New upstream version 1.4.1

50 files changed, 406 insertions, 375 deletions

diff --git a/Makefile.in b/Makefile.in
index 65bd3e0..75dcf11 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -314,7 +314,7 @@ am__relativize = \
     dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \
   done; \
   reldir="$$dir2"
-DIST_ARCHIVES = $(distdir).tar.gz $(distdir).tar.bz2 $(distdir).tar.xz
+DIST_ARCHIVES = $(distdir).tar.gz $(distdir).tar.xz
 GZIP_ENV = --best
 distuninstallcheck_listfiles = find . -type f -print
 am__distuninstallcheck_listfiles = $(distuninstallcheck_listfiles) \
@@ -1020,6 +1020,7 @@ distdir: $(DISTFILES)
 dist-gzip: distdir
 	tardir=$(distdir) && $(am__tar) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz
 	$(am__remove_distdir)
+
 dist-bzip2: distdir
 	tardir=$(distdir) && $(am__tar) | BZIP2=$${BZIP2--9} bzip2 -c >$(distdir).tar.bz2
 	$(am__remove_distdir)
@@ -1050,7 +1051,6 @@ dist-zip: distdir
 
 dist dist-all: distdir
 	tardir=$(distdir) && $(am__tar) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz
-	tardir=$(distdir) && $(am__tar) | BZIP2=$${BZIP2--9} bzip2 -c >$(distdir).tar.bz2
 	tardir=$(distdir) && $(am__tar) | XZ_OPT=$${XZ_OPT--e} xz -c >$(distdir).tar.xz
 	$(am__remove_distdir)
 
diff --git a/NEWS b/NEWS
index 8636685..e8a4fd2 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,13 @@
 Knot DNS NEWS
 
+v1.4.1 - Jan 13, 2013
+---------------------
+Bugfixes:
+	* Empty APL record support
+	* 'zonestatus' when using immediate zone syncing
+	* Immediate zone syncing after reload
+	* Race condition writing time values to zone file
+
 v1.4.0 - Dec 27, 2013
 ---------------------
 Features:
diff --git a/configure b/configure
index 663b30f..0dd3d55 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for knot 1.4.0.
+# Generated by GNU Autoconf 2.69 for knot 1.4.1.
 #
 # Report bugs to <knot-dns@labs.nic.cz>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='knot'
 PACKAGE_TARNAME='knot'
-PACKAGE_VERSION='1.4.0'
-PACKAGE_STRING='knot 1.4.0'
+PACKAGE_VERSION='1.4.1'
+PACKAGE_STRING='knot 1.4.1'
 PACKAGE_BUGREPORT='knot-dns@labs.nic.cz'
 PACKAGE_URL=''
 
@@ -1359,7 +1359,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures knot 1.4.0 to adapt to many kinds of systems.
+\`configure' configures knot 1.4.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1429,7 +1429,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of knot 1.4.0:";;
+     short | recursive ) echo "Configuration of knot 1.4.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1575,7 +1575,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-knot configure 1.4.0
+knot configure 1.4.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1998,7 +1998,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by knot $as_me 1.4.0, which was
+It was created by knot $as_me 1.4.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2821,7 +2821,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='knot'
- VERSION='1.4.0'
+ VERSION='1.4.1'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -13313,11 +13313,6 @@ fi
       LIBS="$save_LIBS"
     done
 
-    if test "$with_openssl" = "no"; then :
-
-      as_fn_error $? "libcrypto (part of OpenSSL) is required" "$LINENO" 5
-
-fi
 
 elif test $pkg_failed = untried; then
      	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
@@ -13413,11 +13408,6 @@ fi
       LIBS="$save_LIBS"
     done
 
-    if test "$with_openssl" = "no"; then :
-
-      as_fn_error $? "libcrypto (part of OpenSSL) is required" "$LINENO" 5
-
-fi
 
 else
 	libcrypto_CFLAGS=$pkg_cv_libcrypto_CFLAGS
@@ -13433,6 +13423,30 @@ fi
 
 fi
 
+if test "$with_openssl" = "no"; then :
+
+  as_fn_error $? "OpenSSL library is required." "$LINENO" 5
+
+fi
+
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <openssl/crypto.h>
+   #if (OPENSSL_VERSION_NUMBER >= 0x1000000fL)
+   openssl_version_ok
+   #endif
+
+_ACEOF
+if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
+  $EGREP "openssl_version_ok" >/dev/null 2>&1; then :
+
+else
+  as_fn_error $? "OpenSSL library version >= 1.0.0 is required." "$LINENO" 5
+
+fi
+rm -f conftest*
+
+
 
 # Check whether --with-libidn was given.
 if test "${with_libidn+set}" = set; then :
@@ -13981,7 +13995,7 @@ fi
 
 
 # Checks for library functions.
-for ac_func in clock_gettime gettimeofday fgetln getline madvise poll posix_memalign pselect pthread_setaffinity_np regcomp select setgroups initgroups
+for ac_func in clock_gettime gettimeofday fgetln getline madvise malloc_trim poll posix_memalign pselect pthread_setaffinity_np regcomp select setgroups initgroups
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -14660,7 +14674,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by knot $as_me 1.4.0, which was
+This file was extended by knot $as_me 1.4.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -14726,7 +14740,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-knot config.status 1.4.0
+knot config.status 1.4.1
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index 4c025d3..90b0db9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,8 +1,8 @@
 #                                               -*- Autoconf -*-
 
 AC_PREREQ([2.60])
-AC_INIT([knot], [1.4.0], [knot-dns@labs.nic.cz])
-AM_INIT_AUTOMAKE([gnits subdir-objects dist-bzip2 dist-xz -Wall -Werror])
+AC_INIT([knot], [1.4.1], [knot-dns@labs.nic.cz])
+AM_INIT_AUTOMAKE([gnits subdir-objects dist-xz -Wall -Werror])
 AM_SILENT_RULES([yes])
 AC_CONFIG_SRCDIR([src/knot/main.c])
 AC_CONFIG_HEADERS([src/config.h])
@@ -276,12 +276,21 @@ AS_IF([test "$with_openssl" != "no"],[
       LIBS="$save_LIBS"
     done
 
-    AS_IF([test "$with_openssl" = "no"],[
-      AC_MSG_ERROR([libcrypto (part of OpenSSL) is required])
-    ])
   ])
 ])
 
+AS_IF([test "$with_openssl" = "no"],[
+  AC_MSG_ERROR([OpenSSL library is required.])
+])
+
+AC_EGREP_CPP(openssl_version_ok,
+  [#include <openssl/crypto.h>
+   #if (OPENSSL_VERSION_NUMBER >= 0x1000000fL)
+   openssl_version_ok
+   #endif
+  ],[],[AC_MSG_ERROR([OpenSSL library version >= 1.0.0 is required.])]
+)
+
 AC_ARG_WITH(libidn, AC_HELP_STRING([--with-libidn=[DIR]],
     [Support IDN (needs GNU Libidn)]),
     libidn=$withval, libidn=yes)
@@ -316,7 +325,7 @@ AC_TYPE_SIZE_T
 AC_TYPE_SSIZE_T
 
 # Checks for library functions.
-AC_CHECK_FUNCS([clock_gettime gettimeofday fgetln getline madvise poll posix_memalign pselect pthread_setaffinity_np regcomp select setgroups initgroups])
+AC_CHECK_FUNCS([clock_gettime gettimeofday fgetln getline madvise malloc_trim poll posix_memalign pselect pthread_setaffinity_np regcomp select setgroups initgroups])
 
 # Check for be64toh function
 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <endian.h>]], [[return be64toh(0);]])],
diff --git a/doc/knot.info b/doc/knot.info
index 3e37025..a19b717 100644
--- a/doc/knot.info
+++ b/doc/knot.info
@@ -1,7 +1,7 @@
 This is knot.info, produced by makeinfo version 4.13 from knot.texi.
 
-This manual is for Knot DNS (version 1.4.0, 20 December 2013), which is
-a high-performance authoritative-only DNS server.
+This manual is for Knot DNS (version 1.4.1, 6 January 2014), which is a
+high-performance authoritative-only DNS server.
 
 Copyright (C) 2012 CZ.NIC, z.s.p.o.
 
@@ -30,7 +30,7 @@ File: knot.info,  Node: Top,  Next: Introduction,  Prev: (dir),  Up: (dir)
 Knot DNS
 ********
 
-This manual is for Knot DNS (version 1.4.0, 20 December 2013).
+This manual is for Knot DNS (version 1.4.1, 6 January 2014).
 
