import unbound 1.5.8

2016-03-05 19:18:07 +00:00 · 2016-03-05 19:18:07 +00:00 · 5bcd892e61
commit 5bcd892e61
parent e24c5f9706
63 changed files with 11757 additions and 8869 deletions
--- a/Makefile.in
+++ b/Makefile.in
@ -54,6 +54,7 @@ LEX=@LEX@
 STRIP=@STRIP@
 CC=@CC@
 CPPFLAGS=-I. @CPPFLAGS@
+PYTHON_CPPFLAGS=-I. @PYTHON_CPPFLAGS@
 CFLAGS=@CFLAGS@
 LDFLAGS=@LDFLAGS@
 LIBS=@LIBS@
@ -216,14 +217,14 @@ WINAPPS=@WINAPPS@
 WIN_DAEMON_THE_SRC=winrc/win_svc.c winrc/w_inst.c
 SVCINST_SRC=winrc/unbound-service-install.c
 SVCINST_OBJ=unbound-service-install.lo
-SVCINST_OBJ_LINK=$(SVCINST_OBJ) w_inst.lo rsrc_svcinst.o $(COMPAT_OBJ_WITHOUT_CTIME)
+SVCINST_OBJ_LINK=$(SVCINST_OBJ) w_inst.lo rsrc_svcinst.o $(COMPAT_OBJ_WITHOUT_CTIMEARC4)
 SVCUNINST_SRC=winrc/unbound-service-remove.c
 SVCUNINST_OBJ=unbound-service-remove.lo
 SVCUNINST_OBJ_LINK=$(SVCUNINST_OBJ) w_inst.lo rsrc_svcuninst.o \
-$(COMPAT_OBJ_WITHOUT_CTIME)
+$(COMPAT_OBJ_WITHOUT_CTIMEARC4)
 ANCHORUPD_SRC=winrc/anchor-update.c
 ANCHORUPD_OBJ=anchor-update.lo
-ANCHORUPD_OBJ_LINK=$(ANCHORUPD_OBJ) rsrc_anchorupd.o $(COMPAT_OBJ_WITHOUT_CTIME)
+ANCHORUPD_OBJ_LINK=$(ANCHORUPD_OBJ) rsrc_anchorupd.o $(COMPAT_OBJ_WITHOUT_CTIMEARC4)
 RSRC_OBJ=rsrc_svcinst.o rsrc_svcuninst.o rsrc_anchorupd.o rsrc_unbound.o \
 	rsrc_unbound_host.o rsrc_unbound_anchor.o rsrc_unbound_control.o \
 	rsrc_unbound_checkconf.o
@ -243,7 +244,7 @@ ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \
 	$(COMPAT_OBJ) $(PYUNBOUND_OBJ) \
 	$(SVCINST_OBJ) $(SVCUNINST_OBJ) $(ANCHORUPD_OBJ) $(SLDNS_OBJ)

-COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS)
+COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@
 LINK=$(LIBTOOL) --tag=CC --mode=link $(CC) $(staticexe) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS)
 LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) $(staticexe) -version-info @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined

@ -353,7 +354,7 @@ delayer$(EXEEXT):	$(DELAYER_OBJ_LINK)
 	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS)

 signit$(EXEEXT):	testcode/signit.c
-	$(CC) $(CPPFLAGS) $(CFLAGS) -o $@ testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)
+	$(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ -o $@ testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)

 unbound.h:	$(srcdir)/libunbound/unbound.h
 	sed -e 's/@''UNBOUND_VERSION_MAJOR@/$(UNBOUND_VERSION_MAJOR)/' -e 's/@''UNBOUND_VERSION_MINOR@/$(UNBOUND_VERSION_MINOR)/' -e 's/@''UNBOUND_VERSION_MICRO@/$(UNBOUND_VERSION_MICRO)/' < $(srcdir)/libunbound/unbound.h > $@
@ -389,13 +390,13 @@ pythonmod.lo pythonmod.o: $(srcdir)/pythonmod/pythonmod.c config.h \

 pythonmod/interface.h:	$(srcdir)/pythonmod/interface.i config.h
 	@-if test ! -d pythonmod; then $(INSTALL) -d pythonmod; fi
-	$(SWIG) $(CPPFLAGS) -o $@ -python $(srcdir)/pythonmod/interface.i
+	$(SWIG) $(PYTHON_CPPFLAGS) -o $@ -python $(srcdir)/pythonmod/interface.i

 libunbound_wrap.lo libunbound_wrap.o: libunbound/python/libunbound_wrap.c \
 	unbound.h
 libunbound/python/libunbound_wrap.c:	$(srcdir)/libunbound/python/libunbound.i unbound.h
 	@-if test ! -d libunbound/python; then $(INSTALL) -d libunbound/python; fi
-	$(SWIG) -python -o $@ $(CPPFLAGS) -DPY_MAJOR_VERSION=$(PY_MAJOR_VERSION) $(srcdir)/libunbound/python/libunbound.i
+	$(SWIG) -python -o $@ $(PYTHON_CPPFLAGS) -DPY_MAJOR_VERSION=$(PY_MAJOR_VERSION) $(srcdir)/libunbound/python/libunbound.i

 # Pyunbound python unbound wrapper
 _unbound.la:	libunbound_wrap.lo libunbound.la
@ -506,11 +507,11 @@ install-all:	all $(PYTHONMOD_INSTALL) $(PYUNBOUND_INSTALL) $(UNBOUND_EVENT_INSTA
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man5
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man1
-	$(LIBTOOL) --mode=install cp unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT)
-	$(LIBTOOL) --mode=install cp unbound-anchor$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-anchor$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT)
+	$(LIBTOOL) --mode=install cp -f unbound-anchor$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-anchor$(EXEEXT)
 	$(INSTALL) -c -m 644 doc/unbound.8 $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -c -m 644 doc/unbound-checkconf.8 $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -c -m 644 doc/unbound-control.8 $(DESTDIR)$(mandir)/man8
@ -567,7 +568,7 @@ DEPEND_TARGET2=Makefile.in
 # then, remove srcdir from the (generated) parser and lexer.
 # and mention the .lo
 depend:
-	(cd $(srcdir) ; $(CC) $(DEPFLAG) $(CPPFLAGS) $(CFLAGS) $(ALL_SRC) $(COMPAT_SRC)) | \
+	(cd $(srcdir) ; $(CC) $(DEPFLAG) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ $(ALL_SRC) $(COMPAT_SRC)) | \
 		sed -e 's!'$$HOME'[^ ]* !!g' -e 's!'$$HOME'[^ ]*$$!!g' \
 			-e 's!/usr[^ ]* !!g' -e 's!/usr[^ ]*$$!!g' \
 			-e 's!/opt[^ ]* !!g' -e 's!/opt[^ ]*$$!!g' | \
--- a/aclocal.m4
+++ b/aclocal.m4
--- a/acx_nlnetlabs.m4
+++ b/acx_nlnetlabs.m4
@ -2,7 +2,9 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 30
+# Version 32
+# 2016-01-04 -D_DEFAULT_SOURCE defined with -D_BSD_SOURCE for Linux glibc 2.20
+# 2015-12-11 FLTO check for new OSX, clang.
 # 2015-11-18 spelling check fix.
 # 2015-11-05 ACX_SSL_CHECKS no longer adds -ldl needlessly.
 # 2015-08-28 ACX_CHECK_PIE and ACX_CHECK_RELRO_NOW added.
@ -241,7 +243,7 @@ ACX_CHECK_COMPILER_FLAG(xc99, [C99FLAG="-xc99"])

 AC_CHECK_HEADERS([getopt.h time.h],,, [AC_INCLUDES_DEFAULT])

-ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE,
+ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE,
 [
 #include "confdefs.h"
 #include <stdlib.h>
@ -276,9 +278,9 @@ int test() {
 		a = 0;
 	return a;
 }
-], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"])
+], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"])

-ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE,
+ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE,
 [
 #include "confdefs.h"
 #include <stdlib.h>
@ -313,7 +315,7 @@ int test() {
 		a = 0;
 	return a;
 }
-], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE"])
+], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE"])

 ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG,
 [
@ -325,7 +327,7 @@ int test() {
 }
 ], [CFLAGS="$CFLAGS $C99FLAG"])

-ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE,
+ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE -D_DEFAULT_SOURCE,
 [
 #include <ctype.h>

@ -334,7 +336,7 @@ int test() {
        a = isascii(32);
        return a;
 }
-], [CFLAGS="$CFLAGS -D_BSD_SOURCE"])
+], [CFLAGS="$CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE"])

 ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE,
 [
@ -423,7 +425,7 @@ AC_DEFUN([ACX_CHECK_FLTO], [
        BAKCFLAGS="$CFLAGS"
        CFLAGS="$CFLAGS -flto"
        AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], [
-            if $CC $CFLAGS -o conftest conftest.c 2>&1 | grep "warning: no debug symbols in executable" >/dev/null; then
+            if $CC $CFLAGS -o conftest conftest.c 2>&1 | $GREP -e "warning: no debug symbols in executable" -e "warning: object" >/dev/null; then
                CFLAGS="$BAKCFLAGS"
                AC_MSG_RESULT(no)
            else
@ -1284,6 +1286,7 @@ AC_DEFUN([ACX_STRIP_EXT_FLAGS],
  AC_MSG_NOTICE([Stripping extension flags...])
  ACX_CFLAGS_STRIP(-D_GNU_SOURCE)
  ACX_CFLAGS_STRIP(-D_BSD_SOURCE)
+  ACX_CFLAGS_STRIP(-D_DEFAULT_SOURCE)
  ACX_CFLAGS_STRIP(-D__EXTENSIONS__)
  ACX_CFLAGS_STRIP(-D_POSIX_C_SOURCE=200112)
  ACX_CFLAGS_STRIP(-D_XOPEN_SOURCE=600)
@ -1311,6 +1314,7 @@ dnl config.h part to define omitted cflags, use with ACX_STRIP_EXT_FLAGS.
 AC_DEFUN([AHX_CONFIG_EXT_FLAGS],
 [AHX_CONFIG_FLAG_EXT(-D_GNU_SOURCE)
 AHX_CONFIG_FLAG_EXT(-D_BSD_SOURCE)
+AHX_CONFIG_FLAG_EXT(-D_DEFAULT_SOURCE)
 AHX_CONFIG_FLAG_EXT(-D__EXTENSIONS__)
 AHX_CONFIG_FLAG_EXT(-D_POSIX_C_SOURCE=200112)
 AHX_CONFIG_FLAG_EXT(-D_XOPEN_SOURCE=600)
--- a/ax_pthread.m4
+++ b/ax_pthread.m4
@ -82,7 +82,7 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.

-#serial 20
+#serial 21

 AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD])
 AC_DEFUN([AX_PTHREAD], [
@ -103,8 +103,8 @@ if test x"$PTHREAD_LIBS$PTHREAD_CFLAGS" != x; then
        save_LIBS="$LIBS"
        LIBS="$PTHREAD_LIBS $LIBS"
        AC_MSG_CHECKING([for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS])
-        AC_TRY_LINK_FUNC(pthread_join, ax_pthread_ok=yes)
-        AC_MSG_RESULT($ax_pthread_ok)
+        AC_TRY_LINK_FUNC([pthread_join], [ax_pthread_ok=yes])
+        AC_MSG_RESULT([$ax_pthread_ok])
        if test x"$ax_pthread_ok" = xno; then
                PTHREAD_LIBS=""
                PTHREAD_CFLAGS=""
@ -164,6 +164,20 @@ case ${host_os} in
        ;;
 esac

+# Clang doesn't consider unrecognized options an error unless we specify
+# -Werror. We throw in some extra Clang-specific options to ensure that
+# this doesn't happen for GCC, which also accepts -Werror.
+
+AC_MSG_CHECKING([if compiler needs -Werror to reject unknown flags])
+save_CFLAGS="$CFLAGS"
+ax_pthread_extra_flags="-Werror"
+CFLAGS="$CFLAGS $ax_pthread_extra_flags -Wunknown-warning-option -Wsizeof-array-argument"
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([int foo(void);],[foo()])],
+                  [AC_MSG_RESULT([yes])],
+                  [ax_pthread_extra_flags=
+                   AC_MSG_RESULT([no])])
+CFLAGS="$save_CFLAGS"
+
 if test x"$ax_pthread_ok" = xno; then
 for flag in $ax_pthread_flags; do

@ -178,7 +192,7 @@ for flag in $ax_pthread_flags; do
                ;;

                pthread-config)
-                AC_CHECK_PROG(ax_pthread_config, pthread-config, yes, no)
+                AC_CHECK_PROG([ax_pthread_config], [pthread-config], [yes], [no])
                if test x"$ax_pthread_config" = xno; then continue; fi
                PTHREAD_CFLAGS="`pthread-config --cflags`"
                PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
@ -193,7 +207,7 @@ for flag in $ax_pthread_flags; do
        save_LIBS="$LIBS"
        save_CFLAGS="$CFLAGS"
        LIBS="$PTHREAD_LIBS $LIBS"
-        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+        CFLAGS="$CFLAGS $PTHREAD_CFLAGS $ax_pthread_extra_flags"

        # Check for various functions.  We must include pthread.h,
        # since some functions may be macros.  (On the Sequent, we
@ -219,7 +233,7 @@ for flag in $ax_pthread_flags; do
        LIBS="$save_LIBS"
        CFLAGS="$save_CFLAGS"

-        AC_MSG_RESULT($ax_pthread_ok)
+        AC_MSG_RESULT([$ax_pthread_ok])
        if test "x$ax_pthread_ok" = xyes; then
                break;
        fi
@ -245,9 +259,9 @@ if test "x$ax_pthread_ok" = xyes; then
                [attr_name=$attr; break],
                [])
        done
-        AC_MSG_RESULT($attr_name)
+        AC_MSG_RESULT([$attr_name])
        if test "$attr_name" != PTHREAD_CREATE_JOINABLE; then
-            AC_DEFINE_UNQUOTED(PTHREAD_CREATE_JOINABLE, $attr_name,
+            AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE], [$attr_name],
                               [Define to necessary symbol if this constant
                                uses a non-standard name on your system.])
        fi
@ -261,24 +275,25 @@ if test "x$ax_pthread_ok" = xyes; then
            if test "$GCC" = "yes"; then
                flag="-D_REENTRANT"
            else
+                # TODO: What about Clang on Solaris?
                flag="-mt -D_REENTRANT"
            fi
            ;;
        esac
-        AC_MSG_RESULT(${flag})
+        AC_MSG_RESULT([$flag])
        if test "x$flag" != xno; then
            PTHREAD_CFLAGS="$flag $PTHREAD_CFLAGS"
        fi

        AC_CACHE_CHECK([for PTHREAD_PRIO_INHERIT],
-            ax_cv_PTHREAD_PRIO_INHERIT, [
-                AC_LINK_IFELSE([
-                    AC_LANG_PROGRAM([[#include <pthread.h>]], [[int i = PTHREAD_PRIO_INHERIT;]])],
+            [ax_cv_PTHREAD_PRIO_INHERIT], [
+                AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <pthread.h>]],
+                                                [[int i = PTHREAD_PRIO_INHERIT;]])],
                    [ax_cv_PTHREAD_PRIO_INHERIT=yes],
                    [ax_cv_PTHREAD_PRIO_INHERIT=no])
            ])
        AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes"],
-            AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], 1, [Have PTHREAD_PRIO_INHERIT.]))
+            [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.])])

        LIBS="$save_LIBS"
        CFLAGS="$save_CFLAGS"
@ -301,13 +316,13 @@ fi

 test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"

-AC_SUBST(PTHREAD_LIBS)
-AC_SUBST(PTHREAD_CFLAGS)
-AC_SUBST(PTHREAD_CC)
+AC_SUBST([PTHREAD_LIBS])
+AC_SUBST([PTHREAD_CFLAGS])
+AC_SUBST([PTHREAD_CC])

 # Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
 if test x"$ax_pthread_ok" = xyes; then
-        ifelse([$1],,AC_DEFINE(HAVE_PTHREAD,1,[Define if you have POSIX threads libraries and header files.]),[$1])
+        ifelse([$1],,[AC_DEFINE([HAVE_PTHREAD],[1],[Define if you have POSIX threads libraries and header files.])],[$1])
        :
 else
        ax_pthread_ok=no
--- a/config.h.in
+++ b/config.h.in
@ -242,6 +242,9 @@
 /* Define to 1 if you have the <netinet/in.h> header file. */
 #undef HAVE_NETINET_IN_H

+/* Define to 1 if you have the <netinet/tcp.h> header file. */
+#undef HAVE_NETINET_TCP_H
+
 /* Use libnettle for crypto */
 #undef HAVE_NETTLE

@ -293,7 +296,7 @@
 /* Define to 1 if you have the `recvmsg' function. */
 #undef HAVE_RECVMSG

-/* Define to 1 if you have the `sbrk' function. */
+/* define if you have the sbrk() call */
 #undef HAVE_SBRK

 /* Define to 1 if you have the `sendmsg' function. */
@ -461,8 +464,7 @@
 /* if lex has yylex_destroy */
 #undef LEX_HAS_YYLEX_DESTROY

-/* Define to the sub-directory in which libtool stores uninstalled libraries.
-   */
+/* Define to the sub-directory where libtool stores uninstalled libraries. */
 #undef LT_OBJDIR

 /* Define to the maximum message length to pass to syslog. */
@ -484,6 +486,9 @@
 /* Put -D_BSD_SOURCE define in config.h */
 #undef OMITTED__D_BSD_SOURCE

+/* Put -D_DEFAULT_SOURCE define in config.h */
+#undef OMITTED__D_DEFAULT_SOURCE
+
 /* Put -D_GNU_SOURCE define in config.h */
 #undef OMITTED__D_GNU_SOURCE

@ -738,6 +743,10 @@
 #define _BSD_SOURCE 1
 #endif 

+#if defined(OMITTED__D_DEFAULT_SOURCE) && !defined(_DEFAULT_SOURCE)
+#define _DEFAULT_SOURCE 1
+#endif 
+
 #if defined(OMITTED__D__EXTENSIONS__) && !defined(__EXTENSIONS__)
 #define __EXTENSIONS__ 1
 #endif 
@ -811,6 +820,10 @@
 #include <netinet/in.h>
 #endif

+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
--- a/2282
+++ b/2282
--- a/configure.ac
+++ b/configure.ac
@ -10,15 +10,15 @@ sinclude(dnstap/dnstap.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[5])
-m4_define([VERSION_MICRO],[7])
+m4_define([VERSION_MICRO],[8])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

-LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=10
-LIBUNBOUND_AGE=3
+LIBUNBOUND_CURRENT=6
+LIBUNBOUND_REVISION=0
+LIBUNBOUND_AGE=4
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
 # 1.0.2 had 0:14:0
@ -64,6 +64,7 @@ LIBUNBOUND_AGE=3
 # 1.5.5 had 5:8:3
 # 1.5.6 had 5:9:3
 # 1.5.7 had 5:10:3
+# 1.5.8 had 6:0:4 # adds ub_ctx_set_stub

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@ -276,7 +277,7 @@ AC_CHECK_TOOL(STRIP, strip)
 ACX_LIBTOOL_C_ONLY

 # Checks for header files.
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h],,, [AC_INCLUDES_DEFAULT])

 # check for types.  
 # Using own tests for int64* because autoconf builtin only give 32bit.
@ -417,6 +418,36 @@ if test x_$withval != x_no; then
 		CC="$PTHREAD_CC"
 		ub_have_pthreads=yes
 		AC_CHECK_TYPES([pthread_spinlock_t, pthread_rwlock_t],,,[#include <pthread.h>])
+
+		if echo "$CFLAGS" | $GREP -e "-pthread" >/dev/null; then
+		AC_MSG_CHECKING([if -pthread unused during linking])
+		# catch clang warning 'argument unused during compilation'
+		AC_LANG_CONFTEST([AC_LANG_SOURCE(AC_INCLUDES_DEFAULT
+[[
+int main(void) {return 0;}
+]])])
+		pthread_unused="yes"
+		# first compile
+		echo "$CC $CFLAGS -c conftest.c -o conftest.o" >&AS_MESSAGE_LOG_FD
+		$CC $CFLAGS -c conftest.c -o conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
+		if test $? = 0; then 
+			# then link
+			echo "$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest contest.o" >&AS_MESSAGE_LOG_FD
+			$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
+			if test $? -ne 0; then
+				AC_MSG_RESULT(yes)
+				CFLAGS=`echo "$CFLAGS" | sed -e 's/-pthread//'`
+				PTHREAD_CFLAGS_ONLY="-pthread"
+				AC_SUBST(PTHREAD_CFLAGS_ONLY)
+			else
+				AC_MSG_RESULT(no)
+			fi
+		else
+			AC_MSG_RESULT(no)
+		fi # endif cc successful
+		rm -f conftest conftest.c conftest.o
+		fi # endif -pthread in CFLAGS
+
 		])
 fi

@ -999,6 +1030,10 @@ AC_INCLUDES_DEFAULT
 #include <netinet/in.h>
 #endif

+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
@ -1012,10 +1047,23 @@ AC_INCLUDES_DEFAULT
 #endif
 ])
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
 AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])

