From a9c863d6cf252d2520e01a9e2ace89256831bf7a Mon Sep 17 00:00:00 2001
From: des <des@FreeBSD.org>
Date: Fri, 2 Jan 2015 17:32:50 +0000
Subject: [PATCH 1/8] fix unwanted merge in previous commit

---
 iterator/iterator.c | 44 --------------------------------------------
 iterator/iterator.h |  6 ------
 2 files changed, 50 deletions(-)

diff --git a/iterator/iterator.c b/iterator/iterator.c
index 06653442fae0..df5f645cc28c 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -120,7 +120,6 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->query_restart_count = 0;
 	iq->referral_count = 0;
 	iq->sent_count = 0;
-	iq->target_count = NULL;
 	iq->wait_priming_stub = 0;
 	iq->refetch_glue = 0;
 	iq->dnssec_expected = 0;
@@ -454,26 +453,6 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 1;
 }
 
-/** create target count structure for this query */
-static void
-target_count_create(struct iter_qstate* iq)
-{
-	if(!iq->target_count) {
-		iq->target_count = (int*)calloc(2, sizeof(int));
-		/* if calloc fails we simply do not track this number */
-		if(iq->target_count)
-			iq->target_count[0] = 1;
-	}
-}
-
-static void
-target_count_increase(struct iter_qstate* iq, int num)
-{
-	target_count_create(iq);
-	if(iq->target_count)
-		iq->target_count[1] += num;
-}
-
 /**
  * Generate a subrequest.
  * Generate a local request event. Local events are tied to this module, and
@@ -545,10 +524,6 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq = (struct iter_qstate*)subq->minfo[id];
 		memset(subiq, 0, sizeof(*subiq));
 		subiq->num_target_queries = 0;
-		target_count_create(iq);
-		subiq->target_count = iq->target_count;
-		if(iq->target_count)
-			iq->target_count[0] ++; /* extra reference */
 		subiq->num_current_queries = 0;
 		subiq->depth = iq->depth+1;
 		outbound_list_init(&subiq->outlist);
@@ -1375,12 +1350,6 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	if(iq->depth == ie->max_dependency_depth)
 		return 0;
-	if(iq->depth > 0 && iq->target_count &&
-		iq->target_count[1] > MAX_TARGET_COUNT) {
-		verbose(VERB_QUERY, "request has exceeded the maximum "
-			"number of glue fetches %d", iq->target_count[1]);
-		return 0;
-	}
 
 	iter_mark_cycle_targets(qstate, iq->dp);
 	missing = (int)delegpt_count_missing_targets(iq->dp);
@@ -1563,7 +1532,6 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += qs;
-		target_count_increase(iq, qs);
 		if(qs != 0) {
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0; /* and wait for them */
@@ -1573,12 +1541,6 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "maxdepth and need more nameservers, fail");
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
-	if(iq->depth > 0 && iq->target_count &&
-		iq->target_count[1] > MAX_TARGET_COUNT) {
-		verbose(VERB_QUERY, "request has exceeded the maximum "
-			"number of glue fetches %d", iq->target_count[1]);
-		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
-	}
 	/* mark cycle targets for parent-side lookups */
 	iter_mark_pside_cycle_targets(qstate, iq->dp);
 	/* see if we can issue queries to get nameserver addresses */
@@ -1608,7 +1570,6 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(query_count != 0) { /* suspend to await results */
 			verbose(VERB_ALGO, "try parent-side glue lookup");
 			iq->num_target_queries += query_count;
-			target_count_increase(iq, query_count);
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0;
 		}
@@ -1764,7 +1725,6 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += extra;
-		target_count_increase(iq, extra);
 		if(iq->num_target_queries > 0) {
 			/* wait to get all targets, we want to try em */
 			verbose(VERB_ALGO, "wait for all targets for fallback");
@@ -1805,7 +1765,6 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* errors ignored, these targets are not strictly necessary for
 		 * this result, we do not have to reply with SERVFAIL */
 		iq->num_target_queries += extra;
-		target_count_increase(iq, extra);
 	}
 
 	/* Add the current set of unused targets to our queue. */
@@ -1851,7 +1810,6 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 					return 1;
 				}
 				iq->num_target_queries += qs;
-				target_count_increase(iq, qs);
 			}
 			/* Since a target query might have been made, we 
 			 * need to check again. */
@@ -2963,8 +2921,6 @@ iter_clear(struct module_qstate* qstate, int id)
 	iq = (struct iter_qstate*)qstate->minfo[id];
 	if(iq) {
 		outbound_list_clear(&iq->outlist);
-		if(iq->target_count && --iq->target_count[0] == 0)
-			free(iq->target_count);
 		iq->num_current_queries = 0;
 	}
 	qstate->minfo[id] = NULL;
diff --git a/iterator/iterator.h b/iterator/iterator.h
index 1364b86d722b..0b91760d4a49 100644
--- a/iterator/iterator.h
+++ b/iterator/iterator.h
@@ -52,8 +52,6 @@ struct iter_donotq;
 struct iter_prep_list;
 struct iter_priv;
 
-/** max number of targets spawned for a query and its subqueries */
-#define MAX_TARGET_COUNT	32
 /** max number of query restarts. Determines max number of CNAME chain. */
 #define MAX_RESTART_COUNT       8
 /** max number of referrals. Makes sure resolver does not run away */
@@ -253,10 +251,6 @@ struct iter_qstate {
 
 	/** number of queries fired off */
 	int sent_count;
-	
-	/** number of target queries spawned in [1], for this query and its
-	 * subqueries, the malloced-array is shared, [0] refcount. */
-	int* target_count;
 
 	/**
 	 * The query must store NS records from referrals as parentside RRs

From 66adf32aa226b0a370ce7df84ac814cbc72ae63b Mon Sep 17 00:00:00 2001
From: des <des@FreeBSD.org>
Date: Fri, 2 Jan 2015 17:35:29 +0000
Subject: [PATCH 2/8] import unbound 1.5.1

---
 Makefile.in                        |    4 +-
 compat/arc4_lock.c                 |    4 +-
 compat/getentropy_linux.c          |   11 +-
 compat/getentropy_win.c            |    4 +-
 config.h.in                        |    3 -
 configure                          | 1429 +---------------------------
 configure.ac                       |   36 +-
 contrib/README                     |    4 +
 contrib/aaaa-filter-iterator.patch |  394 ++++++++
 daemon/cachedump.c                 |    2 +-
 daemon/remote.c                    |   10 +-
 daemon/unbound.c                   |    2 +-
 daemon/worker.c                    |    2 +-
 dns64/dns64.c                      |    8 +-
 doc/Changelog                      |   60 ++
 doc/README                         |    2 +-
 doc/example.conf.in                |    2 +-
 doc/libunbound.3.in                |    4 +-
 doc/unbound-anchor.8.in            |    8 +-
 doc/unbound-checkconf.8.in         |    2 +-
 doc/unbound-control.8.in           |    2 +-
 doc/unbound-host.1.in              |    2 +-
 doc/unbound.8.in                   |    4 +-
 doc/unbound.conf.5.in              |    2 +-
 iterator/iter_utils.c              |    7 +-
 iterator/iter_utils.h              |    3 +-
 iterator/iterator.c                |   71 +-
 iterator/iterator.h                |    6 +
 libunbound/unbound.h               |    2 +-
 pythonmod/pythonmod_utils.c        |    4 +-
 services/cache/dns.c               |   34 +-
 services/cache/dns.h               |    9 +-
 services/mesh.c                    |   43 +-
 services/mesh.h                    |   13 +-
 smallapp/unbound-host.c            |    2 +-
 util/data/msgreply.c               |   13 +-
 util/data/msgreply.h               |    5 +-
 util/fptr_wlist.c                  |    4 +-
 util/fptr_wlist.h                  |    4 +-
 util/iana_ports.inc                |    3 +
 util/module.h                      |   10 +-
 util/net_help.c                    |    2 +-
 validator/validator.c              |   31 +-
 43 files changed, 705 insertions(+), 1562 deletions(-)
 create mode 100644 contrib/aaaa-filter-iterator.patch

diff --git a/Makefile.in b/Makefile.in
index 7300b3e34768..02532a951d2f 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -80,7 +80,7 @@ LINTFLAGS+="-Dsigset_t=long"
 # FreeBSD
 LINTFLAGS+="-D__uint16_t=uint16_t" "-DEVP_PKEY_ASN1_METHOD=int" "-D_RuneLocale=int" "-D__va_list=va_list"
 
-INSTALL=$(srcdir)/install-sh
+INSTALL=$(SHELL) $(srcdir)/install-sh
 
 #pythonmod.c is not here, it is mentioned by itself in its own rules,
 #makedepend fails on missing interface.h otherwise.
@@ -397,7 +397,7 @@ libunbound/python/libunbound_wrap.c:	$(srcdir)/libunbound/python/libunbound.i un
 
 # Pyunbound python unbound wrapper
 _unbound.la:	libunbound_wrap.lo libunbound.la
-	$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -module -version-info @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined -o $@ libunbound_wrap.lo -rpath $(PYTHON_SITE_PKG) L. -L.libs -lunbound $(LIBS)
+	$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -module -avoid-version -no-undefined -shared -o $@ libunbound_wrap.lo -rpath $(PYTHON_SITE_PKG) L. -L.libs -lunbound
 
 util/config_file.c:	util/configparser.h
 util/configlexer.c:  $(srcdir)/util/configlexer.lex util/configparser.h
diff --git a/compat/arc4_lock.c b/compat/arc4_lock.c
index ce8bb4168d64..faa743d15baa 100644
--- a/compat/arc4_lock.c
+++ b/compat/arc4_lock.c
@@ -53,8 +53,10 @@ static int arc4lockinit = 0;
 
 void _ARC4_LOCK(void)
 {
-	if(!arc4lockinit)
+	if(!arc4lockinit) {
+		arc4lockinit = 1;
 		lock_quick_init(&arc4lock);
+	}
 	lock_quick_lock(&arc4lock);
 }
 
diff --git a/compat/getentropy_linux.c b/compat/getentropy_linux.c
index d51d7952d8c3..32d58a7cdbb9 100644
--- a/compat/getentropy_linux.c
+++ b/compat/getentropy_linux.c
@@ -48,6 +48,7 @@
 #include <time.h>
 #include <openssl/sha.h>
 
+#include <linux/types.h>
 #include <linux/random.h>
 #include <linux/sysctl.h>
 #ifdef HAVE_GETAUXVAL
@@ -77,7 +78,7 @@ extern int main(int, char *argv[]);
 #endif
 static int gotdata(char *buf, size_t len);
 static int getentropy_urandom(void *buf, size_t len);
-#ifdef CTL_MAXNAME
+#ifdef SYS__sysctl
 static int getentropy_sysctl(void *buf, size_t len);
 #endif
 static int getentropy_fallback(void *buf, size_t len);
@@ -102,7 +103,7 @@ getentropy(void *buf, size_t len)
 	if (ret != -1)
 		return (ret);
 
-#ifdef CTL_MAXNAME
+#ifdef SYS__sysctl
 	/*
 	 * Try to use sysctl CTL_KERN, KERN_RANDOM, RANDOM_UUID.
 	 * sysctl is a failsafe API, so it guarantees a result.  This
@@ -124,7 +125,7 @@ getentropy(void *buf, size_t len)
 	ret = getentropy_sysctl(buf, len);
 	if (ret != -1)
 		return (ret);
-#endif /* CTL_MAXNAME */
+#endif /* SYS__sysctl */
 
 	/*
 	 * Entropy collection via /dev/urandom and sysctl have failed.
@@ -235,7 +236,7 @@ nodevrandom:
 	return -1;
 }
 
-#ifdef CTL_MAXNAME
+#ifdef SYS__sysctl
 static int
 getentropy_sysctl(void *buf, size_t len)
 {
@@ -265,7 +266,7 @@ sysctlfailed:
 	errno = EIO;
 	return -1;
 }
-#endif /* CTL_MAXNAME */
+#endif /* SYS__sysctl */
 
 static int cl[] = {
 	CLOCK_REALTIME,
diff --git a/compat/getentropy_win.c b/compat/getentropy_win.c
index 9dc55891e393..71fb955e7f90 100644
--- a/compat/getentropy_win.c
+++ b/compat/getentropy_win.c
@@ -41,9 +41,9 @@ getentropy(void *buf, size_t len)
 	}
 
 	if (CryptAcquireContext(&provider, NULL, NULL, PROV_RSA_FULL,
-	    CRYPT_VERIFYCONTEXT) != 0)
+	    CRYPT_VERIFYCONTEXT) == 0)
 		goto fail;
-	if (CryptGenRandom(provider, len, buf) != 0) {
+	if (CryptGenRandom(provider, len, buf) == 0) {
 		CryptReleaseContext(provider, 0);
 		goto fail;
 	}
diff --git a/config.h.in b/config.h.in
index 5f8f8a992de7..2b7770b5c23a 100644
--- a/config.h.in
+++ b/config.h.in
@@ -1,8 +1,5 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
-/* define if a library can reference the 'main' symbol */
-#undef CAN_REFERENCE_MAIN
-
 /* Directory to chroot to */
 #undef CHROOT_DIR
 
diff --git a/configure b/configure
index 32ad5f4f3cc2..bdfc14f22052 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.5.0.
+# Generated by GNU Autoconf 2.69 for unbound 1.5.1.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.5.0'
-PACKAGE_STRING='unbound 1.5.0'
+PACKAGE_VERSION='1.5.1'
+PACKAGE_STRING='unbound 1.5.1'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''
 
@@ -1387,7 +1387,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.5.0 to adapt to many kinds of systems.
+\`configure' configures unbound 1.5.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1452,7 +1452,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.5.0:";;
+     short | recursive ) echo "Configuration of unbound 1.5.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1627,7 +1627,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.5.0
+unbound configure 1.5.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2336,7 +2336,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.5.0, which was
+It was created by unbound $as_me 1.5.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2688,7 +2688,7 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=5
 
-UNBOUND_VERSION_MICRO=0
+UNBOUND_VERSION_MICRO=1
 
 
 LIBUNBOUND_CURRENT=5
@@ -2732,6 +2732,7 @@ LIBUNBOUND_AGE=3
 # 1.4.21 had 4:1:2
 # 1.4.22 had 4:1:2
 # 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
+# 1.5.1 had 5:4:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -18312,1411 +18313,6 @@ fi
 
 			;;
 			esac
-			# generate libtool to test if linking main
-			# from a dynamic library works.
-			: ${CONFIG_LT=./config.lt}
-{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_LT" >&5
-$as_echo "$as_me: creating $CONFIG_LT" >&6;}
-as_write_fail=0
-cat >"$CONFIG_LT" <<_ASEOF || as_write_fail=1
-#! $SHELL
-# Generated by $as_me.
-# Run this file to recreate a libtool stub with the current configuration.
-SHELL=\${CONFIG_SHELL-$SHELL}
-export SHELL
-_ASEOF
-cat >>"$CONFIG_LT" <<\_ASEOF || as_write_fail=1
-## -------------------- ##
-## M4sh Initialization. ##
-## -------------------- ##
-
-# Be more Bourne compatible
-DUALCASE=1; export DUALCASE # for MKS sh
-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
-  emulate sh
-  NULLCMD=:
-  # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
-  # is contrary to our usage.  Disable this feature.
-  alias -g '${1+"$@"}'='"$@"'
-  setopt NO_GLOB_SUBST
-else
-  case `(set -o) 2>/dev/null` in #(
-  *posix*) :
-    set -o posix ;; #(
-  *) :
-     ;;
-esac
-fi
-
-
-as_nl='
-'
-export as_nl
-# Printing a long string crashes Solaris 7 /usr/bin/printf.
-as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
-# Prefer a ksh shell builtin over an external printf program on Solaris,
-# but without wasting forks for bash or zsh.
-if test -z "$BASH_VERSION$ZSH_VERSION" \
-    && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
-  as_echo='print -r --'
-  as_echo_n='print -rn --'
-elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
-  as_echo='printf %s\n'
-  as_echo_n='printf %s'
-else
-  if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
-    as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
-    as_echo_n='/usr/ucb/echo -n'
-  else
-    as_echo_body='eval expr "X$1" : "X\\(.*\\)"'
-    as_echo_n_body='eval
-      arg=$1;
-      case $arg in #(
-      *"$as_nl"*)
-	expr "X$arg" : "X\\(.*\\)$as_nl";
-	arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;;
-      esac;
-      expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl"
-    '
-    export as_echo_n_body
-    as_echo_n='sh -c $as_echo_n_body as_echo'
-  fi
-  export as_echo_body
-  as_echo='sh -c $as_echo_body as_echo'
-fi
-
-# The user is always right.
-if test "${PATH_SEPARATOR+set}" != set; then
-  PATH_SEPARATOR=:
-  (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
-    (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
-      PATH_SEPARATOR=';'
-  }
-fi
-
-
-# IFS
-# We need space, tab and new line, in precisely that order.  Quoting is
-# there to prevent editors from complaining about space-tab.
-# (If _AS_PATH_WALK were called with IFS unset, it would disable word
-# splitting by setting IFS to empty value.)
-IFS=" ""	$as_nl"
-
-# Find who we are.  Look in the path if we contain no directory separator.
-as_myself=
-case $0 in #((
-  *[\\/]* ) as_myself=$0 ;;
-  *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
-  done
-IFS=$as_save_IFS
-
-     ;;
-esac
-# We did not find ourselves, most probably we were run as `sh COMMAND'
-# in which case we are not to be found in the path.
-if test "x$as_myself" = x; then
-  as_myself=$0
-fi
-if test ! -f "$as_myself"; then
-  $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
-  exit 1
-fi
-
-# Unset variables that we do not need and which cause bugs (e.g. in
-# pre-3.0 UWIN ksh).  But do not cause bugs in bash 2.01; the "|| exit 1"
-# suppresses any "Segmentation fault" message there.  '((' could
-# trigger a bug in pdksh 5.2.14.
-for as_var in BASH_ENV ENV MAIL MAILPATH
-do eval test x\${$as_var+set} = xset \
-  && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
-done
-PS1='$ '
-PS2='> '
-PS4='+ '
-
-# NLS nuisances.
-LC_ALL=C
-export LC_ALL
-LANGUAGE=C
-export LANGUAGE
-
-# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
-
-
-# as_fn_error STATUS ERROR [LINENO LOG_FD]
-# ----------------------------------------
-# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are
-# provided, also output the error to LOG_FD, referencing LINENO. Then exit the
-# script with STATUS, using 1 if that was 0.
-as_fn_error ()
-{
-  as_status=$1; test $as_status -eq 0 && as_status=1
-  if test "$4"; then
-    as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-    $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
-  fi
-  $as_echo "$as_me: error: $2" >&2
-  as_fn_exit $as_status
-} # as_fn_error
-
-
-# as_fn_set_status STATUS
-# -----------------------
-# Set $? to STATUS, without forking.
-as_fn_set_status ()
-{
-  return $1
-} # as_fn_set_status
-
-# as_fn_exit STATUS
-# -----------------
-# Exit the shell with STATUS, even in a "trap 0" or "set -e" context.
-as_fn_exit ()
-{
-  set +e
-  as_fn_set_status $1
-  exit $1
-} # as_fn_exit
-
-# as_fn_unset VAR
-# ---------------
-# Portably unset VAR.
-as_fn_unset ()
-{
-  { eval $1=; unset $1;}
-}
-as_unset=as_fn_unset
-# as_fn_append VAR VALUE
-# ----------------------
-# Append the text in VALUE to the end of the definition contained in VAR. Take
-# advantage of any shell optimizations that allow amortized linear growth over
-# repeated appends, instead of the typical quadratic growth present in naive
-# implementations.
-if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
-  eval 'as_fn_append ()
-  {
-    eval $1+=\$2
-  }'
-else
-  as_fn_append ()
-  {
-    eval $1=\$$1\$2
-  }
-fi # as_fn_append
-
-# as_fn_arith ARG...
-# ------------------
-# Perform arithmetic evaluation on the ARGs, and store the result in the
-# global $as_val. Take advantage of shells that can avoid forks. The arguments
-# must be portable across $(()) and expr.
-if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
-  eval 'as_fn_arith ()
-  {
-    as_val=$(( $* ))
-  }'
-else
-  as_fn_arith ()
-  {
-    as_val=`expr "$@" || test $? -eq 1`
-  }
-fi # as_fn_arith
-
-
-if expr a : '\(a\)' >/dev/null 2>&1 &&
-   test "X`expr 00001 : '.*\(...\)'`" = X001; then
-  as_expr=expr
-else
-  as_expr=false
-fi
-
-if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then
-  as_basename=basename
-else
-  as_basename=false
-fi
-
-if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
-  as_dirname=dirname
-else
-  as_dirname=false
-fi
-
-as_me=`$as_basename -- "$0" ||
-$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
-	 X"$0" : 'X\(//\)$' \| \
-	 X"$0" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X/"$0" |
-    sed '/^.*\/\([^/][^/]*\)\/*$/{
-	    s//\1/
-	    q
-	  }
-	  /^X\/\(\/\/\)$/{
-	    s//\1/
-	    q
-	  }
-	  /^X\/\(\/\).*/{
-	    s//\1/
-	    q
-	  }
-	  s/.*/./; q'`
-
-# Avoid depending upon Character Ranges.
-as_cr_letters='abcdefghijklmnopqrstuvwxyz'
-as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
-as_cr_Letters=$as_cr_letters$as_cr_LETTERS
-as_cr_digits='0123456789'
-as_cr_alnum=$as_cr_Letters$as_cr_digits
-
-ECHO_C= ECHO_N= ECHO_T=
-case `echo -n x` in #(((((
--n*)
-  case `echo 'xy\c'` in
-  *c*) ECHO_T='	';;	# ECHO_T is single tab character.
-  xy)  ECHO_C='\c';;
-  *)   echo `echo ksh88 bug on AIX 6.1` > /dev/null
-       ECHO_T='	';;
-  esac;;
-*)
-  ECHO_N='-n';;
-esac
-
-rm -f conf$$ conf$$.exe conf$$.file
-if test -d conf$$.dir; then
-  rm -f conf$$.dir/conf$$.file
-else
-  rm -f conf$$.dir
-  mkdir conf$$.dir 2>/dev/null
-fi
-if (echo >conf$$.file) 2>/dev/null; then
-  if ln -s conf$$.file conf$$ 2>/dev/null; then
-    as_ln_s='ln -s'
-    # ... but there are two gotchas:
-    # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
-    # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
-    # In both cases, we have to default to `cp -pR'.
-    ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
-      as_ln_s='cp -pR'
-  elif ln conf$$.file conf$$ 2>/dev/null; then
-    as_ln_s=ln
-  else
-    as_ln_s='cp -pR'
-  fi
-else
-  as_ln_s='cp -pR'
-fi
-rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file
-rmdir conf$$.dir 2>/dev/null
-
-
-# as_fn_mkdir_p
-# -------------
-# Create "$as_dir" as a directory, including parents if necessary.
-as_fn_mkdir_p ()
-{
-
-  case $as_dir in #(
-  -*) as_dir=./$as_dir;;
-  esac
-  test -d "$as_dir" || eval $as_mkdir_p || {
-    as_dirs=
-    while :; do
-      case $as_dir in #(
-      *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
-      *) as_qdir=$as_dir;;
-      esac
-      as_dirs="'$as_qdir' $as_dirs"
-      as_dir=`$as_dirname -- "$as_dir" ||
-$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
-	 X"$as_dir" : 'X\(//\)[^/]' \| \
-	 X"$as_dir" : 'X\(//\)$' \| \
-	 X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$as_dir" |
-    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
-	    s//\1/
-	    q
-	  }
-	  /^X\(\/\/\)[^/].*/{
-	    s//\1/
-	    q
-	  }
-	  /^X\(\/\/\)$/{
-	    s//\1/
-	    q
-	  }
-	  /^X\(\/\).*/{
-	    s//\1/
-	    q
-	  }
-	  s/.*/./; q'`
-      test -d "$as_dir" && break
-    done
-    test -z "$as_dirs" || eval "mkdir $as_dirs"
-  } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir"
-
-
-} # as_fn_mkdir_p
-if mkdir -p . 2>/dev/null; then
-  as_mkdir_p='mkdir -p "$as_dir"'
-else
-  test -d ./-p && rmdir ./-p
-  as_mkdir_p=false
-fi
-
-
-# as_fn_executable_p FILE
-# -----------------------
-# Test if FILE is an executable regular file.
-as_fn_executable_p ()
-{
-  test -f "$1" && test -x "$1"
-} # as_fn_executable_p
-as_test_x='test -x'
-as_executable_p=as_fn_executable_p
-
-# Sed expression to map a string onto a valid CPP name.
-as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'"
-
-# Sed expression to map a string onto a valid variable name.
-as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'"
-
-
-exec 6>&1
-## --------------------------------- ##
-## Main body of "$CONFIG_LT" script. ##
-## --------------------------------- ##
-_ASEOF
-test $as_write_fail = 0 && chmod +x "$CONFIG_LT"
-
-cat >>"$CONFIG_LT" <<\_LTEOF
-lt_cl_silent=false
-exec 5>>config.log
-{
-  echo
-  sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX
-## Running $as_me. ##
-_ASBOX
-} >&5
-
-lt_cl_help="\
-\`$as_me' creates a local libtool stub from the current configuration,
-for use in further configure time tests before the real libtool is
-generated.
-
-Usage: $0 [OPTIONS]
-
-  -h, --help      print this help, then exit
-  -V, --version   print version number, then exit
-  -q, --quiet     do not print progress messages
-  -d, --debug     don't remove temporary files
-
-Report bugs to <bug-libtool@gnu.org>."
-
-lt_cl_version="\
-unbound config.lt 1.5.0
-configured by $0, generated by GNU Autoconf 2.69.
-
-Copyright (C) 2011 Free Software Foundation, Inc.
-This config.lt script is free software; the Free Software Foundation
-gives unlimited permision to copy, distribute and modify it."
-
-while test $# != 0
-do
-  case $1 in
-    --version | --v* | -V )
-      echo "$lt_cl_version"; exit 0 ;;
-    --help | --h* | -h )
-      echo "$lt_cl_help"; exit 0 ;;
-    --debug | --d* | -d )
-      debug=: ;;
-    --quiet | --q* | --silent | --s* | -q )
-      lt_cl_silent=: ;;
-
-    -*) as_fn_error $? "unrecognized option: $1
-Try \`$0 --help' for more information." "$LINENO" 5 ;;
-
-    *) as_fn_error $? "unrecognized argument: $1
-Try \`$0 --help' for more information." "$LINENO" 5 ;;
-  esac
-  shift
-done
-
-if $lt_cl_silent; then
-  exec 6>/dev/null
-fi
-_LTEOF
-
-cat >>"$CONFIG_LT" <<_LTEOF
-
-
-# The HP-UX ksh and POSIX shell print the target directory to stdout
-# if CDPATH is set.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
-
-sed_quote_subst='$sed_quote_subst'
-double_quote_subst='$double_quote_subst'
-delay_variable_subst='$delay_variable_subst'
-macro_version='`$ECHO "$macro_version" | $SED "$delay_single_quote_subst"`'
-macro_revision='`$ECHO "$macro_revision" | $SED "$delay_single_quote_subst"`'
-enable_shared='`$ECHO "$enable_shared" | $SED "$delay_single_quote_subst"`'
-enable_static='`$ECHO "$enable_static" | $SED "$delay_single_quote_subst"`'
-pic_mode='`$ECHO "$pic_mode" | $SED "$delay_single_quote_subst"`'
-enable_fast_install='`$ECHO "$enable_fast_install" | $SED "$delay_single_quote_subst"`'
-SHELL='`$ECHO "$SHELL" | $SED "$delay_single_quote_subst"`'
-ECHO='`$ECHO "$ECHO" | $SED "$delay_single_quote_subst"`'
-PATH_SEPARATOR='`$ECHO "$PATH_SEPARATOR" | $SED "$delay_single_quote_subst"`'
-host_alias='`$ECHO "$host_alias" | $SED "$delay_single_quote_subst"`'
-host='`$ECHO "$host" | $SED "$delay_single_quote_subst"`'
-host_os='`$ECHO "$host_os" | $SED "$delay_single_quote_subst"`'
-build_alias='`$ECHO "$build_alias" | $SED "$delay_single_quote_subst"`'
-build='`$ECHO "$build" | $SED "$delay_single_quote_subst"`'
-build_os='`$ECHO "$build_os" | $SED "$delay_single_quote_subst"`'
-SED='`$ECHO "$SED" | $SED "$delay_single_quote_subst"`'
-Xsed='`$ECHO "$Xsed" | $SED "$delay_single_quote_subst"`'
-GREP='`$ECHO "$GREP" | $SED "$delay_single_quote_subst"`'
-EGREP='`$ECHO "$EGREP" | $SED "$delay_single_quote_subst"`'
-FGREP='`$ECHO "$FGREP" | $SED "$delay_single_quote_subst"`'
-LD='`$ECHO "$LD" | $SED "$delay_single_quote_subst"`'
-NM='`$ECHO "$NM" | $SED "$delay_single_quote_subst"`'
-LN_S='`$ECHO "$LN_S" | $SED "$delay_single_quote_subst"`'
-max_cmd_len='`$ECHO "$max_cmd_len" | $SED "$delay_single_quote_subst"`'
-ac_objext='`$ECHO "$ac_objext" | $SED "$delay_single_quote_subst"`'
-exeext='`$ECHO "$exeext" | $SED "$delay_single_quote_subst"`'
-lt_unset='`$ECHO "$lt_unset" | $SED "$delay_single_quote_subst"`'
-lt_SP2NL='`$ECHO "$lt_SP2NL" | $SED "$delay_single_quote_subst"`'
-lt_NL2SP='`$ECHO "$lt_NL2SP" | $SED "$delay_single_quote_subst"`'
-lt_cv_to_host_file_cmd='`$ECHO "$lt_cv_to_host_file_cmd" | $SED "$delay_single_quote_subst"`'
-lt_cv_to_tool_file_cmd='`$ECHO "$lt_cv_to_tool_file_cmd" | $SED "$delay_single_quote_subst"`'
-reload_flag='`$ECHO "$reload_flag" | $SED "$delay_single_quote_subst"`'
-reload_cmds='`$ECHO "$reload_cmds" | $SED "$delay_single_quote_subst"`'
-OBJDUMP='`$ECHO "$OBJDUMP" | $SED "$delay_single_quote_subst"`'
-deplibs_check_method='`$ECHO "$deplibs_check_method" | $SED "$delay_single_quote_subst"`'
-file_magic_cmd='`$ECHO "$file_magic_cmd" | $SED "$delay_single_quote_subst"`'
-file_magic_glob='`$ECHO "$file_magic_glob" | $SED "$delay_single_quote_subst"`'
-want_nocaseglob='`$ECHO "$want_nocaseglob" | $SED "$delay_single_quote_subst"`'
-DLLTOOL='`$ECHO "$DLLTOOL" | $SED "$delay_single_quote_subst"`'
-sharedlib_from_linklib_cmd='`$ECHO "$sharedlib_from_linklib_cmd" | $SED "$delay_single_quote_subst"`'
-AR='`$ECHO "$AR" | $SED "$delay_single_quote_subst"`'
-AR_FLAGS='`$ECHO "$AR_FLAGS" | $SED "$delay_single_quote_subst"`'
-archiver_list_spec='`$ECHO "$archiver_list_spec" | $SED "$delay_single_quote_subst"`'
-STRIP='`$ECHO "$STRIP" | $SED "$delay_single_quote_subst"`'
-RANLIB='`$ECHO "$RANLIB" | $SED "$delay_single_quote_subst"`'
-old_postinstall_cmds='`$ECHO "$old_postinstall_cmds" | $SED "$delay_single_quote_subst"`'
-old_postuninstall_cmds='`$ECHO "$old_postuninstall_cmds" | $SED "$delay_single_quote_subst"`'
-old_archive_cmds='`$ECHO "$old_archive_cmds" | $SED "$delay_single_quote_subst"`'
-lock_old_archive_extraction='`$ECHO "$lock_old_archive_extraction" | $SED "$delay_single_quote_subst"`'
-CC='`$ECHO "$CC" | $SED "$delay_single_quote_subst"`'
-CFLAGS='`$ECHO "$CFLAGS" | $SED "$delay_single_quote_subst"`'
-compiler='`$ECHO "$compiler" | $SED "$delay_single_quote_subst"`'
-GCC='`$ECHO "$GCC" | $SED "$delay_single_quote_subst"`'
-lt_cv_sys_global_symbol_pipe='`$ECHO "$lt_cv_sys_global_symbol_pipe" | $SED "$delay_single_quote_subst"`'
-lt_cv_sys_global_symbol_to_cdecl='`$ECHO "$lt_cv_sys_global_symbol_to_cdecl" | $SED "$delay_single_quote_subst"`'
-lt_cv_sys_global_symbol_to_c_name_address='`$ECHO "$lt_cv_sys_global_symbol_to_c_name_address" | $SED "$delay_single_quote_subst"`'
-lt_cv_sys_global_symbol_to_c_name_address_lib_prefix='`$ECHO "$lt_cv_sys_global_symbol_to_c_name_address_lib_prefix" | $SED "$delay_single_quote_subst"`'
-nm_file_list_spec='`$ECHO "$nm_file_list_spec" | $SED "$delay_single_quote_subst"`'
-lt_sysroot='`$ECHO "$lt_sysroot" | $SED "$delay_single_quote_subst"`'
-objdir='`$ECHO "$objdir" | $SED "$delay_single_quote_subst"`'
-MAGIC_CMD='`$ECHO "$MAGIC_CMD" | $SED "$delay_single_quote_subst"`'
-lt_prog_compiler_no_builtin_flag='`$ECHO "$lt_prog_compiler_no_builtin_flag" | $SED "$delay_single_quote_subst"`'
-lt_prog_compiler_pic='`$ECHO "$lt_prog_compiler_pic" | $SED "$delay_single_quote_subst"`'
-lt_prog_compiler_wl='`$ECHO "$lt_prog_compiler_wl" | $SED "$delay_single_quote_subst"`'
-lt_prog_compiler_static='`$ECHO "$lt_prog_compiler_static" | $SED "$delay_single_quote_subst"`'
-lt_cv_prog_compiler_c_o='`$ECHO "$lt_cv_prog_compiler_c_o" | $SED "$delay_single_quote_subst"`'
-need_locks='`$ECHO "$need_locks" | $SED "$delay_single_quote_subst"`'
-MANIFEST_TOOL='`$ECHO "$MANIFEST_TOOL" | $SED "$delay_single_quote_subst"`'
-DSYMUTIL='`$ECHO "$DSYMUTIL" | $SED "$delay_single_quote_subst"`'
-NMEDIT='`$ECHO "$NMEDIT" | $SED "$delay_single_quote_subst"`'
-LIPO='`$ECHO "$LIPO" | $SED "$delay_single_quote_subst"`'
-OTOOL='`$ECHO "$OTOOL" | $SED "$delay_single_quote_subst"`'
-OTOOL64='`$ECHO "$OTOOL64" | $SED "$delay_single_quote_subst"`'
-libext='`$ECHO "$libext" | $SED "$delay_single_quote_subst"`'
-shrext_cmds='`$ECHO "$shrext_cmds" | $SED "$delay_single_quote_subst"`'
-extract_expsyms_cmds='`$ECHO "$extract_expsyms_cmds" | $SED "$delay_single_quote_subst"`'
-archive_cmds_need_lc='`$ECHO "$archive_cmds_need_lc" | $SED "$delay_single_quote_subst"`'
-enable_shared_with_static_runtimes='`$ECHO "$enable_shared_with_static_runtimes" | $SED "$delay_single_quote_subst"`'
-export_dynamic_flag_spec='`$ECHO "$export_dynamic_flag_spec" | $SED "$delay_single_quote_subst"`'
-whole_archive_flag_spec='`$ECHO "$whole_archive_flag_spec" | $SED "$delay_single_quote_subst"`'
-compiler_needs_object='`$ECHO "$compiler_needs_object" | $SED "$delay_single_quote_subst"`'
-old_archive_from_new_cmds='`$ECHO "$old_archive_from_new_cmds" | $SED "$delay_single_quote_subst"`'
-old_archive_from_expsyms_cmds='`$ECHO "$old_archive_from_expsyms_cmds" | $SED "$delay_single_quote_subst"`'
-archive_cmds='`$ECHO "$archive_cmds" | $SED "$delay_single_quote_subst"`'
-archive_expsym_cmds='`$ECHO "$archive_expsym_cmds" | $SED "$delay_single_quote_subst"`'
-module_cmds='`$ECHO "$module_cmds" | $SED "$delay_single_quote_subst"`'
-module_expsym_cmds='`$ECHO "$module_expsym_cmds" | $SED "$delay_single_quote_subst"`'
-with_gnu_ld='`$ECHO "$with_gnu_ld" | $SED "$delay_single_quote_subst"`'
-allow_undefined_flag='`$ECHO "$allow_undefined_flag" | $SED "$delay_single_quote_subst"`'
-no_undefined_flag='`$ECHO "$no_undefined_flag" | $SED "$delay_single_quote_subst"`'
-hardcode_libdir_flag_spec='`$ECHO "$hardcode_libdir_flag_spec" | $SED "$delay_single_quote_subst"`'
-hardcode_libdir_separator='`$ECHO "$hardcode_libdir_separator" | $SED "$delay_single_quote_subst"`'
-hardcode_direct='`$ECHO "$hardcode_direct" | $SED "$delay_single_quote_subst"`'
-hardcode_direct_absolute='`$ECHO "$hardcode_direct_absolute" | $SED "$delay_single_quote_subst"`'
-hardcode_minus_L='`$ECHO "$hardcode_minus_L" | $SED "$delay_single_quote_subst"`'
-hardcode_shlibpath_var='`$ECHO "$hardcode_shlibpath_var" | $SED "$delay_single_quote_subst"`'
-hardcode_automatic='`$ECHO "$hardcode_automatic" | $SED "$delay_single_quote_subst"`'
-inherit_rpath='`$ECHO "$inherit_rpath" | $SED "$delay_single_quote_subst"`'
-link_all_deplibs='`$ECHO "$link_all_deplibs" | $SED "$delay_single_quote_subst"`'
-always_export_symbols='`$ECHO "$always_export_symbols" | $SED "$delay_single_quote_subst"`'
-export_symbols_cmds='`$ECHO "$export_symbols_cmds" | $SED "$delay_single_quote_subst"`'
-exclude_expsyms='`$ECHO "$exclude_expsyms" | $SED "$delay_single_quote_subst"`'
-include_expsyms='`$ECHO "$include_expsyms" | $SED "$delay_single_quote_subst"`'
-prelink_cmds='`$ECHO "$prelink_cmds" | $SED "$delay_single_quote_subst"`'
-postlink_cmds='`$ECHO "$postlink_cmds" | $SED "$delay_single_quote_subst"`'
-file_list_spec='`$ECHO "$file_list_spec" | $SED "$delay_single_quote_subst"`'
-variables_saved_for_relink='`$ECHO "$variables_saved_for_relink" | $SED "$delay_single_quote_subst"`'
-need_lib_prefix='`$ECHO "$need_lib_prefix" | $SED "$delay_single_quote_subst"`'
-need_version='`$ECHO "$need_version" | $SED "$delay_single_quote_subst"`'
-version_type='`$ECHO "$version_type" | $SED "$delay_single_quote_subst"`'
-runpath_var='`$ECHO "$runpath_var" | $SED "$delay_single_quote_subst"`'
-shlibpath_var='`$ECHO "$shlibpath_var" | $SED "$delay_single_quote_subst"`'
-shlibpath_overrides_runpath='`$ECHO "$shlibpath_overrides_runpath" | $SED "$delay_single_quote_subst"`'
-libname_spec='`$ECHO "$libname_spec" | $SED "$delay_single_quote_subst"`'
-library_names_spec='`$ECHO "$library_names_spec" | $SED "$delay_single_quote_subst"`'
-soname_spec='`$ECHO "$soname_spec" | $SED "$delay_single_quote_subst"`'
-install_override_mode='`$ECHO "$install_override_mode" | $SED "$delay_single_quote_subst"`'
-postinstall_cmds='`$ECHO "$postinstall_cmds" | $SED "$delay_single_quote_subst"`'
-postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`'
-finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`'
-finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`'
-hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`'
-sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`'
-sys_lib_dlsearch_path_spec='`$ECHO "$sys_lib_dlsearch_path_spec" | $SED "$delay_single_quote_subst"`'
-hardcode_action='`$ECHO "$hardcode_action" | $SED "$delay_single_quote_subst"`'
-enable_dlopen='`$ECHO "$enable_dlopen" | $SED "$delay_single_quote_subst"`'
-enable_dlopen_self='`$ECHO "$enable_dlopen_self" | $SED "$delay_single_quote_subst"`'
-enable_dlopen_self_static='`$ECHO "$enable_dlopen_self_static" | $SED "$delay_single_quote_subst"`'
-old_striplib='`$ECHO "$old_striplib" | $SED "$delay_single_quote_subst"`'
-striplib='`$ECHO "$striplib" | $SED "$delay_single_quote_subst"`'
-
-LTCC='$LTCC'
-LTCFLAGS='$LTCFLAGS'
-compiler='$compiler_DEFAULT'
-
-# A function that is used when there is no print builtin or printf.
-func_fallback_echo ()
-{
-  eval 'cat <<_LTECHO_EOF
-\$1
-_LTECHO_EOF'
-}
-
-# Quote evaled strings.
-for var in SHELL \
-ECHO \
-PATH_SEPARATOR \
-SED \
-GREP \
-EGREP \
-FGREP \
-LD \
-NM \
-LN_S \
-lt_SP2NL \
-lt_NL2SP \
-reload_flag \
-OBJDUMP \
-deplibs_check_method \
-file_magic_cmd \
-file_magic_glob \
-want_nocaseglob \
-DLLTOOL \
-sharedlib_from_linklib_cmd \
-AR \
-AR_FLAGS \
-archiver_list_spec \
-STRIP \
-RANLIB \
-CC \
-CFLAGS \
-compiler \
-lt_cv_sys_global_symbol_pipe \
-lt_cv_sys_global_symbol_to_cdecl \
-lt_cv_sys_global_symbol_to_c_name_address \
-lt_cv_sys_global_symbol_to_c_name_address_lib_prefix \
-nm_file_list_spec \
-lt_prog_compiler_no_builtin_flag \
-lt_prog_compiler_pic \
-lt_prog_compiler_wl \
-lt_prog_compiler_static \
-lt_cv_prog_compiler_c_o \
-need_locks \
-MANIFEST_TOOL \
-DSYMUTIL \
-NMEDIT \
-LIPO \
-OTOOL \
-OTOOL64 \
-shrext_cmds \
-export_dynamic_flag_spec \
-whole_archive_flag_spec \
-compiler_needs_object \
-with_gnu_ld \
-allow_undefined_flag \
-no_undefined_flag \
-hardcode_libdir_flag_spec \
-hardcode_libdir_separator \
-exclude_expsyms \
-include_expsyms \
-file_list_spec \
-variables_saved_for_relink \
-libname_spec \
-library_names_spec \
-soname_spec \
-install_override_mode \
-finish_eval \
-old_striplib \
-striplib; do
-    case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in
-    *[\\\\\\\`\\"\\\$]*)
-      eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED \\"\\\$sed_quote_subst\\"\\\`\\\\\\""
-      ;;
-    *)
-      eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\""
-      ;;
-    esac
-done
-
-# Double-quote double-evaled strings.
-for var in reload_cmds \
-old_postinstall_cmds \
-old_postuninstall_cmds \
-old_archive_cmds \
-extract_expsyms_cmds \
-old_archive_from_new_cmds \
-old_archive_from_expsyms_cmds \
-archive_cmds \
-archive_expsym_cmds \
-module_cmds \
-module_expsym_cmds \
-export_symbols_cmds \
-prelink_cmds \
-postlink_cmds \
-postinstall_cmds \
-postuninstall_cmds \
-finish_cmds \
-sys_lib_search_path_spec \
-sys_lib_dlsearch_path_spec; do
-    case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in
-    *[\\\\\\\`\\"\\\$]*)
-      eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED -e \\"\\\$double_quote_subst\\" -e \\"\\\$sed_quote_subst\\" -e \\"\\\$delay_variable_subst\\"\\\`\\\\\\""
-      ;;
-    *)
-      eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\""
-      ;;
-    esac
-done
-
-ac_aux_dir='$ac_aux_dir'
-xsi_shell='$xsi_shell'
-lt_shell_append='$lt_shell_append'
-
-# See if we are running on zsh, and set the options which allow our
-# commands through without removal of \ escapes INIT.
-if test -n "\${ZSH_VERSION+set}" ; then
-   setopt NO_GLOB_SUBST
-fi
-
-
-    PACKAGE='$PACKAGE'
-    VERSION='$VERSION'
-    TIMESTAMP='$TIMESTAMP'
-    RM='$RM'
-    ofile='$ofile'
-
-
-
-_LTEOF
-
-cat >>"$CONFIG_LT" <<\_LTEOF
-{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $ofile" >&5
-$as_echo "$as_me: creating $ofile" >&6;}
-
-
-    # See if we are running on zsh, and set the options which allow our
-    # commands through without removal of \ escapes.
-    if test -n "${ZSH_VERSION+set}" ; then
-      setopt NO_GLOB_SUBST
-    fi
-
-    cfgfile="${ofile}T"
-    trap "$RM \"$cfgfile\"; exit 1" 1 2 15
-    $RM "$cfgfile"
-
-    cat <<_LT_EOF >> "$cfgfile"
-#! $SHELL
-
-# `$ECHO "$ofile" | sed 's%^.*/%%'` - Provide generalized library-building support services.
-# Generated automatically by $as_me ($PACKAGE$TIMESTAMP) $VERSION
-# Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`:
-# NOTE: Changes made to this file will be lost: look at ltmain.sh.
-#
-#   Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2003, 2004, 2005,
-#                 2006, 2007, 2008, 2009, 2010, 2011 Free Software
-#                 Foundation, Inc.
-#   Written by Gordon Matzigkeit, 1996
-#
-#   This file is part of GNU Libtool.
-#
-# GNU Libtool is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License as
-# published by the Free Software Foundation; either version 2 of
-# the License, or (at your option) any later version.
-#
-# As a special exception to the GNU General Public License,
-# if you distribute this file as part of a program or library that
-# is built using GNU Libtool, you may include this file under the
-# same distribution terms that you use for the rest of that program.
-#
-# GNU Libtool is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with GNU Libtool; see the file COPYING.  If not, a copy
-# can be downloaded from http://www.gnu.org/licenses/gpl.html, or
-# obtained by writing to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-
-
-# The names of the tagged configurations supported by this script.
-available_tags=""
-
-# ### BEGIN LIBTOOL CONFIG
-
-# Which release of libtool.m4 was used?
-macro_version=$macro_version
-macro_revision=$macro_revision
-
-# Whether or not to build shared libraries.
-build_libtool_libs=$enable_shared
-
-# Whether or not to build static libraries.
-build_old_libs=$enable_static
-
-# What type of objects to build.
-pic_mode=$pic_mode
-
-# Whether or not to optimize for fast installation.
-fast_install=$enable_fast_install
-
-# Shell to use when invoking shell scripts.
-SHELL=$lt_SHELL
-
-# An echo program that protects backslashes.
-ECHO=$lt_ECHO
-
-# The PATH separator for the build system.
-PATH_SEPARATOR=$lt_PATH_SEPARATOR
-
-# The host system.
-host_alias=$host_alias
-host=$host
-host_os=$host_os
-
-# The build system.
-build_alias=$build_alias
-build=$build
-build_os=$build_os
-
-# A sed program that does not truncate output.
-SED=$lt_SED
-
-# Sed that helps us avoid accidentally triggering echo(1) options like -n.
-Xsed="\$SED -e 1s/^X//"
-
-# A grep program that handles long lines.
-GREP=$lt_GREP
-
-# An ERE matcher.
-EGREP=$lt_EGREP
-
-# A literal string matcher.
-FGREP=$lt_FGREP
-
-# A BSD- or MS-compatible name lister.
-NM=$lt_NM
-
-# Whether we need soft or hard links.
-LN_S=$lt_LN_S
-
-# What is the maximum length of a command?
-max_cmd_len=$max_cmd_len
-
-# Object file suffix (normally "o").
-objext=$ac_objext
-
-# Executable file suffix (normally "").
-exeext=$exeext
-
-# whether the shell understands "unset".
-lt_unset=$lt_unset
-
-# turn spaces into newlines.
-SP2NL=$lt_lt_SP2NL
-
-# turn newlines into spaces.
-NL2SP=$lt_lt_NL2SP
-
-# convert \$build file names to \$host format.
-to_host_file_cmd=$lt_cv_to_host_file_cmd
-
-# convert \$build files to toolchain format.
-to_tool_file_cmd=$lt_cv_to_tool_file_cmd
-
-# An object symbol dumper.
-OBJDUMP=$lt_OBJDUMP
-
-# Method to check whether dependent libraries are shared objects.
-deplibs_check_method=$lt_deplibs_check_method
-
-# Command to use when deplibs_check_method = "file_magic".
-file_magic_cmd=$lt_file_magic_cmd
-
-# How to find potential files when deplibs_check_method = "file_magic".
-file_magic_glob=$lt_file_magic_glob
-
-# Find potential files using nocaseglob when deplibs_check_method = "file_magic".
-want_nocaseglob=$lt_want_nocaseglob
-
-# DLL creation program.
-DLLTOOL=$lt_DLLTOOL
-
-# Command to associate shared and link libraries.
-sharedlib_from_linklib_cmd=$lt_sharedlib_from_linklib_cmd
-
-# The archiver.
-AR=$lt_AR
-
-# Flags to create an archive.
-AR_FLAGS=$lt_AR_FLAGS
-
-# How to feed a file listing to the archiver.
-archiver_list_spec=$lt_archiver_list_spec
-
-# A symbol stripping program.
-STRIP=$lt_STRIP
-
-# Commands used to install an old-style archive.
-RANLIB=$lt_RANLIB
-old_postinstall_cmds=$lt_old_postinstall_cmds
-old_postuninstall_cmds=$lt_old_postuninstall_cmds
-
-# Whether to use a lock for old archive extraction.
-lock_old_archive_extraction=$lock_old_archive_extraction
-
-# A C compiler.
-LTCC=$lt_CC
-
-# LTCC compiler flags.
-LTCFLAGS=$lt_CFLAGS
-
-# Take the output of nm and produce a listing of raw symbols and C names.
-global_symbol_pipe=$lt_lt_cv_sys_global_symbol_pipe
-
-# Transform the output of nm in a proper C declaration.
-global_symbol_to_cdecl=$lt_lt_cv_sys_global_symbol_to_cdecl
-
-# Transform the output of nm in a C name address pair.
-global_symbol_to_c_name_address=$lt_lt_cv_sys_global_symbol_to_c_name_address
-
-# Transform the output of nm in a C name address pair when lib prefix is needed.
-global_symbol_to_c_name_address_lib_prefix=$lt_lt_cv_sys_global_symbol_to_c_name_address_lib_prefix
-
-# Specify filename containing input files for \$NM.
-nm_file_list_spec=$lt_nm_file_list_spec
-
-# The root where to search for dependent libraries,and in which our libraries should be installed.
-lt_sysroot=$lt_sysroot
-
-# The name of the directory that contains temporary libtool files.
-objdir=$objdir
-
-# Used to examine libraries when file_magic_cmd begins with "file".
-MAGIC_CMD=$MAGIC_CMD
-
-# Must we lock files when doing compilation?
-need_locks=$lt_need_locks
-
-# Manifest tool.
-MANIFEST_TOOL=$lt_MANIFEST_TOOL
-
-# Tool to manipulate archived DWARF debug symbol files on Mac OS X.
-DSYMUTIL=$lt_DSYMUTIL
-
-# Tool to change global to local symbols on Mac OS X.
-NMEDIT=$lt_NMEDIT
-
-# Tool to manipulate fat objects and archives on Mac OS X.
-LIPO=$lt_LIPO
-
-# ldd/readelf like tool for Mach-O binaries on Mac OS X.
-OTOOL=$lt_OTOOL
-
-# ldd/readelf like tool for 64 bit Mach-O binaries on Mac OS X 10.4.
-OTOOL64=$lt_OTOOL64
-
-# Old archive suffix (normally "a").
-libext=$libext
-
-# Shared library suffix (normally ".so").
-shrext_cmds=$lt_shrext_cmds
-
-# The commands to extract the exported symbol list from a shared archive.
-extract_expsyms_cmds=$lt_extract_expsyms_cmds
-
-# Variables whose values should be saved in libtool wrapper scripts and
-# restored at link time.
-variables_saved_for_relink=$lt_variables_saved_for_relink
-
-# Do we need the "lib" prefix for modules?
-need_lib_prefix=$need_lib_prefix
-
-# Do we need a version for libraries?
-need_version=$need_version
-
-# Library versioning type.
-version_type=$version_type
-
-# Shared library runtime path variable.
-runpath_var=$runpath_var
-
-# Shared library path variable.
-shlibpath_var=$shlibpath_var
-
-# Is shlibpath searched before the hard-coded library search path?
-shlibpath_overrides_runpath=$shlibpath_overrides_runpath
-
-# Format of library name prefix.
-libname_spec=$lt_libname_spec
-
-# List of archive names.  First name is the real one, the rest are links.
-# The last name is the one that the linker finds with -lNAME
-library_names_spec=$lt_library_names_spec
-
-# The coded name of the library, if different from the real name.
-soname_spec=$lt_soname_spec
-
-# Permission mode override for installation of shared libraries.
-install_override_mode=$lt_install_override_mode
-
-# Command to use after installation of a shared archive.
-postinstall_cmds=$lt_postinstall_cmds
-
-# Command to use after uninstallation of a shared archive.
-postuninstall_cmds=$lt_postuninstall_cmds
-
-# Commands used to finish a libtool library installation in a directory.
-finish_cmds=$lt_finish_cmds
-
-# As "finish_cmds", except a single script fragment to be evaled but
-# not shown.
-finish_eval=$lt_finish_eval
-
-# Whether we should hardcode library paths into libraries.
-hardcode_into_libs=$hardcode_into_libs
-
-# Compile-time system search path for libraries.
-sys_lib_search_path_spec=$lt_sys_lib_search_path_spec
-
-# Run-time system search path for libraries.
-sys_lib_dlsearch_path_spec=$lt_sys_lib_dlsearch_path_spec
-
-# Whether dlopen is supported.
-dlopen_support=$enable_dlopen
-
-# Whether dlopen of programs is supported.
-dlopen_self=$enable_dlopen_self
-
-# Whether dlopen of statically linked programs is supported.
-dlopen_self_static=$enable_dlopen_self_static
-
-# Commands to strip libraries.
-old_striplib=$lt_old_striplib
-striplib=$lt_striplib
-
-
-# The linker used to build libraries.
-LD=$lt_LD
-
-# How to create reloadable object files.
-reload_flag=$lt_reload_flag
-reload_cmds=$lt_reload_cmds
-
-# Commands used to build an old-style archive.
-old_archive_cmds=$lt_old_archive_cmds
-
-# A language specific compiler.
-CC=$lt_compiler
-
-# Is the compiler the GNU compiler?
-with_gcc=$GCC
-
-# Compiler flag to turn off builtin functions.
-no_builtin_flag=$lt_lt_prog_compiler_no_builtin_flag
-
-# Additional compiler flags for building library objects.
-pic_flag=$lt_lt_prog_compiler_pic
-
-# How to pass a linker flag through the compiler.
-wl=$lt_lt_prog_compiler_wl
-
-# Compiler flag to prevent dynamic linking.
-link_static_flag=$lt_lt_prog_compiler_static
-
-# Does compiler simultaneously support -c and -o options?
-compiler_c_o=$lt_lt_cv_prog_compiler_c_o
-
-# Whether or not to add -lc for building shared libraries.
-build_libtool_need_lc=$archive_cmds_need_lc
-
-# Whether or not to disallow shared libs when runtime libs are static.
-allow_libtool_libs_with_static_runtimes=$enable_shared_with_static_runtimes
-
-# Compiler flag to allow reflexive dlopens.
-export_dynamic_flag_spec=$lt_export_dynamic_flag_spec
-
-# Compiler flag to generate shared objects directly from archives.
-whole_archive_flag_spec=$lt_whole_archive_flag_spec
-
-# Whether the compiler copes with passing no objects directly.
-compiler_needs_object=$lt_compiler_needs_object
-
-# Create an old-style archive from a shared archive.
-old_archive_from_new_cmds=$lt_old_archive_from_new_cmds
-
-# Create a temporary old-style archive to link instead of a shared archive.
-old_archive_from_expsyms_cmds=$lt_old_archive_from_expsyms_cmds
-
-# Commands used to build a shared archive.
-archive_cmds=$lt_archive_cmds
-archive_expsym_cmds=$lt_archive_expsym_cmds
-
-# Commands used to build a loadable module if different from building
-# a shared archive.
-module_cmds=$lt_module_cmds
-module_expsym_cmds=$lt_module_expsym_cmds
-
-# Whether we are building with GNU ld or not.
-with_gnu_ld=$lt_with_gnu_ld
-
-# Flag that allows shared libraries with undefined symbols to be built.
-allow_undefined_flag=$lt_allow_undefined_flag
-
-# Flag that enforces no undefined symbols.
-no_undefined_flag=$lt_no_undefined_flag
-
-# Flag to hardcode \$libdir into a binary during linking.
-# This must work even if \$libdir does not exist
-hardcode_libdir_flag_spec=$lt_hardcode_libdir_flag_spec
-
-# Whether we need a single "-rpath" flag with a separated argument.
-hardcode_libdir_separator=$lt_hardcode_libdir_separator
-
-# Set to "yes" if using DIR/libNAME\${shared_ext} during linking hardcodes
-# DIR into the resulting binary.
-hardcode_direct=$hardcode_direct
-
-# Set to "yes" if using DIR/libNAME\${shared_ext} during linking hardcodes
-# DIR into the resulting binary and the resulting library dependency is
-# "absolute",i.e impossible to change by setting \${shlibpath_var} if the
-# library is relocated.
-hardcode_direct_absolute=$hardcode_direct_absolute
-
-# Set to "yes" if using the -LDIR flag during linking hardcodes DIR
-# into the resulting binary.
-hardcode_minus_L=$hardcode_minus_L
-
-# Set to "yes" if using SHLIBPATH_VAR=DIR during linking hardcodes DIR
-# into the resulting binary.
-hardcode_shlibpath_var=$hardcode_shlibpath_var
-
-# Set to "yes" if building a shared library automatically hardcodes DIR
-# into the library and all subsequent libraries and executables linked
-# against it.
-hardcode_automatic=$hardcode_automatic
-
-# Set to yes if linker adds runtime paths of dependent libraries
-# to runtime path list.
-inherit_rpath=$inherit_rpath
-
-# Whether libtool must link a program against all its dependency libraries.
-link_all_deplibs=$link_all_deplibs
-
-# Set to "yes" if exported symbols are required.
-always_export_symbols=$always_export_symbols
-
-# The commands to list exported symbols.
-export_symbols_cmds=$lt_export_symbols_cmds
-
-# Symbols that should not be listed in the preloaded symbols.
-exclude_expsyms=$lt_exclude_expsyms
-
-# Symbols that must always be exported.
-include_expsyms=$lt_include_expsyms
-
-# Commands necessary for linking programs (against libraries) with templates.
-prelink_cmds=$lt_prelink_cmds
-
-# Commands necessary for finishing linking programs.
-postlink_cmds=$lt_postlink_cmds
-
-# Specify filename containing input files.
-file_list_spec=$lt_file_list_spec
-
-# How to hardcode a shared library path into an executable.
-hardcode_action=$hardcode_action
-
-# ### END LIBTOOL CONFIG
-
-_LT_EOF
-
-  case $host_os in
-  aix3*)
-    cat <<\_LT_EOF >> "$cfgfile"
-# AIX sometimes has problems with the GCC collect2 program.  For some
-# reason, if we set the COLLECT_NAMES environment variable, the problems
-# vanish in a puff of smoke.
-if test "X${COLLECT_NAMES+set}" != Xset; then
-  COLLECT_NAMES=
-  export COLLECT_NAMES
-fi
-_LT_EOF
-    ;;
-  esac
-
-
-ltmain="$ac_aux_dir/ltmain.sh"
-
-
-  # We use sed instead of cat because bash on DJGPP gets confused if
-  # if finds mixed CR/LF and LF-only lines.  Since sed operates in
-  # text mode, it properly converts lines to CR/LF.  This bash problem
-  # is reportedly fixed, but why not run on old versions too?
-  sed '$q' "$ltmain" >> "$cfgfile" \
-     || (rm -f "$cfgfile"; exit 1)
-
-  if test x"$xsi_shell" = xyes; then
-  sed -e '/^func_dirname ()$/,/^} # func_dirname /c\
-func_dirname ()\
-{\
-\    case ${1} in\
-\      */*) func_dirname_result="${1%/*}${2}" ;;\
-\      *  ) func_dirname_result="${3}" ;;\
-\    esac\
-} # Extended-shell func_dirname implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_basename ()$/,/^} # func_basename /c\
-func_basename ()\
-{\
-\    func_basename_result="${1##*/}"\
-} # Extended-shell func_basename implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_dirname_and_basename ()$/,/^} # func_dirname_and_basename /c\
-func_dirname_and_basename ()\
-{\
-\    case ${1} in\
-\      */*) func_dirname_result="${1%/*}${2}" ;;\
-\      *  ) func_dirname_result="${3}" ;;\
-\    esac\
-\    func_basename_result="${1##*/}"\
-} # Extended-shell func_dirname_and_basename implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_stripname ()$/,/^} # func_stripname /c\
-func_stripname ()\
-{\
-\    # pdksh 5.2.14 does not do ${X%$Y} correctly if both X and Y are\
-\    # positional parameters, so assign one to ordinary parameter first.\
-\    func_stripname_result=${3}\
-\    func_stripname_result=${func_stripname_result#"${1}"}\
-\    func_stripname_result=${func_stripname_result%"${2}"}\
-} # Extended-shell func_stripname implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_split_long_opt ()$/,/^} # func_split_long_opt /c\
-func_split_long_opt ()\
-{\
-\    func_split_long_opt_name=${1%%=*}\
-\    func_split_long_opt_arg=${1#*=}\
-} # Extended-shell func_split_long_opt implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_split_short_opt ()$/,/^} # func_split_short_opt /c\
-func_split_short_opt ()\
-{\
-\    func_split_short_opt_arg=${1#??}\
-\    func_split_short_opt_name=${1%"$func_split_short_opt_arg"}\
-} # Extended-shell func_split_short_opt implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_lo2o ()$/,/^} # func_lo2o /c\
-func_lo2o ()\
-{\
-\    case ${1} in\
-\      *.lo) func_lo2o_result=${1%.lo}.${objext} ;;\
-\      *)    func_lo2o_result=${1} ;;\
-\    esac\
-} # Extended-shell func_lo2o implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_xform ()$/,/^} # func_xform /c\
-func_xform ()\
-{\
-    func_xform_result=${1%.*}.lo\
-} # Extended-shell func_xform implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_arith ()$/,/^} # func_arith /c\
-func_arith ()\
-{\
-    func_arith_result=$(( $* ))\
-} # Extended-shell func_arith implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_len ()$/,/^} # func_len /c\
-func_len ()\
-{\
-    func_len_result=${#1}\
-} # Extended-shell func_len implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-fi
-
-if test x"$lt_shell_append" = xyes; then
-  sed -e '/^func_append ()$/,/^} # func_append /c\
-func_append ()\
-{\
-    eval "${1}+=\\${2}"\
-} # Extended-shell func_append implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  sed -e '/^func_append_quoted ()$/,/^} # func_append_quoted /c\
-func_append_quoted ()\
-{\
-\    func_quote_for_eval "${2}"\
-\    eval "${1}+=\\\\ \\$func_quote_for_eval_result"\
-} # Extended-shell func_append_quoted implementation' "$cfgfile" > $cfgfile.tmp \
-  && mv -f "$cfgfile.tmp" "$cfgfile" \
-    || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-test 0 -eq $? || _lt_function_replace_fail=:
-
-
-  # Save a `func_append' function call where possible by direct use of '+='
-  sed -e 's%func_append \([a-zA-Z_]\{1,\}\) "%\1+="%g' $cfgfile > $cfgfile.tmp \
-    && mv -f "$cfgfile.tmp" "$cfgfile" \
-      || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-  test 0 -eq $? || _lt_function_replace_fail=:
-else
-  # Save a `func_append' function call even when '+=' is not available
-  sed -e 's%func_append \([a-zA-Z_]\{1,\}\) "%\1="$\1%g' $cfgfile > $cfgfile.tmp \
-    && mv -f "$cfgfile.tmp" "$cfgfile" \
-      || (rm -f "$cfgfile" && cp "$cfgfile.tmp" "$cfgfile" && rm -f "$cfgfile.tmp")
-  test 0 -eq $? || _lt_function_replace_fail=:
-fi
-
-if test x"$_lt_function_replace_fail" = x":"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Unable to substitute extended shell functions in $ofile" >&5
-$as_echo "$as_me: WARNING: Unable to substitute extended shell functions in $ofile" >&2;}
-fi
-
-
-   mv -f "$cfgfile" "$ofile" ||
-    (rm -f "$ofile" && cp "$cfgfile" "$ofile" && rm -f "$cfgfile")
-  chmod +x "$ofile"
-
-
-as_fn_exit 0
-_LTEOF
-chmod +x "$CONFIG_LT"
-
-# configure is writing to config.log, but config.lt does its own redirection,
-# appending to config.log, which fails on DOS, as config.log is still kept
-# open by configure.  Here we exec the FD to /dev/null, effectively closing
-# config.log, so it can be properly (re)opened and appended to by config.lt.
-lt_cl_success=:
-test "$silent" = yes &&
-  lt_config_lt_args="$lt_config_lt_args --quiet"
-exec 5>/dev/null
-$SHELL "$CONFIG_LT" $lt_config_lt_args || lt_cl_success=false
-exec 5>>config.log
-$lt_cl_success || as_fn_exit 1
-
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if dynamic lib can refer to main" >&5
-$as_echo_n "checking if dynamic lib can refer to main... " >&6; }
-			cat >tmp.$$.def <<EOF
-myfunc
-EOF
-			cat >tmp.$$.c <<EOF
-int myfunc(void);
-extern int main(int, char *argv);
-int myfunc(void)
-{
-	return ((int)main) + 1;
-}
-EOF
-			mylibtool=./libtool
-			mylibdir=/usr/local/lib
-			myok=yes
-			$mylibtool --quiet --tag=CC --mode=compile $CC $CFLAGS -o tmp.$$.lo -c tmp.$$.c >/dev/null 2>&1
-			if test $? = 0; then myok=yes; else myok=no; fi
-			if test "$myok" = "yes"; then
-			$mylibtool --quiet --tag=CC --mode=link $CC $CFLAGS -version-info 1:0:0 -no-undefined -export-symbols tmp.$$.def -o libtmp$$.la tmp.$$.lo $LDFLAGS -rpath $mylibdir $LIBS >/dev/null 2>&1
-				if test $? = 0; then myok=yes; else myok=no; fi
-			fi
-			if test "$myok" = "yes"; then
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-
-$as_echo "#define CAN_REFERENCE_MAIN 1" >>confdefs.h
-
-			else
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-			fi
-			$mylibtool --quiet --mode=clean rm -rf libtmp$$.la tmp.$$.lo
-			rm -f tmp.$$.def tmp.$$.c libtmp$$.la tmp.$$.lo tmp.$$.o
-
 		    fi
 
 fi
@@ -20156,7 +18752,7 @@ _ACEOF
 
 
 
-version=1.5.0
+version=1.5.1
 
 date=`date +'%b %e, %Y'`
 
@@ -20671,7 +19267,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.5.0, which was
+This file was extended by unbound $as_me 1.5.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -20737,7 +19333,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.5.0
+unbound config.status 1.5.1
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -21129,7 +19725,6 @@ fi
     RM='$RM'
     ofile='$ofile'
 
-ac_aux_dir='$ac_aux_dir'
 
 
 
diff --git a/configure.ac b/configure.ac
index 63a60b428a98..7e5da1a9f046 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10,7 +10,7 @@ sinclude(dnstap/dnstap.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[5])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MICRO],[1])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
@@ -57,6 +57,7 @@ LIBUNBOUND_AGE=3
 # 1.4.21 had 4:1:2
 # 1.4.22 had 4:1:2
 # 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
+# 1.5.1 had 5:4:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -1022,39 +1023,6 @@ if test "$USE_NSS" = "no"; then
 				AC_SEARCH_LIBS([clock_gettime], [rt])
 			;;
 			esac
-			# generate libtool to test if linking main
-			# from a dynamic library works.
-			LT_OUTPUT
-			AC_MSG_CHECKING([if dynamic lib can refer to main])
-			cat >tmp.$$.def <<EOF
-myfunc
-EOF
-			cat >tmp.$$.c <<EOF
-int myfunc(void);
-extern int main(int, char *argv[]);
-int myfunc(void)
-{
-	return ((int)main) + 1;
-}
-EOF
-			mylibtool=./libtool
-			mylibdir=/usr/local/lib
-			myok=yes
-			$mylibtool --quiet --tag=CC --mode=compile $CC $CFLAGS -o tmp.$$.lo -c tmp.$$.c >/dev/null 2>&1
-			if test $? = 0; then myok=yes; else myok=no; fi
-			if test "$myok" = "yes"; then
-			$mylibtool --quiet --tag=CC --mode=link $CC $CFLAGS -version-info 1:0:0 -no-undefined -export-symbols tmp.$$.def -o libtmp$$.la tmp.$$.lo $LDFLAGS -rpath $mylibdir $LIBS >/dev/null 2>&1
-				if test $? = 0; then myok=yes; else myok=no; fi
-			fi
-			if test "$myok" = "yes"; then
-				AC_MSG_RESULT(yes)
-				AC_DEFINE(CAN_REFERENCE_MAIN, [1], [define if a library can reference the 'main' symbol])
-			else
-				AC_MSG_RESULT(no)
-			fi
-			$mylibtool --quiet --mode=clean rm -rf libtmp$$.la tmp.$$.lo
-			rm -f tmp.$$.def tmp.$$.c libtmp$$.la tmp.$$.lo tmp.$$.o
-
 		    fi
 		])
 	fi
diff --git a/contrib/README b/contrib/README
index efbffbd0c565..49dee02e514b 100644
--- a/contrib/README
+++ b/contrib/README
@@ -25,4 +25,8 @@ distribution but may be helpful.
 * unbound_cache.cmd: windows script to save and load the cache.
 * warmup.sh: shell script to warm up DNS cache by your own MRU domains.
 * warmup.cmd: windows script to warm up DNS cache by your own MRU domains.
+* aaaa-filter-iterator.patch: adds config option aaaa-filter: yes that
+  works like the BIND feature (removes AAAA records unless AAAA-only domain).
+  Useful for certain 'broken IPv6 default route' scenarios.
+  Patch from Stephane Lapie for ASAHI Net.
 
diff --git a/contrib/aaaa-filter-iterator.patch b/contrib/aaaa-filter-iterator.patch
new file mode 100644
index 000000000000..8e03d7c99acb
--- /dev/null
+++ b/contrib/aaaa-filter-iterator.patch
@@ -0,0 +1,394 @@
+--- unbound-1.4.17.orig/doc/unbound.conf.5.in
++++ unbound-1.4.17/doc/unbound.conf.5.in
+@@ -519,6 +519,13 @@ authority servers and checks if the repl
+ Disabled by default. 
+ This feature is an experimental implementation of draft dns\-0x20.
+ .TP
++.B aaaa\-filter: \fI<yes or no>
++Activate behavior similar to BIND's AAAA-filter.
++This forces the dropping of all AAAA records, unless in the case of
++explicit AAAA queries, when no A records have been confirmed.
++This also causes an additional A query to be sent for each AAAA query.
++This breaks DNSSEC!
++.TP
+ .B private\-address: \fI<IP address or subnet>
+ Give IPv4 of IPv6 addresses or classless subnets. These are addresses
+ on your private network, and are not allowed to be returned for public
+--- unbound-1.4.17.orig/util/config_file.c
++++ unbound-1.4.17/util/config_file.c
+@@ -160,6 +160,7 @@ config_create(void)
+ 	cfg->harden_below_nxdomain = 0;
+ 	cfg->harden_referral_path = 0;
+ 	cfg->use_caps_bits_for_id = 0;
++	cfg->aaaa_filter = 0; /* ASN: default is disabled */
+ 	cfg->private_address = NULL;
+ 	cfg->private_domain = NULL;
+ 	cfg->unwanted_threshold = 0;
+--- unbound-1.4.17.orig/iterator/iter_scrub.c
++++ unbound-1.4.17/iterator/iter_scrub.c
+@@ -580,6 +580,32 @@ static int sanitize_nsec_is_overreach(st
+ }
+ 
+ /**
++ * ASN: Lookup A records from rrset cache.
++ * @param qinfo: the question originally asked.
++ * @param env: module environment with config and cache.
++ * @param ie: iterator environment with private address data.
++ * @return 0 if no A record found, 1 if A record found.
++ */
++static int
++asn_lookup_a_record_from_cache(struct query_info* qinfo,
++	struct module_env* env, struct iter_env* ie)
++{
++	struct ub_packed_rrset_key* akey;
++
++	/* get cached A records for queried name */
++	akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname,
++		qinfo->qname_len, LDNS_RR_TYPE_A, qinfo->qclass,
++		0, *env->now, 0);
++	if(akey) { /* we had some. */
++		log_rrset_key(VERB_ALGO, "ASN-AAAA-filter: found A record",
++			      akey);
++		lock_rw_unlock(&akey->entry.lock);
++		return 1;
++	}
++	return 0;
++}
++
++/**
+  * Given a response event, remove suspect RRsets from the response.
+  * "Suspect" rrsets are potentially poison. Note that this routine expects
+  * the response to be in a "normalized" state -- that is, all "irrelevant"
+@@ -598,6 +625,7 @@ scrub_sanitize(ldns_buffer* pkt, struct
+ 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
+ 	struct iter_env* ie)
+ {
++	int found_a_record = 0; /* ASN: do we have a A record? */
+ 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
+ 		do not trust the normalized additional-A-AAAA any more */
+ 	struct rrset_parse* rrset, *prev;
+@@ -633,6 +661,13 @@ scrub_sanitize(ldns_buffer* pkt, struct
+ 		rrset = rrset->rrset_all_next;
+ 	}
+ 
++	/* ASN: Locate any A record we can find */
++	if((ie->aaaa_filter) && (qinfo->qtype == LDNS_RR_TYPE_AAAA)) {
++		found_a_record = asn_lookup_a_record_from_cache(qinfo,
++			env, ie);
++	}
++	/* ASN: End of added code */
++
+ 	/* At this point, we brutally remove ALL rrsets that aren't 
+ 	 * children of the originating zone. The idea here is that, 
+ 	 * as far as we know, the server that we contacted is ONLY 
+@@ -644,6 +679,24 @@ scrub_sanitize(ldns_buffer* pkt, struct
+ 	rrset = msg->rrset_first;
+ 	while(rrset) {
+ 
++		/* ASN: For AAAA records only... */
++		if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) {
++			/* ASN: If this is not a AAAA query, then remove AAAA
++			 * records, no questions asked. If this IS a AAAA query
++			 * then remove AAAA records if we have an A record.
++			 * Otherwise, leave things be. */
++			if((qinfo->qtype != LDNS_RR_TYPE_AAAA) ||
++				(found_a_record)) {
++				remove_rrset("ASN-AAAA-filter: removing AAAA "
++					"for record", pkt, msg, prev, &rrset);
++				continue;
++			}
++			log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
++				"keep AAAA for", zonename,
++				LDNS_RR_TYPE_AAAA, qinfo->qclass);
++		}
++		/* ASN: End of added code */
++
+ 		/* remove private addresses */
+ 		if( (rrset->type == LDNS_RR_TYPE_A || 
+ 			rrset->type == LDNS_RR_TYPE_AAAA) &&
+--- unbound-1.4.17.orig/iterator/iterator.c
++++ unbound-1.4.17/iterator/iterator.c
+@@ -1579,6 +1579,53 @@ processDSNSFind(struct module_qstate* qs
+ 
+ 	return 0;
+ }
++
++/**
++ * ASN: This event state was added as an intermediary step between
++ * QUERYTARGETS_STATE and the next step, in order to cast a subquery for the
++ * purpose of caching A records for the queried name.
++ * 
++ * @param qstate: query state.
++ * @param iq: iterator query state.
++ * @param ie: iterator shared global environment.
++ * @param id: module id.
++ * @return true if the event requires more request processing immediately,
++ *         false if not. This state only returns true when it is generating
++ *         a SERVFAIL response because the query has hit a dead end.
++ */
++static int
++asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
++	struct iter_env* ie, int id)
++{
++	struct module_qstate* subq = NULL;
++
++	log_assert(iq->fetch_a_for_aaaa == 0);
++
++	/* flag the query properly in order to not loop */
++	iq->fetch_a_for_aaaa = 1;
++
++	/* re-throw same query, but with a different type */
++	if(!generate_sub_request(iq->qchase.qname,
++        	iq->qchase.qname_len, LDNS_RR_TYPE_A,
++		iq->qchase.qclass, qstate, id, iq,
++		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
++		log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: failed "
++			"preloading of A record for",
++			iq->qchase.qname, LDNS_RR_TYPE_A,
++			iq->qchase.qclass);
++		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
++	}
++	log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
++		"preloading records in cache for",
++		iq->qchase.qname, LDNS_RR_TYPE_A,
++		iq->qchase.qclass);
++
++	/* set this query as waiting */
++	qstate->ext_state[id] = module_wait_subquery;
++	/* at this point break loop */
++	return 0;
++}
++/* ASN: End of added code */
+ 	
+ /** 
+  * This is the request event state where the request will be sent to one of
+@@ -1626,6 +1673,13 @@ processQueryTargets(struct module_qstate
+ 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+ 	}
+ 	
++	/* ASN: If we have a AAAA query, then also query for A records */
++	if((ie->aaaa_filter) && (iq->qchase.qtype == LDNS_RR_TYPE_AAAA) &&
++		(iq->fetch_a_for_aaaa == 0)) {
++		return next_state(iq, ASN_FETCH_A_FOR_AAAA_STATE);
++	}
++	/* ASN: End of added code */
++
+ 	/* Make sure we have a delegation point, otherwise priming failed
+ 	 * or another failure occurred */
+ 	if(!iq->dp) {
+@@ -2568,6 +2622,62 @@ processFinished(struct module_qstate* qs
+ 	return 0;
+ }
+ 
++/** 
++ * ASN: Do final processing on responses to A queries originated from AAAA
++ * queries. Events reach this state after the iterative resolution algorithm
++ * terminates.
++ * This is required down the road to decide whether to scrub AAAA records
++ * from the results or not.
++ *
++ * @param qstate: query state.
++ * @param id: module id.
++ * @param forq: super query state.
++ */
++static void
++asn_processAAAAResponse(struct module_qstate* qstate, int id,
++	struct module_qstate* super)
++{
++	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
++	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
++	struct ub_packed_rrset_key* rrset;
++	struct delegpt_ns* dpns = NULL;
++	int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
++
++	log_assert(super_iq->fetch_a_for_aaaa > 0);
++
++	/* let super go to evaluation of targets after this */
++	super_iq->state = QUERYTARGETS_STATE;
++
++	log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse",
++		&qstate->qinfo);
++	log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse super",
++		&super->qinfo);
++
++	if(super_iq->dp)
++		dpns = delegpt_find_ns(super_iq->dp,
++			qstate->qinfo.qname, qstate->qinfo.qname_len);
++	if (!dpns) {
++		/* not interested */
++		verbose(VERB_ALGO, "ASN-AAAA-filter: subq: %s, but parent not "
++			"interested%s", (error ? "error, but" : "success"),
++			(super_iq->dp ? "anymore" : " (was reset)"));
++		log_query_info(VERB_ALGO, "ASN-AAAA-filter: superq", &super->qinfo);
++		if(super_iq->dp && error)
++			delegpt_log(VERB_ALGO, super_iq->dp);
++		return;
++	} else if (error) {
++		verbose(VERB_ALGO, "ASN-AAAA-filter: mark as failed, "
++			"and go to target query.");
++		/* see if the failure did get (parent-lame) info */
++		if(!cache_fill_missing(super->env,
++			super_iq->qchase.qclass, super->region,
++			super_iq->dp))
++		log_err("ASN-AAAA-filter: out of memory adding missing");
++		dpns->resolved = 1; /* mark as failed */
++	}
++}
++/* ASN: End of added code */
++
+ /*
+  * Return priming query results to interestes super querystates.
+  * 
+@@ -2587,6 +2697,9 @@ iter_inform_super(struct module_qstate*
+ 	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
+ 		super->minfo[id])->state == DSNS_FIND_STATE)
+ 		processDSNSResponse(qstate, id, super);
++	else if (super->qinfo.qtype == LDNS_RR_TYPE_AAAA && ((struct iter_qstate*)
++		super->minfo[id])->state == ASN_FETCH_A_FOR_AAAA_STATE)
++		asn_processAAAAResponse(qstate, id, super);
+ 	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
+ 		error_supers(qstate, id, super);
+ 	else if(qstate->is_priming)
+@@ -2624,6 +2737,9 @@ iter_handle(struct module_qstate* qstate
+ 			case INIT_REQUEST_3_STATE:
+ 				cont = processInitRequest3(qstate, iq, id);
+ 				break;
++			case ASN_FETCH_A_FOR_AAAA_STATE:
++				cont = asn_processQueryAAAA(qstate, iq, ie, id);
++				break;
+ 			case QUERYTARGETS_STATE:
+ 				cont = processQueryTargets(qstate, iq, ie, id);
+ 				break;
+@@ -2863,6 +2979,8 @@ iter_state_to_string(enum iter_state sta
+ 		return "INIT REQUEST STATE (stage 2)";
+ 	case INIT_REQUEST_3_STATE:
+ 		return "INIT REQUEST STATE (stage 3)";
++	case ASN_FETCH_A_FOR_AAAA_STATE:
++		return "ASN_FETCH_A_FOR_AAAA_STATE";
+ 	case QUERYTARGETS_STATE :
+ 		return "QUERY TARGETS STATE";
+ 	case PRIME_RESP_STATE :
+@@ -2887,6 +3005,7 @@ iter_state_is_responsestate(enum iter_st
+ 		case INIT_REQUEST_STATE :
+ 		case INIT_REQUEST_2_STATE :
+ 		case INIT_REQUEST_3_STATE :
++		case ASN_FETCH_A_FOR_AAAA_STATE :
+ 		case QUERYTARGETS_STATE :
+ 		case COLLECT_CLASS_STATE :
+ 			return 0;
+--- unbound-1.4.17.orig/iterator/iter_utils.c
++++ unbound-1.4.17/iterator/iter_utils.c
+@@ -128,6 +128,7 @@ iter_apply_cfg(struct iter_env* iter_env
+ 	}
+ 	iter_env->supports_ipv6 = cfg->do_ip6;
+ 	iter_env->supports_ipv4 = cfg->do_ip4;
++	iter_env->aaaa_filter = cfg->aaaa_filter;
+ 	return 1;
+ }
+ 
+--- unbound-1.4.17.orig/iterator/iterator.h
++++ unbound-1.4.17/iterator/iterator.h
+@@ -110,6 +110,9 @@ struct iter_env {
+ 	 * array of max_dependency_depth+1 size.
+ 	 */
+ 	int* target_fetch_policy;
++
++	/** ASN: AAAA-filter flag */
++	int aaaa_filter;
+ };
+ 
+ /**
+@@ -135,6 +138,14 @@ enum iter_state {
+ 	INIT_REQUEST_3_STATE,
+ 
+ 	/**
++	 * This state is responsible for intercepting AAAA queries,
++	 * and launch a A subquery on the same target, to populate the
++	 * cache with A records, so the AAAA filter scrubbing logic can
++	 * work.
++	 */
++	ASN_FETCH_A_FOR_AAAA_STATE,
++
++	/**
+ 	 * Each time a delegation point changes for a given query or a 
+ 	 * query times out and/or wakes up, this state is (re)visited. 
+ 	 * This state is reponsible for iterating through a list of 
+@@ -309,6 +320,13 @@ struct iter_qstate {
+ 	 */
+ 	int refetch_glue;
+ 
++	/**
++	 * ASN: This is a flag that, if true, means that this query is
++	 * for fetching A records to populate cache and determine if we must
++	 * return AAAA records or not.
++	 */
++	int fetch_a_for_aaaa;
++
+ 	/** list of pending queries to authoritative servers. */
+ 	struct outbound_list outlist;
+ };
+--- unbound-1.4.17.orig/util/config_file.h
++++ unbound-1.4.17/util/config_file.h
+@@ -169,6 +169,8 @@ struct config_file {
+ 	int harden_referral_path;
+ 	/** use 0x20 bits in query as random ID bits */
+ 	int use_caps_bits_for_id;
++	/** ASN: enable AAAA filter? */
++	int aaaa_filter;
+ 	/** strip away these private addrs from answers, no DNS Rebinding */
+ 	struct config_strlist* private_address;
+ 	/** allow domain (and subdomains) to use private address space */
+--- unbound-1.4.17.orig/util/configlexer.lex
++++ unbound-1.4.17/util/configlexer.lex
+@@ -177,6 +177,7 @@ harden-below-nxdomain{COLON}	{ YDVAR(1,
+ harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+ use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+ unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
++aaaa-filter{COLON}		{ YDVAR(1, VAR_AAAA_FILTER) }
+ private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
+ private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
+ prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
+--- unbound-1.4.17.orig/util/configparser.y
++++ unbound-1.4.17/util/configparser.y
+@@ -92,6 +92,7 @@ extern struct config_parser_state* cfg_p
+ %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
+ %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
+ %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
++%token VAR_AAAA_FILTER
+ %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
+ %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
+ %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
+@@ -151,6 +152,7 @@ content_server: server_num_threads | ser
+ 	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
+ 	server_harden_referral_path | server_private_address |
+ 	server_private_domain | server_extended_statistics | 
++	server_aaaa_filter |
+ 	server_local_data_ptr | server_jostle_timeout | 
+ 	server_unwanted_reply_threshold | server_log_time_ascii | 
+ 	server_domain_insecure | server_val_sig_skew_min | 
+@@ -802,6 +803,15 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR
+ 		free($2);
+ 	}
+ 	;
++server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
++	{
++		OUTYY(("P(server_aaaa_filter:%s)\n", $2));
++		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
++			yyerror("expected yes or no.");
++		else cfg_parser->cfg->aaaa_filter = (strcmp($2, "yes")==0);
++		free($2);
++	}
++	;
+ server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
+ 	{
+ 		OUTYY(("P(server_private_address:%s)\n", $2));
+--- unbound-1.4.17.orig/pythonmod/interface.i
++++ unbound-1.4.17/pythonmod/interface.i
+@@ -626,6 +626,7 @@ struct config_file {
+    int harden_dnssec_stripped;
+    int harden_referral_path;
+    int use_caps_bits_for_id;
++   int aaaa_filter; /* ASN */
+    struct config_strlist* private_address;
+    struct config_strlist* private_domain;
+    size_t unwanted_threshold;
diff --git a/daemon/cachedump.c b/daemon/cachedump.c
index cf5b1a12c9a7..20a46ae4dffb 100644
--- a/daemon/cachedump.c
+++ b/daemon/cachedump.c
@@ -664,7 +664,7 @@ load_msg(SSL* ssl, sldns_buffer* buf, struct worker* worker)
 	if(!go_on) 
 		return 1; /* skip this one, not all references satisfied */
 
-	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL)) {
+	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL, flags)) {
 		log_warn("error out of memory");
 		return 0;
 	}
diff --git a/daemon/remote.c b/daemon/remote.c
index 88ea063f21f8..ff3d769d4e54 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -854,7 +854,8 @@ print_ext(SSL* ssl, struct stats_info* s)
 
 	/* RCODE */
 	for(i=0; i<STATS_RCODE_NUM; i++) {
-		if(inhibit_zero && s->svr.ans_rcode[i] == 0)
+		/* Always include RCODEs 0-5 */
+		if(inhibit_zero && i > LDNS_RCODE_REFUSED && s->svr.ans_rcode[i] == 0)
 			continue;
 		lt = sldns_lookup_by_id(sldns_rcodes, i);
 		if(lt && lt->name) {
@@ -1094,8 +1095,13 @@ do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
 	k.qname_len = nmlen;
 	k.qtype = t;
 	k.qclass = c;
-	h = query_info_hash(&k);
+	h = query_info_hash(&k, 0);
 	slabhash_remove(worker->env.msg_cache, h, &k);
+	if(t == LDNS_RR_TYPE_AAAA) {
+		/* for AAAA also flush dns64 bit_cd packet */
+		h = query_info_hash(&k, BIT_CD);
+		slabhash_remove(worker->env.msg_cache, h, &k);
+	}
 }
 
 /** flush a type */
diff --git a/daemon/unbound.c b/daemon/unbound.c
index a53fe954db26..5ded5a964cc3 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -287,7 +287,7 @@ checkrlimits(struct config_file* cfg)
 #ifdef HAVE_SETRLIMIT
 		}
 #endif
-		log_warn("increased limit(open files) from %u to %u",
+		verbose(VERB_ALGO, "increased limit(open files) from %u to %u",
 			(unsigned)avail, (unsigned)total+10);
 	}
 #else	
diff --git a/daemon/worker.c b/daemon/worker.c
index f9067621385b..59ae9dfcefcb 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -935,7 +935,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			&repinfo->addr, repinfo->addrlen);
 		goto send_reply;
 	}
-	h = query_info_hash(&qinfo);
+	h = query_info_hash(&qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
 	if((e=slabhash_lookup(worker->env.msg_cache, h, &qinfo, 0))) {
 		/* answer from cache - we have acquired a readlock on it */
 		if(answer_from_cache(worker, &qinfo, 
diff --git a/dns64/dns64.c b/dns64/dns64.c
index 963e727fed76..eaaa26f7c910 100644
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -399,7 +399,7 @@ handle_ipv6_ptr(struct module_qstate* qstate, int id)
 
     /* Create the new sub-query. */
     fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0,
+    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0, 0,
                 &subq))
         return module_error;
     if (subq) {
@@ -451,7 +451,7 @@ generate_type_A_query(struct module_qstate* qstate, int id)
 	/* Start the sub-query. */
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
 	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0,
-				       &subq))
+				       0, &subq))
 	{
 		verbose(VERB_ALGO, "dns64: sub-query creation failed");
 		return module_error;
@@ -520,11 +520,13 @@ handle_event_moddone(struct module_qstate* qstate, int id)
      *
      *   - An internal query.
      *   - A query for a record type other than AAAA.
+     *   - CD FLAG was set on querier
      *   - An AAAA query for which an error was returned.
      *   - A successful AAAA query with an answer.
      */
 	if ( (enum dns64_qstate)qstate->minfo[id] == DNS64_INTERNAL_QUERY
             || qstate->qinfo.qtype != LDNS_RR_TYPE_AAAA
+	    || (qstate->query_flags & BIT_CD)
 	    || qstate->return_rcode != LDNS_RCODE_NOERROR  
 	    || (qstate->return_msg &&
 		    qstate->return_msg->rep &&
@@ -813,7 +815,7 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 
 	/* Store the generated response in cache. */
 	if (!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-	    0, 0, 0, NULL))
+	    0, 0, 0, NULL, super->query_flags))
 		log_err("out of memory");
 }
 
diff --git a/doc/Changelog b/doc/Changelog
index bd6f5456bb13..192b87c84129 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,9 +1,69 @@
+8 December 2014: Wouter
+	- Fix CVE-2014-8602: denial of service by making resolver chase
+	  endless series of delegations.
+
+1 December 2014: Wouter
+	- Fix bug#632: unbound fails to build on AArch64, protects
+	  getentropy compat code from calling sysctl if it is has been removed.
+
+29 November 2014: Wouter
+	- Add include to getentropy_linux.c, hopefully fixing debian build.
+
+28 November 2014: Wouter
+	- Fix makefile for build from noexec source tree.
+
+26 November 2014: Wouter
+	- Fix libunbound undefined symbol errors for main.
+	  Referencing main does not seem to be possible for libunbound.
+
+24 November 2014: Wouter
+	- Fix log at high verbosity and memory allocation failure.
+	- iana portlist update.
+
+21 November 2014: Wouter
+	- Fix crash on multiple thread random usage on systems without
+	  arc4random.
+
+20 November 2014: Wouter
+	- fix compat/getentropy_win.c check if CryptGenRandom works and no
+	  immediate exit on windows.
+
+19 November 2014: Wouter
+	- Fix cdflag dns64 processing.
+
+18 November 2014: Wouter
+	- Fix that CD flag disables DNS64 processing, returning the DNSSEC
+	  signed AAAA denial.
+	- iana portlist update.
+
+17 November 2014: Wouter
+	- Fix #627: SSL_CTX_load_verify_locations return code not properly
+	  checked.
+
+14 November 2014: Wouter
+	- parser with bison 2.7
+
+13 November 2014: Wouter
+	- Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter,
+	added to contrib/aaaa-filter-iterator.patch.
+
+12 November 2014: Wouter
+	- trunk has 1.5.1 in development.
+	- Patch from Robert Edmonds to build pyunbound python module
+	  differently.  No versioninfo, with -shared and without $(LIBS).
+	- Patch from Robert Edmonds fixes hyphens in unbound-anchor man page.
+	- Removed 'increased limit open files' log message that is written
+	  to console.  It is only written on verbosity 4 and higher.
+	  This keeps system bootup console cleaner.
+	- Patch from James Raftery, always print stats for rcodes 0..5.
+
 11 November 2014: Wouter
 	- iana portlist update.
 	- Fix bug where forward or stub addresses with same address but
 	  different port number were not tried.
 	- version number in svn trunk is 1.5.0
 	- tag 1.5.0rc1
+	- review fix from Ralph.
 
 7 November 2014: Wouter
 	- dnstap fixes by Robert Edmonds:
diff --git a/doc/README b/doc/README
index d194aa0058af..df92fccb5d36 100644
--- a/doc/README
+++ b/doc/README
@@ -1,4 +1,4 @@
-README for Unbound 1.5.0
+README for Unbound 1.5.1
 Copyright 2007 NLnet Labs
 http://unbound.net
 
diff --git a/doc/example.conf.in b/doc/example.conf.in
index 294be92d51a8..b95b3a6339c4 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.5.0.
+# See unbound.conf(5) man page, version 1.5.1.
 #
 # this is a comment.
 
diff --git a/doc/libunbound.3.in b/doc/libunbound.3.in
index 98abd28e2d41..55a9cb286e6e 100644
--- a/doc/libunbound.3.in
+++ b/doc/libunbound.3.in
@@ -1,4 +1,4 @@
-.TH "libunbound" "3" "Nov 18, 2014" "NLnet Labs" "unbound 1.5.0"
+.TH "libunbound" "3" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
 .\"
 .\" libunbound.3 -- unbound library functions manual
 .\"
@@ -42,7 +42,7 @@
 .B ub_ctx_zone_remove,
 .B ub_ctx_data_add,
 .B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.5.0 functions.
+\- Unbound DNS validating resolver 1.5.1 functions.
 .SH "SYNOPSIS"
 .B #include <unbound.h>
 .LP
diff --git a/doc/unbound-anchor.8.in b/doc/unbound-anchor.8.in
index 6036dd241f61..80a3438dcaac 100644
--- a/doc/unbound-anchor.8.in
+++ b/doc/unbound-anchor.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "Nov 18, 2014" "NLnet Labs" "unbound 1.5.0"
+.TH "unbound-anchor" "8" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
 .\"
 .\" unbound-anchor.8 -- unbound anchor maintenance utility manual
 .\"
@@ -24,14 +24,14 @@ Suggested usage:
 .nf
 	# in the init scripts.
 	# provide or update the root anchor (if necessary)
-	unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
+	unbound-anchor \-a "@UNBOUND_ROOTKEY_FILE@"
 	# Please note usage of this root anchor is at your own risk
 	# and under the terms of our LICENSE (see source).
 	#
 	# start validating resolver
 	# the unbound.conf contains:
 	#   auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
-	unbound -c unbound.conf
+	unbound \-c unbound.conf
 .fi
 .P
 This tool provides builtin default contents for the root anchor and root
@@ -138,7 +138,7 @@ tracking, or if an error occurred.
 .P
 You can check the exit value in this manner:
 .nf
-	unbound-anchor -a "root.key" || logger "Please check root.key"
+	unbound-anchor \-a "root.key" || logger "Please check root.key"
 .fi
 Or something more suitable for your operational environment.
 .SH "TRUST"
diff --git a/doc/unbound-checkconf.8.in b/doc/unbound-checkconf.8.in
index 6253729ccb25..5ab53480b6fe 100644
--- a/doc/unbound-checkconf.8.in
+++ b/doc/unbound-checkconf.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "Nov 18, 2014" "NLnet Labs" "unbound 1.5.0"
+.TH "unbound-checkconf" "8" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
diff --git a/doc/unbound-control.8.in b/doc/unbound-control.8.in
index bfe24c2ed1c9..92d2d1a9343d 100644
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "Nov 18, 2014" "NLnet Labs" "unbound 1.5.0"
+.TH "unbound-control" "8" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
 .\"
 .\" unbound-control.8 -- unbound remote control manual
 .\"
diff --git a/doc/unbound-host.1.in b/doc/unbound-host.1.in
index c2b047b3c0c9..d9e92bbe099a 100644
--- a/doc/unbound-host.1.in
+++ b/doc/unbound-host.1.in
@@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "Nov 18, 2014" "NLnet Labs" "unbound 1.5.0"
+.TH "unbound\-host" "1" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
 .\"
 .\" unbound-host.1 -- unbound DNS lookup utility
 .\"
diff --git a/doc/unbound.8.in b/doc/unbound.8.in
index 27e54d6e5153..3b74a3242ada 100644
--- a/doc/unbound.8.in
+++ b/doc/unbound.8.in
@@ -1,4 +1,4 @@
-.TH "unbound" "8" "Nov 18, 2014" "NLnet Labs" "unbound 1.5.0"
+.TH "unbound" "8" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -9,7 +9,7 @@
 .\"
 .SH "NAME"
 .B unbound
-\- Unbound DNS validating resolver 1.5.0.
+\- Unbound DNS validating resolver 1.5.1.
 .SH "SYNOPSIS"
 .B unbound
 .RB [ \-h ]
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index cd0af718fb94..f08a01b31844 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "Nov 18, 2014" "NLnet Labs" "unbound 1.5.0"
+.TH "unbound.conf" "5" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
index 4148c1268f78..9d0aa698f996 100644
--- a/iterator/iter_utils.c
+++ b/iterator/iter_utils.c
@@ -425,10 +425,10 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
 void 
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
 	struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-	struct regional* region)
+	struct regional* region, uint16_t flags)
 {
 	if(!dns_cache_store(env, msgqinf, msgrep, is_referral, leeway,
-		pside, region))
+		pside, region, flags))
 		log_err("out of memory: cannot store data in cache");
 }
 
@@ -457,7 +457,8 @@ causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
 	fptr_ok(fptr_whitelist_modenv_detect_cycle(
 		qstate->env->detect_cycle));
 	return (*qstate->env->detect_cycle)(qstate, &qinf, 
-		(uint16_t)(BIT_RD|BIT_CD), qstate->is_priming);
+		(uint16_t)(BIT_RD|BIT_CD), qstate->is_priming,
+		qstate->is_valrec);
 }
 
 void 
diff --git a/iterator/iter_utils.h b/iterator/iter_utils.h
index abdc68f3cd44..d7c2b68afa2d 100644
--- a/iterator/iter_utils.h
+++ b/iterator/iter_utils.h
@@ -124,6 +124,7 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
  * @param pside: true if dp is parentside, thus message is 'fresh' and NS
  * 	can be prefetch-updates.
  * @param region: to copy modified (cache is better) rrs back to.
+ * @param flags: with BIT_CD for dns64 AAAA translated queries.
  * @return void, because we are not interested in alloc errors,
  * 	the iterator and validator can operate on the results in their
  * 	scratch space (the qstate.region) and are not dependent on the cache.
@@ -132,7 +133,7 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
  */
 void iter_dns_store(struct module_env* env, struct query_info* qinf,
 	struct reply_info* rep, int is_referral, time_t leeway, int pside,
-	struct regional* region);
+	struct regional* region, uint16_t flags);
 
 /**
  * Select randomly with n/m probability.
diff --git a/iterator/iterator.c b/iterator/iterator.c
index df5f645cc28c..6e05c99a0e95 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -120,6 +120,7 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->query_restart_count = 0;
 	iq->referral_count = 0;
 	iq->sent_count = 0;
+	iq->target_count = NULL;
 	iq->wait_priming_stub = 0;
 	iq->refetch_glue = 0;
 	iq->dnssec_expected = 0;
@@ -257,7 +258,7 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 		verbose(VERB_ALGO, "error response for prefetch in cache");
 		/* attempt to adjust the cache entry prefetch */
 		if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo,
-			NORR_TTL))
+			NORR_TTL, qstate->query_flags))
 			return error_response(qstate, id, rcode);
 		/* if that fails (not in cache), fall through to store err */
 	}
@@ -270,7 +271,8 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 	/* do not waste time trying to validate this servfail */
 	err.security = sec_status_indeterminate;
 	verbose(VERB_ALGO, "store error response in message cache");
-	iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL);
+	iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
+		qstate->query_flags);
 	return error_response(qstate, id, rcode);
 }
 
@@ -453,6 +455,26 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 1;
 }
 
+/** create target count structure for this query */
+static void
+target_count_create(struct iter_qstate* iq)
+{
+	if(!iq->target_count) {
+		iq->target_count = (int*)calloc(2, sizeof(int));
+		/* if calloc fails we simply do not track this number */
+		if(iq->target_count)
+			iq->target_count[0] = 1;
+	}
+}
+
+static void
+target_count_increase(struct iter_qstate* iq, int num)
+{
+	target_count_create(iq);
+	if(iq->target_count)
+		iq->target_count[1] += num;
+}
+
 /**
  * Generate a subrequest.
  * Generate a local request event. Local events are tied to this module, and
@@ -486,6 +508,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	uint16_t qflags = 0; /* OPCODE QUERY, no flags */
 	struct query_info qinf;
 	int prime = (finalstate == PRIME_RESP_STATE)?1:0;
+	int valrec = 0;
 	qinf.qname = qname;
 	qinf.qname_len = qnamelen;
 	qinf.qtype = qtype;
@@ -499,12 +522,15 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	 * the resolution chain, which might have a validator. We are 
 	 * uninterested in validating things not on the direct resolution 
 	 * path.  */
-	if(!v)
+	if(!v) {
 		qflags |= BIT_CD;
+		valrec = 1;
+	}
 	
 	/* attach subquery, lookup existing or make a new one */
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, &subq)) {
+	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, valrec,
+		&subq)) {
 		return 0;
 	}
 	*subq_ret = subq;
@@ -524,6 +550,10 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq = (struct iter_qstate*)subq->minfo[id];
 		memset(subiq, 0, sizeof(*subiq));
 		subiq->num_target_queries = 0;
+		target_count_create(iq);
+		subiq->target_count = iq->target_count;
+		if(iq->target_count)
+			iq->target_count[0] ++; /* extra reference */
 		subiq->num_current_queries = 0;
 		subiq->depth = iq->depth+1;
 		outbound_list_init(&subiq->outlist);
@@ -938,7 +968,8 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	} else {
 		msg = dns_cache_lookup(qstate->env, iq->qchase.qname, 
 			iq->qchase.qname_len, iq->qchase.qtype, 
-			iq->qchase.qclass, qstate->region, qstate->env->scratch);
+			iq->qchase.qclass, qstate->query_flags,
+			qstate->region, qstate->env->scratch);
 		if(!msg && qstate->env->neg_cache) {
 			/* lookup in negative cache; may result in 
 			 * NOERROR/NODATA or NXDOMAIN answers that need validation */
@@ -1350,6 +1381,12 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	if(iq->depth == ie->max_dependency_depth)
 		return 0;
+	if(iq->depth > 0 && iq->target_count &&
+		iq->target_count[1] > MAX_TARGET_COUNT) {
+		verbose(VERB_QUERY, "request has exceeded the maximum "
+			"number of glue fetches %d", iq->target_count[1]);
+		return 0;
+	}
 
 	iter_mark_cycle_targets(qstate, iq->dp);
 	missing = (int)delegpt_count_missing_targets(iq->dp);
@@ -1532,6 +1569,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += qs;
+		target_count_increase(iq, qs);
 		if(qs != 0) {
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0; /* and wait for them */
@@ -1541,6 +1579,12 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "maxdepth and need more nameservers, fail");
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
+	if(iq->depth > 0 && iq->target_count &&
+		iq->target_count[1] > MAX_TARGET_COUNT) {
+		verbose(VERB_QUERY, "request has exceeded the maximum "
+			"number of glue fetches %d", iq->target_count[1]);
+		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
+	}
 	/* mark cycle targets for parent-side lookups */
 	iter_mark_pside_cycle_targets(qstate, iq->dp);
 	/* see if we can issue queries to get nameserver addresses */
@@ -1570,6 +1614,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(query_count != 0) { /* suspend to await results */
 			verbose(VERB_ALGO, "try parent-side glue lookup");
 			iq->num_target_queries += query_count;
+			target_count_increase(iq, query_count);
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0;
 		}
@@ -1725,6 +1770,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += extra;
+		target_count_increase(iq, extra);
 		if(iq->num_target_queries > 0) {
 			/* wait to get all targets, we want to try em */
 			verbose(VERB_ALGO, "wait for all targets for fallback");
@@ -1765,6 +1811,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* errors ignored, these targets are not strictly necessary for
 		 * this result, we do not have to reply with SERVFAIL */
 		iq->num_target_queries += extra;
+		target_count_increase(iq, extra);
 	}
 
 	/* Add the current set of unused targets to our queue. */
@@ -1810,6 +1857,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 					return 1;
 				}
 				iq->num_target_queries += qs;
+				target_count_increase(iq, qs);
 			}
 			/* Since a target query might have been made, we 
 			 * need to check again. */
@@ -1991,7 +2039,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		iter_dns_store(qstate->env, &iq->response->qinfo,
 			iq->response->rep, 0, qstate->prefetch_leeway,
 			iq->dp&&iq->dp->has_parent_side_NS,
-			qstate->region);
+			qstate->region, qstate->query_flags);
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
@@ -2029,7 +2077,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* Store the referral under the current query */
 			/* no prefetch-leeway, since its not the answer */
 			iter_dns_store(qstate->env, &iq->response->qinfo,
-				iq->response->rep, 1, 0, 0, NULL);
+				iq->response->rep, 1, 0, 0, NULL, 0);
 			if(iq->store_parent_NS)
 				iter_store_parentside_NS(qstate->env, 
 					iq->response->rep);
@@ -2128,7 +2176,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* prefetchleeway applied because this updates answer parts */
 		iter_dns_store(qstate->env, &iq->response->qinfo,
 			iq->response->rep, 1, qstate->prefetch_leeway,
-			iq->dp&&iq->dp->has_parent_side_NS, NULL);
+			iq->dp&&iq->dp->has_parent_side_NS, NULL,
+			qstate->query_flags);
 		/* set the current request's qname to the new value. */
 		iq->qchase.qname = sname;
 		iq->qchase.qname_len = snamelen;
@@ -2209,7 +2258,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 }
 
 /**
- * Return priming query results to interestes super querystates.
+ * Return priming query results to interested super querystates.
  * 
  * Sets the delegation point and delegation message (not nonRD queries).
  * This is a callback from walk_supers.
@@ -2640,7 +2689,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 			iter_dns_store(qstate->env, &qstate->qinfo, 
 				iq->response->rep, 0, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS,
-				qstate->region);
+				qstate->region, qstate->query_flags);
 		}
 	}
 	qstate->return_rcode = LDNS_RCODE_NOERROR;
@@ -2921,6 +2970,8 @@ iter_clear(struct module_qstate* qstate, int id)
 	iq = (struct iter_qstate*)qstate->minfo[id];
 	if(iq) {
 		outbound_list_clear(&iq->outlist);
+		if(iq->target_count && --iq->target_count[0] == 0)
+			free(iq->target_count);
 		iq->num_current_queries = 0;
 	}
 	qstate->minfo[id] = NULL;
diff --git a/iterator/iterator.h b/iterator/iterator.h
index 0b91760d4a49..1364b86d722b 100644
--- a/iterator/iterator.h
+++ b/iterator/iterator.h
@@ -52,6 +52,8 @@ struct iter_donotq;
 struct iter_prep_list;
 struct iter_priv;
 
+/** max number of targets spawned for a query and its subqueries */
+#define MAX_TARGET_COUNT	32
 /** max number of query restarts. Determines max number of CNAME chain. */
 #define MAX_RESTART_COUNT       8
 /** max number of referrals. Makes sure resolver does not run away */
@@ -251,6 +253,10 @@ struct iter_qstate {
 
 	/** number of queries fired off */
 	int sent_count;
+	
+	/** number of target queries spawned in [1], for this query and its
+	 * subqueries, the malloced-array is shared, [0] refcount. */
+	int* target_count;
 
 	/**
 	 * The query must store NS records from referrals as parentside RRs
diff --git a/libunbound/unbound.h b/libunbound/unbound.h
index 567f48271e3e..fe903d0c51d4 100644
--- a/libunbound/unbound.h
+++ b/libunbound/unbound.h
@@ -357,7 +357,7 @@ int ub_ctx_add_ta(struct ub_ctx* ctx, const char* ta);
 int ub_ctx_add_ta_file(struct ub_ctx* ctx, const char* fname);
 
 /**
- * Add trust anchor to the give context that is tracked with RFC5011
+ * Add trust anchor to the given context that is tracked with RFC5011
  * automated trust anchor maintenance.  The file is written to when the
  * trust anchor is changed.
  * Pass the name of a file that was output from eg. unbound-anchor,
diff --git a/pythonmod/pythonmod_utils.c b/pythonmod/pythonmod_utils.c
index 2f3848008e27..1091dcf10727 100644
--- a/pythonmod/pythonmod_utils.c
+++ b/pythonmod/pythonmod_utils.c
@@ -67,7 +67,7 @@ int storeQueryInCache(struct module_qstate* qstate, struct query_info* qinfo, st
     }
 
     return dns_cache_store(qstate->env, qinfo, msgrep, is_referral, 
-	qstate->prefetch_leeway, 0, NULL);
+	qstate->prefetch_leeway, 0, NULL, qstate->query_flags);
 }
 
 /*  Invalidate the message associated with query_info stored in message cache */
@@ -78,7 +78,7 @@ void invalidateQueryInCache(struct module_qstate* qstate, struct query_info* qin
     struct reply_info *r;
     size_t i, j;
 
-    h = query_info_hash(qinfo);
+    h = query_info_hash(qinfo, qstate->query_flags);
     if ((e=slabhash_lookup(qstate->env->msg_cache, h, qinfo, 0))) 
     {
 	r = (struct reply_info*)(e->data);
diff --git a/services/cache/dns.c b/services/cache/dns.c
index c663b8e8b9a2..4692744a15dd 100644
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -184,7 +184,7 @@ addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 /** lookup message in message cache */
 static struct msgreply_entry* 
 msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen, 
-	uint16_t qtype, uint16_t qclass, time_t now, int wr)
+	uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
 {
 	struct lruhash_entry* e;
 	struct query_info k;
@@ -194,7 +194,7 @@ msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
 	k.qname_len = qnamelen;
 	k.qtype = qtype;
 	k.qclass = qclass;
-	h = query_info_hash(&k);
+	h = query_info_hash(&k, flags);
 	e = slabhash_lookup(env->msg_cache, h, &k, wr);
 
 	if(!e) return NULL;
@@ -226,8 +226,10 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 				addr_to_additional(akey, region, *msg, now);
 			lock_rw_unlock(&akey->entry.lock);
 		} else {
+			/* BIT_CD on false because delegpt lookup does
+			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
-				LDNS_RR_TYPE_A, qclass, now, 0);
+				LDNS_RR_TYPE_A, qclass, 0, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -244,8 +246,10 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 				addr_to_additional(akey, region, *msg, now);
 			lock_rw_unlock(&akey->entry.lock);
 		} else {
+			/* BIT_CD on false because delegpt lookup does
+			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
-				LDNS_RR_TYPE_AAAA, qclass, now, 0);
+				LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -276,8 +280,10 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 				ns->name, LDNS_RR_TYPE_A, qclass);
 			lock_rw_unlock(&akey->entry.lock);
 		} else {
+			/* BIT_CD on false because delegpt lookup does
+			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
-				LDNS_RR_TYPE_A, qclass, now, 0);
+				LDNS_RR_TYPE_A, qclass, 0, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -294,8 +300,10 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 				ns->name, LDNS_RR_TYPE_AAAA, qclass);
 			lock_rw_unlock(&akey->entry.lock);
 		} else {
+			/* BIT_CD on false because delegpt lookup does
+			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
-				LDNS_RR_TYPE_AAAA, qclass, now, 0);
+				LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -626,7 +634,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 struct dns_msg* 
 dns_cache_lookup(struct module_env* env,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	struct regional* region, struct regional* scratch)
+	uint16_t flags, struct regional* region, struct regional* scratch)
 {
 	struct lruhash_entry* e;
 	struct query_info k;
@@ -639,7 +647,7 @@ dns_cache_lookup(struct module_env* env,
 	k.qname_len = qnamelen;
 	k.qtype = qtype;
 	k.qclass = qclass;
-	h = query_info_hash(&k);
+	h = query_info_hash(&k, flags);
 	e = slabhash_lookup(env->msg_cache, h, &k, 0);
 	if(e) {
 		struct msgreply_entry* key = (struct msgreply_entry*)e->key;
@@ -716,7 +724,7 @@ dns_cache_lookup(struct module_env* env,
 	if(env->cfg->harden_below_nxdomain)
 	    while(!dname_is_root(k.qname)) {
 		dname_remove_label(&k.qname, &k.qname_len);
-		h = query_info_hash(&k);
+		h = query_info_hash(&k, flags);
 		e = slabhash_lookup(env->msg_cache, h, &k, 0);
 		if(e) {
 			struct reply_info* data = (struct reply_info*)e->data;
@@ -741,7 +749,7 @@ dns_cache_lookup(struct module_env* env,
 int 
 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
         struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-	struct regional* region)
+	struct regional* region, uint16_t flags)
 {
 	struct reply_info* rep = NULL;
 	/* alloc, malloc properly (not in region, like msg is) */
@@ -786,7 +794,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 		 * Not AA from cache. Not CD in cache (depends on client bit). */
 		rep->flags |= (BIT_RA | BIT_QR);
 		rep->flags &= ~(BIT_AA | BIT_CD);
-		h = query_info_hash(&qinf);
+		h = query_info_hash(&qinf, flags);
 		dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
 			region);
 		/* qname is used inside query_info_entrysetup, and set to 
@@ -798,11 +806,11 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 
 int 
 dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
-        time_t adjust)
+        time_t adjust, uint16_t flags)
 {
 	struct msgreply_entry* msg;
 	msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
-		qinfo->qtype, qinfo->qclass, *env->now, 1);
+		qinfo->qtype, qinfo->qclass, flags, *env->now, 1);
 	if(msg) {
 		struct reply_info* rep = (struct reply_info*)msg->entry.data;
 		if(rep) {
diff --git a/services/cache/dns.h b/services/cache/dns.h
index 05a3e6296543..69796c2eb204 100644
--- a/services/cache/dns.h
+++ b/services/cache/dns.h
@@ -79,11 +79,12 @@ struct dns_msg {
  * 	can be updated to full TTL even in prefetch situations.
  * @param region: region to allocate better entries from cache into.
  *   (used when is_referral is false).
+ * @param flags: flags with BIT_CD for AAAA queries in dns64 translation.
  * @return 0 on alloc error (out of memory).
  */
 int dns_cache_store(struct module_env* env, struct query_info* qinf,
         struct reply_info* rep, int is_referral, time_t leeway, int pside,
-	struct regional* region); 
+	struct regional* region, uint16_t flags); 
 