 * Menu:
 
@@ -1725,8 +1725,8 @@ A.1.3 system Example
 --------------------
 
      system {
-       identity "Knot DNS 1.4.0";
-       version "1.4.0";
+       identity "Knot DNS 1.4.1";
+       version "1.4.1";
        nsid    "amaterasu";
        rundir "/var/run/knot";
        workers 16;
@@ -2820,138 +2820,138 @@ Bind.
 
 
 Tag Table:
-Node: Top1040
-Node: Introduction4093
-Node: What is Knot DNS4391
-Node: Knot DNS features4909
-Node: Scope of this document5879
-Node: Knot DNS Resource Requirements6141
-Node: Hardware requirements6439
-Node: CPU requirements7079
-Node: Memory requirements7464
-Node: Supported operating system8180
-Node: Knot DNS Installation8648
-Node: Required build environment8955
-Node: Required libraries9522
-Node: Userspace RCU10327
-Node: Installation from the sources11279
-Node: Configuring and generating Makefiles11864
-Node: Compilation13353
-Node: Installation13929
-Node: Installation from packages14436
-Node: Installing Knot DNS packages on Debian14960
-Node: Installing Knot DNS packages on Ubuntu15938
-Node: Adding official PPA repository for Knot DNS16852
-Node: Installing Knot DNS packages on Fedora17480
-Node: Installing Knot DNS from ports on FreeBSD18879
-Node: Knot DNS Configuration19226
-Node: Minimal configuration19826
-Node: Slave configuration21609
-Node: Master configuration23605
-Node: Configuring multiple interfaces24651
-Node: Using DNS UPDATE25136
-Node: Remote control interface25828
-Node: Enabling zone semantic checks26920
-Node: Creating IXFR differences from zone file changes27387
-Node: Using Response Rate Limiting27947
-Node: Automatic DNSSEC signing29411
-Node: Running Knot DNS33045
-Node: Running a slave server36503
-Node: Running a master server37799
-Node: Controlling running daemon38780
-Node: Troubleshooting39752
-Node: Submitting a bugreport40160
-Node: Generating backtrace41330
-Node: Debug messages42332
-Node: Enabling debug messages in server43002
-Node: Debug messages Example44435
-Node: Statement Index44634
-Node: Knot DNS Configuration Reference48749
-Node: system49156
-Node: system Syntax49517
-Node: system Statement Definition and Usage50405
-Node: identity50840
-Node: version51371
-Node: nsid51969
-Node: rundir52395
-Node: pidfile52733
-Node: workers53032
-Node: user53417
-Node: max-conn-idle53851
-Node: max-conn-handshake54173
-Node: max-conn-reply54553
-Node: transfers54791
-Node: rate-limit55076
-Node: rate-limit-size55818
-Node: rate-limit-slip56489
-Node: max-udp-payload57097
-Node: system Example57315
-Node: keys57669
-Node: keys Syntax57976
-Node: keys Statement Definition and Usage58205
-Node: key_id58411
-Node: Example59373
-Node: interfaces59607
-Node: interfaces Syntax59942
-Node: interfaces Statement Definition and Usage60280
-Node: interface_id60522
-Node: interfaces Examples60886
-Node: remotes61365
-Node: remotes Syntax61964
-Node: remotes Statement Definition and Grammar62403
-Node: remote_id62673
-Node: address62873
-Node: port63092
-Node: key63346
-Node: via63561
-Node: remotes Examples63791
-Node: groups64317
-Node: groups Syntax65007
-Node: groups Statement Definition and Grammar65225
-Node: group_id65483
-Node: groups_remote_id65690
-Node: groups Examples65937
-Node: control66343
-Node: control Syntax66880
-Node: control Statement Definition and Grammar67248
-Node: control Examples67831
-Node: zones68313
-Node: zones Syntax68657
-Node: zones Statement Definition and Grammar69875
-Node: zone_id70396
-Node: file70784
-Node: xfr-in71128
-Node: xfr-out71467
-Node: notify-in71812
-Node: notify-out72060
-Node: update-in72315
-Node: storage72650
-Node: semantic-checks73307
-Node: ixfr-from-differences73724
-Node: disable-any74269
-Node: notify-timeout74656
-Node: notify-retries75001
-Node: zonefile-sync75320
-Node: ixfr-fslimit76303
-Node: dnssec-keydir76731
-Node: dnssec-enable76988
-Node: signature-lifetime77333
-Node: serial-policy78149
-Node: zones Example78989
-Node: zones List of zone semantic checks80090
-Node: log81890
-Node: log Syntax82113
-Node: log Statement Definition and Grammar82439
-Node: log_name83149
-Node: category83478
-Node: severity83945
-Node: log_file84687
-Node: log Example84942
-Node: include85325
-Node: include Syntax85794
-Node: include Examples85932
-Node: Migration from other DNS servers86199
-Node: Knot DNS for BIND users86437
+Node: Top1038
+Node: Introduction4089
+Node: What is Knot DNS4387
+Node: Knot DNS features4905
+Node: Scope of this document5875
+Node: Knot DNS Resource Requirements6137
+Node: Hardware requirements6435
+Node: CPU requirements7075
+Node: Memory requirements7460
+Node: Supported operating system8176
+Node: Knot DNS Installation8644
+Node: Required build environment8951
+Node: Required libraries9518
+Node: Userspace RCU10323
+Node: Installation from the sources11275
+Node: Configuring and generating Makefiles11860
+Node: Compilation13349
+Node: Installation13925
+Node: Installation from packages14432
+Node: Installing Knot DNS packages on Debian14956
+Node: Installing Knot DNS packages on Ubuntu15934
+Node: Adding official PPA repository for Knot DNS16848
+Node: Installing Knot DNS packages on Fedora17476
+Node: Installing Knot DNS from ports on FreeBSD18875
+Node: Knot DNS Configuration19222
+Node: Minimal configuration19822
+Node: Slave configuration21605
+Node: Master configuration23601
+Node: Configuring multiple interfaces24647
+Node: Using DNS UPDATE25132
+Node: Remote control interface25824
+Node: Enabling zone semantic checks26916
+Node: Creating IXFR differences from zone file changes27383
+Node: Using Response Rate Limiting27943
+Node: Automatic DNSSEC signing29407
+Node: Running Knot DNS33041
+Node: Running a slave server36499
+Node: Running a master server37795
+Node: Controlling running daemon38776
+Node: Troubleshooting39748
+Node: Submitting a bugreport40156
+Node: Generating backtrace41326
+Node: Debug messages42328
+Node: Enabling debug messages in server42998
+Node: Debug messages Example44431
+Node: Statement Index44630
+Node: Knot DNS Configuration Reference48745
+Node: system49152
+Node: system Syntax49513
+Node: system Statement Definition and Usage50401
+Node: identity50836
+Node: version51367
+Node: nsid51965
+Node: rundir52391
+Node: pidfile52729
+Node: workers53028
+Node: user53413
+Node: max-conn-idle53847
+Node: max-conn-handshake54169
+Node: max-conn-reply54549
+Node: transfers54787
+Node: rate-limit55072
+Node: rate-limit-size55814
+Node: rate-limit-slip56485
+Node: max-udp-payload57093
+Node: system Example57311
+Node: keys57665
+Node: keys Syntax57972
+Node: keys Statement Definition and Usage58201
+Node: key_id58407
+Node: Example59369
+Node: interfaces59603
+Node: interfaces Syntax59938
+Node: interfaces Statement Definition and Usage60276
+Node: interface_id60518
+Node: interfaces Examples60882
+Node: remotes61361
+Node: remotes Syntax61960
+Node: remotes Statement Definition and Grammar62399
+Node: remote_id62669
+Node: address62869
+Node: port63088
+Node: key63342
+Node: via63557
+Node: remotes Examples63787
+Node: groups64313
+Node: groups Syntax65003
+Node: groups Statement Definition and Grammar65221
+Node: group_id65479
+Node: groups_remote_id65686
+Node: groups Examples65933
+Node: control66339
+Node: control Syntax66876
+Node: control Statement Definition and Grammar67244
+Node: control Examples67827
+Node: zones68309
+Node: zones Syntax68653
+Node: zones Statement Definition and Grammar69871
+Node: zone_id70392
+Node: file70780
+Node: xfr-in71124
+Node: xfr-out71463
+Node: notify-in71808
+Node: notify-out72056
+Node: update-in72311
+Node: storage72646
+Node: semantic-checks73303
+Node: ixfr-from-differences73720
+Node: disable-any74265
+Node: notify-timeout74652
+Node: notify-retries74997
+Node: zonefile-sync75316
+Node: ixfr-fslimit76299
+Node: dnssec-keydir76727
+Node: dnssec-enable76984
+Node: signature-lifetime77329
+Node: serial-policy78145
+Node: zones Example78985
+Node: zones List of zone semantic checks80086
+Node: log81886
+Node: log Syntax82109
+Node: log Statement Definition and Grammar82435
+Node: log_name83145
+Node: category83474
+Node: severity83941
+Node: log_file84683
+Node: log Example84938
+Node: include85321
+Node: include Syntax85790
+Node: include Examples85928
+Node: Migration from other DNS servers86195
+Node: Knot DNS for BIND users86433
 