+AC_MSG_CHECKING([for sbrk])
+# catch the warning of deprecated sbrk
+old_cflags="$CFLAGS"
+CFLAGS="$CFLAGS -Werror"
+AC_COMPILE_IFELSE([AC_LANG_SOURCE(AC_INCLUDES_DEFAULT
+[[
+int main(void) { void* cur = sbrk(0); printf("%u\n", (unsigned)(size_t)((char*)cur - (char*)sbrk(0))); return 0; }
+]])], [
+	AC_MSG_RESULT(yes)
+	AC_DEFINE(HAVE_SBRK, 1, [define if you have the sbrk() call])
+    ], [AC_MSG_RESULT(no)])
+CFLAGS="$old_cflags"
+
 # check if setreuid en setregid fail, on MacOSX10.4(darwin8).
 if echo $build_os | grep darwin8 > /dev/null; then
 	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
@ -1250,6 +1298,10 @@ dnl includes
 #include <netinet/in.h>
 #endif

+#ifdef HAVE_NETINET_TCP_H
+#include <netinet/tcp.h>
+#endif
+
 #ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
--- a/contrib/aaaa-filter-iterator.patch
+++ b/contrib/aaaa-filter-iterator.patch
@ -1,8 +1,10 @@
--- unbound-1.4.17.orig/doc/unbound.conf.5.in
-+++ unbound-1.4.17/doc/unbound.conf.5.in
-@@ -519,6 +519,13 @@ authority servers and checks if the repl
- Disabled by default. 
- This feature is an experimental implementation of draft dns\-0x20.
+Index: trunk/doc/unbound.conf.5.in
+===================================================================
+--- trunk/doc/unbound.conf.5.in	(revision 3587)
+++ trunk/doc/unbound.conf.5.in	(working copy)
+@@ -593,6 +593,13 @@
+ possible. Best effort approach, full QNAME and original QTYPE will be sent when
+ upstream replies with a RCODE other than NOERROR. Default is off.
 .TP
 +.B aaaa\-filter: \fI<yes or no>
 +Activate behavior similar to BIND's AAAA-filter.
@ -13,20 +15,12 @@
 +.TP
 .B private\-address: \fI<IP address or subnet>
 Give IPv4 of IPv6 addresses or classless subnets. These are addresses
- on your private network, and are not allowed to be returned for public
--- unbound-1.4.17.orig/util/config_file.c
-+++ unbound-1.4.17/util/config_file.c
-@@ -160,6 +160,7 @@ config_create(void)
- 	cfg->harden_below_nxdomain = 0;
- 	cfg->harden_referral_path = 0;
- 	cfg->use_caps_bits_for_id = 0;
-+	cfg->aaaa_filter = 0; /* ASN: default is disabled */
- 	cfg->private_address = NULL;
- 	cfg->private_domain = NULL;
- 	cfg->unwanted_threshold = 0;
--- unbound-1.4.17.orig/iterator/iter_scrub.c
-+++ unbound-1.4.17/iterator/iter_scrub.c
-@@ -580,6 +580,32 @@ static int sanitize_nsec_is_overreach(st
+ on your private network, and are not allowed to be returned for
+Index: trunk/iterator/iter_scrub.c
+===================================================================
+--- trunk/iterator/iter_scrub.c	(revision 3587)
+++ trunk/iterator/iter_scrub.c	(working copy)
+@@ -617,6 +617,32 @@
 }
 
 /**
@ -38,7 +32,7 @@
 + */
 +static int
 +asn_lookup_a_record_from_cache(struct query_info* qinfo,
-+	struct module_env* env, struct iter_env* ie)
+	struct module_env* env, struct iter_env* ATTR_UNUSED(ie))
 +{
 +	struct ub_packed_rrset_key* akey;
 +
@ -59,7 +53,7 @@
  * Given a response event, remove suspect RRsets from the response.
  * "Suspect" rrsets are potentially poison. Note that this routine expects
  * the response to be in a "normalized" state -- that is, all "irrelevant"
-@@ -598,6 +625,7 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -635,6 +661,7 @@
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
 	struct iter_env* ie)
 {
@ -67,7 +61,7 @@
 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
 		do not trust the normalized additional-A-AAAA any more */
 	struct rrset_parse* rrset, *prev;
-@@ -633,6 +661,13 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -670,6 +697,13 @@
 		rrset = rrset->rrset_all_next;
 	}
 
@ -81,7 +75,7 @@
 	/* At this point, we brutally remove ALL rrsets that aren't 
 	 * children of the originating zone. The idea here is that, 
 	 * as far as we know, the server that we contacted is ONLY 
-@@ -644,6 +679,24 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -681,6 +715,24 @@
 	rrset = msg->rrset_first;
 	while(rrset) {
 
@ -105,10 +99,24 @@
 +
 		/* remove private addresses */
 		if( (rrset->type == LDNS_RR_TYPE_A || 
- 			rrset->type == LDNS_RR_TYPE_AAAA) &&
--- unbound-1.4.17.orig/iterator/iterator.c
-+++ unbound-1.4.17/iterator/iterator.c
-@@ -1579,6 +1579,53 @@ processDSNSFind(struct module_qstate* qs
+ 			rrset->type == LDNS_RR_TYPE_AAAA)) {
+Index: trunk/iterator/iter_utils.c
+===================================================================
+--- trunk/iterator/iter_utils.c	(revision 3587)
+++ trunk/iterator/iter_utils.c	(working copy)
+@@ -175,6 +175,7 @@
+ 	}
+ 	iter_env->supports_ipv6 = cfg->do_ip6;
+ 	iter_env->supports_ipv4 = cfg->do_ip4;
+	iter_env->aaaa_filter = cfg->aaaa_filter;
+ 	return 1;
+ }
+ 
+Index: trunk/iterator/iterator.c
+===================================================================
+--- trunk/iterator/iterator.c	(revision 3587)
+++ trunk/iterator/iterator.c	(working copy)
+@@ -1776,6 +1776,53 @@
 
 	return 0;
 }
@ -128,7 +136,7 @@
 + */
 +static int
 +asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
-+	struct iter_env* ie, int id)
+	struct iter_env* ATTR_UNUSED(ie), int id)
 +{
 +	struct module_qstate* subq = NULL;
 +
@ -162,7 +170,7 @@
 	
 /** 
  * This is the request event state where the request will be sent to one of
-@@ -1626,6 +1673,13 @@ processQueryTargets(struct module_qstate
+@@ -1823,6 +1870,13 @@
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	
@ -176,7 +184,7 @@
 	/* Make sure we have a delegation point, otherwise priming failed
 	 * or another failure occurred */
 	if(!iq->dp) {
-@@ -2568,6 +2622,62 @@ processFinished(struct module_qstate* qs
+@@ -2922,6 +2976,61 @@
 	return 0;
 }
 
@ -195,9 +203,8 @@
 +asn_processAAAAResponse(struct module_qstate* qstate, int id,
 +	struct module_qstate* super)
 +{
-+	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
+	/*struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];*/
 +	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
-+	struct ub_packed_rrset_key* rrset;
 +	struct delegpt_ns* dpns = NULL;
 +	int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
 +
@ -239,7 +246,7 @@
 /*
  * Return priming query results to interestes super querystates.
  * 
-@@ -2587,6 +2697,9 @@ iter_inform_super(struct module_qstate*
+@@ -2941,6 +3050,9 @@
 	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
 		super->minfo[id])->state == DSNS_FIND_STATE)
 		processDSNSResponse(qstate, id, super);
@ -249,7 +256,7 @@
 	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		error_supers(qstate, id, super);
 	else if(qstate->is_priming)
-@@ -2624,6 +2737,9 @@ iter_handle(struct module_qstate* qstate
+@@ -2978,6 +3090,9 @@
 			case INIT_REQUEST_3_STATE:
 				cont = processInitRequest3(qstate, iq, id);
 				break;
@ -259,7 +266,7 @@
 			case QUERYTARGETS_STATE:
 				cont = processQueryTargets(qstate, iq, ie, id);
 				break;
-@@ -2863,6 +2979,8 @@ iter_state_to_string(enum iter_state sta
+@@ -3270,6 +3385,8 @@
 		return "INIT REQUEST STATE (stage 2)";
 	case INIT_REQUEST_3_STATE:
 		return "INIT REQUEST STATE (stage 3)";
@ -268,7 +275,7 @@
 	case QUERYTARGETS_STATE :
 		return "QUERY TARGETS STATE";
 	case PRIME_RESP_STATE :
-@@ -2887,6 +3005,7 @@ iter_state_is_responsestate(enum iter_st
+@@ -3294,6 +3411,7 @@
 		case INIT_REQUEST_STATE :
 		case INIT_REQUEST_2_STATE :
 		case INIT_REQUEST_3_STATE :
@ -276,29 +283,21 @@
 		case QUERYTARGETS_STATE :
 		case COLLECT_CLASS_STATE :
 			return 0;
--- unbound-1.4.17.orig/iterator/iter_utils.c
-+++ unbound-1.4.17/iterator/iter_utils.c
-@@ -128,6 +128,7 @@ iter_apply_cfg(struct iter_env* iter_env
- 	}
- 	iter_env->supports_ipv6 = cfg->do_ip6;
- 	iter_env->supports_ipv4 = cfg->do_ip4;
-+	iter_env->aaaa_filter = cfg->aaaa_filter;
- 	return 1;
- }
- 
--- unbound-1.4.17.orig/iterator/iterator.h
-+++ unbound-1.4.17/iterator/iterator.h
-@@ -110,6 +110,9 @@ struct iter_env {
- 	 * array of max_dependency_depth+1 size.
+Index: trunk/iterator/iterator.h
+===================================================================
+--- trunk/iterator/iterator.h	(revision 3587)
+++ trunk/iterator/iterator.h	(working copy)
+@@ -113,6 +113,9 @@
 	 */
 	int* target_fetch_policy;
-+
+ 
 +	/** ASN: AAAA-filter flag */
 +	int aaaa_filter;
+
+ 	/** ip6.arpa dname in wireformat, used for qname-minimisation */
+ 	uint8_t* ip6arpa_dname;
 };
- 
- /**
-@@ -135,6 +138,14 @@ enum iter_state {
+@@ -163,6 +166,14 @@
 	INIT_REQUEST_3_STATE,
 
 	/**
@ -312,8 +311,8 @@
 +	/**
 	 * Each time a delegation point changes for a given query or a 
 	 * query times out and/or wakes up, this state is (re)visited. 
- 	 * This state is responsible for iterating through a list of 
-@@ -309,6 +320,13 @@ struct iter_qstate {
+ 	 * This state is reponsible for iterating through a list of 
+@@ -346,6 +357,13 @@
 	 */
 	int refetch_glue;
 
@ -326,31 +325,61 @@
 +
 	/** list of pending queries to authoritative servers. */
 	struct outbound_list outlist;
- };
--- unbound-1.4.17.orig/util/config_file.h
-+++ unbound-1.4.17/util/config_file.h
-@@ -169,6 +169,8 @@ struct config_file {
- 	int harden_referral_path;
+ 
+Index: trunk/pythonmod/interface.i
+===================================================================
+--- trunk/pythonmod/interface.i	(revision 3587)
+++ trunk/pythonmod/interface.i	(working copy)
+@@ -632,6 +632,7 @@
+    int harden_dnssec_stripped;
+    int harden_referral_path;
+    int use_caps_bits_for_id;
+   int aaaa_filter; /* ASN */
+    struct config_strlist* private_address;
+    struct config_strlist* private_domain;
+    size_t unwanted_threshold;
+Index: trunk/util/config_file.c
+===================================================================
+--- trunk/util/config_file.c	(revision 3587)
+++ trunk/util/config_file.c	(working copy)
+@@ -176,6 +176,7 @@
+ 	cfg->harden_referral_path = 0;
+ 	cfg->harden_algo_downgrade = 0;
+ 	cfg->use_caps_bits_for_id = 0;
+	cfg->aaaa_filter = 0; /* ASN: default is disabled */
+ 	cfg->caps_whitelist = NULL;
+ 	cfg->private_address = NULL;
+ 	cfg->private_domain = NULL;
+Index: trunk/util/config_file.h
+===================================================================
+--- trunk/util/config_file.h	(revision 3587)
+++ trunk/util/config_file.h	(working copy)
+@@ -179,6 +179,8 @@
+ 	int harden_algo_downgrade;
 	/** use 0x20 bits in query as random ID bits */
 	int use_caps_bits_for_id;
 +	/** ASN: enable AAAA filter? */
 +	int aaaa_filter;
+ 	/** 0x20 whitelist, domains that do not use capsforid */
+ 	struct config_strlist* caps_whitelist;
 	/** strip away these private addrs from answers, no DNS Rebinding */
- 	struct config_strlist* private_address;
- 	/** allow domain (and subdomains) to use private address space */
--- unbound-1.4.17.orig/util/configlexer.lex
-+++ unbound-1.4.17/util/configlexer.lex
-@@ -177,6 +177,7 @@ harden-below-nxdomain{COLON}	{ YDVAR(1,
- harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+Index: trunk/util/configlexer.lex
+===================================================================
+--- trunk/util/configlexer.lex	(revision 3587)
+++ trunk/util/configlexer.lex	(working copy)
+@@ -267,6 +267,7 @@
 use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+ caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
 unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 +aaaa-filter{COLON}		{ YDVAR(1, VAR_AAAA_FILTER) }
 private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
 private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
--- unbound-1.4.17.orig/util/configparser.y
-+++ unbound-1.4.17/util/configparser.y
-@@ -92,6 +92,7 @@ extern struct config_parser_state* cfg_p
+Index: trunk/util/configparser.y
+===================================================================
+--- trunk/util/configparser.y	(revision 3587)
+++ trunk/util/configparser.y	(working copy)
+@@ -92,6 +92,7 @@
 %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
 %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
 %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
@ -358,7 +387,7 @@
 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -151,6 +152,7 @@ content_server: server_num_threads | ser
+@@ -169,6 +170,7 @@
 	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
 	server_harden_referral_path | server_private_address |
 	server_private_domain | server_extended_statistics | 
@ -366,8 +395,8 @@
 	server_local_data_ptr | server_jostle_timeout | 
 	server_unwanted_reply_threshold | server_log_time_ascii | 
 	server_domain_insecure | server_val_sig_skew_min | 
-@@ -802,6 +803,15 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR
- 		free($2);
+@@ -893,6 +895,15 @@
+ 			yyerror("out of memory");
 	}
 	;
 +server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
@ -382,13 +411,3 @@
 server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
 	{
 		OUTYY(("P(server_private_address:%s)\n", $2));
--- unbound-1.4.17.orig/pythonmod/interface.i
-+++ unbound-1.4.17/pythonmod/interface.i
-@@ -626,6 +626,7 @@ struct config_file {
-    int harden_dnssec_stripped;
-    int harden_referral_path;
-    int use_caps_bits_for_id;
-+   int aaaa_filter; /* ASN */
-    struct config_strlist* private_address;
-    struct config_strlist* private_domain;
-    size_t unwanted_threshold;
--- a/daemon/remote.c
+++ b/daemon/remote.c
@ -389,7 +389,7 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,

 		/* open fd */
 		fd = create_tcp_accept_sock(res, 1, &noproto, 0,
-			cfg->ip_transparent);
+			cfg->ip_transparent, 0);
 		freeaddrinfo(res);
 	}

--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@ -443,6 +443,9 @@ static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	const char** cfgfile)
 {
+#ifdef HAVE_KILL
+	int pidinchroot;
+#endif
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;

@ -481,6 +484,12 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif

 #ifdef HAVE_KILL
+	/* true if pidfile is inside chrootdir, or nochroot */
+	pidinchroot = !(cfg->chrootdir && cfg->chrootdir[0]) ||
+				(cfg->chrootdir && cfg->chrootdir[0] &&
+				strncmp(cfg->pidfile, cfg->chrootdir,
+				strlen(cfg->chrootdir))==0);
+
 	/* check old pid file before forking */
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		/* calculate position of pidfile */
@ -490,12 +499,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 				cfg, 1);
 		if(!daemon->pidfile)
 			fatal_exit("pidfile alloc: out of memory");
-		checkoldpid(daemon->pidfile,
-			/* true if pidfile is inside chrootdir, or nochroot */
-			!(cfg->chrootdir && cfg->chrootdir[0]) ||
-			(cfg->chrootdir && cfg->chrootdir[0] &&
-			strncmp(daemon->pidfile, cfg->chrootdir,
-				strlen(cfg->chrootdir))==0));
+		checkoldpid(daemon->pidfile, pidinchroot);
 	}
 #endif

@ -508,10 +512,11 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #ifdef HAVE_KILL
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		writepid(daemon->pidfile, getpid());
-		if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
+		if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1 &&
+			pidinchroot) {
 #  ifdef HAVE_CHOWN
 			if(chown(daemon->pidfile, cfg_uid, cfg_gid) == -1) {
-				log_err("cannot chown %u.%u %s: %s",
+				verbose(VERB_QUERY, "cannot chown %u.%u %s: %s",
 					(unsigned)cfg_uid, (unsigned)cfg_gid,
 					daemon->pidfile, strerror(errno));
 			}
@ -735,7 +740,7 @@ main(int argc, char* argv[])
 #endif
 			break;
 		case 'v':
-			cmdline_verbose ++;
+			cmdline_verbose++;
 			verbosity++;
 			break;
 		case 'd':
--- a/daemon/worker.c
+++ b/daemon/worker.c
@ -1217,7 +1217,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		cfg->do_tcp?cfg->outgoing_num_tcp:0, 
 		worker->daemon->env->infra_cache, worker->rndstate,
 		cfg->use_caps_bits_for_id, worker->ports, worker->numports,
-		cfg->unwanted_threshold, &worker_alloc_cleanup, worker,
+		cfg->unwanted_threshold, cfg->outgoing_tcp_mss,
+		&worker_alloc_cleanup, worker,
 		cfg->do_udp, worker->daemon->connect_sslctx, cfg->delay_close,
 		dtenv);
 	if(!worker->back) {
--- a/dnstap/dnstap.c
+++ b/dnstap/dnstap.c
@ -128,7 +128,8 @@ dt_create(const char *socket_path, unsigned num_workers)
 	struct fstrm_writer *fw;
 	struct fstrm_writer_options *fwopt;

-	verbose(VERB_OPS, "opening dnstap socket %s", socket_path);
+	verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
+		socket_path);
 	log_assert(socket_path != NULL);
 	log_assert(num_workers > 0);

--- a/doc/Changelog
+++ b/doc/Changelog
@ -1,3 +1,102 @@
+24 February 2016: Wouter
+	- Fix OpenBSD asynclook lock free that gets used later (fix test code).
+	- Fix that NSEC3 negative cache is used when there is no salt.
+
+23 February 2016: Wouter
+	- ub_ctx_set_stub() function for libunbound to config stub zones.
+	- sorted ubsyms.def file with exported libunbound functions.
+
+19 February 2016: Wouter
+	- Print understandable debug log when unusable DS record is seen.
+	- load gost algorithm if digest is seen before key algorithm.
+	- iana portlist update.
+
+17 February 2016: Wouter
+	- Fix that "make install" fails due to "text file busy" error.
+
+16 February 2016: Wouter
+	- Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.
+
+15 February 2016: Wouter
+	- ip-transparent option for FreeBSD with IP_BINDANY socket option.
+	- wait for sendto to drain socket buffers when they are full.
+
+9 February 2016: Wouter
+	- Test for type OPENPGPKEY.
+	- insecure-lan-zones: yesno config option, patch from Dag-Erling
+	  Smørgrav.
+
+8 February 2016: Wouter
+	- Fix patch typo in prevuous commit for 734 from Adi Prasaja.
+	- RR Type CSYNC support RFC 7477, in debug printout and config input.
+	- RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
+
+29 January 2016: Wouter
+	- Neater cmdline_verbose increment patch from Edgar Pettijohn.
+
+27 January 2016: Wouter
+	- Made netbsd sendmsg test nonfatal, in case of false positives.
+	- Fix #741: log message for dnstap socket connection is more clear.
+
+26 January 2016: Wouter
+	- Fix #734: chown the pidfile if it resides inside the chroot.
+	- Use arc4random instead of random in tests (because it is
+	  available, possibly as compat, anyway).
+	- Fix cmsg alignment for argument to sendmsg on NetBSD.
+	- Fix that unbound complains about unimplemented IP_PKTINFO for
+	  sendmsg on NetBSD (for interface-automatic).
+
+25 January 2016: Wouter
+	- Fix #738: Swig should not be invoked with CPPFLAGS.
+
+19 January 2016: Wouter
+	- Squelch 'cannot assign requested address' log messages unless
+	  verbosity is high, it was spammed after network down.
+
+14 January 2016: Wouter
+	- Fix to simplify empty string checking from Michael McConville.
+	- iana portlist update.
+
+12 January 2016: Wouter
+	- Fix #734: Do not log an error when the PID file cannot be chown'ed.
+	  Patch from Simon Deziel.
+
+11 January 2016: Wouter
+	- Fix test if -pthreads unused to use better grep for portability.
+
+06 January 2016: Wouter
+	- Fix mingw crosscompile for recent mingw.
+	- Update aclocal, autoconf output with new versions (1.15, 2.4.6).
+
+05 January 2016: Wouter
+	- #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch
+	  from Daisuke Higashi.
+	- Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
+	  by default, and can be unblocked with "nodefault" localzone config.
+
+04 January 2016: Wouter
+	- Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined,
+	  for Linux glibc 2.20.
+	- Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
+	  source code, so it applies cleanly again.  Removed unused variable
+	  warnings.
+
+15 December 2015: Ralph
+	- Fix #729: omit use of escape sequences in echo since they are not 
+	  portable (unbound-control-setup).
+
+11 December 2015: Wouter
+	- remove NULL-checks before free, patch from Michael McConville.
+	- updated ax_pthread.m4 to version 21 with clang support, this
+	  removes a warning from compilation.
+	- OSX portability, detect if sbrk is deprecated.
+	- OSX clang, stop -pthread unused during link stage warnings.
+	- OSX clang new flto check.
+
+10 December 2015: Wouter
+	- 1.5.7 release
+	- trunk has 1.5.8 in development.
+
 8 December 2015: Wouter
 	- Fixup 724 for unbound-control.