 /**
  * Store message in the cache. Stores in message cache and rrset cache.
@@ -132,6 +133,7 @@ struct delegpt* dns_cache_find_delegation(struct module_env* env,
  * @param qnamelen: length of qname.
  * @param qtype: query type.
  * @param qclass: query class.
+ * @param flags: flags with BIT_CD for AAAA queries in dns64 translation.
  * @param region: where to allocate result.
  * @param scratch: where to allocate temporary data.
  * @return new response message (alloced in region, rrsets do not have IDs).
@@ -140,7 +142,7 @@ struct delegpt* dns_cache_find_delegation(struct module_env* env,
  */
 struct dns_msg* dns_cache_lookup(struct module_env* env,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	struct regional* region, struct regional* scratch);
+	uint16_t flags, struct regional* region, struct regional* scratch);
 
 /** 
  * find and add A and AAAA records for missing nameservers in delegpt 
@@ -186,9 +188,10 @@ int dns_msg_authadd(struct dns_msg* msg, struct regional* region,
  * @param env: module environment with caches and time.
  * @param qinfo: query info for the query that needs adjustment.
  * @param adjust: time in seconds to add to the prefetch_leeway.
+ * @param flags: flags with BIT_CD for AAAA queries in dns64 translation.
  * @return false if not in cache. true if added.
  */
 int dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
-        time_t adjust);
+        time_t adjust, uint16_t flags);
 
 #endif /* SERVICES_CACHE_DNS_H */
diff --git a/services/mesh.c b/services/mesh.c
index bc711d9b3ed6..a69aced223e3 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -132,6 +132,11 @@ mesh_state_compare(const void* ap, const void* bp)
 	if(!a->s.is_priming && b->s.is_priming)
 		return 1;
 
+	if(a->s.is_valrec && !b->s.is_valrec)
+		return -1;
+	if(!a->s.is_valrec && b->s.is_valrec)
+		return 1;
+
 	if((a->s.query_flags&BIT_RD) && !(b->s.query_flags&BIT_RD))
 		return -1;
 	if(!(a->s.query_flags&BIT_RD) && (b->s.query_flags&BIT_RD))
@@ -277,11 +282,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
         uint16_t qflags, struct edns_data* edns, struct comm_reply* rep,
         uint16_t qid)
 {
-	/* do not use CD flag from user for mesh state, we want the CD-query
-	 * to receive validation anyway, to protect out cache contents and
-	 * avoid bad-data in this cache that a downstream validator cannot
-	 * remove from this cache */
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -311,7 +312,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 #ifdef UNBOUND_DEBUG
 		struct rbnode_t* n;
 #endif
-		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
@@ -375,7 +376,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, sldns_buffer* buf, 
 	uint16_t qid, mesh_cb_func_t cb, void* cb_arg)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -386,7 +387,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 #ifdef UNBOUND_DEBUG
 		struct rbnode_t* n;
 #endif
-		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 		if(!s) {
 			return 0;
 		}
@@ -428,7 +429,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
         uint16_t qflags, time_t leeway)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 #ifdef UNBOUND_DEBUG
 	struct rbnode_t* n;
 #endif
@@ -447,7 +448,7 @@ void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
 		mesh->stats_dropped ++;
 		return;
 	}
-	s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
+	s = mesh_state_create(mesh->env, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 	if(!s) {
 		log_err("prefetch mesh_state_create: out of memory");
 		return;
@@ -496,7 +497,7 @@ void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
 
 struct mesh_state* 
 mesh_state_create(struct module_env* env, struct query_info* qinfo, 
-	uint16_t qflags, int prime)
+	uint16_t qflags, int prime, int valrec)
 {
 	struct regional* region = alloc_reg_obtain(env->alloc);
 	struct mesh_state* mstate;
@@ -533,6 +534,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	/* remove all weird bits from qflags */
 	mstate->s.query_flags = (qflags & (BIT_RD|BIT_CD));
 	mstate->s.is_priming = prime;
+	mstate->s.is_valrec = valrec;
 	mstate->s.reply = NULL;
 	mstate->s.region = region;
 	mstate->s.curmod = 0;
@@ -679,11 +681,12 @@ void mesh_detach_subs(struct module_qstate* qstate)
 }
 
 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, struct module_qstate** newq)
+        uint16_t qflags, int prime, int valrec, struct module_qstate** newq)
 {
 	/* find it, if not, create it */
 	struct mesh_area* mesh = qstate->env->mesh;
-	struct mesh_state* sub = mesh_area_find(mesh, qinfo, qflags, prime);
+	struct mesh_state* sub = mesh_area_find(mesh, qinfo, qflags, prime,
+		valrec);
 	int was_detached;
 	if(mesh_detect_cycle_found(qstate, sub)) {
 		verbose(VERB_ALGO, "attach failed, cycle detected");
@@ -694,7 +697,8 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
 		struct rbnode_t* n;
 #endif
 		/* create a new one */
-		sub = mesh_state_create(qstate->env, qinfo, qflags, prime);
+		sub = mesh_state_create(qstate->env, qinfo, qflags, prime,
+			valrec);
 		if(!sub) {
 			log_err("mesh_attach_sub: out of memory");
 			return 0;
@@ -941,13 +945,14 @@ void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate)
 }
 
 struct mesh_state* mesh_area_find(struct mesh_area* mesh,
-	struct query_info* qinfo, uint16_t qflags, int prime)
+	struct query_info* qinfo, uint16_t qflags, int prime, int valrec)
 {
 	struct mesh_state key;
 	struct mesh_state* result;
 
 	key.node.key = &key;
 	key.s.is_priming = prime;
+	key.s.is_valrec = valrec;
 	key.s.qinfo = *qinfo;
 	key.s.query_flags = qflags;
 	
@@ -1107,8 +1112,9 @@ mesh_log_list(struct mesh_area* mesh)
 	struct mesh_state* m;
 	int num = 0;
 	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
-		snprintf(buf, sizeof(buf), "%d%s%s%s%s%s mod%d %s%s", 
+		snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s", 
 			num++, (m->s.is_priming)?"p":"",  /* prime */
+			(m->s.is_valrec)?"v":"",  /* prime */
 			(m->s.query_flags&BIT_RD)?"RD":"",
 			(m->s.query_flags&BIT_CD)?"CD":"",
 			(m->super_set.count==0)?"d":"", /* detached */
@@ -1178,10 +1184,11 @@ mesh_get_mem(struct mesh_area* mesh)
 
 int 
 mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
-	uint16_t flags, int prime)
+	uint16_t flags, int prime, int valrec)
 {
 	struct mesh_area* mesh = qstate->env->mesh;
-	struct mesh_state* dep_m = mesh_area_find(mesh, qinfo, flags, prime);
+	struct mesh_state* dep_m = mesh_area_find(mesh, qinfo, flags, prime,
+		valrec);
 	return mesh_detect_cycle_found(qstate, dep_m);
 }
 
diff --git a/services/mesh.h b/services/mesh.h
index fbfbbcb4a94b..086e39094e8f 100644
--- a/services/mesh.h
+++ b/services/mesh.h
@@ -353,12 +353,13 @@ void mesh_detach_subs(struct module_qstate* qstate);
  * @param qinfo: what to query for (copied).
  * @param qflags: what flags to use (RD / CD flag or not).
  * @param prime: if it is a (stub) priming query.
+ * @param valrec: if it is a validation recursion query (lookup of key, DS).
  * @param newq: If the new subquery needs initialisation, it is returned,
  * 	otherwise NULL is returned.
  * @return: false on error, true if success (and init may be needed).
  */
 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-	uint16_t qflags, int prime, struct module_qstate** newq);
+	uint16_t qflags, int prime, int valrec, struct module_qstate** newq);
 
 /**
  * Query state is done, send messages to reply entries.
@@ -406,10 +407,12 @@ void mesh_state_delete(struct module_qstate* qstate);
  * @param qinfo: query info that the mesh is for.
  * @param qflags: flags for query (RD / CD flag).
  * @param prime: if true, it is a priming query, set is_priming on mesh state.
+ * @param valrec: if true, it is a validation recursion query, and sets
+ * 	is_valrec on the mesh state.
  * @return: new mesh state or NULL on allocation error.
  */
 struct mesh_state* mesh_state_create(struct module_env* env, 
-	struct query_info* qinfo, uint16_t qflags, int prime);
+	struct query_info* qinfo, uint16_t qflags, int prime, int valrec);
 
 /**
  * Cleanup a mesh state and its query state. Does not do rbtree or 
@@ -432,10 +435,11 @@ void mesh_delete_all(struct mesh_area* mesh);
  * @param qinfo: what query
  * @param qflags: if RD / CD bit is set or not.
  * @param prime: if it is a priming query.
+ * @param valrec: if it is a validation-recursion query.
  * @return: mesh state or NULL if not found.
  */
 struct mesh_state* mesh_area_find(struct mesh_area* mesh, 
-	struct query_info* qinfo, uint16_t qflags, int prime);
+	struct query_info* qinfo, uint16_t qflags, int prime, int valrec);
 
 /**
  * Setup attachment super/sub relation between super and sub mesh state.
@@ -523,13 +527,14 @@ size_t mesh_get_mem(struct mesh_area* mesh);
  * @param qinfo: query info for dependency.
  * @param flags: query flags of dependency.
  * @param prime: if dependency is a priming query or not.
+ * @param valrec: if it is a validation recursion query (lookup of key, DS).
  * @return true if the name,type,class exists and the given qstate mesh exists
  * 	as a dependency of that name. Thus if qstate becomes dependent on
  * 	name,type,class then a cycle is created, this is return value 1.
  * 	Too large to search is value 2 (also true).
  */
 int mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
-	uint16_t flags, int prime);
+	uint16_t flags, int prime, int valrec);
 
 /** compare two mesh_states */
 int mesh_state_compare(const void* ap, const void* bp);
diff --git a/smallapp/unbound-host.c b/smallapp/unbound-host.c
index 8020ad8c8023..95973410924f 100644
--- a/smallapp/unbound-host.c
+++ b/smallapp/unbound-host.c
@@ -409,7 +409,7 @@ extern int optind;
 /** getopt global, in case header files fail to declare it. */
 extern char* optarg;
 
-/** Main routine for checkconf */
+/** Main routine for unbound-host */
 int main(int argc, char* argv[])
 {
 	int c;
diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index 126e7bef45b7..68bcfd09ee39 100644
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -576,10 +576,12 @@ reply_info_delete(void* d, void* ATTR_UNUSED(arg))
 }
 
 hashvalue_t 
-query_info_hash(struct query_info *q)
+query_info_hash(struct query_info *q, uint16_t flags)
 {
 	hashvalue_t h = 0xab;
 	h = hashlittle(&q->qtype, sizeof(q->qtype), h);
+	if(q->qtype == LDNS_RR_TYPE_AAAA && (flags&BIT_CD))
+		h++;
 	h = hashlittle(&q->qclass, sizeof(q->qclass), h);
 	h = dname_query_hash(q->qname, h);
 	return h;
@@ -771,15 +773,14 @@ log_dns_msg(const char* str, struct query_info* qinfo, struct reply_info* rep)
 		region, 65535, 1)) {
 		log_info("%s: log_dns_msg: out of memory", str);
 	} else {
-		char* str = sldns_wire2str_pkt(sldns_buffer_begin(buf),
+		char* s = sldns_wire2str_pkt(sldns_buffer_begin(buf),
 			sldns_buffer_limit(buf));
-		if(!str) {
+		if(!s) {
 			log_info("%s: log_dns_msg: ldns tostr failed", str);
 		} else {
-			log_info("%s %s", 
-				str, (char*)sldns_buffer_begin(buf));
+			log_info("%s %s", str, s);
 		}
-		free(str);
+		free(s);
 	}
 	sldns_buffer_free(buf);
 	regional_destroy(region);
diff --git a/util/data/msgreply.h b/util/data/msgreply.h
index ccbd0d748381..e8d6d762e01a 100644
--- a/util/data/msgreply.h
+++ b/util/data/msgreply.h
@@ -305,8 +305,9 @@ void query_entry_delete(void *q, void* arg);
 /** delete reply_info data structure */
 void reply_info_delete(void* d, void* arg);
 
-/** calculate hash value of query_info, lowercases the qname */
-hashvalue_t query_info_hash(struct query_info *q);
+/** calculate hash value of query_info, lowercases the qname,
+ * uses CD flag for AAAA qtype */
+hashvalue_t query_info_hash(struct query_info *q, uint16_t flags);
 
 /**
  * Setup query info entry
diff --git a/util/fptr_wlist.c b/util/fptr_wlist.c
index 3a5fc5f0611a..5a77432c775e 100644
--- a/util/fptr_wlist.c
+++ b/util/fptr_wlist.c
@@ -280,7 +280,7 @@ fptr_whitelist_modenv_detach_subs(void (*fptr)(
 int 
 fptr_whitelist_modenv_attach_sub(int (*fptr)(
         struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, struct module_qstate** newq))
+        uint16_t qflags, int prime, int valrec, struct module_qstate** newq))
 {
 	if(fptr == &mesh_attach_sub) return 1;
 	return 0;
@@ -296,7 +296,7 @@ fptr_whitelist_modenv_kill_sub(void (*fptr)(struct module_qstate* newq))
 int 
 fptr_whitelist_modenv_detect_cycle(int (*fptr)(        
 	struct module_qstate* qstate, struct query_info* qinfo,         
-	uint16_t flags, int prime))
+	uint16_t flags, int prime, int valrec))
 {
 	if(fptr == &mesh_detect_cycle) return 1;
 	return 0;
diff --git a/util/fptr_wlist.h b/util/fptr_wlist.h
index 62692ba8b530..10de5d816772 100644
--- a/util/fptr_wlist.h
+++ b/util/fptr_wlist.h
@@ -233,7 +233,7 @@ int fptr_whitelist_modenv_detach_subs(void (*fptr)(
  */
 int fptr_whitelist_modenv_attach_sub(int (*fptr)(
 	struct module_qstate* qstate, struct query_info* qinfo, 
-	uint16_t qflags, int prime, struct module_qstate** newq));
+	uint16_t qflags, int prime, int valrec, struct module_qstate** newq));
 
 /**
  * Check function pointer whitelist for module_env kill_sub callback values.
@@ -251,7 +251,7 @@ int fptr_whitelist_modenv_kill_sub(void (*fptr)(struct module_qstate* newq));
  */
 int fptr_whitelist_modenv_detect_cycle(int (*fptr)(
 	struct module_qstate* qstate, struct query_info* qinfo, 
-	uint16_t flags, int prime));
+	uint16_t flags, int prime, int valrec));
 
 /**
  * Check function pointer whitelist for module init call values.
diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index ff971293fe9e..d318477e56f4 100644
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -2061,6 +2061,7 @@
 2423,
 2424,
 2425,
+2426,
 2427,
 2428,
 2429,
@@ -5353,9 +5354,11 @@
 35004,
 35355,
 36001,
+36411,
 36865,
 37475,
 37654,
+38002,
 38201,
 38202,
 38203,
diff --git a/util/module.h b/util/module.h
index f95ff6dc8372..b9dde36e2f3c 100644
--- a/util/module.h
+++ b/util/module.h
@@ -256,13 +256,14 @@ struct module_env {
 	 * @param qinfo: what to query for (copied).
 	 * @param qflags: what flags to use (RD, CD flag or not).
 	 * @param prime: if it is a (stub) priming query.
+	 * @param valrec: validation lookup recursion, does not need validation
 	 * @param newq: If the new subquery needs initialisation, it is 
 	 * 	returned, otherwise NULL is returned.
 	 * @return: false on error, true if success (and init may be needed).
 	 */ 
 	int (*attach_sub)(struct module_qstate* qstate, 
 		struct query_info* qinfo, uint16_t qflags, int prime, 
-		struct module_qstate** newq);
+		int valrec, struct module_qstate** newq);
 
 	/**
 	 * Kill newly attached sub. If attach_sub returns newq for 
@@ -280,13 +281,15 @@ struct module_env {
 	 * @param qinfo: query info for dependency. 
 	 * @param flags: query flags of dependency, RD/CD flags.
 	 * @param prime: if dependency is a priming query or not.
+	 * @param valrec: validation lookup recursion, does not need validation
 	 * @return true if the name,type,class exists and the given 
 	 * 	qstate mesh exists as a dependency of that name. Thus 
 	 * 	if qstate becomes dependent on name,type,class then a 
 	 * 	cycle is created.
 	 */
 	int (*detect_cycle)(struct module_qstate* qstate, 
-		struct query_info* qinfo, uint16_t flags, int prime);
+		struct query_info* qinfo, uint16_t flags, int prime,
+		int valrec);
 
 	/** region for temporary usage. May be cleared after operate() call. */
 	struct regional* scratch;
@@ -397,6 +400,9 @@ struct module_qstate {
 	uint16_t query_flags;
 	/** if this is a (stub or root) priming query (with hints) */
 	int is_priming;
+	/** if this is a validation recursion query that does not get
+	 * validation itself */
+	int is_valrec;
 
 	/** comm_reply contains server replies */
 	struct comm_reply* reply;
diff --git a/util/net_help.c b/util/net_help.c
index 49ce677f4aa0..8c2bac7372fc 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -699,7 +699,7 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem)
 		}
 	}
 	if(verifypem && verifypem[0]) {
-		if(!SSL_CTX_load_verify_locations(ctx, verifypem, NULL) != 1) {
+		if(!SSL_CTX_load_verify_locations(ctx, verifypem, NULL)) {
 			log_crypto_err("error in SSL_CTX verify");
 			SSL_CTX_free(ctx);
 			return NULL;
diff --git a/validator/validator.c b/validator/validator.c
index aefa26a27948..9d5d5c390254 100644
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -283,12 +283,25 @@ needs_validation(struct module_qstate* qstate, int ret_rc,
 {
 	int rcode;
 
-	/* If the CD bit is on in the original request, then we don't bother to
-	 * validate anything.*/
+	/* If the CD bit is on in the original request, then you could think
+	 * that we don't bother to validate anything.
+	 * But this is signalled internally with the valrec flag.
+	 * User queries are validated with BIT_CD to make our cache clean
+	 * so that bogus messages get retried by the upstream also for
+	 * downstream validators that set BIT_CD.
+	 * For DNS64 bit_cd signals no dns64 processing, but we want to
+	 * provide validation there too */
+	/*
 	if(qstate->query_flags & BIT_CD) {
 		verbose(VERB_ALGO, "not validating response due to CD bit");
 		return 0;
 	}
+	*/
+	if(qstate->is_valrec) {
+		verbose(VERB_ALGO, "not validating response, is valrec"
+			"(validation recursion lookup)");
+		return 0;
+	}
 
 	if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg)
 		rcode = ret_rc;
@@ -351,14 +364,20 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 	struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
 	struct module_qstate* newq;
 	struct query_info ask;
+	int valrec;
 	ask.qname = name;
 	ask.qname_len = namelen;
 	ask.qtype = qtype;
 	ask.qclass = qclass;
 	log_query_info(VERB_ALGO, "generate request", &ask);
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
+	/* enable valrec flag to avoid recursion to the same validation
+	 * routine, this lookup is simply a lookup. DLVs need validation */
+	if(qtype == LDNS_RR_TYPE_DLV)
+		valrec = 0;
+	else valrec = 1;
 	if(!(*qstate->env->attach_sub)(qstate, &ask, 
-		(uint16_t)(BIT_RD|flags), 0, &newq)){
+		(uint16_t)(BIT_RD|flags), 0, valrec, &newq)){
 		log_err("Could not generate request: out of memory");
 		return 0;
 	}
@@ -2005,14 +2024,16 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 		/* if secure, this will override cache anyway, no need
 		 * to check if from parentNS */
 		if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo, 
-			vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL)) {
+			vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL,
+			qstate->query_flags)) {
 			log_err("out of memory caching validator results");
 		}
 	} else {
 		/* for a referral, store the verified RRsets */
 		/* and this does not get prefetched, so no leeway */
 		if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo, 
-			vq->orig_msg->rep, 1, 0, 0, NULL)) {
+			vq->orig_msg->rep, 1, 0, 0, NULL,
+			qstate->query_flags)) {
 			log_err("out of memory caching validator results");
 		}
 	}

From bb89a5dd46465ec3bcf4ab8f158c959b3bb7a75c Mon Sep 17 00:00:00 2001
From: des <des@FreeBSD.org>
Date: Mon, 5 Jan 2015 14:55:52 +0000
Subject: [PATCH 3/8] Add support for using a local socket for the remote
 control connection by specifying uts path instead of (or in addition to) an
 IP address as an argument to the control-interface configuration variable.

Add support for unencrypted and unauthenticated control connections
through a new configuration variable, control-use-cert.  To avoid the
complexity of supporting both SSL socket and plain socket descriptors
in the same code, we just use an unencrypted SSL context and forego
authentication.  The downside is that we still have to perform DH kex
when establishing the connection.

This patch was derived (with significant modifications) from the
contrib/unbound_unixsock.diff patch originally submitted by Ilya
Bakulin of Genua mbH.
---
 config.h.in                  |   3 +
 configure.ac                 |   2 +-
 daemon/remote.c              | 118 +++++++++++++++++++++++++++++------
 daemon/remote.h              |   2 +
 daemon/unbound.c             |  39 ++++--------
 doc/unbound.conf.5.in        |  33 ++++++----
 services/listen_dnsport.c    |  54 ++++++++++++++++
 services/listen_dnsport.h    |   9 +++
 smallapp/unbound-checkconf.c |   2 +-
 smallapp/unbound-control.c   |  81 ++++++++++++++++--------
 util/config_file.c           |  16 +++++
 util/config_file.h           |   4 ++
 util/configlexer.lex         |   1 +
 util/configparser.y          |  13 +++-
 util/net_help.c              |   4 +-
 15 files changed, 292 insertions(+), 89 deletions(-)

diff --git a/config.h.in b/config.h.in
index 2b7770b5c23a..7a8a5dd58e9c 100644
--- a/config.h.in
+++ b/config.h.in
@@ -380,6 +380,9 @@
 /* Define to 1 if you have the <sys/uio.h> header file. */
 #undef HAVE_SYS_UIO_H
 
+/* Define to 1 if you have the <sys/un.h> header file. */
+#undef HAVE_SYS_UN_H
+
 /* Define to 1 if you have the <sys/wait.h> header file. */
 #undef HAVE_SYS_WAIT_H
 
diff --git a/configure.ac b/configure.ac
index 7e5da1a9f046..37e1bf6f4bca 100644
--- a/configure.ac
+++ b/configure.ac
@@ -266,7 +266,7 @@ AC_CHECK_TOOL(STRIP, strip)
 ACX_LIBTOOL_C_ONLY
 
 # Checks for header files.
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h],,, [AC_INCLUDES_DEFAULT])
 
 # check for types.  
 # Using own tests for int64* because autoconf builtin only give 32bit.
diff --git a/daemon/remote.c b/daemon/remote.c
index ff3d769d4e54..a1d2628a904a 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -46,6 +46,10 @@
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
 #endif
+#ifndef HEADER_DH_H
+#include <openssl/dh.h>
+#endif
+
 #include <ctype.h>
 #include "daemon/remote.h"
 #include "daemon/worker.h"
@@ -82,6 +86,9 @@
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -131,6 +138,39 @@ timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
 #endif
 }
 
+/*
+ * The following function was generated using the openssl utility, using
+ * the command : "openssl dhparam -dsaparam -C 512"
+ */
+DH *get_dh512()
+{
+	static unsigned char dh512_p[]={
+		0xC9,0xD7,0x05,0xDA,0x5F,0xAB,0x14,0xE8,0x11,0x56,0x77,0x85,
+		0xB1,0x24,0x2C,0x95,0x60,0xEA,0xE2,0x10,0x6F,0x0F,0x84,0xEC,
+		0xF4,0x45,0xE8,0x90,0x7A,0xA7,0x03,0xFF,0x5B,0x88,0x53,0xDE,
+		0xC4,0xDE,0xBC,0x42,0x78,0x71,0x23,0x7E,0x24,0xA5,0x5E,0x4E,
+		0xEF,0x6F,0xFF,0x5F,0xAF,0xBE,0x8A,0x77,0x62,0xB4,0x65,0x82,
+		0x7E,0xC9,0xED,0x2F,
+	};
+	static unsigned char dh512_g[]={
+		0x8D,0x3A,0x52,0xBC,0x8A,0x71,0x94,0x33,0x2F,0xE1,0xE8,0x4C,
+		0x73,0x47,0x03,0x4E,0x7D,0x40,0xE5,0x84,0xA0,0xB5,0x6D,0x10,
+		0x6F,0x90,0x43,0x05,0x1A,0xF9,0x0B,0x6A,0xD1,0x2A,0x9C,0x25,
+		0x0A,0xB9,0xD1,0x14,0xDC,0x35,0x1C,0x48,0x7C,0xC6,0x0C,0x6D,
+		0x32,0x1D,0xD3,0xC8,0x10,0xA8,0x82,0x14,0xA2,0x1C,0xF4,0x53,
+		0x23,0x3B,0x1C,0xB9,
+	};
+	DH *dh;
+
+	if ((dh=DH_new()) == NULL) return(NULL);
+	dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
+	dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
+	if ((dh->p == NULL) || (dh->g == NULL))
+	{ DH_free(dh); return(NULL); }
+	dh->length = 160;
+	return(dh);
+}
+
 struct daemon_remote*
 daemon_remote_create(struct config_file* cfg)
 {
@@ -165,6 +205,24 @@ daemon_remote_create(struct config_file* cfg)
 		daemon_remote_delete(rc);
 		return NULL;
 	}
+
+	if (cfg->remote_control_use_cert == 0) {
+		/* No certificates are requested */
+		if(!SSL_CTX_set_cipher_list(rc->ctx, "aNULL")) {
+			log_crypto_err("Failed to set aNULL cipher list");
+			return NULL;
+		}
+
+		/* Since we have no certificates and hence no source of
+		 * DH params, let's generate and set them
+		 */
+		if(!SSL_CTX_set_tmp_dh(rc->ctx,get_dh512())) {
+			log_crypto_err("Wanted to set DH param, but failed");
+			return NULL;
+		}
+		return rc;
+	}
+	rc->use_cert = 1;
 	s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
 	s_key = fname_after_chroot(cfg->server_key_file, cfg, 1);
 	if(!s_cert || !s_key) {
@@ -244,7 +302,8 @@ void daemon_remote_delete(struct daemon_remote* rc)
  * @return false on failure.
  */
 static int
-add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err)
+add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
+	struct config_file* cfg)
 {
 	struct addrinfo hints;
 	struct addrinfo* res;
@@ -255,29 +314,46 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err)
 	snprintf(port, sizeof(port), "%d", nr);
 	port[sizeof(port)-1]=0;
 	memset(&hints, 0, sizeof(hints));
-	hints.ai_socktype = SOCK_STREAM;
-	hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
-	if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
-#ifdef USE_WINSOCK
-		if(!noproto_is_err && r == EAI_NONAME) {
-			/* tried to lookup the address as name */
-			return 1; /* return success, but do nothing */
+
+	if(ip[0] == '/') {
+		/* This looks like a local socket */
+		fd = create_local_accept_sock(ip, &noproto);
+		/*
+		 * Change socket ownership and permissions so users other
+		 * than root can access it provided they are in the same
+		 * group as the user we run as.
+		 */
+		if(fd != -1) {
+			if (cfg->username && cfg->username[0])
+				chown(ip, cfg->uid, cfg->gid);
+			chmod(ip, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
 		}
+	} else {
+		hints.ai_socktype = SOCK_STREAM;
+		hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
+		if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
+#ifdef USE_WINSOCK
+			if(!noproto_is_err && r == EAI_NONAME) {
+				/* tried to lookup the address as name */
+				return 1; /* return success, but do nothing */
+			}
 #endif /* USE_WINSOCK */
-                log_err("control interface %s:%s getaddrinfo: %s %s",
-			ip?ip:"default", port, gai_strerror(r),
+			log_err("control interface %s:%s getaddrinfo: %s %s",
+				ip?ip:"default", port, gai_strerror(r),
 #ifdef EAI_SYSTEM
-			r==EAI_SYSTEM?(char*)strerror(errno):""
+				r==EAI_SYSTEM?(char*)strerror(errno):""
 #else
-			""
+				""
 #endif
 			);
-		return 0;
+			return 0;
+		}
+
+		/* open fd */
+		fd = create_tcp_accept_sock(res, 1, &noproto, 0);
+		freeaddrinfo(res);
 	}
 
-	/* open fd */
-	fd = create_tcp_accept_sock(res, 1, &noproto, 0);
-	freeaddrinfo(res);
 	if(fd == -1 && noproto) {
 		if(!noproto_is_err)
 			return 1; /* return success, but do nothing */
@@ -314,7 +390,7 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
 	if(cfg->control_ifs) {
 		struct config_strlist* p;
 		for(p = cfg->control_ifs; p; p = p->next) {
-			if(!add_open(p->str, cfg->control_port, &l, 1)) {
+			if(!add_open(p->str, cfg->control_port, &l, 1, cfg)) {
 				listening_ports_free(l);
 				return NULL;
 			}
@@ -322,12 +398,12 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
 	} else {
 		/* defaults */
 		if(cfg->do_ip6 &&
-			!add_open("::1", cfg->control_port, &l, 0)) {
+			!add_open("::1", cfg->control_port, &l, 0, cfg)) {
 			listening_ports_free(l);
 			return NULL;
 		}
 		if(cfg->do_ip4 &&
-			!add_open("127.0.0.1", cfg->control_port, &l, 1)) {
+			!add_open("127.0.0.1", cfg->control_port, &l, 1, cfg)) {
 			listening_ports_free(l);
 			return NULL;
 		}
@@ -2434,7 +2510,9 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
 	s->shake_state = rc_none;
 
 	/* once handshake has completed, check authentication */
-	if(SSL_get_verify_result(s->ssl) == X509_V_OK) {
+	if (!rc->use_cert) {
+		verbose(VERB_ALGO, "unauthenticated remote control connection");
+	} else if(SSL_get_verify_result(s->ssl) == X509_V_OK) {
 		X509* x = SSL_get_peer_certificate(s->ssl);
 		if(!x) {
 			verbose(VERB_DETAIL, "remote control connection "
diff --git a/daemon/remote.h b/daemon/remote.h
index cc670b70128f..b25bfb1af611 100644
--- a/daemon/remote.h
+++ b/daemon/remote.h
@@ -89,6 +89,8 @@ struct daemon_remote {
 	struct worker* worker;
 	/** commpoints for accepting remote control connections */
 	struct listen_list* accept_list;
+	/* if certificates are used */
+	int use_cert;
 	/** number of active commpoints that are handling remote control */
 	int active;
 	/** max active commpoints */
diff --git a/daemon/unbound.c b/daemon/unbound.c
index 5ded5a964cc3..e48a6b5ea951 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -441,20 +441,14 @@ static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	const char** cfgfile)
 {
+	log_assert(cfg);
+
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;
-	uid_t uid;
-	gid_t gid;
-	/* initialize, but not to 0 (root) */
-	memset(&uid, 112, sizeof(uid));
-	memset(&gid, 112, sizeof(gid));
-	log_assert(cfg);
 
 	if(cfg->username && cfg->username[0]) {
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
-		uid = pwd->pw_uid;
-		gid = pwd->pw_gid;
 		/* endpwent below, in case we need pwd for setusercontext */
 	}
 #endif
@@ -511,18 +505,11 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #ifdef HAVE_KILL
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		writepid(daemon->pidfile, getpid());
-		if(!(cfg->chrootdir && cfg->chrootdir[0]) || 
-			(cfg->chrootdir && cfg->chrootdir[0] && 
-			strncmp(daemon->pidfile, cfg->chrootdir, 
-			strlen(cfg->chrootdir))==0)) {
-			/* delete of pidfile could potentially work,
-			 * chown to get permissions */
-			if(cfg->username && cfg->username[0]) {
-			  if(chown(daemon->pidfile, uid, gid) == -1) {
+		if(cfg->username && cfg->username[0]) {
+			if(chown(daemon->pidfile, cfg->uid, cfg->gid) == -1) {
 				log_err("cannot chown %u.%u %s: %s",
-					(unsigned)uid, (unsigned)gid,
+					(unsigned)cfg->uid, (unsigned)cfg->gid,
 					daemon->pidfile, strerror(errno));
-			  }
 			}
 		}
 	}
@@ -537,7 +524,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 		/* setusercontext does initgroups, setuid, setgid, and
 		 * also resource limits from login config, but we
 		 * still call setresuid, setresgid to be sure to set all uid*/
-		if(setusercontext(NULL, pwd, uid, (unsigned)
+		if(setusercontext(NULL, pwd, cfg->uid, (unsigned)
 			LOGIN_SETALL & ~LOGIN_SETUSER & ~LOGIN_SETGROUP) != 0)
 			log_warn("unable to setusercontext %s: %s",
 				cfg->username, strerror(errno));
@@ -601,27 +588,27 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #ifdef HAVE_GETPWNAM
 	if(cfg->username && cfg->username[0]) {
 #  ifdef HAVE_INITGROUPS
-		if(initgroups(cfg->username, gid) != 0)
+		if(initgroups(cfg->username, cfg->gid) != 0)
 			log_warn("unable to initgroups %s: %s",
 				cfg->username, strerror(errno));
 #  endif /* HAVE_INITGROUPS */
 		endpwent();
 
 #ifdef HAVE_SETRESGID
-		if(setresgid(gid,gid,gid) != 0)
+		if(setresgid(cfg->gid,cfg->gid,cfg->gid) != 0)
 #elif defined(HAVE_SETREGID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setregid(gid,gid) != 0)
+		if(setregid(cfg->gid,cfg->gid) != 0)
 #else /* use setgid */
-		if(setgid(gid) != 0)
+		if(setgid(cfg->gid) != 0)
 #endif /* HAVE_SETRESGID */
 			fatal_exit("unable to set group id of %s: %s", 
 				cfg->username, strerror(errno));
 #ifdef HAVE_SETRESUID
-		if(setresuid(uid,uid,uid) != 0)
+		if(setresuid(cfg->uid,cfg->uid,cfg->uid) != 0)
 #elif defined(HAVE_SETREUID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setreuid(uid,uid) != 0)
+		if(setreuid(cfg->uid,cfg->uid) != 0)
 #else /* use setuid */
-		if(setuid(uid) != 0)
+		if(setuid(cfg->uid) != 0)
 #endif /* HAVE_SETRESUID */
 			fatal_exit("unable to set user id of %s: %s", 
 				cfg->username, strerror(errno));
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index f08a01b31844..9b23fd64da1b 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -958,36 +958,47 @@ to setup SSLv3 / TLSv1 security for the connection.  The
 section for options.  To setup the correct self\-signed certificates use the
 \fIunbound\-control\-setup\fR(8) utility.
 .TP 5
-.B control\-enable:     \fI<yes or no>
+.B control\-enable: \fI<yes or no>
 The option is used to enable remote control, default is "no".
 If turned off, the server does not listen for control commands.
 .TP 5
-.B control\-interface: <ip address>
-Give IPv4 or IPv6 addresses to listen on for control commands.
+.B control\-interface: \fI<ip address or path>
+Give IPv4 or IPv6 addresses or local socket path to listen on for
+control commands.
 By default localhost (127.0.0.1 and ::1) is listened to.
 Use 0.0.0.0 and ::0 to listen to all interfaces.
+If you change this and permissions have been dropped, you must restart
+the server for the change to take effect.
 .TP 5
-.B control\-port: <port number>
-The port number to listen on for control commands, default is 8953.
-If you change this port number, and permissions have been dropped,
-a reload is not sufficient to open the port again, you must then restart.
+.B control\-port: \fI<port number>
+The port number to listen on for IPv4 or IPv6 control interfaces,
+default is 8953.
+If you change this and permissions have been dropped, you must restart
+the server for the change to take effect.
 .TP 5
-.B server\-key\-file: "<private key file>"
+.B control-use-cert: \fI<yes or no>
+Whether to require certificate authentication of control connections.
+The default is "yes".
+This should not be changed unless there are other mechanisms in place
+to prevent untrusted users from accessing the remote control
+interface.
+.TP 5
+.B server\-key\-file: \fI<private key file>
 Path to the server private key, by default unbound_server.key.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
 This file is used by the unbound server, but not by \fIunbound\-control\fR.
 .TP 5
-.B server\-cert\-file: "<certificate file.pem>"
+.B server\-cert\-file: \fI<certificate file.pem>
 Path to the server self signed certificate, by default unbound_server.pem.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
 This file is used by the unbound server, and also by \fIunbound\-control\fR.
 .TP 5
-.B control\-key\-file: "<private key file>"
+.B control\-key\-file: \fI<private key file>
 Path to the control client private key, by default unbound_control.key.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
 This file is used by \fIunbound\-control\fR.
 .TP 5
-.B control\-cert\-file: "<certificate file.pem>"
+.B control\-cert\-file: \fI<certificate file.pem>
 Path to the control client certificate, by default unbound_control.pem.
 This certificate has to be signed with the server certificate.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index b7ffb6d3fad3..69c68b2807ff 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -56,6 +56,10 @@
 #endif
 #include <fcntl.h>
 
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+
 /** number of queued TCP connections for listen() */
 #define TCP_BACKLOG 256 
 
@@ -571,6 +575,56 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 	return s;
 }
 
+int
+create_local_accept_sock(char *path, int* noproto)
+{
+#ifdef HAVE_SYS_UN_H
+	int s;
+	struct sockaddr_un sun;
+
+	sun.sun_len = sizeof(sun);
+	sun.sun_family = AF_LOCAL;
+	strlcpy(sun.sun_path, path, 104);
+
+	if ((s = socket(PF_LOCAL, SOCK_STREAM, 0)) == -1) {
+		log_err("Cannot create local socket %s (%s)",
+			path, strerror(errno));
+		return -1;
+	}
+
+	if (unlink(path) && errno != ENOENT) {
+		/* The socket already exists and cannot be removed */
+		log_err("Cannot remove old local socket %s (%s)",
+			path, strerror(errno));
+		return -1;
+	}
+
+	if (bind(s, (struct sockaddr *)&sun,
+		sizeof(struct sockaddr_un)) == -1) {
+		log_err("Cannot bind local socket %s (%s)",
+			path, strerror(errno));
+		return -1;
+	}
+
+	if (!fd_set_nonblock(s)) {
+		log_err("Cannot set non-blocking mode");
+		return -1;
+	}
+
+	if (listen(s, TCP_BACKLOG) == -1) {
+		log_err("can't listen: %s", strerror(errno));
+		return -1;
+	}
+
+	return s;
+#else
+	log_err("Local sockets are not supported");
+	*noproto = 1;
+	return -1;
+#endif
+}
+
+
 /**
  * Create socket from getaddrinfo results
  */
diff --git a/services/listen_dnsport.h b/services/listen_dnsport.h
index 075f6d281d5d..0513b5d6c01b 100644
--- a/services/listen_dnsport.h
+++ b/services/listen_dnsport.h
@@ -207,4 +207,13 @@ int create_udp_sock(int family, int socktype, struct sockaddr* addr,
 int create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 	int* reuseport);
 
+/**
+ * Create and bind local listening socket
+ * @param path: path to the socket.
+ * @param noproto: on error, this is set true if cause is that local sockets
+ *	are not supported.
+ * @return: the socket. -1 on error.
+ */
+int create_local_accept_sock(char* path, int* noproto);
+
 #endif /* LISTEN_DNSPORT_H */
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index e83867f26844..7723c3357695 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -416,7 +416,7 @@ morechecks(struct config_file* cfg, const char* fname)
 		endpwent();
 	}
 #endif
-	if(cfg->remote_control_enable) {
+	if(cfg->remote_control_enable && cfg->remote_control_use_cert) {
 		check_chroot_string("server-key-file", &cfg->server_key_file,
 			cfg->chrootdir, cfg);
 		check_chroot_string("server-cert-file", &cfg->server_cert_file,
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index ff86184a8162..37e840bad799 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -59,6 +59,10 @@
 #include "util/locks.h"
 #include "util/net_help.h"
 
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+
 /** Give unbound-control usage, and exit (1). */
 static void
 usage()
@@ -139,29 +143,37 @@ setup_ctx(struct config_file* cfg)
 	char* s_cert, *c_key, *c_cert;
 	SSL_CTX* ctx;
 
-	s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
-	c_key = fname_after_chroot(cfg->control_key_file, cfg, 1);
-	c_cert = fname_after_chroot(cfg->control_cert_file, cfg, 1);
-	if(!s_cert || !c_key || !c_cert)
-		fatal_exit("out of memory");
+	if(cfg->remote_control_use_cert) {
+		s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
+		c_key = fname_after_chroot(cfg->control_key_file, cfg, 1);
+		c_cert = fname_after_chroot(cfg->control_cert_file, cfg, 1);
+		if(!s_cert || !c_key || !c_cert)
+			fatal_exit("out of memory");
+	}
         ctx = SSL_CTX_new(SSLv23_client_method());
 	if(!ctx)
 		ssl_err("could not allocate SSL_CTX pointer");
         if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2))
 		ssl_err("could not set SSL_OP_NO_SSLv2");
-        if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3))
-		ssl_err("could not set SSL_OP_NO_SSLv3");
-	if(!SSL_CTX_use_certificate_file(ctx,c_cert,SSL_FILETYPE_PEM) ||
-		!SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM)
-		|| !SSL_CTX_check_private_key(ctx))
-		ssl_err("Error setting up SSL_CTX client key and cert");
-	if (SSL_CTX_load_verify_locations(ctx, s_cert, NULL) != 1)
-		ssl_err("Error setting up SSL_CTX verify, server cert");
-	SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
+        if(cfg->remote_control_use_cert) {
+		if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3))
+			ssl_err("could not set SSL_OP_NO_SSLv3");
+		if(!SSL_CTX_use_certificate_file(ctx,c_cert,SSL_FILETYPE_PEM) ||
+		    !SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM)
+		    || !SSL_CTX_check_private_key(ctx))
+			ssl_err("Error setting up SSL_CTX client key and cert");
+		if (SSL_CTX_load_verify_locations(ctx, s_cert, NULL) != 1)
+			ssl_err("Error setting up SSL_CTX verify, server cert");
+		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
 
-	free(s_cert);
-	free(c_key);
-	free(c_cert);
+		free(s_cert);
+		free(c_key);
+		free(c_cert);
+	} else {
+		/* Use ciphers that don't require authentication  */
+		if(!SSL_CTX_set_cipher_list(ctx, "aNULL"))
+			ssl_err("Error setting NULL cipher!");
+	}
 	return ctx;
 }
 
@@ -171,6 +183,7 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 {
 	struct sockaddr_storage addr;
 	socklen_t addrlen;
+	int addrfamily = 0;
 	int fd;
 	/* use svr or the first config entry */
 	if(!svr) {
@@ -189,12 +202,23 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 	if(strchr(svr, '@')) {
 		if(!extstrtoaddr(svr, &addr, &addrlen))
 			fatal_exit("could not parse IP@port: %s", svr);
+#ifdef HAVE_SYS_UN_H
+	} else if(svr[0] == '/') {
+		struct sockaddr_un* sun = (struct sockaddr_un *) &addr;
+		sun->sun_family = AF_LOCAL;
+		sun->sun_len = sizeof(sun);
+		strlcpy(sun->sun_path, svr, 104);
+		addrlen = sizeof(struct sockaddr_un);
+		addrfamily = AF_LOCAL;
+#endif
 	} else {
 		if(!ipstrtoaddr(svr, cfg->control_port, &addr, &addrlen))
 			fatal_exit("could not parse IP: %s", svr);
 	}
-	fd = socket(addr_is_ip6(&addr, addrlen)?AF_INET6:AF_INET, 
-		SOCK_STREAM, 0);
+
+	if(addrfamily == 0)
+		addrfamily = addr_is_ip6(&addr, addrlen)?AF_INET6:AF_INET;
+	fd = socket(addrfamily, SOCK_STREAM, 0);
 	if(fd == -1) {
 #ifndef USE_WINSOCK
 		fatal_exit("socket: %s", strerror(errno));
@@ -223,7 +247,7 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 
 /** setup SSL on the connection */
 static SSL*
-setup_ssl(SSL_CTX* ctx, int fd)
+setup_ssl(SSL_CTX* ctx, int fd, struct config_file* cfg)
 {
 	SSL* ssl;
 	X509* x;
@@ -249,10 +273,13 @@ setup_ssl(SSL_CTX* ctx, int fd)
 	/* check authenticity of server */
 	if(SSL_get_verify_result(ssl) != X509_V_OK)
 		ssl_err("SSL verification failed");
-	x = SSL_get_peer_certificate(ssl);
-	if(!x)
-		ssl_err("Server presented no peer certificate");
-	X509_free(x);
+	if(cfg->remote_control_use_cert) {
+		x = SSL_get_peer_certificate(ssl);
+		if(!x)
+			ssl_err("Server presented no peer certificate");
+		X509_free(x);
+	}
+
 	return ssl;
 }
 
@@ -330,11 +357,11 @@ go(const char* cfgfile, char* svr, int quiet, int argc, char* argv[])
 	if(!cfg->remote_control_enable)
 		log_warn("control-enable is 'no' in the config file.");
 	ctx = setup_ctx(cfg);
-	
+
 	/* contact server */
 	fd = contact_server(svr, cfg, argc>0&&strcmp(argv[0],"status")==0);
-	ssl = setup_ssl(ctx, fd);
-	
+	ssl = setup_ssl(ctx, fd, cfg);
+
 	/* send command */
 	ret = go_cmd(ssl, quiet, argc, argv);
 
diff --git a/util/config_file.c b/util/config_file.c
index 35bc6452a0ce..bb39cf9bd7a2 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -60,6 +60,9 @@
 #ifdef HAVE_GLOB_H
 # include <glob.h>
 #endif
+#ifdef HAVE_PWD_H
+#include <pwd.h>
+#endif
 
 /** global config during parsing */
 struct config_parser_state* cfg_parser = 0;
@@ -131,6 +134,8 @@ config_create(void)
 		goto error_exit;
 	init_outgoing_availports(cfg->outgoing_avail_ports, 65536);
 	if(!(cfg->username = strdup(UB_USERNAME))) goto error_exit;
+	cfg->uid = (uid_t)-1;
+	cfg->gid = (gid_t)-1;
 #ifdef HAVE_CHROOT
 	if(!(cfg->chrootdir = strdup(CHROOT_DIR))) goto error_exit;
 #endif
@@ -799,6 +804,17 @@ config_read(struct config_file* cfg, const char* filename, const char* chroot)
 		errno=EINVAL;
 		return 0;
 	}
+
+#ifdef HAVE_GETPWNAM
+	/* translate username into uid and gid */
+	if(cfg->username && cfg->username[0]) {
+		struct passwd *pwd;
+		if((pwd = getpwnam(cfg->username)) == NULL)
+			log_err("user '%s' does not exist.", cfg->username);
+		cfg->uid = pwd->pw_uid;
+		cfg->gid = pwd->pw_gid;
+	}
+#endif
 	return 1;
 }
 
diff --git a/util/config_file.h b/util/config_file.h
index 49ffbdde4a56..fd35d7863ae1 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -192,6 +192,8 @@ struct config_file {
 	char* chrootdir;
 	/** username to change to, if not "". */
 	char* username;
+	uid_t uid;
+	gid_t gid;
 	/** working directory */
 	char* directory;
 	/** filename to log to. */
@@ -282,6 +284,8 @@ struct config_file {
 	struct config_strlist* control_ifs;
 	/** port number for the control port */
 	int control_port;
+	/** use certificates for remote control */
+	int remote_control_use_cert;
 	/** private key file for server */
 	char* server_key_file;
 	/** certificate file for server */
diff --git a/util/configlexer.lex b/util/configlexer.lex
index 7ee7b9bd9a92..eea1b858400c 100644
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -315,6 +315,7 @@ remote-control{COLON}		{ YDVAR(0, VAR_REMOTE_CONTROL) }
 control-enable{COLON}		{ YDVAR(1, VAR_CONTROL_ENABLE) }
 control-interface{COLON}	{ YDVAR(1, VAR_CONTROL_INTERFACE) }
 control-port{COLON}		{ YDVAR(1, VAR_CONTROL_PORT) }
+control-use-cert{COLON}		{ YDVAR(1, VAR_CONTROL_USE_CERT) }
 server-key-file{COLON}		{ YDVAR(1, VAR_SERVER_KEY_FILE) }
 server-cert-file{COLON}		{ YDVAR(1, VAR_SERVER_CERT_FILE) }
 control-key-file{COLON}		{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
diff --git a/util/configparser.y b/util/configparser.y
index 7a92d9ee7899..cbb5e16bd813 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -95,6 +95,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
+%token VAR_CONTROL_USE_CERT
 %token VAR_EXTENDED_STATISTICS VAR_LOCAL_DATA_PTR VAR_JOSTLE_TIMEOUT
 %token VAR_STUB_PRIME VAR_UNWANTED_REPLY_THRESHOLD VAR_LOG_TIME_ASCII
 %token VAR_DOMAIN_INSECURE VAR_PYTHON VAR_PYTHON_SCRIPT VAR_VAL_SIG_SKEW_MIN
@@ -1270,7 +1271,7 @@ contents_rc: contents_rc content_rc
 	| ;
 content_rc: rc_control_enable | rc_control_interface | rc_control_port |
 	rc_server_key_file | rc_server_cert_file | rc_control_key_file |
-	rc_control_cert_file
+	rc_control_cert_file | rc_control_use_cert
 	;
 rc_control_enable: VAR_CONTROL_ENABLE STRING_ARG
 	{
@@ -1298,6 +1299,16 @@ rc_control_interface: VAR_CONTROL_INTERFACE STRING_ARG
 			yyerror("out of memory");
 	}
 	;
+rc_control_use_cert: VAR_CONTROL_USE_CERT STRING_ARG
+	{
+		OUTYY(("P(control_use_cert:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->remote_control_use_cert =
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 rc_server_key_file: VAR_SERVER_KEY_FILE STRING_ARG
 	{
 		OUTYY(("P(rc_server_key_file:%s)\n", $2));
diff --git a/util/net_help.c b/util/net_help.c
index 8c2bac7372fc..335ee7499e7d 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -156,7 +156,7 @@ log_addr(enum verbosity_value v, const char* str,
 		case AF_INET6: family="ip6";
 			sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
 			break;
-		case AF_UNIX: family="unix"; break;
+		case AF_LOCAL: family="local"; break;
 		default: break;
 	}
 	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
@@ -313,7 +313,7 @@ void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone,
 		case AF_INET6: family="";
 			sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
 			break;
-		case AF_UNIX: family="unix_family "; break;
+		case AF_LOCAL: family="local "; break;
 		default: break;
 	}
 	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {

From cabe860377233bc13a6d101fdb59bb834cab980a Mon Sep 17 00:00:00 2001
From: des <des@FreeBSD.org>
Date: Mon, 12 Jan 2015 07:24:01 +0000
Subject: [PATCH 4/8] Merge upstream version of the local socket patch
 (upstream svn revisions 3304 through 3309).

---
 config.h.in                |  3 +++
 configure                  | 18 +++++++++++++++++-
 configure.ac               |  6 ++++++
 daemon/remote.c            |  5 ++++-
 daemon/unbound.c           |  3 +--
 doc/Changelog              |  5 +++++
 doc/unbound.conf.5.in      |  2 +-
 services/listen_dnsport.c  | 13 +++++++++----
 services/listen_dnsport.h  |  2 +-
 smallapp/unbound-control.c | 10 ++++++----
 util/config_file.c         | 25 +++++++++++++++----------
 util/config_file.h         |  6 ++++++
 12 files changed, 74 insertions(+), 24 deletions(-)

diff --git a/config.h.in b/config.h.in
index 7a8a5dd58e9c..a8fd05cb5286 100644
--- a/config.h.in
+++ b/config.h.in
@@ -350,6 +350,9 @@
 /* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
 #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST
 
+/* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
+#undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
+
 /* Define if you have Swig libraries and header files. */
 #undef HAVE_SWIG
 
diff --git a/configure b/configure
index bdfc14f22052..8c6c0785260c 100755
--- a/configure
+++ b/configure
@@ -13713,7 +13713,7 @@ CC="$lt_save_CC"
 
 
 # Checks for header files.
-for ac_header in stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h
+for ac_header in stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h
 do :
   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
 ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
@@ -17818,6 +17818,22 @@ $as_echo "no" >&6; }
 
 fi
 
+fi
+
+ac_fn_c_check_member "$LINENO" "struct sockaddr_un" "sun_len" "ac_cv_member_struct_sockaddr_un_sun_len" "
+$ac_includes_default
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+
+"
+if test "x$ac_cv_member_struct_sockaddr_un_sun_len" = xyes; then :
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_STRUCT_SOCKADDR_UN_SUN_LEN 1
+_ACEOF
+
+
 fi
 
 ac_fn_c_check_member "$LINENO" "struct in_pktinfo" "ipi_spec_dst" "ac_cv_member_struct_in_pktinfo_ipi_spec_dst" "
diff --git a/configure.ac b/configure.ac
index 37e1bf6f4bca..e06c1d6690aa 100644
--- a/configure.ac
+++ b/configure.ac
@@ -938,6 +938,12 @@ if test $ac_cv_func_daemon = yes; then
 ])
 fi
 
+AC_CHECK_MEMBERS([struct sockaddr_un.sun_len],,,[
+AC_INCLUDES_DEFAULT
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+])
 AC_CHECK_MEMBERS([struct in_pktinfo.ipi_spec_dst],,,[
 AC_INCLUDES_DEFAULT
 #if HAVE_SYS_PARAM_H
diff --git a/daemon/remote.c b/daemon/remote.c
index a1d2628a904a..a5be6d68c882 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -142,6 +142,7 @@ timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
  * The following function was generated using the openssl utility, using
  * the command : "openssl dhparam -dsaparam -C 512"
  */
+#ifndef S_SPLINT_S
 DH *get_dh512()
 {
 	static unsigned char dh512_p[]={
@@ -170,6 +171,7 @@ DH *get_dh512()
 	dh->length = 160;
 	return(dh);
 }
+#endif /* SPLINT */
 
 struct daemon_remote*
 daemon_remote_create(struct config_file* cfg)
@@ -299,6 +301,7 @@ void daemon_remote_delete(struct daemon_remote* rc)
  * @param nr: port nr
  * @param list: list head
  * @param noproto_is_err: if lack of protocol support is an error.
+ * @param cfg: config with username for chown of unix-sockets.
  * @return false on failure.
  */
 static int
@@ -326,7 +329,7 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 		if(fd != -1) {
 			if (cfg->username && cfg->username[0])
 				chown(ip, cfg->uid, cfg->gid);
-			chmod(ip, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+			chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP));
 		}
 	} else {
 		hints.ai_socktype = SOCK_STREAM;
diff --git a/daemon/unbound.c b/daemon/unbound.c
index e48a6b5ea951..a31b0392ffdb 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -441,8 +441,6 @@ static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	const char** cfgfile)
 {
-	log_assert(cfg);
-
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;
 
@@ -653,6 +651,7 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
 			log_warn("Continuing with default config settings");
 		}
 		apply_settings(daemon, cfg, cmdline_verbose, debug_mode);
+		config_lookup_uid(cfg);
 	
 		/* prepare */
 		if(!daemon_open_shared_ports(daemon))
diff --git a/doc/Changelog b/doc/Changelog
index 192b87c84129..1bd19f19c436 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,11 @@
 8 December 2014: Wouter
 	- Fix CVE-2014-8602: denial of service by making resolver chase
 	  endless series of delegations.
+	- patch for remote control over local sockets, from Dag-Erling
+	  Smorgrav, Ilya Bakulin.  Use control-interface: /path/sock and
+	  control-use-cert: no.
+	- Fixup that patch and uid lookup (only for daemon).
+	- coded the default of control-use-cert, to yes.
 
 1 December 2014: Wouter
 	- Fix bug#632: unbound fails to build on AArch64, protects
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 9b23fd64da1b..d4420e26a0a4 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -976,7 +976,7 @@ default is 8953.
 If you change this and permissions have been dropped, you must restart
 the server for the change to take effect.
 .TP 5
-.B control-use-cert: \fI<yes or no>
+.B control\-use\-cert: \fI<yes or no>
 Whether to require certificate authentication of control connections.
 The default is "yes".
 This should not be changed unless there are other mechanisms in place
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index 69c68b2807ff..0ce0a6b7b175 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -576,15 +576,19 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 }
 
 int
-create_local_accept_sock(char *path, int* noproto)
+create_local_accept_sock(const char *path, int* noproto)
 {
 #ifdef HAVE_SYS_UN_H
 	int s;
 	struct sockaddr_un sun;
 
-	sun.sun_len = sizeof(sun);
+#ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
+	/* this member exists on BSDs, not Linux */
+	sun.sun_len = (sa_family_t)sizeof(sun);
+#endif
 	sun.sun_family = AF_LOCAL;
-	strlcpy(sun.sun_path, path, 104);
+	/* length is 92-108, 104 on FreeBSD */
+	(void)strlcpy(sun.sun_path, path, sizeof(sun.sun_path));
 
 	if ((s = socket(PF_LOCAL, SOCK_STREAM, 0)) == -1) {
 		log_err("Cannot create local socket %s (%s)",
@@ -600,7 +604,7 @@ create_local_accept_sock(char *path, int* noproto)
 	}
 
 	if (bind(s, (struct sockaddr *)&sun,
-		sizeof(struct sockaddr_un)) == -1) {
+		(socklen_t)sizeof(struct sockaddr_un)) == -1) {
 		log_err("Cannot bind local socket %s (%s)",
 			path, strerror(errno));
 		return -1;
@@ -616,6 +620,7 @@ create_local_accept_sock(char *path, int* noproto)
 		return -1;
 	}
 
+	(void)noproto; /*unused*/
 	return s;
 #else
 	log_err("Local sockets are not supported");
diff --git a/services/listen_dnsport.h b/services/listen_dnsport.h
index 0513b5d6c01b..e9883a8f4f97 100644
--- a/services/listen_dnsport.h
+++ b/services/listen_dnsport.h
@@ -214,6 +214,6 @@ int create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
  *	are not supported.
  * @return: the socket. -1 on error.
  */
-int create_local_accept_sock(char* path, int* noproto);
+int create_local_accept_sock(const char* path, int* noproto);
 
 #endif /* LISTEN_DNSPORT_H */
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 37e840bad799..ac8d96857d47 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -140,7 +140,7 @@ static void ssl_err(const char* s)
 static SSL_CTX*
 setup_ctx(struct config_file* cfg)
 {
-	char* s_cert, *c_key, *c_cert;
+	char* s_cert=NULL, *c_key=NULL, *c_cert=NULL;
 	SSL_CTX* ctx;
 
 	if(cfg->remote_control_use_cert) {
@@ -206,9 +206,11 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 	} else if(svr[0] == '/') {
 		struct sockaddr_un* sun = (struct sockaddr_un *) &addr;
 		sun->sun_family = AF_LOCAL;
-		sun->sun_len = sizeof(sun);
-		strlcpy(sun->sun_path, svr, 104);
-		addrlen = sizeof(struct sockaddr_un);
+#ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
+		sun->sun_len = (sa_family_t)sizeof(sun);
+#endif
+		(void)strlcpy(sun->sun_path, svr, sizeof(sun->sun_path));
+		addrlen = (socklen_t)sizeof(struct sockaddr_un);
 		addrfamily = AF_LOCAL;
 #endif
 	} else {
diff --git a/util/config_file.c b/util/config_file.c
index bb39cf9bd7a2..3554e3fa0505 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -201,6 +201,7 @@ config_create(void)
 	cfg->remote_control_enable = 0;
 	cfg->control_ifs = NULL;
 	cfg->control_port = UNBOUND_CONTROL_PORT;
+	cfg->remote_control_use_cert = 1;
 	cfg->minimal_responses = 0;
 	cfg->rrset_roundrobin = 0;
 	cfg->max_udp_size = 4096;
@@ -805,16 +806,6 @@ config_read(struct config_file* cfg, const char* filename, const char* chroot)
 		return 0;
 	}
 
-#ifdef HAVE_GETPWNAM
-	/* translate username into uid and gid */
-	if(cfg->username && cfg->username[0]) {
-		struct passwd *pwd;
-		if((pwd = getpwnam(cfg->username)) == NULL)
-			log_err("user '%s' does not exist.", cfg->username);
-		cfg->uid = pwd->pw_uid;
-		cfg->gid = pwd->pw_gid;
-	}
-#endif
 	return 1;
 }
 
@@ -1203,6 +1194,20 @@ config_apply(struct config_file* config)
 	log_set_time_asc(config->log_time_ascii);
 }
 
+void config_lookup_uid(struct config_file* cfg)
+{
+#ifdef HAVE_GETPWNAM
+	/* translate username into uid and gid */
+	if(cfg->username && cfg->username[0]) {
+		struct passwd *pwd;
+		if((pwd = getpwnam(cfg->username)) == NULL)
+			log_err("user '%s' does not exist.", cfg->username);
+		cfg->uid = pwd->pw_uid;
+		cfg->gid = pwd->pw_gid;
+	}
+#endif
+}
+
 /** 
  * Calculate string length of full pathname in original filesys
  * @param fname: the path name to convert.
diff --git a/util/config_file.h b/util/config_file.h
index fd35d7863ae1..327eadc76f7b 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -426,6 +426,12 @@ void config_delete(struct config_file* config);
  */
 void config_apply(struct config_file* config);
 
+/**
+ * Find username, sets uid and gid.
+ * @param config: the config structure.
+ */
+void config_lookup_uid(struct config_file* config);
+
 /**
  * Set the given keyword to the given value.
  * @param config: where to store config

From fe0c01d26579d19ddf439fb46ef0bd3cc2bc7f4c Mon Sep 17 00:00:00 2001
From: des <des@FreeBSD.org>
Date: Sun, 26 Apr 2015 11:23:26 +0000
Subject: [PATCH 5/8] import unbound 1.5.2

---
 Makefile.in                          |  184 +-
 compat/getentropy_linux.c            |   14 +-
 config.h.in                          |    9 +-
 configure                            |   65 +-
 configure.ac                         |   16 +-
 contrib/unbound_cache.cmd            |   64 +-
 contrib/unbound_cache.sh             |   85 +-
 contrib/unbound_munin_               |  172 +-
 contrib/warmup.cmd                   |  169 +-
 contrib/warmup.sh                    |  163 +-
 daemon/remote.c                      |    4 +
 daemon/unbound.c                     |    4 +-
 daemon/worker.c                      |    2 +-
 doc/Changelog                        |   88 +-
 doc/README                           |    2 +-
 doc/example.conf.in                  |   12 +-
 doc/libunbound.3.in                  |    4 +-
 doc/unbound-anchor.8.in              |    2 +-
 doc/unbound-checkconf.8.in           |    6 +-
 doc/unbound-control.8.in             |    2 +-
 doc/unbound-host.1.in                |    2 +-
 doc/unbound.8.in                     |    4 +-
 doc/unbound.conf.5.in                |   16 +-
 iterator/iter_scrub.c                |    4 +-
 iterator/iter_utils.c                |   36 +
 iterator/iter_utils.h                |    9 +
 iterator/iterator.c                  |   15 +-
 libunbound/libworker.c               |    6 +-
 libunbound/python/libunbound.i       |    8 +-
 pythonmod/interface.i                |  155 ++
 pythonmod/pythonmod_utils.c          |   15 +
 pythonmod/pythonmod_utils.h          |    4 +
 services/listen_dnsport.c            |   66 +-
 services/localzone.c                 |   29 +-
 services/localzone.h                 |    9 +-
 smallapp/unbound-checkconf.c         |   20 +-
 smallapp/unbound-control-setup.sh.in |    3 +-
 smallapp/unbound-control.c           |    8 +-
 testcode/do-tests.sh                 |    2 +-
 testcode/testbed.sh                  |  133 --
 testcode/testbed.txt                 |   38 -
 testdata/ctrl_pipe.tpkg              |  Bin 0 -> 6451 bytes
 testdata/fwd_capsid_strip.tpkg       |  Bin 0 -> 1603 bytes
 testdata/val_spurious_ns.rpl         |  151 ++
 util/config_file.c                   |   10 +
 util/config_file.h                   |    2 +
 util/configlexer.c                   | 2556 +++++++++++++-------------
 util/configlexer.lex                 |    1 +
 util/configparser.c                  | 1584 ++++++++--------
 util/configparser.h                  |  218 +--
 util/configparser.y                  |   18 +-
 util/iana_ports.inc                  |    5 +
 util/net_help.c                      |    7 +-
 util/rtt.c                           |    2 +
 util/rtt.h                           |    2 +-
 validator/val_secalgo.c              |    3 +-
 validator/val_utils.c                |   12 +
 validator/val_utils.h                |    7 +
 validator/validator.c                |   57 +
 59 files changed, 3593 insertions(+), 2691 deletions(-)
 delete mode 100755 testcode/testbed.sh
 delete mode 100644 testcode/testbed.txt
 create mode 100644 testdata/ctrl_pipe.tpkg
 create mode 100644 testdata/fwd_capsid_strip.tpkg
 create mode 100644 testdata/val_spurious_ns.rpl

diff --git a/Makefile.in b/Makefile.in
index 02532a951d2f..0c7e0c638b9c 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -459,8 +459,8 @@ strip:
 	$(STRIP) unbound$(EXEEXT)
 	$(STRIP) unbound-checkconf$(EXEEXT)
 	$(STRIP) unbound-control$(EXEEXT)
-	$(STRIP) unbound-host$(EXEEXT)
-	$(STRIP) unbound-anchor$(EXEEXT)
+	$(STRIP) unbound-host$(EXEEXT) || $(STRIP) .libs/unbound-host$(EXEEXT)
+	$(STRIP) unbound-anchor$(EXEEXT) || $(STRIP) .libs/unbound-anchor$(EXEEXT)
 
 pythonmod-install:
 	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
@@ -576,6 +576,7 @@ depend:
 			-e 's?$$(srcdir)/util/configlexer.c?util/configlexer.c?g' \
 			-e 's?$$(srcdir)/util/configparser.c?util/configparser.c?g' \
 			-e 's?$$(srcdir)/util/configparser.h?util/configparser.h?g' \
+			-e 's?$$(srcdir)/dnstap/dnstap_config.h??g' \
 			-e 's?$$(srcdir)/pythonmod/pythonmod.h?$$(PYTHONMOD_HEADER)?g' \
 			-e 's!\(.*\)\.o[ :]*!\1.lo \1.o: !g' \
 			> $(DEPEND_TMP)
@@ -689,13 +690,14 @@ iter_utils.lo iter_utils.o: $(srcdir)/iterator/iter_utils.c config.h $(srcdir)/i
  $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/ldns/sbuffer.h
 listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
- $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/rbtree.h  $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/net_help.h $(srcdir)/ldns/sbuffer.h
 localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h \
  $(srcdir)/ldns/sbuffer.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h
 mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
@@ -711,15 +713,16 @@ modstack.lo modstack.o: $(srcdir)/services/modstack.c config.h $(srcdir)/service
  $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h
 outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/netevent.h
+ $(srcdir)/util/netevent.h 
 outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/ldns/sbuffer.h \
+  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rtt.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/dnstap/dnstap.h \
  
 alloc.lo alloc.o: $(srcdir)/util/alloc.c config.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
@@ -732,8 +735,8 @@ config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/ut
  $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/parseutil.h \
- $(srcdir)/util/iana_ports.inc
+ $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h $(srcdir)/ldns/wire2str.h \
+ $(srcdir)/ldns/parseutil.h $(srcdir)/util/iana_ports.inc
 configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
  $(srcdir)/util/config_file.h util/configparser.h
 configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
@@ -743,15 +746,16 @@ fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_nsec3.h \
- $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
- $(srcdir)/validator/autotrust.h $(srcdir)/util/storage/dnstree.h $(srcdir)/libunbound/libworker.h \
- $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h $(srcdir)/util/config_file.h
+ $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h  \
+ $(srcdir)/services/localzone.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
+ $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h \
+ $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/util/config_file.h
 locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/ldns/sbuffer.h
 mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
@@ -767,6 +771,7 @@ netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/neteve
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/dnstap/dnstap.h  \
  $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
@@ -854,8 +859,8 @@ val_nsec.lo val_nsec.o: $(srcdir)/validator/val_nsec.c config.h $(srcdir)/valida
  $(srcdir)/validator/val_utils.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
  $(srcdir)/ldns/rrdef.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h
-val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/validator/val_secalgo.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h \
  $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/keyraw.h \
  $(srcdir)/ldns/sbuffer.h \
  
@@ -884,6 +889,11 @@ dns64.lo dns64.o: $(srcdir)/dns64/dns64.c config.h $(srcdir)/dns64/dns64.h $(src
  $(srcdir)/util/regional.h
 checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/checklocks.h
+dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/dnstap/dnstap.pb-c.h
+dnstap.pb-c.lo dnstap.pb-c.o: $(srcdir)/dnstap/dnstap.pb-c.c $(srcdir)/dnstap/dnstap.pb-c.h
 unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/rrdef.h
@@ -894,7 +904,8 @@ unitlruhash.lo unitlruhash.o: $(srcdir)/testcode/unitlruhash.c config.h $(srcdir
  $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h
 unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h \
  $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/log.h \
+ $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/random.h
 unitmsgparse.lo unitmsgparse.o: $(srcdir)/testcode/unitmsgparse.c config.h $(srcdir)/util/log.h \
@@ -935,19 +946,21 @@ cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h \
  $(srcdir)/ldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h \
- $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
+ $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h $(srcdir)/ldns/wire2str.h \
+ $(srcdir)/ldns/str2wire.h
 daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/daemon/remote.h \
+  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/ldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
+ $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
@@ -959,11 +972,12 @@ remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/localzone.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
  $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
  $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
@@ -973,14 +987,15 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/daemon/daemon.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/outside_network.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
+ $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
 unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
- $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
+ $(srcdir)/daemon/remote.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
@@ -993,7 +1008,8 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
@@ -1008,9 +1024,10 @@ testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/test
  $(srcdir)/daemon/remote.h \
  $(srcdir)/util/config_file.h $(srcdir)/ldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/util/log.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
@@ -1021,7 +1038,8 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
@@ -1036,10 +1054,11 @@ acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/ac
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
 daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/daemon/remote.h \
+  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/ldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
+ $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
@@ -1049,12 +1068,12 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/daemon/daemon.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/outside_network.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
+ $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
 replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h
@@ -1063,10 +1082,10 @@ fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/t
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h  \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h
 lock_verify.lo lock_verify.o: $(srcdir)/testcode/lock_verify.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
@@ -1118,13 +1137,14 @@ libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/worker.h \
  $(srcdir)/ldns/sbuffer.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/netevent.h $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/util/netevent.h  $(srcdir)/services/mesh.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/ldns/str2wire.h
 unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/wire2str.h
 asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
@@ -1144,7 +1164,8 @@ perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir
 delayer.lo delayer.o: $(srcdir)/testcode/delayer.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h
 unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h \
- $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h
+ $(srcdir)/util/log.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h
 unbound-anchor.lo unbound-anchor.o: $(srcdir)/smallapp/unbound-anchor.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/ldns/rrdef.h \
  
@@ -1155,13 +1176,14 @@ pythonmod_utils.lo pythonmod_utils.o: $(srcdir)/pythonmod/pythonmod_utils.c conf
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
- $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/ldns/sbuffer.h
 win_svc.lo win_svc.o: $(srcdir)/winrc/win_svc.c config.h $(srcdir)/winrc/win_svc.h $(srcdir)/winrc/w_inst.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/daemon/remote.h \
+  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/ldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
+ $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/winsock_event.h
 w_inst.lo w_inst.o: $(srcdir)/winrc/w_inst.c config.h $(srcdir)/winrc/w_inst.h $(srcdir)/winrc/win_svc.h
 unbound-service-install.lo unbound-service-install.o: $(srcdir)/winrc/unbound-service-install.c config.h \
diff --git a/compat/getentropy_linux.c b/compat/getentropy_linux.c
index 32d58a7cdbb9..60e010db713a 100644
--- a/compat/getentropy_linux.c
+++ b/compat/getentropy_linux.c
@@ -474,22 +474,24 @@ getentropy_fallback(void *buf, size_t len)
 
 			HD(cnt);
 		}
-#ifdef AT_RANDOM
+#ifdef HAVE_GETAUXVAL
+#  ifdef AT_RANDOM
 		/* Not as random as you think but we take what we are given */
 		p = (char *) getauxval(AT_RANDOM);
 		if (p)
 			HR(p, 16);
-#endif
-#ifdef AT_SYSINFO_EHDR
+#  endif
+#  ifdef AT_SYSINFO_EHDR
 		p = (char *) getauxval(AT_SYSINFO_EHDR);
 		if (p)
 			HR(p, pgs);
-#endif
-#ifdef AT_BASE
+#  endif
+#  ifdef AT_BASE
 		p = (char *) getauxval(AT_BASE);
 		if (p)
 			HD(p);
-#endif
+#  endif
+#endif /* HAVE_GETAUXVAL */
 
 		SHA512_Final(results, &ctx);
 		memcpy((char*)buf + i, results, min(sizeof(results), len - i));
diff --git a/config.h.in b/config.h.in
index a8fd05cb5286..c36d4b98b0f7 100644
--- a/config.h.in
+++ b/config.h.in
@@ -42,7 +42,7 @@
 /* Whether the C compiler accepts the "unused" attribute */
 #undef HAVE_ATTR_UNUSED
 
-/* Define to 1 if your system has a working `chown' function. */
+/* Define to 1 if you have the `chown' function. */
 #undef HAVE_CHOWN
 
 /* Define to 1 if you have the `chroot' function. */
@@ -146,6 +146,9 @@
 /* Whether getaddrinfo is available */
 #undef HAVE_GETADDRINFO
 
+/* Define to 1 if you have the `getauxval' function. */
+#undef HAVE_GETAUXVAL
+
 /* Define to 1 if you have the `getentropy' function. */
 #undef HAVE_GETENTROPY
 
@@ -799,6 +802,10 @@
 #define ARG_LL "%I64"
 #endif
 
+#ifndef AF_LOCAL
+#define AF_LOCAL AF_UNIX
+#endif
+
 
  
 #ifdef HAVE_ATTR_FORMAT
diff --git a/configure b/configure
index 8c6c0785260c..26e3e8296b69 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.5.1.
+# Generated by GNU Autoconf 2.69 for unbound 1.5.2.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.5.1'
-PACKAGE_STRING='unbound 1.5.1'
+PACKAGE_VERSION='1.5.2'
+PACKAGE_STRING='unbound 1.5.2'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''
 
@@ -733,6 +733,7 @@ UNBOUND_PIDFILE
 UNBOUND_SHARE_DIR
 UNBOUND_CHROOT_DIR
 UNBOUND_RUN_DIR
+ub_conf_dir
 ub_conf_file
 EGREP
 GREP
@@ -1387,7 +1388,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.5.1 to adapt to many kinds of systems.
+\`configure' configures unbound 1.5.2 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1452,7 +1453,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.5.1:";;
+     short | recursive ) echo "Configuration of unbound 1.5.2:";;
    esac
   cat <<\_ACEOF
 
@@ -1627,7 +1628,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.5.1
+unbound configure 1.5.2
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2336,7 +2337,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.5.1, which was
+It was created by unbound $as_me 1.5.2, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2688,11 +2689,11 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=5
 
-UNBOUND_VERSION_MICRO=1
+UNBOUND_VERSION_MICRO=2
 
 
 LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=3
+LIBUNBOUND_REVISION=5
 LIBUNBOUND_AGE=3
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2732,7 +2733,8 @@ LIBUNBOUND_AGE=3
 # 1.4.21 had 4:1:2
 # 1.4.22 had 4:1:2
 # 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
-# 1.5.1 had 5:4:3
+# 1.5.1 had 5:3:3
+# 1.5.2 had 5:5:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -4047,6 +4049,30 @@ cat >>confdefs.h <<_ACEOF
 #define CONFIGFILE "$hdr_config"
 _ACEOF
 
+ub_conf_dir=`$as_dirname -- "$ub_conf_file" ||
+$as_expr X"$ub_conf_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+	 X"$ub_conf_file" : 'X\(//\)[^/]' \| \
+	 X"$ub_conf_file" : 'X\(//\)$' \| \
+	 X"$ub_conf_file" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X"$ub_conf_file" |
+    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)[^/].*/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\).*/{
+	    s//\1/
+	    q
+	  }
+	  s/.*/./; q'`
+
 
 # Determine run, chroot directory and pidfile locations
 
@@ -17932,7 +17958,7 @@ if test "$ac_res" != no; then :
 
 fi
 
-for ac_func in tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent
+for ac_func in tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -18269,6 +18295,17 @@ _ACEOF
 
 fi
 
+done
+
+				for ac_func in getauxval
+do :
+  ac_fn_c_check_func "$LINENO" "getauxval" "ac_cv_func_getauxval"
+if test "x$ac_cv_func_getauxval" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_GETAUXVAL 1
+_ACEOF
+
+fi
 done
 
 				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing clock_gettime" >&5
@@ -18768,7 +18805,7 @@ _ACEOF
 
 
 
-version=1.5.1
+version=1.5.2
 
 date=`date +'%b %e, %Y'`
 
@@ -19283,7 +19320,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.5.1, which was
+This file was extended by unbound $as_me 1.5.2, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -19349,7 +19386,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.5.1
+unbound config.status 1.5.2
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index e06c1d6690aa..8d496ce9bbf1 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10,14 +10,14 @@ sinclude(dnstap/dnstap.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[5])
-m4_define([VERSION_MICRO],[1])
+m4_define([VERSION_MICRO],[2])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=3
+LIBUNBOUND_REVISION=5
 LIBUNBOUND_AGE=3
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -57,7 +57,8 @@ LIBUNBOUND_AGE=3
 # 1.4.21 had 4:1:2
 # 1.4.22 had 4:1:2
 # 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
-# 1.5.1 had 5:4:3
+# 1.5.1 had 5:3:3
+# 1.5.2 had 5:5:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -118,6 +119,8 @@ AC_ARG_WITH([conf_file],
 AC_SUBST(ub_conf_file)
 ACX_ESCAPE_BACKSLASH($ub_conf_file, hdr_config)
 AC_DEFINE_UNQUOTED(CONFIGFILE, ["$hdr_config"], [Pathname to the Unbound configuration file])
+ub_conf_dir=`AS_DIRNAME(["$ub_conf_file"])`
+AC_SUBST(ub_conf_dir)
 
 # Determine run, chroot directory and pidfile locations
 AC_ARG_WITH(run-dir, 
@@ -975,7 +978,7 @@ AC_INCLUDES_DEFAULT
 #endif
 ])
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
 AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
@@ -1026,6 +1029,7 @@ if test "$USE_NSS" = "no"; then
 					AC_LIBOBJ(sha512)
 				])
 				AC_CHECK_HEADERS([sys/sysctl.h],,, [AC_INCLUDES_DEFAULT])
+				AC_CHECK_FUNCS([getauxval])
 				AC_SEARCH_LIBS([clock_gettime], [rt])
 			;;
 			esac
@@ -1211,6 +1215,10 @@ dnl includes
 #else
 #define ARG_LL "%I64"
 #endif
+
+#ifndef AF_LOCAL
+#define AF_LOCAL AF_UNIX
+#endif
 ]
 
 AHX_CONFIG_FORMAT_ATTRIBUTE
diff --git a/contrib/unbound_cache.cmd b/contrib/unbound_cache.cmd
index 0f0069388dfb..532162b16191 100644
--- a/contrib/unbound_cache.cmd
+++ b/contrib/unbound_cache.cmd
@@ -2,7 +2,7 @@
 rem --------------------------------------------------------------
 rem -- DNS cache save/load script
 rem --
-rem -- Version 1.0
+rem -- Version 1.2
 rem -- By Yuri Voinov (c) 2014
 rem --------------------------------------------------------------
 
@@ -19,47 +19,87 @@ exit 1
 
 :start
 
-set arg=%1
+rem arg1 - command (optional)
+rem arg2 - file name (optional)
+set arg1=%1
+set arg2=%2
 
-if /I "%arg%" == "-h" goto help
+if /I "%arg1%" == "-h" goto help
 
-if "%arg%" == "" (
+if "%arg1%" == "" (
 echo Loading cache from %program_path%\%fname%
+dir /a %program_path%\%fname%
 type %program_path%\%fname%|%uc% load_cache
 goto end
 )
 
-if /I "%arg%" == "-s" (
+if defined %arg2% (goto Not_Defined) else (goto Defined)
+
+rem If file not specified; use default dump file
+:Not_defined
+if /I "%arg1%" == "-s" (
 echo Saving cache to %program_path%\%fname%
 %uc% dump_cache>%program_path%\%fname%
+dir /a %program_path%\%fname%
 echo ok
 goto end
 )
 
-if /I "%arg%" == "-l" (
+if /I "%arg1%" == "-l" (
+echo Loading cache from %program_path%\%fname%
+dir /a %program_path%\%fname%
+type %program_path%\%fname%|%uc% load_cache
+goto end
+)
+
+if /I "%arg1%" == "-r" (
+echo Saving cache to %program_path%\%fname%
+dir /a %program_path%\%fname%
+%uc% dump_cache>%program_path%\%fname%
+echo ok
 echo Loading cache from %program_path%\%fname%
 type %program_path%\%fname%|%uc% load_cache
 goto end
 )
 
-if /I "%arg%" == "-r" (
-echo Saving cache to %program_path%\%fname%
-%uc% dump_cache>%program_path%\%fname%
+rem If file name specified; use this filename
+:Defined
+if /I "%arg1%" == "-s" (
+echo Saving cache to %arg2%
+%uc% dump_cache>%arg2%
+dir /a %arg2%
 echo ok
-echo Loading cache from %program_path%\%fname%
-type %program_path%\%fname%|%uc% load_cache
+goto end
+)
+
+if /I "%arg1%" == "-l" (
+echo Loading cache from %arg2%
+dir /a %arg2%
+type %arg2%|%uc% load_cache
+goto end
+)
+
+if /I "%arg1%" == "-r" (
+echo Saving cache to %arg2%
+dir /a %arg2%
+%uc% dump_cache>%arg2%
+echo ok
+echo Loading cache from %arg2%
+type %arg2%|%uc% load_cache
 goto end
 )
 
 :help
-echo Usage: unbound_cache.cmd [-s] or [-l] or [-r] or [-h]
+echo Usage: unbound_cache.cmd [-s] or [-l] or [-r] or [-h] [filename]
 echo.
 echo l - Load - default mode. Warming up Unbound DNS cache from saved file. cache-ttl must be high value.
 echo s - Save - save Unbound DNS cache contents to plain file with domain names.
 echo r - Reload - reloadind new cache entries and refresh existing cache
 echo h - this screen.
+echo filename - file to save/load dumped cache. If not specified, %program_path%\%fname% will be used instead.
 echo Note: Run without any arguments will be in default mode.
 echo       Also, unbound-control must be configured.
 exit 1
 
 :end
+exit 0
diff --git a/contrib/unbound_cache.sh b/contrib/unbound_cache.sh
index c3dd9c3a2df9..b3e876ba9012 100755
--- a/contrib/unbound_cache.sh
+++ b/contrib/unbound_cache.sh
@@ -1,13 +1,13 @@
 #!/sbin/sh
-#
+
 # --------------------------------------------------------------
 # -- DNS cache save/load script
 # --
-# -- Version 1.0
+# -- Version 1.2
 # -- By Yuri Voinov (c) 2006, 2014
 # --------------------------------------------------------------
 #
-# ident   "@(#)unbound_cache.sh     1.1     14/04/26 YV"
+# ident   "@(#)unbound_cache.sh     1.2     14/10/30 YV"
 #
 
 #############
@@ -27,9 +27,10 @@ BASENAME=`which basename`
 CAT=`which cat`
 CUT=`which cut`
 ECHO=`which echo`
+EXPR=`which expr`
 GETOPT=`which getopt`
 ID=`which id`
-PRINTF=`which printf`
+LS=`which ls`
 
 ###############
 # Subroutines #
@@ -38,12 +39,13 @@ PRINTF=`which printf`
 usage_note ()
 {
 # Script usage note
- $ECHO "Usage: `$BASENAME $0` [-s] or [-l] or [-r] or [-h]"
- $ECHO
+ $ECHO "Usage: `$BASENAME $0` [-s] or [-l] or [-r] or [-h] [filename]"
+ $ECHO .
  $ECHO "l - Load - default mode. Warming up Unbound DNS cache from saved file. cache-ttl must be high value."
  $ECHO "s - Save - save Unbound DNS cache contents to plain file with domain names."
  $ECHO "r - Reload - reloadind new cache entries and refresh existing cache"
  $ECHO "h - this screen."
+ $ECHO "filename - file to save/load dumped cache. If not specified, $CONF/$FNAME will be used instead."
  $ECHO "Note: Run without any arguments will be in default mode."
  $ECHO "      Also, unbound-control must be configured."
  exit 0
@@ -68,7 +70,12 @@ check_uc ()
 
 check_saved_file ()
 {
- if [ ! -f "$CONF/$FNAME" ]; then
+ filename=$1
+ if [ ! -z "$filename" -a ! -f "$filename" ]; then
+  $ECHO .
+  $ECHO "ERROR: File $filename does not exists. Save it first."
+  exit 1
+ elif [ ! -f "$CONF/$FNAME" ]; then
   $ECHO .
   $ECHO "ERROR: File $CONF/$FNAME does not exists. Save it first."
   exit 1
@@ -78,24 +85,42 @@ check_saved_file ()
 save_cache ()
 {
  # Save unbound cache
- $PRINTF "Saving cache in $CONF/$FNAME..."
- $UC dump_cache>$CONF/$FNAME
+ filename=$1
+ if [ -z "$filename" ]; then
+  $ECHO "Saving cache in $CONF/$FNAME..."
+  $UC dump_cache>$CONF/$FNAME
+  $LS -lh $CONF/$FNAME
+ else
+  $ECHO "Saving cache in $filename..."
+  $UC dump_cache>$filename
+  $LS -lh $filename
+ fi
  $ECHO "ok"
 }
 
 load_cache ()
 {
- # Load saved cache contents and warmup DNS cache
- $PRINTF "Loading cache from saved $CONF/$FNAME..."
- check_saved_file
- $CAT $CONF/$FNAME|$UC load_cache
+ # Load saved cache contents and warmup cache
+ filename=$1
+ if [ -z "$filename" ]; then
+  $ECHO "Loading cache from saved $CONF/$FNAME..."
+  $LS -lh $CONF/$FNAME
+  check_saved_file $filename
+  $CAT $CONF/$FNAME|$UC load_cache
+ else
+  $ECHO "Loading cache from saved $filename..."
+  $LS -lh $filename
+  check_saved_file $filename
+  $CAT $filename|$UC load_cache
+ fi
 }
 
 reload_cache ()
 {
  # Reloading and refresh existing cache and saved dump
- save_cache
- load_cache
+ filename=$1
+ save_cache $filename
+ load_cache $filename
 }
 
 ##############
@@ -109,27 +134,41 @@ root_check
 check_uc
 
 # Check command-line arguments
-if [ "x$1" = "x" ]; then
-# If arguments list empty, load cache by default
+if [ "x$*" = "x" ]; then
+ # If arguments list empty,load cache by default
  load_cache
 else
- arg_list=$1
+ arg_list=$*
  # Parse command line
  set -- `$GETOPT sSlLrRhH: $arg_list` || {
   usage_note 1>&2
  }
 
-  # Read arguments
+ # Read arguments
  for i in $arg_list
   do
    case $i in
-    -s | -S) save_cache;;
-    -l | -L) load_cache;;
-    -r | -R) reload_cache;;
+    -s | -S) save="1";;
+    -l | -L) save="0";;
+    -r | -R) save="2";;
     -h | -H | \?) usage_note;;
+    *) shift
+       file=$1
+       break;;
    esac
-   break
+   shift
   done
+
+ # Remove trailing --
+ shift `$EXPR $OPTIND - 1`
+fi
+
+if [ "$save" = "1" ]; then
+ save_cache $file
+elif [ "$save" = "0" ]; then
+ load_cache $file
+elif [ "$save" = "2" ]; then
+ reload_cache $file
 fi
 
 exit 0
\ No newline at end of file
diff --git a/contrib/unbound_munin_ b/contrib/unbound_munin_
index 1f9f39a3ebb2..69e9f31163ca 100755
--- a/contrib/unbound_munin_
+++ b/contrib/unbound_munin_
@@ -210,6 +210,7 @@ exist_config ( ) {
 	if grep '^'$1'=' $state >/dev/null 2>&1; then
 		echo "$mn.label $2"
 		echo "$mn.min 0"
+		echo "$mn.type ABSOLUTE"
 	fi
 }
 
@@ -218,6 +219,7 @@ p_config ( ) {
 	mn=`echo $1 | sed $ABBREV | tr . _`
 	echo $mn.label "$2"
 	echo $mn.min 0
+	echo $mn.type $3
 }
 
 if test "$1" = "config" ; then
@@ -228,20 +230,21 @@ if test "$1" = "config" ; then
 	hits)
 		echo "graph_title Unbound DNS traffic and cache hits"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
 			sed -e 's/=.*//'`; do
 			exist_config $x "queries handled by `basename $x .num.queries`"
 		done
-		p_config "total.num.queries" "total queries from clients"
-		p_config "total.num.cachehits" "cache hits"
-		p_config "total.num.prefetch" "cache prefetch"
-		p_config "num.query.tcp" "TCP queries"
-		p_config "num.query.tcpout" "TCP out queries"
-		p_config "num.query.ipv6" "IPv6 queries"
-		p_config "unwanted.queries" "queries that failed acl"
-		p_config "unwanted.replies" "unwanted or unsolicited replies"
+		p_config "total.num.queries" "total queries from clients" "ABSOLUTE"
+		p_config "total.num.cachehits" "cache hits" "ABSOLUTE"
+		p_config "total.num.prefetch" "cache prefetch" "ABSOLUTE"
+		p_config "num.query.tcp" "TCP queries" "ABSOLUTE"
+		p_config "num.query.tcpout" "TCP out queries" "ABSOLUTE"
+		p_config "num.query.ipv6" "IPv6 queries" "ABSOLUTE"
+		p_config "unwanted.queries" "queries that failed acl" "ABSOLUTE"
+		p_config "unwanted.replies" "unwanted or unsolicited replies" "ABSOLUTE"
 		echo "u_replies.warning $warn"
 		echo "u_replies.critical $crit"
 		echo "graph_info DNS queries to the recursive resolver. The unwanted replies could be innocent duplicate packets, late replies, or spoof threats."
@@ -250,11 +253,12 @@ if test "$1" = "config" ; then
 		echo "graph_title Unbound requestlist size"
 		echo "graph_args --base 1000 -l 0"
 		echo "graph_vlabel number of queries"
+		echo "graph_scale no"
 		echo "graph_category DNS"
-		p_config "total.requestlist.avg" "Average size of queue on insert"
-		p_config "total.requestlist.max" "Max size of queue (in 5 min)"
-		p_config "total.requestlist.overwritten" "Number of queries replaced by new ones"
-		p_config "total.requestlist.exceeded" "Number of queries dropped due to lack of space"
+		p_config "total.requestlist.avg" "Average size of queue on insert" "GAUGE"
+		p_config "total.requestlist.max" "Max size of queue (in 5 min)" "GAUGE"
+		p_config "total.requestlist.overwritten" "Number of queries replaced by new ones" "GAUGE"
+		p_config "total.requestlist.exceeded" "Number of queries dropped due to lack of space" "GAUGE"
 		echo "graph_info The queries that did not hit the cache and need recursion service take up space in the requestlist. If there are too many queries, first queries get overwritten, and at last resort dropped."
 		;;
 	memory)
@@ -262,128 +266,144 @@ if test "$1" = "config" ; then
 		echo "graph_args --base 1024 -l 0"
 		echo "graph_vlabel memory used in bytes"
 		echo "graph_category DNS"
-		p_config "mem.total.sbrk" "Total memory"
-		p_config "mem.cache.rrset" "RRset cache memory"
-		p_config "mem.cache.message" "Message cache memory"
-		p_config "mem.mod.iterator" "Iterator module memory"
-		p_config "mem.mod.validator" "Validator module and key cache memory"
-		p_config "msg.cache.count" "msg cache count"
-		p_config "rrset.cache.count" "rrset cache count"
-		p_config "infra.cache.count" "infra cache count"
-		p_config "key.cache.count" "key cache count"
+		p_config "mem.total.sbrk" "Total memory" "GAUGE"
+		p_config "mem.cache.rrset" "RRset cache memory" "GAUGE"
+		p_config "mem.cache.message" "Message cache memory" "GAUGE"
+		p_config "mem.mod.iterator" "Iterator module memory" "GAUGE"
+		p_config "mem.mod.validator" "Validator module and key cache memory" "GAUGE"
+		p_config "msg.cache.count" "msg cache count" "GAUGE"
+		p_config "rrset.cache.count" "rrset cache count" "GAUGE"
+		p_config "infra.cache.count" "infra cache count" "GAUGE"
+		p_config "key.cache.count" "key cache count" "GAUGE"
 		echo "graph_info The memory used by unbound."
 		;;
 	by_type)
 		echo "graph_title Unbound DNS queries by type"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.query.type" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.query.type.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
 		echo "graph_info queries by DNS RR type queried for"
 		;;
 	by_class)
 		echo "graph_title Unbound DNS queries by class"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.query.class" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.query.class.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
 		echo "graph_info queries by DNS RR class queried for."
 		;;
 	by_opcode)
 		echo "graph_title Unbound DNS queries by opcode"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.query.opcode" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.query.opcode.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
 		echo "graph_info queries by opcode in the query packet."
 		;;
 	by_rcode)
 		echo "graph_title Unbound DNS answers by return code"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel answer packets / second"
+		echo "graph_vlabel answer packets / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.answer.rcode" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.answer.rcode.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
-		p_config "num.answer.secure" "answer secure"
-		p_config "num.answer.bogus" "answer bogus"
-		p_config "num.rrset.bogus" "num rrsets marked bogus"
-		echo "graph_info answers sorted by return value. rrsets bogus is the number of rrsets marked bogus per second by the validator"
+		p_config "num.answer.secure" "answer secure" "ABSOLUTE"
+		p_config "num.answer.bogus" "answer bogus" "ABSOLUTE"
+		p_config "num.rrset.bogus" "num rrsets marked bogus" "ABSOLUTE"
+		echo "graph_info answers sorted by return value. rrsets bogus is the number of rrsets marked bogus per \${graph_period} by the validator"
 		;;
 	by_flags)
 		echo "graph_title Unbound DNS incoming queries by flags"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
-		p_config "num.query.flags.QR" "QR (query reply) flag"
-		p_config "num.query.flags.AA" "AA (auth answer) flag"
-		p_config "num.query.flags.TC" "TC (truncated) flag"
-		p_config "num.query.flags.RD" "RD (recursion desired) flag"
-		p_config "num.query.flags.RA" "RA (rec avail) flag"
-		p_config "num.query.flags.Z" "Z (zero) flag"
-		p_config "num.query.flags.AD" "AD (auth data) flag"
-		p_config "num.query.flags.CD" "CD (check disabled) flag"
-		p_config "num.query.edns.present" "EDNS OPT present"
-		p_config "num.query.edns.DO" "DO (DNSSEC OK) flag"
+		p_config "num.query.flags.QR" "QR (query reply) flag" "ABSOLUTE"
+		p_config "num.query.flags.AA" "AA (auth answer) flag" "ABSOLUTE"
+		p_config "num.query.flags.TC" "TC (truncated) flag" "ABSOLUTE"
+		p_config "num.query.flags.RD" "RD (recursion desired) flag" "ABSOLUTE"
+		p_config "num.query.flags.RA" "RA (rec avail) flag" "ABSOLUTE"
+		p_config "num.query.flags.Z" "Z (zero) flag" "ABSOLUTE"
+		p_config "num.query.flags.AD" "AD (auth data) flag" "ABSOLUTE"
+		p_config "num.query.flags.CD" "CD (check disabled) flag" "ABSOLUTE"
+		p_config "num.query.edns.present" "EDNS OPT present" "ABSOLUTE"
+		p_config "num.query.edns.DO" "DO (DNSSEC OK) flag" "ABSOLUTE"
 		echo "graph_info This graphs plots the flags inside incoming queries. For example, if QR, AA, TC, RA, Z flags are set, the query can be rejected. RD, AD, CD and DO are legitimately set by some software."
 		;;
 	histogram)
 		echo "graph_title Unbound DNS histogram of reply time"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		echo hcache.label "cache hits"
 		echo hcache.min 0
+		echo hcache.type ABSOLUTE
 		echo hcache.draw AREA
 		echo hcache.colour 999999
 		echo h64ms.label "0 msec - 66 msec"
 		echo h64ms.min 0
+		echo h64ms.type ABSOLUTE
 		echo h64ms.draw STACK
 		echo h64ms.colour 0000FF
 		echo h128ms.label "66 msec - 131 msec"
 		echo h128ms.min 0
+		echo h128ms.type ABSOLUTE
 		echo h128ms.colour 1F00DF
 		echo h128ms.draw STACK
 		echo h256ms.label "131 msec - 262 msec"
 		echo h256ms.min 0
+		echo h256ms.type ABSOLUTE
 		echo h256ms.draw STACK
 		echo h256ms.colour 3F00BF
 		echo h512ms.label "262 msec - 524 msec"
 		echo h512ms.min 0
+		echo h512ms.type ABSOLUTE
 		echo h512ms.draw STACK
 		echo h512ms.colour 5F009F
 		echo h1s.label "524 msec - 1 sec"
 		echo h1s.min 0
+		echo h1s.type ABSOLUTE
 		echo h1s.draw STACK
 		echo h1s.colour 7F007F
 		echo h2s.label "1 sec - 2 sec"
 		echo h2s.min 0
+		echo h2s.type ABSOLUTE
 		echo h2s.draw STACK
 		echo h2s.colour 9F005F
 		echo h4s.label "2 sec - 4 sec"
 		echo h4s.min 0
+		echo h4s.type ABSOLUTE
 		echo h4s.draw STACK
 		echo h4s.colour BF003F
 		echo h8s.label "4 sec - 8 sec"
 		echo h8s.min 0
+		echo h8s.type ABSOLUTE
 		echo h8s.draw STACK
 		echo h8s.colour DF001F
 		echo h16s.label "8 sec - ..."
 		echo h16s.min 0
+		echo h16s.type ABSOLUTE
 		echo h16s.draw STACK
 		echo h16s.colour FF0000
 		echo "graph_info Histogram of the reply times for queries."
@@ -404,20 +424,6 @@ if test $value = 0 || test $value = "0.000000"; then
 fi
 elapsed="$value"
 
-# print value for $1 / elapsed
-print_qps ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	get_value $1
-	echo "$mn.value" `echo scale=6';' $value / $elapsed | bc `
-}
-
-# print qps if line already found in $2
-print_qps_line ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	value="`echo $2 | sed -e 's/^.*=//'`"
-	echo "$mn.value" `echo scale=6';' $value / $elapsed | bc `
-}
-
 # print value for $1
 print_value ( ) {
 	mn=`echo $1 | sed $ABBREV | tr . _`
@@ -425,6 +431,14 @@ print_value ( ) {
 	echo "$mn.value" $value
 }
 
+# print value if line already found in $2
+print_value_line ( ) {
+	mn=`echo $1 | sed $ABBREV | tr . _`
+	value="`echo $2 | sed -e 's/^.*=//'`"
+	echo "$mn.value" $value
+}
+
+
 case $id in
 hits)
 	for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
@@ -433,7 +447,7 @@ hits)
 		num.query.tcpout num.query.ipv6 unwanted.queries \
 		unwanted.replies; do
 		if grep "^"$x"=" $state >/dev/null 2>&1; then
-			print_qps $x
+			print_value $x
 		fi
 	done
 	;;
@@ -467,38 +481,38 @@ memory)
 by_type)
 	for x in `grep "^num.query.type" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
 	;;
 by_class)
 	for x in `grep "^num.query.class" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
 	;;
 by_opcode)
 	for x in `grep "^num.query.opcode" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
 	;;
 by_rcode)
 	for x in `grep "^num.answer.rcode" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
-	print_qps "num.answer.secure"
-	print_qps "num.answer.bogus"
-	print_qps "num.rrset.bogus"
+	print_value "num.answer.secure"
+	print_value "num.answer.bogus"
+	print_value "num.rrset.bogus"
 	;;
 by_flags)
 	for x in num.query.flags.QR num.query.flags.AA num.query.flags.TC num.query.flags.RD num.query.flags.RA num.query.flags.Z num.query.flags.AD num.query.flags.CD num.query.edns.present num.query.edns.DO; do
-		print_qps $x
+		print_value $x
 	done
 	;;
 histogram)
 	get_value total.num.cachehits
-	echo hcache.value `echo scale=6';' $value / $elapsed | bc `
+	echo hcache.value $value
 	r=0
 	for x in histogram.000000.000000.to.000000.000001 \
 		histogram.000000.000001.to.000000.000002 \
@@ -520,21 +534,21 @@ histogram)
 		get_value $x
 		r=`expr $r + $value`
 	done
-	echo h64ms.value `echo scale=6';' $r / $elapsed | bc `
+	echo h64ms.value $r
 	get_value histogram.000000.065536.to.000000.131072
-	echo h128ms.value `echo scale=6';' $value / $elapsed | bc `
+	echo h128ms.value $value
 	get_value histogram.000000.131072.to.000000.262144
-	echo h256ms.value `echo scale=6';' $value / $elapsed | bc `
+	echo h256ms.value $value
 	get_value histogram.000000.262144.to.000000.524288
-	echo h512ms.value `echo scale=6';' $value / $elapsed | bc `
+	echo h512ms.value $value
 	get_value histogram.000000.524288.to.000001.000000
-	echo h1s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h1s.value $value
 	get_value histogram.000001.000000.to.000002.000000
-	echo h2s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h2s.value $value
 	get_value histogram.000002.000000.to.000004.000000
-	echo h4s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h4s.value $value
 	get_value histogram.000004.000000.to.000008.000000
-	echo h8s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h8s.value $value
 	r=0
 	for x in histogram.000008.000000.to.000016.000000 \
 		histogram.000016.000000.to.000032.000000 \
@@ -555,6 +569,6 @@ histogram)
 		get_value $x
 		r=`expr $r + $value`
 	done
-	echo h16s.value `echo scale=6';' $r / $elapsed | bc `
+	echo h16s.value $r
 	;;
 esac
diff --git a/contrib/warmup.cmd b/contrib/warmup.cmd
index d7df01827382..b3895a86fe2e 100644
--- a/contrib/warmup.cmd
+++ b/contrib/warmup.cmd
@@ -1,68 +1,153 @@
 @echo off
 
 rem --------------------------------------------------------------
-rem -- Warm up DNS cache script by your own MRU domains
+rem -- Warm up DNS cache script by your own MRU domains or from
+rem -- file when it specified as script argument.
 rem --
-rem -- Version 1.0
+rem -- Version 1.1
 rem -- By Yuri Voinov (c) 2014
 rem --------------------------------------------------------------
 
+rem DNS host address
+set address="127.0.0.1"
+
 rem Check dig installed
 for /f "delims=" %%a in ('where dig') do @set dig=%%a
 if /I "%dig%"=="" echo Dig not found. If installed, add path to PATH environment variable. & exit 1
 echo Dig found: %dig%
 
-echo Warming up cache by MRU domains...
-rem dig -f my_domains 1>nul 2>nul
-rem echo Done.
+set arg=%1%
 
+if defined %arg% (goto builtin) else (goto from_file)
+
+:builtin
+echo Warming up cache by MRU domains...
 for %%a in (
-mail.ru
-my.mail.ru
-mra.mail.ru
+2gis.ru
+admir.kz
+adobe.com
 agent.mail.ru
-news.mail.ru
-icq.com
-lenta.ru
-gazeta.ru
-peerbet.ru
-www.opennet.ru
-snob.ru
+aimp.ru
+akamai.com
+akamai.net
+almaty.tele2.kz
+aol.com
+apple.com
+arin.com
 artlebedev.ru
-mail.google.com
-translate.google.com
+auto.mail.ru
+beeline.kz
+bing.com
+blogspot.com
+comodo.com
+dnscrypt.org
 drive.google.com
+drive.mail.ru
+facebook.com
+farmanager.com
+fb.com
+firefox.com
+forum.farmanager.com
+gazeta.ru
+getsharex.com
+gismeteo.ru
 google.com
 google.kz
-drive.google.com
-blogspot.com
-farmanager.com
-forum.farmanager.com
+google.ru
+googlevideo.com
+goto.kz
+iana.org
+icq.com
+imap.mail.ru
+instagram.com
+intel.com
+irr.kz
+java.com
+kaspersky.com
+kaspersky.ru
+kcell.kz
+krisha.kz
+lady.mail.ru
+lenta.ru
+libreoffice.org
+linkedin.com
+livejournal.com
+mail.google.com
+mail.ru
+microsoft.com
+mozilla.org
+mra.mail.ru
+munin-monitoring.org
+my.mail.ru
+news.bbcimg.co.uk
+news.mail.ru
+newsimg.bbc.net.uk
+nvidia.com
+odnoklassniki.ru
+ok.ru
+opencsw.org
+opendns.com
+opendns.org
+opennet.ru
+opera.com
+oracle.com
+peerbet.ru
+piriform.com
 plugring.farmanager.com
+privoxy.org
+qip.ru
+raidcall.com
+rambler.ru
+reddit.com
+ru.wikipedia.org
+shallalist.de
+skype.com
+snob.ru
+squid-cache.org
+squidclamav.darold.net
+squidguard.org
+ssl.comodo.com
+ssl.verisign.com
 symantec.com
 symantecliveupdate.com
-shalla.de
-torstatus.blutmagie.de
-torproject.org
-dnscrypt.org
-unbound.net
-getsharex.com
-skype.com
-vlc.org
-aimp.ru
-mozilla.org
-libreoffice.org
-piriform.com
-raidcall.com
-nvidia.com
-intel.com
-microsoft.com
-windowsupdate.com
-ru.wikipedia.org
-www.bbc.co.uk
+tele2.kz
 tengrinews.kz
-) do "%dig%" %%a 1>nul 2>nul
+thunderbird.com
+torproject.org
+torstatus.blutmagie.de
+translate.google.com
+unbound.net
+verisign.com
+vk.com
+vk.me
+vk.ru
+vkontakte.com
+vkontakte.ru
+vlc.org
+watsapp.net
+weather.mail.ru
+windowsupdate.com
+www.baidu.com
+www.bbc.co.uk
+www.internic.net
+www.opennet.ru
+www.topgear.com
+ya.ru
+yahoo.com
+yandex.com
+yandex.ru
+youtube.com
+ytimg.com
+) do "%dig%" %%a @%address% 1>nul 2>nul
+goto end
 
+:from_file
+echo Warming up cache from %1% file...
+%dig% -f %arg% @%address% 1>nul 2>nul 
+
+:end
 echo Saving cache...
-unbound_cache.cmd -s
+if exist unbound_cache.cmd unbound_cache.cmd -s
 echo Done.
+
+exit 0
\ No newline at end of file
diff --git a/contrib/warmup.sh b/contrib/warmup.sh
index 820f019d7122..b4d9135a68dd 100755
--- a/contrib/warmup.sh
+++ b/contrib/warmup.sh
@@ -1,65 +1,150 @@
 #!/bin/sh
 
 # --------------------------------------------------------------
-# -- Warm up DNS cache script by your own MRU domains
+# -- Warm up DNS cache script by your own MRU domains or from
+# -- file when it specified as script argument.
 # --
-# -- Version 1.0
+# -- Version 1.1
 # -- By Yuri Voinov (c) 2014
 # --------------------------------------------------------------
 
+# Default DNS host address
+address="127.0.0.1"
+
+cat=`which cat`
 dig=`which dig`
 
+if [ -z "$1" ]; then
 echo "Warming up cache by MRU domains..."
-$dig -f - >/dev/null 2>&1 <<EOT
-mail.ru
-my.mail.ru
-mra.mail.ru
+$dig -f - @$address >/dev/null 2>&1 <<EOT
+2gis.ru
+admir.kz
+adobe.com
 agent.mail.ru
-news.mail.ru
-icq.com
-lenta.ru
-gazeta.ru
-peerbet.ru
-www.opennet.ru
-snob.ru
+aimp.ru
+akamai.com
+akamai.net
+almaty.tele2.kz
+aol.com
+apple.com
+arin.com
 artlebedev.ru
-mail.google.com
-translate.google.com
+auto.mail.ru
+beeline.kz
+bing.com
+blogspot.com
+clamav.net
+comodo.com
+dnscrypt.org
 drive.google.com
+drive.mail.ru
+facebook.com
+farmanager.com
+fb.com
+firefox.com
+forum.farmanager.com
+gazeta.ru
+getsharex.com
+gismeteo.ru
 google.com
 google.kz
-drive.google.com
-blogspot.com
-farmanager.com
-forum.farmanager.com
+google.ru
+googlevideo.com
+goto.kz
+iana.org
+icq.com
+imap.mail.ru
+instagram.com
+instagram.com
+intel.com
+irr.kz
+java.com
+kaspersky.com
+kaspersky.ru
+kcell.kz
+krisha.kz
+lady.mail.ru
+lenta.ru
+libreoffice.org
+linkedin.com
+livejournal.com
+mail.google.com
+mail.ru
+microsoft.com
+mozilla.org
+mra.mail.ru
+munin-monitoring.org
+my.mail.ru
+news.bbcimg.co.uk
+news.mail.ru
+newsimg.bbc.net.uk
+nvidia.com
+odnoklassniki.ru
+ok.ru
+opencsw.org
+opendns.com
+opendns.org
+opennet.ru
+opera.com
+oracle.com
+peerbet.ru
+piriform.com
 plugring.farmanager.com
+privoxy.org
+qip.ru
+raidcall.com
+rambler.ru
+reddit.com
+ru.wikipedia.org
+shallalist.de
+skype.com
+snob.ru
+squid-cache.org
+squidclamav.darold.net
+squidguard.org
+ssl.comodo.com
+ssl.verisign.com
 symantec.com
 symantecliveupdate.com
-shalla.de
-torstatus.blutmagie.de
-torproject.org
-dnscrypt.org
-unbound.net
-getsharex.com
-skype.com
-vlc.org
-aimp.ru
-mozilla.org
-libreoffice.org
-piriform.com
-raidcall.com
-nvidia.com
-intel.com
-microsoft.com
-windowsupdate.com
-ru.wikipedia.org
-www.bbc.co.uk
+tele2.kz
 tengrinews.kz
+thunderbird.com
+torproject.org
+torstatus.blutmagie.de
+translate.google.com
+unbound.net
+verisign.com
+vk.com
+vk.me
+vk.ru
+vkontakte.com
+vkontakte.ru
+vlc.org
+watsapp.net
+weather.mail.ru
+windowsupdate.com
+www.baidu.com
+www.bbc.co.uk
+www.internic.net
+www.opennet.ru
+www.topgear.com
+ya.ru
+yahoo.com
+yandex.com
+yandex.ru
+youtube.com
+ytimg.com
 EOT
+else
+ echo "Warming up cache from $1 file..."
+ $cat $1 | $dig -f - @$address >/dev/null 2>&1 
+fi
+
 echo "Done."
 
 echo "Saving cache..."
-/usr/local/bin/unbound_cache.sh -s
+script=`which unbound_cache.sh`
+[ -f "$script" ] && $script -s
 echo "Done."
 
 exit 0
diff --git a/daemon/remote.c b/daemon/remote.c
index a5be6d68c882..7a8fdb75e75b 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -327,9 +327,13 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 		 * group as the user we run as.
 		 */
 		if(fd != -1) {
+#ifdef HAVE_CHOWN
 			if (cfg->username && cfg->username[0])
 				chown(ip, cfg->uid, cfg->gid);
 			chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP));
+#else
+			(void)cfg;
+#endif
 		}
 	} else {
 		hints.ai_socktype = SOCK_STREAM;
diff --git a/daemon/unbound.c b/daemon/unbound.c
index a31b0392ffdb..f6bd924a57b9 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -504,16 +504,18 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		writepid(daemon->pidfile, getpid());
 		if(cfg->username && cfg->username[0]) {
+#  ifdef HAVE_CHOWN
 			if(chown(daemon->pidfile, cfg->uid, cfg->gid) == -1) {
 				log_err("cannot chown %u.%u %s: %s",
 					(unsigned)cfg->uid, (unsigned)cfg->gid,
 					daemon->pidfile, strerror(errno));
 			}
+#  endif /* HAVE_CHOWN */
 		}
 	}
 #else
 	(void)daemon;
-#endif
+#endif /* HAVE_KILL */
 
 	/* Set user context */
 #ifdef HAVE_GETPWNAM
diff --git a/daemon/worker.c b/daemon/worker.c
index 59ae9dfcefcb..5edc21dd46e7 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -900,7 +900,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		goto send_reply;
 	}
 	if(local_zones_answer(worker->daemon->local_zones, &qinfo, &edns, 
-		c->buffer, worker->scratchpad)) {
+		c->buffer, worker->scratchpad, repinfo)) {
 		regional_free_all(worker->scratchpad);
 		if(sldns_buffer_limit(c->buffer) == 0) {
 			comm_point_drop_reply(repinfo);
diff --git a/doc/Changelog b/doc/Changelog
index 1bd19f19c436..4b3a4949a217 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,12 +1,94 @@
-8 December 2014: Wouter
-	- Fix CVE-2014-8602: denial of service by making resolver chase
-	  endless series of delegations.
+13 February 2015: Wouter
+	- Fix #643: doc/example.conf.in: unnecessary whitespace.
+
+12 February 2015: Wouter
+	- tag 1.5.2rc1
+
+11 February 2015: Wouter
+	- iana portlist update.
+
+10 February 2015: Wouter
+	- Fix scrubber with harden-glue turned off to reject NS (and other
+	  not-address) records.
+
+9 February 2015: Wouter
+	- Fix validation failure in case upstream forwarder (ISC BIND) does
+	  not have the same trust anchors and decides to insert unsigned NS
+	  record in authority section.
+
+2 February 2015: Wouter
+	- infra-cache-min-rtt patch from Florian Riehm, for expected long
+	  uplink roundtrip times.
+
+30 January 2015: Wouter
+	- Fix 0x20 capsforid fallback to omit gratuitous NS and additional
+	  section changes.
+	- Portability fix for Solaris ('sun' is not usable for a variable).
+
+29 January 2015: Wouter
+	- Fix pyunbound byte string representation for python3.
+
+26 January 2015: Wouter
+	- Fix unintended use of gcc extension for incomplete enum types,
+	  compile with pedantic c99 compliance (from Daniel Dickman).
+
+23 January 2015: Wouter
+	- windows port fixes, no AF_LOCAL, no chown, no chmod(grp).
+
+16 January 2015: Wouter
+	- unit test for local unix connection.  Documentation and log_addr
+	  does not inspect port for AF_LOCAL.
+	- unbound-checkconf -f prints chroot with pidfile path.
+
+13 January 2015: Wouter
+	- iana portlist update.
+
+12 January 2015: Wouter
+	- Cast sun_len sizeof to socklen_t.
+	- Fix pyunbound ord call, portable for python 2 and 3.
+
+7 January 2015: Wouter
+	- Fix warnings in pythonmod changes.
+
+6 January 2015: Wouter
+	- iana portlist update.
 	- patch for remote control over local sockets, from Dag-Erling
 	  Smorgrav, Ilya Bakulin.  Use control-interface: /path/sock and
 	  control-use-cert: no.
 	- Fixup that patch and uid lookup (only for daemon).
 	- coded the default of control-use-cert, to yes.
 