 End Tag Table
 
diff --git a/doc/stamp-vti b/doc/stamp-vti
index 4f6cc30..c7cfa69 100644
--- a/doc/stamp-vti
+++ b/doc/stamp-vti
@@ -1,4 +1,4 @@
-@set UPDATED 20 December 2013
-@set UPDATED-MONTH December 2013
-@set EDITION 1.4.0
-@set VERSION 1.4.0
+@set UPDATED 6 January 2014
+@set UPDATED-MONTH January 2014
+@set EDITION 1.4.1
+@set VERSION 1.4.1
diff --git a/doc/version.texi b/doc/version.texi
index 4f6cc30..c7cfa69 100644
--- a/doc/version.texi
+++ b/doc/version.texi
@@ -1,4 +1,4 @@
-@set UPDATED 20 December 2013
-@set UPDATED-MONTH December 2013
-@set EDITION 1.4.0
-@set VERSION 1.4.0
+@set UPDATED 6 January 2014
+@set UPDATED-MONTH January 2014
+@set EDITION 1.4.1
+@set VERSION 1.4.1
diff --git a/man/kdig.1 b/man/kdig.1
index 5fdd414..ca5659e 100644
--- a/man/kdig.1
+++ b/man/kdig.1
@@ -1,4 +1,4 @@
-.TH "kdig" "1" "6 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.0"
+.TH "kdig" "1" "13 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.1"
 .SH NAME
 .TP 5
 .B kdig
diff --git a/man/khost.1 b/man/khost.1
index 6701ab0..6621d12 100644
--- a/man/khost.1
+++ b/man/khost.1
@@ -1,4 +1,4 @@
-.TH "khost" "1" "6 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.0"
+.TH "khost" "1" "13 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.1"
 .SH NAME
 .TP 6
 .B khost
diff --git a/man/knot.conf.5 b/man/knot.conf.5
index 736ada4..287f566 100644
--- a/man/knot.conf.5
+++ b/man/knot.conf.5
@@ -1,4 +1,4 @@
-.TH "knot.conf" "5" "6 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.0"
+.TH "knot.conf" "5" "13 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.1"
 .SH "NAME"
 .LP
 .B knot.conf
diff --git a/man/knotc.8 b/man/knotc.8
index 1b89de8..ce89601 100644
--- a/man/knotc.8
+++ b/man/knotc.8
@@ -1,4 +1,4 @@
-.TH knotc "8" "6 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.0"
+.TH knotc "8" "13 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.1"
 .SH NAME
 .B knotc
 \- Knot DNS control utility
diff --git a/man/knotd.8 b/man/knotd.8
index 2cf3749..a9b8d3d 100644
--- a/man/knotd.8
+++ b/man/knotd.8
@@ -1,4 +1,4 @@
-.TH "knotd" "8" "6 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.0"
+.TH "knotd" "8" "13 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.1"
 .SH NAME
 .B knotd
 \- Knot DNS server daemon
diff --git a/man/knsec3hash.1 b/man/knsec3hash.1
index dcbe1c6..26bfd6d 100644
--- a/man/knsec3hash.1
+++ b/man/knsec3hash.1
@@ -1,4 +1,4 @@
-.TH "knsec3hash" "8" "June 2013" "CZ.NIC Labs" "Knot DNS, version 1.4.0"
+.TH "knsec3hash" "1" "June 2013" "CZ.NIC Labs" "Knot DNS, version 1.4.1"
 .SH NAME
 .B knsec3hash
 \- Simple utility to compute NSEC3 hash (libknot equivalent of ISC nsec3hash)
diff --git a/man/knsec3hash.1.in b/man/knsec3hash.1.in
index e3d7a88..8f3ca80 100644
--- a/man/knsec3hash.1.in
+++ b/man/knsec3hash.1.in
@@ -1,4 +1,4 @@
-.TH "knsec3hash" "8" "June 2013" "CZ.NIC Labs" "Knot DNS, version @VERSION@"
+.TH "knsec3hash" "1" "June 2013" "CZ.NIC Labs" "Knot DNS, version @VERSION@"
 .SH NAME
 .B knsec3hash
 \- Simple utility to compute NSEC3 hash (libknot equivalent of ISC nsec3hash)
diff --git a/man/knsupdate.1 b/man/knsupdate.1
index 7fba4d8..d9409fb 100644
--- a/man/knsupdate.1
+++ b/man/knsupdate.1
@@ -1,4 +1,4 @@
-.TH "knsupdate" "1" "6 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.0"
+.TH "knsupdate" "1" "13 January 2014" "CZ.NIC Labs" "Knot DNS, version 1.4.1"
 .SH NAME
 .TP 10
 .B knsupdate
diff --git a/src/common/evsched.c b/src/common/evsched.c
index 1e30feb..1b290bb 100644
--- a/src/common/evsched.c
+++ b/src/common/evsched.c
@@ -22,10 +22,11 @@
 #include "common/errcode.h"
 #include "common/evsched.h"
 
-/*! \todo Fix properly (issue #1581). */
-#ifndef HAVE_PSELECT
+/*! \bug #187: Disabled SLAB for events (testing reasons). */
+//#ifndef HAVE_PSELECT
 #define OPENBSD_SLAB_BROKEN
-#endif
+//#endif
+
 
 /*! \brief Some implementations of timercmp >= are broken, this is for compat.*/
 static inline int timercmp_ge(struct timeval *a, struct timeval *b) {
@@ -357,6 +358,8 @@ int evsched_cancel(evsched_t *s, event_t *ev)
 		ret = evsched_try_cancel(s, ev);
 	}
 
+	/* Reset event timer. */
+	memset(&ev->tv, 0, sizeof(struct timeval));
 	/* Now we're sure event is canceled or finished. */
 	return KNOT_EOK;
 }
diff --git a/src/common/hattrie/hat-trie.c b/src/common/hattrie/hat-trie.c
index 3715c1e..0c332a6 100644
--- a/src/common/hattrie/hat-trie.c
+++ b/src/common/hattrie/hat-trie.c
@@ -104,7 +104,14 @@ static node_ptr hattrie_consume_ns(node_ptr **s, size_t *sp, size_t slen,
                     bs = malloc(slen * sizeof(node_ptr));
                     memcpy(bs, *s, (slen/2) * sizeof(node_ptr));
                 } else {        /* points to heap memory already */
-                    bs = realloc(bs, slen * sizeof(node_ptr));
+                    node_ptr *bs_new = realloc(bs, slen * sizeof(node_ptr));
+					/* \note tricky, hattrie should be slowly moved from 'never-expect-malloc-fail' state */
+					if (bs_new == NULL) {
+						*sp = 0;      /* caller will get take care of freeing old 'bs' */
+						return bs[0]; /* return root node, so the search fails */
+					} else {
+						bs = bs_new;
+					}
                 }
                 /* update parent pointer on resize */
                 *s = bs;
@@ -154,14 +161,13 @@ static inline int hattrie_clrval(hattrie_t *T, node_ptr n)
 static value_t* hattrie_find_rightmost(node_ptr node)
 {
     /* iterate children from right */
-    value_t *ret = NULL;
     if (*node.flag & NODE_TYPE_TRIE) {
         for (int i = TRIE_MAXCHAR; i > -1; --i) {
             /* skip repeated pointers to hybrid bucket */
             if (i < TRIE_MAXCHAR && node.t->xs[i].t == node.t->xs[i + 1].t)
                 continue;
             /* nest if trie */
-            ret = hattrie_find_rightmost(node.t->xs[i]);
+            value_t *ret = hattrie_find_rightmost(node.t->xs[i]);
             if (ret) {
                 return ret;
             }
@@ -317,7 +323,7 @@ hattrie_t* hattrie_dup(const hattrie_t* T, value_t (*nval)(value_t))
     /*! \todo could be probably implemented faster */
 
     size_t l = 0;
-    const char *k = 0;
+    const char *k = NULL;
     hattrie_iter_t *i = hattrie_iter_begin(T, false);
     while (!hattrie_iter_finished(i)) {
         k = hattrie_iter_key(i, &l);
diff --git a/src/common/hhash.c b/src/common/hhash.c
index c4374bd..2e1aefd 100644
--- a/src/common/hhash.c
+++ b/src/common/hhash.c
@@ -30,7 +30,7 @@ static int universal_cmp(uint32_t k1, uint32_t k2, hhash_t *tbl);
  * Key is variable-sized string. */
 #define KEY_VAL(p) (p)
 #define KEY_LEN(p) ((p) + HHVAL_LEN)
-#define KEY_STR(p) ((p) + HHKEY_LEN)
+#define KEY_STR(p) ((char*)(p) + HHKEY_LEN)
 