--- a/doc/README
+++ b/doc/README
@ -1,4 +1,4 @@
-README for Unbound 1.5.7
+README for Unbound 1.5.8
 Copyright 2007 NLnet Labs
 http://unbound.net

--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.5.7.
+# See unbound.conf(5) man page, version 1.5.8.
 #
 # this is a comment.

@ -90,6 +90,7 @@ server:

 	# use IP_TRANSPARENT so the interface: addresses can be non-local
 	# and you can config non-existing IPs that are going to work later on
+	# (uses IP_BINDANY on FreeBSD).
 	# ip-transparent: no

 	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
@ -173,6 +174,14 @@ server:
 	# useful for tunneling scenarios, default no.
 	# tcp-upstream: no

+	# Maximum segment size (MSS) of TCP socket on which the server
+	# responds to queries. Default is 0, system default MSS.
+	# tcp-mss: 0
+
+	# Maximum segment size (MSS) of TCP socket for outgoing queries.
+	# Default is 0, system default MSS.
+	# outgoing-tcp-mss: 0
+
 	# Detach from the terminal, run in background, "yes" or "no".
 	# do-daemonize: yes

@ -475,6 +484,7 @@ server:
 	# local-zone: "localhost." nodefault
 	# local-zone: "127.in-addr.arpa." nodefault
 	# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
+	# local-zone: "onion." nodefault
 	# local-zone: "10.in-addr.arpa." nodefault
 	# local-zone: "16.172.in-addr.arpa." nodefault
 	# local-zone: "17.172.in-addr.arpa." nodefault
--- a/doc/libunbound.3.in
+++ b/doc/libunbound.3.in
@ -1,4 +1,4 @@
-.TH "libunbound" "3" "Dec 10, 2015" "NLnet Labs" "unbound 1.5.7"
+.TH "libunbound" "3" "Mar  2, 2016" "NLnet Labs" "unbound 1.5.8"
 .\"
 .\" libunbound.3 -- unbound library functions manual
 .\"
@ -19,6 +19,7 @@
 .B ub_ctx_get_option,
 .B ub_ctx_config,
 .B ub_ctx_set_fwd,
+.B ub_ctx_set_stub,
 .B ub_ctx_resolvconf,
 .B ub_ctx_hosts,
 .B ub_ctx_add_ta,
@ -42,7 +43,7 @@
 .B ub_ctx_zone_remove,
 .B ub_ctx_data_add,
 .B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.5.7 functions.
+\- Unbound DNS validating resolver 1.5.8 functions.
 .SH "SYNOPSIS"
 .B #include <unbound.h>
 .LP
@ -65,6 +66,12 @@
 \fBub_ctx_set_fwd\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR addr);
 .LP
 \fIint\fR
+\fBub_ctx_set_stub\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone,
+\fIchar*\fR addr,
+.br
+		\fIint\fR isprime);
+.LP
+\fIint\fR
 \fBub_ctx_resolvconf\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
@ -207,6 +214,15 @@ that case the addresses are used as backup servers.
 At this time it is only possible to set configuration before the
 first resolve is done.
 .TP
+.B ub_ctx_set_stub
+Set a stub zone, authoritative dns servers to use for a particular zone.
+IP4 or IP6 address.  If the address is NULL the stub entry is removed.
+Set isprime true if you configure root hints with it.  Otherwise similar to
+the stub zone item from unbound's config file.  Can be called several times,
+for different zones, or to add multiple addresses for a particular zone.
+At this time it is only possible to set configuration before the
+first resolve is done.
+.TP
 .B ub_ctx_resolvconf
 By default the root servers are queried and full resolver mode is used, but
 you can use this call to read the list of nameservers to use from the
--- a/doc/unbound-anchor.8.in
+++ b/doc/unbound-anchor.8.in
@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "Dec 10, 2015" "NLnet Labs" "unbound 1.5.7"
+.TH "unbound-anchor" "8" "Mar  2, 2016" "NLnet Labs" "unbound 1.5.8"
 .\"
 .\" unbound-anchor.8 -- unbound anchor maintenance utility manual
 .\"
--- a/doc/unbound-checkconf.8.in
+++ b/doc/unbound-checkconf.8.in
@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "Dec 10, 2015" "NLnet Labs" "unbound 1.5.7"
+.TH "unbound-checkconf" "8" "Mar  2, 2016" "NLnet Labs" "unbound 1.5.8"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "Dec 10, 2015" "NLnet Labs" "unbound 1.5.7"
+.TH "unbound-control" "8" "Mar  2, 2016" "NLnet Labs" "unbound 1.5.8"
 .\"
 .\" unbound-control.8 -- unbound remote control manual
 .\"
--- a/doc/unbound-host.1.in
+++ b/doc/unbound-host.1.in
@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "Dec 10, 2015" "NLnet Labs" "unbound 1.5.7"
+.TH "unbound\-host" "1" "Mar  2, 2016" "NLnet Labs" "unbound 1.5.8"
 .\"
 .\" unbound-host.1 -- unbound DNS lookup utility
 .\"
--- a/doc/unbound.8.in
+++ b/doc/unbound.8.in
@ -1,4 +1,4 @@
-.TH "unbound" "8" "Dec 10, 2015" "NLnet Labs" "unbound 1.5.7"
+.TH "unbound" "8" "Mar  2, 2016" "NLnet Labs" "unbound 1.5.8"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@ -9,7 +9,7 @@
 .\"
 .SH "NAME"
 .B unbound
-\- Unbound DNS validating resolver 1.5.7.
+\- Unbound DNS validating resolver 1.5.8.
 .SH "SYNOPSIS"
 .B unbound
 .RB [ \-h ]
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "Dec 10, 2015" "NLnet Labs" "unbound 1.5.7"
+.TH "unbound.conf" "5" "Mar  2, 2016" "NLnet Labs" "unbound 1.5.8"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
@ -275,7 +275,7 @@ are going to exist later on, with host failover configuration.  This is
 a lot like interface\-automatic, but that one services all interfaces
 and with this option you can select which (future) interfaces unbound
 provides service on.  This option needs unbound to be started with root
-permissions on some systems.
+permissions on some systems.  The option uses IP_BINDANY on FreeBSD systems.
 .TP
 .B rrset\-cache\-size: \fI<number>
 Number of bytes size of the RRset cache. Default is 4 megabytes.
@ -338,6 +338,22 @@ Enable or disable whether UDP queries are answered or issued. Default is yes.
 .B do\-tcp: \fI<yes or no>
 Enable or disable whether TCP queries are answered or issued. Default is yes.
 .TP
+.B tcp\-mss: \fI<number>
+Maximum segment size (MSS) of TCP socket on which the server responds
+to queries. Value lower than common MSS on Ethernet 
+(1220 for example) will address path MTU problem.
+Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
+Default is system default MSS determined by interface MTU and
+negotiation between server and client.
+.TP
+.B outgoing\-tcp\-mss: \fI<number>
+Maximum segment size (MSS) of TCP socket for outgoing queries
+(from Unbound to other servers). Value lower than
+common MSS on Ethernet (1220 for example) will address path MTU problem.
+Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
+Default is system default MSS determined by interface MTU and
+negotiation between Unbound and other servers.
+.TP
 .B tcp\-upstream: \fI<yes or no>
 Enable or disable whether the upstream queries use TCP only for transport.
 Default is no.  Useful in tunneling scenarios.
@ -917,10 +933,10 @@ has no other effect than turning off default contents for the
 given zone.  Use \fInodefault\fR if you use exactly that zone, if you want to
 use a subzone, use \fItransparent\fR.
 .P
-The default zones are localhost, reverse 127.0.0.1 and ::1, and the AS112
-zones. The AS112 zones are reverse DNS zones for private use and reserved
-IP addresses for which the servers on the internet cannot provide correct
-answers. They are configured by default to give nxdomain (no reverse 
+The default zones are localhost, reverse 127.0.0.1 and ::1, the onion and
+the AS112 zones. The AS112 zones are reverse DNS zones for private use and
+reserved IP addresses for which the servers on the internet cannot provide
+correct answers. They are configured by default to give nxdomain (no reverse
 information) answers. The defaults can be turned off by specifying your
 own local\-zone of that name, or using the 'nodefault' type. Below is a 
 list of the default zone contents.
@ -964,6 +980,15 @@ local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
    PTR localhost."
 .fi
 .TP 10
+\h'5'\fIonion (RFC 7686)\fR 
+Default content:
+.nf
+local\-zone: "onion." static
+local\-data: "onion. 10800 IN NS localhost."
+local\-data: "onion. 10800 IN 
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+.fi
+.TP 10
 \h'5'\fIreverse RFC1918 local use zones\fR 
 Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to 
 31.172.in\-addr.arpa, 168.192.in\-addr.arpa.
--- a/354
+++ b/354
@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile

-scriptversion=2011-11-20.07; # UTC
+scriptversion=2013-12-25.23; # UTC

 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@ -41,19 +41,15 @@ scriptversion=2011-11-20.07; # UTC
 # This script is compatible with the BSD install script, but was written
 # from scratch.

+tab='	'
 nl='
 '
-IFS=" ""	$nl"
+IFS=" $tab$nl"

-# set DOITPROG to echo to test this script
+# Set DOITPROG to "echo" to test this script.

-# Don't use :- since 4.3BSD and earlier shells don't like it.
 doit=${DOITPROG-}
-if test -z "$doit"; then
-  doit_exec=exec
-else
-  doit_exec=$doit
-fi
+doit_exec=${doit:-exec}

 # Put in absolute file names if you don't have them in your path;
 # or use environment vars.
@ -68,17 +64,6 @@ mvprog=${MVPROG-mv}
 rmprog=${RMPROG-rm}
 stripprog=${STRIPPROG-strip}

-posix_glob='?'
-initialize_posix_glob='
-  test "$posix_glob" != "?" || {
-    if (set -f) 2>/dev/null; then
-      posix_glob=
-    else
-      posix_glob=:
-    fi
-  }
-'
-
 posix_mkdir=

 # Desired mode of installed file.
@ -97,7 +82,7 @@ dir_arg=
 dst_arg=

 copy_on_change=false
-no_target_directory=
+is_target_a_directory=possibly

 usage="\
 Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
@ -137,46 +122,57 @@ while test $# -ne 0; do
    -d) dir_arg=true;;

    -g) chgrpcmd="$chgrpprog $2"
-	shift;;
+        shift;;

    --help) echo "$usage"; exit $?;;

    -m) mode=$2
-	case $mode in
-	  *' '* | *'	'* | *'
-'*	  | *'*'* | *'?'* | *'['*)
-	    echo "$0: invalid mode: $mode" >&2
-	    exit 1;;
-	esac
-	shift;;
+        case $mode in
+          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*)
+            echo "$0: invalid mode: $mode" >&2
+            exit 1;;
+        esac
+        shift;;

    -o) chowncmd="$chownprog $2"
-	shift;;
+        shift;;

    -s) stripcmd=$stripprog;;

-    -t) dst_arg=$2
-	# Protect names problematic for 'test' and other utilities.
-	case $dst_arg in
-	  -* | [=\(\)!]) dst_arg=./$dst_arg;;
-	esac
-	shift;;
+    -t)
+        is_target_a_directory=always
+        dst_arg=$2
+        # Protect names problematic for 'test' and other utilities.
+        case $dst_arg in
+          -* | [=\(\)!]) dst_arg=./$dst_arg;;
+        esac
+        shift;;

-    -T) no_target_directory=true;;
+    -T) is_target_a_directory=never;;

    --version) echo "$0 $scriptversion"; exit $?;;

-    --)	shift
-	break;;
+    --) shift
+        break;;

-    -*)	echo "$0: invalid option: $1" >&2
-	exit 1;;
+    -*) echo "$0: invalid option: $1" >&2
+        exit 1;;

    *)  break;;
  esac
  shift
 done

+# We allow the use of options -d and -T together, by making -d
+# take the precedence; this is for compatibility with GNU install.
+
+if test -n "$dir_arg"; then
+  if test -n "$dst_arg"; then
+    echo "$0: target directory not allowed when installing a directory." >&2
+    exit 1
+  fi
+fi
+
 if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
  # When -d is used, all remaining arguments are directories to create.
  # When -t is used, the destination is already specified.
@ -207,6 +203,15 @@ if test $# -eq 0; then
  exit 0
 fi

+if test -z "$dir_arg"; then
+  if test $# -gt 1 || test "$is_target_a_directory" = always; then
+    if test ! -d "$dst_arg"; then
+      echo "$0: $dst_arg: Is not a directory." >&2
+      exit 1
+    fi
+  fi
+fi
+
 if test -z "$dir_arg"; then
  do_exit='(exit $ret); exit $ret'
  trap "ret=129; $do_exit" 1
@ -223,16 +228,16 @@ if test -z "$dir_arg"; then

    *[0-7])
      if test -z "$stripcmd"; then
-	u_plus_rw=
+        u_plus_rw=
      else
-	u_plus_rw='% 200'
+        u_plus_rw='% 200'
      fi
      cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
    *)
      if test -z "$stripcmd"; then
-	u_plus_rw=
+        u_plus_rw=
      else
-	u_plus_rw=,u+rw
+        u_plus_rw=,u+rw
      fi
      cp_umask=$mode$u_plus_rw;;
  esac
@ -269,41 +274,15 @@ do
    # If destination is a directory, append the input filename; won't work
    # if double slashes aren't ignored.
    if test -d "$dst"; then
-      if test -n "$no_target_directory"; then
-	echo "$0: $dst_arg: Is a directory" >&2
-	exit 1
+      if test "$is_target_a_directory" = never; then
+        echo "$0: $dst_arg: Is a directory" >&2
+        exit 1
      fi
      dstdir=$dst
      dst=$dstdir/`basename "$src"`
      dstdir_status=0
    else
-      # Prefer dirname, but fall back on a substitute if dirname fails.
-      dstdir=`
-	(dirname "$dst") 2>/dev/null ||
-	expr X"$dst" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
-	     X"$dst" : 'X\(//\)[^/]' \| \
-	     X"$dst" : 'X\(//\)$' \| \
-	     X"$dst" : 'X\(/\)' \| . 2>/dev/null ||
-	echo X"$dst" |
-	    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)[^/].*/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\).*/{
-		   s//\1/
-		   q
-		 }
-		 s/.*/./; q'
-      `
-
+      dstdir=`dirname "$dst"`
      test -d "$dstdir"
      dstdir_status=$?
    fi
@ -314,74 +293,74 @@ do
  if test $dstdir_status != 0; then
    case $posix_mkdir in
      '')
-	# Create intermediate dirs using mode 755 as modified by the umask.
-	# This is like FreeBSD 'install' as of 1997-10-28.
-	umask=`umask`
-	case $stripcmd.$umask in
-	  # Optimize common cases.
-	  *[2367][2367]) mkdir_umask=$umask;;
-	  .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
+        # Create intermediate dirs using mode 755 as modified by the umask.
+        # This is like FreeBSD 'install' as of 1997-10-28.
+        umask=`umask`
+        case $stripcmd.$umask in
+          # Optimize common cases.
+          *[2367][2367]) mkdir_umask=$umask;;
+          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;

-	  *[0-7])
-	    mkdir_umask=`expr $umask + 22 \
-	      - $umask % 100 % 40 + $umask % 20 \
-	      - $umask % 10 % 4 + $umask % 2
-	    `;;
-	  *) mkdir_umask=$umask,go-w;;
-	esac
+          *[0-7])
+            mkdir_umask=`expr $umask + 22 \
+              - $umask % 100 % 40 + $umask % 20 \
+              - $umask % 10 % 4 + $umask % 2
+            `;;
+          *) mkdir_umask=$umask,go-w;;
+        esac

-	# With -d, create the new directory with the user-specified mode.
-	# Otherwise, rely on $mkdir_umask.
-	if test -n "$dir_arg"; then
-	  mkdir_mode=-m$mode
-	else
-	  mkdir_mode=
-	fi
+        # With -d, create the new directory with the user-specified mode.
+        # Otherwise, rely on $mkdir_umask.
+        if test -n "$dir_arg"; then
+          mkdir_mode=-m$mode
+        else
+          mkdir_mode=
+        fi

-	posix_mkdir=false
-	case $umask in
-	  *[123567][0-7][0-7])
-	    # POSIX mkdir -p sets u+wx bits regardless of umask, which
-	    # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-	    ;;
-	  *)
-	    tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-	    trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
+        posix_mkdir=false
+        case $umask in
+          *[123567][0-7][0-7])
+            # POSIX mkdir -p sets u+wx bits regardless of umask, which
+            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
+            ;;
+          *)
+            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0

-	    if (umask $mkdir_umask &&
-		exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
-	    then
-	      if test -z "$dir_arg" || {
-		   # Check for POSIX incompatibilities with -m.
-		   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-		   # other-writable bit of parent directory when it shouldn't.
-		   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-		   ls_ld_tmpdir=`ls -ld "$tmpdir"`
-		   case $ls_ld_tmpdir in
-		     d????-?r-*) different_mode=700;;
-		     d????-?--*) different_mode=755;;
-		     *) false;;
-		   esac &&
-		   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
-		     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
-		     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-		   }
-		 }
-	      then posix_mkdir=:
-	      fi
-	      rmdir "$tmpdir/d" "$tmpdir"
-	    else
-	      # Remove any dirs left behind by ancient mkdir implementations.
-	      rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
-	    fi
-	    trap '' 0;;
-	esac;;
+            if (umask $mkdir_umask &&
+                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+            then
+              if test -z "$dir_arg" || {
+                   # Check for POSIX incompatibilities with -m.
+                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
+                   # other-writable bit of parent directory when it shouldn't.
+                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
+                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
+                   case $ls_ld_tmpdir in
+                     d????-?r-*) different_mode=700;;
+                     d????-?--*) different_mode=755;;
+                     *) false;;
+                   esac &&
+                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
+                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
+                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
+                   }
+                 }
+              then posix_mkdir=:
+              fi
+              rmdir "$tmpdir/d" "$tmpdir"
+            else
+              # Remove any dirs left behind by ancient mkdir implementations.
+              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+            fi
+            trap '' 0;;
+        esac;;
    esac

    if
      $posix_mkdir && (
-	umask $mkdir_umask &&
-	$doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
+        umask $mkdir_umask &&
+        $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
      )
    then :
    else
@ -391,53 +370,51 @@ do
      # directory the slow way, step by step, checking for races as we go.

      case $dstdir in
-	/*) prefix='/';;
-	[-=\(\)!]*) prefix='./';;
-	*)  prefix='';;
+        /*) prefix='/';;
+        [-=\(\)!]*) prefix='./';;
+        *)  prefix='';;
      esac

-      eval "$initialize_posix_glob"
-
      oIFS=$IFS
      IFS=/
-      $posix_glob set -f
+      set -f
      set fnord $dstdir
      shift
-      $posix_glob set +f
+      set +f
      IFS=$oIFS

      prefixes=

      for d
      do
-	test X"$d" = X && continue
+        test X"$d" = X && continue

-	prefix=$prefix$d
-	if test -d "$prefix"; then
-	  prefixes=
-	else
-	  if $posix_mkdir; then
-	    (umask=$mkdir_umask &&
-	     $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
-	    # Don't fail if two instances are running concurrently.
-	    test -d "$prefix" || exit 1
-	  else
-	    case $prefix in
-	      *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
-	      *) qprefix=$prefix;;
-	    esac
-	    prefixes="$prefixes '$qprefix'"
-	  fi
-	fi
-	prefix=$prefix/
+        prefix=$prefix$d
+        if test -d "$prefix"; then
+          prefixes=
+        else
+          if $posix_mkdir; then
+            (umask=$mkdir_umask &&
+             $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
+            # Don't fail if two instances are running concurrently.
+            test -d "$prefix" || exit 1
+          else
+            case $prefix in
+              *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
+              *) qprefix=$prefix;;
+            esac
+            prefixes="$prefixes '$qprefix'"
+          fi
+        fi
+        prefix=$prefix/
      done

      if test -n "$prefixes"; then
-	# Don't fail if two instances are running concurrently.
-	(umask $mkdir_umask &&
-	 eval "\$doit_exec \$mkdirprog $prefixes") ||
-	  test -d "$dstdir" || exit 1
-	obsolete_mkdir_used=true
+        # Don't fail if two instances are running concurrently.
+        (umask $mkdir_umask &&
+         eval "\$doit_exec \$mkdirprog $prefixes") ||
+          test -d "$dstdir" || exit 1
+        obsolete_mkdir_used=true
      fi
    fi
  fi
@ -472,15 +449,12 @@ do

