From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 14 Jan 2020 16:26:15 +0000 (+0100)
Subject: auth: Reduce the number of memory allocations
X-Git-Tag: dnsdist-1.5.0-alpha1~27^2~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9bbcf03a6ff139016686e97a387cc6787a3990ce;p=thirdparty%2Fpdns.git

auth: Reduce the number of memory allocations
---

diff --git a/modules/bindbackend/bindbackend2.cc b/modules/bindbackend/bindbackend2.cc
index fe383aa8b9..9e6c33c38d 100644
--- a/modules/bindbackend/bindbackend2.cc
+++ b/modules/bindbackend/bindbackend2.cc
@@ -34,6 +34,8 @@
 #include <sstream>
 #include <boost/algorithm/string.hpp>
 #include <system_error>
+#include <unordered_map>
+#include <unordered_set>
 
 #include "pdns/dnsseckeeper.hh"
 #include "pdns/dnssecinfra.hh"
@@ -325,7 +327,7 @@ void Bind2Backend::getUpdatedMasters(vector<DomainInfo> *changedDomains)
       di.notified_serial=i->d_lastnotified;
       di.backend=this;
       di.kind=DomainInfo::Master;
-      consider.push_back(di);
+      consider.push_back(std::move(di));
     }
   }
 
@@ -346,7 +348,7 @@ void Bind2Backend::getUpdatedMasters(vector<DomainInfo> *changedDomains)
       }
       if(di.notified_serial)  { // don't do notification storm on startup
         di.serial=soadata.serial;
-        changedDomains->push_back(di);
+        changedDomains->push_back(std::move(di));
       }
     }
   }
@@ -359,6 +361,7 @@ void Bind2Backend::getAllDomains(vector<DomainInfo> *domains, bool include_disab
   // prevent deadlock by using getSOA() later on
   {
     ReadLock rl(&s_state_lock);
+    domains->reserve(s_state.size());
 
     for(state_t::const_iterator i = s_state.begin(); i != s_state.end() ; ++i) {
       DomainInfo di;
@@ -368,7 +371,7 @@ void Bind2Backend::getAllDomains(vector<DomainInfo> *domains, bool include_disab
       di.kind=i->d_kind;
       di.masters=i->d_masters;
       di.backend=this;
-      domains->push_back(di);
+      domains->push_back(std::move(di));
     };
   }
 
@@ -390,6 +393,7 @@ void Bind2Backend::getUnfreshSlaveInfos(vector<DomainInfo> *unfreshDomains)
   vector<DomainInfo> domains;
   {
     ReadLock rl(&s_state_lock);
+    domains.reserve(s_state.size());
     for(state_t::const_iterator i = s_state.begin(); i != s_state.end() ; ++i) {
       if(i->d_kind != DomainInfo::Slave)
         continue;
@@ -400,9 +404,10 @@ void Bind2Backend::getUnfreshSlaveInfos(vector<DomainInfo> *unfreshDomains)
       sd.last_check=i->d_lastcheck;
       sd.backend=this;
       sd.kind=DomainInfo::Slave;
-      domains.push_back(sd);
+      domains.push_back(std::move(sd));
     }
   }
+  unfreshDomains->reserve(domains.size());
 
   for(DomainInfo &sd :  domains) {
     SOAData soadata;
@@ -414,7 +419,7 @@ void Bind2Backend::getUnfreshSlaveInfos(vector<DomainInfo> *unfreshDomains)
     catch(...){}
     sd.serial=soadata.serial;
     if(sd.last_check+soadata.refresh < (unsigned int)time(0))
-      unfreshDomains->push_back(sd);    
+      unfreshDomains->push_back(std::move(sd));
   }
 }
 
@@ -510,7 +515,7 @@ void Bind2Backend::insertRecord(std::shared_ptr<recordstorage_t>& records, const
   if(zoneName.empty())
     ;
   else if(bdr.qname.isPartOf(zoneName))
-    bdr.qname = bdr.qname.makeRelative(zoneName);
+    bdr.qname.makeUsRelative(zoneName);
   else {
     string msg = "Trying to insert non-zone data, name='"+bdr.qname.toLogString()+"', qtype="+qtype.getName()+", zone='"+zoneName.toLogString()+"'";
     if(s_ignore_broken_records) {
@@ -537,7 +542,7 @@ void Bind2Backend::insertRecord(std::shared_ptr<recordstorage_t>& records, const
     bdr.auth=true;
 
   bdr.ttl=ttl;
-  records->insert(bdr);
+  records->insert(std::move(bdr));
 }
 
 string Bind2Backend::DLReloadNowHandler(const vector<string>&parts, Utility::pid_t ppid)
@@ -803,8 +808,8 @@ void Bind2Backend::doEmptyNonTerminals(std::shared_ptr<recordstorage_t>& records
 {
   bool auth;
   DNSName shorter;
-  set<DNSName> qnames;
-  map<DNSName, bool> nonterm;
+  std::unordered_set<DNSName> qnames;
+  std::unordered_map<DNSName, bool> nonterm;
 
   uint32_t maxent = ::arg().asNum("max-ent-entries");
 