 /*! \brief Helper function to read key length. */
 static inline uint16_t key_readlen(const void *k)
diff --git a/src/common/mempattern.c b/src/common/mempattern.c
index 5807cec..e5bbd6b 100644
--- a/src/common/mempattern.c
+++ b/src/common/mempattern.c
@@ -20,6 +20,9 @@
 #include <string.h>
 #include <sys/resource.h>
 #include <stdarg.h>
+#ifdef HAVE_MALLOC_TRIM
+ #include <malloc.h>
+#endif /* HAVE_MALLOC_TRIM */
 
 #include "common/mempattern.h"
 #include "common/log.h"
@@ -172,3 +175,11 @@ void usage_dump()
 	        usage.ru_nivcsw);
 	fprintf(stderr, "==================\n");
 }
+
+/*! \brief Trim excess heap memory. */
+void mem_trim(void)
+{
+#ifdef HAVE_MALLOC_TRIM
+	malloc_trim(0);
+#endif
+}
diff --git a/src/common/mempattern.h b/src/common/mempattern.h
index c7062ca..0b05d40 100644
--- a/src/common/mempattern.h
+++ b/src/common/mempattern.h
@@ -110,6 +110,9 @@ char* strcdup(const char *s1, const char *s2);
  */
 void usage_dump();
 
+/*! \brief Trim excess heap memory. */
+void mem_trim(void);
+
 #endif // _KNOTD_COMMON_MALLOC_H_
 
 /*! @} */
diff --git a/src/common/slab/alloc-common.h b/src/common/slab/alloc-common.h
index e15008a..ade4b43 100644
--- a/src/common/slab/alloc-common.h
+++ b/src/common/slab/alloc-common.h
@@ -55,7 +55,6 @@
 #define dbg_mem(msg...)
 #endif
 
-
 #endif /* _KNOTD_COMMON_ALLOC_COMMON_H_ */
 
 /*! @} */
diff --git a/src/common/sockaddr.c b/src/common/sockaddr.c
index b82edc8..ab61669 100644
--- a/src/common/sockaddr.c
+++ b/src/common/sockaddr.c
@@ -118,12 +118,11 @@ int sockaddr_tostr(const sockaddr_t *addr, char *dst, size_t size)
 		return -1;
 	}
 
-	/* Minimum length. */
-	size_t minlen = INET_ADDRSTRLEN;
-
 	/* Check unsupported IPv6. */
 #ifndef DISABLE_IPV6
-	minlen = INET6_ADDRSTRLEN;
+	size_t minlen = INET6_ADDRSTRLEN;
+#else
+	size_t minlen = INET_ADDRSTRLEN;
 #endif
 
 	/* Check minimum length. */
diff --git a/src/config.h.in b/src/config.h.in
index ad20881..b3bb53f 100644
--- a/src/config.h.in
+++ b/src/config.h.in
@@ -54,6 +54,9 @@
 /* Define to 1 if you have the `madvise' function. */
 #undef HAVE_MADVISE
 
+/* Define to 1 if you have the `malloc_trim' function. */
+#undef HAVE_MALLOC_TRIM
+
 /* Define to 1 if you have the <memory.h> header file. */
 #undef HAVE_MEMORY_H
 
diff --git a/src/knot/ctl/knotc_main.c b/src/knot/ctl/knotc_main.c
index 44395bd..74a9e0a 100644
--- a/src/knot/ctl/knotc_main.c
+++ b/src/knot/ctl/knotc_main.c
@@ -374,7 +374,7 @@ static int tsig_parse_file(knot_tsig_key_t *k, const char *f)
 				ret = KNOT_EMALF;
 				break;
 			}
-			line[llen++] = '\0';
+			line[llen] = '\0';
 			ret = tsig_parse_line(k, line);
 			llen = 0;
 		} else {
diff --git a/src/knot/ctl/process.c b/src/knot/ctl/process.c
index 32e2bb1..5e08c17 100644
--- a/src/knot/ctl/process.c
+++ b/src/knot/ctl/process.c
@@ -157,8 +157,8 @@ int proc_update_privileges(int uid, int gid)
 						   uid, strerror(errno));
 			}
 		}
-	}
 # endif /* HAVE_INITGROUPS */
+	}
 #endif /* HAVE_SETGROUPS */
 
 	/* Watch uid/gid. */
diff --git a/src/knot/ctl/remote.c b/src/knot/ctl/remote.c
index 17b0698..e616443 100644
--- a/src/knot/ctl/remote.c
+++ b/src/knot/ctl/remote.c
@@ -286,7 +286,7 @@ static int remote_c_zonestatus(server_t *s, remote_cmdargs_t* a)
 		char *when = NULL;
 		if (zd->xfr_in.state == XFR_PENDING) {
 			when = strdup("pending");
-		} else if (zd->xfr_in.timer) {
+		} else if (zd->xfr_in.timer && zd->xfr_in.timer->tv.tv_sec != 0) {
 			struct timeval now, dif;
 			gettimeofday(&now, 0);
 			timersub(&zd->xfr_in.timer->tv, &now, &dif);
@@ -296,15 +296,14 @@ static int remote_c_zonestatus(server_t *s, remote_cmdargs_t* a)
 				break;
 			}
 			/*! Workaround until proper zone fetching API and locking
-
 			 *  is implemented (ref #31)
 			 */
 			if (dif.tv_sec < 0) {
 				memcpy(when, "busy", 5);
-			} else if (snprintf(when, 64, "in %luh%lum%lus",
-			             dif.tv_sec/3600,
-			             (dif.tv_sec % 3600)/60,
-			             dif.tv_sec % 60) < 0) {
+			} else if (snprintf(when, 64, "in %uh%um%us",
+			                    (unsigned int)dif.tv_sec / 3600,
+			                    (unsigned int)(dif.tv_sec % 3600) / 60,
+			                    (unsigned int)dif.tv_sec % 60) < 0) {
 				free(when);
 				ret = KNOT_ESPACE;
 				break;
diff --git a/src/knot/server/server.c b/src/knot/server/server.c
index d3d5478..8008520 100644
--- a/src/knot/server/server.c
+++ b/src/knot/server/server.c
@@ -262,12 +262,14 @@ static int server_bind_sockets(server_t *s)
 		/* Find already matching interface. */
 		int found_match = 0;
 		conf_iface_t *cfg_if = (conf_iface_t*)n;
-		if (s->ifaces) WALK_LIST(m, s->ifaces->u) {
-			/* Matching port and address. */
-			if (cfg_if->port == m->port) {
-				if (strcmp(cfg_if->address, m->addr) == 0) {
-					found_match = 1;
-					break;
+		if (s->ifaces) {
+			WALK_LIST(m, s->ifaces->u) {
+				/* Matching port and address. */
+				if (cfg_if->port == m->port) {
+					if (strcmp(cfg_if->address, m->addr) == 0) {
+						found_match = 1;
+						break;
+					}
 				}
 			}
 		}
diff --git a/src/knot/server/xfr-handler.c b/src/knot/server/xfr-handler.c
index f381d3b..51cae3a 100644
--- a/src/knot/server/xfr-handler.c
+++ b/src/knot/server/xfr-handler.c
@@ -1425,6 +1425,10 @@ int xfr_task_free(knot_ns_xfr_t *rq)
 	free(rq->msg);
 	rq->msg = NULL;
 	free(rq);
+
+	/* Trim extra heap. */
+	mem_trim();
+
 	return KNOT_EOK;
 }
 
@@ -1446,19 +1450,14 @@ char *xfr_remote_str(const sockaddr_t *addr, const char *key)
 	}
 
 	/* Prepare address strings. */
-	char r_addr[SOCKADDR_STRLEN];
+	char r_addr[SOCKADDR_STRLEN] = {0};
 	int r_port = sockaddr_portnum(addr);
 	sockaddr_tostr(addr, r_addr, sizeof(r_addr));
 