    # If -C, don't bother to copy if it wouldn't change the file.
    if $copy_on_change &&
-       old=`LC_ALL=C ls -dlL "$dst"	2>/dev/null` &&
-       new=`LC_ALL=C ls -dlL "$dsttmp"	2>/dev/null` &&
-
-       eval "$initialize_posix_glob" &&
-       $posix_glob set -f &&
+       old=`LC_ALL=C ls -dlL "$dst"     2>/dev/null` &&
+       new=`LC_ALL=C ls -dlL "$dsttmp"  2>/dev/null` &&
+       set -f &&
       set X $old && old=:$2:$4:$5:$6 &&
       set X $new && new=:$2:$4:$5:$6 &&
-       $posix_glob set +f &&
-
+       set +f &&
       test "$old" = "$new" &&
       $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
    then
@ -493,24 +467,24 @@ do
      # to itself, or perhaps because mv is so ancient that it does not
      # support -f.
      {
-	# Now remove or move aside any old file at destination location.
-	# We try this two ways since rm can't unlink itself on some
-	# systems and the destination file might be busy for other
-	# reasons.  In this case, the final cleanup might fail but the new
-	# file should still install successfully.
-	{
-	  test ! -f "$dst" ||
-	  $doit $rmcmd -f "$dst" 2>/dev/null ||
-	  { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-	    { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
-	  } ||
-	  { echo "$0: cannot unlink or rename $dst" >&2
-	    (exit 1); exit 1
-	  }
-	} &&
+        # Now remove or move aside any old file at destination location.
+        # We try this two ways since rm can't unlink itself on some
+        # systems and the destination file might be busy for other
+        # reasons.  In this case, the final cleanup might fail but the new
+        # file should still install successfully.
+        {
+          test ! -f "$dst" ||
+          $doit $rmcmd -f "$dst" 2>/dev/null ||
+          { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
+            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
+          } ||
+          { echo "$0: cannot unlink or rename $dst" >&2
+            (exit 1); exit 1
+          }
+        } &&

-	# Now rename the file to the real destination.
-	$doit $mvcmd "$dsttmp" "$dst"
+        # Now rename the file to the real destination.
+        $doit $mvcmd "$dsttmp" "$dst"
      }
    fi || exit 1

--- a/libunbound/libunbound.c
+++ b/libunbound/libunbound.c
@ -924,6 +924,88 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 	return UB_NOERROR;
 }

+int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr,
+	int isprime)
+{
+	char* a;
+	struct config_stub **prev, *elem;
+
+	/* check syntax for zone name */
+	if(zone) {
+		uint8_t* nm;
+		int nmlabs;
+		size_t nmlen;
+		if(!parse_dname(zone, &nm, &nmlen, &nmlabs)) {
+			errno=EINVAL;
+			return UB_SYNTAX;
+		}
+		free(nm);
+	} else {
+		zone = ".";
+	}
+
+	/* check syntax for addr (if not NULL) */
+	if(addr) {
+		struct sockaddr_storage storage;
+		socklen_t stlen;
+		if(!extstrtoaddr(addr, &storage, &stlen)) {
+			errno=EINVAL;
+			return UB_SYNTAX;
+		}
+	}
+
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno=EINVAL;
+		return UB_AFTERFINAL;
+	}
+
+	/* arguments all right, now find or add the stub */
+	prev = &ctx->env->cfg->stubs;
+	elem = cfg_stub_find(&prev, zone);
+	if(!elem && !addr) {
+		/* not found and we want to delete, nothing to do */
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOERROR;
+	} else if(elem && !addr) {
+		/* found, and we want to delete */
+		*prev = elem->next;
+		config_delstub(elem);
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOERROR;
+	} else if(!elem) {
+		/* not found, create the stub entry */
+		elem=(struct config_stub*)calloc(1, sizeof(struct config_stub));
+		if(elem) elem->name = strdup(zone);
+		if(!elem || !elem->name) {
+			free(elem);
+			lock_basic_unlock(&ctx->cfglock);
+			errno = ENOMEM;
+			return UB_NOMEM;
+		}
+		elem->next = ctx->env->cfg->stubs;
+		ctx->env->cfg->stubs = elem;
+	}
+
+	/* add the address to the list and set settings */
+	elem->isprime = isprime;
+	a = strdup(addr);
+	if(!a) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno = ENOMEM;
+		return UB_NOMEM;
+	}
+	if(!cfg_strlist_insert(&elem->addrs, a)) {
+		lock_basic_unlock(&ctx->cfglock);
+		free(a);
+		errno = ENOMEM;
+		return UB_NOMEM;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
 int 
 ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
 {
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@ -232,6 +232,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct event_base* eb)
 		cfg->do_tcp?cfg->outgoing_num_tcp:0,
 		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
 		ports, numports, cfg->unwanted_threshold,
+		cfg->outgoing_tcp_mss,
 		&libworker_alloc_cleanup, w, cfg->do_udp, w->sslctx,
 		cfg->delay_close, NULL);
 	if(!w->is_bg || w->is_bg_thread) {
--- a/libunbound/ubsyms.def
+++ b/libunbound/ubsyms.def
@ -1,33 +1,34 @@
-ub_ctx_create
-ub_ctx_create_event
-ub_ctx_delete
-ub_ctx_get_option
-ub_ctx_set_option
-ub_ctx_config
-ub_ctx_set_fwd
-ub_ctx_resolvconf
-ub_ctx_hosts
+ub_cancel
 ub_ctx_add_ta
 ub_ctx_add_ta_autr
 ub_ctx_add_ta_file
-ub_ctx_trustedkeys
-ub_ctx_debugout
-ub_ctx_debuglevel
 ub_ctx_async
-ub_poll
-ub_wait
+ub_ctx_config
+ub_ctx_create
+ub_ctx_create_event
+ub_ctx_data_add
+ub_ctx_data_remove
+ub_ctx_debuglevel
+ub_ctx_debugout
+ub_ctx_delete
+ub_ctx_get_option
+ub_ctx_hosts
+ub_ctx_print_local_zones
+ub_ctx_resolvconf
+ub_ctx_set_event
+ub_ctx_set_fwd
+ub_ctx_set_option
+ub_ctx_set_stub
+ub_ctx_trustedkeys
+ub_ctx_zone_add
+ub_ctx_zone_remove
 ub_fd
+ub_poll
 ub_process
 ub_resolve
 ub_resolve_async
 ub_resolve_event
-ub_cancel
 ub_resolve_free
 ub_strerror
-ub_ctx_print_local_zones
-ub_ctx_zone_add
-ub_ctx_zone_remove
-ub_ctx_data_add
-ub_ctx_data_remove
 ub_version
-ub_ctx_set_event
+ub_wait
--- a/libunbound/unbound.h
+++ b/libunbound/unbound.h
@ -303,6 +303,27 @@ int ub_ctx_config(struct ub_ctx* ctx, const char* fname);
 */
 int ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr);

+/**
+ * Add a stub zone, with given address to send to.  This is for custom
+ * root hints or pointing to a local authoritative dns server.
+ * For dns resolvers and the 'DHCP DNS' ip address, use ub_ctx_set_fwd.
+ * This is similar to a stub-zone entry in unbound.conf.
+ *
+ * @param ctx: context.
+ *	It is only possible to set configuration before the
+ *	first resolve is done.
+ * @param zone: name of the zone, string.
+ * @param addr: address, IP4 or IP6 in string format.
+ * 	The addr is added to the list of stub-addresses if the entry exists.
+ * 	If the addr is NULL the stub entry is removed.
+ * @param isprime: set to true to set stub-prime to yes for the stub.
+ * 	For local authoritative servers, people usually set it to false,
+ * 	For root hints it should be set to true.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr,
+	int isprime);
+
 /**
 * Read list of nameservers to use from the filename given.
 * Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
--- a/ltmain.sh
+++ b/ltmain.sh
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@ -99,7 +99,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 	int rcv, int snd, int listen, int* reuseport, int transparent)
 {
 	int s;
-#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_USE_MIN_MTU)  || defined(IP_TRANSPARENT)
+#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_USE_MIN_MTU)  || defined(IP_TRANSPARENT) || defined(IP_BINDANY)
 	int on=1;
 #endif
 #ifdef IPV6_MTU
@ -114,7 +114,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #ifndef IPV6_V6ONLY
 	(void)v6only;
 #endif
-#ifndef IP_TRANSPARENT
+#if !defined(IP_TRANSPARENT) && !defined(IP_BINDANY)
 	(void)transparent;
 #endif
 	if((s = socket(family, socktype, 0)) == -1) {
@ -187,7 +187,14 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s",
 			strerror(errno));
 		}
-#endif /* IP_TRANSPARENT */
+#elif defined(IP_BINDANY)
+		if (transparent &&
+		    setsockopt(s, (family==AF_INET6? IPPROTO_IPV6:IPPROTO_IP),
+		    IP_BINDANY, (void*)&on, (socklen_t)sizeof(on)) < 0) {
+			log_warn("setsockopt(.. IP_BINDANY ..) failed: %s",
+			strerror(errno));
+		}
+#endif /* IP_TRANSPARENT || IP_BINDANY */
 	}
 	if(rcv) {
 #ifdef SO_RCVBUF
@ -483,7 +490,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,

 int
 create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
-	int* reuseport, int transparent)
+	int* reuseport, int transparent, int mss)
 {
 	int s;
 #if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_V6ONLY) || defined(IP_TRANSPARENT)
@ -512,6 +519,25 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 #endif
 		return -1;
 	}
+	if (mss > 0) {
+#if defined(IPPROTO_TCP) && defined(TCP_MAXSEG)
+		if(setsockopt(s, IPPROTO_TCP, TCP_MAXSEG, (void*)&mss,
+			(socklen_t)sizeof(mss)) < 0) {
+			#ifndef USE_WINSOCK
+			log_err(" setsockopt(.. TCP_MAXSEG ..) failed: %s",
+				strerror(errno));
+			#else
+			log_err(" setsockopt(.. TCP_MAXSEG ..) failed: %s",
+				wsa_strerror(WSAGetLastError()));
+			#endif
+		} else {
+			verbose(VERB_ALGO,
+				" tcp socket mss set to %d", mss);
+		}
+#else
+		log_warn(" setsockopt(TCP_MAXSEG) unsupported");
+#endif /* defined(IPPROTO_TCP) && defined(TCP_MAXSEG) */
+	}
 #ifdef SO_REUSEADDR
 	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 
 		(socklen_t)sizeof(on)) < 0) {
@ -678,7 +704,7 @@ create_local_accept_sock(const char *path, int* noproto)
 static int
 make_sock(int stype, const char* ifname, const char* port, 
 	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
-	int* reuseport, int transparent)
+	int* reuseport, int transparent, int tcp_mss)
 {
 	struct addrinfo *res = NULL;
 	int r, s, inuse, noproto;
@ -714,7 +740,7 @@ make_sock(int stype, const char* ifname, const char* port,
 		}
 	} else	{
 		s = create_tcp_accept_sock(res, v6only, &noproto, reuseport,
-			transparent);
+			transparent, tcp_mss);
 		if(s == -1 && noproto && hints->ai_family == AF_INET6){
 			*noip6 = 1;
 		}
@ -727,7 +753,7 @@ make_sock(int stype, const char* ifname, const char* port,
 static int
 make_sock_port(int stype, const char* ifname, const char* port, 
 	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
-	int* reuseport, int transparent)
+	int* reuseport, int transparent, int tcp_mss)
 {
 	char* s = strchr(ifname, '@');
 	if(s) {
@ -749,10 +775,10 @@ make_sock_port(int stype, const char* ifname, const char* port,
 		(void)strlcpy(p, s+1, sizeof(p));
 		p[strlen(s+1)]=0;
 		return make_sock(stype, newif, p, hints, v6only, noip6,
-			rcv, snd, reuseport, transparent);
+			rcv, snd, reuseport, transparent, tcp_mss);
 	}
 	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv, snd,
-		reuseport, transparent);
+		reuseport, transparent, tcp_mss);
 }

 /**
@ -847,19 +873,22 @@ set_recvpktinfo(int s, int family)
 * @param reuseport: try to set SO_REUSEPORT if nonNULL and true.
 * 	set to false on exit if reuseport failed due to no kernel support.
 * @param transparent: set IP_TRANSPARENT socket option.
+ * @param tcp_mss: maximum segment size of tcp socket. default if zero.
 * @return: returns false on error.
 */
 static int
 ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, 
 	struct addrinfo *hints, const char* port, struct listen_port** list,
-	size_t rcv, size_t snd, int ssl_port, int* reuseport, int transparent)
+	size_t rcv, size_t snd, int ssl_port, int* reuseport, int transparent,
+	int tcp_mss)
 {
 	int s, noip6=0;
 	if(!do_udp && !do_tcp)
 		return 0;
 	if(do_auto) {
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv, snd, reuseport, transparent)) == -1) {
+			&noip6, rcv, snd, reuseport, transparent,
+			tcp_mss)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@ -886,7 +915,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	} else if(do_udp) {
 		/* regular udp socket */
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv, snd, reuseport, transparent)) == -1) {
+			&noip6, rcv, snd, reuseport, transparent,
+			tcp_mss)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@ -907,7 +937,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 			atoi(strchr(ifname, '@')+1) == ssl_port) ||
 			(!strchr(ifname, '@') && atoi(port) == ssl_port));
 		if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, 
-			&noip6, 0, 0, reuseport, transparent)) == -1) {
+			&noip6, 0, 0, reuseport, transparent, tcp_mss)) == -1) {
 			if(noip6) {
 				/*log_warn("IPv6 protocol not available");*/
 				return 1;
@ -1064,7 +1094,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 				&hints, portbuf, &list,
 				cfg->so_rcvbuf, cfg->so_sndbuf,
 				cfg->ssl_port, reuseport,
-				cfg->ip_transparent)) {
+				cfg->ip_transparent,
+				cfg->tcp_mss)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@ -1076,7 +1107,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 				&hints, portbuf, &list,
 				cfg->so_rcvbuf, cfg->so_sndbuf,
 				cfg->ssl_port, reuseport,
-				cfg->ip_transparent)) {
+				cfg->ip_transparent,
+				cfg->tcp_mss)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@ -1090,7 +1122,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 				do_tcp, &hints, portbuf, &list, 
 				cfg->so_rcvbuf, cfg->so_sndbuf,
 				cfg->ssl_port, reuseport,
-				cfg->ip_transparent)) {
+				cfg->ip_transparent,
+				cfg->tcp_mss)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@ -1102,7 +1135,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 				do_tcp, &hints, portbuf, &list, 
 				cfg->so_rcvbuf, cfg->so_sndbuf,
 				cfg->ssl_port, reuseport,
-				cfg->ip_transparent)) {
+				cfg->ip_transparent,
+				cfg->tcp_mss)) {
 				listening_ports_free(list);
 				return NULL;
 			}
--- a/services/listen_dnsport.h
+++ b/services/listen_dnsport.h
@ -204,10 +204,11 @@ int create_udp_sock(int family, int socktype, struct sockaddr* addr,
 * @param reuseport: if nonNULL and true, try to set SO_REUSEPORT on
 * 	listening UDP port.  Set to false on return if it failed to do so.
 * @param transparent: set IP_TRANSPARENT socket option.
+ * @param mss: maximum segment size of the socket. if zero, leaves the default. 
 * @return: the socket. -1 on error.
 */
 int create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
-	int* reuseport, int transparent);
+	int* reuseport, int transparent, int mss);

 /**
 * Create and bind local listening socket
--- a/services/localzone.c
+++ b/services/localzone.c
@ -595,9 +595,9 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg)
 	struct local_zone* z;
 	const char** zstr;

-	/* this list of zones is from RFC 6303 */
+	/* this list of zones is from RFC 6303 and RFC 7686 */

-	/* block localhost level zones, first, later the LAN zones */
+	/* block localhost level zones first, then onion and later the LAN zones */

 	/* localhost. zone */
 	if(!lz_exists(zones, "localhost.") &&
@ -655,6 +655,22 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg)
 		}
 		lock_rw_unlock(&z->lock);
 	}
+	/* onion. zone (RFC 7686) */
+	if(!lz_exists(zones, "onion.") &&
+		!lz_nodefault(cfg, "onion.")) {
+		if(!(z=lz_enter_zone(zones, "onion.", "static", 
+			LDNS_RR_CLASS_IN)) ||
+		   !lz_enter_rr_into_zone(z,
+			"onion. 10800 IN NS localhost.") ||
+		   !lz_enter_rr_into_zone(z,
+			"onion. 10800 IN SOA localhost. nobody.invalid. "
+			"1 3600 1200 604800 10800")) {
+			log_err("out of memory adding default zone");
+			if(z) { lock_rw_unlock(&z->lock); }
+			return 0;
+		}
+		lock_rw_unlock(&z->lock);
+	}

 	/* block AS112 zones, unless asked not to */
 	if(!cfg->unblock_lan_zones) {
--- a/services/outside_network.c
+++ b/services/outside_network.c
@ -222,6 +222,21 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
 #endif
 		return 0;
 	}
+
+	if (w->outnet->tcp_mss > 0) {
+#if defined(IPPROTO_TCP) && defined(TCP_MAXSEG)
+		if(setsockopt(s, IPPROTO_TCP, TCP_MAXSEG,
+			(void*)&w->outnet->tcp_mss,
+			(socklen_t)sizeof(w->outnet->tcp_mss)) < 0) {
+			verbose(VERB_ALGO, "outgoing tcp:"
+				" setsockopt(.. SO_REUSEADDR ..) failed");
+		}
+#else
+		verbose(VERB_ALGO, "outgoing tcp:"
+			" setsockopt(TCP_MAXSEG) unsupported");
+#endif /* defined(IPPROTO_TCP) && defined(TCP_MAXSEG) */
+	}
+
 	if(!pick_outgoing_tcp(w, s))
 		return 0;

@ -590,7 +605,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	size_t num_ports, char** ifs, int num_ifs, int do_ip4, 
 	int do_ip6, size_t num_tcp, struct infra_cache* infra,
 	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
-	int numavailports, size_t unwanted_threshold,
+	int numavailports, size_t unwanted_threshold, int tcp_mss,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, struct dt_env* dtenv)
 {
@ -620,6 +635,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	outnet->unwanted_param = unwanted_param;
 	outnet->use_caps_for_id = use_caps_for_id;
 	outnet->do_udp = do_udp;
+	outnet->tcp_mss = tcp_mss;
 #ifndef S_SPLINT_S
 	if(delayclose) {
 		outnet->delayclose = 1;
--- a/services/outside_network.h
+++ b/services/outside_network.h
@ -132,6 +132,8 @@ struct outside_network {
 	/** dnstap environment */
 	struct dt_env* dtenv;
 #endif
+	/** maximum segment size of tcp socket */
+	int tcp_mss;

 	/**
 	 * Array of tcp pending used for outgoing TCP connections.
@ -392,6 +394,7 @@ struct serviced_query {
 * @param unwanted_threshold: when to take defensive action.
 * @param unwanted_action: the action to take.
 * @param unwanted_param: user parameter to action.
+ * @param tcp_mss: maximum segment size of tcp socket.
 * @param do_udp: if udp is done.
 * @param sslctx: context to create outgoing connections with (if enabled).
 * @param delayclose: if not 0, udp sockets are delayed before timeout closure.
@ -403,7 +406,7 @@ struct outside_network* outside_network_create(struct comm_base* base,
 	size_t bufsize, size_t num_ports, char** ifs, int num_ifs,
 	int do_ip4, int do_ip6, size_t num_tcp, struct infra_cache* infra, 
 	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
-	int numavailports, size_t unwanted_threshold,
+	int numavailports, size_t unwanted_threshold, int tcp_mss,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, struct dt_env *dtenv);

--- a/sldns/rrdef.c
+++ b/sldns/rrdef.c
@ -144,6 +144,12 @@ static const sldns_rdf_type type_dhcid_wireformat[] = {
 static const sldns_rdf_type type_talink_wireformat[] = {
 	LDNS_RDF_TYPE_DNAME, LDNS_RDF_TYPE_DNAME
 };
+static const sldns_rdf_type type_openpgpkey_wireformat[] = {
+	LDNS_RDF_TYPE_B64
+};
+static const sldns_rdf_type type_csync_wireformat[] = {
+	LDNS_RDF_TYPE_INT32, LDNS_RDF_TYPE_INT16, LDNS_RDF_TYPE_NSEC
+};
 /* nsec3 is some vars, followed by same type of data of nsec */
 static const sldns_rdf_type type_nsec3_wireformat[] = {
 /*	LDNS_RDF_TYPE_NSEC3_VARS, LDNS_RDF_TYPE_NSEC3_NEXT_OWNER, LDNS_RDF_TYPE_NSEC*/
@ -361,8 +367,10 @@ static sldns_rr_descriptor rdata_field_descriptors[] = {
 	{LDNS_RR_TYPE_CDS, "CDS", 4, 4, type_ds_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 	/* 60 */
 	{LDNS_RR_TYPE_CDNSKEY, "CDNSKEY", 4, 4, type_dnskey_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-{LDNS_RR_TYPE_NULL, "TYPE61", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-{LDNS_RR_TYPE_NULL, "TYPE62", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+	/* 61 */
+{LDNS_RR_TYPE_OPENPGPKEY, "OPENPGPKEY", 1, 1, type_openpgpkey_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+	/* 62 */
+	{LDNS_RR_TYPE_CSYNC, "CSYNC", 3, 3, type_csync_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE63", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE64", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE65", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
--- a/sldns/rrdef.h
+++ b/sldns/rrdef.h
@ -182,6 +182,8 @@ enum sldns_enum_rr_type
 	LDNS_RR_TYPE_NSEC3PARAM = 51, /* RFC 5155 */
 	LDNS_RR_TYPE_NSEC3PARAMS = 51,
 	LDNS_RR_TYPE_TLSA = 52, /* RFC 6698 */
+	LDNS_RR_TYPE_SMIMEA = 53, /* draft-ietf-dane-smime, TLSA-like but may
+				     be extended */