@@ -830,7 +835,7 @@ void Bind2Backend::doEmptyNonTerminals(std::shared_ptr<recordstorage_t>& records
         }
 
         if (!nonterm.count(shorter)) {
-          nonterm.insert(pair<DNSName, bool>(shorter, auth));
+          nonterm.emplace(shorter, auth);
           --maxent;
         } else if (auth)
           nonterm[shorter] = true;
@@ -899,7 +904,7 @@ void Bind2Backend::loadConfig(string* status)
     sort(domains.begin(), domains.end()); // put stuff in inode order
     for(vector<BindDomainInfo>::const_iterator i=domains.begin();
         i!=domains.end();
-        ++i) 
+        ++i)
       {
         if (!(i->hadFileDirective)) {
           g_log<<Logger::Warning<<d_logprefix<<" Zone '"<<i->name<<"' has no 'file' directive set in "<<getArg("config")<<endl;
@@ -1134,7 +1139,7 @@ void Bind2Backend::lookup(const QType &qtype, const DNSName &qname, int zoneId,
 
   if (zoneId >= 0) {
     if ((found = (safeGetBBDomainInfo(zoneId, &bbd) && qname.isPartOf(bbd.d_name)))) {
-      domain = bbd.d_name;
+      domain = std::move(bbd.d_name);
     }
   } else {
     domain = qname;
@@ -1156,17 +1161,17 @@ void Bind2Backend::lookup(const QType &qtype, const DNSName &qname, int zoneId,
   d_handle.id=bbd.d_id;
   d_handle.qname=qname.makeRelative(domain); // strip domain name
   d_handle.qtype=qtype;
-  d_handle.domain=domain;
+  d_handle.domain=std::move(domain);
 
   if(!bbd.d_loaded) {
     d_handle.reset();
-    throw DBException("Zone for '"+bbd.d_name.toLogString()+"' in '"+bbd.d_filename+"' temporarily not available (file missing, or master dead)"); // fsck
+    throw DBException("Zone for '"+d_handle.domain.toLogString()+"' in '"+bbd.d_filename+"' temporarily not available (file missing, or master dead)"); // fsck
   }
     
   if(!bbd.current()) {
-    g_log<<Logger::Warning<<"Zone '"<<bbd.d_name<<"' ("<<bbd.d_filename<<") needs reloading"<<endl;
+    g_log<<Logger::Warning<<"Zone '"<<d_handle.domain<<"' ("<<bbd.d_filename<<") needs reloading"<<endl;
     queueReloadAndStore(bbd.d_id);
-    if (!safeGetBBDomainInfo(domain, &bbd))
+    if (!safeGetBBDomainInfo(d_handle.domain, &bbd))
       throw DBException("Zone '"+bbd.d_name.toLogString()+"' ("+bbd.d_filename+") gone after reload"); // if we don't throw here, we crash for some reason
   }
 
@@ -1424,7 +1429,7 @@ bool Bind2Backend::searchRecords(const string &pattern, int maxResults, vector<D
           r.qtype=ri->qtype;
           r.ttl=ri->ttl;
           r.auth = ri->auth;
-          result.push_back(r);
+          result.push_back(std::move(r));
         }
       }
     }
diff --git a/pdns/auth-packetcache.cc b/pdns/auth-packetcache.cc
index 7759c8c071..fd96a16257 100644
--- a/pdns/auth-packetcache.cc
+++ b/pdns/auth-packetcache.cc
@@ -170,7 +170,7 @@ void AuthPacketCache::insert(DNSPacket& q, DNSPacket& r, unsigned int maxTTL)
     }
 
     /* no existing entry found to refresh */
-    mc.d_map.insert(entry);
+    mc.d_map.insert(std::move(entry));
 
     if (*d_statnumentries >= d_maxEntries) {
       /* remove the least recently inserted or replaced entry */
@@ -178,7 +178,7 @@ void AuthPacketCache::insert(DNSPacket& q, DNSPacket& r, unsigned int maxTTL)
       sidx.pop_front();
     }
     else {
-      (*d_statnumentries)++;
+      ++(*d_statnumentries);
     }
   }
 }
diff --git a/pdns/auth-querycache.cc b/pdns/auth-querycache.cc
index b9b13602c1..1baa521092 100644
--- a/pdns/auth-querycache.cc
+++ b/pdns/auth-querycache.cc
@@ -86,7 +86,7 @@ bool AuthQueryCache::getEntry(const DNSName &qname, const QType& qtype, vector<D
   }
 }
 
-void AuthQueryCache::insert(const DNSName &qname, const QType& qtype, const vector<DNSZoneRecord>& value, uint32_t ttl, int zoneID)
+void AuthQueryCache::insert(const DNSName &qname, const QType& qtype, vector<DNSZoneRecord>&& value, uint32_t ttl, int zoneID)
 {
   cleanupIfNeeded();
 
@@ -99,7 +99,7 @@ void AuthQueryCache::insert(const DNSName &qname, const QType& qtype, const vect
   val.ttd = now + ttl;
   val.qname = qname;
   val.qtype = qtype.getCode();
-  val.drs = value;
+  val.drs = std::move(value);
   val.zoneID = zoneID;
 
   auto& mc = getMap(val.qname);
@@ -116,7 +116,7 @@ void AuthQueryCache::insert(const DNSName &qname, const QType& qtype, const vect
     tie(place, inserted) = mc.d_map.insert(val);
 
     if (!inserted) {
-      mc.d_map.replace(place, val);
+      mc.d_map.replace(place, std::move(val));
       moveCacheItemToBack<SequencedTag>(mc.d_map, place);
     }
     else {
diff --git a/pdns/auth-querycache.hh b/pdns/auth-querycache.hh
index 889634bb60..c62230b228 100644
--- a/pdns/auth-querycache.hh
+++ b/pdns/auth-querycache.hh
@@ -39,7 +39,7 @@ public:
   AuthQueryCache(size_t mapsCount=1024);
   ~AuthQueryCache();
 
