+	assert(data != NULL);
+	arg_t *args = (arg_t *)data;
+
+	knot_rrset_t **rrsets = knot_node_get_rrsets(node);
+	short count = knot_node_rrset_count(node);
+
+	assert(count == 0 || rrsets != NULL);
+
+	knot_zone_contents_t *zone = (knot_zone_contents_t *)args->arg1;
+
+	assert(zone);
+
+
+/*	for (int i = 0; i < count; ++i) {
+		assert(rrsets[i] != NULL);
+		knot_zone_save_enclosers_rrset(rrsets[i],
+						 zone,
+						 (skip_list_t *)args->arg2);
+	} */
+
+	knot_node_t *first_node = (knot_node_t *)args->arg4;
+	knot_node_t **last_node = (knot_node_t **)args->arg5;
+
+	err_handler_t *handler = (err_handler_t *)args->arg6;
+
+	char do_checks = *((char *)(args->arg3));
+
+	if (do_checks) {
+		semantic_checks_plain(zone, node, do_checks, handler);
+	}
+
+	if (do_checks > 1) {
+		semantic_checks_dnssec(zone, node, first_node, last_node,
+				       handler, do_checks == 3);
+	}
+
+	free(rrsets);
+}
+
+void zone_do_sem_checks(knot_zone_contents_t *zone, char do_checks,
+                        err_handler_t *handler,
+                        knot_node_t **last_node)
+{
+	if (!do_checks) {
+		return;
+	}
+
+	arg_t arguments;
+	arguments.arg1 = zone;
+	arguments.arg3 = &do_checks;
+	arguments.arg4 = NULL;
+	arguments.arg5 = last_node;
+	arguments.arg6 = handler;
+
+	knot_zone_contents_tree_apply_inorder(zone,
+			   do_checks_in_tree,
+			   (void *)&arguments);
+}
+
+void log_cyclic_errors_in_zone(err_handler_t *handler,
+				      knot_zone_contents_t *zone,
+				      knot_node_t *last_node,
+				      const knot_node_t *first_nsec3_node,
+				      const knot_node_t *last_nsec3_node,
+				      char do_checks)
+{
+	if (do_checks == 3) {
+		/* Each NSEC3 node should only contain one RRSET. */
+		assert(last_nsec3_node && first_nsec3_node);
+		const knot_rrset_t *nsec3_rrset =
+			knot_node_rrset(last_nsec3_node,
+		                              KNOT_RRTYPE_NSEC3);
+		if (nsec3_rrset == NULL) {
+			err_handler_handle_error(handler, last_nsec3_node,
+						 ZC_ERR_NSEC3_RDATA_CHAIN);
+			return;
+		}
+
+		/* check that next dname is in the zone */
+		uint8_t *next_dname_decoded = NULL;
+		size_t real_size = 0;
+
+		if (((real_size = base32hex_encode_alloc(((char *)
+			rdata_item_data(&(nsec3_rrset->rdata->items[4]))) + 1,
+			rdata_item_size(&nsec3_rrset->rdata->items[4]) - 1,
+			(char **)&next_dname_decoded)) <= 0) ||
+			(next_dname_decoded == NULL)) {
+			fprintf(stderr, "Could not encode base32 string!\n");
+			err_handler_handle_error(handler, last_nsec3_node,
+						 ZC_ERR_NSEC3_RDATA_CHAIN);
+			return;
+		}
+
+		/* This is why allocate maximum length of decoded string + 1 */
+		memmove(next_dname_decoded + 1, next_dname_decoded, real_size);
+		next_dname_decoded[0] = real_size;
+
+		/* Local allocation, will be discarded. */
+		knot_dname_t *next_dname =
+			knot_dname_new_from_wire(next_dname_decoded,
+						   real_size + 1, NULL);
+		if (next_dname == NULL) {
+			fprintf(stderr, "Could not allocate dname!\n");
+			err_handler_handle_error(handler, last_nsec3_node,
+						 ZC_ERR_ALLOC);
+			return;
+		}
+
+		free(next_dname_decoded);
+
+		/*! \todo Free result and dname! */
+		if (knot_dname_cat(next_dname,
+			     knot_node_owner(knot_zone_contents_apex(zone))) ==
+		                NULL) {
+			fprintf(stderr, "Could not concatenate dnames!\n");
+			err_handler_handle_error(handler, last_nsec3_node,
+						 ZC_ERR_NSEC3_RDATA_CHAIN);
+			return;
+		}
+
+		/* Check it points somewhere first. */
+		if (knot_zone_contents_find_nsec3_node(zone, next_dname) == NULL) {
+			err_handler_handle_error(handler, last_nsec3_node,
+						 ZC_ERR_NSEC3_RDATA_CHAIN);
+		}
+
+		/* Compare with the actual first NSEC3 node. */
+		if (knot_dname_compare(first_nsec3_node->owner,
+		                         next_dname) != 0) {
+			err_handler_handle_error(handler, last_nsec3_node,
+						 ZC_ERR_NSEC3_RDATA_CHAIN);
+		}
+
+		/* Directly discard. */
+		knot_dname_free(&next_dname);
+
+	} else if (do_checks == 2 ) {
+		if (last_node == NULL) {
+			err_handler_handle_error(handler, last_node,
+				ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC);
+				return;
+		} else {
+			const knot_rrset_t *nsec_rrset =
+				knot_node_rrset(last_node,
+						  KNOT_RRTYPE_NSEC);
+
+			if (nsec_rrset == NULL) {
+				err_handler_handle_error(handler, last_node,
+					 ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC);
+				return;
+			}
+
+			const knot_dname_t *next_dname =
+				knot_rdata_item(
+				knot_rrset_rdata(nsec_rrset), 0)->dname;
+			assert(next_dname);
+
+			const knot_dname_t *apex_dname =
+				knot_node_owner(knot_zone_contents_apex(zone));
+			assert(apex_dname);
+
+			if (knot_dname_compare(next_dname, apex_dname) !=0) {
+				err_handler_handle_error(handler, last_node,
+					 ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC);
+			}
+		}
+	}
+}
diff --git a/src/knot/zone/semantic-check.h b/src/knot/zone/semantic-check.h
new file mode 100644
index 0000000..88d828a
--- /dev/null
+++ b/src/knot/zone/semantic-check.h
@@ -0,0 +1,276 @@
+/*  Copyright (C) 2011 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+/*!
+ * \file semantic-check.h
+ *
+ * \author Jan Kadlec <jan.kadlec@nic.cz>
+ *
+ * \brief DNS zone semantic checks.
+ *
+ * \addtogroup dnslib
+ * @{
+ */
+
+#ifndef _KNOT_SEMANTIC_CHECK_H_
+#define _KNOT_SEMANTIC_CHECK_H_
+
+/*!
+ *\brief Internal error constants. General errors are added for convenience,
+ *       so that code does not have to change if new errors are added.
+ */
+enum zonechecks_errors {
+	ZC_ERR_ALLOC = -40,
+	ZC_ERR_UNKNOWN,
+
+	ZC_ERR_MISSING_SOA,
+
+	ZC_ERR_GENERIC_GENERAL_ERROR, /* isn't there a better name? */
+
+	ZC_ERR_RRSIG_RDATA_TYPE_COVERED,
+	ZC_ERR_RRSIG_RDATA_TTL,
+	ZC_ERR_RRSIG_RDATA_LABELS,
+	ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER,
+	ZC_ERR_RRSIG_RDATA_SIGNED_WRONG,
+	ZC_ERR_RRSIG_NO_RRSIG,
+	ZC_ERR_RRSIG_SIGNED,
+	ZC_ERR_RRSIG_OWNER,
+	ZC_ERR_RRSIG_CLASS,
+	ZC_ERR_RRSIG_TTL,
+	ZC_ERR_RRSIG_NOT_ALL,
+
+	ZC_ERR_RRSIG_GENERAL_ERROR,
+
+	ZC_ERR_NO_NSEC,
+	ZC_ERR_NSEC_RDATA_BITMAP,
+	ZC_ERR_NSEC_RDATA_MULTIPLE,
+	ZC_ERR_NSEC_RDATA_CHAIN,
+	ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC,
+
+	ZC_ERR_NSEC_GENERAL_ERROR,
+
+	ZC_ERR_NSEC3_UNSECURED_DELEGATION,
+	ZC_ERR_NSEC3_NOT_FOUND,
+	ZC_ERR_NSEC3_UNSECURED_DELEGATION_OPT,
+	ZC_ERR_NSEC3_RDATA_TTL,
+	ZC_ERR_NSEC3_RDATA_CHAIN,
+	ZC_ERR_NSEC3_RDATA_BITMAP,
+
+	ZC_ERR_NSEC3_GENERAL_ERROR,
+
+	ZC_ERR_CNAME_CYCLE,
+	ZC_ERR_DNAME_CYCLE,
+	ZC_ERR_CNAME_EXTRA_RECORDS,
+	ZC_ERR_DNAME_EXTRA_RECORDS,
+	ZC_ERR_CNAME_EXTRA_RECORDS_DNSSEC,
+	ZC_ERR_CNAME_MULTIPLE,
+	ZC_ERR_DNAME_MULTIPLE,
+
+	ZC_ERR_CNAME_GENERAL_ERROR,
+
+	ZC_ERR_GLUE_NODE,
+	ZC_ERR_GLUE_RECORD,
+
+	ZC_ERR_GLUE_GENERAL_ERROR,
+};
+
+static char *error_messages[(-ZC_ERR_ALLOC) + 1] = {
+	[-ZC_ERR_ALLOC] = "Memory allocation error!\n",
+
+	[-ZC_ERR_MISSING_SOA] = "SOA record missing in zone!\n",
+
+	[-ZC_ERR_RRSIG_RDATA_TYPE_COVERED] =
+	"RRSIG: Type covered rdata field is wrong!\n",
+	[-ZC_ERR_RRSIG_RDATA_TTL] =
+	"RRSIG: TTL rdata field is wrong!\n",
+	[-ZC_ERR_RRSIG_RDATA_LABELS] =
+	"RRSIG: Labels rdata field is wrong!\n",
+	[-ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER] =
+	"RRSIG: Signer name is different than in DNSKEY!\n",
+	[-ZC_ERR_RRSIG_RDATA_SIGNED_WRONG] =
+	"RRSIG: Key error!\n",
+	[-ZC_ERR_RRSIG_NO_RRSIG] =
+	"RRSIG: No RRSIG!\n",
+	[-ZC_ERR_RRSIG_SIGNED] =
+	"RRSIG: Signed RRSIG!\n",
+	[-ZC_ERR_RRSIG_OWNER] =
+	"RRSIG: Owner name rdata field is wrong!\n",
+	[-ZC_ERR_RRSIG_CLASS] =
+	"RRSIG: Class is wrong!\n",
+	[-ZC_ERR_RRSIG_TTL] =
+	"RRSIG: TTL is wrong!\n",
+	[-ZC_ERR_RRSIG_NOT_ALL] =
+	"RRSIG: Not all RRs are signed!\n",
+
+	[-ZC_ERR_NO_NSEC] =
+	"NSEC: Missing NSEC record\n",
+	[-ZC_ERR_NSEC_RDATA_BITMAP] =
+	"NSEC: Wrong NSEC bitmap!\n",
+	[-ZC_ERR_NSEC_RDATA_MULTIPLE] =
+	"NSEC: Multiple NSEC records!\n",
+	[-ZC_ERR_NSEC_RDATA_CHAIN] =
+	"NSEC: NSEC chain is not coherent!\n",
+	[-ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC] =
+	"NSEC: NSEC chain is not cyclic!\n",
+
+	[-ZC_ERR_NSEC3_UNSECURED_DELEGATION] =
+	"NSEC3: Zone contains unsecured delegation!\n",
+	[-ZC_ERR_NSEC3_NOT_FOUND] =
+	"NSEC3: Could not find previous NSEC3 record in the zone!\n",
+	[-ZC_ERR_NSEC3_UNSECURED_DELEGATION_OPT] =
+	"NSEC3: Unsecured delegation is not part "
+	"of the Opt-Out span!\n",
+	[-ZC_ERR_NSEC3_RDATA_TTL] =
+	"NSEC3: Original TTL rdata field is wrong!\n",
+	[-ZC_ERR_NSEC3_RDATA_CHAIN] =
+	"NSEC3: NSEC3 chain is not coherent!\n",
+	[-ZC_ERR_NSEC3_RDATA_BITMAP] =
+	"NSEC3: NSEC3 bitmap error!\n",
+
+	[-ZC_ERR_CNAME_CYCLE] =
+	"CNAME: CNAME cycle!\n",
+	[-ZC_ERR_DNAME_CYCLE] =
+	"CNAME: DNAME cycle!\n",
+	[-ZC_ERR_CNAME_EXTRA_RECORDS] =
+	"CNAME: Node with CNAME record has other records!\n",
+	[-ZC_ERR_DNAME_EXTRA_RECORDS] =
+	"DNAME: Node with DNAME record has other records!\n",
+	[-ZC_ERR_CNAME_EXTRA_RECORDS_DNSSEC] =
+	"CNAME: Node with CNAME record has other "
+	"records than RRSIG and NSEC/NSEC3!\n",
+	[-ZC_ERR_CNAME_MULTIPLE] = "CNAME: Multiple CNAME records!\n",
+	[-ZC_ERR_DNAME_MULTIPLE] = "DNAME: Multiple DNAME records!\n",
+
+	/* ^
+	   | Important errors (to be logged on first occurence and counted) */
+
+
+	/* Below are errors of lesser importance, to be counted unless
+	   specified otherwise */
+
+	[-ZC_ERR_GLUE_NODE] =
+	"GLUE: Node with Glue record missing!\n",
+	[-ZC_ERR_GLUE_RECORD] =
+	"GLUE: Record with Glue address missing\n",
+};
+
+/*!
+ * \brief Arguments to be used with tree traversal functions. Uses void pointers
+ *        to be more versatile.
+ *
+ */
+struct arg {
+	void *arg1; /* FILE *f / zone */
+	void *arg2; /* skip_list_t */
+	void *arg3; /* zone */
+	void *arg4; /* first node */
+	void *arg5; /* last node */
+	void *arg6; /* error handler */
+	void *arg7; /* CRC */
+};
+
+typedef struct arg arg_t;
+
+/*!
+ * \brief Structure representing handle options.
+ */
+struct handler_options {
+	char log_cname; /*!< Log all CNAME related semantic errors. */
+	char log_glue; /*!< Log all glue related semantic errors. */
+	char log_rrsigs; /*!< Log all RRSIG related semantic errors. */
+	char log_nsec; /*!< Log all NSEC related semantic errors. */
+	char log_nsec3; /*!< Log all NSEC3 related semantic errors. */
+};
+
+/*!
+ * \brief Structure for handling semantic errors.
+ */
+struct err_handler {
+	/* Consider moving error messages here */
+	struct handler_options options; /*!< Handler options. */
+	uint errors[(-ZC_ERR_ALLOC) + 1]; /*!< Array with error messages */
+};
+
+typedef struct err_handler err_handler_t;
+
+/*!
+ * \brief Creates new semantic error handler.
+ *
+ * \param log_cname If true, log all CNAME related events.
+ * \param log_glue If true, log all Glue related events.
+ * \param log_rrsigs If true, log all RRSIGs related events.
+ * \param log_nsec If true, log all NSEC related events.
+ * \param log_nsec3 If true, log all NSEC3 related events.
+ *
+ * \return err_handler_t * Created error handler.
+ */
+err_handler_t *handler_new(char log_cname, char log_glue,
+				  char log_rrsigs, char log_nsec,
+				  char log_nsec3);
+
+/*!
+ * \brief Called when error has been encountered in node. Will either log error
+ *        or print it, depending on handler's options.
+ *
+ * \param handler Error handler.
+ * \param node Node with semantic error in it.
+ * \param error Type of error.
+ *
+ * \retval KNOT_EOK on success.
+ * \retval ZC_ERR_UNKNOWN if unknown error.
+ * \retval ZC_ERR_ALLOC if memory error.
+ */
+int err_handler_handle_error(err_handler_t *handler,
+				    const knot_node_t *node,
+				    uint error);
+
+/*!
+ * \brief Checks if last node in NSEC/NSEC3 chain points to first node in the
+ *        chain and prints possible errors.
+ *
+ * \param handler Semantic error handler.
+ * \param zone Current zone.
+ * \param last_node Last node in NSEC/NSEC3 chain.
+ * \param do_checks Level of semantic checks.
+ */
+void log_cyclic_errors_in_zone(err_handler_t *handler,
+				      knot_zone_contents_t *zone,
+				      knot_node_t *last_node,
+				      const knot_node_t *first_nsec3_node,
+				      const knot_node_t *last_nsec3_node,
+				      char do_checks);
+
+/*!
+ * \brief This function prints all errors that occured in zone.
+ *
+ * \param handler Error handler containing found errors.
+ */
+void err_handler_log_all(err_handler_t *handler);
+
+/*!
+ * \brief Helper function - wraps its arguments into arg_t structure and
+ *        calls function that does the actual work.
+ *
+ * \param zone Zone to be searched / checked
+ * \param list Skip list of closests enclosers.
+ * \param do_checks Level of semantic checks.
+ * \param handler Semantic error handler.
+ * \param last_node Last checked node, which is part of NSEC(3) chain.
+ */
+void zone_do_sem_checks(knot_zone_contents_t *zone, char do_checks,
+                        err_handler_t *handler,
+                        knot_node_t **last_node);
+
+#endif // _KNOT_SEMANTIC_CHECK_H_
diff --git a/src/knot/zone/zone-dump.c b/src/knot/zone/zone-dump.c
index afc577d..de4a5a1 100644
--- a/src/knot/zone/zone-dump.c
+++ b/src/knot/zone/zone-dump.c
@@ -26,11 +26,11 @@
 #include "libknot/common.h"
 #include "knot/zone/zone-dump.h"
 #include "libknot/libknot.h"
+#include "common/crc.h"
 #include "knot/other/debug.h"
 #include "common/skip-list.h"
-#include "common/base32hex.h"
-#include "common/crc.h"
 #include "libknot/util/error.h"
+#include "semantic-check.h"
 