 	LDNS_RR_TYPE_HIP = 55, /* RFC 5205 */

@ -193,6 +195,8 @@ enum sldns_enum_rr_type
        LDNS_RR_TYPE_TALINK = 58,
 	LDNS_RR_TYPE_CDS = 59, /** RFC 7344 */
 	LDNS_RR_TYPE_CDNSKEY = 60, /** RFC 7344 */
+	LDNS_RR_TYPE_OPENPGPKEY = 61, /* draft-ietf-dane-openpgpkey */
+	LDNS_RR_TYPE_CSYNC = 62, /* RFC 7477 */

 	LDNS_RR_TYPE_SPF = 99, /* RFC 4408 */

--- a/sldns/str2wire.c
+++ b/sldns/str2wire.c
@ -204,7 +204,7 @@ rrinternal_get_owner(sldns_buffer* strbuf, uint8_t* rr, size_t* len,
 			return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL,
 				sldns_buffer_position(strbuf));
 		memmove(rr, tocopy, *dname_len);
-	} else if(strlen(token) == 0) {
+	} else if(*token == '\0') {
 		/* no ownername was given, try prev, if that fails
 		 * origin, else default to root */
 		uint8_t* tocopy;
@ -1091,7 +1091,7 @@ int sldns_str2wire_apl_buf(const char* str, uint8_t* rd, size_t* len)
 	uint8_t prefix;
 	size_t i;

-	if(strlen(my_str) == 0) {
+	if(*my_str == '\0') {
 		/* empty APL element, no data, no string */
 		*len = 0;
 		return LDNS_WIREPARSE_ERR_OK;
--- a/smallapp/unbound-control-setup.sh.in
+++ b/smallapp/unbound-control-setup.sh.in
@ -107,14 +107,14 @@ else
 fi

 # create self-signed cert for server
-echo "[req]\n" > request.cfg
-echo "default_bits=$BITS\n" >> request.cfg
-echo "default_md=$HASH\n" >> request.cfg
-echo "prompt=no\n" >> request.cfg
-echo "distinguished_name=req_distinguished_name\n" >> request.cfg
-echo "\n" >> request.cfg
-echo "[req_distinguished_name]\n" >> request.cfg
-echo "commonName=$SERVERNAME\n" >> request.cfg
+echo "[req]" > request.cfg
+echo "default_bits=$BITS" >> request.cfg
+echo "default_md=$HASH" >> request.cfg
+echo "prompt=no" >> request.cfg
+echo "distinguished_name=req_distinguished_name" >> request.cfg
+echo "" >> request.cfg
+echo "[req_distinguished_name]" >> request.cfg
+echo "commonName=$SERVERNAME" >> request.cfg

 test -f request.cfg || error "could not create request.cfg"

@ -124,13 +124,13 @@ openssl req -key $SVR_BASE.key -config request.cfg  -new -x509 -days $DAYS -out
 openssl x509 -in $SVR_BASE.pem -addtrust serverAuth -out $SVR_BASE"_trust.pem"

 # create client request and sign it, piped
-echo "[req]\n" > request.cfg
-echo "default_bits=$BITS\n" >> request.cfg
-echo "default_md=$HASH\n" >> request.cfg
-echo "prompt=no\n" >> request.cfg
-echo "distinguished_name=req_distinguished_name\n" >> request.cfg
-echo "\n" >> request.cfg
-echo "[req_distinguished_name]\n" >> request.cfg
+echo "[req]" > request.cfg
+echo "default_bits=$BITS" >> request.cfg
+echo "default_md=$HASH" >> request.cfg
+echo "prompt=no" >> request.cfg
+echo "distinguished_name=req_distinguished_name" >> request.cfg
+echo "" >> request.cfg
+echo "[req_distinguished_name]" >> request.cfg
 echo "commonName=$CLIENTNAME" >> request.cfg

 test -f request.cfg || error "could not create request.cfg"
--- a/testcode/asynclook.c
+++ b/testcode/asynclook.c
@ -335,12 +335,17 @@ ext_thread(void* arg)
 		r = ub_wait(inf->ctx);
 		checkerr("ub_ctx_wait", r);
 	}
+	/* if these locks are destroyed, or if the async_ids is freed, then
+	   a use-after-free happens in another thread.
+	   The allocation is only part of this test, though. */
+	/*
 	if(async_ids) {
 		for(i=0; i<inf->numq; i++) {
 			lock_basic_destroy(&async_ids[i].lock);
 		}
 	}
 	free(async_ids);
+	*/
 	
 	return NULL;
 }
--- a/testcode/delayer.c
+++ b/testcode/delayer.c
@ -1042,7 +1042,7 @@ service(const char* bind_str, int bindport, const char* serv_str,
 	}
 	i=0;
 	if(bindport == 0) {
-		bindport = 1024 + random()%64000;
+		bindport = 1024 + arc4random()%64000;
 		i = 100;
 	}
 	while(1) {
@ -1058,7 +1058,7 @@ service(const char* bind_str, int bindport, const char* serv_str,
 #endif
 			if(i--==0)
 				fatal_exit("cannot bind any port");
-			bindport = 1024 + random()%64000;
+			bindport = 1024 + arc4random()%64000;
 		} else break;
 	}
 	fd_set_nonblock(s);
@ -1138,7 +1138,6 @@ int main(int argc, char** argv)
 	verbosity = 0;
 	log_init(0, 0, 0);
 	log_ident_set("delayer");
-	srandom(time(NULL) ^ getpid());
 	if(argc == 1) usage(argv);
 	while( (c=getopt(argc, argv, "b:d:f:hm:p:")) != -1) {
 		switch(c) {
--- a/testcode/fake_event.c
+++ b/testcode/fake_event.c
@ -900,6 +900,7 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	struct ub_randstate* ATTR_UNUSED(rnd), 
 	int ATTR_UNUSED(use_caps_for_id), int* ATTR_UNUSED(availports),
 	int ATTR_UNUSED(numavailports), size_t ATTR_UNUSED(unwanted_threshold),
+	int ATTR_UNUSED(outgoing_tcp_mss),
 	void (*unwanted_action)(void*), void* ATTR_UNUSED(unwanted_param),
 	int ATTR_UNUSED(do_udp), void* ATTR_UNUSED(sslctx),
 	int ATTR_UNUSED(delayclose), struct dt_env* ATTR_UNUSED(dtenv))
--- a/testcode/replay.c
+++ b/testcode/replay.c
@ -499,8 +499,7 @@ replay_scenario_delete(struct replay_scenario* scen)
 	struct replay_range* rng, *rngn;
 	if(!scen)
 		return;
-	if(scen->title)
-		free(scen->title);
+	free(scen->title);
 	mom = scen->mom_first;
 	while(mom) {
 		momn = mom->mom_next;
--- a/testcode/streamtcp.c
+++ b/testcode/streamtcp.c
@ -265,7 +265,7 @@ static int get_random(void)
 	if (RAND_bytes((unsigned char*)&r, (int)sizeof(r)) == 1) {
 		return r;
 	}
-	return (int)random();
+	return arc4random();
 }

 /** send the TCP queries and print answers */
--- a/testcode/testbound.c
+++ b/testcode/testbound.c
@ -142,7 +142,7 @@ spool_auto_file(FILE* in, int* lineno, FILE* cfg, char* id)
 	/* find filename for new file */
 	while(isspace((unsigned char)*id))
 		id++;
-	if(strlen(id)==0) 
+	if(*id == '\0') 
 		fatal_exit("AUTROTRUST_FILE must have id, line %d", *lineno);
 	id[strlen(id)-1]=0; /* remove newline */
 	fake_temp_file("_auto_", id, line, sizeof(line));
--- a/testdata/fwd_ancil.tpkg
+++ b/testdata/fwd_ancil.tpkg
--- a/testdata/test_ldnsrr.5
+++ b/testdata/test_ldnsrr.5
@ -143,3 +143,5 @@ noszhpvp.example.com.	3600	IN	LOC	40 32 24.716 N 105 4 25.770 W 1208.00m 1m 1000
 txt5	TXT	Test-String"Test-String"
 txt6       IN      TXT     ("v=DKIM1; k=rsa; g=*; s=email; h=sha1; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC33ewKxBZARSAPbT96IpW/k3DgdNuFEb896eIf80HcVxWw+w2G+1sQcUjxWUSGp6yTTMEls6n7tthixidyRiE/aWOy3ic/K+927PuCy0M1ZX2QY8gVmOHJbYT3qBQ8toQrvGIer8fQqqJIzO/ATVbHxX8B/z0PsmGI2xxqCyXkOw""IDAQAB;")

+example.com. 3600 IN CSYNC 66 3 A NS AAAA
+9fe6cbb9e933ad0b8b4fa94066474e091ee8be696c224b1c1678fcec._openpgpkey 3600 IN OPENPGPKEY \# 2221 ( 99020d044d6cf351011000ae2731a071cae66040331dcfffbc1abaea01fba2b3 341ad29f4191e1e2e47514cc595e5d3b59ebd460db81cb04e98a753dae963543 74b8c3a420364960a6c6875e66cea7216327c16996557c4d13e25e236b3714e9 32795be889e8b33a295faf6d9015474cfe9c2643603f1e91e01334011a841909 8e2fc9807285b2195cdbb1a9ae1916a26b9e33b3f91cde2f728aa133464a1099 fc2beecaf8f67ee03a999aa97be89ce4a252f804ce27a9efb7a631ca956bfa99 c51d6beca52af39a93353aac43097671074a4bb5b039eb86e99209989d5b6a4a e22b32c1605e712072926095b4640db4b4d16b54a8139048e25ef0098781e524 4222df9b6a6bf2335942527356a29e1063c5bc1297c051ab969a3e0c01fb15e2 0ea63a06b416d6c96f9794c5d80e97afb249d2b907dc46605f1001019dd62774 4bc2ad73f239cd623f945bf9922ec6ceb607ce8818455173199de1ef555bf3e8 5e9702dcab7a30e5e6c0f6827ce6d550df2ba4fa6ef2ed47bceb916aded25a72 7039a09942a0684897cdf2efc13f5169693c19da94d861be40e8b07fe853d297 8389eba876332be7db146f1ec6a957bfe39ac90514b1f870a5d899bb4e1d97af 49294ad09dede6d5a04abdc29332bbe74cf70393b626c0f4fdfef6ee2b01d8a6 a40750c446e159b44d0a783611585385ba912b771364b6eda8a69680026a6bf2 105692fd6f9a6cf19e09550011010001b42357696c6c656d20546f6f726f7020 3c77696c6c656d406e6c6e65746c6162732e6e6c3e89023e0413010200280502 4d6cf351021b23050909660180060b090807030206150802090a0b0416020301 021e01021780000a0910e5f8f8212f77a4985d5b0ffe289b97f7d8e4e5abc537 8b7d6db7c395f98c3d787e3fb598638c41e889aea40cbe5b3001d947c7184c92 9efe6ad1e32ae9acb0802823870bb149c3a7bdfbb591601d8c099b3bdd3b3ddc cb03b4d611dc741d9c49c3b5b87654a21dfb618cfe6087f172b3dc663a9f4c0d ad81476ebe5b6fd966164383bc39303a66272a3fe6a0b9a813d4e249c6b9dacf 748a49a979b3fa24036e47099e1d24ed3310cc04341e0bf3afd4e365a04cd075 b7d1dff607a3b8738abf885a7dc959251785ca626b8c9b476f44439653615437 c715b1a586236132e1f89b0e4a9d2d84e403e6733c90a96ec041d14994b19ec0 d23153bb94d9059851901353ddb60b9c42edf715af6ee4ef111e5afd56092a1f 7662a72af80f8768425324a8a7335c805a49b1c4d3dc279b69114a5c592638ff 22a963bd34d2d4bcc319972b99c197fa31c21b89e627f36ce811297ff707f53e 6c258dab407b7d618ec296317a565c2c8b740a39244d8f82095842f6f84448dc e29bb292c7e15072b00c04f2a0f4cd700f2e7348b703f74bcb8d5f4235fbd282 4f515852ea9be06255f88d81a5046d1f730e9bf103b3335f5f03d74ac2ec6581 4dd920e985b57a3b4e0c699f3103ab033ccf36a5b037b3668365484b58a4462d 79414d27170c9db4285bec72d24a9654354b996d13c14b2994f6725e36fb766d 57a79ed721c3ca248221390d7d6fa65f867fa6fa1369b9020d044d6cf3510110 00a4ece215b3f782bae8fb6c1e3fdc06d1e6242271f41b073fc7a85237788814 7b7168134e0b753c608d07308f188b9489af34f1dab1bb52fc3968d0a705c30a 35ea0226e7d2608931138d56ccf124a9236276462863a8f1c83b3a640167211d eaaadfc557ff7701cbb1d413259cf3f5b18ec6e615000bb4ab73c75b980615cf a9a7778de3bab318cc448eca044e3fdc95ac63aa2b28846d77fe190fe8fbc3a0 3ece39d38675040ff1be064410faad9fc5a8c2efe02f34cc39f3087d6b2e9346 42995fd5a9f2d3a59302c0cbe1fea01002c7eb64c8c4e5f853b5b17aebc7c722 97380b8df9ec7f32f1766b3d76e186dc582eedd5da955b7cacdb4cca69e99e9b 25d22b157a68c9f828170917709d335a000590f2be22fd7a5ed0ff2432969642 e84978428c1a3c8380bb339d21ce9cb8ce8f4d6bc102b70a56042159f26c85f7 8599f931a73fe159cf4ae34c828e66fe84f648af745b5d2b1022d514901a8e48 c1cdae82205fe21a58cab77bbc8c1dd32a94aaf4954e7695f05b7c40a395e07f 34ee0add218904fcd380bb737be2ec5b148942840c58abfa212c10ad6debb265 23aa040dad2191397deb472f0dbeeceb6afb386b7166754a47216c3629f63633 a02c5fd1c116e46c8a682a163426e556ea5c0ecdb472429c0d51bea5e583f889 e70f831251e8b31c231d2f946de8c31a6550f884ea961dfdf75a2c3e366ad48c b5001101000189022404180102000f05024d6cf351021b0c050909660180000a 0910e5f8f8212f77a498ed740ff8e1cd5baa631d75dff18a2aa27def9c416118 d178092a1c327c3cc641fd74bc976f3a1b5da52b95cfea68618b31f2aaee6f82 f30ed934eb98de0105878a4814fc811139ed4b3aa356e3c962c422f0be4d3d59 f8e9e64913964287282a6519cd0b1f3f03615aea223b276efcbc5cd4921787c1 7f70b0967aefdcc5462344399b4180efd75c1185a83d6b691e660f8210e76624 f1a87d988baf9367d26b84dcb5df8c7303c2947c4c238734addccb7970f6c192 f3f5dd5f75127e289f26b2fda0562b44a032ed45ae1fc855dca67d54125ccd36 c16f207e4389b0f4e5ff45fe60328a53b322534868ff0d3d8aca0bb0781ee1fe 62f2c0e6fc468f57ccf795ced9f2b27e3cb6d16fc417bd4ca969a364dc649ea5 c57f0325205eaa77fd9df84431c3be5329773828d0e32c0011cbb885e7131b44 b1fc5267b0b3ff125e7255c233239fc6e8c8844d613dab76833e49a7d947fae6 b3ceb35b2ddce2a0f71f384f74fecda521ae07ce3332e5eb2c79d100ad8f9ace 2a0067c1b590f61dd18ab021d66605aa745b5944d830de4c9f61dcc889354b1a 6203d918a5c2317b6d5f188d8d0cf6dab11c9578f6f41d3089871bbb2963b114 59ab0b4c4220ddafb14c20ecbacab1cec60a522ecc883bd1d539ca61cdd4933c 412fafd631d03eff23b23a4164729e32236947f622fe79a17493154e9a30b257 e3fdf97f0b2e1b8c65fc85bd98)
--- a/testdata/test_ldnsrr.c5
+++ b/testdata/test_ldnsrr.c5
@ -174,3 +174,7 @@ noszhpvp.example.com.	3600	IN	LOC	40 32 24.716 N 105 04 25.770 W 1208m 1m 10000m
 txt5.	3600	IN	TXT	"Test-String\"Test-String\""
 0474787436000010000100000E100108FF763D444B494D313B206B3D7273613B20673D2A3B20733D656D61696C3B20683D736861313B20743D733B20703D4D4947664D413047435371475349623344514542415155414134474E4144434269514B42675143333365774B78425A4152534150625439364970572F6B334467644E7546456238393665496638304863567857772B7732472B31735163556A785755534770367954544D456C73366E3774746869786964795269452F61574F793369632F4B2B39323750754379304D315A583251593867566D4F484A6259543371425138746F5172764749657238665171714A497A4F2F4154566248785838422F7A3050736D4749327878714379586B4F77074944415141423B
 txt6.	3600	IN	TXT	"v=DKIM1; k=rsa; g=*; s=email; h=sha1; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC33ewKxBZARSAPbT96IpW/k3DgdNuFEb896eIf80HcVxWw+w2G+1sQcUjxWUSGp6yTTMEls6n7tthixidyRiE/aWOy3ic/K+927PuCy0M1ZX2QY8gVmOHJbYT3qBQ8toQrvGIer8fQqqJIzO/ATVbHxX8B/z0PsmGI2xxqCyXkOw" "IDAQAB;"
+076578616D706C6503636F6D00003E000100000E10000C000000420003000460000008
+example.com.	3600	IN	CSYNC	66 3 A NS AAAA
+3839666536636262396539333361643062386234666139343036363437346530393165653862653639366332323462316331363738666365630B5F6F70656E7067706B657900003D000100000E1008AD99020D044D6CF351011000AE2731A071CAE66040331DCFFFBC1ABAEA01FBA2B3341AD29F4191E1E2E47514CC595E5D3B59EBD460DB81CB04E98A753DAE96354374B8C3A420364960A6C6875E66CEA7216327C16996557C4D13E25E236B3714E932795BE889E8B33A295FAF6D9015474CFE9C2643603F1E91E01334011A8419098E2FC9807285B2195CDBB1A9AE1916A26B9E33B3F91CDE2F728AA133464A1099FC2BEECAF8F67EE03A999AA97BE89CE4A252F804CE27A9EFB7A631CA956BFA99C51D6BECA52AF39A93353AAC43097671074A4BB5B039EB86E99209989D5B6A4AE22B32C1605E712072926095B4640DB4B4D16B54A8139048E25EF0098781E5244222DF9B6A6BF2335942527356A29E1063C5BC1297C051AB969A3E0C01FB15E20EA63A06B416D6C96F9794C5D80E97AFB249D2B907DC46605F1001019DD627744BC2AD73F239CD623F945BF9922EC6CEB607CE8818455173199DE1EF555BF3E85E9702DCAB7A30E5E6C0F6827CE6D550DF2BA4FA6EF2ED47BCEB916ADED25A727039A09942A0684897CDF2EFC13F5169693C19DA94D861BE40E8B07FE853D2978389EBA876332BE7DB146F1EC6A957BFE39AC90514B1F870A5D899BB4E1D97AF49294AD09DEDE6D5A04ABDC29332BBE74CF70393B626C0F4FDFEF6EE2B01D8A6A40750C446E159B44D0A783611585385BA912B771364B6EDA8A69680026A6BF2105692FD6F9A6CF19E09550011010001B42357696C6C656D20546F6F726F70203C77696C6C656D406E6C6E65746C6162732E6E6C3E89023E04130102002805024D6CF351021B23050909660180060B090807030206150802090A0B0416020301021E01021780000A0910E5F8F8212F77A4985D5B0FFE289B97F7D8E4E5ABC5378B7D6DB7C395F98C3D787E3FB598638C41E889AEA40CBE5B3001D947C7184C929EFE6AD1E32AE9ACB0802823870BB149C3A7BDFBB591601D8C099B3BDD3B3DDCCB03B4D611DC741D9C49C3B5B87654A21DFB618CFE6087F172B3DC663A9F4C0DAD81476EBE5B6FD966164383BC39303A66272A3FE6A0B9A813D4E249C6B9DACF748A49A979B3FA24036E47099E1D24ED3310CC04341E0BF3AFD4E365A04CD075B7D1DFF607A3B8738ABF885A7DC959251785CA626B8C9B476F44439653615437C715B1A586236132E1F89B0E4A9D2D84E403E6733C90A96EC041D14994B19EC0D23153BB94D9059851901353DDB60B9C42EDF715AF6EE4EF111E5AFD56092A1F7662A72AF80F8768425324A8A7335C805A49B1C4D3DC279B69114A5C592638FF22A963BD34D2D4BCC319972B99C197FA31C21B89E627F36CE811297FF707F53E6C258DAB407B7D618EC296317A565C2C8B740A39244D8F82095842F6F84448DCE29BB292C7E15072B00C04F2A0F4CD700F2E7348B703F74BCB8D5F4235FBD2824F515852EA9BE06255F88D81A5046D1F730E9BF103B3335F5F03D74AC2EC65814DD920E985B57A3B4E0C699F3103AB033CCF36A5B037B3668365484B58A4462D79414D27170C9DB4285BEC72D24A9654354B996D13C14B2994F6725E36FB766D57A79ED721C3CA248221390D7D6FA65F867FA6FA1369B9020D044D6CF351011000A4ECE215B3F782BAE8FB6C1E3FDC06D1E6242271F41B073FC7A852377888147B7168134E0B753C608D07308F188B9489AF34F1DAB1BB52FC3968D0A705C30A35EA0226E7D2608931138D56CCF124A9236276462863A8F1C83B3A640167211DEAAADFC557FF7701CBB1D413259CF3F5B18EC6E615000BB4AB73C75B980615CFA9A7778DE3BAB318CC448ECA044E3FDC95AC63AA2B28846D77FE190FE8FBC3A03ECE39D38675040FF1BE064410FAAD9FC5A8C2EFE02F34CC39F3087D6B2E934642995FD5A9F2D3A59302C0CBE1FEA01002C7EB64C8C4E5F853B5B17AEBC7C72297380B8DF9EC7F32F1766B3D76E186DC582EEDD5DA955B7CACDB4CCA69E99E9B25D22B157A68C9F828170917709D335A000590F2BE22FD7A5ED0FF2432969642E84978428C1A3C8380BB339D21CE9CB8CE8F4D6BC102B70A56042159F26C85F78599F931A73FE159CF4AE34C828E66FE84F648AF745B5D2B1022D514901A8E48C1CDAE82205FE21A58CAB77BBC8C1DD32A94AAF4954E7695F05B7C40A395E07F34EE0ADD218904FCD380BB737BE2EC5B148942840C58ABFA212C10AD6DEBB26523AA040DAD2191397DEB472F0DBEECEB6AFB386B7166754A47216C3629F63633A02C5FD1C116E46C8A682A163426E556EA5C0ECDB472429C0D51BEA5E583F889E70F831251E8B31C231D2F946DE8C31A6550F884EA961DFDF75A2C3E366AD48CB5001101000189022404180102000F05024D6CF351021B0C050909660180000A0910E5F8F8212F77A498ED740FF8E1CD5BAA631D75DFF18A2AA27DEF9C416118D178092A1C327C3CC641FD74BC976F3A1B5DA52B95CFEA68618B31F2AAEE6F82F30ED934EB98DE0105878A4814FC811139ED4B3AA356E3C962C422F0BE4D3D59F8E9E64913964287282A6519CD0B1F3F03615AEA223B276EFCBC5CD4921787C17F70B0967AEFDCC5462344399B4180EFD75C1185A83D6B691E660F8210E76624F1A87D988BAF9367D26B84DCB5DF8C7303C2947C4C238734ADDCCB7970F6C192F3F5DD5F75127E289F26B2FDA0562B44A032ED45AE1FC855DCA67D54125CCD36C16F207E4389B0F4E5FF45FE60328A53B322534868FF0D3D8ACA0BB0781EE1FE62F2C0E6FC468F57CCF795CED9F2B27E3CB6D16FC417BD4CA969A364DC649EA5C57F0325205EAA77FD9DF84431C3BE5329773828D0E32C0011CBB885E7131B44B1FC5267B0B3FF125E7255C233239FC6E8C8844D613DAB76833E49A7D947FAE6B3CEB35B2DDCE2A0F71F384F74FECDA521AE07CE3332E5EB2C79D100AD8F9ACE2A0067C1B590F61DD18AB021D66605AA745B5944D830DE4C9F61DCC889354B1A6203D918A5C2317B6D5F188D8D0CF6DAB11C9578F6F41D3089871BBB2963B11459AB0B4C4220DDAFB14C20ECBACAB1CEC60A522ECC883BD1D539CA61CDD4933C412FAFD631D03EFF23B23A4164729E32236947F622FE79A17493154E9A30B257E3FDF97F0B2E1B8C65FC85BD98
+9fe6cbb9e933ad0b8b4fa94066474e091ee8be696c224b1c1678fcec._openpgpkey.	3600	IN	OPENPGPKEY	mQINBE1s81EBEACuJzGgccrmYEAzHc//vBq66gH7orM0GtKfQZHh4uR1FMxZXl07WevUYNuBywTpinU9rpY1Q3S4w6QgNklgpsaHXmbOpyFjJ8FpllV8TRPiXiNrNxTpMnlb6InoszopX69tkBVHTP6cJkNgPx6R4BM0ARqEGQmOL8mAcoWyGVzbsamuGRaia54zs/kc3i9yiqEzRkoQmfwr7sr49n7gOpmaqXvonOSiUvgEziep77emMcqVa/qZxR1r7KUq85qTNTqsQwl2cQdKS7WwOeuG6ZIJmJ1bakriKzLBYF5xIHKSYJW0ZA20tNFrVKgTkEjiXvAJh4HlJEIi35tqa/IzWUJSc1ainhBjxbwSl8BRq5aaPgwB+xXiDqY6BrQW1slvl5TF2A6Xr7JJ0rkH3EZgXxABAZ3WJ3RLwq1z8jnNYj+UW/mSLsbOtgfOiBhFUXMZneHvVVvz6F6XAtyrejDl5sD2gnzm1VDfK6T6bvLtR7zrkWre0lpycDmgmUKgaEiXzfLvwT9RaWk8GdqU2GG+QOiwf+hT0peDieuodjMr59sUbx7GqVe/45rJBRSx+HCl2Jm7Th2Xr0kpStCd7ebVoEq9wpMyu+dM9wOTtibA9P3+9u4rAdimpAdQxEbhWbRNCng2EVhThbqRK3cTZLbtqKaWgAJqa/IQVpL9b5ps8Z4JVQARAQABtCNXaWxsZW0gVG9vcm9wIDx3aWxsZW1AbmxuZXRsYWJzLm5sPokCPgQTAQIAKAUCTWzzUQIbIwUJCWYBgAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQ5fj4IS93pJhdWw/+KJuX99jk5avFN4t9bbfDlfmMPXh+P7WYY4xB6ImupAy+WzAB2UfHGEySnv5q0eMq6aywgCgjhwuxScOnvfu1kWAdjAmbO907PdzLA7TWEdx0HZxJw7W4dlSiHfthjP5gh/Fys9xmOp9MDa2BR26+W2/ZZhZDg7w5MDpmJyo/5qC5qBPU4knGudrPdIpJqXmz+iQDbkcJnh0k7TMQzAQ0Hgvzr9TjZaBM0HW30d/2B6O4c4q/iFp9yVklF4XKYmuMm0dvREOWU2FUN8cVsaWGI2Ey4fibDkqdLYTkA+ZzPJCpbsBB0UmUsZ7A0jFTu5TZBZhRkBNT3bYLnELt9xWvbuTvER5a/VYJKh92Yqcq+A+HaEJTJKinM1yAWkmxxNPcJ5tpEUpcWSY4/yKpY7000tS8wxmXK5nBl/oxwhuJ5ifzbOgRKX/3B/U+bCWNq0B7fWGOwpYxelZcLIt0CjkkTY+CCVhC9vhESNzim7KSx+FQcrAMBPKg9M1wDy5zSLcD90vLjV9CNfvSgk9RWFLqm+BiVfiNgaUEbR9zDpvxA7MzX18D10rC7GWBTdkg6YW1ejtODGmfMQOrAzzPNqWwN7Nmg2VIS1ikRi15QU0nFwydtChb7HLSSpZUNUuZbRPBSymU9nJeNvt2bVenntchw8okgiE5DX1vpl+Gf6b6E2m5Ag0ETWzzUQEQAKTs4hWz94K66PtsHj/cBtHmJCJx9BsHP8eoUjd4iBR7cWgTTgt1PGCNBzCPGIuUia808dqxu1L8OWjQpwXDCjXqAibn0mCJMRONVszxJKkjYnZGKGOo8cg7OmQBZyEd6qrfxVf/dwHLsdQTJZzz9bGOxuYVAAu0q3PHW5gGFc+pp3eN47qzGMxEjsoETj/claxjqisohG13/hkP6PvDoD7OOdOGdQQP8b4GRBD6rZ/FqMLv4C80zDnzCH1rLpNGQplf1any06WTAsDL4f6gEALH62TIxOX4U7WxeuvHxyKXOAuN+ex/MvF2az124YbcWC7t1dqVW3ys20zKaememyXSKxV6aMn4KBcJF3CdM1oABZDyviL9el7Q/yQylpZC6El4QowaPIOAuzOdIc6cuM6PTWvBArcKVgQhWfJshfeFmfkxpz/hWc9K40yCjmb+hPZIr3RbXSsQItUUkBqOSMHNroIgX+IaWMq3e7yMHdMqlKr0lU52lfBbfECjleB/NO4K3SGJBPzTgLtze+LsWxSJQoQMWKv6ISwQrW3rsmUjqgQNrSGROX3rRy8Nvuzravs4a3FmdUpHIWw2KfY2M6AsX9HBFuRsimgqFjQm5VbqXA7NtHJCnA1RvqXlg/iJ5w+DElHosxwjHS+UbejDGmVQ+ITqlh3991osPjZq1Iy1ABEBAAGJAiQEGAECAA8FAk1s81ECGwwFCQlmAYAACgkQ5fj4IS93pJjtdA/44c1bqmMddd/xiiqife+cQWEY0XgJKhwyfDzGQf10vJdvOhtdpSuVz+poYYsx8qrub4LzDtk065jeAQWHikgU/IEROe1LOqNW48lixCLwvk09Wfjp5kkTlkKHKCplGc0LHz8DYVrqIjsnbvy8XNSSF4fBf3Cwlnrv3MVGI0Q5m0GA79dcEYWoPWtpHmYPghDnZiTxqH2Yi6+TZ9JrhNy134xzA8KUfEwjhzSt3Mt5cPbBkvP13V91En4onyay/aBWK0SgMu1Frh/IVdymfVQSXM02wW8gfkOJsPTl/0X+YDKKU7MiU0ho/w09isoLsHge4f5i8sDm/EaPV8z3lc7Z8rJ+PLbRb8QXvUypaaNk3GSepcV/AyUgXqp3/Z34RDHDvlMpdzgo0OMsABHLuIXnExtEsfxSZ7Cz/xJeclXCMyOfxujIhE1hPat2gz5Jp9lH+uazzrNbLdzioPcfOE90/s2lIa4HzjMy5essedEArY+azioAZ8G1kPYd0YqwIdZmBap0W1lE2DDeTJ9h3MiJNUsaYgPZGKXCMXttXxiNjQz22rEclXj29B0wiYcbuyljsRRZqwtMQiDdr7FMIOy6yrHOxgpSLsyIO9HVOcphzdSTPEEvr9Yx0D7/I7I6QWRynjIjaUf2Iv55oXSTFU6aMLJX4/35fwsuG4xl/IW9mA==
--- a/util/config_file.c
+++ b/util/config_file.c
@ -98,6 +98,8 @@ config_create(void)
 	cfg->do_udp = 1;
 	cfg->do_tcp = 1;
 	cfg->tcp_upstream = 0;
+	cfg->tcp_mss = 0;
+	cfg->outgoing_tcp_mss = 0;
 	cfg->ssl_service_key = NULL;
 	cfg->ssl_service_pem = NULL;
 	cfg->ssl_port = 853;
@ -369,6 +371,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("do-udp:", do_udp)
 	else S_YNO("do-tcp:", do_tcp)
 	else S_YNO("tcp-upstream:", tcp_upstream)
+	else S_NUMBER_NONZERO("tcp-mss:", tcp_mss)
+	else S_NUMBER_NONZERO("outgoing-tcp-mss:", outgoing_tcp_mss)
 	else S_YNO("ssl-upstream:", ssl_upstream)
 	else S_STR("ssl-service-key:", ssl_service_key)
 	else S_STR("ssl-service-pem:", ssl_service_pem)
@ -677,6 +681,8 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "do-udp", do_udp)
 	else O_YNO(opt, "do-tcp", do_tcp)
 	else O_YNO(opt, "tcp-upstream", tcp_upstream)
+	else O_DEC(opt, "tcp-mss", tcp_mss)
+	else O_DEC(opt, "outgoing-tcp-mss", outgoing_tcp_mss)
 	else O_YNO(opt, "ssl-upstream", ssl_upstream)
 	else O_STR(opt, "ssl-service-key", ssl_service_key)
 	else O_STR(opt, "ssl-service-pem", ssl_service_pem)
@ -867,6 +873,18 @@ config_read(struct config_file* cfg, const char* filename, const char* chroot)
 	return 1;
 }