-  void insert(const DNSName &qname, const QType& qtype, const vector<DNSZoneRecord>& content, uint32_t ttl, int zoneID);
+  void insert(const DNSName &qname, const QType& qtype, vector<DNSZoneRecord>&& content, uint32_t ttl, int zoneID);
 
   bool getEntry(const DNSName &qname, const QType& qtype, vector<DNSZoneRecord>& entry, int zoneID);
 
diff --git a/pdns/dnsbackend.cc b/pdns/dnsbackend.cc
index 6b15ffd8ab..07fe9c6d42 100644
--- a/pdns/dnsbackend.cc
+++ b/pdns/dnsbackend.cc
@@ -347,6 +347,7 @@ void fillSOAData(const string &content, SOAData &data)
   // fill out data with some plausible defaults:
   // 10800 3600 604800 3600
   vector<string>parts;
+  parts.reserve(7);
   stringtok(parts,content);
   int pleft=parts.size();
 
diff --git a/pdns/dnspacket.cc b/pdns/dnspacket.cc
index e87d0a1991..97a372be32 100644
--- a/pdns/dnspacket.cc
+++ b/pdns/dnspacket.cc
@@ -123,7 +123,7 @@ void DNSPacket::clearRecords()
   d_dedup.clear();
 }
 
-void DNSPacket::addRecord(const DNSZoneRecord &rr)
+void DNSPacket::addRecord(DNSZoneRecord&& rr)
 {
   // this removes duplicates from the packet.
   // in case we are not compressing for AXFR, no such checking is performed!
@@ -140,7 +140,7 @@ void DNSPacket::addRecord(const DNSZoneRecord &rr)
     d_dedup.insert(hash);
   }
 
-  d_rrs.push_back(rr);
+  d_rrs.push_back(std::move(rr));
 }
 
 vector<DNSZoneRecord*> DNSPacket::getAPRecords()
diff --git a/pdns/dnspacket.hh b/pdns/dnspacket.hh
index 90dd156d9e..86ef68b731 100644
--- a/pdns/dnspacket.hh
+++ b/pdns/dnspacket.hh
@@ -97,7 +97,7 @@ public:
   /** Add a DNSZoneRecord to this packet. A DNSPacket (as does a DNS Packet) has 4 kinds of resource records. Questions, 
       Answers, Authority and Additional. See RFC 1034 and 1035 for details. You can specify where a record needs to go in the
       DNSZoneRecord d_place field */
-  void addRecord(const DNSZoneRecord &);  // adds to 'rrs'
+  void addRecord(DNSZoneRecord&&);  // adds to 'rrs'
 
   void setQuestion(int op, const DNSName &qdomain, int qtype);  // wipes 'd', sets a random id, creates start of packet (domain, type, class etc)
 
diff --git a/pdns/dnsproxy.cc b/pdns/dnsproxy.cc
index 05fd4bed19..decd631e4f 100644
--- a/pdns/dnsproxy.cc
+++ b/pdns/dnsproxy.cc
@@ -114,7 +114,7 @@ bool DNSProxy::completePacket(std::unique_ptr<DNSPacket>& r, const DNSName& targ
       for (auto &ip : ips)
       {
         ip.dr.d_name = aname;
-        r->addRecord(ip);
+        r->addRecord(std::move(ip));
       }
     }
 
@@ -262,7 +262,7 @@ void DNSProxy::mainloop(void)
                 dzr.dr.d_ttl=j->first.d_ttl;
                 dzr.dr.d_place= j->first.d_place;
                 dzr.dr.d_content=j->first.d_content;
-                i->second.complete->addRecord(dzr);
+                i->second.complete->addRecord(std::move(dzr));
               }
             }
           }
diff --git a/pdns/dnsrecords.cc b/pdns/dnsrecords.cc
index aa5ae30cec..2f2268bf54 100644
--- a/pdns/dnsrecords.cc
+++ b/pdns/dnsrecords.cc
@@ -191,7 +191,7 @@ void OPTRecordContent::getData(vector<pair<uint16_t, string> >& options)
 
     string field(d_data.c_str() + pos, len);
     pos+=len;
-    options.push_back(make_pair(code, field));
+    options.push_back(make_pair(code, std::move(field)));
   }
 }
 
diff --git a/pdns/dnswriter.cc b/pdns/dnswriter.cc
index 82ddce7073..1cbd2b219c 100644
--- a/pdns/dnswriter.cc
+++ b/pdns/dnswriter.cc
@@ -53,9 +53,9 @@ DNSPacketWriter::DNSPacketWriter(vector<uint8_t>& content, const DNSName& qname,
   dnsheader.opcode=opcode;
 
   const uint8_t* ptr=(const uint8_t*)&dnsheader;
-  uint32_t len=d_content.size();
-  d_content.resize(len + sizeof(dnsheader));
-  uint8_t* dptr=(&*d_content.begin()) + len;
+  d_content.reserve(sizeof(dnsheader) + qname.wirelength() + sizeof(qtype) + sizeof(qclass));
+  d_content.resize(sizeof(dnsheader));
+  uint8_t* dptr=(&*d_content.begin());
 