+5 January 2015: Wouter
+	- getauxval test for ppc64 linux compatibility.
+	- make strip works for unbound-host and unbound-anchor.
+	- patch from Stephane Lapie that adds to the python API, that
+	  exposes struct delegpt, and adds the find_delegation function.
+	- print query name when max target count is exceeded.
+	- patch from Stuart Henderson that fixes DESTDIR in
+	  unbound-control-setup for installs where config is not in
+	  the prefix location.
+	- Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing
+	  IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne).
+	- Updated contrib warmup.cmd/sh to support two modes - load
+	  from pre-defined list of domains or (with filename as argument)
+	  load from user-specified list of domains, and updated contrib
+	  unbound_cache.sh/cmd to support loading/save/reload cache to/from
+	  default path or (with secondary argument) arbitrary path/filename,
+	  from Yuri Voinov.
+	- Patch from Philip Paeps to contrib/unbound_munin_ that uses
+	  type ABSOLUTE.  Allows munin.conf: [idleserver.example.net]
+	  unbound_munin_hits.graph_period minute
+
+9 December 2014: Wouter
+	- svn trunk has 1.5.2 in development.
+	- config.guess and config.sub update from libtoolize.
+	- local-zone: example.com inform makes unbound log a message with
+	  client IP for queries in that zone.  Eg. for finding infected hosts.
+
+8 December 2014: Wouter
+	- Fix CVE-2014-8602: denial of service by making resolver chase
+	  endless series of delegations.
+
 1 December 2014: Wouter
 	- Fix bug#632: unbound fails to build on AArch64, protects
 	  getentropy compat code from calling sysctl if it is has been removed.
diff --git a/doc/README b/doc/README
index df92fccb5d36..5c6648599e5c 100644
--- a/doc/README
+++ b/doc/README
@@ -1,4 +1,4 @@
-README for Unbound 1.5.1
+README for Unbound 1.5.2
 Copyright 2007 NLnet Labs
 http://unbound.net
 
diff --git a/doc/example.conf.in b/doc/example.conf.in
index b95b3a6339c4..ddcb4f03d1bc 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.5.1.
+# See unbound.conf(5) man page, version 1.5.2.
 #
 # this is a comment.
 
@@ -138,6 +138,9 @@ server:
 	# the time to live (TTL) value for cached roundtrip times, lameness and
 	# EDNS version information for hosts. In seconds.
 	# infra-host-ttl: 900
+	
+	# minimum wait time for responses, increase if uplink is long. In msec.
+	# infra-cache-min-rtt: 50
 
 	# the number of slabs to use for the Infrastructure cache.
 	# the number of slabs must be a power of 2.
@@ -437,7 +440,7 @@ server:
 	# the amount of memory to use for the negative cache (used for DLV).
 	# plain value in bytes or you can append k, m or G. default is "1Mb". 
 	# neg-cache-size: 1m
-	
+
 	# By default, for a number of zones a small default 'nothing here'
 	# reply is built-in.  Query traffic is thus blocked.  If you
 	# wish to serve such zone you can unblock them by uncommenting one
@@ -497,6 +500,7 @@ server:
 	# o redirect serves the zone data for any subdomain in the zone.
 	# o nodefault can be used to normally resolve AS112 zones.
 	# o typetransparent resolves normally for other types and other names
+	# o inform resolves normally, but logs client IP address
 	#
 	# defaults are localhost address, reverse for 127.0.0.1 and ::1
 	# and nxdomain for AS112 zones. If you configure one of these zones
@@ -552,6 +556,10 @@ remote-control:
 	# set up the keys and certificates with unbound-control-setup.
 	# control-enable: no
 
+	# Set to no and use an absolute path as control-interface to use
+	# a unix local named pipe for unbound-control.
+	# control-use-cert: yes
+
 	# what interfaces are listened to for remote control.
 	# give 0.0.0.0 and ::0 to listen to all interfaces.
 	# control-interface: 127.0.0.1
diff --git a/doc/libunbound.3.in b/doc/libunbound.3.in
index 55a9cb286e6e..02f45e66fc69 100644
--- a/doc/libunbound.3.in
+++ b/doc/libunbound.3.in
@@ -1,4 +1,4 @@
-.TH "libunbound" "3" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
+.TH "libunbound" "3" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
 .\"
 .\" libunbound.3 -- unbound library functions manual
 .\"
@@ -42,7 +42,7 @@
 .B ub_ctx_zone_remove,
 .B ub_ctx_data_add,
 .B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.5.1 functions.
+\- Unbound DNS validating resolver 1.5.2 functions.
 .SH "SYNOPSIS"
 .B #include <unbound.h>
 .LP
diff --git a/doc/unbound-anchor.8.in b/doc/unbound-anchor.8.in
index 80a3438dcaac..aaba750ae0ed 100644
--- a/doc/unbound-anchor.8.in
+++ b/doc/unbound-anchor.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
+.TH "unbound-anchor" "8" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
 .\"
 .\" unbound-anchor.8 -- unbound anchor maintenance utility manual
 .\"
diff --git a/doc/unbound-checkconf.8.in b/doc/unbound-checkconf.8.in
index 5ab53480b6fe..93fe204a1aa2 100644
--- a/doc/unbound-checkconf.8.in
+++ b/doc/unbound-checkconf.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
+.TH "unbound-checkconf" "8" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
@@ -13,6 +13,7 @@ unbound\-checkconf
 .SH "SYNOPSIS"
 .B unbound\-checkconf
 .RB [ \-h ]
+.RB [ \-f ]
 .RB [ \-o
 .IR option ]
 .RI [ cfgfile ]
@@ -29,6 +30,9 @@ The available options are:
 .B \-h
 Show the version and commandline option help.
 .TP
+.B \-f
+Print full pathname, with chroot applied to it.  Use with the -o option.
+.TP
 .B \-o\fI option
 If given, after checking the config file the value of this option is 
 printed to stdout.  For "" (disabled) options an empty line is printed.
diff --git a/doc/unbound-control.8.in b/doc/unbound-control.8.in
index 92d2d1a9343d..95ed5908616b 100644
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
+.TH "unbound-control" "8" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
 .\"
 .\" unbound-control.8 -- unbound remote control manual
 .\"
diff --git a/doc/unbound-host.1.in b/doc/unbound-host.1.in
index d9e92bbe099a..475b04cc473e 100644
--- a/doc/unbound-host.1.in
+++ b/doc/unbound-host.1.in
@@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
+.TH "unbound\-host" "1" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
 .\"
 .\" unbound-host.1 -- unbound DNS lookup utility
 .\"
diff --git a/doc/unbound.8.in b/doc/unbound.8.in
index 3b74a3242ada..50a04b3d0a25 100644
--- a/doc/unbound.8.in
+++ b/doc/unbound.8.in
@@ -1,4 +1,4 @@
-.TH "unbound" "8" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
+.TH "unbound" "8" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -9,7 +9,7 @@
 .\"
 .SH "NAME"
 .B unbound
-\- Unbound DNS validating resolver 1.5.1.
+\- Unbound DNS validating resolver 1.5.2.
 .SH "SYNOPSIS"
 .B unbound
 .RB [ \-h ]
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index d4420e26a0a4..bbfce632e30f 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "Dec  8, 2014" "NLnet Labs" "unbound 1.5.1"
+.TH "unbound.conf" "5" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
@@ -301,6 +301,11 @@ by threads. Must be set to a power of 2.
 .B infra\-cache\-numhosts: \fI<number>
 Number of hosts for which information is cached. Default is 10000.
 .TP
+.B infra\-cache\-min\-rtt: \fI<msec>
+Lower limit for dynamic retransmit timeout calculation in infrastructure
+cache. Default is 50 milliseconds. Increase this value if using forwarders
+needing more time to do recursive name resolution.
+.TP
 .B do\-ip4: \fI<yes or no>
 Enable or disable whether ip4 queries are answered or issued. Default is yes.
 .TP
@@ -791,7 +796,7 @@ data leakage about the local network to the upstream DNS servers.
 .B local\-zone: \fI<zone> <type>
 Configure a local zone. The type determines the answer to give if
 there is no match from local\-data. The types are deny, refuse, static,
-transparent, redirect, nodefault, typetransparent, and are explained
+transparent, redirect, nodefault, typetransparent, inform, and are explained
 below. After that the default settings are listed. Use local\-data: to
 enter data into the local zone. Answers for local zones are authoritative
 DNS answers. By default the zones are class IN.
@@ -841,6 +846,13 @@ local\-data: "example.com. A 127.0.0.1"
 queries for www.example.com and www.foo.example.com are redirected, so
 that users with web browsers cannot access sites with suffix example.com.
 .TP 10
+\h'5'\fIinform\fR 
+The query is answered normally.  The client IP address (@portnumber)
+is printed to the logfile.  The log message is: timestamp, unbound-pid,
+info: zonename inform IP@port queryname type class.  This option can be
+used for normal resolution, but machines looking up infected names are
+logged, eg. to run antivirus on them.
+.TP 10
 \h'5'\fInodefault\fR 
 Used to turn off default contents for AS112 zones. The other types
 also turn off default contents for the zone. The 'nodefault' option 
diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
index b2248bc0cbc5..1c81975b234f 100644
--- a/iterator/iter_scrub.c
+++ b/iterator/iter_scrub.c
@@ -680,7 +680,9 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				 * (we dont want its glue that was approved
 				 * during the normalize action) */
 				del_addi = 1;
-			} else if(!env->cfg->harden_glue) {
+			} else if(!env->cfg->harden_glue && (
+				rrset->type == LDNS_RR_TYPE_A ||
+				rrset->type == LDNS_RR_TYPE_AAAA)) {
 				/* store in cache! Since it is relevant
 				 * (from normalize) it will be picked up 
 				 * from the cache to be used later */
diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
index 9d0aa698f996..10ae12f75c6c 100644
--- a/iterator/iter_utils.c
+++ b/iterator/iter_utils.c
@@ -714,6 +714,42 @@ reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region)
 	return 1;
 }
 
+void 
+caps_strip_reply(struct reply_info* rep)
+{
+	size_t i;
+	if(!rep) return;
+	/* see if message is a referral, in which case the additional and
+	 * NS record cannot be removed */
+	/* referrals have the AA flag unset (strict check, not elsewhere in
+	 * unbound, but for 0x20 this is very convenient). */
+	if(!(rep->flags&BIT_AA))
+		return;
+	/* remove the additional section from the reply */
+	if(rep->ar_numrrsets != 0) {
+		verbose(VERB_ALGO, "caps fallback: removing additional section");
+		rep->rrset_count -= rep->ar_numrrsets;
+		rep->ar_numrrsets = 0;
+	}
+	/* is there an NS set in the authority section to remove? */
+	/* the failure case (Cisco firewalls) only has one rrset in authsec */
+	for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
+		struct ub_packed_rrset_key* s = rep->rrsets[i];
+		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS) {
+			/* remove NS rrset and break from loop (loop limits
+			 * have changed) */
+			/* move last rrset into this position (there is no
+			 * additional section any more) */
+			verbose(VERB_ALGO, "caps fallback: removing NS rrset");
+			if(i < rep->rrset_count-1)
+				rep->rrsets[i]=rep->rrsets[rep->rrset_count-1];
+			rep->rrset_count --;
+			rep->ns_numrrsets --;
+			break;
+		}
+	}
+}
+
 void 
 iter_store_parentside_rrset(struct module_env* env, 
 	struct ub_packed_rrset_key* rrset)
diff --git a/iterator/iter_utils.h b/iterator/iter_utils.h
index d7c2b68afa2d..9373487e002c 100644
--- a/iterator/iter_utils.h
+++ b/iterator/iter_utils.h
@@ -222,6 +222,15 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
  */
 int reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region);
 
+/**
+ * Remove unused bits from the reply if possible.
+ * So that caps-for-id (0x20) fallback is more likely to be successful.
+ * This removes like, the additional section, and NS record in the authority
+ * section if those records are gratuitous (not for a referral).
+ * @param rep: the reply to strip stuff out of.
+ */
+void caps_strip_reply(struct reply_info* rep);
+
 /**
  * Store parent-side rrset in seperate rrset cache entries for later 
  * last-resort * lookups in case the child-side versions of this information 
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 6e05c99a0e95..2037cc8814f2 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -1383,8 +1383,10 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return 0;
 	if(iq->depth > 0 && iq->target_count &&
 		iq->target_count[1] > MAX_TARGET_COUNT) {
-		verbose(VERB_QUERY, "request has exceeded the maximum "
-			"number of glue fetches %d", iq->target_count[1]);
+		char s[LDNS_MAX_DOMAINLEN+1];
+		dname_str(qstate->qinfo.qname, s);
+		verbose(VERB_QUERY, "request %s has exceeded the maximum "
+			"number of glue fetches %d", s, iq->target_count[1]);
 		return 0;
 	}
 
@@ -1581,8 +1583,10 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	if(iq->depth > 0 && iq->target_count &&
 		iq->target_count[1] > MAX_TARGET_COUNT) {
-		verbose(VERB_QUERY, "request has exceeded the maximum "
-			"number of glue fetches %d", iq->target_count[1]);
+		char s[LDNS_MAX_DOMAINLEN+1];
+		dname_str(qstate->qinfo.qname, s);
+		verbose(VERB_QUERY, "request %s has exceeded the maximum "
+			"number of glue fetches %d", s, iq->target_count[1]);
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	/* mark cycle targets for parent-side lookups */
@@ -2878,6 +2882,9 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->response->rep);
 	
 	if(event == module_event_capsfail || iq->caps_fallback) {
+		/* for fallback we care about main answer, not additionals */
+		/* removing that makes comparison more likely to succeed */
+		caps_strip_reply(iq->response->rep);
 		if(!iq->caps_fallback) {
 			/* start fallback */
 			iq->caps_fallback = 1;
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index e388e7956c81..c72b586ab70d 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -606,7 +606,7 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
+		w->back->udp_buff, w->env->scratch, NULL)) {
 		regional_free_all(w->env->scratch);
 		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
 			w->back->udp_buff, sec_status_insecure, NULL);
@@ -676,7 +676,7 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
+		w->back->udp_buff, w->env->scratch, NULL)) {
 		regional_free_all(w->env->scratch);
 		free(qinfo.qname);
 		libworker_event_done_cb(q, LDNS_RCODE_NOERROR,
@@ -796,7 +796,7 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(w->ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
+		w->back->udp_buff, w->env->scratch, NULL)) {
 		regional_free_all(w->env->scratch);
 		q->msg_security = sec_status_insecure;
 		add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL);
diff --git a/libunbound/python/libunbound.i b/libunbound/python/libunbound.i
index 313c74862f4d..1bef79f22094 100644
--- a/libunbound/python/libunbound.i
+++ b/libunbound/python/libunbound.i
@@ -44,6 +44,10 @@
 
 %pythoncode %{
    import encodings.idna
+   try:
+       import builtins
+   except ImportError:
+       import __builtin__ as builtins
 
    # Ensure compatibility with older python versions
    if 'bytes' not in vars():
@@ -52,7 +56,7 @@
    def ord(s):
        if isinstance(s, int):
            return s
-       return __builtins__.ord(s)
+       return builtins.ord(s)
 %}
 
 //%include "doc.i"
@@ -699,7 +703,7 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
          while (idx < slen):
             complen = ord(s[idx])
             # In python 3.x `str()` converts the string to unicode which is the expected text string type
-            res.append(str(s[idx+1:idx+1+complen]))
+            res.append(str(s[idx+1:idx+1+complen].decode()))
             idx += complen + 1
 
          return res
diff --git a/pythonmod/interface.i b/pythonmod/interface.i
index 4f1a25f21344..b2dd089043ed 100644
--- a/pythonmod/interface.i
+++ b/pythonmod/interface.i
@@ -26,6 +26,9 @@
    #include "util/storage/lruhash.h"
    #include "services/cache/dns.h"
    #include "services/mesh.h"
+   #include "iterator/iter_delegpt.h"
+   #include "iterator/iter_hints.h"
+   #include "iterator/iter_utils.h"
    #include "ldns/wire2str.h"
    #include "ldns/str2wire.h"
    #include "ldns/pkthdr.h"
@@ -671,6 +674,99 @@ struct config_file {
    char* python_script;
 };
 
+/* ************************************************************************************ * 
+   ASN: Adding structures related to forwards_lookup and dns_cache_find_delegation
+ * ************************************************************************************ */
+struct delegpt_ns {
+    struct delegpt_ns* next;
+    int resolved;
+    uint8_t got4;
+    uint8_t got6;
+    uint8_t lame;
+    uint8_t done_pside4;
+    uint8_t done_pside6;
+};
+
+struct delegpt_addr {
+    struct delegpt_addr* next_result;
+    struct delegpt_addr* next_usable;
+    struct delegpt_addr* next_target;
+    int attempts;
+    int sel_rtt;
+    int bogus;
+    int lame;
+};
+
+struct delegpt {
+    int namelabs;
+    struct delegpt_ns* nslist;
+    struct delegpt_addr* target_list;
+    struct delegpt_addr* usable_list;
+    struct delegpt_addr* result_list;
+    int bogus;
+    uint8_t has_parent_side_NS;
+    uint8_t dp_type_mlc;
+};
+
+
+%inline %{
+   PyObject* _get_dp_dname(struct delegpt* dp) {
+      return PyString_FromStringAndSize((char*)dp->name, dp->namelen);
+   } 
+   PyObject* _get_dp_dname_components(struct delegpt* dp) {
+      return GetNameAsLabelList((char*)dp->name, dp->namelen);
+   }
+   PyObject* _get_dpns_dname(struct delegpt_ns* dpns) {
+      return PyString_FromStringAndSize((char*)dpns->name, dpns->namelen);
+   }
+   PyObject* _get_dpns_dname_components(struct delegpt_ns* dpns) {
+      return GetNameAsLabelList((char*)dpns->name, dpns->namelen);
+   }
+
+  PyObject* _delegpt_addr_addr_get(struct delegpt_addr* target) {
+     char dest[64];
+     delegpt_addr_addr2str(target, dest, 64);
+     if (dest[0] == 0)
+        return Py_None;
+     return PyString_FromString(dest);
+  }
+
+%}
+
+%extend delegpt {
+   %pythoncode %{
+        __swig_getmethods__["dname"] = _unboundmodule._get_dp_dname
+        if _newclass:dname = _swig_property(_unboundmodule._get_dp_dname)
+
+        __swig_getmethods__["dname_list"] = _unboundmodule._get_dp_dname_components
+        if _newclass:dname_list = _swig_property(_unboundmodule._get_dp_dname_components)
+
+        def _get_dname_str(self): return dnameAsStr(self.dname)
+        __swig_getmethods__["dname_str"] = _get_dname_str
+        if _newclass:dname_str = _swig_property(_get_dname_str)
+   %}
+}
+%extend delegpt_ns {
+   %pythoncode %{
+        __swig_getmethods__["dname"] = _unboundmodule._get_dpns_dname
+        if _newclass:dname = _swig_property(_unboundmodule._get_dpns_dname)
+
+        __swig_getmethods__["dname_list"] = _unboundmodule._get_dpns_dname_components
+        if _newclass:dname_list = _swig_property(_unboundmodule._get_dpns_dname_components)
+
+        def _get_dname_str(self): return dnameAsStr(self.dname)
+        __swig_getmethods__["dname_str"] = _get_dname_str
+        if _newclass:dname_str = _swig_property(_get_dname_str)
+   %}
+}
+%extend delegpt_addr {
+   %pythoncode %{
+        def _addr_get(self): return _delegpt_addr_addr_get(self)
+        __swig_getmethods__["addr"] = _addr_get
+        if _newclass:addr = _swig_property(_addr_get)
+   %}
+}
+
 /* ************************************************************************************ * 
    Enums
  * ************************************************************************************ */
@@ -879,6 +975,65 @@ int set_return_msg(struct module_qstate* qstate,
             return status 
 
 %}
+/* ************************************************************************************ * 
+   ASN: Delegation pointer related functions
+ * ************************************************************************************ */
+
+/* Functions which we will need to lookup delegations */
+struct delegpt* dns_cache_find_delegation(struct module_env* env,
+        uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
+        struct regional* region, struct dns_msg** msg, uint32_t timenow);
+int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
+        struct delegpt* dp);
+struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints,
+        uint8_t* qname, uint16_t qclass, struct delegpt* dp);
+
+/* Custom function to perform logic similar to the one in daemon/cachedump.c */
+struct delegpt* find_delegation(struct module_qstate* qstate, char *nm, size_t nmlen);
+
+%{
+#define BIT_RD 0x100
+
+struct delegpt* find_delegation(struct module_qstate* qstate, char *nm, size_t nmlen)
+{
+    struct delegpt *dp;
+    struct dns_msg *msg = NULL;
+    struct regional* region = qstate->env->scratch;
+    char b[260];
+    struct query_info qinfo;
+    struct iter_hints_stub* stub;
+    uint32_t timenow = *qstate->env->now;
+
+    regional_free_all(region);
+    qinfo.qname = (uint8_t*)nm;
+    qinfo.qname_len = nmlen;
+    qinfo.qtype = LDNS_RR_TYPE_A;
+    qinfo.qclass = LDNS_RR_CLASS_IN;
+
+    while(1) {
+        dp = dns_cache_find_delegation(qstate->env, (uint8_t*)nm, nmlen, qinfo.qtype, qinfo.qclass, region, &msg, timenow);
+        if(!dp)
+            return NULL;
+        if(iter_dp_is_useless(&qinfo, BIT_RD, dp)) {
+            if (dname_is_root((uint8_t*)nm))
+                return NULL;
+            nm = (char*)dp->name;
+            nmlen = dp->namelen;
+            dname_remove_label((uint8_t**)&nm, &nmlen);
+            dname_str((uint8_t*)nm, b);
+            continue;
+        }
+        stub = hints_lookup_stub(qstate->env->hints, qinfo.qname, qinfo.qclass, dp);
+        if (stub) {
+            return stub->dp;
+        } else {
+            return dp;
+        }
+    }
+    return NULL;
+}
+%}
+
 /* ************************************************************************************ * 
    Functions
  * ************************************************************************************ */
diff --git a/pythonmod/pythonmod_utils.c b/pythonmod/pythonmod_utils.c
index 1091dcf10727..05914b88a8fb 100644
--- a/pythonmod/pythonmod_utils.c
+++ b/pythonmod/pythonmod_utils.c
@@ -48,6 +48,7 @@
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
 #include "util/regional.h"
+#include "iterator/iter_delegpt.h"
 #include "ldns/sbuffer.h"
 
 #undef _POSIX_C_SOURCE
@@ -176,3 +177,17 @@ void reply_addr2str(struct comm_reply* reply, char* dest, int maxlen)
 	   return;
 	dest[maxlen-1] = 0;
 }
+
+/* Convert target->addr to string */
+void delegpt_addr_addr2str(struct delegpt_addr* target, char *dest, int maxlen)
+{
+	int af = (int)((struct sockaddr_in*) &(target->addr))->sin_family;
+	void* sinaddr = &((struct sockaddr_in*) &(target->addr))->sin_addr;
+
+	if(af == AF_INET6)
+		sinaddr = &((struct sockaddr_in6*)&(target->addr))->sin6_addr;
+	dest[0] = 0;
+	if (inet_ntop(af, sinaddr, dest, (socklen_t)maxlen) == 0)
+	   return;
+	dest[maxlen-1] = 0;
+}
diff --git a/pythonmod/pythonmod_utils.h b/pythonmod/pythonmod_utils.h
index a901f391a460..768eb46de6ac 100644
--- a/pythonmod/pythonmod_utils.h
+++ b/pythonmod/pythonmod_utils.h
@@ -42,6 +42,7 @@
 #define PYTHONMOD_UTILS_H
 
 #include "util/module.h"
+struct delegpt_addr;
 
 /**
  *  Store the reply_info and query_info pair in message cache (qstate->msg_cache)
@@ -86,4 +87,7 @@ int createResponse(struct module_qstate* qstate, sldns_buffer* pkt);
  */
 void reply_addr2str(struct comm_reply* reply, char* dest, int maxlen);
 
+/* Convert target->addr to string */
+void delegpt_addr_addr2str(struct delegpt_addr* target, char *dest, int maxlen);
+
 #endif /* PYTHONMOD_UTILS_H */
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index 0ce0a6b7b175..1addfa901dbb 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -372,29 +372,47 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
  * (and also uses the interface mtu to determine the size of the packets).
  * So there won't be any EMSGSIZE error.  Against DNS fragmentation attacks.
  * FreeBSD already has same semantics without setting the option. */
-#    if defined(IP_PMTUDISC_OMIT)
-		int action = IP_PMTUDISC_OMIT;
-#    else
-		int action = IP_PMTUDISC_DONT;
-#    endif
+		int omit_set = 0;
+		int action;
+#   if defined(IP_PMTUDISC_OMIT)
+		action = IP_PMTUDISC_OMIT;
 		if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, 
 			&action, (socklen_t)sizeof(action)) < 0) {
-			log_err("setsockopt(..., IP_MTU_DISCOVER, "
-#    if defined(IP_PMTUDISC_OMIT)
-				"IP_PMTUDISC_OMIT"
-#    else
-				"IP_PMTUDISC_DONT"
-#    endif
-				"...) failed: %s",
-				strerror(errno));
+
+			if (errno != EINVAL) {
+				log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_OMIT...) failed: %s",
+					strerror(errno));
+
 #    ifndef USE_WINSOCK
-			close(s);
+				close(s);
 #    else
-			closesocket(s);
+				closesocket(s);
 #    endif
-			*noproto = 0;
-			*inuse = 0;
-			return -1;
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
+		}
+		else
+		{
+		    omit_set = 1;
+		}
+#   endif
+		if (omit_set == 0) {
+   			action = IP_PMTUDISC_DONT;
+			if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER,
+				&action, (socklen_t)sizeof(action)) < 0) {
+				log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_DONT...) failed: %s",
+					strerror(errno));
+#    ifndef USE_WINSOCK
+				close(s);
+#    else
+				closesocket(s);
+#    endif
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
 		}
 #  elif defined(IP_DONTFRAG)
 		int off = 0;
@@ -580,15 +598,16 @@ create_local_accept_sock(const char *path, int* noproto)
 {
 #ifdef HAVE_SYS_UN_H
 	int s;
-	struct sockaddr_un sun;
+	struct sockaddr_un usock;
 
+	verbose(VERB_ALGO, "creating unix socket %s", path);
 #ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
 	/* this member exists on BSDs, not Linux */
-	sun.sun_len = (sa_family_t)sizeof(sun);
+	usock.sun_len = (socklen_t)sizeof(usock);
 #endif
-	sun.sun_family = AF_LOCAL;
+	usock.sun_family = AF_LOCAL;
 	/* length is 92-108, 104 on FreeBSD */
-	(void)strlcpy(sun.sun_path, path, sizeof(sun.sun_path));
+	(void)strlcpy(usock.sun_path, path, sizeof(usock.sun_path));
 
 	if ((s = socket(PF_LOCAL, SOCK_STREAM, 0)) == -1) {
 		log_err("Cannot create local socket %s (%s)",
@@ -603,7 +622,7 @@ create_local_accept_sock(const char *path, int* noproto)
 		return -1;
 	}
 
-	if (bind(s, (struct sockaddr *)&sun,
+	if (bind(s, (struct sockaddr *)&usock,
 		(socklen_t)sizeof(struct sockaddr_un)) == -1) {
 		log_err("Cannot bind local socket %s (%s)",
 			path, strerror(errno));
@@ -623,6 +642,7 @@ create_local_accept_sock(const char *path, int* noproto)
 	(void)noproto; /*unused*/
 	return s;
 #else
+	(void)path;
 	log_err("Local sockets are not supported");
 	*noproto = 1;
 	return -1;
diff --git a/services/localzone.c b/services/localzone.c
index d285a127cbbf..57510bd27364 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -48,6 +48,7 @@
 #include "util/data/packed_rrset.h"
 #include "util/data/msgencode.h"
 #include "util/net_help.h"
+#include "util/netevent.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgparse.h"
 
@@ -1022,6 +1023,10 @@ void local_zones_print(struct local_zones* zones)
 			log_nametypeclass(0, "static zone", 
 				z->name, 0, z->dclass);
 			break;
+		case local_zone_inform:
+			log_nametypeclass(0, "inform zone", 
+				z->name, 0, z->dclass);
+			break;
 		default:
 			log_nametypeclass(0, "badtyped zone", 
 				z->name, 0, z->dclass);
@@ -1169,9 +1174,25 @@ lz_zone_answer(struct local_zone* z, struct query_info* qinfo,
 	return 0;
 }
 
+/** print log information for an inform zone query */
+static void
+lz_inform_print(struct local_zone* z, struct query_info* qinfo,
+	struct comm_reply* repinfo)
+{
+	char ip[128], txt[512];
+	char zname[LDNS_MAX_DOMAINLEN+1];
+	uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
+	dname_str(z->name, zname);
+	addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
+	snprintf(txt, sizeof(txt), "%s inform %s@%u", zname, ip,
+		(unsigned)port);
+	log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
+}
+
 int 
 local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
-	struct edns_data* edns, sldns_buffer* buf, struct regional* temp)
+	struct edns_data* edns, sldns_buffer* buf, struct regional* temp,
+	struct comm_reply* repinfo)
 {
 	/* see if query is covered by a zone,
 	 * 	if so:	- try to match (exact) local data 
@@ -1190,6 +1211,9 @@ local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
 	lock_rw_rdlock(&z->lock);
 	lock_rw_unlock(&zones->lock);
 
+	if(z->type == local_zone_inform && repinfo)
+		lz_inform_print(z, qinfo, repinfo);
+
 	if(local_data_answer(z, qinfo, edns, buf, temp, labs, &ld)) {
 		lock_rw_unlock(&z->lock);
 		return 1;
@@ -1209,6 +1233,7 @@ const char* local_zone_type2str(enum localzone_type t)
 		case local_zone_typetransparent: return "typetransparent";
 		case local_zone_static: return "static";
 		case local_zone_nodefault: return "nodefault";
+		case local_zone_inform: return "inform";
 	}
 	return "badtyped"; 
 }
@@ -1227,6 +1252,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
 		*t = local_zone_typetransparent;
 	else if(strcmp(type, "redirect") == 0)
 		*t = local_zone_redirect;
+	else if(strcmp(type, "inform") == 0)
+		*t = local_zone_inform;
 	else return 0;
 	return 1;
 }
diff --git a/services/localzone.h b/services/localzone.h
index 788fbfb3ba2b..29ba8663fd04 100644
--- a/services/localzone.h
+++ b/services/localzone.h
@@ -49,6 +49,7 @@ struct config_file;
 struct edns_data;
 struct query_info;
 struct sldns_buffer;
+struct comm_reply;
 
 /**
  * Local zone type
@@ -70,7 +71,9 @@ enum localzone_type {
 	local_zone_redirect,
 	/** remove default AS112 blocking contents for zone
 	 * nodefault is used in config not during service. */
-	local_zone_nodefault
+	local_zone_nodefault,
+	/** log client address, but no block (transparent) */
+	local_zone_inform
 };
 
 /**
@@ -220,12 +223,14 @@ void local_zones_print(struct local_zones* zones);
  * @param edns: edns info (parsed).
  * @param buf: buffer with query ID and flags, also for reply.
  * @param temp: temporary storage region.
+ * @param repinfo: source address for checks. may be NULL.
  * @return true if answer is in buffer. false if query is not answered 
  * by authority data. If the reply should be dropped altogether, the return 
  * value is true, but the buffer is cleared (empty).
  */
 int local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
-	struct edns_data* edns, struct sldns_buffer* buf, struct regional* temp);
+	struct edns_data* edns, struct sldns_buffer* buf, struct regional* temp,
+	struct comm_reply* repinfo);
 
 /**
  * Parse the string into localzone type.
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index 7723c3357695..b5d7b9f44419 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -78,6 +78,7 @@ usage()
 	printf("	Checks unbound configuration file for errors.\n");
 	printf("file	if omitted %s is used.\n", CONFIGFILE);
 	printf("-o option	print value of option to stdout.\n");
+	printf("-f 		output full pathname with chroot applied, eg. with -o pidfile.\n");
 	printf("-h		show this usage help.\n");
 	printf("Version %s\n", PACKAGE_VERSION);
 	printf("BSD licensed, see LICENSE in source package for details.\n");
@@ -90,10 +91,15 @@ usage()
  * @param cfg: config
  * @param opt: option name without trailing :. 
  *	This is different from config_set_option.
+ * @param final: if final pathname with chroot applied has to be printed.
  */
 static void
-print_option(struct config_file* cfg, const char* opt)
+print_option(struct config_file* cfg, const char* opt, int final)
 {
+	if(strcmp(opt, "pidfile") == 0 && final) {
+		printf("%s\n", fname_after_chroot(cfg->pidfile, cfg, 1));
+		return;
+	}
 	if(!config_get_option(cfg, opt, config_print_func, stdout))
 		fatal_exit("cannot print option '%s'", opt);
 }
@@ -456,7 +462,7 @@ check_hints(struct config_file* cfg)
 
 /** check config file */
 static void
-checkconf(const char* cfgfile, const char* opt)
+checkconf(const char* cfgfile, const char* opt, int final)
 {
 	struct config_file* cfg = config_create();
 	if(!cfg)
@@ -467,7 +473,7 @@ checkconf(const char* cfgfile, const char* opt)
 		exit(1);
 	}
 	if(opt) {
-		print_option(cfg, opt);
+		print_option(cfg, opt, final);
 		config_delete(cfg);
 		return;
 	}
@@ -493,6 +499,7 @@ extern char* optarg;
 int main(int argc, char* argv[])
 {
 	int c;
+	int final = 0;
 	const char* f;
 	const char* opt = NULL;
 	const char* cfgfile = CONFIGFILE;
@@ -505,8 +512,11 @@ int main(int argc, char* argv[])
 		cfgfile = CONFIGFILE;
 #endif /* USE_WINSOCK */
 	/* parse the options */
-	while( (c=getopt(argc, argv, "ho:")) != -1) {
+	while( (c=getopt(argc, argv, "fho:")) != -1) {
 		switch(c) {
+		case 'f':
+			final = 1;
+			break;
 		case 'o':
 			opt = optarg;
 			break;
@@ -523,7 +533,7 @@ int main(int argc, char* argv[])
 	if(argc == 1)
 		f = argv[0];
 	else	f = cfgfile;
-	checkconf(f, opt);
+	checkconf(f, opt, final);
 	checklock_stop();
 	return 0;
 }
diff --git a/smallapp/unbound-control-setup.sh.in b/smallapp/unbound-control-setup.sh.in
index 79605dc6fd45..75e76e25d967 100644
--- a/smallapp/unbound-control-setup.sh.in
+++ b/smallapp/unbound-control-setup.sh.in
@@ -36,8 +36,7 @@
 # settings:
 
 # directory for files
-prefix=@prefix@
-DESTDIR=@sysconfdir@/unbound
+DESTDIR=@ub_conf_dir@
 
 # issuer and subject name for certificates
 SERVERNAME=unbound
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index ac8d96857d47..3b47d3bf885a 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -204,12 +204,12 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 			fatal_exit("could not parse IP@port: %s", svr);
 #ifdef HAVE_SYS_UN_H
 	} else if(svr[0] == '/') {
-		struct sockaddr_un* sun = (struct sockaddr_un *) &addr;
-		sun->sun_family = AF_LOCAL;
+		struct sockaddr_un* usock = (struct sockaddr_un *) &addr;
+		usock->sun_family = AF_LOCAL;
 #ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
-		sun->sun_len = (sa_family_t)sizeof(sun);
+		usock->sun_len = (socklen_t)sizeof(usock);
 #endif
-		(void)strlcpy(sun->sun_path, svr, sizeof(sun->sun_path));
+		(void)strlcpy(usock->sun_path, svr, sizeof(usock->sun_path));
 		addrlen = (socklen_t)sizeof(struct sockaddr_un);
 		addrfamily = AF_LOCAL;
 #endif
diff --git a/testcode/do-tests.sh b/testcode/do-tests.sh
index 84d2ef566fd9..6ea12cd2f336 100755
--- a/testcode/do-tests.sh
+++ b/testcode/do-tests.sh
@@ -14,7 +14,7 @@ NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
 test_tool_avail "dig"
 test_tool_avail "ldns-testns"
 
-# test for ipv6, uses streamptcp peculiarity.
+# test for ipv6, uses streamtcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
 	HAVE_IPV6=no
 else
diff --git a/testcode/testbed.sh b/testcode/testbed.sh
deleted file mode 100755
index 62ce2059be61..000000000000
--- a/testcode/testbed.sh
+++ /dev/null
@@ -1,133 +0,0 @@
-#!/usr/bin/env bash
-# Testbed for NSD.
-# By Wouter Wijngaards, NLnet Labs, 2006.
-# BSD License.
-
-# this version prefers gmake if available.
-# adds variable LDNS for the LDNS path to use.
-
-# global settings
-CONFIGURE_FLAGS=""
-REPORT_FILE=testdata/testbed.report
-LOG_FILE=testdata/testbed.log
-HOST_FILE=testdata/host_file.$USER
-
-if test ! -f $HOST_FILE; then
-	echo "No such file: $HOST_FILE"
-	exit 1
-fi
-
-function echossh() # like ssh but echos.
-{
-	echo "> ssh $*"
-	ssh $*
-}
-
-# Compile and run NSD on platforms
-function dotest() 
-# parameters: <host> <dir>
-# host is name of ssh host
-# dir is directory of nsd trunk on host
-{
-	echo "$1 begin on "`date` | tee -a $REPORT_FILE
-
-	DISABLE=""
-	if test $IP6 = no; then
-		DISABLE="--disable-ipv6"
-	fi
-	if test x$LDNS != x; then
-		DISABLE="--with-ldns=$LDNS $DISABLE"
-	fi
-	if test x$LIBEVENT != x; then
-		DISABLE="--with-libevent=$LIBEVENT $DISABLE"
-	fi
-
-	cat >makeconf.mak.$$ << EOF 
-#configure:	configure.ac
-#	$AC_CMD
-#	touch configure
-Makefile:	Makefile.in #configure
-	./configure $CONFIGURE_FLAGS $DISABLE
-	touch Makefile 
-EOF
-	scp makeconf.mak.$$ $1:$2
-	# determine make to use
-	tempx=`ssh $1 "cd $2; which gmake"`
-	MAKE_CMD=`ssh $1 "cd $2; if test -f '$tempx'; then echo $tempx; else echo $MAKE_CMD; fi"`
-
-	if test $SVN = yes; then
-		echossh $1 "cd $2; svn up"
-		echossh $1 "cd $2; $MAKE_CMD -f makeconf.mak.$$ configure"
-	else
-		# svn and autoconf locally
-		echo "fake svn via svnexport, tar, autoconf, bison, flex."
-		svn export svn+ssh://open.nlnetlabs.nl/svn/nsd/trunk unbound_ttt
-		(cd unbound_ttt; $AC_CMD; rm -r autom4te* .c-mode-rc.el .cvsignore)
-		if test $FIXCONFIGURE = yes; then
-			echo fixing up configure length test.
-			(cd unbound_ttt; mv configure oldconf; sed -e 's?while (test "X"?lt_cv_sys_max_cmd_len=65500; echo skip || while (test "X"?' <oldconf >configure; chmod +x ./configure)
-		fi
-		du unbound_ttt
-		rsync -vrcpz --rsync-path=/home/wouter/bin/rsync unbound_ttt $1:unbound_ttt
-		# tar czf unbound_ttt.tgz unbound_ttt
-		rm -rf unbound_ttt
-		# ls -al unbound_ttt.tgz
-		# scp unbound_ttt.tgz $1:unbound_ttt.tar.gz
-		# rm unbound_ttt.tgz
-		# echossh $1 "gtar xzf unbound_ttt.tar.gz && rm unbound_ttt.tar.gz"
-	fi
-	echossh $1 "cd $2; $MAKE_CMD -f makeconf.mak.$$ Makefile"
-	echossh $1 "cd $2; $MAKE_CMD all tests"
-	echossh $1 "cd $2; $MAKE_CMD doc"
-	if test $RUN_TEST = yes; then
-	echossh $1 "cd $2; bash testcode/do-tests.sh"
-	echossh $1 "cd $2/testdata; sh ../testcode/mini_tpkg.sh -q report" | tee -a $REPORT_FILE
-	fi
-	echossh $1 "cd $2; rm -f makeconf.mak.$$"
-	rm -f makeconf.mak.$$
-	echo "$1 end on "`date` | tee -a $REPORT_FILE
-}
-
-echo "on "`date`" by $USER." > $REPORT_FILE
-echo "on "`date`" by $USER." > $LOG_FILE
-
-# read host names
-declare -a hostname desc dir vars
-IFS='	'
-i=0
-while read a b c d; do
-	if echo $a | grep "^#" >/dev/null; then
-		continue # skip it
-	fi
-	# append after arrays
-	hostname[$i]=$a
-	desc[$i]=$b
-	dir[$i]=$c
-	vars[$i]=$d
-	i=$(($i+1))
-done <$HOST_FILE
-echo "testing on $i hosts"
-
-# do the test
-for((i=0; i<${#hostname[*]}; i=$i+1)); do
-	if echo ${hostname[$i]} | grep "^#" >/dev/null; then
-		continue # skip it
-	fi
-	# echo "hostname=[${hostname[$i]}]"
-	# echo "desc=[${desc[$i]}]"
-	# echo "dir=[${dir[$i]}]"
-	# echo "vars=[${vars[$i]}]"
-	AC_CMD="libtoolize -c --force; autoconf && autoheader"
-	MAKE_CMD="make"
-	SVN=yes
-	IP6=yes
-	FIXCONFIGURE=no
-	RUN_TEST=yes
-	LDNS=
-	LIBEVENT=
-	eval ${vars[$i]}
-	echo "*** ${hostname[$i]} ${desc[$i]} ***" | tee -a $LOG_FILE | tee -a $REPORT_FILE
-	dotest ${hostname[$i]} ${dir[$i]} 2>&1 | tee -a $LOG_FILE
-done
-
-echo "done"
diff --git a/testcode/testbed.txt b/testcode/testbed.txt
deleted file mode 100644
index b0175049eec4..000000000000
--- a/testcode/testbed.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-Testbed.sh help page.
-
-Testbed helps in running the test packages (using tpkg(1)) on several systems.
-The script is specially written for unbound (edit it to change to different
-software). It is licensed BSD.
-
-The hosts to run on are listed in host_file.<username>. You need to have
-public-key authorized ssh access to these systems (or type your password lots
-and lots of times). The host_file describes the directories and environment
-of each host. You need only user-level access to the host.
-
-The host_file is very restrictive in formatting. Comments are lines starting
-with the # mark. The entries must be separated by tabs. Please list the
-hostname<tab>description<tab>checkoutdir<tab>variables
-
-hostname:	network hostname to ssh to.
-desc:		pretty text to describe the machine architecture.
-checkoutdir:	directory on the remote host where a svn checkout is present.
-variables:	zero or more variables separated by spaces. BLA=value BAR=val.
-
-Only important variable for unbound is the LDNS=<dir> variable that if present
-forces --with-ldns=<dir> to be passed to ./configure. In case LDNS is not
-installed on the system itself, but present somewhere else.
-
-You can also set LIBEVENT=<dir> for the libevent directory, if it is
-installed in a nonstandard location.
-
-*** Running the testbed
-
-Run by executing the script. It will take all the hosts from the file in 
-turn and update the svn directory there, possible autoreconf if necessary,
-possibly ./configure <args> if necessary, make the executables.
-Then it will run the testcode/do-tests script. This script should execute
-the tests that this host is capable of running.
-
-in testdata/testbed.log has a line-by-line log. See your make errors here.
-in testdata/testbed.report has only the tpkg reports. Summary.
-
diff --git a/testdata/ctrl_pipe.tpkg b/testdata/ctrl_pipe.tpkg
new file mode 100644
index 0000000000000000000000000000000000000000..877fcf9010d9a442ac161b59fd79e4c509a2b737
GIT binary patch
literal 6451
zcmZA4<y(|pxbR`R5ox3bq(d6%Mv+uex*KU!O28qcOF)JOm6Glug&_x#lI{V96ozhQ
z=6-$l`(+>d%lZS>vCeB<KTrY*&M)uY*Esm7Q1|qrXYJP2T&&64>0GRrE(XuxV_vS6
zt&zJIBab&8s)l{SSsANWXeH&m&mn>*Z~&}>HbM4xpZe}0x)u-zVun`j745<8!KLk`
zJ5>c<^p0sa+ZUrDfwV(HyML=KwojIXN6<o|BccWDVid0kaG_dF7_cIg7=0T^kW9l7
zvB8~~PN%)jk=V2|O-KTc>g<fE;74_i>f{@j0JJ6Ek&iM}ICt9l*H%tiBEV=-?5_cp
z_SP4kjI7LS6rDYPjy9g$X)GZSE#0%24lp+8;e#nw;BXwcQd#c54nQ3tl*vvz0<ge{
zzKn@KWB{9i8Z;?Ed_hHZ-_-bpk-VV)h&6ZZX=&Xww`_PM68uOcn_=!kf1(z_U}ipO
zS0`u_us7$=T6R&`>$tUJw-*dHkFEzU2XD%txp!XK+jka)b8X(i;8PZarvmP=ru1Dd
z41Xo2%YeCX5-93YoCH(wimGnxJMM5|hc5uTJDZ<=9!J%=yiNs!CaK-vG^xc~4qr49
zm6FOG%OR%CNf7_gbO}r6>j9iy0~FVJCji1GZxBcT&Vn9#4+4NMEmC$2*w<3~cr^x?
z4FcV(xLDf2AApU<ok}@CqGp(K0V;`Y#HtXBr0kxAYU9I+@RJ88KZytVz{a1O;25RN
zKj6Axa-JZ6UqeCasOI&+0bZpQQD^uia0xZzl<EPo@GIse*rLp`-CFDO*%Jx`iGAUu
zDw=SEJ+YQrUN8nVL-U~OF?&N*n<Ossxyltodz^H}8yt`jzLJ1lMY__y)nZn><>`Up
zg(1!2`8DZQ?W`_PC5w%(ma@XB0tKgUJvTeS4@s&v7_6NLB|wrfO9S84qq3b;o`So@
zHvTRdHhy7$U*oy=Zb3a8VNSZ~Ak=L)Iy|$|)^U*8!+x)owap?o?a^2cUQvjs+T*zG
zyRmPenfE3d*}O>$Pr}|z<1HB>iRfPkh)w(*QS@O65HA@?Vy5opw@SmMN=yr)c$De0
z5|{I6>g9`7Z%q$|G`&(L@_?Tz6s7ygWncB2Ce`}?%Ets1)m8B{lA1>2b6Zrs9D#rG
zEmp5&-gB`k<EAZh>wP;ZweXp@g`_qBa=^YQY^Sy5B+{1?IjsAe8iG^>7s>fMaOw3+
zHcc6!3pRFtbf_sn{#x`X@6sd1u7vadrujG1*Vh~zsJrSjzwa4v#rH^EX{F%mYWZCD
z+trAI>gF3mYj}z*P5&9G)o+S-OtTKrkQU^?(04MPLY)O?2l?MdTDUY|MX~s<&&)L0
zYklIm#yYgc<hVK2F7+~t(%IH5=MNtwU%q$XcdJiI<BsyPat^6+#QAkFX5!clDV>UE
zzgCtxnoUZf%cE&z3F-D{NH~}<F){Tr-P9AQM70Z)&c8h>(YXC=t4hzm>XrFSz3)27
zNFiM0ipjI~p(*lSehClN-21NNy8|-kHhKc2#-l@Kdy@kmH<=$yw!*rf)DAz`qn;1G
z85Fg|6*#9ftJEE_(RiY=c+{M~oLF>21=9`<OuDNx$1J*mV+uFG+1){DQeBC_`W%`{
zIRzMxsD%Sq<UlqMdUh=f1Ph`7DL~`dK|Qvpe*t?X+zJOwKYHjy^h0T9*sk_Vh#^kr
zIZl3KTwfLa=0fe^;^v~U&`SP;Dd}a0_qw*SgD>EEqlE9gCQli=F7Lw@h7`PYG~K8Q
zeR(4*Et}?M(biV`b-cyZh10jAEEhgICRcN4OVsEch5ZT6)Q=)#)m__kx1NXY#5}eE
z8jKawHWd`hE=it<&#Z}4Hx439L`Uuv@Jn?}PBos5jtQvIXiazTuLG1UM8GQ4Quu3t
zRSi3rvqC^!K62%O(j({_F|}tU@5IV|pyq2^tG2FPjGX?&_XMfP+Wx?Hqo$p4)^0d0
z^da}WzKU(>KX&ep)N3B$br6=kt56@KQ}%)y5<ZbLLe}8yM6P_#PL5v<RIo|F;oOcC
z$=&yH>1ymZGkuvhTBie+$r|;2=kD;m3vsfgmOb3s%Djy!73xH)9Qjq+bo?&#r2=h$
zQC~XF&dMZl&=hx|==Gfw!0h<q8UeJ+o^^Y(ADwlV&0-6k0F4(1Rls=ocs-!MZ*d3G
zt*x-64R%VIB<y1T)%R%yK08hGVo0Kn?dP0dD1^>Q`qjn4{OUs-LzKGHt0jzJ;e->-
z2#NWZk?$^st))99Vy35g5~LX+k&ALglYJVgYfcS)w!V*<-?_t>+hfUS<(=4Op{Y~>
zY?90;OPGqL%S)2=ZGnSUmNJ1P*Te7RABSfvU(#7Le;miU)KDcn?Ryt2+1#uNm0ZYM
zXV~h9!6k4}sw$@>yvU8~VE=&ZTV{#P-_uOXZHx54p)hxkhq)z++7q;Shk!Ga-;(Lx
z(urrjAvM#xD9>if>Y;p=ts!p;wUeFyQ>M-gS)jRZs8ReR<SBuA%6vU}PQmlZwpi1~
zy&+0-10xyYz)YRow8RBma1*fpj?G1k{*a>g@ZNpoJx&T?9&y{sgD1`7hYxXcIAaC^
ze-`X)>S#mj`7~eJUJ|_meUos19GU*1N}kKHD+|}o1@1{|rmzUO^%pX-Fc|PAy3Glw
zy(yMx3Ba&@xlg}wC?Uz>;}p>$NezWs5U?Bw;m`}8+4B8>+TY;LG~XMWzQnZidFQmb
zaOKyFNEXyHYdShfpg-nM&wiM*`gSS>k$zu}AFtv$D4y9EM9(gN`2}*q5$)Pu_;-Q*
zZAX?_mGS;37Ev<zR@2_SVV9qTUvjH$)x5K1Eyjj;nvW>)=#l+~t0<#`HNDrV&aCF%
zc@Z%=AJnMOYAU<~`tUghvm*PN`{ueGHZYtfQ>_F$ss-3z1H%JhFP?Ez4{nW+GF>_U
zNt?v2ta%6#Y2037?2|>-Cpwv;@k#@(8aSxz-HB;bjz-p)Bga;|tk9Z>xTU}Diutzg
zOW|@n7LQ2K$EnNi+y`sFC~#C_fNwh&g*!cSNHB1-F#>c2g?s^&@^6l&E>-Y?Q-B_q
ze`DhM3&#6h1F$Dt*=R}6UFq4PB^bk32b2%pU3SmbZqIerNL=S*o_96^z8<1MqE6Pf
zS$5vll73<-^R{D>9c_(DiSAlg>+E92v%!*;2_6somAqq)c?jF6$H@swWKY5w*Y=?2
zd8|}%-@Aufh9=F{)LrCO&*&Wd<Z)amf7GW+jj(6OaKH3|O3O%)>m2fv$Cm~V;m-Pg
z(v^C}Vy>Y%@W(ZH=v(Ysj#{cbt?EkE8#XrAP`%anY(o19i_XFXQI0gHnp<Y2+YbiO
zs!`AZH_|J1+4C8Jr>gHIb#LCh6zH91UPRkA@U)sq3%Mj$Ixl}od||EqZfVfgzU4c^
zg`57+p#Pp%80Ydq%cLDtLG^HXiE1<~MKQxd6>T7z6K-}iTRgtT9dQ)=EcqAxx~O7j
zVTt2&%LitJ#Y+#z?P}8$PCx${`ML7jzWimX{Udn?%iYXe%h<Hl&N9S~l1m4|8#m<!
zq0o}ct0KJ`imRLetSAC;T$^zK^==Rv%n+i4z3LVnLm%bBH8244BJc(~_ZZ=T@y>U_
zfbUs0V&-58m$m5(c5PtF4Oqevta#B9QdzV}S8JgZLe1-WA?!KlZN=|L*aDa%ghzkR
zt>yml@#w;}ZW{hzc90-TX&tFe*4Y|7z9D^m>ck>@o?L6!lq~2wDR@$2UO0=e+InMd
z9V7QQ*xnoMo|$RQ`zENZ8XW?DP*%fMJNaFabR45^ew!)tT&Rh#Rj%Wlc1e!6;VL1Z
z;OZ^l+@H0<vb#N8-q`&>dpS2CJY~QKgO<-{L|B>paoRi*1vvu+<>;*rA9xmsbbj>}
z8~$qP8E)Jad)H6UsfNUnQrQWOX=#w>&gvGYJ{l_G<#t?=;Tt?~+1Yu~?%pBeJ+fZD
zV2!tPa$L&@+5uayE5Bqe`~{HEL{Z~uJx8hpK>;PIE_UGVE<qBw+ddJ;UcLW!gBbV;
z{1$NvJ39l9M-*6HFUCDuZdMXIIeVy=4%xNp!P#N-Vt3y9Rix8Pq!^8>+s)s@BKTIf
z7Y91i;GjAtViB&+9`PtQ6Gfm|H^+a%d=w$<9RW8cdfidth^n3On)qD{+oKO2Xo~U4
zC-DDmLKfy3MZkARQn$zJ9;a{EMKqrTzsW9SH4`{K)H_EWNQ(_0Wg-QChuXg1NVr0q
z%h=vhDWyc=W>rv|NBezw+>r2{O%kW)9<n0ihAI$teT@cJm6vHFbq`dy4cK<TtV${X
zpm^<e1^~f+z6C&cP>2T>ERO=3u&+oiO#$k^ihv4v7k+m~XNZ(aL}n%e7ZLu%e9KE=
zsy4*Ofzfj-OhJJ-#h9ed`i7JVf?$MKqJ-~S*0yLm+aqd*g~@6bZB1mvvGmt>2n5+J
z>>{Q-Pj-NBvX$0{46TZe)P>a(Sd$$tB~-6LUKab|6%bgly_>uzpDWcSXsk*%2yX~p
z6S5or$);_|A}-vsC<6Pg*En(olNUBg`E~C)#^*+4?#Whr*U`-?==mwk1TxEFzNpQ9
z&9!->z+Y|-K8GW?3aRmiWZ;us_Axnf?1J7Yyp_ZZl>sJ;=v)0<o9mq<Hx+SU2TOZV
zFPa0a?_YsGpWTk1t?iEj!1;zE06x3kMFWnDfHp>p`nnzq>c)RR3+%vx&%lQ&I|qo0
zE2La#_O@--a%%W-YYx6MiY+LMz(xm;ef%QarfU?{uPfu7B4olrwmjO~SAWx2c{2LI
z=Q|!>tqOX5jPW3B2n3K^9|{uMC?^IYE@;pvaQK6^<THc6sD+qbcA;)mdRdOF$VwBv
z-$=j#&%lyHSTT;ZK%R4_bWq<k#jynb(Wa7w8#m!Kvf;93LrRvK{P+q+`RitV2C+Oo
z{Rg?d$z`@UpGw7U64kdhO&)f)yh;3H*%78>aN1XCqWVXoOc#Xi3NzS`1YZ%|V%3yF
zsY1cQm=6Mf={BI;0Vcp(^SZkZ8So7jm+clS8c?5788C5mCGbc5w3`4_;~c3Hk?~Hx
zqjHT!C*ZG_r%Hf_4B2TBl^FAxN~fa#LS-hbau#=m=%)wJ(Gmdzc{55J867KGU)7|6
z0$1OKbk-{VSS98G5@q4959O5Si)*ZuFDp^UYAV4NPHXyCZC(Bym-Dv>p_?Gwla_>(
zGr)l{Fh{D(7L(E+H+2j8h{eJs*Y~Rd%+)`sz<*MK|D<A54Er50T0>`NHscX+G|>M8
z;9S97c6sahmd|2gELjLdL4F^1s(3V<?V8GTH9zTyea3yMyNYbh^<07X=CA0Q(?;ZR
zVT$x;9MKw5)BG}RAJHTvzNuD$-|wDUtE=*<gjco%$H?C9j8hS;yN_%jsc_%(?Zb1A
zWs7kUPoM0v@^@P@m)o+%ydOy=IMj<wj_E%{q0Mhpj4=W$EJb@4_`Y!79}Sf(m$zKI
z%~uS5RtP7otYjxaa+mjEfrY}#;c|CUpeWI`_hNBK-OSEZ=y0`9z*YyfE8i2;j%doo
z{mqX=U7Cv@!fVB@$zp6)2ZKxn;18EYt%WM8KS7V-Uk6;KCj=l6NZD{}b)7@WvglRt
z=;Z?*u*w)C1Ov4|yYYbekHTBwlU_x65*Osct1ip%=Vw51V7ydU7{Jwkan;R#fW{*J
zVK@N*f8T8Yq4+T#P)WK3n**dw!Bs$i5RkIdQ`m#-z>|4@kP`}u>#JNhmG7brDKx>Y
z)q902P7{qAHaBvDM(zEyQ+3iaCYT!0R{||V?y4}sbYzJ)sS?B&;zMFzA8*2u>rA$?
z3le%0`i+>S34DqI>5^|me;K@4pNBz4etvFZ99f}%Dp`uY9s>rHy8P40t&ty}MpJxL
zq-N5-$zxUeYC5;jk$GOb@~N97We1?@j6F@5x~{qbg=<r2iPLcPJZ4HRM1jX6Yh?hS
zEa40dj3U2b!IUTfebl`&1*TIP{}(@^%Ro3+o7BX7?{N@Ixof*da#h@vO4UqX57iqZ
z=Ffyl0r$KhFEyO!8^h6J_G?z1wM~<Pfs{+LMemFDZ=aH}rZbOy$4{7E67zJ+{j|qx
z)V@cT#t-Tn%0nD!!o;-Opo#)v85%fd(aTRl8jaKYmXD9EjXmBig6vGU<{c`!BZj^_
zM81A7c!)XbCgt6B_#{Y3W9{3poZo{i$@<2uph+(T8x5DFv{HyR4b(Z>5XY0YYE5xe
z-1tUrn**^3l8`=Ihnxq$iJWkF%%6c%t%ZrLk)=UR5V_b-4;PZv51gL7*M()T@^LL%
zMumnUFU^|fMLF<LKCADKK0!saX2Mu$EJBUn=*gwd2%8!Os!(T7T_NHHbr~RIPX7Kw
zxR$oQGqH3{eH=x;+C<lmMrBKOyyG6ea@v}PU$Yh~qT`LPev0=T`qSk-a?)8PvLal;
ziF5|hj`@V3u`GH!q|xJkvb0XmDU|r0atWkXv;~FjCCl}HdE?1PlJPA1+0tc*%=%l7
zB9`Kq{g|B9LzZ*{WS0E(eeoL3_yMNSq<sm8?@H5$vQ~U#S!T5`LcUr$Va8Vm_rj<J
zcO|)UDashwiGR>AW{4qtOG*rcUDgH6JoxqpMn+Lgxl^zD-@a&0zp-wiSDb6UXPeRp
zE4w6Yt}My<Yv(9BaA3DV#@3gA$Hr+$`c6ZehC3moU8+3Fx{}K=Q_9doGaQM3w(`F6
z;u*`7X^wF(ztSP_bz?UEY!EjtTTUS8Pl2PK#V3wknCt7_&C|DStmkDBCQ~>vLuJ{}
zl~Kkminp1amTmX}BVMs>lTO6F%YUw}xt&;kZ-E;T;5*pTK(}mCVILs2sfhje=l<J0
zL>d2W(xb?-8^lxy!Qm_Pkv|Y~ho+K407~RtwgB;4XZK>CEcI*AdEnbi{b<*ex(_Wt
zWHYGiEO-(FlKo#HJYpO!T2cu@0N+H#8k4FMGVY6I=*Fkdgm4BsFY^DKY1nHi0u_if
zHScp&WwO_Oi&(FSI>*W3Yp_pBZoobx>zHWeN&cCZ`lOAE_E3t{kV*GsV6c)n$G0w5
zR>Nl#$F9wY%))xpjDt0;CstZK;Z(<PrSY}Fp`u?$VVeIzk{Gl~PIiK7J?!O_AKVd=
z*r5a_K5Pk3Iq5D#lcC4g!2Ch0z(vr1^$Y&_KlKaR20!m0?jNrMdirnfRQ?AhE-ioC
z{5SeU$9VM}^#+mG<Y^wpb;bCa-(`0eLl|w=dd!pJT!(S8R(21e@u~7PNy`sdLE=jR
ziXV8?+5Cty6Fx8oxO=pkc}DBG?z3q)l9w~r@HKZ8^bm>}f8dsozn@P{YvBKDsMP7r
zD%W|4>RZ|_S8m@GqZkoRs%WI*dXoB@@#d-t=I&CZG^Z3}4awCgb-&0I|K_oiS}i@;
zv`BYmR`jDc2W7BeU(K2G3OX&WC0J^p<Y0&6*sOfuoF65?yVvmbl3UrKgE~54`}5X>
zhGNNgA0@w$!w{tca)#_lJm0!oRwZW?!6n((EV`OF=O}wth;=<R)7%1gXl=GuBMDo5
zEC=Kg;>`@sSn@^4F9OS+>=PNvSpz~!1kQ;{!yQj$S2B>4Zc}L$BHvFYb3~Q{xxIez
zD9i}{c5X{{U*xftoS99b*$%U#Ret0~VLEpEgjsFk4>sm}E=~4#ObxZm@3@1{IVuN6
zJs&JZeh|9QgumjgP%FFFsXyHFN!Y^z*VL11j$UhjUbrDvda}HKrBg+{IZ`N?zr%V)
zqR(J0gW>t>!kWF3R$8e}oAg&&C4B27VXq?db{c->xjR2OxJ_6nerfpV<uTdR_Tx7x
zRr<|Y)y?f?!dr)FS+aZfP2BKmTkW$K9Ql$~a1zewha`T{-ZFb?#mB6S%$k+ZPdquf
zhppQoBoLI<6#ZA}Y6Hn212}myV;$3H8v9)ZE|$qlLwk?X7eYZVlU#%IV5D;i{Xy*h
z@+2B>?w(OP@l&r;!W#`}{Qj1PQ>vD?q}f~=Crw>km{a<Er<Hg(5T95P5d48hH4c{k
z(Ht9n1r7ufqPi9TlR0*$qD=cA%)<W<lkWyWi^4t8z5|^UV5kQFrIy+8zqjfW#mhCz
zYjM*1&*gghWw%Wyps{crT((tO;>-eLZ^$Jy@a=U)P#M!2N69-4*kWc}=dXD7IPS<f
zCnkDnh=aD<8h(5K2^HtqIutP*gWt!gCN$4(C#!$mtN{_34R4Bj`ln*d%qjn&h$v@M
zFH5sc&dS(ZE8Thx)`@((^9KlduRMAVhbPh>Wcz)8O^D5=>Pv;JPWg5}o3%fW!+^2~
zRo#8^_&bf)8roSN<m*p5#ZjU(Q#rEPqjkPDSog-*7HC7bMl|0#pUJJvF(_3ctZqX&
zqKEbZA+o>veeC0&DX|qwV+h%J&*a)3l`&bO_zjm!BCCo-?=$vk&z}uijn){82*tx9
zB;?zRMtTjBherfiN@55*4&zR;BKx*s9J%3M!$LvSc~@XrWTNEQ|2eK_j{#iVQCe@D
IuQ)jW5AM-KU;qFB

literal 0
HcmV?d00001

diff --git a/testdata/fwd_capsid_strip.tpkg b/testdata/fwd_capsid_strip.tpkg
new file mode 100644
index 0000000000000000000000000000000000000000..c0be8a3c5dd6c7ecda1e8198b888da6aa3e00303
GIT binary patch
literal 1603
zcmV-J2E6$niwFQjRm)TW1ML}WbJ{pCU(v7Fl1$RhjU8LOX2>-Y0;Hi$fC9Np=kA7a
zYyob-ax7Cq=YIUH1O}5p!ljvX(qr>L+Fk8RTJ36AbVg3wwtV3_Z4m~puRCtAzxBLe
zAmnlx`Dx}dM*K5^Et96RG@GI6bZ*Nq)7g}{1(|1_$5I%I&<X&yMtm5uU^U-k^j8X<
zW%j>^w7J)Lx(;dJY&N~p{%HBR{SD-!CNgY+@qEi%4gYid3l@B1L7pV={}mT*IL<?w
zB(}jD4z#crFv}5nFiFDoaQPj}X4s=S-M}Bj`aB5pa8$1~T1O-?6igFi(dXSfc$_5g
zEHOLe0m@7!k=b=RZXX3Chu#$*dXA15#M`}q^Kin0A_C7Euu0G1n#V)!X2^oE*5|g>
z?{N`MgiB@ekZK(sXs(loF%tyaBP(#U@7!a!sHr3!MMV_LaRNlm)^K#xs;TL(!9$UW
z{A`OoFRbVPe!zY}$0PnvY0Upq*(~}$vTywVMPM7YH4T;-T+_D6HV8fpYzASE!N3x@
z1Mm&EOS&<Pddvei+!K--F!Cp89nkfCJ@l`;I<o205r4z(ZX{?49krk@!yFwl5d!)m
zxE`oBB3<hWRr;0?uGgKaS{$&TWr0M9F7?`cFyNjpdZf$3c3^o9AGBovgA}=_9@j3a
zrMC3)_dAVgi=13WsJCxtSojUhckd*P&WRD{l*sHJhvcHvcrOWuhj(W=88cTIwI1Z9
zb7s1dTiOv%x!P12;Ls+f+JwI2iMC|%1lc(&Rh#Wrx!I~VLGxk0q<g1hG6D{fpkuHH
zdbn%C?qs(rrT05;;%kwJX=BZ~(WP^t4^D=v+0Z4^q4(xPXA`0;W;C#_8OWr^?W(g*
z1am-RuqXD_UH8|~{@#K;_xAT9`sAum9MKNmqtb{>XY}9iuS`w=4q<quTC<IsUY^Q3
z&@Hbl`??!Q45>HD?~~HQ@WR`{&VIzI;jbMDg2U+gjcwL!F>(7XAY+}SyJlPAUEIiW
z7tUCF=)?5PtfJ95aXL#$h)wtxyMKQ+tatxUee8)k9?So;=Dhx+ROSEa&Heu}Z~!t#
zo>T#o%T~p^om!*vp;85QYYqH9!?-cf$xf?v2C1xJ5K^wT8eiJSW#l2}g;wztxNmcZ
z!A&^!@xK&G8s+-g7x>(OLIJ9^a-&gekV5I>MYDym)gQNAhcwH@R;5;j&lec$u|W>t
zvRrADpjfCk-@pO*0l&hle~c-AsKTA91>TU$(WP}|JFL^~xnHmQ1CRSRfe44+Mz`bd
zNYu->h4cDZSugT)9TJslqA*ids5URl4KlhM6^@Ig^2vwO%EwP<=hcTqC<zJE(5a!P
z3_WekrCqd6akpAu=9p5cA{&J>f=;8y_YiPT3t;M0PwAQIE|#mMpI23^ng3(e^>iJN
z`F{p${#pG`bE^K&nj8Or30Rf?qru@ND}b1mDCK`h$J(jCT!F)3j6@WS`6VBDpak8i
z39j9KzwNsYM7iO842_{;+0d)bNY?XzN7z50<5B;o*~tHmT$-x-KfSsCUj&XV!K&(&
z?5@$tA1n|q_wsmM8KlI7jmS_TP9~)qU<oaq%ebWmbgX_~mLlk;SO|EGIRca%9}9M!
z6a!|-!6hq1T_=GHDFZ%Q9+*ZxZRS%cD3)754KqW|E!PY2j|F*f0v#^(qF%rc_p8^n
zP^}<E6w+1CiloQ~KKGax=1Fnjl$g&v`Cv)rty9+b^Q0auS)zRAAa(VkxHJNi7F$YF
zk)<%aJ;4AaRn#qk1!A6@SZ;raie6Df_%HeYQ*}J%|2aC#|4qY8sr=ud8~=X^*yR7u
zm;c{Q^s7zqgt?IaFXvgT5ti2x=E^!E{Ude6`u_j)Gxmu8n^*wEzW>dt{6DkF|6c@F
z<o_xX{7T;d#Ggi0MG#dQ)2GfuaNI78MxzBcOA?7antk)A-lF60zH-FsICMuG{DT@9
z;6YL`Hc~7fPW!woaU!XnQKNVDs6*$y_)F+aK#yVGWqD%6f+TS}&<&Um$yl&TMoJIl
zx;>JZ46S`i64n<i>Q^zwN?d~7x*?dP;}W8p#w*HbHn4#WY+wWHz`p=3BH#ch005vX
BGa>*0

literal 0
HcmV?d00001

diff --git a/testdata/val_spurious_ns.rpl b/testdata/val_spurious_ns.rpl
new file mode 100644
index 000000000000..741fd1affc3c
--- /dev/null
+++ b/testdata/val_spurious_ns.rpl
@@ -0,0 +1,151 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with spurious unsigned NS in auth section 
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+SECTION AUTHORITY
+; removed by spurious NS record removal code
+;;example.com.	IN NS	ns.example.com.
+;;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END
diff --git a/util/config_file.c b/util/config_file.c
index 3554e3fa0505..f4eaccf1b3db 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -55,6 +55,7 @@
 #include "util/regional.h"
 #include "util/fptr_wlist.h"
 #include "util/data/dname.h"
+#include "util/rtt.h"
 #include "ldns/wire2str.h"
 #include "ldns/parseutil.h"
 #ifdef HAVE_GLOB_H
@@ -129,6 +130,7 @@ config_create(void)
 	cfg->prefetch_key = 0;
 	cfg->infra_cache_slabs = 4;
 	cfg->infra_cache_numhosts = 10000;
+	cfg->infra_cache_min_rtt = 50;
 	cfg->delay_close = 0;
 	if(!(cfg->outgoing_avail_ports = (int*)calloc(65536, sizeof(int))))
 		goto error_exit;
@@ -375,6 +377,10 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	{ IS_NUMBER_OR_ZERO; cfg->max_ttl = atoi(val); MAX_TTL=(time_t)cfg->max_ttl;}
 	else if(strcmp(opt, "cache-min-ttl:") == 0)
 	{ IS_NUMBER_OR_ZERO; cfg->min_ttl = atoi(val); MIN_TTL=(time_t)cfg->min_ttl;}
+	else if(strcmp(opt, "infra-cache-min-rtt:") == 0) {
+	    IS_NUMBER_OR_ZERO; cfg->infra_cache_min_rtt = atoi(val);
+	    RTT_MIN_TIMEOUT=cfg->infra_cache_min_rtt;
+	}
 	else S_NUMBER_OR_ZERO("infra-host-ttl:", host_ttl)
 	else S_POW2("infra-cache-slabs:", infra_cache_slabs)
 	else S_SIZET_NONZERO("infra-cache-numhosts:", infra_cache_numhosts)
@@ -623,6 +629,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_DEC(opt, "cache-min-ttl", min_ttl)
 	else O_DEC(opt, "infra-host-ttl", host_ttl)
 	else O_DEC(opt, "infra-cache-slabs", infra_cache_slabs)
+	else O_DEC(opt, "infra-cache-min-rtt", infra_cache_min_rtt)
 	else O_MEM(opt, "infra-cache-numhosts", infra_cache_numhosts)
 	else O_UNS(opt, "delay-close", delay_close)
 	else O_YNO(opt, "do-ip4", do_ip4)
@@ -1188,6 +1195,7 @@ config_apply(struct config_file* config)
 {
 	MAX_TTL = (time_t)config->max_ttl;
 	MIN_TTL = (time_t)config->min_ttl;
+	RTT_MIN_TIMEOUT = config->infra_cache_min_rtt;
 	EDNS_ADVERTISED_SIZE = (uint16_t)config->edns_buffer_size;
 	MINIMAL_RESPONSES = config->minimal_responses;
 	RRSET_ROUNDROBIN = config->rrset_roundrobin;
@@ -1205,6 +1213,8 @@ void config_lookup_uid(struct config_file* cfg)
 		cfg->uid = pwd->pw_uid;
 		cfg->gid = pwd->pw_gid;
 	}
+#else
+	(void)cfg;
 #endif
 }
 
diff --git a/util/config_file.h b/util/config_file.h
index 327eadc76f7b..7ffc00a02d2e 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -119,6 +119,8 @@ struct config_file {
 	size_t infra_cache_slabs;
 	/** max number of hosts in the infra cache */
 	size_t infra_cache_numhosts;
+	/** min value for infra cache rtt */
+	int infra_cache_min_rtt;
 	/** delay close of udp-timeouted ports, if 0 no delayclose. in msec */
 	int delay_close;
 
diff --git a/util/configlexer.c b/util/configlexer.c
index 3a71d967e687..7bb48afda21a 100644
--- a/util/configlexer.c
+++ b/util/configlexer.c
@@ -363,8 +363,8 @@ static void yy_fatal_error (yyconst char msg[]  );
 	*yy_cp = '\0'; \
 	(yy_c_buf_p) = yy_cp;
 
-#define YY_NUM_RULES 162
-#define YY_END_OF_BUFFER 163
+#define YY_NUM_RULES 164
+#define YY_END_OF_BUFFER 165
 /* This struct is not used in this scanner,
    but its presence is necessary. */
 struct yy_trans_info
@@ -372,185 +372,187 @@ struct yy_trans_info
 	flex_int32_t yy_verify;
 	flex_int32_t yy_nxt;
 	};
-static yyconst flex_int16_t yy_accept[1611] =
+static yyconst flex_int16_t yy_accept[1628] =
     {   0,
-        1,    1,  144,  144,  148,  148,  152,  152,  156,  156,
-        1,    1,  163,  160,    1,  142,  142,  161,    2,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  161,  144,
-      145,  145,  146,  161,  148,  149,  149,  150,  161,  155,
-      152,  153,  153,  154,  161,  156,  157,  157,  158,  161,
-      159,  143,    2,  147,  159,  161,  160,    0,    1,    2,
-        2,    2,    2,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+        1,    1,  146,  146,  150,  150,  154,  154,  158,  158,
+        1,    1,  165,  162,    1,  144,  144,  163,    2,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  163,  146,
+      147,  147,  148,  163,  150,  151,  151,  152,  163,  157,
+      154,  155,  155,  156,  163,  158,  159,  159,  160,  163,
+      161,  145,    2,  149,  161,  163,  162,    0,    1,    2,
+        2,    2,    2,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  144,    0,  148,    0,  155,    0,  152,  156,
-        0,  159,    0,    2,    2,  159,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  159,  160,  160,  160,  160,  160,  160,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  146,    0,  150,    0,  157,    0,  154,  158,
+        0,  161,    0,    2,    2,  161,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  161,  162,  162,  162,  162,  162,  162,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  159,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  161,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
 
-      160,  160,  160,  160,  160,   65,  160,  160,  160,  160,
-      160,    6,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  159,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      162,  162,  162,  162,  162,   66,  162,  162,  162,  162,
+      162,    6,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  161,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  159,  160,  160,  160,  160,   29,  160,  160,  160,
-      160,  160,  160,  160,  160,  129,  160,   12,   13,  160,
-       15,   14,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  122,
-      160,  160,  160,  160,  160,    3,  160,  160,  160,  160,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  161,  162,  162,  162,  162,   29,  162,  162,  162,
+      162,  162,  162,  162,  162,  131,  162,   12,   13,  162,
+       15,   14,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  124,
+      162,  162,  162,  162,  162,    3,  162,  162,  162,  162,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  159,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      151,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   32,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   33,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  161,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      153,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,   32,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,   33,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,   80,  151,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   79,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   63,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,   81,  153,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,   80,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+       64,  162,  162,  162,  162,  162,  162,  162,  162,  162,
 
-      160,  160,   20,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   30,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-       31,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,   22,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      162,  162,  162,   20,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+       30,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,   31,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,   22,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
 
-      160,  160,  160,  160,   26,  160,   27,  160,  160,  160,
-       66,  160,   67,  160,   64,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-        5,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   82,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,   23,  160,  160,  160,
-      160,  107,  106,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      162,  162,  162,  162,  162,  162,   26,  162,   27,  162,
+      162,  162,   67,  162,   68,  162,   65,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,    5,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,   83,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,   23,
+      162,  162,  162,  162,  108,  107,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
 
-      160,  160,   34,  160,  160,  160,  160,  160,  160,  160,
-      160,   69,   68,  160,  160,  160,  160,  160,  160,  160,
-      103,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   50,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,   54,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  105,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,    4,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      162,  162,  162,  162,  162,   34,  162,  162,  162,  162,
+      162,  162,  162,  162,   70,   69,  162,  162,  162,  162,
+      162,  162,  162,  104,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,   51,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,   55,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  106,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,    4,  162,  162,  162,  162,  162,  162,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  100,  160,  160,  160,  160,  160,  160,
-      160,  116,  101,  160,  127,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,   21,  160,  160,  160,  160,
-       71,  160,   72,   70,  160,  160,  160,  160,  160,  160,
-       78,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      102,  160,  160,  160,  160,  126,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,   62,  160,  160,
-      160,  160,  160,  160,  160,  160,   28,  160,  160,   17,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  101,  162,  162,
+      162,  162,  162,  162,  162,  117,  162,  102,  162,  129,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+       21,  162,  162,  162,  162,   72,  162,   73,   71,  162,
+      162,  162,  162,  162,  162,   79,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  103,  162,  162,  162,
+      162,  128,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,   63,  162,  162,  162,  162,  162,  162,
 
-      160,  160,  160,   16,  160,   87,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   41,
-       42,  160,  160,  160,  160,  160,  160,  130,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,   73,  160,  160,  160,  160,  160,   77,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,   81,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  121,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,   91,  160,   95,  160,  160,  160,  160,   76,  160,
+      162,  162,   28,  162,  162,   17,  162,  162,  162,   16,
+      162,   88,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,   41,   42,  162,  162,  162,
+      162,  162,  162,  162,  132,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,   74,  162,
+      162,  162,  162,  162,   78,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+       82,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  123,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,   92,
 
-      160,  114,  160,  160,  160,  128,  160,  160,  160,  160,
-      160,  160,  160,  135,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   94,  160,  160,  160,  160,   43,
-       44,  160,   49,   96,  160,  108,  104,  160,  160,   37,
-      160,   98,  160,  160,  160,  160,  160,    7,  160,   61,
-      113,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,   83,  134,  160,  160,
-      160,  160,  160,  160,  160,  160,  123,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   97,
+      162,   96,  162,  162,  162,  162,   77,  162,  162,  115,
+      162,  162,  162,  162,  130,  162,  162,  162,  162,  162,
+      162,  162,  137,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,   95,  162,  162,  162,  162,  162,   43,
+       44,  162,   50,   97,  162,  109,  105,  162,  162,   37,
+      162,   99,  162,  162,  162,  162,  162,    7,  162,   62,
+      114,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,   84,  136,  162,
+      162,  162,  162,  162,  162,  162,  162,  125,  162,  162,
 
-      160,   36,   38,  160,  160,  160,  160,  160,   60,  160,
-      160,  160,  160,  117,   18,   19,  160,  160,  160,  160,
-      160,  160,  160,   58,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  119,  160,  160,  160,  160,  160,  160,
-      160,  160,   35,  160,  160,  160,  160,  160,  160,   11,
-      160,  160,  160,  160,  160,  160,  160,   10,  160,  160,
-       39,  160,  125,  118,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,   90,   89,  160,  120,  115,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,   45,  160,  124,  160,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,   98,  162,   36,   38,  162,  162,  162,  162,  162,
+       61,  162,  162,  162,  162,  119,   18,   19,  162,  162,
+      162,  162,  162,  162,  162,   59,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  121,  118,  162,  162,  162,
+      162,  162,  162,  162,  162,   35,  162,  162,  162,  162,
+      162,  162,   11,  162,  162,  162,  162,  162,  162,  162,
+      162,   10,  162,  162,   39,  162,  127,  120,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,   91,
+       90,  162,  122,  116,  162,  162,  162,  162,  162,  162,
 
-      160,  160,  160,   40,  160,  160,  160,   84,   86,  109,
-      160,  160,  160,   88,  160,  160,  160,  160,  160,  160,
-      160,  160,  131,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,   24,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  133,  160,  160,  112,  160,  160,  160,  160,  160,
-      160,  160,   25,  160,    9,  160,  160,  110,   51,  160,
-      160,  160,   93,  160,  160,  160,  160,  160,  160,  132,
-       74,  160,  160,  160,   53,   57,   52,  160,   46,  160,
-        8,  160,  160,   92,  160,  160,  160,  160,  160,  160,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,   45,  162,  126,  162,  162,  162,  162,   40,  162,
+      162,  162,   85,   87,  110,  162,  162,  162,   89,  162,
+      162,  162,  162,  162,  162,  162,  162,  133,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,   24,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  135,  162,  162,
+      113,  162,  162,  162,  162,  162,  162,   48,  162,   25,
+      162,    9,  162,  162,  111,   52,  162,  162,  162,   94,
+      162,  162,  162,  162,  162,  162,  134,   75,  162,  162,
 
-      160,  160,  160,   56,  160,   47,  160,  111,  160,  160,
-       85,  160,  160,  160,  160,  160,  160,   75,   55,   48,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,   59,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,   99,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  138,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  136,  160,
+      162,   54,   58,   53,  162,   46,  162,    8,  162,  162,
+       93,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+       57,  162,   47,  162,  112,  162,  162,   86,  162,  162,
+      162,  162,  162,  162,   76,   56,   49,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,   60,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  100,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
 
-      139,  140,  160,  160,  160,  160,  160,  137,  141,    0
+      162,  140,  162,  162,  162,  162,  162,  162,  162,  162,
+      162,  162,  162,  162,  162,  138,  162,  141,  142,  162,
+      162,  162,  162,  162,  139,  143,    0
     } ;
 
 static yyconst flex_int32_t yy_ec[256] =
@@ -596,15 +598,15 @@ static yyconst flex_int32_t yy_meta[66] =
         1,    1,    1,    1,    1
     } ;
 
-static yyconst flex_int16_t yy_base[1625] =
+static yyconst flex_int16_t yy_base[1642] =
     {   0,
         0,    0,   63,   66,   69,   71,   77,   83,   88,   91,
-      129,  135,  428,  340,   95, 4656, 4656, 4656,  107,  110,
+      129,  135,  428,  340,   95, 4681, 4681, 4681,  107,  110,
       142,  180,  108,   50,  145,  172,  118,  148,  121,  181,
       197,  166,  217,  223,  251,  230,  164,  262,  116,  312,
-     4656, 4656, 4656,   94,  298, 4656, 4656, 4656,   96,  269,
-      294, 4656, 4656, 4656,  244,  254, 4656, 4656, 4656,  102,
-      249, 4656,  259, 4656,  247,  287,  237,  309,  111,    0,
+     4681, 4681, 4681,   94,  298, 4681, 4681, 4681,   96,  269,
+      294, 4681, 4681, 4681,  244,  254, 4681, 4681, 4681,  102,
+      249, 4681,  259, 4681,  247,  287,  237,  309,  111,    0,
       313,    0,    0,  284,  170,  265,  288,  289,  296,  305,
       301,  273,  302,  328,  306,  311,  308,  309,  216,  325,
       329,  339,  353,  344,  356,  357,  338,  365,  346,  367,
@@ -631,8 +633,8 @@ static yyconst flex_int16_t yy_base[1625] =
       934,  960,  938,  945,  943,  949,  959,  969,  973,  970,
       982,  985,  976,  983,  981,  992,  996,  978, 1002, 1001,
 
-     1010, 1015, 1012, 1003, 1021, 4656, 1026, 1004, 1028, 1023,
-     1033, 4656, 1037, 1038, 1020, 1041, 1048, 1006, 1044, 1047,
+     1010, 1015, 1012, 1003, 1021, 4681, 1026, 1004, 1028, 1023,
+     1033, 4681, 1037, 1038, 1020, 1041, 1048, 1006, 1044, 1047,
      1049, 1063, 1051, 1072, 1064, 1060, 1107, 1075, 1076, 1104,
      1098, 1085, 1110, 1089, 1116, 1103, 1112, 1131, 1102, 1125,
      1122, 1144, 1136, 1141, 1157, 1130, 1150, 1148, 1151,  899,
@@ -645,324 +647,328 @@ static yyconst flex_int16_t yy_base[1625] =
      1342, 1318, 1317, 1321, 1331, 1333, 1327, 1332, 1335, 1344,
      1341, 1343, 1350, 1337, 1348, 1371, 1370, 1373, 1376, 1366,
      1368, 1377, 1378, 1386, 1389, 1397, 1401, 1392, 1400, 1411,
-     1408, 1416, 1412, 1426, 1404, 1431, 4656, 1445, 1442, 1424,
-     1437, 1448, 1443, 1435, 1484, 4656, 1439, 4656, 4656, 1451,
-     4656, 4656, 1465, 1438, 1473, 1449, 1532, 1475, 1467, 1472,
+     1408, 1416, 1412, 1426, 1404, 1431, 4681, 1445, 1442, 1424,
+     1437, 1448, 1443, 1435, 1484, 4681, 1439, 4681, 4681, 1451,
+     4681, 4681, 1465, 1438, 1473, 1449, 1532, 1475, 1467, 1472,
      1483, 1490, 1491, 1504, 1499, 1518, 1525, 1510, 1502, 1508,
      1513, 1537, 1541, 1535, 1542, 1543, 1561, 1562, 1557, 1566,
-     1559, 1565, 1558, 1570, 1574, 1579, 1582, 1586, 1577, 4656,
-     1588, 1584, 1594, 1592, 1609, 4656, 1589, 1600, 1603, 1606,
+     1559, 1565, 1558, 1570, 1574, 1579, 1582, 1586, 1577, 4681,
+     1588, 1584, 1594, 1592, 1609, 4681, 1589, 1600, 1603, 1606,
 
      1613, 1611, 1619, 1625, 1623, 1630, 1633, 1634, 1637, 1639,
      1640, 1618, 1667, 1661, 1652, 1660, 1668, 1653, 1676, 1682,
      1680, 1666, 1678, 1686, 1669, 1685, 1690, 1687, 1693, 1696,
-     1695, 1694, 1744, 1721, 1712, 1705, 1716, 1701, 1723, 1724,
-     1732, 1741, 1757, 1761, 1759, 1713, 1763, 1764, 1748, 1795,
-     1780, 1765, 1786, 1804, 1797, 1800, 1806, 1790, 1767, 1807,
-     4656, 1799, 1812, 1791, 1827, 1814, 1824, 1835, 1826, 1847,
-     1829, 1836, 1846, 1861, 4656, 1839, 1841, 1854, 1860, 1870,
-     1873, 1871, 1863, 1887, 4656, 1893, 1900, 1881, 1879, 1883,
-     1892, 1888, 1907, 1908, 1910, 1902, 1911, 1899, 1914, 1906,
+     1695, 1694, 1744, 1721, 1712, 1705, 1716, 1701, 1723, 1742,
+     1732, 1746, 1757, 1763, 1752, 1754, 1764, 1771, 1774, 1802,
+     1780, 1782, 1788, 1793, 1792, 1798, 1799, 1795, 1740, 1807,
+     4681, 1790, 1815, 1812, 1819, 1838, 1817, 1839, 1830, 1842,
+     1833, 1837, 1841, 1856, 4681, 1835, 1855, 1852, 1866, 1879,
+     1880, 1863, 1860, 1890, 4681, 1895, 1888, 1893, 1882, 1881,
+     1899, 1883, 1898, 1900, 1907, 1917, 1908, 1918, 1912, 1919,
 
-     1922, 1928, 1929, 1927, 1940, 1937, 1952, 1941, 1955, 1949,
-     1950, 1936, 1965, 1951, 1970, 1964, 1967, 1976,  120, 1972,
-     1986, 1977, 1973, 4656,   76, 1987, 1991, 1982, 2009, 2011,
-     2007, 2005, 2010, 2015, 2016, 2025, 2008, 2021, 2023, 2038,
-     2029, 2052, 2050, 2054, 2043, 2042, 2046, 2051, 2058, 2047,
-     2070, 2067, 2079, 2080, 2077, 2081, 2087, 2076, 2084, 2082,
-     2106, 2102, 2098, 2111, 4656, 2119, 2107, 2116, 2108, 2125,
-     2140, 2122, 2129, 2144, 2135, 2136, 2145, 2149, 2157, 2151,
-     2156, 2152, 2147, 2163, 2174, 2168, 2171, 2190, 2178, 4656,
-     2182, 2176, 2192, 2180, 2193, 2188, 2197, 2207, 2202, 2214,
+     1935, 1924, 1928, 1916, 1939, 1944, 1945, 1940, 1951, 1946,
+     1941, 1960, 1963, 1955, 1961, 1956, 1972, 1977,  120, 1973,
+     1983, 1974, 1969, 4681,   76, 1981, 1988, 1978, 2010, 2011,
+     2004, 2000, 2012, 2018, 2002, 2005, 2013, 2015, 2033, 2025,
+     2029, 2027, 2045, 2044, 2041, 2050, 2054, 2040, 2056, 2061,
+     2059, 2074, 2063, 2076, 2060, 2083, 2084, 2077, 2075, 2087,
+     2095, 2091, 2085, 2103, 2106, 4681, 2121, 2105, 2112, 2109,
+     2126, 2138, 2118, 2128, 2134, 2132, 2148, 2139, 2146, 2153,
+     2158, 2147, 2155, 2145, 2161, 2164, 2157, 2173, 2183, 2175,
+     4681, 2189, 2180, 2185, 2184, 2187, 2200, 2191, 2211, 2190,
 
-     2213, 2222, 4656, 2229, 2231, 2223, 2230, 2224, 2243, 2240,
-     2246, 2233, 2256, 2239, 2257, 2263, 2250, 2259, 2269, 4656,
-     2252, 2279, 2273, 2285, 2284, 2275, 2271, 2287, 2277, 2290,
-     2289, 2281, 2295, 2292, 2298, 2303, 2302, 2314, 2308, 2328,
-     4656, 2338, 2309, 2335, 2337, 2330, 2350, 2345, 2336, 2329,
-     2325, 2355, 2356, 2362, 2359, 2363, 2366, 2368, 2371, 2354,
-     2372, 2392, 2394, 2398, 2386, 2393, 2390, 2409, 2389, 2417,
-     2396, 2412, 2425, 4656, 2427, 2428, 2420, 2416, 2445, 2438,
-     2421, 2431, 2430, 2432, 2457, 2468, 2447, 2452, 2454, 2461,
-     2455, 2449, 2460, 2484, 2481, 2487, 2476, 2483, 2474, 2499,
+     2209, 2216, 2221, 4681, 2220, 2232, 2222, 2234, 2219, 2240,
+     2246, 2244, 2225, 2248, 2247, 2249, 2256, 2242, 2259, 2263,
+     4681, 2266, 2267, 2272, 2283, 2276, 2269, 2278, 2291, 2275,
+     2284, 2302, 2281, 2286, 2282, 2313, 2297, 2294, 2305, 2315,
+     2303, 2330, 4681, 2343, 2322, 2328, 2346, 2311, 2341, 2347,
+     2334, 2337, 2333, 2349, 2360, 2353, 2357, 2362, 2361, 2363,
+     2381, 2354, 2372, 2380, 2390, 2396, 2384, 2394, 2398, 2399,
+     2389, 2409, 2404, 2419, 2426, 4681, 2420, 2428, 2421, 2415,
+     2443, 2438, 2425, 2430, 2424, 2437, 2439, 2462, 2440, 2454,
+     2455, 2460, 2461, 2442, 2453, 2477, 2480, 2487, 2471, 2483,
 
-     2500, 2502, 2495, 2508, 4656, 2507, 4656, 2504, 2516, 2524,
-     4656, 2523, 4656, 2528, 4656, 2527, 2536, 2526, 2513, 2531,
-     2534, 2532, 2546, 2529, 2559, 2540, 2558, 2544, 2551, 2572,
-     4656, 2561, 2566, 2581, 2563, 2564, 2574, 2590, 2593, 2585,
-     2575, 2586, 2603, 2599, 4656, 2591, 2613, 2604, 2608, 2630,
-     2627, 2619, 2620, 2632, 2625, 2631, 2642, 2638, 2626, 2643,
-     2647, 2663, 2622, 2671, 2673, 2674, 2660, 2661, 2664, 2666,
-     2670, 2672, 2687, 2690, 2693, 2675, 4656, 2677, 2708, 2709,
-     2700, 4656, 4656, 2722, 2723, 2719, 2712, 2720, 2706, 2732,
-     2745, 2734, 2731, 2737, 2747, 2748, 2749, 2740, 2751, 2761,
+     2476, 2493, 2489, 2495, 2488, 2501, 4681, 2506, 4681, 2504,
+     2512, 2521, 4681, 2525, 4681, 2527, 4681, 2526, 2531, 2515,
+     2516, 2520, 2533, 2522, 2544, 2535, 2545, 2547, 2539, 2559,
+     2548, 2565, 4681, 2558, 2564, 2579, 2561, 2573, 2575, 2582,
+     2594, 2583, 2592, 2587, 2590, 2589, 2607, 4681, 2574, 2614,
+     2606, 2603, 2626, 2628, 2622, 2634, 2630, 2611, 2645, 2641,
+     2646, 2633, 2639, 2649, 2659, 2654, 2660, 2652, 2662, 2666,
+     2663, 2668, 2685, 2670, 2687, 2702, 2681, 2686, 2695, 4681,
+     2690, 2696, 2709, 2704, 4681, 4681, 2680, 2722, 2714, 2708,
+     2728, 2715, 2741, 2729, 2743, 2740, 2739, 2731, 2736, 2746,
 
-     2764, 2752, 4656, 2777, 2767, 2781, 2776, 2775, 2787, 2773,
-     2796, 4656, 4656, 2790, 2788, 2792, 2797, 2815, 2802, 2803,
-     4656, 2800, 2827, 2828, 2829, 2830, 2832, 2813, 2823, 2839,
-     2837, 2840, 2857, 2848, 2858, 2853, 2866, 2846, 2849, 4656,
-     2865, 2877, 2875, 2876, 2873, 2878, 2868, 2884, 2885, 2886,
-     2900, 2891, 2892, 2899, 2903, 2904, 2923, 2905, 2928, 2929,
-     2939, 2933, 4656, 2941, 2926, 2942, 2918, 2940, 2945, 2952,
-     2962, 2937, 2938, 2955, 2956, 2959, 2935, 2979, 2967, 4656,
-     2969, 2990, 2982, 2984, 2983, 2972, 2994, 2986, 2999, 4656,
-     3011, 3004, 3000, 3021, 3023, 3024, 3025, 3010, 3017, 3014,
+     2747, 2751, 2756, 2763, 2758, 4681, 2766, 2764, 2792, 2783,
+     2774, 2796, 2784, 2795, 4681, 4681, 2799, 2787, 2790, 2786,
+     2806, 2802, 2810, 4681, 2816, 2811, 2825, 2834, 2835, 2832,
+     2821, 2831, 2820, 2837, 2838, 2842, 2853, 2848, 2852, 2866,
+     2856, 2871, 2876, 4681, 2873, 2884, 2877, 2880, 2879, 2878,
+     2881, 2886, 2905, 2875, 2904, 2894, 2924, 2907, 2906, 2909,
+     2910, 2915, 2926, 2930, 2942, 2936, 4681, 2944, 2931, 2947,
+     2920, 2948, 2958, 2954, 2965, 2940, 2941, 2953, 2943, 2982,
+     2963, 2992, 2974, 4681, 2986, 2983, 2981, 2990, 2998, 2976,
+     3011, 2988, 3010, 4681, 3013, 3003, 3008, 3020, 3031, 3037,
 
-     3031, 3039, 3026, 3036, 3038, 3040, 3043, 3055, 3072, 3071,
-     3078, 3079, 3057, 3065, 3084, 3073, 3082, 3075, 3063, 3093,
-     3081, 3097, 3089, 4656, 3091, 3095, 3107, 3111, 3114, 3120,
-     3116, 4656, 4656, 3115, 4656, 3121, 3123, 3109, 3122, 3137,
-     3113, 3135, 3140, 3141, 3143, 4656, 3162, 3151, 3152, 3156,
-     4656, 3171, 4656, 4656, 3159, 3179, 3160, 3175, 3178, 3181,
-     4656, 3184, 3189, 3192, 3194, 3183, 3185, 3187, 3198, 3203,
-     4656, 3212, 3225, 3210, 3220, 4656, 3218, 3231, 3207, 3230,
-     3236, 3241, 3243, 3249, 3244, 3245, 3256, 4656, 3247, 3255,
-     3251, 3265, 3272, 3278, 3270, 3273, 4656, 3282, 3290, 4656,
+     3023, 3016, 3029, 3030, 3033, 3040, 3043, 3051, 3050, 3062,
+     3047, 3058, 3069, 3080, 3086, 3085, 3057, 3075, 3094, 3079,
+     3088, 3089, 3073, 3107, 3082, 3109, 3096, 4681, 3114, 3097,
+     3111, 3116, 3115, 3121, 3123, 4681, 3124, 4681, 3118, 4681,
+     3125, 3126, 3113, 3146, 3140, 3142, 3135, 3160, 3150, 3149,
+     4681, 3167, 3153, 3166, 3169, 4681, 3170, 4681, 4681, 3172,
+     3176, 3157, 3180, 3187, 3183, 4681, 3184, 3192, 3199, 3195,
+     3188, 3205, 3208, 3211, 3206, 3210, 4681, 3219, 3226, 3207,
+     3231, 4681, 3215, 3241, 3233, 3238, 3247, 3256, 3257, 3227,
+     3244, 3267, 3268, 4681, 3250, 3252, 3275, 3270, 3278, 3279,
 
-     3276, 3293, 3294, 4656, 3292, 4656, 3296, 3300, 3299, 3309,
-     3301, 3321, 3331, 3314, 3328, 3329, 3322, 3338, 3336, 4656,
-     4656, 3337, 3339, 3342, 3340, 3345, 3347, 4656, 3351, 3348,
-     3358, 3367, 3363, 3365, 3370, 3384, 3385, 3372, 3388, 3374,
-     3377, 4656, 3378, 3379, 3397, 3395, 3405, 4656, 3417, 3416,
-     3408, 3415, 3429, 3431, 3433, 3423, 3437, 3438, 3420, 3440,
-     3441, 3432, 4656, 3444, 3452, 3435, 3461, 3455, 3463, 3467,
-     3471, 3474, 3456, 3477, 4656, 3480, 3458, 3485, 3482, 3481,
-     3490, 3478, 3479, 3489, 3516, 3500, 3514, 3517, 3511, 3528,
-     3527, 4656, 3509, 4656, 3524, 3534, 3532, 3538, 4656, 3530,
+     3271, 3289, 4681, 3294, 3298, 4681, 3291, 3265, 3295, 4681,
+     3307, 4681, 3309, 3305, 3302, 3310, 3323, 3324, 3335, 3322,
+     3339, 3340, 3331, 3348, 3347, 4681, 4681, 3350, 3352, 3356,
+     3349, 3346, 3358, 3353, 4681, 3362, 3373, 3342, 3366, 3389,
+     3377, 3380, 3397, 3398, 3384, 3401, 3383, 3393, 4681, 3391,
+     3400, 3410, 3405, 3413, 4681, 3403, 3432, 3425, 3427, 3430,
+     3444, 3447, 3448, 3436, 3450, 3451, 3437, 3453, 3455, 3454,
+     4681, 3461, 3460, 3465, 3467, 3468, 3463, 3476, 3488, 3485,
+     3472, 3497, 4681, 3498, 3475, 3506, 3496, 3502, 3503, 3492,
+     3509, 3499, 3516, 3512, 3528, 3529, 3526, 3546, 3541, 4681,
 
-     3537, 4656, 3543, 3558, 3540, 4656, 3568, 3555, 3570, 3565,
-     3561, 3559, 3579, 4656, 3583, 3581, 3589, 3586, 3573, 3590,
-     3592, 3596, 3603, 3609, 4656, 3606, 3619, 3617, 3627, 4656,
-     4656, 3630, 4656, 4656, 3626, 4656, 4656, 3632, 3634, 4656,
-     3635, 4656, 3613, 3640, 3639, 3616, 3642, 4656, 3645, 4656,
-     4656, 3643, 3658, 3636, 3666, 3673, 3676, 3678, 3667, 3662,
-     3669, 3672, 3674, 3683, 3670, 3691, 3693, 3695, 3689, 3699,
-     3668, 3700, 3705, 3719, 3720, 3704, 4656, 4656, 3708, 3715,
-     3716, 3710, 3731, 3729, 3726, 3753, 4656, 3734, 3736, 3747,
-     3741, 3746, 3750, 3751, 3769, 3779, 3767, 3765, 3763, 4656,
+     3530, 4681, 3542, 3557, 3556, 3561, 4681, 3544, 3548, 4681,
+     3563, 3569, 3571, 3576, 4681, 3579, 3567, 3594, 3580, 3585,
+     3583, 3603, 4681, 3578, 3597, 3611, 3608, 3596, 3610, 3605,
+     3612, 3619, 3622, 4681, 3618, 3615, 3637, 3640, 3649, 4681,
+     4681, 3635, 4681, 4681, 3650, 4681, 4681, 3652, 3653, 4681,
+     3654, 4681, 3660, 3658, 3655, 3643, 3661, 4681, 3668, 4681,
+     4681, 3664, 3670, 3675, 3678, 3673, 3674, 3690, 3682, 3685,
+     3692, 3695, 3696, 3701, 3691, 3713, 3705, 3698, 3700, 3702,
+     3712, 3723, 3725, 3721, 3739, 3745, 3746, 4681, 4681, 3729,
+     3740, 3732, 3735, 3748, 3741, 3742, 3764, 4681, 3774, 3768,
 
-     3768, 4656, 4656, 3778, 3785, 3799, 3786, 3789, 4656, 3800,
-     3802, 3803, 3804, 4656, 4656, 4656, 3816, 3796, 3810, 3815,
-     3827, 3814, 3828, 4656, 3823, 3830, 3834, 3825, 3822, 3824,
-     3857, 3856, 3858, 4656, 3868, 3865, 3866, 3861, 3859, 3864,
-     3873, 3863, 4656, 3876, 3867, 3895, 3899, 3886, 3900, 4656,
-     3891, 3892, 3889, 3903, 3915, 3913, 3918, 4656, 3916, 3907,
-     4656, 3917, 4656, 4656, 3926, 3927, 3929, 3924, 3933, 3941,
-     3931, 3943, 3965, 3962, 3959, 4656, 4656, 3958, 4656, 4656,
-     3954, 3961, 3951, 3947, 3968, 3975, 3960, 3989, 3981, 3976,
-     3985, 3978, 3987, 3991, 4002, 3993, 4656, 4012, 4656, 4003,
+     3763, 3762, 3775, 3767, 3779, 3786, 3800, 3781, 3782, 3784,
+     3792, 4681, 3795, 4681, 4681, 3796, 3815, 3817, 3806, 3810,
+     4681, 3829, 3813, 3831, 3834, 4681, 4681, 4681, 3835, 3824,
+     3838, 3844, 3845, 3833, 3856, 4681, 3839, 3848, 3862, 3842,
+     3868, 3870, 3882, 3885, 3886, 4681, 4681, 3891, 3884, 3887,
+     3881, 3878, 3894, 3895, 3889, 4681, 3896, 3897, 3898, 3921,
+     3905, 3922, 4681, 3916, 3918, 3917, 3939, 3932, 3940, 3934,
+     3945, 4681, 3937, 3943, 4681, 3947, 4681, 4681, 3933, 3951,
+     3968, 3954, 3955, 3975, 3958, 3970, 3990, 3987, 3985, 4681,
+     4681, 3982, 4681, 4681, 3974, 3994, 3978, 3973, 4008, 4004,
 
-     4019, 4018, 4014, 4656, 4016, 4020, 4006, 4656, 4656, 4656,
-     4030, 4036, 4042, 4656, 4048, 4045, 4034, 4060, 4049, 4064,
-     4041, 4056, 4656, 4052, 4058, 4070, 4068, 4072, 4082, 4076,
-     4081, 4063, 4083, 4096, 4100, 4656, 4106, 4087, 4090, 4118,
-     4119, 4103, 4108, 4104, 4121, 4113, 4131, 4123, 4130, 4126,
-     4137, 4656, 4138, 4135, 4656, 4141, 4151, 4159, 4160, 4161,
-     4162, 4166, 4656, 4171, 4656, 4173, 4169, 4656, 4656, 4168,
-     4175, 4179, 4656, 4180, 4186, 4181, 4192, 4193, 4200, 4656,
-     4656, 4195, 4190, 4212, 4656, 4656, 4656, 4191, 4656, 4217,
-     4656, 4223, 4211, 4656, 4207, 4228, 4208, 4230, 4219, 4224,
+     4005, 3998, 4009, 4012, 4011, 4002, 4010, 4015, 4034, 4025,
+     4026, 4681, 4044, 4681, 4032, 4048, 4052, 4049, 4681, 4051,
+     4053, 4037, 4681, 4681, 4681, 4061, 4068, 4054, 4681, 4077,
+     4075, 4070, 4081, 4076, 4071, 4074, 4100, 4681, 4087, 4090,
+     4107, 4101, 4096, 4097, 4111, 4115, 4103, 4122, 4117, 4125,
+     4126, 4681, 4135, 4121, 4118, 4150, 4151, 4138, 4142, 4139,
+     4155, 4148, 4156, 4145, 4174, 4162, 4171, 4681, 4173, 4166,
+     4681, 4176, 4187, 4194, 4195, 4196, 4197, 4681, 4199, 4681,
+     4203, 4681, 4205, 4206, 4681, 4681, 4200, 4209, 4210, 4681,
+     4213, 4198, 4212, 4229, 4223, 4236, 4681, 4681, 4231, 4234,
 
-     4242, 4235, 4249, 4656, 4258, 4656, 4259, 4656, 4251, 4260,
-     4656, 4268, 4252, 4265, 4256, 4253, 4257, 4656, 4656, 4656,
-     4278, 4269, 4264, 4280, 4276, 4285, 4281, 4295, 4311, 4304,
-     4309, 4312, 4293, 4300, 4323, 4316, 4656, 4319, 4305, 4327,
-     4329, 4321, 4336, 4328, 4338, 4339, 4340, 4346, 4341, 4364,
-     4365, 4356, 4371, 4373, 4376, 4377, 4374, 4368, 4384, 4383,
-     4387, 4388, 4392, 4394, 4399, 4656, 4411, 4403, 4404, 4405,
-     4424, 4430, 4409, 4426, 4436, 4439, 4434, 4429, 4442, 4440,
-     4451, 4446, 4454, 4453, 4656, 4455, 4471, 4464, 4469, 4478,
-     4470, 4474, 4494, 4477, 4500, 4484, 4490, 4501, 4656, 4497,
+     4245, 4681, 4681, 4681, 4248, 4681, 4250, 4681, 4252, 4238,
+     4681, 4239, 4259, 4235, 4255, 4262, 4264, 4280, 4271, 4267,
+     4681, 4288, 4681, 4292, 4681, 4281, 4294, 4681, 4303, 4286,
+     4296, 4287, 4284, 4289, 4681, 4681, 4681, 4314, 4304, 4312,
+     4307, 4317, 4320, 4313, 4322, 4342, 4334, 4341, 4345, 4329,
+     4333, 4359, 4344, 4681, 4351, 4355, 4361, 4363, 4353, 4370,
+     4357, 4365, 4368, 4378, 4385, 4377, 4384, 4394, 4381, 4401,
+     4404, 4408, 4410, 4403, 4411, 4417, 4412, 4405, 4414, 4438,
+     4426, 4430, 4681, 4442, 4429, 4431, 4439, 4453, 4456, 4436,
+     4458, 4463, 4457, 4460, 4449, 4471, 4466, 4485, 4477, 4494,
 
-     4656, 4656, 4504, 4499, 4506, 4512, 4513, 4656, 4656, 4656,
-     4564, 4571, 4578, 4585, 4592,   82, 4599, 4606, 4613, 4620,
-     4627, 4634, 4641, 4648
+     4478, 4681, 4498, 4501, 4483, 4488, 4508, 4495, 4512, 4510,
+     4513, 4520, 4516, 4517, 4525, 4681, 4537, 4681, 4681, 4540,
+     4529, 4530, 4546, 4550, 4681, 4681, 4681, 4589, 4596, 4603,
+     4610, 4617,   82, 4624, 4631, 4638, 4645, 4652, 4659, 4666,
+     4673
     } ;
 
-static yyconst flex_int16_t yy_def[1625] =
+static yyconst flex_int16_t yy_def[1642] =
     {   0,
-     1610,    1, 1611, 1611, 1612, 1612, 1613, 1613, 1614, 1614,
-     1615, 1615, 1610, 1616, 1610, 1610, 1610, 1610, 1617, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1618,
-     1610, 1610, 1610, 1618, 1619, 1610, 1610, 1610, 1619, 1620,
-     1610, 1610, 1610, 1610, 1620, 1621, 1610, 1610, 1610, 1621,
-     1622, 1610, 1623, 1610, 1622, 1622, 1616, 1616, 1610, 1624,
-     1617, 1624, 1617, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1627,    1, 1628, 1628, 1629, 1629, 1630, 1630, 1631, 1631,
+     1632, 1632, 1627, 1633, 1627, 1627, 1627, 1627, 1634, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1635,
+     1627, 1627, 1627, 1635, 1636, 1627, 1627, 1627, 1636, 1637,
+     1627, 1627, 1627, 1627, 1637, 1638, 1627, 1627, 1627, 1638,
+     1639, 1627, 1640, 1627, 1639, 1639, 1633, 1633, 1627, 1641,
+     1634, 1641, 1634, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1618, 1618, 1619, 1619, 1620, 1620, 1610, 1621,
-     1621, 1622, 1622, 1623, 1623, 1622, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1622, 1616, 1616, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1635, 1635, 1636, 1636, 1637, 1637, 1627, 1638,
+     1638, 1639, 1639, 1640, 1640, 1639, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1639, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1622, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1639, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1622, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
+     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1639, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1622, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1610, 1610, 1616,
-     1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1639, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1627, 1633,
+     1627, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1622, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1639, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1622, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1627, 1639, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1616, 1610, 1616, 1610, 1616, 1616, 1616,
-     1610, 1616, 1610, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616,
-     1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1633,
+     1633, 1633, 1627, 1633, 1627, 1633, 1627, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627,
+     1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1610, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1610, 1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1610,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1633, 1627,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1627, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1627, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633,
+     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1610, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1616, 1610, 1616, 1616, 1616, 1616, 1610, 1616,
+     1633, 1633, 1627, 1633, 1633, 1627, 1633, 1633, 1633, 1627,
+     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633,
+     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627,
 
-     1616, 1610, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1610,
-     1610, 1616, 1610, 1610, 1616, 1610, 1610, 1616, 1616, 1610,
-     1616, 1610, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1610,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1610, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
+     1633, 1627, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1627,
+     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1627,
+     1627, 1633, 1627, 1627, 1633, 1627, 1627, 1633, 1633, 1627,
+     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627,
+     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1627, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
 
-     1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1610, 1616,
-     1616, 1616, 1616, 1610, 1610, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616,
-     1610, 1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1610, 1616, 1610, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1610, 1616,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1627, 1633, 1627, 1627, 1633, 1633, 1633, 1633, 1633,
+     1627, 1633, 1633, 1633, 1633, 1627, 1627, 1627, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
+     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1627, 1633, 1633, 1627, 1633, 1627, 1627, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627,
+     1627, 1633, 1627, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1610, 1610, 1610,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1610, 1616, 1616, 1610, 1610, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1610, 1616, 1616, 1616, 1610, 1610, 1610, 1616, 1610, 1616,
-     1610, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1627, 1633, 1627, 1633, 1633, 1633, 1633, 1627, 1633,
+     1633, 1633, 1627, 1627, 1627, 1633, 1633, 1633, 1627, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
+     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627,
+     1633, 1627, 1633, 1633, 1627, 1627, 1633, 1633, 1633, 1627,
+     1633, 1633, 1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633,
 