 	/* Prepare key strings. */
-	char *tag = "";
-	char *q = "'";
 	if (key) {
-		tag = " key "; /* Prefix */
-	} else {
-		key = tag; /* Both empty. */
-		q = tag;
+		return sprintf_alloc("'%s@%d' key '%s'", r_addr, r_port, key);
 	}
 
-	return sprintf_alloc("'%s@%d'%s%s%s%s", r_addr, r_port, tag, q, key, q);
+	return sprintf_alloc("'%s@%d'", r_addr, r_port);
 }
diff --git a/src/knot/server/zone-load.c b/src/knot/server/zone-load.c
index e94151d..53ba876 100644
--- a/src/knot/server/zone-load.c
+++ b/src/knot/server/zone-load.c
@@ -666,10 +666,8 @@ static int update_zone(knot_zone_t **dst, conf_zone_t *conf, knot_nameserver_t *
 		goto fail;
 	}
 
-	/* Don't schedule when immediate syncing is used. */
-	if (conf->dbsync_timeout > 0) {
-		zones_schedule_ixfr_sync(new_zone, conf->dbsync_timeout);
-	}
+	/* Schedule zonefile flush. */
+	zones_schedule_ixfr_sync(new_zone, conf->dbsync_timeout);
 
 	knot_zone_contents_t *new_contents = new_zone->contents;
 	if (new_contents) {
diff --git a/src/knot/server/zones.c b/src/knot/server/zones.c
index 9a88d6e..2cd006f 100644
--- a/src/knot/server/zones.c
+++ b/src/knot/server/zones.c
@@ -374,7 +374,7 @@ static int zones_zonefile_sync_from_ev(knot_zone_t *zone, zonedata_t *zd)
 }
 
 /*!
- * \brief Sync chagnes in zone to zonefile.
+ * \brief Sync changes in zone to zonefile.
  */
 int zones_flush_ev(event_t *e)
 {
@@ -1248,15 +1248,17 @@ static int zones_process_update_auth(knot_zone_t *zone,
 		knot_zone_contents_set_gen_old(new_contents);
 		ret = xfrin_apply_changesets(fake_zone, sec_chs,
 		                             &dnssec_contents);
-		free(fake_zone);
 		if (ret != KNOT_EOK) {
 			log_zone_error("%s: Failed to sign incoming update %s\n",
 			               msg, knot_strerror(ret));
+			new_contents->zone = zone;
 			zones_store_changesets_rollback(transaction);
 			zones_free_merged_changesets(chgsets, sec_chs);
+			free(fake_zone);
 			return ret;
 		}
 		assert(dnssec_contents);
+		dnssec_contents->zone = zone;
 
 		// Plan zone resign if needed
 		zonedata_t *zd = (zonedata_t *)zone->data;
@@ -1265,14 +1267,17 @@ static int zones_process_update_auth(knot_zone_t *zone,
 		if (ret != KNOT_EOK) {
 			log_zone_error("%s: Failed to replan zone sign %s\n",
 			               msg, knot_strerror(ret));
+			new_contents->zone = zone;
 			zones_store_changesets_rollback(transaction);
 			zones_free_merged_changesets(chgsets, sec_chs);
+			free(fake_zone);
 			return ret;
 		}
-	} else {
-		free(fake_zone);
 	}
 
+	new_contents->zone = zone;
+	free(fake_zone);
+
 	dbg_zones_verb("%s: DNSSEC changes applied\n", msg);
 
 	// Commit transaction.
@@ -1331,6 +1336,9 @@ static int zones_process_update_auth(knot_zone_t *zone,
 	free(msg);
 	msg = NULL;
 
+	/* Trim extra heap. */
+	mem_trim();
+
 	/* Sync zonefile immediately if configured. */
 	zonedata_t *zone_data = (zonedata_t *)zone->data;
 	int sync_timeout = zone_data->conf->dbsync_timeout;
@@ -1596,8 +1604,6 @@ int zones_normal_query_answer(knot_nameserver_t *nameserver,
 			rcu_read_unlock();
 			return KNOT_EOK;
 		}
-		knot_ns_error_response_full(nameserver, resp, rcode, resp_wire,
-		                            rsize);
 	} else {
 		/*
 		 * Now we have zone. Verify TSIG if it is in the packet.
@@ -2121,6 +2127,7 @@ static int zones_dump_zone_text(knot_zone_contents_t *zone, const char *fname)
 	char *new_fname = NULL;
 	int fd = zones_open_free_filename(fname, &new_fname);
 	if (fd < 0) {
+		free(new_fname);
 		return KNOT_EWRITABLE;
 	}
 
@@ -2242,6 +2249,9 @@ int zones_ns_conf_hook(const struct conf_t *conf, void *data)
 	/* Delete all deprecated zones and delete the old database. */
 	knot_zonedb_deep_free(&old_db);
 
+	/* Trim extra heap. */
+	mem_trim();
+
 	/* Update events scheduled for zone. */
 	knot_zone_t *zone = NULL;
 	const knot_zone_t **zones = knot_zonedb_zones(ns->zone_db);
diff --git a/src/libknot/dname.c b/src/libknot/dname.c
index 96fa5f2..7cb3584 100644
--- a/src/libknot/dname.c
+++ b/src/libknot/dname.c
@@ -425,7 +425,7 @@ bool knot_dname_is_sub(const knot_dname_t *sub, const knot_dname_t *domain)
 	if (sub_l < 0 || domain_l < 0)
 		return false;
 
-	assert(sub >= 0 && sub_l <= KNOT_DNAME_MAXLABELS);
+	assert(sub_l >= 0 && sub_l <= KNOT_DNAME_MAXLABELS);
 	assert(domain_l >= 0 && domain_l <= KNOT_DNAME_MAXLABELS);
 
 	/* Subdomain must have more labels as parent. */
diff --git a/src/libknot/dnssec/config.h b/src/libknot/dnssec/config.h
index 79cab34..6e8582a 100644
--- a/src/libknot/dnssec/config.h
+++ b/src/libknot/dnssec/config.h
@@ -35,13 +35,13 @@
 #endif
 
 // ECDSA support requires OpenSSL version >= 1.0.1
-#if !defined(OPENSSL_NO_ECDSA) && OPENSSL_VERSION_NUMBER >= 0x10001000
+#if !defined(OPENSSL_NO_ECDSA) && OPENSSL_VERSION_NUMBER >= 0x10001000L
   #define KNOT_ENABLE_ECDSA 1
 #else
   #undef KNOT_ENABLE_ECDSA
 #endif
 
-#if !defined(OPENSSL_NO_GOST)
+#if !defined(OPENSSL_NO_GOST) && OPENSSL_VERSION_NUMBER >= 0x1000001fL
   #define KNOT_ENABLE_GOST 1
 #else
   #undef KNOT_ENABLE_GOST
diff --git a/src/libknot/dnssec/crypto.c b/src/libknot/dnssec/crypto.c
index c8c5a34..8c080dc 100644
--- a/src/libknot/dnssec/crypto.c
+++ b/src/libknot/dnssec/crypto.c
@@ -105,11 +105,20 @@ static void openssl_mutexes_destroy(void)
  *
  * \param openssl_id  Thread identifier in OpenSSL.
  */
+#if OPENSSL_VERSION_NUMBER >= 0x1000001fL
 static void openssl_threadid_cb(CRYPTO_THREADID *openssl_id)
 {
 	pthread_t id = pthread_self();
 	CRYPTO_THREADID_set_pointer(openssl_id, (void *)id);
 }
+#else
+static unsigned long openssl_threadid_cb(void)
+{
+	unsigned long ret;
+	ret = (unsigned long)pthread_self();
+	return(ret);
+}
+#endif
 
 /*- pluggable engines -------------------------------------------------------*/
 
@@ -181,7 +190,11 @@ void knot_crypto_init_threads(void)
 	}
 
 	// thread identification
+#if OPENSSL_VERSION_NUMBER >= 0x1000001fL
 	CRYPTO_THREADID_set_callback(openssl_threadid_cb);
+#else
+        CRYPTO_set_id_callback((unsigned long (*)())openssl_threadid_cb);
+#endif
 }
 
 void knot_crypto_cleanup_threads(void)
diff --git a/src/libknot/dnssec/zone-keys.c b/src/libknot/dnssec/zone-keys.c
index 2c59f1d..1cd4e75 100644
--- a/src/libknot/dnssec/zone-keys.c
+++ b/src/libknot/dnssec/zone-keys.c
@@ -232,7 +232,7 @@ int knot_load_zone_keys(const char *keydir_name, const knot_dname_t *zone_name,
 		                                       nsec3_enabled)
 		) {
 			log_zone_notice("%s Ignoring key %d (%s): unknown "
-			                "algorithm or non-NSEC3 algrorithm when"
+			                "algorithm or non-NSEC3 algorithm when"
 			                " NSEC3 is requested.\n", msgpref,
 			                params.keytag, entry->d_name);
 			knot_free_key_params(&params);
diff --git a/src/libknot/dnssec/zone-nsec.c b/src/libknot/dnssec/zone-nsec.c
index e261437..76c90d6 100644
--- a/src/libknot/dnssec/zone-nsec.c
+++ b/src/libknot/dnssec/zone-nsec.c
@@ -562,16 +562,20 @@ static int connect_nsec3_nodes(knot_node_t *a, knot_node_t *b, void *data)
 }
 