 #define ZONECHECKS_VERBOSE
 
@@ -51,1344 +51,6 @@
  * or raw data stored like this: data_len [data]
  */
 
-static const uint MAX_CNAME_CYCLE_DEPTH = 15;
-
-/*!
- *\brief Internal error constants. General errors are added for convenience,
- *       so that code does not have to change if new errors are added.
- */
-enum zonechecks_errors {
-	ZC_ERR_ALLOC = -40,
-	ZC_ERR_UNKNOWN,
-
-	ZC_ERR_MISSING_SOA,
-
-	ZC_ERR_GENERIC_GENERAL_ERROR, /* isn't there a better name? */
-
-	ZC_ERR_RRSIG_RDATA_TYPE_COVERED,
-	ZC_ERR_RRSIG_RDATA_TTL,
-	ZC_ERR_RRSIG_RDATA_LABELS,
-	ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER,
-	ZC_ERR_RRSIG_RDATA_SIGNED_WRONG,
-	ZC_ERR_RRSIG_NO_RRSIG,
-	ZC_ERR_RRSIG_SIGNED,
-	ZC_ERR_RRSIG_OWNER,
-	ZC_ERR_RRSIG_CLASS,
-	ZC_ERR_RRSIG_TTL,
-	ZC_ERR_RRSIG_NOT_ALL,
-
-	ZC_ERR_RRSIG_GENERAL_ERROR,
-
-	ZC_ERR_NO_NSEC,
-	ZC_ERR_NSEC_RDATA_BITMAP,
-	ZC_ERR_NSEC_RDATA_MULTIPLE,
-	ZC_ERR_NSEC_RDATA_CHAIN,
-	ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC,
-
-	ZC_ERR_NSEC_GENERAL_ERROR,
-
-	ZC_ERR_NSEC3_UNSECURED_DELEGATION,
-	ZC_ERR_NSEC3_NOT_FOUND,
-	ZC_ERR_NSEC3_UNSECURED_DELEGATION_OPT,
-	ZC_ERR_NSEC3_RDATA_TTL,
-	ZC_ERR_NSEC3_RDATA_CHAIN,
-	ZC_ERR_NSEC3_RDATA_BITMAP,
-
-	ZC_ERR_NSEC3_GENERAL_ERROR,
-
-	ZC_ERR_CNAME_CYCLE,
-	ZC_ERR_DNAME_CYCLE,
-	ZC_ERR_CNAME_EXTRA_RECORDS,
-	ZC_ERR_DNAME_EXTRA_RECORDS,
-	ZC_ERR_CNAME_EXTRA_RECORDS_DNSSEC,
-	ZC_ERR_CNAME_MULTIPLE,
-	ZC_ERR_DNAME_MULTIPLE,
-
-	ZC_ERR_CNAME_GENERAL_ERROR,
-
-	ZC_ERR_GLUE_NODE,
-	ZC_ERR_GLUE_RECORD,
-
-	ZC_ERR_GLUE_GENERAL_ERROR,
-};
-
-static char *error_messages[(-ZC_ERR_ALLOC) + 1] = {
-	[-ZC_ERR_ALLOC] = "Memory allocation error!\n",
-
-	[-ZC_ERR_MISSING_SOA] = "SOA record missing in zone!\n",
-
-	[-ZC_ERR_RRSIG_RDATA_TYPE_COVERED] =
-	"RRSIG: Type covered rdata field is wrong!\n",
-	[-ZC_ERR_RRSIG_RDATA_TTL] =
-	"RRSIG: TTL rdata field is wrong!\n",
-	[-ZC_ERR_RRSIG_RDATA_LABELS] =
-	"RRSIG: Labels rdata field is wrong!\n",
-	[-ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER] =
-	"RRSIG: Signer name is different than in DNSKEY!\n",
-	[-ZC_ERR_RRSIG_RDATA_SIGNED_WRONG] =
-	"RRSIG: Key error!\n",
-	[-ZC_ERR_RRSIG_NO_RRSIG] =
-	"RRSIG: No RRSIG!\n",
-	[-ZC_ERR_RRSIG_SIGNED] =
-	"RRSIG: Signed RRSIG!\n",
-	[-ZC_ERR_RRSIG_OWNER] =
-	"RRSIG: Owner name rdata field is wrong!\n",
-	[-ZC_ERR_RRSIG_CLASS] =
-	"RRSIG: Class is wrong!\n",
-	[-ZC_ERR_RRSIG_TTL] =
-	"RRSIG: TTL is wrong!\n",
-	[-ZC_ERR_RRSIG_NOT_ALL] =
-	"RRSIG: Not all RRs are signed!\n",
-
-	[-ZC_ERR_NO_NSEC] =
-	"NSEC: Missing NSEC record\n",
-	[-ZC_ERR_NSEC_RDATA_BITMAP] =
-	"NSEC: Wrong NSEC bitmap!\n",
-	[-ZC_ERR_NSEC_RDATA_MULTIPLE] =
-	"NSEC: Multiple NSEC records!\n",
-	[-ZC_ERR_NSEC_RDATA_CHAIN] =
-	"NSEC: NSEC chain is not coherent!\n",
-	[-ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC] =
-	"NSEC: NSEC chain is not cyclic!\n",
-
-	[-ZC_ERR_NSEC3_UNSECURED_DELEGATION] =
-	"NSEC3: Zone contains unsecured delegation!\n",
-	[-ZC_ERR_NSEC3_NOT_FOUND] =
-	"NSEC3: Could not find previous NSEC3 record in the zone!\n",
-	[-ZC_ERR_NSEC3_UNSECURED_DELEGATION_OPT] =
-	"NSEC3: Unsecured delegation is not part "
-	"of the Opt-Out span!\n",
-	[-ZC_ERR_NSEC3_RDATA_TTL] =
-	"NSEC3: Original TTL rdata field is wrong!\n",
-	[-ZC_ERR_NSEC3_RDATA_CHAIN] =
-	"NSEC3: NSEC3 chain is not coherent!\n",
-	[-ZC_ERR_NSEC3_RDATA_BITMAP] =
-	"NSEC3: NSEC3 bitmap error!\n",
-
-	[-ZC_ERR_CNAME_CYCLE] =
-	"CNAME: CNAME cycle!\n",
-	[-ZC_ERR_DNAME_CYCLE] =
-	"CNAME: DNAME cycle!\n",
-	[-ZC_ERR_CNAME_EXTRA_RECORDS] =
-	"CNAME: Node with CNAME record has other records!\n",
-	[-ZC_ERR_DNAME_EXTRA_RECORDS] =
-	"DNAME: Node with DNAME record has other records!\n",
-	[-ZC_ERR_CNAME_EXTRA_RECORDS_DNSSEC] =
-	"CNAME: Node with CNAME record has other "
-	"records than RRSIG and NSEC/NSEC3!\n",
-	[-ZC_ERR_CNAME_MULTIPLE] = "CNAME: Multiple CNAME records!\n",
-	[-ZC_ERR_DNAME_MULTIPLE] = "DNAME: Multiple DNAME records!\n",
-
-	/* ^
-	   | Important errors (to be logged on first occurence and counted) */
-
-
-	/* Below are errors of lesser importance, to be counted unless
-	   specified otherwise */
-
-	[-ZC_ERR_GLUE_NODE] =
-	"GLUE: Node with Glue record missing!\n",
-	[-ZC_ERR_GLUE_RECORD] =
-	"GLUE: Record with Glue address missing\n",
-};
-
-/*!
- * \brief Structure representing handle options.
- */
-struct handler_options {
-	char log_cname; /*!< Log all CNAME related semantic errors. */
-	char log_glue; /*!< Log all glue related semantic errors. */
-	char log_rrsigs; /*!< Log all RRSIG related semantic errors. */
-	char log_nsec; /*!< Log all NSEC related semantic errors. */
-	char log_nsec3; /*!< Log all NSEC3 related semantic errors. */
-};
-
-/*!
- * \brief Structure for handling semantic errors.
- */
-struct err_handler {
-	/* Consider moving error messages here */
-	struct handler_options options; /*!< Handler options. */
-	uint errors[(-ZC_ERR_ALLOC) + 1]; /*!< Array with error messages */
-};
-
-typedef struct err_handler err_handler_t;
-
-/*!
- * \brief Creates new semantic error handler.
- *
- * \param log_cname If true, log all CNAME related events.
- * \param log_glue If true, log all Glue related events.
- * \param log_rrsigs If true, log all RRSIGs related events.
- * \param log_nsec If true, log all NSEC related events.
- * \param log_nsec3 If true, log all NSEC3 related events.
- *
- * \return err_handler_t * Created error handler.
- */
-static err_handler_t *handler_new(char log_cname, char log_glue,
-				  char log_rrsigs, char log_nsec,
-				  char log_nsec3)
-{
-	err_handler_t *handler = malloc(sizeof(err_handler_t));
-	CHECK_ALLOC_LOG(handler, NULL);
-
-	/* It should be initialized, but to be safe */
-	memset(handler->errors, 0, sizeof(uint) * (-ZC_ERR_ALLOC + 1));
-
-	handler->options.log_cname = log_cname;
-	handler->options.log_glue = log_glue;
-	handler->options.log_rrsigs = log_rrsigs;
-	handler->options.log_nsec = log_nsec;
-	handler->options.log_nsec3 = log_nsec3;
-
-	return handler;
-}
-
-/*!
- * \brief Prints error message with node information.
- *
- * \note If \a node is NULL, only total number of errors is printed.
- *
- * \param handler Error handler.
- * \param node Node with semantic error in it.
- * \param error Type of error.
- */
-static void log_error_from_node(err_handler_t *handler,
-				const knot_node_t *node,
-				uint error)
-{
-	if (node != NULL) {
-		char *name =
-			knot_dname_to_str(knot_node_owner(node));
-		fprintf(stderr, "Semantic warning in node: %s: ", name);
-		fprintf(stderr, "%s", error_messages[-error]);
-		free(name);
-	} else {
-		fprintf(stderr, "Total number of warnings is: %d for error: %s",
-			handler->errors[-error],
-			error_messages[-error]);
-	}
-}
-
-/*!
- * \brief Called when error has been encountered in node. Will either log error
- *        or print it, depending on handler's options.
- *
- * \param handler Error handler.
- * \param node Node with semantic error in it.
- * \param error Type of error.
- *
- * \retval KNOT_EOK on success.
- * \retval ZC_ERR_UNKNOWN if unknown error.
- * \retval ZC_ERR_ALLOC if memory error.
- */
-static int err_handler_handle_error(err_handler_t *handler,
-				    const knot_node_t *node,
-				    uint error)
-{
-	assert(handler && node);
-	if ((error != 0) &&
-	    (error > ZC_ERR_GLUE_GENERAL_ERROR)) {
-		return ZC_ERR_UNKNOWN;
-	}
-
-	if (error == ZC_ERR_ALLOC) {
-		ERR_ALLOC_FAILED;
-		return ZC_ERR_ALLOC;
-	}
-
-	/* missing SOA can only occur once, so there
-	 * needn't to be an option for it */
-
-	if ((error != 0) &&
-	    (error < ZC_ERR_GENERIC_GENERAL_ERROR)) {
-		/* The two errors before SOA were handled */
-		log_error_from_node(handler, node, error);
-
-	} else if ((error < ZC_ERR_RRSIG_GENERAL_ERROR) &&
-		   ((handler->errors[-error] == 0) ||
-		   (handler->options.log_rrsigs))) {
-
-		log_error_from_node(handler, node, error);
-
-	} else if ((error > ZC_ERR_RRSIG_GENERAL_ERROR) &&
-		   (error < ZC_ERR_NSEC_GENERAL_ERROR) &&
-		   ((handler->errors[-error] == 0) ||
-		    (handler->options.log_nsec))) {
-
-		log_error_from_node(handler, node, error);
-
-	} else if ((error > ZC_ERR_NSEC_GENERAL_ERROR) &&
-		   (error < ZC_ERR_NSEC3_GENERAL_ERROR) &&
-		   ((handler->errors[-error] == 0) ||
-		    (handler->options.log_nsec3))) {
-
-		log_error_from_node(handler, node, error);
-
-	} else if ((error > ZC_ERR_NSEC3_GENERAL_ERROR) &&
-		   (error < ZC_ERR_CNAME_GENERAL_ERROR) &&
-		   ((handler->errors[-error] == 0) ||
-		    (handler->options.log_cname))) {
-
-		log_error_from_node(handler, node, error);
-
-	} else if ((error > ZC_ERR_CNAME_GENERAL_ERROR) &&
-		   (error < ZC_ERR_GLUE_GENERAL_ERROR) &&
-		    handler->options.log_glue) {
-
-		log_error_from_node(handler, node, error);
-
-	}
-
-	handler->errors[-error]++;
-
-	return KNOT_EOK;
-}
-
-/*!
- * \brief This function prints all errors that occured in zone.
- *
- * \param handler Error handler containing found errors.
- */
-static void err_handler_log_all(err_handler_t *handler)
-{
-	if (handler == NULL) {
-		return;
-	}
-
-	for (int i = ZC_ERR_ALLOC; i < ZC_ERR_GLUE_GENERAL_ERROR; i++) {
-		if (handler->errors[-i] > 0) {
-			log_error_from_node(handler, NULL, i);
-		}
-	}
-}
-
-/*!
- * \brief Arguments to be used with tree traversal functions. Uses void pointers
- *        to be more versatile.
- *
- */
-struct arg {
-	void *arg1; /* FILE *f / zone */
-	void *arg2; /* skip_list_t */
-	void *arg3; /* zone */
-	void *arg4; /* first node */
-	void *arg5; /* last node */
-	void *arg6; /* error handler */
-	void *arg7; /* CRC */
-};
-
-typedef struct arg arg_t;
-
-/*!
- * \brief Semantic check - CNAME cycles. Uses constant value with maximum
- *        allowed CNAME chain depth.
- *
- * \param zone Zone containing the RRSet.
- * \param rrset RRSet to be tested.
- *
- * \retval KNOT_EOK when there is no cycle.
- * \retval ZC_ERR_CNAME_CYCLE when cycle is present.
- */
-static int check_cname_cycles_in_zone(knot_zone_contents_t *zone,
-				      const knot_rrset_t *rrset)
-{
-	const knot_rrset_t *next_rrset = rrset;
-	assert(rrset);
-	const knot_rdata_t *tmp_rdata = knot_rrset_rdata(next_rrset);
-	const knot_node_t *next_node = NULL;
-
-	uint i = 0;
-
-	assert(tmp_rdata);
-
-	const knot_dname_t *next_dname =
-		knot_rdata_cname_name(tmp_rdata);
-
-	assert(next_dname);
-
-	while (i < MAX_CNAME_CYCLE_DEPTH && next_dname != NULL) {
-		next_node = knot_zone_contents_get_node(zone, next_dname);
-		if (next_node == NULL) {
-			next_node =
-				knot_zone_contents_get_nsec3_node(zone, next_dname);
-		}
-
-		if (next_node != NULL) {
-			next_rrset = knot_node_rrset(next_node,
-						       KNOT_RRTYPE_CNAME);
-			if (next_rrset != NULL) {
-				next_dname =
-				knot_rdata_cname_name(next_rrset->rdata);
-			} else {
-				next_node = NULL;
-				next_dname = NULL;
-			}
-		} else {
-			next_dname = NULL;
-		}
-		i++;
-	}
-
-	/* even if the length is 0, i will be 1 */
-	if (i >= MAX_CNAME_CYCLE_DEPTH) {
-		return ZC_ERR_CNAME_CYCLE;
-	}
-
-	return KNOT_EOK;
-}
-
-/*!
- * \brief Return raw data from rdata item structure (without length).
- *
- * \param item Item to get rdata from.
- * \return uint16_t * raw data without length.
- */
-static inline uint16_t *rdata_item_data(const knot_rdata_item_t *item)
-{
-	return (uint16_t *)(item->raw_data + 1);
-}
-
-/*!
- * \brief Returns type covered field from RRSIG RRSet's rdata.
- *
- * \param rdata RRSIG rdata.
- * \return uint16_t Type covered.
- */
-uint16_t type_covered_from_rdata(const knot_rdata_t *rdata)
-{
-	return ntohs(*(uint16_t *) rdata_item_data(&(rdata->items[0])));
-}
-
-/*!
- * \brief Check whether DNSKEY rdata are valid.
- *
- * \param rdata DNSKEY rdata to be checked.
- *
- * \retval KNOT_EOK when rdata are OK.
- * \retval ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER when rdata are not OK.
- */
-static int check_dnskey_rdata(const knot_rdata_t *rdata)
-{
-	/* check that Zone key bit it set - position 7 in net order */
-	/*! \todo FIXME: endian? I swear I've fixed this already, it was 7 i guesss*/
-	uint16_t mask = 1 << 8; //0b0000000100000000;
-
-	uint16_t flags =
-		knot_wire_read_u16((uint8_t *)rdata_item_data
-				     (knot_rdata_item(rdata, 0)));
-
-	if (flags & mask) {
-		return KNOT_EOK;
-	} else {
-		/* This error does not exactly fit, but it's better
-		 * than a new one */
-		return ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER;
-	}
-}
-
-/*!
- * \brief Calculates keytag for RSA/SHA algorithm.
- *
- * \param key Key wireformat.
- * \param keysize Wireformat size.
- *
- * \return uint16_t Calculated keytag.
- */
-static uint16_t keytag_1(uint8_t *key, uint16_t keysize)
-{
-	uint16_t ac = 0;
-	if (keysize > 4) {
-		memmove(&ac, key + keysize - 3, 2);
-	}
-
-	ac = ntohs(ac);
-	return ac;
-}
-
-/*!
- * \brief Calculates keytag from key wire.
- *
- * \param key Key wireformat.
- * \param keysize Wireformat size.
- *
- * \return uint16_t Calculated keytag.
- */
-static uint16_t keytag(uint8_t *key, uint16_t keysize )
-{
-	uint32_t ac = 0; /* assumed to be 32 bits or larger */
-
-	/* algorithm RSA/SHA */
-	if (key[3] == 1) {
-		return keytag_1(key, keysize);
-	} else {
-		for(int i = 0; i < keysize; i++) {
-			ac += (i & 1) ? key[i] : key[i] << 8;
-		}
-
-		ac += (ac >> 16) & 0xFFFF;
-		return (uint16_t)ac & 0xFFFF;
-	}
-}
-
-/*!
- * \brief Returns size of raw data item.
- *
- * \param item Raw data item.
- *
- * \return uint16_t Size of raw data item.
- */
-static inline uint16_t rdata_item_size(const knot_rdata_item_t *item)
-{
-	return item->raw_data[0];
-}
-
-/*!
- * \brief Converts DNSKEY rdata to wireformat.
- *
- * \param rdata DNSKEY rdata to be converted.
- * \param wire Created wire.
- * \param size Size of created wire.
- *
- * \retval KNOT_EOK on success.
- * \retval KNOT_ENOMEM on memory error.
- */
-static int dnskey_to_wire(const knot_rdata_t *rdata, uint8_t **wire,
-			  uint *size)
-{
-	assert(*wire == NULL);
-	/* flags + algorithm + protocol + keysize */
-	*size = 2 + 1 + 1 + knot_rdata_item(rdata, 3)->raw_data[0];
-	*wire = malloc(sizeof(uint8_t) * *size);
-	CHECK_ALLOC_LOG(*wire, KNOT_ENOMEM);
-
-	/* copy the wire octet by octet */
-
-	/* TODO check if we really have that many items */
-	if (rdata->count < 4) {
-		return KNOT_ERROR;
-	}
-
-	(*wire)[0] = ((uint8_t *)(knot_rdata_item(rdata, 0)->raw_data))[2];
-	(*wire)[1] = ((uint8_t *)(knot_rdata_item(rdata, 0)->raw_data))[3];
-
-	(*wire)[2] = ((uint8_t *)(knot_rdata_item(rdata, 1)->raw_data))[2];
-	(*wire)[3] = ((uint8_t *)(knot_rdata_item(rdata, 2)->raw_data))[2];
-
-	memcpy(*wire + 4, knot_rdata_item(rdata, 3)->raw_data + 1,
-	       knot_rdata_item(rdata, 3)->raw_data[0]);
-
-	return KNOT_EOK;
-}
-
-/*!
- * \brief Semantic check - RRSIG rdata.
- *
- * \param rdata_rrsig RRSIG rdata to be checked.
- * \param rrset RRSet containing the rdata.
- * \param dnskey_rrset RRSet containing zone's DNSKEY
- *
- * \retval KNOT_EOK if rdata are OK.
- *
- * \return Appropriate error code if error was found.
- */
-static int check_rrsig_rdata(const knot_rdata_t *rdata_rrsig,
-			     const knot_rrset_t *rrset,
-			     const knot_rrset_t *dnskey_rrset)
-{
-	if (rdata_rrsig == NULL) {
-		return ZC_ERR_RRSIG_NO_RRSIG;
-	}
-
-	if (type_covered_from_rdata(rdata_rrsig) !=
-	    knot_rrset_type(rrset)) {
-		/* zoneparser would not let this happen
-		 * but to be on the safe side
-		 */
-		return ZC_ERR_RRSIG_RDATA_TYPE_COVERED;
-	}
-
-	/* label number at the 2nd index should be same as owner's */
-	uint16_t *raw_data =
-		rdata_item_data(knot_rdata_item(rdata_rrsig, 2));
-
-	uint8_t labels_rdata = ((uint8_t *)raw_data)[0];
-
-	int tmp = knot_dname_label_count(knot_rrset_owner(rrset)) -
-		  labels_rdata;
-
-	if (tmp != 0) {
-		/* if name has wildcard, label must not be included */
-		if (!knot_dname_is_wildcard(knot_rrset_owner(rrset))) {
-			return ZC_ERR_RRSIG_RDATA_LABELS;
-		} else {
-			if (abs(tmp) != 1) {
-				return ZC_ERR_RRSIG_RDATA_LABELS;
-			}
-		}
-	}
-
-	/* check original TTL */
-	uint32_t original_ttl =
-		knot_wire_read_u32((uint8_t *)rdata_item_data(
-				     knot_rdata_item(rdata_rrsig, 3)));
-
-	if (original_ttl != knot_rrset_ttl(rrset)) {
-		return ZC_ERR_RRSIG_RDATA_TTL;
-	}
-
-	/* signer's name is same as in the zone apex */
-	knot_dname_t *signer_name =
-		knot_rdata_item(rdata_rrsig, 7)->dname;
-
-	/* dnskey is in the apex node */
-	if (knot_dname_compare(signer_name,
-				 knot_rrset_owner(dnskey_rrset)) != 0) {
-		return ZC_ERR_RRSIG_RDATA_DNSKEY_OWNER;
-	}
-
-	/* Compare algorithm, key tag and signer's name with DNSKEY rrset
-	 * one of the records has to match. Signer name has been checked
-	 * before */
-	char match = 0;
-	const knot_rdata_t *tmp_dnskey_rdata =
-		knot_rrset_rdata(dnskey_rrset);
-	do {
-		uint8_t alg =
-		((uint8_t *)(knot_rdata_item(rdata_rrsig, 1)->raw_data))[2];
-		uint8_t alg_dnskey =
-		((uint8_t *)(knot_rdata_item(tmp_dnskey_rdata,
-					       2)->raw_data))[2];
-
-		raw_data = rdata_item_data(knot_rdata_item(rdata_rrsig, 6));
-		uint16_t key_tag_rrsig =
-			knot_wire_read_u16((uint8_t *)raw_data);
-
-/*		raw_data =
-			rdata_item_data(knot_rdata_item(
-					tmp_dnskey_rdata, 3));
-
-		uint16_t raw_length = rdata_item_size(knot_rdata_item(
-						     tmp_dnskey_rdata, 3)); */
-
-		uint8_t *dnskey_wire = NULL;
-		uint dnskey_wire_size = 0;
-
-		int ret = 0;
-		if ((ret = dnskey_to_wire(tmp_dnskey_rdata, &dnskey_wire,
-				   &dnskey_wire_size)) != KNOT_EOK) {
-			return ret;
-		}
-
-		uint16_t key_tag_dnskey =
-			keytag(dnskey_wire, dnskey_wire_size);
-
-		free(dnskey_wire);
-
-		match = (alg == alg_dnskey) &&
-			(key_tag_rrsig == key_tag_dnskey) &&
-			!check_dnskey_rdata(tmp_dnskey_rdata);
-
-	} while (!match &&
-		 ((tmp_dnskey_rdata =
-			knot_rrset_rdata_next(dnskey_rrset,
-						tmp_dnskey_rdata))
-		!= NULL));
-
-	if (!match) {
-		return ZC_ERR_RRSIG_RDATA_SIGNED_WRONG;
-	}
-
-	return KNOT_EOK;
-}
-
-/*!
- * \brief Semantic check - RRSet's RRSIG.
- *
- * \param rrset RRSet containing RRSIG.
- * \param dnskey_rrset
- * \param nsec3 NSEC3 active.
- *
- * \retval KNOT_EOK on success.
- *
- * \return Appropriate error code if error was found.
- */
-static int check_rrsig_in_rrset(const knot_rrset_t *rrset,
-				const knot_rrset_t *dnskey_rrset,
-				char nsec3)
-{
-	assert(dnskey_rrset && rrset);
-
-	const knot_rrset_t *rrsigs = knot_rrset_rrsigs(rrset);
-
-	if (rrsigs == NULL) {
-		return ZC_ERR_RRSIG_NO_RRSIG;
-	}
-
-	/* signed rrsig - nonsense */
-	if (knot_rrset_rrsigs(rrsigs) != NULL) {
-		return ZC_ERR_RRSIG_SIGNED;
-	}
-
-	/* Different owner, class, ttl */
-
-	if (knot_dname_compare(knot_rrset_owner(rrset),
-				 knot_rrset_owner(rrsigs)) != 0) {
-		return ZC_ERR_RRSIG_OWNER;
-	}
-
-	if (knot_rrset_class(rrset) != knot_rrset_class(rrsigs)) {
-		return ZC_ERR_RRSIG_CLASS;
-	}
-
-	if (knot_rrset_ttl(rrset) != knot_rrset_ttl(rrset)) {
-		return ZC_ERR_RRSIG_TTL;
-	}
-
-	/* Check whether all rrsets have their rrsigs */
-	const knot_rdata_t *tmp_rdata = knot_rrset_rdata(rrset);
-	const knot_rdata_t *tmp_rrsig_rdata = knot_rrset_rdata(rrsigs);
-
-	assert(tmp_rdata);
-	assert(tmp_rrsig_rdata);
-	int ret = 0;
-	char all_signed = tmp_rdata && tmp_rrsig_rdata;
-	do {
-		if ((ret = check_rrsig_rdata(tmp_rrsig_rdata,
-					     rrset,
-					     dnskey_rrset)) != 0) {
-			return ret;
-		}
-
-		all_signed = tmp_rdata && tmp_rrsig_rdata;
-	} while (((tmp_rdata = knot_rrset_rdata_next(rrset, tmp_rdata))
-		!= NULL) &&
-		((tmp_rrsig_rdata =
-			knot_rrset_rdata_next(rrsigs, tmp_rrsig_rdata))
-		!= NULL));
-
-	if (!all_signed) {
-		return ZC_ERR_RRSIG_NOT_ALL;
-	}
-
-	return KNOT_EOK;
-}
-
-/*!
- * \brief Returns bit on index from array in network order. Taken from NSD.
- *
- * \param bits Array in network order.
- * \param index Index to return from array.
- *
- * \return int Bit on given index.
- */
-static int get_bit(uint8_t *bits, size_t index)
-{
-	/*
-	 * The bits are counted from left to right, so bit #0 is the
-	 * leftmost bit.
-	 */
-	return bits[index / 8] & (1 << (7 - index % 8));
-}
-
-/*!
- * \brief Converts NSEC bitmap to array of integers. (Inspired by NSD code)
- *
- * \param item Item containing the bitmap.
- * \param array Array to be created.
- * \param count Count of items in array.
- *
- * \retval KNOT_OK on success.
- * \retval KNOT_NOMEM on memory error.
- */
-static int rdata_nsec_to_type_array(const knot_rdata_item_t *item,
-			      uint16_t **array,
-			      uint *count)
-{
-	assert(*array == NULL);
-
-	uint8_t *data = (uint8_t *)rdata_item_data(item);
-
-	int increment = 0;
-	*count = 0;
-
-	for (int i = 0; i < rdata_item_size(item); i += increment) {
-		increment = 0;
-		uint8_t window = data[i];
-		increment++;
-
-		uint8_t bitmap_size = data[i + increment];
-		increment++;
-
-		uint8_t *bitmap =
-			malloc(sizeof(uint8_t) * (bitmap_size));
-		if (bitmap == NULL) {
-			ERR_ALLOC_FAILED;
-			free(*array);
-			return KNOT_ENOMEM;
-		}
-
-		memcpy(bitmap, data + i + increment,
-		       bitmap_size);
-
-		increment += bitmap_size;
-
-		for (int j = 0; j < bitmap_size * 8; j++) {
-			if (get_bit(bitmap, j)) {
-				(*count)++;
-				void *tmp = realloc(*array,
-						    sizeof(uint16_t) *
-						    *count);
-				if (tmp == NULL) {
-					ERR_ALLOC_FAILED;
-					free(bitmap);
-					free(*array);
-					return KNOT_ENOMEM;
-				}
-				*array = tmp;
-				(*array)[*count - 1] = j + window * 256;
-			}
-		}
-		free(bitmap);
-	}
-
-	return KNOT_EOK;
-}
-
-/* should write error, not return values !!! */
-
-/*!
- * \brief Semantic check - check node's NSEC node.
- *
- * \param zone Current zone.
- * \param node Node to be checked.
- * \param handler Error handler
- *
- * \retval KNOT_EOK if no error was found.
- *
- * \return Appropriate error code if error was found.
- */
-static int check_nsec3_node_in_zone(knot_zone_contents_t *zone, knot_node_t *node,
-                                    err_handler_t *handler)
-{
-	assert(handler);
-	const knot_node_t *nsec3_node = knot_node_nsec3_node(node, 0);
-
-	if (nsec3_node == NULL) {
-		/* I know it's probably not what RFCs say, but it will have to
-		 * do for now. */
-		if (knot_node_rrset(node, KNOT_RRTYPE_DS) != NULL) {
-			err_handler_handle_error(handler, node,
-					ZC_ERR_NSEC3_UNSECURED_DELEGATION);
-		} else {
-			/* Unsecured delegation, check whether it is part of
-			 * opt-out span */
-			const knot_node_t *nsec3_previous;
-			const knot_node_t *nsec3_node;
-
-			if (knot_zone_contents_find_nsec3_for_name(zone,
-						knot_node_owner(node),
-						&nsec3_node,
-						&nsec3_previous, 0) != 0) {
-				err_handler_handle_error(handler, node,
-						 ZC_ERR_NSEC3_NOT_FOUND);
-			}
-
-			if (nsec3_node == NULL) {
-				/* Probably should not ever happen */
-				return ZC_ERR_NSEC3_NOT_FOUND;
-			}
-
-			assert(nsec3_previous);
-
-			const knot_rrset_t *previous_rrset =
-				knot_node_rrset(nsec3_previous,
-						  KNOT_RRTYPE_NSEC3);
-
-			assert(previous_rrset);
-
-			/* check for Opt-Out flag */
-			uint8_t flags =
-		((uint8_t *)(previous_rrset->rdata->items[1].raw_data))[2];
-
-			uint8_t opt_out_mask = 1;
-
-			if (!(flags & opt_out_mask)) {
-				err_handler_handle_error(handler, node,
-					ZC_ERR_NSEC3_UNSECURED_DELEGATION_OPT);
-			}
-		}
-	}
-
-	const knot_rrset_t *nsec3_rrset =
-		knot_node_rrset(nsec3_node, KNOT_RRTYPE_NSEC3);
-
-	assert(nsec3_rrset);
-
-	const knot_rrset_t *soa_rrset =
-		knot_node_rrset(knot_zone_contents_apex(zone),
-	                        KNOT_RRTYPE_SOA);
-	assert(soa_rrset);
-
-	uint32_t minimum_ttl =
-		knot_wire_read_u32((uint8_t *)
-		rdata_item_data(
-		knot_rdata_item(
-		knot_rrset_rdata(
-		knot_node_rrset(
-		knot_zone_contents_apex(zone), KNOT_RRTYPE_SOA)), 6)));
-	/* Are those getters even worth this?
-	 * Now I have no idea what this code does. */
-
-	if (knot_rrset_ttl(nsec3_rrset) != minimum_ttl) {
-			err_handler_handle_error(handler, node,
-						 ZC_ERR_NSEC3_RDATA_TTL);
-	}
-
-	/* check that next dname is in the zone */
-	uint8_t *next_dname_decoded = NULL;
-	size_t real_size = 0;
-
-	if (((real_size = base32hex_encode_alloc(((char *)
-		rdata_item_data(&(nsec3_rrset->rdata->items[4]))) + 1,
-		rdata_item_size(&nsec3_rrset->rdata->items[4]) - 1,
-		(char **)&next_dname_decoded)) <= 0) ||
-		(next_dname_decoded == NULL)) {
-		fprintf(stderr, "Could not encode base32 string!\n");
-		return KNOT_ERROR;
-	}
-
-	/* This is why we allocate maximum length of decoded string + 1 */
-	memmove(next_dname_decoded + 1, next_dname_decoded, real_size);
-	next_dname_decoded[0] = real_size;
-
-	/* Local allocation, will be discarded. */
-	knot_dname_t *next_dname =
-		knot_dname_new_from_wire(next_dname_decoded,
-					   real_size + 1, NULL);
-	CHECK_ALLOC_LOG(next_dname, KNOT_ENOMEM);
-
-	free(next_dname_decoded);
-
-	if (knot_dname_cat(next_dname,
-		     knot_node_owner(knot_zone_contents_apex(zone))) == NULL) {
-		fprintf(stderr, "Could not concatenate dnames!\n");
-		return KNOT_ERROR;
-
-	}
-
-	if (knot_zone_contents_find_nsec3_node(zone, next_dname) == NULL) {
-		err_handler_handle_error(handler, node,
-					 ZC_ERR_NSEC3_RDATA_CHAIN);
-	}
-
-	/* Directly discard. */
-	knot_dname_free(&next_dname);
-
-	/* This is probably not sufficient, but again, it is covered in
-	 * zone load time */
-
-	uint count;
-	uint16_t *array = NULL;
-	if (rdata_nsec_to_type_array(
-	    knot_rdata_item(
-	    knot_rrset_rdata(nsec3_rrset), 5),
-	    &array, &count) != 0) {
-			err_handler_handle_error(handler, node,
-						 ZC_ERR_ALLOC);
-			return KNOT_ERROR;
-	}
-
-	uint16_t type = 0;
-	for (int j = 0; j < count; j++) {
-		/* test for each type's presence */
-		type = array[j];
-		if (type == KNOT_RRTYPE_RRSIG) {
-		       continue;
-		}
-		if (knot_node_rrset(node,
-				      type) == NULL) {
-			err_handler_handle_error(handler, node,
-						 ZC_ERR_NSEC3_RDATA_BITMAP);
-			break;
-/*			char *name =
-				knot_dname_to_str(
-			log_zone_error("Node %s does "
-					"not contain RRSet of type %s "
-					"but NSEC bitmap says "
-					"it does!\n", name,
-					knot_rrtype_to_string(type));
-			free(name); */
-		}
-	}
-
-	free(array);
-
-	return KNOT_EOK;
-}
-
-/*!
- * \brief Run semantic checks for node without DNSSEC-related types.
- *
- * \param zone Current zone.
- * \param node Node to be checked.
- * \param do_checks Level of checks to be done.
- * \param handler Error handler.
- *
- * \retval KNOT_EOK if no error was found.
- *
- * \return Appropriate error code if error was found.
- */
-static int semantic_checks_plain(knot_zone_contents_t *zone,
-				 knot_node_t *node,
-				 char do_checks,
-				 err_handler_t *handler)
-{
-	assert(handler);
-	const knot_rrset_t *cname_rrset =
-			knot_node_rrset(node, KNOT_RRTYPE_CNAME);
-	if (cname_rrset != NULL) {
-		if (check_cname_cycles_in_zone(zone, cname_rrset) !=
-				KNOT_EOK) {
-			err_handler_handle_error(handler, node,
-						 ZC_ERR_CNAME_CYCLE);
-		}
-
-		/* No DNSSEC and yet there is more than one rrset in node */
-		if (do_checks == 1 &&
-		                knot_node_rrset_count(node) != 1) {
-			err_handler_handle_error(handler, node,
-			                         ZC_ERR_CNAME_EXTRA_RECORDS);
-		} else if (knot_node_rrset_count(node) != 1) {
-			/* With DNSSEC node can contain RRSIG or NSEC */
-			if (!(knot_node_rrset(node, KNOT_RRTYPE_RRSIG) ||
-			      knot_node_rrset(node, KNOT_RRTYPE_NSEC)) ||
-			    knot_node_rrset_count(node) > 3) {
-				err_handler_handle_error(handler, node,
-				ZC_ERR_CNAME_EXTRA_RECORDS_DNSSEC);
-			}
-		}
-
-		if (knot_rrset_rdata(cname_rrset)->next !=
-		                knot_rrset_rdata(cname_rrset)) {
-			err_handler_handle_error(handler, node,
-			                         ZC_ERR_CNAME_MULTIPLE);
-		}
-	}
-
-	const knot_rrset_t *dname_rrset =
-		knot_node_rrset(node, KNOT_RRTYPE_DNAME);
-	if (dname_rrset != NULL) {
-		if (check_cname_cycles_in_zone(zone, dname_rrset) !=
-				KNOT_EOK) {
-			err_handler_handle_error(handler, node,
-						 ZC_ERR_DNAME_CYCLE);
-		}
-
-		if (knot_node_rrset(node, KNOT_RRTYPE_CNAME)) {
-			err_handler_handle_error(handler, node,
-			                         ZC_ERR_DNAME_EXTRA_RECORDS);
-		}
-
-		if (knot_rrset_rdata(dname_rrset)->next !=
-		    knot_rrset_rdata(dname_rrset)) {
-			err_handler_handle_error(handler, node,
-			                         ZC_ERR_DNAME_MULTIPLE);
-		}
-	}
-
-	/* check for glue records at zone cuts */
-	if (knot_node_is_deleg_point(node)) {
-		const knot_rrset_t *ns_rrset =
-				knot_node_rrset(node, KNOT_RRTYPE_NS);
-		assert(ns_rrset);
-		//FIXME this should be an error as well ! (i guess)
-
-		const knot_dname_t *ns_dname =
-				knot_rdata_get_item(knot_rrset_rdata
-						      (ns_rrset), 0)->dname;
-
-		assert(ns_dname);
-
-		const knot_node_t *glue_node =
-				knot_zone_contents_find_node(zone, ns_dname);
-
-		if (knot_dname_is_subdomain(ns_dname,
-			      knot_node_owner(knot_zone_contents_apex(zone)))) {
-			if (glue_node == NULL) {
-				err_handler_handle_error(handler, node,
-							 ZC_ERR_GLUE_NODE);
-			} else {
-				if ((knot_node_rrset(glue_node,
-					       KNOT_RRTYPE_A) == NULL) &&
-				    (knot_node_rrset(glue_node,
-					       KNOT_RRTYPE_AAAA) == NULL)) {
-					err_handler_handle_error(handler, node,
-							 ZC_ERR_GLUE_RECORD);
-				}
-			}
-		}
-	}
-	return KNOT_EOK;
-}
-
-/*!
- * \brief Run semantic checks for node without DNSSEC-related types.
- *
- * \param zone Current zone.
- * \param node Node to be checked.
- * \param first_node First node in canonical order.
- * \param last_node Last node in canonical order.
- * \param handler Error handler.
- * \param nsec3 NSEC3 used.
- *
- * \retval KNOT_EOK if no error was found.
- *
- * \return Appropriate error code if error was found.
- */
-static int semantic_checks_dnssec(knot_zone_contents_t *zone,
-				  knot_node_t *node,
-				  knot_node_t *first_node,
-				  knot_node_t **last_node,
-				  err_handler_t *handler,
-				  char nsec3)
-{
-	assert(handler);
-	assert(node);
-	char auth = !knot_node_is_non_auth(node);
-	char deleg = knot_node_is_deleg_point(node);
-	uint rrset_count = knot_node_rrset_count(node);
-	const knot_rrset_t **rrsets = knot_node_rrsets(node);
-	const knot_rrset_t *dnskey_rrset =
-		knot_node_rrset(knot_zone_contents_apex(zone),
-				  KNOT_RRTYPE_DNSKEY);
-
-	int ret = 0;
-
-	for (int i = 0; i < rrset_count; i++) {
-		const knot_rrset_t *rrset = rrsets[i];
-		if (auth && !deleg &&
-		    (ret = check_rrsig_in_rrset(rrset, dnskey_rrset,
-						nsec3)) != 0) {
-		  /* CLEANUP */
-/*			log_zone_error("RRSIG %d node %s\n", ret,
-				       knot_dname_to_str(node->owner));*/
-
-			err_handler_handle_error(handler, node, ret);
-		}
-
-		if (!nsec3 && auth) {
-			/* check for NSEC record */
-			const knot_rrset_t *nsec_rrset =
-					knot_node_rrset(node,
-							  KNOT_RRTYPE_NSEC);
-
-			if (nsec_rrset == NULL) {
-				err_handler_handle_error(handler, node,
-							 ZC_ERR_NO_NSEC);
-				/* CLEANUP */
-/*				char *name =
-					knot_dname_to_str(node->owner);
-				log_zone_error("Missing NSEC in node: "
-					       "%s\n", name);
-				free(name);
-				return; */
-			} else {
-
-				/* check NSEC/NSEC3 bitmap */
-
-				uint count;
-
-				uint16_t *array = NULL;
-
-				if (rdata_nsec_to_type_array(
-						knot_rdata_item(
-						knot_rrset_rdata(nsec_rrset),
-						1),
-						&array, &count) != 0) {
-					err_handler_handle_error(handler,
-								 NULL,
-								 ZC_ERR_ALLOC);
-					return ZC_ERR_ALLOC; /* ... */
-					/*return; */
-				}
-
-				uint16_t type = 0;
-				for (int j = 0; j < count; j++) {
-					/* test for each type's presence */
-					type = array[j];
-					if (type == KNOT_RRTYPE_RRSIG) {
-						continue;
-					}
-					if (knot_node_rrset(node,
-							      type) == NULL) {
-					err_handler_handle_error(
-						handler,
-						node,
-						ZC_ERR_NSEC_RDATA_BITMAP);
-					/* CLEANUP */
-	/*					char *name =
-						knot_dname_to_str(
-						knot_node_owner(node));
-
-						log_zone_error("Node %s does "
-						"not contain RRSet of type %s "
-						"but NSEC bitmap says "
-					       "it does!\n", name,
-					       knot_rrtype_to_string(type));
-
-					free(name); */
-					}
-				}
-				free(array);
-			}
-
-			/* Test that only one record is in the
-				 * NSEC RRSet */
-
-			if ((nsec_rrset != NULL) &&
-			    knot_rrset_rdata(nsec_rrset)->next !=
-			    knot_rrset_rdata(nsec_rrset)) {
-				err_handler_handle_error(handler,
-						 node,
-						 ZC_ERR_NSEC_RDATA_MULTIPLE);
-				/* CLEANUP */
-/*				char *name =
-					knot_dname_to_str(
-					knot_node_owner(node));
-				log_zone_error("Node %s contains more "
-					       "than one NSEC "
-					       "record!\n", name);
-				knot_rrset_dump(nsec_rrset, 0);
-				free(name); */
-			}
-
-			/*
-			 * Test that NSEC chain is coherent.
-			 * We have already checked that every
-			 * authoritative node contains NSEC record
-			 * so checking should only be matter of testing
-			 * the next link in each node.
-			 */
-
-			if (nsec_rrset != NULL) {
-				knot_dname_t *next_domain =
-					knot_rdata_item(
-					knot_rrset_rdata(nsec_rrset),
-					0)->dname;
-
-				assert(next_domain);
-
-				if (knot_zone_contents_find_node(zone, next_domain) ==
-				    NULL) {
-					err_handler_handle_error(handler,
-						node,
-						ZC_ERR_NSEC_RDATA_CHAIN);
-					/* CLEANUP */
-/*					log_zone_error("NSEC chain is not "
-						       "coherent!\n"); */
-				}
-
-				if (knot_dname_compare(next_domain,
-				    knot_node_owner(knot_zone_contents_apex(zone)))
-					== 0) {
-					/* saving the last node */
-					*last_node = node;
-				}
-
-			}
-		} else if (nsec3 && (auth || deleg)) { /* nsec3 */
-			int ret = check_nsec3_node_in_zone(zone, node,
-			                                   handler);
-			if (ret != KNOT_EOK) {
-				free(rrsets);
-				return ret;
-			}
-		}
-	}
-	free(rrsets);
-
-	return KNOT_EOK;
-}
-
-/*!
- * \brief Function called by zone traversal function. Used to call
- *        knot_zone_save_enclosers.
- *
- * \param node Node to be searched.
- * \param data Arguments.
- */
-static void do_checks_in_tree(knot_node_t *node, void *data)
-{
-	assert(data != NULL);
-	arg_t *args = (arg_t *)data;
-
-	knot_rrset_t **rrsets = knot_node_get_rrsets(node);
-	short count = knot_node_rrset_count(node);
-
-	assert(count == 0 || rrsets != NULL);
-
-	knot_zone_contents_t *zone = (knot_zone_contents_t *)args->arg1;
-
-	assert(zone);
-
-
-/*	for (int i = 0; i < count; ++i) {
-		assert(rrsets[i] != NULL);
-		knot_zone_save_enclosers_rrset(rrsets[i],
-						 zone,
-						 (skip_list_t *)args->arg2);
-	} */
-
-	knot_node_t *first_node = (knot_node_t *)args->arg4;
-	knot_node_t **last_node = (knot_node_t **)args->arg5;
-
-	err_handler_t *handler = (err_handler_t *)args->arg6;
-
-	char do_checks = *((char *)(args->arg3));
-
-	if (do_checks) {
-		semantic_checks_plain(zone, node, do_checks, handler);
-	}
-
-	if (do_checks > 1) {
-		semantic_checks_dnssec(zone, node, first_node, last_node,
-				       handler, do_checks == 3);
-	}
-
-	free(rrsets);
-}
-
-/*!
- * \brief Helper function - wraps its arguments into arg_t structure and
- *        calls function that does the actual work.
- *
- * \param zone Zone to be searched / checked
- * \param list Skip list of closests enclosers.
- * \param do_checks Level of semantic checks.
- * \param handler Semantic error handler.
- * \param last_node Last checked node, which is part of NSEC(3) chain.
- */
-void zone_do_sem_checks(knot_zone_contents_t *zone, char do_checks,
-                        err_handler_t *handler,
-                        knot_node_t **last_node)
-{
-	if (!do_checks) {
-		return;
-	}
-
-	arg_t arguments;
-	arguments.arg1 = zone;
-	arguments.arg3 = &do_checks;
-	arguments.arg4 = NULL;
-	arguments.arg5 = last_node;
-	arguments.arg6 = handler;
-
-	knot_zone_contents_tree_apply_inorder(zone,
-			   do_checks_in_tree,
-			   (void *)&arguments);
-}
-
 static inline int fwrite_to_file_crc(const void *src,
                                      size_t size, size_t n, FILE *f,
                                      crc_t *crc)
@@ -1428,6 +90,7 @@ static inline int fwrite_to_stream(const void *src,
 		return KNOT_EOK;
 	} else {
 		free(*stream);
+		*stream = NULL;
 		return KNOT_ENOMEM;
 	}
 