-     1616, 1616, 1616, 1610, 1616, 1610, 1616, 1610, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1610, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616,
+     1633, 1627, 1627, 1627, 1633, 1627, 1633, 1627, 1633, 1633,
+     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1627, 1633, 1627, 1633, 1627, 1633, 1633, 1627, 1633, 1633,
+     1633, 1633, 1633, 1633, 1627, 1627, 1627, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
 
-     1610, 1610, 1616, 1616, 1616, 1616, 1616, 1610, 1610,    0,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610
+     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1627, 1633,
+     1633, 1633, 1633, 1633, 1627, 1627,    0, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627
     } ;
 
-static yyconst flex_int16_t yy_nxt[4722] =
+static yyconst flex_int16_t yy_nxt[4747] =
     {   0,
        14,   15,   16,   17,   18,   19,   18,   14,   14,   14,
        14,   18,   20,   14,   21,   22,   23,   24,   14,   25,
@@ -977,7 +983,7 @@ static yyconst flex_int16_t yy_nxt[4722] =
 
        70,   44,  125,   87,   44,  130,  130,   49,   72,   49,
        72,   72,   69,   72,  133,   55,   70,   67,   72,   67,
-       67,   55,   67,   85,   74,   75,   60,   67,  724,   60,
+       67,   55,   67,   85,   74,   75,   60,   67,  725,   60,
        15,   16,   17,   62,   63,   64,   15,   16,   17,   62,
        63,   64,   76,   86,   94,   73,   68,   96,   68,   65,
        85,   74,   75,  133,   77,   65,   68,   88,   68,   68,
@@ -1010,34 +1016,34 @@ static yyconst flex_int16_t yy_nxt[4722] =
 
       165,  160,  164,   68,  172,   68,   68,   68,  182,  173,
        68,   68,  168,  170,  177,  174,  178,  166,  175,  162,
-      169,   68,  176,  171,   68,  179,  180, 1610, 1610,  181,
+      169,   68,  176,  171,   68,  179,  180, 1627, 1627,  181,
        68,  172,   68,  183,   68,  184,  173,   68,   68,   68,
-       68,  177,  174,  178,  189,  175,  187, 1610,   68,  176,
+       68,  177,  174,  178,  189,  175,  187, 1627,   68,  176,
       186,  192,  179,  180,  191,  185,  181,   68,  188,   68,
-      183,   68,  184,  193,   68,  190,   68, 1610, 1610,   68,
-     1610,  189,   68,  187,  196,  194,   68,  186,  192,  195,
-     1610,  191,  185,  204,  127,  188,  127,  127, 1610,  127,
+      183,   68,  184,  193,   68,  190,   68, 1627, 1627,   68,
+     1627,  189,   68,  187,  196,  194,   68,  186,  192,  195,
+     1627,  191,  185,  204,  127,  188,  127,  127, 1627,  127,
       193,  132,  190,  132,  132,   72,  132,   72,   72,  133,
 
        72,   68,  194,  197,  198,   68,  195,  199,  201,  200,
-      213,  203, 1610,  202,   68,   68,   68, 1610,   68,   68,
-      205, 1610,  214,   68,  215,  217,  222,  216,   68,  218,
+      213,  203, 1627,  202,   68,   68,   68, 1627,   68,   68,
+      205, 1627,  214,   68,  215,  217,  222,  216,   68,  218,
       197,  198,  135,   68,  199,   68,  200,  213,  203,   68,
-      202,  206,   68,  219,   68,  227, 1610,   68,   68,  214,
-       68,  215,  217,  222,  216,   68,  218,  220, 1610, 1610,
-      221,  223, 1610,  224,  225, 1610,  226,  231,  206,  207,
+      202,  206,   68,  219,   68,  227, 1627,   68,   68,  214,
+       68,  215,  217,  222,  216,   68,  218,  220, 1627, 1627,
+      221,  223, 1627,  224,  225, 1627,  226,  231,  206,  207,
       219,   68,   68,  228,  208,  233,   68,   68,  234,  209,
-      236,   68, 1610,   68,  220,  210,  211,  221,  223,   68,
+      236,   68, 1627,   68,  220,  210,  211,  221,  223,   68,
       224,  225,   68,  226,  229,  235,  207,  232,   68,   68,
 
-      228,  208,  233,  237,  230,  239,  209, 1610,  238,   68,
-     1610,   68,  210,  211,  240,   68,  241,   68,  242,  243,
+      228,  208,  233,  237,  230,  239,  209, 1627,  238,   68,
+     1627,   68,  210,  211,  240,   68,  241,   68,  242,  243,
       246,   68,  235,   68,  232,   68,   68,  244,   68,  245,
       250,  230,  239,  251,   68,  238,   68,   68,   68,   68,
        68,  240,   68,  241,  247,  242,  243,  246,  253,   68,
       248,  249,  254,  257,  244,  255,  245,  256,  260,   68,
-      251,   68, 1610,   68,  258,  267,  263,  269,   68, 1610,
-      266,  247,   68,  261, 1610,  253,   68,  248,  249,   68,
+      251,   68, 1627,   68,  258,  267,  263,  269,   68, 1627,
+      266,  247,   68,  261, 1627,  253,   68,  248,  249,   68,
       257,  133,  255,   68,  256,  265,  259,   68,  264,   68,
       262,  268,  267,  263,  269,   68,   68,  270,   68,  272,
 
@@ -1047,48 +1053,48 @@ static yyconst flex_int16_t yy_nxt[4722] =
        68,   68,  271,  279,   68,  275,   68,  276,  277,   68,
        68,  283,  285,   68,  286,  288,  278,  280,  281,  287,
       293,   68,  284,  289,   68,  291,   68,  290,  292,   68,
-      295,  300,  296,  294,   68, 1610, 1610,   68,  297,  285,
-      306,   68,  288,   68, 1610,   68,  287,  293,   68,   68,
+      295,  300,  296,  294,   68, 1627, 1627,   68,  297,  285,
+      306,   68,  288,   68, 1627,   68,  287,  293,   68,   68,
       289,   68,  291,   68,  290,  292,   68,  302,  300,  296,
       294,   68,  301,  298,  303,  297,  299,   68,   68,  304,
 
       305,   68,  308,   68,  307,  309,  310,  311,  312,   68,
-      317, 1610,   68,  314,  302,  313,  327, 1610,   68,  301,
+      317, 1627,   68,  314,  302,  313,  327, 1627,   68,  301,
       298,  303,  319,  299,   68,   68,  304,  305,   68,  308,
       328,  307,  309,  310,  311,   68,  315,   68,  316,   68,
       314,   68,  313,  318,   68,   68,  322,   68,   68,  319,
        68,  320,   68,  321,  326,  323,  329,  328,  324,   68,
-      325,  330,   68,  315,  331,  316,   68, 1610,   68,  349,
-      318,  332,   68,  322, 1610,   68,   68,  333,  320,  335,
+      325,  330,   68,  315,  331,  316,   68, 1627,   68,  349,
+      318,  332,   68,  322, 1627,   68,   68,  333,  320,  335,
       321,  326,  323,  329,   68,  324,  346,  325,  330,  344,
-      343,  331,   68,  334,   68, 1610,  347,  345,  332,  351,
+      343,  331,   68,  334,   68, 1627,  347,  345,  332,  351,
 
        68,   68,   68,  133,  333,  348,  335,   68,   68,  353,
-      437,   68,   68,  346, 1610,  352,  344,  343,  350,  356,
+      437,   68,   68,  346, 1627,  352,  344,  343,  350,  356,
       334,  336,  337,  347,  345,   68,  351,   68,  355,  354,
-      358,  338,  348,  339,  340,  341,   68,   68,  342, 1610,
-       68,   68,  352,  357,  361,  350,   68, 1610,  336,  337,
+      358,  338,  348,  339,  340,  341,   68,   68,  342, 1627,
+       68,   68,  352,  357,  361,  350,   68, 1627,  336,  337,
        68,   68,   68,  366,   68,  355,  354,  358,  338,  364,
       339,  340,  341,  359,  360,  342,  362,  363,  368,  369,
-      357,  361,   68,  365,  367, 1610,   68,   68,   68,  371,
-      366,   68,  370,   68, 1610,  372,  364,   68,  373,  375,
+      357,  361,   68,  365,  367, 1627,   68,   68,   68,  371,
+      366,   68,  370,   68, 1627,  372,  364,   68,  373,  375,
       374,  377,   68,  362,  363,  368,  369,   68,   68,  378,
 
       365,  367,  376,  381,  380,  379,  371,   68,   68,  370,
       382,   68,  372,  400,   68,  373,   68,  374,  377,   68,
        68,   68,  383,   68,  384,  385,  378,  386,  387,  376,
        68,  380,  379,  389,   68,  388,  391,  382,  390,   68,
-       68,   68,   68,  393,   68,  397, 1610,  392,   68,  383,
+       68,   68,   68,  393,   68,  397, 1627,  392,   68,  383,
        68,  384,  385,   68,  386,  387,  394,  398,   68,   68,
       389,   68,  388,  391,   68,  390,   68,  399,  395,  396,
       393,   68,  397,  401,  392,   68,   68,  405,  404,   68,
       402,  403,   68,  394,  398,   68,   68,   68,  406,   68,
-      408,  407, 1610, 1610,  399,  395,  396, 1610,   68, 1610,
+      408,  407, 1627, 1627,  399,  395,  396, 1627,   68, 1627,
 
-      401,   68,   68,  415,  405,  404,  414,  402,  403, 1610,
+      401,   68,   68,  415,  405,  404,  414,  402,  403, 1627,
        68,  416,  418,   68,   68,  406,  419,  408,  407,  409,
-      417, 1610,  420,   68,  410,  421,  411,   68,  422,  423,
-      415, 1610,  426,  414,  412,  424,   68,  433,  428,  418,
+      417, 1627,  420,   68,  410,  421,  411,   68,  422,  423,
+      415, 1627,  426,  414,  412,  424,   68,  433,  428,  418,
        68,   68,   68,  419,  413,   68,  409,  417,   68,  420,
        68,  410,  421,  411,   68,  422,  423,  425,  427,  426,
        68,  412,  424,   68,  429,  428,  430,  431,   68,   68,
@@ -1098,40 +1104,40 @@ static yyconst flex_int16_t yy_nxt[4722] =
 
       434,  447,  436,  449,  435,  441,  443,   68,  438,  444,
       439,   68,  450,  451,  440,   68,   68,   68,  452,  442,
-      453,  454,  455,  456,  457, 1610,  461,   68,  447,  458,
-       68,  459,  460,  443,  463, 1610,  444,  467,  462,   68,
-       68,  469, 1610,   68,   68,   68,   68,   68,  454,  455,
+      453,  454,  455,  456,  457, 1627,  461,   68,  447,  458,
+       68,  459,  460,  443,  463, 1627,  444,  467,  462,   68,
+       68,  469, 1627,   68,   68,   68,   68,   68,  454,  455,
       456,   68,   68,   68,  471,   68,  458,   68,  459,  460,
        68,  463,  464,   68,  467,  462,  468,  465,  472,  470,
-      474,  466,   68,  477,  475,   68,  479,  476,   68, 1610,
-     1610,  471,  491,  483,   68,  480,   68,   68,   68,  464,
+      474,  466,   68,  477,  475,   68,  479,  476,   68, 1627,
+     1627,  471,  491,  483,   68,  480,   68,   68,   68,  464,
       473,   68,   68,  468,  465,  472,  470,  474,  466,   68,
 
       477,  475,  481,  478,  476,   68,   68,   68,  482,  485,
-      483,  484,  480,   68, 1610,  486,  487,  473,   68,  488,
-       68,  489,   68, 1610,  493,  490,   68,  492, 1610,  481,
-      478,  497,   68, 1610,  499,  482,  485,   68,  484,  494,
+      483,  484,  480,   68, 1627,  486,  487,  473,   68,  488,
+       68,  489,   68, 1627,  493,  490,   68,  492, 1627,  481,
+      478,  497,   68, 1627,  499,  482,  485,   68,  484,  494,
        68,   68,  486,  487,  509,   68,  488,  498,   68,  495,
       504,  493,   68,  496,  492,   68,   68,  502,  497,   68,
-      500,  499,  501,  503,  505,   68,  494,  506, 1610,   68,
+      500,  499,  501,  503,  505,   68,  494,  506, 1627,   68,
        68,   68,  507,   68,  498,   68,  508,  504,  510,   68,
        68,   68,   68,  511,  502,  512,   68,  500,   68,  501,
-      503,  505,  514,  515,  506,  513,  518, 1610,  516,  507,
+      503,  505,  514,  515,  506,  513,  518, 1627,  516,  507,
 
-     1610,  517,  519,  508,   68,  510,   68,  520,   68,   68,
+     1627,  517,  519,  508,   68,  510,   68,  520,   68,   68,
       511,   68,  512,  521,   68,   68,   68,  522,  524,  514,
       515,  523,  513,  518,   68,  516,  528,   68,  517,  519,
-       68,  525,  527,  526,  520,   68,  530, 1610,   68,   68,
+       68,  525,  527,  526,  520,   68,  530, 1627,   68,   68,
       521,  529,   68,  531,  522,  524,   68,  535,  523,   68,
        68,  532,  533,  528,  133,  548,  550,  534,  525,  527,
-      526, 1610,   68,  530,   68,  545,  536,  537,  529,   68,
+      526, 1627,   68,  530,   68,  545,  536,  537,  529,   68,
       531,  539,  538,   68,  535,   68,   68,   68,  532,  546,
        68,   68,  548,   68,  534,  547,   68,   68,  549,   68,
-     1610,  557,  545,  536,  537, 1610,  558,  560,  539,  538,
+     1627,  557,  545,  536,  537, 1627,  558,  560,  539,  538,
 
-      540,  561, 1610,   68,  541,   68,  546,  542,  559,  562,
-       68,   68,  547,   68,  543,  549,  563,  544,  557, 1610,
-     1610,   68,   68,  558,  560,  564,  567,  540,   68,   68,
+      540,  561, 1627,   68,  541,   68,  546,  542,  559,  562,
+       68,   68,  547,   68,  543,  549,  563,  544,  557, 1627,
+     1627,   68,   68,  558,  560,  564,  567,  540,   68,   68,
       565,  541,  570,  568,  542,  559,  562,   68,  569,  566,
        68,  543,   68,  563,  544,  551,   68,  552,   68,  571,
       553,   68,  564,  567,  575,  554,   68,  565,  574,  570,
@@ -1145,348 +1151,350 @@ static yyconst flex_int16_t yy_nxt[4722] =
        68,  595,   68,  593,   68,  610,   68,   68,  586,  589,
        68,  594,   68,  591,  588,  597,  590,  598,   68,  601,
       602,   68,  600,  596,   68,  592,  599,   68,  595,   68,
-      593,   68,  603,  605,  607, 1610,   68,   68,  594,  606,
+      593,   68,  603,  605,  607, 1627,   68,   68,  594,  606,
       604,   68,  597,   68,  598,  609,  601,  602,   68,  600,
       608,   68,   68,  599,  611,   68,  612,   68,   68,  603,
       605,  607,  613,  614,  615,  616,  606,  604,  617,  618,
        68,   68,  609,  622,  619,  620,  624,  608,   68,   68,
 
       623,  625,  621,  612,   68,   68,   68,   68,  627,  613,
-      614,  615,  616,  626,   68,  617,   68,  640,   68,  630,
+      614,  615,  616,  626,   68,  617,   68,  641,   68,  630,
        68,  619,  620,   68,   68,   68,  628,  623,  133,  621,
-      629,   68,   68,   68,   68,  627,  636, 1610,  637,   68,
-      626,  638,  639,   68,  640,  649,  630,  643,  641,  642,
-       68,   68, 1610,  628,   68,  652, 1610,  629,  631,   68,
-      632,   68,   68,  636,  633,  637,  634,  644,  638,  639,
-       68,  635,  649,  645,  643,  641,  642,  647,  665,   68,
-     1610,  651,   68,  646,  648,  631,   68,  632,  650, 1610,
-      658,  633, 1610,  634,  644,   68,  657,   68,  635,   68,
+      629,   68,   68,   68,   68,  627,  637, 1627,  638,   68,
+      626,  639,  640,   68,  641, 1627,  630,  644,  642, 1627,
+       68,  666, 1627,  628,   68, 1627, 1627,  629,  631,   68,
+      632,   68, 1627,  637,  633,  638,  634,  643,  639,  640,
+       68,  635,  645,  646,  644,  642,  636,  649,   68,  648,
+       68,  653,   68,  647,   68,  631,  650,  632,  652,  651,
+       68,  633,   68,  634,  643,   68,  658,  668,  635,  645,
 
-      645,   68,   68,   68,  647,   68,  667,  653,  651,  659,
-      646,  648,  654,  661,  655,  650,  660,  658,   68,  662,
-      664,  669,  666,  657,   68, 1610,  668, 1610,   68,   68,
-      671,  663,  656,   68,  653,   68,  659,   68,   68,  654,
-      661,  655,   68,  660,   68,   68,  662,  664,  669,  666,
-       68,  670,   68,  668,  672,  673,  674,  671,  663,  656,
-      676,  677,   68,  675,   68,   68,  678,   68,  679,  680,
-      681, 1610, 1610,   68,   68,  687,  683,   68,  670,   68,
-      682,  672,  673,  674,   68,   68,  684,  676,  677,  685,
-      675,  686,   68,  678,  688,  693,  680,  681,   68,   68,
+      646,   68,   68,  636,  649,  661,  648,  659,  662,   68,
+      647,  660,   68,  650,  654,  652,  651,  663,   68,  655,
+       68,  656,  667,  658,  664,  665,   68, 1627,   68,  669,
+       68,   68,  661,   68,  659,  662,   68,   68,  660,  657,
+       68,  654,  670,  671,  663,   68,  655,  673,  656,  667,
+       68,  664,  665,   68,  672,   68,  669,   68,  676,  674,
+      675,  679,  678,  680,  677,  681,  657, 1627,   68,  670,
+      671,   68,  688,   68,  673,   68,   68,   68,  683,   68,
+       68,  672,  684,  687,  682,  676,  674,  675,  679,  678,
+       68,  677,  681,   68,   68,  685,  686,  689,   68,  688,
 
-      689,   68,  687,  683,  690,  694,  696,  682,   68,   68,
-      703,   68,  691,  684,  695,  692,  685,   68,  686,   68,
-      697,   68,  693,  698,  699,   68,   68,  700,  702,  701,
-       68,   68,  694,  696,  704,  705,  706,   68,   68,  691,
-       68,  695,  692,  717,   68,   68,   68,  697,   68,   68,
-      698,  699,   68,  711,  700,  702,  701,  707,  709,  708,
-       68,  704,  705,  706,  710,   68,   68,   68,  712,  714,
-      713,  715,  718,  716,   68,   68, 1610,  719,   68,   68,
-      711,  720, 1610, 1610,  707,  709,  708,   68,   68,   68,
-       68,  710,  722,   68,  721,  712,  714,  713,  715,  723,
+      692,   68,  690,  693,   68,  683,  691,  694,  695,  684,
+      687,  682,  696,  697,  699,  698,  700,   68,   68,   68,
+       68,   68,  685,  686,  701,  703,   68,  692,   68,  704,
+      693,   68,  705,   68,  694,  695,   68,   68,   68,  696,
+      697,  699,  698,  700,  702,   68,   68,  710,  706,  707,
+       68,  701,  703,  708,   68,   68,   68,   68,  709,  705,
+      712,  713,   68,  711,  717,  715,   68,  718,  716,  714,
+      719,  702,  721,   68,  710,  706,  707,   68,   68,   68,
+      708,  720,   68,   68,   68,  709,  722,  712,  713,   68,
+      711,  717,  715,   68,   68,  716,  714,  723,   68,   68,
 
-      716,  725,   68,   68,  719,   68,  726,  727,   68,  728,
-       68,   68,  729,  731,   68,   68,  732,  730,  733,  722,
-       68,  721, 1610,  734,   68,   68,  723, 1610,  725,   68,
-      735,  737,  741,  726,  727,  736,  728, 1610,  740,  729,
-      731, 1610,  738,   68,  730,   68,   68,   68,   68,   68,
-      734,  739,  742,   68,   68,  743,  749,  735,  737,   68,
-      744,   68,  736,   68,  745,  740,  746,   68,  748,  738,
-     1610,  751,  747, 1610,  752,  750,   68,  753,  739,  742,
-       68,   68,  743,  749,   68,   68,  754,  744,   68,   68,
-       68,  745,   68,  746,  756,  748,   68,  755,  751,  747,
+      724,   68,  726,  727,  728,  729,  730,   68,  720,  732,
+       68,   68,   68,  722,  731,   68,   68,  733,  734,   68,
+      735,   68, 1627, 1627,  723,  736,   68,  724,  739,  726,
+      727,  728,  729,  730,  738,  740,  732,  737,   68,  741,
+       68,  731,   68,   68,  743,  742,  745,  735,   68,   68,
+       68,   68,  736,   68,  744,  739,   68,  747,  746,  749,
+      748,  738,  740,   68,  737,   68,  741,   68,  751,  752,
+     1627,   68,  742,  745, 1627,  750,  753,  754,   68,   68,
+      759,  744,   68,   68,  747,  746,  749,  748,   68,  755,
+      756,  758,   68,  757,   68,  751,  752,   68,   68,   68,
 
-      757,  752,  750,  758,  753,   68,  761,  759,   68, 1610,
-      760,  763, 1610,  754,   68,   68,  762,   68,   68,   68,
-       68,  756,   68,  764,  755,   68,  768,  757,  765,  766,
-      758,  767,  769,  761,  759,  770,   68,  760,  763,  771,
-       68,  772,  778,  762,   68,   68,   68,  773,  779,   68,
-      764,  774,  775,  776,   68,  765,  766,   68,  767,  769,
-       68,  780,  770,   68,  777,  781,  771,   68,  772,  782,
-      787,  783,  784,   68,   68,  779,  786,  785,   68,  775,
-      776,  788,   68,   68,  789,   68,  790,   68,  780,   68,
-       68,  777,  781, 1610,   68,   68,  782,  796,  783,  784,
+      762,   68,  750,  753,  754,  763, 1627,  759,  766,  760,
+      761,  767,   68,   68,   68,   68,  755,  756,  758,  764,
+      757,   68,   68,   68,  765,   68,  769,  762,  770,   68,
+      771,  772,  763,   68,  768,  766,  760,  761,  767,  780,
+      773,   68,  774,   68,   68,  775,  764,   68,  777,  776,
+       68,  765,  778,  769,  779,  782,   68,  771,  772,   68,
+      781,  768,  783,  786,   68,  784,   68,  773,  789,  774,
+       68,  790,   68,  791,  788,  777,   68,   68,  785,  778,
+      787,  779,  782,   68,   68,   68,   68,  781,  792,  783,
+      786,   68,  784,   68, 1627,   68,   68,  797, 1627,   68,
 
-      795,   68,  797,  786,  785,  799,   68,  801, 1610,   68,
-      791,  789,   68,  790,   68,  792,   68,  793,   68,  794,
-       68,  798,  802,  800,  796,  805,   68,  795,   68,  797,
-       68,   68,  799,  807,  801,   68,  803,  791,  804,  806,
-       68,  811,  792,  808,  793,   68,  794,  809,  798,  802,
-      800,   68,   68,  810,  813,  812,  814,  815,  818,  824,
-       68,   68,   68,  803,  816,  804,  806,   68,   68,   68,
-      808,   68,  817,  819,  809,  820,  822,   68,   68,  821,
-      810,   68,  812,  814,   68,  818,  825,  823,   68,  826,
-       68,  816,  827,  830,   68,   68,  834,   68,  831,  817,
+      791,  788,   68,  793,  798,  785,  799,  787,  794,  801,
+      795,   68,  796,   68,  800,  792,  804,  802,   68,  803,
+      807,   68,   68,   68,  797,   68,  806,   68,   68,   68,
+      793,  798,  809,  799,  810,  794,  801,  795,   68,  796,
+      805,  800,  808,  804,  802,  813,  803,   68,  811,   68,
+      814,  815,  812,  806,   68,  817,  818,   68,   68,   68,
+       68,  810,  816,   68,  819,  821,  820,  805,  822,  808,
+       68,  823,   68,  826,  827,  811,  824,  814,   68,  812,
+       68,  825,   68,  818,   68,   68,   68,   68,  828,  816,
+      829,  819,  821,  820,   68,  822,  830,   68,  823,  831,
 
-      819,   68,  820,  822,  828,  829,  821,   68,  832,   68,
-      838,   68,  835,   68,  823,   68,  826,   68, 1610,   68,
-      830,  837,   68,   68,  833,   68,  836,   68,   68,  846,
-       68,  828,  829,   68,  839,  832,   68,  838,  840,  835,
-       68,   68,  842,  841,  843,  844,   68,   68,  837,  845,
-      848,  833,   68,  836,  847,  849,  846,  850,  852,  853,
-      851,  839,  854,   68, 1610,  840,   68,   68,   68,  842,
-      841,  843,  856,   68,   68,   68,   68,  848,  859, 1610,
-      863,  847,  849,   68,  855,  852,  853,  851,   68,  854,
-      858,  857,   68,   68,   68,  860,  862,   68,  861,  856,
+      832,   68,  833,  824,   68,   68,  834,   68,  825,  836,
+       68,  839,  837,   68,   68,  828,   68,  838,  835,   68,
+       68,   68,   68,  830,   68,  840,  831,  832,  841,   68,
+      842,  844,   68,  834,  843,   68,  852,  845,  839,  837,
+       68,   68,  849,   68,  838,  835,  846,  850,  853,   68,
+      847,   68,  840,   68,  848,  841,  855,  842,  844,  851,
+       68,  843,  854,  852,  845, 1627,   68,  856,   68,  849,
+      857,   68,   68,  846,  850,   68,  859,  862,  858,   68,
+      866,   68,  860,  855,   68,   68,  851,   68,  861,  854,
+      863,   68,   68,  864,  856,   68,  868,  857,   68,   68,
 
-       68,   68,  864,  874,   68,  859,   68,  863,  865,   68,
-       68,  855,  866,  869,  867,  868,  870,  858,  857,  875,
-     1610,  872,  860,  862,   68,  861,  871,   68,   68,  864,
-       68,   68,   68,  873,   68,  865,   68,  876,  877,  866,
-      869,  867,  868,  870,  878,  879,  880,   68,  872,  883,
-       68,  884,  881,  871,   68,   68,  882, 1610,   68,   68,
-      873,  885,  887,   68,  876,   68,   68,  886,   68,   68,
-       68,  878,  879,  880,  888,  889,   68,  890,  884, 1610,
-      894,  895,  891,   68,  892,   68,  896,   68,  885,  887,
-       68,  893,   68,   68,  886,   68,  897,  898,   68,   68,
+       68,   68,  867,  859,  862,  858,  865,  866,  869,  860,
+       68,  877,  870,  871,  872,  861,  874,  863,   68,   68,
+      864,  875,   68,  868,  873,  876,  878,   68,   68,  867,
+     1627,  880,   68,  865,   68,  869,   68,   68,  879,  870,
+      871,  872,   68,  874,  881,  883,  882,   68,  875,  886,
+      884,  873,  876,   68,  885,  887,  891,   68,   68,   68,
+      888,  889,   68,   68,   68,  879,   68,  890,   68,  892,
+      893,  881,  883,  882,  898,   68,   68,   68,   68,  899,
+       68,   68,  887,  891,  894,  895,  897,  888,  889,  900,
+      896,   68,   68,   68,  890,  903,  901,  893,   68,   68,
 
-      900,  888,  899,  901,  890,  902,   68,  894,  895,  891,
-      903,  892,   68,  896,   68,  907,  904,  905,  893,   68,
-      909,   68,   68,  897,  898,   68,  906,  900,  910,  899,
-      901,  911,  902,   68,  912, 1610,  908,   68,   68,  913,
-       68,  914,   68,  904,  905,   68,   68,  909,  915,  917,
-      919,   68,  916,  906,   68,  910,  918,  921,  920,  926,
-      922,   68,   68,  908,   68,   68,   68,   68,  914,   68,
-       68,  923,   68,  924,   68,  915,  917,  919,   68,  916,
-      925,  927,   68,  918,   68,  920,  926,  922,  928,   68,
-      929,  930,  937,  931,  932,  933,   68,   68,  923,   68,
+       68,  898,  902,  904,  906,  907,  899,  905,  910,   68,
+      908,  894,  895,  897,   68,   68,  900,  896,   68,  909,
+      912,   68,  903,  901,  913,   68,   68,   68,  914,  902,
+      904,   68,  907,   68,  905,  911,  915,  908,  916,   68,
+      917,  919,   68,  918,   68,  921,  909,  912,  923,  922,
+       68,  913,  920,   68,   68,  924, 1627,  926,   68,   68,
+       68,  928,  911,   68,   68,   68,  925,  917,  919,   68,
+      918,   68,  921,   68,  929,  923,  922,   68,  930,  920,
+      927,  931,   68,   68,  926,   68,   68,  932,  928,  933,
+      940,  934,  935,  925,  942,  938,   68,   68, 1627,   68,
 
-      924,   68,   68,  935,   68,  934,  938,  925,  927,  936,
-       68,  939,   68,   68,  940,  928,  941,  929,  930,   68,
-      931,  932,  933,   68,   68,  943,  942,  944,   68,   68,
-      935,   68,  934,  938,  949,  950,  936,   68,  939,  945,
-      951,   68,   68,  941,  946,  954,   68,  947,  952,  955,
-      956,   68,  943,  942,  944,  957,  961,   68,   68,  948,
-       68,  953,  950,   68,   68,   68,  945,  951,   68,   68,
-       68,  946,  954,  958,  947,  952,   68,  956,  959,  960,
-       68,   68,  957,  961,  963,   68,  948,  962,  953,  965,
-      964,  968,  966,  969,  971,  967,  970, 1610,   68,   68,
+      944,  929,   68,   68,  936,  930,  937,  927,  931,  946,
+      939,   68,   68,   68,  932,  943,  933,   68,  934,  935,
+       68,   68,  938,  941,  945,   68,  947,   68,   68,  948,
+       68,  936,   68,  937,  949,  953,  946,  939,  954, 1627,
+      950,   68,  943,  951,   68,   68,  956,  957,  959,   68,
+      941,  945,   68,  947,  955,  952,  948, 1627,  960,  958,
+       68,  949,  961,  967,   68,  954,   68,  950,   68,  962,
+      951,   68,   68,  956,  957,  964,  966,   68,  968,   68,
+      963,  955,  952,   68,   68,  960,  958,   68,  965,  961,
+       68,  984,   68,  973,  970,  969,  962,   68,   68,  971,
 
-      958,   68,   68,  975,   68,  959,  960,  974,   68,   68,
-       68,   68,   68,   68,  962,   68,  965,  964,  968,  966,
-      969,  972,  967,  970,  973,   68,  976,  979,   68,  977,
-      975,   68,  978,  980,  974,  982,  985,  981,   68,  983,
-      984,  989,  990, 1610,   68, 1610,   68,   68,  972, 1610,
-       68,  973,  986,  976,  979,  987,  977,   68,   68,  978,
-       68,   68,  982,  985,  981,  988,  983,  984,  991,   68,
-       68,  992,   68,  997,  994,   68,  995,  993,   68,  986,
-      996,  999,  987,   68, 1000,   68,   68,   68, 1002,   68,
-       68,  998,  988, 1003, 1005,  991, 1001, 1006,  992,   68,
+       68,   68,  964,  966,   68,  968,   68,  963,   68,  975,
+      972,  974,  976, 1627,  980,  965,  979,  977,   68,   68,
+      973,  970,  969,   68,   68,   68,  971,  978,   68,  981,
+      986,  983,  982,   68,   68,  987,  985,  972,  974,  976,
+       68,  980,   68,  979,  977,  989,   68,   68,  988,  992,
+      993,  994,   68,   68,  978,  996,  981,  986,  983,  982,
+       68,  990,  987,  985,  991,  997,   68,   68, 1001,   68,
+      995,  998,  989, 1004,   68,  988,  992,   68,   68,   68,
+     1000,   68,  996,  999,   68,   68, 1627, 1003,  990,   68,
+     1002,  991,  997, 1005,   68, 1001,   68,  995,  998, 1006,
 
-      997,  994,   68,  995,  993,   68, 1004,  996,  999, 1009,
-     1007,   68, 1010,   68,   68,   68, 1008, 1610,  998,   68,
-     1003, 1011, 1013, 1001, 1006,   68,   68, 1012,   68, 1014,
-       68, 1016, 1015, 1004,   68,   68, 1009, 1007,   68, 1010,
-       68,   68, 1017, 1008, 1018, 1019, 1020, 1022, 1011, 1023,
-     1024,   68, 1021,   68, 1012, 1028, 1014, 1032, 1016, 1015,
-     1033,   68, 1025, 1026, 1610,   68,   68,   68,   68, 1017,
-       68, 1018, 1019, 1020, 1022,   68, 1023,   68,   68, 1021,
-     1027, 1029, 1030, 1031,   68, 1034,   68,   68, 1035, 1025,
-     1026,   68, 1037, 1038, 1040,   68,   68, 1610, 1036, 1047,
+     1007,   68,   68, 1009,   68, 1008, 1627, 1000, 1010, 1011,
+      999, 1014,   68, 1017, 1003, 1012, 1016, 1002, 1013, 1015,
+     1005,   68,   68, 1627,   68,   68, 1021, 1007,   68, 1018,
+       68, 1028, 1008,   68,   68, 1010, 1011,   68, 1014, 1019,
+       68, 1022, 1012, 1016,   68, 1013, 1015, 1020,   68,   68,
+     1023, 1024, 1025, 1021,   68, 1026, 1018, 1027,   68,   68,
+     1032, 1030, 1029,   68, 1627, 1031, 1019, 1036, 1022,   68,
+       68, 1033,   68,   68, 1020,   68,   68, 1023, 1024, 1025,
+       68, 1034, 1026, 1035, 1027, 1037,   68, 1038, 1030, 1029,
+       68,   68, 1031, 1039,   68, 1040, 1042, 1627, 1033, 1043,
 
-     1041, 1039, 1046,   68,   68, 1042,   68, 1027, 1029, 1030,
-     1031,   68, 1034,   68,   68,   68,   68, 1044, 1043, 1037,
-     1038, 1040,   68,   68,   68, 1036, 1045, 1041, 1039,   68,
-       68, 1048, 1042, 1049, 1051, 1050, 1052,   68,   68, 1053,
-     1054,   68,   68,   68, 1044, 1043, 1055, 1056, 1057, 1059,
-     1610, 1061, 1610, 1045, 1060, 1058,   68, 1062, 1048, 1063,
-     1049,   68, 1050, 1052,   68, 1610,   68,   68, 1067, 1068,
-     1071,   68, 1072,   68, 1056,   68,   68,   68,   68,   68,
-       68, 1060, 1058,   68, 1062, 1064, 1069, 1065, 1070, 1075,
-       68, 1073, 1066,   68,   68, 1067, 1068,   68, 1074, 1072,
+     1041, 1044, 1046, 1627,   68, 1051, 1049, 1045, 1034,   68,
+     1035,   68, 1037,   68,   68,   68,   68,   68,   68,   68,
+     1039, 1056,   68, 1042,   68, 1047, 1043, 1041, 1044, 1046,
+     1050, 1052,   68, 1049, 1045, 1627, 1054, 1058, 1048, 1053,
+     1055, 1059,   68,   68,   68,   68, 1057,   68,   68, 1060,
+     1061, 1062, 1047,   68, 1064, 1627, 1065, 1050,   68, 1066,
+     1063, 1068,   68, 1054,   68, 1048, 1053, 1055,   68,   68,
+     1067, 1073, 1074, 1057,   68, 1076, 1627, 1061,   68,   68,
+       68,   68,   68, 1065, 1075,   68,   68, 1063, 1069, 1070,
+     1071,   68,   68, 1077, 1082, 1072,   68, 1067, 1073, 1074,
 
-       68, 1076, 1078, 1079, 1610,   68, 1081,   68, 1077, 1080,
-       68, 1085, 1064, 1069, 1065, 1070, 1075,   68, 1073, 1066,
-       68,   68,   68, 1082,   68, 1074, 1083, 1084,   68, 1078,
-     1079, 1086,   68, 1081, 1088, 1077, 1080,   68,   68, 1087,
-     1089, 1091,   68, 1092, 1093, 1090, 1096, 1097,   68,   68,
-     1082, 1100,   68, 1083, 1084,   68, 1095, 1094, 1086,   68,
-     1098,   68,   68,   68,   68, 1099, 1087, 1089, 1091,   68,
-     1092, 1093, 1090, 1096,   68, 1101,   68,   68,   68, 1103,
-     1102,   68, 1104, 1095, 1094, 1105, 1107, 1098, 1109, 1106,
-     1610, 1110, 1099,   68, 1108,   68, 1111, 1112, 1113, 1114,
+     1078,   68, 1076,   68, 1079, 1080, 1081, 1083, 1084, 1627,
+     1091, 1075,   68, 1086,   68, 1069, 1070, 1071, 1085,   68,
+       68,   68, 1072, 1087,   68, 1088,   68, 1078,   68, 1090,
+       68, 1079, 1080, 1081, 1083, 1084,   68, 1089, 1093, 1092,
+     1086,   68, 1094, 1096, 1627, 1085,   68, 1097,   68,   68,
+     1087,   68, 1088, 1095,   68, 1098, 1090, 1101,   68, 1100,
+     1099,   68, 1103, 1102, 1089, 1093, 1092,   68,   68,   68,
+     1096,   68, 1104, 1106, 1097,   68, 1109, 1105,   68, 1107,
+     1095,   68, 1098, 1108, 1101,   68, 1100, 1099,   68,   68,
+     1102, 1110, 1113, 1111, 1114,   68,   68, 1112, 1115, 1104,
 
-     1115,   68, 1101,   68, 1117, 1119, 1120, 1102, 1610,   68,
-       68,   68, 1118,   68, 1116, 1109,   68,   68, 1121,   68,
-       68, 1108,   68, 1111, 1112, 1113, 1114,   68, 1122,   68,
-     1123,   68, 1119,   68, 1128,   68, 1125, 1124, 1126, 1118,
-     1129, 1116, 1130, 1132, 1127,   68, 1610,   68, 1135,   68,
-     1133,   68,   68,   68,   68, 1122, 1134, 1123,   68,   68,
-       68,   68, 1610, 1125, 1124, 1126, 1131, 1129, 1136, 1130,
-     1132, 1127, 1140,   68, 1137,   68, 1141, 1133,   68,   68,
-     1139,   68, 1142, 1134, 1143, 1138, 1144, 1146, 1145,   68,
-       68, 1147, 1148, 1131,   68, 1136, 1610,   68,   68, 1140,
+       68, 1116, 1117, 1118, 1105, 1627, 1107,   68, 1126, 1120,
+     1108,   68, 1119,   68, 1121, 1122, 1123,   68,   68, 1124,
+       68, 1114, 1127,   68,   68, 1115,   68,   68, 1125, 1117,
+     1118, 1129,   68, 1128,   68,   68, 1120, 1135, 1130, 1119,
+     1132, 1133, 1122, 1131, 1136,   68, 1124,   68, 1134,   68,
+     1140,   68,   68,   68,   68, 1125,   68, 1142, 1129,   68,
+     1128,   68,   68,   68,   68, 1130, 1137, 1132, 1133, 1138,
+     1131, 1136, 1139,   68, 1143, 1134, 1141, 1140,   68, 1144,
+       68, 1149, 1146, 1151,   68, 1152, 1147,   68,   68, 1148,
+     1145,   68, 1153, 1137, 1155,   68, 1138, 1150,   68, 1139,
 
-       68, 1137, 1149, 1141, 1151, 1610, 1153, 1139, 1154,   68,
-     1155, 1143, 1138,   68, 1146, 1145,   68,   68, 1147,   68,
-     1150,   68,   68,   68, 1156,   68, 1152,   68, 1158, 1149,
-       68, 1151,   68, 1153, 1157, 1154,   68, 1155, 1159, 1160,
-     1161,   68, 1163, 1162, 1164,   68, 1165, 1150,   68, 1166,
-       68, 1156, 1171, 1152, 1610, 1158,   68, 1167,   68, 1168,
-     1610, 1157, 1175,   68, 1610, 1159, 1160, 1161,   68,   68,
-     1162, 1164, 1172, 1165,   68, 1170, 1166, 1173, 1169,   68,
-     1174,   68,   68,   68, 1167,   68, 1168,   68, 1176,   68,
-     1180, 1179, 1177,   68,   68, 1178, 1181, 1610, 1182, 1172,
+     1154, 1143, 1156, 1141,   68,   68, 1144,   68,   68, 1146,
+       68, 1158, 1152, 1147,   68, 1159, 1148, 1145,   68, 1153,
+     1160,   68,   68, 1157, 1150,   68,   68, 1154, 1161, 1156,
+       68, 1162, 1164,   68, 1163, 1166, 1168,   68, 1158, 1167,
+     1170, 1165, 1159,   68,   68,   68,   68, 1160,   68,   68,
+     1157, 1169, 1171,   68, 1173, 1161, 1177,   68, 1162, 1164,
+     1174, 1163, 1166, 1168,   68,   68, 1167, 1170, 1165,   68,
+     1172,   68, 1175, 1176, 1179, 1178,   68, 1182, 1169,   68,
+     1181, 1173,   68, 1177, 1180,   68, 1183, 1174,   68, 1627,
+       68, 1188, 1187, 1184,   68,   68, 1193, 1172, 1185, 1175,
 
-     1184, 1610, 1170,   68, 1173, 1169, 1183, 1174,   68, 1187,
-       68,   68, 1192, 1188,   68, 1176,   68, 1180, 1179, 1177,
-       68, 1186, 1178, 1181, 1185, 1182, 1189, 1184,   68, 1191,
-       68,   68,   68, 1183,   68, 1190, 1187,   68,   68,   68,
-     1188, 1193, 1194, 1196, 1195, 1197, 1198,   68, 1186, 1199,
-     1202, 1185,   68, 1189, 1203, 1200, 1191, 1201, 1206,   68,
-       68, 1205, 1190, 1204, 1208, 1610,   68,   68, 1193,   68,
-     1196, 1195, 1197, 1198,   68,   68,   68,   68,   68, 1211,
-       68, 1203, 1200,   68, 1201,   68,   68, 1207, 1205,   68,
-     1204, 1208, 1209, 1210, 1212, 1214,   68, 1213, 1216, 1610,
+     1176, 1186, 1178,   68, 1182,   68,   68, 1181,   68,   68,
+     1190, 1180, 1189,   68, 1191, 1192,   68,   68, 1188, 1187,
+     1184, 1627, 1194, 1193, 1195, 1185, 1196,   68, 1186,   68,
+     1199, 1197,   68,   68, 1200, 1627,   68, 1190, 1198, 1189,
+       68, 1191, 1192,   68, 1201,   68, 1202,   68,   68, 1194,
+     1627, 1195, 1203, 1196, 1204, 1206, 1205, 1199, 1197, 1207,
+       68,   68,   68, 1210, 1215, 1198, 1208, 1627, 1211,   68,
+     1209, 1201, 1212,   68, 1214, 1213, 1218,   68,   68, 1203,
+       68, 1204, 1206, 1205,   68,   68,   68,   68,   68, 1217,
+       68,   68, 1219, 1208,   68, 1211,   68, 1209, 1216, 1212,
 
-     1215,   68, 1610,   68, 1217,   68, 1211, 1219,   68, 1221,
-       68, 1218,   68, 1220, 1207,   68,   68,   68, 1223, 1209,
-     1210, 1212,   68,   68, 1213, 1216,   68, 1215, 1225, 1222,
-     1226, 1217, 1227,   68, 1219,   68, 1221, 1224, 1218, 1228,
-     1220, 1229, 1230,   68, 1231, 1223,   68, 1232, 1233, 1234,
-     1235, 1236, 1237,   68,   68,   68, 1222, 1226,   68, 1227,
-     1239,   68, 1238, 1240, 1224, 1241, 1228,   68, 1229,   68,
-       68,   68, 1242,   68, 1232,   68,   68, 1235,   68,   68,
-     1244, 1245,   68, 1246, 1243, 1248, 1249, 1239, 1250, 1238,
-       68, 1251, 1241,   68,   68, 1252,   68, 1253, 1247,   68,
+       68, 1214, 1213, 1218,   68, 1220, 1221, 1222, 1223, 1627,
+     1225,   68, 1627, 1224, 1234,   68, 1217, 1226,   68, 1219,
+     1227,   68,   68, 1228, 1627, 1216, 1229,   68, 1232,   68,
+     1230,   68, 1220, 1221, 1222,   68,   68, 1225,   68,   68,
+     1224,   68, 1231,   68, 1226, 1233, 1235, 1227,   68, 1236,
+     1228,   68, 1237, 1229, 1238, 1232, 1239, 1230, 1240, 1241,
+     1242, 1243, 1244,   68, 1246,   68, 1247, 1245,   68, 1231,
+       68, 1250, 1233, 1235,   68,   68, 1236, 1249, 1252, 1237,
+     1254, 1238,   68, 1239, 1248,   68,   68, 1242,   68,   68,
+     1255,   68,   68,   68, 1245, 1251, 1258, 1253,   68,   68,
 
-     1610,   68, 1254, 1258, 1255,   68, 1256, 1244, 1245,   68,
-     1246, 1243,   68, 1249, 1257,   68,   68,   68,   68,   68,
-       68, 1259, 1252,   68, 1253, 1247, 1261,   68,   68, 1254,
-     1258, 1255, 1260, 1256, 1262, 1265, 1264, 1263,   68, 1270,
-     1267, 1257, 1266, 1610, 1268, 1610, 1269,   68, 1259,   68,
-     1271, 1277,   68, 1261,   68,   68, 1273, 1275, 1272, 1260,
-     1274, 1262,   68, 1264, 1263,   68,   68, 1267,   68, 1266,
-       68, 1268,   68, 1269, 1276,   68,   68, 1271,   68, 1278,
-     1279,   68, 1280, 1273, 1275, 1272, 1282, 1274, 1281, 1283,
-     1610, 1284, 1610,   68, 1610, 1286,   68,   68, 1285,   68,
+     1256,   68, 1259,   68, 1249,   68,   68, 1254, 1260, 1261,
+       68, 1248, 1262,   68,   68, 1257, 1264, 1255, 1263, 1266,
+     1627, 1627, 1251,   68, 1253, 1265,   68, 1256, 1267, 1259,
+       68, 1269, 1270, 1268,   68,   68,   68,   68, 1271, 1262,
+       68,   68, 1257, 1264,   68, 1263, 1266,   68, 1272, 1273,
+       68, 1274, 1265, 1275,   68, 1267, 1276, 1627, 1269, 1270,
+     1268, 1277, 1278, 1280,   68, 1271,   68,   68,   68, 1279,
+     1283, 1284, 1627, 1281, 1627, 1272, 1273, 1285, 1274,   68,
+       68, 1282,   68, 1276,   68, 1286,   68, 1288, 1277, 1278,
+     1289, 1627, 1290, 1296,   68,   68, 1279, 1283, 1284,   68,
 
-     1287, 1276, 1288,   68, 1289, 1290,   68, 1279,   68, 1280,
-     1293,   68, 1292, 1282, 1610, 1281, 1283,   68, 1284,   68,
-     1304,   68, 1286, 1291,   68, 1285, 1294,   68,   68, 1288,
-       68, 1289, 1290, 1295,   68, 1296, 1297, 1300, 1610, 1292,
-     1298,   68, 1299, 1610,   68, 1302, 1303,   68, 1301, 1307,
-     1291,   68, 1305, 1294,   68,   68, 1309,   68, 1308, 1310,
-     1295, 1312, 1296, 1297,   68,   68, 1306, 1298,   68, 1299,
-       68, 1311,   68,   68,   68, 1301, 1307,   68,   68, 1305,
-       68,   68, 1313,   68, 1314, 1308, 1310, 1315, 1312, 1316,
-     1317, 1318, 1319, 1306, 1610, 1320,   68, 1321, 1311, 1322,
+     1281,   68, 1287, 1292, 1285,   68, 1291,   68, 1282,   68,
+     1293, 1297, 1286, 1294,   68, 1295,   68,   68,   68, 1290,
+     1296,   68, 1298,   68, 1299, 1301, 1304, 1300, 1303, 1287,
+     1292, 1307,   68, 1291,   68,   68, 1302, 1293, 1297, 1305,
+     1294,   68, 1295,   68, 1308, 1306,   68, 1311,   68,   68,
+       68, 1299, 1301,   68, 1300, 1303,   68,   68, 1307, 1309,
+       68, 1312, 1310, 1302, 1314, 1315, 1305, 1316, 1313, 1627,
+     1317, 1627, 1306,   68, 1311,   68, 1319, 1320,   68, 1321,
+     1322,   68, 1318, 1323, 1326, 1327, 1309,   68,   68, 1310,
+       68,   68,   68,   68, 1325, 1313,   68, 1317,   68,   68,
 
-       68, 1323, 1324, 1329,   68,   68,   68,   68,   68, 1313,
-       68,   68,   68, 1325,   68, 1334,   68, 1317, 1318, 1319,
-     1327,   68, 1320, 1328, 1321, 1330, 1322,   68, 1323,   68,
-     1329,   68, 1326,   68, 1331, 1332, 1333,   68,   68, 1335,
-     1325, 1338,   68,   68, 1336, 1343,   68, 1327,   68, 1337,
-     1328, 1339, 1330,   68,   68, 1341, 1344,   68,   68, 1326,
-     1340, 1331, 1332, 1333,   68, 1342, 1335,   68, 1338,   68,
-     1346, 1336,   68, 1345,   68, 1347, 1337, 1348, 1339,   68,
-     1350, 1349, 1341, 1344,   68,   68, 1351, 1340,   68,   68,
-     1610,   68, 1342, 1352, 1354, 1353, 1610, 1346, 1355, 1357,
+     1324, 1328,   68, 1319, 1320, 1329,   68, 1322,   68, 1318,
+     1323,   68,   68,   68, 1330, 1331,   68, 1334, 1332, 1333,
+       68, 1325, 1335,   68, 1336, 1337, 1340, 1324,   68,   68,
+       68, 1339, 1329,   68,   68, 1338,   68, 1344,   68,   68,
+       68, 1330, 1331,   68, 1334, 1332, 1333, 1341, 1342, 1335,
+       68,   68, 1337, 1340, 1343, 1345, 1346, 1347, 1339,   68,
+     1348,   68, 1338,   68, 1344, 1350, 1351,   68, 1352, 1349,
+       68, 1354, 1353,   68, 1341, 1342, 1355,   68,   68,   68,
+       68, 1343, 1345,   68,   68, 1356,   68, 1348, 1357, 1358,
+     1627, 1359, 1350, 1351, 1361, 1352, 1349, 1363, 1354, 1353,
 
-     1345,   68, 1347,   68, 1348,   68,   68,   68, 1349, 1356,
-     1358, 1361, 1359, 1610, 1363, 1364,   68,   68, 1360, 1610,
-     1352, 1354, 1353,   68,   68, 1355, 1357,   68, 1365, 1366,
-     1367, 1368, 1362, 1376,   68, 1377, 1356,   68,   68, 1359,
-       68,   68,   68, 1369, 1370, 1360, 1373, 1371,   68, 1372,
-     1374, 1375,   68,   68,   68, 1365, 1366, 1367, 1368, 1362,
-       68,   68,   68,   68, 1378,   68,   68, 1379,   68, 1380,
-     1369, 1370,   68, 1373, 1371, 1381, 1372, 1374, 1375, 1610,
-     1382, 1384, 1383, 1386, 1610, 1385, 1388, 1610, 1610, 1387,
-     1389, 1390, 1610, 1610,   68,   68,   68,   68, 1393,   68,
+       68,   68,   68, 1355, 1360,   68,   68, 1364, 1366, 1362,
+     1365, 1627,   68,   68, 1367, 1357, 1358,   68, 1359,   68,
+       68, 1361,   68, 1368,   68, 1369, 1627, 1370, 1372, 1371,
+       68, 1360, 1373,   68,   68, 1366, 1362, 1365,   68, 1374,
+     1375, 1367, 1377, 1376,   68, 1378, 1627, 1379,   68, 1627,
+     1368,   68, 1369,   68, 1370,   68, 1371, 1380, 1381, 1373,
+     1382, 1383,   68, 1384, 1387, 1386, 1374,   68, 1389,   68,
+     1376,   68,   68,   68, 1379, 1385,   68,   68, 1388, 1390,
+       68, 1391,   68,   68, 1380, 1381,   68, 1382, 1383, 1392,
+     1384, 1387, 1386, 1627,   68, 1389, 1393, 1394, 1395, 1396,
 
-     1397,   68,   68,   68,   68,   68,   68, 1382, 1384, 1383,
-     1386,   68, 1385, 1388,   68, 1391, 1387, 1389, 1390, 1392,
-     1394, 1395, 1396, 1398,   68, 1393, 1399,   68, 1404,   68,
-       68, 1403, 1400,   68, 1401, 1408, 1402,   68,   68, 1406,
-     1610,   68, 1391, 1407, 1409,   68, 1392, 1394, 1395, 1396,
-     1398,   68, 1410,   68,   68,   68,   68, 1405, 1403, 1400,
-     1411, 1401,   68, 1402,   68,   68, 1406,   68, 1412,   68,
-     1407,   68, 1413, 1414, 1415, 1416, 1610, 1419, 1421,   68,
-     1420,   68, 1417, 1418, 1405,   68, 1423, 1411, 1427,   68,
-     1424, 1610,   68, 1422, 1429, 1412,   68,   68,   68,   68,
+       68, 1398, 1385, 1397, 1399, 1388,   68, 1627,   68, 1627,
+     1403, 1401, 1402, 1400, 1627, 1627,   68, 1407, 1405,   68,
+       68, 1404,   68,   68,   68,   68, 1396,   68, 1398,   68,
+     1397, 1399,   68,   68,   68,   68,   68, 1403, 1401, 1402,
+     1400, 1406, 1408,   68, 1407, 1405, 1409, 1411, 1404, 1410,
+     1412, 1414, 1413, 1415,   68,   68,   68, 1417, 1419,   68,
+       68, 1416, 1627, 1421, 1420, 1423, 1424, 1418, 1406, 1408,
+       68,   68,   68, 1409, 1411,   68, 1410,   68,   68, 1413,
+     1415,   68, 1422,   68, 1417,   68, 1425, 1426, 1416,   68,
+     1421, 1420,   68,   68, 1418, 1427,   68, 1428, 1429, 1431,
 
-       68, 1415, 1416,   68, 1419, 1421,   68, 1420, 1425, 1417,
-     1418, 1426, 1428,   68,   68, 1427,   68, 1424, 1430,   68,
-     1422, 1429, 1432,   68, 1433,   68, 1434,   68, 1431,   68,
-     1436,   68, 1435, 1437, 1438, 1425, 1439, 1610, 1426, 1428,
-       68,   68, 1441, 1440,   68, 1430, 1442, 1610, 1443, 1432,
-       68, 1433,   68, 1434,   68, 1431,   68,   68,   68, 1435,
-     1437, 1438, 1444, 1439, 1445, 1446, 1447, 1452,   68, 1441,
-     1440, 1450,   68, 1442,   68, 1443, 1448, 1451, 1449,   68,
-       68, 1455, 1453,   68, 1454, 1610,   68,   68, 1456, 1444,
-       68, 1445, 1446, 1447,   68, 1459,   68, 1460,   68, 1457,
+     1430, 1627, 1432, 1433, 1436, 1627,   68, 1435,   68, 1422,
+     1434,   68,   68,   68, 1426, 1438,   68, 1440, 1444, 1627,
+       68, 1627, 1427,   68, 1442,   68, 1431, 1430,   68, 1432,
+     1433, 1436,   68, 1437, 1435, 1439,   68, 1434, 1443, 1441,
+       68, 1445,   68,   68, 1440, 1444,   68,   68,   68,   68,
+       68, 1442, 1446,   68, 1447, 1627, 1448, 1449, 1450, 1452,
+     1437, 1451, 1439,   68,   68, 1443, 1441, 1453, 1445, 1454,
+       68, 1455,   68, 1457, 1460,   68, 1456, 1458, 1466, 1446,
+     1459, 1447,   68, 1448, 1449, 1450,   68,   68, 1451,   68,
+       68,   68,   68, 1461, 1453, 1462, 1454, 1464, 1455,   68,
 
-     1461,   68,   68, 1448, 1451, 1449,   68, 1463,   68, 1453,
-       68, 1454, 1458, 1462,   68, 1456, 1464, 1465, 1466,   68,
-       68,   68, 1459, 1467, 1460,   68, 1457, 1461,   68, 1468,
-     1469, 1471, 1473, 1470,   68, 1472, 1474, 1477,   68, 1458,
-     1462,   68,   68, 1464,   68, 1466,   68, 1475, 1480, 1481,
-     1467,   68, 1610, 1476, 1478, 1479,   68,   68, 1471,   68,
-     1470,   68, 1472, 1474,   68, 1482, 1483, 1484,   68,   68,
-     1485, 1486, 1487,   68, 1475,   68,   68, 1489, 1488,   68,
-     1476, 1478, 1479, 1490, 1491, 1492, 1494, 1493, 1610,   68,
-     1610, 1610, 1482, 1483, 1484, 1495, 1496,   68,   68,   68,
+     1457, 1460, 1463, 1456, 1458, 1465,   68, 1459,   68,   68,
+     1467, 1468,   68,   68,   68,   68, 1470, 1469, 1471,   68,
+     1461, 1472, 1462, 1473, 1464,   68, 1627, 1474,   68, 1463,
+     1475, 1476, 1465, 1478,   68,   68, 1480, 1467,   68,   68,
+     1477,   68, 1481, 1470, 1469,   68, 1482, 1479, 1472,   68,
+     1473, 1484, 1483,   68, 1474,   68,   68, 1475, 1476,   68,
+       68, 1485, 1486,   68,   68, 1488, 1490, 1477, 1487, 1481,
+     1489, 1491, 1492,   68, 1479, 1493,   68,   68, 1484, 1483,
+       68, 1494, 1497,   68, 1498, 1627,   68, 1627,   68,   68,
+     1495, 1496, 1488,   68,   68, 1487, 1499, 1489, 1491, 1492,
 
-       68, 1504, 1506, 1610,   68, 1488,   68,   68, 1498,   68,
-     1490,   68, 1492,   68, 1493, 1497, 1502,   68,   68,   68,
-     1499, 1500, 1495, 1496,   68, 1501, 1503, 1505,   68,   68,
-       68,   68, 1507,   68, 1508, 1498, 1510, 1509,   68, 1511,
-     1515, 1610, 1497, 1502, 1512,   68,   68, 1499, 1500,   68,
-       68, 1514, 1501, 1503, 1505,   68, 1513,   68, 1516, 1507,
-     1518,   68,   68, 1510, 1509, 1517,   68, 1515,   68, 1519,
-     1520, 1512, 1522,   68, 1521, 1523, 1610, 1524, 1514, 1610,
-       68, 1525, 1527, 1513, 1528, 1516, 1526,   68, 1531,   68,
-       68,   68, 1517, 1529,   68,   68,   68,   68,   68, 1522,
+       68, 1500, 1493, 1501,   68, 1502, 1503, 1504, 1627,   68,
+     1506,   68,   68, 1505,   68, 1507, 1508, 1495, 1496, 1510,
+     1511, 1627, 1509, 1499, 1627,   68, 1512, 1514, 1500, 1513,
+     1501, 1627,   68,   68,   68,   68,   68,   68,   68, 1515,
+     1505,   68, 1507,   68,   68, 1521, 1510,   68,   68, 1509,
+       68,   68, 1519, 1512, 1514, 1518, 1513, 1516, 1517, 1523,
+     1522,   68, 1520, 1525, 1526, 1524, 1515,   68, 1527,   68,
+     1528, 1529,   68,   68,   68, 1627,   68,   68, 1535, 1519,
+     1532, 1530, 1518,   68, 1516, 1517,   68, 1522,   68, 1520,
+       68, 1526, 1524,   68, 1531, 1527, 1533,   68, 1529, 1536,
 
-     1530, 1521,   68,   68, 1524, 1533,   68,   68, 1525, 1527,
-     1532, 1528, 1534, 1526,   68, 1531,   68, 1535,   68,   68,
-     1529, 1536, 1537,   68, 1538, 1539, 1542, 1530, 1540, 1541,
-     1543,   68, 1533,   68, 1547, 1546, 1548, 1532,   68, 1534,
-     1610, 1544,   68,   68, 1535, 1545, 1549,   68, 1536,   68,
-       68, 1538, 1539, 1542,   68, 1540, 1541,   68, 1551,   68,
-     1550,   68, 1546, 1552, 1554,   68,   68,   68, 1544, 1553,
-     1555, 1556, 1545, 1549,   68, 1565,   68,   68,   68,   68,
-     1557, 1558, 1610, 1560,   68, 1551, 1559, 1550, 1610, 1561,
-     1552, 1554, 1562, 1563,   68, 1566, 1553, 1555, 1556, 1570,
+       68, 1534,   68, 1537, 1538,   68, 1539, 1532, 1530,   68,
+     1540, 1541, 1542, 1544, 1627, 1627, 1545, 1543,   68,   68,
+     1627, 1531,   68, 1533,   68,   68,   68,   68, 1534, 1546,
+       68, 1538,   68, 1539,   68, 1547, 1548, 1549, 1541, 1542,
+     1544,   68,   68, 1545, 1543,   68, 1550, 1551, 1553, 1552,
+       68,   68,   68, 1554, 1555,   68, 1546, 1556,   68, 1559,
+       68, 1557, 1547, 1548, 1549, 1558, 1560,   68, 1564, 1561,
+     1565,   68,   68, 1550, 1551, 1553, 1552, 1562, 1566,   68,
+       68, 1555,   68,   68, 1556, 1563, 1559, 1568, 1557,   68,
+     1569,   68, 1558,   68, 1567,   68, 1561,   68, 1570,   68,
 
-     1610, 1567,   68,   68, 1564, 1610,   68, 1557, 1558,   68,
-     1560,   68,   68, 1559,   68,   68, 1561, 1568, 1569, 1562,
-     1563,   68,   68, 1572, 1571,   68,   68, 1573, 1567, 1576,
-       68, 1564,   68, 1574, 1575, 1610, 1577,   68, 1580, 1579,
-     1610,   68,   68,   68, 1568, 1569, 1578,   68, 1581,   68,
-     1572, 1571, 1583, 1585, 1573, 1582, 1576, 1610, 1586, 1584,
-     1574, 1575,   68, 1577,   68, 1580, 1579,   68,   68, 1587,
-     1589, 1591,   68, 1578,   68, 1581, 1588,   68,   68, 1583,
-       68, 1610, 1582, 1590,   68, 1586, 1584, 1592, 1599,   68,
-     1595,   68,   68,   68, 1593, 1601, 1587, 1589, 1591, 1594,
+     1574,   68, 1571,   68, 1562, 1566,   68, 1573,   68, 1572,
+     1575, 1576, 1563, 1577, 1568,   68,   68, 1569, 1582,   68,
+     1578, 1567,   68,   68, 1579, 1570, 1580, 1574, 1583, 1571,
+     1584, 1627,   68, 1581, 1573, 1585, 1572, 1575, 1576,   68,
+     1577,   68,   68,   68, 1586, 1587,   68, 1578,   68,   68,
+       68, 1579,   68, 1580, 1589,   68, 1588, 1584, 1590, 1591,
+     1581, 1592, 1585, 1593,   68, 1594, 1596,   68,   68,   68,
+     1597, 1586, 1595, 1599,   68, 1598,   68,   68, 1600, 1601,
+       68, 1589, 1602, 1588, 1603, 1590, 1591,   68, 1592, 1627,
+     1593,   68, 1594, 1596,   68,   68,   68, 1597,   68, 1595,
 
-     1596, 1602,   68, 1588, 1597, 1610, 1598,   68,   68,   68,
-     1590, 1610,   68, 1604, 1592,   68,   68, 1595, 1600, 1603,
-     1605, 1593,   68, 1608, 1609, 1610, 1594, 1596,   68, 1606,
-     1610, 1597,   68, 1598, 1610,   68, 1607,   68,   68,   68,
-     1604, 1610,   68, 1610,   68, 1600, 1603, 1605, 1610, 1610,
-       68,   68, 1610, 1610, 1610, 1610, 1606, 1610, 1610, 1610,
-     1610, 1610, 1610, 1607,   40,   40,   40,   40,   40,   40,
-       40,   45,   45,   45,   45,   45,   45,   45,   50,   50,
-       50,   50,   50,   50,   50,   56,   56,   56,   56,   56,
-       56,   56,   61,   61,   61,   61,   61,   61,   61,   71,
+     1599,   68, 1598, 1604,   68, 1600, 1601, 1605, 1607,   68,
+     1606, 1603, 1627, 1610, 1608,   68,   68, 1609, 1611, 1627,
+     1612,   68, 1615,   68, 1616, 1613,   68, 1618, 1619, 1627,
+     1604, 1627,   68,   68, 1605, 1607,   68, 1606, 1617,   68,
+     1610, 1608, 1614, 1620, 1609, 1611,   68, 1612,   68, 1615,
+       68,   68, 1613, 1621,   68,   68, 1622, 1625,   68, 1623,
+     1624, 1626, 1627,   68, 1627, 1617, 1627,   68,   68, 1614,
+     1620, 1627, 1627, 1627, 1627,   68, 1627, 1627,   68, 1627,
+     1621, 1627, 1627, 1622,   68, 1627, 1623, 1624,   68,   40,
+       40,   40,   40,   40,   40,   40,   45,   45,   45,   45,
 
-       71, 1610,   71,   71,   71,   71,  123,  123, 1610, 1610,
-     1610,  123,  123,  125,  125, 1610, 1610,  125, 1610,  125,
-      127, 1610, 1610, 1610, 1610, 1610,  127,  130,  130, 1610,
-     1610, 1610,  130,  130,  132, 1610, 1610, 1610, 1610, 1610,
-      132,  134,  134, 1610,  134,  134,  134,  134,   72,   72,
-     1610,   72,   72,   72,   72,   13, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
+       45,   45,   45,   50,   50,   50,   50,   50,   50,   50,
+       56,   56,   56,   56,   56,   56,   56,   61,   61,   61,
+       61,   61,   61,   61,   71,   71, 1627,   71,   71,   71,
+       71,  123,  123, 1627, 1627, 1627,  123,  123,  125,  125,
+     1627, 1627,  125, 1627,  125,  127, 1627, 1627, 1627, 1627,
+     1627,  127,  130,  130, 1627, 1627, 1627,  130,  130,  132,
+     1627, 1627, 1627, 1627, 1627,  132,  134,  134, 1627,  134,
+      134,  134,  134,   72,   72, 1627,   72,   72,   72,   72,
+       13, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
 
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627
     } ;
 
-static yyconst flex_int16_t yy_chk[4722] =
+static yyconst flex_int16_t yy_chk[4747] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -1496,7 +1504,7 @@ static yyconst flex_int16_t yy_chk[4722] =
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    3,    3,    3,    4,    4,
         4,    5,    5,    6,    6,    5,   24,    6,    7,    7,
-        7,    7, 1616,    7,    8,    8,    8,    8,   24,    8,
+        7,    7, 1633,    7,    8,    8,    8,    8,   24,    8,
         9,    9,    9,   10,   10,   10,   15,   44,   44,   49,
 
        15,    3,   49,   24,    4,   60,   60,    5,   19,    6,
@@ -1679,335 +1687,337 @@ static yyconst flex_int16_t yy_chk[4722] =
       516,  517,  518,  528,  519,  519,  523,  538,  521,  532,
       520,  521,  522,  526,  524,  528,  530,  525,  527,  523,
       531,  529,  532,  531,  530,  529,  534,    0,  535,  538,
-      528,  536,  537,  536,  538,  546,  532,  541,  539,  540,
-      535,  546,    0,  530,  537,  549,    0,  531,  533,  534,
-      533,  539,  540,  534,  533,  535,  533,  542,  536,  537,
-      541,  533,  546,  543,  541,  539,  540,  544,  559,  542,
-        0,  548,  533,  543,  545,  533,  549,  533,  547,    0,
-      552,  533,    0,  533,  542,  543,  551,  545,  533,  544,
+      528,  536,  537,  536,  538,    0,  532,  541,  539,    0,
+      535,  559,    0,  530,  537,    0,    0,  531,  533,  534,
+      533,  539,    0,  534,  533,  535,  533,  540,  536,  537,
+      541,  533,  542,  543,  541,  539,  533,  545,  559,  544,
+      540,  549,  533,  543,  542,  533,  546,  533,  548,  547,
+      545,  533,  546,  533,  540,  543,  551,  562,  533,  542,
 
-      543,  547,  548,  552,  544,  559,  562,  550,  548,  553,
-      543,  545,  550,  555,  550,  547,  554,  552,  551,  556,
-      558,  564,  560,  551,  553,    0,  563,    0,  558,  564,
-      566,  557,  550,  550,  550,  555,  553,  562,  556,  550,
-      555,  550,  554,  554,  557,  560,  556,  558,  564,  560,
-      563,  565,  566,  563,  567,  568,  569,  566,  557,  550,
-      571,  572,  567,  570,  569,  565,  573,  571,  574,  576,
-      577,    0,    0,  568,  572,  583,  579,  576,  565,  577,
-      578,  567,  568,  569,  573,  570,  580,  571,  572,  581,
-      570,  582,  578,  573,  584,  588,  576,  577,  579,  574,
+      543,  544,  547,  533,  545,  554,  544,  552,  555,  548,
+      543,  553,  549,  546,  550,  548,  547,  556,  551,  550,
+      552,  550,  560,  551,  557,  558,  553,    0,  562,  563,
+      555,  554,  554,  558,  552,  555,  556,  557,  553,  550,
+      550,  550,  564,  565,  556,  560,  550,  567,  550,  560,
+      564,  557,  558,  563,  566,  567,  563,  565,  570,  568,
+      569,  573,  572,  574,  571,  576,  550,    0,  569,  564,
+      565,  571,  583,  576,  567,  572,  566,  568,  578,  573,
+      570,  566,  579,  582,  577,  570,  568,  569,  573,  572,
+      578,  571,  576,  577,  574,  580,  581,  584,  583,  583,
 
-      586,  583,  583,  579,  586,  589,  591,  578,  580,  582,
-      598,  581,  587,  580,  590,  587,  581,  589,  582,  588,
-      592,  590,  588,  593,  594,  584,  592,  595,  597,  596,
-      591,  586,  589,  591,  599,  600,  601,  598,  587,  587,
-      596,  590,  587,  612,  600,  593,  594,  592,  595,  597,
-      593,  594,  599,  606,  595,  597,  596,  602,  604,  603,
-      601,  599,  600,  601,  605,  604,  602,  603,  607,  609,
-      608,  610,  613,  611,  612,  606,    0,  614,  605,  608,
-      606,  615,    0,    0,  602,  604,  603,  610,  611,  614,
-      607,  605,  617,  609,  616,  607,  609,  608,  610,  618,
+      587,  582,  586,  587,  579,  578,  586,  588,  589,  579,
+      582,  577,  590,  591,  593,  592,  594,  580,  581,  590,
+      589,  592,  580,  581,  595,  597,  587,  587,  584,  598,
+      587,  588,  599,  586,  588,  589,  593,  591,  594,  590,
+      591,  593,  592,  594,  596,  595,  597,  604,  600,  601,
+      599,  595,  597,  602,  604,  596,  598,  600,  603,  599,
+      606,  607,  602,  605,  611,  609,  603,  612,  610,  608,
+      613,  596,  615,  601,  604,  600,  601,  605,  608,  611,
+      602,  614,  606,  607,  610,  603,  616,  606,  607,  609,
+      605,  611,  609,  614,  616,  610,  608,  617,  612,  615,
 
-      611,  620,  616,  613,  614,  617,  621,  622,  615,  623,
-      620,  623,  626,  628,  618,  622,  629,  627,  630,  617,
-      628,  616,    0,  631,  621,  626,  618,    0,  620,  627,
-      632,  634,  638,  621,  622,  633,  623,    0,  637,  626,
-      628,    0,  635,  632,  627,  631,  637,  629,  633,  630,
-      631,  636,  639,  634,  635,  640,  646,  632,  634,  638,
-      641,  639,  633,  636,  642,  637,  643,  641,  645,  635,
-        0,  648,  644,    0,  649,  647,  640,  650,  636,  639,
-      646,  645,  640,  646,  647,  650,  651,  641,  643,  648,
-      642,  642,  644,  643,  653,  645,  649,  652,  648,  644,
+      618,  613,  620,  621,  622,  623,  626,  623,  614,  628,
+      617,  620,  622,  616,  627,  618,  628,  629,  630,  626,
+      631,  621,    0,    0,  617,  632,  627,  618,  635,  620,
+      621,  622,  623,  626,  634,  636,  628,  633,  632,  637,
+      635,  627,  631,  636,  639,  638,  641,  631,  629,  630,
+      633,  637,  632,  638,  640,  635,  634,  643,  642,  645,
+      644,  634,  636,  640,  633,  642,  637,  641,  647,  648,
+        0,  639,  638,  641,    0,  646,  649,  650,  648,  645,
+      655,  640,  644,  643,  643,  642,  645,  644,  646,  651,
+      652,  654,  647,  653,  649,  647,  648,  651,  655,  650,
 
-      654,  649,  647,  655,  650,  652,  658,  656,  651,    0,
-      657,  660,    0,  651,  658,  655,  659,  653,  654,  656,
-      660,  653,  659,  661,  652,  657,  666,  654,  662,  663,
-      655,  664,  667,  658,  656,  668,  663,  657,  660,  669,
-      662,  670,  675,  659,  661,  667,  669,  671,  676,  664,
-      661,  671,  672,  673,  668,  662,  663,  666,  664,  667,
-      672,  677,  668,  670,  674,  678,  669,  673,  670,  679,
-      684,  680,  681,  675,  676,  676,  683,  682,  671,  672,
-      673,  685,  674,  677,  686,  683,  687,  678,  677,  680,
-      682,  674,  678,    0,  681,  679,  679,  691,  680,  681,
+      658,  653,  646,  649,  650,  659,    0,  655,  662,  656,
+      657,  663,  652,  659,  654,  658,  651,  652,  654,  660,
+      653,  656,  657,  663,  661,  660,  665,  658,  667,  662,
+      668,  669,  659,  661,  664,  662,  656,  657,  663,  676,
+      670,  664,  671,  668,  665,  672,  660,  670,  673,  672,
+      669,  661,  674,  665,  675,  678,  673,  668,  669,  667,
+      677,  664,  679,  682,  671,  680,  674,  670,  685,  671,
+      676,  686,  675,  687,  684,  673,  672,  678,  681,  674,
+      683,  675,  678,  684,  679,  682,  677,  677,  688,  679,
+      682,  680,  680,  683,    0,  687,  681,  690,    0,  685,
 
-      689,  684,  692,  683,  682,  694,  686,  696,    0,  687,
-      688,  686,  685,  687,  692,  688,  689,  688,  694,  688,
-      691,  693,  697,  695,  691,  700,  696,  689,  688,  692,
-      693,  695,  694,  702,  696,  697,  698,  688,  699,  701,
-      699,  707,  688,  704,  688,  698,  688,  705,  693,  697,
-      695,  701,  700,  706,  709,  708,  710,  711,  714,  721,
-      702,  706,  708,  698,  712,  699,  701,  704,  707,  705,
-      704,  712,  713,  715,  705,  716,  718,  714,  710,  717,
-      706,  709,  708,  710,  711,  714,  722,  719,  717,  723,
-      721,  712,  724,  727,  713,  715,  731,  718,  728,  713,
+      687,  684,  686,  689,  692,  681,  693,  683,  689,  695,
+      689,  688,  689,  690,  694,  688,  698,  696,  693,  697,
+      701,  689,  695,  694,  690,  696,  700,  692,  700,  698,
+      689,  692,  703,  693,  705,  689,  695,  689,  697,  689,
+      699,  694,  702,  698,  696,  708,  697,  701,  706,  699,
+      709,  710,  707,  700,  702,  712,  713,  709,  705,  703,
+      707,  705,  711,  713,  714,  716,  715,  699,  717,  702,
+      706,  718,  708,  722,  723,  706,  719,  709,  710,  707,
+      718,  720,  712,  713,  711,  715,  714,  716,  724,  711,
+      725,  714,  716,  715,  717,  717,  726,  719,  718,  727,
 
-      715,  716,  716,  718,  725,  726,  717,  719,  729,  727,
-      735,  723,  732,  726,  719,  729,  723,  722,    0,  732,
-      727,  734,  725,  724,  730,  728,  733,  731,  730,  743,
-      734,  725,  726,  733,  736,  729,  735,  735,  737,  732,
-      737,  736,  739,  738,  740,  742,  739,  743,  734,  742,
-      745,  730,  738,  733,  744,  746,  743,  747,  749,  750,
-      748,  736,  751,  751,    0,  737,  740,  750,  746,  739,
-      738,  740,  753,  744,  749,  745,  742,  745,  756,    0,
-      760,  744,  746,  748,  752,  749,  750,  748,  747,  751,
-      755,  754,  760,  752,  753,  757,  759,  755,  758,  753,
+      728,  720,  729,  719,  722,  723,  730,  727,  720,  732,
+      724,  735,  733,  730,  726,  724,  728,  734,  731,  733,
+      735,  725,  731,  726,  734,  736,  727,  728,  737,  729,
+      738,  740,  738,  730,  739,  737,  748,  741,  735,  733,
+      732,  741,  745,  739,  734,  731,  742,  746,  749,  748,
+      744,  736,  736,  740,  744,  737,  751,  738,  740,  747,
+      745,  739,  750,  748,  741,    0,  746,  752,  742,  745,
+      753,  753,  751,  742,  746,  752,  755,  758,  754,  749,
+      762,  744,  756,  751,  747,  750,  747,  754,  757,  750,
+      759,  756,  762,  760,  752,  757,  764,  753,  755,  759,
 
-      754,  756,  761,  771,  757,  756,  758,  760,  762,  759,
-      761,  752,  763,  766,  764,  765,  767,  755,  754,  772,
-        0,  769,  757,  759,  765,  758,  768,  769,  767,  761,
-      762,  766,  763,  770,  771,  762,  764,  773,  775,  763,
-      766,  764,  765,  767,  776,  777,  778,  768,  769,  780,
-      772,  781,  779,  768,  778,  770,  779,    0,  777,  781,
-      770,  782,  784,  773,  773,  775,  776,  783,  783,  782,
-      784,  776,  777,  778,  785,  786,  780,  787,  781,    0,
-      791,  792,  788,  779,  789,  787,  793,  792,  782,  784,
-      788,  790,  789,  791,  783,  785,  794,  795,  793,  790,
+      758,  760,  763,  755,  758,  754,  761,  762,  765,  756,
+      763,  773,  766,  767,  768,  757,  770,  759,  764,  761,
+      760,  771,  767,  764,  769,  772,  774,  771,  765,  763,
+        0,  777,  768,  761,  766,  765,  769,  770,  775,  766,
+      767,  768,  773,  770,  778,  780,  779,  772,  771,  782,
+      781,  769,  772,  780,  781,  783,  787,  774,  777,  779,
+      784,  785,  785,  783,  775,  775,  778,  786,  784,  788,
+      789,  778,  780,  779,  794,  786,  782,  787,  789,  795,
+      794,  781,  783,  787,  790,  791,  793,  784,  785,  796,
+      792,  795,  790,  791,  786,  799,  797,  789,  792,  793,
 
-      797,  785,  796,  798,  787,  799,  786,  791,  792,  788,
-      800,  789,  799,  793,  797,  804,  801,  802,  790,  795,
-      808,  798,  794,  794,  795,  796,  803,  797,  809,  796,
-      798,  810,  799,  803,  812,    0,  806,  800,  801,  814,
-      802,  816,  808,  801,  802,  806,  804,  808,  817,  819,
-      821,  819,  818,  803,  809,  809,  820,  823,  822,  828,
-      824,  812,  810,  806,  818,  816,  814,  824,  816,  820,
-      822,  825,  821,  826,  817,  817,  819,  821,  826,  818,
-      827,  829,  828,  820,  823,  822,  828,  824,  830,  829,
-      832,  833,  840,  834,  835,  836,  827,  825,  825,  832,
+      788,  794,  798,  800,  802,  803,  795,  801,  806,  799,
+      804,  790,  791,  793,  801,  796,  796,  792,  797,  805,
+      810,  800,  799,  797,  811,  798,  805,  803,  812,  798,
+      800,  802,  803,  804,  801,  808,  814,  804,  816,  806,
+      818,  820,  810,  819,  808,  822,  805,  810,  824,  823,
+      811,  811,  821,  820,  821,  825,    0,  827,  822,  812,
+      824,  829,  808,  814,  818,  816,  826,  818,  820,  819,
+      819,  823,  822,  826,  830,  824,  823,  829,  831,  821,
+      828,  832,  825,  827,  827,  828,  831,  834,  829,  835,
+      842,  836,  837,  826,  844,  840,  834,  830,    0,  837,
 
-      826,  835,  836,  838,  833,  837,  841,  827,  829,  839,
-      830,  842,  837,  841,  843,  830,  844,  832,  833,  834,
-      834,  835,  836,  840,  842,  847,  846,  848,  838,  846,
-      838,  839,  837,  841,  851,  852,  839,  844,  842,  849,
-      853,  843,  848,  844,  850,  856,  849,  850,  854,  857,
-      858,  847,  847,  846,  848,  859,  863,  852,  853,  850,
-      863,  855,  852,  855,  859,  851,  849,  853,  850,  856,
-      854,  850,  856,  860,  850,  854,  858,  858,  861,  862,
-      857,  860,  859,  863,  865,  861,  850,  864,  855,  867,
-      866,  870,  868,  871,  873,  869,  872,    0,  867,  868,
+      846,  830,  835,  832,  838,  831,  839,  828,  832,  849,
+      841,  838,  849,  839,  834,  845,  835,  836,  836,  837,
+      840,  842,  840,  843,  847,  844,  850,  846,  845,  851,
+      843,  838,  841,  839,  852,  854,  849,  841,  855,    0,
+      853,  852,  845,  853,  851,  847,  857,  858,  860,  858,
+      843,  847,  850,  850,  856,  853,  851,    0,  861,  859,
+      855,  852,  862,  868,  853,  855,  854,  853,  857,  863,
+      853,  862,  856,  857,  858,  865,  867,  863,  869,  860,
+      864,  856,  853,  859,  861,  861,  859,  864,  866,  862,
+      868,  887,  866,  874,  871,  870,  863,  865,  867,  872,
 
-      860,  862,  869,  878,  870,  861,  862,  876,  871,  864,
-      872,  865,  866,  876,  864,  878,  867,  866,  870,  868,
-      871,  874,  869,  872,  875,  873,  879,  881,  874,  880,
-      878,  875,  880,  884,  876,  886,  889,  885,  881,  887,
-      888,  892,  893,    0,  889,    0,  879,  880,  874,    0,
-      887,  875,  890,  879,  881,  890,  880,  886,  888,  880,
-      884,  885,  886,  889,  885,  891,  887,  888,  894,  893,
-      890,  895,  892,  900,  897,  894,  898,  896,  898,  890,
-      899,  902,  890,  891,  904,  895,  896,  897,  906,  899,
-      902,  901,  891,  907,  909,  894,  905,  910,  895,  900,
+      869,  871,  865,  867,  870,  869,  872,  864,  874,  876,
+      873,  875,  877,    0,  882,  866,  881,  878,  887,  877,
+      874,  871,  870,  873,  878,  875,  872,  879,  881,  883,
+      889,  884,  883,  879,  882,  890,  888,  873,  875,  877,
+      876,  882,  884,  881,  878,  892,  890,  883,  891,  894,
+      895,  896,  889,  892,  879,  898,  883,  889,  884,  883,
+      888,  893,  890,  888,  893,  899,  891,  894,  903,  898,
+      897,  900,  892,  907,  899,  891,  894,  897,  896,  893,
+      902,  895,  898,  901,  900,  901,    0,  905,  893,  902,
+      904,  893,  899,  908,  903,  903,  905,  897,  900,  909,
 
-      900,  897,  901,  898,  896,  905,  908,  899,  902,  914,
-      911,  910,  915,  908,  907,  904,  911,    0,  901,  906,
-      907,  916,  918,  905,  910,  909,  915,  917,  914,  919,
-      916,  922,  920,  908,  911,  917,  914,  911,  922,  915,
-      919,  920,  923,  911,  924,  925,  926,  928,  916,  929,
-      930,  928,  927,  918,  917,  934,  919,  938,  922,  920,
-      939,  929,  931,  932,    0,  923,  924,  925,  926,  923,
-      927,  924,  925,  926,  928,  931,  929,  930,  932,  927,
-      933,  935,  936,  937,  938,  941,  934,  939,  942,  931,
-      932,  936,  944,  945,  947,  933,  935,    0,  943,  953,
+      910,  904,  908,  912,  907,  911,    0,  902,  913,  914,
+      901,  918,  911,  921,  905,  914,  920,  904,  917,  919,
+      908,  910,  913,    0,  920,  918,  926,  910,  919,  922,
+      909,  933,  911,  914,  912,  913,  914,  917,  918,  923,
+      922,  927,  914,  920,  921,  917,  919,  925,  923,  926,
+      928,  929,  930,  926,  925,  931,  922,  932,  933,  931,
+      937,  935,  934,  927,    0,  936,  923,  941,  927,  932,
+      930,  938,  928,  929,  925,  934,  935,  928,  929,  930,
+      936,  939,  931,  940,  932,  942,  938,  943,  935,  934,
+      939,  937,  936,  945,  941,  946,  948,    0,  938,  949,
 
-      948,  946,  952,  941,  937,  949,  947,  933,  935,  936,
-      937,  945,  941,  943,  944,  942,  946,  950,  949,  944,
-      945,  947,  948,  949,  950,  943,  951,  948,  946,  952,
-      953,  954,  949,  955,  957,  956,  958,  954,  951,  959,
-      960,  955,  956,  958,  950,  949,  961,  962,  964,  966,
-        0,  968,    0,  951,  967,  965,  967,  969,  954,  970,
-      955,  957,  956,  958,  965,    0,  959,  960,  972,  973,
-      976,  962,  977,  977,  962,  972,  973,  961,  968,  964,
-      966,  967,  965,  969,  969,  971,  974,  971,  975,  981,
-      970,  978,  971,  974,  975,  972,  973,  976,  979,  977,
+      947,  950,  952,    0,  940,  956,  954,  951,  939,  942,
+      940,  945,  942,  954,  943,  947,  950,  949,  948,  951,
+      945,  961,  946,  948,  952,  953,  949,  947,  950,  952,
+      955,  957,  956,  954,  951,    0,  959,  963,  953,  958,
+      960,  964,  955,  953,  959,  958,  962,  960,  961,  965,
+      966,  968,  953,  962,  970,    0,  971,  955,  971,  972,
+      969,  974,  957,  959,  963,  953,  958,  960,  964,  969,
+      973,  976,  977,  962,  966,  979,    0,  966,  976,  977,
+      965,  979,  968,  971,  978,  970,  972,  969,  975,  975,
+      975,  978,  974,  980,  986,  975,  973,  973,  976,  977,
 
-      971,  982,  984,  985,    0,  979,  987,  981,  983,  986,
-      986,  992,  971,  974,  971,  975,  981,  978,  978,  971,
-      983,  985,  984,  988,  988,  979,  989,  991,  982,  984,
-      985,  993,  987,  987,  995,  983,  986,  989,  993,  994,
-      996,  998,  992,  999, 1000,  997, 1003, 1004,  998,  991,
-      988, 1006, 1000,  989,  991,  999, 1002, 1001,  993,  994,
-     1005,  995,  996,  997, 1003, 1005,  994,  996,  998, 1001,
-      999, 1000,  997, 1003, 1004, 1007, 1005, 1002, 1006, 1009,
-     1008, 1007, 1010, 1002, 1001, 1011, 1012, 1005, 1014, 1011,
-        0, 1015, 1005, 1008, 1013, 1013, 1016, 1017, 1018, 1019,
+      981,  981,  979,  975,  982,  983,  985,  987,  988,    0,
+      996,  978,  983,  990,  990,  975,  975,  975,  989,  987,
+      980,  986,  975,  991,  985,  992,  992,  981,  988,  995,
+      982,  982,  983,  985,  987,  988,  989,  993,  998,  997,
+      990,  996,  999, 1001,    0,  989,  997, 1002,  993,  991,
+      991,  995,  992, 1000, 1002, 1003,  995, 1006,  998, 1005,
+     1004, 1001, 1008, 1007,  993,  998,  997, 1003, 1004,  999,
+     1001, 1005, 1009, 1010, 1002, 1000, 1013, 1009, 1006, 1011,
+     1000, 1007, 1003, 1012, 1006, 1011, 1005, 1004, 1009, 1008,
+     1007, 1014, 1016, 1015, 1017, 1017, 1012, 1015, 1018, 1009,
 
-     1020, 1019, 1007, 1014, 1022, 1025, 1026, 1008,    0, 1010,
-     1009, 1016, 1023, 1018, 1021, 1014, 1011, 1012, 1027, 1021,
-     1017, 1013, 1015, 1016, 1017, 1018, 1019, 1023, 1028, 1025,
-     1029, 1020, 1025, 1026, 1037, 1022, 1031, 1030, 1034, 1023,
-     1038, 1021, 1039, 1041, 1036, 1027,    0, 1038, 1044, 1028,
-     1042, 1041, 1029, 1034, 1031, 1028, 1043, 1029, 1030, 1036,
-     1039, 1037,    0, 1031, 1030, 1034, 1040, 1038, 1045, 1039,
-     1041, 1036, 1049, 1042, 1047, 1040, 1050, 1042, 1043, 1044,
-     1048, 1045, 1052, 1043, 1055, 1047, 1056, 1058, 1057, 1048,
-     1049, 1059, 1060, 1040, 1050, 1045,    0, 1055, 1057, 1049,
+     1010, 1019, 1020, 1021, 1009,    0, 1011, 1013, 1030, 1023,
+     1012, 1023, 1022, 1018, 1024, 1025, 1026, 1020, 1014, 1027,
+     1025, 1017, 1031, 1016, 1015, 1018, 1021, 1022, 1029, 1020,
+     1021, 1033, 1019, 1032, 1027, 1030, 1023, 1042, 1034, 1022,
+     1037, 1039, 1025, 1035, 1043, 1024, 1027, 1026, 1041, 1031,
+     1047, 1043, 1029, 1033, 1032, 1029, 1039, 1049, 1033, 1034,
+     1032, 1035, 1037, 1041, 1042, 1034, 1044, 1037, 1039, 1045,
+     1035, 1043, 1046, 1047, 1050, 1041, 1048, 1047, 1045, 1052,
+     1046, 1057, 1053, 1061, 1044, 1062, 1054, 1050, 1049, 1055,
+     1052, 1053, 1063, 1044, 1065, 1062, 1045, 1060, 1048, 1046,
 
-     1047, 1047, 1062, 1050, 1064,    0, 1066, 1048, 1067, 1052,
-     1068, 1055, 1047, 1058, 1058, 1057, 1059, 1056, 1059, 1060,
-     1063, 1066, 1062, 1067, 1069, 1068, 1065, 1063, 1072, 1062,
-     1064, 1064, 1065, 1066, 1070, 1067, 1069, 1068, 1073, 1074,
-     1075, 1070, 1078, 1077, 1079, 1079, 1080, 1063, 1074, 1081,
-     1072, 1069, 1086, 1065,    0, 1072, 1077, 1082, 1075, 1083,
-        0, 1070, 1091, 1073,    0, 1073, 1074, 1075, 1080, 1078,
-     1077, 1079, 1087, 1080, 1081, 1085, 1081, 1089, 1084, 1082,
-     1090, 1083, 1085, 1086, 1082, 1089, 1083, 1084, 1092, 1091,
-     1095, 1094, 1093, 1090, 1087, 1093, 1096,    0, 1098, 1087,
+     1064, 1050, 1067, 1048, 1054, 1052, 1052, 1055, 1057, 1053,
+     1060, 1069, 1062, 1054, 1061, 1070, 1055, 1052, 1063, 1063,
+     1071, 1065, 1067, 1068, 1060, 1064, 1071, 1064, 1072, 1067,
+     1068, 1073, 1075, 1070, 1074, 1078, 1080, 1069, 1069, 1079,
+     1083, 1076, 1070, 1072, 1075, 1080, 1073, 1071, 1076, 1074,
+     1068, 1081, 1084, 1083, 1086, 1072, 1090, 1078, 1073, 1075,
+     1087, 1074, 1078, 1080, 1079, 1090, 1079, 1083, 1076, 1081,
+     1085, 1085, 1088, 1089, 1092, 1091, 1086, 1096, 1081, 1084,
+     1095, 1086, 1091, 1090, 1093, 1087, 1097, 1087, 1095,    0,
+     1096, 1101, 1100, 1098, 1088, 1089, 1108, 1085, 1099, 1088,
 
-     1101,    0, 1085, 1092, 1089, 1084, 1099, 1090, 1095, 1105,
-     1093, 1096, 1111, 1107, 1101, 1092, 1094, 1095, 1094, 1093,
-     1098, 1103, 1093, 1096, 1102, 1098, 1108, 1101, 1099, 1110,
-     1105, 1102, 1103, 1099, 1107, 1109, 1105, 1109, 1108, 1111,
-     1107, 1112, 1113, 1115, 1114, 1116, 1117, 1110, 1103, 1118,
-     1123, 1102, 1114, 1108, 1124, 1119, 1110, 1122, 1127, 1112,
-     1117, 1126, 1109, 1125, 1130,    0, 1115, 1116, 1112, 1113,
-     1115, 1114, 1116, 1117, 1119, 1122, 1118, 1123, 1125, 1133,
-     1124, 1124, 1119, 1126, 1122, 1127, 1130, 1129, 1126, 1129,
-     1125, 1130, 1131, 1132, 1134, 1136, 1131, 1135, 1138,    0,
+     1089, 1099, 1091, 1108, 1096, 1092, 1093, 1095, 1098, 1101,
+     1104, 1093, 1102, 1097, 1105, 1107, 1099, 1100, 1101, 1100,
+     1098,    0, 1109, 1108, 1111, 1099, 1113, 1102, 1099, 1107,
+     1116, 1114, 1104, 1109, 1117,    0, 1105, 1104, 1115, 1102,
+     1115, 1105, 1107, 1114, 1118, 1111, 1119, 1113, 1116, 1109,
+        0, 1111, 1120, 1113, 1121, 1123, 1122, 1116, 1114, 1124,
+     1120, 1117, 1118, 1129, 1134, 1115, 1125,    0, 1130, 1123,
+     1128, 1118, 1131, 1119, 1133, 1132, 1138, 1121, 1122, 1120,
+     1138, 1121, 1123, 1122, 1132, 1125, 1124, 1131, 1128, 1137,
+     1129, 1134, 1139, 1125, 1130, 1130, 1133, 1128, 1136, 1131,
 
-     1137, 1133,    0, 1134, 1139, 1132, 1133, 1141, 1135, 1144,
-     1138, 1140, 1140, 1143, 1129, 1141, 1143, 1144, 1146, 1131,
-     1132, 1134, 1136, 1137, 1135, 1138, 1139, 1137, 1149, 1145,
-     1150, 1139, 1151, 1146, 1141, 1145, 1144, 1147, 1140, 1152,
-     1143, 1153, 1154, 1147, 1155, 1146, 1151, 1156, 1157, 1158,
-     1159, 1160, 1161, 1152, 1150, 1149, 1145, 1150, 1159, 1151,
-     1164, 1156, 1162, 1165, 1147, 1166, 1152, 1153, 1153, 1154,
-     1162, 1155, 1167, 1166, 1156, 1157, 1158, 1159, 1160, 1161,
-     1169, 1170, 1164, 1171, 1168, 1172, 1173, 1164, 1174, 1162,
-     1165, 1176, 1166, 1168, 1173, 1177, 1177, 1178, 1171, 1167,
+     1136, 1133, 1132, 1138, 1139, 1140, 1141, 1142, 1143,    0,
+     1145, 1137,    0, 1144, 1156, 1141, 1137, 1146, 1142, 1139,
+     1147, 1147, 1145, 1148,    0, 1136, 1150, 1140, 1153, 1150,
+     1151, 1148, 1140, 1141, 1142, 1143, 1144, 1145, 1151, 1146,
+     1144, 1156, 1152, 1153, 1146, 1154, 1157, 1147, 1152, 1158,
+     1148, 1154, 1159, 1150, 1160, 1153, 1161, 1151, 1162, 1163,
+     1164, 1165, 1166, 1158, 1168, 1159, 1169, 1167, 1160, 1152,
+     1157, 1173, 1154, 1157, 1164, 1167, 1158, 1172, 1175, 1159,
+     1177, 1160, 1161, 1161, 1170, 1162, 1163, 1164, 1165, 1166,
+     1178, 1168, 1170, 1169, 1167, 1174, 1180, 1176, 1173, 1172,
 
-        0, 1169, 1179, 1183, 1180, 1170, 1181, 1169, 1170, 1171,
-     1171, 1168, 1172, 1173, 1182, 1174, 1182, 1183, 1176, 1180,
-     1179, 1184, 1177, 1178, 1178, 1171, 1186, 1184, 1181, 1179,
-     1183, 1180, 1185, 1181, 1187, 1190, 1189, 1188, 1186, 1197,
-     1193, 1182, 1191,    0, 1195,    0, 1196, 1193, 1184, 1189,
-     1198, 1205, 1187, 1186, 1185, 1188, 1200, 1203, 1198, 1185,
-     1201, 1187, 1195, 1189, 1188, 1191, 1190, 1193, 1200, 1191,
-     1197, 1195, 1196, 1196, 1204, 1201, 1198, 1198, 1205, 1207,
-     1208, 1203, 1209, 1200, 1203, 1198, 1211, 1201, 1210, 1212,
-        0, 1213,    0, 1208,    0, 1216, 1204, 1212, 1215, 1211,
+     1179, 1177, 1181, 1174, 1172, 1175, 1176, 1177, 1182, 1184,
+     1181, 1170, 1185, 1185, 1178, 1179, 1187, 1178, 1186, 1189,
+        0,    0, 1174, 1180, 1176, 1188, 1179, 1179, 1190, 1181,
+     1190, 1192, 1193, 1191, 1187, 1182, 1184, 1192, 1194, 1185,
+     1188, 1189, 1179, 1187, 1186, 1186, 1189, 1191, 1195, 1196,
+     1194, 1197, 1188, 1198, 1193, 1190, 1199,    0, 1192, 1193,
+     1191, 1201, 1203, 1205, 1197, 1194, 1195, 1196, 1201, 1204,
+     1208, 1209,    0, 1206,    0, 1195, 1196, 1211, 1197, 1199,
+     1203, 1206, 1208, 1199, 1198, 1212, 1209, 1214, 1201, 1203,
+     1216,    0, 1217, 1224, 1205, 1204, 1204, 1208, 1209, 1206,
 
-     1217, 1204, 1218, 1210, 1219, 1220, 1207, 1208, 1209, 1209,
-     1223, 1219, 1222, 1211,    0, 1210, 1212, 1213, 1213, 1216,
-     1243, 1215, 1216, 1221, 1218, 1215, 1224, 1217, 1220, 1218,
-     1221, 1219, 1220, 1226, 1222, 1227, 1228, 1235,    0, 1222,
-     1229, 1223, 1232,    0, 1226, 1239, 1241, 1224, 1238, 1246,
-     1221, 1243, 1244, 1224, 1246, 1228, 1249, 1227, 1247, 1252,
-     1226, 1254, 1227, 1228, 1235, 1229, 1245, 1229, 1232, 1232,
-     1238, 1253, 1239, 1241, 1254, 1238, 1246, 1245, 1244, 1244,
-     1247, 1252, 1255, 1249, 1256, 1247, 1252, 1257, 1254, 1258,
-     1259, 1260, 1261, 1245,    0, 1262, 1253, 1263, 1253, 1264,
+     1206, 1211, 1213, 1219, 1211, 1217, 1218, 1212, 1206, 1213,
+     1220, 1225, 1212, 1221, 1214, 1222, 1224, 1216, 1219, 1217,
+     1224, 1221, 1226, 1220, 1227, 1229, 1232, 1228, 1231, 1213,
+     1219, 1236, 1218, 1218, 1228, 1225, 1230, 1220, 1225, 1233,
+     1221, 1222, 1222, 1230, 1237, 1235, 1227, 1242, 1229, 1226,
+     1231, 1227, 1229, 1236, 1228, 1231, 1235, 1232, 1236, 1238,
+     1233, 1245, 1239, 1230, 1249, 1251, 1233, 1253, 1248,    0,
+     1254,    0, 1235, 1242, 1242, 1237, 1256, 1257, 1238, 1259,
+     1262, 1256, 1255, 1263, 1266, 1267, 1238, 1239, 1245, 1239,
+     1248, 1249, 1251, 1255, 1265, 1248, 1254, 1254, 1253, 1257,
 
-     1260, 1265, 1266, 1271, 1255, 1259, 1271, 1261, 1265, 1255,
-     1262, 1256, 1263, 1267, 1257, 1276, 1258, 1259, 1260, 1261,
-     1269, 1264, 1262, 1270, 1263, 1272, 1264, 1269, 1265, 1266,
-     1271, 1267, 1268, 1268, 1273, 1274, 1275, 1270, 1272, 1279,
-     1267, 1282, 1276, 1273, 1280, 1288, 1279, 1269, 1282, 1281,
-     1270, 1283, 1272, 1280, 1281, 1285, 1289, 1274, 1275, 1268,
-     1284, 1273, 1274, 1275, 1285, 1286, 1279, 1284, 1282, 1283,
-     1291, 1280, 1288, 1290, 1289, 1292, 1281, 1293, 1283, 1291,
-     1295, 1294, 1285, 1289, 1292, 1290, 1296, 1284, 1293, 1294,
-        0, 1286, 1286, 1297, 1299, 1298,    0, 1291, 1301, 1305,
+     1264, 1268, 1262, 1256, 1257, 1269, 1259, 1262, 1263, 1255,
+     1263, 1266, 1267, 1264, 1270, 1271, 1265, 1274, 1272, 1273,
+     1269, 1265, 1275, 1270, 1276, 1277, 1280, 1264, 1268, 1275,
+     1271, 1279, 1269, 1272, 1273, 1278, 1278, 1284, 1279, 1274,
+     1280, 1270, 1271, 1277, 1274, 1272, 1273, 1281, 1282, 1275,
+     1281, 1276, 1277, 1280, 1283, 1285, 1286, 1287, 1279, 1284,
+     1290, 1282, 1278, 1283, 1284, 1292, 1293, 1290, 1294, 1291,
+     1292, 1296, 1295, 1293, 1281, 1282, 1297, 1285, 1291, 1295,
+     1296, 1283, 1285, 1286, 1287, 1299, 1294, 1290, 1300, 1301,
+        0, 1302, 1292, 1293, 1304, 1294, 1291, 1306, 1296, 1295,
 
-     1290, 1299, 1292, 1298, 1293, 1297, 1301, 1295, 1294, 1304,
-     1306, 1310, 1307,    0, 1312, 1313, 1304, 1296, 1308,    0,
-     1297, 1299, 1298, 1305, 1307, 1301, 1305, 1308, 1317, 1318,
-     1319, 1320, 1311, 1329, 1318, 1330, 1304, 1306, 1310, 1307,
-     1311, 1312, 1313, 1321, 1322, 1308, 1326, 1323, 1319, 1325,
-     1327, 1328, 1322, 1320, 1317, 1317, 1318, 1319, 1320, 1311,
-     1329, 1325, 1330, 1328, 1331, 1321, 1323, 1332, 1326, 1333,
-     1321, 1322, 1327, 1326, 1323, 1335, 1325, 1327, 1328,    0,
-     1336, 1338, 1337, 1340,    0, 1339, 1342,    0,    0, 1341,
-     1344, 1345,    0,    0, 1332, 1331, 1333, 1339, 1348, 1338,
+     1302, 1301, 1297, 1297, 1303, 1304, 1300, 1307, 1309, 1305,
+     1308,    0, 1299, 1303, 1310, 1300, 1301, 1305, 1302, 1308,
+     1309, 1304, 1310, 1311, 1306, 1313,    0, 1316, 1318, 1317,
+     1311, 1303, 1319, 1313, 1316, 1309, 1305, 1308, 1307, 1320,
+     1322, 1310, 1324, 1323, 1319, 1325,    0, 1329, 1320,    0,
+     1311, 1323, 1313, 1317, 1316, 1318, 1317, 1330, 1331, 1319,
+     1332, 1333, 1330, 1334, 1338, 1337, 1320, 1322, 1340, 1324,
+     1323, 1334, 1325, 1329, 1329, 1335, 1331, 1337, 1339, 1341,
+     1340, 1342, 1332, 1333, 1330, 1331, 1338, 1332, 1333, 1343,
+     1334, 1338, 1337,    0, 1335, 1340, 1344, 1345, 1348, 1349,
 
-     1353, 1342, 1340, 1336, 1337, 1345, 1335, 1336, 1338, 1337,
-     1340, 1341, 1339, 1342, 1344, 1346, 1341, 1344, 1345, 1347,
-     1349, 1351, 1352, 1354, 1348, 1348, 1355, 1353, 1362, 1351,
-     1352, 1360, 1356, 1346, 1357, 1368, 1359, 1347, 1349, 1366,
-        0, 1354, 1346, 1367, 1369, 1360, 1347, 1349, 1351, 1352,
-     1354, 1356, 1370, 1355, 1359, 1362, 1357, 1365, 1360, 1356,
-     1371, 1357, 1368, 1359, 1365, 1366, 1366, 1367, 1372, 1371,
-     1367, 1369, 1373, 1374, 1375, 1378,    0, 1382, 1384, 1370,
-     1383, 1372, 1381, 1381, 1365, 1384, 1386, 1371, 1390, 1383,
-     1387,    0, 1381, 1385, 1392, 1372, 1378, 1375, 1387, 1382,
+     1339, 1351, 1335, 1350, 1352, 1339, 1341,    0, 1342,    0,
+     1357, 1354, 1355, 1353,    0,    0, 1352, 1361, 1359, 1351,
+     1343, 1358, 1349, 1344, 1345, 1350, 1349, 1355, 1351, 1348,
+     1350, 1352, 1353, 1354, 1357, 1358, 1359, 1357, 1354, 1355,
+     1353, 1360, 1362, 1361, 1361, 1359, 1364, 1366, 1358, 1365,
+     1367, 1369, 1368, 1370, 1364, 1366, 1365, 1373, 1376, 1360,
+     1362, 1371,    0, 1380, 1379, 1382, 1383, 1374, 1360, 1362,
+     1368, 1379, 1370, 1364, 1366, 1373, 1365, 1367, 1369, 1368,
+     1370, 1374, 1381, 1371, 1373, 1376, 1384, 1385, 1371, 1380,
+     1380, 1379, 1382, 1383, 1374, 1386, 1385, 1387, 1388, 1392,
 
-     1374, 1375, 1378, 1373, 1382, 1384, 1385, 1383, 1388, 1381,
-     1381, 1389, 1391, 1386, 1390, 1390, 1392, 1387, 1393, 1389,
-     1385, 1392, 1395, 1391, 1396, 1393, 1398, 1388, 1394, 1394,
-     1401, 1396, 1400, 1402, 1403, 1388, 1405,    0, 1389, 1391,
-     1395, 1400, 1407, 1406, 1407, 1393, 1411,    0, 1412, 1395,
-     1398, 1396, 1403, 1398, 1405, 1394, 1402, 1401, 1406, 1400,
-     1402, 1403, 1413, 1405, 1415, 1416, 1417, 1422, 1411, 1407,
-     1406, 1420, 1417, 1411, 1412, 1412, 1418, 1421, 1419, 1421,
-     1413, 1426, 1424, 1416, 1425,    0, 1415, 1419, 1427, 1413,
-     1424, 1415, 1416, 1417, 1422, 1430, 1425, 1431, 1418, 1428,
+     1389,    0, 1395, 1395, 1398,    0, 1381, 1397, 1386, 1381,
+     1396, 1398, 1395, 1384, 1385, 1400, 1397, 1402, 1406,    0,
+     1392,    0, 1386, 1389, 1404, 1388, 1392, 1389, 1387, 1395,
+     1395, 1398, 1396, 1399, 1397, 1401, 1402, 1396, 1405, 1403,
+     1406, 1407, 1400, 1401, 1402, 1406, 1399, 1403, 1407, 1405,
+     1404, 1404, 1408, 1408, 1409,    0, 1410, 1411, 1413, 1416,
+     1399, 1415, 1401, 1410, 1411, 1405, 1403, 1417, 1407, 1418,
+     1415, 1420, 1409, 1422, 1428, 1422, 1421, 1426, 1435, 1408,
+     1427, 1409, 1413, 1410, 1411, 1413, 1416, 1418, 1415, 1420,
+     1417, 1421, 1428, 1430, 1417, 1431, 1418, 1433, 1420, 1426,
 
-     1432, 1432, 1420, 1418, 1421, 1419, 1427, 1434, 1426, 1424,
-     1428, 1425, 1429, 1433, 1430, 1427, 1435, 1437, 1438, 1431,
-     1429, 1433, 1430, 1439, 1431, 1438, 1428, 1432, 1439, 1440,
-     1441, 1443, 1445, 1442, 1434, 1444, 1446, 1449, 1435, 1429,
-     1433, 1442, 1444, 1435, 1437, 1438, 1443, 1447, 1451, 1453,
-     1439, 1446,    0, 1448, 1450, 1450, 1440, 1441, 1443, 1445,
-     1442, 1448, 1444, 1446, 1450, 1454, 1456, 1457, 1449, 1447,
-     1458, 1459, 1460, 1454, 1447, 1451, 1453, 1462, 1461, 1456,
-     1448, 1450, 1450, 1464, 1466, 1467, 1471, 1470,    0, 1457,
-        0,    0, 1454, 1456, 1457, 1472, 1474, 1458, 1459, 1460,
+     1422, 1428, 1432, 1421, 1426, 1434, 1427, 1427, 1432, 1435,
+     1436, 1437, 1436, 1431, 1434, 1430, 1440, 1439, 1441, 1433,
+     1430, 1442, 1431, 1443, 1433, 1439,    0, 1444, 1440, 1432,
+     1445, 1446, 1434, 1448, 1443, 1444, 1450, 1436, 1437, 1442,
+     1447, 1447, 1451, 1440, 1439, 1441, 1453, 1449, 1442, 1445,
+     1443, 1455, 1454, 1446, 1444, 1449, 1455, 1445, 1446, 1454,
+     1448, 1456, 1457, 1450, 1451, 1459, 1461, 1447, 1458, 1451,
+     1460, 1462, 1463, 1453, 1449, 1464, 1458, 1460, 1455, 1454,
+     1459, 1465, 1467, 1464, 1469,    0, 1462,    0, 1456, 1457,
+     1466, 1466, 1459, 1461, 1463, 1458, 1470, 1460, 1462, 1463,
 
-     1461, 1483, 1488,    0, 1462, 1461, 1470, 1467, 1476, 1464,
-     1464, 1466, 1467, 1471, 1470, 1475, 1479, 1472, 1474, 1476,
-     1477, 1477, 1472, 1474, 1475, 1478, 1482, 1484, 1483, 1488,
-     1477, 1478, 1490, 1482, 1492, 1476, 1495, 1493, 1479, 1496,
-     1500,    0, 1475, 1479, 1497, 1495, 1497, 1477, 1477, 1493,
-     1484, 1499, 1478, 1482, 1484, 1490, 1498, 1499, 1501, 1490,
-     1503, 1492, 1500, 1495, 1493, 1502, 1496, 1500, 1498, 1505,
-     1507, 1497, 1510, 1502, 1509, 1512,    0, 1513, 1499,    0,
-     1501, 1514, 1516, 1498, 1517, 1501, 1515, 1503, 1523, 1509,
-     1513, 1516, 1502, 1521, 1515, 1517, 1505, 1507, 1510, 1510,
+     1466, 1472, 1464, 1473, 1470, 1474, 1475, 1476,    0, 1467,
+     1479, 1469, 1465, 1477, 1472, 1481, 1483, 1466, 1466, 1487,
+     1488,    0, 1484, 1470,    0, 1473, 1489, 1492, 1472, 1491,
+     1473,    0, 1474, 1475, 1476, 1477, 1492, 1479, 1487, 1493,
+     1477, 1481, 1481, 1483, 1484, 1500, 1487, 1488, 1489, 1484,
+     1493, 1491, 1496, 1489, 1492, 1495, 1491, 1494, 1494, 1505,
+     1501, 1495, 1499, 1509, 1510, 1507, 1493, 1494, 1512, 1499,
+     1513, 1514, 1500, 1514, 1496,    0, 1510, 1512, 1520, 1496,
+     1517, 1515, 1495, 1501, 1494, 1494, 1505, 1501, 1507, 1499,
+     1509, 1510, 1507, 1515, 1516, 1512, 1518, 1513, 1514, 1522,
 
-     1522, 1509, 1523, 1514, 1513, 1525, 1512, 1522, 1514, 1516,
-     1524, 1517, 1526, 1515, 1525, 1523, 1521, 1527, 1524, 1527,
-     1521, 1528, 1529, 1526, 1530, 1531, 1534, 1522, 1532, 1533,
-     1535, 1533, 1525, 1528, 1540, 1539, 1541, 1524, 1534, 1526,
-        0, 1536, 1530, 1539, 1527, 1538, 1542, 1531, 1528, 1529,
-     1532, 1530, 1531, 1534, 1536, 1532, 1533, 1538, 1544, 1542,
-     1543, 1535, 1539, 1545, 1547, 1540, 1544, 1541, 1536, 1546,
-     1548, 1549, 1538, 1542, 1543, 1558, 1545, 1546, 1547, 1549,
-     1550, 1551,    0, 1553, 1548, 1544, 1552, 1543,    0, 1554,
-     1545, 1547, 1555, 1556, 1552, 1559, 1546, 1548, 1549, 1563,
+     1516, 1519, 1517, 1524, 1526, 1520, 1527, 1517, 1515, 1519,
+     1529, 1530, 1531, 1533,    0,    0, 1534, 1532, 1518, 1526,
+        0, 1516, 1533, 1518, 1530, 1532, 1522, 1534, 1519, 1538,
+     1524, 1526, 1527, 1527, 1531, 1539, 1540, 1541, 1530, 1531,
+     1533, 1529, 1539, 1534, 1532, 1541, 1542, 1543, 1545, 1544,
+     1540, 1544, 1538, 1546, 1547, 1542, 1538, 1548, 1543, 1551,
+     1545, 1549, 1539, 1540, 1541, 1550, 1552, 1550, 1557, 1553,
+     1558, 1551, 1547, 1542, 1543, 1545, 1544, 1555, 1559, 1548,
+     1546, 1547, 1553, 1549, 1548, 1556, 1551, 1561, 1549, 1555,
+     1562, 1559, 1550, 1556, 1560, 1561, 1553, 1552, 1563, 1557,
 