   memcpy(dptr, ptr, sizeof(dnsheader));
   d_namepositions.reserve(16);
diff --git a/pdns/lua-auth4.cc b/pdns/lua-auth4.cc
index f990f18b48..ede5d1b038 100644
--- a/pdns/lua-auth4.cc
+++ b/pdns/lua-auth4.cc
@@ -54,8 +54,8 @@ void AuthLua4::postPrepareContext() {
   d_lw->registerFunction<DNSPacket, void(unsigned int)>("setOpCode", [](DNSPacket &p, unsigned int opcode) { return p.setOpcode(static_cast<uint16_t>(opcode)); });
   d_lw->registerFunction<DNSPacket, void(int)>("setRcode", [](DNSPacket &p, int rcode) { return p.setRcode(rcode); });
   d_lw->registerFunction<DNSPacket, void()>("clearRecords",[](DNSPacket &p){p.clearRecords();});
-  d_lw->registerFunction<DNSPacket, void(DNSRecord&, bool)>("addRecord", [](DNSPacket &p, DNSRecord &dr, bool auth) { DNSZoneRecord dzr; dzr.dr = dr; dzr.auth = auth; p.addRecord(dzr); });
-  d_lw->registerFunction<DNSPacket, void(const vector<pair<unsigned int, DNSRecord> >&)>("addRecords", [](DNSPacket &p, const vector<pair<unsigned int, DNSRecord> >& records){ for(const auto &dr: records){ DNSZoneRecord dzr; dzr.dr = std::get<1>(dr); dzr.auth = true; p.addRecord(dzr); }});
+  d_lw->registerFunction<DNSPacket, void(DNSRecord&, bool)>("addRecord", [](DNSPacket &p, DNSRecord &dr, bool auth) { DNSZoneRecord dzr; dzr.dr = dr; dzr.auth = auth; p.addRecord(std::move(dzr)); });
+  d_lw->registerFunction<DNSPacket, void(const vector<pair<unsigned int, DNSRecord> >&)>("addRecords", [](DNSPacket &p, const vector<pair<unsigned int, DNSRecord> >& records){ for(const auto &dr: records){ DNSZoneRecord dzr; dzr.dr = std::get<1>(dr); dzr.auth = true; p.addRecord(std::move(dzr)); }});
   d_lw->registerFunction<DNSPacket, void(unsigned int, const DNSName&, const std::string&)>("setQuestion", [](DNSPacket &p, unsigned int opcode, const DNSName &name, const string &type){ QType qtype; qtype = type; p.setQuestion(static_cast<int>(opcode), name, static_cast<int>(qtype.getCode())); });
   d_lw->registerFunction<DNSPacket, bool()>("isEmpty", [](DNSPacket &p){return p.isEmpty();});
   d_lw->registerFunction<DNSPacket, std::shared_ptr<DNSPacket>()>("replyPacket",[](DNSPacket& p){ return p.replyPacket();});
diff --git a/pdns/nameserver.cc b/pdns/nameserver.cc
index 2a8b3a5bfb..bac4ede45f 100644
--- a/pdns/nameserver.cc
+++ b/pdns/nameserver.cc
@@ -222,7 +222,7 @@ UDPNameserver::UDPNameserver( bool additional_socket )
 
 void UDPNameserver::send(DNSPacket& p)
 {
-  string buffer=p.getString();
+  const string& buffer=p.getString();
   g_rs.submitResponse(p, true);
 
   struct msghdr msgh;
diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 580039217b..2a955664c1 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -125,7 +125,7 @@ bool PacketHandler::addCDNSKEY(DNSPacket& p, std::unique_ptr<DNSPacket>& r, cons
     rr.dr.d_name=p.qdomain;
     rr.dr.d_content=std::make_shared<DNSKEYRecordContent>(value.first.getDNSKEY());
     rr.auth=true;
-    r->addRecord(rr);
+    r->addRecord(std::move(rr));
     haveOne=true;
   }
 
@@ -134,7 +134,7 @@ bool PacketHandler::addCDNSKEY(DNSPacket& p, std::unique_ptr<DNSPacket>& r, cons
 
     while(B.get(rr)) {
       rr.dr.d_ttl=sd.minimum;
-      r->addRecord(rr);
+      r->addRecord(std::move(rr));
       haveOne=true;
     }
   }
@@ -164,7 +164,7 @@ bool PacketHandler::addDNSKEY(DNSPacket& p, std::unique_ptr<DNSPacket>& r, const
     rr.dr.d_name=p.qdomain;
     rr.dr.d_content=std::make_shared<DNSKEYRecordContent>(value.first.getDNSKEY());
     rr.auth=true;
-    r->addRecord(rr);
+    r->addRecord(std::move(rr));
     haveOne=true;
   }
 
@@ -173,7 +173,7 @@ bool PacketHandler::addDNSKEY(DNSPacket& p, std::unique_ptr<DNSPacket>& r, const
 
     while(B.get(rr)) {
       rr.dr.d_ttl=sd.minimum;
-      r->addRecord(rr);
+      r->addRecord(std::move(rr));
       haveOne=true;
     }
   }
@@ -216,7 +216,7 @@ bool PacketHandler::addCDS(DNSPacket& p, std::unique_ptr<DNSPacket>& r, const SO
     }
     for(auto const &digestAlgo : digestAlgos){
       rr.dr.d_content=std::make_shared<DSRecordContent>(makeDSFromDNSKey(p.qdomain, value.first.getDNSKEY(), pdns_stou(digestAlgo)));
-      r->addRecord(rr);
+      r->addRecord(DNSZoneRecord(rr));
       haveOne=true;
     }
   }
@@ -226,7 +226,7 @@ bool PacketHandler::addCDS(DNSPacket& p, std::unique_ptr<DNSPacket>& r, const SO
 
     while(B.get(rr)) {
       rr.dr.d_ttl=sd.minimum;
-      r->addRecord(rr);
+      r->addRecord(std::move(rr));
       haveOne=true;
     }
   }
@@ -247,7 +247,7 @@ bool PacketHandler::addNSEC3PARAM(const DNSPacket& p, std::unique_ptr<DNSPacket>
     ns3prc.d_flags = 0; // the NSEC3PARAM 'flag' is defined to always be zero in RFC5155.
     rr.dr.d_content=std::make_shared<NSEC3PARAMRecordContent>(ns3prc);
     rr.auth = true;
-    r->addRecord(rr);
+    r->addRecord(std::move(rr));
     return true;
   }
   return false;
@@ -300,7 +300,7 @@ int PacketHandler::doChaosRequest(const DNSPacket& p, std::unique_ptr<DNSPacket>
     rr.dr.d_name=target;
     rr.dr.d_type=QType::TXT;
     rr.dr.d_class=QClass::CHAOS;
-    r->addRecord(rr);
+    r->addRecord(std::move(rr));
     return 1;
   }
 