@@ -1834,125 +497,6 @@ static int zone_is_secure(knot_zone_contents_t *zone)
 }
 
 /*!
- * \brief Checks if last node in NSEC/NSEC3 chain points to first node in the
- *        chain and prints possible errors.
- *
- * \param handler Semantic error handler.
- * \param zone Current zone.
- * \param last_node Last node in NSEC/NSEC3 chain.
- * \param do_checks Level of semantic checks.
- */
-static void log_cyclic_errors_in_zone(err_handler_t *handler,
-				      knot_zone_contents_t *zone,
-				      knot_node_t *last_node,
-				      const knot_node_t *first_nsec3_node,
-				      const knot_node_t *last_nsec3_node,
-				      char do_checks)
-{
-	if (do_checks == 3) {
-		/* Each NSEC3 node should only contain one RRSET. */
-		assert(last_nsec3_node && first_nsec3_node);
-		const knot_rrset_t *nsec3_rrset =
-			knot_node_rrset(last_nsec3_node,
-		                              KNOT_RRTYPE_NSEC3);
-		if (nsec3_rrset == NULL) {
-			err_handler_handle_error(handler, last_nsec3_node,
-						 ZC_ERR_NSEC3_RDATA_CHAIN);
-			return;
-		}
-
-		/* check that next dname is in the zone */
-		uint8_t *next_dname_decoded = NULL;
-		size_t real_size = 0;
-
-		if (((real_size = base32hex_encode_alloc(((char *)
-			rdata_item_data(&(nsec3_rrset->rdata->items[4]))) + 1,
-			rdata_item_size(&nsec3_rrset->rdata->items[4]) - 1,
-			(char **)&next_dname_decoded)) <= 0) ||
-			(next_dname_decoded == NULL)) {
-			fprintf(stderr, "Could not encode base32 string!\n");
-			err_handler_handle_error(handler, last_nsec3_node,
-						 ZC_ERR_NSEC3_RDATA_CHAIN);
-			return;
-		}
-
-		/* This is why allocate maximum length of decoded string + 1 */
-		memmove(next_dname_decoded + 1, next_dname_decoded, real_size);
-		next_dname_decoded[0] = real_size;
-
-		/* Local allocation, will be discarded. */
-		knot_dname_t *next_dname =
-			knot_dname_new_from_wire(next_dname_decoded,
-						   real_size + 1, NULL);
-		if (next_dname == NULL) {
-			fprintf(stderr, "Could not allocate dname!\n");
-			err_handler_handle_error(handler, last_nsec3_node,
-						 ZC_ERR_ALLOC);
-			return;
-		}
-
-		free(next_dname_decoded);
-
-		/*! \todo Free result and dname! */
-		if (knot_dname_cat(next_dname,
-			     knot_node_owner(knot_zone_contents_apex(zone))) ==
-		                NULL) {
-			fprintf(stderr, "Could not concatenate dnames!\n");
-			err_handler_handle_error(handler, last_nsec3_node,
-						 ZC_ERR_NSEC3_RDATA_CHAIN);
-			return;
-		}
-
-		/* Check it points somewhere first. */
-		if (knot_zone_contents_find_nsec3_node(zone, next_dname) == NULL) {
-			err_handler_handle_error(handler, last_nsec3_node,
-						 ZC_ERR_NSEC3_RDATA_CHAIN);
-		}
-
-		/* Compare with the actual first NSEC3 node. */
-		if (knot_dname_compare(first_nsec3_node->owner,
-		                         next_dname) != 0) {
-			err_handler_handle_error(handler, last_nsec3_node,
-						 ZC_ERR_NSEC3_RDATA_CHAIN);
-		}
-
-		/* Directly discard. */
-		knot_dname_free(&next_dname);
-
-	} else if (do_checks == 2 ) {
-		if (last_node == NULL) {
-			err_handler_handle_error(handler, last_node,
-				ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC);
-				return;
-		} else {
-			const knot_rrset_t *nsec_rrset =
-				knot_node_rrset(last_node,
-						  KNOT_RRTYPE_NSEC);
-
-			if (nsec_rrset == NULL) {
-				err_handler_handle_error(handler, last_node,
-					 ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC);
-				return;
-			}
-
-			const knot_dname_t *next_dname =
-				knot_rdata_item(
-				knot_rrset_rdata(nsec_rrset), 0)->dname;
-			assert(next_dname);
-
-			const knot_dname_t *apex_dname =
-				knot_node_owner(knot_zone_contents_apex(zone));
-			assert(apex_dname);
-
-			if (knot_dname_compare(next_dname, apex_dname) !=0) {
-				err_handler_handle_error(handler, last_node,
-					 ZC_ERR_NSEC_RDATA_CHAIN_NOT_CYCLIC);
-			}
-		}
-	}
-}
-
-/*!
  * \brief Safe wrapper around fwrite.
  *
  * \param dst Destination pointer.
diff --git a/src/libknot/nameserver/name-server.c b/src/libknot/nameserver/name-server.c
index f88f802..f353ee7 100644
--- a/src/libknot/nameserver/name-server.c
+++ b/src/libknot/nameserver/name-server.c
@@ -619,17 +619,35 @@ static void ns_put_authority_ns(const knot_zone_contents_t *zone,
  * \param zone Zone to take the SOA RRSet from.
  * \param resp Response where to add the RRSet.
  */
-static void ns_put_authority_soa(const knot_zone_contents_t *zone,
+static int ns_put_authority_soa(const knot_zone_contents_t *zone,
                                  knot_packet_t *resp)
 {
 	const knot_rrset_t *soa_rrset = knot_node_rrset(
 			knot_zone_contents_apex(zone), KNOT_RRTYPE_SOA);
 	assert(soa_rrset != NULL);
 
-	knot_response_add_rrset_authority(resp, soa_rrset, 0, 0, 0);
-	ns_add_rrsigs(soa_rrset, resp,
-	              knot_node_owner(knot_zone_contents_apex(zone)),
-	              knot_response_add_rrset_authority, 1);
+	// if SOA's TTL is larger than MINIMUM, copy the RRSet and set
+	// MINIMUM as TTL
+	uint32_t min = knot_rdata_soa_minimum(knot_rrset_rdata(soa_rrset));
+	if (min < knot_rrset_ttl(soa_rrset)) {
+		knot_rrset_t *soa_copy = NULL;
+		knot_rrset_deep_copy(soa_rrset, &soa_copy);
+		CHECK_ALLOC_LOG(soa_copy, KNOT_ENOMEM);
+
+		knot_rrset_set_ttl(soa_copy, min);
+		soa_rrset = soa_copy;
+	}
+
+	assert(soa_rrset != NULL);
+
+	int ret = knot_response_add_rrset_authority(resp, soa_rrset, 0, 0, 0);
+	if (ret == KNOT_EOK) {
+		ret = ns_add_rrsigs(soa_rrset, resp,
+		                    knot_node_owner(knot_zone_contents_apex(zone)),
+		                    knot_response_add_rrset_authority, 1);
+	}
+
+	return ret;
 }
 
 /*----------------------------------------------------------------------------*/
@@ -1637,13 +1655,15 @@ static void ns_add_dnskey(const knot_node_t *apex, knot_packet_t *resp)
  * \todo Describe the answering logic in detail.
  */
 static int ns_answer_from_zone(const knot_zone_contents_t *zone,
-                               const knot_dname_t *qname, uint16_t qtype,
                                knot_packet_t *resp)
 {
 	const knot_node_t *node = NULL, *closest_encloser = NULL,
 	                    *previous = NULL;
 	int cname = 0, auth_soa = 0, ret = 0, find_ret = 0;
 
+	const knot_dname_t *qname = knot_packet_qname(resp);
+	uint16_t qtype = knot_packet_qtype(resp);
+
 search:
 #ifdef USE_HASH_TABLE
 	/*! \todo Check version. */
@@ -1839,20 +1859,20 @@ finalize:
  * \retval KNOT_EOK
  * \retval NS_ERR_SERVFAIL
  */
-static int ns_answer(knot_zonedb_t *db, knot_packet_t *resp)
-{
-	const knot_dname_t *qname = knot_packet_qname(resp);
-	assert(qname != NULL);
-
-	uint16_t qtype = knot_packet_qtype(resp);
-dbg_ns_exec(
-	char *name_str = knot_dname_to_str(qname);
-	dbg_ns("Trying to find zone for QNAME %s\n", name_str);
-	free(name_str);
-);
-	// find zone in which to search for the name
-	const knot_zone_t *zone =
-		ns_get_zone_for_qname(db, qname, qtype);
+static int ns_answer(const knot_zone_t *zone, knot_packet_t *resp)
+{
+//	const knot_dname_t *qname = knot_packet_qname(resp);
+//	assert(qname != NULL);
+
+//	uint16_t qtype = knot_packet_qtype(resp);
+//dbg_ns_exec(
+//	char *name_str = knot_dname_to_str(qname);
+//	dbg_ns("Trying to find zone for QNAME %s\n", name_str);
+//	free(name_str);
+//);
+//	// find zone in which to search for the name
+//	const knot_zone_t *zone =
+//		ns_get_zone_for_qname(db, qname, qtype);
 	const knot_zone_contents_t *contents = knot_zone_contents(zone);
 
 	// if no zone found, return REFUSED
@@ -1875,25 +1895,15 @@ dbg_ns_exec(
 
 	// take the zone contents and use only them for answering
 
-	return ns_answer_from_zone(contents, qname, qtype, resp);
+	return ns_answer_from_zone(contents, resp);
 
 	//knot_dname_free(&qname);
 }
 
 /*----------------------------------------------------------------------------*/
-/*!
- * \brief Converts the response to wire format.
- *
- * \param resp Response to convert.
- * \param wire Place for the wire format of the response.
- * \param wire_size In: space available for the wire format in bytes.
- *                  Out: actual size of the wire format in bytes.
- *
- * \retval KNOT_EOK
- * \retval NS_ERR_SERVFAIL
- */
-static int ns_response_to_wire(knot_packet_t *resp, uint8_t *wire,
-                               size_t *wire_size)
+
+int ns_response_to_wire(knot_packet_t *resp, uint8_t *wire,
+                        size_t *wire_size)
 {
 	uint8_t *rwire = NULL;
 	size_t rsize = 0;
@@ -2001,11 +2011,6 @@ static int ns_xfr_send_and_clear(knot_ns_xfr_t *xfr, int add_tsig)
 	size_t real_size = xfr->wire_size;
 	if (ns_response_to_wire(xfr->response, xfr->wire, &real_size) != 0) {
 		return NS_ERR_SERVFAIL;
-//		// send back SERVFAIL (as this is our problem)
-//		ns_error_response(nameserver,
-//				  knot_wire_get_id(query_wire),
-//				  KNOT_RCODE_SERVFAIL, response_wire,
-//				  rsize);
 	}
 	
 	int res = 0;
@@ -2013,6 +2018,17 @@ static int ns_xfr_send_and_clear(knot_ns_xfr_t *xfr, int add_tsig)
 	size_t digest_real_size = xfr->digest_max_size;
 	
 	dbg_ns_detail("xfr->tsig_key=%p\n", xfr->tsig_key);
+	dbg_ns_detail("xfr->tsig_rcode=%d\n", xfr->tsig_rcode);
+
+	if (xfr->tsig_key) {
+		// add the data to TSIG data
+		assert(KNOT_NS_TSIG_DATA_MAX_SIZE - xfr->tsig_data_size
+		       >= xfr->wire_size);
+		memcpy(xfr->tsig_data + xfr->tsig_data_size,
+		       xfr->wire, real_size);
+		xfr->tsig_data_size += real_size;
+	}
+
 	/*! \note [TSIG] Generate TSIG if required (during XFR/IN). */
 	if (xfr->tsig_key && add_tsig) {
 		if (xfr->packet_nr == 0) {
@@ -2026,7 +2042,8 @@ static int ns_xfr_send_and_clear(knot_ns_xfr_t *xfr, int add_tsig)
 			               xfr->wire_size, xfr->digest, 
 			               xfr->digest_size, xfr->digest, 
 			               &digest_real_size,
-			               xfr->tsig_key);
+			               xfr->tsig_key, xfr->tsig_rcode,
+			               xfr->tsig_prev_time_signed);
 		} else {
 			/* Add key, digest and digest length. */
 			dbg_ns_detail("Calling tsig_sign_next()\n");
@@ -2036,7 +2053,8 @@ static int ns_xfr_send_and_clear(knot_ns_xfr_t *xfr, int add_tsig)
 			                          xfr->digest_size,
 			                          xfr->digest, 
 			                          &digest_real_size,
-			                          xfr->tsig_key);
+			                          xfr->tsig_key, xfr->tsig_data,
+			                          xfr->tsig_data_size);
 		}
 
 		dbg_ns_detail("Sign function returned: %s\n",
@@ -2050,6 +2068,27 @@ static int ns_xfr_send_and_clear(knot_ns_xfr_t *xfr, int add_tsig)
 		assert(digest_real_size > 0);
 		// save the new previous digest size
 		xfr->digest_size = digest_real_size;
+
+		// clear the TSIG data
+		xfr->tsig_data_size = 0;
+
+	} else if (xfr->tsig_rcode != 0) {
+		dbg_ns_detail("Adding TSIG without signing, TSIG RCODE: %d.\n",
+		              xfr->tsig_rcode);
+		assert(xfr->tsig_rcode != KNOT_TSIG_RCODE_BADTIME);
+		// add TSIG without signing
+		assert(xfr->query != NULL);
+		assert(knot_packet_additional_rrset_count(xfr->query) > 0);
+
+		const knot_rrset_t *tsig = knot_packet_additional_rrset(
+			xfr->query,
+			knot_packet_additional_rrset_count(xfr->query) - 1);
+
+		res = knot_tsig_add(xfr->wire, &real_size, xfr->wire_size,
+		                    xfr->tsig_rcode, tsig);
+		if (res != KNOT_EOK) {
+			return res;
+		}
 	}
 
 	// Send the response
@@ -2071,7 +2110,9 @@ static int ns_xfr_send_and_clear(knot_ns_xfr_t *xfr, int add_tsig)
 	