-        0, 1560, 1550, 1551, 1557,    0, 1558, 1550, 1551, 1553,
-     1553, 1554, 1557, 1552, 1555, 1556, 1554, 1561, 1562, 1555,
-     1556, 1560, 1559, 1565, 1564, 1561, 1562, 1567, 1560, 1570,
-     1563, 1557, 1564, 1568, 1569,    0, 1571, 1565, 1574, 1573,
-        0, 1568, 1569, 1570, 1561, 1562, 1572, 1573, 1575, 1567,
-     1565, 1564, 1577, 1579, 1567, 1576, 1570,    0, 1580, 1578,
-     1568, 1569, 1571, 1571, 1574, 1574, 1573, 1578, 1572, 1581,
-     1583, 1586, 1577, 1572, 1575, 1575, 1582, 1576, 1580, 1577,
-     1579,    0, 1576, 1584, 1582, 1580, 1578, 1587, 1594, 1581,
-     1590, 1584, 1583, 1586, 1588, 1596, 1581, 1583, 1586, 1589,
+     1567, 1558, 1564, 1562, 1555, 1559, 1563, 1566, 1560, 1565,
+     1568, 1569, 1556, 1570, 1561, 1566, 1564, 1562, 1575, 1569,
+     1571, 1560, 1567, 1565, 1572, 1563, 1573, 1567, 1576, 1564,
+     1577,    0, 1568, 1574, 1566, 1578, 1565, 1568, 1569, 1570,
+     1570, 1574, 1571, 1578, 1579, 1580, 1572, 1571, 1573, 1575,
+     1577, 1572, 1579, 1573, 1582, 1576, 1581, 1577, 1584, 1585,
+     1574, 1586, 1578, 1587, 1581, 1588, 1590, 1585, 1582, 1586,
+     1591, 1579, 1589, 1593, 1590, 1592, 1580, 1587, 1594, 1595,
+     1584, 1582, 1596, 1581, 1597, 1584, 1585, 1595, 1586,    0,
+     1587, 1588, 1588, 1590, 1589, 1593, 1591, 1591, 1594, 1589,
 
-     1591, 1597, 1588, 1582, 1592,    0, 1593, 1589, 1591, 1587,
-     1584,    0, 1592, 1600, 1587, 1594, 1590, 1590, 1595, 1598,
-     1603, 1588, 1596, 1606, 1607,    0, 1589, 1591, 1597, 1604,
-        0, 1592, 1593, 1593,    0, 1600, 1605, 1604, 1595, 1598,
-     1600,    0, 1603,    0, 1605, 1595, 1598, 1603,    0,    0,
-     1606, 1607,    0,    0,    0,    0, 1604,    0,    0,    0,
-        0,    0,    0, 1605, 1611, 1611, 1611, 1611, 1611, 1611,
-     1611, 1612, 1612, 1612, 1612, 1612, 1612, 1612, 1613, 1613,
-     1613, 1613, 1613, 1613, 1613, 1614, 1614, 1614, 1614, 1614,
-     1614, 1614, 1615, 1615, 1615, 1615, 1615, 1615, 1615, 1617,
+     1593, 1592, 1592, 1598, 1597, 1594, 1595, 1599, 1601, 1596,
+     1600, 1597,    0, 1605, 1603, 1599, 1601, 1604, 1606,    0,
+     1607, 1605, 1610, 1598, 1611, 1608, 1606, 1613, 1614,    0,
+     1598,    0, 1600, 1608, 1599, 1601, 1603, 1600, 1612, 1604,
+     1605, 1603, 1609, 1615, 1604, 1606, 1607, 1607, 1610, 1610,
+     1609, 1611, 1608, 1617, 1613, 1614, 1620, 1623, 1612, 1621,
+     1622, 1624,    0, 1615,    0, 1612,    0, 1621, 1622, 1609,
+     1615,    0,    0,    0,    0, 1617,    0,    0, 1620,    0,
+     1617,    0,    0, 1620, 1623,    0, 1621, 1622, 1624, 1628,
+     1628, 1628, 1628, 1628, 1628, 1628, 1629, 1629, 1629, 1629,
 
-     1617,    0, 1617, 1617, 1617, 1617, 1618, 1618,    0,    0,
-        0, 1618, 1618, 1619, 1619,    0,    0, 1619,    0, 1619,
-     1620,    0,    0,    0,    0,    0, 1620, 1621, 1621,    0,
-        0,    0, 1621, 1621, 1622,    0,    0,    0,    0,    0,
-     1622, 1623, 1623,    0, 1623, 1623, 1623, 1623, 1624, 1624,
-        0, 1624, 1624, 1624, 1624, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
+     1629, 1629, 1629, 1630, 1630, 1630, 1630, 1630, 1630, 1630,
+     1631, 1631, 1631, 1631, 1631, 1631, 1631, 1632, 1632, 1632,
+     1632, 1632, 1632, 1632, 1634, 1634,    0, 1634, 1634, 1634,
+     1634, 1635, 1635,    0,    0,    0, 1635, 1635, 1636, 1636,
+        0,    0, 1636,    0, 1636, 1637,    0,    0,    0,    0,
+        0, 1637, 1638, 1638,    0,    0,    0, 1638, 1638, 1639,
+        0,    0,    0,    0,    0, 1639, 1640, 1640,    0, 1640,
+     1640, 1640, 1640, 1641, 1641,    0, 1641, 1641, 1641, 1641,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
 
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1627, 1627, 1627, 1627, 1627, 1627
     } ;
 
 static yy_state_type yy_last_accepting_state;
@@ -2208,7 +2218,7 @@ static void config_end_include(void)
 #define YY_NO_INPUT 1
 #endif
 
-#line 2210 "<stdout>"
+#line 2220 "<stdout>"
 
 #define INITIAL 0
 #define quotedstring 1
@@ -2395,7 +2405,7 @@ YY_DECL
     
 #line 197 "util/configlexer.lex"
 
-#line 2397 "<stdout>"
+#line 2407 "<stdout>"
 
 	if ( !(yy_init) )
 		{
@@ -2454,13 +2464,13 @@ yy_match:
 			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 				{
 				yy_current_state = (int) yy_def[yy_current_state];
-				if ( yy_current_state >= 1611 )
+				if ( yy_current_state >= 1628 )
 					yy_c = yy_meta[(unsigned int) yy_c];
 				}
 			yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
 			++yy_cp;
 			}
-		while ( yy_base[yy_current_state] != 4656 );
+		while ( yy_base[yy_current_state] != 4681 );
 
 yy_find_action:
 		yy_act = yy_accept[yy_current_state];
@@ -2725,515 +2735,525 @@ YY_RULE_SETUP
 case 48:
 YY_RULE_SETUP
 #line 248 "util/configlexer.lex"
-{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
+{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
 	YY_BREAK
 case 49:
 YY_RULE_SETUP
 #line 249 "util/configlexer.lex"
-{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
+{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
 	YY_BREAK
 case 50:
 YY_RULE_SETUP
 #line 250 "util/configlexer.lex"
-{ YDVAR(1, VAR_DELAY_CLOSE) }
+{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
 	YY_BREAK
 case 51:
 YY_RULE_SETUP
 #line 251 "util/configlexer.lex"
-{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
+{ YDVAR(1, VAR_DELAY_CLOSE) }
 	YY_BREAK
 case 52:
 YY_RULE_SETUP
 #line 252 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
+{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
 	YY_BREAK
 case 53:
 YY_RULE_SETUP
 #line 253 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
+{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
 	YY_BREAK
 case 54:
 YY_RULE_SETUP
 #line 254 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_GLUE) }
+{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
 	YY_BREAK
 case 55:
 YY_RULE_SETUP
 #line 255 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
+{ YDVAR(1, VAR_HARDEN_GLUE) }
 	YY_BREAK
 case 56:
 YY_RULE_SETUP
 #line 256 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
+{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
 	YY_BREAK
 case 57:
 YY_RULE_SETUP
 #line 257 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 	YY_BREAK
 case 58:
 YY_RULE_SETUP
 #line 258 "util/configlexer.lex"
-{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
 	YY_BREAK
 case 59:
 YY_RULE_SETUP
 #line 259 "util/configlexer.lex"
-{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
+{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 	YY_BREAK
 case 60:
 YY_RULE_SETUP
 #line 260 "util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
+{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 	YY_BREAK
 case 61:
 YY_RULE_SETUP
 #line 261 "util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
+{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
 	YY_BREAK
 case 62:
 YY_RULE_SETUP
 #line 262 "util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH_KEY) }
+{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 	YY_BREAK
 case 63:
 YY_RULE_SETUP
 #line 263 "util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH) }
+{ YDVAR(1, VAR_PREFETCH_KEY) }
 	YY_BREAK
 case 64:
 YY_RULE_SETUP
 #line 264 "util/configlexer.lex"
-{ YDVAR(0, VAR_STUB_ZONE) }
+{ YDVAR(1, VAR_PREFETCH) }
 	YY_BREAK
 case 65:
 YY_RULE_SETUP
 #line 265 "util/configlexer.lex"
-{ YDVAR(1, VAR_NAME) }
+{ YDVAR(0, VAR_STUB_ZONE) }
 	YY_BREAK
 case 66:
 YY_RULE_SETUP
 #line 266 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_ADDR) }
+{ YDVAR(1, VAR_NAME) }
 	YY_BREAK
 case 67:
 YY_RULE_SETUP
 #line 267 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_HOST) }
+{ YDVAR(1, VAR_STUB_ADDR) }
 	YY_BREAK
 case 68:
 YY_RULE_SETUP
 #line 268 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_PRIME) }
+{ YDVAR(1, VAR_STUB_HOST) }
 	YY_BREAK
 case 69:
 YY_RULE_SETUP
 #line 269 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_FIRST) }
+{ YDVAR(1, VAR_STUB_PRIME) }
 	YY_BREAK
 case 70:
 YY_RULE_SETUP
 #line 270 "util/configlexer.lex"
-{ YDVAR(0, VAR_FORWARD_ZONE) }
+{ YDVAR(1, VAR_STUB_FIRST) }
 	YY_BREAK
 case 71:
 YY_RULE_SETUP
 #line 271 "util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_ADDR) }
+{ YDVAR(0, VAR_FORWARD_ZONE) }
 	YY_BREAK
 case 72:
 YY_RULE_SETUP
 #line 272 "util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_HOST) }
+{ YDVAR(1, VAR_FORWARD_ADDR) }
 	YY_BREAK
 case 73:
 YY_RULE_SETUP
 #line 273 "util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_FIRST) }
+{ YDVAR(1, VAR_FORWARD_HOST) }
 	YY_BREAK
 case 74:
 YY_RULE_SETUP
 #line 274 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
+{ YDVAR(1, VAR_FORWARD_FIRST) }
 	YY_BREAK
 case 75:
 YY_RULE_SETUP
 #line 275 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
 	YY_BREAK
 case 76:
 YY_RULE_SETUP
 #line 276 "util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
 	YY_BREAK
 case 77:
 YY_RULE_SETUP
 #line 277 "util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_IDENTITY) }
+{ YDVAR(2, VAR_ACCESS_CONTROL) }
 	YY_BREAK
 case 78:
 YY_RULE_SETUP
 #line 278 "util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_VERSION) }
+{ YDVAR(1, VAR_HIDE_IDENTITY) }
 	YY_BREAK
 case 79:
 YY_RULE_SETUP
 #line 279 "util/configlexer.lex"
-{ YDVAR(1, VAR_IDENTITY) }
+{ YDVAR(1, VAR_HIDE_VERSION) }
 	YY_BREAK
 case 80:
 YY_RULE_SETUP
 #line 280 "util/configlexer.lex"
-{ YDVAR(1, VAR_VERSION) }
+{ YDVAR(1, VAR_IDENTITY) }
 	YY_BREAK
 case 81:
 YY_RULE_SETUP
 #line 281 "util/configlexer.lex"
-{ YDVAR(1, VAR_MODULE_CONF) }
+{ YDVAR(1, VAR_VERSION) }
 	YY_BREAK
 case 82:
 YY_RULE_SETUP
 #line 282 "util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR) }
+{ YDVAR(1, VAR_MODULE_CONF) }
 	YY_BREAK
 case 83:
 YY_RULE_SETUP
 #line 283 "util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
+{ YDVAR(1, VAR_DLV_ANCHOR) }
 	YY_BREAK
 case 84:
 YY_RULE_SETUP
 #line 284 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
 	YY_BREAK
 case 85:
 YY_RULE_SETUP
 #line 285 "util/configlexer.lex"
-{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 86:
 YY_RULE_SETUP
 #line 286 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
+{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 87:
 YY_RULE_SETUP
 #line 287 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR) }
+{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
 	YY_BREAK
 case 88:
 YY_RULE_SETUP
 #line 288 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
+{ YDVAR(1, VAR_TRUST_ANCHOR) }
 	YY_BREAK
 case 89:
 YY_RULE_SETUP
 #line 289 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
+{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
 	YY_BREAK
 case 90:
 YY_RULE_SETUP
 #line 290 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
 	YY_BREAK
 case 91:
 YY_RULE_SETUP
 #line 291 "util/configlexer.lex"
-{ YDVAR(1, VAR_BOGUS_TTL) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 	YY_BREAK
 case 92:
 YY_RULE_SETUP
 #line 292 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
+{ YDVAR(1, VAR_BOGUS_TTL) }
 	YY_BREAK
 case 93:
 YY_RULE_SETUP
 #line 293 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 	YY_BREAK
 case 94:
 YY_RULE_SETUP
 #line 294 "util/configlexer.lex"
-{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
+{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
 	YY_BREAK
 case 95:
 YY_RULE_SETUP
 #line 295 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
+{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
 	YY_BREAK
 case 96:
 YY_RULE_SETUP
 #line 296 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
+{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 	YY_BREAK
 case 97:
 YY_RULE_SETUP
 #line 297 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
+{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 	YY_BREAK
 case 98:
 YY_RULE_SETUP
 #line 298 "util/configlexer.lex"
-{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
+{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 	YY_BREAK
 case 99:
 YY_RULE_SETUP
 #line 299 "util/configlexer.lex"
-{ 
-				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
+{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
 	YY_BREAK
 case 100:
 YY_RULE_SETUP
-#line 301 "util/configlexer.lex"
-{ YDVAR(1, VAR_ADD_HOLDDOWN) }
+#line 300 "util/configlexer.lex"
+{ 
+				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 	YY_BREAK
 case 101:
 YY_RULE_SETUP
 #line 302 "util/configlexer.lex"
-{ YDVAR(1, VAR_DEL_HOLDDOWN) }
+{ YDVAR(1, VAR_ADD_HOLDDOWN) }
 	YY_BREAK
 case 102:
 YY_RULE_SETUP
 #line 303 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEEP_MISSING) }
+{ YDVAR(1, VAR_DEL_HOLDDOWN) }
 	YY_BREAK
 case 103:
 YY_RULE_SETUP
 #line 304 "util/configlexer.lex"
-{ YDVAR(1, VAR_USE_SYSLOG) }
+{ YDVAR(1, VAR_KEEP_MISSING) }
 	YY_BREAK
 case 104:
 YY_RULE_SETUP
 #line 305 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_TIME_ASCII) }
+{ YDVAR(1, VAR_USE_SYSLOG) }
 	YY_BREAK
 case 105:
 YY_RULE_SETUP
 #line 306 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_QUERIES) }
+{ YDVAR(1, VAR_LOG_TIME_ASCII) }
 	YY_BREAK
 case 106:
 YY_RULE_SETUP
 #line 307 "util/configlexer.lex"
-{ YDVAR(2, VAR_LOCAL_ZONE) }
+{ YDVAR(1, VAR_LOG_QUERIES) }
 	YY_BREAK
 case 107:
 YY_RULE_SETUP
 #line 308 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA) }
+{ YDVAR(2, VAR_LOCAL_ZONE) }
 	YY_BREAK
 case 108:
 YY_RULE_SETUP
 #line 309 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
+{ YDVAR(1, VAR_LOCAL_DATA) }
 	YY_BREAK
 case 109:
 YY_RULE_SETUP
 #line 310 "util/configlexer.lex"
-{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
+{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
 	YY_BREAK
 case 110:
 YY_RULE_SETUP
 #line 311 "util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
+{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
 	YY_BREAK
 case 111:
 YY_RULE_SETUP
 #line 312 "util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
+{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
 	YY_BREAK
 case 112:
 YY_RULE_SETUP
 #line 313 "util/configlexer.lex"
-{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
+{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
 	YY_BREAK
 case 113:
 YY_RULE_SETUP
 #line 314 "util/configlexer.lex"
-{ YDVAR(0, VAR_REMOTE_CONTROL) }
+{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
 	YY_BREAK
 case 114:
 YY_RULE_SETUP
 #line 315 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_ENABLE) }
+{ YDVAR(0, VAR_REMOTE_CONTROL) }
 	YY_BREAK
 case 115:
 YY_RULE_SETUP
 #line 316 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_INTERFACE) }
+{ YDVAR(1, VAR_CONTROL_ENABLE) }
 	YY_BREAK
 case 116:
 YY_RULE_SETUP
 #line 317 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_PORT) }
+{ YDVAR(1, VAR_CONTROL_INTERFACE) }
 	YY_BREAK
 case 117:
 YY_RULE_SETUP
 #line 318 "util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_KEY_FILE) }
+{ YDVAR(1, VAR_CONTROL_PORT) }
 	YY_BREAK
 case 118:
 YY_RULE_SETUP
 #line 319 "util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_CERT_FILE) }
+{ YDVAR(1, VAR_CONTROL_USE_CERT) }
 	YY_BREAK
 case 119:
 YY_RULE_SETUP
 #line 320 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
+{ YDVAR(1, VAR_SERVER_KEY_FILE) }
 	YY_BREAK
 case 120:
 YY_RULE_SETUP
 #line 321 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
+{ YDVAR(1, VAR_SERVER_CERT_FILE) }
 	YY_BREAK
 case 121:
 YY_RULE_SETUP
 #line 322 "util/configlexer.lex"
-{ YDVAR(1, VAR_PYTHON_SCRIPT) }
+{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
 	YY_BREAK
 case 122:
 YY_RULE_SETUP
 #line 323 "util/configlexer.lex"
-{ YDVAR(0, VAR_PYTHON) }
+{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
 	YY_BREAK
 case 123:
 YY_RULE_SETUP
 #line 324 "util/configlexer.lex"
-{ YDVAR(1, VAR_DOMAIN_INSECURE) }
+{ YDVAR(1, VAR_PYTHON_SCRIPT) }
 	YY_BREAK
 case 124:
 YY_RULE_SETUP
 #line 325 "util/configlexer.lex"
-{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
+{ YDVAR(0, VAR_PYTHON) }
 	YY_BREAK
 case 125:
 YY_RULE_SETUP
 #line 326 "util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
+{ YDVAR(1, VAR_DOMAIN_INSECURE) }
 	YY_BREAK
 case 126:
 YY_RULE_SETUP
 #line 327 "util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_UDP_SIZE) }
+{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
 	YY_BREAK
 case 127:
 YY_RULE_SETUP
 #line 328 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_PREFIX) }
+{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
 	YY_BREAK
 case 128:
 YY_RULE_SETUP
 #line 329 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_SYNTHALL) }
+{ YDVAR(1, VAR_MAX_UDP_SIZE) }
 	YY_BREAK
 case 129:
 YY_RULE_SETUP
 #line 330 "util/configlexer.lex"
-{ YDVAR(0, VAR_DNSTAP) }
+{ YDVAR(1, VAR_DNS64_PREFIX) }
 	YY_BREAK
 case 130:
 YY_RULE_SETUP
 #line 331 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_ENABLE) }
+{ YDVAR(1, VAR_DNS64_SYNTHALL) }
 	YY_BREAK
 case 131:
 YY_RULE_SETUP
 #line 332 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
+{ YDVAR(0, VAR_DNSTAP) }
 	YY_BREAK
 case 132:
 YY_RULE_SETUP
 #line 333 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
+{ YDVAR(1, VAR_DNSTAP_ENABLE) }
 	YY_BREAK
 case 133:
 YY_RULE_SETUP
 #line 334 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
+{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
 	YY_BREAK
 case 134:
 YY_RULE_SETUP
 #line 335 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
+{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
 	YY_BREAK
 case 135:
 YY_RULE_SETUP
 #line 336 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_VERSION) }
+{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
 	YY_BREAK
 case 136:
 YY_RULE_SETUP
 #line 337 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
+{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
 	YY_BREAK
 case 137:
 YY_RULE_SETUP
-#line 339 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
+#line 338 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_VERSION) }
 	YY_BREAK
 case 138:
 YY_RULE_SETUP
-#line 341 "util/configlexer.lex"
+#line 339 "util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
 	YY_BREAK
 case 139:
 YY_RULE_SETUP
-#line 343 "util/configlexer.lex"
+#line 341 "util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
 	YY_BREAK
 case 140:
 YY_RULE_SETUP
-#line 345 "util/configlexer.lex"
+#line 343 "util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
 	YY_BREAK
 case 141:
 YY_RULE_SETUP
+#line 345 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+	YY_BREAK
+case 142:
+YY_RULE_SETUP
 #line 347 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+	YY_BREAK
+case 143:
+YY_RULE_SETUP
+#line 349 "util/configlexer.lex"
 {
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
 	YY_BREAK
-case 142:
-/* rule 142 can match eol */
+case 144:
+/* rule 144 can match eol */
 YY_RULE_SETUP
-#line 349 "util/configlexer.lex"
+#line 351 "util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++; }
 	YY_BREAK
 /* Quoted strings. Strip leading and ending quotes */
-case 143:
+case 145:
 YY_RULE_SETUP
-#line 352 "util/configlexer.lex"
+#line 354 "util/configlexer.lex"
 { BEGIN(quotedstring); LEXOUT(("QS ")); }
 	YY_BREAK
 case YY_STATE_EOF(quotedstring):
-#line 353 "util/configlexer.lex"
+#line 355 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 144:
+case 146:
 YY_RULE_SETUP
-#line 358 "util/configlexer.lex"
+#line 360 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 145:
-/* rule 145 can match eol */
+case 147:
+/* rule 147 can match eol */
 YY_RULE_SETUP
-#line 359 "util/configlexer.lex"
+#line 361 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end \""); 
 			  cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 146:
+case 148:
 YY_RULE_SETUP
-#line 361 "util/configlexer.lex"
+#line 363 "util/configlexer.lex"
 {
         LEXOUT(("QE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -3246,34 +3266,34 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* Single Quoted strings. Strip leading and ending quotes */
-case 147:
+case 149:
 YY_RULE_SETUP
-#line 373 "util/configlexer.lex"
+#line 375 "util/configlexer.lex"
 { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
 	YY_BREAK
 case YY_STATE_EOF(singlequotedstr):
-#line 374 "util/configlexer.lex"
+#line 376 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 148:
+case 150:
 YY_RULE_SETUP
-#line 379 "util/configlexer.lex"
+#line 381 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 149:
-/* rule 149 can match eol */
+case 151:
+/* rule 151 can match eol */
 YY_RULE_SETUP
-#line 380 "util/configlexer.lex"
+#line 382 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end '"); 
 			     cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 150:
+case 152:
 YY_RULE_SETUP
-#line 382 "util/configlexer.lex"
+#line 384 "util/configlexer.lex"
 {
         LEXOUT(("SQE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -3286,38 +3306,38 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* include: directive */
-case 151:
+case 153:
 YY_RULE_SETUP
-#line 394 "util/configlexer.lex"
+#line 396 "util/configlexer.lex"
 { 
 	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
 	YY_BREAK
 case YY_STATE_EOF(include):
-#line 396 "util/configlexer.lex"
+#line 398 "util/configlexer.lex"
 {
         yyerror("EOF inside include directive");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 152:
-YY_RULE_SETUP
-#line 400 "util/configlexer.lex"
-{ LEXOUT(("ISP ")); /* ignore */ }
-	YY_BREAK
-case 153:
-/* rule 153 can match eol */
-YY_RULE_SETUP
-#line 401 "util/configlexer.lex"
-{ LEXOUT(("NL\n")); cfg_parser->line++;}
-	YY_BREAK
 case 154:
 YY_RULE_SETUP
 #line 402 "util/configlexer.lex"
-{ LEXOUT(("IQS ")); BEGIN(include_quoted); }
+{ LEXOUT(("ISP ")); /* ignore */ }
 	YY_BREAK
 case 155:
+/* rule 155 can match eol */
 YY_RULE_SETUP
 #line 403 "util/configlexer.lex"
+{ LEXOUT(("NL\n")); cfg_parser->line++;}
+	YY_BREAK
+case 156:
+YY_RULE_SETUP
+#line 404 "util/configlexer.lex"
+{ LEXOUT(("IQS ")); BEGIN(include_quoted); }
+	YY_BREAK
+case 157:
+YY_RULE_SETUP
+#line 405 "util/configlexer.lex"
 {
 	LEXOUT(("Iunquotedstr(%s) ", yytext));
 	config_start_include_glob(yytext);
@@ -3325,27 +3345,27 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 case YY_STATE_EOF(include_quoted):
-#line 408 "util/configlexer.lex"
+#line 410 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 156:
+case 158:
 YY_RULE_SETUP
-#line 412 "util/configlexer.lex"
+#line 414 "util/configlexer.lex"
 { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 157:
-/* rule 157 can match eol */
+case 159:
+/* rule 159 can match eol */
 YY_RULE_SETUP
-#line 413 "util/configlexer.lex"
+#line 415 "util/configlexer.lex"
 { yyerror("newline before \" in include name"); 
 				  cfg_parser->line++; BEGIN(inc_prev); }
 	YY_BREAK
-case 158:
+case 160:
 YY_RULE_SETUP
-#line 415 "util/configlexer.lex"
+#line 417 "util/configlexer.lex"
 {
 	LEXOUT(("IQE "));
 	yytext[yyleng - 1] = '\0';
@@ -3355,7 +3375,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case YY_STATE_EOF(INITIAL):
 case YY_STATE_EOF(val):
-#line 421 "util/configlexer.lex"
+#line 423 "util/configlexer.lex"
 {
 	LEXOUT(("LEXEOF "));
 	yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
@@ -3367,33 +3387,33 @@ case YY_STATE_EOF(val):
 	}
 }
 	YY_BREAK
-case 159:
+case 161:
 YY_RULE_SETUP
-#line 432 "util/configlexer.lex"
+#line 434 "util/configlexer.lex"
 { LEXOUT(("unquotedstr(%s) ", yytext)); 
 			if(--num_args == 0) { BEGIN(INITIAL); }
 			yylval.str = strdup(yytext); return STRING_ARG; }
 	YY_BREAK
-case 160:
+case 162:
 YY_RULE_SETUP
-#line 436 "util/configlexer.lex"
+#line 438 "util/configlexer.lex"
 {
 	ub_c_error_msg("unknown keyword '%s'", yytext);
 	}
 	YY_BREAK
-case 161:
+case 163:
 YY_RULE_SETUP
-#line 440 "util/configlexer.lex"
+#line 442 "util/configlexer.lex"
 {
 	ub_c_error_msg("stray '%s'", yytext);
 	}
 	YY_BREAK
-case 162:
+case 164:
 YY_RULE_SETUP
-#line 444 "util/configlexer.lex"
+#line 446 "util/configlexer.lex"
 ECHO;
 	YY_BREAK
-#line 3395 "<stdout>"
+#line 3415 "<stdout>"
 
 	case YY_END_OF_BUFFER:
 		{
@@ -3683,7 +3703,7 @@ static int yy_get_next_buffer (void)
 		while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 			{
 			yy_current_state = (int) yy_def[yy_current_state];
-			if ( yy_current_state >= 1611 )
+			if ( yy_current_state >= 1628 )
 				yy_c = yy_meta[(unsigned int) yy_c];
 			}
 		yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
@@ -3711,11 +3731,11 @@ static int yy_get_next_buffer (void)
 	while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 		{
 		yy_current_state = (int) yy_def[yy_current_state];
-		if ( yy_current_state >= 1611 )
+		if ( yy_current_state >= 1628 )
 			yy_c = yy_meta[(unsigned int) yy_c];
 		}
 	yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
-	yy_is_jam = (yy_current_state == 1610);
+	yy_is_jam = (yy_current_state == 1627);
 
 		return yy_is_jam ? 0 : yy_current_state;
 }
@@ -4348,7 +4368,7 @@ void yyfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 444 "util/configlexer.lex"
+#line 446 "util/configlexer.lex"
 
 
 
diff --git a/util/configlexer.lex b/util/configlexer.lex
index eea1b858400c..dbde8113c491 100644
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -245,6 +245,7 @@ infra-lame-ttl{COLON}		{ YDVAR(1, VAR_INFRA_LAME_TTL) }
 infra-cache-slabs{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
 infra-cache-numhosts{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
 infra-cache-lame-size{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
+infra-cache-min-rtt{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
 num-queries-per-thread{COLON}	{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
 jostle-timeout{COLON}		{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
 delay-close{COLON}		{ YDVAR(1, VAR_DELAY_CLOSE) }
diff --git a/util/configparser.c b/util/configparser.c
index 6aa5646fad57..0d7328f873a9 100644
--- a/util/configparser.c
+++ b/util/configparser.c
@@ -220,59 +220,61 @@ extern int yydebug;
      VAR_SERVER_CERT_FILE = 348,
      VAR_CONTROL_KEY_FILE = 349,
      VAR_CONTROL_CERT_FILE = 350,
-     VAR_EXTENDED_STATISTICS = 351,
-     VAR_LOCAL_DATA_PTR = 352,
-     VAR_JOSTLE_TIMEOUT = 353,
-     VAR_STUB_PRIME = 354,
-     VAR_UNWANTED_REPLY_THRESHOLD = 355,
-     VAR_LOG_TIME_ASCII = 356,
-     VAR_DOMAIN_INSECURE = 357,
-     VAR_PYTHON = 358,
-     VAR_PYTHON_SCRIPT = 359,
-     VAR_VAL_SIG_SKEW_MIN = 360,
-     VAR_VAL_SIG_SKEW_MAX = 361,
-     VAR_CACHE_MIN_TTL = 362,
-     VAR_VAL_LOG_LEVEL = 363,
-     VAR_AUTO_TRUST_ANCHOR_FILE = 364,
-     VAR_KEEP_MISSING = 365,
-     VAR_ADD_HOLDDOWN = 366,
-     VAR_DEL_HOLDDOWN = 367,
-     VAR_SO_RCVBUF = 368,
-     VAR_EDNS_BUFFER_SIZE = 369,
-     VAR_PREFETCH = 370,
-     VAR_PREFETCH_KEY = 371,
-     VAR_SO_SNDBUF = 372,
-     VAR_SO_REUSEPORT = 373,
-     VAR_HARDEN_BELOW_NXDOMAIN = 374,
-     VAR_IGNORE_CD_FLAG = 375,
-     VAR_LOG_QUERIES = 376,
-     VAR_TCP_UPSTREAM = 377,
-     VAR_SSL_UPSTREAM = 378,
-     VAR_SSL_SERVICE_KEY = 379,
-     VAR_SSL_SERVICE_PEM = 380,
-     VAR_SSL_PORT = 381,
-     VAR_FORWARD_FIRST = 382,
-     VAR_STUB_FIRST = 383,
-     VAR_MINIMAL_RESPONSES = 384,
-     VAR_RRSET_ROUNDROBIN = 385,
-     VAR_MAX_UDP_SIZE = 386,
-     VAR_DELAY_CLOSE = 387,
-     VAR_UNBLOCK_LAN_ZONES = 388,
-     VAR_DNS64_PREFIX = 389,
-     VAR_DNS64_SYNTHALL = 390,
-     VAR_DNSTAP = 391,
-     VAR_DNSTAP_ENABLE = 392,
-     VAR_DNSTAP_SOCKET_PATH = 393,
-     VAR_DNSTAP_SEND_IDENTITY = 394,
-     VAR_DNSTAP_SEND_VERSION = 395,
-     VAR_DNSTAP_IDENTITY = 396,
-     VAR_DNSTAP_VERSION = 397,
-     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 398,
-     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 399,
-     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 400,
-     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 401,
-     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 402,
-     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 403
+     VAR_CONTROL_USE_CERT = 351,
+     VAR_EXTENDED_STATISTICS = 352,
+     VAR_LOCAL_DATA_PTR = 353,
+     VAR_JOSTLE_TIMEOUT = 354,
+     VAR_STUB_PRIME = 355,
+     VAR_UNWANTED_REPLY_THRESHOLD = 356,
+     VAR_LOG_TIME_ASCII = 357,
+     VAR_DOMAIN_INSECURE = 358,
+     VAR_PYTHON = 359,
+     VAR_PYTHON_SCRIPT = 360,
+     VAR_VAL_SIG_SKEW_MIN = 361,
+     VAR_VAL_SIG_SKEW_MAX = 362,
+     VAR_CACHE_MIN_TTL = 363,
+     VAR_VAL_LOG_LEVEL = 364,
+     VAR_AUTO_TRUST_ANCHOR_FILE = 365,
+     VAR_KEEP_MISSING = 366,
+     VAR_ADD_HOLDDOWN = 367,
+     VAR_DEL_HOLDDOWN = 368,
+     VAR_SO_RCVBUF = 369,
+     VAR_EDNS_BUFFER_SIZE = 370,
+     VAR_PREFETCH = 371,
+     VAR_PREFETCH_KEY = 372,
+     VAR_SO_SNDBUF = 373,
+     VAR_SO_REUSEPORT = 374,
+     VAR_HARDEN_BELOW_NXDOMAIN = 375,
+     VAR_IGNORE_CD_FLAG = 376,
+     VAR_LOG_QUERIES = 377,
+     VAR_TCP_UPSTREAM = 378,
+     VAR_SSL_UPSTREAM = 379,
+     VAR_SSL_SERVICE_KEY = 380,
+     VAR_SSL_SERVICE_PEM = 381,
+     VAR_SSL_PORT = 382,
+     VAR_FORWARD_FIRST = 383,
+     VAR_STUB_FIRST = 384,
+     VAR_MINIMAL_RESPONSES = 385,
+     VAR_RRSET_ROUNDROBIN = 386,
+     VAR_MAX_UDP_SIZE = 387,
+     VAR_DELAY_CLOSE = 388,
+     VAR_UNBLOCK_LAN_ZONES = 389,
+     VAR_INFRA_CACHE_MIN_RTT = 390,
+     VAR_DNS64_PREFIX = 391,
+     VAR_DNS64_SYNTHALL = 392,
+     VAR_DNSTAP = 393,
+     VAR_DNSTAP_ENABLE = 394,
+     VAR_DNSTAP_SOCKET_PATH = 395,
+     VAR_DNSTAP_SEND_IDENTITY = 396,
+     VAR_DNSTAP_SEND_VERSION = 397,
+     VAR_DNSTAP_IDENTITY = 398,
+     VAR_DNSTAP_VERSION = 399,
+     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 400,
+     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 401,
+     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 402,
+     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 403,
+     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 404,
+     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405
    };
 #endif
 /* Tokens.  */
@@ -369,59 +371,61 @@ extern int yydebug;
 #define VAR_SERVER_CERT_FILE 348
 #define VAR_CONTROL_KEY_FILE 349
 #define VAR_CONTROL_CERT_FILE 350
-#define VAR_EXTENDED_STATISTICS 351
-#define VAR_LOCAL_DATA_PTR 352
-#define VAR_JOSTLE_TIMEOUT 353
-#define VAR_STUB_PRIME 354
-#define VAR_UNWANTED_REPLY_THRESHOLD 355
-#define VAR_LOG_TIME_ASCII 356
-#define VAR_DOMAIN_INSECURE 357
-#define VAR_PYTHON 358
-#define VAR_PYTHON_SCRIPT 359
-#define VAR_VAL_SIG_SKEW_MIN 360
-#define VAR_VAL_SIG_SKEW_MAX 361
-#define VAR_CACHE_MIN_TTL 362
-#define VAR_VAL_LOG_LEVEL 363
-#define VAR_AUTO_TRUST_ANCHOR_FILE 364
-#define VAR_KEEP_MISSING 365
-#define VAR_ADD_HOLDDOWN 366
-#define VAR_DEL_HOLDDOWN 367
-#define VAR_SO_RCVBUF 368
-#define VAR_EDNS_BUFFER_SIZE 369
-#define VAR_PREFETCH 370
-#define VAR_PREFETCH_KEY 371
-#define VAR_SO_SNDBUF 372
-#define VAR_SO_REUSEPORT 373
-#define VAR_HARDEN_BELOW_NXDOMAIN 374
-#define VAR_IGNORE_CD_FLAG 375
-#define VAR_LOG_QUERIES 376
-#define VAR_TCP_UPSTREAM 377
-#define VAR_SSL_UPSTREAM 378
-#define VAR_SSL_SERVICE_KEY 379
-#define VAR_SSL_SERVICE_PEM 380
-#define VAR_SSL_PORT 381
-#define VAR_FORWARD_FIRST 382
-#define VAR_STUB_FIRST 383
-#define VAR_MINIMAL_RESPONSES 384
-#define VAR_RRSET_ROUNDROBIN 385
-#define VAR_MAX_UDP_SIZE 386
-#define VAR_DELAY_CLOSE 387
-#define VAR_UNBLOCK_LAN_ZONES 388
-#define VAR_DNS64_PREFIX 389
-#define VAR_DNS64_SYNTHALL 390
-#define VAR_DNSTAP 391
-#define VAR_DNSTAP_ENABLE 392
-#define VAR_DNSTAP_SOCKET_PATH 393
-#define VAR_DNSTAP_SEND_IDENTITY 394
-#define VAR_DNSTAP_SEND_VERSION 395
-#define VAR_DNSTAP_IDENTITY 396
-#define VAR_DNSTAP_VERSION 397
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 398
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 399
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 400
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 401
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 402
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 403
+#define VAR_CONTROL_USE_CERT 351
+#define VAR_EXTENDED_STATISTICS 352
+#define VAR_LOCAL_DATA_PTR 353
+#define VAR_JOSTLE_TIMEOUT 354
+#define VAR_STUB_PRIME 355
+#define VAR_UNWANTED_REPLY_THRESHOLD 356
+#define VAR_LOG_TIME_ASCII 357
+#define VAR_DOMAIN_INSECURE 358
+#define VAR_PYTHON 359
+#define VAR_PYTHON_SCRIPT 360
+#define VAR_VAL_SIG_SKEW_MIN 361
+#define VAR_VAL_SIG_SKEW_MAX 362
+#define VAR_CACHE_MIN_TTL 363
+#define VAR_VAL_LOG_LEVEL 364
+#define VAR_AUTO_TRUST_ANCHOR_FILE 365
+#define VAR_KEEP_MISSING 366
+#define VAR_ADD_HOLDDOWN 367
+#define VAR_DEL_HOLDDOWN 368
+#define VAR_SO_RCVBUF 369
+#define VAR_EDNS_BUFFER_SIZE 370
+#define VAR_PREFETCH 371
+#define VAR_PREFETCH_KEY 372
+#define VAR_SO_SNDBUF 373
+#define VAR_SO_REUSEPORT 374
+#define VAR_HARDEN_BELOW_NXDOMAIN 375
+#define VAR_IGNORE_CD_FLAG 376
+#define VAR_LOG_QUERIES 377
+#define VAR_TCP_UPSTREAM 378
+#define VAR_SSL_UPSTREAM 379
+#define VAR_SSL_SERVICE_KEY 380
+#define VAR_SSL_SERVICE_PEM 381
+#define VAR_SSL_PORT 382
+#define VAR_FORWARD_FIRST 383
+#define VAR_STUB_FIRST 384
+#define VAR_MINIMAL_RESPONSES 385
+#define VAR_RRSET_ROUNDROBIN 386
+#define VAR_MAX_UDP_SIZE 387
+#define VAR_DELAY_CLOSE 388
+#define VAR_UNBLOCK_LAN_ZONES 389
+#define VAR_INFRA_CACHE_MIN_RTT 390
+#define VAR_DNS64_PREFIX 391
+#define VAR_DNS64_SYNTHALL 392
+#define VAR_DNSTAP 393
+#define VAR_DNSTAP_ENABLE 394
+#define VAR_DNSTAP_SOCKET_PATH 395
+#define VAR_DNSTAP_SEND_IDENTITY 396
+#define VAR_DNSTAP_SEND_VERSION 397
+#define VAR_DNSTAP_IDENTITY 398
+#define VAR_DNSTAP_VERSION 399
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 400
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 401
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 402
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 403
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 404
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 405
 
 
 
@@ -435,7 +439,7 @@ typedef union YYSTYPE
 
 
 /* Line 387 of yacc.c  */
-#line 439 "util/configparser.c"
+#line 443 "util/configparser.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -463,7 +467,7 @@ int yyparse ();
 /* Copy the second part of user declarations.  */
 
 /* Line 390 of yacc.c  */
-#line 467 "util/configparser.c"
+#line 471 "util/configparser.c"
 
 #ifdef short
 # undef short
@@ -683,20 +687,20 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  2
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   276
+#define YYLAST   280
 
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  149
+#define YYNTOKENS  151
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  154
+#define YYNNTS  156
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  293
+#define YYNRULES  297
 /* YYNRULES -- Number of states.  */
-#define YYNSTATES  429
+#define YYNSTATES  435
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   403
+#define YYMAXUTOK   405
 
 #define YYTRANSLATE(YYX)						\
   ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
@@ -744,7 +748,7 @@ static const yytype_uint8 yytranslate[] =
      115,   116,   117,   118,   119,   120,   121,   122,   123,   124,
      125,   126,   127,   128,   129,   130,   131,   132,   133,   134,
      135,   136,   137,   138,   139,   140,   141,   142,   143,   144,
-     145,   146,   147,   148
+     145,   146,   147,   148,   149,   150
 };
 
 #if YYDEBUG
@@ -763,138 +767,139 @@ static const yytype_uint16 yyprhs[] =
      165,   167,   169,   171,   173,   175,   177,   179,   181,   183,
      185,   187,   189,   191,   193,   195,   197,   199,   201,   203,
      205,   207,   209,   211,   213,   215,   217,   219,   221,   223,
-     225,   227,   229,   231,   233,   235,   237,   239,   241,   244,
-     245,   247,   249,   251,   253,   255,   257,   260,   261,   263,
-     265,   267,   269,   272,   275,   278,   281,   284,   287,   290,
-     293,   296,   299,   302,   305,   308,   311,   314,   317,   320,
-     323,   326,   329,   332,   335,   338,   341,   344,   347,   350,
-     353,   356,   359,   362,   365,   368,   371,   374,   377,   380,
-     383,   386,   389,   392,   395,   398,   401,   404,   407,   410,
-     413,   416,   419,   422,   425,   428,   431,   434,   437,   440,
-     443,   446,   449,   452,   455,   458,   461,   464,   467,   470,
-     473,   476,   479,   482,   485,   488,   491,   494,   497,   500,
-     504,   507,   510,   513,   516,   519,   522,   525,   528,   531,
-     534,   537,   540,   543,   546,   549,   552,   555,   558,   562,
-     565,   568,   571,   574,   577,   580,   583,   586,   589,   592,
-     595,   598,   601,   604,   607,   610,   612,   615,   616,   618,
-     620,   622,   624,   626,   628,   630,   633,   636,   639,   642,
-     645,   648,   651,   653,   656,   657,   659,   661,   663,   665,
-     667,   669,   671,   673,   675,   677,   679,   681,   684,   687,
-     690,   693,   696,   699,   702,   705,   708,   711,   714,   717,
-     719,   722,   723,   725
+     225,   227,   229,   231,   233,   235,   237,   239,   241,   243,
+     246,   247,   249,   251,   253,   255,   257,   259,   262,   263,
+     265,   267,   269,   271,   274,   277,   280,   283,   286,   289,
+     292,   295,   298,   301,   304,   307,   310,   313,   316,   319,
+     322,   325,   328,   331,   334,   337,   340,   343,   346,   349,
+     352,   355,   358,   361,   364,   367,   370,   373,   376,   379,
+     382,   385,   388,   391,   394,   397,   400,   403,   406,   409,
+     412,   415,   418,   421,   424,   427,   430,   433,   436,   439,
+     442,   445,   448,   451,   454,   457,   460,   463,   466,   469,
+     472,   475,   478,   481,   484,   487,   490,   493,   496,   499,
+     502,   505,   509,   512,   515,   518,   521,   524,   527,   530,
+     533,   536,   539,   542,   545,   548,   551,   554,   557,   560,
+     563,   567,   570,   573,   576,   579,   582,   585,   588,   591,
+     594,   597,   600,   603,   606,   609,   612,   615,   617,   620,
+     621,   623,   625,   627,   629,   631,   633,   635,   637,   640,
+     643,   646,   649,   652,   655,   658,   661,   663,   666,   667,
+     669,   671,   673,   675,   677,   679,   681,   683,   685,   687,
+     689,   691,   694,   697,   700,   703,   706,   709,   712,   715,
+     718,   721,   724,   727,   729,   732,   733,   735
 };
 
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int16 yyrhs[] =
 {
-     150,     0,    -1,    -1,   150,   151,    -1,   152,   153,    -1,
-     155,   156,    -1,   158,   159,    -1,   299,   300,    -1,   274,
-     275,    -1,   284,   285,    -1,    11,    -1,   153,   154,    -1,
-      -1,   161,    -1,   162,    -1,   166,    -1,   169,    -1,   175,
-      -1,   176,    -1,   177,    -1,   178,    -1,   167,    -1,   188,
-      -1,   189,    -1,   190,    -1,   191,    -1,   192,    -1,   210,
-      -1,   211,    -1,   212,    -1,   216,    -1,   217,    -1,   172,
-      -1,   218,    -1,   219,    -1,   222,    -1,   220,    -1,   221,
-      -1,   223,    -1,   224,    -1,   225,    -1,   236,    -1,   201,
-      -1,   202,    -1,   203,    -1,   204,    -1,   226,    -1,   239,
-      -1,   197,    -1,   199,    -1,   240,    -1,   245,    -1,   246,
-      -1,   247,    -1,   173,    -1,   209,    -1,   254,    -1,   255,
-      -1,   198,    -1,   250,    -1,   185,    -1,   168,    -1,   193,
-      -1,   237,    -1,   243,    -1,   227,    -1,   238,    -1,   257,
-      -1,   258,    -1,   174,    -1,   163,    -1,   184,    -1,   230,
-      -1,   164,    -1,   170,    -1,   171,    -1,   194,    -1,   195,
-      -1,   256,    -1,   229,    -1,   231,    -1,   232,    -1,   165,
-      -1,   259,    -1,   213,    -1,   235,    -1,   186,    -1,   200,
-      -1,   241,    -1,   242,    -1,   244,    -1,   249,    -1,   196,
-      -1,   251,    -1,   252,    -1,   253,    -1,   205,    -1,   208,
-      -1,   233,    -1,   234,    -1,   206,    -1,   228,    -1,   248,
-      -1,   187,    -1,   179,    -1,   180,    -1,   181,    -1,   182,
-      -1,   183,    -1,   260,    -1,   261,    -1,   262,    -1,   207,
-      -1,   214,    -1,   215,    -1,   263,    -1,   264,    -1,    38,
-      -1,   156,   157,    -1,    -1,   265,    -1,   266,    -1,   267,
-      -1,   269,    -1,   268,    -1,    44,    -1,   159,   160,    -1,
-      -1,   270,    -1,   271,    -1,   272,    -1,   273,    -1,    13,
-      10,    -1,    12,    10,    -1,    76,    10,    -1,    79,    10,
-      -1,    96,    10,    -1,    14,    10,    -1,    16,    10,    -1,
-      67,    10,    -1,    15,    10,    -1,    80,    10,    -1,    81,
-      10,    -1,    31,    10,    -1,    60,    10,    -1,    75,    10,
-      -1,    17,    10,    -1,    18,    10,    -1,    19,    10,    -1,
-      20,    10,    -1,   122,    10,    -1,   123,    10,    -1,   124,
-      10,    -1,   125,    10,    -1,   126,    10,    -1,    77,    10,
-      -1,    66,    10,    -1,   101,    10,    -1,   121,    10,    -1,
-      21,    10,    -1,    22,    10,    -1,    23,    10,    -1,    24,
-      10,    -1,    25,    10,    -1,    68,    10,    -1,    82,    10,
-      -1,    83,    10,    -1,   109,    10,    -1,    54,    10,    -1,
-      64,    10,    -1,    55,    10,    -1,   102,    10,    -1,    48,
-      10,    -1,    49,    10,    -1,    50,    10,    -1,    51,    10,
-      -1,   113,    10,    -1,   117,    10,    -1,   118,    10,    -1,
-     114,    10,    -1,    61,    10,    -1,    26,    10,    -1,    27,
-      10,    -1,    28,    10,    -1,    98,    10,    -1,   132,    10,
-      -1,   133,    10,    -1,    29,    10,    -1,    30,    10,    -1,
-      32,    10,    -1,    33,    10,    -1,    35,    10,    -1,    36,
-      10,    -1,    34,    10,    -1,    41,    10,    -1,    42,    10,
-      -1,    43,    10,    -1,    52,    10,    -1,    71,    10,    -1,
-     119,    10,    -1,    85,    10,    -1,    78,    10,    -1,    86,
-      10,    -1,    87,    10,    -1,   115,    10,    -1,   116,    10,
-      -1,   100,    10,    -1,    47,    10,    -1,    69,    10,    -1,
-      72,    10,    10,    -1,    53,    10,    -1,    56,    10,    -1,
-     105,    10,    -1,   106,    10,    -1,    70,    10,    -1,   107,
-      10,    -1,    57,    10,    -1,    58,    10,    -1,    59,    10,
-      -1,   120,    10,    -1,   108,    10,    -1,    65,    10,    -1,
-     111,    10,    -1,   112,    10,    -1,   110,    10,    -1,    62,
-      10,    -1,    63,    10,    -1,    84,    10,    -1,    73,    10,
-      10,    -1,    74,    10,    -1,    97,    10,    -1,   129,    10,
-      -1,   130,    10,    -1,   131,    10,    -1,   134,    10,    -1,
-     135,    10,    -1,    37,    10,    -1,    39,    10,    -1,    40,
-      10,    -1,   128,    10,    -1,    99,    10,    -1,    37,    10,
-      -1,    45,    10,    -1,    46,    10,    -1,   127,    10,    -1,
-      88,    -1,   275,   276,    -1,    -1,   277,    -1,   279,    -1,
-     278,    -1,   280,    -1,   281,    -1,   282,    -1,   283,    -1,
-      89,    10,    -1,    91,    10,    -1,    90,    10,    -1,    92,
+     152,     0,    -1,    -1,   152,   153,    -1,   154,   155,    -1,
+     157,   158,    -1,   160,   161,    -1,   303,   304,    -1,   277,
+     278,    -1,   288,   289,    -1,    11,    -1,   155,   156,    -1,
+      -1,   163,    -1,   164,    -1,   168,    -1,   171,    -1,   177,
+      -1,   178,    -1,   179,    -1,   180,    -1,   169,    -1,   190,
+      -1,   191,    -1,   192,    -1,   193,    -1,   194,    -1,   212,
+      -1,   213,    -1,   214,    -1,   218,    -1,   219,    -1,   174,
+      -1,   220,    -1,   221,    -1,   224,    -1,   222,    -1,   223,
+      -1,   226,    -1,   227,    -1,   228,    -1,   239,    -1,   203,
+      -1,   204,    -1,   205,    -1,   206,    -1,   229,    -1,   242,
+      -1,   199,    -1,   201,    -1,   243,    -1,   248,    -1,   249,
+      -1,   250,    -1,   175,    -1,   211,    -1,   257,    -1,   258,
+      -1,   200,    -1,   253,    -1,   187,    -1,   170,    -1,   195,
+      -1,   240,    -1,   246,    -1,   230,    -1,   241,    -1,   260,
+      -1,   261,    -1,   176,    -1,   165,    -1,   186,    -1,   233,
+      -1,   166,    -1,   172,    -1,   173,    -1,   196,    -1,   197,
+      -1,   259,    -1,   232,    -1,   234,    -1,   235,    -1,   167,
+      -1,   262,    -1,   215,    -1,   238,    -1,   188,    -1,   202,
+      -1,   244,    -1,   245,    -1,   247,    -1,   252,    -1,   198,
+      -1,   254,    -1,   255,    -1,   256,    -1,   207,    -1,   210,
+      -1,   236,    -1,   237,    -1,   208,    -1,   231,    -1,   251,
+      -1,   189,    -1,   181,    -1,   182,    -1,   183,    -1,   184,
+      -1,   185,    -1,   263,    -1,   264,    -1,   265,    -1,   209,
+      -1,   216,    -1,   217,    -1,   266,    -1,   267,    -1,   225,
+      -1,    38,    -1,   158,   159,    -1,    -1,   268,    -1,   269,
+      -1,   270,    -1,   272,    -1,   271,    -1,    44,    -1,   161,
+     162,    -1,    -1,   273,    -1,   274,    -1,   275,    -1,   276,
+      -1,    13,    10,    -1,    12,    10,    -1,    76,    10,    -1,
+      79,    10,    -1,    97,    10,    -1,    14,    10,    -1,    16,
+      10,    -1,    67,    10,    -1,    15,    10,    -1,    80,    10,
+      -1,    81,    10,    -1,    31,    10,    -1,    60,    10,    -1,
+      75,    10,    -1,    17,    10,    -1,    18,    10,    -1,    19,
+      10,    -1,    20,    10,    -1,   123,    10,    -1,   124,    10,
+      -1,   125,    10,    -1,   126,    10,    -1,   127,    10,    -1,
+      77,    10,    -1,    66,    10,    -1,   102,    10,    -1,   122,
+      10,    -1,    21,    10,    -1,    22,    10,    -1,    23,    10,
+      -1,    24,    10,    -1,    25,    10,    -1,    68,    10,    -1,
+      82,    10,    -1,    83,    10,    -1,   110,    10,    -1,    54,
+      10,    -1,    64,    10,    -1,    55,    10,    -1,   103,    10,
+      -1,    48,    10,    -1,    49,    10,    -1,    50,    10,    -1,
+      51,    10,    -1,   114,    10,    -1,   118,    10,    -1,   119,
+      10,    -1,   115,    10,    -1,    61,    10,    -1,    26,    10,
+      -1,    27,    10,    -1,    28,    10,    -1,    99,    10,    -1,
+     133,    10,    -1,   134,    10,    -1,    29,    10,    -1,    30,
+      10,    -1,    32,    10,    -1,    33,    10,    -1,    35,    10,
+      -1,    36,    10,    -1,    34,    10,    -1,   135,    10,    -1,
+      41,    10,    -1,    42,    10,    -1,    43,    10,    -1,    52,
+      10,    -1,    71,    10,    -1,   120,    10,    -1,    85,    10,
+      -1,    78,    10,    -1,    86,    10,    -1,    87,    10,    -1,
+     116,    10,    -1,   117,    10,    -1,   101,    10,    -1,    47,
+      10,    -1,    69,    10,    -1,    72,    10,    10,    -1,    53,
+      10,    -1,    56,    10,    -1,   106,    10,    -1,   107,    10,
+      -1,    70,    10,    -1,   108,    10,    -1,    57,    10,    -1,
+      58,    10,    -1,    59,    10,    -1,   121,    10,    -1,   109,
+      10,    -1,    65,    10,    -1,   112,    10,    -1,   113,    10,
+      -1,   111,    10,    -1,    62,    10,    -1,    63,    10,    -1,
+      84,    10,    -1,    73,    10,    10,    -1,    74,    10,    -1,
+      98,    10,    -1,   130,    10,    -1,   131,    10,    -1,   132,
+      10,    -1,   136,    10,    -1,   137,    10,    -1,    37,    10,
+      -1,    39,    10,    -1,    40,    10,    -1,   129,    10,    -1,
+     100,    10,    -1,    37,    10,    -1,    45,    10,    -1,    46,
+      10,    -1,   128,    10,    -1,    88,    -1,   278,   279,    -1,
+      -1,   280,    -1,   282,    -1,   281,    -1,   284,    -1,   285,
+      -1,   286,    -1,   287,    -1,   283,    -1,    89,    10,    -1,
+      91,    10,    -1,    90,    10,    -1,    96,    10,    -1,    92,
       10,    -1,    93,    10,    -1,    94,    10,    -1,    95,    10,
-      -1,   136,    -1,   285,   286,    -1,    -1,   287,    -1,   288,
-      -1,   289,    -1,   290,    -1,   291,    -1,   292,    -1,   293,
-      -1,   294,    -1,   295,    -1,   296,    -1,   297,    -1,   298,
-      -1,   137,    10,    -1,   138,    10,    -1,   139,    10,    -1,
-     140,    10,    -1,   141,    10,    -1,   142,    10,    -1,   143,
-      10,    -1,   144,    10,    -1,   145,    10,    -1,   146,    10,
-      -1,   147,    10,    -1,   148,    10,    -1,   103,    -1,   300,
-     301,    -1,    -1,   302,    -1,   104,    10,    -1
+      -1,   138,    -1,   289,   290,    -1,    -1,   291,    -1,   292,
+      -1,   293,    -1,   294,    -1,   295,    -1,   296,    -1,   297,
+      -1,   298,    -1,   299,    -1,   300,    -1,   301,    -1,   302,
+      -1,   139,    10,    -1,   140,    10,    -1,   141,    10,    -1,
+     142,    10,    -1,   143,    10,    -1,   144,    10,    -1,   145,
+      10,    -1,   146,    10,    -1,   147,    10,    -1,   148,    10,
+      -1,   149,    10,    -1,   150,    10,    -1,   104,    -1,   304,
+     305,    -1,    -1,   306,    -1,   105,    10,    -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   121,   121,   121,   122,   122,   123,   123,   124,   124,
-     128,   133,   134,   135,   135,   135,   136,   136,   137,   137,
-     137,   138,   138,   138,   139,   139,   139,   140,   140,   141,
-     141,   142,   142,   143,   143,   144,   144,   145,   145,   146,
-     146,   147,   147,   148,   148,   148,   149,   149,   149,   150,
-     150,   150,   151,   151,   152,   152,   153,   153,   154,   154,
-     155,   155,   155,   156,   156,   157,   157,   158,   158,   158,
-     159,   159,   160,   160,   161,   161,   162,   162,   162,   163,
-     163,   164,   164,   165,   165,   166,   166,   167,   167,   168,
-     168,   168,   169,   169,   170,   170,   170,   171,   171,   171,
-     172,   172,   172,   173,   173,   173,   174,   174,   174,   175,
-     175,   175,   176,   176,   176,   177,   177,   179,   191,   192,
-     193,   193,   193,   193,   193,   195,   207,   208,   209,   209,
-     209,   209,   211,   220,   229,   240,   249,   258,   267,   280,
-     295,   304,   313,   322,   331,   340,   349,   358,   367,   376,
-     385,   394,   403,   410,   417,   426,   435,   449,   458,   467,
-     474,   481,   488,   496,   503,   510,   517,   524,   532,   540,
-     548,   555,   562,   571,   580,   587,   594,   602,   610,   620,
-     633,   644,   652,   665,   674,   683,   692,   702,   710,   723,
-     732,   740,   749,   757,   770,   777,   787,   797,   807,   817,
-     827,   837,   847,   854,   861,   870,   879,   888,   895,   905,
-     922,   929,   947,   960,   973,   982,   991,  1000,  1010,  1020,
-    1029,  1038,  1045,  1054,  1063,  1072,  1080,  1093,  1101,  1123,
-    1130,  1145,  1155,  1165,  1172,  1179,  1188,  1198,  1205,  1212,
-    1221,  1231,  1241,  1248,  1255,  1264,  1269,  1270,  1271,  1271,
-    1271,  1272,  1272,  1272,  1273,  1275,  1285,  1294,  1301,  1308,
-    1315,  1322,  1329,  1334,  1335,  1336,  1336,  1337,  1337,  1338,
-    1338,  1339,  1340,  1341,  1342,  1343,  1344,  1346,  1354,  1361,
-    1369,  1377,  1384,  1391,  1400,  1409,  1418,  1427,  1436,  1445,
-    1450,  1451,  1452,  1454
+       0,   123,   123,   123,   124,   124,   125,   125,   126,   126,
+     130,   135,   136,   137,   137,   137,   138,   138,   139,   139,
+     139,   140,   140,   140,   141,   141,   141,   142,   142,   143,
+     143,   144,   144,   145,   145,   146,   146,   147,   147,   148,
+     148,   149,   149,   150,   150,   150,   151,   151,   151,   152,
+     152,   152,   153,   153,   154,   154,   155,   155,   156,   156,
+     157,   157,   157,   158,   158,   159,   159,   160,   160,   160,
+     161,   161,   162,   162,   163,   163,   164,   164,   164,   165,
+     165,   166,   166,   167,   167,   168,   168,   169,   169,   170,
+     170,   170,   171,   171,   172,   172,   172,   173,   173,   173,
+     174,   174,   174,   175,   175,   175,   176,   176,   176,   177,
+     177,   177,   178,   178,   178,   179,   179,   180,   182,   194,
+     195,   196,   196,   196,   196,   196,   198,   210,   211,   212,
+     212,   212,   212,   214,   223,   232,   243,   252,   261,   270,
+     283,   298,   307,   316,   325,   334,   343,   352,   361,   370,
+     379,   388,   397,   406,   413,   420,   429,   438,   452,   461,
+     470,   477,   484,   491,   499,   506,   513,   520,   527,   535,
+     543,   551,   558,   565,   574,   583,   590,   597,   605,   613,
+     623,   636,   647,   655,   668,   677,   686,   695,   705,   713,
+     726,   735,   743,   752,   760,   773,   782,   789,   799,   809,
+     819,   829,   839,   849,   859,   866,   873,   882,   891,   900,
+     907,   917,   934,   941,   959,   972,   985,   994,  1003,  1012,
+    1022,  1032,  1041,  1050,  1057,  1066,  1075,  1084,  1092,  1105,
+    1113,  1136,  1143,  1158,  1168,  1178,  1185,  1192,  1201,  1211,
+    1218,  1225,  1234,  1244,  1254,  1261,  1268,  1277,  1282,  1283,
+    1284,  1284,  1284,  1285,  1285,  1285,  1286,  1286,  1288,  1298,
+    1307,  1314,  1324,  1331,  1338,  1345,  1352,  1357,  1358,  1359,
+    1359,  1360,  1360,  1361,  1361,  1362,  1363,  1364,  1365,  1366,
+    1367,  1369,  1377,  1384,  1392,  1400,  1407,  1414,  1423,  1432,
+    1441,  1450,  1459,  1468,  1473,  1474,  1475,  1477
 };
 #endif
 
@@ -933,22 +938,23 @@ static const char *const yytname[] =
   "VAR_PRIVATE_DOMAIN", "VAR_REMOTE_CONTROL", "VAR_CONTROL_ENABLE",
   "VAR_CONTROL_INTERFACE", "VAR_CONTROL_PORT", "VAR_SERVER_KEY_FILE",
   "VAR_SERVER_CERT_FILE", "VAR_CONTROL_KEY_FILE", "VAR_CONTROL_CERT_FILE",
-  "VAR_EXTENDED_STATISTICS", "VAR_LOCAL_DATA_PTR", "VAR_JOSTLE_TIMEOUT",
-  "VAR_STUB_PRIME", "VAR_UNWANTED_REPLY_THRESHOLD", "VAR_LOG_TIME_ASCII",
-  "VAR_DOMAIN_INSECURE", "VAR_PYTHON", "VAR_PYTHON_SCRIPT",
-  "VAR_VAL_SIG_SKEW_MIN", "VAR_VAL_SIG_SKEW_MAX", "VAR_CACHE_MIN_TTL",
-  "VAR_VAL_LOG_LEVEL", "VAR_AUTO_TRUST_ANCHOR_FILE", "VAR_KEEP_MISSING",
-  "VAR_ADD_HOLDDOWN", "VAR_DEL_HOLDDOWN", "VAR_SO_RCVBUF",
-  "VAR_EDNS_BUFFER_SIZE", "VAR_PREFETCH", "VAR_PREFETCH_KEY",
-  "VAR_SO_SNDBUF", "VAR_SO_REUSEPORT", "VAR_HARDEN_BELOW_NXDOMAIN",
-  "VAR_IGNORE_CD_FLAG", "VAR_LOG_QUERIES", "VAR_TCP_UPSTREAM",
-  "VAR_SSL_UPSTREAM", "VAR_SSL_SERVICE_KEY", "VAR_SSL_SERVICE_PEM",
-  "VAR_SSL_PORT", "VAR_FORWARD_FIRST", "VAR_STUB_FIRST",
-  "VAR_MINIMAL_RESPONSES", "VAR_RRSET_ROUNDROBIN", "VAR_MAX_UDP_SIZE",
-  "VAR_DELAY_CLOSE", "VAR_UNBLOCK_LAN_ZONES", "VAR_DNS64_PREFIX",
-  "VAR_DNS64_SYNTHALL", "VAR_DNSTAP", "VAR_DNSTAP_ENABLE",
-  "VAR_DNSTAP_SOCKET_PATH", "VAR_DNSTAP_SEND_IDENTITY",
-  "VAR_DNSTAP_SEND_VERSION", "VAR_DNSTAP_IDENTITY", "VAR_DNSTAP_VERSION",
+  "VAR_CONTROL_USE_CERT", "VAR_EXTENDED_STATISTICS", "VAR_LOCAL_DATA_PTR",
+  "VAR_JOSTLE_TIMEOUT", "VAR_STUB_PRIME", "VAR_UNWANTED_REPLY_THRESHOLD",
+  "VAR_LOG_TIME_ASCII", "VAR_DOMAIN_INSECURE", "VAR_PYTHON",
+  "VAR_PYTHON_SCRIPT", "VAR_VAL_SIG_SKEW_MIN", "VAR_VAL_SIG_SKEW_MAX",
+  "VAR_CACHE_MIN_TTL", "VAR_VAL_LOG_LEVEL", "VAR_AUTO_TRUST_ANCHOR_FILE",
+  "VAR_KEEP_MISSING", "VAR_ADD_HOLDDOWN", "VAR_DEL_HOLDDOWN",
+  "VAR_SO_RCVBUF", "VAR_EDNS_BUFFER_SIZE", "VAR_PREFETCH",
+  "VAR_PREFETCH_KEY", "VAR_SO_SNDBUF", "VAR_SO_REUSEPORT",
+  "VAR_HARDEN_BELOW_NXDOMAIN", "VAR_IGNORE_CD_FLAG", "VAR_LOG_QUERIES",
+  "VAR_TCP_UPSTREAM", "VAR_SSL_UPSTREAM", "VAR_SSL_SERVICE_KEY",
+  "VAR_SSL_SERVICE_PEM", "VAR_SSL_PORT", "VAR_FORWARD_FIRST",
+  "VAR_STUB_FIRST", "VAR_MINIMAL_RESPONSES", "VAR_RRSET_ROUNDROBIN",
+  "VAR_MAX_UDP_SIZE", "VAR_DELAY_CLOSE", "VAR_UNBLOCK_LAN_ZONES",
+  "VAR_INFRA_CACHE_MIN_RTT", "VAR_DNS64_PREFIX", "VAR_DNS64_SYNTHALL",
+  "VAR_DNSTAP", "VAR_DNSTAP_ENABLE", "VAR_DNSTAP_SOCKET_PATH",
+  "VAR_DNSTAP_SEND_IDENTITY", "VAR_DNSTAP_SEND_VERSION",
+  "VAR_DNSTAP_IDENTITY", "VAR_DNSTAP_VERSION",
   "VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES",
   "VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES",
   "VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES",
@@ -982,17 +988,18 @@ static const char *const yytname[] =
   "server_rrset_cache_size", "server_rrset_cache_slabs",
   "server_infra_host_ttl", "server_infra_lame_ttl",
   "server_infra_cache_numhosts", "server_infra_cache_lame_size",
-  "server_infra_cache_slabs", "server_target_fetch_policy",
-  "server_harden_short_bufsize", "server_harden_large_queries",
-  "server_harden_glue", "server_harden_dnssec_stripped",
-  "server_harden_below_nxdomain", "server_harden_referral_path",
-  "server_use_caps_for_id", "server_private_address",
-  "server_private_domain", "server_prefetch", "server_prefetch_key",
-  "server_unwanted_reply_threshold", "server_do_not_query_address",
-  "server_do_not_query_localhost", "server_access_control",
-  "server_module_conf", "server_val_override_date",
-  "server_val_sig_skew_min", "server_val_sig_skew_max",
-  "server_cache_max_ttl", "server_cache_min_ttl", "server_bogus_ttl",
+  "server_infra_cache_slabs", "server_infra_cache_min_rtt",
+  "server_target_fetch_policy", "server_harden_short_bufsize",
+  "server_harden_large_queries", "server_harden_glue",
+  "server_harden_dnssec_stripped", "server_harden_below_nxdomain",
+  "server_harden_referral_path", "server_use_caps_for_id",
+  "server_private_address", "server_private_domain", "server_prefetch",
+  "server_prefetch_key", "server_unwanted_reply_threshold",
+  "server_do_not_query_address", "server_do_not_query_localhost",
+  "server_access_control", "server_module_conf",
+  "server_val_override_date", "server_val_sig_skew_min",
+  "server_val_sig_skew_max", "server_cache_max_ttl",
+  "server_cache_min_ttl", "server_bogus_ttl",
   "server_val_clean_additional", "server_val_permissive_mode",
   "server_ignore_cd_flag", "server_val_log_level",
   "server_val_nsec3_keysize_iterations", "server_add_holddown",
@@ -1004,10 +1011,11 @@ static const char *const yytname[] =
   "stub_first", "stub_prime", "forward_name", "forward_host",
   "forward_addr", "forward_first", "rcstart", "contents_rc", "content_rc",
   "rc_control_enable", "rc_control_port", "rc_control_interface",
-  "rc_server_key_file", "rc_server_cert_file", "rc_control_key_file",
-  "rc_control_cert_file", "dtstart", "contents_dt", "content_dt",
-  "dt_dnstap_enable", "dt_dnstap_socket_path", "dt_dnstap_send_identity",
-  "dt_dnstap_send_version", "dt_dnstap_identity", "dt_dnstap_version",
+  "rc_control_use_cert", "rc_server_key_file", "rc_server_cert_file",
+  "rc_control_key_file", "rc_control_cert_file", "dtstart", "contents_dt",
+  "content_dt", "dt_dnstap_enable", "dt_dnstap_socket_path",
+  "dt_dnstap_send_identity", "dt_dnstap_send_version",
+  "dt_dnstap_identity", "dt_dnstap_version",
   "dt_dnstap_log_resolver_query_messages",
   "dt_dnstap_log_resolver_response_messages",
   "dt_dnstap_log_client_query_messages",
@@ -1037,43 +1045,44 @@ static const yytype_uint16 yytoknum[] =
      365,   366,   367,   368,   369,   370,   371,   372,   373,   374,
      375,   376,   377,   378,   379,   380,   381,   382,   383,   384,
      385,   386,   387,   388,   389,   390,   391,   392,   393,   394,
-     395,   396,   397,   398,   399,   400,   401,   402,   403
+     395,   396,   397,   398,   399,   400,   401,   402,   403,   404,
+     405
 };
 # endif
 
 /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_uint16 yyr1[] =
 {
-       0,   149,   150,   150,   151,   151,   151,   151,   151,   151,
-     152,   153,   153,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   155,   156,   156,
-     157,   157,   157,   157,   157,   158,   159,   159,   160,   160,
-     160,   160,   161,   162,   163,   164,   165,   166,   167,   168,
-     169,   170,   171,   172,   173,   174,   175,   176,   177,   178,
-     179,   180,   181,   182,   183,   184,   185,   186,   187,   188,
-     189,   190,   191,   192,   193,   194,   195,   196,   197,   198,
-     199,   200,   201,   202,   203,   204,   205,   206,   207,   208,
-     209,   210,   211,   212,   213,   214,   215,   216,   217,   218,
-     219,   220,   221,   222,   223,   224,   225,   226,   227,   228,
-     229,   230,   231,   232,   233,   234,   235,   236,   237,   238,
-     239,   240,   241,   242,   243,   244,   245,   246,   247,   248,
-     249,   250,   251,   252,   253,   254,   255,   256,   257,   258,
-     259,   260,   261,   262,   263,   264,   265,   266,   267,   268,
-     269,   270,   271,   272,   273,   274,   275,   275,   276,   276,
-     276,   276,   276,   276,   276,   277,   278,   279,   280,   281,
-     282,   283,   284,   285,   285,   286,   286,   286,   286,   286,
-     286,   286,   286,   286,   286,   286,   286,   287,   288,   289,
+       0,   151,   152,   152,   153,   153,   153,   153,   153,   153,
+     154,   155,   155,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
+     156,   156,   156,   156,   156,   156,   156,   156,   157,   158,
+     158,   159,   159,   159,   159,   159,   160,   161,   161,   162,
+     162,   162,   162,   163,   164,   165,   166,   167,   168,   169,
+     170,   171,   172,   173,   174,   175,   176,   177,   178,   179,
+     180,   181,   182,   183,   184,   185,   186,   187,   188,   189,
+     190,   191,   192,   193,   194,   195,   196,   197,   198,   199,
+     200,   201,   202,   203,   204,   205,   206,   207,   208,   209,
+     210,   211,   212,   213,   214,   215,   216,   217,   218,   219,
+     220,   221,   222,   223,   224,   225,   226,   227,   228,   229,
+     230,   231,   232,   233,   234,   235,   236,   237,   238,   239,
+     240,   241,   242,   243,   244,   245,   246,   247,   248,   249,
+     250,   251,   252,   253,   254,   255,   256,   257,   258,   259,
+     260,   261,   262,   263,   264,   265,   266,   267,   268,   269,
+     270,   271,   272,   273,   274,   275,   276,   277,   278,   278,
+     279,   279,   279,   279,   279,   279,   279,   279,   280,   281,
+     282,   283,   284,   285,   286,   287,   288,   289,   289,   290,
+     290,   290,   290,   290,   290,   290,   290,   290,   290,   290,
      290,   291,   292,   293,   294,   295,   296,   297,   298,   299,
-     300,   300,   301,   302
+     300,   301,   302,   303,   304,   304,   305,   306
 };
 
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
@@ -1090,25 +1099,25 @@ static const yytype_uint8 yyr2[] =
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     2,     0,
-       1,     1,     1,     1,     1,     1,     2,     0,     1,     1,
-       1,     1,     2,     2,     2,     2,     2,     2,     2,     2,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     2,
+       0,     1,     1,     1,     1,     1,     1,     2,     0,     1,
+       1,     1,     1,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     3,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     3,     2,
+       2,     3,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     1,     2,     0,     1,     1,
-       1,     1,     1,     1,     1,     2,     2,     2,     2,     2,
-       2,     2,     1,     2,     0,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     1,
-       2,     0,     1,     2
+       3,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     1,     2,     0,
+       1,     1,     1,     1,     1,     1,     1,     1,     2,     2,
+       2,     2,     2,     2,     2,     2,     1,     2,     0,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     1,     2,     0,     1,     2
 };
 
 /* YYDEFACT[STATE-NAME] -- Default reduction number in state STATE-NUM.
@@ -1116,8 +1125,8 @@ static const yytype_uint8 yyr2[] =
    means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-       2,     0,     1,    10,   117,   125,   245,   289,   262,     3,
-      12,   119,   127,   247,   264,   291,     4,     5,     6,     8,
+       2,     0,     1,    10,   118,   126,   247,   293,   266,     3,
+      12,   120,   128,   249,   268,   295,     4,     5,     6,     8,
        9,     7,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
@@ -1128,129 +1137,131 @@ static const yytype_uint16 yydefact[] =
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,    11,    13,    14,    70,
-      73,    82,    15,    21,    61,    16,    74,    75,    32,    54,
-      69,    17,    18,    19,    20,   104,   105,   106,   107,   108,
-      71,    60,    86,   103,    22,    23,    24,    25,    26,    62,
-      76,    77,    92,    48,    58,    49,    87,    42,    43,    44,
-      45,    96,   100,   112,    97,    55,    27,    28,    29,    84,
-     113,   114,    30,    31,    33,    34,    36,    37,    35,    38,
-      39,    40,    46,    65,   101,    79,    72,    80,    81,    98,
-      99,    85,    41,    63,    66,    47,    50,    88,    89,    64,
-      90,    51,    52,    53,   102,    91,    59,    93,    94,    95,
-      56,    57,    78,    67,    68,    83,   109,   110,   111,   115,
-     116,     0,     0,     0,     0,     0,   118,   120,   121,   122,
-     124,   123,     0,     0,     0,     0,   126,   128,   129,   130,
-     131,     0,     0,     0,     0,     0,     0,     0,   246,   248,
-     250,   249,   251,   252,   253,   254,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,   263,   265,
-     266,   267,   268,   269,   270,   271,   272,   273,   274,   275,
-     276,     0,   290,   292,   133,   132,   137,   140,   138,   146,
-     147,   148,   149,   159,   160,   161,   162,   163,   181,   182,
-     183,   187,   188,   143,   189,   190,   193,   191,   192,   194,
-     195,   196,   207,   172,   173,   174,   175,   197,   210,   168,
-     170,   211,   216,   217,   218,   144,   180,   225,   226,   169,
-     221,   156,   139,   164,   208,   214,   198,     0,     0,   229,
-     145,   134,   155,   201,   135,   141,   142,   165,   166,   227,
-     200,   202,   203,   136,   230,   184,   206,   157,   171,   212,
-     213,   215,   220,   167,   224,   222,   223,   176,   179,   204,
-     205,   177,   178,   199,   219,   158,   150,   151,   152,   153,
-     154,   231,   232,   233,   185,   186,   234,   235,   236,   237,
-     238,   240,   239,   241,   242,   243,   244,   255,   257,   256,
-     258,   259,   260,   261,   277,   278,   279,   280,   281,   282,
-     283,   284,   285,   286,   287,   288,   293,   209,   228
+       0,     0,     0,     0,     0,     0,     0,    11,    13,    14,
+      70,    73,    82,    15,    21,    61,    16,    74,    75,    32,
+      54,    69,    17,    18,    19,    20,   104,   105,   106,   107,
+     108,    71,    60,    86,   103,    22,    23,    24,    25,    26,
+      62,    76,    77,    92,    48,    58,    49,    87,    42,    43,
+      44,    45,    96,   100,   112,    97,    55,    27,    28,    29,
+      84,   113,   114,    30,    31,    33,    34,    36,    37,    35,
+     117,    38,    39,    40,    46,    65,   101,    79,    72,    80,
+      81,    98,    99,    85,    41,    63,    66,    47,    50,    88,
+      89,    64,    90,    51,    52,    53,   102,    91,    59,    93,
+      94,    95,    56,    57,    78,    67,    68,    83,   109,   110,
+     111,   115,   116,     0,     0,     0,     0,     0,   119,   121,
+     122,   123,   125,   124,     0,     0,     0,     0,   127,   129,
+     130,   131,   132,     0,     0,     0,     0,     0,     0,     0,
+       0,   248,   250,   252,   251,   257,   253,   254,   255,   256,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,   267,   269,   270,   271,   272,   273,   274,   275,
+     276,   277,   278,   279,   280,     0,   294,   296,   134,   133,
+     138,   141,   139,   147,   148,   149,   150,   160,   161,   162,
+     163,   164,   182,   183,   184,   188,   189,   144,   190,   191,
+     194,   192,   193,   196,   197,   198,   209,   173,   174,   175,
+     176,   199,   212,   169,   171,   213,   218,   219,   220,   145,
+     181,   227,   228,   170,   223,   157,   140,   165,   210,   216,
+     200,     0,     0,   231,   146,   135,   156,   203,   136,   142,
+     143,   166,   167,   229,   202,   204,   205,   137,   232,   185,
+     208,   158,   172,   214,   215,   217,   222,   168,   226,   224,
+     225,   177,   180,   206,   207,   178,   179,   201,   221,   159,
+     151,   152,   153,   154,   155,   233,   234,   235,   186,   187,
+     195,   236,   237,   238,   239,   240,   242,   241,   243,   244,
+     245,   246,   258,   260,   259,   262,   263,   264,   265,   261,
+     281,   282,   283,   284,   285,   286,   287,   288,   289,   290,
+     291,   292,   297,   211,   230
 };
 
 /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     1,     9,    10,    16,   126,    11,    17,   236,    12,
-      18,   246,   127,   128,   129,   130,   131,   132,   133,   134,
-     135,   136,   137,   138,   139,   140,   141,   142,   143,   144,
-     145,   146,   147,   148,   149,   150,   151,   152,   153,   154,
-     155,   156,   157,   158,   159,   160,   161,   162,   163,   164,
-     165,   166,   167,   168,   169,   170,   171,   172,   173,   174,
-     175,   176,   177,   178,   179,   180,   181,   182,   183,   184,
-     185,   186,   187,   188,   189,   190,   191,   192,   193,   194,
-     195,   196,   197,   198,   199,   200,   201,   202,   203,   204,
-     205,   206,   207,   208,   209,   210,   211,   212,   213,   214,
-     215,   216,   217,   218,   219,   220,   221,   222,   223,   224,
-     225,   226,   227,   228,   229,   230,   237,   238,   239,   240,
-     241,   247,   248,   249,   250,    13,    19,   258,   259,   260,
-     261,   262,   263,   264,   265,    14,    20,   278,   279,   280,
-     281,   282,   283,   284,   285,   286,   287,   288,   289,   290,
-      15,    21,   292,   293
+      -1,     1,     9,    10,    16,   127,    11,    17,   238,    12,
+      18,   248,   128,   129,   130,   131,   132,   133,   134,   135,
+     136,   137,   138,   139,   140,   141,   142,   143,   144,   145,
+     146,   147,   148,   149,   150,   151,   152,   153,   154,   155,
+     156,   157,   158,   159,   160,   161,   162,   163,   164,   165,
+     166,   167,   168,   169,   170,   171,   172,   173,   174,   175,
+     176,   177,   178,   179,   180,   181,   182,   183,   184,   185,
+     186,   187,   188,   189,   190,   191,   192,   193,   194,   195,
+     196,   197,   198,   199,   200,   201,   202,   203,   204,   205,
+     206,   207,   208,   209,   210,   211,   212,   213,   214,   215,
+     216,   217,   218,   219,   220,   221,   222,   223,   224,   225,
+     226,   227,   228,   229,   230,   231,   232,   239,   240,   241,
+     242,   243,   249,   250,   251,   252,    13,    19,   261,   262,
+     263,   264,   265,   266,   267,   268,   269,    14,    20,   282,
+     283,   284,   285,   286,   287,   288,   289,   290,   291,   292,
+     293,   294,    15,    21,   296,   297
 };
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -123
+#define YYPACT_NINF -125
 static const yytype_int16 yypact[] =
 {
-    -123,     0,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,    92,   -36,   -32,   -62,
-    -122,  -102,    -4,    -3,    -2,    -1,     2,    24,    25,    26,
-      27,    29,    30,    31,    32,    33,    35,    36,    37,    38,
-      39,    40,    41,    42,    43,    44,    45,    46,    47,    48,
-      49,    50,    51,    52,    54,    55,    56,    57,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    68,    69,
-      70,    71,    72,    73,    74,    75,    76,    77,    79,    80,
-      81,    83,    84,    86,    87,    88,    89,    90,    91,   119,
-     120,   121,   122,   127,   128,   170,   171,   172,   173,   174,
-     175,   176,   177,   181,   185,   186,   209,   210,   218,   219,
-     220,   221,   222,   223,   224,   225,   226,   227,   228,   229,
-     230,   231,   232,   233,   234,   235,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,   236,   237,   238,   239,   240,  -123,  -123,  -123,  -123,
-    -123,  -123,   241,   242,   243,   244,  -123,  -123,  -123,  -123,
-    -123,   245,   246,   247,   248,   249,   250,   251,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,   252,   253,   254,   255,
-     256,   257,   258,   259,   260,   261,   262,   263,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,   264,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,   265,   266,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123
+    -125,     0,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,    93,   -36,   -32,   -62,
+    -124,  -103,    -4,    -3,    -2,    -1,     2,    25,    26,    27,
+      29,    30,    31,    32,    33,    35,    36,    37,    38,    39,
+      40,    41,    42,    43,    44,    45,    46,    47,    48,    49,
+      50,    51,    52,    53,    55,    56,    57,    58,    59,    60,
+      61,    62,    63,    64,    65,    66,    67,    68,    69,    70,
+      71,    72,    73,    74,    75,    76,    77,    79,    80,    81,
+      82,    84,    85,    87,    88,    89,    90,    91,    92,   120,
+     121,   122,   123,   127,   129,   171,   172,   173,   174,   175,
+     176,   177,   178,   179,   183,   187,   188,   211,   212,   221,
+     222,   223,   224,   225,   226,   227,   228,   229,   230,   231,
+     232,   233,   234,   235,   236,   237,   238,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,   239,   240,   241,   242,   243,  -125,  -125,
+    -125,  -125,  -125,  -125,   244,   245,   246,   247,  -125,  -125,
+    -125,  -125,  -125,   248,   249,   250,   251,   252,   253,   254,
+     255,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+     256,   257,   258,   259,   260,   261,   262,   263,   264,   265,
+     266,   267,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,   268,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,   269,   270,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125
 };
 
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int8 yypgoto[] =
 {
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
+    -125,  -125,  -125,  -125,  -125,  -125
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
@@ -1259,108 +1270,110 @@ static const yytype_int8 yypgoto[] =
 #define YYTABLE_NINF -1
 static const yytype_uint16 yytable[] =
 {
-       2,   231,   291,   232,   233,   242,   294,   295,   296,   297,
-       0,     3,   298,   243,   244,   266,   267,   268,   269,   270,
-     271,   272,   273,   274,   275,   276,   277,   251,   252,   253,
-     254,   255,   256,   257,   299,   300,   301,   302,     4,   303,
-     304,   305,   306,   307,     5,   308,   309,   310,   311,   312,
-     313,   314,   315,   316,   317,   318,   319,   320,   321,   322,
-     323,   324,   325,   234,   326,   327,   328,   329,   330,   331,
-     332,   333,   334,   335,   336,   337,   338,   339,   340,   341,
-     342,   343,   344,   345,   346,   347,   348,   349,     6,   350,
-     351,   352,   235,   353,   354,   245,   355,   356,   357,   358,
-     359,   360,     0,     7,    22,    23,    24,    25,    26,    27,
-      28,    29,    30,    31,    32,    33,    34,    35,    36,    37,
-      38,    39,    40,    41,    42,    43,    44,    45,    46,   361,
-     362,   363,   364,    47,    48,    49,     8,   365,   366,    50,
-      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
-      61,    62,    63,    64,    65,    66,    67,    68,    69,    70,
-      71,    72,    73,    74,    75,    76,    77,    78,    79,    80,
-      81,    82,    83,    84,    85,    86,    87,    88,    89,    90,
-     367,   368,   369,   370,   371,   372,   373,   374,    91,    92,
-      93,   375,    94,    95,    96,   376,   377,    97,    98,    99,
-     100,   101,   102,   103,   104,   105,   106,   107,   108,   109,
-     110,   111,   112,   113,   114,   115,   116,   117,   118,   378,
-     379,   119,   120,   121,   122,   123,   124,   125,   380,   381,
-     382,   383,   384,   385,   386,   387,   388,   389,   390,   391,
-     392,   393,   394,   395,   396,   397,   398,   399,   400,   401,
-     402,   403,   404,   405,   406,   407,   408,   409,   410,   411,
-     412,   413,   414,   415,   416,   417,   418,   419,   420,   421,
-     422,   423,   424,   425,   426,   427,   428
+       2,   233,   295,   234,   235,   244,   298,   299,   300,   301,
+       0,     3,   302,   245,   246,   270,   271,   272,   273,   274,
+     275,   276,   277,   278,   279,   280,   281,   253,   254,   255,
+     256,   257,   258,   259,   260,   303,   304,   305,     4,   306,
+     307,   308,   309,   310,     5,   311,   312,   313,   314,   315,
+     316,   317,   318,   319,   320,   321,   322,   323,   324,   325,
+     326,   327,   328,   329,   236,   330,   331,   332,   333,   334,
+     335,   336,   337,   338,   339,   340,   341,   342,   343,   344,
+     345,   346,   347,   348,   349,   350,   351,   352,     6,   353,
+     354,   355,   356,   237,   357,   358,   247,   359,   360,   361,
+     362,   363,   364,     0,     7,    22,    23,    24,    25,    26,
+      27,    28,    29,    30,    31,    32,    33,    34,    35,    36,
+      37,    38,    39,    40,    41,    42,    43,    44,    45,    46,
+     365,   366,   367,   368,    47,    48,    49,   369,     8,   370,
+      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
+      60,    61,    62,    63,    64,    65,    66,    67,    68,    69,
+      70,    71,    72,    73,    74,    75,    76,    77,    78,    79,
+      80,    81,    82,    83,    84,    85,    86,    87,    88,    89,
+      90,   371,   372,   373,   374,   375,   376,   377,   378,   379,
+      91,    92,    93,   380,    94,    95,    96,   381,   382,    97,
+      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
+     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
+     118,   383,   384,   119,   120,   121,   122,   123,   124,   125,
+     126,   385,   386,   387,   388,   389,   390,   391,   392,   393,
+     394,   395,   396,   397,   398,   399,   400,   401,   402,   403,
+     404,   405,   406,   407,   408,   409,   410,   411,   412,   413,
+     414,   415,   416,   417,   418,   419,   420,   421,   422,   423,
+     424,   425,   426,   427,   428,   429,   430,   431,   432,   433,
+     434
 };
 
 #define yypact_value_is_default(Yystate) \
-  (!!((Yystate) == (-123)))
+  (!!((Yystate) == (-125)))
 
 #define yytable_value_is_error(Yytable_value) \
   YYID (0)
 
 static const yytype_int16 yycheck[] =
 {
-       0,    37,   104,    39,    40,    37,    10,    10,    10,    10,
-      -1,    11,    10,    45,    46,   137,   138,   139,   140,   141,
-     142,   143,   144,   145,   146,   147,   148,    89,    90,    91,
-      92,    93,    94,    95,    10,    10,    10,    10,    38,    10,
+       0,    37,   105,    39,    40,    37,    10,    10,    10,    10,
+      -1,    11,    10,    45,    46,   139,   140,   141,   142,   143,
+     144,   145,   146,   147,   148,   149,   150,    89,    90,    91,
+      92,    93,    94,    95,    96,    10,    10,    10,    38,    10,
       10,    10,    10,    10,    44,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    99,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,   100,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    88,    10,
-      10,    10,   128,    10,    10,   127,    10,    10,    10,    10,
-      10,    10,    -1,   103,    12,    13,    14,    15,    16,    17,
-      18,    19,    20,    21,    22,    23,    24,    25,    26,    27,
-      28,    29,    30,    31,    32,    33,    34,    35,    36,    10,
-      10,    10,    10,    41,    42,    43,   136,    10,    10,    47,
-      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      68,    69,    70,    71,    72,    73,    74,    75,    76,    77,
-      78,    79,    80,    81,    82,    83,    84,    85,    86,    87,
-      10,    10,    10,    10,    10,    10,    10,    10,    96,    97,
-      98,    10,   100,   101,   102,    10,    10,   105,   106,   107,
-     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
-     118,   119,   120,   121,   122,   123,   124,   125,   126,    10,
-      10,   129,   130,   131,   132,   133,   134,   135,    10,    10,
+      10,    10,    10,   129,    10,    10,   128,    10,    10,    10,
+      10,    10,    10,    -1,   104,    12,    13,    14,    15,    16,
+      17,    18,    19,    20,    21,    22,    23,    24,    25,    26,
+      27,    28,    29,    30,    31,    32,    33,    34,    35,    36,
+      10,    10,    10,    10,    41,    42,    43,    10,   138,    10,
+      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
+      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
+      67,    68,    69,    70,    71,    72,    73,    74,    75,    76,
+      77,    78,    79,    80,    81,    82,    83,    84,    85,    86,
+      87,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      97,    98,    99,    10,   101,   102,   103,    10,    10,   106,
+     107,   108,   109,   110,   111,   112,   113,   114,   115,   116,
+     117,   118,   119,   120,   121,   122,   123,   124,   125,   126,
+     127,    10,    10,   130,   131,   132,   133,   134,   135,   136,
+     137,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10
+      10
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
    symbol of state STATE-NUM.  */
 static const yytype_uint16 yystos[] =
 {
-       0,   150,     0,    11,    38,    44,    88,   103,   136,   151,
-     152,   155,   158,   274,   284,   299,   153,   156,   159,   275,
-     285,   300,    12,    13,    14,    15,    16,    17,    18,    19,
+       0,   152,     0,    11,    38,    44,    88,   104,   138,   153,
+     154,   157,   160,   277,   288,   303,   155,   158,   161,   278,
+     289,   304,    12,    13,    14,    15,    16,    17,    18,    19,
       20,    21,    22,    23,    24,    25,    26,    27,    28,    29,
       30,    31,    32,    33,    34,    35,    36,    41,    42,    43,
       47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
       57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
       67,    68,    69,    70,    71,    72,    73,    74,    75,    76,
       77,    78,    79,    80,    81,    82,    83,    84,    85,    86,
-      87,    96,    97,    98,   100,   101,   102,   105,   106,   107,
-     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
-     118,   119,   120,   121,   122,   123,   124,   125,   126,   129,
-     130,   131,   132,   133,   134,   135,   154,   161,   162,   163,
-     164,   165,   166,   167,   168,   169,   170,   171,   172,   173,
-     174,   175,   176,   177,   178,   179,   180,   181,   182,   183,
-     184,   185,   186,   187,   188,   189,   190,   191,   192,   193,
-     194,   195,   196,   197,   198,   199,   200,   201,   202,   203,
-     204,   205,   206,   207,   208,   209,   210,   211,   212,   213,
-     214,   215,   216,   217,   218,   219,   220,   221,   222,   223,
-     224,   225,   226,   227,   228,   229,   230,   231,   232,   233,
-     234,   235,   236,   237,   238,   239,   240,   241,   242,   243,
-     244,   245,   246,   247,   248,   249,   250,   251,   252,   253,
-     254,   255,   256,   257,   258,   259,   260,   261,   262,   263,
-     264,    37,    39,    40,    99,   128,   157,   265,   266,   267,
-     268,   269,    37,    45,    46,   127,   160,   270,   271,   272,
-     273,    89,    90,    91,    92,    93,    94,    95,   276,   277,
-     278,   279,   280,   281,   282,   283,   137,   138,   139,   140,
-     141,   142,   143,   144,   145,   146,   147,   148,   286,   287,
-     288,   289,   290,   291,   292,   293,   294,   295,   296,   297,
-     298,   104,   301,   302,    10,    10,    10,    10,    10,    10,
+      87,    97,    98,    99,   101,   102,   103,   106,   107,   108,
+     109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
+     119,   120,   121,   122,   123,   124,   125,   126,   127,   130,
+     131,   132,   133,   134,   135,   136,   137,   156,   163,   164,
+     165,   166,   167,   168,   169,   170,   171,   172,   173,   174,
+     175,   176,   177,   178,   179,   180,   181,   182,   183,   184,
+     185,   186,   187,   188,   189,   190,   191,   192,   193,   194,
+     195,   196,   197,   198,   199,   200,   201,   202,   203,   204,
+     205,   206,   207,   208,   209,   210,   211,   212,   213,   214,
+     215,   216,   217,   218,   219,   220,   221,   222,   223,   224,
+     225,   226,   227,   228,   229,   230,   231,   232,   233,   234,
+     235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
+     245,   246,   247,   248,   249,   250,   251,   252,   253,   254,
+     255,   256,   257,   258,   259,   260,   261,   262,   263,   264,
+     265,   266,   267,    37,    39,    40,   100,   129,   159,   268,
+     269,   270,   271,   272,    37,    45,    46,   128,   162,   273,
+     274,   275,   276,    89,    90,    91,    92,    93,    94,    95,
+      96,   279,   280,   281,   282,   283,   284,   285,   286,   287,
+     139,   140,   141,   142,   143,   144,   145,   146,   147,   148,
+     149,   150,   290,   291,   292,   293,   294,   295,   296,   297,
+     298,   299,   300,   301,   302,   105,   305,   306,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
@@ -1373,7 +1386,8 @@ static const yytype_uint16 yystos[] =
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -2175,15 +2189,15 @@ yyreduce:
     {
         case 10:
 /* Line 1792 of yacc.c  */
-#line 129 "util/configparser.y"
+#line 131 "util/configparser.y"
     { 
 		OUTYY(("\nP(server:)\n")); 
 	}
     break;
 
-  case 117:
+  case 118:
 /* Line 1792 of yacc.c  */
-#line 180 "util/configparser.y"
+#line 183 "util/configparser.y"
     {
 		struct config_stub* s;
 		OUTYY(("\nP(stub_zone:)\n")); 
@@ -2196,9 +2210,9 @@ yyreduce:
 	}
     break;
 
-  case 125:
+  case 126:
 /* Line 1792 of yacc.c  */
-#line 196 "util/configparser.y"
+#line 199 "util/configparser.y"
     {
 		struct config_stub* s;
 		OUTYY(("\nP(forward_zone:)\n")); 
@@ -2211,9 +2225,9 @@ yyreduce:
 	}
     break;
 
-  case 132:
+  case 133:
 /* Line 1792 of yacc.c  */
-#line 212 "util/configparser.y"
+#line 215 "util/configparser.y"
     { 
 		OUTYY(("P(server_num_threads:%s)\n", (yyvsp[(2) - (2)].str))); 
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2223,9 +2237,9 @@ yyreduce:
 	}
     break;
 
-  case 133:
+  case 134:
 /* Line 1792 of yacc.c  */
-#line 221 "util/configparser.y"
+#line 224 "util/configparser.y"
     { 
 		OUTYY(("P(server_verbosity:%s)\n", (yyvsp[(2) - (2)].str))); 
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2235,9 +2249,9 @@ yyreduce:
 	}
     break;
 
-  case 134:
+  case 135:
 /* Line 1792 of yacc.c  */
-#line 230 "util/configparser.y"
+#line 233 "util/configparser.y"
     { 
 		OUTYY(("P(server_statistics_interval:%s)\n", (yyvsp[(2) - (2)].str))); 
 		if(strcmp((yyvsp[(2) - (2)].str), "") == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0)
@@ -2249,9 +2263,9 @@ yyreduce:
 	}
     break;
 
-  case 135:
+  case 136:
 /* Line 1792 of yacc.c  */
-#line 241 "util/configparser.y"
+#line 244 "util/configparser.y"
     {
 		OUTYY(("P(server_statistics_cumulative:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2261,9 +2275,9 @@ yyreduce:
 	}
     break;
 
-  case 136:
+  case 137:
 /* Line 1792 of yacc.c  */
-#line 250 "util/configparser.y"
+#line 253 "util/configparser.y"
     {
 		OUTYY(("P(server_extended_statistics:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2273,9 +2287,9 @@ yyreduce:
 	}
     break;
 
-  case 137:
+  case 138:
 /* Line 1792 of yacc.c  */
-#line 259 "util/configparser.y"
+#line 262 "util/configparser.y"
     {
 		OUTYY(("P(server_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2285,9 +2299,9 @@ yyreduce:
 	}
     break;
 
-  case 138:
+  case 139:
 /* Line 1792 of yacc.c  */
-#line 268 "util/configparser.y"
+#line 271 "util/configparser.y"
     {
 		OUTYY(("P(server_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->num_ifs == 0)
@@ -2301,9 +2315,9 @@ yyreduce:
 	}
     break;
 
-  case 139:
+  case 140:
 /* Line 1792 of yacc.c  */
-#line 281 "util/configparser.y"
+#line 284 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->num_out_ifs == 0)
@@ -2319,9 +2333,9 @@ yyreduce:
 	}
     break;
 
-  case 140:
+  case 141:
 /* Line 1792 of yacc.c  */
-#line 296 "util/configparser.y"
+#line 299 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_range:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2331,9 +2345,9 @@ yyreduce:
 	}
     break;
 
-  case 141:
+  case 142:
 /* Line 1792 of yacc.c  */
-#line 305 "util/configparser.y"
+#line 308 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_port_permit:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_mark_ports((yyvsp[(2) - (2)].str), 1, 
@@ -2343,9 +2357,9 @@ yyreduce:
 	}
     break;
 
-  case 142:
+  case 143:
 /* Line 1792 of yacc.c  */
-#line 314 "util/configparser.y"
+#line 317 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_port_avoid:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_mark_ports((yyvsp[(2) - (2)].str), 0, 
@@ -2355,9 +2369,9 @@ yyreduce:
 	}
     break;
 
-  case 143:
+  case 144:
 /* Line 1792 of yacc.c  */
-#line 323 "util/configparser.y"
+#line 326 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_num_tcp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2367,9 +2381,9 @@ yyreduce:
 	}
     break;
 
-  case 144:
+  case 145:
 /* Line 1792 of yacc.c  */
-#line 332 "util/configparser.y"
+#line 335 "util/configparser.y"
     {
 		OUTYY(("P(server_incoming_num_tcp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2379,9 +2393,9 @@ yyreduce:
 	}
     break;
 
-  case 145:
+  case 146:
 /* Line 1792 of yacc.c  */
-#line 341 "util/configparser.y"
+#line 344 "util/configparser.y"
     {
 		OUTYY(("P(server_interface_automatic:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2391,9 +2405,9 @@ yyreduce:
 	}
     break;
 
-  case 146:
+  case 147:
 /* Line 1792 of yacc.c  */
-#line 350 "util/configparser.y"
+#line 353 "util/configparser.y"
     {
 		OUTYY(("P(server_do_ip4:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2403,9 +2417,9 @@ yyreduce:
 	}
     break;
 
-  case 147:
+  case 148:
 /* Line 1792 of yacc.c  */
-#line 359 "util/configparser.y"
+#line 362 "util/configparser.y"
     {
 		OUTYY(("P(server_do_ip6:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2415,9 +2429,9 @@ yyreduce:
 	}
     break;
 
-  case 148:
+  case 149:
 /* Line 1792 of yacc.c  */
-#line 368 "util/configparser.y"
+#line 371 "util/configparser.y"
     {
 		OUTYY(("P(server_do_udp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2427,9 +2441,9 @@ yyreduce:
 	}
     break;
 
-  case 149:
+  case 150:
 /* Line 1792 of yacc.c  */
-#line 377 "util/configparser.y"
+#line 380 "util/configparser.y"
     {
 		OUTYY(("P(server_do_tcp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2439,9 +2453,9 @@ yyreduce:
 	}
     break;
 
-  case 150:
+  case 151:
 /* Line 1792 of yacc.c  */
-#line 386 "util/configparser.y"
+#line 389 "util/configparser.y"
     {
 		OUTYY(("P(server_tcp_upstream:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2451,9 +2465,9 @@ yyreduce:
 	}
     break;
 
-  case 151:
+  case 152:
 /* Line 1792 of yacc.c  */
-#line 395 "util/configparser.y"
+#line 398 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_upstream:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2463,9 +2477,9 @@ yyreduce:
 	}
     break;
 
-  case 152:
+  case 153:
 /* Line 1792 of yacc.c  */
-#line 404 "util/configparser.y"
+#line 407 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_service_key:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->ssl_service_key);
@@ -2473,9 +2487,9 @@ yyreduce:
 	}
     break;
 
-  case 153:
+  case 154:
 /* Line 1792 of yacc.c  */
-#line 411 "util/configparser.y"
+#line 414 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_service_pem:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->ssl_service_pem);
@@ -2483,9 +2497,9 @@ yyreduce:
 	}
     break;
 
-  case 154:
+  case 155:
 /* Line 1792 of yacc.c  */
-#line 418 "util/configparser.y"
+#line 421 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2495,9 +2509,9 @@ yyreduce:
 	}
     break;
 
-  case 155:
+  case 156:
 /* Line 1792 of yacc.c  */
-#line 427 "util/configparser.y"
+#line 430 "util/configparser.y"
     {
 		OUTYY(("P(server_do_daemonize:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2507,9 +2521,9 @@ yyreduce:
 	}
     break;
 
-  case 156:
+  case 157:
 /* Line 1792 of yacc.c  */
-#line 436 "util/configparser.y"
+#line 439 "util/configparser.y"
     {
 		OUTYY(("P(server_use_syslog:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2524,9 +2538,9 @@ yyreduce:
 	}
     break;
 
-  case 157:
+  case 158:
 /* Line 1792 of yacc.c  */
-#line 450 "util/configparser.y"
+#line 453 "util/configparser.y"
     {
 		OUTYY(("P(server_log_time_ascii:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2536,9 +2550,9 @@ yyreduce:
 	}
     break;
 
-  case 158:
+  case 159:
 /* Line 1792 of yacc.c  */
-#line 459 "util/configparser.y"
+#line 462 "util/configparser.y"
     {
 		OUTYY(("P(server_log_queries:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2548,9 +2562,9 @@ yyreduce:
 	}
     break;
 
-  case 159:
+  case 160:
 /* Line 1792 of yacc.c  */
-#line 468 "util/configparser.y"
+#line 471 "util/configparser.y"
     {
 		OUTYY(("P(server_chroot:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->chrootdir);
@@ -2558,9 +2572,9 @@ yyreduce:
 	}
     break;
 
-  case 160:
+  case 161:
 /* Line 1792 of yacc.c  */
-#line 475 "util/configparser.y"
+#line 478 "util/configparser.y"
     {
 		OUTYY(("P(server_username:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->username);
@@ -2568,9 +2582,9 @@ yyreduce:
 	}
     break;
 
-  case 161:
+  case 162:
 /* Line 1792 of yacc.c  */
-#line 482 "util/configparser.y"
+#line 485 "util/configparser.y"
     {
 		OUTYY(("P(server_directory:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->directory);
@@ -2578,9 +2592,9 @@ yyreduce:
 	}
     break;
 
-  case 162:
+  case 163:
 /* Line 1792 of yacc.c  */
-#line 489 "util/configparser.y"
+#line 492 "util/configparser.y"
     {
 		OUTYY(("P(server_logfile:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->logfile);
@@ -2589,9 +2603,9 @@ yyreduce:
 	}
     break;
 
-  case 163:
+  case 164:
 /* Line 1792 of yacc.c  */
-#line 497 "util/configparser.y"
+#line 500 "util/configparser.y"
     {
 		OUTYY(("P(server_pidfile:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->pidfile);
@@ -2599,9 +2613,9 @@ yyreduce:
 	}
     break;
 
-  case 164:
+  case 165:
 /* Line 1792 of yacc.c  */
-#line 504 "util/configparser.y"
+#line 507 "util/configparser.y"
     {
 		OUTYY(("P(server_root_hints:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->root_hints, (yyvsp[(2) - (2)].str)))
@@ -2609,9 +2623,9 @@ yyreduce:
 	}
     break;
 
-  case 165:
+  case 166:
 /* Line 1792 of yacc.c  */
-#line 511 "util/configparser.y"
+#line 514 "util/configparser.y"
     {
 		OUTYY(("P(server_dlv_anchor_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dlv_anchor_file);
@@ -2619,9 +2633,9 @@ yyreduce:
 	}
     break;
 
-  case 166:
+  case 167:
 /* Line 1792 of yacc.c  */
-#line 518 "util/configparser.y"
+#line 521 "util/configparser.y"
     {
 		OUTYY(("P(server_dlv_anchor:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, (yyvsp[(2) - (2)].str)))
@@ -2629,9 +2643,9 @@ yyreduce:
 	}
     break;
 
-  case 167:
+  case 168:
 /* Line 1792 of yacc.c  */
-#line 525 "util/configparser.y"
+#line 528 "util/configparser.y"
     {
 		OUTYY(("P(server_auto_trust_anchor_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
@@ -2640,9 +2654,9 @@ yyreduce:
 	}
     break;
 
-  case 168:
+  case 169:
 /* Line 1792 of yacc.c  */
-#line 533 "util/configparser.y"
+#line 536 "util/configparser.y"
     {
 		OUTYY(("P(server_trust_anchor_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
@@ -2651,9 +2665,9 @@ yyreduce:
 	}
     break;
 
-  case 169:
+  case 170:
 /* Line 1792 of yacc.c  */
-#line 541 "util/configparser.y"
+#line 544 "util/configparser.y"
     {
 		OUTYY(("P(server_trusted_keys_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
@@ -2662,9 +2676,9 @@ yyreduce:
 	}
     break;
 
-  case 170:
+  case 171:
 /* Line 1792 of yacc.c  */
-#line 549 "util/configparser.y"
+#line 552 "util/configparser.y"
     {
 		OUTYY(("P(server_trust_anchor:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->trust_anchor_list, (yyvsp[(2) - (2)].str)))
@@ -2672,9 +2686,9 @@ yyreduce:
 	}
     break;
 
-  case 171:
+  case 172:
 /* Line 1792 of yacc.c  */
-#line 556 "util/configparser.y"
+#line 559 "util/configparser.y"
     {
 		OUTYY(("P(server_domain_insecure:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->domain_insecure, (yyvsp[(2) - (2)].str)))
@@ -2682,9 +2696,9 @@ yyreduce:
 	}
     break;
 
-  case 172:
+  case 173:
 /* Line 1792 of yacc.c  */
-#line 563 "util/configparser.y"
+#line 566 "util/configparser.y"
     {
 		OUTYY(("P(server_hide_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2694,9 +2708,9 @@ yyreduce:
 	}
     break;
 
-  case 173:
+  case 174:
 /* Line 1792 of yacc.c  */
-#line 572 "util/configparser.y"
+#line 575 "util/configparser.y"
     {
 		OUTYY(("P(server_hide_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2706,9 +2720,9 @@ yyreduce:
 	}
     break;
 
-  case 174:
+  case 175:
 /* Line 1792 of yacc.c  */
-#line 581 "util/configparser.y"
+#line 584 "util/configparser.y"
     {
 		OUTYY(("P(server_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->identity);
@@ -2716,9 +2730,9 @@ yyreduce:
 	}
     break;
 
-  case 175:
+  case 176:
 /* Line 1792 of yacc.c  */
-#line 588 "util/configparser.y"
+#line 591 "util/configparser.y"
     {
 		OUTYY(("P(server_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->version);
@@ -2726,9 +2740,9 @@ yyreduce:
 	}
     break;
 
-  case 176:
+  case 177:
 /* Line 1792 of yacc.c  */
-#line 595 "util/configparser.y"
+#line 598 "util/configparser.y"
     {
 		OUTYY(("P(server_so_rcvbuf:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->so_rcvbuf))
@@ -2737,9 +2751,9 @@ yyreduce:
 	}
     break;
 
-  case 177:
+  case 178:
 /* Line 1792 of yacc.c  */
-#line 603 "util/configparser.y"
+#line 606 "util/configparser.y"
     {
 		OUTYY(("P(server_so_sndbuf:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->so_sndbuf))
@@ -2748,9 +2762,9 @@ yyreduce:
 	}
     break;
 
-  case 178:
+  case 179:
 /* Line 1792 of yacc.c  */
-#line 611 "util/configparser.y"
+#line 614 "util/configparser.y"
     {
         OUTYY(("P(server_so_reuseport:%s)\n", (yyvsp[(2) - (2)].str)));
         if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2761,9 +2775,9 @@ yyreduce:
     }
     break;
 
-  case 179:
+  case 180:
 /* Line 1792 of yacc.c  */
-#line 621 "util/configparser.y"
+#line 624 "util/configparser.y"
     {
 		OUTYY(("P(server_edns_buffer_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2777,9 +2791,9 @@ yyreduce:
 	}
     break;
 
-  case 180:
+  case 181:
 /* Line 1792 of yacc.c  */
-#line 634 "util/configparser.y"
+#line 637 "util/configparser.y"
     {
 		OUTYY(("P(server_msg_buffer_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2791,9 +2805,9 @@ yyreduce:
 	}
     break;
 
-  case 181:
+  case 182:
 /* Line 1792 of yacc.c  */
-#line 645 "util/configparser.y"
+#line 648 "util/configparser.y"
     {
 		OUTYY(("P(server_msg_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->msg_cache_size))
@@ -2802,9 +2816,9 @@ yyreduce:
 	}
     break;
 
-  case 182:
+  case 183:
 /* Line 1792 of yacc.c  */
-#line 653 "util/configparser.y"
+#line 656 "util/configparser.y"
     {
 		OUTYY(("P(server_msg_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2818,9 +2832,9 @@ yyreduce:
 	}
     break;
 
-  case 183:
+  case 184:
 /* Line 1792 of yacc.c  */
-#line 666 "util/configparser.y"
+#line 669 "util/configparser.y"
     {
 		OUTYY(("P(server_num_queries_per_thread:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2830,9 +2844,9 @@ yyreduce:
 	}
     break;
 
-  case 184:
+  case 185:
 /* Line 1792 of yacc.c  */
-#line 675 "util/configparser.y"
+#line 678 "util/configparser.y"
     {
 		OUTYY(("P(server_jostle_timeout:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2842,9 +2856,9 @@ yyreduce:
 	}
     break;
 
-  case 185:
+  case 186:
 /* Line 1792 of yacc.c  */
-#line 684 "util/configparser.y"
+#line 687 "util/configparser.y"
     {
 		OUTYY(("P(server_delay_close:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2854,9 +2868,9 @@ yyreduce:
 	}
     break;
 
-  case 186:
+  case 187:
 /* Line 1792 of yacc.c  */
-#line 693 "util/configparser.y"
+#line 696 "util/configparser.y"
     {
 		OUTYY(("P(server_unblock_lan_zones:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2867,9 +2881,9 @@ yyreduce:
 	}
     break;
 
-  case 187:
+  case 188:
 /* Line 1792 of yacc.c  */
-#line 703 "util/configparser.y"
+#line 706 "util/configparser.y"
     {
 		OUTYY(("P(server_rrset_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->rrset_cache_size))
@@ -2878,9 +2892,9 @@ yyreduce:
 	}
     break;
 
-  case 188:
+  case 189:
 /* Line 1792 of yacc.c  */
-#line 711 "util/configparser.y"
+#line 714 "util/configparser.y"
     {
 		OUTYY(("P(server_rrset_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2894,9 +2908,9 @@ yyreduce:
 	}
     break;
 