@@ -486,8 +486,10 @@ int PacketHandler::doAdditionalProcessingAndDropAA(DNSPacket& p, std::unique_ptr
         toAdd.push_back(rr);
       }
     }
-    for(const auto& rec : toAdd)
-      r->addRecord(rec);
+
+    for(auto& rec : toAdd) {
+      r->addRecord(std::move(rec));
+    }
     
     //records.insert(records.end(), toAdd.cbegin(), toAdd.cend()); // would be faster, but no dedup
   }
@@ -535,7 +537,7 @@ void PacketHandler::emitNSEC(std::unique_ptr<DNSPacket>& r, const SOAData& sd, c
   rr.dr.d_place = (mode == 5 ) ? DNSResourceRecord::ANSWER: DNSResourceRecord::AUTHORITY;
   rr.auth = true;
 
-  r->addRecord(rr);
+  r->addRecord(std::move(rr));
 }
 
 void PacketHandler::emitNSEC3(std::unique_ptr<DNSPacket>& r, const SOAData& sd, const NSEC3PARAMRecordContent& ns3prc, const DNSName& name, const string& namehash, const string& nexthash, int mode)
@@ -588,7 +590,7 @@ void PacketHandler::emitNSEC3(std::unique_ptr<DNSPacket>& r, const SOAData& sd,
   rr.dr.d_place = (mode == 5 ) ? DNSResourceRecord::ANSWER: DNSResourceRecord::AUTHORITY;
   rr.auth = true;
 
-  r->addRecord(rr);
+  r->addRecord(std::move(rr));
 }
 
 /*
@@ -943,18 +945,21 @@ int PacketHandler::processNotify(const DNSPacket& p)
 static bool validDNSName(const DNSName &name)
 {
   if (!g_8bitDNS) {
-    string::size_type pos, length;
-    char c;
-    for(const auto& s : name.getRawLabels()) {
-      length=s.length();
-      for(pos=0; pos < length; ++pos) {
-        c=s[pos];
+    const auto& s = name.getStorage();
+    string::size_type pos = 0;
+    uint8_t length = s.at(pos);
+    while (length > 0) {
+      for (size_t idx = 0; idx < length; idx++) {
+        ++pos;
+        char c = s.at(pos);
         if(!((c >= 'a' && c <= 'z') ||
              (c >= 'A' && c <= 'Z') ||
              (c >= '0' && c <= '9') ||
              c =='-' || c == '_' || c=='*' || c=='.' || c=='/' || c=='@' || c==' ' || c=='\\' || c==':'))
           return false;
       }
+      ++pos;
+      length = s.at(pos);
     }
   }
   return true;
@@ -985,7 +990,7 @@ void PacketHandler::makeNXDomain(DNSPacket& p, std::unique_ptr<DNSPacket>& r, co
   DNSZoneRecord rr;
   rr=makeEditedDNSZRFromSOAData(d_dk, sd, DNSResourceRecord::AUTHORITY);
   rr.dr.d_ttl=sd.getNegativeTTL();
-  r->addRecord(rr);
+  r->addRecord(std::move(rr));
 
   if(d_dnssec) {
     addNSECX(p, r, target, wildcard, sd.qname, 4);
@@ -999,7 +1004,7 @@ void PacketHandler::makeNOError(DNSPacket& p, std::unique_ptr<DNSPacket>& r, con
   DNSZoneRecord rr;
   rr=makeEditedDNSZRFromSOAData(d_dk, sd, DNSResourceRecord::AUTHORITY);
   rr.dr.d_ttl=sd.getNegativeTTL();
-  r->addRecord(rr);
+  r->addRecord(std::move(rr));
 
   if(d_dnssec) {
     addNSECX(p, r, target, wildcard, sd.qname, mode);
@@ -1018,7 +1023,7 @@ bool PacketHandler::addDSforNS(DNSPacket& p, std::unique_ptr<DNSPacket>& r, cons
   while(B.get(rr)) {
     gotOne=true;
     rr.dr.d_place = DNSResourceRecord::AUTHORITY;
-    r->addRecord(rr);
+    r->addRecord(std::move(rr));
   }
   return gotOne;
 }
@@ -1028,16 +1033,17 @@ bool PacketHandler::tryReferral(DNSPacket& p, std::unique_ptr<DNSPacket>& r, con
   vector<DNSZoneRecord> rrset = getBestReferralNS(p, sd, target);
   if(rrset.empty())
     return false;
-  
+
+  DNSName name = rrset.begin()->dr.d_name;
   for(auto& rr: rrset) {
     rr.dr.d_place=DNSResourceRecord::AUTHORITY;
-    r->addRecord(rr);
+    r->addRecord(std::move(rr));
   }
   if(!retargeted)
     r->setA(false);
 