 	// increment the packet number
 	++xfr->packet_nr;
-	if (xfr->tsig_key && add_tsig) {
+	if ((xfr->tsig_key && knot_ns_tsig_required(xfr->packet_nr))
+	     || xfr->tsig_rcode != 0) {
+		/*! \todo Where is xfr->tsig_size set?? */
 		knot_packet_set_tsig_size(xfr->response, xfr->tsig_size);
 	} else {
 		knot_packet_set_tsig_size(xfr->response, 0);
@@ -2312,7 +2353,7 @@ static int ns_ixfr_put_rrset(knot_ns_xfr_t *xfr, const knot_rrset_t *rrset)
 		/*! \todo Probably rename the function. */
 		ns_xfr_send_and_clear(xfr, 1);
 		//socket_close(xfr->session);  /*! \todo Remove for UDP.*/
-		return KNOT_ERROR;
+		return res;
 	}
 
 	return KNOT_EOK;
@@ -2363,38 +2404,9 @@ static int ns_ixfr_from_zone(knot_ns_xfr_t *xfr)
 	assert(xfr->response != NULL);
 	assert(knot_packet_authority_rrset_count(xfr->query) > 0);
 	assert(xfr->data != NULL);
-
-	/*! \todo REMOVE start */
-//	const knot_rrset_t *zone_soa =
-//		knot_node_rrset(knot_zone_contents_apex(
-//		                       knot_zone_contents(xfr->zone)),
-//		                  KNOT_RRTYPE_SOA);
-//	// retrieve origin (xfr) serial and target (zone) serial
-//	uint32_t zone_serial = knot_rdata_soa_serial(
-//	                             knot_rrset_rdata(zone_soa));
-//	uint32_t xfr_serial = knot_rdata_soa_serial(knot_rrset_rdata(
-//			knot_packet_authority_rrset(xfr->query, 0)));
-
-//	// 3) load changesets from journal
-//	knot_changesets_t *chgsets = (knot_changesets_t *)
-//	                               calloc(1, sizeof(knot_changesets_t));
-//	int res = xfr_load_changesets(xfr->zone, chgsets, xfr_serial, 
-//	                              zone_serial);
-//	if (res != KNOT_EOK) {
-//		dbg_ns("IXFR query cannot be answered: %s.\n",
-//		         knot_strerror(res));
-//		/*! \todo Probably send back AXFR instead. */
-//		knot_response_set_rcode(xfr->response, KNOT_RCODE_SERVFAIL);
-//		/*! \todo Probably rename the function. */
-//		ns_axfr_send_and_clear(xfr);
-//		//socket_close(xfr->session);  /*! \todo Remove for UDP. */
-//		return 1;
-//	}
-	
-	/*! \todo REMOVE end */
 	
 	knot_changesets_t *chgsets = (knot_changesets_t *)xfr->data;
-	knot_zone_contents_t* contents = knot_zone_get_contents(xfr->zone);
+	knot_zone_contents_t *contents = knot_zone_get_contents(xfr->zone);
 	assert(contents);
 	const knot_rrset_t *zone_soa =
 		knot_node_rrset(knot_zone_contents_apex(contents),
@@ -2411,15 +2423,15 @@ static int ns_ixfr_from_zone(knot_ns_xfr_t *xfr)
 		/*! \todo Probably rename the function. */
 		ns_xfr_send_and_clear(xfr, 1);
 //		socket_close(xfr->session);  /*! \todo Remove for UDP.*/
-		return 1;
+		return res;
 	}
 
 	// 5) put the changesets into the response while they fit in
 	for (int i = 0; i < chgsets->count; ++i) {
 		res = ns_ixfr_put_changeset(xfr, &chgsets->sets[i]);
 		if (res != KNOT_EOK) {
-			// answer is sent, socket is closed
-			return KNOT_EOK;
+			// answer is sent
+			return res;
 		}
 	}
 
@@ -2431,7 +2443,7 @@ static int ns_ixfr_from_zone(knot_ns_xfr_t *xfr)
 		/*! \todo Probably rename the function. */
 		ns_xfr_send_and_clear(xfr, 1);
 		//socket_close(xfr->session);  /*! \todo Remove for UDP.*/
-		return 1;
+//		return 1;
 	}
 
 	return KNOT_EOK;
@@ -2454,7 +2466,7 @@ static int ns_ixfr(knot_ns_xfr_t *xfr)
 		/*! \todo Probably rename the function. */
 		ns_xfr_send_and_clear(xfr, 1);
 		//socket_close(xfr->session);
-		return 1;
+		return KNOT_EMALF;
 	}
 
 	const knot_rrset_t *soa = knot_packet_authority_rrset(xfr->query, 0);
@@ -2470,7 +2482,7 @@ static int ns_ixfr(knot_ns_xfr_t *xfr)
 		/*! \todo Probably rename the function. */
 		ns_xfr_send_and_clear(xfr, 1);
 		//socket_close(xfr->session);  /*! \todo Remove for UDP. */
-		return 1;
+		return KNOT_EMALF;
 	}
 
 	return ns_ixfr_from_zone(xfr);
@@ -2728,10 +2740,16 @@ void knot_ns_error_response_full(knot_nameserver_t *nameserver,
 
 /*----------------------------------------------------------------------------*/
 
-int knot_ns_answer_normal(knot_nameserver_t *nameserver, knot_packet_t *query,
-                          uint8_t *response_wire, size_t *rsize)
+int knot_ns_prep_normal_response(knot_nameserver_t *nameserver,
+                                 knot_packet_t *query, knot_packet_t **resp,
+                                 const knot_zone_t **zone)
 {
-	dbg_ns("ns_answer_normal()\n");
+	dbg_ns("knot_ns_prep_normal_response()\n");
+
+	if (nameserver == NULL || query == NULL || resp == NULL
+	    || zone == NULL) {
+		return KNOT_EBADARG;
+	}
 
 	// first, parse the rest of the packet
 	assert(knot_packet_is_query(query));
@@ -2743,12 +2761,7 @@ int knot_ns_answer_normal(knot_nameserver_t *nameserver, knot_packet_t *query,
 	if (ret != KNOT_EOK) {
 		dbg_ns("Failed to parse rest of the query: "
 				   "%s.\n", knot_strerror(ret));
-		knot_ns_error_response(nameserver, knot_packet_id(query),
-				       (ret == KNOT_EMALF)
-					  ? KNOT_RCODE_FORMERR
-					  : KNOT_RCODE_SERVFAIL, response_wire,
-		                       rsize);
-		return KNOT_EOK;
+		return ret;
 	}
 
 	/*
@@ -2764,18 +2777,15 @@ int knot_ns_answer_normal(knot_nameserver_t *nameserver, knot_packet_t *query,
 	    || knot_packet_nscount(query) > 0
 	    || knot_packet_qdcount(query) != 1) {
 		dbg_ns("ANCOUNT or NSCOUNT not 0 in query, reply FORMERR.\n");
-		knot_ns_error_response(nameserver, knot_packet_id(query),
-		                       KNOT_RCODE_FORMERR, response_wire,
-		                       rsize);
-		return KNOT_EOK;
+		return KNOT_EMALF;
 	}
 
 	size_t resp_max_size = 0;
-	
-	assert(*rsize >= MAX_UDP_PAYLOAD);
+
+	//assert(*rsize >= MAX_UDP_PAYLOAD);
 
 	knot_packet_dump(query);
-	
+
 	if (knot_query_edns_supported(query)) {
 		if (knot_edns_get_payload(&query->opt_rr) <
 		    knot_edns_get_payload(nameserver->opt_rr)) {
@@ -2785,28 +2795,23 @@ int knot_ns_answer_normal(knot_nameserver_t *nameserver, knot_packet_t *query,
 						nameserver->opt_rr);
 		}
 	}
-	
+
 	if (resp_max_size < MAX_UDP_PAYLOAD) {
 		resp_max_size = MAX_UDP_PAYLOAD;
 	}
-	
-	knot_packet_t *response;
-	ret = knot_ns_prepare_response(nameserver, query, &response, 
+
+	ret = knot_ns_prepare_response(nameserver, query, resp,
 	                               resp_max_size);
 	if (ret != KNOT_EOK) {
-		knot_ns_error_response(nameserver, knot_packet_id(query),
-		                       KNOT_RCODE_SERVFAIL, response_wire,
-		                       rsize);
-		return KNOT_EOK;
+		return KNOT_ERROR;
 	}
 
-	dbg_ns("Query - parsed: %zu, total wire size: %zu\n", 
+	dbg_ns("Query - parsed: %zu, total wire size: %zu\n",
 	              query->parsed, query->size);
-	dbg_ns("Opt RR: version: %d, payload: %d\n", 
+	dbg_ns("Opt RR: version: %d, payload: %d\n",
 	              query->opt_rr.version, query->opt_rr.payload);
 
 	// get the answer for the query
-	rcu_read_lock();
 	knot_zonedb_t *zonedb = rcu_dereference(nameserver->zone_db);
 
 	dbg_ns("EDNS supported in query: %d\n",
@@ -2814,74 +2819,66 @@ int knot_ns_answer_normal(knot_nameserver_t *nameserver, knot_packet_t *query,
 
 	// set the OPT RR to the response
 	if (knot_query_edns_supported(query)) {
-		/*! \todo API. */
-//		if (knot_edns_get_payload(&query->opt_rr) > MAX_UDP_PAYLOAD) {
-//			ret = knot_packet_set_max_size(response, 
-//				knot_edns_get_payload(&query->opt_rr));
-//		} else {
-//			ret = knot_packet_set_max_size(response, 
-//			                               MAX_UDP_PAYLOAD);
-//		}
-		
-//		if (ret != KNOT_EOK) {
-//			dbg_ns("Failed to set max size.\n");
-//			knot_ns_error_response_full(nameserver, response,
-//			                            KNOT_RCODE_SERVFAIL,
-//			                            response_wire, rsize);
-//			return KNOT_EOK;
-//		}
-		
-		ret = knot_response_add_opt(response, nameserver->opt_rr, 1);
+		ret = knot_response_add_opt(*resp, nameserver->opt_rr, 1);
 		if (ret != KNOT_EOK) {
 			dbg_ns("Failed to set OPT RR to the response"
-			                  ": %s\n",knot_strerror(ret));
+			                  ": %s\n", knot_strerror(ret));
 		} else {
 			// copy the DO bit from the query
 			if (knot_query_dnssec_requested(query)) {
 				/*! \todo API for this. */
-				knot_edns_set_do(&response->opt_rr);
+				knot_edns_set_do(&(*resp)->opt_rr);
 			}
 		}
-	}/* else {
-		dbg_ns("Setting max size to %u.\n", MAX_UDP_PAYLOAD);
-		ret = knot_packet_set_max_size(response, MAX_UDP_PAYLOAD);
-		if (ret != KNOT_EOK) {
-			dbg_ns("Failed to set max size to %u\n",
-			              MAX_UDP_PAYLOAD);
-			knot_ns_error_response_full(nameserver, response,
-			                            KNOT_RCODE_SERVFAIL,
-			                            response_wire, rsize);
-			return KNOT_EOK;
-		}
-	}*/
-	
-	dbg_ns("Response max size: %zu\n", response->max_size);
+	}
+
+	dbg_ns("Response max size: %zu\n", (*resp)->max_size);
+
+	const knot_dname_t *qname = knot_packet_qname(*resp);
+	assert(qname != NULL);
+
+	uint16_t qtype = knot_packet_qtype(*resp);
+dbg_ns_exec(
+	char *name_str = knot_dname_to_str(qname);
+	dbg_ns("Trying to find zone for QNAME %s\n", name_str);
+	free(name_str);
+);
+	// find zone in which to search for the name
+	*zone = ns_get_zone_for_qname(zonedb, qname, qtype);
+
+	return KNOT_EOK;
+}
+
+/*----------------------------------------------------------------------------*/
+
+int knot_ns_answer_normal(knot_nameserver_t *nameserver, 
+                          const knot_zone_t *zone, knot_packet_t *resp,
+                          uint8_t *response_wire, size_t *rsize)
+{
+	dbg_ns("ns_answer_normal()\n");
+
+	int ret = ns_answer(zone, resp);
 
-	ret = ns_answer(zonedb, response);
 	if (ret != 0) {
 		// now only one type of error (SERVFAIL), later maybe more
-		knot_ns_error_response_full(nameserver, response,
+		knot_ns_error_response_full(nameserver, resp,
 		                            KNOT_RCODE_SERVFAIL,
 		                            response_wire, rsize);
 	} else {
 		dbg_ns("Created response packet.\n");
 		//knot_response_dump(resp);
-		knot_packet_dump(response);
+		knot_packet_dump(resp);
 
 		// 4) Transform the packet into wire format
-		if (ns_response_to_wire(response, response_wire, rsize) != 0) {
+		if (ns_response_to_wire(resp, response_wire, rsize) != 0) {
 			// send back SERVFAIL (as this is our problem)
-			knot_ns_error_response_full(nameserver, response,
+			knot_ns_error_response_full(nameserver, resp,
 			                            KNOT_RCODE_SERVFAIL,
 			                            response_wire, rsize);
 		}
 	}
 
-	rcu_read_unlock();
-	knot_packet_free(&response);
-
 	dbg_ns("Returning response with wire size %zu\n", *rsize);
-	//dbg_ns_hex((char *)response_wire, *rsize);
 
 	return KNOT_EOK;
 }
@@ -3158,12 +3155,7 @@ int knot_ns_answer_ixfr(knot_nameserver_t *nameserver, knot_ns_xfr_t *xfr)
 	int ret = knot_packet_parse_rest(xfr->query);
 	if (ret != KNOT_EOK) {
 		dbg_ns("Failed to parse rest of the packet. Reply FORMERR.\n");
-//		knot_ns_error_response_full(nameserver, xfr->response,
-//		                            KNOT_RCODE_FORMERR, xfr->wire, 
-//		                            &size);
 		knot_ns_xfr_send_error(nameserver, xfr, KNOT_RCODE_FORMERR);
-
-		//ret = xfr->send(xfr->session, &xfr->addr, xfr->wire, size);
 		knot_packet_free(&xfr->response);
 		return ret;
 	}
@@ -3172,11 +3164,6 @@ int knot_ns_answer_ixfr(knot_nameserver_t *nameserver, knot_ns_xfr_t *xfr)
 	if (knot_zone_contents(xfr->zone) == NULL) {
 		dbg_ns("Zone expired or not bootstrapped. Reply SERVFAIL.\n");
 		ret = knot_ns_xfr_send_error(nameserver, xfr, KNOT_RCODE_SERVFAIL);
-//		knot_ns_error_response_full(nameserver, xfr->response,
-//		                            KNOT_RCODE_SERVFAIL, xfr->wire, 
-//		                            &size);
-
-//		ret = xfr->send(xfr->session, &xfr->addr, xfr->wire, size);
 		knot_packet_free(&xfr->response);
 		return ret;
 	}
@@ -3195,35 +3182,15 @@ int knot_ns_answer_ixfr(knot_nameserver_t *nameserver, knot_ns_xfr_t *xfr)
 	
 	ret = ns_ixfr(xfr);
 
-	/*! \todo Somehow distinguish when it makes sense to send the SERVFAIL
-	 *        and when it does not. E.g. if there was problem in sending
-	 *        packet, it will probably fail when sending the SERVFAIL also.
-	 */
-	if (ret < 0) {
-		dbg_ns("IXFR failed, sending SERVFAIL.\n");
-		// now only one type of error (SERVFAIL), later maybe more
-
-		/*! \todo Extract this to some function. */
-//		knot_response_set_rcode(xfr->response, KNOT_RCODE_SERVFAIL);
-//		uint8_t *wire = NULL;
-//		ret = knot_packet_to_wire(xfr->response, &wire, &size);
-//		if (ret != KNOT_EOK) {
-////			knot_ns_error_response(nameserver, 
-////			                         xfr->query->header.id,
-////			                         KNOT_RCODE_SERVFAIL, xfr->wire, 
-////			                         &size);
-////			ret = xfr->send(xfr->session, &xfr->addr, xfr->wire, 
-////			                size);
-//			knot_ns_xfr_send_error(xfr, KNOT_RCODE_SERVFAIL);
-//			knot_packet_free(&xfr->response);
-//			return ret;
-//		} else {
-//			ret = xfr->send(xfr->session, &xfr->addr, wire, size);
-//		}
-		knot_ns_xfr_send_error(nameserver, xfr, KNOT_RCODE_SERVFAIL);
-	} /*else if (ret > 0) {
-		ret = KNOT_ERROR;
-	}*/
+//	/*! \todo Somehow distinguish when it makes sense to send the SERVFAIL
+//	 *        and when it does not. E.g. if there was problem in sending
+//	 *        packet, it will probably fail when sending the SERVFAIL also.
+//	 */
+//	if (ret < 0) {
+//		dbg_ns("IXFR failed, sending SERVFAIL.\n");
+//		// now only one type of error (SERVFAIL), later maybe more
+//		knot_ns_xfr_send_error(nameserver, xfr, KNOT_RCODE_SERVFAIL);
+//	}
 
 	knot_packet_free(&xfr->response);
 
@@ -3363,16 +3330,11 @@ int knot_ns_process_ixfrin(knot_nameserver_t *nameserver,
 	 *       digest.
 	 */
 
-	int ret = xfrin_process_ixfr_packet(xfr/*xfr->wire, xfr->wire_size,
-	                                   (knot_changesets_t **)(&xfr->data)*/);
+	int ret = xfrin_process_ixfr_packet(xfr);
 	
 	if (ret == XFRIN_RES_FALLBACK) {
 		dbg_ns("ns_process_ixfrin: Fallback to AXFR.\n");
-		assert(xfr->data == NULL);
-//		dbg_ns("xfr->zone = %p\n", xfr->zone);
-//		dbg_ns("Zone name: %.*s\n", 
-//		              xfr->zone->name->size, xfr->zone->name->name);
-//		assert(xfr->zone == NULL);
+		knot_free_changesets((knot_changesets_t **)&xfr->data);
 		knot_packet_free(&xfr->query);
 		return KNOT_ENOIXFR;
 	}
@@ -3417,12 +3379,24 @@ int knot_ns_process_ixfrin(knot_nameserver_t *nameserver,
 				return KNOT_ERROR;
 			}
 			
-			if (knot_rdata_soa_serial(knot_rrset_rdata(
-			        chgsets->first_soa))
-			    != knot_rdata_soa_serial(knot_rrset_rdata(
-			        zone_soa))) {
-				dbg_ns("Update did not fit.\n");
-				return KNOT_EAGAIN;
+			if (ns_serial_compare(knot_rdata_soa_serial(
+			      knot_rrset_rdata(chgsets->first_soa)),
+			      knot_rdata_soa_serial(knot_rrset_rdata(zone_soa)))
+			    > 0) {
+				if ((xfr->flags & XFR_FLAG_UDP) > 0) {
+					// IXFR over UDP
+					dbg_ns("Update did not fit.\n");
+					return KNOT_EIXFRSPACE;
+				} else {
+					// fallback to AXFR
+					dbg_ns("ns_process_ixfrin: "
+					       "Fallback to AXFR.\n");
+					knot_free_changesets(
+					      (knot_changesets_t **)&xfr->data);
+					knot_packet_free(&xfr->query);
+					return KNOT_ENOIXFR;
+				}
+
 			} else {
 				// free changesets
 				dbg_ns("No update needed.\n");
diff --git a/src/libknot/nameserver/name-server.h b/src/libknot/nameserver/name-server.h
index 0d93df6..928d79c 100644
--- a/src/libknot/nameserver/name-server.h
+++ b/src/libknot/nameserver/name-server.h
@@ -118,6 +118,9 @@ typedef struct knot_ns_xfr {
 	uint8_t *digest;     /*!< Buffer for counting digest. */
 	size_t digest_size;  /*!< Size of the digest. */
 	size_t digest_max_size; /*!< Size of the buffer. */
+
+	uint16_t tsig_rcode;
+	uint64_t tsig_prev_time_signed;
 	
 	/*! \brief Previous digest or request digest. 
 	 *
@@ -219,6 +222,14 @@ int knot_ns_parse_packet(const uint8_t *query_wire, size_t qsize,
 void knot_ns_error_response(const knot_nameserver_t *nameserver, uint16_t query_id,
                        uint8_t rcode, uint8_t *response_wire, size_t *rsize);
 
+void knot_ns_error_response_full(knot_nameserver_t *nameserver,
+                                 knot_packet_t *response, uint8_t rcode,
+                                 uint8_t *response_wire, size_t *rsize);
+
+int knot_ns_prep_normal_response(knot_nameserver_t *nameserver,
+                                 knot_packet_t *query, knot_packet_t **resp,
+                                 const knot_zone_t **zone);
+
 /*!
  * \brief Creates a response for the given normal query using the data of the
  *        nameserver.
@@ -232,8 +243,9 @@ void knot_ns_error_response(const knot_nameserver_t *nameserver, uint16_t query_
  * \retval KNOT_EOK if a valid response was created.
  * \retval KNOT_EMALF if an error occured and the response is not valid.
  */
-int knot_ns_answer_normal(knot_nameserver_t *nameserver, knot_packet_t *query,
-                     uint8_t *response_wire, size_t *rsize);
+int knot_ns_answer_normal(knot_nameserver_t *nameserver, 
+                          const knot_zone_t *zone, knot_packet_t *resp,
+                          uint8_t *response_wire, size_t *rsize);
 
 int knot_ns_init_xfr(knot_nameserver_t *nameserver, knot_ns_xfr_t *xfr);
 
@@ -346,6 +358,20 @@ void knot_ns_set_data(knot_nameserver_t *nameserver, void *data);
 int knot_ns_tsig_required(int packet_nr);
 
 /*!
+ * \brief Converts the response to wire format.
+ *
+ * \param resp Response to convert.
+ * \param wire Place for the wire format of the response.
+ * \param wire_size In: space available for the wire format in bytes.
+ *                  Out: actual size of the wire format in bytes.
+ *
+ * \retval KNOT_EOK
+ * \retval NS_ERR_SERVFAIL
+ */
+int ns_response_to_wire(knot_packet_t *resp, uint8_t *wire,
+                        size_t *wire_size);
+
+/*!
  * \brief Properly destroys the name server structure.
  *
  * \param nameserver Nameserver to destroy.
diff --git a/src/libknot/packet/packet.c b/src/libknot/packet/packet.c
index 82e818f..59c1a0d 100644
--- a/src/libknot/packet/packet.c
+++ b/src/libknot/packet/packet.c
@@ -1159,6 +1159,20 @@ void knot_packet_set_tsig_size(knot_packet_t *packet, size_t tsig_size)
 
 /*----------------------------------------------------------------------------*/
 
+const knot_rrset_t *knot_packet_tsig(const knot_packet_t *packet)
+{
+	return packet->tsig_rr;
+}
+
+/*----------------------------------------------------------------------------*/
+
+void knot_packet_set_tsig(knot_packet_t *packet, const knot_rrset_t *tsig_rr)
+{
+    packet->tsig_rr = (knot_rrset_t *)tsig_rr;
+}
+
+/*----------------------------------------------------------------------------*/
+
 short knot_packet_answer_rrset_count(const knot_packet_t *packet)
 {
 	if (packet == NULL) {
@@ -1217,7 +1231,7 @@ const knot_rrset_t *knot_packet_authority_rrset(
 /*----------------------------------------------------------------------------*/
 
 const knot_rrset_t *knot_packet_additional_rrset(
-	knot_packet_t *packet, short pos)
+    knot_packet_t *packet, short pos)
 {
 	if (packet == NULL || pos > packet->ar_rrsets) {
 		return NULL;
diff --git a/src/libknot/packet/packet.h b/src/libknot/packet/packet.h
index 1bf74a9..81b1812 100644
--- a/src/libknot/packet/packet.h
+++ b/src/libknot/packet/packet.h
@@ -143,6 +143,7 @@ struct knot_packet {
 	knot_packet_prealloc_type_t prealloc_type;
 	
 	size_t tsig_size;	/*!< Space to reserve for the TSIG RR. */
+	knot_rrset_t *tsig_rr;  /*!< TSIG RR stored in the packet. */
 };
 
 typedef struct knot_packet knot_packet_t;
@@ -378,6 +379,10 @@ int knot_packet_arcount(const knot_packet_t *packet);
 
 void knot_packet_set_tsig_size(knot_packet_t *packet, size_t tsig_size);
 
+const knot_rrset_t *knot_packet_tsig(const knot_packet_t *packet);
+
+void knot_packet_set_tsig(knot_packet_t *packet, const knot_rrset_t *tsig_rr);
+
 /*!
  * \brief Returns number of RRSets in Answer section of the packet.
  *
@@ -439,7 +444,7 @@ const knot_rrset_t *knot_packet_authority_rrset(
  *         or NULL if there is no such RRSet.
  */
 const knot_rrset_t *knot_packet_additional_rrset(
-	knot_packet_t *packet, short pos);
+    knot_packet_t *packet, short pos);
 
 /*!
  * \brief Checks if the packet already contains the given RRSet.
diff --git a/src/libknot/rdata.c b/src/libknot/rdata.c
index 0c51f5b..27fa6ec 100644
--- a/src/libknot/rdata.c
+++ b/src/libknot/rdata.c
@@ -828,6 +828,22 @@ uint32_t knot_rdata_soa_expire(const knot_rdata_t *rdata)
 
 /*---------------------------------------------------------------------------*/
 
+uint32_t knot_rdata_soa_minimum(const knot_rdata_t *rdata)
+{
+	if (!rdata) {
+		return -1;
+	}
+
+	if (rdata->count < 7) {
+		return 0;	/*! \todo Some other error value. */
+	}
+
+	// the number is in network byte order, transform it
+	return knot_wire_read_u32((uint8_t *)(rdata->items[6].raw_data + 1));
+}
+
+/*---------------------------------------------------------------------------*/
+
 uint16_t knot_rdata_rrsig_type_covered(const knot_rdata_t *rdata)
 {
 	if (rdata->count < 1) {
diff --git a/src/libknot/rdata.h b/src/libknot/rdata.h
index 5d328c9..6d9907d 100644
--- a/src/libknot/rdata.h
+++ b/src/libknot/rdata.h
@@ -331,6 +331,7 @@ int64_t knot_rdata_soa_serial(const knot_rdata_t *rdata);
 uint32_t knot_rdata_soa_refresh(const knot_rdata_t *rdata);
 uint32_t knot_rdata_soa_retry(const knot_rdata_t *rdata);
 uint32_t knot_rdata_soa_expire(const knot_rdata_t *rdata);
+uint32_t knot_rdata_soa_minimum(const knot_rdata_t *rdata);
 
 uint16_t knot_rdata_rrsig_type_covered(const knot_rdata_t *rdata);
 
diff --git a/src/libknot/rrset.c b/src/libknot/rrset.c
index 6083f77..f037716 100644
--- a/src/libknot/rrset.c
+++ b/src/libknot/rrset.c
@@ -24,6 +24,7 @@
 #include "rrset.h"
 #include "util/descriptor.h"
 #include "util/error.h"
+#include "util/debug.h"
 #include "util/utils.h"
 
 /*----------------------------------------------------------------------------*/
@@ -211,6 +212,15 @@ void knot_rrset_set_owner(knot_rrset_t *rrset, knot_dname_t* owner)
 
 /*----------------------------------------------------------------------------*/
 
+void knot_rrset_set_ttl(knot_rrset_t *rrset, uint32_t ttl)
+{
+	if (rrset) {
+		rrset->ttl = ttl;
+	}
+}
+
+/*----------------------------------------------------------------------------*/
+
 uint16_t knot_rrset_type(const knot_rrset_t *rrset)
 {
 	return rrset->type;
@@ -385,7 +395,7 @@ static int knot_rrset_rr_to_wire(const knot_rrset_t *rrset,
 	assert(pos != NULL);
 	assert(*pos != NULL);
 	
-	fprintf(stderr, "Max size: %zu, owner: %p, owner size: %d\n",
+	dbg_rrset_detail("Max size: %zu, owner: %p, owner size: %d\n",
 	        max_size, rrset->owner, rrset->owner->size);
 
 	// check if owner fits
@@ -398,21 +408,21 @@ static int knot_rrset_rr_to_wire(const knot_rrset_t *rrset,
 	*pos += knot_dname_size(rrset->owner);
 	size += knot_dname_size(rrset->owner);
 	
-	fprintf(stderr, "Max size: %zu, size: %d\n", max_size, size);
+	dbg_rrset_detail("Max size: %zu, size: %d\n", max_size, size);
 
-	fprintf(stderr, "Wire format:\n");
+	dbg_rrset_detail("Wire format:\n");
 