-  case 189:
+  case 190:
 /* Line 1792 of yacc.c  */
-#line 724 "util/configparser.y"
+#line 727 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_host_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2906,9 +2920,9 @@ yyreduce:
 	}
     break;
 
-  case 190:
+  case 191:
 /* Line 1792 of yacc.c  */
-#line 733 "util/configparser.y"
+#line 736 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_lame_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		verbose(VERB_DETAIL, "ignored infra-lame-ttl: %s (option "
@@ -2917,9 +2931,9 @@ yyreduce:
 	}
     break;
 
-  case 191:
+  case 192:
 /* Line 1792 of yacc.c  */
-#line 741 "util/configparser.y"
+#line 744 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_numhosts:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2929,9 +2943,9 @@ yyreduce:
 	}
     break;
 
-  case 192:
+  case 193:
 /* Line 1792 of yacc.c  */
-#line 750 "util/configparser.y"
+#line 753 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_lame_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		verbose(VERB_DETAIL, "ignored infra-cache-lame-size: %s "
@@ -2940,9 +2954,9 @@ yyreduce:
 	}
     break;
 
-  case 193:
+  case 194:
 /* Line 1792 of yacc.c  */
-#line 758 "util/configparser.y"
+#line 761 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2956,9 +2970,21 @@ yyreduce:
 	}
     break;
 
-  case 194:
+  case 195:
 /* Line 1792 of yacc.c  */
-#line 771 "util/configparser.y"
+#line 774 "util/configparser.y"
+    {
+		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->infra_cache_min_rtt = atoi((yyvsp[(2) - (2)].str));
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 196:
+/* Line 1792 of yacc.c  */
+#line 783 "util/configparser.y"
     {
 		OUTYY(("P(server_target_fetch_policy:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->target_fetch_policy);
@@ -2966,9 +2992,9 @@ yyreduce:
 	}
     break;
 
-  case 195:
+  case 197:
 /* Line 1792 of yacc.c  */
-#line 778 "util/configparser.y"
+#line 790 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_short_bufsize:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2979,9 +3005,9 @@ yyreduce:
 	}
     break;
 
-  case 196:
+  case 198:
 /* Line 1792 of yacc.c  */
-#line 788 "util/configparser.y"
+#line 800 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_large_queries:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2992,9 +3018,9 @@ yyreduce:
 	}
     break;
 
-  case 197:
+  case 199:
 /* Line 1792 of yacc.c  */
-#line 798 "util/configparser.y"
+#line 810 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_glue:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3005,9 +3031,9 @@ yyreduce:
 	}
     break;
 
-  case 198:
+  case 200:
 /* Line 1792 of yacc.c  */
-#line 808 "util/configparser.y"
+#line 820 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_dnssec_stripped:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3018,9 +3044,9 @@ yyreduce:
 	}
     break;
 
-  case 199:
+  case 201:
 /* Line 1792 of yacc.c  */
-#line 818 "util/configparser.y"
+#line 830 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_below_nxdomain:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3031,9 +3057,9 @@ yyreduce:
 	}
     break;
 
-  case 200:
+  case 202:
 /* Line 1792 of yacc.c  */
-#line 828 "util/configparser.y"
+#line 840 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_referral_path:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3044,9 +3070,9 @@ yyreduce:
 	}
     break;
 
-  case 201:
+  case 203:
 /* Line 1792 of yacc.c  */
-#line 838 "util/configparser.y"
+#line 850 "util/configparser.y"
     {
 		OUTYY(("P(server_use_caps_for_id:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3057,9 +3083,9 @@ yyreduce:
 	}
     break;
 
-  case 202:
+  case 204:
 /* Line 1792 of yacc.c  */
-#line 848 "util/configparser.y"
+#line 860 "util/configparser.y"
     {
 		OUTYY(("P(server_private_address:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_address, (yyvsp[(2) - (2)].str)))
@@ -3067,9 +3093,9 @@ yyreduce:
 	}
     break;
 
-  case 203:
+  case 205:
 /* Line 1792 of yacc.c  */
-#line 855 "util/configparser.y"
+#line 867 "util/configparser.y"
     {
 		OUTYY(("P(server_private_domain:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_domain, (yyvsp[(2) - (2)].str)))
@@ -3077,9 +3103,9 @@ yyreduce:
 	}
     break;
 
-  case 204:
+  case 206:
 /* Line 1792 of yacc.c  */
-#line 862 "util/configparser.y"
+#line 874 "util/configparser.y"
     {
 		OUTYY(("P(server_prefetch:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3089,9 +3115,9 @@ yyreduce:
 	}
     break;
 
-  case 205:
+  case 207:
 /* Line 1792 of yacc.c  */
-#line 871 "util/configparser.y"
+#line 883 "util/configparser.y"
     {
 		OUTYY(("P(server_prefetch_key:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3101,9 +3127,9 @@ yyreduce:
 	}
     break;
 
-  case 206:
+  case 208:
 /* Line 1792 of yacc.c  */
-#line 880 "util/configparser.y"
+#line 892 "util/configparser.y"
     {
 		OUTYY(("P(server_unwanted_reply_threshold:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3113,9 +3139,9 @@ yyreduce:
 	}
     break;
 
-  case 207:
+  case 209:
 /* Line 1792 of yacc.c  */
-#line 889 "util/configparser.y"
+#line 901 "util/configparser.y"
     {
 		OUTYY(("P(server_do_not_query_address:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->donotqueryaddrs, (yyvsp[(2) - (2)].str)))
@@ -3123,9 +3149,9 @@ yyreduce:
 	}
     break;
 
-  case 208:
+  case 210:
 /* Line 1792 of yacc.c  */
-#line 896 "util/configparser.y"
+#line 908 "util/configparser.y"
     {
 		OUTYY(("P(server_do_not_query_localhost:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3136,9 +3162,9 @@ yyreduce:
 	}
     break;
 
-  case 209:
+  case 211:
 /* Line 1792 of yacc.c  */
-#line 906 "util/configparser.y"
+#line 918 "util/configparser.y"
     {
 		OUTYY(("P(server_access_control:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)));
 		if(strcmp((yyvsp[(3) - (3)].str), "deny")!=0 && strcmp((yyvsp[(3) - (3)].str), "refuse")!=0 &&
@@ -3156,9 +3182,9 @@ yyreduce:
 	}
     break;
 
-  case 210:
+  case 212:
 /* Line 1792 of yacc.c  */
-#line 923 "util/configparser.y"
+#line 935 "util/configparser.y"
     {
 		OUTYY(("P(server_module_conf:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->module_conf);
@@ -3166,9 +3192,9 @@ yyreduce:
 	}
     break;
 
-  case 211:
+  case 213:
 /* Line 1792 of yacc.c  */
-#line 930 "util/configparser.y"
+#line 942 "util/configparser.y"
     {
 		OUTYY(("P(server_val_override_date:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strlen((yyvsp[(2) - (2)].str)) == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0) {
@@ -3187,9 +3213,9 @@ yyreduce:
 	}
     break;
 
-  case 212:
+  case 214:
 /* Line 1792 of yacc.c  */
-#line 948 "util/configparser.y"
+#line 960 "util/configparser.y"
     {
 		OUTYY(("P(server_val_sig_skew_min:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strlen((yyvsp[(2) - (2)].str)) == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0) {
@@ -3203,9 +3229,9 @@ yyreduce:
 	}
     break;
 
-  case 213:
+  case 215:
 /* Line 1792 of yacc.c  */
-#line 961 "util/configparser.y"
+#line 973 "util/configparser.y"
     {
 		OUTYY(("P(server_val_sig_skew_max:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strlen((yyvsp[(2) - (2)].str)) == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0) {
@@ -3219,9 +3245,9 @@ yyreduce:
 	}
     break;
 
-  case 214:
+  case 216:
 /* Line 1792 of yacc.c  */
-#line 974 "util/configparser.y"
+#line 986 "util/configparser.y"
     {
 		OUTYY(("P(server_cache_max_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3231,9 +3257,9 @@ yyreduce:
 	}
     break;
 
-  case 215:
+  case 217:
 /* Line 1792 of yacc.c  */
-#line 983 "util/configparser.y"
+#line 995 "util/configparser.y"
     {
 		OUTYY(("P(server_cache_min_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3243,9 +3269,9 @@ yyreduce:
 	}
     break;
 
-  case 216:
+  case 218:
 /* Line 1792 of yacc.c  */
-#line 992 "util/configparser.y"
+#line 1004 "util/configparser.y"
     {
 		OUTYY(("P(server_bogus_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3255,9 +3281,9 @@ yyreduce:
 	}
     break;
 
-  case 217:
+  case 219:
 /* Line 1792 of yacc.c  */
-#line 1001 "util/configparser.y"
+#line 1013 "util/configparser.y"
     {
 		OUTYY(("P(server_val_clean_additional:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3268,9 +3294,9 @@ yyreduce:
 	}
     break;
 
-  case 218:
+  case 220:
 /* Line 1792 of yacc.c  */
-#line 1011 "util/configparser.y"
+#line 1023 "util/configparser.y"
     {
 		OUTYY(("P(server_val_permissive_mode:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3281,9 +3307,9 @@ yyreduce:
 	}
     break;
 
-  case 219:
+  case 221:
 /* Line 1792 of yacc.c  */
-#line 1021 "util/configparser.y"
+#line 1033 "util/configparser.y"
     {
 		OUTYY(("P(server_ignore_cd_flag:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3293,9 +3319,9 @@ yyreduce:
 	}
     break;
 
-  case 220:
+  case 222:
 /* Line 1792 of yacc.c  */
-#line 1030 "util/configparser.y"
+#line 1042 "util/configparser.y"
     {
 		OUTYY(("P(server_val_log_level:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3305,9 +3331,9 @@ yyreduce:
 	}
     break;
 
-  case 221:
+  case 223:
 /* Line 1792 of yacc.c  */
-#line 1039 "util/configparser.y"
+#line 1051 "util/configparser.y"
     {
 		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->val_nsec3_key_iterations);
@@ -3315,9 +3341,9 @@ yyreduce:
 	}
     break;
 
-  case 222:
+  case 224:
 /* Line 1792 of yacc.c  */
-#line 1046 "util/configparser.y"
+#line 1058 "util/configparser.y"
     {
 		OUTYY(("P(server_add_holddown:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3327,9 +3353,9 @@ yyreduce:
 	}
     break;
 
-  case 223:
+  case 225:
 /* Line 1792 of yacc.c  */
-#line 1055 "util/configparser.y"
+#line 1067 "util/configparser.y"
     {
 		OUTYY(("P(server_del_holddown:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3339,9 +3365,9 @@ yyreduce:
 	}
     break;
 
-  case 224:
+  case 226:
 /* Line 1792 of yacc.c  */
-#line 1064 "util/configparser.y"
+#line 1076 "util/configparser.y"
     {
 		OUTYY(("P(server_keep_missing:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3351,9 +3377,9 @@ yyreduce:
 	}
     break;
 
-  case 225:
+  case 227:
 /* Line 1792 of yacc.c  */
-#line 1073 "util/configparser.y"
+#line 1085 "util/configparser.y"
     {
 		OUTYY(("P(server_key_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->key_cache_size))
@@ -3362,9 +3388,9 @@ yyreduce:
 	}
     break;
 
-  case 226:
+  case 228:
 /* Line 1792 of yacc.c  */
-#line 1081 "util/configparser.y"
+#line 1093 "util/configparser.y"
     {
 		OUTYY(("P(server_key_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -3378,9 +3404,9 @@ yyreduce:
 	}
     break;
 
-  case 227:
+  case 229:
 /* Line 1792 of yacc.c  */
-#line 1094 "util/configparser.y"
+#line 1106 "util/configparser.y"
     {
 		OUTYY(("P(server_neg_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->neg_cache_size))
@@ -3389,18 +3415,19 @@ yyreduce:
 	}
     break;
 
-  case 228:
+  case 230:
 /* Line 1792 of yacc.c  */
-#line 1102 "util/configparser.y"
+#line 1114 "util/configparser.y"
     {
 		OUTYY(("P(server_local_zone:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)));
 		if(strcmp((yyvsp[(3) - (3)].str), "static")!=0 && strcmp((yyvsp[(3) - (3)].str), "deny")!=0 &&
 		   strcmp((yyvsp[(3) - (3)].str), "refuse")!=0 && strcmp((yyvsp[(3) - (3)].str), "redirect")!=0 &&
 		   strcmp((yyvsp[(3) - (3)].str), "transparent")!=0 && strcmp((yyvsp[(3) - (3)].str), "nodefault")!=0
-		   && strcmp((yyvsp[(3) - (3)].str), "typetransparent")!=0)
+		   && strcmp((yyvsp[(3) - (3)].str), "typetransparent")!=0 &&
+		   strcmp((yyvsp[(3) - (3)].str), "inform")!=0)
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
-				"typetransparent or nodefault");
+				"typetransparent, inform or nodefault");
 		else if(strcmp((yyvsp[(3) - (3)].str), "nodefault")==0) {
 			if(!cfg_strlist_insert(&cfg_parser->cfg->
 				local_zones_nodefault, (yyvsp[(2) - (3)].str)))
@@ -3414,9 +3441,9 @@ yyreduce:
 	}
     break;
 
-  case 229:
+  case 231:
 /* Line 1792 of yacc.c  */
-#line 1124 "util/configparser.y"
+#line 1137 "util/configparser.y"
     {
 		OUTYY(("P(server_local_data:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[(2) - (2)].str)))
@@ -3424,9 +3451,9 @@ yyreduce:
 	}
     break;
 
-  case 230:
+  case 232:
 /* Line 1792 of yacc.c  */
-#line 1131 "util/configparser.y"
+#line 1144 "util/configparser.y"
     {
 		char* ptr;
 		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[(2) - (2)].str)));
@@ -3442,9 +3469,9 @@ yyreduce:
 	}
     break;
 
-  case 231:
+  case 233:
 /* Line 1792 of yacc.c  */
-#line 1146 "util/configparser.y"
+#line 1159 "util/configparser.y"
     {
 		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3455,9 +3482,9 @@ yyreduce:
 	}
     break;
 
-  case 232:
+  case 234:
 /* Line 1792 of yacc.c  */
-#line 1156 "util/configparser.y"
+#line 1169 "util/configparser.y"
     {
 		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3468,9 +3495,9 @@ yyreduce:
 	}
     break;
 
-  case 233:
+  case 235:
 /* Line 1792 of yacc.c  */
-#line 1166 "util/configparser.y"
+#line 1179 "util/configparser.y"
     {
 		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		cfg_parser->cfg->max_udp_size = atoi((yyvsp[(2) - (2)].str));
@@ -3478,9 +3505,9 @@ yyreduce:
 	}
     break;
 
-  case 234:
+  case 236:
 /* Line 1792 of yacc.c  */
-#line 1173 "util/configparser.y"
+#line 1186 "util/configparser.y"
     {
 		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dns64_prefix);
@@ -3488,9 +3515,9 @@ yyreduce:
 	}
     break;
 
-  case 235:
+  case 237:
 /* Line 1792 of yacc.c  */
-#line 1180 "util/configparser.y"
+#line 1193 "util/configparser.y"
     {
 		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3500,9 +3527,9 @@ yyreduce:
 	}
     break;
 
-  case 236:
+  case 238:
 /* Line 1792 of yacc.c  */
-#line 1189 "util/configparser.y"
+#line 1202 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->stubs->name)
@@ -3513,9 +3540,9 @@ yyreduce:
 	}
     break;
 
-  case 237:
+  case 239:
 /* Line 1792 of yacc.c  */
-#line 1199 "util/configparser.y"
+#line 1212 "util/configparser.y"
     {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[(2) - (2)].str)))
@@ -3523,9 +3550,9 @@ yyreduce:
 	}
     break;
 
-  case 238:
+  case 240:
 /* Line 1792 of yacc.c  */
-#line 1206 "util/configparser.y"
+#line 1219 "util/configparser.y"
     {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[(2) - (2)].str)))
@@ -3533,9 +3560,9 @@ yyreduce:
 	}
     break;
 
-  case 239:
+  case 241:
 /* Line 1792 of yacc.c  */
-#line 1213 "util/configparser.y"
+#line 1226 "util/configparser.y"
     {
 		OUTYY(("P(stub-first:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3545,9 +3572,9 @@ yyreduce:
 	}
     break;
 
-  case 240:
+  case 242:
 /* Line 1792 of yacc.c  */
-#line 1222 "util/configparser.y"
+#line 1235 "util/configparser.y"
     {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3558,9 +3585,9 @@ yyreduce:
 	}
     break;
 
-  case 241:
+  case 243:
 /* Line 1792 of yacc.c  */
-#line 1232 "util/configparser.y"
+#line 1245 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->forwards->name)
@@ -3571,9 +3598,9 @@ yyreduce:
 	}
     break;
 
-  case 242:
+  case 244:
 /* Line 1792 of yacc.c  */
-#line 1242 "util/configparser.y"
+#line 1255 "util/configparser.y"
     {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[(2) - (2)].str)))
@@ -3581,9 +3608,9 @@ yyreduce:
 	}
     break;
 
-  case 243:
+  case 245:
 /* Line 1792 of yacc.c  */
-#line 1249 "util/configparser.y"
+#line 1262 "util/configparser.y"
     {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[(2) - (2)].str)))
@@ -3591,9 +3618,9 @@ yyreduce:
 	}
     break;
 
-  case 244:
+  case 246:
 /* Line 1792 of yacc.c  */
-#line 1256 "util/configparser.y"
+#line 1269 "util/configparser.y"
     {
 		OUTYY(("P(forward-first:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3603,17 +3630,17 @@ yyreduce:
 	}
     break;
 
-  case 245:
+  case 247:
 /* Line 1792 of yacc.c  */
-#line 1265 "util/configparser.y"
+#line 1278 "util/configparser.y"
     { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
     break;
 
-  case 255:
+  case 258:
 /* Line 1792 of yacc.c  */
-#line 1276 "util/configparser.y"
+#line 1289 "util/configparser.y"
     {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3624,9 +3651,9 @@ yyreduce:
 	}
     break;
 
-  case 256:
+  case 259:
 /* Line 1792 of yacc.c  */
-#line 1286 "util/configparser.y"
+#line 1299 "util/configparser.y"
     {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -3636,9 +3663,9 @@ yyreduce:
 	}
     break;
 
-  case 257:
+  case 260:
 /* Line 1792 of yacc.c  */
-#line 1295 "util/configparser.y"
+#line 1308 "util/configparser.y"
     {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->control_ifs, (yyvsp[(2) - (2)].str)))
@@ -3646,9 +3673,22 @@ yyreduce:
 	}
     break;
 
-  case 258:
+  case 261:
 /* Line 1792 of yacc.c  */
-#line 1302 "util/configparser.y"
+#line 1315 "util/configparser.y"
+    {
+		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->remote_control_use_cert =
+			(strcmp((yyvsp[(2) - (2)].str), "yes")==0);
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 262:
+/* Line 1792 of yacc.c  */
+#line 1325 "util/configparser.y"
     {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->server_key_file);
@@ -3656,9 +3696,9 @@ yyreduce:
 	}
     break;
 
-  case 259:
+  case 263:
 /* Line 1792 of yacc.c  */
-#line 1309 "util/configparser.y"
+#line 1332 "util/configparser.y"
     {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->server_cert_file);
@@ -3666,9 +3706,9 @@ yyreduce:
 	}
     break;
 
-  case 260:
+  case 264:
 /* Line 1792 of yacc.c  */
-#line 1316 "util/configparser.y"
+#line 1339 "util/configparser.y"
     {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->control_key_file);
@@ -3676,9 +3716,9 @@ yyreduce:
 	}
     break;
 
-  case 261:
+  case 265:
 /* Line 1792 of yacc.c  */
-#line 1323 "util/configparser.y"
+#line 1346 "util/configparser.y"
     {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->control_cert_file);
@@ -3686,17 +3726,17 @@ yyreduce:
 	}
     break;
 
-  case 262:
+  case 266:
 /* Line 1792 of yacc.c  */
-#line 1330 "util/configparser.y"
+#line 1353 "util/configparser.y"
     {
 		OUTYY(("\nP(dnstap:)\n"));
 	}
     break;
 
-  case 277:
+  case 281:
 /* Line 1792 of yacc.c  */
-#line 1347 "util/configparser.y"
+#line 1370 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3705,9 +3745,9 @@ yyreduce:
 	}
     break;
 
-  case 278:
+  case 282:
 /* Line 1792 of yacc.c  */
-#line 1355 "util/configparser.y"
+#line 1378 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dnstap_socket_path);
@@ -3715,9 +3755,9 @@ yyreduce:
 	}
     break;
 
-  case 279:
+  case 283:
 /* Line 1792 of yacc.c  */
-#line 1362 "util/configparser.y"
+#line 1385 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3726,9 +3766,9 @@ yyreduce:
 	}
     break;
 
-  case 280:
+  case 284:
 /* Line 1792 of yacc.c  */
-#line 1370 "util/configparser.y"
+#line 1393 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3737,9 +3777,9 @@ yyreduce:
 	}
     break;
 
-  case 281:
+  case 285:
 /* Line 1792 of yacc.c  */
-#line 1378 "util/configparser.y"
+#line 1401 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dnstap_identity);
@@ -3747,9 +3787,9 @@ yyreduce:
 	}
     break;
 
-  case 282:
+  case 286:
 /* Line 1792 of yacc.c  */
-#line 1385 "util/configparser.y"
+#line 1408 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dnstap_version);
@@ -3757,9 +3797,9 @@ yyreduce:
 	}
     break;
 
-  case 283:
+  case 287:
 /* Line 1792 of yacc.c  */
-#line 1392 "util/configparser.y"
+#line 1415 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3769,9 +3809,9 @@ yyreduce:
 	}
     break;
 
-  case 284:
+  case 288:
 /* Line 1792 of yacc.c  */
-#line 1401 "util/configparser.y"
+#line 1424 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3781,9 +3821,9 @@ yyreduce:
 	}
     break;
 
-  case 285:
+  case 289:
 /* Line 1792 of yacc.c  */
-#line 1410 "util/configparser.y"
+#line 1433 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3793,9 +3833,9 @@ yyreduce:
 	}
     break;
 
-  case 286:
+  case 290:
 /* Line 1792 of yacc.c  */
-#line 1419 "util/configparser.y"
+#line 1442 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3805,9 +3845,9 @@ yyreduce:
 	}
     break;
 
-  case 287:
+  case 291:
 /* Line 1792 of yacc.c  */
-#line 1428 "util/configparser.y"
+#line 1451 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3817,9 +3857,9 @@ yyreduce:
 	}
     break;
 
-  case 288:
+  case 292:
 /* Line 1792 of yacc.c  */
-#line 1437 "util/configparser.y"
+#line 1460 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3829,17 +3869,17 @@ yyreduce:
 	}
     break;
 
-  case 289:
+  case 293:
 /* Line 1792 of yacc.c  */
-#line 1446 "util/configparser.y"
+#line 1469 "util/configparser.y"
     { 
 		OUTYY(("\nP(python:)\n")); 
 	}
     break;
 
-  case 293:
+  case 297:
 /* Line 1792 of yacc.c  */
-#line 1455 "util/configparser.y"
+#line 1478 "util/configparser.y"
     {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->python_script);
@@ -3849,7 +3889,7 @@ yyreduce:
 
 
 /* Line 1792 of yacc.c  */
-#line 3853 "util/configparser.c"
+#line 3893 "util/configparser.c"
       default: break;
     }
   /* User semantic actions sometimes alter yychar, and that requires
@@ -4081,7 +4121,7 @@ yyreturn:
 
 
 /* Line 2055 of yacc.c  */
-#line 1460 "util/configparser.y"
+#line 1483 "util/configparser.y"
 
 
 /* parse helper routines could be here */
diff --git a/util/configparser.h b/util/configparser.h
index e0a2b4f78bf4..95b6f640e402 100644
--- a/util/configparser.h
+++ b/util/configparser.h
@@ -139,59 +139,61 @@ extern int yydebug;
      VAR_SERVER_CERT_FILE = 348,
      VAR_CONTROL_KEY_FILE = 349,
      VAR_CONTROL_CERT_FILE = 350,
-     VAR_EXTENDED_STATISTICS = 351,
-     VAR_LOCAL_DATA_PTR = 352,
-     VAR_JOSTLE_TIMEOUT = 353,
-     VAR_STUB_PRIME = 354,
-     VAR_UNWANTED_REPLY_THRESHOLD = 355,
-     VAR_LOG_TIME_ASCII = 356,
-     VAR_DOMAIN_INSECURE = 357,
-     VAR_PYTHON = 358,
-     VAR_PYTHON_SCRIPT = 359,
-     VAR_VAL_SIG_SKEW_MIN = 360,
-     VAR_VAL_SIG_SKEW_MAX = 361,
-     VAR_CACHE_MIN_TTL = 362,
-     VAR_VAL_LOG_LEVEL = 363,
-     VAR_AUTO_TRUST_ANCHOR_FILE = 364,
-     VAR_KEEP_MISSING = 365,
-     VAR_ADD_HOLDDOWN = 366,
-     VAR_DEL_HOLDDOWN = 367,
-     VAR_SO_RCVBUF = 368,
-     VAR_EDNS_BUFFER_SIZE = 369,
-     VAR_PREFETCH = 370,
-     VAR_PREFETCH_KEY = 371,
-     VAR_SO_SNDBUF = 372,
-     VAR_SO_REUSEPORT = 373,
-     VAR_HARDEN_BELOW_NXDOMAIN = 374,
-     VAR_IGNORE_CD_FLAG = 375,
-     VAR_LOG_QUERIES = 376,
-     VAR_TCP_UPSTREAM = 377,
-     VAR_SSL_UPSTREAM = 378,
-     VAR_SSL_SERVICE_KEY = 379,
-     VAR_SSL_SERVICE_PEM = 380,
-     VAR_SSL_PORT = 381,
-     VAR_FORWARD_FIRST = 382,
-     VAR_STUB_FIRST = 383,
-     VAR_MINIMAL_RESPONSES = 384,
-     VAR_RRSET_ROUNDROBIN = 385,
-     VAR_MAX_UDP_SIZE = 386,
-     VAR_DELAY_CLOSE = 387,
-     VAR_UNBLOCK_LAN_ZONES = 388,
-     VAR_DNS64_PREFIX = 389,
-     VAR_DNS64_SYNTHALL = 390,
-     VAR_DNSTAP = 391,
-     VAR_DNSTAP_ENABLE = 392,
-     VAR_DNSTAP_SOCKET_PATH = 393,
-     VAR_DNSTAP_SEND_IDENTITY = 394,
-     VAR_DNSTAP_SEND_VERSION = 395,
-     VAR_DNSTAP_IDENTITY = 396,
-     VAR_DNSTAP_VERSION = 397,
-     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 398,
-     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 399,
-     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 400,
-     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 401,
-     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 402,
-     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 403
+     VAR_CONTROL_USE_CERT = 351,
+     VAR_EXTENDED_STATISTICS = 352,
+     VAR_LOCAL_DATA_PTR = 353,
+     VAR_JOSTLE_TIMEOUT = 354,
+     VAR_STUB_PRIME = 355,
+     VAR_UNWANTED_REPLY_THRESHOLD = 356,
+     VAR_LOG_TIME_ASCII = 357,
+     VAR_DOMAIN_INSECURE = 358,
+     VAR_PYTHON = 359,
+     VAR_PYTHON_SCRIPT = 360,
+     VAR_VAL_SIG_SKEW_MIN = 361,
+     VAR_VAL_SIG_SKEW_MAX = 362,
+     VAR_CACHE_MIN_TTL = 363,
+     VAR_VAL_LOG_LEVEL = 364,
+     VAR_AUTO_TRUST_ANCHOR_FILE = 365,
+     VAR_KEEP_MISSING = 366,
+     VAR_ADD_HOLDDOWN = 367,
+     VAR_DEL_HOLDDOWN = 368,
+     VAR_SO_RCVBUF = 369,
+     VAR_EDNS_BUFFER_SIZE = 370,
+     VAR_PREFETCH = 371,
+     VAR_PREFETCH_KEY = 372,
+     VAR_SO_SNDBUF = 373,
+     VAR_SO_REUSEPORT = 374,
+     VAR_HARDEN_BELOW_NXDOMAIN = 375,
+     VAR_IGNORE_CD_FLAG = 376,
+     VAR_LOG_QUERIES = 377,
+     VAR_TCP_UPSTREAM = 378,
+     VAR_SSL_UPSTREAM = 379,
+     VAR_SSL_SERVICE_KEY = 380,
+     VAR_SSL_SERVICE_PEM = 381,
+     VAR_SSL_PORT = 382,
+     VAR_FORWARD_FIRST = 383,
+     VAR_STUB_FIRST = 384,
+     VAR_MINIMAL_RESPONSES = 385,
+     VAR_RRSET_ROUNDROBIN = 386,
+     VAR_MAX_UDP_SIZE = 387,
+     VAR_DELAY_CLOSE = 388,
+     VAR_UNBLOCK_LAN_ZONES = 389,
+     VAR_INFRA_CACHE_MIN_RTT = 390,
+     VAR_DNS64_PREFIX = 391,
+     VAR_DNS64_SYNTHALL = 392,
+     VAR_DNSTAP = 393,
+     VAR_DNSTAP_ENABLE = 394,
+     VAR_DNSTAP_SOCKET_PATH = 395,
+     VAR_DNSTAP_SEND_IDENTITY = 396,
+     VAR_DNSTAP_SEND_VERSION = 397,
+     VAR_DNSTAP_IDENTITY = 398,
+     VAR_DNSTAP_VERSION = 399,
+     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 400,
+     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 401,
+     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 402,
+     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 403,
+     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 404,
+     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405
    };
 #endif
 /* Tokens.  */
@@ -288,59 +290,61 @@ extern int yydebug;
 #define VAR_SERVER_CERT_FILE 348
 #define VAR_CONTROL_KEY_FILE 349
 #define VAR_CONTROL_CERT_FILE 350
-#define VAR_EXTENDED_STATISTICS 351
-#define VAR_LOCAL_DATA_PTR 352
-#define VAR_JOSTLE_TIMEOUT 353
-#define VAR_STUB_PRIME 354
-#define VAR_UNWANTED_REPLY_THRESHOLD 355
-#define VAR_LOG_TIME_ASCII 356
-#define VAR_DOMAIN_INSECURE 357
-#define VAR_PYTHON 358
-#define VAR_PYTHON_SCRIPT 359
-#define VAR_VAL_SIG_SKEW_MIN 360
-#define VAR_VAL_SIG_SKEW_MAX 361
-#define VAR_CACHE_MIN_TTL 362
-#define VAR_VAL_LOG_LEVEL 363
-#define VAR_AUTO_TRUST_ANCHOR_FILE 364
-#define VAR_KEEP_MISSING 365
-#define VAR_ADD_HOLDDOWN 366
-#define VAR_DEL_HOLDDOWN 367
-#define VAR_SO_RCVBUF 368
-#define VAR_EDNS_BUFFER_SIZE 369
-#define VAR_PREFETCH 370
-#define VAR_PREFETCH_KEY 371
-#define VAR_SO_SNDBUF 372
-#define VAR_SO_REUSEPORT 373
-#define VAR_HARDEN_BELOW_NXDOMAIN 374
-#define VAR_IGNORE_CD_FLAG 375
-#define VAR_LOG_QUERIES 376
-#define VAR_TCP_UPSTREAM 377
-#define VAR_SSL_UPSTREAM 378
-#define VAR_SSL_SERVICE_KEY 379
-#define VAR_SSL_SERVICE_PEM 380
-#define VAR_SSL_PORT 381
-#define VAR_FORWARD_FIRST 382
-#define VAR_STUB_FIRST 383
-#define VAR_MINIMAL_RESPONSES 384
-#define VAR_RRSET_ROUNDROBIN 385
-#define VAR_MAX_UDP_SIZE 386
-#define VAR_DELAY_CLOSE 387
-#define VAR_UNBLOCK_LAN_ZONES 388
-#define VAR_DNS64_PREFIX 389
-#define VAR_DNS64_SYNTHALL 390
-#define VAR_DNSTAP 391
-#define VAR_DNSTAP_ENABLE 392
-#define VAR_DNSTAP_SOCKET_PATH 393
-#define VAR_DNSTAP_SEND_IDENTITY 394
-#define VAR_DNSTAP_SEND_VERSION 395
-#define VAR_DNSTAP_IDENTITY 396
-#define VAR_DNSTAP_VERSION 397
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 398
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 399
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 400
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 401
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 402
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 403
+#define VAR_CONTROL_USE_CERT 351
+#define VAR_EXTENDED_STATISTICS 352
+#define VAR_LOCAL_DATA_PTR 353
+#define VAR_JOSTLE_TIMEOUT 354
+#define VAR_STUB_PRIME 355
+#define VAR_UNWANTED_REPLY_THRESHOLD 356
+#define VAR_LOG_TIME_ASCII 357
+#define VAR_DOMAIN_INSECURE 358
+#define VAR_PYTHON 359
+#define VAR_PYTHON_SCRIPT 360
+#define VAR_VAL_SIG_SKEW_MIN 361
+#define VAR_VAL_SIG_SKEW_MAX 362
+#define VAR_CACHE_MIN_TTL 363
+#define VAR_VAL_LOG_LEVEL 364
+#define VAR_AUTO_TRUST_ANCHOR_FILE 365
+#define VAR_KEEP_MISSING 366
+#define VAR_ADD_HOLDDOWN 367
+#define VAR_DEL_HOLDDOWN 368
+#define VAR_SO_RCVBUF 369
+#define VAR_EDNS_BUFFER_SIZE 370
+#define VAR_PREFETCH 371
+#define VAR_PREFETCH_KEY 372
+#define VAR_SO_SNDBUF 373
+#define VAR_SO_REUSEPORT 374
+#define VAR_HARDEN_BELOW_NXDOMAIN 375
+#define VAR_IGNORE_CD_FLAG 376
+#define VAR_LOG_QUERIES 377
+#define VAR_TCP_UPSTREAM 378
+#define VAR_SSL_UPSTREAM 379
+#define VAR_SSL_SERVICE_KEY 380
+#define VAR_SSL_SERVICE_PEM 381
+#define VAR_SSL_PORT 382
+#define VAR_FORWARD_FIRST 383
+#define VAR_STUB_FIRST 384
+#define VAR_MINIMAL_RESPONSES 385
+#define VAR_RRSET_ROUNDROBIN 386
+#define VAR_MAX_UDP_SIZE 387
+#define VAR_DELAY_CLOSE 388
+#define VAR_UNBLOCK_LAN_ZONES 389
+#define VAR_INFRA_CACHE_MIN_RTT 390
+#define VAR_DNS64_PREFIX 391
+#define VAR_DNS64_SYNTHALL 392
+#define VAR_DNSTAP 393
+#define VAR_DNSTAP_ENABLE 394
+#define VAR_DNSTAP_SOCKET_PATH 395
+#define VAR_DNSTAP_SEND_IDENTITY 396
+#define VAR_DNSTAP_SEND_VERSION 397
+#define VAR_DNSTAP_IDENTITY 398
+#define VAR_DNSTAP_VERSION 399
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 400
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 401
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 402
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 403
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 404
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 405
 
 
 
@@ -354,7 +358,7 @@ typedef union YYSTYPE
 
 
 /* Line 2058 of yacc.c  */
-#line 358 "util/configparser.h"
+#line 362 "util/configparser.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
diff --git a/util/configparser.y b/util/configparser.y
index cbb5e16bd813..396ea3c64d64 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -107,6 +107,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_SSL_SERVICE_KEY VAR_SSL_SERVICE_PEM VAR_SSL_PORT VAR_FORWARD_FIRST
 %token VAR_STUB_FIRST VAR_MINIMAL_RESPONSES VAR_RRSET_ROUNDROBIN
 %token VAR_MAX_UDP_SIZE VAR_DELAY_CLOSE VAR_UNBLOCK_LAN_ZONES
+%token VAR_INFRA_CACHE_MIN_RTT
 %token VAR_DNS64_PREFIX VAR_DNS64_SYNTHALL
 %token VAR_DNSTAP VAR_DNSTAP_ENABLE VAR_DNSTAP_SOCKET_PATH
 %token VAR_DNSTAP_SEND_IDENTITY VAR_DNSTAP_SEND_VERSION
@@ -175,7 +176,8 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_ssl_service_key | server_ssl_service_pem | server_ssl_port |
 	server_minimal_responses | server_rrset_roundrobin | server_max_udp_size |
 	server_so_reuseport | server_delay_close | server_unblock_lan_zones |
-	server_dns64_prefix | server_dns64_synthall
+	server_dns64_prefix | server_dns64_synthall |
+	server_infra_cache_min_rtt
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -768,6 +770,15 @@ server_infra_cache_slabs: VAR_INFRA_CACHE_SLABS STRING_ARG
 		free($2);
 	}
 	;
+server_infra_cache_min_rtt: VAR_INFRA_CACHE_MIN_RTT STRING_ARG
+	{
+		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->infra_cache_min_rtt = atoi($2);
+		free($2);
+	}
+	;
 server_target_fetch_policy: VAR_TARGET_FETCH_POLICY STRING_ARG
 	{
 		OUTYY(("P(server_target_fetch_policy:%s)\n", $2));
@@ -1105,10 +1116,11 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 		if(strcmp($3, "static")!=0 && strcmp($3, "deny")!=0 &&
 		   strcmp($3, "refuse")!=0 && strcmp($3, "redirect")!=0 &&
 		   strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
-		   && strcmp($3, "typetransparent")!=0)
+		   && strcmp($3, "typetransparent")!=0 &&
+		   strcmp($3, "inform")!=0)
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
-				"typetransparent or nodefault");
+				"typetransparent, inform or nodefault");
 		else if(strcmp($3, "nodefault")==0) {
 			if(!cfg_strlist_insert(&cfg_parser->cfg->
 				local_zones_nodefault, $2))
diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index d318477e56f4..99e5a6543518 100644
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -3819,6 +3819,7 @@
 4359,
 4361,
 4362,
+4366,
 4368,
 4369,
 4370,
@@ -4399,6 +4400,7 @@
 6163,
 6200,
 6201,
+6209,
 6222,
 6241,
 6242,
@@ -4488,6 +4490,8 @@
 6628,
 6633,
 6634,
+6635,
+6636,
 6653,
 6657,
 6670,
@@ -4671,6 +4675,7 @@
 7778,
 7779,
 7781,
+7784,
 7786,
 7787,
 7789,
diff --git a/util/net_help.c b/util/net_help.c
index 335ee7499e7d..e2b7c38783ab 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -156,7 +156,12 @@ log_addr(enum verbosity_value v, const char* str,
 		case AF_INET6: family="ip6";
 			sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
 			break;
-		case AF_LOCAL: family="local"; break;
+		case AF_LOCAL:
+			dest[0]=0;
+			(void)inet_ntop(af, sinaddr, dest,
+				(socklen_t)sizeof(dest));
+			verbose(v, "%s local %s", str, dest);
+			return; /* do not continue and try to get port */
 		default: break;
 	}
 	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
diff --git a/util/rtt.c b/util/rtt.c
index 4b44fca5060e..5d86f13378e5 100644
--- a/util/rtt.c
+++ b/util/rtt.c
@@ -42,6 +42,8 @@
 #include "config.h"
 #include "util/rtt.h"
 
+/* overwritten by config: infra_cache_min_rtt: */
+int RTT_MIN_TIMEOUT = 50;
 /** calculate RTO from rtt information */
 static int
 calc_rto(const struct rtt_info* rtt)
diff --git a/util/rtt.h b/util/rtt.h
index 57e904d1407f..d6da98606502 100644
--- a/util/rtt.h
+++ b/util/rtt.h
@@ -56,7 +56,7 @@ struct rtt_info {
 };
 
 /** min retransmit timeout value, in milliseconds */
-#define RTT_MIN_TIMEOUT	50
+extern int RTT_MIN_TIMEOUT;
 /** max retransmit timeout value, in milliseconds */
 #define RTT_MAX_TIMEOUT 120000
 
diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
index d89675f835b0..3437c8da6047 100644
--- a/validator/val_secalgo.c
+++ b/validator/val_secalgo.c
@@ -41,8 +41,9 @@
  * and do the library calls (for the crypto library in use).
  */
 #include "config.h"
-#include "validator/val_secalgo.h"
+/* packed_rrset on top to define enum types (forced by c99 standard) */
 #include "util/data/packed_rrset.h"
+#include "validator/val_secalgo.h"
 #include "util/log.h"
 #include "ldns/rrdef.h"
 #include "ldns/keyraw.h"
diff --git a/validator/val_utils.c b/validator/val_utils.c
index ecf2dfaf05c8..475b0c9054e0 100644
--- a/validator/val_utils.c
+++ b/validator/val_utils.c
@@ -846,6 +846,18 @@ val_fill_reply(struct reply_info* chase, struct reply_info* orig,
 		chase->ar_numrrsets;
 }
 
+void val_reply_remove_auth(struct reply_info* rep, size_t index)
+{
+	log_assert(index < rep->rrset_count);
+	log_assert(index >= rep->an_numrrsets);
+	log_assert(index < rep->an_numrrsets+rep->ns_numrrsets);
+	memmove(rep->rrsets+index, rep->rrsets+index+1,
+		sizeof(struct ub_packed_rrset_key*)*
+		(rep->rrset_count - index - 1));
+	rep->ns_numrrsets--;
+	rep->rrset_count--;
+}
+
 void
 val_check_nonsecure(struct val_env* ve, struct reply_info* rep) 
 {
diff --git a/validator/val_utils.h b/validator/val_utils.h
index b0344eff7de9..cdb87697e1c2 100644
--- a/validator/val_utils.h
+++ b/validator/val_utils.h
@@ -294,6 +294,13 @@ int val_chase_cname(struct query_info* qchase, struct reply_info* rep,
 void val_fill_reply(struct reply_info* chase, struct reply_info* orig, 
 	size_t cname_skip, uint8_t* name, size_t len, uint8_t* signer);
 
+/**
+ * Remove rrset with index from reply, from the authority section.
+ * @param rep: reply to remove it from.
+ * @param index: rrset to remove, must be in the authority section.
+ */
+void val_reply_remove_auth(struct reply_info* rep, size_t index);
+
 /**
  * Remove all unsigned or non-secure status rrsets from NS and AR sections.
  * So that unsigned data does not get let through to clients, when we have
diff --git a/validator/validator.c b/validator/validator.c
index 9d5d5c390254..cc07cc2b1525 100644
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -574,6 +574,61 @@ detect_wrongly_truncated(struct reply_info* rep)
 	return 1;
 }
 
+/**
+ * For messages that are not referrals, if the chase reply contains an
+ * unsigned NS record in the authority section it could have been
+ * inserted by a (BIND) forwarder that thinks the zone is insecure, and
+ * that has an NS record without signatures in cache.  Remove the NS
+ * record since the reply does not hinge on that record (in the authority
+ * section), but do not remove it if it removes the last record from the
+ * answer+authority sections.
+ * @param chase_reply: the chased reply, we have a key for this contents,
+ * 	so we should have signatures for these rrsets and not having
+ * 	signatures means it will be bogus.
+ * @param orig_reply: original reply, remove NS from there as well because
+ * 	we cannot mark the NS record as DNSSEC valid because it is not
+ * 	validated by signatures.
+ */
+static void
+remove_spurious_authority(struct reply_info* chase_reply,
+	struct reply_info* orig_reply)
+{
+	size_t i, found = 0;
+	int remove = 0;
+	/* if no answer and only 1 auth RRset, do not remove that one */
+	if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1)
+		return;
+	/* search authority section for unsigned NS records */
+	for(i = chase_reply->an_numrrsets;
+		i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) {
+		struct packed_rrset_data* d = (struct packed_rrset_data*)
+			chase_reply->rrsets[i]->entry.data;
+		if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
+			&& d->rrsig_count == 0) {
+			found = i;
+			remove = 1;
+			break;
+		}
+	}
+	/* see if we found the entry */
+	if(!remove) return;
+	log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record "
+		"(likely inserted by forwarder)", chase_reply->rrsets[found]);
+
+	/* find rrset in orig_reply */
+	for(i = orig_reply->an_numrrsets;
+		i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) {
+		if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
+			&& query_dname_compare(orig_reply->rrsets[i]->rk.dname,
+				chase_reply->rrsets[found]->rk.dname) == 0) {
+			/* remove from orig_msg */
+			val_reply_remove_auth(orig_reply, i);
+			break;
+		}
+	}
+	/* remove rrset from chase_reply */
+	val_reply_remove_auth(chase_reply, found);
+}
 
 /**
  * Given a "positive" response -- a response that contains an answer to the
@@ -1642,6 +1697,8 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 	}
 	subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
 		&vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
+	if(subtype != VAL_CLASS_REFERRAL)
+		remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
 
 	/* check signatures in the message; 
 	 * answer and authority must be valid, additional is only checked. */

From 6734afde60fe68c745f16185e37a1aad6654984a Mon Sep 17 00:00:00 2001
From: des <des@FreeBSD.org>
Date: Sun, 26 Apr 2015 11:25:07 +0000
Subject: [PATCH 6/8] import unbound 1.5.3

---
 compat/getentropy_linux.c  |  7 ++++
 configure                  | 81 ++++++++++++++++++++++++++++++++------
 configure.ac               |  6 ++-
 daemon/remote.c            |  2 +-
 daemon/unbound.c           | 23 +++++------
 doc/Changelog              | 15 +++++++
 doc/README                 |  2 +-
 doc/example.conf.in        |  2 +-
 doc/libunbound.3.in        |  4 +-
 doc/unbound-anchor.8.in    |  2 +-
 doc/unbound-checkconf.8.in |  2 +-
 doc/unbound-control.8.in   |  2 +-
 doc/unbound-host.1.in      |  2 +-
 doc/unbound.8.in           |  4 +-
 doc/unbound.conf.5.in      |  2 +-
 services/listen_dnsport.c  |  2 +-
 util/config_file.c         | 11 ++++--
 util/config_file.h         |  9 +++--
 util/iana_ports.inc        |  2 +
 19 files changed, 135 insertions(+), 45 deletions(-)

diff --git a/compat/getentropy_linux.c b/compat/getentropy_linux.c
index 60e010db713a..d4adab2852d4 100644
--- a/compat/getentropy_linux.c
+++ b/compat/getentropy_linux.c
@@ -93,6 +93,13 @@ getentropy(void *buf, size_t len)
 		return -1;
 	}
 
+#ifdef SYS_getrandom
+	/* try to use getrandom syscall introduced with kernel 3.17 */
+	ret = syscall(SYS_getrandom, buf, len, 0);
+	if (ret != -1)
+		return (ret);
+#endif /* SYS_getrandom */
+
 	/*
 	 * Try to get entropy with /dev/urandom
 	 *
diff --git a/configure b/configure
index 26e3e8296b69..20ff33d72990 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.5.2.
+# Generated by GNU Autoconf 2.69 for unbound 1.5.3.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.5.2'
-PACKAGE_STRING='unbound 1.5.2'
+PACKAGE_VERSION='1.5.3'
+PACKAGE_STRING='unbound 1.5.3'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''
 
@@ -1388,7 +1388,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.5.2 to adapt to many kinds of systems.
+\`configure' configures unbound 1.5.3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1453,7 +1453,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.5.2:";;
+     short | recursive ) echo "Configuration of unbound 1.5.3:";;
    esac
   cat <<\_ACEOF
 
@@ -1628,7 +1628,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.5.2
+unbound configure 1.5.3
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2337,7 +2337,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.5.2, which was
+It was created by unbound $as_me 1.5.3, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2689,11 +2689,11 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=5
 
-UNBOUND_VERSION_MICRO=2
+UNBOUND_VERSION_MICRO=3
 
 
 LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=5
+LIBUNBOUND_REVISION=6
 LIBUNBOUND_AGE=3
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2735,6 +2735,7 @@ LIBUNBOUND_AGE=3
 # 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
 # 1.5.1 had 5:3:3
 # 1.5.2 had 5:5:3
+# 1.5.3 had 5:6:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -18253,6 +18254,62 @@ done
 					# this lib needed for sha2 on solaris
 					LIBS="$LIBS -lmd"
 				fi
+				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing clock_gettime" >&5
+$as_echo_n "checking for library containing clock_gettime... " >&6; }
+if ${ac_cv_search_clock_gettime+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char clock_gettime ();
+int
+main ()
+{
+return clock_gettime ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' rt; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_clock_gettime=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_clock_gettime+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_clock_gettime+:} false; then :
+
+else
+  ac_cv_search_clock_gettime=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_clock_gettime" >&5
+$as_echo "$ac_cv_search_clock_gettime" >&6; }
+ac_res=$ac_cv_search_clock_gettime
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
 			;;
 			Linux|*)
 				case " $LIBOBJS " in
@@ -18805,7 +18862,7 @@ _ACEOF
 
 
 
-version=1.5.2
+version=1.5.3
 
 date=`date +'%b %e, %Y'`
 
@@ -19320,7 +19377,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.5.2, which was
+This file was extended by unbound $as_me 1.5.3, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -19386,7 +19443,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.5.2
+unbound config.status 1.5.3
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index 8d496ce9bbf1..ae0525b540b0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10,14 +10,14 @@ sinclude(dnstap/dnstap.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[5])
-m4_define([VERSION_MICRO],[2])
+m4_define([VERSION_MICRO],[3])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=5
+LIBUNBOUND_REVISION=6
 LIBUNBOUND_AGE=3
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -59,6 +59,7 @@ LIBUNBOUND_AGE=3
 # 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
 # 1.5.1 had 5:3:3
 # 1.5.2 had 5:5:3
+# 1.5.3 had 5:6:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -1021,6 +1022,7 @@ if test "$USE_NSS" = "no"; then
 					# this lib needed for sha2 on solaris
 					LIBS="$LIBS -lmd"
 				fi
+				AC_SEARCH_LIBS([clock_gettime], [rt])
 			;;
 			Linux|*)
 				AC_LIBOBJ(getentropy_linux)
diff --git a/daemon/remote.c b/daemon/remote.c
index 7a8fdb75e75b..65749568fddf 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -329,7 +329,7 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 		if(fd != -1) {
 #ifdef HAVE_CHOWN
 			if (cfg->username && cfg->username[0])
-				chown(ip, cfg->uid, cfg->gid);
+				chown(ip, cfg_uid, cfg_gid);
 			chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP));
 #else
 			(void)cfg;
diff --git a/daemon/unbound.c b/daemon/unbound.c
index f6bd924a57b9..b70e39686d4c 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -505,9 +505,9 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 		writepid(daemon->pidfile, getpid());
 		if(cfg->username && cfg->username[0]) {
 #  ifdef HAVE_CHOWN
-			if(chown(daemon->pidfile, cfg->uid, cfg->gid) == -1) {
+			if(chown(daemon->pidfile, cfg_uid, cfg_gid) == -1) {
 				log_err("cannot chown %u.%u %s: %s",
-					(unsigned)cfg->uid, (unsigned)cfg->gid,
+					(unsigned)cfg_uid, (unsigned)cfg_gid,
 					daemon->pidfile, strerror(errno));
 			}
 #  endif /* HAVE_CHOWN */
@@ -524,7 +524,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 		/* setusercontext does initgroups, setuid, setgid, and
 		 * also resource limits from login config, but we
 		 * still call setresuid, setresgid to be sure to set all uid*/
-		if(setusercontext(NULL, pwd, cfg->uid, (unsigned)
+		if(setusercontext(NULL, pwd, cfg_uid, (unsigned)
 			LOGIN_SETALL & ~LOGIN_SETUSER & ~LOGIN_SETGROUP) != 0)
 			log_warn("unable to setusercontext %s: %s",
 				cfg->username, strerror(errno));
@@ -588,27 +588,27 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #ifdef HAVE_GETPWNAM
 	if(cfg->username && cfg->username[0]) {
 #  ifdef HAVE_INITGROUPS
-		if(initgroups(cfg->username, cfg->gid) != 0)
+		if(initgroups(cfg->username, cfg_gid) != 0)
 			log_warn("unable to initgroups %s: %s",
 				cfg->username, strerror(errno));
 #  endif /* HAVE_INITGROUPS */
 		endpwent();
 
 #ifdef HAVE_SETRESGID
-		if(setresgid(cfg->gid,cfg->gid,cfg->gid) != 0)
+		if(setresgid(cfg_gid,cfg_gid,cfg_gid) != 0)
 #elif defined(HAVE_SETREGID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setregid(cfg->gid,cfg->gid) != 0)
+		if(setregid(cfg_gid,cfg_gid) != 0)
 #else /* use setgid */
-		if(setgid(cfg->gid) != 0)
+		if(setgid(cfg_gid) != 0)
 #endif /* HAVE_SETRESGID */
 			fatal_exit("unable to set group id of %s: %s", 
 				cfg->username, strerror(errno));
 #ifdef HAVE_SETRESUID
-		if(setresuid(cfg->uid,cfg->uid,cfg->uid) != 0)
+		if(setresuid(cfg_uid,cfg_uid,cfg_uid) != 0)
 #elif defined(HAVE_SETREUID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setreuid(cfg->uid,cfg->uid) != 0)
+		if(setreuid(cfg_uid,cfg_uid) != 0)
 #else /* use setuid */
-		if(setuid(cfg->uid) != 0)
+		if(setuid(cfg_uid) != 0)
 #endif /* HAVE_SETRESUID */
 			fatal_exit("unable to set user id of %s: %s", 
 				cfg->username, strerror(errno));
@@ -653,7 +653,8 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
 			log_warn("Continuing with default config settings");
 		}
 		apply_settings(daemon, cfg, cmdline_verbose, debug_mode);
-		config_lookup_uid(cfg);
+		if(!done_setup)
+			config_lookup_uid(cfg);
 	
 		/* prepare */
 		if(!daemon_open_shared_ports(daemon))
diff --git a/doc/Changelog b/doc/Changelog
index 4b3a4949a217..5c3447cbe673 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,18 @@
+2 March 2015: Wouter
+	- iana portlist update.
+
+20 February 2015: Wouter
+	- Use the getrandom syscall introduced in Linux 3.17 (from Heiner
+	  Kallweit).
+	- Fix #645 Portability to Solaris 10, use AF_LOCAL.
+	- Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
+	- Fix #647 crash in 1.5.2 because pwd.db no longer accessible after
+	  reload.
+
+19 February 2015: Wouter
+	- 1.5.2 release tag.
+	- svn trunk contains 1.5.3 under development.
+
 13 February 2015: Wouter
 	- Fix #643: doc/example.conf.in: unnecessary whitespace.
 
diff --git a/doc/README b/doc/README
index 5c6648599e5c..f3530d6eedf4 100644
--- a/doc/README
+++ b/doc/README
@@ -1,4 +1,4 @@
-README for Unbound 1.5.2
+README for Unbound 1.5.3
 Copyright 2007 NLnet Labs
 http://unbound.net
 
diff --git a/doc/example.conf.in b/doc/example.conf.in
index ddcb4f03d1bc..60ed5c89f91e 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.5.2.
+# See unbound.conf(5) man page, version 1.5.3.
 #
 # this is a comment.
 
diff --git a/doc/libunbound.3.in b/doc/libunbound.3.in
index 02f45e66fc69..a4c7945aea1b 100644
--- a/doc/libunbound.3.in
+++ b/doc/libunbound.3.in
@@ -1,4 +1,4 @@
-.TH "libunbound" "3" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
+.TH "libunbound" "3" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
 .\"
 .\" libunbound.3 -- unbound library functions manual
 .\"
@@ -42,7 +42,7 @@
 .B ub_ctx_zone_remove,
 .B ub_ctx_data_add,
 .B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.5.2 functions.
+\- Unbound DNS validating resolver 1.5.3 functions.
 .SH "SYNOPSIS"
 .B #include <unbound.h>
 .LP
diff --git a/doc/unbound-anchor.8.in b/doc/unbound-anchor.8.in
index aaba750ae0ed..fb2136fc1aaf 100644
--- a/doc/unbound-anchor.8.in
+++ b/doc/unbound-anchor.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
+.TH "unbound-anchor" "8" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
 .\"
 .\" unbound-anchor.8 -- unbound anchor maintenance utility manual
 .\"
diff --git a/doc/unbound-checkconf.8.in b/doc/unbound-checkconf.8.in
index 93fe204a1aa2..e7db810bbec8 100644
--- a/doc/unbound-checkconf.8.in
+++ b/doc/unbound-checkconf.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
+.TH "unbound-checkconf" "8" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
diff --git a/doc/unbound-control.8.in b/doc/unbound-control.8.in
index 95ed5908616b..f6eae249abc9 100644
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
+.TH "unbound-control" "8" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
 .\"
 .\" unbound-control.8 -- unbound remote control manual
 .\"
diff --git a/doc/unbound-host.1.in b/doc/unbound-host.1.in
index 475b04cc473e..9129bea66af1 100644
--- a/doc/unbound-host.1.in
+++ b/doc/unbound-host.1.in
@@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
+.TH "unbound\-host" "1" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
 .\"
 .\" unbound-host.1 -- unbound DNS lookup utility
 .\"
diff --git a/doc/unbound.8.in b/doc/unbound.8.in
index 50a04b3d0a25..7242469c1f1f 100644
--- a/doc/unbound.8.in
+++ b/doc/unbound.8.in
@@ -1,4 +1,4 @@
-.TH "unbound" "8" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
+.TH "unbound" "8" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -9,7 +9,7 @@
 .\"
 .SH "NAME"
 .B unbound
-\- Unbound DNS validating resolver 1.5.2.
+\- Unbound DNS validating resolver 1.5.3.
 .SH "SYNOPSIS"
 .B unbound
 .RB [ \-h ]
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index bbfce632e30f..9b088f372b63 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "Feb 19, 2015" "NLnet Labs" "unbound 1.5.2"
+.TH "unbound.conf" "5" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index 1addfa901dbb..3e5bf4004448 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -609,7 +609,7 @@ create_local_accept_sock(const char *path, int* noproto)
 	/* length is 92-108, 104 on FreeBSD */
 	(void)strlcpy(usock.sun_path, path, sizeof(usock.sun_path));
 
-	if ((s = socket(PF_LOCAL, SOCK_STREAM, 0)) == -1) {
+	if ((s = socket(AF_LOCAL, SOCK_STREAM, 0)) == -1) {
 		log_err("Cannot create local socket %s (%s)",
 			path, strerror(errno));
 		return -1;
diff --git a/util/config_file.c b/util/config_file.c
index f4eaccf1b3db..5c4e897da373 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -65,6 +65,11 @@
 #include <pwd.h>
 #endif
 
+/** from cfg username, after daemonise setup performed */
+uid_t cfg_uid = (uid_t)-1;
+/** from cfg username, after daemonise setup performed */
+gid_t cfg_gid = (gid_t)-1;
+
 /** global config during parsing */
 struct config_parser_state* cfg_parser = 0;
 
@@ -136,8 +141,6 @@ config_create(void)
 		goto error_exit;
 	init_outgoing_availports(cfg->outgoing_avail_ports, 65536);
 	if(!(cfg->username = strdup(UB_USERNAME))) goto error_exit;
-	cfg->uid = (uid_t)-1;
-	cfg->gid = (gid_t)-1;
 #ifdef HAVE_CHROOT
 	if(!(cfg->chrootdir = strdup(CHROOT_DIR))) goto error_exit;
 #endif
@@ -1210,8 +1213,8 @@ void config_lookup_uid(struct config_file* cfg)
 		struct passwd *pwd;
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			log_err("user '%s' does not exist.", cfg->username);
-		cfg->uid = pwd->pw_uid;
-		cfg->gid = pwd->pw_gid;
+		cfg_uid = pwd->pw_uid;
+		cfg_gid = pwd->pw_gid;
 	}
 #else
 	(void)cfg;
diff --git a/util/config_file.h b/util/config_file.h
index 7ffc00a02d2e..ca512d720ebd 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -194,8 +194,6 @@ struct config_file {
 	char* chrootdir;
 	/** username to change to, if not "". */
 	char* username;
-	uid_t uid;
-	gid_t gid;
 	/** working directory */
 	char* directory;
 	/** filename to log to. */
@@ -345,6 +343,11 @@ struct config_file {
 	int dnstap_log_forwarder_response_messages;
 };
 
+/** from cfg username, after daemonise setup performed */
+extern uid_t cfg_uid;
+/** from cfg username, after daemonise setup performed */
+extern gid_t cfg_gid;
+
 /**
  * Stub config options
  */
@@ -429,7 +432,7 @@ void config_delete(struct config_file* config);
 void config_apply(struct config_file* config);
 
 /**
- * Find username, sets uid and gid.
+ * Find username, sets cfg_uid and cfg_gid.
  * @param config: the config structure.
  */
 void config_lookup_uid(struct config_file* config);
diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index 99e5a6543518..ce939d55ce54 100644
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -4844,6 +4844,8 @@
 8912,
 8913,
 8954,
+8980,
+8981,
 8989,
 8990,
 8991,

From 21ac29a0ff1054ea52b61a17165ad64759b8080b Mon Sep 17 00:00:00 2001
From: des <des@FreeBSD.org>
Date: Sun, 26 Apr 2015 11:33:01 +0000
Subject: [PATCH 7/8] Merge upstream r3375 and r3376 which fix a segfault on
 startup when the user specified in the configuration file does not exist.

PR:		197534
---
 daemon/remote.c    | 3 ++-
 daemon/unbound.c   | 6 +++---
 doc/Changelog      | 3 +++
 util/config_file.c | 8 ++++----
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/daemon/remote.c b/daemon/remote.c
index 65749568fddf..3ce55ee7ea1a 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -328,7 +328,8 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 		 */
 		if(fd != -1) {
 #ifdef HAVE_CHOWN
-			if (cfg->username && cfg->username[0])
+			if (cfg->username && cfg->username[0] &&
+				cfg_uid != (uid_t)-1)
 				chown(ip, cfg_uid, cfg_gid);
 			chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP));
 #else
diff --git a/daemon/unbound.c b/daemon/unbound.c
index b70e39686d4c..8e07c3895650 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -503,7 +503,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #ifdef HAVE_KILL
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		writepid(daemon->pidfile, getpid());
-		if(cfg->username && cfg->username[0]) {
+		if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
 #  ifdef HAVE_CHOWN
 			if(chown(daemon->pidfile, cfg_uid, cfg_gid) == -1) {
 				log_err("cannot chown %u.%u %s: %s",
@@ -519,7 +519,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 
 	/* Set user context */
 #ifdef HAVE_GETPWNAM
-	if(cfg->username && cfg->username[0]) {
+	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
 #ifdef HAVE_SETUSERCONTEXT
 		/* setusercontext does initgroups, setuid, setgid, and
 		 * also resource limits from login config, but we
@@ -586,7 +586,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 
 	/* drop permissions after chroot, getpwnam, pidfile, syslog done*/
 #ifdef HAVE_GETPWNAM
-	if(cfg->username && cfg->username[0]) {
+	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
 #  ifdef HAVE_INITGROUPS
 		if(initgroups(cfg->username, cfg_gid) != 0)
 			log_warn("unable to initgroups %s: %s",
diff --git a/doc/Changelog b/doc/Changelog
index 5c3447cbe673..a1c2f76cd21d 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+23 March 2015: Wouter
+	- Fix segfault on user not found at startup (from Maciej Soltysiak).
+
 2 March 2015: Wouter
 	- iana portlist update.
 
diff --git a/util/config_file.c b/util/config_file.c
index 5c4e897da373..9c427ed0d4f5 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -1211,10 +1211,10 @@ void config_lookup_uid(struct config_file* cfg)
 	/* translate username into uid and gid */
 	if(cfg->username && cfg->username[0]) {
 		struct passwd *pwd;
-		if((pwd = getpwnam(cfg->username)) == NULL)
-			log_err("user '%s' does not exist.", cfg->username);
-		cfg_uid = pwd->pw_uid;
-		cfg_gid = pwd->pw_gid;
+		if((pwd = getpwnam(cfg->username)) != NULL) {
+			cfg_uid = pwd->pw_uid;
+			cfg_gid = pwd->pw_gid;
+		}
 	}
 #else
 	(void)cfg;

From 0b3e2c01ad6e393f14541f9b977e89fdb993a100 Mon Sep 17 00:00:00 2001
From: des <des@FreeBSD.org>
Date: Thu, 17 Sep 2015 15:21:27 +0000
Subject: [PATCH 8/8] import unbound 1.5.4

---
 Makefile.in                                  |  482 +--
 acx_nlnetlabs.m4                             |   13 +-
 compat/getentropy_linux.c                    |   34 +-
 compat/reallocarray.c                        |   39 +
 config.h.in                                  |   16 +
 configure                                    |   52 +-
 configure.ac                                 |   15 +-
 contrib/README                               |    5 +-
 contrib/unbound.spec_fedora                  |    7 -
 contrib/unbound_smf22.tar.gz                 |  Bin 0 -> 4578 bytes
 contrib/unbound_unixsock.diff                |  305 --
 daemon/cachedump.c                           |   16 +-
 daemon/daemon.c                              |    2 +-
 daemon/remote.c                              |  139 +-
 daemon/stats.c                               |   12 +-
 daemon/stats.h                               |    2 +
 daemon/worker.c                              |   42 +-
 daemon/worker.h                              |    4 +
 dns64/dns64.c                                |    6 +
 dnstap/dnstap.c                              |    2 +-
 doc/Changelog                                |  158 +
 doc/README                                   |    2 +-
 doc/example.conf.in                          |   41 +-
 doc/libunbound.3.in                          |    5 +-
 doc/unbound-anchor.8.in                      |    2 +-
 doc/unbound-checkconf.8.in                   |    4 +-
 doc/unbound-control.8.in                     |   23 +-
 doc/unbound-host.1.in                        |    2 +-
 doc/unbound.8.in                             |    4 +-
 doc/unbound.conf.5.in                        |  101 +-
 iterator/iter_delegpt.c                      |    4 +-
 iterator/iter_fwd.c                          |    4 +-
 iterator/iter_hints.c                        |    6 +-
 iterator/iter_priv.c                         |    4 +-
 iterator/iter_resptype.c                     |    4 +-
 iterator/iter_scrub.c                        |    4 +-
 iterator/iter_utils.c                        |   53 +-
 iterator/iter_utils.h                        |    8 +
 iterator/iterator.c                          |  146 +-
 iterator/iterator.h                          |    8 +
 libunbound/context.c                         |    4 +-
 libunbound/libunbound.c                      |    8 +-
 libunbound/libworker.c                       |    4 +-
 libunbound/python/Makefile                   |    7 +-
 libunbound/python/examples/async-lookup.py   |    5 +-
 libunbound/python/examples/dns-lookup.py     |    3 +-
 libunbound/python/examples/dnssec-valid.py   |    3 +-
 libunbound/python/examples/dnssec_test.py    |    9 +-
 libunbound/python/examples/example8-1.py     |    7 +-
 libunbound/python/examples/idn-lookup.py     |    7 +-
 libunbound/python/examples/mx-lookup.py      |    5 +-
 libunbound/python/examples/ns-lookup.py      |    3 +-
 libunbound/python/examples/reverse-lookup.py |    3 +-
 libunbound/python/file_py3.i                 |  155 +
 libunbound/python/libunbound.i               |    4 +
 libunbound/worker.h                          |    2 +-
 pythonmod/interface.i                        |   34 +-
 pythonmod/pythonmod.c                        |   10 +-
 pythonmod/pythonmod_utils.c                  |    2 +-
 services/cache/dns.c                         |   77 +-
 services/cache/infra.c                       |  315 +-
 services/cache/infra.h                       |  107 +
 services/cache/rrset.c                       |    9 +-
 services/listen_dnsport.c                    |   68 +-
 services/listen_dnsport.h                    |    6 +-
 services/localzone.c                         |   16 +-
 services/localzone.h                         |    4 +-
 services/mesh.c                              |    2 +-
 services/outside_network.c                   |   11 +-
 {ldns => sldns}/keyraw.c                     |    4 +-
 {ldns => sldns}/keyraw.h                     |    0
 {ldns => sldns}/parse.c                      |    6 +-
 {ldns => sldns}/parse.h                      |    0
 {ldns => sldns}/parseutil.c                  |    2 +-
 {ldns => sldns}/parseutil.h                  |    0
 {ldns => sldns}/pkthdr.h                     |    0
 {ldns => sldns}/rrdef.c                      |   10 +-
 {ldns => sldns}/rrdef.h                      |    3 +-
 {ldns => sldns}/sbuffer.c                    |    2 +-
 {ldns => sldns}/sbuffer.h                    |    0
 {ldns => sldns}/str2wire.c                   |   10 +-
 {ldns => sldns}/str2wire.h                   |    2 +-
 {ldns => sldns}/wire2str.c                   |   14 +-
 {ldns => sldns}/wire2str.h                   |    0
 smallapp/unbound-anchor.c                    |    7 +-
 smallapp/unbound-checkconf.c                 |    2 +-
 smallapp/unbound-control-setup.sh.in         |    2 +-
 smallapp/unbound-control.c                   |    3 +
 smallapp/unbound-host.c                      |    4 +-
 testcode/asynclook.c                         |    2 +-
 testcode/delayer.c                           |    2 +-
 testcode/fake_event.c                        |    6 +-
 testcode/perf.c                              |    6 +-
 testcode/pktview.c                           |    4 +-
 testcode/readhex.c                           |    4 +-
 testcode/replay.c                            |    2 +-
 testcode/streamtcp.c                         |    6 +-
 testcode/testbound.c                         |    2 +-
 testcode/testpkts.c                          |   10 +-
 testcode/unitanchor.c                        |    4 +-
 testcode/unitdname.c                         |    4 +-
 testcode/unitldns.c                          |    6 +-
 testcode/unitmain.c                          |    4 +-
 testcode/unitmsgparse.c                      |    9 +-
 testcode/unitneg.c                           |    2 +-
 testcode/unitverify.c                        |    8 +-
 testdata/fwd_any.rpl                         |  161 +
 testdata/fwd_capsid_white.tpkg               |  Bin 0 -> 1567 bytes
 testdata/fwd_compress_c00c.tpkg              |  Bin 1794 -> 1858 bytes
 testdata/iter_domain_sale.rpl                |    3 +-
 testdata/iter_domain_sale_nschange.rpl       |    6 +-
 testdata/root_anchor.tpkg                    |  Bin 1001 -> 1004 bytes
 testdata/val_dnametopos.rpl                  |   27 +
 testdata/val_ta_algo_dnskey_dp.rpl           |  182 +
 testdata/val_ta_algo_missing_dp.rpl          |  185 +
 util/alloc.c                                 |   19 +-
 util/alloc.h                                 |    4 +-
 util/config_file.c                           |   54 +-
 util/config_file.h                           |   21 +
 util/configlexer.c                           | 3373 +++++++++---------
 util/configlexer.lex                         |   10 +
 util/configparser.c                          | 1432 ++++----
 util/configparser.h                          |   24 +-
 util/configparser.y                          |  116 +-
 util/data/dname.c                            |    2 +-
 util/data/msgencode.c                        |    2 +-
 util/data/msgparse.c                         |    8 +-
 util/data/msgparse.h                         |    6 +-
 util/data/msgreply.c                         |   46 +-
 util/data/msgreply.h                         |    3 +-
 util/data/packed_rrset.c                     |    6 +-
 util/data/packed_rrset.h                     |    6 +
 util/fptr_wlist.c                            |    4 +
 util/iana_ports.inc                          |   11 +-
 util/log.c                                   |   10 +-
 util/log.h                                   |    9 +
 util/net_help.c                              |   10 +-
 util/netevent.c                              |   22 +-
 util/netevent.h                              |    2 +
 validator/autotrust.c                        |   18 +-
 validator/val_anchor.c                       |   20 +-
 validator/val_kentry.c                       |    4 +-
 validator/val_neg.c                          |    4 +-
 validator/val_nsec3.c                        |    2 +-
 validator/val_secalgo.c                      |    6 +-
 validator/val_sigcrypt.c                     |   12 +-
 validator/validator.c                        |   12 +-
 winrc/README.txt                             |    2 +-
 winrc/anchor-update.c                        |    6 +-
 winrc/setup.nsi                              |   39 +-
 150 files changed, 5526 insertions(+), 3181 deletions(-)
 create mode 100644 compat/reallocarray.c
 create mode 100644 contrib/unbound_smf22.tar.gz
 delete mode 100644 contrib/unbound_unixsock.diff
 create mode 100644 libunbound/python/file_py3.i
 rename {ldns => sldns}/keyraw.c (99%)
 rename {ldns => sldns}/keyraw.h (100%)
 rename {ldns => sldns}/parse.c (99%)
 rename {ldns => sldns}/parse.h (100%)
 rename {ldns => sldns}/parseutil.c (99%)
 rename {ldns => sldns}/parseutil.h (100%)
 rename {ldns => sldns}/pkthdr.h (100%)
 rename {ldns => sldns}/rrdef.c (99%)
 rename {ldns => sldns}/rrdef.h (99%)
 rename {ldns => sldns}/sbuffer.c (99%)
 rename {ldns => sldns}/sbuffer.h (100%)
 rename {ldns => sldns}/str2wire.c (99%)
 rename {ldns => sldns}/str2wire.h (99%)
 rename {ldns => sldns}/wire2str.c (99%)
 rename {ldns => sldns}/wire2str.h (100%)
 create mode 100644 testdata/fwd_any.rpl
 create mode 100644 testdata/fwd_capsid_white.tpkg
 create mode 100644 testdata/val_ta_algo_dnskey_dp.rpl
 create mode 100644 testdata/val_ta_algo_missing_dp.rpl

diff --git a/Makefile.in b/Makefile.in
index 0c7e0c638b9c..40cf9a57d208 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -25,6 +25,7 @@ DNSTAP_SRC=@DNSTAP_SRC@
 DNSTAP_OBJ=@DNSTAP_OBJ@
 WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
 WITH_PYUNBOUND=@WITH_PYUNBOUND@
+PY_MAJOR_VERSION=@PY_MAJOR_VERSION@
 PYTHON_SITE_PKG=@PYTHON_SITE_PKG@
 PYTHONMOD_INSTALL=@PYTHONMOD_INSTALL@
 PYTHONMOD_UNINSTALL=@PYTHONMOD_UNINSTALL@
@@ -131,12 +132,12 @@ compat/memcmp.c compat/memmove.c compat/snprintf.c compat/strlcat.c \
 compat/strlcpy.c compat/strptime.c compat/getentropy_linux.c \
 compat/getentropy_osx.c compat/getentropy_solaris.c compat/getentropy_win.c \
 compat/explicit_bzero.c compat/arc4random.c compat/arc4random_uniform.c \
-compat/arc4_lock.c compat/sha512.c
+compat/arc4_lock.c compat/sha512.c compat/reallocarray.c
 COMPAT_OBJ=$(LIBOBJS:.o=.lo)
 COMPAT_OBJ_WITHOUT_CTIME=$(LIBOBJ_WITHOUT_CTIME:.o=.lo)
 COMPAT_OBJ_WITHOUT_CTIMEARC4=$(LIBOBJ_WITHOUT_CTIMEARC4:.o=.lo)
-SLDNS_SRC=ldns/keyraw.c ldns/sbuffer.c ldns/wire2str.c ldns/parse.c \
-ldns/parseutil.c ldns/rrdef.c ldns/str2wire.c
+SLDNS_SRC=sldns/keyraw.c sldns/sbuffer.c sldns/wire2str.c sldns/parse.c \
+sldns/parseutil.c sldns/rrdef.c sldns/str2wire.c
 SLDNS_OBJ=keyraw.lo sbuffer.lo wire2str.lo parse.lo parseutil.lo rrdef.lo \
 str2wire.lo
 UNITTEST_SRC=testcode/unitanchor.c testcode/unitdname.c \
@@ -393,7 +394,7 @@ libunbound_wrap.lo libunbound_wrap.o: libunbound/python/libunbound_wrap.c \
 	unbound.h
 libunbound/python/libunbound_wrap.c:	$(srcdir)/libunbound/python/libunbound.i unbound.h
 	@-if test ! -d libunbound/python; then $(INSTALL) -d libunbound/python; fi
-	$(SWIG) -python -o $@ $(CPPFLAGS) $(srcdir)/libunbound/python/libunbound.i
+	$(SWIG) -python -o $@ $(CPPFLAGS) -DPY_MAJOR_VERSION=$(PY_MAJOR_VERSION) $(srcdir)/libunbound/python/libunbound.i
 
 # Pyunbound python unbound wrapper
 _unbound.la:	libunbound_wrap.lo libunbound.la
@@ -597,146 +598,151 @@ dns.lo dns.o: $(srcdir)/services/cache/dns.c config.h $(srcdir)/iterator/iter_de
  $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/services/cache/dns.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h
-infra.lo infra.o: $(srcdir)/services/cache/infra.c config.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
+infra.lo infra.o: $(srcdir)/services/cache/infra.c config.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h \
  $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/rtt.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lookup3.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h
 rrset.lo rrset.o: $(srcdir)/services/cache/rrset.c config.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/regional.h $(srcdir)/util/alloc.h
 dname.lo dname.o: $(srcdir)/util/data/dname.c config.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/storage/lookup3.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/storage/lookup3.h $(srcdir)/sldns/sbuffer.h
 msgencode.lo msgencode.o: $(srcdir)/util/data/msgencode.c config.h $(srcdir)/util/data/msgencode.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
+ $(srcdir)/sldns/sbuffer.h
 msgparse.lo msgparse.o: $(srcdir)/util/data/msgparse.c config.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parseutil.h \
- $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/wire2str.h
 msgreply.lo msgreply.o: $(srcdir)/util/data/msgreply.c config.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h
 packed_rrset.lo packed_rrset.o: $(srcdir)/util/data/packed_rrset.c config.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
- $(srcdir)/util/net_help.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/net_help.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h
 iterator.lo iterator.o: $(srcdir)/iterator/iterator.c config.h $(srcdir)/iterator/iterator.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/iterator/iter_utils.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/iterator/iter_utils.h \
  $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_donotq.h \
  $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_scrub.h $(srcdir)/iterator/iter_priv.h \
  $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/config_file.h $(srcdir)/ldns/wire2str.h \
- $(srcdir)/ldns/parseutil.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/config_file.h $(srcdir)/util/random.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h
 iter_delegpt.lo iter_delegpt.o: $(srcdir)/iterator/iter_delegpt.c config.h $(srcdir)/iterator/iter_delegpt.h \
  $(srcdir)/util/log.h $(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
 iter_donotq.lo iter_donotq.o: $(srcdir)/iterator/iter_donotq.c config.h $(srcdir)/iterator/iter_donotq.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
 iter_fwd.lo iter_fwd.o: $(srcdir)/iterator/iter_fwd.c config.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
 iter_hints.lo iter_hints.o: $(srcdir)/iterator/iter_hints.c config.h $(srcdir)/iterator/iter_hints.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/str2wire.h \
- $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/sldns/wire2str.h
 iter_priv.lo iter_priv.o: $(srcdir)/iterator/iter_priv.c config.h $(srcdir)/iterator/iter_priv.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/sbuffer.h
 iter_resptype.lo iter_resptype.o: $(srcdir)/iterator/iter_resptype.c config.h \
  $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
  $(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/dname.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h
+ $(srcdir)/util/data/dname.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h
 iter_scrub.lo iter_scrub.o: $(srcdir)/iterator/iter_scrub.c config.h $(srcdir)/iterator/iter_scrub.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/iterator/iter_priv.h $(srcdir)/util/rbtree.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/util/alloc.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/util/alloc.h $(srcdir)/sldns/sbuffer.h
 iter_utils.lo iter_utils.o: $(srcdir)/iterator/iter_utils.c config.h $(srcdir)/iterator/iter_utils.h \
  $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_donotq.h \
- $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_priv.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
- $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/iterator/iter_donotq.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_priv.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/random.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_kcache.h \
+ $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
 listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/services/outside_network.h \
  $(srcdir)/util/rbtree.h  $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/net_help.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h
 localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h
 mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
- $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/dns.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
 modstack.lo modstack.o: $(srcdir)/services/modstack.c config.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h
 outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h 
 outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
   $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rtt.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rtt.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/dnstap/dnstap.h \
  
 alloc.lo alloc.o: $(srcdir)/util/alloc.c config.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/configyyrename.h $(srcdir)/util/config_file.h util/configparser.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h $(srcdir)/ldns/wire2str.h \
- $(srcdir)/ldns/parseutil.h $(srcdir)/util/iana_ports.inc
+ $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/util/iana_ports.inc
 configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
  $(srcdir)/util/config_file.h util/configparser.h
 configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
@@ -744,46 +750,45 @@ configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/conf
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
  $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h  \
- $(srcdir)/services/localzone.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h \
- $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/util/config_file.h
+ $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h \
+ $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h
 locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
-log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/ldns/sbuffer.h
+log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
 mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 module.lo module.o: $(srcdir)/util/module.c config.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
 netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/netevent.h $(srcdir)/util/log.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/dnstap/dnstap.h  \
  $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/ldns/parseutil.h \
- $(srcdir)/ldns/wire2str.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/wire2str.h \
  
 random.lo random.o: $(srcdir)/util/random.c config.h $(srcdir)/util/random.h $(srcdir)/util/log.h
 rbtree.lo rbtree.o: $(srcdir)/util/rbtree.c config.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 regional.lo regional.o: $(srcdir)/util/regional.c config.h $(srcdir)/util/log.h $(srcdir)/util/regional.h
 rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h
@@ -794,7 +799,7 @@ lookup3.lo lookup3.o: $(srcdir)/util/storage/lookup3.c config.h $(srcdir)/util/s
 lruhash.lo lruhash.o: $(srcdir)/util/storage/lruhash.c config.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h
 slabhash.lo slabhash.o: $(srcdir)/util/storage/slabhash.c config.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
@@ -802,43 +807,44 @@ timehist.lo timehist.o: $(srcdir)/util/timehist.c config.h $(srcdir)/util/timehi
 tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/services/mesh.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h \
  $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 winsock_event.lo winsock_event.o: $(srcdir)/util/winsock_event.c config.h
 autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/validator/autotrust.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/dname.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/validator/val_kcache.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/keyraw.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h \
  
 val_anchor.lo val_anchor.o: $(srcdir)/validator/val_anchor.c config.h $(srcdir)/validator/val_anchor.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_sigcrypt.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/validator/autotrust.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
 validator.lo validator.o: $(srcdir)/validator/validator.c config.h $(srcdir)/validator/validator.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
- $(srcdir)/util/rbtree.h $(srcdir)/validator/val_kcache.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_nsec3.h \
- $(srcdir)/validator/val_neg.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/autotrust.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/validator/val_kcache.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_nsec.h \
+ $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_neg.h $(srcdir)/validator/val_sigcrypt.h \
+ $(srcdir)/validator/autotrust.h $(srcdir)/services/cache/dns.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
+ $(srcdir)/sldns/wire2str.h
 val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/validator/val_kcache.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/validator/val_kentry.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
 val_kentry.lo val_kentry.o: $(srcdir)/validator/val_kentry.c config.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/keyraw.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
  
 val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h \
  $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
@@ -846,78 +852,78 @@ val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
 val_nsec3.lo val_nsec3.o: $(srcdir)/validator/val_nsec3.c config.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/validator.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kentry.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/validator/val_nsec.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/validator/val_nsec.h $(srcdir)/sldns/sbuffer.h
 val_nsec.lo val_nsec.o: $(srcdir)/validator/val_nsec.c config.h $(srcdir)/validator/val_nsec.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/validator/val_utils.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h
 val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/sbuffer.h \
  
 val_sigcrypt.lo val_sigcrypt.o: $(srcdir)/validator/val_sigcrypt.c config.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h $(srcdir)/validator/validator.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/util/data/dname.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parseutil.h $(srcdir)/ldns/wire2str.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/util/data/dname.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
  
 val_utils.lo val_utils.o: $(srcdir)/validator/val_utils.c config.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_kentry.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h \
  $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/regional.h
 dns64.lo dns64.o: $(srcdir)/dns64/dns64.c config.h $(srcdir)/dns64/dns64.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/regional.h
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h
 checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/checklocks.h
-dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h $(srcdir)/ldns/sbuffer.h \
+dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
  $(srcdir)/dnstap/dnstap.h \
  $(srcdir)/dnstap/dnstap.pb-c.h
 dnstap.pb-c.lo dnstap.pb-c.o: $(srcdir)/dnstap/dnstap.pb-c.c $(srcdir)/dnstap/dnstap.pb-c.h
 unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/unitmain.h \
- $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h
 unitdname.lo unitdname.o: $(srcdir)/testcode/unitdname.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 unitlruhash.lo unitlruhash.o: $(srcdir)/testcode/unitlruhash.c config.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h
 unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/util/log.h \
- $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/random.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/random.h
 unitmsgparse.lo unitmsgparse.o: $(srcdir)/testcode/unitmsgparse.c config.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/unitmain.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/alloc.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/testcode/readhex.h \
- $(srcdir)/testcode/testpkts.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/testcode/testpkts.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 unitneg.lo unitneg.o: $(srcdir)/testcode/unitneg.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/dname.h $(srcdir)/testcode/unitmain.h $(srcdir)/validator/val_neg.h $(srcdir)/util/rbtree.h \
- $(srcdir)/ldns/rrdef.h
+ $(srcdir)/sldns/rrdef.h
 unitregional.lo unitregional.o: $(srcdir)/testcode/unitregional.c config.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/log.h $(srcdir)/util/regional.h
 unitslabhash.lo unitslabhash.o: $(srcdir)/testcode/unitslabhash.c config.h $(srcdir)/testcode/unitmain.h \
@@ -927,88 +933,89 @@ unitverify.lo unitverify.o: $(srcdir)/testcode/unitverify.c config.h $(srcdir)/u
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/validator/val_secalgo.h \
  $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h \
  $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/testcode/testpkts.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/alloc.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 readhex.lo readhex.o: $(srcdir)/testcode/readhex.c config.h $(srcdir)/testcode/readhex.h $(srcdir)/util/log.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parseutil.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 unitldns.lo unitldns.o: $(srcdir)/testcode/unitldns.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
 cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h \
  $(srcdir)/daemon/cachedump.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
   $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/regional.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
- $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/util/rbtree.h \
- $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h $(srcdir)/ldns/wire2str.h \
- $(srcdir)/ldns/str2wire.h
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
+ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/sldns/str2wire.h
 daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
   $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
  $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/util/random.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/ldns/keyraw.h
+ $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h
 remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
  $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
  $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/localzone.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
  $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/iterator/iter_delegpt.h $(srcdir)/services/outside_network.h $(srcdir)/ldns/str2wire.h \
- $(srcdir)/ldns/parseutil.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_delegpt.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/wire2str.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
   $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
 unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
  $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
  $(srcdir)/daemon/remote.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/util/net_help.h $(srcdir)/util/mini_event.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/mini_event.h \
  $(srcdir)/util/rbtree.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
  $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
@@ -1022,23 +1029,23 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
 testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h \
  $(srcdir)/daemon/remote.h \
- $(srcdir)/util/config_file.h $(srcdir)/ldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/util/log.h \
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/util/log.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
   $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rtt.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
  $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
@@ -1055,134 +1062,135 @@ acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/ac
 daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
   $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
  $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/util/random.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/ldns/keyraw.h
+ $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
   $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
 replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/testcode/testpkts.h \
- $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/testcode/fake_event.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h  \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
+ $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 lock_verify.lo lock_verify.o: $(srcdir)/testcode/lock_verify.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
 pktview.lo pktview.o: $(srcdir)/testcode/pktview.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/testcode/readhex.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/ldns/parseutil.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/testcode/readhex.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/parseutil.h
 readhex.lo readhex.o: $(srcdir)/testcode/readhex.c config.h $(srcdir)/testcode/readhex.h $(srcdir)/util/log.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parseutil.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
 memstats.lo memstats.o: $(srcdir)/testcode/memstats.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
 unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/localzone.h \
- $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/sldns/sbuffer.h
 worker_cb.lo worker_cb.o: $(srcdir)/smallapp/worker_cb.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h
 context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/sldns/sbuffer.h
 libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/libworker.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h \
  $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/sldns/sbuffer.h
 libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h \
  $(srcdir)/libunbound/libworker.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/services/outside_network.h \
  $(srcdir)/util/netevent.h  $(srcdir)/services/mesh.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/str2wire.h
 unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/ldns/rrdef.h
+ $(srcdir)/sldns/rrdef.h
 streamtcp.lo streamtcp.o: $(srcdir)/testcode/streamtcp.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
  
 perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 delayer.lo delayer.o: $(srcdir)/testcode/delayer.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
- $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
 unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h \
- $(srcdir)/util/log.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h
+ $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h
 unbound-anchor.lo unbound-anchor.o: $(srcdir)/smallapp/unbound-anchor.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/sldns/rrdef.h \
  
 petal.lo petal.o: $(srcdir)/testcode/petal.c config.h \
  
 pythonmod_utils.lo pythonmod_utils.o: $(srcdir)/pythonmod/pythonmod_utils.c config.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
- $(srcdir)/iterator/iter_delegpt.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h
 win_svc.lo win_svc.o: $(srcdir)/winrc/win_svc.c config.h $(srcdir)/winrc/win_svc.h $(srcdir)/winrc/w_inst.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
   $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
  $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/winsock_event.h
 w_inst.lo w_inst.o: $(srcdir)/winrc/w_inst.c config.h $(srcdir)/winrc/w_inst.h $(srcdir)/winrc/win_svc.h
@@ -1191,20 +1199,21 @@ unbound-service-install.lo unbound-service-install.o: $(srcdir)/winrc/unbound-se
 unbound-service-remove.lo unbound-service-remove.o: $(srcdir)/winrc/unbound-service-remove.c config.h \
  $(srcdir)/winrc/w_inst.h
 anchor-update.lo anchor-update.o: $(srcdir)/winrc/anchor-update.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/wire2str.h
-keyraw.lo keyraw.o: $(srcdir)/ldns/keyraw.c config.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/wire2str.h
+keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/rrdef.h \
  
-sbuffer.lo sbuffer.o: $(srcdir)/ldns/sbuffer.c config.h $(srcdir)/ldns/sbuffer.h
-wire2str.lo wire2str.o: $(srcdir)/ldns/wire2str.c config.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/parseutil.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/keyraw.h \
+sbuffer.lo sbuffer.o: $(srcdir)/sldns/sbuffer.c config.h $(srcdir)/sldns/sbuffer.h
+wire2str.lo wire2str.o: $(srcdir)/sldns/wire2str.c config.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/keyraw.h \
  
-parse.lo parse.o: $(srcdir)/ldns/parse.c config.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/parseutil.h \
- $(srcdir)/ldns/sbuffer.h
-parseutil.lo parseutil.o: $(srcdir)/ldns/parseutil.c config.h $(srcdir)/ldns/parseutil.h
-rrdef.lo rrdef.o: $(srcdir)/ldns/rrdef.c config.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/parseutil.h
-str2wire.lo str2wire.o: $(srcdir)/ldns/str2wire.c config.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/parseutil.h
+parse.lo parse.o: $(srcdir)/sldns/parse.c config.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/sbuffer.h
+parseutil.lo parseutil.o: $(srcdir)/sldns/parseutil.c config.h $(srcdir)/sldns/parseutil.h
+rrdef.lo rrdef.o: $(srcdir)/sldns/rrdef.c config.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h
+str2wire.lo str2wire.o: $(srcdir)/sldns/str2wire.c config.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h
 ctime_r.lo ctime_r.o: $(srcdir)/compat/ctime_r.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 fake-rfc2553.lo fake-rfc2553.o: $(srcdir)/compat/fake-rfc2553.c $(srcdir)/compat/fake-rfc2553.h config.h
 gmtime_r.lo gmtime_r.o: $(srcdir)/compat/gmtime_r.c config.h
@@ -1228,3 +1237,4 @@ arc4random.lo arc4random.o: $(srcdir)/compat/arc4random.c config.h $(srcdir)/com
 arc4random_uniform.lo arc4random_uniform.o: $(srcdir)/compat/arc4random_uniform.c config.h
 arc4_lock.lo arc4_lock.o: $(srcdir)/compat/arc4_lock.c config.h $(srcdir)/util/locks.h
 sha512.lo sha512.o: $(srcdir)/compat/sha512.c config.h
+reallocarray.lo reallocarray.o: $(srcdir)/compat/reallocarray.c config.h
diff --git a/acx_nlnetlabs.m4 b/acx_nlnetlabs.m4
index e1cf83a70bd6..decf0f58600b 100644
--- a/acx_nlnetlabs.m4
+++ b/acx_nlnetlabs.m4
@@ -2,7 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 26
+# Version 27
+# 2015-03-17 AHX_CONFIG_REALLOCARRAY added
 # 2013-09-19 FLTO help text improved.
 # 2013-07-18 Enable ACX_CHECK_COMPILER_FLAG to test for -Wstrict-prototypes
 # 2013-06-25 FLTO has --disable-flto option.
@@ -1213,6 +1214,16 @@ struct tm *gmtime_r(const time_t *timep, struct tm *result);
 #endif
 ])
 
+dnl provide reallocarray compat prototype.
+dnl $1: unique name for compat code
+AC_DEFUN([AHX_CONFIG_REALLOCARRAY],
+[
+#ifndef HAVE_REALLOCARRAY
+#define reallocarray reallocarray$1
+void* reallocarray(void *ptr, size_t nmemb, size_t size);
+#endif
+])
+
 dnl provide w32 compat definition for sleep
 AC_DEFUN([AHX_CONFIG_W32_SLEEP],
 [
diff --git a/compat/getentropy_linux.c b/compat/getentropy_linux.c
index d4adab2852d4..76f0f9df5f1b 100644
--- a/compat/getentropy_linux.c
+++ b/compat/getentropy_linux.c
@@ -77,6 +77,9 @@ int	getentropy(void *buf, size_t len);
 extern int main(int, char *argv[]);
 #endif
 static int gotdata(char *buf, size_t len);
+#ifdef SYS_getrandom
+static int getentropy_getrandom(void *buf, size_t len);
+#endif
 static int getentropy_urandom(void *buf, size_t len);
 #ifdef SYS__sysctl
 static int getentropy_sysctl(void *buf, size_t len);
@@ -94,11 +97,15 @@ getentropy(void *buf, size_t len)
 	}
 
 #ifdef SYS_getrandom
-	/* try to use getrandom syscall introduced with kernel 3.17 */
-	ret = syscall(SYS_getrandom, buf, len, 0);
+	/*
+	 * Try descriptor-less getrandom()
+	 */
+	ret = getentropy_getrandom(buf, len);
 	if (ret != -1)
 		return (ret);
-#endif /* SYS_getrandom */
+	if (errno != ENOSYS)
+		return (-1);
+#endif
 
 	/*
 	 * Try to get entropy with /dev/urandom
@@ -185,6 +192,25 @@ gotdata(char *buf, size_t len)
 	return 0;
 }
 
+#ifdef SYS_getrandom
+static int
+getentropy_getrandom(void *buf, size_t len)
+{
+	int pre_errno = errno;
+	int ret;
+	if (len > 256)
+		return (-1);
+	do {
+		ret = syscall(SYS_getrandom, buf, len, 0);
+	} while (ret == -1 && errno == EINTR);
+
+	if (ret != (int)len)
+		return (-1);
+	errno = pre_errno;
+	return (0);
+}
+#endif
+
 static int
 getentropy_urandom(void *buf, size_t len)
 {
@@ -258,7 +284,7 @@ getentropy_sysctl(void *buf, size_t len)
 		struct __sysctl_args args = {
 			.name = mib,
 			.nlen = 3,
-			.oldval = buf + i,
+			.oldval = (char *)buf + i,
 			.oldlenp = &chunk,
 		};
 		if (syscall(SYS__sysctl, &args) != 0)
diff --git a/compat/reallocarray.c b/compat/reallocarray.c
new file mode 100644
index 000000000000..04d5d71c8be6
--- /dev/null
+++ b/compat/reallocarray.c
@@ -0,0 +1,39 @@
+/*	$OpenBSD: reallocarray.c,v 1.1 2014/05/08 21:43:49 deraadt Exp $	*/
+/*
+ * Copyright (c) 2008 Otto Moerbeek <otto@drijf.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "config.h"
+#include <sys/types.h>
+#include <errno.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+/*
+ * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX
+ * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW
+ */
+#define MUL_NO_OVERFLOW	((size_t)1 << (sizeof(size_t) * 4))
+
+void *
+reallocarray(void *optr, size_t nmemb, size_t size)
+{
+	if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
+	    nmemb > 0 && SIZE_MAX / nmemb < size) {
+		errno = ENOMEM;
+		return NULL;
+	}
+	return realloc(optr, size * nmemb);
+}
diff --git a/config.h.in b/config.h.in
index c36d4b98b0f7..723b3ad0253f 100644
--- a/config.h.in
+++ b/config.h.in
@@ -70,6 +70,10 @@
    if you don't. */
 #undef HAVE_DECL_NID_X9_62_PRIME256V1
 
+/* Define to 1 if you have the declaration of `reallocarray', and to 0 if you
+   don't. */
+#undef HAVE_DECL_REALLOCARRAY
+
 /* Define to 1 if you have the declaration of `sk_SSL_COMP_pop_free', and to 0
    if you don't. */
 #undef HAVE_DECL_SK_SSL_COMP_POP_FREE
@@ -266,6 +270,9 @@
 /* Define to 1 if you have the `random' function. */
 #undef HAVE_RANDOM
 
+/* Define to 1 if you have the `reallocarray' function. */
+#undef HAVE_REALLOCARRAY
+
 /* Define to 1 if you have the `recvmsg' function. */
 #undef HAVE_RECVMSG
 
@@ -889,6 +896,12 @@ struct tm *gmtime_r(const time_t *timep, struct tm *result);
 #endif
 
 
+#ifndef HAVE_REALLOCARRAY
+#define reallocarray reallocarrayunbound
+void* reallocarray(void *ptr, size_t nmemb, size_t size);
+#endif
+
+
 #if !defined(HAVE_SLEEP) || defined(HAVE_WINDOWS_H)
 #define sleep(x) Sleep((x)*1000) /* on win32 */
 #endif /* HAVE_SLEEP */
@@ -954,6 +967,9 @@ uint32_t arc4random(void);
 #  if !HAVE_DECL_ARC4RANDOM_UNIFORM && defined(HAVE_ARC4RANDOM_UNIFORM)
 uint32_t arc4random_uniform(uint32_t upper_bound);
 #  endif
+#  if !HAVE_DECL_REALLOCARRAY
+void *reallocarray(void *ptr, size_t nmemb, size_t size);
+#  endif
 #endif /* HAVE_LIBRESSL */
 #ifndef HAVE_ARC4RANDOM
 void explicit_bzero(void* buf, size_t len);
diff --git a/configure b/configure
index 20ff33d72990..a4c011df476e 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.5.3.
+# Generated by GNU Autoconf 2.69 for unbound 1.5.4.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.5.3'
-PACKAGE_STRING='unbound 1.5.3'
+PACKAGE_VERSION='1.5.4'
+PACKAGE_STRING='unbound 1.5.4'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''
 
@@ -677,6 +677,7 @@ WITH_PYTHONMODULE
 swig
 SWIG_LIB
 SWIG
+PY_MAJOR_VERSION
 PYTHON_SITE_PKG
 PYTHON_LDFLAGS
 PYTHON_CPPFLAGS
@@ -1388,7 +1389,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.5.3 to adapt to many kinds of systems.
+\`configure' configures unbound 1.5.4 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1453,7 +1454,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.5.3:";;
+     short | recursive ) echo "Configuration of unbound 1.5.4:";;
    esac
   cat <<\_ACEOF
 
@@ -1628,7 +1629,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.5.3
+unbound configure 1.5.4
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2337,7 +2338,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.5.3, which was
+It was created by unbound $as_me 1.5.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2689,11 +2690,11 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=5
 
-UNBOUND_VERSION_MICRO=3
+UNBOUND_VERSION_MICRO=4
 
 
 LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=6
+LIBUNBOUND_REVISION=7
 LIBUNBOUND_AGE=3
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2736,6 +2737,7 @@ LIBUNBOUND_AGE=3
 # 1.5.1 had 5:3:3
 # 1.5.2 had 5:5:3
 # 1.5.3 had 5:6:3
+# 1.5.4 had 5:7:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -16099,6 +16101,8 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 		as_fn_error $? "Python version >= 2.4.0 is required" "$LINENO" 5
 	fi
 
+      PY_MAJOR_VERSION="`$PYTHON -c "import sys; print(sys.version_info.major)"`"
+
       # Have Python
 
 $as_echo "#define HAVE_PYTHON 1" >>confdefs.h
@@ -16728,6 +16732,16 @@ fi
 cat >>confdefs.h <<_ACEOF
 #define HAVE_DECL_ARC4RANDOM_UNIFORM $ac_have_decl
 _ACEOF
+ac_fn_c_check_decl "$LINENO" "reallocarray" "ac_cv_have_decl_reallocarray" "$ac_includes_default"
+if test "x$ac_cv_have_decl_reallocarray" = xyes; then :
+  ac_have_decl=1
+else
+  ac_have_decl=0
+fi
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_REALLOCARRAY $ac_have_decl
+_ACEOF
 
 else
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
@@ -18138,6 +18152,20 @@ fi
 
 LIBOBJ_WITHOUT_CTIMEARC4="$LIBOBJS"
 
+ac_fn_c_check_func "$LINENO" "reallocarray" "ac_cv_func_reallocarray"
+if test "x$ac_cv_func_reallocarray" = xyes; then :
+  $as_echo "#define HAVE_REALLOCARRAY 1" >>confdefs.h
+
+else
+  case " $LIBOBJS " in
+  *" reallocarray.$ac_objext "* ) ;;
+  *) LIBOBJS="$LIBOBJS reallocarray.$ac_objext"
+ ;;
+esac
+
+fi
+
+
 if test "$USE_NSS" = "no"; then
 	ac_fn_c_check_func "$LINENO" "arc4random" "ac_cv_func_arc4random"
 if test "x$ac_cv_func_arc4random" = xyes; then :
@@ -18862,7 +18890,7 @@ _ACEOF
 
 
 
-version=1.5.3
+version=1.5.4
 
 date=`date +'%b %e, %Y'`
 
@@ -19377,7 +19405,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.5.3, which was
+This file was extended by unbound $as_me 1.5.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -19443,7 +19471,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.5.3
+unbound config.status 1.5.4
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index ae0525b540b0..00145cf76f91 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10,14 +10,14 @@ sinclude(dnstap/dnstap.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[5])
-m4_define([VERSION_MICRO],[3])
+m4_define([VERSION_MICRO],[4])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=6
+LIBUNBOUND_REVISION=7
 LIBUNBOUND_AGE=3
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -60,6 +60,7 @@ LIBUNBOUND_AGE=3
 # 1.5.1 had 5:3:3
 # 1.5.2 had 5:5:3
 # 1.5.3 had 5:6:3
+# 1.5.4 had 5:7:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -474,6 +475,8 @@ if test x_$ub_test_python != x_no; then
 		AC_ERROR([Python version >= 2.4.0 is required])
 	fi
 
+      PY_MAJOR_VERSION="`$PYTHON -c "import sys; print(sys.version_info.major)"`"
+      AC_SUBST(PY_MAJOR_VERSION)
       # Have Python
       AC_DEFINE(HAVE_PYTHON,1,[Define if you have Python libraries and header files.])
       LIBS="$PYTHON_LDFLAGS $LIBS"
@@ -568,7 +571,7 @@ if grep OPENSSL_VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL
 	AC_DEFINE([HAVE_LIBRESSL], [1], [Define if we have LibreSSL])
 	# libressl provides these compat functions, but they may also be
 	# declared by the OS in libc.  See if they have been declared.
-	AC_CHECK_DECLS([strlcpy,strlcat,arc4random,arc4random_uniform])
+	AC_CHECK_DECLS([strlcpy,strlcat,arc4random,arc4random_uniform,reallocarray])
 else
 	AC_MSG_RESULT([no])
 fi
@@ -995,8 +998,10 @@ AC_REPLACE_FUNCS(strlcat)
 AC_REPLACE_FUNCS(strlcpy)
 AC_REPLACE_FUNCS(memmove)
 AC_REPLACE_FUNCS(gmtime_r)
+dnl without CTIME, ARC4-functions and without reallocarray.
 LIBOBJ_WITHOUT_CTIMEARC4="$LIBOBJS"
 AC_SUBST(LIBOBJ_WITHOUT_CTIMEARC4)
+AC_REPLACE_FUNCS(reallocarray)
 if test "$USE_NSS" = "no"; then
 	AC_REPLACE_FUNCS(arc4random)
 	AC_REPLACE_FUNCS(arc4random_uniform)
@@ -1235,6 +1240,7 @@ AHX_CONFIG_MEMMOVE(unbound)
 AHX_CONFIG_STRLCAT(unbound)
 AHX_CONFIG_STRLCPY(unbound)
 AHX_CONFIG_GMTIME_R(unbound)
+AHX_CONFIG_REALLOCARRAY(unbound)
 AHX_CONFIG_W32_SLEEP
 AHX_CONFIG_W32_USLEEP
 AHX_CONFIG_W32_RANDOM
@@ -1268,6 +1274,9 @@ uint32_t arc4random(void);
 #  if !HAVE_DECL_ARC4RANDOM_UNIFORM && defined(HAVE_ARC4RANDOM_UNIFORM)
 uint32_t arc4random_uniform(uint32_t upper_bound);
 #  endif
+#  if !HAVE_DECL_REALLOCARRAY
+void *reallocarray(void *ptr, size_t nmemb, size_t size);
+#  endif
 #endif /* HAVE_LIBRESSL */
 #ifndef HAVE_ARC4RANDOM
 void explicit_bzero(void* buf, size_t len);
diff --git a/contrib/README b/contrib/README
index 49dee02e514b..8eae9b5b7cfc 100644
--- a/contrib/README
+++ b/contrib/README
@@ -15,8 +15,6 @@ distribution but may be helpful.
 	a local-zone and local-data include file for unbound.conf.
 * unbound-host.nagios.patch: makes unbound-host return status that fits right
 	in with the nagios monitoring framework.  Contributed by Migiel de Vos.
-* unbound_unixsock.diff: Add Unix socket support for unbound-control. 
-	Contributed by Ilya Bakulin, 2012-08-28.
 * patch_rsamd5_enable.diff: this patch enables RSAMD5 validation (otherwise
   it is treated as insecure).  The RSAMD5 algorithm is deprecated (RFC6725).
 * create_unbound_ad_servers.sh: shell script to enter anti-ad server lists.
@@ -29,4 +27,5 @@ distribution but may be helpful.
   works like the BIND feature (removes AAAA records unless AAAA-only domain).
   Useful for certain 'broken IPv6 default route' scenarios.
   Patch from Stephane Lapie for ASAHI Net.
-
+* unbound_smf22.tar.gz: Solaris SMF installation/removal scripts.
+  Contributed by Yuri Voinov.
diff --git a/contrib/unbound.spec_fedora b/contrib/unbound.spec_fedora
index 6e02a0964c43..f8b2e7512efe 100644
--- a/contrib/unbound.spec_fedora
+++ b/contrib/unbound.spec_fedora
@@ -18,7 +18,6 @@ Source2: unbound.conf
 Source3: unbound.munin
 Source4: unbound_munin_
 Source5: root.key
-Source6: dlv.isc.org.key
 Patch1: unbound-1.2-glob.patch
 
 Group: System Environment/Daemons
@@ -140,7 +139,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %attr(0755,root,root) %dir %{_sysconfdir}/%{name}
 %ghost %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/root.key
 %{_sbindir}/*
 %{_mandir}/*/*
@@ -178,11 +176,6 @@ exit 0
 
 %post
 /sbin/chkconfig --add %{name}
-# dnssec-conf used to contain our DLV key, but now we include it via unbound
-# If unbound had previously been configured with dnssec-configure, we need
-# to migrate the location of the DLV key file (to keep DLV enabled, and because
-# unbound won't start with a bad location for a DLV key file.
-sed -i "s:/etc/pki/dnssec-keys[/]*dlv:/etc/unbound:" %{_sysconfdir}/unbound/unbound.conf
 