 /*!
- * \brief Check whether at least one RR type in node should be signed
+ * \brief Check whether at least one RR type in node should be signed,
+ *        used when signing with NSEC3.
  *
  * \param node  Node for which the check is done.
  *
  * \return true/false.
  */
-static bool node_should_be_signed(const knot_node_t *n)
+static bool node_should_be_signed_nsec3(const knot_node_t *n)
 {
 	knot_rrset_t **node_rrsets = knot_node_get_rrsets_no_copy(n);
 	for (int i = 0; i < n->rrset_count; i++) {
+		if (node_rrsets[i]->type == KNOT_RRTYPE_NSEC) {
+			continue;
+		}
 		if (knot_zone_sign_rr_should_be_signed(n, node_rrsets[i],
 		                                       NULL)) {
 			return true;
@@ -608,7 +612,7 @@ static knot_node_t *create_nsec3_node_for_node(knot_node_t *node,
 
 	bitmap_t rr_types = { 0 };
 	bitmap_add_node_rrsets(&rr_types, node);
-	if (node->rrset_count > 0 && node_should_be_signed(node)) {
+	if (node->rrset_count > 0 && node_should_be_signed_nsec3(node)) {
 		bitmap_add_type(&rr_types, KNOT_RRTYPE_RRSIG);
 	}
 	if (node == apex) {
diff --git a/src/libknot/nameserver/name-server.c b/src/libknot/nameserver/name-server.c
index fb5463d..8500894 100644
--- a/src/libknot/nameserver/name-server.c
+++ b/src/libknot/nameserver/name-server.c
@@ -3158,6 +3158,12 @@ int knot_ns_parse_packet(const uint8_t *query_wire, size_t qsize,
 		return KNOT_RCODE_FORMERR;
 	}
 
+	// 2) queries need to have 1 question
+	if (knot_wire_get_qdcount(packet->wireformat) != 1) {
+		dbg_ns("Missing question section, FORMERR\n");
+		return KNOT_RCODE_FORMERR;
+	}
+
 	dbg_ns_verb("Parsed packet header and Question:\n");
 	knot_packet_dump(packet);
 
diff --git a/src/libknot/packet/packet.c b/src/libknot/packet/packet.c
index 51f4b8b..86268b3 100644
--- a/src/libknot/packet/packet.c
+++ b/src/libknot/packet/packet.c
@@ -88,7 +88,7 @@ static int knot_packet_parse_rdata(knot_rrset_t *rr, const uint8_t *wire,
                                    size_t *pos, size_t total_size,
                                    size_t rdlength)
 {
-	if (!rr || !wire || !pos || rdlength == 0) {
+	if (!rr || !wire || !pos) {
 		return KNOT_EINVAL;
 	}
 
@@ -172,11 +172,6 @@ dbg_packet_exec_verb(
 
 	rrset->rrsigs = NULL;
 
-	if (rdlength == 0) {
-		return rrset;
-	}
-
-
 	// parse RDATA
 	/*! \todo Merge with add_rdata_to_rr in zcompile, should be a rrset func
 	 *        probably. */
@@ -489,7 +484,7 @@ int knot_packet_parse_from_wire(knot_packet_t *packet,
 		if ((err = knot_packet_parse_question(packet)) != KNOT_EOK)
 			return err;
 	} else if (qdcount > 1) {
-		dbg_packet("QDCOUNT larger than 1, FORMERR.\n");
+		dbg_packet("QDCOUNT > 1, FORMERR.\n");
 		return KNOT_EMALF;
 	}
 
diff --git a/src/libknot/packet/response.c b/src/libknot/packet/response.c
index a1b5c15..fae2176 100644
--- a/src/libknot/packet/response.c
+++ b/src/libknot/packet/response.c
@@ -404,7 +404,7 @@ int knot_response_add_opt(knot_packet_t *resp,
 	 * other options are supported.
 	 */
 
-	if (add_nsid) {
+	if (add_nsid && opt_rr->option_count > 0) {
 		resp->opt_rr.option_count = opt_rr->option_count;
 		assert(resp->opt_rr.options == NULL);
 		resp->opt_rr.options = (knot_opt_option_t *)malloc(
diff --git a/src/libknot/rrset-dump.c b/src/libknot/rrset-dump.c
index aac68b4..4e214f7 100644
--- a/src/libknot/rrset-dump.c
+++ b/src/libknot/rrset-dump.c
@@ -624,9 +624,10 @@ static void wire_timestamp_to_str(rrset_dump_params_t *p)
 	time_t timestamp = ntohl(data);
 
 	if (p->style->human_tmstamp) {
+		struct tm result;
 		// Write timestamp in YYYYMMDDhhmmss format.
 		ret = strftime(p->out, p->out_max, "%Y%m%d%H%M%S",
-		               gmtime(&timestamp));
+		               gmtime_r(&timestamp, &result));
 		if (ret == 0) {
 			return;
 		}
diff --git a/src/libknot/rrset.c b/src/libknot/rrset.c
index e6192da..0f85414 100644
--- a/src/libknot/rrset.c
+++ b/src/libknot/rrset.c
@@ -35,8 +35,6 @@
 #include "libknot/dname.h"
 #include "libknot/rdata.h"
 
-static const unsigned int RR_CHANGE_TOO_BIG = 16;
-
 static uint32_t rrset_rdata_offset(const knot_rrset_t *rrset, size_t pos)
 {
 	if (rrset == NULL || rrset->rdata_indices == NULL ||
@@ -135,8 +133,6 @@ dbg_rrset_exec_detail(
 static size_t rrset_rdata_remainder_size(const knot_rrset_t *rrset,
                                          size_t offset, size_t pos)
 {
-	assert(rrset_rdata_item_size(rrset, pos) != 0);
-
 	size_t ret = rrset_rdata_item_size(rrset, pos) - offset;
 	assert(ret <= rrset_rdata_size_total(rrset));
 	return ret;
@@ -771,7 +767,7 @@ int knot_rrset_add_rdata(knot_rrset_t *rrset,
 static uint8_t* knot_rrset_create_rdata_at_pos(knot_rrset_t *rrset,
                                                size_t pos, uint16_t size)
 {
-	if (rrset == NULL || size == 0 || pos > rrset->rdata_count) {
+	if (rrset == NULL || pos > rrset->rdata_count) {
 		return NULL;
 	}
 	if (pos == rrset->rdata_count) {
@@ -822,10 +818,10 @@ static uint8_t* knot_rrset_create_rdata_at_pos(knot_rrset_t *rrset,
 	return old_pointer;
 }
 
-int knot_rrset_add_rdata_at_pos(knot_rrset_t *rrset, size_t pos,
-                                const uint8_t *rdata, uint16_t size)
+static int knot_rrset_add_rdata_at_pos(knot_rrset_t *rrset, size_t pos,
+                                       const uint8_t *rdata, uint16_t size)
 {
-	if (rrset == NULL || rdata == NULL || size == 0) {
+	if (rrset == NULL || rdata == NULL) {
 		return KNOT_EINVAL;
 	}
 
@@ -842,7 +838,7 @@ int knot_rrset_add_rdata_at_pos(knot_rrset_t *rrset, size_t pos,
 
 uint8_t* knot_rrset_create_rdata(knot_rrset_t *rrset, uint16_t size)
 {
-	if (rrset == NULL || size == 0) {
+	if (rrset == NULL) {
 		return NULL;
 	}
 