+struct config_stub* cfg_stub_find(struct config_stub*** pp, const char* nm)
+{
+	struct config_stub* p = *(*pp);
+	while(p) {
+		if(strcmp(p->name, nm) == 0)
+			return p;
+		(*pp) = &p->next;
+		p = p->next;
+	}
+	return NULL;
+}
+
 void
 config_delstrlist(struct config_strlist* p)
 {
@ -892,16 +910,23 @@ config_deldblstrlist(struct config_str2list* p)
 	}
 }

+void
+config_delstub(struct config_stub* p)
+{
+	if(!p) return;
+	free(p->name);
+	config_delstrlist(p->hosts);
+	config_delstrlist(p->addrs);
+	free(p);
+}
+
 void
 config_delstubs(struct config_stub* p)
 {
 	struct config_stub* np;
 	while(p) {
 		np = p->next;
-		free(p->name);
-		config_delstrlist(p->hosts);
-		config_delstrlist(p->addrs);
-		free(p);
+		config_delstub(p);
 		p = np;
 	}
 }
--- a/util/config_file.h
+++ b/util/config_file.h
@ -78,6 +78,10 @@ struct config_file {
 	int do_tcp;
 	/** tcp upstream queries (no UDP upstream queries) */
 	int tcp_upstream;
+	/** maximum segment size of tcp socket which queries are answered */
+	int tcp_mss;
+	/** maximum segment size of tcp socket for outgoing queries */
+	int outgoing_tcp_mss;

 	/** private key file for dnstcp-ssl service (enabled if not NULL) */
 	char* ssl_service_key;
@ -555,6 +559,17 @@ int cfg_strlist_insert(struct config_strlist** head, char* item);
 */
 int cfg_str2list_insert(struct config_str2list** head, char* item, char* i2);

+/**
+ * Find stub in config list, also returns prevptr (for deletion).
+ * @param pp: call routine with pointer to a pointer to the start of the list,
+ * 	if the stub is found, on exit, the value contains a pointer to the
+ * 	next pointer that points to the found element (or to the list start
+ * 	pointer if it is the first element).
+ * @param nm: name of stub to find.
+ * @return: pointer to config_stub if found, or NULL if not found.
+ */
+struct config_stub* cfg_stub_find(struct config_stub*** pp, const char* nm);
+
 /**
 * Delete items in config string list.
 * @param list: list.
@ -567,6 +582,12 @@ void config_delstrlist(struct config_strlist* list);
 */
 void config_deldblstrlist(struct config_str2list* list);

+/**
+ * Delete a stub item
+ * @param p: stub item
+ */
+void config_delstub(struct config_stub* p);
+
 /**
 * Delete items in config stub list.
 * @param list: list.
--- a/util/configlexer.c
+++ b/util/configlexer.c
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@ -63,7 +63,7 @@ static void config_start_include(const char* filename)
 		ub_c_error_msg("too many include files");
 		return;
 	}
-	if(strlen(filename) == 0) {
+	if(*filename == '\0') {
 		ub_c_error_msg("empty include file name");
 		return;
 	}
@ -219,6 +219,8 @@ do-ip6{COLON}			{ YDVAR(1, VAR_DO_IP6) }
 do-udp{COLON}			{ YDVAR(1, VAR_DO_UDP) }
 do-tcp{COLON}			{ YDVAR(1, VAR_DO_TCP) }
 tcp-upstream{COLON}		{ YDVAR(1, VAR_TCP_UPSTREAM) }
+tcp-mss{COLON}			{ YDVAR(1, VAR_TCP_MSS) }
+outgoing-tcp-mss{COLON}		{ YDVAR(1, VAR_OUTGOING_TCP_MSS) }
 ssl-upstream{COLON}		{ YDVAR(1, VAR_SSL_UPSTREAM) }
 ssl-service-key{COLON}		{ YDVAR(1, VAR_SSL_SERVICE_KEY) }
 ssl-service-pem{COLON}		{ YDVAR(1, VAR_SSL_SERVICE_PEM) }
--- a/util/configparser.c
+++ b/util/configparser.c
--- a/util/configparser.h
+++ b/util/configparser.h
@ -1,19 +1,19 @@
-/* A Bison parser, made by GNU Bison 2.7.  */
+/* A Bison parser, made by GNU Bison 3.0.4.  */

 /* Bison interface for Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989-1990, 2000-2012 Free Software Foundation, Inc.
-   
+
+   Copyright (C) 1984, 1989-1990, 2000-2015 Free Software Foundation, Inc.
+
   This program is free software: you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation, either version 3 of the License, or
   (at your option) any later version.
-   
+
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
-   
+
   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */

@ -26,13 +26,13 @@
   special exception, which will cause the skeleton and the resulting
   Bison output files to be licensed under the GNU General Public
   License without this special exception.
-   
+
   This special exception was added by the Free Software Foundation in
   version 2.2 of Bison.  */

 #ifndef YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
 # define YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
-/* Enabling traces.  */
+/* Debug traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
 #endif
@ -40,173 +40,175 @@
 extern int yydebug;
 #endif