 %post libs -p /sbin/ldconfig
 
diff --git a/contrib/unbound_smf22.tar.gz b/contrib/unbound_smf22.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..e4c51c3dc6c1054b59ae8d3218bd52930b6097fc
GIT binary patch
literal 4578
zcmV<85gqOyiwFp7UiVZ40CjF+Z*^{DUvq6{GBPf7VR8WN9BET4MUc<?D~2@+D7k<@
z6&e)*m6EFh-erX)JAtjY*^PU^!{fhMmX?0-D9g`QMI;(QLI|FPirq6idnMtLhgvda
z`LZ+JJ$=ng_iQhkp*bnnST|im?R!8ilg(r%CMNnayv6?=9iJHM%Z`kVXR@QC<C$@Q
zhraPXlIgpJ=Gu;8^<{2lu76>Bs6TD5Yew4Ml%$8Ghsd;PIF_lC1?p^?Dk+;5@w|f!
zrgd#SZEuy*6*ia-`_2&HzHDiZLk+UNLtb?)jl5)PhPg!sr-#T0c);*TCYxiEXeu=v
zB0oL&(2$3ovNs8|k<<wLC!5Y>)7cz(^(7e)Qbf!QY$_H_+m&)rGfKLvQb6n+H>l%}
zGr>X)=YL7DG-X|<HhCyE27}KiHYKWNG1)Z(+(Xx?N?zoQO3zHK%ob<n3VAv0+E!XO
zONuT7+Pt<tK1QmFv&j(Q_qyf?EF7oG7A5PtV%%c@qazW3`MGDt$AG3;b<!n!n+Y^N
zhJ;ramI=<{Xr>{-0{}Uds?5!`v;r2ZR1`zCeIT+W!~>A&snz`2_NG?aBrv)rO}`jC
zyYM_a{rr;XpruW7O?qK&eqQw4({z1JDlCX+tFk7&xHz>iD>__5sn9jxMF>L58cfXe
zU<2qgOD`_Y6qlz~pU=w)p*mS+J}1Yp0{Ca<7K_i$&Clj#&pl*`%W6@bf_bE+mEudY
zh5TBAF+-BpI|&esB+DZtsmdvN4IywS0I>x~7C{Jr_@)mWW5r#!OxMv2&oyGsQQD-X
zdqvYGgG18W5`oo%9mv=gwQRHx(aPj?(of`s$AC=oL|$=?r4^YZ6*j_|hesXOKsF<j
zHy$U>CIw`YKywgzwoq6qOoDQ3w^}tVhpIS-AV~y;5W;;8nBGXGQrJo1iDV^Es`RcT
z;r`}SEwhA7qm20MD_&J-1^EVm4NIxy6Isa<B6**nhci#4_hDVDR7IntY%`S&@l0G@
ztH6XwgJd%!W7snfCNIp+FHOx9M@RC#sQ@f6ixNgr80)?+lW&32*!l=m#pZy%!c^f^
z?p_>XG7;;S{25{c-W-XrkERoz8o1ufYFKUXc#hV95-uFFmVgyU60lBvVyUX8u8~I`
zA&J65=Lk;K;fD)~2HPks=zAS*2+$pF=R2l9=y4eAUy@K}naDAj<Ezed)a3mOAp?6v
zJ=fQhVLGIYzxrjVo39F2MN>R<^%g8l*c5=<tPBE6vPGHC%R^v%VMWrxJPb0ho}-UH
zF3AC*i(zppf6ntD9~}x-?u)jvK_^KfL*C|7kark9{Nss1-VLp3YAYp4Vh<Uq?*^Jh
z6}3W(mYZ_!JADtPT@e3`<tDNi|4rn^;n!FW;d5gXck$nCwEW*`k_Zh~7M>+@e5>Ih
z$Rnfx`ws*>BpUvO14AkQcbX(U`skyCy#MLPpS<_!#~=2?OrO{G>uvb=s7c7l56y#L
zYKM(K2|27Cw_DBnA^sxdyV}vo@xI`En4BE9YlqF<gZkm&>Gx!p1W{eTBz;iBUPS!5
z*&@gLt;SKixl4{(^}WN|cZaoKfa>1CnIN*?APsV|R|8^=GwHbA+HD-yP&o|9jT|1x
z48#Rw#nd5Ov*GLn+}+b(>nTZk|F{lw)|+4d)ZA<Qa0(AFW2?Tu+xV{0J{=~pL8LAO
ztNGJ<%@>rl<K{O9wd2DkduW~PH+P$R$L-w{_I%Wo_M3-4HoiG&HCoMGu01l?INm?_
z^OxEg{EiLR8O5)G0BEl%bUFmRyQfFZgTu2w+s9}4gaR~wt{)#GMxZVD?QuISd1|Zs
zU4$u)sq+lYx(mpj2~GjAAtr%Asa5-~RsW^|cCP*0_)}02vIA`Wn<i;`)1IWju%NNp
ze!Br01&js>IkHE#(XNx@gZkddpT7Z9zt+BKOiIb?HA%{*$d`O}ARDlSGDS@Jb>r)U
zMzdYtZw%Lu4;ti;c2lbV1~9<OUi|<F0PiCy@<m{XlkY<m!7o87VVxgDf2w2}<<zaL
zn6VUE_#;GVqpU>OEO5mlPv2|@a<gIPRPAO9C^aOZdBpMzPCA^OL{|gv0pz15%y<aA
z9UPqf+-M#ia_GJK_u!w6Gww1c!U{e&%+0(-11id;7`gX-A7BjrP&?eiH3BIn9G4ii
z8kk@OGO;x%g**x-gQ;5WTHG1A^8s57n1Kd+M%WJpV&IQb^4d-6aOF-H4U87DTFh)#
zWy?#|2~*S;3`$~4tG0Up0x^FI4Cu8MY@qELo1Zs-M>zEzt5s`##}+YqHIQMJ@wW)@
z6jTGu^!uO0-xdV22h5F3n(h5s`;_z2JgT=)%fp@?>*yH3&tbhT9km+aT|j7Dtdx&x
zKh%H0g)|8?zl`rs5eLE*3e<MNOWV@Eu;-uQwbFzw==0A)Ztz~~r^YVqpL_Mzw~h9s
zB!%x&gqD)z%cB-(_6&6QJ^7*DZtjJhL=xogS9B8Ke8E`6<@p2f|6~2Q9YKl&eIc~3
z+RZlkvG)A|87#QAttrNkfTczZc6C#;S=vqpXN?VAvp0vNE(@Fii_Ne33$WyQR;Lu5
zE|&ECtLyrZ5F!>s{D<O~zJEsx`A^@2Y8hzbV`IJI|J=kVi~n;IxzS86mxX?~2!?y$
zTZzd<{BN1&x%m%{UnJznI3zD4>{s7^q&@KzSYF&C<mGHCBR}<|^hE#6()8-9%d^C$
z)|OVH#dUBJSnDgVuB^^35O(*;FI(Bo4$w%ej+%}_r=Tm9m62RB2`gzqF|;xywMpDI
z!dJ_~r0P1v5jzSd@r1WD+-34BXAc+ecDGIIUOK$-31|hDvIQ~qLx52#ZxF45H$Rsn
z;?cO=C3Z3iLd8_$>{MxfKuj?};ARw_y%`3clzap+lLrywWk3vj1U)3b+qcy~7Kr-2
zPn2Mzc4$$hWyRGUw*4wbiF%QWnja`Dx=ja2I*ep%uys=(I6A1(Dqhzar5%scvYljM
zp5P^D8*pn{1zPz5i@xb<7A-1zCz!a=C?fZUX@rF8F7uNe<G#|%6-(<F^;M+kE|S?Q
zO{VP~+o6>-`jz*S%Yd@_RMUa1-8B%{3RGZL*Ok(}e~T8v()x}qn7qE2)y*AS`xhCz
ztC)hx>x=2Q2K`ryXsBuuej}gPlhTE^MgK|(z2%7fT}m=~pO%XJ)ngAX_+ST*o+6ke
zor6d=KXBf=P4aN1i`-g;!mFa9O(D5f?fk%aW*~jD?3&eH+)m<)xy$iHZj>pDK6oug
zIfje$Dz%)QBJ<d=Db-%iShfHN7f%;=WTA-dt|#$=p4v7knHIe6bt_ey*qf%StHyxi
zU%lG^f$2ap8BmIF2L9}^q-_{LsYor$v;xLDnNw`Xf^|0_mIBT{Yy)=3E*6#iLY-_-
zgIYl3vPy7F{=$L3Zm?k!P%k5=Qo;nOsJLKYOM8o@O9L_4E<Bj|oo5Qty%YpY@CM}4
zq65q8nyxuJg4T-$cIolR26mRJ4gpaYc}noY93((-g3%5rh!PwM883u}le&T%<@7*r
zaN*-Kiz~>OrYeqUiQu{SBx!G!E?lM~YzEzdVA2y_ydC@w!qF%DF4wxG?0q-gGSDV+
zx!(ET$ap;e%VkEhclqBfG^qaxmH$NUAGOehND9WTSkn{u)Op1{&~c^uoaMsObA_n|
zUfdCshpfyNUYeVp?dYB^%q_2az3ecO<wO`3Ko*`YzOpc%kM+x#6S7fW?9(%c1elkm
ziwmnW024X={Gt`t!3|5JHp&VweP3SmD{wZ=ZDS4k7M5m$zKW?r-_r7{epmG}bvtuD
z2@UWUUI4a5N97*WGp!+`)6YI9I(d%FdRIbycJ~UO*OnG%!`*K|Fvv%4rWgl6o_%qC
zJ_KU%Nufu~eVvjW(=M{&2v)MgOG?7UIsKwK=gL($Dbl^@hUz%SHOqW_>LSY*wLUQ0
zIVC>0H+72H55*{RGf+qn(=}Ek!C{}z3?kl8Z^m9VT~dMlk*re)nczT9x^T!q;DDDb
z{JO?2Sz6WUWC;wjXd1~4-CS36<}5ZAgJ@;VD`Yd^Xyc<rHp&_2szZZ&w&5V1btd`0
z)q-Lac8d-FEiNsR=jNB5nVM(J62?M`teOxX!g)&_8rcp>mDQoaV09-T#+5-5!L9>R
z_@kh<gtt`$D4G$O7B&|b=GY<6%s#tRm}LPPT3tjEa4Usdb1ERPXgW|nvP`Xt#zIw_
zm_~$yz=G64)1l2LA@xehH=|4$ig&J4!?bMCB&w7!zqO$!sAuAR{@O+G74$!JKW_}h
z5Tl+L$;&s{$03REiGs@Yb-fKa7FqWV5B|FiJ9rrPQZ0%Da%0x<#H`^^>q#^SBtBqb
zmk#&Ffl%^^X~)tZo8}mJSEqNK=Q_GzuXspRV%5J@=3u-YQxL;maKfmn0x;Z?*ve(a
zWl`@>D!kJ>Wy1>@Pq>Ju`pW|b*^x+cxt!mb4ueVpUl4{L{G`Sae$I(Focd#F0sSQ0
zFl?m_7mPac<Rh?WS=1?+D$TEPi4#w)NyMuu^M+)8DV-S-iw55i0x92HRLYmXX^Dx^
zk!`nxS!UVQ<;Ncf{70{dzp2=SrIa?q$MP><K<|3{*2Uw~UR|^Rx2sqbuBT&lguNFh
z_q?FKFhzQm6?z0;qLx<P=_DB0))_L!pBmi`N+<m^4)wl5B5|T$aLHb07_lQSLLAm-
z$EoMDH&>3bCg!vQHt?pxq9sS)8TKyq@qLGv!)p$1PqHWt?7MV}y?K2Q>EFfqUv46v
z|Ba20kKN^ex6sbX|19<f{JhL>ES~wryy?8e?|+r`O}+erNSu`IdzZ=Po-52Qi=GXO
zR^$2Ia`-ciD*sMndByLrV_$6`yHhiw$E#zy%Lwl>!hdf@ShTK|6J9@$>C6kSlo+~3
zm(<YPJ$;JZv%_GtY?+nL{IGX|IQ8u6Y$2E$!*jTjH}Nn7<=?1I{(Je|71BFlsB30-
zF%*`KUk#<;8b(KQ6=#xvQbN`KFzN%$J}*o@ZzlH)r=ByKt*moDHdHPzJcKPK==XrM
z&Qm1YBoq7)Bq}37qmg_pX#$qK62Q)UnD<{M9qyjJ@~pTsZwu{cg@vBjp$u20xB($#
zq+}o>*Q8ew6qAq5(aFMt%EHdel7d~V*FkV$78fId)BAJA#&{NYf$h5_%-!<k41UNJ
zB)vTq)p16Mm(M{S96m2GC4Tg}q=U44M@CW?d@|;j_x^+5e~o0vgYUma$JzH^*}Lz*
zZl&d;?Y~n$?bYbNJXKhnTYRpcKtVdp=52O_RH67y*?=Cr_QrDy&xhb^C@HvBfhZ<T
zpqv%{FFs<y;Ey4iWiOt!+0GSSXuQ}Ig;ey&DFuM>PraZk_N^DgR@Pa5Elue<u!!s%
z6xXg|?SKFlWtCaB=HM1fDSS8`1lrV}F8IDnDZveqibo*A0gwn6@sKZT8?MC}AEfu;
zPa`0p1Tcu_AW#enW%obmg4hgXs8Eo|#R?B3E>swR3!a9FP>kOdTquArfFyZpMLh`W
zHc>(34b6twMBoV){G&bv)-jP~Z40h;nUG;8EStJ+Zeus>)<CFgU;C@A;L|O#0<Pdz
z`D6h<C`ZU*a1CIAb*Vj!$rkLknk~V}2vE4k?(h${rac`;Ij1T+HKU(vJxB+Kue1uD
zA8|u;{Wc566(_I`P-AxQ>7=L>=rbYc=T$<d*u!I3j~(Hz;T6Nbx<ZD$RZ!x8(L#J~
zC2l(fsuS2B>GMBufS7ToVZMSY^TC5f8*v-oaU=dC-IV{Zzqk-qcIP!2WR(6e^K-sR
zL`>^5D<TK*G88N+){9LdaxlG!1XTw^`D>5Cd6u$3Sm?nzVNdf|b;YBkV8v6#(lv^k
zAHs0eGZ<L%VXbqA^-`dMxBi1oBoeczCJ!4uwwPOm?%U0>v#nTRJ5E`pO$`7sT~PqC
z=hspTSWbp2<F|2__*QDg<4Iic{j*<6#ZOYtC%Szh<s%4f3)s7lqVC#VyK8stu3gmr
M0*i6>Qvgr^0AvEvKmY&$

literal 0
HcmV?d00001

diff --git a/contrib/unbound_unixsock.diff b/contrib/unbound_unixsock.diff
deleted file mode 100644
index 09d05d39203f..000000000000
--- a/contrib/unbound_unixsock.diff
+++ /dev/null
@@ -1,305 +0,0 @@
-diff --git a/daemon/remote.c b/daemon/remote.c
-index a2b2204..b6990f3 100644
---- a/daemon/remote.c
-+++ b/daemon/remote.c
-@@ -81,6 +81,11 @@
- #ifdef HAVE_NETDB_H
- #include <netdb.h>
- #endif
-+#ifdef HAVE_PWD_H
-+#include <pwd.h>
-+#include <sys/stat.h>
-+#include <fcntl.h>
-+#endif
- 
- /* just for portability */
- #ifdef SQ
-@@ -235,7 +240,8 @@ void daemon_remote_delete(struct daemon_remote* rc)
-  * @return false on failure.
-  */
- static int
--add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err)
-+add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
-+	struct config_file* cfg)
- {
- 	struct addrinfo hints;
- 	struct addrinfo* res;
-@@ -246,29 +252,74 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err)
- 	snprintf(port, sizeof(port), "%d", nr);
- 	port[sizeof(port)-1]=0;
- 	memset(&hints, 0, sizeof(hints));
--	hints.ai_socktype = SOCK_STREAM;
--	hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
--	if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
--#ifdef USE_WINSOCK
--		if(!noproto_is_err && r == EAI_NONAME) {
--			/* tried to lookup the address as name */
--			return 1; /* return success, but do nothing */
-+
-+	if(ip[0] == '/') {
-+		/* This looks like UNIX socket! */
-+		fd = create_domain_accept_sock(ip);
-+/*
-+ * When unbound starts, it first creates a socket and then
-+ * drops privs, so the socket is created as root user.
-+ * This is fine, but we would like to set _unbound user group
-+ * for this socket, and permissions should be 0660 so only
-+ * root and _unbound group members can invoke unbound-control.
-+ * The username used here is the same as username that unbound
-+ * uses for its worker processes.
-+ */
-+
-+/*
-+ * Note: this code is an exact copy of code from daemon.c
-+ * Normally this should be either wrapped into a function,
-+ * or gui/gid values should be retrieved at config parsing time
-+ * and then stored in configfile structure.
-+ * This requires action from unbound developers!
-+*/
-+#ifdef HAVE_GETPWNAM
-+		struct passwd *pwd = NULL;
-+		uid_t uid;
-+		gid_t gid;
-+		/* initialize, but not to 0 (root) */
-+		memset(&uid, 112, sizeof(uid));
-+		memset(&gid, 112, sizeof(gid));
-+		log_assert(cfg);
-+
-+		if(cfg->username && cfg->username[0]) {
-+			if((pwd = getpwnam(cfg->username)) == NULL)
-+				fatal_exit("user '%s' does not exist.",
-+					cfg->username);
-+			uid = pwd->pw_uid;
-+			gid = pwd->pw_gid;
-+			endpwent();
- 		}
-+
-+		chown(ip, 0, gid);
-+		chmod(ip, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
-+#endif
-+	} else {
-+		hints.ai_socktype = SOCK_STREAM;
-+		hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
-+		if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
-+#ifdef USE_WINSOCK
-+			if(!noproto_is_err && r == EAI_NONAME) {
-+				/* tried to lookup the address as name */
-+				return 1; /* return success, but do nothing */
-+			}
- #endif /* USE_WINSOCK */
--                log_err("control interface %s:%s getaddrinfo: %s %s",
--			ip?ip:"default", port, gai_strerror(r),
-+			log_err("control interface %s:%s getaddrinfo: %s %s",
-+				ip?ip:"default", port, gai_strerror(r),
- #ifdef EAI_SYSTEM
- 			r==EAI_SYSTEM?(char*)strerror(errno):""
- #else
- 			""
- #endif
- 			);
--		return 0;
-+			return 0;
-+		}
-+
-+		/* open fd */
-+		fd = create_tcp_accept_sock(res, 1, &noproto);
-+		freeaddrinfo(res);
- 	}
- 
--	/* open fd */
--	fd = create_tcp_accept_sock(res, 1, &noproto);
--	freeaddrinfo(res);
- 	if(fd == -1 && noproto) {
- 		if(!noproto_is_err)
- 			return 1; /* return success, but do nothing */
-@@ -305,7 +356,7 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
- 	if(cfg->control_ifs) {
- 		struct config_strlist* p;
- 		for(p = cfg->control_ifs; p; p = p->next) {
--			if(!add_open(p->str, cfg->control_port, &l, 1)) {
-+			if(!add_open(p->str, cfg->control_port, &l, 1, cfg)) {
- 				listening_ports_free(l);
- 				return NULL;
- 			}
-@@ -313,12 +364,12 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
- 	} else {
- 		/* defaults */
- 		if(cfg->do_ip6 &&
--			!add_open("::1", cfg->control_port, &l, 0)) {
-+			!add_open("::1", cfg->control_port, &l, 0, cfg)) {
- 			listening_ports_free(l);
- 			return NULL;
- 		}
- 		if(cfg->do_ip4 &&
--			!add_open("127.0.0.1", cfg->control_port, &l, 1)) {
-+			!add_open("127.0.0.1", cfg->control_port, &l, 1, cfg)) {
- 			listening_ports_free(l);
- 			return NULL;
- 		}
-diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
-index ea7ec3a..4cb04e2 100644
---- a/services/listen_dnsport.c
-+++ b/services/listen_dnsport.c
-@@ -55,6 +55,10 @@
- #endif
- #include <fcntl.h>
- 
-+#ifndef USE_WINSOCK
-+#include <sys/un.h>
-+#endif
-+
- /** number of queued TCP connections for listen() */
- #define TCP_BACKLOG 5 
- 
-@@ -376,6 +380,53 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
- }
- 
- int
-+create_domain_accept_sock(char *path) {
-+	int s;
-+	struct sockaddr_un unixaddr;
-+
-+#ifndef USE_WINSOCK
-+	unixaddr.sun_len = sizeof(unixaddr);
-+	unixaddr.sun_family = AF_UNIX;
-+	strlcpy(unixaddr.sun_path, path, 104);
-+
-+	if((s = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
-+		log_err("Cannot create UNIX socket %s (%s)",
-+			path, strerror(errno));
-+		return -1;
-+	}
-+
-+	if(unlink(path) && errno != ENOENT) {
-+		/* The socket already exists and cannot be removed */
-+		log_err("Cannot remove old UNIX socket %s (%s)",
-+			path, strerror(errno));
-+		return -1;
-+	}
-+
-+	if(bind(s, (struct sockaddr *) &unixaddr,
-+		sizeof(struct sockaddr_un)) == -1) {
-+		log_err("Cannot bind UNIX socket %s (%s)",
-+			path, strerror(errno));
-+		return -1;
-+	}
-+
-+	if(!fd_set_nonblock(s)) {
-+		log_err("Cannot set non-blocking mode");
-+		return -1;
-+	}
-+
-+	if(listen(s, TCP_BACKLOG) == -1) {
-+		log_err("can't listen: %s", strerror(errno));
-+		return -1;
-+	}
-+
-+	return s;
-+#else
-+	log_err("UNIX sockets are not supported");
-+	return -1;
-+#endif
-+}
-+
-+int
- create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto)
- {
- 	int s;
-diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
-index a872f92..10631fd 100644
---- a/smallapp/unbound-control.c
-+++ b/smallapp/unbound-control.c
-@@ -59,6 +59,8 @@
- #include "util/locks.h"
- #include "util/net_help.h"
- 
-+#include <sys/un.h>
-+
- /** Give unbound-control usage, and exit (1). */
- static void
- usage()
-@@ -158,6 +160,7 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
- {
- 	struct sockaddr_storage addr;
- 	socklen_t addrlen;
-+	int addrfamily = 0;
- 	int fd;
- 	/* use svr or the first config entry */
- 	if(!svr) {
-@@ -176,12 +179,21 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
- 	if(strchr(svr, '@')) {
- 		if(!extstrtoaddr(svr, &addr, &addrlen))
- 			fatal_exit("could not parse IP@port: %s", svr);
-+	} else if(svr[0] == '/') {
-+		struct sockaddr_un* unixsock = (struct sockaddr_un *) &addr;
-+		unixsock->sun_family = AF_UNIX;
-+		unixsock->sun_len = sizeof(unixsock);
-+		strlcpy(unixsock->sun_path, svr, 104);
-+		addrlen = sizeof(struct sockaddr_un);
-+		addrfamily = AF_UNIX;
- 	} else {
- 		if(!ipstrtoaddr(svr, cfg->control_port, &addr, &addrlen))
- 			fatal_exit("could not parse IP: %s", svr);
- 	}
--	fd = socket(addr_is_ip6(&addr, addrlen)?AF_INET6:AF_INET, 
--		SOCK_STREAM, 0);
-+
-+	if(addrfamily != AF_UNIX)
-+		addrfamily = addr_is_ip6(&addr, addrlen)?AF_INET6:AF_INET;
-+	fd = socket(addrfamily, SOCK_STREAM, 0);
- 	if(fd == -1) {
- #ifndef USE_WINSOCK
- 		fatal_exit("socket: %s", strerror(errno));
-diff --git a/util/net_help.c b/util/net_help.c
-index b3136a3..5b5b4a3 100644
---- a/util/net_help.c
-+++ b/util/net_help.c
-@@ -45,6 +45,7 @@
- #include "util/module.h"
- #include "util/regional.h"
- #include <fcntl.h>
-+#include <sys/un.h>
- #include <openssl/ssl.h>
- #include <openssl/err.h>
- 
-@@ -135,7 +136,7 @@ log_addr(enum verbosity_value v, const char* str,
- {
- 	uint16_t port;
- 	const char* family = "unknown";
--	char dest[100];
-+	char dest[108];
- 	int af = (int)((struct sockaddr_in*)addr)->sin_family;
- 	void* sinaddr = &((struct sockaddr_in*)addr)->sin_addr;
- 	if(verbosity < v)
-@@ -148,15 +149,23 @@ log_addr(enum verbosity_value v, const char* str,
- 		case AF_UNIX: family="unix"; break;
- 		default: break;
- 	}
--	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
--		strncpy(dest, "(inet_ntop error)", sizeof(dest));
-+
-+	if(af != AF_UNIX) {
-+		if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
-+			strncpy(dest, "(inet_ntop error)", sizeof(dest));
-+		}
-+		dest[sizeof(dest)-1] = 0;
-+		port = ntohs(((struct sockaddr_in*)addr)->sin_port);
-+		if(verbosity >= 4)
-+			verbose(v, "%s %s %s port %d (len %d)", str, family,
-+				dest, (int)port, (int)addrlen);
-+		else	verbose(v, "%s %s port %d", str, dest, (int)port);
-+	} else {
-+		struct sockaddr_un* unixsock;
-+		unixsock = (struct sockaddr_un *) addr;
-+		strlcpy(dest, unixsock->sun_path, sizeof(dest));
-+		verbose(v, "%s %s %s", str, family, dest);
- 	}
--	dest[sizeof(dest)-1] = 0;
--	port = ntohs(((struct sockaddr_in*)addr)->sin_port);
--	if(verbosity >= 4)
--		verbose(v, "%s %s %s port %d (len %d)", str, family, dest, 
--			(int)port, (int)addrlen);
--	else	verbose(v, "%s %s port %d", str, dest, (int)port);
- }
- 
- int 
diff --git a/daemon/cachedump.c b/daemon/cachedump.c
index 20a46ae4dffb..4b0a583a6547 100644
--- a/daemon/cachedump.c
+++ b/daemon/cachedump.c
@@ -56,9 +56,9 @@
 #include "iterator/iter_utils.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
 
 /** dump one rrset zonefile line */
 static int
@@ -223,6 +223,8 @@ copy_msg(struct regional* region, struct lruhash_entry* e,
 	struct query_info** k, struct reply_info** d)
 {
 	struct reply_info* rep = (struct reply_info*)e->data;
+	if(rep->rrset_count > RR_COUNT_MAX)
+		return 0; /* to protect against integer overflow */
 	*d = (struct reply_info*)regional_alloc_init(region, e->data,
 		sizeof(struct reply_info) + 
 		sizeof(struct rrset_ref) * (rep->rrset_count-1) +
@@ -470,6 +472,10 @@ load_rrset(SSL* ssl, sldns_buffer* buf, struct worker* worker)
 		log_warn("bad rrset without contents");
 		return 0;
 	}
+	if(rr_count > RR_COUNT_MAX || rrsig_count > RR_COUNT_MAX) {
+		log_warn("bad rrset with too many rrs");
+		return 0;
+	}
 	d->count = (size_t)rr_count;
 	d->rrsig_count = (size_t)rrsig_count;
 	d->security = (enum sec_status)security;
@@ -646,6 +652,10 @@ load_msg(SSL* ssl, sldns_buffer* buf, struct worker* worker)
 	rep.ttl = (time_t)ttl;
 	rep.prefetch_ttl = PREFETCH_TTL_CALC(rep.ttl);
 	rep.security = (enum sec_status)security;
+	if(an > RR_COUNT_MAX || ns > RR_COUNT_MAX || ar > RR_COUNT_MAX) {
+		log_warn("error too many rrsets");
+		return 0; /* protect against integer overflow in alloc */
+	}
 	rep.an_numrrsets = (size_t)an;
 	rep.ns_numrrsets = (size_t)ns;
 	rep.ar_numrrsets = (size_t)ar;
diff --git a/daemon/daemon.c b/daemon/daemon.c
index f693a0285a2c..0cd37ae8231c 100644
--- a/daemon/daemon.c
+++ b/daemon/daemon.c
@@ -84,7 +84,7 @@
 #include "util/random.h"
 #include "util/tube.h"
 #include "util/net_help.h"
-#include "ldns/keyraw.h"
+#include "sldns/keyraw.h"
 #include <signal.h>
 
 /** How many quit requests happened. */
diff --git a/daemon/remote.c b/daemon/remote.c
index 3ce55ee7ea1a..93d0eda28b86 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -78,10 +78,10 @@
 #include "iterator/iter_delegpt.h"
 #include "services/outbound_list.h"
 #include "services/outside_network.h"
-#include "ldns/str2wire.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
-#include "ldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
+#include "sldns/sbuffer.h"
 
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
@@ -140,34 +140,45 @@ timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
 
 /*
  * The following function was generated using the openssl utility, using
- * the command : "openssl dhparam -dsaparam -C 512"
+ * the command : "openssl dhparam -dsaparam -C 1024"
+ * (some openssl versions reject DH that is 'too small', eg. 512).
  */
 #ifndef S_SPLINT_S
-DH *get_dh512()
+DH *get_dh1024()
 {
-	static unsigned char dh512_p[]={
-		0xC9,0xD7,0x05,0xDA,0x5F,0xAB,0x14,0xE8,0x11,0x56,0x77,0x85,
-		0xB1,0x24,0x2C,0x95,0x60,0xEA,0xE2,0x10,0x6F,0x0F,0x84,0xEC,
-		0xF4,0x45,0xE8,0x90,0x7A,0xA7,0x03,0xFF,0x5B,0x88,0x53,0xDE,
-		0xC4,0xDE,0xBC,0x42,0x78,0x71,0x23,0x7E,0x24,0xA5,0x5E,0x4E,
-		0xEF,0x6F,0xFF,0x5F,0xAF,0xBE,0x8A,0x77,0x62,0xB4,0x65,0x82,
-		0x7E,0xC9,0xED,0x2F,
-	};
-	static unsigned char dh512_g[]={
-		0x8D,0x3A,0x52,0xBC,0x8A,0x71,0x94,0x33,0x2F,0xE1,0xE8,0x4C,
-		0x73,0x47,0x03,0x4E,0x7D,0x40,0xE5,0x84,0xA0,0xB5,0x6D,0x10,
-		0x6F,0x90,0x43,0x05,0x1A,0xF9,0x0B,0x6A,0xD1,0x2A,0x9C,0x25,
-		0x0A,0xB9,0xD1,0x14,0xDC,0x35,0x1C,0x48,0x7C,0xC6,0x0C,0x6D,
-		0x32,0x1D,0xD3,0xC8,0x10,0xA8,0x82,0x14,0xA2,0x1C,0xF4,0x53,
-		0x23,0x3B,0x1C,0xB9,
-	};
+	static unsigned char dh1024_p[]={
+		0xB3,0x67,0x2E,0x3B,0x68,0xC5,0xDA,0x58,0x46,0xD6,0x2B,0xD3,
+		0x41,0x78,0x97,0xE4,0xE1,0x61,0x71,0x68,0xE6,0x0F,0x1D,0x78,
+		0x05,0xAA,0xF0,0xFF,0x30,0xDF,0xAC,0x49,0x7F,0xE0,0x90,0xFE,
+		0xB9,0x56,0x4E,0x3F,0xE2,0x98,0x8A,0xED,0xF5,0x28,0x39,0xEF,
+		0x2E,0xA6,0xB7,0x67,0xB2,0x43,0xE4,0x53,0xF8,0xEB,0x2C,0x1F,
+		0x06,0x77,0x3A,0x6F,0x62,0x98,0xC1,0x3B,0xF7,0xBA,0x4D,0x93,
+		0xF7,0xEB,0x5A,0xAD,0xC5,0x5F,0xF0,0xB7,0x24,0x35,0x81,0xF7,
+		0x7F,0x1F,0x24,0xC0,0xDF,0xD3,0xD8,0x40,0x72,0x7E,0xF3,0x19,
+		0x2B,0x26,0x27,0xF4,0xB6,0xB3,0xD4,0x7D,0x08,0x23,0xBE,0x68,
+		0x2B,0xCA,0xB4,0x46,0xA8,0x9E,0xDD,0x6C,0x3D,0x75,0xA6,0x48,
+		0xF7,0x44,0x43,0xBF,0x91,0xC2,0xB4,0x49,
+		};
+	static unsigned char dh1024_g[]={
+		0x5F,0x37,0xB5,0x80,0x4D,0xB4,0xC4,0xB2,0x37,0x12,0xD5,0x2F,
+		0x56,0x81,0xB0,0xDF,0x3D,0x27,0xA2,0x54,0xE7,0x14,0x65,0x2D,
+		0x72,0xA8,0x97,0xE0,0xA9,0x4A,0x09,0x5E,0x89,0xBE,0x34,0x9A,
+		0x90,0x98,0xC1,0xE8,0xBB,0x01,0x2B,0xC2,0x74,0x74,0x90,0x59,
+		0x0B,0x72,0x62,0x5C,0xFD,0x49,0x63,0x4B,0x38,0x91,0xF1,0x7F,
+		0x13,0x25,0xEB,0x52,0x50,0x47,0xA2,0x8C,0x32,0x28,0x42,0xAC,
+		0xBD,0x7A,0xCC,0x58,0xBE,0x36,0xDA,0x6A,0x24,0x06,0xC7,0xF1,
+		0xDA,0x8D,0x8A,0x3B,0x03,0xFA,0x6F,0x25,0xE5,0x20,0xA7,0xD6,
+		0x6F,0x74,0x61,0x53,0x14,0x81,0x29,0x04,0xB5,0x61,0x12,0x53,
+		0xA3,0xD6,0x09,0x98,0x0C,0x8F,0x1C,0xBB,0xD7,0x1C,0x2C,0xEE,
+		0x56,0x4B,0x74,0x8F,0x4A,0xF8,0xA9,0xD5,
+		};
 	DH *dh;
 
 	if ((dh=DH_new()) == NULL) return(NULL);
-	dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
-	dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
+	dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
+	dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
 	if ((dh->p == NULL) || (dh->g == NULL))
-	{ DH_free(dh); return(NULL); }
+		{ DH_free(dh); return(NULL); }
 	dh->length = 160;
 	return(dh);
 }
@@ -218,7 +229,7 @@ daemon_remote_create(struct config_file* cfg)
 		/* Since we have no certificates and hence no source of
 		 * DH params, let's generate and set them
 		 */
-		if(!SSL_CTX_set_tmp_dh(rc->ctx,get_dh512())) {
+		if(!SSL_CTX_set_tmp_dh(rc->ctx,get_dh1024())) {
 			log_crypto_err("Wanted to set DH param, but failed");
 			return NULL;
 		}
@@ -358,7 +369,8 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 		}
 
 		/* open fd */
-		fd = create_tcp_accept_sock(res, 1, &noproto, 0);
+		fd = create_tcp_accept_sock(res, 1, &noproto, 0,
+			cfg->ip_transparent);
 		freeaddrinfo(res);
 	}
 
@@ -725,6 +737,8 @@ print_stats(SSL* ssl, const char* nm, struct stats_info* s)
 		(long long)avg.tv_sec, (int)avg.tv_usec)) return 0;
 	if(!ssl_printf(ssl, "%s.recursion.time.median"SQ"%g\n", nm, 
 		s->mesh_time_median)) return 0;
+	if(!ssl_printf(ssl, "%s.tcpusage"SQ"%lu\n", nm,
+		(unsigned long)s->svr.tcp_accept_usage)) return 0;
 	return 1;
 }
 
@@ -1889,6 +1903,21 @@ do_insecure_remove(SSL* ssl, struct worker* worker, char* arg)
 	send_ok(ssl);
 }
 
+static void
+do_insecure_list(SSL* ssl, struct worker* worker)
+{
+	char buf[257];
+	struct trust_anchor* a;
+	if(worker->env.anchors) {
+		RBTREE_FOR(a, struct trust_anchor*, worker->env.anchors->tree) {
+			if(a->numDS == 0 && a->numDNSKEY == 0) {
+				dname_str(a->name, buf);
+				ssl_printf(ssl, "%s\n", buf);
+			}
+		}
+	}
+}
+
 /** do the status command */
 static void
 do_status(SSL* ssl, struct worker* worker)
@@ -2074,7 +2103,7 @@ dump_infra_host(struct lruhash_entry* e, void* arg)
 		d->rtt.srtt, d->rtt.rttvar, rtt_notimeout(&d->rtt), d->rtt.rto,
 		d->timeout_A, d->timeout_AAAA, d->timeout_other,
 		(int)d->edns_lame_known, (int)d->edns_version,
-		(int)(a->now<d->probedelay?d->probedelay-a->now:0),
+		(int)(a->now<d->probedelay?(d->probedelay - a->now):0),
 		(int)d->isdnsseclame, (int)d->rec_lame, (int)d->lame_type_A,
 		(int)d->lame_other)) {
 		a->ssl_failed = 1;
@@ -2249,6 +2278,54 @@ do_list_local_data(SSL* ssl, struct worker* worker)
 	lock_rw_unlock(&zones->lock);
 }
 
+/** struct for user arg ratelimit list */
+struct ratelimit_list_arg {
+	/** the infra cache */
+	struct infra_cache* infra;
+	/** the SSL to print to */
+	SSL* ssl;
+	/** all or only ratelimited */
+	int all;
+	/** current time */
+	time_t now;
+};
+
+/** list items in the ratelimit table */
+static void
+rate_list(struct lruhash_entry* e, void* arg)
+{
+	struct ratelimit_list_arg* a = (struct ratelimit_list_arg*)arg;
+	struct rate_key* k = (struct rate_key*)e->key;
+	struct rate_data* d = (struct rate_data*)e->data;
+	char buf[257];
+	int lim = infra_find_ratelimit(a->infra, k->name, k->namelen);
+	int max = infra_rate_max(d, a->now);
+	if(a->all == 0) {
+		if(max < lim)
+			return;
+	}
+	dname_str(k->name, buf);
+	ssl_printf(a->ssl, "%s %d limit %d\n", buf, max, lim);
+}
+
+/** do the ratelimit_list command */
+static void
+do_ratelimit_list(SSL* ssl, struct worker* worker, char* arg)
+{
+	struct ratelimit_list_arg a;
+	a.all = 0;
+	a.infra = worker->env.infra_cache;
+	a.now = *worker->env.now;
+	a.ssl = ssl;
+	arg = skipwhite(arg);
+	if(strcmp(arg, "+a") == 0)
+		a.all = 1;
+	if(a.infra->domain_rates==NULL ||
+		(a.all == 0 && infra_dp_ratelimit == 0))
+		return;
+	slabhash_traverse(a.infra->domain_rates, 0, rate_list, &a);
+}
+
 /** tell other processes to execute the command */
 static void
 distribute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd)
@@ -2309,12 +2386,18 @@ execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd,
 	} else if(cmdcmp(p, "list_stubs", 10)) {
 		do_list_stubs(ssl, worker);
 		return;
+	} else if(cmdcmp(p, "list_insecure", 13)) {
+		do_insecure_list(ssl, worker);
+		return;
 	} else if(cmdcmp(p, "list_local_zones", 16)) {
 		do_list_local_zones(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "list_local_data", 15)) {
 		do_list_local_data(ssl, worker);
 		return;
+	} else if(cmdcmp(p, "ratelimit_list", 14)) {
+		do_ratelimit_list(ssl, worker, p+14);
+		return;
 	} else if(cmdcmp(p, "stub_add", 8)) {
 		/* must always distribute this cmd */
 		if(rc) distribute_cmd(rc, ssl, cmd);
diff --git a/daemon/stats.c b/daemon/stats.c
index d3f41de037b4..838cf05ae52c 100644
--- a/daemon/stats.c
+++ b/daemon/stats.c
@@ -50,12 +50,13 @@
 #include "daemon/daemon.h"
 #include "services/mesh.h"
 #include "services/outside_network.h"
+#include "services/listen_dnsport.h"
 #include "util/config_file.h"
 #include "util/tube.h"
 #include "util/timehist.h"
 #include "util/net_help.h"
 #include "validator/validator.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
 #include "validator/val_kcache.h"
@@ -140,6 +141,7 @@ void
 server_stats_compile(struct worker* worker, struct stats_info* s, int reset)
 {
 	int i;
+	struct listen_list* lp;
 
 	s->svr = worker->stats;
 	s->mesh_num_states = worker->env.mesh->all.count;
@@ -174,6 +176,13 @@ server_stats_compile(struct worker* worker, struct stats_info* s, int reset)
 		s->svr.key_cache_count = count_slabhash_entries(worker->env.key_cache->slab);
 	else	s->svr.key_cache_count = 0;
 
+	/* get tcp accept usage */
+	s->svr.tcp_accept_usage = 0;
+	for(lp = worker->front->cps; lp; lp = lp->next) {
+		if(lp->com->type == comm_tcp_accept)
+			s->svr.tcp_accept_usage += lp->com->cur_tcp_count;
+	}
+
 	if(reset && !worker->env.cfg->stat_cumulative) {
 		worker_stats_clear(worker);
 	}
@@ -247,6 +256,7 @@ void server_stats_add(struct stats_info* total, struct stats_info* a)
 		total->svr.rrset_bogus += a->svr.rrset_bogus;
 		total->svr.unwanted_replies += a->svr.unwanted_replies;
 		total->svr.unwanted_queries += a->svr.unwanted_queries;
+		total->svr.tcp_accept_usage += a->svr.tcp_accept_usage;
 		for(i=0; i<STATS_QTYPE_NUM; i++)
 			total->svr.qtype[i] += a->svr.qtype[i];
 		for(i=0; i<STATS_QCLASS_NUM; i++)
diff --git a/daemon/stats.h b/daemon/stats.h
index 5ea00a0da5b7..6985446ce299 100644
--- a/daemon/stats.h
+++ b/daemon/stats.h
@@ -129,6 +129,8 @@ struct server_stats {
 	size_t unwanted_replies;
 	/** unwanted traffic received on client-facing ports */
 	size_t unwanted_queries;
+	/** usage of tcp accept list */
+	size_t tcp_accept_usage;
 
 	/** histogram data exported to array 
 	 * if the array is the same size, no data is lost, and
diff --git a/daemon/worker.c b/daemon/worker.c
index 5edc21dd46e7..79aec4d3a4b2 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -71,7 +71,7 @@
 #include "validator/val_anchor.h"
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
@@ -86,6 +86,8 @@
 
 /** Size of an UDP datagram */
 #define NORMAL_UDP_SIZE	512 /* bytes */
+/** ratelimit for error responses */
+#define ERROR_RATELIMIT 100 /* qps */
 
 /** 
  * seconds to add to prefetch leeway.  This is a TTL that expires old rrsets
@@ -291,6 +293,26 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 	return 0;
 }
 
+/** ratelimit error replies
+ * @param worker: the worker struct with ratelimit counter
+ * @param err: error code that would be wanted.
+ * @return value of err if okay, or -1 if it should be discarded instead.
+ */
+static int
+worker_err_ratelimit(struct worker* worker, int err)
+{
+	if(worker->err_limit_time == *worker->env.now) {
+		/* see if limit is exceeded for this second */
+		if(worker->err_limit_count++ > ERROR_RATELIMIT)
+			return -1;
+	} else {
+		/* new second, new limits */
+		worker->err_limit_time = *worker->env.now;
+		worker->err_limit_count = 1;
+	}
+	return err;
+}
+
 /** check request sanity.
  * @param pkt: the wire packet to examine for sanity.
  * @param worker: parameters for checking.
@@ -315,32 +337,32 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker)
 	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
 		LDNS_TC_CLR(sldns_buffer_begin(pkt));
 		verbose(VERB_QUERY, "request bad, has TC bit on");
-		return LDNS_RCODE_FORMERR;
+		return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 	}
 	if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY) {
 		verbose(VERB_QUERY, "request unknown opcode %d", 
 			LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)));
-		return LDNS_RCODE_NOTIMPL;
+		return worker_err_ratelimit(worker, LDNS_RCODE_NOTIMPL);
 	}
 	if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) {
 		verbose(VERB_QUERY, "request wrong nr qd=%d", 
 			LDNS_QDCOUNT(sldns_buffer_begin(pkt)));
-		return LDNS_RCODE_FORMERR;
+		return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 	}
 	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) != 0) {
 		verbose(VERB_QUERY, "request wrong nr an=%d", 
 			LDNS_ANCOUNT(sldns_buffer_begin(pkt)));
-		return LDNS_RCODE_FORMERR;
+		return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 	}
 	if(LDNS_NSCOUNT(sldns_buffer_begin(pkt)) != 0) {
 		verbose(VERB_QUERY, "request wrong nr ns=%d", 
 			LDNS_NSCOUNT(sldns_buffer_begin(pkt)));
-		return LDNS_RCODE_FORMERR;
+		return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 	}
 	if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) > 1) {
 		verbose(VERB_QUERY, "request wrong nr ar=%d", 
 			LDNS_ARCOUNT(sldns_buffer_begin(pkt)));
-		return LDNS_RCODE_FORMERR;
+		return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 	}
 	return 0;
 }
@@ -546,7 +568,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	if(rep->an_numrrsets > 0 && (rep->rrsets[0]->rk.type == 
 		htons(LDNS_RR_TYPE_CNAME) || rep->rrsets[0]->rk.type == 
 		htons(LDNS_RR_TYPE_DNAME))) {
-		if(!reply_check_cname_chain(rep)) {
+		if(!reply_check_cname_chain(qinfo, rep)) {
 			/* cname chain invalid, redo iterator steps */
 			verbose(VERB_ALGO, "Cache reply: cname chain broken");
 		bail_out:
@@ -813,6 +835,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	if(!query_info_parse(&qinfo, c->buffer)) {
 		verbose(VERB_ALGO, "worker parse request: formerror.");
 		log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
+		if(worker_err_ratelimit(worker, LDNS_RCODE_FORMERR) == -1) {
+			comm_point_drop_reply(repinfo);
+			return 0;
+		}
 		sldns_buffer_rewind(c->buffer);
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
diff --git a/daemon/worker.h b/daemon/worker.h
index ff69bc1acfd4..63613430b054 100644
--- a/daemon/worker.h
+++ b/daemon/worker.h
@@ -103,6 +103,10 @@ struct worker {
 	struct comm_point* cmd_com;
 	/** timer for statistics */
 	struct comm_timer* stat_timer;
+	/** ratelimit for errors, time value */
+	time_t err_limit_time;
+	/** ratelimit for errors, packet count */
+	unsigned int err_limit_count;
 
 	/** random() table for this worker. */
 	struct ub_randstate* rndstate;
diff --git a/dns64/dns64.c b/dns64/dns64.c
index eaaa26f7c910..63cc8084e35f 100644
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -590,6 +590,10 @@ dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
 	 * for the RRs themselves. Each RR has a length, TTL, pointer to wireformat
 	 * data, 2 bytes of data length, and 16 bytes of IPv6 address.
 	 */
+	if(fd->count > RR_COUNT_MAX) {
+		*dd_out = NULL;
+		return; /* integer overflow protection in alloc */
+	}
 	if (!(dd = *dd_out = regional_alloc(region,
 		  sizeof(struct packed_rrset_data)
 		  + fd->count * (sizeof(size_t) + sizeof(time_t) +
@@ -713,6 +717,8 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 		if(i<rep->an_numrrsets && fk->rk.type == htons(LDNS_RR_TYPE_A)) {
 			/* also sets dk->entry.hash */
 			dns64_synth_aaaa_data(fk, fd, dk, &dd, super->region, dns64_env);
+			if(!dd)
+				return;
 			/* Delete negative AAAA record from cache stored by
 			 * the iterator module */
 			rrset_cache_remove(super->env->rrset_cache, dk->rk.dname, 
diff --git a/dnstap/dnstap.c b/dnstap/dnstap.c
index b2dc053bdbf6..b62dc5b8cfc5 100644
--- a/dnstap/dnstap.c
+++ b/dnstap/dnstap.c
@@ -39,7 +39,7 @@
 #include "config.h"
 #include <string.h>
 #include <sys/time.h>
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
 #include "util/netevent.h"
diff --git a/doc/Changelog b/doc/Changelog
index a1c2f76cd21d..525bb365e3d9 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,164 @@
+29 June 2015: Wouter
+	- iana portlist update.
+	- Fix alloc with log for allocation size checks.
+
+26 June 2015: Wouter
+	- Fix #677 Fix DNAME responses from cache that failed internal chain
+	  test.
+	- iana portlist update.
+
+22 June 2015: Wouter
+	- Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly
+	  and was therefore always synthesized (thanks to Valentin Dietrich).
+
+4 June 2015: Wouter
+	- RFC 7553 RR type URI support, is now enabled by default.
+
+2 June 2015: Wouter
+	- Fix #674: Do not free pointers given by getenv.
+
+29 May 2015: Wouter
+	- Fix that unparseable error responses are ratelimited.
+	- SOA negative TTL is capped at minimumttl in its rdata section.
+	- cache-max-negative-ttl config option, default 3600.
+
+26 May 2015: Wouter
+	- Document that ratelimit works with unbound-control set_option.
+
+21 May 2015: Wouter
+	- iana portlist update.
+	- documentation proposes ratelimit of 1000 (closer to what upstream
+	  servers expect from us).
+
+20 May 2015: Wouter
+	- DLV is going to be decommissioned.  Advice to stop using it, and
+	  put text in the example configuration and man page to that effect.
+
+10 May 2015: Wouter
+	- Change syntax of particular validator error to be easier for
+	  machine parse, swap rrset and ip adres info so it looks like:
+	  validation failure <www.example.nl. TXT IN>: signature crypto
+	  failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
+
+1 May 2015: Wouter
+	- caps-whitelist in unbound.conf allows whitelist of loadbalancers
+	  that cannot work with caps-for-id or its fallback.
+
+30 April 2015: Wouter
+	- Unit test for type ANY synthesis.
+
+22 April 2015: Wouter
+	- Removed contrib/unbound_unixsock.diff, because it has been
+	  integrated, use control-interface: /path in unbound.conf.
+	- iana portlist update.
+
+17 April 2015: Wouter
+	- Synthesize ANY responses from cache.  Does not search exhaustively,
+	  but MX,A,AAAA,SOA,NS also CNAME.
+	- Fix leaked dns64prefix configuration string.
+
+16 April 2015: Wouter
+	- Add local-zone type inform_deny, that logs query and drops answer.
+	- Ratelimit does not apply to prefetched queries, and ratelimit-factor
+	  is default 10.  Repeated normal queries get resolved and with
+	  prefetch stay in the cache.
+	- Fix bug#664: libunbound python3 related fixes (from Tomas Hozza)
+	  Use print_function also for Python2.
+	  libunbound examples: produce sorted output.
+	  libunbound-Python: libldns is not used anymore.
+	  Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
+
+10 April 2015: Wouter
+	- unbound-control ratelimit_list lists high rate domains.
+	- ratelimit feature, ratelimit: 100, or some sensible qps, can be
+	  used to turn it on.  It ratelimits recursion effort per zone.
+	  For particular names you can configure exceptions in unbound.conf.
+	- Fix that get_option for cache-sizes does not print double newline.
+	- Fix#663: ssl handshake fails when using unix socket because dh size
+	  is too small.
+
+8 April 2015: Wouter
+	- Fix crash in dnstap: Do not try to log TCP responses after timeout.
+
+7 April 2015: Wouter
+	- Libunbound skips dos-line-endings from etc/hosts.
+	- Unbound exits with a fatal error when the auto-trust-anchor-file
+	  fails to be writable.  This is seconds after startup.  You can
+	  load a readonly auto-trust-anchor-file with trust-anchor-file.
+	  The file has to be writable to notice the trust anchor change,
+	  without it, a trust anchor change will be unnoticed and the system
+	  will then become inoperable.
+	- unbound-control list_insecure command shows the negative trust
+	  anchors currently configured, patch from Jelte Jansen.
+
+2 April 2015: Wouter
+	- Fix #660: Fix interface-automatic broken in the presence of
+	  asymmetric routing.
+
+26 March 2015: Wouter
+	- remote.c probedelay line is easier to read.
+	- rename ldns subdirectory to sldns to avoid name collision.
+
+25 March 2015: Wouter
+	- Fix #657:  libunbound(3) recommends deprecated
+	  CRYPTO_set_id_callback.
+	- If unknown trust anchor algorithm, and libressl is used, error
+	  message encourages upgrade of the libressl package.
+
 23 March 2015: Wouter
 	- Fix segfault on user not found at startup (from Maciej Soltysiak).
 
+20 March 2015: Wouter
+	- Fixed to add integer overflow checks on allocation (defense in depth).
+
+19 March 2015: Wouter
+	- Add ip-transparent config option for bind to non-local addresses.
+
+17 March 2015: Wouter
+	- Use reallocarray for integer overflow protection, patch submitted
+	  by Loganaden Velvindron.
+
+16 March 2015: Wouter
+	- Fixup compile on cygwin, more portable openssl thread id.
+
+12 March 2015: Wouter
+	- Updated default keylength in unbound-control-setup to 3k.
+
+10 March 2015: Wouter
+	- Fix lintian warning in unbound-checkconf man page (from Andreas
+	  Schulze).
+	- print svnroot when building windows dist.
+	- iana portlist update.
+	- Fix warning on sign compare in getentropy_linux.
+
+9 March 2015: Wouter
+	- Fix #644: harden-algo-downgrade option, if turned off, fixes the
+	  reported excessive validation failure when multiple algorithms
+	  are present.  It allows the weakest algorithm to validate the zone.
+	- iana portlist update.
+
+5 March 2015: Wouter
+	- contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
+	  scripts.  Contributed by Yuri Voinov.
+	- Document that incoming-num-tcp increase is good for large servers.
+	- stats reports tcp usage, of incoming-num-tcp buffers.
+
+4 March 2015: Wouter
+	- Patch from Brad Smith that syncs compat/getentropy_linux with
+	  OpenBSD's version (2015-03-04).
+	- 0x20 fallback improved: servfail responses do not count as missing
+	  comparisons (except if all responses are errors),
+	  inability to find nameservers does not fail equality comparisons,
+	  many nameservers does not try to compare more than max-sent-count,
+	  parse failures start 0x20 fallback procedure.
+	- store caps_response with best response in case downgrade response
+	  happens to be the last one.
+	- Document windows 8 tests.
+
+3 March 2015: Wouter
+	- tag 1.5.3rc1
+	[ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ]
+
 2 March 2015: Wouter
 	- iana portlist update.
 
diff --git a/doc/README b/doc/README
index f3530d6eedf4..e192333dc986 100644
--- a/doc/README
+++ b/doc/README
@@ -1,4 +1,4 @@
-README for Unbound 1.5.3
+README for Unbound 1.5.4
 Copyright 2007 NLnet Labs
 http://unbound.net
 
diff --git a/doc/example.conf.in b/doc/example.conf.in
index 60ed5c89f91e..677598767bf5 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.5.3.
+# See unbound.conf(5) man page, version 1.5.4.
 #
 # this is a comment.
 
@@ -87,6 +87,10 @@ server:
 	
 	# use SO_REUSEPORT to distribute queries over threads.
 	# so-reuseport: no
+	
+	# use IP_TRANSPARENT so the interface: addresses can be non-local
+	# and you can config non-existing IPs that are going to work later on
+	# ip-transparent: no
 
 	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
 	# is set with msg-buffer-size). 1480 can solve fragmentation (timeouts).
@@ -135,6 +139,9 @@ server:
 	# cache. Items are not cached for longer. In seconds.
 	# cache-max-ttl: 86400
 
+	# the time to live (TTL) value cap for negative responses in the cache
+	# cache-max-negative-ttl: 3600
+
 	# the time to live (TTL) value for cached roundtrip times, lameness and
 	# EDNS version information for hosts. In seconds.
 	# infra-host-ttl: 900
@@ -284,9 +291,18 @@ server:
 	# implementation of draft-wijngaards-dnsext-resolver-side-mitigation.
 	# harden-referral-path: no
 
+	# Harden against algorithm downgrade when multiple algorithms are
+	# advertised in the DS record.  If no, allows the weakest algorithm
+	# to validate the zone.
+	# harden-algo-downgrade: yes
+
 	# Use 0x20-encoded random bits in the query to foil spoof attempts.
 	# This feature is an experimental implementation of draft dns-0x20.
 	# use-caps-for-id: no
+	
+	# Domains (and domains in them) without support for dns-0x20 and
+	# the fallback fails because they keep sending different answers.
+	# caps-whitelist: "licdn.com"
 
 	# Enforce privacy of these addresses. Strips them away from answers. 
 	# It may cause DNSSEC validation to additionally mark it as bogus. 
@@ -349,7 +365,7 @@ server:
 
 	# File with DLV trusted keys. Same format as trust-anchor-file.
 	# There can be only one DLV configured, it is trusted from root down.
-	# Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
+	# DLV is going to be decommissioned.  Please do not use it any more.
 	# dlv-anchor-file: "dlv.isc.org.key"
 
 	# File with trusted keys for validation. Specify more than one file
@@ -501,6 +517,7 @@ server:
 	# o nodefault can be used to normally resolve AS112 zones.
 	# o typetransparent resolves normally for other types and other names
 	# o inform resolves normally, but logs client IP address
+	# o inform_deny drops queries and logs client IP address
 	#
 	# defaults are localhost address, reverse for 127.0.0.1 and ::1
 	# and nxdomain for AS112 zones. If you configure one of these zones
@@ -542,6 +559,26 @@ server:
 	# Enable dns64 in module-config.  Used to synthesize IPv6 from IPv4.
 	# dns64-prefix: 64:ff9b::0/96
 
+	# ratelimit for uncached, new queries, this limits recursion effort.
+	# ratelimiting is experimental, and may help against randomqueryflood.
+	# if 0(default) it is disabled, otherwise state qps allowed per zone.
+	# ratelimit: 0
+
+	# ratelimits are tracked in a cache, size in bytes of cache (or k,m).
+	# ratelimit-size: 4m
+	# ratelimit cache slabs, reduces lock contention if equal to cpucount.
+	# ratelimit-slabs: 4
+	
+	# 0 blocks when ratelimited, otherwise let 1/xth traffic through
+	# ratelimit-factor: 10
+
+	# override the ratelimit for a specific domain name.
+	# give this setting multiple times to have multiple overrides.
+	# ratelimit-for-domain: example.com 1000
+	# override the ratelimits for all domains below a domain name
+	# can give this multiple times, the name closest to the zone is used.
+	# ratelimit-below-domain: example 1000
+
 # Python config section. To enable:
 # o use --with-pythonmodule to configure before compiling.
 # o list python in the module-config string (above) to enable.
diff --git a/doc/libunbound.3.in b/doc/libunbound.3.in
index a4c7945aea1b..7ef77865b6e7 100644
--- a/doc/libunbound.3.in
+++ b/doc/libunbound.3.in
@@ -1,4 +1,4 @@
-.TH "libunbound" "3" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
+.TH "libunbound" "3" "Jul  9, 2015" "NLnet Labs" "unbound 1.5.4"
 .\"
 .\" libunbound.3 -- unbound library functions manual
 .\"
@@ -42,7 +42,7 @@
 .B ub_ctx_zone_remove,
 .B ub_ctx_data_add,
 .B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.5.3 functions.
+\- Unbound DNS validating resolver 1.5.4 functions.
 .SH "SYNOPSIS"
 .B #include <unbound.h>
 .LP
@@ -175,6 +175,7 @@ to read them.
 Before you call this, use the openssl functions CRYPTO_set_id_callback and
 CRYPTO_set_locking_callback to set up asyncronous operation if you use
 lib openssl (the application calls these functions once for initialisation).
+Openssl 1.0.0 or later uses the CRYPTO_THREADID_set_callback function.
 .TP
 .B ub_ctx_delete
 Delete validation context and free associated resources.
diff --git a/doc/unbound-anchor.8.in b/doc/unbound-anchor.8.in
index fb2136fc1aaf..4632cf71d681 100644
--- a/doc/unbound-anchor.8.in
+++ b/doc/unbound-anchor.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
+.TH "unbound-anchor" "8" "Jul  9, 2015" "NLnet Labs" "unbound 1.5.4"
 .\"
 .\" unbound-anchor.8 -- unbound anchor maintenance utility manual
 .\"
diff --git a/doc/unbound-checkconf.8.in b/doc/unbound-checkconf.8.in
index e7db810bbec8..e1a94cf7a812 100644
--- a/doc/unbound-checkconf.8.in
+++ b/doc/unbound-checkconf.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
+.TH "unbound-checkconf" "8" "Jul  9, 2015" "NLnet Labs" "unbound 1.5.4"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
@@ -31,7 +31,7 @@ The available options are:
 Show the version and commandline option help.
 .TP
 .B \-f
-Print full pathname, with chroot applied to it.  Use with the -o option.
+Print full pathname, with chroot applied to it.  Use with the \-o option.
 .TP
 .B \-o\fI option
 If given, after checking the config file the value of this option is 
diff --git a/doc/unbound-control.8.in b/doc/unbound-control.8.in
index f6eae249abc9..057eb0336fe4 100644
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
+.TH "unbound-control" "8" "Jul  9, 2015" "NLnet Labs" "unbound 1.5.4"
 .\"
 .\" unbound-control.8 -- unbound remote control manual
 .\"
@@ -177,7 +177,8 @@ harden\-glue, harden\-dnssec\-stripped, harden\-below\-nxdomain,
 harden\-referral\-path, prefetch, prefetch\-key, log\-queries,
 hide\-identity, hide\-version, identity, version, val\-log\-level,
 val\-log\-squelch, ignore\-cd\-flag, add\-holddown, del\-holddown,
-keep\-missing, tcp\-upstream, ssl\-upstream, max\-udp\-size.
+keep\-missing, tcp\-upstream, ssl\-upstream, max\-udp\-size, ratelimit,
+cache\-max\-ttl, cache\-min\-ttl, cache\-max\-negative\-ttl.
 .TP
 .B get_option \fIopt
 Get the value of the option.  Give the option name without a trailing ':'.
@@ -197,6 +198,9 @@ This includes the root hints in use.
 .B list_forwards
 List the forward zones in use.  These are printed zone by zone to the output.
 .TP
+.B list_insecure
+List the zones with domain\-insecure.
+.TP
 .B list_local_zones
 List the local zones in use.  These are printed one per line with zone type.
 .TP
@@ -252,6 +256,13 @@ port number can be set explicitly (default port is 53 (DNS)).
 By default the forwarder information from the config file for the root "." is
 used.  The config file is not changed, so after a reload these changes are
 gone.  Other forward zones from the config file are not affected by this command.
+.TP
+.B ratelimit_list \fR[\fI+a\fR]
+List the domains that are ratelimited.  Printed one per line with current
+estimated qps and qps limit from config.  With +a it prints all domains, not
+just the ratelimited domains, with their estimated qps.  The ratelimited
+domains return an error for uncached (new) queries, but cached queries work
+as normal.
 .SH "EXIT CODE"
 The unbound\-control program exits with status code 1 on error, 0 on success.
 .SH "SET UP"
@@ -322,6 +333,11 @@ less than this time.  Because of big outliers (usually queries to non
 responsive servers), the average can be bigger than the median.  This median
 has been calculated by interpolation from a histogram.
 .TP
+.I threadX.tcpusage
+The currently held tcp buffers for incoming connections.  A spot value on
+the time of the request.  This helps you spot if the incoming\-num\-tcp
+buffers are full.
+.TP
 .I total.num.queries
 summed over threads.
 .TP
@@ -355,6 +371,9 @@ summed over threads.
 .I total.recursion.time.median
 averaged over threads.
 .TP
+.I total.tcpusage
+summed over threads.
+.TP
 .I time.now
 current time in seconds since 1970.
 .TP
diff --git a/doc/unbound-host.1.in b/doc/unbound-host.1.in
index 9129bea66af1..568dbcd407df 100644
--- a/doc/unbound-host.1.in
+++ b/doc/unbound-host.1.in
@@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
+.TH "unbound\-host" "1" "Jul  9, 2015" "NLnet Labs" "unbound 1.5.4"
 .\"
 .\" unbound-host.1 -- unbound DNS lookup utility
 .\"
diff --git a/doc/unbound.8.in b/doc/unbound.8.in
index 7242469c1f1f..e4ff3b8e9b14 100644
--- a/doc/unbound.8.in
+++ b/doc/unbound.8.in
@@ -1,4 +1,4 @@
-.TH "unbound" "8" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
+.TH "unbound" "8" "Jul  9, 2015" "NLnet Labs" "unbound 1.5.4"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -9,7 +9,7 @@
 .\"
 .SH "NAME"
 .B unbound
-\- Unbound DNS validating resolver 1.5.3.
+\- Unbound DNS validating resolver 1.5.4.
 .SH "SYNOPSIS"
 .B unbound
 .RB [ \-h ]
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 9b088f372b63..cd57ab83d3d8 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "Mar 10, 2015" "NLnet Labs" "unbound 1.5.3"
+.TH "unbound.conf" "5" "Jul  9, 2015" "NLnet Labs" "unbound 1.5.4"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
@@ -164,12 +164,14 @@ By default only ports above 1024 that have not been assigned by IANA are used.
 Give a port number or a range of the form "low\-high", without spaces.
 .TP
 .B outgoing\-num\-tcp: \fI<number>
-Number of outgoing TCP buffers to allocate per thread. Default is 10. If set
-to 0, or if do\-tcp is "no", no TCP queries to authoritative servers are done.
+Number of outgoing TCP buffers to allocate per thread. Default is 10. If
+set to 0, or if do\-tcp is "no", no TCP queries to authoritative servers
+are done.  For larger installations increasing this value is a good idea.
 .TP
 .B incoming\-num\-tcp: \fI<number>
-Number of incoming TCP buffers to allocate per thread. Default is 10. If set
-to 0, or if do\-tcp is "no", no TCP queries from clients are accepted.
+Number of incoming TCP buffers to allocate per thread. Default is
+10. If set to 0, or if do\-tcp is "no", no TCP queries from clients are
+accepted. For larger installations increasing this value is a good idea.
 .TP
 .B edns\-buffer\-size: \fI<number>
 Number of bytes size to advertise as the EDNS reassembly buffer size.
@@ -265,6 +267,16 @@ it then attempts to open the port and passes the option if it was available
 at compile time, if that works it is used, if it fails, it continues
 silently (unless verbosity 3) without the option.
 .TP
+.B ip\-transparent: \fI<yes or no>
+If yes, then use IP_TRANSPARENT socket option on sockets where unbound
+is listening for incoming traffic.  Default no.  Allows you to bind to
+non\-local interfaces.  For example for non\-existant IP addresses that
+are going to exist later on, with host failover configuration.  This is
+a lot like interface\-automatic, but that one services all interfaces
+and with this option you can select which (future) interfaces unbound
+provides service on.  This option needs unbound to be started with root
+permissions on some systems.
+.TP
 .B rrset\-cache\-size: \fI<number>
 Number of bytes size of the RRset cache. Default is 4 megabytes.
 A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
@@ -290,6 +302,10 @@ Zero makes sure the data in the cache is as the domain owner intended,
 higher values, especially more than an hour or so, can lead to trouble as 
 the data in the cache does not match up with the actual data any more.
 .TP
+.B cache\-max\-negative\-ttl: \fI<seconds>
+Time to live maximum for negative responses, these have a SOA in the
+authority section that is limited in time.  Default is 3600.
+.TP
 .B infra\-host\-ttl: \fI<seconds>
 Time to live for entries in the host cache. The host cache contains 
 roundtrip timing, lameness and EDNS support information. Default is 900.
@@ -548,6 +564,13 @@ extra query load that is generated.  Experimental option.
 If you enable it consider adding more numbers after the target\-fetch\-policy
 to increase the max depth that is checked to.
 .TP
+.B harden\-algo\-downgrade: \fI<yes or no>
+Harden against algorithm downgrade when multiple algorithms are
+advertised in the DS record.  If no, allows the weakest algorithm to
+validate the zone.  Default is yes.  Zone signers must produce zones
+that allow this feature to work, but sometimes they do not, and turning
+this option off avoids that validation failure.
+.TP
 .B use\-caps\-for\-id: \fI<yes or no>
 Use 0x20\-encoded random bits in the query to foil spoof attempts.
 This perturbs the lowercase and uppercase of query names sent to 
@@ -555,6 +578,12 @@ authority servers and checks if the reply still has the correct casing.
 Disabled by default. 
 This feature is an experimental implementation of draft dns\-0x20.
 .TP
+.B caps\-whitelist: \fI<domain>
+Whitelist the domain so that it does not receive caps\-for\-id perturbed
+queries.  For domains that do not support 0x20 and also fail with fallback
+because they keep sending different answers, like some load balancers.
+Can be given multiple times, for different domains.
+.TP
 .B private\-address: \fI<IP address or subnet>
 Give IPv4 of IPv6 addresses or classless subnets. These are addresses
 on your private network, and are not allowed to be returned for public
@@ -655,14 +684,19 @@ It is possible to use wildcards with this statement, the wildcard is
 expanded on start and on reload.
 .TP
 .B dlv\-anchor\-file: \fI<filename>
+This option was used during early days DNSSEC deployment when no parent-side
+DS record registrations were easily available.  Nowadays, it is best to have
+DS records registered with the parent zone (many top level zones are signed).
 File with trusted keys for DLV (DNSSEC Lookaside Validation). Both DS and
 DNSKEY entries can be used in the file, in the same format as for
 \fItrust\-anchor\-file:\fR statements. Only one DLV can be configured, more
 would be slow. The DLV configured is used as a root trusted DLV, this 
 means that it is a lookaside for the root. Default is "", or no dlv anchor file.
+DLV is going to be decommissioned.  Please do not use it any more.
 .TP
 .B dlv\-anchor: \fI<"Resource Record">
 Much like trust\-anchor, this is a DLV anchor with the DS or DNSKEY inline.
+DLV is going to be decommissioned.  Please do not use it any more.
 .TP
 .B domain\-insecure: \fI<domain name>
 Sets domain name to be insecure, DNSSEC chain of trust is ignored towards
@@ -796,10 +830,10 @@ data leakage about the local network to the upstream DNS servers.
 .B local\-zone: \fI<zone> <type>
 Configure a local zone. The type determines the answer to give if
 there is no match from local\-data. The types are deny, refuse, static,
-transparent, redirect, nodefault, typetransparent, inform, and are explained
-below. After that the default settings are listed. Use local\-data: to
-enter data into the local zone. Answers for local zones are authoritative
-DNS answers. By default the zones are class IN.
+transparent, redirect, nodefault, typetransparent, inform, inform_deny,
+and are explained below. After that the default settings are listed. Use
+local\-data: to enter data into the local zone. Answers for local zones
+are authoritative DNS answers. By default the zones are class IN.
 .IP
 If you need more complicated authoritative data, with referrals, wildcards,
 CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
@@ -853,6 +887,10 @@ info: zonename inform IP@port queryname type class.  This option can be
 used for normal resolution, but machines looking up infected names are
 logged, eg. to run antivirus on them.
 .TP 10
+\h'5'\fIinform_deny\fR 
+The query is dropped, like 'deny', and logged, like 'inform'.  Ie. find
+infected machines without answering the queries.
+.TP 10
 \h'5'\fInodefault\fR 
 Used to turn off default contents for AS112 zones. The other types
 also turn off default contents for the zone. The 'nodefault' option 
@@ -959,6 +997,51 @@ it as detailed in the stub zone section below.
 Configure local data shorthand for a PTR record with the reversed IPv4 or
 IPv6 address and the host name.  For example "192.0.2.4 www.example.com".
 TTL can be inserted like this: "2001:DB8::4 7200 www.example.com"
+.TP 5
+.B ratelimit: \fI<number or 0>
+Enable ratelimiting of queries sent to nameserver for performing recursion.
+If 0, the default, it is disabled.  This option is experimental at this time.
+The ratelimit is in queries per second that are allowed.  More queries are
+turned away with an error (servfail).  This stops recursive floods, eg. random
+query names, but not spoofed reflection floods.  Cached responses are not
+ratelimited by this setting.  The zone of the query is determined by examining
+the nameservers for it, the zone name is used to keep track of the rate.
+For example, 1000 may be a suitable value to stop the server from being
+overloaded with random names, and keeps unbound from sending traffic to the
+nameservers for those zones.
+.TP 5
+.B ratelimit\-size: \fI<memory size>
+Give the size of the data structure in which the current ongoing rates are
+kept track in.  Default 4m.  In bytes or use m(mega), k(kilo), g(giga).
+The ratelimit structure is small, so this data structure likely does
+not need to be large.
+.TP 5
+.B ratelimit\-slabs: \fI<number>
+Give power of 2 number of slabs, this is used to reduce lock contention
+in the ratelimit tracking data structure.  Close to the number of cpus is
+a fairly good setting.
+.TP 5
+.B ratelimit\-factor: \fI<number>
+Set the amount of queries to rate limit when the limit is exceeded.
+If set to 0, all queries are dropped for domains where the limit is
+exceeded.  If set to another value, 1 in that number is allowed through
+to complete.  Default is 10, allowing 1/10 traffic to flow normally.
+This can make ordinary queries complete (if repeatedly queried for),
+and enter the cache, whilst also mitigiting the traffic flow by the
+factor given.
+.TP 5
+.B ratelimit\-for\-domain: \fI<domain> <number qps>
+Override the global ratelimit for an exact match domain name with the listed
+number.  You can give this for any number of names.  For example, for
+a top\-level\-domain you may want to have a higher limit than other names.
+.TP 5
+.B ratelimit\-below\-domain: \fI<domain> <number qps>
+Override the global ratelimit for a domain name that ends in this name.
+You can give this multiple times, it then describes different settings
+in different parts of the namespace.  The closest matching suffix is used
+to determine the qps limit.  The rate for the exact matching domain name
+is not changed, use ratelimit\-for\-domain to set that, you might want
+to use different settings for a top\-level\-domain and subdomains.
 .SS "Remote Control Options"
 In the
 .B remote\-control:
diff --git a/iterator/iter_delegpt.c b/iterator/iter_delegpt.c
index b212ec0775fd..0e251ff583c4 100644
--- a/iterator/iter_delegpt.c
+++ b/iterator/iter_delegpt.c
@@ -47,8 +47,8 @@
 #include "util/data/packed_rrset.h"
 #include "util/data/msgreply.h"
 #include "util/net_help.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
 
 struct delegpt* 
 delegpt_create(struct regional* region)
diff --git a/iterator/iter_fwd.c b/iterator/iter_fwd.c
index 012121241194..0feee032c960 100644
--- a/iterator/iter_fwd.c
+++ b/iterator/iter_fwd.c
@@ -46,8 +46,8 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "ldns/rrdef.h"
-#include "ldns/str2wire.h"
+#include "sldns/rrdef.h"
+#include "sldns/str2wire.h"
 
 int
 fwd_cmp(const void* k1, const void* k2)
diff --git a/iterator/iter_hints.c b/iterator/iter_hints.c
index 57b57c2e034d..25cae0723751 100644
--- a/iterator/iter_hints.c
+++ b/iterator/iter_hints.c
@@ -46,9 +46,9 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "ldns/rrdef.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 struct iter_hints* 
 hints_create(void)
diff --git a/iterator/iter_priv.c b/iterator/iter_priv.c
index 9e09a84bd01e..90bea1746d9a 100644
--- a/iterator/iter_priv.c
+++ b/iterator/iter_priv.c
@@ -49,8 +49,8 @@
 #include "util/data/msgparse.h"
 #include "util/net_help.h"
 #include "util/storage/dnstree.h"
-#include "ldns/str2wire.h"
-#include "ldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/sbuffer.h"
 
 struct iter_priv* priv_create(void)
 {
diff --git a/iterator/iter_resptype.c b/iterator/iter_resptype.c
index 45f919387dca..f146a2b6bfe8 100644
--- a/iterator/iter_resptype.c
+++ b/iterator/iter_resptype.c
@@ -45,8 +45,8 @@
 #include "services/cache/dns.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "ldns/rrdef.h"
-#include "ldns/pkthdr.h"
+#include "sldns/rrdef.h"
+#include "sldns/pkthdr.h"
 
 enum response_type 
 response_type_from_cache(struct dns_msg* msg, 
diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
index 1c81975b234f..cc05867c0a4b 100644
--- a/iterator/iter_scrub.c
+++ b/iterator/iter_scrub.c
@@ -53,7 +53,7 @@
 #include "util/data/dname.h"
 #include "util/data/msgreply.h"
 #include "util/alloc.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** RRset flag used during scrubbing. The RRset is OK. */
 #define RRSET_SCRUB_OK	0x80
@@ -372,7 +372,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				/* check next cname */
 				uint8_t* t = NULL;
 				size_t tlen = 0;
-				if(!parse_get_cname_target(rrset, &t, &tlen))
+				if(!parse_get_cname_target(nx, &t, &tlen))
 					return 0;
 				if(dname_pkt_compare(pkt, alias, t) == 0) {
 					/* it's OK and better capitalized */
diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
index 10ae12f75c6c..bc94ef682247 100644
--- a/iterator/iter_utils.c
+++ b/iterator/iter_utils.c
@@ -64,7 +64,8 @@
 #include "validator/val_kentry.h"
 #include "validator/val_utils.h"
 #include "validator/val_sigcrypt.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
 
 /** time when nameserver glue is said to be 'recent' */
 #define SUSPICION_RECENT_EXPIRY 86400
@@ -105,6 +106,40 @@ read_fetch_policy(struct iter_env* ie, const char* str)
 	return 1;
 }
 
+/** apply config caps whitelist items to name tree */
+static int
+caps_white_apply_cfg(rbtree_t* ntree, struct config_file* cfg)
+{
+	struct config_strlist* p;
+	for(p=cfg->caps_whitelist; p; p=p->next) {
+		struct name_tree_node* n;
+		size_t len;
+		uint8_t* nm = sldns_str2wire_dname(p->str, &len);
+		if(!nm) {
+			log_err("could not parse %s", p->str);
+			return 0;
+		}
+		n = (struct name_tree_node*)calloc(1, sizeof(*n));
+		if(!n) {
+			log_err("out of memory");
+			free(nm);
+			return 0;
+		}
+		n->node.key = n;
+		n->name = nm;
+		n->len = len;
+		n->labs = dname_count_labels(nm);
+		n->dclass = LDNS_RR_CLASS_IN;
+		if(!name_tree_insert(ntree, n, nm, len, n->labs, n->dclass)) {
+			/* duplicate element ignored, idempotent */
+			free(n->name);
+			free(n);
+		}
+	}
+	name_tree_init_parents(ntree);
+	return 1;
+}
+
 int 
 iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 {
@@ -128,6 +163,16 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 		log_err("Could not set private addresses");
 		return 0;
 	}
+	if(cfg->caps_whitelist) {
+		if(!iter_env->caps_white)
+			iter_env->caps_white = rbtree_create(name_tree_compare);
+		if(!iter_env->caps_white || !caps_white_apply_cfg(
+			iter_env->caps_white, cfg)) {
+			log_err("Could not set capsforid whitelist");
+			return 0;
+		}
+
+	}
 	iter_env->supports_ipv6 = cfg->do_ip6;
 	iter_env->supports_ipv4 = cfg->do_ip4;
 	return 1;
@@ -750,6 +795,12 @@ caps_strip_reply(struct reply_info* rep)
 	}
 }
 
+int caps_failed_rcode(struct reply_info* rep)
+{
+	return !(FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR ||
+		FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN);
+}
+
 void 
 iter_store_parentside_rrset(struct module_env* env, 
 	struct ub_packed_rrset_key* rrset)
diff --git a/iterator/iter_utils.h b/iterator/iter_utils.h
index 9373487e002c..3a4df3e45968 100644
--- a/iterator/iter_utils.h
+++ b/iterator/iter_utils.h
@@ -231,6 +231,14 @@ int reply_equal(struct reply_info* p, struct reply_info* q, struct regional* reg
  */
 void caps_strip_reply(struct reply_info* rep);
 
+/**
+ * see if reply has a 'useful' rcode for capsforid comparison, so
+ * not SERVFAIL or REFUSED, and thus NOERROR or NXDOMAIN.
+ * @param rep: reply to check.
+ * @return true if the rcode is a bad type of message.
+ */
+int caps_failed_rcode(struct reply_info* rep);
+
 /**
  * Store parent-side rrset in seperate rrset cache entries for later 
  * last-resort * lookups in case the child-side versions of this information 
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 2037cc8814f2..96918fa97883 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -61,10 +61,11 @@
 #include "util/data/msgencode.h"
 #include "util/fptr_wlist.h"
 #include "util/config_file.h"
-#include "ldns/rrdef.h"
-#include "ldns/wire2str.h"
-#include "ldns/parseutil.h"
-#include "ldns/sbuffer.h"
+#include "util/random.h"
+#include "sldns/rrdef.h"
+#include "sldns/wire2str.h"
+#include "sldns/parseutil.h"
+#include "sldns/sbuffer.h"
 
 int 
 iter_init(struct module_env* env, int id)
@@ -83,6 +84,16 @@ iter_init(struct module_env* env, int id)
 	return 1;
 }
 
+/** delete caps_whitelist element */
+static void
+caps_free(struct rbnode_t* n, void* ATTR_UNUSED(d))
+{
+	if(n) {
+		free(((struct name_tree_node*)n)->name);
+		free(n);
+	}
+}
+
 void 
 iter_deinit(struct module_env* env, int id)
 {
@@ -93,6 +104,10 @@ iter_deinit(struct module_env* env, int id)
 	free(iter_env->target_fetch_policy);
 	priv_delete(iter_env->priv);
 	donotq_delete(iter_env->donotq);
+	if(iter_env->caps_white) {
+		traverse_postorder(iter_env->caps_white, caps_free, NULL);
+		free(iter_env->caps_white);
+	}
 	free(iter_env);
 	env->modinfo[id] = NULL;
 }
@@ -120,6 +135,7 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->query_restart_count = 0;
 	iq->referral_count = 0;
 	iq->sent_count = 0;
+	iq->ratelimit_ok = 0;
 	iq->target_count = NULL;
 	iq->wait_priming_stub = 0;
 	iq->refetch_glue = 0;
@@ -308,6 +324,8 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 	if(num_an + num_ns == 0)
 		return 1;
 	verbose(VERB_ALGO, "prepending %d rrsets", (int)num_an + (int)num_ns);
+	if(num_an > RR_COUNT_MAX || num_ns > RR_COUNT_MAX ||
+		msg->rep->rrset_count > RR_COUNT_MAX) return 0; /* overflow */
 	sets = regional_alloc(region, (num_an+num_ns+msg->rep->rrset_count) *
 		sizeof(struct ub_packed_rrset_key*));
 	if(!sets) 
@@ -455,6 +473,16 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 1;
 }
 
+/** see if target name is caps-for-id whitelisted */
+static int
+is_caps_whitelisted(struct iter_env* ie, struct iter_qstate* iq)
+{
+	if(!ie->caps_white) return 0; /* no whitelist, or no capsforid */
+	return name_tree_lookup(ie->caps_white, iq->qchase.qname,
+		iq->qchase.qname_len, dname_count_labels(iq->qchase.qname),
+		iq->qchase.qclass) != NULL;
+}
+
 /** create target count structure for this query */
 static void
 target_count_create(struct iter_qstate* iq)
@@ -1123,6 +1151,32 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			 * results of priming. */
 			return 0;
 		}
+		if(!iq->ratelimit_ok && qstate->prefetch_leeway)
+			iq->ratelimit_ok = 1; /* allow prefetches, this keeps
+			otherwise valid data in the cache */
+		if(!iq->ratelimit_ok && infra_ratelimit_exceeded(
+			qstate->env->infra_cache, iq->dp->name,
+			iq->dp->namelen, *qstate->env->now)) {
+			/* and increment the rate, so that the rate for time
+			 * now will also exceed the rate, keeping cache fresh */
+			(void)infra_ratelimit_inc(qstate->env->infra_cache,
+				iq->dp->name, iq->dp->namelen,
+				*qstate->env->now);
+			/* see if we are passed through with slip factor */
+			if(qstate->env->cfg->ratelimit_factor != 0 &&
+				ub_random_max(qstate->env->rnd,
+				    qstate->env->cfg->ratelimit_factor) == 1) {
+				iq->ratelimit_ok = 1;
+				log_nametypeclass(VERB_ALGO, "ratelimit allowed through for "
+					"delegation point", iq->dp->name,
+					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
+			} else {
+				log_nametypeclass(VERB_ALGO, "ratelimit exceeded with "
+					"delegation point", iq->dp->name,
+					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
+				return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			}
+		}
 
 		/* see if this dp not useless.
 		 * It is useless if:
@@ -1787,11 +1841,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * the original query is one that matched too, so we have
 		 * caps_server+1 number of matching queries now */
 		if(iq->caps_server+1 >= naddr*3 ||
-			iq->caps_server+1 >= MAX_SENT_COUNT) {
+			iq->caps_server*2+2 >= MAX_SENT_COUNT) {
+			/* *2 on sentcount check because ipv6 may fail */
 			/* we're done, process the response */
 			verbose(VERB_ALGO, "0x20 fallback had %d responses "
 				"match for %d wanted, done.", 
 				(int)iq->caps_server+1, (int)naddr*3);
+			iq->response = iq->caps_response;
 			iq->caps_fallback = 0;
 			iter_dec_attempts(iq->dp, 3); /* space for fallback */
 			iq->num_current_queries++; /* RespState decrements it*/
@@ -1866,6 +1922,24 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* Since a target query might have been made, we 
 			 * need to check again. */
 			if(iq->num_target_queries == 0) {
+				/* if in capsforid fallback, instead of last
+				 * resort, we agree with the current reply
+				 * we have (if any) (our count of addrs bad)*/
+				if(iq->caps_fallback && iq->caps_reply) {
+					/* we're done, process the response */
+					verbose(VERB_ALGO, "0x20 fallback had %d responses, "
+						"but no more servers except "
+						"last resort, done.", 
+						(int)iq->caps_server+1);
+					iq->response = iq->caps_response;
+					iq->caps_fallback = 0;
+					iter_dec_attempts(iq->dp, 3); /* space for fallback */
+					iq->num_current_queries++; /* RespState decrements it*/
+					iq->referral_count++; /* make sure we don't loop */
+					iq->sent_count = 0;
+					iq->state = QUERY_RESP_STATE;
+					return 1;
+				}
 				return processLastResort(qstate, iq, ie, id);
 			}
 		}
@@ -1892,6 +1966,15 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return 0;
 	}
 
+	/* if not forwarding, check ratelimits per delegationpoint name */
+	if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
+		if(!infra_ratelimit_inc(qstate->env->infra_cache, iq->dp->name,
+			iq->dp->namelen, *qstate->env->now)) {
+			verbose(VERB_ALGO, "query exceeded ratelimits");
+			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		}
+	}
+
 	/* We have a valid target. */
 	if(verbosity >= VERB_QUERY) {
 		log_query_info(VERB_QUERY, "sending query:", &iq->qchase);
@@ -1906,11 +1989,15 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->qchase.qname, iq->qchase.qname_len, 
 		iq->qchase.qtype, iq->qchase.qclass, 
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), EDNS_DO|BIT_CD, 
-		iq->dnssec_expected, iq->caps_fallback, &target->addr,
-		target->addrlen, iq->dp->name, iq->dp->namelen, qstate);
+		iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
+		ie, iq), &target->addr, target->addrlen, iq->dp->name,
+		iq->dp->namelen, qstate);
 	if(!outq) {
 		log_addr(VERB_DETAIL, "error sending query to auth server", 
 			&target->addr, target->addrlen);
+		if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok)
+		    infra_ratelimit_dec(qstate->env->infra_cache, iq->dp->name,
+			iq->dp->namelen, *qstate->env->now);
 		return next_state(iq, QUERYTARGETS_STATE);
 	}
 	outbound_list_insert(&iq->outlist, outq);
@@ -2061,6 +2148,14 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * delegation point, and back to the QUERYTARGETS_STATE. */
 		verbose(VERB_DETAIL, "query response was REFERRAL");
 
+		if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
+			/* we have a referral, no ratelimit, we can send
+			 * our queries to the given name */
+			infra_ratelimit_dec(qstate->env->infra_cache,
+				iq->dp->name, iq->dp->namelen,
+				*qstate->env->now);
+		}
+
 		/* if hardened, only store referral if we asked for it */
 		if(!qstate->env->cfg->harden_referral_path ||
 		    (  qstate->qinfo.qtype == LDNS_RR_TYPE_NS 
@@ -2529,6 +2624,12 @@ processClassResponse(struct module_qstate* qstate, int id,
 			/* copy appropriate rcode */
 			to->rep->flags = from->rep->flags;
 			/* copy rrsets */
+			if(from->rep->rrset_count > RR_COUNT_MAX ||
+				to->rep->rrset_count > RR_COUNT_MAX) {
+				log_err("malloc failed (too many rrsets) in collect ANY"); 
+				foriq->state = FINISHED_STATE;
+				return; /* integer overflow protection */
+			}
 			dest = regional_alloc(forq->region, sizeof(dest[0])*n);
 			if(!dest) {
 				log_err("malloc failed in collect ANY"); 
@@ -2825,6 +2926,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->caps_fallback = 1;
 			iq->caps_server = 0;
 			iq->caps_reply = NULL;
+			iq->caps_response = NULL;
 			iq->state = QUERYTARGETS_STATE;
 			iq->num_current_queries--;
 			/* need fresh attempts for the 0x20 fallback, if
@@ -2867,8 +2969,19 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* normalize and sanitize: easy to delete items from linked lists */
 	if(!scrub_message(pkt, prs, &iq->qchase, iq->dp->name, 
-		qstate->env->scratch, qstate->env, ie))
+		qstate->env->scratch, qstate->env, ie)) {
+		/* if 0x20 enabled, start fallback, but we have no message */
+		if(event == module_event_capsfail && !iq->caps_fallback) {
+			iq->caps_fallback = 1;
+			iq->caps_server = 0;
+			iq->caps_reply = NULL;
+			iq->caps_response = NULL;
+			iq->state = QUERYTARGETS_STATE;
+			iq->num_current_queries--;
+			verbose(VERB_DETAIL, "Capsforid: scrub failed, starting fallback with no response");
+		}
 		goto handle_it;
+	}
 
 	/* allocate response dns_msg in region */
 	iq->response = dns_alloc_msg(pkt, prs, qstate->region);
@@ -2890,6 +3003,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->caps_fallback = 1;
 			iq->caps_server = 0;
 			iq->caps_reply = iq->response->rep;
+			iq->caps_response = iq->response;
 			iq->state = QUERYTARGETS_STATE;
 			iq->num_current_queries--;
 			verbose(VERB_DETAIL, "Capsforid: starting fallback");
@@ -2898,8 +3012,24 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* check if reply is the same, otherwise, fail */
 			if(!iq->caps_reply) {
 				iq->caps_reply = iq->response->rep;
+				iq->caps_response = iq->response;
 				iq->caps_server = -1; /*become zero at ++,
 				so that we start the full set of trials */
+			} else if(caps_failed_rcode(iq->caps_reply) &&
+				!caps_failed_rcode(iq->response->rep)) {
+				/* prefer to upgrade to non-SERVFAIL */
+				iq->caps_reply = iq->response->rep;
+				iq->caps_response = iq->response;
+			} else if(!caps_failed_rcode(iq->caps_reply) &&
+				caps_failed_rcode(iq->response->rep)) {
+				/* if we have non-SERVFAIL as answer then 
+				 * we can ignore SERVFAILs for the equality
+				 * comparison */
+				/* no instructions here, skip other else */
+			} else if(caps_failed_rcode(iq->caps_reply) &&
+				caps_failed_rcode(iq->response->rep)) {
+				/* failure is same as other failure in fallbk*/
+				/* no instructions here, skip other else */
 			} else if(!reply_equal(iq->response->rep, iq->caps_reply,
 				qstate->env->scratch)) {
 				verbose(VERB_DETAIL, "Capsforid fallback: "
diff --git a/iterator/iterator.h b/iterator/iterator.h
index 1364b86d722b..aaf0fb3834b7 100644
--- a/iterator/iterator.h
+++ b/iterator/iterator.h
@@ -51,6 +51,7 @@ struct iter_forwards;
 struct iter_donotq;
 struct iter_prep_list;
 struct iter_priv;
+struct rbtree_t;
 
 /** max number of targets spawned for a query and its subqueries */
 #define MAX_TARGET_COUNT	32
@@ -96,6 +97,9 @@ struct iter_env {
 	/** private address space and private domains */
 	struct iter_priv* priv;
 
+	/** whitelist for capsforid names */
+	struct rbtree_t* caps_white;
+
 	/** The maximum dependency depth that this resolver will pursue. */
 	int max_dependency_depth;
 
@@ -235,6 +239,7 @@ struct iter_qstate {
 	/** state for capsfail: stored query for comparisons. Can be NULL if
 	 * no response had been seen prior to starting the fallback. */
 	struct reply_info* caps_reply;
+	struct dns_msg* caps_response;
 
 	/** Current delegation message - returned for non-RD queries */
 	struct dns_msg* deleg_msg;
@@ -258,6 +263,9 @@ struct iter_qstate {
 	 * subqueries, the malloced-array is shared, [0] refcount. */
 	int* target_count;
 
+	/** if true, already tested for ratelimiting and passed the test */
+	int ratelimit_ok;
+
 	/**
 	 * The query must store NS records from referrals as parentside RRs
 	 * Enabled once it hits resolution problems, to throttle retries.
diff --git a/libunbound/context.c b/libunbound/context.c
index c21f94184156..4469b5bb4eb2 100644
--- a/libunbound/context.c
+++ b/libunbound/context.c
@@ -49,7 +49,7 @@
 #include "services/cache/infra.h"
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 int 
 context_finalize(struct ub_ctx* ctx)
@@ -360,7 +360,7 @@ context_serialize_cancel(struct ctx_query* q, uint32_t* len)
 	/* format of cancel:
 	 * 	o uint32 cmd
 	 * 	o uint32 async-id */
-	uint8_t* p = (uint8_t*)malloc(2*sizeof(uint32_t));
+	uint8_t* p = (uint8_t*)reallocarray(NULL, sizeof(uint32_t), 2);
 	if(!p) return NULL;
 	*len = 2*sizeof(uint32_t);
 	sldns_write_uint32(p, UB_LIBCMD_CANCEL);
diff --git a/libunbound/libunbound.c b/libunbound/libunbound.c
index 91a663a773cb..b3a4c2ba77f6 100644
--- a/libunbound/libunbound.c
+++ b/libunbound/libunbound.c
@@ -61,7 +61,7 @@
 #include "services/localzone.h"
 #include "services/cache/infra.h"
 #include "services/cache/rrset.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #ifdef HAVE_PTHREAD
 #include <signal.h>
 #endif
@@ -1028,7 +1028,6 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 					"\\hosts");
 				retval=ub_ctx_hosts(ctx, buf);
 			}
-			free(name);
 			return retval;
 		}
 		return UB_READFILE;
@@ -1053,6 +1052,8 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 		/* skip addr */
 		while(isxdigit((unsigned char)*parse) || *parse == '.' || *parse == ':')
 			parse++;
+		if(*parse == '\r')
+			parse++;
 		if(*parse == '\n' || *parse == 0)
 			continue;
 		if(*parse == '%') 
@@ -1066,7 +1067,8 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 		*parse++ = 0; /* end delimiter for addr ... */
 		/* go to names and add them */
 		while(*parse) {
-			while(*parse == ' ' || *parse == '\t' || *parse=='\n')
+			while(*parse == ' ' || *parse == '\t' || *parse=='\n'
+				|| *parse=='\r')
 				parse++;
 			if(*parse == 0 || *parse == '#')
 				break;
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index c72b586ab70d..72b615313a4b 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -70,8 +70,8 @@
 #include "util/tube.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
 
 /** handle new query command for bg worker */
 static void handle_newq(struct libworker* w, uint8_t* buf, uint32_t len);
diff --git a/libunbound/python/Makefile b/libunbound/python/Makefile
index 86ba1774707a..01b057731fe2 100644
--- a/libunbound/python/Makefile
+++ b/libunbound/python/Makefile
@@ -48,17 +48,14 @@ help:
 #../../.libs/libunbound.so.0:	../../Makefile
 	#$(MAKE) -C ../..
 
-#../../ldns-src/lib/libldns.so:	../../ldns-src/Makefile
-	#$(MAKE) -C ../../ldns-src
-
 clean:
 	rm -rdf examples/unbound
 	rm -f _unbound.so libunbound_wrap.o
 	$(MAKE) -C ../.. clean
 
-testenv: ../../.libs/libunbound.so.2 ../../ldns-src/lib/libldns.so ../../.libs/_unbound.so
+testenv: ../../.libs/libunbound.so.2 ../../.libs/_unbound.so
 	rm -rdf examples/unbound
-	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.2 unbound/libunbound.so.2 && ln -s ../../../../ldns-src/lib/libldns.so.1 unbound/libldns.so.1 && ls -la
+	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.2 unbound/libunbound.so.2 && ls -la
 	cd examples && if test -f ../../../.libs/_unbound.so; then cp ../../../.libs/_unbound.so . ; fi
 	@echo "Run a script by typing ./script_name.py"
 	cd examples && LD_LIBRARY_PATH=unbound bash
diff --git a/libunbound/python/examples/async-lookup.py b/libunbound/python/examples/async-lookup.py
index cbb8ea02d29a..936be3218f3e 100644
--- a/libunbound/python/examples/async-lookup.py
+++ b/libunbound/python/examples/async-lookup.py
@@ -32,6 +32,7 @@
  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  POSSIBILITY OF SUCH DAMAGE.
 '''
+from __future__ import print_function
 import unbound
 import time
 
@@ -39,9 +40,9 @@ ctx = unbound.ub_ctx()
 ctx.resolvconf("/etc/resolv.conf")
 
 def call_back(my_data,status,result):
-    print("Call_back:", my_data)
+    print("Call_back:", sorted(my_data))
     if status == 0 and result.havedata:
-        print("Result:", result.data.address_list)
+        print("Result:", sorted(result.data.address_list))
         my_data['done_flag'] = True
 
 
diff --git a/libunbound/python/examples/dns-lookup.py b/libunbound/python/examples/dns-lookup.py
index b3f4008fdd91..a175dfb0e0ba 100644
--- a/libunbound/python/examples/dns-lookup.py
+++ b/libunbound/python/examples/dns-lookup.py
@@ -32,6 +32,7 @@
  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  POSSIBILITY OF SUCH DAMAGE.
 '''
+from __future__ import print_function
 import unbound
 
 ctx = unbound.ub_ctx()
@@ -39,6 +40,6 @@ ctx.resolvconf("/etc/resolv.conf")
 
 status, result = ctx.resolve("www.nic.cz", unbound.RR_TYPE_A, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print("Result:", result.data.address_list)
+    print("Result:", sorted(result.data.address_list))
 elif status != 0:
     print("Error:", unbound.ub_strerror(status))
diff --git a/libunbound/python/examples/dnssec-valid.py b/libunbound/python/examples/dnssec-valid.py
index 5c3cad9e9036..386f4c2770a5 100644
--- a/libunbound/python/examples/dnssec-valid.py
+++ b/libunbound/python/examples/dnssec-valid.py
@@ -32,6 +32,7 @@
  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  POSSIBILITY OF SUCH DAMAGE.
 '''
+from __future__ import print_function
 import os
 from unbound import ub_ctx,RR_TYPE_A,RR_CLASS_IN
 
@@ -48,7 +49,7 @@ if os.path.isfile("keys"):
 status, result = ctx.resolve("www.nic.cz", RR_TYPE_A, RR_CLASS_IN)
 if status == 0 and result.havedata:
 
-    print("Result:", result.data.address_list)
+    print("Result:", sorted(result.data.address_list))
 
     if result.secure:
         print("Result is secure")
diff --git a/libunbound/python/examples/dnssec_test.py b/libunbound/python/examples/dnssec_test.py
index 0d62b9ff2154..430e51a8068a 100644
--- a/libunbound/python/examples/dnssec_test.py
+++ b/libunbound/python/examples/dnssec_test.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python
+from __future__ import print_function
 from unbound import ub_ctx, RR_TYPE_A, RR_TYPE_RRSIG, RR_TYPE_NSEC, RR_TYPE_NSEC3
 import ldns
 
@@ -12,16 +13,16 @@ def dnssecParse(domain, rrType=RR_TYPE_A):
         raise RuntimeError("Error parsing DNS packet")
 
     rrsigs = pkt.rr_list_by_type(RR_TYPE_RRSIG, ldns.LDNS_SECTION_ANSWER)
-    print("RRSIGs from answer:", rrsigs)
+    print("RRSIGs from answer:", sorted(rrsigs))
     
     rrsigs = pkt.rr_list_by_type(RR_TYPE_RRSIG, ldns.LDNS_SECTION_AUTHORITY)
-    print("RRSIGs from authority:", rrsigs)
+    print("RRSIGs from authority:", sorted(rrsigs))
     
     nsecs = pkt.rr_list_by_type(RR_TYPE_NSEC, ldns.LDNS_SECTION_AUTHORITY)
-    print("NSECs:", nsecs)
+    print("NSECs:", sorted(nsecs))
     
     nsec3s = pkt.rr_list_by_type(RR_TYPE_NSEC3, ldns.LDNS_SECTION_AUTHORITY)
-    print("NSEC3s:", nsec3s)
+    print("NSEC3s:", sorted(nsec3s))
     
     print("---")
 
diff --git a/libunbound/python/examples/example8-1.py b/libunbound/python/examples/example8-1.py
index ca868e510685..723c4060e6d1 100644
--- a/libunbound/python/examples/example8-1.py
+++ b/libunbound/python/examples/example8-1.py
@@ -33,6 +33,7 @@
  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  POSSIBILITY OF SUCH DAMAGE.
 '''
+from __future__ import print_function
 import unbound
 
 ctx = unbound.ub_ctx()
@@ -42,20 +43,20 @@ status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_MX, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
     print("Result:")
     print("      raw data:", result.data)
-    for k in result.data.mx_list:
+    for k in sorted(result.data.mx_list):
         print("      priority:%d address:%s" % k)
 
 status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_A, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
     print("Result:")
     print("      raw data:", result.data)
-    for k in result.data.address_list:
+    for k in sorted(result.data.address_list):
         print("      address:%s" % k)
 
 status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_NS, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
     print("Result:")
     print("      raw data:", result.data)
-    for k in result.data.domain_list:
+    for k in sorted(result.data.domain_list):
         print("      host: %s" % k)
 
diff --git a/libunbound/python/examples/idn-lookup.py b/libunbound/python/examples/idn-lookup.py
index 2170637d32b0..f28315067d20 100644
--- a/libunbound/python/examples/idn-lookup.py
+++ b/libunbound/python/examples/idn-lookup.py
@@ -33,6 +33,7 @@
  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  POSSIBILITY OF SUCH DAMAGE.
 '''
+from __future__ import print_function
 import unbound
 import locale
 
@@ -45,18 +46,18 @@ status, result = ctx.resolve(u"www.háčkyčárky.cz", unbound.RR_TYPE_A, unboun
 if status == 0 and result.havedata:
     print("Result:")
     print("      raw data:", result.data)
-    for k in result.data.address_list:
+    for k in sorted(result.data.address_list):
         print("      address:%s" % k)
 
 status, result = ctx.resolve(u"háčkyčárky.cz", unbound.RR_TYPE_MX, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
     print("Result:")
     print("      raw data:", result.data)
-    for k in result.data.mx_list_idn:
+    for k in sorted(result.data.mx_list_idn):
         print("      priority:%d address:%s" % k)
 
 status, result = ctx.resolve(unbound.reverse('217.31.204.66')+'.in-addr.arpa', unbound.RR_TYPE_PTR, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
     print("Result.data:", result.data)
-    for k in result.data.domain_list_idn:
+    for k in sorted(result.data.domain_list_idn):
         print("      dname:%s" % k)
diff --git a/libunbound/python/examples/mx-lookup.py b/libunbound/python/examples/mx-lookup.py
index f83f690f85ac..e9394b3554b5 100644
--- a/libunbound/python/examples/mx-lookup.py
+++ b/libunbound/python/examples/mx-lookup.py
@@ -33,6 +33,7 @@
  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  POSSIBILITY OF SUCH DAMAGE.
 '''
+from __future__ import print_function
 import unbound
 
 ctx = unbound.ub_ctx()
@@ -42,12 +43,12 @@ status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_MX, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
     print("Result:")
     print("      raw data:", result.data)
-    for k in result.data.mx_list:
+    for k in sorted(result.data.mx_list):
         print("      priority:%d address:%s" % k)
 
 status, result = ctx.resolve("nic.cz", unbound.RR_TYPE_A, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
     print("Result:")
     print("      raw data:", result.data)
-    for k in result.data.address_list:
+    for k in sorted(result.data.address_list):
         print("      address:%s" % k)
diff --git a/libunbound/python/examples/ns-lookup.py b/libunbound/python/examples/ns-lookup.py
index bcd51de6dfd6..49f567283a25 100644
--- a/libunbound/python/examples/ns-lookup.py
+++ b/libunbound/python/examples/ns-lookup.py
@@ -33,6 +33,7 @@
  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  POSSIBILITY OF SUCH DAMAGE.
 '''
+from __future__ import print_function
 import unbound
 
 ctx = unbound.ub_ctx()
@@ -42,6 +43,6 @@ status, result = ctx.resolve("vutbr.cz", unbound.RR_TYPE_NS, unbound.RR_CLASS_IN
 if status == 0 and result.havedata:
     print("Result:")
     print("      raw data:", result.data)
-    for k in result.data.domain_list:
+    for k in sorted(result.data.domain_list):
         print("      host: %s" % k)
 
diff --git a/libunbound/python/examples/reverse-lookup.py b/libunbound/python/examples/reverse-lookup.py
index 7e06844ec6a9..c9a13fea6299 100644
--- a/libunbound/python/examples/reverse-lookup.py
+++ b/libunbound/python/examples/reverse-lookup.py
@@ -32,6 +32,7 @@
  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  POSSIBILITY OF SUCH DAMAGE.
 '''
+from __future__ import print_function
 import unbound
 
 ctx = unbound.ub_ctx()
@@ -39,5 +40,5 @@ ctx.resolvconf("/etc/resolv.conf")
 
 status, result = ctx.resolve(unbound.reverse("74.125.43.147") + ".in-addr.arpa.", unbound.RR_TYPE_PTR, unbound.RR_CLASS_IN)
 if status == 0 and result.havedata:
-    print("Result.data:", result.data, result.data.domain_list)
+    print("Result.data:", result.data, sorted(result.data.domain_list))
 
diff --git a/libunbound/python/file_py3.i b/libunbound/python/file_py3.i
new file mode 100644
index 000000000000..5d8b5a2716a5
--- /dev/null
+++ b/libunbound/python/file_py3.i
@@ -0,0 +1,155 @@
+/*
+ * file_py3.i: Typemaps for FILE* for Python 3
+ *
+ * Copyright (c) 2011, Karel Slany (karel.slany AT nic.cz)
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+%{
+#include <unistd.h>
+#include <fcntl.h>
+%}
+
+%types(FILE *);
+
+//#define SWIG_FILE3_DEBUG
+
+/* converts basic file descriptor flags onto a string */
+%fragment("fdfl_to_str", "header") {
+const char *
+fdfl_to_str(int fdfl) {
+
+  static const char * const file_mode[] = {"w+", "w", "r"};
+
+  if (fdfl & O_RDWR) {
+    return file_mode[0];
+  } else if (fdfl & O_WRONLY) {
+    return file_mode[1];
+  } else {
+    return file_mode[2];
+  }
+}
+}
+
+%fragment("is_obj_file", "header") {
+int
+is_obj_file(PyObject *obj) {
+  int fd, fdfl;
+  if (!PyLong_Check(obj) &&                                /* is not an integer */
+      PyObject_HasAttrString(obj, "fileno") &&             /* has fileno method */
+      (PyObject_CallMethod(obj, "flush", NULL) != NULL) && /* flush() succeeded */
+      ((fd = PyObject_AsFileDescriptor(obj)) != -1) &&     /* got file descriptor */
+      ((fdfl = fcntl(fd, F_GETFL)) != -1)                  /* got descriptor flags */
+    ) {
+    return 1;
+  }
+  else {
+    return 0;
+  }
+}
+}
+
+%fragment("obj_to_file","header", fragment="fdfl_to_str,is_obj_file") {
+FILE *
+obj_to_file(PyObject *obj) {
+  int fd, fdfl;
+  FILE *fp;
+  if (is_obj_file(obj)) {
+    fd = PyObject_AsFileDescriptor(obj);
+    fdfl = fcntl(fd, F_GETFL);
+    fp = fdopen(dup(fd), fdfl_to_str(fdfl)); /* the FILE* must be flushed
+                                                and closed after being used */
+#ifdef SWIG_FILE3_DEBUG
+    fprintf(stderr, "opening fd %d (fl %d \"%s\") as FILE %p\n",
+            fd, fdfl, fdfl_to_str(fdfl), (void *)fp);
+#endif
+    return fp;
+  }
+  return NULL;
+}
+}
+
+/* returns -1 if error occurred */
+/* caused magic SWIG Syntax errors when was commented out */
+#if 0
+%fragment("dispose_file", "header") {
+int
+dispose_file(FILE **fp) {
+#ifdef SWIG_FILE3_DEBUG
+  fprintf(stderr, "flushing FILE %p\n", (void *)fp);
+#endif
+  if (*fp == NULL) {
+    return 0;
+  }
+  if ((fflush(*fp) == 0) &&  /* flush file */
+      (fclose(*fp) == 0)) {  /* close file */
+    *fp = NULL;
+    return 0;
+  }
+  return -1;
+}
+}
+#endif
+
+%typemap(arginit, noblock = 1) FILE* {
+  $1 = NULL;
+}
+
+/*
+ * added due to ub_ctx_debugout since since it is overloaded:
+ * takes void* and FILE*. In reality only FILE* but the wrapper
+ * and the function is declared in such way.
+ */
+%typemap(typecheck, noblock = 1, fragment = "is_obj_file", precedence = SWIG_TYPECHECK_POINTER) FILE* {
+  $1 = is_obj_file($input);
+}
+
+%typemap(check, noblock = 1) FILE* {
+  if ($1 == NULL) {
+    /* The generated wrapper function raises TypeError on mismatching types. */
+    SWIG_exception_fail(SWIG_TypeError, "in method '" "$symname" "', argument "
+                        "$argnum"" of type '" "$type""'");
+  }
+}
+
+%typemap(in, noblock = 1, fragment = "obj_to_file") FILE* {
+  $1 = obj_to_file($input);
+}
+
+/*
+ * Commented out due the way how ub_ctx_debugout() uses the parameter.
+ * This typemap would cause the FILE* to be closed after return from
+ * the function. This caused Python interpreter to crash, since the
+ * function just stores the FILE* internally in ctx and use it for
+ * logging. So we'll leave the closing of the file on the OS.
+ */
+/*%typemap(freearg, noblock = 1, fragment = "dispose_file") FILE* {
+  if (dispose_file(&$1) == -1) {
+    SWIG_exception_fail(SWIG_IOError, "closing file in method '" "$symname" "', argument "
+                        "$argnum"" of type '" "$type""'");
+  }
+}*/
diff --git a/libunbound/python/libunbound.i b/libunbound/python/libunbound.i
index 1bef79f22094..3c0e45b7db42 100644
--- a/libunbound/python/libunbound.i
+++ b/libunbound/python/libunbound.i
@@ -60,7 +60,11 @@
 %}
 
 //%include "doc.i"
+#if PY_MAJOR_VERSION >= 3
+%include "file_py3.i" // python 3 FILE *
+#else
 %include "file.i"
+#endif
 
 %feature("docstring") strerror "Convert error value to a human readable string."
 
diff --git a/libunbound/worker.h b/libunbound/worker.h
index 824012a01848..a531501994af 100644
--- a/libunbound/worker.h
+++ b/libunbound/worker.h
@@ -42,7 +42,7 @@
 #ifndef LIBUNBOUND_WORKER_H
 #define LIBUNBOUND_WORKER_H
 
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "util/data/packed_rrset.h" /* for enum sec_status */
 struct comm_reply;
 struct comm_point;
diff --git a/pythonmod/interface.i b/pythonmod/interface.i
index b2dd089043ed..4b20c6ec135c 100644
--- a/pythonmod/interface.i
+++ b/pythonmod/interface.i
@@ -29,15 +29,15 @@
    #include "iterator/iter_delegpt.h"
    #include "iterator/iter_hints.h"
    #include "iterator/iter_utils.h"
-   #include "ldns/wire2str.h"
-   #include "ldns/str2wire.h"
-   #include "ldns/pkthdr.h"
+   #include "sldns/wire2str.h"
+   #include "sldns/str2wire.h"
+   #include "sldns/pkthdr.h"
 %}
 
 %include "stdint.i" // uint_16_t can be known type now
 
 %inline %{
-   //converts [len][data][len][data][0] string to a List of labels (PyStrings)
+   //converts [len][data][len][data][0] string to a List of labels (PyBytes)
    PyObject* GetNameAsLabelList(const char* name, int len) {
      PyObject* list;
      int cnt=0, i;
@@ -79,8 +79,8 @@ struct query_info {
 %inline %{
    enum enum_rr_class  { 
       RR_CLASS_IN = 1,
-      RR_CLASS_CH	= 3,
-      RR_CLASS_HS	= 4,
+      RR_CLASS_CH = 3,
+      RR_CLASS_HS = 4,
       RR_CLASS_NONE = 254,
       RR_CLASS_ANY = 255,
    };
@@ -164,7 +164,7 @@ struct query_info {
        char buf[LDNS_MAX_DOMAINLEN+1];
        buf[0] = '\0';
        dname_str((uint8_t*)dname, buf);
-       return PyString_FromString(buf);
+       return PyBytes_FromString(buf);
    }
 %}
 
@@ -440,7 +440,7 @@ struct comm_reply {
      reply_addr2str(reply, dest, 64);
      if (dest[0] == 0)
         return Py_None;
-     return PyString_FromString(dest);
+     return PyBytes_FromString(dest);
   }
 
   PyObject* _comm_reply_family_get(struct comm_reply* reply) {
@@ -448,9 +448,9 @@ struct comm_reply {
         int af = (int)((struct sockaddr_in*) &(reply->addr))->sin_family;
 
         switch(af) {
-           case AF_INET: return PyString_FromString("ip4");
-           case AF_INET6: return PyString_FromString("ip6"); 
-           case AF_UNIX: return PyString_FromString("unix");
+           case AF_INET: return PyBytes_FromString("ip4");
+           case AF_INET6: return PyBytes_FromString("ip6");
+           case AF_UNIX: return PyBytes_FromString("unix");
         }
 
         return Py_None;
@@ -711,13 +711,13 @@ struct delegpt {
 
 %inline %{
    PyObject* _get_dp_dname(struct delegpt* dp) {
-      return PyString_FromStringAndSize((char*)dp->name, dp->namelen);
+      return PyBytes_FromStringAndSize((char*)dp->name, dp->namelen);
    } 
    PyObject* _get_dp_dname_components(struct delegpt* dp) {
       return GetNameAsLabelList((char*)dp->name, dp->namelen);
    }
    PyObject* _get_dpns_dname(struct delegpt_ns* dpns) {
-      return PyString_FromStringAndSize((char*)dpns->name, dpns->namelen);
+      return PyBytes_FromStringAndSize((char*)dpns->name, dpns->namelen);
    }
    PyObject* _get_dpns_dname_components(struct delegpt_ns* dpns) {
       return GetNameAsLabelList((char*)dpns->name, dpns->namelen);
@@ -728,7 +728,7 @@ struct delegpt {
      delegpt_addr_addr2str(target, dest, 64);
      if (dest[0] == 0)
         return Py_None;
-     return PyString_FromString(dest);
+     return PyBytes_FromString(dest);
   }
 
 %}
@@ -842,7 +842,7 @@ int checkList(PyObject *l)
        for (i=0; i < PyList_Size(l); i++) 
        {
            item = PyList_GetItem(l, i);
-           if (!PyString_Check(item))
+           if (!PyBytes_Check(item))
               return 0;
        }
        return 1;
@@ -864,12 +864,12 @@ int pushRRList(sldns_buffer* qb, PyObject *l, uint32_t default_ttl, int qsec,
 
         len = sldns_buffer_remaining(qb);
         if(qsec) {
-                if(sldns_str2wire_rr_question_buf(PyString_AsString(item),
+                if(sldns_str2wire_rr_question_buf(PyBytes_AsString(item),
                         sldns_buffer_current(qb), &len, NULL, NULL, 0, NULL, 0)
                         != 0)
                         return 0;
         } else {
-                if(sldns_str2wire_rr_buf(PyString_AsString(item),
+                if(sldns_str2wire_rr_buf(PyBytes_AsString(item),
                         sldns_buffer_current(qb), &len, NULL, default_ttl,
                         NULL, 0, NULL, 0) != 0)
                         return 0;
diff --git a/pythonmod/pythonmod.c b/pythonmod/pythonmod.c
index 359eea0c6553..48dbc01698cb 100644
--- a/pythonmod/pythonmod.c
+++ b/pythonmod/pythonmod.c
@@ -45,7 +45,7 @@
 #endif
 
 #include "config.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 #undef _POSIX_C_SOURCE
 #undef _XOPEN_SOURCE
@@ -133,7 +133,13 @@ int pythonmod_init(struct module_env* env, int id)
    /* Initialize Python libraries */
    if (!Py_IsInitialized()) 
    {
-      Py_SetProgramName("unbound");
+#if PY_MAJOR_VERSION >= 3
+      wchar_t progname[8];
+      mbstowcs(progname, "unbound", 8);
+#else
+      char *progname = "unbound";
+#endif
+      Py_SetProgramName(progname);
       Py_NoSiteFlag = 1;
       Py_Initialize();
       PyEval_InitThreads();
diff --git a/pythonmod/pythonmod_utils.c b/pythonmod/pythonmod_utils.c
index 05914b88a8fb..5120074e839a 100644
--- a/pythonmod/pythonmod_utils.c
+++ b/pythonmod/pythonmod_utils.c
@@ -49,7 +49,7 @@
 #include "util/storage/slabhash.h"
 #include "util/regional.h"
 #include "iterator/iter_delegpt.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 #undef _POSIX_C_SOURCE
 #undef _XOPEN_SOURCE
diff --git a/services/cache/dns.c b/services/cache/dns.c
index 4692744a15dd..ba81afde4fda 100644
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -50,7 +50,7 @@
 #include "util/net_help.h"
 #include "util/regional.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** store rrsets in the rrset cache. 
  * @param env: module environment with caches.
@@ -366,6 +366,8 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		sizeof(struct reply_info)-sizeof(struct rrset_ref));
 	if(!msg->rep)
 		return NULL;
+	if(capacity > RR_COUNT_MAX)
+		return NULL; /* integer overflow protection */
 	msg->rep->flags = BIT_QR; /* with QR, no AA */
 	msg->rep->qdcount = 1;
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
@@ -387,6 +389,18 @@ dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 	return 1;
 }
 
+/** add rrset to answer section */
+static int
+dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 
+	struct ub_packed_rrset_key* rrset, time_t now)
+{
+	if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 
+		packed_rrset_copy_region(rrset, region, now)))
+		return 0;
+	msg->rep->an_numrrsets++;
+	return 1;
+}
+
 struct delegpt* 
 dns_cache_find_delegation(struct module_env* env, uint8_t* qname, 
 	size_t qnamelen, uint16_t qtype, uint16_t qclass, 
@@ -453,6 +467,8 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
 	if(!msg->rep)
 		return NULL;
+	if(num > RR_COUNT_MAX)
+		return NULL; /* integer overflow protection */
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
 		regional_alloc(region,
 		num * sizeof(struct ub_packed_rrset_key*));
@@ -489,7 +505,7 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 		return NULL;
 	if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
 		LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
-		LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(r)) {
+		LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) {
 		/* cname chain is now invalid, reconstruct msg */
 		rrset_array_unlock(r->ref, r->rrset_count);
 		return NULL;
@@ -631,6 +647,58 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	return msg;
 }
 
+/** Fill TYPE_ANY response with some data from cache */
+static struct dns_msg*
+fill_any(struct module_env* env,
+	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
+	struct regional* region)
+{
+	time_t now = *env->now;
+	struct dns_msg* msg = NULL;
+	uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA,
+		LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS, 0};
+	int i, num=5; /* number of RR types to look up */
+	log_assert(lookup[num] == 0);
+
+	for(i=0; i<num; i++) {
+		/* look up this RR for inclusion in type ANY response */
+		struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
+			env->rrset_cache, qname, qnamelen, lookup[i],
+			qclass, 0, now, 0);
+		struct packed_rrset_data *d;
+		if(!rrset)
+			continue;
+
+		/* only if rrset from answer section */
+		d = (struct packed_rrset_data*)rrset->entry.data;
+		if(d->trust == rrset_trust_add_noAA ||
+			d->trust == rrset_trust_auth_noAA ||
+			d->trust == rrset_trust_add_AA ||
+			d->trust == rrset_trust_auth_AA) {
+			lock_rw_unlock(&rrset->entry.lock);
+			continue;
+		}
+
+		/* create msg if none */
+		if(!msg) {
+			msg = dns_msg_create(qname, qnamelen, qtype, qclass,
+				region, (size_t)(num-i));
+			if(!msg) {
+				lock_rw_unlock(&rrset->entry.lock);
+				return NULL;
+			}
+		}
+
+		/* add RRset to response */
+		if(!dns_msg_ansadd(msg, region, rrset, now)) {
+			lock_rw_unlock(&rrset->entry.lock);
+			return NULL;
+		}
+		lock_rw_unlock(&rrset->entry.lock);
+	}
+	return msg;
+}
+
 struct dns_msg* 
 dns_cache_lookup(struct module_env* env,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
@@ -743,6 +811,11 @@ dns_cache_lookup(struct module_env* env,
 		}
 	}
 