-  if(d_dk.isSecuredZone(sd.qname) && !addDSforNS(p, r, sd, rrset.begin()->dr.d_name) && d_dnssec) {
-    addNSECX(p, r, rrset.begin()->dr.d_name, DNSName(), sd.qname, 1);
+  if(d_dk.isSecuredZone(sd.qname) && !addDSforNS(p, r, sd, name) && d_dnssec) {
+    addNSECX(p, r, name, DNSName(), sd.qname, 1);
   }
 
   return true;
@@ -1063,7 +1069,7 @@ bool PacketHandler::tryDNAME(DNSPacket& p, std::unique_ptr<DNSPacket>& r, const
   if(!rrset.empty()) {
     for(auto& rr: rrset) {
       rr.dr.d_place = DNSResourceRecord::ANSWER;
-      r->addRecord(rr);
+      r->addRecord(std::move(rr));
     }
     return true;
   }
@@ -1093,7 +1099,7 @@ bool PacketHandler::tryWildcard(DNSPacket& p, std::unique_ptr<DNSPacket>& r, con
       }
   
       rr.dr.d_place=DNSResourceRecord::ANSWER;
-      r->addRecord(rr);
+      r->addRecord(std::move(rr));
     }
   }
   if(d_dnssec && !nodata) {
@@ -1308,7 +1314,7 @@ std::unique_ptr<DNSPacket> PacketHandler::doQuestion(DNSPacket& p)
 
     if(p.qtype.getCode() == QType::SOA && sd.qname==p.qdomain) {
       rr=makeEditedDNSZRFromSOAData(d_dk, sd);
-      r->addRecord(rr);
+      r->addRecord(std::move(rr));
       goto sendit;
     }
 
@@ -1503,7 +1509,7 @@ std::unique_ptr<DNSPacket> PacketHandler::doQuestion(DNSPacket& p)
     if(weRedirected) {
       for(auto& loopRR: rrset) {
         if(loopRR.dr.d_type == QType::CNAME) {
-          r->addRecord(loopRR);
+          r->addRecord(DNSZoneRecord(loopRR));
           target = getRR<CNAMERecordContent>(loopRR.dr)->getTarget();
           retargetcount++;
           goto retargeted;
@@ -1518,7 +1524,7 @@ std::unique_ptr<DNSPacket> PacketHandler::doQuestion(DNSPacket& p)
             continue;
 #endif
         if((p.qtype.getCode() == QType::ANY || loopRR.dr.d_type == p.qtype.getCode()) && loopRR.dr.d_type && loopRR.dr.d_type != QType::ALIAS && loopRR.auth) {
-          r->addRecord(loopRR);
+          r->addRecord(DNSZoneRecord(loopRR));
           haveRecords = true;
         }
       }
diff --git a/pdns/serialtweaker.cc b/pdns/serialtweaker.cc
index 3ec6fe7494..b4573b9c27 100644
--- a/pdns/serialtweaker.cc
+++ b/pdns/serialtweaker.cc
@@ -176,7 +176,7 @@ DNSZoneRecord makeEditedDNSZRFromSOAData(DNSSECKeeper& dk, const SOAData& sd, DN
   dzr.domain_id = sd.domain_id;
   dzr.signttl = sd.ttl;
   dzr.auth = true;
-  dzr.dr = soa;
+  dzr.dr = std::move(soa);
 
   return dzr;
 }
diff --git a/pdns/slavecommunicator.cc b/pdns/slavecommunicator.cc
index 6ca6128504..8a55e4125b 100644
--- a/pdns/slavecommunicator.cc
+++ b/pdns/slavecommunicator.cc
@@ -768,6 +768,7 @@ void CommunicatorClass::slaveRefresh(PacketHandler *P)
   {
     Lock l(&d_lock);
     set<DomainInfo> requeue;
+    rdomains.reserve(d_tocheck.size());
     for(const auto& di: d_tocheck) {
       if(d_inprogress.count(di.zone)) {
         g_log<<Logger::Debug<<"Got NOTIFY for "<<di.zone<<" while AXFR in progress, requeueing SOA check"<<endl;
@@ -802,6 +803,7 @@ void CommunicatorClass::slaveRefresh(PacketHandler *P)
   if(rdomains.empty()) { // if we have priority domains, check them first
     B->getUnfreshSlaveInfos(&rdomains);
   }
+  sdomains.reserve(rdomains.size());
   DNSSECKeeper dk(B); // NOW HEAR THIS! This DK uses our B backend, so no interleaved access!
   {
     Lock l(&d_lock);
@@ -859,7 +861,7 @@ void CommunicatorClass::slaveRefresh(PacketHandler *P)
         dni.localaddr.sin4.sin_family = 0;
       }
 
-      sdomains.push_back(dni);
+      sdomains.push_back(std::move(dni));
     }
   }
   if(sdomains.empty())
diff --git a/pdns/tcpreceiver.cc b/pdns/tcpreceiver.cc
index 8de12d61f5..80cf3f9f4c 100644
--- a/pdns/tcpreceiver.cc
+++ b/pdns/tcpreceiver.cc
@@ -648,7 +648,7 @@ int TCPNameserver::doAXFR(const DNSName &target, std::unique_ptr<DNSPacket>& q,
   // SOA *must* go out first, our signing pipe might reorder
   DLOG(g_log<<"Sending out SOA"<<endl);
   DNSZoneRecord soa = makeEditedDNSZRFromSOAData(dk, sd);
-  outpacket->addRecord(soa);
+  outpacket->addRecord(DNSZoneRecord(soa));
   if(securedZone && !presignedZone) {
     set<DNSName> authSet;
     authSet.insert(target);
@@ -1043,7 +1043,7 @@ int TCPNameserver::doAXFR(const DNSName &target, std::unique_ptr<DNSPacket>& q,
   DLOG(g_log<<"Done writing out records"<<endl);
   /* and terminate with yet again the SOA record */
   outpacket=getFreshAXFRPacket(q);
-  outpacket->addRecord(soa);
+  outpacket->addRecord(std::move(soa));
   if(haveTSIGDetails && !tsigkeyname.empty())
     outpacket->setTSIGDetails(trc, tsigkeyname, tsigsecret, trc.d_mac, true); 
   