-/* Tokens.  */
+/* Token type.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     SPACE = 258,
-     LETTER = 259,
-     NEWLINE = 260,
-     COMMENT = 261,
-     COLON = 262,
-     ANY = 263,
-     ZONESTR = 264,
-     STRING_ARG = 265,
-     VAR_SERVER = 266,
-     VAR_VERBOSITY = 267,
-     VAR_NUM_THREADS = 268,
-     VAR_PORT = 269,
-     VAR_OUTGOING_RANGE = 270,
-     VAR_INTERFACE = 271,
-     VAR_DO_IP4 = 272,
-     VAR_DO_IP6 = 273,
-     VAR_DO_UDP = 274,
-     VAR_DO_TCP = 275,
-     VAR_CHROOT = 276,
-     VAR_USERNAME = 277,
-     VAR_DIRECTORY = 278,
-     VAR_LOGFILE = 279,
-     VAR_PIDFILE = 280,
-     VAR_MSG_CACHE_SIZE = 281,
-     VAR_MSG_CACHE_SLABS = 282,
-     VAR_NUM_QUERIES_PER_THREAD = 283,
-     VAR_RRSET_CACHE_SIZE = 284,
-     VAR_RRSET_CACHE_SLABS = 285,
-     VAR_OUTGOING_NUM_TCP = 286,
-     VAR_INFRA_HOST_TTL = 287,
-     VAR_INFRA_LAME_TTL = 288,
-     VAR_INFRA_CACHE_SLABS = 289,
-     VAR_INFRA_CACHE_NUMHOSTS = 290,
-     VAR_INFRA_CACHE_LAME_SIZE = 291,
-     VAR_NAME = 292,
-     VAR_STUB_ZONE = 293,
-     VAR_STUB_HOST = 294,
-     VAR_STUB_ADDR = 295,
-     VAR_TARGET_FETCH_POLICY = 296,
-     VAR_HARDEN_SHORT_BUFSIZE = 297,
-     VAR_HARDEN_LARGE_QUERIES = 298,
-     VAR_FORWARD_ZONE = 299,
-     VAR_FORWARD_HOST = 300,
-     VAR_FORWARD_ADDR = 301,
-     VAR_DO_NOT_QUERY_ADDRESS = 302,
-     VAR_HIDE_IDENTITY = 303,
-     VAR_HIDE_VERSION = 304,
-     VAR_IDENTITY = 305,
-     VAR_VERSION = 306,
-     VAR_HARDEN_GLUE = 307,
-     VAR_MODULE_CONF = 308,
-     VAR_TRUST_ANCHOR_FILE = 309,
-     VAR_TRUST_ANCHOR = 310,
-     VAR_VAL_OVERRIDE_DATE = 311,
-     VAR_BOGUS_TTL = 312,
-     VAR_VAL_CLEAN_ADDITIONAL = 313,
-     VAR_VAL_PERMISSIVE_MODE = 314,
-     VAR_INCOMING_NUM_TCP = 315,
-     VAR_MSG_BUFFER_SIZE = 316,
-     VAR_KEY_CACHE_SIZE = 317,
-     VAR_KEY_CACHE_SLABS = 318,
-     VAR_TRUSTED_KEYS_FILE = 319,
-     VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 320,
-     VAR_USE_SYSLOG = 321,
-     VAR_OUTGOING_INTERFACE = 322,
-     VAR_ROOT_HINTS = 323,
-     VAR_DO_NOT_QUERY_LOCALHOST = 324,
-     VAR_CACHE_MAX_TTL = 325,
-     VAR_HARDEN_DNSSEC_STRIPPED = 326,
-     VAR_ACCESS_CONTROL = 327,
-     VAR_LOCAL_ZONE = 328,
-     VAR_LOCAL_DATA = 329,
-     VAR_INTERFACE_AUTOMATIC = 330,
-     VAR_STATISTICS_INTERVAL = 331,
-     VAR_DO_DAEMONIZE = 332,
-     VAR_USE_CAPS_FOR_ID = 333,
-     VAR_STATISTICS_CUMULATIVE = 334,
-     VAR_OUTGOING_PORT_PERMIT = 335,
-     VAR_OUTGOING_PORT_AVOID = 336,
-     VAR_DLV_ANCHOR_FILE = 337,
-     VAR_DLV_ANCHOR = 338,
-     VAR_NEG_CACHE_SIZE = 339,
-     VAR_HARDEN_REFERRAL_PATH = 340,
-     VAR_PRIVATE_ADDRESS = 341,
-     VAR_PRIVATE_DOMAIN = 342,
-     VAR_REMOTE_CONTROL = 343,
-     VAR_CONTROL_ENABLE = 344,
-     VAR_CONTROL_INTERFACE = 345,
-     VAR_CONTROL_PORT = 346,
-     VAR_SERVER_KEY_FILE = 347,
-     VAR_SERVER_CERT_FILE = 348,
-     VAR_CONTROL_KEY_FILE = 349,
-     VAR_CONTROL_CERT_FILE = 350,
-     VAR_CONTROL_USE_CERT = 351,
-     VAR_EXTENDED_STATISTICS = 352,
-     VAR_LOCAL_DATA_PTR = 353,
-     VAR_JOSTLE_TIMEOUT = 354,
-     VAR_STUB_PRIME = 355,
-     VAR_UNWANTED_REPLY_THRESHOLD = 356,
-     VAR_LOG_TIME_ASCII = 357,
-     VAR_DOMAIN_INSECURE = 358,
-     VAR_PYTHON = 359,
-     VAR_PYTHON_SCRIPT = 360,
-     VAR_VAL_SIG_SKEW_MIN = 361,
-     VAR_VAL_SIG_SKEW_MAX = 362,
-     VAR_CACHE_MIN_TTL = 363,
-     VAR_VAL_LOG_LEVEL = 364,
-     VAR_AUTO_TRUST_ANCHOR_FILE = 365,
-     VAR_KEEP_MISSING = 366,
-     VAR_ADD_HOLDDOWN = 367,
-     VAR_DEL_HOLDDOWN = 368,
-     VAR_SO_RCVBUF = 369,
-     VAR_EDNS_BUFFER_SIZE = 370,
-     VAR_PREFETCH = 371,
-     VAR_PREFETCH_KEY = 372,
-     VAR_SO_SNDBUF = 373,
-     VAR_SO_REUSEPORT = 374,
-     VAR_HARDEN_BELOW_NXDOMAIN = 375,
-     VAR_IGNORE_CD_FLAG = 376,
-     VAR_LOG_QUERIES = 377,
-     VAR_TCP_UPSTREAM = 378,
-     VAR_SSL_UPSTREAM = 379,
-     VAR_SSL_SERVICE_KEY = 380,
-     VAR_SSL_SERVICE_PEM = 381,
-     VAR_SSL_PORT = 382,
-     VAR_FORWARD_FIRST = 383,
-     VAR_STUB_FIRST = 384,
-     VAR_MINIMAL_RESPONSES = 385,
-     VAR_RRSET_ROUNDROBIN = 386,
-     VAR_MAX_UDP_SIZE = 387,
-     VAR_DELAY_CLOSE = 388,
-     VAR_UNBLOCK_LAN_ZONES = 389,
-     VAR_INFRA_CACHE_MIN_RTT = 390,
-     VAR_DNS64_PREFIX = 391,
-     VAR_DNS64_SYNTHALL = 392,
-     VAR_DNSTAP = 393,
-     VAR_DNSTAP_ENABLE = 394,
-     VAR_DNSTAP_SOCKET_PATH = 395,
-     VAR_DNSTAP_SEND_IDENTITY = 396,
-     VAR_DNSTAP_SEND_VERSION = 397,
-     VAR_DNSTAP_IDENTITY = 398,
-     VAR_DNSTAP_VERSION = 399,
-     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 400,
-     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 401,
-     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 402,
-     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 403,
-     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 404,
-     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405,
-     VAR_HARDEN_ALGO_DOWNGRADE = 406,
-     VAR_IP_TRANSPARENT = 407,
-     VAR_RATELIMIT = 408,
-     VAR_RATELIMIT_SLABS = 409,
-     VAR_RATELIMIT_SIZE = 410,
-     VAR_RATELIMIT_FOR_DOMAIN = 411,
-     VAR_RATELIMIT_BELOW_DOMAIN = 412,
-     VAR_RATELIMIT_FACTOR = 413,
-     VAR_CAPS_WHITELIST = 414,
-     VAR_CACHE_MAX_NEGATIVE_TTL = 415,
-     VAR_PERMIT_SMALL_HOLDDOWN = 416,
-     VAR_QNAME_MINIMISATION = 417
-   };
+  enum yytokentype
+  {
+    SPACE = 258,
+    LETTER = 259,
+    NEWLINE = 260,
+    COMMENT = 261,
+    COLON = 262,
+    ANY = 263,
+    ZONESTR = 264,
+    STRING_ARG = 265,
+    VAR_SERVER = 266,
+    VAR_VERBOSITY = 267,
+    VAR_NUM_THREADS = 268,
+    VAR_PORT = 269,
+    VAR_OUTGOING_RANGE = 270,
+    VAR_INTERFACE = 271,
+    VAR_DO_IP4 = 272,
+    VAR_DO_IP6 = 273,
+    VAR_DO_UDP = 274,
+    VAR_DO_TCP = 275,
+    VAR_TCP_MSS = 276,
+    VAR_OUTGOING_TCP_MSS = 277,
+    VAR_CHROOT = 278,
+    VAR_USERNAME = 279,
+    VAR_DIRECTORY = 280,
+    VAR_LOGFILE = 281,
+    VAR_PIDFILE = 282,
+    VAR_MSG_CACHE_SIZE = 283,
+    VAR_MSG_CACHE_SLABS = 284,
+    VAR_NUM_QUERIES_PER_THREAD = 285,
+    VAR_RRSET_CACHE_SIZE = 286,
+    VAR_RRSET_CACHE_SLABS = 287,
+    VAR_OUTGOING_NUM_TCP = 288,
+    VAR_INFRA_HOST_TTL = 289,
+    VAR_INFRA_LAME_TTL = 290,
+    VAR_INFRA_CACHE_SLABS = 291,
+    VAR_INFRA_CACHE_NUMHOSTS = 292,
+    VAR_INFRA_CACHE_LAME_SIZE = 293,
+    VAR_NAME = 294,
+    VAR_STUB_ZONE = 295,
+    VAR_STUB_HOST = 296,
+    VAR_STUB_ADDR = 297,
+    VAR_TARGET_FETCH_POLICY = 298,
+    VAR_HARDEN_SHORT_BUFSIZE = 299,
+    VAR_HARDEN_LARGE_QUERIES = 300,
+    VAR_FORWARD_ZONE = 301,
+    VAR_FORWARD_HOST = 302,
+    VAR_FORWARD_ADDR = 303,
+    VAR_DO_NOT_QUERY_ADDRESS = 304,
+    VAR_HIDE_IDENTITY = 305,
+    VAR_HIDE_VERSION = 306,
+    VAR_IDENTITY = 307,
+    VAR_VERSION = 308,
+    VAR_HARDEN_GLUE = 309,
+    VAR_MODULE_CONF = 310,
+    VAR_TRUST_ANCHOR_FILE = 311,
+    VAR_TRUST_ANCHOR = 312,
+    VAR_VAL_OVERRIDE_DATE = 313,
+    VAR_BOGUS_TTL = 314,
+    VAR_VAL_CLEAN_ADDITIONAL = 315,
+    VAR_VAL_PERMISSIVE_MODE = 316,
+    VAR_INCOMING_NUM_TCP = 317,
+    VAR_MSG_BUFFER_SIZE = 318,
+    VAR_KEY_CACHE_SIZE = 319,
+    VAR_KEY_CACHE_SLABS = 320,
+    VAR_TRUSTED_KEYS_FILE = 321,
+    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 322,
+    VAR_USE_SYSLOG = 323,
+    VAR_OUTGOING_INTERFACE = 324,
+    VAR_ROOT_HINTS = 325,
+    VAR_DO_NOT_QUERY_LOCALHOST = 326,
+    VAR_CACHE_MAX_TTL = 327,
+    VAR_HARDEN_DNSSEC_STRIPPED = 328,
+    VAR_ACCESS_CONTROL = 329,
+    VAR_LOCAL_ZONE = 330,
+    VAR_LOCAL_DATA = 331,
+    VAR_INTERFACE_AUTOMATIC = 332,
+    VAR_STATISTICS_INTERVAL = 333,
+    VAR_DO_DAEMONIZE = 334,
+    VAR_USE_CAPS_FOR_ID = 335,
+    VAR_STATISTICS_CUMULATIVE = 336,
+    VAR_OUTGOING_PORT_PERMIT = 337,
+    VAR_OUTGOING_PORT_AVOID = 338,
+    VAR_DLV_ANCHOR_FILE = 339,
+    VAR_DLV_ANCHOR = 340,
+    VAR_NEG_CACHE_SIZE = 341,
+    VAR_HARDEN_REFERRAL_PATH = 342,
+    VAR_PRIVATE_ADDRESS = 343,
+    VAR_PRIVATE_DOMAIN = 344,
+    VAR_REMOTE_CONTROL = 345,
+    VAR_CONTROL_ENABLE = 346,
+    VAR_CONTROL_INTERFACE = 347,
+    VAR_CONTROL_PORT = 348,
+    VAR_SERVER_KEY_FILE = 349,
+    VAR_SERVER_CERT_FILE = 350,
+    VAR_CONTROL_KEY_FILE = 351,
+    VAR_CONTROL_CERT_FILE = 352,
+    VAR_CONTROL_USE_CERT = 353,
+    VAR_EXTENDED_STATISTICS = 354,
+    VAR_LOCAL_DATA_PTR = 355,
+    VAR_JOSTLE_TIMEOUT = 356,
+    VAR_STUB_PRIME = 357,
+    VAR_UNWANTED_REPLY_THRESHOLD = 358,
+    VAR_LOG_TIME_ASCII = 359,
+    VAR_DOMAIN_INSECURE = 360,
+    VAR_PYTHON = 361,
+    VAR_PYTHON_SCRIPT = 362,
+    VAR_VAL_SIG_SKEW_MIN = 363,
+    VAR_VAL_SIG_SKEW_MAX = 364,
+    VAR_CACHE_MIN_TTL = 365,
+    VAR_VAL_LOG_LEVEL = 366,
+    VAR_AUTO_TRUST_ANCHOR_FILE = 367,
+    VAR_KEEP_MISSING = 368,
+    VAR_ADD_HOLDDOWN = 369,
+    VAR_DEL_HOLDDOWN = 370,
+    VAR_SO_RCVBUF = 371,
+    VAR_EDNS_BUFFER_SIZE = 372,
+    VAR_PREFETCH = 373,
+    VAR_PREFETCH_KEY = 374,
+    VAR_SO_SNDBUF = 375,
+    VAR_SO_REUSEPORT = 376,
+    VAR_HARDEN_BELOW_NXDOMAIN = 377,
+    VAR_IGNORE_CD_FLAG = 378,
+    VAR_LOG_QUERIES = 379,
+    VAR_TCP_UPSTREAM = 380,
+    VAR_SSL_UPSTREAM = 381,
+    VAR_SSL_SERVICE_KEY = 382,
+    VAR_SSL_SERVICE_PEM = 383,
+    VAR_SSL_PORT = 384,
+    VAR_FORWARD_FIRST = 385,
+    VAR_STUB_FIRST = 386,
+    VAR_MINIMAL_RESPONSES = 387,
+    VAR_RRSET_ROUNDROBIN = 388,
+    VAR_MAX_UDP_SIZE = 389,
+    VAR_DELAY_CLOSE = 390,
+    VAR_UNBLOCK_LAN_ZONES = 391,
+    VAR_INSECURE_LAN_ZONES = 392,
+    VAR_INFRA_CACHE_MIN_RTT = 393,
+    VAR_DNS64_PREFIX = 394,
+    VAR_DNS64_SYNTHALL = 395,
+    VAR_DNSTAP = 396,
+    VAR_DNSTAP_ENABLE = 397,
+    VAR_DNSTAP_SOCKET_PATH = 398,
+    VAR_DNSTAP_SEND_IDENTITY = 399,
+    VAR_DNSTAP_SEND_VERSION = 400,
+    VAR_DNSTAP_IDENTITY = 401,
+    VAR_DNSTAP_VERSION = 402,
+    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 403,
+    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 404,
+    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 405,
+    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 406,
+    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 407,
+    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 408,
+    VAR_HARDEN_ALGO_DOWNGRADE = 409,
+    VAR_IP_TRANSPARENT = 410,
+    VAR_RATELIMIT = 411,
+    VAR_RATELIMIT_SLABS = 412,
+    VAR_RATELIMIT_SIZE = 413,
+    VAR_RATELIMIT_FOR_DOMAIN = 414,
+    VAR_RATELIMIT_BELOW_DOMAIN = 415,
+    VAR_RATELIMIT_FACTOR = 416,
+    VAR_CAPS_WHITELIST = 417,
+    VAR_CACHE_MAX_NEGATIVE_TTL = 418,
+    VAR_PERMIT_SMALL_HOLDDOWN = 419,
+    VAR_QNAME_MINIMISATION = 420
+  };
 #endif
 /* Tokens.  */
 #define SPACE 258
@ -227,182 +229,172 @@ extern int yydebug;
 #define VAR_DO_IP6 273
 #define VAR_DO_UDP 274
 #define VAR_DO_TCP 275
-#define VAR_CHROOT 276
-#define VAR_USERNAME 277
-#define VAR_DIRECTORY 278
-#define VAR_LOGFILE 279
-#define VAR_PIDFILE 280
-#define VAR_MSG_CACHE_SIZE 281
-#define VAR_MSG_CACHE_SLABS 282
-#define VAR_NUM_QUERIES_PER_THREAD 283
-#define VAR_RRSET_CACHE_SIZE 284
-#define VAR_RRSET_CACHE_SLABS 285
-#define VAR_OUTGOING_NUM_TCP 286
-#define VAR_INFRA_HOST_TTL 287
-#define VAR_INFRA_LAME_TTL 288
-#define VAR_INFRA_CACHE_SLABS 289
-#define VAR_INFRA_CACHE_NUMHOSTS 290
-#define VAR_INFRA_CACHE_LAME_SIZE 291
-#define VAR_NAME 292
-#define VAR_STUB_ZONE 293
-#define VAR_STUB_HOST 294
-#define VAR_STUB_ADDR 295
-#define VAR_TARGET_FETCH_POLICY 296
-#define VAR_HARDEN_SHORT_BUFSIZE 297
-#define VAR_HARDEN_LARGE_QUERIES 298
-#define VAR_FORWARD_ZONE 299
-#define VAR_FORWARD_HOST 300
-#define VAR_FORWARD_ADDR 301
-#define VAR_DO_NOT_QUERY_ADDRESS 302
-#define VAR_HIDE_IDENTITY 303
-#define VAR_HIDE_VERSION 304
-#define VAR_IDENTITY 305
-#define VAR_VERSION 306
-#define VAR_HARDEN_GLUE 307
-#define VAR_MODULE_CONF 308
-#define VAR_TRUST_ANCHOR_FILE 309
-#define VAR_TRUST_ANCHOR 310
-#define VAR_VAL_OVERRIDE_DATE 311
-#define VAR_BOGUS_TTL 312
-#define VAR_VAL_CLEAN_ADDITIONAL 313
-#define VAR_VAL_PERMISSIVE_MODE 314
-#define VAR_INCOMING_NUM_TCP 315
-#define VAR_MSG_BUFFER_SIZE 316
-#define VAR_KEY_CACHE_SIZE 317
-#define VAR_KEY_CACHE_SLABS 318
-#define VAR_TRUSTED_KEYS_FILE 319
-#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 320
-#define VAR_USE_SYSLOG 321
-#define VAR_OUTGOING_INTERFACE 322
-#define VAR_ROOT_HINTS 323
-#define VAR_DO_NOT_QUERY_LOCALHOST 324
-#define VAR_CACHE_MAX_TTL 325
-#define VAR_HARDEN_DNSSEC_STRIPPED 326
-#define VAR_ACCESS_CONTROL 327
-#define VAR_LOCAL_ZONE 328
-#define VAR_LOCAL_DATA 329
-#define VAR_INTERFACE_AUTOMATIC 330
-#define VAR_STATISTICS_INTERVAL 331
-#define VAR_DO_DAEMONIZE 332
-#define VAR_USE_CAPS_FOR_ID 333
-#define VAR_STATISTICS_CUMULATIVE 334
-#define VAR_OUTGOING_PORT_PERMIT 335
-#define VAR_OUTGOING_PORT_AVOID 336
-#define VAR_DLV_ANCHOR_FILE 337
-#define VAR_DLV_ANCHOR 338
-#define VAR_NEG_CACHE_SIZE 339
-#define VAR_HARDEN_REFERRAL_PATH 340
-#define VAR_PRIVATE_ADDRESS 341
-#define VAR_PRIVATE_DOMAIN 342
-#define VAR_REMOTE_CONTROL 343
-#define VAR_CONTROL_ENABLE 344
-#define VAR_CONTROL_INTERFACE 345
-#define VAR_CONTROL_PORT 346
-#define VAR_SERVER_KEY_FILE 347
-#define VAR_SERVER_CERT_FILE 348
-#define VAR_CONTROL_KEY_FILE 349
-#define VAR_CONTROL_CERT_FILE 350
-#define VAR_CONTROL_USE_CERT 351
-#define VAR_EXTENDED_STATISTICS 352
-#define VAR_LOCAL_DATA_PTR 353
-#define VAR_JOSTLE_TIMEOUT 354
-#define VAR_STUB_PRIME 355
-#define VAR_UNWANTED_REPLY_THRESHOLD 356
-#define VAR_LOG_TIME_ASCII 357
-#define VAR_DOMAIN_INSECURE 358
-#define VAR_PYTHON 359
-#define VAR_PYTHON_SCRIPT 360
-#define VAR_VAL_SIG_SKEW_MIN 361
-#define VAR_VAL_SIG_SKEW_MAX 362
-#define VAR_CACHE_MIN_TTL 363
-#define VAR_VAL_LOG_LEVEL 364
-#define VAR_AUTO_TRUST_ANCHOR_FILE 365
-#define VAR_KEEP_MISSING 366
-#define VAR_ADD_HOLDDOWN 367
-#define VAR_DEL_HOLDDOWN 368
-#define VAR_SO_RCVBUF 369
-#define VAR_EDNS_BUFFER_SIZE 370
-#define VAR_PREFETCH 371
-#define VAR_PREFETCH_KEY 372
-#define VAR_SO_SNDBUF 373
-#define VAR_SO_REUSEPORT 374
-#define VAR_HARDEN_BELOW_NXDOMAIN 375
-#define VAR_IGNORE_CD_FLAG 376
-#define VAR_LOG_QUERIES 377
-#define VAR_TCP_UPSTREAM 378
-#define VAR_SSL_UPSTREAM 379
-#define VAR_SSL_SERVICE_KEY 380
-#define VAR_SSL_SERVICE_PEM 381
-#define VAR_SSL_PORT 382
-#define VAR_FORWARD_FIRST 383
-#define VAR_STUB_FIRST 384
-#define VAR_MINIMAL_RESPONSES 385
-#define VAR_RRSET_ROUNDROBIN 386
-#define VAR_MAX_UDP_SIZE 387
-#define VAR_DELAY_CLOSE 388
-#define VAR_UNBLOCK_LAN_ZONES 389
-#define VAR_INFRA_CACHE_MIN_RTT 390
-#define VAR_DNS64_PREFIX 391
-#define VAR_DNS64_SYNTHALL 392
-#define VAR_DNSTAP 393
-#define VAR_DNSTAP_ENABLE 394
-#define VAR_DNSTAP_SOCKET_PATH 395
-#define VAR_DNSTAP_SEND_IDENTITY 396
-#define VAR_DNSTAP_SEND_VERSION 397
-#define VAR_DNSTAP_IDENTITY 398
-#define VAR_DNSTAP_VERSION 399
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 400
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 401
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 402
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 403
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 404
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 405
-#define VAR_HARDEN_ALGO_DOWNGRADE 406
-#define VAR_IP_TRANSPARENT 407
-#define VAR_RATELIMIT 408
-#define VAR_RATELIMIT_SLABS 409
-#define VAR_RATELIMIT_SIZE 410
-#define VAR_RATELIMIT_FOR_DOMAIN 411
-#define VAR_RATELIMIT_BELOW_DOMAIN 412
-#define VAR_RATELIMIT_FACTOR 413
-#define VAR_CAPS_WHITELIST 414
-#define VAR_CACHE_MAX_NEGATIVE_TTL 415
-#define VAR_PERMIT_SMALL_HOLDDOWN 416
-#define VAR_QNAME_MINIMISATION 417
-
-
+#define VAR_TCP_MSS 276
+#define VAR_OUTGOING_TCP_MSS 277
+#define VAR_CHROOT 278
+#define VAR_USERNAME 279
+#define VAR_DIRECTORY 280
+#define VAR_LOGFILE 281
+#define VAR_PIDFILE 282
+#define VAR_MSG_CACHE_SIZE 283
+#define VAR_MSG_CACHE_SLABS 284
+#define VAR_NUM_QUERIES_PER_THREAD 285
+#define VAR_RRSET_CACHE_SIZE 286
+#define VAR_RRSET_CACHE_SLABS 287
+#define VAR_OUTGOING_NUM_TCP 288
+#define VAR_INFRA_HOST_TTL 289
+#define VAR_INFRA_LAME_TTL 290
+#define VAR_INFRA_CACHE_SLABS 291
+#define VAR_INFRA_CACHE_NUMHOSTS 292
+#define VAR_INFRA_CACHE_LAME_SIZE 293
+#define VAR_NAME 294
+#define VAR_STUB_ZONE 295
+#define VAR_STUB_HOST 296
+#define VAR_STUB_ADDR 297
+#define VAR_TARGET_FETCH_POLICY 298
+#define VAR_HARDEN_SHORT_BUFSIZE 299
+#define VAR_HARDEN_LARGE_QUERIES 300
+#define VAR_FORWARD_ZONE 301
+#define VAR_FORWARD_HOST 302
+#define VAR_FORWARD_ADDR 303
+#define VAR_DO_NOT_QUERY_ADDRESS 304
+#define VAR_HIDE_IDENTITY 305
+#define VAR_HIDE_VERSION 306
+#define VAR_IDENTITY 307
+#define VAR_VERSION 308
+#define VAR_HARDEN_GLUE 309
+#define VAR_MODULE_CONF 310
+#define VAR_TRUST_ANCHOR_FILE 311
+#define VAR_TRUST_ANCHOR 312
+#define VAR_VAL_OVERRIDE_DATE 313
+#define VAR_BOGUS_TTL 314
+#define VAR_VAL_CLEAN_ADDITIONAL 315
+#define VAR_VAL_PERMISSIVE_MODE 316
+#define VAR_INCOMING_NUM_TCP 317
+#define VAR_MSG_BUFFER_SIZE 318
+#define VAR_KEY_CACHE_SIZE 319
+#define VAR_KEY_CACHE_SLABS 320
+#define VAR_TRUSTED_KEYS_FILE 321
+#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 322
+#define VAR_USE_SYSLOG 323
+#define VAR_OUTGOING_INTERFACE 324
+#define VAR_ROOT_HINTS 325
+#define VAR_DO_NOT_QUERY_LOCALHOST 326
+#define VAR_CACHE_MAX_TTL 327
+#define VAR_HARDEN_DNSSEC_STRIPPED 328
+#define VAR_ACCESS_CONTROL 329
+#define VAR_LOCAL_ZONE 330
+#define VAR_LOCAL_DATA 331
+#define VAR_INTERFACE_AUTOMATIC 332
+#define VAR_STATISTICS_INTERVAL 333
+#define VAR_DO_DAEMONIZE 334
+#define VAR_USE_CAPS_FOR_ID 335
+#define VAR_STATISTICS_CUMULATIVE 336
+#define VAR_OUTGOING_PORT_PERMIT 337
+#define VAR_OUTGOING_PORT_AVOID 338
+#define VAR_DLV_ANCHOR_FILE 339
+#define VAR_DLV_ANCHOR 340
+#define VAR_NEG_CACHE_SIZE 341
+#define VAR_HARDEN_REFERRAL_PATH 342
+#define VAR_PRIVATE_ADDRESS 343
+#define VAR_PRIVATE_DOMAIN 344
+#define VAR_REMOTE_CONTROL 345
+#define VAR_CONTROL_ENABLE 346
+#define VAR_CONTROL_INTERFACE 347
+#define VAR_CONTROL_PORT 348
+#define VAR_SERVER_KEY_FILE 349
+#define VAR_SERVER_CERT_FILE 350
+#define VAR_CONTROL_KEY_FILE 351
+#define VAR_CONTROL_CERT_FILE 352
+#define VAR_CONTROL_USE_CERT 353
+#define VAR_EXTENDED_STATISTICS 354
+#define VAR_LOCAL_DATA_PTR 355
+#define VAR_JOSTLE_TIMEOUT 356
+#define VAR_STUB_PRIME 357
+#define VAR_UNWANTED_REPLY_THRESHOLD 358
+#define VAR_LOG_TIME_ASCII 359
+#define VAR_DOMAIN_INSECURE 360
+#define VAR_PYTHON 361
+#define VAR_PYTHON_SCRIPT 362
+#define VAR_VAL_SIG_SKEW_MIN 363
+#define VAR_VAL_SIG_SKEW_MAX 364
+#define VAR_CACHE_MIN_TTL 365
+#define VAR_VAL_LOG_LEVEL 366
+#define VAR_AUTO_TRUST_ANCHOR_FILE 367
+#define VAR_KEEP_MISSING 368
+#define VAR_ADD_HOLDDOWN 369
+#define VAR_DEL_HOLDDOWN 370
+#define VAR_SO_RCVBUF 371
+#define VAR_EDNS_BUFFER_SIZE 372
+#define VAR_PREFETCH 373
+#define VAR_PREFETCH_KEY 374
+#define VAR_SO_SNDBUF 375
+#define VAR_SO_REUSEPORT 376
+#define VAR_HARDEN_BELOW_NXDOMAIN 377
+#define VAR_IGNORE_CD_FLAG 378
+#define VAR_LOG_QUERIES 379
+#define VAR_TCP_UPSTREAM 380
+#define VAR_SSL_UPSTREAM 381
+#define VAR_SSL_SERVICE_KEY 382
+#define VAR_SSL_SERVICE_PEM 383
+#define VAR_SSL_PORT 384
+#define VAR_FORWARD_FIRST 385
+#define VAR_STUB_FIRST 386
+#define VAR_MINIMAL_RESPONSES 387
+#define VAR_RRSET_ROUNDROBIN 388
+#define VAR_MAX_UDP_SIZE 389
+#define VAR_DELAY_CLOSE 390
+#define VAR_UNBLOCK_LAN_ZONES 391
+#define VAR_INSECURE_LAN_ZONES 392
+#define VAR_INFRA_CACHE_MIN_RTT 393
+#define VAR_DNS64_PREFIX 394
+#define VAR_DNS64_SYNTHALL 395
+#define VAR_DNSTAP 396
+#define VAR_DNSTAP_ENABLE 397
+#define VAR_DNSTAP_SOCKET_PATH 398
+#define VAR_DNSTAP_SEND_IDENTITY 399
+#define VAR_DNSTAP_SEND_VERSION 400
+#define VAR_DNSTAP_IDENTITY 401
+#define VAR_DNSTAP_VERSION 402
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 403
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 404
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 405
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 406
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 407
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 408
+#define VAR_HARDEN_ALGO_DOWNGRADE 409
+#define VAR_IP_TRANSPARENT 410
+#define VAR_RATELIMIT 411
+#define VAR_RATELIMIT_SLABS 412
+#define VAR_RATELIMIT_SIZE 413
+#define VAR_RATELIMIT_FOR_DOMAIN 414
+#define VAR_RATELIMIT_BELOW_DOMAIN 415
+#define VAR_RATELIMIT_FACTOR 416
+#define VAR_CAPS_WHITELIST 417
+#define VAR_CACHE_MAX_NEGATIVE_TTL 418
+#define VAR_PERMIT_SMALL_HOLDDOWN 419
+#define VAR_QNAME_MINIMISATION 420