 	// put rest of RR 'header'
 	knot_wire_write_u16(*pos, rrset->type);
-	fprintf(stderr, "  Type: %u\n", rrset->type);
+	dbg_rrset_detail("  Type: %u\n", rrset->type);
 	*pos += 2;
 
 	knot_wire_write_u16(*pos, rrset->rclass);
-	fprintf(stderr, "  Class: %u\n", rrset->rclass);
+	dbg_rrset_detail("  Class: %u\n", rrset->rclass);
 	*pos += 2;
 
 	knot_wire_write_u32(*pos, rrset->ttl);
-	fprintf(stderr, "  TTL: %u\n", rrset->ttl);
+	dbg_rrset_detail("  TTL: %u\n", rrset->ttl);
 	*pos += 4;
 
 	// save space for RDLENGTH
@@ -422,7 +432,7 @@ static int knot_rrset_rr_to_wire(const knot_rrset_t *rrset,
 	size += 10;
 //	compr->wire_pos += size;
 	
-	fprintf(stderr, "Max size: %zu, size: %d\n", max_size, size);
+	dbg_rrset_detail("Max size: %zu, size: %d\n", max_size, size);
 
 	knot_rrtype_descriptor_t *desc =
 		knot_rrtype_descriptor_by_type(rrset->type);
@@ -447,8 +457,9 @@ static int knot_rrset_rr_to_wire(const knot_rrset_t *rrset,
 			// save whole domain name
 			memcpy(*pos, knot_dname_name(dname), 
 			       knot_dname_size(dname));
-			fprintf(stderr, "Uncompressed dname size: %d\n",
-			        knot_dname_size(dname));
+			dbg_rrset_detail(stderr,
+			                 "Uncompressed dname size: %d\n",
+			                 knot_dname_size(dname));
 			*pos += knot_dname_size(dname);
 			rdlength += knot_dname_size(dname);
 //			compr->wire_pos += dname->size;
@@ -464,7 +475,7 @@ static int knot_rrset_rr_to_wire(const knot_rrset_t *rrset,
 
 			// copy just the rdata item data (without size)
 			memcpy(*pos, raw_data + 1, raw_data[0]);
-			fprintf(stderr, "Raw data size: %d\n", raw_data[0]);
+			dbg_rrset_detail("Raw data size: %d\n", raw_data[0]);
 			*pos += raw_data[0];
 			rdlength += raw_data[0];
 //			compr->wire_pos += raw_data[0];
@@ -473,7 +484,7 @@ static int knot_rrset_rr_to_wire(const knot_rrset_t *rrset,
 		}
 	}
 	
-	fprintf(stderr, "Max size: %zu, size: %d\n", max_size, size);
+	dbg_rrset_detail("Max size: %zu, size: %d\n", max_size, size);
 
 	assert(size + rdlength <= max_size);
 	size += rdlength;
@@ -509,11 +520,11 @@ int knot_rrset_to_wire(const knot_rrset_t *rrset, uint8_t *wire, size_t *size,
 		if (ret < 0) {
 			// some RR didn't fit in, so no RRs should be used
 			// TODO: remove last entries from compression table
-			fprintf(stderr, "Some RR didn't fit in.\n");
+			dbg_rrset_detail("Some RR didn't fit in.\n");
 			return KNOT_ESPACE;
 		}
 
-		fprintf(stderr, "RR of size %d added.\n", ret);
+		dbg_rrset_detail("RR of size %d added.\n", ret);
 		rrset_size += ret;
 		++rrs;
 	} while ((rdata = knot_rrset_rdata_next(rrset, rdata)) != NULL);
@@ -523,7 +534,7 @@ int knot_rrset_to_wire(const knot_rrset_t *rrset, uint8_t *wire, size_t *size,
 	assert(pos - wire == rrset_size);
 	*size = rrset_size;
 
-	fprintf(stderr, "  Size after: %zu\n", *size);
+	dbg_rrset_detail("Size after: %zu\n", *size);
 
 	*rr_count = rrs;
 
diff --git a/src/libknot/rrset.h b/src/libknot/rrset.h
index 7754c7f..e13cbba 100644
--- a/src/libknot/rrset.h
+++ b/src/libknot/rrset.h
@@ -146,6 +146,8 @@ knot_dname_t *knot_rrset_get_owner(const knot_rrset_t *rrset);
  */
 void knot_rrset_set_owner(knot_rrset_t *rrset, knot_dname_t* owner);
 
+void knot_rrset_set_ttl(knot_rrset_t *rrset, uint32_t ttl);
+
 /*!
  * \brief Returns the TYPE of the RRSet.
  *
diff --git a/src/libknot/tsig-op.c b/src/libknot/tsig-op.c
index 3178a23..edc68d8 100644
--- a/src/libknot/tsig-op.c
+++ b/src/libknot/tsig-op.c
@@ -25,305 +25,10 @@
 #include "tsig.h"
 #include "tsig-op.h"
 #include "util/wire.h"
+#include "libknot/util/conv.h"
 #include "util/error.h"
 #include "util/debug.h"
-
-
-static const char Base64[] =
-	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-static const char Pad64 = '=';
-
-
-static int b64rmap_initialized = 0;
-static uint8_t b64rmap[256];
-
-static const uint8_t b64rmap_special = 0xf0;
-static const uint8_t b64rmap_end = 0xfd;
-static const uint8_t b64rmap_space = 0xfe;
-static const uint8_t b64rmap_invalid = 0xff;
-
-/**
- * Initializing the reverse map is not thread safe.
- * Which is fine for NSD. For now...
- **/
-void b64_initialize_rmap()
-{
-	int i;
-	char ch;
-
-	/* Null: end of string, stop parsing */
-	b64rmap[0] = b64rmap_end;
-
-	for (i = 1; i < 256; ++i) {
-		ch = (char)i;
-		/* Whitespaces */
-		if (isspace(ch)) {
-			b64rmap[i] = b64rmap_space;
-		}
-		/* Padding: stop parsing */
-		else if (ch == Pad64) {
-			b64rmap[i] = b64rmap_end;
-		}
-		/* Non-base64 char */
-		else {
-			b64rmap[i] = b64rmap_invalid;
-		}
-	}
-
-	/* Fill reverse mapping for base64 chars */
-	for (i = 0; Base64[i] != '\0'; ++i) {
-		b64rmap[(uint8_t)Base64[i]] = i;
-	}
-
-	b64rmap_initialized = 1;
-}
-
-int b64_pton_do(char const *src, uint8_t *target, size_t targsize)
-{
-	int tarindex, state, ch;
-	uint8_t ofs;
-
-	state = 0;
-	tarindex = 0;
-
-	while (1) {
-		ch = *src++;
-		ofs = b64rmap[ch];
-
-		if (ofs >= b64rmap_special) {
-			/* Ignore whitespaces */
-			if (ofs == b64rmap_space) {
-				continue;
-			}
-			/* End of base64 characters */
-			if (ofs == b64rmap_end) {
-				break;
-			}
-			/* A non-base64 character. */
-			return (-1);
-		}
-
-		switch (state) {
-		case 0:
-			if ((size_t)tarindex >= targsize) {
-				return (-1);
-			}
-			target[tarindex] = ofs << 2;
-			state = 1;
-			break;
-		case 1:
-			if ((size_t)tarindex + 1 >= targsize) {
-				return (-1);
-			}
-			target[tarindex]   |=  ofs >> 4;
-			target[tarindex+1]  = (ofs & 0x0f)
-					      << 4 ;
-			tarindex++;
-			state = 2;
-			break;
-		case 2:
-			if ((size_t)tarindex + 1 >= targsize) {
-				return (-1);
-			}
-			target[tarindex]   |=  ofs >> 2;
-			target[tarindex+1]  = (ofs & 0x03)
-					      << 6;
-			tarindex++;
-			state = 3;
-			break;
-		case 3:
-			if ((size_t)tarindex >= targsize) {
-				return (-1);
-			}
-			target[tarindex] |= ofs;
-			tarindex++;
-			state = 0;
-			break;
-		default:
-			abort();
-		}
-	}
-
-	/*
-	 * We are done decoding Base-64 chars.  Let's see if we ended
-	 * on a byte boundary, and/or with erroneous trailing characters.
-	 */
-
-	if (ch == Pad64) {		/* We got a pad char. */
-		ch = *src++;		/* Skip it, get next. */
-		switch (state) {
-		case 0:		/* Invalid = in first position */
-		case 1:		/* Invalid = in second position */
-			return (-1);
-
-		case 2:		/* Valid, means one byte of info */
-			/* Skip any number of spaces. */
-			for ((void)NULL; ch != '\0'; ch = *src++)
-				if (b64rmap[ch] != b64rmap_space) {
-					break;
-				}
-			/* Make sure there is another trailing = sign. */
-			if (ch != Pad64) {
-				return (-1);
-			}
-			ch = *src++;		/* Skip the = */
-			/* Fall through to "single trailing =" case. */
-			/* FALLTHROUGH */
-
-		case 3:		/* Valid, means two bytes of info */
-			/*
-			 * We know this char is an =.  Is there anything but
-			 * whitespace after it?
-			 */
-			for ((void)NULL; ch != '\0'; ch = *src++)
-				if (b64rmap[ch] != b64rmap_space) {
-					return (-1);
-				}
-
-			/*
-			 * Now make sure for cases 2 and 3 that the "extra"
-			 * bits that slopped past the last full byte were
-			 * zeros.  If we don't check them, they become a
-			 * subliminal channel.
-			 */
-			if (target[tarindex] != 0) {
-				return (-1);
-			}
-		}
-	} else {
-		/*
-		 * We ended by seeing the end of the string.  Make sure we
-		 * have no partial bytes lying around.
-		 */
-		if (state != 0) {
-			return (-1);
-		}
-	}
-
-	return (tarindex);
-}
-
-
-int b64_pton_len(char const *src)
-{
-	int tarindex, state, ch;
-	uint8_t ofs;
-
-	state = 0;
-	tarindex = 0;
-
-	while (1) {
-		ch = *src++;
-		ofs = b64rmap[ch];
-
-		if (ofs >= b64rmap_special) {
-			/* Ignore whitespaces */
-			if (ofs == b64rmap_space) {
-				continue;
-			}
-			/* End of base64 characters */
-			if (ofs == b64rmap_end) {
-				break;
-			}
-			/* A non-base64 character. */
-			return (-1);
-		}
-
-		switch (state) {
-		case 0:
-			state = 1;
-			break;
-		case 1:
-			tarindex++;
-			state = 2;
-			break;
-		case 2:
-			tarindex++;
-			state = 3;
-			break;
-		case 3:
-			tarindex++;
-			state = 0;
-			break;
-		default:
-			abort();
-		}
-	}
-
-	/*
-	 * We are done decoding Base-64 chars.  Let's see if we ended
-	 * on a byte boundary, and/or with erroneous trailing characters.
-	 */
-
-	if (ch == Pad64) {		/* We got a pad char. */
-		ch = *src++;		/* Skip it, get next. */
-		switch (state) {
-		case 0:		/* Invalid = in first position */
-		case 1:		/* Invalid = in second position */
-			return (-1);
-
-		case 2:		/* Valid, means one byte of info */
-			/* Skip any number of spaces. */
-			for ((void)NULL; ch != '\0'; ch = *src++)
-				if (b64rmap[ch] != b64rmap_space) {
-					break;
-				}
-			/* Make sure there is another trailing = sign. */
-			if (ch != Pad64) {
-				return (-1);
-			}
-			ch = *src++;		/* Skip the = */
-			/* Fall through to "single trailing =" case. */
-			/* FALLTHROUGH */
-
-		case 3:		/* Valid, means two bytes of info */
-			/*
-			 * We know this char is an =.  Is there anything but
-			 * whitespace after it?
-			 */
-			for ((void)NULL; ch != '\0'; ch = *src++)
-				if (b64rmap[ch] != b64rmap_space) {
-					return (-1);
-				}
-
-		}
-	} else {
-		/*
-		 * We ended by seeing the end of the string.  Make sure we
-		 * have no partial bytes lying around.
-		 */
-		if (state != 0) {
-			return (-1);
-		}
-	}
-
-	return (tarindex);
-}
-
-int b64_pton(char const *src, uint8_t *target, size_t targsize)
-{
-	if (!b64rmap_initialized) {
-		b64_initialize_rmap();
-	}
-
-	if (target) {
-		return b64_pton_do(src, target, targsize);
-	} else {
-		return b64_pton_len(src);
-	}
-}
-
-#define	B64BUFSIZE	65535	/*!< Buffer size for b64 conversion. */
-
-
-
-
-
-
-
-
-
-
+#include "consts.h"
 
 
 const int KNOT_TSIG_MAX_DIGEST_SIZE = 64;    // size of HMAC-SHA512 digest
@@ -354,7 +59,7 @@ static int knot_tsig_check_key(const knot_rrset_t *tsig_rr,
 		return KNOT_EMALF;
 	}
 
-	const char *name = knot_dname_to_str(tsig_name);
+	char *name = knot_dname_to_str(tsig_name);
 	if (!name) {
 		return KNOT_EMALF;
 	}
@@ -362,9 +67,11 @@ static int knot_tsig_check_key(const knot_rrset_t *tsig_rr,
 	if (knot_dname_compare(tsig_name, tsig_key->name) != 0) {
 		/*!< \todo which error. */
 		dbg_tsig("TSIG: unknown key: %s\n", name);
+		free(name);
 		return KNOT_TSIG_EBADKEY;
 	}
 
+	free(name);
 	return KNOT_EOK;
 }
 
@@ -402,15 +109,15 @@ static int knot_tsig_compute_digest(const uint8_t *wire, size_t wire_len,
 					B64BUFSIZE);
 	if (decoded_key_size < 0) {
 		dbg_tsig("TSIG: Could not decode Base64\n");
-		return KNOT_EMALF;
+		return KNOT_ERROR;
 	}
 
-	dbg_tsig("TSIG: decoded key size: %d\n", decoded_key_size);
-	dbg_tsig("TSIG: decoded key: '%*s'\n", decoded_key_size, decoded_key);
-
-	dbg_tsig("TSIG: using this wire for digest calculation\n");
+	dbg_tsig_detail("TSIG: decoded key size: %d\n", decoded_key_size);
+	dbg_tsig_detail("TSIG: decoded key: '%*s'\n", decoded_key_size, decoded_key);
 
-	//dbg_tsig_hex(wire, wire_len);
+//	dbg_tsig_detail("TSIG: using this wire for digest calculation\n");
+//	dbg_tsig_hex_detail(wire, wire_len);
+	dbg_tsig_detail("Wire for signing is %zu bytes long.\n", wire_len);
 
 	/* Compute digest. */
 	HMAC_CTX ctx;
@@ -420,6 +127,14 @@ static int knot_tsig_compute_digest(const uint8_t *wire, size_t wire_len,
 			HMAC_Init(&ctx, decoded_key,
 			          decoded_key_size, EVP_md5());
 			break;
+		case KNOT_TSIG_ALG_HMAC_SHA1:
+			HMAC_Init(&ctx, decoded_key,
+			          decoded_key_size, EVP_sha1());
+			break;
+		case KNOT_TSIG_ALG_HMAC_SHA256:
+			HMAC_Init(&ctx, decoded_key,
+			          decoded_key_size, EVP_sha256());
+			break;
 		default:
 			return KNOT_ENOTSUP;
 	} /* switch */
@@ -428,11 +143,14 @@ static int knot_tsig_compute_digest(const uint8_t *wire, size_t wire_len,
 	HMAC_Update(&ctx, (const unsigned char *)wire, wire_len);
 	HMAC_Final(&ctx, digest, &tmp_dig_len);
 	*digest_len = tmp_dig_len;
+	
+	HMAC_CTX_cleanup(&ctx);
 
 	return KNOT_EOK;
 }
 
-static int knot_tsig_check_time_signed(const knot_rrset_t *tsig_rr)
+static int knot_tsig_check_time_signed(const knot_rrset_t *tsig_rr,
+                                       uint64_t prev_time_signed)
 {
 	if (!tsig_rr) {
 		return KNOT_EBADARG;
@@ -452,7 +170,15 @@ static int knot_tsig_check_time_signed(const knot_rrset_t *tsig_rr)
 	time_t curr_time = time(NULL);
 
 	/*!< \todo bleeding eyes. */
-	if (difftime(curr_time, (time_t)time_signed) > fudge) {
+	double diff = difftime(curr_time, (time_t)time_signed);
+
+	if (diff > fudge || diff < -fudge) {
+		return KNOT_TSIG_EBADTIME;
+	}
+
+	diff = difftime((time_t)time_signed, prev_time_signed);
+
+	if (diff < 0) {
 		return KNOT_TSIG_EBADTIME;
 	}
 
@@ -569,7 +295,7 @@ static int knot_tsig_wire_write_timers(uint8_t *wire,
 	return KNOT_EOK;
 }
 
-int knot_tsig_create_sign_wire(const uint8_t *msg, size_t msg_len,
+static int knot_tsig_create_sign_wire(const uint8_t *msg, size_t msg_len,
 				      /*size_t msg_max_len, */const uint8_t *request_mac,
 		                      size_t request_mac_len,
 		                      uint8_t *digest, size_t *digest_len,
@@ -635,6 +361,7 @@ int knot_tsig_create_sign_wire(const uint8_t *msg, size_t msg_len,
 	if (ret != KNOT_EOK) {
 		dbg_tsig("TSIG: create wire: failed to write TSIG "
 		         "variables: %s\n", knot_strerror(ret));
+		free(wire);
 		return ret;
 	}
 
@@ -645,6 +372,7 @@ int knot_tsig_create_sign_wire(const uint8_t *msg, size_t msg_len,
 		dbg_tsig("TSIG: create wire: failed to compute digest: %s\n",
 		         knot_strerror(ret));
 		*digest_len = 0;
+		free(wire);
 		return ret;
 	}
 
@@ -666,11 +394,11 @@ int knot_tsig_create_sign_wire(const uint8_t *msg, size_t msg_len,
 }
 
 static int knot_tsig_create_sign_wire_next(const uint8_t *msg, size_t msg_len,
-				      const uint8_t *prev_mac,
-		                      size_t prev_mac_len,
-		                      uint8_t *digest, size_t *digest_len,
-				      const knot_rrset_t *tmp_tsig,
-		                      const knot_key_t *key)
+                                           const uint8_t *prev_mac,
+                                           size_t prev_mac_len,
+                                           uint8_t *digest, size_t *digest_len,
+                                           const knot_rrset_t *tmp_tsig,
+                                           const knot_key_t *key)
 {
 	if (!msg || !key || digest_len == NULL) {
 		dbg_tsig("TSIG: create wire: bad args.\n");
@@ -689,7 +417,7 @@ static int knot_tsig_create_sign_wire_next(const uint8_t *msg, size_t msg_len,
 	         tsig_rdata_tsig_timers_length());
 	size_t wire_len = sizeof(uint8_t) *
 	                (msg_len + prev_mac_len +
-			tsig_rdata_tsig_timers_length());
+			tsig_rdata_tsig_timers_length() + 2);
 	uint8_t *wire = malloc(wire_len);
 	if (!wire) {
 		ERR_ALLOC_FAILED;
@@ -699,19 +427,21 @@ static int knot_tsig_create_sign_wire_next(const uint8_t *msg, size_t msg_len,
 	memset(wire, 0, wire_len);
 
 	/* Copy the request MAC - should work even if NULL. */
+	dbg_tsig("Copying request mac size.\n");
+	knot_wire_write_u16(wire, prev_mac_len);
 	dbg_tsig("Copying request mac.\n");
-	memcpy(wire, prev_mac, sizeof(uint8_t) * prev_mac_len);
+	memcpy(wire + 2, prev_mac, sizeof(uint8_t) * prev_mac_len);
 	dbg_tsig_detail("TSIG: create wire: request mac: ");
-	dbg_tsig_hex_detail(wire, prev_mac_len);
+	dbg_tsig_hex_detail(wire + 2, prev_mac_len);
 	/* Copy the original message. */
 	dbg_tsig("Copying original message.\n");
-	memcpy(wire + prev_mac_len, msg, msg_len);
+	memcpy(wire + prev_mac_len + 2, msg, msg_len);
 	dbg_tsig_detail("TSIG: create wire: original message: \n");
 	//dbg_tsig_hex_detail(wire + prev_mac_len, msg_len);
 	/* Copy TSIG variables. */
 	
 	dbg_tsig("Writing TSIG timers.\n");
-	ret = knot_tsig_write_tsig_timers(wire + prev_mac_len + msg_len, 
+	ret = knot_tsig_write_tsig_timers(wire + prev_mac_len + msg_len + 2, 
 	                                  tmp_tsig);
 //	ret = knot_tsig_write_tsig_variables(wire + prev_mac_len + msg_len,
 //	                                     tmp_tsig);
@@ -740,7 +470,8 @@ int knot_tsig_sign(uint8_t *msg, size_t *msg_len,
                    size_t msg_max_len, const uint8_t *request_mac,
                    size_t request_mac_len,
                    uint8_t *digest, size_t *digest_len,
-                   const knot_key_t *key)
+                   const knot_key_t *key, uint16_t tsig_rcode,
+                   uint64_t request_time_signed)
 {
 	if (!msg || !msg_len || !key || digest == NULL || digest_len == NULL) {
 		return KNOT_EBADARG;
@@ -755,6 +486,8 @@ int knot_tsig_sign(uint8_t *msg, size_t *msg_len,
 	knot_rrset_t *tmp_tsig =
 		knot_rrset_new(key_name_copy,
 			       KNOT_RRTYPE_TSIG, KNOT_CLASS_ANY, 0);
+	/* Should be retained by rrsig or freed, release. */
+	knot_dname_release(key_name_copy);
 	if (!tmp_tsig) {
 		dbg_tsig_detail("TSIG: tmp_tsig = NULL\n");
 		return KNOT_ENOMEM;
@@ -764,6 +497,7 @@ int knot_tsig_sign(uint8_t *msg, size_t *msg_len,
 	knot_rdata_t *rdata = knot_rdata_new();
 	if (!rdata) {
 		dbg_tsig_detail("TSIG: rdata = NULL\n");
+		knot_rrset_free(&tmp_tsig);
 		return KNOT_ENOMEM;
 	}
 
@@ -779,6 +513,8 @@ int knot_tsig_sign(uint8_t *msg, size_t *msg_len,
 	if (!items) {
 		dbg_tsig_detail("TSIG: items = NULL\n");
 		ERR_ALLOC_FAILED;
+		knot_rrset_free(&tmp_tsig);
+		knot_rdata_free(&rdata);
 		return KNOT_ENOMEM;
 	}
 
@@ -787,23 +523,42 @@ int knot_tsig_sign(uint8_t *msg, size_t *msg_len,
 	int ret = knot_rdata_set_items(rdata, items, desc->length);
 	if (ret != KNOT_EOK) {
 		dbg_tsig_detail("TSIG: rdata_set_items returned %s\n", knot_strerror(ret));
+		free(items);
+		knot_rrset_free(&tmp_tsig);
+		knot_rdata_free(&rdata);
 		return ret;
 	}
 	free(items);
 
 	tsig_rdata_set_alg(tmp_tsig, key->algorithm);
-	tsig_rdata_store_current_time(tmp_tsig);
-	tsig_rdata_set_fudge(tmp_tsig, 300);
 
-	/* Set original ID */
-	tsig_rdata_set_orig_id(tmp_tsig, knot_wire_get_id(msg));
+	/* Distinguish BADTIME response. */
+	if (tsig_rcode == KNOT_TSIG_RCODE_BADTIME) {
+		/* Set error */
+		tsig_rdata_set_tsig_error(tmp_tsig, tsig_rcode);
+		/* Set client's time signed into the time signed field. */
+		tsig_rdata_set_time_signed(tmp_tsig, request_time_signed);
 
-	/* Set error */
-	/*! \todo [TSIG] Set error and other data if appropriate. */
-	tsig_rdata_set_tsig_error(tmp_tsig, 0);
+		/* Store current time into Other data. */
+		uint8_t time_signed[3];
+		time_t curr_time = time(NULL);
 
-	/* Set other len. */
-	tsig_rdata_set_other_data(tmp_tsig, 0, 0);
+		/*! \todo bleeding eyes. */
+		knot_wire_write_u48(time_signed, (uint64_t)curr_time);
+
+		tsig_rdata_set_other_data(tmp_tsig, 6, time_signed);
+	} else {
+		tsig_rdata_store_current_time(tmp_tsig);
+		tsig_rdata_set_tsig_error(tmp_tsig, 0);
+
+		/* Set other len. */
+		tsig_rdata_set_other_data(tmp_tsig, 0, 0);
+	}
+
+	tsig_rdata_set_fudge(tmp_tsig, 300);   /*! \todo Bleeding eyes :-) */
+
+	/* Set original ID */
+	tsig_rdata_set_orig_id(tmp_tsig, knot_wire_get_id(msg));
 
 	uint8_t digest_tmp[KNOT_TSIG_MAX_DIGEST_SIZE];
 	size_t digest_tmp_len = 0;
@@ -818,6 +573,10 @@ int knot_tsig_sign(uint8_t *msg, size_t *msg_len,
 	if (ret != KNOT_EOK) {
 		dbg_tsig("TSIG: could not create wire or sign wire: %s\n",
 		         knot_strerror(ret));
+		free(items);
+		knot_rrset_free(&tmp_tsig);
+		knot_rdata_free(&rdata);
+		
 		return ret;
 	}
 
@@ -834,6 +593,9 @@ int knot_tsig_sign(uint8_t *msg, size_t *msg_len,
 	if (ret != KNOT_EOK) {
 		dbg_tsig_detail("TSIG: rrset_to_wire = %s\n", knot_strerror(ret));
 		*digest_len = 0;
+		free(items);
+		knot_rrset_free(&tmp_tsig);
+		knot_rdata_free(&rdata);
 		return ret;
 	}
 
@@ -854,7 +616,8 @@ int knot_tsig_sign(uint8_t *msg, size_t *msg_len,
 int knot_tsig_sign_next(uint8_t *msg, size_t *msg_len, size_t msg_max_len,
                         const uint8_t *prev_digest, size_t prev_digest_len,
                         uint8_t *digest, size_t *digest_len,
-                        const knot_key_t *key)
+                        const knot_key_t *key, uint8_t *to_sign,
+                        size_t to_sign_len)
 {
 	if (!msg || !msg_len || !key || !key || !digest || !digest_len) {
 		return KNOT_EBADARG;
@@ -869,52 +632,135 @@ int knot_tsig_sign_next(uint8_t *msg, size_t *msg_len, size_t msg_max_len,
 	if (!tmp_tsig) {
 		return KNOT_ENOMEM;
 	}
+	
+	/* Create rdata for TSIG RR. */
+	knot_rdata_t *rdata = knot_rdata_new();
+	if (!rdata) {
+		dbg_tsig_detail("TSIG: rdata = NULL\n");
+		knot_rrset_free(&tmp_tsig);
+		return KNOT_ENOMEM;
+	}
+	
+	int ret = 0;
 