@@ -1112,8 +1108,14 @@ int knot_rrset_rdata_from_wire_one(knot_rrset_t *rrset,
 	}
 
 	if (rdlength == 0) {
-		/* Nothing to parse, */
-		return KNOT_EOK;
+		/* Nothing to parse, APLs can have 0 RDLENGTH, but only APLs. */
+		if (rrset->type == KNOT_RRTYPE_APL) {
+			// Add empty RDATA
+			return knot_rrset_create_rdata(rrset, 0) == NULL ?
+			       KNOT_ENOMEM : KNOT_EOK;
+		} else {
+			return KNOT_EOK;
+		}
 	}
 
 	dbg_rrset_detail("rr: parse_rdata_wire: Parsing RDATA of size=%zu,"
diff --git a/src/utils/common/exec.c b/src/utils/common/exec.c
index 69cebc4..7d46001 100644
--- a/src/utils/common/exec.c
+++ b/src/utils/common/exec.c
@@ -228,17 +228,20 @@ static void print_section_full(const knot_rrset_t **rrsets,
 		}
 
 		while (knot_rrset_txt_dump(rrsets[i], buf, buflen,
-		                           true, true,
-		                           &(style->style)) < 0)
-		{
+		                           true, true, &(style->style)) < 0) {
 			buflen += 4096;
-			buf = realloc(buf, buflen);
-
 			// Oversize protection.
 			if (buflen > 1000000) {
 				WARN("can't print whole section\n");
 				break;
 			}
+
+			char *newbuf = realloc(buf, buflen);
+			if (newbuf == NULL) {
+				WARN("can't print whole section\n");
+				break;
+			}
+			buf = newbuf;
 		}
 		printf("%s", buf);
 	}
@@ -260,13 +263,18 @@ static void print_section_dig(const knot_rrset_t **rrsets,
 			while (knot_rrset_txt_dump_data(rrset, j, buf, buflen,
 			                                &(style->style)) < 0) {
 				buflen += 4096;
-				buf = realloc(buf, buflen);
-
 				// Oversize protection.
 				if (buflen > 1000000) {
 					WARN("can't print whole section\n");
 					break;
 				}
+
+				char *newbuf = realloc(buf, buflen);
+				if (newbuf == NULL) {
+					WARN("can't print whole section\n");
+					break;
+				}
+				buf = newbuf;
 			}
 			printf("%s\n", buf);
 		}
@@ -303,13 +311,18 @@ static void print_section_host(const knot_rrset_t **rrsets,
 			while (knot_rrset_txt_dump_data(rrset, j, buf, buflen,
 			                                &(style->style)) < 0) {
 				buflen += 4096;
-				buf = realloc(buf, buflen);
-
 				// Oversize protection.
 				if (buflen > 1000000) {
-					WARN("can't print whole RR set\n");
+					WARN("can't print whole section\n");
+					break;
+				}
+
+				char *newbuf = realloc(buf, buflen);
+				if (newbuf == NULL) {
+					WARN("can't print whole section\n");
 					break;
 				}
+				buf = newbuf;
 			}
 
 			if (descr != NULL) {
diff --git a/src/utils/common/resolv.c b/src/utils/common/resolv.c
index 279c06b..b9c5060 100644
--- a/src/utils/common/resolv.c
+++ b/src/utils/common/resolv.c
@@ -135,7 +135,7 @@ static int get_resolv_nameservers(list_t *servers, const char *def_port)
 		pos += len;
 
 		// Check if the token is not empty.
-		if (len <= 0) {
+		if (len == 0) {
 			continue;
 		}
 
@@ -144,7 +144,7 @@ static int get_resolv_nameservers(list_t *servers, const char *def_port)
 		pos += len;
 
 		// Check if there is a separation between tokens.
-		if (len <= 0) {
+		if (len == 0) {
 			continue;
 		}
 
diff --git a/src/utils/dig/dig_exec.c b/src/utils/dig/dig_exec.c
index 7acbdb7..3ea0da2 100644
--- a/src/utils/dig/dig_exec.c
+++ b/src/utils/dig/dig_exec.c
@@ -571,10 +571,10 @@ static int process_packet_xfr(const knot_packet_t     *query,
 			knot_lookup_table_t *rcode =
 				knot_lookup_by_id(knot_rcode_names, rcode_id);
 			if (rcode != NULL) {
-				ERR("server %s respond %s\n",
+				ERR("server %s responded %s\n",
 				    net->remote_str, rcode->name);
 			} else {
-				ERR("server %s respond %i\n",
+				ERR("server %s responded %i\n",
 				    net->remote_str, rcode_id);
 			}
 
diff --git a/src/utils/dig/dig_params.c b/src/utils/dig/dig_params.c
index e9121d8..71bc337 100644
--- a/src/utils/dig/dig_params.c
+++ b/src/utils/dig/dig_params.c
@@ -1109,7 +1109,6 @@ static void complete_servers(query_t *query, const query_t *conf)
 
 void complete_queries(list_t *queries, const query_t *conf)
 {
-	query_t *q = NULL;
 	node_t  *n = NULL;
 
 	if (queries == NULL || conf == NULL) {
@@ -1119,7 +1118,7 @@ void complete_queries(list_t *queries, const query_t *conf)
 
 	// If there is no query, add default query: NS to ".".
 	if (list_size(queries) == 0) {
-		q = query_create(".", conf);
+		query_t *q = query_create(".", conf);
 		if (q == NULL) {
 			WARN("can't create query . NS IN\n");
 			return;
diff --git a/src/zscanner/tests/tests.c b/src/zscanner/tests/tests.c
index 2970cf4..4674c23 100644
--- a/src/zscanner/tests/tests.c
+++ b/src/zscanner/tests/tests.c
@@ -42,10 +42,11 @@ int test__date_to_timestamp()
 	// Testing loop over whole input interval.
 	for (ref_timestamp = 0;
 	     ref_timestamp < max_timestamp;
-	     ref_timestamp += 30) {
+	     ref_timestamp += 1) {
+		struct tm result;
 		// Get reference (correct) timestamp.
 		strftime((char*)buffer, sizeof(buffer), "%Y%m%d%H%M%S",
-			 gmtime(&ref_timestamp));
+			 gmtime_r(&ref_timestamp, &result));
 
 		// Get testing timestamp.
 		date_to_timestamp(buffer, &test_timestamp);
diff --git a/src/zscanner/tests/zscanner-tool.c b/src/zscanner/tests/zscanner-tool.c
index c26cbf5..afdf5ce 100644
--- a/src/zscanner/tests/zscanner-tool.c
+++ b/src/zscanner/tests/zscanner-tool.c
@@ -19,6 +19,7 @@
 #include <stdio.h>			// printf
 #include <stdlib.h>			// atoi
 #include <getopt.h>			// getopt
+#include <pthread.h>			// pthread_t
 
 #include "error.h"		// knot_strerror
 #include "file_loader.h"	// file_loader
@@ -29,7 +30,14 @@
 #define DEFAULT_CLASS	1
 #define DEFAULT_TTL	0
 
-void help(void)
+static void *timestamp_worker(void *data)
+{
+	int *ret = (int *)data;
+	*ret = test__date_to_timestamp();
+	return NULL;
+}
+
+static void help(void)
 {
 	printf("\nZone scanner testing tool.\n"
 	       "Usage: zscanner-tool [parameters] origin zonefile\n"
@@ -79,7 +87,20 @@ int main(int argc, char *argv[])
 	}
 
 	if (test == 1) {
-		test__date_to_timestamp();
+		pthread_t t1, t2, t3;
+		int ret1, ret2, ret3;
+
+		pthread_create(&t1, NULL, timestamp_worker, &ret1);
+		pthread_create(&t2, NULL, timestamp_worker, &ret2);
+		pthread_create(&t3, NULL, timestamp_worker, &ret3);
+
+		pthread_join(t1, NULL);
+		pthread_join(t2, NULL);
+		pthread_join(t3, NULL);
+
+		if (ret1 != 0 || ret2 != 0 || ret3 != 0) {
+			return EXIT_FAILURE;
+		}
 	} else {
 		// Check if there are 2 remaining non-options.
 		if (argc - optind != 2) {
diff --git a/tests/dname.c b/tests/dname.c
index 24bea65..338f8fa 100644
--- a/tests/dname.c
+++ b/tests/dname.c
@@ -120,7 +120,6 @@ int main(int argc, char *argv[])
 
 	/* 18-19. dname cat (valid) */
 	w = "\x03""cat";
-	len = 5;
 	d = knot_dname_copy((const uint8_t *)w);
 	t = "*";
 	d2 = knot_dname_from_str(t);
diff --git a/tests/dthreads.c b/tests/dthreads.c
index f33d2bf..5e8e123 100644
--- a/tests/dthreads.c
+++ b/tests/dthreads.c
@@ -65,14 +65,6 @@ int destruct(struct dthread_t *thread)
 	return 0;
 }
 