+/* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-typedef union YYSTYPE
+
+union YYSTYPE
 {
-/* Line 2058 of yacc.c  */
-#line 64 "util/configparser.y"
+#line 64 "util/configparser.y" /* yacc.c:1909  */

 	char*	str;

+#line 388 "util/configparser.h" /* yacc.c:1909  */
+};

-/* Line 2058 of yacc.c  */
-#line 386 "util/configparser.h"
-} YYSTYPE;
+typedef union YYSTYPE YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
-# define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
 #endif

+
 extern YYSTYPE yylval;

-#ifdef YYPARSE_PARAM
-#if defined __STDC__ || defined __cplusplus
-int yyparse (void *YYPARSE_PARAM);
-#else
-int yyparse ();
-#endif
-#else /* ! YYPARSE_PARAM */
-#if defined __STDC__ || defined __cplusplus
 int yyparse (void);
-#else
-int yyparse ();
-#endif
-#endif /* ! YYPARSE_PARAM */

 #endif /* !YY_YY_UTIL_CONFIGPARSER_H_INCLUDED  */
--- a/util/configparser.y
+++ b/util/configparser.y
@ -70,6 +70,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_SERVER VAR_VERBOSITY VAR_NUM_THREADS VAR_PORT
 %token VAR_OUTGOING_RANGE VAR_INTERFACE
 %token VAR_DO_IP4 VAR_DO_IP6 VAR_DO_UDP VAR_DO_TCP 
+%token VAR_TCP_MSS VAR_OUTGOING_TCP_MSS
 %token VAR_CHROOT VAR_USERNAME VAR_DIRECTORY VAR_LOGFILE VAR_PIDFILE
 %token VAR_MSG_CACHE_SIZE VAR_MSG_CACHE_SLABS VAR_NUM_QUERIES_PER_THREAD
 %token VAR_RRSET_CACHE_SIZE VAR_RRSET_CACHE_SLABS VAR_OUTGOING_NUM_TCP
@ -143,6 +144,7 @@ contents_server: contents_server content_server
 content_server: server_num_threads | server_verbosity | server_port |
 	server_outgoing_range | server_do_ip4 |
 	server_do_ip6 | server_do_udp | server_do_tcp | 
+	server_tcp_mss | server_outgoing_tcp_mss |
 	server_interface | server_chroot | server_username | 
 	server_directory | server_logfile | server_pidfile |
 	server_msg_cache_size | server_msg_cache_slabs |
@ -397,6 +399,24 @@ server_do_tcp: VAR_DO_TCP STRING_ARG
 		free($2);
 	}
 	;
+server_tcp_mss: VAR_TCP_MSS STRING_ARG
+	{
+		OUTYY(("P(server_tcp_mss:%s)\n", $2));
+                if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                        yyerror("number expected");
+                else cfg_parser->cfg->tcp_mss = atoi($2);
+                free($2);
+	}
+	;
+server_outgoing_tcp_mss: VAR_OUTGOING_TCP_MSS STRING_ARG
+	{
+		OUTYY(("P(server_outgoing_tcp_mss:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->outgoing_tcp_mss = atoi($2);
+		free($2);
+	}
+	;
 server_tcp_upstream: VAR_TCP_UPSTREAM STRING_ARG
 	{
 		OUTYY(("P(server_tcp_upstream:%s)\n", $2));
@ -990,7 +1010,7 @@ server_module_conf: VAR_MODULE_CONF STRING_ARG
 server_val_override_date: VAR_VAL_OVERRIDE_DATE STRING_ARG
 	{
 		OUTYY(("P(server_val_override_date:%s)\n", $2));
-		if(strlen($2) == 0 || strcmp($2, "0") == 0) {
+		if(*$2 == '\0' || strcmp($2, "0") == 0) {
 			cfg_parser->cfg->val_date_override = 0;
 		} else if(strlen($2) == 14) {
 			cfg_parser->cfg->val_date_override = 
@ -1008,7 +1028,7 @@ server_val_override_date: VAR_VAL_OVERRIDE_DATE STRING_ARG
 server_val_sig_skew_min: VAR_VAL_SIG_SKEW_MIN STRING_ARG
 	{
 		OUTYY(("P(server_val_sig_skew_min:%s)\n", $2));
-		if(strlen($2) == 0 || strcmp($2, "0") == 0) {
+		if(*$2 == '\0' || strcmp($2, "0") == 0) {
 			cfg_parser->cfg->val_sig_skew_min = 0;
 		} else {
 			cfg_parser->cfg->val_sig_skew_min = atoi($2);
@ -1021,7 +1041,7 @@ server_val_sig_skew_min: VAR_VAL_SIG_SKEW_MIN STRING_ARG
 server_val_sig_skew_max: VAR_VAL_SIG_SKEW_MAX STRING_ARG
 	{
 		OUTYY(("P(server_val_sig_skew_max:%s)\n", $2));
-		if(strlen($2) == 0 || strcmp($2, "0") == 0) {
+		if(*$2 == '\0' || strcmp($2, "0") == 0) {
 			cfg_parser->cfg->val_sig_skew_max = 0;
 		} else {
 			cfg_parser->cfg->val_sig_skew_max = atoi($2);
--- a/util/data/packed_rrset.c
+++ b/util/data/packed_rrset.c
@ -57,11 +57,9 @@ ub_packed_rrset_parsedelete(struct ub_packed_rrset_key* pkey,
 {
 	if(!pkey)
 		return;
-	if(pkey->entry.data)
-		free(pkey->entry.data);
+	free(pkey->entry.data);
 	pkey->entry.data = NULL;
-	if(pkey->rk.dname)
-		free(pkey->rk.dname);
+	free(pkey->rk.dname);
 	pkey->rk.dname = NULL;
 	pkey->id = 0;
 	alloc_special_release(alloc, pkey);
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@ -4777,9 +4777,12 @@
 8207,
 8208,
 8230,
+8231,
+8232,
 8243,
 8276,
 8280,
+8282,
 8292,
 8294,
 8300,
--- a/util/mini_event.c
+++ b/util/mini_event.c
@ -261,12 +261,9 @@ void event_base_free(struct event_base* base)
 {
 	if(!base)
 		return;
-	if(base->times)
-		free(base->times);
-	if(base->fds)
-		free(base->fds);
-	if(base->signals)
-		free(base->signals);
+	free(base->times);
+	free(base->fds);
+	free(base->signals);
 	free(base);
 }

--- a/util/netevent.c
+++ b/util/netevent.c
@ -56,7 +56,9 @@
 /* -------- Start of local definitions -------- */
 /** if CMSG_ALIGN is not defined on this platform, a workaround */
 #ifndef CMSG_ALIGN
-#  ifdef _CMSG_DATA_ALIGN
+#  ifdef __CMSG_ALIGN
+#    define CMSG_ALIGN(n) __CMSG_ALIGN(n)
+#  elif defined(CMSG_DATA_ALIGN)
 #    define CMSG_ALIGN _CMSG_DATA_ALIGN
 #  else
 #    define CMSG_ALIGN(len) (((len)+sizeof(long)-1) & ~(sizeof(long)-1))
@ -356,7 +358,12 @@ udp_send_errno_needs_log(struct sockaddr* addr, socklen_t addrlen)
 #endif
 	/* permission denied is gotten for every send if the
 	 * network is disconnected (on some OS), squelch it */
-	if(errno == EPERM && verbosity < VERB_DETAIL)
+	if( ((errno == EPERM)
+#  ifdef EADDRNOTAVAIL
+		/* 'Cannot assign requested address' also when disconnected */
+		|| (errno == EADDRNOTAVAIL)
+#  endif
+		) && verbosity < VERB_DETAIL)
 		return 0;
 	/* squelch errors where people deploy AAAA ::ffff:bla for
 	 * authority servers, which we try for intranets. */
@ -393,6 +400,31 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
 	sent = sendto(c->fd, (void*)sldns_buffer_begin(packet), 
 		sldns_buffer_remaining(packet), 0,
 		addr, addrlen);
+	if(sent == -1) {
+		/* try again and block, waiting for IO to complete,
+		 * we want to send the answer, and we will wait for
+		 * the ethernet interface buffer to have space. */
+#ifndef USE_WINSOCK
+		if(errno == EAGAIN || 
+#  ifdef EWOULDBLOCK
+			errno == EWOULDBLOCK ||
+#  endif
+			errno == ENOBUFS) {
+#else
+		if(WSAGetLastError() == WSAEINPROGRESS ||
+			WSAGetLastError() == WSAENOBUFS ||
+			WSAGetLastError() == WSAEWOULDBLOCK) {
+#endif
+			int e;
+			fd_set_block(c->fd);
+			sent = sendto(c->fd, (void*)sldns_buffer_begin(packet), 
+				sldns_buffer_remaining(packet), 0,
+				addr, addrlen);
+			e = errno;
+			fd_set_nonblock(c->fd);
+			errno = e;
+		}
+	}
 	if(sent == -1) {
 		if(!udp_send_errno_needs_log(addr, addrlen))
 			return 0;
@ -546,12 +578,41 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 	if(verbosity >= VERB_ALGO)
 		p_ancil("send_udp over interface", r);
 	sent = sendmsg(c->fd, &msg, 0);
+	if(sent == -1) {
+		/* try again and block, waiting for IO to complete,
+		 * we want to send the answer, and we will wait for
+		 * the ethernet interface buffer to have space. */
+#ifndef USE_WINSOCK
+		if(errno == EAGAIN || 
+#  ifdef EWOULDBLOCK
+			errno == EWOULDBLOCK ||
+#  endif
+			errno == ENOBUFS) {
+#else
+		if(WSAGetLastError() == WSAEINPROGRESS ||
+			WSAGetLastError() == WSAENOBUFS ||
+			WSAGetLastError() == WSAEWOULDBLOCK) {
+#endif
+			int e;
+			fd_set_block(c->fd);
+			sent = sendmsg(c->fd, &msg, 0);
+			e = errno;
+			fd_set_nonblock(c->fd);
+			errno = e;
+		}
+	}
 	if(sent == -1) {
 		if(!udp_send_errno_needs_log(addr, addrlen))
 			return 0;
 		verbose(VERB_OPS, "sendmsg failed: %s", strerror(errno));
 		log_addr(VERB_OPS, "remote address is", 
 			(struct sockaddr_storage*)addr, addrlen);
+#ifdef __NetBSD__
+		/* netbsd 7 has IP_PKTINFO for recv but not send */
+		if(errno == EINVAL && r->srctype == 4)
+			log_err("sendmsg: No support for sendmsg(IP_PKTINFO). "
+				"Please disable interface-automatic");
+#endif
 		return 0;
 	} else if((size_t)sent != sldns_buffer_remaining(packet)) {
 		log_err("sent %d in place of %d bytes", 
--- a/util/random.c
+++ b/util/random.c
@ -228,7 +228,6 @@ ub_random_max(struct ub_randstate* state, long int x)
 void 
 ub_randfree(struct ub_randstate* s)
 {
-	if(s)
-		free(s);
+	free(s);
 	/* user app must do RAND_cleanup(); */
 }
--- a/util/tube.c
+++ b/util/tube.c
@ -118,10 +118,8 @@ void tube_remove_bg_listen(struct tube* tube)
 		comm_point_delete(tube->listen_com);
 		tube->listen_com = NULL;
 	}
-	if(tube->cmd_msg) {
-		free(tube->cmd_msg);
-		tube->cmd_msg = NULL;
-	}
+	free(tube->cmd_msg);
+	tube->cmd_msg = NULL;
 }

 void tube_remove_bg_write(struct tube* tube)
--- a/util/winsock_event.c
+++ b/util/winsock_event.c
@ -459,12 +459,9 @@ void event_base_free(struct event_base *base)
 	verbose(VERB_CLIENT, "winsock_event event_base_free");
        if(!base)
                return;
-	if(base->items)
-		free(base->items);
-        if(base->times)
-                free(base->times);
-        if(base->signals)
-                free(base->signals);
+	free(base->items);
+        free(base->times);
+        free(base->signals);
        free(base);
 }

--- a/validator/val_neg.c
+++ b/validator/val_neg.c
@ -823,13 +823,22 @@ void neg_insert_data(struct val_neg_cache* neg,
 			(h != zone->nsec3_hash || it != zone->nsec3_iter ||
 			slen != zone->nsec3_saltlen || 
 			memcmp(zone->nsec3_salt, s, slen) != 0)) {
-			uint8_t* sa = memdup(s, slen);
-			if(sa) {
+
+			if(slen > 0) {
+				uint8_t* sa = memdup(s, slen);
+				if(sa) {
+					free(zone->nsec3_salt);
+					zone->nsec3_salt = sa;
+					zone->nsec3_saltlen = slen;
+					zone->nsec3_iter = it;
+					zone->nsec3_hash = h;
+				}
+			} else {
 				free(zone->nsec3_salt);
-				zone->nsec3_salt = sa;
-				zone->nsec3_saltlen = slen;
-				zone->nsec3_hash = h;
+				zone->nsec3_salt = NULL;
+				zone->nsec3_saltlen = 0;
 				zone->nsec3_iter = it;
+				zone->nsec3_hash = h;
 			}
 		}
 	}
--- a/validator/val_secalgo.c
+++ b/validator/val_secalgo.c
@ -117,6 +117,8 @@ ds_digest_size_supported(int algo)
 #endif
 #ifdef USE_GOST
 		case LDNS_HASH_GOST:
+			/* we support GOST if it can be loaded */
+			(void)sldns_key_EVP_load_gost_id();
 			if(EVP_get_digestbyname("md_gost94"))
 				return 32;
 			else	return 0;
--- a/validator/val_utils.c
+++ b/validator/val_utils.c
@ -54,6 +54,8 @@
 #include "util/net_help.h"
 #include "util/module.h"
 #include "util/regional.h"
+#include "sldns/wire2str.h"
+#include "sldns/parseutil.h"

 enum val_classification 
 val_classify_response(uint16_t query_flags, struct query_info* origqinf,
@ -691,6 +693,31 @@ val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset)
 			ds_key_algo_is_supported(ds_rrset, i))
 			return 1;
 	}
+	if(verbosity < VERB_ALGO)
+		return 0;
+	if(rrset_get_count(ds_rrset) == 0)
+		verbose(VERB_ALGO, "DS is not usable");
+	else {
+		/* report usability for the first DS RR */
+		sldns_lookup_table *lt;
+		char herr[64], aerr[64];
+		lt = sldns_lookup_by_id(sldns_hashes,
+			(int)ds_get_digest_algo(ds_rrset, i));
+		if(lt) snprintf(herr, sizeof(herr), "%s", lt->name);
+		else snprintf(herr, sizeof(herr), "%d",
+			(int)ds_get_digest_algo(ds_rrset, i));
+		lt = sldns_lookup_by_id(sldns_algorithms,
+			(int)ds_get_key_algo(ds_rrset, i));
+		if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name);
+		else snprintf(aerr, sizeof(aerr), "%d",
+			(int)ds_get_key_algo(ds_rrset, i));
+		verbose(VERB_ALGO, "DS unsupported, hash %s %s, "
+			"key algorithm %s %s", herr,
+			(ds_digest_algo_is_supported(ds_rrset, 0)?
+			"(supported)":"(unsupported)"), aerr, 
+			(ds_key_algo_is_supported(ds_rrset, 0)?
+			"(supported)":"(unsupported)"));
+	}
 	return 0;
 }