-	tsig_rdata_store_current_time(tmp_tsig);
+	ret = knot_rrset_add_rdata(tmp_tsig, rdata);
+	if (ret != KNOT_EOK) {
+		dbg_tsig_detail("TSIG: could not add rdata\n");
+		knot_rrset_free(&tmp_tsig);
+		knot_rdata_free(&rdata);
+		return ret;
+	}
+
+	/* Create items for TSIG RR. */
+	knot_rrtype_descriptor_t *desc =
+		knot_rrtype_descriptor_by_type(KNOT_RRTYPE_TSIG);
+	assert(desc);
+
+	knot_rdata_item_t *items =
+		malloc(sizeof(knot_rdata_item_t) * desc->length);
+	if (!items) {
+		dbg_tsig_detail("TSIG: items = NULL\n");
+		ERR_ALLOC_FAILED;
+		knot_rrset_free(&tmp_tsig);
+		knot_rdata_free(&rdata);
+		return KNOT_ENOMEM;
+	}
+
+	memset(items, 0, sizeof(knot_rdata_item_t) * desc->length);
 
+	ret = knot_rdata_set_items(rdata, items, desc->length);
+	if (ret != KNOT_EOK) {
+		dbg_tsig_detail("TSIG: rdata_set_items returned %s\n", knot_strerror(ret));
+		knot_rrset_free(&tmp_tsig);
+		knot_rdata_free(&rdata);
+		free(items);
+		return ret;
+	}
+	free(items);
+
+	tsig_rdata_store_current_time(tmp_tsig);
+	tsig_rdata_set_fudge(tmp_tsig, 300);
+	
 	/* Create wire to be signed. */
-	size_t wire_len = prev_digest_len + *msg_len + KNOT_TSIG_TIMERS_LENGTH;
+	size_t wire_len = prev_digest_len + to_sign_len
+	                  + KNOT_TSIG_TIMERS_LENGTH + 2;
 	uint8_t *wire = malloc(wire_len);
 	if (!wire) {
 		ERR_ALLOC_FAILED;
+		knot_rrset_free(&tmp_tsig);
+		knot_rdata_deep_free(&rdata, KNOT_RRTYPE_TSIG, 0);
 		return KNOT_ENOMEM;
 	}
 	memset(wire, 0, wire_len);
 
+	/* Write previous digest length. */
+	knot_wire_write_u16(wire, prev_digest_len);
 	/* Write previous digest. */
-	memcpy(wire, prev_digest, sizeof(uint8_t) * prev_digest_len);
+	memcpy(wire + 2, prev_digest, sizeof(uint8_t) * prev_digest_len);
 	/* Write original message. */
-	memcpy(msg + prev_digest_len, msg, *msg_len);
+	memcpy(wire + prev_digest_len + 2, to_sign, to_sign_len);
 	/* Write timers. */
-	knot_tsig_wire_write_timers(msg + prev_digest_len + *msg_len, tmp_tsig);
+	knot_tsig_wire_write_timers(wire + prev_digest_len + to_sign_len + 2,
+	                            tmp_tsig);
+
+	dbg_tsig_detail("Previous digest: \n");
+	dbg_tsig_hex_detail(prev_digest, prev_digest_len);
+
+	dbg_tsig_detail("Timers: \n");
+	dbg_tsig_hex_detail(wire + prev_digest_len + *msg_len,
+			    KNOT_TSIG_TIMERS_LENGTH);
 
-	int ret = 0;
 	ret = knot_tsig_compute_digest(wire, wire_len,
 	                               digest_tmp, &digest_tmp_len, key);
+	
+	/* No matter how the function did, this data is no longer needed. */
+	free(wire);
 	if (ret != KNOT_EOK) {
+		knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
 		*digest_len = 0;
 		return ret;
 	}
 	
 	if (digest_tmp_len > *digest_len) {
+		knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
 		*digest_len = 0;
 		return KNOT_ESPACE;
 	}
 
-	free(wire);
-
 	/* Set the MAC. */
-	tsig_rdata_set_mac(tmp_tsig, *digest_len, digest);
+	tsig_rdata_set_mac(tmp_tsig, digest_tmp_len, digest_tmp);
+	
+	/* Set algorithm. */
+	tsig_rdata_set_alg(tmp_tsig, key->algorithm);
+	
+	/* Set original id. */
+	tsig_rdata_set_orig_id(tmp_tsig, knot_wire_get_id(msg));
+
+	/* Set TSIG error. */
+	tsig_rdata_set_tsig_error(tmp_tsig, 0);
+	
+	/* Set other data. */
+	tsig_rdata_set_other_data(tmp_tsig, 0, NULL);
+
+	dbg_tsig_detail("Message max length: %zu, message length: %zu\n",
+			msg_max_len, *msg_len);
 
 	size_t tsig_wire_size = msg_max_len - *msg_len;
 	int rr_count = 0;
 	ret = knot_rrset_to_wire(tmp_tsig, msg + *msg_len,
 	                         &tsig_wire_size, &rr_count);
 	if (ret != KNOT_EOK) {
+		knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
 		*digest_len = 0;
 		return ret;
 	}
 
+	/* This should not happen, at least one rr has to be converted. */
+	if (rr_count == 0) {
+		knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
+		return KNOT_EBADARG;
+	}
+
 	knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
 
 	*msg_len += tsig_wire_size;
@@ -932,6 +778,7 @@ static int knot_tsig_check_digest(const knot_rrset_t *tsig_rr,
                                   const uint8_t *request_mac,
                                   size_t request_mac_len,
                                   const knot_key_t *tsig_key,
+                                  uint64_t prev_time_signed,
                                   int use_times)
 {
 	if (!tsig_rr || !wire || !tsig_key) {
@@ -939,7 +786,7 @@ static int knot_tsig_check_digest(const knot_rrset_t *tsig_rr,
 	}
 
 	/* Check time signed. */
-	int ret = knot_tsig_check_time_signed(tsig_rr);
+	int ret = knot_tsig_check_time_signed(tsig_rr, prev_time_signed);
 	if (ret != KNOT_EOK) {
 		return ret;
 	}
@@ -1061,29 +908,140 @@ int knot_tsig_server_check(const knot_rrset_t *tsig_rr,
                            const knot_key_t *tsig_key)
 {
 	dbg_tsig_verb("tsig_server_check()\n");
-	return knot_tsig_check_digest(tsig_rr, wire, size, NULL, 0, tsig_key, 0);
+	return knot_tsig_check_digest(tsig_rr, wire, size, NULL, 0, tsig_key,
+	                              0, 0);
 }
 
 int knot_tsig_client_check(const knot_rrset_t *tsig_rr,
                            const uint8_t *wire, size_t size,
                            const uint8_t *request_mac, size_t request_mac_len,
-                           const knot_key_t *tsig_key)
+                           const knot_key_t *tsig_key,
+                           uint64_t prev_time_signed)
 {
 	dbg_tsig_verb("tsig_client_check()\n");
 	return knot_tsig_check_digest(tsig_rr, wire, size, request_mac,
-	                              request_mac_len, tsig_key, 0);
+	                              request_mac_len, tsig_key,
+	                              prev_time_signed, 0);
 }
 
 int knot_tsig_client_check_next(const knot_rrset_t *tsig_rr,
                                 const uint8_t *wire, size_t size,
                                 const uint8_t *prev_digest,
                                 size_t prev_digest_len,
-                                const knot_key_t *tsig_key)
+                                const knot_key_t *tsig_key,
+                                uint64_t prev_time_signed)
 {
 //	return knot_tsig_client_check(tsig_rr, wire, size, prev_digest,
 //	                              prev_digest_len, tsig_key);
 	dbg_tsig_verb("tsig_client_check_next()\n");
 	return knot_tsig_check_digest(tsig_rr, wire, size, prev_digest,
-	                              prev_digest_len, tsig_key, 1);
+	                              prev_digest_len, tsig_key,
+	                              prev_time_signed, 1);
 	return KNOT_ENOTSUP;
 }
+
+int knot_tsig_add(uint8_t *msg, size_t *msg_len, size_t msg_max_len,
+                  uint16_t tsig_rcode, const knot_rrset_t *tsig_rr)
+{
+	/*! \todo Revise!! */
+
+	if (!msg || !msg_len || !tsig_rr) {
+		return KNOT_EBADARG;
+	}
+
+	/*! \todo What key to use, when we do not sign? Does this even work? */
+	knot_dname_t *key_name =
+			knot_dname_deep_copy(knot_rrset_owner(tsig_rr));
+	if (key_name == NULL) {
+		dbg_tsig_detail("TSIG: failed to copy owner\n");
+		return KNOT_ERROR;
+	}
+
+	knot_rrset_t *tmp_tsig =
+		knot_rrset_new(key_name,
+			       KNOT_RRTYPE_TSIG, KNOT_CLASS_ANY, 0);
+	if (!tmp_tsig) {
+		dbg_tsig_detail("TSIG: tmp_tsig = NULL\n");
+		knot_dname_free(&key_name);
+		return KNOT_ENOMEM;
+	}
+
+	/* Create rdata for TSIG RR. */
+	knot_rdata_t *rdata = knot_rdata_new();
+	if (!rdata) {
+		dbg_tsig_detail("TSIG: rdata = NULL\n");
+		knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
+		return KNOT_ENOMEM;
+	}
+
+	knot_rrset_add_rdata(tmp_tsig, rdata);
+
+	/* Create items for TSIG RR. */
+	knot_rrtype_descriptor_t *desc =
+		knot_rrtype_descriptor_by_type(KNOT_RRTYPE_TSIG);
+	assert(desc);
+
+	knot_rdata_item_t *items =
+		malloc(sizeof(knot_rdata_item_t) * desc->length);
+	if (!items) {
+		dbg_tsig_detail("TSIG: items = NULL\n");
+		ERR_ALLOC_FAILED;
+		knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
+		return KNOT_ENOMEM;
+	}
+
+	memset(items, 0, sizeof(knot_rdata_item_t) * desc->length);
+
+	int ret = knot_rdata_set_items(rdata, items, desc->length);
+	if (ret != KNOT_EOK) {
+		dbg_tsig_detail("TSIG: rdata_set_items returned %s\n",
+		                knot_strerror(ret));
+		knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
+		return ret;
+	}
+	free(items);
+
+	knot_dname_t *alg_name =
+			knot_dname_deep_copy(tsig_rdata_alg_name(tsig_rr));
+	if (alg_name == NULL) {
+		dbg_tsig_detail("TSIG: failed to copy alg name\n");
+		return KNOT_ERROR;
+	}
+
+	tsig_rdata_set_alg_name(tmp_tsig, alg_name);
+	tsig_rdata_set_time_signed(tmp_tsig, tsig_rdata_time_signed(tsig_rr));
+	tsig_rdata_set_fudge(tmp_tsig, tsig_rdata_fudge(tsig_rr));
+	tsig_rdata_set_mac(tmp_tsig, 0, NULL);
+
+	/* Set original ID */
+	tsig_rdata_set_orig_id(tmp_tsig, knot_wire_get_id(msg));
+
+	/* Set error */
+	tsig_rdata_set_tsig_error(tmp_tsig, tsig_rcode);
+
+	assert(tsig_rcode != KNOT_TSIG_RCODE_BADTIME);
+	/* Set other len. */
+	tsig_rdata_set_other_data(tmp_tsig, 0, 0);
+
+	size_t tsig_wire_len = msg_max_len - *msg_len;
+	int rr_count = 0;
+
+	/* Write RRSet to wire */
+	ret = knot_rrset_to_wire(tmp_tsig, msg + *msg_len,
+	                         &tsig_wire_len, &rr_count);
+	if (ret != KNOT_EOK) {
+		dbg_tsig_detail("TSIG: rrset_to_wire = %s\n", knot_strerror(ret));
+		knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
+		return ret;
+	}
+
+	knot_rrset_deep_free(&tmp_tsig, 1, 1, 1);
+
+	*msg_len += tsig_wire_len;
+
+	uint16_t arcount = knot_wire_get_arcount(msg);
+	knot_wire_set_arcount(msg, ++arcount);
+
+	return KNOT_EOK;
+}
+
diff --git a/src/libknot/tsig-op.h b/src/libknot/tsig-op.h
index b206dc7..07a84a8 100644
--- a/src/libknot/tsig-op.h
+++ b/src/libknot/tsig-op.h
@@ -63,7 +63,8 @@
 int knot_tsig_sign(uint8_t *msg, size_t *msg_len, size_t msg_max_len,
                    const uint8_t *request_mac, size_t request_mac_len,
                    uint8_t *digest, size_t *digest_len,
-                   const knot_key_t *key);
+                   const knot_key_t *key, uint16_t tsig_rcode,
+                   uint64_t request_time_signed);
 
 /*!
  * \brief Generate TSIG signature of a 2nd or later message in a TCP session.
@@ -96,7 +97,8 @@ int knot_tsig_sign(uint8_t *msg, size_t *msg_len, size_t msg_max_len,
 int knot_tsig_sign_next(uint8_t *msg, size_t *msg_len, size_t msg_max_len,
                         const uint8_t *prev_digest, size_t prev_digest_len,
                         uint8_t *digest, size_t *digest_len,
-                        const knot_key_t *key);
+                        const knot_key_t *key, uint8_t *to_sign,
+                        size_t to_sign_len);
 
 /*!
  * \brief Checks incoming request.
@@ -133,7 +135,8 @@ int knot_tsig_server_check(const knot_rrset_t *tsig_rr,
 int knot_tsig_client_check(const knot_rrset_t *tsig_rr,
                            const uint8_t *wire, size_t size,
                            const uint8_t *request_mac, size_t request_mac_len,
-                           const knot_key_t *key);
+                           const knot_key_t *key,
+                           uint64_t prev_time_signed);
 
 /*!
  * \brief Checks signature of 2nd or next packet in a TCP session.
@@ -154,7 +157,11 @@ int knot_tsig_client_check_next(const knot_rrset_t *tsig_rr,
                                 const uint8_t *wire, size_t size,
                                 const uint8_t *prev_digest,
                                 size_t prev_digest_len,
-                                const knot_key_t *key);
+                                const knot_key_t *key,
+                                uint64_t prev_time_signed);
+
+int knot_tsig_add(uint8_t *msg, size_t *msg_len, size_t msg_max_len,
+                  uint16_t tsig_rcode, const knot_rrset_t *tsig_rr);
 
 #endif /* _KNOT_TSIG_H_ */
 
diff --git a/src/libknot/tsig.c b/src/libknot/tsig.c
index 432539f..5790b68 100644
--- a/src/libknot/tsig.c
+++ b/src/libknot/tsig.c
@@ -32,7 +32,7 @@
 /*! \brief TSIG algorithms table. */
 #define TSIG_ALG_TABLE_SIZE 8
 static knot_lookup_table_t tsig_alg_table[TSIG_ALG_TABLE_SIZE] = {
-	{ KNOT_TSIG_ALG_GSS_TSIG, "gss-tsig." },
+	{ KNOT_TSIG_ALG_NULL, "gss-tsig." },
 	{ KNOT_TSIG_ALG_HMAC_MD5, "hmac-md5.sig-alg.reg.int." },
 	{ KNOT_TSIG_ALG_HMAC_SHA1, "hmac-sha1." },
 	{ KNOT_TSIG_ALG_HMAC_SHA224, "hmac-sha224." },
@@ -84,6 +84,9 @@ int tsig_rdata_set_alg_name(knot_rrset_t *tsig, knot_dname_t *alg_name)
 	}
 
 	knot_rdata_item_set_dname(rdata, 0, alg_name_copy);
+	
+	/* Release the dname. We want it to have 1 reference only. */
+	knot_dname_release(alg_name_copy);
 
 	return KNOT_EOK;
 }
@@ -103,12 +106,15 @@ int tsig_rdata_set_alg(knot_rrset_t *tsig, tsig_algorithm_t alg)
 	const char *alg_str = tsig_alg_to_str(alg);
 	knot_dname_t *alg_name_copy = knot_dname_new_from_str(alg_str,
 							      strlen(alg_str),
-							      0);
+							      NULL);
 	if (!alg_name_copy) {
 		return KNOT_ENOMEM;
 	}
-
+	
 	knot_rdata_item_set_dname(rdata, 0, alg_name_copy);
+	
+	/* Release the dname. We want it to have 1 reference only. */
+	knot_dname_release(alg_name_copy);
 
 	return KNOT_EOK;
 }
@@ -306,8 +312,35 @@ const knot_dname_t *tsig_rdata_alg_name(const knot_rrset_t *tsig)
 
 tsig_algorithm_t tsig_rdata_alg(const knot_rrset_t *tsig)
 {
-	/*! \todo [TSIG] Implement me. */
-	return KNOT_TSIG_ALG_HMAC_MD5;
+	if (!tsig) {
+		return KNOT_TSIG_ALG_NULL;
+	}
+
+	/* Get the algorithm name. */
+	const knot_dname_t *alg_name = tsig_rdata_alg_name(tsig);
+	if (!alg_name) {
+		dbg_tsig_detail("TSIG: rdata: cannot get algorithm name.\n");
+		return KNOT_TSIG_ALG_NULL;
+	}
+
+	/* Convert alg name to string. */
+	char *name = knot_dname_to_str(alg_name);
+	if (!name) {
+		dbg_tsig_detail("TSIG: rdata: cannot convert alg name.\n");
+		return KNOT_TSIG_ALG_NULL;
+	}
+
+	knot_lookup_table_t *item = knot_lookup_by_name(tsig_alg_table, name);
+	if (!item) {
+		dbg_tsig_detail("TSIG: rdata: unknown algorithm.\n");
+		return KNOT_TSIG_ALG_NULL;
+	}
+	free(name);
+
+	int id = item->id;
+
+
+	return id;
 }
 
 uint64_t tsig_rdata_time_signed(const knot_rrset_t *tsig)
@@ -581,7 +614,7 @@ const char* tsig_alg_to_str(tsig_algorithm_t alg)
 size_t tsig_wire_maxsize(const knot_key_t* key)
 {
 	size_t alg_name_size = strlen(tsig_alg_to_str(key->algorithm)) + 1;
-		
+
 	return knot_dname_size(key->name) +
 	sizeof(uint16_t) + /* TYPE */
 	sizeof(uint16_t) + /* CLASS */
diff --git a/src/libknot/tsig.h b/src/libknot/tsig.h
index eafcfab..73fa832 100644
--- a/src/libknot/tsig.h
+++ b/src/libknot/tsig.h
@@ -59,9 +59,9 @@ typedef struct knot_key knot_key_t;
 enum tsig_algorithm_digest_length {
 	KNOT_TSIG_ALG_DIG_LENGTH_GSS_TSIG = 0,
 	KNOT_TSIG_ALG_DIG_LENGTH_HMAC_MD5 = 16,
-	KNOT_TSIG_ALG_DIG_LENGTH_SHA1 = 0,
+	KNOT_TSIG_ALG_DIG_LENGTH_SHA1 = 20,
 	KNOT_TSIG_ALG_DIG_LENGTH_SHA224 = 0,
-	KNOT_TSIG_ALG_DIG_LENGTH_SHA256 = 0,
+	KNOT_TSIG_ALG_DIG_LENGTH_SHA256 = 32,
 	KNOT_TSIG_ALG_DIG_LENGTH_SHA384 = 0,
 	KNOT_TSIG_ALG_DIG_LENGTH_SHA512 = 0
 };
diff --git a/src/libknot/updates/xfr-in.c b/src/libknot/updates/xfr-in.c
index 51be430..b1feddb 100644
--- a/src/libknot/updates/xfr-in.c
+++ b/src/libknot/updates/xfr-in.c
@@ -121,7 +121,8 @@ static int xfrin_create_query(knot_dname_t *qname, uint16_t qtype,
 		
 		xfr->digest_size = xfr->digest_max_size;
 		rc = knot_tsig_sign(wire, &wire_size, *size, NULL, 0, 
-		               xfr->digest, &xfr->digest_size, xfr->tsig_key);
+		               xfr->digest, &xfr->digest_size, xfr->tsig_key,
+		               0, 0);
 		if (rc != KNOT_EOK) {
 			/*! \todo [TSIG] Handle TSIG errors. */
 			knot_packet_free(&pkt);
@@ -315,7 +316,7 @@ static int xfrin_process_orphan_rrsigs(knot_zone_contents_t *zone,
 
 /*----------------------------------------------------------------------------*/
 
-static void xfrin_free_orphan_rrsigs(xfrin_orphan_rrsig_t **rrsigs)
+void xfrin_free_orphan_rrsigs(xfrin_orphan_rrsig_t **rrsigs)
 {
 	xfrin_orphan_rrsig_t *r = *rrsigs;
 	while (r != NULL) {
@@ -358,6 +359,15 @@ static int xfrin_check_tsig(knot_packet_t *packet, knot_ns_xfr_t *xfr,
 	}
 	
 	if (xfr->tsig_key) {
+		// just append the wireformat to the TSIG data
+		assert(KNOT_NS_TSIG_DATA_MAX_SIZE - xfr->tsig_data_size
+		       >= xfr->wire_size);
+		memcpy(xfr->tsig_data + xfr->tsig_data_size,
+		       xfr->wire, xfr->wire_size);
+		xfr->tsig_data_size += xfr->wire_size;
+	}
+	
+	if (xfr->tsig_key) {
 		if (tsig_req && tsig == NULL) {
 			// TSIG missing!!
 			return KNOT_EMALF;
@@ -367,12 +377,14 @@ static int xfrin_check_tsig(knot_packet_t *packet, knot_ns_xfr_t *xfr,
 				ret = knot_tsig_client_check(tsig, 
 					xfr->wire, xfr->wire_size, 
 					xfr->digest, xfr->digest_size,
-					xfr->tsig_key);
+					xfr->tsig_key,
+					xfr->tsig_prev_time_signed);
 			} else {
 				ret = knot_tsig_client_check_next(tsig, 
-					xfr->wire, xfr->wire_size, 
+					xfr->tsig_data, xfr->tsig_data_size, 
 					xfr->digest, xfr->digest_size,
-					xfr->tsig_key);
+					xfr->tsig_key,
+					xfr->tsig_prev_time_signed);
 			}
 			
 			if (ret != KNOT_EOK) {
@@ -392,20 +404,23 @@ static int xfrin_check_tsig(knot_packet_t *packet, knot_ns_xfr_t *xfr,
 			memcpy(xfr->digest, tsig_rdata_mac(tsig), 
 			       tsig_rdata_mac_length(tsig));
 			xfr->digest_size = tsig_rdata_mac_length(tsig);
+
+			// Extract the time signed from the TSIG and store it
+			// We may rewrite the tsig_req_time_signed field
+			xfr->tsig_prev_time_signed =
+			                tsig_rdata_time_signed(tsig);
+
 			
-		} else { // TSIG not required and not there
-			// just append the wireformat to the TSIG data
-			assert(KNOT_NS_TSIG_DATA_MAX_SIZE - xfr->tsig_data_size
-			       >= xfr->wire_size);
-			memcpy(xfr->tsig_data + xfr->tsig_data_size,
-			       xfr->wire, xfr->wire_size);
-			xfr->tsig_data_size += xfr->wire_size;
-		}
+		}/* else { // TSIG not required and not there
+			
+		}*/
 	} else if (tsig != NULL) {
 		// TSIG where it should not be
 		return KNOT_EMALF;
 	}
 	
+	knot_rrset_deep_free(&tsig, 1, 1, 1);
+	
 	return KNOT_EOK;
 }
 
@@ -482,8 +497,8 @@ int xfrin_process_axfr_packet(/*const uint8_t *pkt, size_t size,
 		// this should be the first packet
 		/*! \note [TSIG] Packet number for checking TSIG validation. */
 		xfr->packet_nr = 0;
-		/*! \note [TSIG] Storing total size of data for TSIG digest. */
-		xfr->tsig_data_size = 0;
+//		/*! \note [TSIG] Storing total size of data for TSIG digest. */
+//		xfr->tsig_data_size = 0;
 		
 		// create new zone
 		/*! \todo Ensure that the packet is the first one. */
@@ -586,16 +601,16 @@ dbg_xfrin_exec(
 	/*! \note [TSIG] add the packet wire size to the data to be verified by 
 	 *               TSIG 
 	 */
-	if (xfr->tsig_key) {
-		dbg_xfrin("Adding packet wire to TSIG data (size till now: %zu,"
-		          " adding: %zu).\n", xfr->tsig_data_size, 
-		          xfr->wire_size);
-		assert(KNOT_NS_TSIG_DATA_MAX_SIZE - xfr->tsig_data_size
-		       >= xfr->wire_size);
-		memcpy(xfr->tsig_data + xfr->tsig_data_size, xfr->wire, 
-		       xfr->wire_size);
-		xfr->tsig_data_size += xfr->wire_size;
-	}
+//	if (xfr->tsig_key) {
+//		dbg_xfrin("Adding packet wire to TSIG data (size till now: %zu,"
+//		          " adding: %zu).\n", xfr->tsig_data_size, 
+//		          xfr->wire_size);
+//		assert(KNOT_NS_TSIG_DATA_MAX_SIZE - xfr->tsig_data_size
+//		       >= xfr->wire_size);
+//		memcpy(xfr->tsig_data + xfr->tsig_data_size, xfr->wire, 
+//		       xfr->wire_size);
+//		xfr->tsig_data_size += xfr->wire_size;
+//	}
 	
 	assert(zone != NULL);
 
@@ -904,8 +919,7 @@ static int xfrin_parse_first_rr(knot_packet_t **packet, const uint8_t *pkt,
 
 /*----------------------------------------------------------------------------*/
 
-int xfrin_process_ixfr_packet(/*const uint8_t *pkt, size_t size,
-                              knot_changesets_t **chs*/knot_ns_xfr_t *xfr)
+int xfrin_process_ixfr_packet(knot_ns_xfr_t *xfr)
 {
 	size_t size = xfr->wire_size;
 	const uint8_t *pkt = xfr->wire;
@@ -922,8 +936,6 @@ int xfrin_process_ixfr_packet(/*const uint8_t *pkt, size_t size,
 	}
 
 	knot_packet_t *packet = NULL;
-//	knot_rrset_t *soa1 = NULL;
-//	knot_rrset_t *soa2 = NULL;
 	knot_rrset_t *rr = NULL;
 
 	int ret;
@@ -977,13 +989,16 @@ int xfrin_process_ixfr_packet(/*const uint8_t *pkt, size_t size,
 		