-/*! \brief Unit blocking runnable. */
-int runnable_simio(struct dthread_t *thread)
-{
-	// Infinite blocking, must be interrupted
-	select(0, 0, 0, 0, 0);
-	return 0;
-}
-
 /*! \brief Create unit. */
 static inline dt_unit_t *dt_test_create(int size)
 {
@@ -96,52 +88,6 @@ static inline int dt_test_coherent(dt_unit_t *unit)
 	return ret == 0;
 }
 
-/*! \brief Repurpose single thread. */
-static inline int dt_test_repurpose(dt_unit_t *unit, int id)
-{
-	return dt_repurpose(unit->threads[id], &runnable_simio, NULL) == 0;
-}
-
-/*! \brief Cancel single thread. */
-static inline int dt_test_cancel(dt_unit_t *unit, int id)
-{
-	int ret = dt_cancel(unit->threads[id]);
-	ret |= dt_signalize(unit->threads[id], SIGALRM);
-	return ret == 0; /* Both succeeded. */
-}
-
-/*! \brief Reanimate dead threads. */
-static inline int dt_test_reanimate(dt_unit_t *unit)
-{
-	// Compact all threads
-	int ret = 0;
-	ret += dt_compact(unit);
-
-	// Remove purpose from all
-	for (int i = 0; i < unit->size; ++i) {
-		ret += dt_repurpose(unit->threads[i], 0, 0);
-	}
-
-	// Set single thread to purpose
-	ret += dt_repurpose(unit->threads[0], &runnable, 0);
-
-	// Restart
-	_runnable_i = 0;
-	ret += dt_start(unit);
-
-	// Wait for finish
-	ret += dt_join(unit);
-
-	// Verify
-	int expected = 1 * _runnable_cycles;
-	if (_runnable_i != expected) {
-		return 0;
-	}
-
-	// Check return codes
-	return ret == 0;
-}
-
 /*! \brief Start unit. */
 static inline int dt_test_start(dt_unit_t *unit)
 {
@@ -168,7 +114,7 @@ static void interrupt_handle(int s)
 /*! API: run tests. */
 int main(int argc, char *argv[])
 {
-	plan(20);
+	plan(15);
 
 	// Register service and signal handler
 	struct sigaction sa;
@@ -179,7 +125,6 @@ int main(int argc, char *argv[])
 
 	/* Initialize */
 	srand(time(NULL));
-	struct timeval tv;
 	pthread_mutex_init(&_runnable_mx, NULL);
 	pthread_mutex_init(&_destructor_mx, NULL);
 
@@ -212,52 +157,22 @@ int main(int argc, char *argv[])
 	/* Test 7: Restart threads. */
 	ok(dt_test_start(unit), "dthreads: start coherent unit");
 
-	/* Test 8: Repurpose single thread. */
-	tv.tv_sec = 0;
-	tv.tv_usec = 4000 + rand() % 1000; // 4-5ms
-	diag("waiting for %dus to let thread do some work ...",
-	     (int)tv.tv_usec);
-	select(0, 0, 0, 0, &tv);
-	ok(dt_test_repurpose(unit, 0), "dthreads: repurpose on-the-fly");
-
-	/* Test 9: Cancel blocking thread. */
-	tv.tv_sec = 0;
-	tv.tv_usec = (250 + rand() % 500) * 1000; // 250-750ms
-	diag("waiting for %dms to let thread pretend blocking I/O ...",
-	     (int)(tv.tv_usec / 1000));
-	select(0, 0, 0, 0, &tv);
-	ok(dt_test_cancel(unit, 0), "dthreads: cancel blocking thread");
-
-	/* Test 10: Wait for tasks. */
+	/* Test 8: Wait for tasks. */
 	ok(dt_test_join(unit), "dthreads: join threads");
-
-	/* Test 11: Compare counter. */
-	int expected_lo = _runnable_cycles * (unit->size - 1);
-	ok(_runnable_i >= expected_lo,
-	       "dthreads: result %d is => %d", _runnable_i, expected_lo);
-
-	/* Test 12: Compare counter #2. */
-	/*! \note repurpose could trigger next run of the unit if both finished */
-	int expected_hi = _runnable_cycles * (unit->size + unit->size - 1);
-	ok(_runnable_i <= expected_hi,
-	       "dthreads: result %d is <= %d", _runnable_i, expected_hi);
-
-	/* Test 13: Reanimate dead threads. */
-	ok(dt_test_reanimate(unit), "dthreads: reanimate dead threads");
-
-	/* Test 14: Deinitialize */
+	
+	/* Test 9: Deinitialize */
 	dt_delete(&unit);
 	ok(unit == NULL, "dthreads: delete unit");
 
-	/* Test 15: Wrong values. */
+	/* Test 10: Wrong values. */
 	unit = dt_create(-1);
 	ok(unit == NULL, "dthreads: create with negative count");
 	unit = dt_create_coherent(dt_optimal_size(), 0, 0, 0);
 
-	/* Test 16: NULL runnable. */
+	/* Test 11: NULL runnable. */
 	is_int(0, dt_start(unit), "dthreads: start with NULL runnable");
 
-	/* Test 17: NULL operations crashing. */
+	/* Test 12: NULL operations crashing. */
 	int op_count = 14;
 	int expected_min = op_count * -1;
 	// All functions must return -1 at least
@@ -278,12 +193,12 @@ int main(int argc, char *argv[])
 	ret += dt_unit_unlock(0);           // -1
 	is_int(-1464, ret, "dthreads: not crashed while executing functions on NULL context");
 
-	/* Test 18: expected results. */
+	/* Test 13: expected results. */
 	ok(ret <= expected_min,
 	       "dthreads: correct values when passed NULL context "
 	       "(%d, min: %d)", ret, expected_min);
 
-	/* Test 19: Thread destructor. */
+	/* Test 14: Thread destructor. */
 	_destructor_data = 0;
 	unit = dt_create_coherent(2, 0, destruct, 0);
 	dt_start(unit);
@@ -292,7 +207,7 @@ int main(int argc, char *argv[])
 	is_int(2, _destructor_data, "dthreads: destructor with dt_create_coherent()");
 	dt_delete(&unit);
 
-	/* Test 20: Thread destructor setter. */
+	/* Test 15: Thread destructor setter. */
 	unit = dt_create(1);
 	dt_set_desctructor(unit->threads[0], destruct);
 	dt_start(unit);
diff --git a/tests/fdset.c b/tests/fdset.c
index f42843f..846871a 100644
--- a/tests/fdset.c
+++ b/tests/fdset.c
@@ -84,7 +84,7 @@ void* thr_action(void *arg)
 
 int main(int argc, char *argv[])
 {
-	plan(11);
+	plan(12);
 
 	/* 1. Create fdset. */
 	fdset_t set;
@@ -96,6 +96,7 @@ int main(int argc, char *argv[])
 	ret = pipe(fds);
 	ok(ret >= 0, "fdset: pipe() works");
 	ret = pipe(tmpfds);
+	ok(ret >= 0, "fdset: 2nd pipe() works");
 
 	/* 3. Add fd to set. */
 	ret = fdset_add(&set, fds[0], POLLIN, NULL);
diff --git a/tests/hattrie.c b/tests/hattrie.c
index 7efee4b..53bcf79 100644
--- a/tests/hattrie.c
+++ b/tests/hattrie.c
@@ -77,14 +77,13 @@ int main(int argc, char *argv[])
 	}
 
 	/* Test 1: Create */
-	unsigned passed = 1;
 	value_t *v = NULL;
 	hattrie_t *t = hattrie_create();
 	ok(t != NULL, "hattrie: create");
 
 	/* Test 2: Insert */
+	unsigned passed = 1;
 	unsigned really_inserted = 0;
-	passed = 1;
 	for (unsigned i = 0; i < count; ++i) {
 		v = hattrie_get(t, items[i], strlen(items[i]));
 		if (!v) {
@@ -166,13 +165,12 @@ int main(int argc, char *argv[])
 
 	/* Sorted iteration. */
 	size_t len = 0, prev_len = 0;
-	const char *cur = NULL;
 	char *prev = NULL;
 	counted = 0;
 	hattrie_build_index(t);
 	it = hattrie_iter_begin(t, true);
 	while (!hattrie_iter_finished(it)) {
-		cur = hattrie_iter_key(it, &len);
+		const char *cur = hattrie_iter_key(it, &len);
 		if (!str_check_sort(prev, cur, prev_len, len)) {
 			diag("(%zu)'%s' < (%zu)'%s' FAIL\n",
 			     prev_len, prev, len, cur);