@@ -1167,7 +1167,7 @@ int TCPNameserver::doIXFR(std::unique_ptr<DNSPacket>& q, int outsock)
     // SOA *must* go out first, our signing pipe might reorder
     DLOG(g_log<<"Sending out SOA"<<endl);
     DNSZoneRecord soa = makeEditedDNSZRFromSOAData(dk, sd);
-    outpacket->addRecord(soa);
+    outpacket->addRecord(std::move(soa));
     if(securedZone && outpacket->d_dnssecOk) {
       set<DNSName> authSet;
       authSet.insert(target);
diff --git a/pdns/test-packetcache_cc.cc b/pdns/test-packetcache_cc.cc
index 1655abe42a..39f5911998 100644
--- a/pdns/test-packetcache_cc.cc
+++ b/pdns/test-packetcache_cc.cc
@@ -23,7 +23,7 @@ BOOST_AUTO_TEST_CASE(test_AuthQueryCacheSimple) {
   vector<DNSZoneRecord> records;
 
   BOOST_CHECK_EQUAL(QC.size(), 0U);
-  QC.insert(DNSName("hello"), QType(QType::A), records, 3600, 1);
+  QC.insert(DNSName("hello"), QType(QType::A), vector<DNSZoneRecord>(records), 3600, 1);
   BOOST_CHECK_EQUAL(QC.size(), 1U);
   BOOST_CHECK_EQUAL(QC.purge(), 1U);
   BOOST_CHECK_EQUAL(QC.size(), 0U);
@@ -34,10 +34,10 @@ BOOST_AUTO_TEST_CASE(test_AuthQueryCacheSimple) {
       DNSName a=DNSName("hello ")+DNSName(std::to_string(counter));
       BOOST_CHECK_EQUAL(DNSName(a.toString()), a);
 
-      QC.insert(a, QType(QType::A), records, 3600, 1);
+      QC.insert(a, QType(QType::A), vector<DNSZoneRecord>(records), 3600, 1);
       if(!QC.purge(a.toString()))
 	BOOST_FAIL("Could not remove entry we just added to the query cache!");
-      QC.insert(a, QType(QType::A), records, 3600, 1);
+      QC.insert(a, QType(QType::A), vector<DNSZoneRecord>(records), 3600, 1);
     }
 
     BOOST_CHECK_EQUAL(QC.size(), counter);
@@ -77,7 +77,7 @@ try
   vector<DNSZoneRecord> records;
   unsigned int offset=(unsigned int)(unsigned long)a;
   for(unsigned int counter=0; counter < 100000; ++counter)
-    g_QC->insert(DNSName("hello ")+DNSName(std::to_string(counter+offset)), QType(QType::A), records, 3600, 1);
+    g_QC->insert(DNSName("hello ")+DNSName(std::to_string(counter+offset)), QType(QType::A), vector<DNSZoneRecord>(records), 3600, 1);
   return 0;
 }
  catch(PDNSException& e) {
@@ -264,7 +264,7 @@ BOOST_AUTO_TEST_CASE(test_QueryCacheClean) {
     vector<DNSZoneRecord> records;
 
     for(unsigned int counter = 0; counter < 1000000; ++counter) {
-      QC.insert(DNSName("hello ")+DNSName(std::to_string(counter)), QType(QType::A), records, 1, 1);
+      QC.insert(DNSName("hello ")+DNSName(std::to_string(counter)), QType(QType::A), vector<DNSZoneRecord>(records), 1, 1);
     }
 
     sleep(1);
diff --git a/pdns/tkey.cc b/pdns/tkey.cc
index d1dc180ba0..7f7e5da313 100644
--- a/pdns/tkey.cc
+++ b/pdns/tkey.cc
@@ -79,7 +79,7 @@ void PacketHandler::tkeyHandler(const DNSPacket& p, std::unique_ptr<DNSPacket>&
   zrr.dr.d_class = QClass::ANY;
   zrr.dr.d_content = tkey_out;
   zrr.dr.d_place = DNSResourceRecord::ANSWER;
-  r->addRecord(zrr);
+  r->addRecord(std::move(zrr));
 
   if (sign)
   {
diff --git a/pdns/ueberbackend.cc b/pdns/ueberbackend.cc
index 266b25be13..5fd0a3936e 100644
--- a/pdns/ueberbackend.cc
+++ b/pdns/ueberbackend.cc
@@ -528,7 +528,7 @@ void UeberBackend::addNegCache(const Question &q)
   QC.insert(q.qname, q.qtype, vector<DNSZoneRecord>(), d_negcache_ttl, q.zoneId);
 }
 
-void UeberBackend::addCache(const Question &q, const vector<DNSZoneRecord> &rrs)
+void UeberBackend::addCache(const Question &q, vector<DNSZoneRecord> &&rrs)
 {
   extern AuthQueryCache QC;
 
@@ -543,7 +543,7 @@ void UeberBackend::addCache(const Question &q, const vector<DNSZoneRecord> &rrs)
      return;
   }
 
-  QC.insert(q.qname, q.qtype, rrs, store_ttl, q.zoneId);
+  QC.insert(q.qname, q.qtype, std::move(rrs), store_ttl, q.zoneId);
 }
 
 void UeberBackend::alsoNotifies(const DNSName &domain, set<string> *ips)
@@ -647,7 +647,7 @@ bool UeberBackend::get(DNSZoneRecord &rr)
     }
     else {
       // cout<<"adding query cache"<<endl;
-      addCache(d_question, d_answers);
+      addCache(d_question, std::move(d_answers));
     }
     d_answers.clear();
     return false;
diff --git a/pdns/ueberbackend.hh b/pdns/ueberbackend.hh
index 131cf1d184..09c3b451b1 100644
--- a/pdns/ueberbackend.hh
+++ b/pdns/ueberbackend.hh
@@ -160,6 +160,6 @@ private:
 
   int cacheHas(const Question &q, vector<DNSZoneRecord> &rrs);
   void addNegCache(const Question &q);
-  void addCache(const Question &q, const vector<DNSZoneRecord> &rrs);
+  void addCache(const Question &q, vector<DNSZoneRecord>&& rrs);
   