 		/*
 		 * If there is no other records in the response than the SOA, it
-		 * means one of these two cases:
+		 * means one of these three cases:
 		 *
 		 * 1) The server does not have newer zone than ours.
 		 *    This is indicated by serial equal to the one of our zone.
 		 * 2) The server wants to send the transfer but is unable to fit
 		 *    it in the packet. This is indicated by serial different 
-		 *    (newer) from the one of our zone. 
+		 *    (newer) from the one of our zone, but applies only for
+		 *    IXFR/UDP.
+		 * 3) The master is weird and sends only SOA in the first packet
+		 *    of a fallback to AXFR answer (PowerDNS does this).
 		 *
 		 * The serials must be compared in other parts of the server, so
 		 * just indicate that the answer contains only one SOA.
@@ -996,8 +1011,6 @@ int xfrin_process_ixfr_packet(/*const uint8_t *pkt, size_t size,
 			knot_rrset_deep_free(&rr, 1, 1, 1);
 			dbg_xfrin("Fallback to AXFR.\n");
 			ret = XFRIN_RES_FALLBACK;
-			knot_free_changesets(chs);
-			xfr->data = 0;
 			return ret;
 		}
 	} else {
@@ -2014,7 +2027,6 @@ static knot_node_t *xfrin_add_new_node(knot_zone_contents_t *contents,
 //	dbg_xfrin("Adding new node to zone. From owner: %s type %s\n",
 //	               knot_dname_to_str(node->owner),
 //	               knot_rrtype_to_string(rrset->type));
-//	getchar();
 	if (knot_rrset_type(rrset) == KNOT_RRTYPE_NSEC3) {
 		ret = knot_zone_contents_add_nsec3_node(contents, node, 1, 0,
 		                                        1);
@@ -2067,7 +2079,6 @@ static int xfrin_apply_add_normal(xfrin_changes_t *changes,
 
 	dbg_xfrin("applying rrset:\n");
 	knot_rrset_dump(add, 0);
-//	getchar();
 	
 	if (!*rrset
 	    || knot_dname_compare(knot_rrset_owner(*rrset),
@@ -2089,7 +2100,6 @@ dbg_xfrin_exec_verb(
 		               knot_rrtype_to_string(add->type));
 		free(name);
 );
-//		getchar();
 		// add the RRSet from the changeset to the node
 		/*! \todo What about domain names?? Shouldn't we use the
 		 *        zone-contents' version of this function??
diff --git a/src/libknot/updates/xfr-in.h b/src/libknot/updates/xfr-in.h
index 8a7c64b..bb1b98b 100644
--- a/src/libknot/updates/xfr-in.h
+++ b/src/libknot/updates/xfr-in.h
@@ -151,6 +151,8 @@ int xfrin_process_axfr_packet(/*const uint8_t *pkt, size_t size,
                               xfrin_constructed_zone_t **zone*/
                               knot_ns_xfr_t *xfr);
 
+void xfrin_free_orphan_rrsigs(xfrin_orphan_rrsig_t **rrsigs);
+
 /*!
  * \brief Destroys the whole changesets structure.
  *
diff --git a/src/libknot/util/conv.c b/src/libknot/util/conv.c
new file mode 100644
index 0000000..6626ddd
--- /dev/null
+++ b/src/libknot/util/conv.c
@@ -0,0 +1,325 @@
+/*
+ * Copyright (c) 2001-2011, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <ctype.h>
+#include "conv.h"
+
+#define	B64BUFSIZE	65535	/*!< Buffer size for b64 conversion. */
+
+
+static const char Base64[] =
+	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+static const char Pad64 = '=';
+
+static int b64rmap_initialized = 0;
+static uint8_t b64rmap[256];
+
+static const uint8_t b64rmap_special = 0xf0;
+static const uint8_t b64rmap_end = 0xfd;
+static const uint8_t b64rmap_space = 0xfe;
+static const uint8_t b64rmap_invalid = 0xff;
+
+/**
+ * Initializing the reverse map is not thread safe.
+ * Which is fine for NSD. For now...
+ **/
+static void b64_initialize_rmap()
+{
+	int i;
+	char ch;
+
+	/* Null: end of string, stop parsing */
+	b64rmap[0] = b64rmap_end;
+
+	for (i = 1; i < 256; ++i) {
+		ch = (char)i;
+		/* Whitespaces */
+		if (isspace(ch)) {
+			b64rmap[i] = b64rmap_space;
+		}
+		/* Padding: stop parsing */
+		else if (ch == Pad64) {
+			b64rmap[i] = b64rmap_end;
+		}
+		/* Non-base64 char */
+		else {
+			b64rmap[i] = b64rmap_invalid;
+		}
+	}
+
+	/* Fill reverse mapping for base64 chars */
+	for (i = 0; Base64[i] != '\0'; ++i) {
+		b64rmap[(uint8_t)Base64[i]] = i;
+	}
+
+	b64rmap_initialized = 1;
+}
+
+static int b64_pton_do(char const *src, uint8_t *target, size_t targsize)
+{
+	int tarindex, state, ch;
+	uint8_t ofs;
+
+	state = 0;
+	tarindex = 0;
+
+	while (1) {
+		ch = *src++;
+		ofs = b64rmap[ch];
+
+		if (ofs >= b64rmap_special) {
+			/* Ignore whitespaces */
+			if (ofs == b64rmap_space) {
+				continue;
+			}
+			/* End of base64 characters */
+			if (ofs == b64rmap_end) {
+				break;
+			}
+			/* A non-base64 character. */
+			return (-1);
+		}
+
+		switch (state) {
+		case 0:
+			if ((size_t)tarindex >= targsize) {
+				return (-1);
+			}
+			target[tarindex] = ofs << 2;
+			state = 1;
+			break;
+		case 1:
+			if ((size_t)tarindex + 1 >= targsize) {
+				return (-1);
+			}
+			target[tarindex]   |=  ofs >> 4;
+			target[tarindex+1]  = (ofs & 0x0f)
+					      << 4 ;
+			tarindex++;
+			state = 2;
+			break;
+		case 2:
+			if ((size_t)tarindex + 1 >= targsize) {
+				return (-1);
+			}
+			target[tarindex]   |=  ofs >> 2;
+			target[tarindex+1]  = (ofs & 0x03)
+					      << 6;
+			tarindex++;
+			state = 3;
+			break;
+		case 3:
+			if ((size_t)tarindex >= targsize) {
+				return (-1);
+			}
+			target[tarindex] |= ofs;
+			tarindex++;
+			state = 0;
+			break;
+		default:
+			abort();
+		}
+	}
+
+	/*
+	 * We are done decoding Base-64 chars.  Let's see if we ended
+	 * on a byte boundary, and/or with erroneous trailing characters.
+	 */
+
+	if (ch == Pad64) {		/* We got a pad char. */
+		ch = *src++;		/* Skip it, get next. */
+		switch (state) {
+		case 0:		/* Invalid = in first position */
+		case 1:		/* Invalid = in second position */
+			return (-1);
+
+		case 2:		/* Valid, means one byte of info */
+			/* Skip any number of spaces. */
+			for ((void)NULL; ch != '\0'; ch = *src++)
+				if (b64rmap[ch] != b64rmap_space) {
+					break;
+				}
+			/* Make sure there is another trailing = sign. */
+			if (ch != Pad64) {
+				return (-1);
+			}
+			ch = *src++;		/* Skip the = */
+			/* Fall through to "single trailing =" case. */
+			/* FALLTHROUGH */
+
+		case 3:		/* Valid, means two bytes of info */
+			/*
+			 * We know this char is an =.  Is there anything but
+			 * whitespace after it?
+			 */
+			for ((void)NULL; ch != '\0'; ch = *src++)
+				if (b64rmap[ch] != b64rmap_space) {
+					return (-1);
+				}
+
+			/*
+			 * Now make sure for cases 2 and 3 that the "extra"
+			 * bits that slopped past the last full byte were
+			 * zeros.  If we don't check them, they become a
+			 * subliminal channel.
+			 */
+			if (target[tarindex] != 0) {
+				return (-1);
+			}
+		}
+	} else {
+		/*
+		 * We ended by seeing the end of the string.  Make sure we
+		 * have no partial bytes lying around.
+		 */
+		if (state != 0) {
+			return (-1);
+		}
+	}
+
+	return (tarindex);
+}
+
+
+static int b64_pton_len(char const *src)
+{
+	int tarindex, state, ch;
+	uint8_t ofs;
+
+	state = 0;
+	tarindex = 0;
+
+	while (1) {
+		ch = *src++;
+		ofs = b64rmap[ch];
+
+		if (ofs >= b64rmap_special) {
+			/* Ignore whitespaces */
+			if (ofs == b64rmap_space) {
+				continue;
+			}
+			/* End of base64 characters */
+			if (ofs == b64rmap_end) {
+				break;
+			}
+			/* A non-base64 character. */
+			return (-1);
+		}
+
+		switch (state) {
+		case 0:
+			state = 1;
+			break;
+		case 1:
+			tarindex++;
+			state = 2;
+			break;
+		case 2:
+			tarindex++;
+			state = 3;
+			break;
+		case 3:
+			tarindex++;
+			state = 0;
+			break;
+		default:
+			abort();
+		}
+	}
+
+	/*
+	 * We are done decoding Base-64 chars.  Let's see if we ended
+	 * on a byte boundary, and/or with erroneous trailing characters.
+	 */
+
+	if (ch == Pad64) {		/* We got a pad char. */
+		ch = *src++;		/* Skip it, get next. */
+		switch (state) {
+		case 0:		/* Invalid = in first position */
+		case 1:		/* Invalid = in second position */
+			return (-1);
+
+		case 2:		/* Valid, means one byte of info */
+			/* Skip any number of spaces. */
+			for ((void)NULL; ch != '\0'; ch = *src++)
+				if (b64rmap[ch] != b64rmap_space) {
+					break;
+				}
+			/* Make sure there is another trailing = sign. */
+			if (ch != Pad64) {
+				return (-1);
+			}
+			ch = *src++;		/* Skip the = */
+			/* Fall through to "single trailing =" case. */
+			/* FALLTHROUGH */
+
+		case 3:		/* Valid, means two bytes of info */
+			/*
+			 * We know this char is an =.  Is there anything but
+			 * whitespace after it?
+			 */
+			for ((void)NULL; ch != '\0'; ch = *src++)
+				if (b64rmap[ch] != b64rmap_space) {
+					return (-1);
+				}
+
+		}
+	} else {
+		/*
+		 * We ended by seeing the end of the string.  Make sure we
+		 * have no partial bytes lying around.
+		 */
+		if (state != 0) {
+			return (-1);
+		}
+	}
+
+	return (tarindex);
+}
+
+int b64_pton(char const *src, uint8_t *target, size_t targsize)
+{
+	if (!b64rmap_initialized) {
+		b64_initialize_rmap();
+	}
+
+	if (target) {
+		return b64_pton_do(src, target, targsize);
+	} else {
+		return b64_pton_len(src);
+	}
+}
+
+#define	B64BUFSIZE	65535	/*!< Buffer size for b64 conversion. */
diff --git a/src/libknot/util/conv.h b/src/libknot/util/conv.h
new file mode 100644
index 0000000..d1e6dae
--- /dev/null
+++ b/src/libknot/util/conv.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2001-2011, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _KNOT_CONV_H_
+#define _KNOT_CONV_H_
+
+#define	B64BUFSIZE	65535	/*!< Buffer size for b64 conversion. */
+
+/*!
+ * \brief Base64 presentation to wire conversion.
+ */
+int b64_pton(char const *src, uint8_t *target, size_t targsize);
+
+#endif // _KNOT_CONV_H_
diff --git a/src/libknot/util/debug.h b/src/libknot/util/debug.h
index 2f9f5fd..2c03c9c 100644
--- a/src/libknot/util/debug.h
+++ b/src/libknot/util/debug.h
@@ -57,10 +57,10 @@
 //#define KNOT_NSEC3_DEBUG
 //#define CUCKOO_DEBUG
 //#define CUCKOO_DEBUG_HASH
-//#define KNOT_NS_DEBUG
+#define KNOT_NS_DEBUG
 //#define KNOT_XFRIN_DEBUG
 //#define KNOT_DDNS_DEBUG
-//#define KNOT_TSIG_DEBUG
+#define KNOT_TSIG_DEBUG
 
 /*!
  * \brief Dumps RDATA of the given type.
@@ -748,6 +748,45 @@ void knot_zone_contents_dump(knot_zone_contents_t *zone, char loaded_zone);
 #define dbg_tsig_hex_detail(data, len)
 #endif
 
+#ifdef KNOT_RRSET_DEBUG
+
+/* Brief messages. */
+#ifdef DEBUG_ENABLE_BRIEF
+#define dbg_rrset(msg...) fprintf(stderr, msg)
+#define dbg_rrset_hex(data, len)  hex_print((data), (len))
+#else
+#define dbg_rrset(msg...)
+#define dbg_rrset_hex(data, len)
+#endif
+
+/* Verbose messages. */
+#ifdef DEBUG_ENABLE_VERBOSE
+#define dbg_rrset_verb(msg...) fprintf(stderr, msg)
+#define dbg_rrset_hex_verb(data, len)  hex_print((data), (len))
+#else
+#define dbg_rrset_verb(msg...)
+#define dbg_rrset_hex_verb(data, len)
+#endif
+
+/* Detail messages. */
+#ifdef DEBUG_ENABLE_DETAILS
+#define dbg_rrset_detail(msg...) fprintf(stderr, msg)
+#define dbg_rrset_hex_detail(data, len)  hex_print((data), (len))
+#else
+#define dbg_rrset_detail(msg...)
+#define dbg_rrset_hex_detail(data, len)
+#endif
+
+/* No messages. */
+#else
+#define dbg_rrset(msg...)
+#define dbg_rrset_hex(data, len)
+#define dbg_rrset_verb(msg...)
+#define dbg_rrset_hex_verb(data, len)
+#define dbg_rrset_detail(msg...)
+#define dbg_rrset_hex_detail(data, len)
+#endif
+
 /******************************************************************************/
 
 #endif /* _KNOT_DEBUG_H_ */
diff --git a/src/libknot/util/error.h b/src/libknot/util/error.h
index da45151..2f34a28 100644
--- a/src/libknot/util/error.h
+++ b/src/libknot/util/error.h
@@ -64,7 +64,8 @@ enum knot_error {
 	KNOT_ENOIXFR,         /*!< Transfer is not IXFR (is in AXFR format). */
 	KNOT_EXFRREFUSED,     /*!< Zone transfer refused by the server. */
 	KNOT_ECONN,           /*!< Connection reset. */
-	KNOT_ERROR_COUNT = 30
+	KNOT_EIXFRSPACE,      /*!< IXFR reply did not fit in. */
+	KNOT_ERROR_COUNT = 31
 };
 
 /*! \brief Table linking error messages to error codes. */
diff --git a/src/libknot/util/libknot_error.c b/src/libknot/util/libknot_error.c
index bc2bed2..5795a23 100644
--- a/src/libknot/util/libknot_error.c
+++ b/src/libknot/util/libknot_error.c
@@ -49,5 +49,6 @@ const error_table_t knot_error_msgs[KNOT_ERROR_COUNT] = {
 	{KNOT_TSIG_EBADKEY, "TSIG key not recognized or invalid." },
 	{KNOT_TSIG_EBADTIME, "TSIG signing time out of range." },
 	{KNOT_ECONN, "Connection reset."},
+	{KNOT_EIXFRSPACE, "IXFR reply did not fit in."},
 	{KNOT_ERROR, 0}
 };
diff --git a/src/libknot/zone/zone-contents.c b/src/libknot/zone/zone-contents.c
index d550728..feec8e5 100644
--- a/src/libknot/zone/zone-contents.c
+++ b/src/libknot/zone/zone-contents.c
@@ -676,7 +676,9 @@ static int knot_zone_contents_dnames_from_rdata_to_table(
 {
 	unsigned int count = knot_rdata_item_count(rdata);
 	int rc = 0;
-	assert(count <= d->length);
+	if (d->fixed_items) {
+		assert(count <= d->length);
+	}
 	// for each RDATA item
 	for (unsigned int j = 0; j < count; ++j) {
 		if (d->wireformat[j]
diff --git a/src/tests/common/acl_tests.c b/src/tests/common/acl_tests.c
index b4232ac..e9af20c 100644
--- a/src/tests/common/acl_tests.c
+++ b/src/tests/common/acl_tests.c
@@ -53,55 +53,55 @@ static int acl_tests_run(int argc, char *argv[])
 	ok(ret > 0, "acl: new IPv6 address");
 
 	// 4. Create simple IPv4 rule
-	ret = acl_create(acl, &test_v4, ACL_ACCEPT);
+	ret = acl_create(acl, &test_v4, ACL_ACCEPT, 0);
 	ok(ret == ACL_ACCEPT, "acl: inserted IPv4 rule");
 
 	// 5. Create simple IPv6 rule
-	ret = acl_create(acl, &test_v6, ACL_ACCEPT);
+	ret = acl_create(acl, &test_v6, ACL_ACCEPT, 0);
 	ok(ret == ACL_ACCEPT, "acl: inserted IPv6 rule");
 
 	// 6. Create simple IPv4 'any port' rule
 	sockaddr_t test_v4a;
 	sockaddr_set(&test_v4a, AF_INET, "20.20.20.20", 0);
-	ret = acl_create(acl, &test_v4a, ACL_ACCEPT);
+	ret = acl_create(acl, &test_v4a, ACL_ACCEPT, 0);
 	ok(ret == ACL_ACCEPT, "acl: inserted IPv4 'any port' rule");
 
 	// 7. Attempt to match unmatching address
 	sockaddr_t unmatch_v4;
 	sockaddr_set(&unmatch_v4, AF_INET, "10.10.10.10", 24424);
-	ret = acl_match(acl, &unmatch_v4);
+	ret = acl_match(acl, &unmatch_v4, 0);
 	ok(ret == ACL_DENY, "acl: matching non-existing address");
 
 	// 8. Attempt to match unmatching IPv6 address
 	sockaddr_t unmatch_v6;
 	sockaddr_set(&unmatch_v6, AF_INET6, "2001:db8::1428:57ab", 24424);
-	ret = acl_match(acl, &unmatch_v6);
+	ret = acl_match(acl, &unmatch_v6, 0);
 	ok(ret == ACL_DENY, "acl: matching non-existing IPv6 address");
 
 	// 9. Attempt to match matching address
-	ret = acl_match(acl, &test_v4);
+	ret = acl_match(acl, &test_v4, 0);
 	ok(ret == ACL_ACCEPT, "acl: matching existing address");
 
 	// 10. Attempt to match matching address
-	ret = acl_match(acl, &test_v6);
+	ret = acl_match(acl, &test_v6, 0);
 	ok(ret == ACL_ACCEPT, "acl: matching existing IPv6 address");
 
 	// 11. Attempt to match matching 'any port' address
 	sockaddr_t match_v4a;
 	sockaddr_set(&match_v4a, AF_INET, "20.20.20.20", 24424);
-	ret = acl_match(acl, &match_v4a);
+	ret = acl_match(acl, &match_v4a, 0);
 	ok(ret == ACL_ACCEPT, "acl: matching existing IPv4 'any port' address");
 
 	// 12. Attempt to match matching address without matching port
 	sockaddr_set(&unmatch_v4, AF_INET, "127.0.0.1", 54321);
-	ret = acl_match(acl, &unmatch_v4);
+	ret = acl_match(acl, &unmatch_v4, 0);
 	ok(ret == ACL_DENY, "acl: matching address without matching port");
 
 	// 13. Invalid parameters
 	lives_ok({
 		acl_delete(0);
-		acl_create(0, 0, ACL_ERROR);
-		acl_match(0, 0);
+		acl_create(0, 0, ACL_ERROR, 0);
+		acl_match(0, 0, 0);
 		acl_truncate(0);
 		acl_name(0);
 	}, "acl: won't crash with NULL parameters");
diff --git a/src/tests/libknot/libknot/tsig_tests.c b/src/tests/libknot/libknot/tsig_tests.c
new file mode 100644
index 0000000..284579f
--- /dev/null
+++ b/src/tests/libknot/libknot/tsig_tests.c
@@ -0,0 +1,685 @@
+/*  Copyright (C) 2011 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <time.h>
+
+#include "libknot/rrset.h"
+#include "libknot/packet/response.h"
+#include "libknot/dname.h"
+#include "libknot/util/error.h"
+#include "libknot/util/wire.h"
+#include "libknot/tsig-op.h"
+
+#include "tsig_tests.h"
+
+static int knot_tsig_tests_count(int argc, char *argv[]);
+static int knot_tsig_tests_run(int argc, char *argv[]);
+
+/*! Exported unit API.
+ */
+unit_api tsig_tests_api = {
+	"DNS library - tsig",        //! Unit name
+	&knot_tsig_tests_count,  //! Count scheduled tests
+	&knot_tsig_tests_run     //! Run scheduled tests
+};
+
+static const int KNOT_TSIG_TEST_COUNT = 6;
+
+static knot_rrset_t *create_dummy_tsig_rr()
+{
+	knot_dname_t *tsig_owner =
+		knot_dname_new_from_str("dummy.key.name.",
+	                                strlen("dummy.key.name."), NULL);
+	assert(tsig_owner);
+
+	/* Create dummy TSIG rr. */
+	knot_rrset_t *tsig_rr = knot_rrset_new(tsig_owner, KNOT_RRTYPE_TSIG,
+	                                       KNOT_CLASS_ANY, 0);
+	assert(tsig_rr);
+
+	knot_rdata_t *tsig_rdata = knot_rdata_new();
+	assert(tsig_rr);
+	/* Create TSIG items. */
+	knot_rdata_item_t items[9];
+
+	/*
+	 * I am not sure if 9 is the right count in our impl,
+	 * but it should work fine.
+	 */
+	knot_rdata_set_items(tsig_rdata, items, 9);
+	knot_dname_t *alg_name =
+		knot_dname_new_from_str("hmac-md5.sig-alg.reg.int.",
+	                                strlen("hmac-md5.sig-alg.reg.int."),
+	                                NULL);
+	assert(alg_name);
+	tsig_rdata_set_alg_name(tsig_rr, alg_name);
+
+	/* Get current time and save it to TSIG rr. */
+	time_t current_time = time(NULL);
+	tsig_rdata_set_time_signed(tsig_rr, current_time);
+	tsig_rdata_set_fudge(tsig_rr, 300);
+	tsig_rdata_set_orig_id(tsig_rr, 0);
+	tsig_rdata_set_tsig_error(tsig_rr, 0);
+	tsig_rdata_set_mac(tsig_rr, strlen("nonsensemac"),
+	                   (uint8_t *)"nonsensemac");
+
+	return tsig_rr;
+}
+
+static int test_knot_tsig_sign()
+{
+	int errors = 0;
+	/* Test bad arguments. */
+	int lived = 0;
+	lives_ok_silent({
+		int ret = knot_tsig_sign(NULL, NULL, 0, NULL, 0, NULL,
+		               NULL, NULL, 0, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign((uint8_t *)0x1, NULL, 0, NULL, 0, NULL,
+		               NULL, NULL, 0, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign((uint8_t *)0x1, (size_t *)0x1, 0, NULL,
+		                     0, NULL,
+		               NULL, NULL, 0, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign((uint8_t *)0x1, (size_t *)0x1, 0,
+		                     (uint8_t *)0x1, 0, NULL,
+		               NULL, NULL, 0, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign((uint8_t *)0x12345678, (size_t *)0x1,
+		                     0,(uint8_t *)0x1, 0,(uint8_t *) 0x1,
+		               NULL, NULL, 0, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign((uint8_t *)0x12345678, (size_t *)0x1, 0,
+		                     (uint8_t *)0x1, 0,(uint8_t *) 0x1,
+		               (size_t *)0x1, NULL, 0, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+	}, NULL);
+
+	errors += !lived;
+	
+	if (errors) {
+		diag("NULL tests crashed!");
+	}
+
+	/* Create some dummy variables. */
+	/* One NS rrset. */
+	knot_dname_t *ns_dname = knot_dname_new_from_str("test.cz.",
+	                                                 strlen("test.cz."),
+	                                                 NULL);
+	assert(ns_dname);
+	knot_rrset_t *ns_rrset = knot_rrset_new(ns_dname, KNOT_RRTYPE_NS, 
+	                                        KNOT_CLASS_IN, 3600);
+	assert(ns_rrset);
+	knot_packet_t *packet = knot_packet_new(KNOT_PACKET_PREALLOC_RESPONSE);
+	assert(packet);
+	
+	/* Add rdata. */
+	knot_rdata_t *ns_rdata = knot_rdata_new();
+	assert(ns_rdata);
+	
+	knot_rdata_item_t items[1];
+	items[0].dname = ns_dname;
+	
+	int ret = knot_rdata_set_items(ns_rdata, items, 1);
+	assert(ret == KNOT_EOK);
+	ret = knot_rrset_add_rdata(ns_rrset, ns_rdata);
+	assert(ret == KNOT_EOK);
+	
+	knot_packet_set_max_size(packet, 2048);
+	
+	if ((ret = knot_response_add_rrset_answer(packet, ns_rrset,
+	                                   0, 0, 0)) != KNOT_EOK) {
+		diag("Could not add rrset to packet!"
+		     " %s\n", knot_strerror(ret));
+		/* No point in continuing. */
+		return 0;
+	}
+
+	uint8_t *msg = NULL;
+	size_t msg_len;
+	ret = knot_packet_to_wire(packet, &msg, &msg_len);
+	assert(ret == KNOT_EOK);
+
+	size_t msg_copy_length = msg_len;
+	uint8_t msg_copy[msg_len];
+	memcpy(msg_copy, msg, msg_len);
+	
+	size_t msg_max_len = 1024;
+	uint8_t request_mac[16];
+	size_t request_mac_length = 0;
+	uint8_t digest[512];
+	size_t digest_len;
+
+	knot_key_t key;
+	key.algorithm = KNOT_TSIG_ALG_HMAC_MD5;
+	key.name = knot_dname_new_from_str("test.",
+	                                   strlen("test."), NULL);
+	key.secret = "abcdefgh";
+	key.secret_size = strlen("abcdefgh");
+
+	/* Test not enough space for wire. */
+	ret = knot_tsig_sign(msg, &msg_len, msg_len + 1, request_mac,
+	                     request_mac_length,
+	               digest, &digest_len, &key, 0, 0);
+	if (ret != KNOT_ESPACE) {
+		diag("knot_tsig_sign did not return error when given too"
+		     " litle space for wire!");
+		errors++;
+	}
+
+	/* Test normal operation. */
+	ret = knot_tsig_sign(msg, &msg_len, msg_max_len, request_mac,
+	                     request_mac_length,
+	               digest, &digest_len, &key, 0, 0);
+	if (ret != KNOT_EOK) {
+		diag("knot_tsig_sign failed when given right arguments!");
+		return 0;
+	}
+	
+	/*
+	 * Now check that the initial wire remained the same.
+	 * (Except for arcount)
+	 */
+	
+	/* Read arcount. Should be 1. */
+	if (knot_wire_get_arcount(msg) != 1) {
+		diag("Signed wire did not have its arcount changed!");
+		errors++;
+	}
+	
+	knot_wire_set_arcount(msg, 0);
+	/* Wire now should be identical. Compare with its pre-signing copy. */
+	if (strncmp((char *)msg, (char *)msg_copy, msg_len) != 0) {
+		hex_print(msg, msg_len);
+		hex_print(msg_copy, msg_len);
+		diag("knot_tsig_sign has changed the signed wire!");
+		errors++;
+	}
+
+	/* Do exactly the same, but add the request_mac variable. */
+	request_mac_length = 16;
+	memcpy(msg, msg_copy, msg_copy_length);
+	msg = msg_copy;
+	ret = knot_tsig_sign(msg, &msg_len, msg_max_len, request_mac,
+	                     request_mac_length,
+	               digest, &digest_len, &key, 0, 0);
+	if (ret != KNOT_EOK) {
+		diag("knot_tsig_sign failed when given right arguments "
+		     "(request mac set)!");
+		return 0;
+	}
+
+	/* Read arcount. Should be 1. */
+	if (knot_wire_get_arcount(msg) != 1) {
+		diag("Signed wire did not have its arcount changed!");
+		errors++;
+	}
+
+	knot_wire_set_arcount(msg, 0);
+	/* Wire now should be identical. Compare with its pre-signing copy. */
+	if (strncmp((char *)msg, (char *)msg_copy, msg_len) != 0) {
+		hex_print(msg, msg_len);
+		hex_print(msg_copy, msg_len);
+		diag("knot_tsig_sign has changed the signed wire!");
+		errors++;
+	}
+
+	/*
+	 * Check that the wire is correctly signed
+	 * using knot_tsig_server_check.
+	 */
+
+	/* Create dummy tsig_rr. */
+	knot_rrset_t *tsig_rr = create_dummy_tsig_rr();
+	assert(tsig_rr);
+
+	/* Set the created digest. */
+	tsig_rdata_set_mac(tsig_rr, digest_len, digest);
+
+	ret = knot_tsig_server_check(tsig_rr, msg, msg_len, &key);
+	if (ret != KNOT_EOK) {
+		diag("Signed wire did not pass check!");
+		errors++;
+	}
+
+//	free(msg);
+	return errors == 0;
+}
+
+static int test_knot_tsig_sign_next()
+{
+	int errors = 0;
+	/* Test bad arguments. */
+	int lived = 0;
+	lives_ok_silent({
+		int ret = knot_tsig_sign_next(NULL, NULL, 0, NULL, 0, NULL,
+		               NULL, NULL, NULL, 0); /*! \todo FIX */
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign_next((uint8_t *)0x1, NULL, 0, NULL, 0,
+		                          NULL,
+		               NULL, NULL, NULL, 0); /*! \todo FIX */
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign_next((uint8_t *)0x1, (size_t *)0x1, 0,
+		                          NULL, 0, NULL,
+		               NULL, NULL, NULL, 0); /*! \todo FIX */
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign_next((uint8_t *)0x1, (size_t *)0x1, 0,
+		                          (uint8_t *)0x1, 0, NULL,
+		               NULL, NULL, NULL, 0); /*! \todo FIX */
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign_next((uint8_t *)0x12345678, (size_t *)0x1,
+		                          0,(uint8_t *)0x1, 0,(uint8_t *) 0x1,
+		               NULL, NULL, NULL, 0); /*! \todo FIX */
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+
+		lived = 0;
+		ret = knot_tsig_sign_next((uint8_t *)0x12345678, (size_t *)0x1,
+		                          0, (uint8_t *)0x1, 0,(uint8_t *) 0x1,
+		               (size_t *)0x1, NULL, NULL, 0); /*! \todo FIX */
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+	}, NULL);
+
+	errors += !lived;
+	
+	if (errors) {
+		diag("NULL tests crashed!");
+	}
+	
+	/* Create some dummy variables. */
+	uint8_t msg[2048]; /* Should be random. */
+	size_t msg_len = 512;
+	size_t msg_max_len = 2048;
+	uint8_t *prev_digest = NULL;
+	size_t prev_digest_len = 0;
+	uint8_t digest[512];
+	size_t digest_len = 512;
+
+	knot_key_t key;
+	key.algorithm = KNOT_TSIG_ALG_HMAC_MD5;
+	key.name = knot_dname_new_from_str("test.",
+	                                   strlen("test."), NULL);
+	key.secret = "abcdefgh";
+	key.secret_size = strlen("abcdefgh");
+
+	/* Test not enough space for wire. */
+	int ret = knot_tsig_sign_next(msg, &msg_len, 513, prev_digest,
+	                              prev_digest_len,
+	               digest, &digest_len, &key, NULL, 0); /*! \todo FIX */
+	if (ret != KNOT_ESPACE) {
+		diag("knot_tsig_sign_next did not return error when "
+		     "given too litle space for wire!"
+		     " returned: %s", knot_strerror(ret));
+		errors++;
+	}
+	
+	digest_len = 512;
+
+	/* Test normal operation. */
+	ret = knot_tsig_sign_next(msg, &msg_len, msg_max_len, prev_digest,
+	                          prev_digest_len,
+	               digest, &digest_len, &key, NULL, 0); /*! \todo FIX */
+	if (ret != KNOT_EOK) {
+		diag("knot_tsig_sign_next failed when given right arguments!"
+		     " returned: %s", knot_strerror(ret));
+		errors++;
+	}
+	
+	/*!< \todo test that the variables have changed and so on. */
+
+	return errors == 0;
+}
+
+static int test_knot_tsig_server_check()
+{
+	int errors = 0;
+	/* Test bad arguments. */
+	int lived = 0;
+	lives_ok_silent({
+		int ret = knot_tsig_server_check(NULL, NULL, 0, NULL);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+		
+		lived = 0;
+		ret = knot_tsig_server_check((knot_rrset_t *)0x1,
+		                             (uint8_t *)0x1, 0,
+		                                 NULL);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+	}, NULL);
+		
+	errors += !lived;
+	
+	if (errors) {
+		diag("NULL tests crashed!");
+	}
+
+	/* Create dummy TSIG rr. */
+	knot_rrset_t *tsig_rr = create_dummy_tsig_rr();
+	assert(tsig_rr);
+
+	
+	/* Create dummy key. */
+	knot_key_t key;
+	key.algorithm = KNOT_TSIG_ALG_HMAC_MD5;
+	key.secret = "supersecretsecret";
+	key.secret_size = strlen("supersecretsecret");
+	/* Bleeding eyes, I know. */
+	key.name = (knot_dname_t *)knot_rrset_owner(tsig_rr);
+
+	/* Create dummy wire. */
+	uint8_t wire[500];
+	size_t wire_size = 500;
+	
+	/*!< \note
+	 * Since there are no meaningful data in the wire,
+	 * the function should fail.
+	 */
+	int ret = knot_tsig_server_check(tsig_rr, wire, wire_size, &key);
+	if (ret != KNOT_TSIG_EBADSIG) {
+		diag("tsig_server_check did not return "
+		     "TSIG_EBADSIG when given random wire!"
+		     " returned: %s", knot_strerror(ret));
+		errors++;
+	}
+	
+	/* Set 0 time - the error should be TSIG_EBADTIME. */
+	tsig_rdata_set_time_signed(tsig_rr, 0);
+	ret = knot_tsig_server_check(tsig_rr, wire, wire_size, &key);
+	if (ret != KNOT_TSIG_EBADTIME) {
+		diag("tsig_server_check did not return TSIG_EBADTIME "
+		     "when given zero time!");
+		errors++;
+	}
+		
+	return errors == 0;
+}
+
+static int test_knot_tsig_client_check()
+{
+	int errors = 0;
+	/* Test bad arguments. */
+	int lived = 0;
+	lives_ok({
+		int ret = knot_tsig_client_check(NULL, NULL, 0, NULL,
+	                                         0, NULL, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+	
+		lived = 0;
+		ret = knot_tsig_client_check((knot_rrset_t *)0x1, NULL, 0, NULL,
+	                                         0, NULL, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+	
+		lived = 0;
+		ret = knot_tsig_client_check((knot_rrset_t *)0x1,
+		                             (uint8_t *)0x1, 0, NULL,
+	                                         0, NULL, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+		
+		lived = 0;
+		ret = knot_tsig_client_check((knot_rrset_t *)0x1,
+		                             (uint8_t *)0x1, 0, NULL,
+	                                         0, NULL, 0);
+		if (ret != KNOT_EBADARG) {
+			diag("NULL argument did not return KNOT_EBADARG!");
+			errors++;
+		}
+		lived = 1;
+	}, NULL);
+		
+	errors += !lived;
+	
+	if (errors) {
+		diag("NULL tests crashed!");
+	}
+	
+	knot_dname_t *tsig_owner =
+		knot_dname_new_from_str("dummy.key.name.",
+	                                strlen("dummy.key.name."), NULL);
+	assert(tsig_owner);
+	/* Create dummy key. */
+	knot_key_t key;
+	key.algorithm = KNOT_TSIG_ALG_HMAC_MD5;
+	key.secret = "supersecretsecret";
+	key.secret_size = strlen("supersecretsecret");
+	key.name = tsig_owner;
+	
+	/* Create dummy TSIG rr. */
+	knot_rrset_t *tsig_rr = knot_rrset_new(tsig_owner,
+	                                       KNOT_RRTYPE_TSIG,
+	                                       KNOT_CLASS_ANY, 0);
+	assert(tsig_rr);
+	
+	knot_rdata_t *tsig_rdata = knot_rdata_new();
+	assert(tsig_rr);
+	/* Create TSIG items. */
+	knot_rdata_item_t items[9];
+
+	/*
+	 * I am not sure if 9 is the right count in our impl.,
+	 * but is should work fine.
+	 */
+	knot_rdata_set_items(tsig_rdata, items, 9);
+	knot_dname_t *alg_name =
+		knot_dname_new_from_str("hmac-md5.sig-alg.reg.int.",
+	                                strlen("hmac-md5.sig-alg.reg.int."),
+	                                NULL);
+	assert(alg_name);
+	tsig_rdata_set_alg_name(tsig_rr, alg_name);
+	/* Get current time and save it to TSIG rr. */
+	time_t current_time = time(NULL);
+	tsig_rdata_set_time_signed(tsig_rr, current_time);
+	tsig_rdata_set_fudge(tsig_rr, 300);
+	tsig_rdata_set_orig_id(tsig_rr, 0);
+	tsig_rdata_set_tsig_error(tsig_rr, 0);
+	tsig_rdata_set_mac(tsig_rr, strlen("nonsensemac"),
+	                   (uint8_t *)"nonsensemac");
+		
+	/* Create dummy wire. */
+	uint8_t wire[500];
+	size_t wire_size = 500;
+	
+	/*!< \note
+	 * Since there are no meaningful data in the wire,
+	 * the function should fail.
+	 */
+	int ret = knot_tsig_client_check(tsig_rr,
+	                                 wire, wire_size, NULL, 0, &key, 0);
+	if (ret != KNOT_TSIG_EBADSIG) {
+		diag("tsig_server_check did not return TSIG_EBADSIG when "
+		     "given random wire!");
+		errors++;
+	}
+	
+	/* Set 0 time - the error should be TSIG_EBADTIME. */
+	tsig_rdata_set_time_signed(tsig_rr, 0);
+	ret = knot_tsig_client_check(tsig_rr, wire, wire_size, NULL,
+	                             0, &key, 0);
+	if (ret != KNOT_TSIG_EBADTIME) {
+		diag("tsig_server_check did not return "
+		     "TSIG_EBADTIME when given zero time!");
+		errors++;
+	}
+		
+	return errors == 0;
+}
+
+static int test_knot_tsig_client_check_next()
+{
+	/*!< \todo think of extra test cases. */
+	return test_knot_tsig_client_check();
+}
+
+static int test_knot_tsig_test_tsig_add()
+{
+	int errors = 0;
+	
+	/* Faulty arguments. */
+	int lived = 0;
+	lives_ok({
+		int ret = knot_tsig_add(NULL, NULL, 0, 0, NULL);
+		if (ret != KNOT_EBADARG) {
+			diag("tsig_add did not return EBADARG "
+			     "when given NULL parameters.");
+			errors++;
+		}
+		lived = 1;
+		
+		lived = 0;
+		ret = knot_tsig_add((uint8_t *)0x1, NULL, 0, 0, NULL);
+		if (ret != KNOT_EBADARG) {
+			diag("tsig_add did not return EBADARG when "
+			     "given NULL parameters.");
+			errors++;
+		}
+		lived = 1;
+	}, NULL);
+	
+	errors += !lived;
+	
+	if (errors) {
+		diag("NULL tests failed!");
+	}
+	
+	size_t wire_size = 512;
+	uint8_t wire[wire_size * 2];
+	
+	/*! \todo Fix */
+	int ret = knot_tsig_add(wire, &wire_size, wire_size * 2, 0, NULL);
+	if (ret != KNOT_EOK) {
+		diag("tsig_add did not return EOK when given valid parameters."
+		     " returned: %s", knot_strerror(ret));
+		errors++;
+	}
+	
+	return errors == 0;
+}
+
+/*! This helper routine should report number of
+ *  scheduled tests for given parameters.
+ */
+static int knot_tsig_tests_count(int argc, char *argv[])
+{
+	return KNOT_TSIG_TEST_COUNT;
+}
+
+/*! Run all scheduled tests for given parameters.
+ */
+static int knot_tsig_tests_run(int argc, char *argv[])
+{
+	int res_final = 0;
+	int res = 0;
+
+	ok(res = test_knot_tsig_sign(), "tsig: sign");
+	res_final *= res;
+	ok(res = test_knot_tsig_sign_next(), "tsig: sign next");
+	res_final *= res;
+	ok(res = test_knot_tsig_server_check(), "tsig: server check");
+	res_final *= res;
+	ok(res = test_knot_tsig_client_check(), "tsig: client check");
+	res_final *= res;
+	ok(res = test_knot_tsig_client_check_next(), "tsig: client check next");
+	res_final *= res;
+	ok(res = test_knot_tsig_test_tsig_add(), "tsig: tsig add");
+	res_final *= res;
+
+	return res_final;
+}
diff --git a/src/tests/libknot/libknot/tsig_tests.h b/src/tests/libknot/libknot/tsig_tests.h
new file mode 100644
index 0000000..8ea15f6
--- /dev/null
+++ b/src/tests/libknot/libknot/tsig_tests.h
@@ -0,0 +1,9 @@
+#ifndef TSIH_TESTS_H
+#define TSIH_TESTS_H
+
+#include "common/libtap/tap_unit.h"
+
+/* Unit API. */
+unit_api tsig_tests_api;
+
+#endif // TSIH_TESTS_H
diff --git a/src/tests/libknot/realdata/libknot_tests_loader_realdata.c b/src/tests/libknot/realdata/libknot_tests_loader_realdata.c
index 71a9c3d..e972855 100644
--- a/src/tests/libknot/realdata/libknot_tests_loader_realdata.c
+++ b/src/tests/libknot/realdata/libknot_tests_loader_realdata.c
@@ -988,9 +988,6 @@ static int add_rrset_to_node(const test_rrset_t *rrset, test_data_t *data)
 	tmp_node->next = NULL;
 
 
-//	printf("%s\n", rrset->owner->wire);
-//	getchar();
-
 /*	tmp_node->avl_left = NULL;
 	tmp_node->avl_right = NULL;
 	tmp_node->avl_height = 0; */
diff --git a/src/tests/libknot/unittests_libknot.c b/src/tests/libknot/unittests_libknot.c
index 62d4b90..d522e1d 100644
--- a/src/tests/libknot/unittests_libknot.c
+++ b/src/tests/libknot/unittests_libknot.c
@@ -33,6 +33,7 @@
 #include "tests/libknot/libknot/query_tests.h"
 #include "tests/libknot/libknot/zonedb_tests.h"
 #include "tests/libknot/libknot/zone_tree_tests.h"
+#include "tests/libknot/libknot/tsig_tests.h"
 
 // Run all loaded units
 int main(int argc, char *argv[])
@@ -58,6 +59,7 @@ int main(int argc, char *argv[])
 		&query_tests_api,
 		&zonedb_tests_api,   //! DNS library (zonedb) unit
 		&zone_tree_tests_api,
+		&tsig_tests_api,
 		NULL
 	};
 
diff --git a/src/tests/xfr_tests.c b/src/tests/xfr_tests.c
new file mode 100644
index 0000000..8a0b703
--- /dev/null
+++ b/src/tests/xfr_tests.c
@@ -0,0 +1,369 @@
+/*  Copyright (C) 2011 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/*
+ * This test is basically a copy of the whole server, with following exceptions:
+ * - conf file path is hardcoded, because it is generated by script
+ * 	invoking this binary.
+ * - signal handler now handles one more signal
+ * 	SIGCONT is used to signal this
+ * 		binary that an integrity check should be done
+ * - once the integrity check is completed, the server signal the script
+*/
+
+#include <time.h>
+#include <config.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <getopt.h>
+
+#include "knot/common.h"
+#include "knot/other/error.h"
+#include "knot/server/server.h"
+#include "knot/ctl/process.h"
+#include "knot/conf/conf.h"
+#include "knot/conf/logconf.h"
+#include "common/evqueue.h"
+#include "knot/server/zones.h"
+
+/*----------------------------------------------------------------------------*/
+
+/* Signal flags. */
+static volatile short sig_req_stop = 0;
+static volatile short sig_req_reload = 0;
+static volatile short sig_stopping = 0;
+
+/* Global PID of invoking script. */
+static pid_t script_pid;
+static const char *zone;
+
+// SIGINT signal handler
+void interrupt_handle(int s)
+{
+	// Reload configuration
+	if (s == SIGHUP) {
+		sig_req_reload = 1;
+		return;
+	}
+
+	// Stop server
+	if (s == SIGINT || s == SIGTERM) {
+		if (sig_stopping == 0) {
+			sig_req_stop = 1;
+			sig_stopping = 1;
+		} else {
+			log_server_notice("OK! Exiting immediately.\n");
+			exit(1);
+		}
+	}
+	
+	// Start zone integrity check
+	if (s == SIGCONT) {
+		/*!< \todo Insert actual integrity check! */
+		if (1) {
+			kill(script_pid, SIGCONT);
+		} else {
+			kill(script_pid, SIGHUP);
+		}
+	}
+}
+
+void help(int argc, char **argv)
+{
+	printf("Usage: %sd [parameters]\n",
+	       PACKAGE_NAME);
+	printf("Parameters:\n"
+	       " -c, --config [file] Select configuration file.\n"
+	       " -d, --daemonize     Run server as a daemon.\n"
+	       " -v, --verbose       Verbose mode - additional runtime information.\n"
+	       " -V, --version       Print version of the server.\n"
+	       " -h, --help          Print help and usage.\n");
+}
+
+int main(int argc, char **argv)
+{
+	// Parse command line arguments
+	int c = 0, li = 0;
+	int verbose = 0;
+	int daemonize = 0;
+	char* config_fn = 0;
+	
+	/* Long options. */
+	struct option opts[] = {
+		{"config",    required_argument, 0, 'c'},
+		{"script_pid",required_argument, 0, 'p'},
+		{"daemonize", no_argument,       0, 'd'},
+		{"verbose",   no_argument,       0, 'v'},
+		{"version",   no_argument,       0, 'V'},
+		{"help",      no_argument,       0, 'h'},
+		{0, 0, 0, 0}
+	};
+	
+	while ((c = getopt_long(argc, argv, "c:p:dvVh", opts, &li)) != -1) {
+		switch (c)
+		{
+		case 'c':
+			config_fn = strdup(optarg);
+			break;
+		case 'd':
+			daemonize = 1;
+			break;
+		case 'v':
+			verbose = 1;
+			break;
+		case 'V':
+			printf("%s, version %s\n", "Knot DNS", PACKAGE_VERSION);
+			return 0;
+		case 'p':
+			script_pid = atoi(optarg);
+			break;
+		case 'z':
+			zone = strdup(optarg);
+			break;
+		case 'h':
+		case '?':
+		default:
+			help(argc, argv);
+			return 1;
+		}
+	}
+
+	// Now check if we want to daemonize
+	if (daemonize) {
+		if (daemon(1, 0) != 0) {
+			fprintf(stderr, "Daemonization failed, "
+					"shutting down...\n");
+			return 1;
+		}
+	}
+
+	// Register service and signal handler
+	struct sigaction emptyset;
+	memset(&emptyset, 0, sizeof(struct sigaction));
+	emptyset.sa_handler = interrupt_handle;
+	sigemptyset(&emptyset.sa_mask);
+	emptyset.sa_flags = 0;
+	sigaction(SIGALRM, &emptyset, NULL); // Interrupt
+
+	// Setup event queue
+	evqueue_set(evqueue_new());
+
+	// Initialize log
+	log_init();
+
+	// Verbose mode
+	if (verbose) {
+		int mask = LOG_MASK(LOG_INFO)|LOG_MASK(LOG_DEBUG);
+		log_levels_add(LOGT_STDOUT, LOG_ANY, mask);
+	}
+
+	// Initialize pseudorandom number generator
+	srand(time(0));
+
+	// Create server
+	server_t *server = server_create();
+
+	// Initialize configuration
+	conf_read_lock();
+	conf_add_hook(conf(), CONF_LOG, log_conf_hook, 0);
+	conf_add_hook(conf(), CONF_LOG, zones_ns_conf_hook, server->nameserver);
+	conf_add_hook(conf(), CONF_LOG, server_conf_hook, server);
+	conf_read_unlock();
+
+	// Find implicit configuration file
+	if (!config_fn) {
+		config_fn = conf_find_default();
+	}
+
+	// Find absolute path for config file
+	if (config_fn[0] != '/')
+	{
+		// Get absolute path to cwd
+		size_t cwbuflen = 64;
+		char *cwbuf = malloc((cwbuflen + 2) * sizeof(char));
+		while (getcwd(cwbuf, cwbuflen) == 0) {
+			cwbuflen *= 2;
+			cwbuf = realloc(cwbuf, (cwbuflen + 2) * sizeof(char));
+		}
+		cwbuflen = strlen(cwbuf);
+
+		// Append ending slash
+		if (cwbuf[cwbuflen - 1] != '/') {
+			cwbuf = strncat(cwbuf, "/", 1);
+		}
+
+		// Assemble path to config file
+		char *abs_cfg = strcdup(cwbuf, config_fn);
+		free(config_fn);
+		free(cwbuf);
+		config_fn = abs_cfg;
+	}
+
+	// Open configuration
+	log_server_info("Parsing configuration '%s' ...\n", config_fn);
+	if (conf_open(config_fn) != KNOTD_EOK) {
+
+		log_server_error("Failed to parse configuration file '%s'.\n",
+				 config_fn);
+		server_destroy(&server);
+		free(config_fn);
+		return 1;
+	} else {
+		log_server_info("Configured %d interfaces and %d zones.\n",
+				conf()->ifaces_count, conf()->zones_count);
+	}
+	log_server_info("\n");
+
+	// Create server instance
+	char* pidfile = pid_filename();
+
+	// Run server
+	int res = 0;
+	log_server_info("Starting server...\n");
+	if ((res = server_start(server)) == KNOTD_EOK) {
+
+		// Save PID
+		int has_pid = 1;
+		int rc = pid_write(pidfile);
+		if (rc < 0) {
+			has_pid = 0;
+			log_server_warning("Failed to create "
+					   "PID file '%s'.\n", pidfile);
+		}
+
+		// Change directory if daemonized
+		if (daemonize) {
+			log_server_info("Server started as a daemon, "
+					"PID = %ld\n", (long)getpid());
+			res = chdir("/");
+		} else {
+			log_server_info("Server started in foreground, "
+					"PID = %ld\n", (long)getpid());
+		}
+		if (has_pid) {
+			log_server_info("PID stored in %s\n", pidfile);
+		} else {
+			log_server_warning("Server running without PID file.\n");
+		}
+		size_t zcount = server->nameserver->zone_db->zone_count;
+		if (!zcount) {
+			log_server_warning("Server started, but no zones served.\n");
+		}
+
+		// Setup signal handler
+		struct sigaction sa;
+		memset(&sa, 0, sizeof(sa));
+		sa.sa_handler = interrupt_handle;
+		sigemptyset(&sa.sa_mask);
+		sigaction(SIGINT,  &sa, NULL);
+		sigaction(SIGTERM, &sa, NULL);
+		sigaction(SIGHUP,  &sa, NULL);
+		sigaction(SIGCONT,  &sa, NULL);
+		sa.sa_flags = 0;
+		pthread_sigmask(SIG_BLOCK, &sa.sa_mask, NULL);
+
+		/* Run event loop. */
+		for(;;) {
+			pthread_sigmask(SIG_UNBLOCK, &sa.sa_mask, NULL);
+			int ret = evqueue_poll(evqueue(), 0, 0);
+			pthread_sigmask(SIG_BLOCK, &sa.sa_mask, NULL);
+
+			/* Interrupts. */
+			/*! \todo More robust way to exit evloop.
+			 *        Event loop should exit with a special
+			 *        event.
+			 */
+			if (sig_req_stop) {
+				sig_req_stop = 0;
+				server_stop(server);
+				break;
+			}
+			if (sig_req_reload) {
+				log_server_info("Reloading configuration...\n");
+				sig_req_reload = 0;
+				int cf_ret = conf_open(config_fn);
+				switch (cf_ret) {
+				case KNOTD_EOK:
+					log_server_info("Configuration "
+							"reloaded.\n");
+					break;
+				case KNOTD_ENOENT:
+					log_server_error("Configuration "
+							 "file '%s' "
+							 "not found.\n",
+							 conf()->filename);
+					break;
+				default:
+					log_server_error("Configuration "
+							 "reload failed.\n");
+					break;
+				}
+			}
+
+			/* Events. */
+			if (ret > 0) {
+				event_t ev;
+				if (evqueue_get(evqueue(), &ev) == 0) {
+					dbg_server_verb("Event: "
+					                "received new event.\n");
+					if (ev.cb) {
+						ev.cb(&ev);
+					}
+				}
+			}
+		}
+		pthread_sigmask(SIG_UNBLOCK, &sa.sa_mask, NULL);
+
+		if ((res = server_wait(server)) != KNOTD_EOK) {
+			log_server_error("An error occured while "
+					 "waiting for server to finish.\n");
+		} else {
+			log_server_info("Server finished.\n");
+		}
+
+	} else {
+		log_server_fatal("An error occured while "
+				 "starting the server.\n");
+	}
+
+	// Stop server and close log
+	server_destroy(&server);
+
+	// Remove PID file
+	if (pid_remove(pidfile) < 0) {
+		log_server_warning("Failed to remove PID file.\n");
+	}
+
+	log_server_info("Shut down.\n");
+	log_close();
+	free(pidfile);
+
+	// Destroy event loop
+	evqueue_t *q = evqueue();
+	evqueue_free(&q);
+
+	// Free default config filename if exists
+	free(config_fn);
+
+	if (!daemonize) {
+		fflush(stdout);
+		fflush(stderr);
+	}
+
+	return res;
+}
+
diff --git a/src/tests/xfr_tests.h b/src/tests/xfr_tests.h
new file mode 100644
index 0000000..29de11d
--- /dev/null
+++ b/src/tests/xfr_tests.h
@@ -0,0 +1,10 @@
+#ifndef XFR_TESTS_H
+#define XFR_TESTS_H
+
+class xfr_tests
+{
+public:
+    xfr_tests();
+};
+
+#endif // XFR_TESTS_H
author	Ondřej Surý <ondrej@sury.org>	2012-01-16 09:06:06 +0100
committer	Ondřej Surý <ondrej@sury.org>	2012-01-16 09:06:06 +0100
commit	008d2859f102613c5a1d064c97e5dc7ea753faa2 (patch)
tree	3c86cc7ea7616be45fc1aa6179967af62beef1ad
parent	24569f087c5ea054a9199d7532dbbc98dd760ab5 (diff)
download	knot-008d2859f102613c5a1d064c97e5dc7ea753faa2.tar.gz