 };
diff --git a/pdns/zoneparser-tng.cc b/pdns/zoneparser-tng.cc
index 3a1bc444d3..0dc2b64670 100644
--- a/pdns/zoneparser-tng.cc
+++ b/pdns/zoneparser-tng.cc
@@ -294,36 +294,37 @@ bool ZoneParserTNG::get(DNSResourceRecord& rr, std::string* comment)
     comment->clear();
   if(comment && d_line.find(';') != string::npos)
     *comment = d_line.substr(d_line.find(';'));
-  parts_t parts;
-  vstringtok(parts, d_line);
 
-  if(parts.empty())
+  d_parts.clear();
+  vstringtok(d_parts, d_line);
+
+  if(d_parts.empty())
     goto retry;
 
-  if(parts[0].first != parts[0].second && d_line[parts[0].first]==';') // line consisting of nothing but comments
+  if(d_parts[0].first != d_parts[0].second && d_line[d_parts[0].first]==';') // line consisting of nothing but comments
     goto retry;
 
   if(d_line[0]=='$') { 
-    string command=makeString(d_line, parts[0]);
-    if(pdns_iequals(command,"$TTL") && parts.size() > 1) {
-      d_defaultttl=makeTTLFromZone(trim_right_copy_if(makeString(d_line, parts[1]), is_any_of(";")));
+    string command=makeString(d_line, d_parts[0]);
+    if(pdns_iequals(command,"$TTL") && d_parts.size() > 1) {
+      d_defaultttl=makeTTLFromZone(trim_right_copy_if(makeString(d_line, d_parts[1]), is_any_of(";")));
       d_havedollarttl=true;
     }
-    else if(pdns_iequals(command,"$INCLUDE") && parts.size() > 1 && d_fromfile) {
-      string fname=unquotify(makeString(d_line, parts[1]));
+    else if(pdns_iequals(command,"$INCLUDE") && d_parts.size() > 1 && d_fromfile) {
+      string fname=unquotify(makeString(d_line, d_parts[1]));
       if(!fname.empty() && fname[0]!='/' && !d_reldir.empty())
         fname=d_reldir+"/"+fname;
       stackFile(fname);
     }
-    else if(pdns_iequals(command, "$ORIGIN") && parts.size() > 1) {
-      d_zonename = DNSName(makeString(d_line, parts[1]));
+    else if(pdns_iequals(command, "$ORIGIN") && d_parts.size() > 1) {
+      d_zonename = DNSName(makeString(d_line, d_parts[1]));
     }
-    else if(pdns_iequals(command, "$GENERATE") && parts.size() > 2) {
+    else if(pdns_iequals(command, "$GENERATE") && d_parts.size() > 2) {
       if (!d_generateEnabled) {
         throw exception("$GENERATE is not allowed in this zone");
       }
       // $GENERATE 1-127 $ CNAME $.0
-      string range=makeString(d_line, parts[1]);
+      string range=makeString(d_line, d_parts[1]);
       d_templatestep=1;
       d_templatestop=0;
       sscanf(range.c_str(),"%u-%u/%u", &d_templatecounter, &d_templatestop, &d_templatestep);
@@ -338,10 +339,10 @@ bool ZoneParserTNG::get(DNSResourceRecord& rr, std::string* comment)
         }
       }
       d_templateline=d_line;
-      parts.pop_front();
-      parts.pop_front();
+      d_parts.pop_front();
+      d_parts.pop_front();
 
-      d_templateparts=parts;
+      d_templateparts=d_parts;
       goto retry;
     }
     else
@@ -350,13 +351,13 @@ bool ZoneParserTNG::get(DNSResourceRecord& rr, std::string* comment)
   }
 
   bool prevqname=false;
-  string qname = makeString(d_line, parts[0]); // Don't use DNSName here!
+  string qname = makeString(d_line, d_parts[0]); // Don't use DNSName here!
   if(dns_isspace(d_line[0])) {
     rr.qname=d_prevqname;
     prevqname=true;
   }else {
     rr.qname=DNSName(qname); 
-    parts.pop_front();
+    d_parts.pop_front();
     if(qname.empty() || qname[0]==';')
       goto retry;
   }
@@ -366,7 +367,7 @@ bool ZoneParserTNG::get(DNSResourceRecord& rr, std::string* comment)
     rr.qname += d_zonename;
   d_prevqname=rr.qname;
 
-  if(parts.empty()) 
+  if(d_parts.empty())
     throw exception("Line with too little parts "+getLineOfFile());
 
   string nextpart;
@@ -375,9 +376,9 @@ bool ZoneParserTNG::get(DNSResourceRecord& rr, std::string* comment)
   bool haveTTL=0, haveQTYPE=0;
   pair<string::size_type, string::size_type> range;
 
-  while(!parts.empty()) {
-    range=parts.front();
-    parts.pop_front();
+  while(!d_parts.empty()) {
+    range=d_parts.front();
+    d_parts.pop_front();
     nextpart=makeString(d_line, range);
     if(nextpart.empty())
       break;
diff --git a/pdns/zoneparser-tng.hh b/pdns/zoneparser-tng.hh
index 8cb2788a22..bd4aa71b17 100644
--- a/pdns/zoneparser-tng.hh
+++ b/pdns/zoneparser-tng.hh
@@ -61,6 +61,7 @@ private:
     int d_lineno;
   };
 
+  parts_t d_parts;
   string d_reldir;
   string d_line;
   DNSName d_prevqname;