+	/* fill common RR types for ANY response to avoid requery */
+	if(qtype == LDNS_RR_TYPE_ANY) {
+		return fill_any(env, qname, qnamelen, qtype, qclass, region);
+	}
+
 	return NULL;
 }
 
diff --git a/services/cache/infra.c b/services/cache/infra.c
index 07f2103d756b..c0049d8b6a8b 100644
--- a/services/cache/infra.c
+++ b/services/cache/infra.c
@@ -39,7 +39,8 @@
  * This file contains the infrastructure cache.
  */
 #include "config.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
+#include "sldns/str2wire.h"
 #include "services/cache/infra.h"
 #include "util/storage/slabhash.h"
 #include "util/storage/lookup3.h"
@@ -57,6 +58,9 @@
  * can do this number of packets (until those all timeout too) */
 #define TIMEOUT_COUNT_MAX 3
 
+/** ratelimit value for delegation point */
+int infra_dp_ratelimit = 0;
+
 size_t 
 infra_sizefunc(void* k, void* ATTR_UNUSED(d))
 {
@@ -99,6 +103,114 @@ infra_deldatafunc(void* d, void* ATTR_UNUSED(arg))
 	free(data);
 }
 
+size_t 
+rate_sizefunc(void* k, void* ATTR_UNUSED(d))
+{
+	struct rate_key* key = (struct rate_key*)k;
+	return sizeof(*key) + sizeof(struct rate_data) + key->namelen
+		+ lock_get_mem(&key->entry.lock);
+}
+
+int 
+rate_compfunc(void* key1, void* key2)
+{
+	struct rate_key* k1 = (struct rate_key*)key1;
+	struct rate_key* k2 = (struct rate_key*)key2;
+	if(k1->namelen != k2->namelen) {
+		if(k1->namelen < k2->namelen)
+			return -1;
+		return 1;
+	}
+	return query_dname_compare(k1->name, k2->name);
+}
+
+void 
+rate_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
+{
+	struct rate_key* key = (struct rate_key*)k;
+	if(!key)
+		return;
+	lock_rw_destroy(&key->entry.lock);
+	free(key->name);
+	free(key);
+}
+
+void 
+rate_deldatafunc(void* d, void* ATTR_UNUSED(arg))
+{
+	struct rate_data* data = (struct rate_data*)d;
+	free(data);
+}
+
+/** find or create element in domainlimit tree */
+static struct domain_limit_data* domain_limit_findcreate(
+	struct infra_cache* infra, char* name)
+{
+	uint8_t* nm;
+	int labs;
+	size_t nmlen;
+	struct domain_limit_data* d;
+
+	/* parse name */
+	nm = sldns_str2wire_dname(name, &nmlen);
+	if(!nm) {
+		log_err("could not parse %s", name);
+		return NULL;
+	}
+	labs = dname_count_labels(nm);
+
+	/* can we find it? */
+	d = (struct domain_limit_data*)name_tree_find(&infra->domain_limits,
+		nm, nmlen, labs, LDNS_RR_CLASS_IN);
+	if(d) {
+		free(nm);
+		return d;
+	}
+	
+	/* create it */
+	d = (struct domain_limit_data*)calloc(1, sizeof(*d));
+	if(!d) {
+		free(nm);
+		return NULL;
+	}
+	d->node.node.key = &d->node;
+	d->node.name = nm;
+	d->node.len = nmlen;
+	d->node.labs = labs;
+	d->node.dclass = LDNS_RR_CLASS_IN;
+	d->lim = -1;
+	d->below = -1;
+	if(!name_tree_insert(&infra->domain_limits, &d->node, nm, nmlen,
+		labs, LDNS_RR_CLASS_IN)) {
+		log_err("duplicate element in domainlimit tree");
+		free(nm);
+		free(d);
+		return NULL;
+	}
+	return d;
+}
+
+/** insert rate limit configuration into lookup tree */
+static int infra_ratelimit_cfg_insert(struct infra_cache* infra,
+	struct config_file* cfg)
+{
+	struct config_str2list* p;
+	struct domain_limit_data* d;
+	for(p = cfg->ratelimit_for_domain; p; p = p->next) {
+		d = domain_limit_findcreate(infra, p->str);
+		if(!d)
+			return 0;
+		d->lim = atoi(p->str2);
+	}
+	for(p = cfg->ratelimit_below_domain; p; p = p->next) {
+		d = domain_limit_findcreate(infra, p->str);
+		if(!d)
+			return 0;
+		d->below = atoi(p->str2);
+	}
+	return 1;
+}
+
 struct infra_cache* 
 infra_create(struct config_file* cfg)
 {
@@ -114,15 +226,44 @@ infra_create(struct config_file* cfg)
 		return NULL;
 	}
 	infra->host_ttl = cfg->host_ttl;
+	name_tree_init(&infra->domain_limits);
+	infra_dp_ratelimit = cfg->ratelimit;
+	if(cfg->ratelimit != 0) {
+		infra->domain_rates = slabhash_create(cfg->ratelimit_slabs,
+			INFRA_HOST_STARTSIZE, cfg->ratelimit_size,
+			&rate_sizefunc, &rate_compfunc, &rate_delkeyfunc,
+			&rate_deldatafunc, NULL);
+		if(!infra->domain_rates) {
+			infra_delete(infra);
+			return NULL;
+		}
+		/* insert config data into ratelimits */
+		if(!infra_ratelimit_cfg_insert(infra, cfg)) {
+			infra_delete(infra);
+			return NULL;
+		}
+		name_tree_init_parents(&infra->domain_limits);
+	}
 	return infra;
 }
 
+/** delete domain_limit entries */
+static void domain_limit_free(rbnode_t* n, void* ATTR_UNUSED(arg))
+{
+	if(n) {
+		free(((struct domain_limit_data*)n)->node.name);
+		free(n);
+	}
+}
+
 void 
 infra_delete(struct infra_cache* infra)
 {
 	if(!infra)
 		return;
 	slabhash_delete(infra->hosts);
+	slabhash_delete(infra->domain_rates);
+	traverse_postorder(&infra->domain_limits, domain_limit_free, NULL);
 	free(infra);
 }
 
@@ -562,8 +703,178 @@ infra_get_lame_rtt(struct infra_cache* infra,
 	return 1;
 }
 
+int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name,
+	size_t namelen)
+{
+	int labs = dname_count_labels(name);
+	struct domain_limit_data* d = (struct domain_limit_data*)
+		name_tree_lookup(&infra->domain_limits, name, namelen, labs,
+		LDNS_RR_CLASS_IN);
+	if(!d) return infra_dp_ratelimit;
+
+	if(d->node.labs == labs && d->lim != -1)
+		return d->lim; /* exact match */
+
+	/* find 'below match' */
+	if(d->node.labs == labs)
+		d = (struct domain_limit_data*)d->node.parent;
+	while(d) {
+		if(d->below != -1)
+			return d->below;
+		d = (struct domain_limit_data*)d->node.parent;
+	}
+	return infra_dp_ratelimit;
+}
+
+/** find data item in array, for write access, caller unlocks */
+static struct lruhash_entry* infra_find_ratedata(struct infra_cache* infra,
+	uint8_t* name, size_t namelen, int wr)
+{
+	struct rate_key key;
+	hashvalue_t h = dname_query_hash(name, 0xab);
+	memset(&key, 0, sizeof(key));
+	key.name = name;
+	key.namelen = namelen;
+	key.entry.hash = h;
+	return slabhash_lookup(infra->domain_rates, h, &key, wr);
+}
+
+/** create rate data item for name, number 1 in now */
+static void infra_create_ratedata(struct infra_cache* infra,
+	uint8_t* name, size_t namelen, time_t timenow)
+{
+	hashvalue_t h = dname_query_hash(name, 0xab);
+	struct rate_key* k = (struct rate_key*)calloc(1, sizeof(*k));
+	struct rate_data* d = (struct rate_data*)calloc(1, sizeof(*d));
+	if(!k || !d) {
+		free(k);
+		free(d);
+		return; /* alloc failure */
+	}
+	k->namelen = namelen;
+	k->name = memdup(name, namelen);
+	if(!k->name) {
+		free(k);
+		free(d);
+		return; /* alloc failure */
+	}
+	lock_rw_init(&k->entry.lock);
+	k->entry.hash = h;
+	k->entry.key = k;
+	k->entry.data = d;
+	d->qps[0] = 1;
+	d->timestamp[0] = timenow;
+	slabhash_insert(infra->domain_rates, h, &k->entry, d, NULL);
+}
+
+/** find the second and return its rate counter, if none, remove oldest */
+static int* infra_rate_find_second(void* data, time_t t)
+{
+	struct rate_data* d = (struct rate_data*)data;
+	int i, oldest;
+	for(i=0; i<RATE_WINDOW; i++) {
+		if(d->timestamp[i] == t)
+			return &(d->qps[i]);
+	}
+	/* remove oldest timestamp, and insert it at t with 0 qps */
+	oldest = 0;
+	for(i=0; i<RATE_WINDOW; i++) {
+		if(d->timestamp[i] < d->timestamp[oldest])
+			oldest = i;
+	}
+	d->timestamp[oldest] = t;
+	d->qps[oldest] = 0;
+	return &(d->qps[oldest]);
+}
+
+int infra_rate_max(void* data, time_t now)
+{
+	struct rate_data* d = (struct rate_data*)data;
+	int i, max = 0;
+	for(i=0; i<RATE_WINDOW; i++) {
+		if(now-d->timestamp[i] <= RATE_WINDOW) {
+			if(d->qps[i] > max)
+				max = d->qps[i];
+		}
+	}
+	return max;
+}
+
+int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
+	size_t namelen, time_t timenow)
+{
+	int lim, max;
+	struct lruhash_entry* entry;
+
+	if(!infra_dp_ratelimit)
+		return 1; /* not enabled */
+
+	/* find ratelimit */
+	lim = infra_find_ratelimit(infra, name, namelen);
+	
+	/* find or insert ratedata */
+	entry = infra_find_ratedata(infra, name, namelen, 1);
+	if(entry) {
+		int premax = infra_rate_max(entry->data, timenow);
+		int* cur = infra_rate_find_second(entry->data, timenow);
+		(*cur)++;
+		max = infra_rate_max(entry->data, timenow);
+		lock_rw_unlock(&entry->lock);
+
+		if(premax < lim && max >= lim) {
+			char buf[257];
+			dname_str(name, buf);
+			verbose(VERB_OPS, "ratelimit exceeded %s %d", buf, lim);
+		}
+		return (max < lim);
+	}
+
+	/* create */
+	infra_create_ratedata(infra, name, namelen, timenow);
+	return (1 < lim);
+}
+
+void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
+	size_t namelen, time_t timenow)
+{
+	struct lruhash_entry* entry;
+	int* cur;
+	if(!infra_dp_ratelimit)
+		return; /* not enabled */
+	entry = infra_find_ratedata(infra, name, namelen, 1);
+	if(!entry) return; /* not cached */
+	cur = infra_rate_find_second(entry->data, timenow);
+	if((*cur) > 0)
+		(*cur)--;
+	lock_rw_unlock(&entry->lock);
+}
+
+int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
+	size_t namelen, time_t timenow)
+{
+	struct lruhash_entry* entry;
+	int lim, max;
+	if(!infra_dp_ratelimit)
+		return 0; /* not enabled */
+
+	/* find ratelimit */
+	lim = infra_find_ratelimit(infra, name, namelen);
+
+	/* find current rate */
+	entry = infra_find_ratedata(infra, name, namelen, 0);
+	if(!entry)
+		return 0; /* not cached */
+	max = infra_rate_max(entry->data, timenow);
+	lock_rw_unlock(&entry->lock);
+
+	return (max >= lim);
+}
+
 size_t 
 infra_get_mem(struct infra_cache* infra)
 {
-	return sizeof(*infra) + slabhash_get_mem(infra->hosts);
+	size_t s = sizeof(*infra) + slabhash_get_mem(infra->hosts);
+	if(infra->domain_rates) s += slabhash_get_mem(infra->domain_rates);
+	/* ignore domain_limits because walk through tree is big */
+	return s;
 }
diff --git a/services/cache/infra.h b/services/cache/infra.h
index fc54f7f0df00..fc7abb7c4dd1 100644
--- a/services/cache/infra.h
+++ b/services/cache/infra.h
@@ -42,6 +42,7 @@
 #ifndef SERVICES_CACHE_INFRA_H
 #define SERVICES_CACHE_INFRA_H
 #include "util/storage/lruhash.h"
+#include "util/storage/dnstree.h"
 #include "util/rtt.h"
 struct slabhash;
 struct config_file;
@@ -108,6 +109,55 @@ struct infra_cache {
 	struct slabhash* hosts;
 	/** TTL value for host information, in seconds */
 	int host_ttl;
+	/** hash table with query rates per name: rate_key, rate_data */
+	struct slabhash* domain_rates;
+	/** ratelimit settings for domains, struct domain_limit_data */
+	rbtree_t domain_limits;
+};
+
+/** ratelimit, unless overridden by domain_limits, 0 is off */
+extern int infra_dp_ratelimit;
+
+/**
+ * ratelimit settings for domains
+ */
+struct domain_limit_data {
+	/** key for rbtree, must be first in struct, name of domain */
+	struct name_tree_node node;
+	/** ratelimit for exact match with this name, -1 if not set */
+	int lim;
+	/** ratelimit for names below this name, -1 if not set */
+	int below;
+};
+
+/**
+ * key for ratelimit lookups, a domain name
+ */
+struct rate_key {
+	/** lruhash key entry */
+	struct lruhash_entry entry;
+	/** domain name in uncompressed wireformat */
+	uint8_t* name;
+	/** length of name */
+	size_t namelen;
+};
+
+/** number of seconds to track qps rate */
+#define RATE_WINDOW 2
+
+/**
+ * Data for ratelimits per domain name
+ * It is incremented when a non-cache-lookup happens for that domain name.
+ * The name is the delegation point we have for the name.
+ * If a new delegation point is found (a referral reply), the previous
+ * delegation point is decremented, and the new one is charged with the query.
+ */
+struct rate_data {
+	/** queries counted, for that second. 0 if not in use. */
+	int qps[RATE_WINDOW];
+	/** what the timestamp is of the qps array members, counter is
+	 * valid for that timestamp.  Usually now and now-1. */
+	time_t timestamp[RATE_WINDOW];
 };
 
 /** infra host cache default hash lookup size */
@@ -286,6 +336,51 @@ long long infra_get_host_rto(struct infra_cache* infra,
 	size_t namelen, struct rtt_info* rtt, int* delay, time_t timenow,
 	int* tA, int* tAAAA, int* tother);
 
+/**
+ * Increment the query rate counter for a delegation point.
+ * @param infra: infra cache.
+ * @param name: zone name
+ * @param namelen: zone name length
+ * @param timenow: what time it is now.
+ * @return 1 if it could be incremented. 0 if the increment overshot the
+ * ratelimit or if in the previous second the ratelimit was exceeded.
+ * Failures like alloc failures are not returned (probably as 1).
+ */
+int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
+	size_t namelen, time_t timenow);
+
+/**
+ * Decrement the query rate counter for a delegation point.
+ * Because the reply received for the delegation point was pleasant,
+ * we do not charge this delegation point with it (i.e. it was a referral).
+ * Should call it with same second as when inc() was called.
+ * @param infra: infra cache.
+ * @param name: zone name
+ * @param namelen: zone name length
+ * @param timenow: what time it is now.
+ */
+void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
+	size_t namelen, time_t timenow);
+
+/**
+ * See if the query rate counter for a delegation point is exceeded.
+ * So, no queries are going to be allowed.
+ * @param infra: infra cache.
+ * @param name: zone name
+ * @param namelen: zone name length
+ * @param timenow: what time it is now.
+ * @return true if exceeded.
+ */
+int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
+	size_t namelen, time_t timenow);
+
+/** find the maximum rate stored, not too old. 0 if no information. */
+int infra_rate_max(void* data, time_t now);
+
+/** find the ratelimit in qps for a domain */
+int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name,
+	size_t namelen);
+
 /**
  * Get memory used by the infra cache.
  * @param infra: infrastructure cache.
@@ -306,4 +401,16 @@ void infra_delkeyfunc(void* k, void* arg);
 /** delete data and destroy the lameness hashtable */
 void infra_deldatafunc(void* d, void* arg);
 
+/** calculate size for the hashtable */
+size_t rate_sizefunc(void* k, void* d);
+
+/** compare two names, returns -1, 0, or +1 */
+int rate_compfunc(void* key1, void* key2);
+
+/** delete key, and destroy the lock */
+void rate_delkeyfunc(void* k, void* arg);
+
+/** delete data */
+void rate_deldatafunc(void* d, void* arg);
+
 #endif /* SERVICES_CACHE_INFRA_H */
diff --git a/services/cache/rrset.c b/services/cache/rrset.c
index 5f52dbce1948..2c8552953871 100644
--- a/services/cache/rrset.c
+++ b/services/cache/rrset.c
@@ -40,7 +40,7 @@
  */
 #include "config.h"
 #include "services/cache/rrset.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
 #include "util/storage/slabhash.h"
 #include "util/config_file.h"
 #include "util/data/packed_rrset.h"
@@ -304,10 +304,11 @@ rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
 {
 	hashvalue_t* h;
 	size_t i;
-	if(!(h = (hashvalue_t*)regional_alloc(scratch, 
-		sizeof(hashvalue_t)*count)))
+	if(count > RR_COUNT_MAX || !(h = (hashvalue_t*)regional_alloc(scratch, 
+		sizeof(hashvalue_t)*count))) {
 		log_warn("rrset LRU: memory allocation failed");
-	else 	/* store hash values */
+		h = NULL;
+	} else 	/* store hash values */
 		for(i=0; i<count; i++)
 			h[i] = ref[i].key->entry.hash;
 	/* unlock */
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index 3e5bf4004448..276c0fb32ecd 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -49,7 +49,7 @@
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
@@ -96,10 +96,10 @@ verbose_print_addr(struct addrinfo *addr)
 int
 create_udp_sock(int family, int socktype, struct sockaddr* addr,
         socklen_t addrlen, int v6only, int* inuse, int* noproto,
-	int rcv, int snd, int listen, int* reuseport)
+	int rcv, int snd, int listen, int* reuseport, int transparent)
 {
 	int s;
-#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_USE_MIN_MTU)
+#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_USE_MIN_MTU)  || defined(IP_TRANSPARENT)
 	int on=1;
 #endif
 #ifdef IPV6_MTU
@@ -113,6 +113,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #endif
 #ifndef IPV6_V6ONLY
 	(void)v6only;
+#endif
+#ifndef IP_TRANSPARENT
+	(void)transparent;
 #endif
 	if((s = socket(family, socktype, 0)) == -1) {
 		*inuse = 0;
@@ -177,6 +180,14 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #else
 		(void)reuseport;
 #endif /* defined(SO_REUSEPORT) */
+#ifdef IP_TRANSPARENT
+		if (transparent &&
+		    setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on,
+		    (socklen_t)sizeof(on)) < 0) {
+			log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s",
+			strerror(errno));
+		}
+#endif /* IP_TRANSPARENT */
 	}
 	if(rcv) {
 #ifdef SO_RCVBUF
@@ -472,12 +483,15 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 
 int
 create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
-	int* reuseport)
+	int* reuseport, int transparent)
 {
 	int s;
-#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_V6ONLY)
+#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_V6ONLY) || defined(IP_TRANSPARENT)
 	int on = 1;
-#endif /* SO_REUSEADDR || IPV6_V6ONLY */
+#endif
+#ifndef IP_TRANSPARENT
+	(void)transparent;
+#endif
 	verbose_print_addr(addr);
 	*noproto = 0;
 	if((s = socket(addr->ai_family, addr->ai_socktype, 0)) == -1) {
@@ -552,6 +566,14 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 #else
 	(void)v6only;
 #endif /* IPV6_V6ONLY */
+#ifdef IP_TRANSPARENT
+	if (transparent &&
+	    setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on,
+	    (socklen_t)sizeof(on)) < 0) {
+		log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s",
+			strerror(errno));
+	}
+#endif /* IP_TRANSPARENT */
 	if(bind(s, addr->ai_addr, addr->ai_addrlen) != 0) {
 #ifndef USE_WINSOCK
 		/* detect freebsd jail with no ipv6 permission */
@@ -656,7 +678,7 @@ create_local_accept_sock(const char *path, int* noproto)
 static int
 make_sock(int stype, const char* ifname, const char* port, 
 	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
-	int* reuseport)
+	int* reuseport, int transparent)
 {
 	struct addrinfo *res = NULL;
 	int r, s, inuse, noproto;
@@ -684,14 +706,15 @@ make_sock(int stype, const char* ifname, const char* port,
 		s = create_udp_sock(res->ai_family, res->ai_socktype,
 			(struct sockaddr*)res->ai_addr, res->ai_addrlen,
 			v6only, &inuse, &noproto, (int)rcv, (int)snd, 1,
-			reuseport);
+			reuseport, transparent);
 		if(s == -1 && inuse) {
 			log_err("bind: address already in use");
 		} else if(s == -1 && noproto && hints->ai_family == AF_INET6){
 			*noip6 = 1;
 		}
 	} else	{
-		s = create_tcp_accept_sock(res, v6only, &noproto, reuseport);
+		s = create_tcp_accept_sock(res, v6only, &noproto, reuseport,
+			transparent);
 		if(s == -1 && noproto && hints->ai_family == AF_INET6){
 			*noip6 = 1;
 		}
@@ -704,7 +727,7 @@ make_sock(int stype, const char* ifname, const char* port,
 static int
 make_sock_port(int stype, const char* ifname, const char* port, 
 	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
-	int* reuseport)
+	int* reuseport, int transparent)
 {
 	char* s = strchr(ifname, '@');
 	if(s) {
@@ -726,10 +749,10 @@ make_sock_port(int stype, const char* ifname, const char* port,
 		(void)strlcpy(p, s+1, sizeof(p));
 		p[strlen(s+1)]=0;
 		return make_sock(stype, newif, p, hints, v6only, noip6,
-			rcv, snd, reuseport);
+			rcv, snd, reuseport, transparent);
 	}
 	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv, snd,
-		reuseport);
+		reuseport, transparent);
 }
 
 /**
@@ -823,19 +846,20 @@ set_recvpktinfo(int s, int family)
  * @param ssl_port: ssl service port number
  * @param reuseport: try to set SO_REUSEPORT if nonNULL and true.
  * 	set to false on exit if reuseport failed due to no kernel support.
+ * @param transparent: set IP_TRANSPARENT socket option.
  * @return: returns false on error.
  */
 static int
 ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, 
 	struct addrinfo *hints, const char* port, struct listen_port** list,
-	size_t rcv, size_t snd, int ssl_port, int* reuseport)
+	size_t rcv, size_t snd, int ssl_port, int* reuseport, int transparent)
 {
 	int s, noip6=0;
 	if(!do_udp && !do_tcp)
 		return 0;
 	if(do_auto) {
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv, snd, reuseport)) == -1) {
+			&noip6, rcv, snd, reuseport, transparent)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -862,7 +886,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	} else if(do_udp) {
 		/* regular udp socket */
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv, snd, reuseport)) == -1) {
+			&noip6, rcv, snd, reuseport, transparent)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -883,7 +907,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 			atoi(strchr(ifname, '@')+1) == ssl_port) ||
 			(!strchr(ifname, '@') && atoi(port) == ssl_port));
 		if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, 
-			&noip6, 0, 0, reuseport)) == -1) {
+			&noip6, 0, 0, reuseport, transparent)) == -1) {
 			if(noip6) {
 				/*log_warn("IPv6 protocol not available");*/
 				return 1;
@@ -1039,7 +1063,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 				do_auto, cfg->do_udp, do_tcp, 
 				&hints, portbuf, &list,
 				cfg->so_rcvbuf, cfg->so_sndbuf,
-				cfg->ssl_port, reuseport)) {
+				cfg->ssl_port, reuseport,
+				cfg->ip_transparent)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -1050,7 +1075,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 				do_auto, cfg->do_udp, do_tcp, 
 				&hints, portbuf, &list,
 				cfg->so_rcvbuf, cfg->so_sndbuf,
-				cfg->ssl_port, reuseport)) {
+				cfg->ssl_port, reuseport,
+				cfg->ip_transparent)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -1063,7 +1089,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list, 
 				cfg->so_rcvbuf, cfg->so_sndbuf,
-				cfg->ssl_port, reuseport)) {
+				cfg->ssl_port, reuseport,
+				cfg->ip_transparent)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -1074,7 +1101,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list, 
 				cfg->so_rcvbuf, cfg->so_sndbuf,
-				cfg->ssl_port, reuseport)) {
+				cfg->ssl_port, reuseport,
+				cfg->ip_transparent)) {
 				listening_ports_free(list);
 				return NULL;
 			}
diff --git a/services/listen_dnsport.h b/services/listen_dnsport.h
index e9883a8f4f97..676f0c638ca4 100644
--- a/services/listen_dnsport.h
+++ b/services/listen_dnsport.h
@@ -189,11 +189,12 @@ void listen_start_accept(struct listen_dnsport* listen);
  * 	set SO_REUSEADDR on it.
  * @param reuseport: if nonNULL and true, try to set SO_REUSEPORT on
  * 	listening UDP port.  Set to false on return if it failed to do so.
+ * @param transparent: set IP_TRANSPARENT socket option.
  * @return: the socket. -1 on error.
  */
 int create_udp_sock(int family, int socktype, struct sockaddr* addr, 
 	socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv,
-	int snd, int listen, int* reuseport);
+	int snd, int listen, int* reuseport, int transparent);
 
 /**
  * Create and bind TCP listening socket
@@ -202,10 +203,11 @@ int create_udp_sock(int family, int socktype, struct sockaddr* addr,
  * @param noproto: if error caused by lack of protocol support.
  * @param reuseport: if nonNULL and true, try to set SO_REUSEPORT on
  * 	listening UDP port.  Set to false on return if it failed to do so.
+ * @param transparent: set IP_TRANSPARENT socket option.
  * @return: the socket. -1 on error.
  */
 int create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
-	int* reuseport);
+	int* reuseport, int transparent);
 
 /**
  * Create and bind local listening socket
diff --git a/services/localzone.c b/services/localzone.c
index 57510bd27364..c50ad0f1586f 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -40,8 +40,8 @@
  */
 #include "config.h"
 #include "services/localzone.h"
-#include "ldns/str2wire.h"
-#include "ldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/sbuffer.h"
 #include "util/regional.h"
 #include "util/config_file.h"
 #include "util/data/dname.h"
@@ -1027,6 +1027,10 @@ void local_zones_print(struct local_zones* zones)
 			log_nametypeclass(0, "inform zone", 
 				z->name, 0, z->dclass);
 			break;
+		case local_zone_inform_deny:
+			log_nametypeclass(0, "inform_deny zone", 
+				z->name, 0, z->dclass);
+			break;
 		default:
 			log_nametypeclass(0, "badtyped zone", 
 				z->name, 0, z->dclass);
@@ -1124,7 +1128,7 @@ lz_zone_answer(struct local_zone* z, struct query_info* qinfo,
 	struct edns_data* edns, sldns_buffer* buf, struct regional* temp,
 	struct local_data* ld)
 {
-	if(z->type == local_zone_deny) {
+	if(z->type == local_zone_deny || z->type == local_zone_inform_deny) {
 		/** no reply at all, signal caller by clearing buffer. */
 		sldns_buffer_clear(buf);
 		sldns_buffer_flip(buf);
@@ -1211,7 +1215,8 @@ local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
 	lock_rw_rdlock(&z->lock);
 	lock_rw_unlock(&zones->lock);
 
-	if(z->type == local_zone_inform && repinfo)
+	if((z->type == local_zone_inform || z->type == local_zone_inform_deny)
+		&& repinfo)
 		lz_inform_print(z, qinfo, repinfo);
 
 	if(local_data_answer(z, qinfo, edns, buf, temp, labs, &ld)) {
@@ -1234,6 +1239,7 @@ const char* local_zone_type2str(enum localzone_type t)
 		case local_zone_static: return "static";
 		case local_zone_nodefault: return "nodefault";
 		case local_zone_inform: return "inform";
+		case local_zone_inform_deny: return "inform_deny";
 	}
 	return "badtyped"; 
 }
@@ -1254,6 +1260,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
 		*t = local_zone_redirect;
 	else if(strcmp(type, "inform") == 0)
 		*t = local_zone_inform;
+	else if(strcmp(type, "inform_deny") == 0)
+		*t = local_zone_inform_deny;
 	else return 0;
 	return 1;
 }
diff --git a/services/localzone.h b/services/localzone.h
index 29ba8663fd04..3d62a69d191d 100644
--- a/services/localzone.h
+++ b/services/localzone.h
@@ -73,7 +73,9 @@ enum localzone_type {
 	 * nodefault is used in config not during service. */
 	local_zone_nodefault,
 	/** log client address, but no block (transparent) */
-	local_zone_inform
+	local_zone_inform,
+	/** log client address, and block (drop) */
+	local_zone_inform_deny
 };
 
 /**
diff --git a/services/mesh.c b/services/mesh.c
index a69aced223e3..8076874ae752 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -55,7 +55,7 @@
 #include "util/fptr_wlist.h"
 #include "util/alloc.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** subtract timers and the values do not overflow or become negative */
 static void
diff --git a/services/outside_network.c b/services/outside_network.c
index 5bb52ff9fe44..f105bc0d48b0 100644
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -57,7 +57,7 @@
 #include "util/net_help.h"
 #include "util/random.h"
 #include "util/fptr_wlist.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "dnstap/dnstap.h"
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
@@ -893,13 +893,13 @@ udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int port,
 		sa->sin6_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET6, SOCK_DGRAM, 
 			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
-			0, 0, 0, NULL);
+			0, 0, 0, NULL, 0);
 	} else {
 		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
 		sa->sin_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET, SOCK_DGRAM, 
 			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
-			0, 0, 0, NULL);
+			0, 0, 0, NULL, 0);
 	}
 	return fd;
 }
@@ -1510,7 +1510,8 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 	log_assert(rem); /* should have been present */
 	sq->to_be_deleted = 1; 
 	verbose(VERB_ALGO, "svcd callbacks start");
-	if(sq->outnet->use_caps_for_id && error == NETEVENT_NOERROR && c) {
+	if(sq->outnet->use_caps_for_id && error == NETEVENT_NOERROR && c &&
+		!sq->nocaps) {
 		/* noerror and nxdomain must have a qname in reply */
 		if(sldns_buffer_read_u16_at(c->buffer, 4) == 0 &&
 			(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
@@ -1590,7 +1591,7 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 		infra_update_tcp_works(sq->outnet->infra, &sq->addr,
 			sq->addrlen, sq->zone, sq->zonelen);
 #ifdef USE_DNSTAP
-	if(sq->outnet->dtenv &&
+	if(error==NETEVENT_NOERROR && sq->outnet->dtenv &&
 	   (sq->outnet->dtenv->log_resolver_response_messages ||
 	    sq->outnet->dtenv->log_forwarder_response_messages))
 		dt_msg_send_outside_response(sq->outnet->dtenv, &sq->addr,
diff --git a/ldns/keyraw.c b/sldns/keyraw.c
similarity index 99%
rename from ldns/keyraw.c
rename to sldns/keyraw.c
index 1ff07742b880..59e8000f5abf 100644
--- a/ldns/keyraw.c
+++ b/sldns/keyraw.c
@@ -11,8 +11,8 @@
  */
 
 #include "config.h"
-#include "ldns/keyraw.h"
-#include "ldns/rrdef.h"
+#include "sldns/keyraw.h"
+#include "sldns/rrdef.h"
 
 #ifdef HAVE_SSL
 #include <openssl/ssl.h>
diff --git a/ldns/keyraw.h b/sldns/keyraw.h
similarity index 100%
rename from ldns/keyraw.h
rename to sldns/keyraw.h
diff --git a/ldns/parse.c b/sldns/parse.c
similarity index 99%
rename from ldns/parse.c
rename to sldns/parse.c
index a605e549fcab..35dee719628c 100644
--- a/ldns/parse.c
+++ b/sldns/parse.c
@@ -8,9 +8,9 @@
  * See the file LICENSE for the license
  */
 #include "config.h"
-#include "ldns/parse.h"
-#include "ldns/parseutil.h"
-#include "ldns/sbuffer.h"
+#include "sldns/parse.h"
+#include "sldns/parseutil.h"
+#include "sldns/sbuffer.h"
 
 #include <limits.h>
 #include <strings.h>
diff --git a/ldns/parse.h b/sldns/parse.h
similarity index 100%
rename from ldns/parse.h
rename to sldns/parse.h
diff --git a/ldns/parseutil.c b/sldns/parseutil.c
similarity index 99%
rename from ldns/parseutil.c
rename to sldns/parseutil.c
index 28b344ede749..2a2ebbb08c38 100644
--- a/ldns/parseutil.c
+++ b/sldns/parseutil.c
@@ -13,7 +13,7 @@
  */
 
 #include "config.h"
-#include "ldns/parseutil.h"
+#include "sldns/parseutil.h"
 #include <sys/time.h>
 #include <time.h>
 #include <ctype.h>
diff --git a/ldns/parseutil.h b/sldns/parseutil.h
similarity index 100%
rename from ldns/parseutil.h
rename to sldns/parseutil.h
diff --git a/ldns/pkthdr.h b/sldns/pkthdr.h
similarity index 100%
rename from ldns/pkthdr.h
rename to sldns/pkthdr.h
diff --git a/ldns/rrdef.c b/sldns/rrdef.c
similarity index 99%
rename from ldns/rrdef.c
rename to sldns/rrdef.c
index 9b4bf7cfe326..a8c6229b9d2e 100644
--- a/ldns/rrdef.c
+++ b/sldns/rrdef.c
@@ -13,8 +13,8 @@
  * Defines resource record types and constants.
  */
 #include "config.h"
-#include "ldns/rrdef.h"
-#include "ldns/parseutil.h"
+#include "sldns/rrdef.h"
+#include "sldns/parseutil.h"
 
 /* classes  */
 static sldns_lookup_table sldns_rr_classes_data[] = {
@@ -213,13 +213,11 @@ static const sldns_rdf_type type_eui48_wireformat[] = {
 static const sldns_rdf_type type_eui64_wireformat[] = {
 	LDNS_RDF_TYPE_EUI64
 };
-#ifdef DRAFT_RRTYPES
 static const sldns_rdf_type type_uri_wireformat[] = {
 	LDNS_RDF_TYPE_INT16,
 	LDNS_RDF_TYPE_INT16,
 	LDNS_RDF_TYPE_LONG_STR
 };
-#endif
 static const sldns_rdf_type type_caa_wireformat[] = {
 	LDNS_RDF_TYPE_INT8,
 	LDNS_RDF_TYPE_TAG,
@@ -590,12 +588,8 @@ static sldns_rr_descriptor rdata_field_descriptors[] = {
 	/* ANY: A request for all (available) records */
 {LDNS_RR_TYPE_ANY, "ANY", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 
-#ifdef DRAFT_RRTYPES
 	/* 256 */
 	{LDNS_RR_TYPE_URI, "URI", 3, 3, type_uri_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-#else
-{LDNS_RR_TYPE_NULL, "TYPE256", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-#endif
 	/* 257 */
 	{LDNS_RR_TYPE_CAA, "CAA", 3, 3, type_caa_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 
diff --git a/ldns/rrdef.h b/sldns/rrdef.h
similarity index 99%
rename from ldns/rrdef.h
rename to sldns/rrdef.h
index 933bcdfbf07e..678d2bc791e2 100644
--- a/ldns/rrdef.h
+++ b/sldns/rrdef.h
@@ -220,8 +220,7 @@ enum sldns_enum_rr_type
 	LDNS_RR_TYPE_MAILA = 254,
 	/**  any type (wildcard) */
 	LDNS_RR_TYPE_ANY = 255,
-	/** draft-faltstrom-uri-06 */
-	LDNS_RR_TYPE_URI = 256,
+	LDNS_RR_TYPE_URI = 256, /* RFC 7553 */
 	LDNS_RR_TYPE_CAA = 257, /* RFC 6844 */
 
 	/** DNSSEC Trust Authorities */
diff --git a/ldns/sbuffer.c b/sldns/sbuffer.c
similarity index 99%
rename from ldns/sbuffer.c
rename to sldns/sbuffer.c
index 3d087bfe252e..a7fe53aa0278 100644
--- a/ldns/sbuffer.c
+++ b/sldns/sbuffer.c
@@ -12,7 +12,7 @@
  * This file contains the definition of sldns_buffer, and functions to manipulate those.
  */
 #include "config.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include <stdarg.h>
 
 sldns_buffer *
diff --git a/ldns/sbuffer.h b/sldns/sbuffer.h
similarity index 100%
rename from ldns/sbuffer.h
rename to sldns/sbuffer.h
diff --git a/ldns/str2wire.c b/sldns/str2wire.c
similarity index 99%
rename from ldns/str2wire.c
rename to sldns/str2wire.c
index 931e28f84e3e..8cda8c750fb9 100644
--- a/ldns/str2wire.c
+++ b/sldns/str2wire.c
@@ -12,11 +12,11 @@
  * Parses text to wireformat.
  */
 #include "config.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parse.h"
-#include "ldns/parseutil.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parse.h"
+#include "sldns/parseutil.h"
 #include <ctype.h>
 #ifdef HAVE_TIME_H
 #include <time.h>
diff --git a/ldns/str2wire.h b/sldns/str2wire.h
similarity index 99%
rename from ldns/str2wire.h
rename to sldns/str2wire.h
index 94c8933897c0..527074a15b81 100644
--- a/ldns/str2wire.h
+++ b/sldns/str2wire.h
@@ -16,7 +16,7 @@
 #define LDNS_STR2WIRE_H
 
 /* include rrdef for MAX_DOMAINLEN constant */
-#include <ldns/rrdef.h>
+#include <sldns/rrdef.h>
 
 #ifdef __cplusplus
 extern "C" {
diff --git a/ldns/wire2str.c b/sldns/wire2str.c
similarity index 99%
rename from ldns/wire2str.c
rename to sldns/wire2str.c
index 81e173c78d58..cec3bc7b08da 100644
--- a/ldns/wire2str.c
+++ b/sldns/wire2str.c
@@ -15,13 +15,13 @@
  * representation, as well as functions to print them.
  */
 #include "config.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
-#include "ldns/rrdef.h"
-#include "ldns/pkthdr.h"
-#include "ldns/parseutil.h"
-#include "ldns/sbuffer.h"
-#include "ldns/keyraw.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
+#include "sldns/rrdef.h"
+#include "sldns/pkthdr.h"
+#include "sldns/parseutil.h"
+#include "sldns/sbuffer.h"
+#include "sldns/keyraw.h"
 #ifdef HAVE_TIME_H
 #include <time.h>
 #endif
diff --git a/ldns/wire2str.h b/sldns/wire2str.h
similarity index 100%
rename from ldns/wire2str.h
rename to sldns/wire2str.h
diff --git a/smallapp/unbound-anchor.c b/smallapp/unbound-anchor.c
index 9df0d95b417c..576a30f646a9 100644
--- a/smallapp/unbound-anchor.c
+++ b/smallapp/unbound-anchor.c
@@ -116,7 +116,7 @@
 
 #include "config.h"
 #include "libunbound/unbound.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
 #include <expat.h>
 #ifndef HAVE_EXPAT_H
 #error "need libexpat to parse root-anchors.xml file."
@@ -915,7 +915,10 @@ read_data_chunk(SSL* ssl, size_t len)
 {
 	size_t got = 0;
 	int r;
-	char* data = malloc(len+1);
+	char* data;
+	if(len >= 0xfffffff0)
+		return NULL; /* to protect against integer overflow in malloc*/
+	data = malloc(len+1);
 	if(!data) {
 		if(verb) printf("out of memory\n");
 		return NULL;
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index b5d7b9f44419..0524edeaab12 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -53,7 +53,7 @@
 #include "iterator/iter_hints.h"
 #include "validator/validator.h"
 #include "services/localzone.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
diff --git a/smallapp/unbound-control-setup.sh.in b/smallapp/unbound-control-setup.sh.in
index 75e76e25d967..682ab260a605 100644
--- a/smallapp/unbound-control-setup.sh.in
+++ b/smallapp/unbound-control-setup.sh.in
@@ -46,7 +46,7 @@ CLIENTNAME=unbound-control
 DAYS=7200
 
 # size of keys in bits
-BITS=1536
+BITS=3072
 
 # hash algorithm
 HASH=sha256
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 3b47d3bf885a..d4b147d67095 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -109,6 +109,7 @@ usage()
 	printf("  get_option opt		get option value\n");
 	printf("  list_stubs			list stub-zones and root hints in use\n");
 	printf("  list_forwards			list forward-zones in use\n");
+	printf("  list_insecure			list domain-insecure zones\n");
 	printf("  list_local_zones		list local-zones in use\n");
 	printf("  list_local_data		list local-data RRs in use\n");
 	printf("  insecure_add zone 		add domain-insecure zone\n");
@@ -122,6 +123,8 @@ usage()
 	printf("  forward [off | addr ...]	without arg show forward setup\n");
 	printf("				or off to turn off root forwarding\n");
 	printf("				or give list of ip addresses\n");
+	printf("  ratelimit_list [+a]		list ratelimited domains\n");
+	printf("		+a		list all, also not ratelimited\n");
 	printf("Version %s\n", PACKAGE_VERSION);
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
diff --git a/smallapp/unbound-host.c b/smallapp/unbound-host.c
index 95973410924f..30fef51fdc6f 100644
--- a/smallapp/unbound-host.c
+++ b/smallapp/unbound-host.c
@@ -60,8 +60,8 @@
 #define unbound_lite_wrapstr(s) s
 #endif
 #include "libunbound/unbound.h"
-#include "ldns/rrdef.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/wire2str.h"
 #ifdef HAVE_NSS
 /* nss3 */
 #include "nss.h"
diff --git a/testcode/asynclook.c b/testcode/asynclook.c
index 7e9ee77580a3..534489735bb2 100644
--- a/testcode/asynclook.c
+++ b/testcode/asynclook.c
@@ -48,7 +48,7 @@
 #include "libunbound/context.h"
 #include "util/locks.h"
 #include "util/log.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
 #ifdef UNBOUND_ALLOC_LITE
 #undef malloc
 #undef calloc
diff --git a/testcode/delayer.c b/testcode/delayer.c
index 7a90fc04ce78..050cbd23e759 100644
--- a/testcode/delayer.c
+++ b/testcode/delayer.c
@@ -50,7 +50,7 @@
 #include <sys/time.h>
 #include "util/net_help.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include <signal.h>
 
 /** number of reads per select for delayer */
diff --git a/testcode/fake_event.c b/testcode/fake_event.c
index de453aaa28a9..4335a8f220b7 100644
--- a/testcode/fake_event.c
+++ b/testcode/fake_event.c
@@ -60,9 +60,9 @@
 #include "testcode/testpkts.h"
 #include "util/log.h"
 #include "util/fptr_wlist.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
 #include <signal.h>
 struct worker;
 struct daemon_remote;
diff --git a/testcode/perf.c b/testcode/perf.c
index c51eee4b161d..320cbc933e9e 100644
--- a/testcode/perf.c
+++ b/testcode/perf.c
@@ -50,9 +50,9 @@
 #include "util/data/msgencode.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgparse.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
 #include <sys/time.h>
 
 /** usage information for perf */
diff --git a/testcode/pktview.c b/testcode/pktview.c
index e59283fa854c..12e0d8edbb68 100644
--- a/testcode/pktview.c
+++ b/testcode/pktview.c
@@ -45,8 +45,8 @@
 #include "util/data/msgparse.h"
 #include "testcode/unitmain.h"
 #include "testcode/readhex.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parseutil.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parseutil.h"
 
 /** usage information for pktview */
 static void usage(char* argv[])
diff --git a/testcode/readhex.c b/testcode/readhex.c
index d9aba09b7102..e871def0ec45 100644
--- a/testcode/readhex.c
+++ b/testcode/readhex.c
@@ -41,8 +41,8 @@
 #include <ctype.h>
 #include "testcode/readhex.h"
 #include "util/log.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parseutil.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parseutil.h"
 
 /** skip whitespace */
 static void
diff --git a/testcode/replay.c b/testcode/replay.c
index 5c1197146396..01b17a7f7d0c 100644
--- a/testcode/replay.c
+++ b/testcode/replay.c
@@ -50,7 +50,7 @@
 #include "testcode/replay.h"
 #include "testcode/testpkts.h"
 #include "testcode/fake_event.h"
-#include "ldns/str2wire.h"
+#include "sldns/str2wire.h"
 
 /** max length of lines in file */
 #define MAX_LINE_LEN 10240
diff --git a/testcode/streamtcp.c b/testcode/streamtcp.c
index d93ab966d564..c5919428a52e 100644
--- a/testcode/streamtcp.c
+++ b/testcode/streamtcp.c
@@ -51,9 +51,9 @@
 #include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
 #include "util/data/dname.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 #include <openssl/ssl.h>
 #include <openssl/rand.h>
 #include <openssl/err.h>
diff --git a/testcode/testbound.c b/testcode/testbound.c
index daf8ddd41547..fa361c4ead64 100644
--- a/testcode/testbound.c
+++ b/testcode/testbound.c
@@ -47,7 +47,7 @@
 #include "testcode/fake_event.h"
 #include "daemon/remote.h"
 #include "util/config_file.h"
-#include "ldns/keyraw.h"
+#include "sldns/keyraw.h"
 #include <ctype.h>
 
 /** signal that this is a testbound compile */
diff --git a/testcode/testpkts.c b/testcode/testpkts.c
index a494d9f01d7b..d1960a4108b5 100644
--- a/testcode/testpkts.c
+++ b/testcode/testpkts.c
@@ -27,11 +27,11 @@ struct sockaddr_storage;
 #include <ctype.h>
 #include "testcode/testpkts.h"
 #include "util/net_help.h"
-#include "ldns/sbuffer.h"
-#include "ldns/rrdef.h"
-#include "ldns/pkthdr.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/pkthdr.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 /** max size of a packet */
 #define MAX_PACKETLEN 65536
diff --git a/testcode/unitanchor.c b/testcode/unitanchor.c
index 8047eb2bf988..8819c5ab6643 100644
--- a/testcode/unitanchor.c
+++ b/testcode/unitanchor.c
@@ -43,8 +43,8 @@
 #include "util/data/dname.h"
 #include "testcode/unitmain.h"
 #include "validator/val_anchor.h"
-#include "ldns/sbuffer.h"
-#include "ldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/rrdef.h"
 
 /** test empty set */
 static void
diff --git a/testcode/unitdname.c b/testcode/unitdname.c
index 83d829fae15b..238c3edf7ade 100644
--- a/testcode/unitdname.c
+++ b/testcode/unitdname.c
@@ -42,8 +42,8 @@
 #include "util/log.h"
 #include "testcode/unitmain.h"
 #include "util/data/dname.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
 
 /** put dname into buffer */
 static sldns_buffer*
diff --git a/testcode/unitldns.c b/testcode/unitldns.c
index 65170a82526f..e27e46eaa926 100644
--- a/testcode/unitldns.c
+++ b/testcode/unitldns.c
@@ -41,9 +41,9 @@
 #include "config.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 /** verbose this unit test */
 static int vbmp = 0; 
diff --git a/testcode/unitmain.c b/testcode/unitmain.c
index 4673214adc04..09ebba329821 100644
--- a/testcode/unitmain.c
+++ b/testcode/unitmain.c
@@ -61,8 +61,8 @@
 #include "nss.h"
 #endif
 
-#include "ldns/rrdef.h"
-#include "ldns/keyraw.h"
+#include "sldns/rrdef.h"
+#include "sldns/keyraw.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 
diff --git a/testcode/unitmsgparse.c b/testcode/unitmsgparse.c
index b33a2408d4e7..627d10b78ec3 100644
--- a/testcode/unitmsgparse.c
+++ b/testcode/unitmsgparse.c
@@ -51,9 +51,9 @@
 #include "util/net_help.h"
 #include "testcode/readhex.h"
 #include "testcode/testpkts.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 /** verbose message parse unit test */
 static int vbmp = 0;
@@ -497,9 +497,11 @@ testfromdrillfile(sldns_buffer* pkt, struct alloc_cache* alloc,
 
 void msgparse_test(void)
 {
+	time_t origttl = MAX_NEG_TTL;
 	sldns_buffer* pkt = sldns_buffer_new(65553);
 	sldns_buffer* out = sldns_buffer_new(65553);
 	struct alloc_cache super_a, alloc;
+	MAX_NEG_TTL = 86400;
 	/* init */
 	alloc_init(&super_a, NULL, 0);
 	alloc_init(&alloc, &super_a, 2);
@@ -536,4 +538,5 @@ void msgparse_test(void)
 	alloc_clear(&super_a);
 	sldns_buffer_free(pkt);
 	sldns_buffer_free(out);
+	MAX_NEG_TTL = origttl;
 }
diff --git a/testcode/unitneg.c b/testcode/unitneg.c
index d3968409519e..36fa6b906e3f 100644
--- a/testcode/unitneg.c
+++ b/testcode/unitneg.c
@@ -45,7 +45,7 @@
 #include "util/data/dname.h"
 #include "testcode/unitmain.h"
 #include "validator/val_neg.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
 
 /** verbose unit test for negative cache */
 static int negverbose = 0;
diff --git a/testcode/unitverify.c b/testcode/unitverify.c
index 2074f3c4ee22..078af0a9c7c5 100644
--- a/testcode/unitverify.c
+++ b/testcode/unitverify.c
@@ -56,10 +56,10 @@
 #include "util/net_help.h"
 #include "util/module.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
-#include "ldns/keyraw.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/keyraw.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 /** verbose signature test */
 static int vsig = 0;
diff --git a/testdata/fwd_any.rpl b/testdata/fwd_any.rpl
new file mode 100644
index 000000000000..4284ee79e73a
--- /dev/null
+++ b/testdata/fwd_any.rpl
@@ -0,0 +1,161 @@
+; This is a comment.
+; config options go here.
+forward-zone: name: "." forward-addr: 216.0.0.1
+CONFIG_END
+
+SCENARIO_BEGIN Test query and cache with type ANY
+RANGE_BEGIN 0 1000
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+SECTION AUTHORITY
+www.example.com. IN NS ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A 10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN ANY
+SECTION ANSWER
+;; different type in this answer.
+www.example.com. IN TXT "text"
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN AAAA
+SECTION ANSWER
+www.example.com. IN AAAA ::5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.foo.com. IN ANY
+SECTION ANSWER
+www.foo.com. IN A 1.2.3.77
+www.foo.com. IN AAAA ::77
+ENTRY_END
+
+RANGE_END
+
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; unneccesary nothing steps.
+STEP 20 NOTHING
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+ENTRY_END
+
+; test cache synthesis
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN ANY
+ENTRY_END
+STEP 50 NOTHING
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www.example.com. IN ANY
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+ENTRY_END
+
+; and again
+; the synthesized result itself is not added to the cache
+STEP 62 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN ANY
+ENTRY_END
+STEP 63 NOTHING
+STEP 64 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www.example.com. IN ANY
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+ENTRY_END
+
+; AAAA lookup to add more data in cache
+STEP 70 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN AAAA
+ENTRY_END
+STEP 80 NOTHING
+STEP 90 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www.example.com. IN AAAA
+SECTION ANSWER
+www.example.com. IN AAAA ::5
+ENTRY_END
+
+; test cache synthesis of AAAA, and two rrsets.
+STEP 100 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN ANY
+ENTRY_END
+STEP 110 NOTHING
+STEP 120 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www.example.com. IN ANY
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+www.example.com. IN AAAA ::5
+ENTRY_END
+
+; test query that is not synthesized from cache.
+STEP 130 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.foo.com. IN ANY
+ENTRY_END
+STEP 140 NOTHING
+STEP 150 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www.foo.com. IN ANY
+SECTION ANSWER
+www.foo.com. IN A 1.2.3.77
+www.foo.com. IN AAAA ::77
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/fwd_capsid_white.tpkg b/testdata/fwd_capsid_white.tpkg
new file mode 100644
index 0000000000000000000000000000000000000000..199befb56871f57a2e839ac4872c14f554c07e14
GIT binary patch
literal 1567
zcmV+)2H^Q0iwFR)aYI!A1MOLDbJ{o%&R6s+wuDLAxv^u5w;6KHgaB!16QG1#rgL}0
zIJN*cV7aoXL+5_{tpw&Jfk4wv+TO7VAnmSqrInwxwC+Ss+qV3`b=pzS4Vmt^;$Y|d
zl7W=ZXXUS%&l>Z;G3}T%OO0IK$YoK_%;b#B4rIUcIF`~d2rU7y6Y*il#A>~D@?VrX
z%hvw^)8=01=|1EF=W>~q>z}3OZ2c+SF{qKx<aWULe$!k{|MT?^nE1>@fh6$zh6ipq
zDnN!LcEKACw6G_b<pc#VNy7DT`W?$=*rR#fz(3^rT!aNUZq%EtW0DvKObbRqpLYx3
zagxA$iP<3+Xfv5aW!LGreKe39dN+LNIXZHXZ}$Y};aCSv2+ta@anIqJ$3yMYkcpAj
z=eE`F@gN)<m(Ju(s&%-~T&Dmd7N9N3Q8#Vhm6}O*XAS(myoCozf~t`v9PJDD7|wa(
zNJmex#Bv;gtmzbwk6U#$yA5<GDv=+(pkGOw;orxoKi$V#{A03@@lP|zr>0?~xA=b!
z+J#+BgQW`&nzl=JA>cz{GYESO23CMEfX^5(31o<R%mX*v52REu@+W8=(Deg7^l!U5
zs_By}{)WB1*w7OBqL+}N?=?QA29)xG`2`V?GjKSJP>6;Ry*%<j8PerQFe?nWrw2W9
z>-PI?%tw$qy)L&K)$&6Qonu|qPU=^+vEq+j!*8L@@GnF8bRTQ*ZyK5G;{FfuZyH<t
zKL@SAzk=0s;vb*p_fd_HTX4N;I&iHUbm?0`;CkJ!O#`ISth`Q2*Z8nk86nOzgxNg~
z$s=&wE<{nJ&uth`S8|W1I}gzOIq2gfUtVF|*beJ-d+x{E{=nn@ClQ3h&(YoJ%RO`O
z4|-&PH<FCr)Uj=afLkWX3z9_ka5;43K-{6TUc7Tc#>_yE*|%VMLBvFoxE<&U=Hvdv
z(5a!Pjb!ZcP)^z-iSc#ycS*wf0gL-J9)jd0*qs~Vj<4eqqMF7po#3|gC~cnqy?{Q^
z$J+g0mQM43I-QsKKa-~0{Qn$u2=Wj#J_U|bt;$WQdb9ebT7&syNK&oVIiz!jK}e<6
zYJO;+R8WUp6kDY;;J(cr2A{%_kKfWLX;vENAK-lxibbf^E6rxTNs8sSSC=iYxj$;V
z4!Nw9TGe_D-d|NNWrG~Tb*0)YL#f!fd;y2x3x0!%e}qTAP~~iO7JNajqwCdq7lnG|
zu6WTnujnOyp+lltOBAQhinYt@N|Qv_QSqcyuAII(tG<1Aeo=eOgtCx`Q>vcH%&c9t
z&M;c74>L}=T$PRD`6N!2TKQ)^7=8`@pXy`%`ER!WOH+maG;RsE_<si4;{R#*H-3I-
zZ$z8n-wEt*@Ua&E=B)mkHdOsLi|SkaKLedu0jsGp=>0_}e=rfa+$(^o8>GwvTeyCx
z7^mYxC>}Y+AC)(ZJ8HnR@~V@PV3t%bTOnFM6)u1Y7uE>OOo3(#Mg~fVd7y@wB^Q?K
zh4^8j0FKb%S}*BE{Bb{eT?;)0q=Z(ws*+4feBg7Bd0~N+22Ppz%#$^0GHac&zF!~>
zv1C@dkLT2eDk3i}dXW}eDpN<r;_&WNp3=}o1J9w%DUegk?GMq>ubKlktp5u34L;W3
zpVAz?SN}C~Mt+O`=b%;fU%~!M)t`H{-YyH<0uvV>wB-vdNR#=R&g)cj(juzxt5`2z
zPPy<Kn6F+*8J!7Z&53YaQdzV*-%G;L(fv`5ubH`wTaW6}nKE6eE!Pq6aurmWxN%KP
z6@<Ry1?}<Xo}|vpwaa!3b8_uc)w!lqT5%kJqqt5*kM>O1Ba<@u>(q<+xk$#OvEkV0
z(y`D-2Se3p=#t^k2jijB0nrsB8d$ds<V$b2JKhgtt_O|5esG}Pb^djHu)naL`v?26
zeEcp@X~YqHAf>UGPUXKpoS7T|9KrBLwWfiZlmHbv5SBNVecKh1vryzrVdo%L)$rer
z4Z+b|5it(d-204KycU>qouyHe)yaFj$Z{9%vG&l9Yn!WNbS9jPQVQm)o<BNcZfQ$f
R+R}f6{sk|^K(+uV004m5E~5Yd

literal 0
HcmV?d00001

diff --git a/testdata/fwd_compress_c00c.tpkg b/testdata/fwd_compress_c00c.tpkg
index c48fbbc00457c9243c7a2b03326bba781256f75c..a75a56a7d6e63f6df05a1493f91802116f40ac57 100644
GIT binary patch
literal 1858
zcmV-I2fg?oiwFQmA&pf41MOLRbJ|7_&%fNK*vg)`omR5mxU^yH7}BIoz`?kgOdpJp
z4p0m_MJIxt$%pUWNdn1%+I3U<V&lNw-tBMq_O!QqVzdYbKAXh}<$U1lx~~Oca`@nr
zlCJA@#{v8{>aLZ2*LCr|Brr_JwoKh{Tmy8&)gAi*IG@&x^)%<Hm!K&NHcx4?dERZ~
z`8t;0{}LLl-TyUQ?%!Jn`op#D&HL|Ibuje0Zo758ZsGo$rtX>#K>vj6+(`fP{eSFn
z+VN(z0Uzx-`H?0(WKjbQO(!kN{UnT2$#}w&g_i{2MFIE|>R&=3iNnA~IKUS)ft119
zIZdu1LKPZ0O{gaTT3(6@U*OcPpMv4wU&E<4bPG<~=Y25oydW>UFiP=1O&Sm+8obg@
zwG;db-$Y{%b#roxC}WmfH-Ma?b{5enZIIJh(4sMo0*?Gu>nWYa4RV&OTd0Oja>jVN
zb`1HXPuCBo$R{WBt0&=<3N2?I=QL=LCtf(6qb~AyZ||*i*Z3bZ7Tj0IZSh|>ts?$S
z*K$Pso3^!!|7}pd1r5MG@_`O*1CER%9lN@*{IEc-N%!0lfHuWAToEG@z(9z)>pFm2
z=z#mROTo2e7o}Y)TDG3U!aJJKFbZg*MKnc>48oLF;JA3;ss^B-b!3Z{4GuQZiVB?_
zWe^rZ1S3CKLYO5SCtH`Hivq(aL%b9pUIt+cD@-)MZt1uXv1E6+T!<yQ0oo%KfEID>
z4ZFmJV6-e3;$#b1qZ`df-6l#~w18MyFw~j_gnJ8wl|f`wg7CHGA3JmI8vj0vMt|ZN
z``!4rTo>y<%fYCxJ2+9szp;z|Z4jpkMq`82@N>v`m|{9LNo^0J`AkhGn6O3qG)N7z
zF-=CEj|tQ;>za=LkQ=iE6XWq&x7R-=wK=CMzvfdmZa~CH4Id@yr!qxrI5!MNm?s;c
z%%dTjM}dYMh1C2>!Wg0`ibO~vS&oQaz|@GPsw^SYDf7MQL}qEk9%U7X`X19hTA#~k
zC{&DiL4c)$vNZPixZjm_D&(J^mbXTCjek+;+*ijf@oyTU0+jbZ6VFal#=oQQ;(r^o
z2Yafzp|S;4-6MOz**x(nq!S7=kE0XdotJ<JWmrsT1Yvr>#V8ihKY=>Jbabet@#R><
zX<9Dv3p{*S0IeBEEg1Q*VoUWH$q+^$+sF*PA*zhA#15lzuBs|f(NY;As3E(kEGAxx
zbCOhCQ?UH-vAdu!@!nAqBF6`H0%r4}0UuzT&={1rz^TubZ^RlSJZgLvr;il%Em)u~
zz*GpGa=PM6)+i+8tk-^|h{fWmv<Cr`9+bvVf5Jd%=654jDTh!k+ORLtAoXMHUtI+V
zkqL=1NmOZA#$;tznXp(9HJB*DL<J@aFj2OM@=H`-`FumkFhNZ~jVt<=hb8P^bRKsv
zI<0{?GV}Q#(0U3O2V(D+ix3XP6JPMSLPQUrCJi|tJH=U#jEYDOlSzDpDYq)SL@Hui
zvYjXut94H)q>7Engj2>~7>+-~OhB(fT$0#}bqKD%0ipXtwxzX#G4ul9;d}ZOCY}_;
za0z;a{i}W#^ig;<kEJ^oVLCz2MdK`%Vv&9Ea*R%_;UyAO3J3h~SN-tt0KP4-pjosq
zNzdLbJ4+AN%I?g~3&PQ8O^Ayt-Fh2aLZEO%g^A&a67f8(`am}IU0VJ3(OvUDHt((D
zmi&*m856JuFdY-`0=Bh#|F=cjl>f2$U&{WP(2Faau}I?+GN$Pu@uGmu2I2;TH=c63
zd$ixnTja^Bg7x|5OD=o~#us1Y$*L+??kUi0-ZUhWS)mrKb#sOD@!6D~5H}ihl(2gm
zM0_A7M4aqDZ*|TG{q}jkb1riE5^qCA7jbA7*;&>&53?0MYdzZktZbZM<c$rc&Adwr
z;;lfK<u9_zS@Jsg^YP(9#T^Hj$MW&)A|_`P1|P^QxBk5YCcXJkww5l*s|xvm;FCG@
z{L677IF+hvA3KM|R2BdH0tlL=x}<Q$(%P~+D$G)6ty@I$y}?^}VP($-nEmrD$i{L*
z1ixG>Z7G@F`TS>p+5Jzq-PQSTi`R4F{%7yb|83C5^Pg?`{#Vjc9QnVe<IYF_UUv7o
z#z6$eW0Wl-kU%$b!euy}4&pF?;@~TBN^$=mD{}wH`=5y4PseTX@7C?&_aDQsWc}w_
zyZ1j^p>O0*v)NnVEbwG9-|zOGefO+$<K2Wt_WS+kV7a<ZNW0VTy&gPn<23T(q<{Jp
zSnRWa!rSyZ#!rDudhN64ui<46PEMfHZTEWJ9yw`!e{tT&+9AFkgaJ8kpZ1@1JMi)X
z%NT5s8#=S!IM5bJC(HRKo%2`i-bb^)M(0-q@*hc#bj@)!)3h{GcUB-5{inFp{_Br$
wj$B(J6*yR6N%E?{`P^A<cuzV1hFs?McBi#_i@l>A?dZ?ZZ(hG_U;rop0B^pgqW}N^

literal 1794
zcmV+d2mSaTiwFQ`PpMM?1MOLDbJ|7_&R6bNY-Ep}Oe<OMa%jVt0B+JI;9%TLrtL67
zIzTbjVVwwZCO^J=CkYE1$BvsYlaw_^cYC+b?!B#ckKsJ*2kdN`P|o{-t_NBeC3_FP
zD(SlJIS$~{@LVf<db)Tn2n@q99aGnB(*)gcb=!Ra&et_#HO+YHCuqu?%~G1&-0!yb
zd>o7CcS6IJ>wle##e3_(`EYIf#`QN`%UrC#Wm}+|rtX>#K>v#4ypjIr>%RqCstPOD
zTUEEn7H~F80t)Gv!kN!;3gEq;z%ZInn2%`;QM$`TYeLCipbkOP_Ox_*I?}M4mP`Bt
zJ39r?igwg8<Jhubr<A8KWC=tu$TBh`e}F2dKIc(9%2h23ENNM4B198<afD|q*7%r=
zXxdNwIAmx2DN9l?$w~WJ=cL{2A9cFDr`z4UL=N8+tVfR)T=)r$$BzjO#tf8Y!E#N3
zTJ5SKnam|>QCihkOg`>SITLd~32~x?-IFlpebFK2Wcy{aecbQ0j(hE6P^YlKTd|^<
z2-L7eo3Ig>wH*U?vJt*$KHYv;Hcl||!VRXK`KJ^D77wG5+zo`&5L61geD6S5@b|&q
z?$UJZ?(G)sz0RUXVX$cZb%oVJ1JqzPkfp_x%;Eu?#i86FxHAWSa5_o^ha7cVPZhDr
zG=*$qWv}R};wLD8pq8`CQ?anNJRM8SQf1||1b%vzH}|8ZHS5o&kS{^jmK!4YC7TFY
z&-uTr{~s|H-dD#h{$KY@3k==EcfM!3mLvSXX<HlrzYfZmpbEG~0nmYMz`n7sgLp45
zzATVq(tURbpiQ*8c1et6FL8wMT-O0yLI>O@E(O<?Rg`wADA{@r3-9r55yj}xw3w!d
zkwKW!3Tzh}ZrK17wDxULvcbV3TCqe&`x%6V5aBQg7Z7F%$H~TJ=pw*0$`G%`m!Cn{
z!U_}3_beR;B8Kb^76Y+FHAH))0?=Zvy<?|15Iil5fjHSfR_I3aQMZZG7A+tyEf{FE
z0>Zro!pa~rDnSHV?aLg;UC+O8UjJc_eLntkT#Wy0*LG~r!UjD5mTqj$|2pWV_)kVu
zKT-s^1;LmGr)V<1qqzwB*bvbDh*$QU!q|ULNrapL)NvLNe1cIzr=XkzrvX=f5o3%=
zB@Wm$eX6MEV1YUZQz3N1=_OyXh7nncM7AJgat2FLU=7Y^G`Rq_<PK3S+ORFrAPuHi
z|L`G1h)hVhN#Ui@jb(1POz5nH4;C(1cwpgxh1(MDS9ssNzoBH9pe7<_EbB8&Pt)<w
zfThqa@Bay{r-0``#(Tve!~|l%B6wVp5l|6f%1Sw=DU0MVnZz|rxm144=QL5ovSce!
zdRckCQb-jGlL@Dc!5|tvRFLr@!Xb&ZScTvQHz0KW$d<HHFa~}IJo-p~hM1)wnoH0E
zJB)_I6=z7qOsiEig+QTaiHZ9iC8o1<S&1y_-ykNutN#~4^L=&P7XMi;`hU}MFzWLh
z>?q^EjsIT@ahjm}sgeqQ4;YWqiz;Trl`V*8XKFf5s2}nwZo*0w<M4-mK&zKtf>cEI
zTm_l%9gqt8aFt(hJnB_EDx`v2i3TZ45L3gxQ7BGA6_mm!AP2X3Fisdl6h)B;N$j7|
ztQImAPn;^<q&i`NKN&NgO6)u*RzI?sqV>59y2(n>;)h{^tc9@$dD?lPtSh(r9_Y^Z
zf9#vZf0*}O-v8N#jQ>o>-kkq+(2e(hY|ZgsNlOv%eNM-n1HY{-_PW4E1V+ce<}pa1
zD|dpY(PYv`j|9cVSBX=)_xZtm$Cu=PF~6UV+s?o1*~R^jVOaA1-?jA3`CkY90^-$~
zMFH8tlY#hlr~Bf!7ws##iAJ`2y_aCQx=u)|-Rr*XKWkw(@~YlzJO?%nSV-YKy_n*+
zz$M+*(aX2+x(oF>v^%YCx6>u{=I<xRJ-~$Hq929ixYg*r=(OSWN$Xe?$Q7O09S7PX
zslMo6Zy&#Db+7e)f|I`_kYAGQ>zd<grfF%W?p%VL^q%8TdvCAd?7Ox^DsbAz+0$RX
z^SQI!;GS~96}fEMTkYo8iDK@0{zD$zTgPqZ-?6;n{Og`&Y<~Y+BR%suZOh>K+M1I;
zX~H8GW5BQJq)B;@MAK9<4zm~=GxRXe)eA{%78fg7>JBN(?>K}r&`1N*2?5abQ&jj0
zyLJN1a2@<q9j~fe&_Evm7zTRem5&(*{$p|iVWPnst)bQN5xt8?KI-PAfhZ%HT#yE8
z$3!4btE6!jHtCecB5fg;rRQ`qt&*c;)j-9Mo#aSn7OMjx(xa;zWrR_meK-`CAE@QX
k=bVOBa_C2s8S47Mf`tujXhR#?&<{iZ0x6Xl^8hFS0LW;AlK=n!

diff --git a/testdata/iter_domain_sale.rpl b/testdata/iter_domain_sale.rpl
index 724b51dadb11..ff612780a8c8 100644
--- a/testdata/iter_domain_sale.rpl
+++ b/testdata/iter_domain_sale.rpl
@@ -238,7 +238,8 @@ SECTION QUESTION
 nx1.example.com. IN A
 SECTION ANSWER
 SECTION AUTHORITY
-example.com.	3600 IN SOA	a. b. 1 2 3 4 5
+; at TTL 5 because TTL is capped at min-ttl of 5 in rdata of SOA
+example.com.	5 IN SOA	a. b. 1 2 3 4 5
 example.com.	1800 IN NS	ns.example.com.
 SECTION ADDITIONAL
 ns.example.com.	1800 	IN 	A	1.2.3.4
diff --git a/testdata/iter_domain_sale_nschange.rpl b/testdata/iter_domain_sale_nschange.rpl
index a7d9f11b88be..bc396f67c6f3 100644
--- a/testdata/iter_domain_sale_nschange.rpl
+++ b/testdata/iter_domain_sale_nschange.rpl
@@ -285,7 +285,8 @@ SECTION QUESTION
 nx1.example.com. IN A
 SECTION ANSWER
 SECTION AUTHORITY
-example.com.	3600 IN SOA	a. b. 1 2 3 4 5
+; at TTL 5 because TTL capped at ttl of minttl in rdata of SOA.
+example.com.	5 IN SOA	a. b. 1 2 3 4 5
 example.com.	3600 IN NS	nsb.example.com.
 SECTION ADDITIONAL
 nsb.example.com.	3600 	IN 	A	1.2.3.4
@@ -306,7 +307,8 @@ SECTION QUESTION
 nx1.example.com. IN A
 SECTION ANSWER
 SECTION AUTHORITY
-example.com.	3600 IN SOA	a. b. 1 2 3 4 5
+; at TTL 5 because TTL capped at ttl of minttl in rdata of SOA.
+example.com.	5 IN SOA	a. b. 1 2 3 4 5
 example.com.	1800 IN NS	nsb.example.com.
 SECTION ADDITIONAL
 nsb.example.com.	3600 	IN 	A	1.2.3.4
diff --git a/testdata/root_anchor.tpkg b/testdata/root_anchor.tpkg
index 47bdd000b39f4031a47dc29b38ce1fd09657a2b2..dfb4c5a1c2c221e8ac3ad71d20ee7a42af759bc2 100644
GIT binary patch
literal 1004
zcmV<I0~7ooiwFR<jw4k71MOC8ZzDAn%~$*@u4Yl$l{$_mPdbQYOWK08qK(=Lgb-rg
z87J{J@r-Owvz7SqTzir*iJBI)T@b>jkIDG@K75XS9bFXmH?Fc-p=mC4yY&gc5W`{L
zJ(FRdHJ@v=l1@KiLpJR6J1v%U2W;4a{--Er7nQMG1GJV!Wrf~9?<xC#6naPh=DQWf
zK1U8G@L<r}r+;UNwvGP1F6uvI-9Zc3b0mKX|8xCcfGH}S39vH(3vO_YaEF9U<XpgV
zCKO2fg>hCb$S)92fYLU#<?WQ>G`jNm6%G#8fgZ4v7f>0rY=+&=f=Qu4D)66iQ1Tm0
zS#o2fnyyl9J8WgyG7&PqJpDRyscA$oU7_apkQZ3DG<60!@k>;~E(?7NI9!#K2;Arp
zNwc=$;5QM$xw)Len_KFRLu`b;6WUN`r*L&~44u~p3H%OIElN1QIK8~QxP-4<3`IWk
zA@7ADVs6ChRTcQ*gS5cNM7sKXNp{9Dp}Hw5mB;m&J4Ct-+*ERIk(!h9tGA~=AA+mc
zP~x=mh0d%kjax!4jbkl`ms7M9kaUKW;ZO1=VeIJW6(ye|G41Uf5LXawW=0T?!Ow=6
z`?_duAil$F*-T`&b(Jpb+UB<gCck(~9aCEwW(BSbmD|Lzp0D^0iEEM;y)+`Lw0IS5
z(H31}p3Um7z|jwN)yA_BHCcUhcJ5fWE2o<L#FJmUMvsbM8-X*St(?e=Td`8Y3vuZ7
zZ?@KADeVm6Gt8cQ=Qwi=aV$Y$YHTsedfpz^W5v76<UIXLDHe{l_-v05e)3<Iq7MBL
zVt8(=GDjAgjMRkeS7o1DUI?>CpSo9IJ#)9CjS%ajJN|CG6=TNnqzLR#b^M$X?-a*Y
zE<~IaC`Hs^NuTxD5O;XW+;3D1mbTmI!>Qzo(?U=Ey|>cCv@yO?H%Q`KcpYA2YgoF}
zj%2@UVg=DVtYU3=w?o}-gxy+k$qnzn;k6>F$@fEEj@oTczxC@D)a?I{-T%4Cp5=~t
z;{Ip7PSQ$}UY~V)-EK0#`+qP<y5au+C-5yd;+!u;3JvASk9gh5LZy&UMoxsuv@ES3
zs9O;pgGRIUJ1(1XHFbw@qy=|#PjKI*a9s(w!XDH45-+E;*G<_Gj83nv0Z%3)KX9om
z{t2Bzt||OPNAwsU^1YgJu5&|17-d@M`xMBiSd`dKl}*WLk)McCsNCTApP#-L^D-r4
zE$|<9zm#0#S>0M${cYj6`f!Gw)47cC`-aF<a>nJna*qGDAOQgZ0RaI40RaI40RaI4
a0RaI40RaI40RaIYfj<DdhK*<dC;$LtRO@m8

literal 1001
zcmV<F0~Y)riwFR9O1w+}1MOC8Z`(E$_1E!NT&P3V0ue3w*=ShT%t=<DSYpJ%hG7_1
zMxre?HYJc$+yMRYyQJ(?GV<8abi**7Al8Gt51w;*DOD8a4<^&RP&5;&+xY^B5aaQ%
zzK#a1>js@T9t_9PU>FZaoha^)dZP{uzeF;-sI*}UptCM2!`1!s9vlCULhb0^d^TL0
zr-)$%9_{Gf(7$KzKk1Kk5|5+dpaaoU1b+<wbN!!zE-ICBFgb@6)3`>sMndLd$zh#y
z3Br7%?Wp49HwfoIX_uPvYC&-t-B|n%dwW|)cZ`!~P-z^weQhfX=7j<w!QJCa!7edm
z$+Q-7u?f{SXhmra5i&hL{w}bgX+SVsA(uCh6_~fsbp$bYOO)KK3v~tfx+*E*Sm+Q4
zy&c1s-v<QeW?})auc+M)q2}tED^2Y<h1uC5^j_`7@DUb@mvDM^e13j*4&PcIl6>V{
z-f&I$QuEEDEb!)oFc6Wsu=%-^OwKT%yeul2h4r4>N4hm!R$^(8nxoU%+v8vN!Dg%}
zv0AxAb7M+vmyii<S<B%00!Ipndt(~mU;H|bqJx7MlzffEblWi?tRT3Z89+D%Hyc9c
z@}ilB@EW6~IZv<ZEN#^7m@5qoe)g7Hrdkp50@sDg-TE<(ukad)Ymyc`*F3Ehe-X53
z3obCu?doS>>4!RN?N|t!tUfq9v#gtqQB8jA$gfR<2SqRq$0=7v%tgu!-zedP*thkY
zZnanolS6od(KBZprj{XwDM$>BEk+v0+ueF>c(;+PrF$s(%F-5|+#`gW{FkMuU4Moc
zj@zotkcB2AH6iz_a-UgNaD9(Hb+5pDmbRib=i9A2{c+mzku%&W96MC)KcmDMg`p8E
z9;O9K5%eM~?U(To;)5g}BvBO9f+gK9+Au1ZWVBEVckXTU&|UN|<t381<W7fI*c#S0
zv?bY9O(-FFhgoa~-tADg>tQ!nTyn$uZ&+=JYVv)Tm8G_A=}NzDLCyaE(D|R~^hwT`
zN6!Cf(2L#qAN2?Qer&)0Mx$Qepa1^^eqfrPvK3FDp*;B+k2_Jw1Y#PIBd${=O5<MC
ztq8Y4quIKOOLHa{b`wq%XLjxp)?ES@6^9x2nBGe~oRUF5i4I_LJi7q9Gs#a(NQ3`e
zC6Fl!zt9Oi#EW<@7mTS)lL>lR6zV1cGAULiwo_>mGFfFuyyP;|`2N$~8@?<PGF2RZ
zu=^$C0{3cbW%bv>VfEnzJEt|7;`av65^}=Cva*K%wjdrJ9v&VZ9v&VZ9v&VZ9v&VZ
X9v&VZ9v&VZpMgICh3y<M04M+e$}!$2

diff --git a/testdata/val_dnametopos.rpl b/testdata/val_dnametopos.rpl
index 6264a6d0ee39..faeb40f9dac4 100644
--- a/testdata/val_dnametopos.rpl
+++ b/testdata/val_dnametopos.rpl
@@ -231,4 +231,31 @@ SECTION AUTHORITY
 SECTION ADDITIONAL
 ENTRY_END
 
+; Check cache response for DNAME
+; so 100+ the authority will not respond any more : must be from cache.
+STEP 110 TIME_PASSES ELAPSE 10
+
+STEP 120 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 130 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+example.com.    3590    IN      DNAME   example.net.
+example.com.    3590    IN      RRSIG   DNAME 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFH1xw24Hswia3g10AVL1yFUHUPdFAhQDrA+qZJwqXRPg2C1oiNPk9fosGg== ;{id = 2854}
+www.example.com.        3590    IN      CNAME   www.example.net.
+www.example.net.        3590    IN      A       11.12.13.14
+www.example.net.        3590    IN      RRSIG   A 5 3 3600 20070926134150 20070829134150 30899 example.net. CPxF5hK9Kg5eT7W6LgZwr0ePYEm9HMcSY4vvqCS6gDWB4X9jvXLCfBkCLhsNybPBpGWlsLi5wM6MTdJXuPpsRA== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
 SCENARIO_END
diff --git a/testdata/val_ta_algo_dnskey_dp.rpl b/testdata/val_ta_algo_dnskey_dp.rpl
new file mode 100644
index 000000000000..b23c0f1b04d7
--- /dev/null
+++ b/testdata/val_ta_algo_dnskey_dp.rpl
@@ -0,0 +1,182 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.	3600	IN	DNSKEY	256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}"
+	trust-anchor: "example.com.	3600	IN	DS	30899 5 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	harden-algo-downgrade: no
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with multiple algorithm trust anchor without harden 
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+example.com.	3600	IN	DNSKEY	256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 512b}
+example.com.	3600	IN	RRSIG	DNSKEY 3 2 3600 20070926134150 20070829134150 2854 example.com. AKIIYDOGHogglFqJK94ZtOnF7EfGikgAyloMNRSMCrQgFaFkmcOyjrc= ;{id = 2854}
+example.com.	3600	IN	RRSIG	DNSKEY 5 2 3600 20070926134150 20070829134150 30899 example.com. J55fsz1GGMnngc4r50xvXDUdaVMlfcLKLVsfMhwNLF+ERac5XV/lLRAc/aSER+qQdsSo0CrjYjy1wat7YQpDAA== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. JNWECShNE+nCLQwOXJJ3xpUkh2G+FCh5nk8uYAHIVQRse/BIvCMSlvRrtVyw9RnXvk5RR2bEgN0pRdLWW7ug5Q== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. JNWECShNE+nCLQwOXJJ3xpUkh2G+FCh5nk8uYAHIVQRse/BIvCMSlvRrtVyw9RnXvk5RR2bEgN0pRdLWW7ug5Q== ;{id = 30899}
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/val_ta_algo_missing_dp.rpl b/testdata/val_ta_algo_missing_dp.rpl
new file mode 100644
index 000000000000..2cf0556f5bff
--- /dev/null
+++ b/testdata/val_ta_algo_missing_dp.rpl
@@ -0,0 +1,185 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.	3600	IN	DNSKEY	256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}"
+	trust-anchor: "example.com.	3600	IN	DS	30899 5 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512"
+	trust-anchor: "example.com.	3600	IN	DS	30899 7 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	harden-algo-downgrade: no
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with multiple algorithm missing one
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+example.com.	3600	IN	DNSKEY	256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 512b}
+example.com.	3600	IN	RRSIG	DNSKEY 3 2 3600 20070926134150 20070829134150 2854 example.com. AKIIYDOGHogglFqJK94ZtOnF7EfGikgAyloMNRSMCrQgFaFkmcOyjrc= ;{id = 2854}
+example.com.	3600	IN	RRSIG	DNSKEY 5 2 3600 20070926134150 20070829134150 30899 example.com. J55fsz1GGMnngc4r50xvXDUdaVMlfcLKLVsfMhwNLF+ERac5XV/lLRAc/aSER+qQdsSo0CrjYjy1wat7YQpDAA== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. JNWECShNE+nCLQwOXJJ3xpUkh2G+FCh5nk8uYAHIVQRse/BIvCMSlvRrtVyw9RnXvk5RR2bEgN0pRdLWW7ug5Q== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com.	3600	IN	A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. JNWECShNE+nCLQwOXJJ3xpUkh2G+FCh5nk8uYAHIVQRse/BIvCMSlvRrtVyw9RnXvk5RR2bEgN0pRdLWW7ug5Q== ;{id = 30899}
+www.example.com.	3600	IN	RRSIG	A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+
+SECTION ADDITIONAL
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+SCENARIO_END
diff --git a/util/alloc.c b/util/alloc.c
index 4b81beb4c4cb..05d2fa36207b 100644
--- a/util/alloc.c
+++ b/util/alloc.c
@@ -364,11 +364,18 @@ void *unbound_stat_malloc(size_t size)
 #ifdef calloc
 #undef calloc
 #endif
+#ifndef INT_MAX
+#define INT_MAX (((int)-1)>>1)
+#endif
 /** calloc with stats */
 void *unbound_stat_calloc(size_t nmemb, size_t size)
 {
-	size_t s = (nmemb*size==0)?(size_t)1:nmemb*size;
-	void* res = calloc(1, s+16);
+	size_t s;
+	void* res;
+	if(nmemb != 0 && INT_MAX/nmemb < size)
+		return NULL; /* integer overflow check */
+	s = (nmemb*size==0)?(size_t)1:nmemb*size;
+	res = calloc(1, s+16);
 	if(!res) return NULL;
 	log_info("stat %p=calloc(%u, %u)", res+16, (unsigned)nmemb, (unsigned)size);
 	unbound_mem_alloc += s;
@@ -503,8 +510,12 @@ void *unbound_stat_malloc_lite(size_t size, const char* file, int line,
 void *unbound_stat_calloc_lite(size_t nmemb, size_t size, const char* file,
         int line, const char* func)
 {
-	size_t req = nmemb * size;
-	void* res = malloc(req+lite_pad*2+sizeof(size_t));
+	size_t req;
+	void* res;
+	if(nmemb != 0 && INT_MAX/nmemb < size)
+		return NULL; /* integer overflow check */
+	req = nmemb * size;
+	res = malloc(req+lite_pad*2+sizeof(size_t));
 	if(!res) return NULL;
 	memmove(res, lite_pre, lite_pad);
 	memmove(res+lite_pad, &req, sizeof(size_t));
diff --git a/util/alloc.h b/util/alloc.h
index ffd605c5dc16..43fc30f98f21 100644
--- a/util/alloc.h
+++ b/util/alloc.h
@@ -177,8 +177,8 @@ void alloc_set_id_cleanup(struct alloc_cache* alloc, void (*cleanup)(void*),
 	void* arg);
 
 #ifdef UNBOUND_ALLOC_LITE
-#  include <ldns/ldns.h>
-#  include <ldns/packet.h>
+#  include <sldns/ldns.h>
+#  include <sldns/packet.h>
 #  ifdef HAVE_OPENSSL_SSL_H
 #    include <openssl/ssl.h>
 #  endif
diff --git a/util/config_file.c b/util/config_file.c
index 9c427ed0d4f5..5d31301fa002 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -56,8 +56,9 @@
 #include "util/fptr_wlist.h"
 #include "util/data/dname.h"
 #include "util/rtt.h"
-#include "ldns/wire2str.h"
-#include "ldns/parseutil.h"
+#include "services/cache/infra.h"
+#include "sldns/wire2str.h"
+#include "sldns/parseutil.h"
 #ifdef HAVE_GLOB_H
 # include <glob.h>
 #endif
@@ -131,6 +132,7 @@ config_create(void)
 	cfg->bogus_ttl = 60;
 	cfg->min_ttl = 0;
 	cfg->max_ttl = 3600 * 24;
+	cfg->max_negative_ttl = 3600;
 	cfg->prefetch = 0;
 	cfg->prefetch_key = 0;
 	cfg->infra_cache_slabs = 4;
@@ -156,6 +158,7 @@ config_create(void)
 	cfg->so_rcvbuf = 0;
 	cfg->so_sndbuf = 0;
 	cfg->so_reuseport = 0;
+	cfg->ip_transparent = 0;
 	cfg->num_ifs = 0;
 	cfg->ifs = NULL;
 	cfg->num_out_ifs = 0;
@@ -169,7 +172,9 @@ config_create(void)
 	cfg->harden_dnssec_stripped = 1;
 	cfg->harden_below_nxdomain = 0;
 	cfg->harden_referral_path = 0;
+	cfg->harden_algo_downgrade = 1;
 	cfg->use_caps_bits_for_id = 0;
+	cfg->caps_whitelist = NULL;
 	cfg->private_address = NULL;
 	cfg->private_domain = NULL;
 	cfg->unwanted_threshold = 0;
@@ -226,6 +231,12 @@ config_create(void)
 	if(!(cfg->dnstap_socket_path = strdup(DNSTAP_SOCKET_PATH)))
 		goto error_exit;
 #endif
+	cfg->ratelimit = 0;
+	cfg->ratelimit_slabs = 4;
+	cfg->ratelimit_size = 4*1024*1024;
+	cfg->ratelimit_for_domain = NULL;
+	cfg->ratelimit_below_domain = NULL;
+	cfg->ratelimit_factor = 10;
 	return cfg;
 error_exit:
 	config_delete(cfg); 
@@ -372,12 +383,15 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_MEMSIZE("so-rcvbuf:", so_rcvbuf)
 	else S_MEMSIZE("so-sndbuf:", so_sndbuf)
 	else S_YNO("so-reuseport:", so_reuseport)
+	else S_YNO("ip-transparent:", ip_transparent)
 	else S_MEMSIZE("rrset-cache-size:", rrset_cache_size)
 	else S_POW2("rrset-cache-slabs:", rrset_cache_slabs)
 	else S_YNO("prefetch:", prefetch)
 	else S_YNO("prefetch-key:", prefetch_key)
 	else if(strcmp(opt, "cache-max-ttl:") == 0)
 	{ IS_NUMBER_OR_ZERO; cfg->max_ttl = atoi(val); MAX_TTL=(time_t)cfg->max_ttl;}
+	else if(strcmp(opt, "cache-max-negative-ttl:") == 0)
+	{ IS_NUMBER_OR_ZERO; cfg->max_negative_ttl = atoi(val); MAX_NEG_TTL=(time_t)cfg->max_negative_ttl;}
 	else if(strcmp(opt, "cache-min-ttl:") == 0)
 	{ IS_NUMBER_OR_ZERO; cfg->min_ttl = atoi(val); MIN_TTL=(time_t)cfg->min_ttl;}
 	else if(strcmp(opt, "infra-cache-min-rtt:") == 0) {
@@ -404,7 +418,9 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("harden-dnssec-stripped:", harden_dnssec_stripped)
 	else S_YNO("harden-below-nxdomain:", harden_below_nxdomain)
 	else S_YNO("harden-referral-path:", harden_referral_path)
+	else S_YNO("harden-algo-downgrade:", harden_algo_downgrade)
 	else S_YNO("use-caps-for-id", use_caps_bits_for_id)
+	else S_STRLIST("caps-whitelist:", caps_whitelist)
 	else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold)
 	else S_STRLIST("private-address:", private_address)
 	else S_STRLIST("private-domain:", private_domain)
@@ -444,6 +460,13 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_STR("control-cert-file:", control_cert_file)
 	else S_STR("module-config:", module_conf)
 	else S_STR("python-script:", python_script)
+	else if(strcmp(opt, "ratelimit:") == 0) {
+	    IS_NUMBER_OR_ZERO; cfg->ratelimit = atoi(val);
+	    infra_dp_ratelimit=cfg->ratelimit;
+	}
+	else S_MEMSIZE("ratelimit-size:", ratelimit_size)
+	else S_POW2("ratelimit-slabs:", ratelimit_slabs)
+	else S_NUMBER_OR_ZERO("ratelimit-factor:", ratelimit_factor)
 	/* val_sig_skew_min and max are copied into val_env during init,
 	 * so this does not update val_env with set_option */
 	else if(strcmp(opt, "val-sig-skew-min:") == 0)
@@ -452,7 +475,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	{ IS_NUMBER_OR_ZERO; cfg->val_sig_skew_max = (int32_t)atoi(val); }
 	else if (strcmp(opt, "outgoing-interface:") == 0) {
 		char* d = strdup(val);
-		char** oi = (char**)malloc((cfg->num_out_ifs+1)*sizeof(char*));
+		char** oi = 
+		(char**)reallocarray(NULL, (size_t)cfg->num_out_ifs+1, sizeof(char*));
 		if(!d || !oi) { free(d); free(oi); return -1; }
 		if(cfg->out_ifs && cfg->num_out_ifs) {
 			memmove(oi, cfg->out_ifs, cfg->num_out_ifs*sizeof(char*));
@@ -465,7 +489,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
 		 * interface, outgoing-interface, access-control, 
 		 * stub-zone, name, stub-addr, stub-host, stub-prime
 		 * forward-first, stub-first,
-		 * forward-zone, name, forward-addr, forward-host */
+		 * forward-zone, name, forward-addr, forward-host,
+		 * ratelimit-for-domain, ratelimit-below-domain */
 		return 0;
 	}
 	return 1;
@@ -577,8 +602,8 @@ config_collate_cat(struct config_strlist* list)
 #define O_MEM(opt, str, var) if(strcmp(opt, str)==0) { \
 	if(cfg->var > 1024*1024*1024) {	\
 	  size_t f=cfg->var/(size_t)1000000, b=cfg->var%(size_t)1000000; \
-	  snprintf(buf, len, "%u%6.6u\n", (unsigned)f, (unsigned)b); \
-	} else snprintf(buf, len, "%u\n", (unsigned)cfg->var); \
+	  snprintf(buf, len, "%u%6.6u", (unsigned)f, (unsigned)b); \
+	} else snprintf(buf, len, "%u", (unsigned)cfg->var); \
 	func(buf, arg);}
 /** compare and print list option */
 #define O_LST(opt, name, lst) if(strcmp(opt, name)==0) { \
@@ -624,11 +649,13 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_MEM(opt, "so-rcvbuf", so_rcvbuf)
 	else O_MEM(opt, "so-sndbuf", so_sndbuf)
 	else O_YNO(opt, "so-reuseport", so_reuseport)
+	else O_YNO(opt, "ip-transparent", ip_transparent)
 	else O_MEM(opt, "rrset-cache-size", rrset_cache_size)
 	else O_DEC(opt, "rrset-cache-slabs", rrset_cache_slabs)
 	else O_YNO(opt, "prefetch-key", prefetch_key)
 	else O_YNO(opt, "prefetch", prefetch)
 	else O_DEC(opt, "cache-max-ttl", max_ttl)
+	else O_DEC(opt, "cache-max-negative-ttl", max_negative_ttl)
 	else O_DEC(opt, "cache-min-ttl", min_ttl)
 	else O_DEC(opt, "infra-host-ttl", host_ttl)
 	else O_DEC(opt, "infra-cache-slabs", infra_cache_slabs)
@@ -662,7 +689,9 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "harden-dnssec-stripped", harden_dnssec_stripped)
 	else O_YNO(opt, "harden-below-nxdomain", harden_below_nxdomain)
 	else O_YNO(opt, "harden-referral-path", harden_referral_path)
+	else O_YNO(opt, "harden-algo-downgrade", harden_algo_downgrade)
 	else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
+	else O_LST(opt, "caps-whitelist", caps_whitelist)
 	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
 	else O_YNO(opt, "do-not-query-localhost", donotquery_localhost)
 	else O_STR(opt, "module-config", module_conf)
@@ -703,6 +732,12 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "unblock-lan-zones", unblock_lan_zones)
 	else O_DEC(opt, "max-udp-size", max_udp_size)
 	else O_STR(opt, "python-script", python_script)
+	else O_DEC(opt, "ratelimit", ratelimit)
+	else O_MEM(opt, "ratelimit-size", ratelimit_size)
+	else O_DEC(opt, "ratelimit-slabs", ratelimit_slabs)
+	else O_LS2(opt, "ratelimit-for-domain", ratelimit_for_domain)
+	else O_LS2(opt, "ratelimit-below-domain", ratelimit_below_domain)
+	else O_DEC(opt, "ratelimit-factor", ratelimit_factor)
 	else O_DEC(opt, "val-sig-skew-min", val_sig_skew_min)
 	else O_DEC(opt, "val-sig-skew-max", val_sig_skew_max)
 	/* not here:
@@ -890,6 +925,7 @@ config_delete(struct config_file* cfg)
 	free(cfg->version);
 	free(cfg->module_conf);
 	free(cfg->outgoing_avail_ports);
+	config_delstrlist(cfg->caps_whitelist);
 	config_delstrlist(cfg->private_address);
 	config_delstrlist(cfg->private_domain);
 	config_delstrlist(cfg->auto_trust_anchor_file_list);
@@ -909,9 +945,12 @@ config_delete(struct config_file* cfg)
 	free(cfg->server_cert_file);
 	free(cfg->control_key_file);
 	free(cfg->control_cert_file);
+	free(cfg->dns64_prefix);
 	free(cfg->dnstap_socket_path);
 	free(cfg->dnstap_identity);
 	free(cfg->dnstap_version);
+	config_deldblstrlist(cfg->ratelimit_for_domain);
+	config_deldblstrlist(cfg->ratelimit_below_domain);
 	free(cfg);
 }
 
@@ -998,7 +1037,7 @@ int cfg_condense_ports(struct config_file* cfg, int** avail)
 	*avail = NULL;
 	if(num == 0)
 		return 0;
-	*avail = (int*)malloc(sizeof(int)*num);
+	*avail = (int*)reallocarray(NULL, (size_t)num, sizeof(int));
 	if(!*avail)
 		return 0;
 	for(i=0; i<65536; i++) {
@@ -1198,6 +1237,7 @@ config_apply(struct config_file* config)
 {
 	MAX_TTL = (time_t)config->max_ttl;
 	MIN_TTL = (time_t)config->min_ttl;
+	MAX_NEG_TTL = (time_t)config->max_negative_ttl;
 	RTT_MIN_TIMEOUT = config->infra_cache_min_rtt;
 	EDNS_ADVERTISED_SIZE = (uint16_t)config->edns_buffer_size;
 	MINIMAL_RESPONSES = config->minimal_responses;
diff --git a/util/config_file.h b/util/config_file.h
index ca512d720ebd..1c3c31dcf136 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -136,6 +136,8 @@ struct config_file {
 	size_t so_sndbuf;
 	/** SO_REUSEPORT requested on port 53 sockets */
 	int so_reuseport;
+	/** IP_TRANSPARENT socket option requested on port 53 sockets */
+	int ip_transparent;
 
 	/** number of interfaces to open. If 0 default all interfaces. */
 	int num_ifs;
@@ -173,8 +175,12 @@ struct config_file {
 	int harden_below_nxdomain;
 	/** harden the referral path, query for NS,A,AAAA and validate */
 	int harden_referral_path;
+	/** harden against algorithm downgrade */
+	int harden_algo_downgrade;
 	/** use 0x20 bits in query as random ID bits */
 	int use_caps_bits_for_id;
+	/** 0x20 whitelist, domains that do not use capsforid */
+	struct config_strlist* caps_whitelist;
 	/** strip away these private addrs from answers, no DNS Rebinding */
 	struct config_strlist* private_address;
 	/** allow domain (and subdomains) to use private address space */
@@ -185,6 +191,8 @@ struct config_file {
 	int max_ttl;
 	/** the number of seconds minimum TTL used for RRsets and messages */
 	int min_ttl;
+	/** the number of seconds maximal negative TTL for SOA in auth */
+	int max_negative_ttl;
 	/** if prefetching of messages should be performed. */
 	int prefetch;
 	/** if prefetching of DNSKEYs should be performed. */
@@ -341,6 +349,19 @@ struct config_file {
 	int dnstap_log_forwarder_query_messages;
 	/** true to log dnstap FORWARDER_RESPONSE message events */
 	int dnstap_log_forwarder_response_messages;
+
+	/** ratelimit 0 is off, otherwise qps (unless overridden) */
+	int ratelimit;
+	/** number of slabs for ratelimit cache */
+	size_t ratelimit_slabs;
+	/** memory size in bytes for ratelimit cache */
+	size_t ratelimit_size;
+	/** ratelimits for domain (exact match) */
+	struct config_str2list* ratelimit_for_domain;
+	/** ratelimits below domain */
+	struct config_str2list* ratelimit_below_domain;
+	/** ratelimit factor, 0 blocks all, 10 allows 1/10 of traffic */
+	int ratelimit_factor;
 };
 
 /** from cfg username, after daemonise setup performed */
diff --git a/util/configlexer.c b/util/configlexer.c
index 7bb48afda21a..e9fa947bf759 100644
--- a/util/configlexer.c
+++ b/util/configlexer.c
@@ -363,8 +363,8 @@ static void yy_fatal_error (yyconst char msg[]  );
 	*yy_cp = '\0'; \
 	(yy_c_buf_p) = yy_cp;
 
-#define YY_NUM_RULES 164
-#define YY_END_OF_BUFFER 165
+#define YY_NUM_RULES 174
+#define YY_END_OF_BUFFER 175
 /* This struct is not used in this scanner,
    but its presence is necessary. */
 struct yy_trans_info
@@ -372,187 +372,198 @@ struct yy_trans_info
 	flex_int32_t yy_verify;
 	flex_int32_t yy_nxt;
 	};
-static yyconst flex_int16_t yy_accept[1628] =
+static yyconst flex_int16_t yy_accept[1731] =
     {   0,
-        1,    1,  146,  146,  150,  150,  154,  154,  158,  158,
-        1,    1,  165,  162,    1,  144,  144,  163,    2,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  163,  146,
-      147,  147,  148,  163,  150,  151,  151,  152,  163,  157,
-      154,  155,  155,  156,  163,  158,  159,  159,  160,  163,
-      161,  145,    2,  149,  161,  163,  162,    0,    1,    2,
-        2,    2,    2,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+        1,    1,  156,  156,  160,  160,  164,  164,  168,  168,
+        1,    1,  175,  172,    1,  154,  154,  173,    2,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  173,  156,
+      157,  157,  158,  173,  160,  161,  161,  162,  173,  167,
+      164,  165,  165,  166,  173,  168,  169,  169,  170,  173,
+      171,  155,    2,  159,  171,  173,  172,    0,    1,    2,
+        2,    2,    2,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
 
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  146,    0,  150,    0,  157,    0,  154,  158,
-        0,  161,    0,    2,    2,  161,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  161,  162,  162,  162,  162,  162,  162,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  156,    0,  160,    0,  167,    0,  164,
+      168,    0,  171,    0,    2,    2,  171,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  171,  172,  172,  172,
 
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  161,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  171,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
 
-      162,  162,  162,  162,  162,   66,  162,  162,  162,  162,
-      162,    6,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  161,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,   70,  172,  172,  172,  172,  172,    6,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  171,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
 
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  161,  162,  162,  162,  162,   29,  162,  162,  162,
-      162,  162,  162,  162,  162,  131,  162,   12,   13,  162,
-       15,   14,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  124,
-      162,  162,  162,  162,  162,    3,  162,  162,  162,  162,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  171,  172,  172,  172,  172,  172,   30,
+      172,  172,  172,  172,  172,  172,  172,  172,  135,  172,
+       12,   13,  172,   15,   14,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
 
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  161,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      153,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,   32,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,   33,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      172,  172,  172,  128,  172,  172,  172,  172,  172,  172,
+        3,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  171,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  163,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,   33,  172,  172,  172,  172,  172,  172,  172,
 
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,   81,  153,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,   80,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-       64,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      172,  172,   34,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,   85,  163,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,   84,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
 
-      162,  162,  162,   20,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-       30,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,   31,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,   22,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,   68,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,   20,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,   31,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,   32,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
 
-      162,  162,  162,  162,  162,  162,   26,  162,   27,  162,
-      162,  162,   67,  162,   68,  162,   65,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,    5,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,   83,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,   23,
-      162,  162,  162,  162,  108,  107,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+       22,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  148,  172,  172,
+      172,  172,  172,  172,   26,  172,   27,  172,  172,  172,
+       71,  172,   72,  172,   69,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+        5,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,   87,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
 
-      162,  162,  162,  162,  162,   34,  162,  162,  162,  162,
-      162,  162,  162,  162,   70,   69,  162,  162,  162,  162,
-      162,  162,  162,  104,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,   51,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,   55,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  106,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,    4,  162,  162,  162,  162,  162,  162,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+       23,  172,  172,  172,  172,  172,  112,  111,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+       35,  172,  172,  172,  172,  172,  172,  172,  172,   74,
+       73,  172,  172,  172,  172,  172,  172,  172,  108,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+       53,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
 
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  101,  162,  162,
-      162,  162,  162,  162,  162,  117,  162,  102,  162,  129,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-       21,  162,  162,  162,  162,   72,  162,   73,   71,  162,
-      162,  162,  162,  162,  162,   79,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  103,  162,  162,  162,
-      162,  128,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,   63,  162,  162,  162,  162,  162,  162,
+      172,  172,  172,  172,   57,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  110,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,    4,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  105,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  121,  172,  106,  172,  133,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,   21,  172,  172,  172,
 
-      162,  162,   28,  162,  162,   17,  162,  162,  162,   16,
-      162,   88,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,   41,   42,  162,  162,  162,
-      162,  162,  162,  162,  132,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,   74,  162,
-      162,  162,  162,  162,   78,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-       82,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  123,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,   92,
+      172,   76,  172,   77,   75,  172,  172,  172,  172,  172,
+      172,  172,   83,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  107,  172,  172,  172,  172,  132,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,   67,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,   28,  172,  172,   17,  172,
+      172,  172,   16,  172,   92,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,   42,
+       44,  172,  172,  172,  172,  172,  172,  172,  172,  136,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
 
-      162,   96,  162,  162,  162,  162,   77,  162,  162,  115,
-      162,  162,  162,  162,  130,  162,  162,  162,  162,  162,
-      162,  162,  137,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,   95,  162,  162,  162,  162,  162,   43,
-       44,  162,   50,   97,  162,  109,  105,  162,  162,   37,
-      162,   99,  162,  162,  162,  162,  162,    7,  162,   62,
-      114,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,   84,  136,  162,
-      162,  162,  162,  162,  162,  162,  162,  125,  162,  162,
+      172,  172,  172,   78,  172,  172,  172,  172,  172,  172,
+       82,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,   86,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  127,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,   96,  172,  100,  172,  172,  172,  172,   81,  172,
+      172,   63,  172,  119,  172,  172,  172,  172,  134,  172,
+      172,  172,  172,  172,  172,  172,  141,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,   99,  172,
 
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,   98,  162,   36,   38,  162,  162,  162,  162,  162,
-       61,  162,  162,  162,  162,  119,   18,   19,  162,  162,
-      162,  162,  162,  162,  162,   59,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  121,  118,  162,  162,  162,
-      162,  162,  162,  162,  162,   35,  162,  162,  162,  162,
-      162,  162,   11,  162,  162,  162,  162,  162,  162,  162,
-      162,   10,  162,  162,   39,  162,  127,  120,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,   91,
-       90,  162,  122,  116,  162,  162,  162,  162,  162,  162,
+      172,  172,  172,  172,   45,   46,  172,   29,   52,  101,
+      172,  113,  109,  172,  172,   38,  172,  103,  172,  172,
+      172,  172,  172,    7,  172,   66,  172,  172,  172,  150,
+      172,  118,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,   88,
+      140,  172,  172,  172,  172,  172,  172,  172,  172,  129,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  102,  172,   37,   39,  172,  172,
+      172,  172,  172,   65,  172,  172,  172,  149,  172,  172,
 
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,   45,  162,  126,  162,  162,  162,  162,   40,  162,
-      162,  162,   85,   87,  110,  162,  162,  162,   89,  162,
-      162,  162,  162,  162,  162,  162,  162,  133,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,   24,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  135,  162,  162,
-      113,  162,  162,  162,  162,  162,  162,   48,  162,   25,
-      162,    9,  162,  162,  111,   52,  162,  162,  162,   94,
-      162,  162,  162,  162,  162,  162,  134,   75,  162,  162,
+      172,  172,  123,   18,   19,  172,  172,  172,  172,  172,
+      172,  172,   62,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  125,  122,  172,  172,  172,  172,  172,
+      172,  172,  172,   36,  172,  172,  172,  172,  172,  172,
+      172,   11,  172,  172,  172,  172,  172,  172,  172,  172,
+       10,  172,  172,  172,  153,  172,   40,  172,  131,  124,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,   95,   94,  172,  172,  126,  120,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,   47,  172,  130,  172,  172,
 
-      162,   54,   58,   53,  162,   46,  162,    8,  162,  162,
-       93,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-       57,  162,   47,  162,  112,  162,  162,   86,  162,  162,
-      162,  162,  162,  162,   76,   56,   49,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,   60,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  100,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  162,  162,  162,  162,  162,
+      172,  172,  172,  172,   41,  172,  172,  172,   89,   91,
+      114,  172,  172,  172,   93,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  137,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,   24,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  139,  172,
+      172,  117,  172,  172,  172,  172,  172,  172,  172,   50,
+      172,   25,  172,    9,  172,  172,  172,  172,  115,   54,
+      172,  172,  172,   98,  172,  172,  172,  172,  172,  172,
+      172,  138,   79,  172,  172,  172,  172,   56,   60,   55,
 
-      162,  140,  162,  162,  162,  162,  162,  162,  162,  162,
-      162,  162,  162,  162,  162,  138,  162,  141,  142,  162,
-      162,  162,  162,  162,  139,  143,    0
+      172,   48,  172,    8,  172,  151,  172,  172,   97,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,   61,
+       59,  172,   49,  172,  172,  116,  172,  172,   90,   43,
+      172,  172,  172,  172,  172,  172,   80,   58,   51,  152,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,   64,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  104,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  172,  172,
+
+      172,  172,  172,  172,  144,  172,  172,  172,  172,  172,
+      172,  172,  172,  172,  172,  172,  172,  172,  142,  172,
+      145,  146,  172,  172,  172,  172,  172,  143,  147,    0
     } ;
 
 static yyconst flex_int32_t yy_ec[256] =
@@ -598,377 +609,399 @@ static yyconst flex_int32_t yy_meta[66] =
         1,    1,    1,    1,    1
     } ;
 
-static yyconst flex_int16_t yy_base[1642] =
+static yyconst flex_int16_t yy_base[1745] =
     {   0,
         0,    0,   63,   66,   69,   71,   77,   83,   88,   91,
-      129,  135,  428,  340,   95, 4681, 4681, 4681,  107,  110,
+      129,  135,  378,  309,   95, 5006, 5006, 5006,  107,  110,
       142,  180,  108,   50,  145,  172,  118,  148,  121,  181,
-      197,  166,  217,  223,  251,  230,  164,  262,  116,  312,
-     4681, 4681, 4681,   94,  298, 4681, 4681, 4681,   96,  269,
-      294, 4681, 4681, 4681,  244,  254, 4681, 4681, 4681,  102,
-      249, 4681,  259, 4681,  247,  287,  237,  309,  111,    0,
-      313,    0,    0,  284,  170,  265,  288,  289,  296,  305,
-      301,  273,  302,  328,  306,  311,  308,  309,  216,  325,
-      329,  339,  353,  344,  356,  357,  338,  365,  346,  367,
+      197,  166,  217,  233,  252,  236,  164,  269,  116,  298,
+     5006, 5006, 5006,   94,  295, 5006, 5006, 5006,   96,  249,
+      265, 5006, 5006, 5006,  238,  216, 5006, 5006, 5006,  102,
+      214, 5006,  290, 5006,  259,  257,  209,  312,  111,    0,
+      316,    0,    0,  265,  170,  283,  310,  296,  301,  306,
+      302,  297,  308,  325,  317,  312,  330,  333,  345,  329,
+      336,  361,  250,  343,  368,  376,  347,  341,  365,  377,
 
-      369,  368,  372,  373,  394,  386,  402,  383,  392,  399,
-      396,  400,  401,  410,  423,  421,  419,  426,  431,  438,
-      428,  434,  203,  159,  177,  169,  141,  483,  165,  122,
-      174,  115,  490,  494,    0,  461,  463,  467,  477,  485,
-      481,  478,  501,  495,  476,  510,  554,  245,  480,  506,
-      490,  512,  509,  504,  517,  534,  497,  545,  551,  533,
-      539,  538,  561,  587,  560,  577,  543,  571,  579,  573,
-      596,  590,  588,  583,  599,  585,  600,  601,  598,  604,
-      611,  621,  623,  602,  349,  630,  645,  625,  634,  641,
-      657,  651,  660,  643,  658,  666,  663,  649,  665,  638,
+      372,  380,  388,  370,  382,  398,  413,  399,  403,  408,
+      409,  410,  414,  260,  415,  437,  426,  436,  412,  445,
+      450,  449,  439,  193,  159,  177,  169,  141,  298,  165,
+      122,  174,  115,  488,  497,    0,  464,  470,  262,  471,
+      485,  477,  484,  480,  505,  498,  435,  509,  553,  513,
+      491,  511,  492,  517,  523,  508,  519,  539,  541,  526,
+      544,  543,  549,  556,  568,  579,  581,  578,  561,  583,
+      588,  601,  602,  592,  597,  584,  607,  594,  609,  618,
+      610,  612,  622,  611,  628,  626,  615,  639,  644,  652,
+      637,  645,  660,  662,  667,  663,  658,  650,  668,  671,
 
-      678,  669,  685,  690,  213,  696,  698,  684,  693,  692,
-      705,  701,  702,  689,  713,  726,  737,  718,  716,  721,
-      733,  743,  729,  735,  740,  753,  748,  745,  765,  741,
-      760,  763,  771,  786,  759,  790,  774,  780,  787,  797,
-      799,  801,  810,  807,  803,  812,  806,  837,  821,  828,
-      834,  809,  814,  824,  830,  838,  846,  863,  854,  908,
-      864,  869,  865,  856,  870,  874,  862,  887,  873,  889,
-      902,  898,  903,  912,  916,  914,  954,  913,  939,  940,
-      934,  960,  938,  945,  943,  949,  959,  969,  973,  970,
-      982,  985,  976,  983,  981,  992,  996,  978, 1002, 1001,
+      681,  679,  678,  673,  694,  674,  701,  709,  213,  711,
+      713,  700,  707,  720,  715,  708,  728,  718,  724,  743,
+      734,  733,  736,  735,  744,  763,  740,  761,  750,  760,
+      770,  766,  762,  759,  773,  777,  781,  790,  808,  778,
+      804,  795,  799,  809,  813,  819,  822,  801,  820,  828,
+      831,  833,  825,  851,  847,  846,  855,  870,  858,  850,
+      849,  857,  873,  876,  888,  928,  878,  877,  880,  889,
+      894,  890,  922,  896,  905,  897,  911,  937,  907,  934,
+      945,  935,  954,  967,  936,  952,  957,  962,  958,  978,
+      970,  963,  971,  983,  986,  995,  987, 1005, 1000,  998,
 
-     1010, 1015, 1012, 1003, 1021, 4681, 1026, 1004, 1028, 1023,
-     1033, 4681, 1037, 1038, 1020, 1041, 1048, 1006, 1044, 1047,
-     1049, 1063, 1051, 1072, 1064, 1060, 1107, 1075, 1076, 1104,
-     1098, 1085, 1110, 1089, 1116, 1103, 1112, 1131, 1102, 1125,
-     1122, 1144, 1136, 1141, 1157, 1130, 1150, 1148, 1151,  899,
-     1158, 1160, 1173, 1152, 1178, 1179, 1169, 1177, 1159, 1192,
-     1205, 1202, 1207, 1213, 1189, 1206, 1208, 1217, 1214, 1215,
-     1201, 1219, 1222, 1209, 1248, 1225, 1237, 1234, 1249, 1240,
-     1253, 1254, 1250, 1261, 1246, 1280, 1269, 1268, 1288, 1294,
-     1267, 1282, 1284, 1299, 1302, 1303, 1314, 1275, 1307, 1310,
+     1007, 1011, 1004, 1020, 1015, 1003, 1019, 1025, 1032, 1038,
+     1035, 1029, 1044, 5006, 1048, 1033, 1053, 1059, 1046, 5006,
+     1062, 1063, 1043, 1060, 1073, 1066, 1095, 1076, 1070, 1077,
+     1075, 1084, 1102, 1096, 1089, 1139, 1097, 1111, 1132, 1130,
+     1116, 1114, 1121, 1148, 1135, 1141, 1143, 1142, 1129, 1166,
+     1170, 1162, 1168, 1180, 1190, 1175, 1173, 1186, 1188, 1194,
+     1189, 1192, 1200, 1197, 1202, 1206, 1238, 1223, 1220, 1235,
+     1213, 1237, 1241, 1246, 1224, 1239, 1249, 1247, 1250, 1243,
+     1240, 1259, 1251, 1255, 1276, 1289, 1267, 1277, 1262, 1283,
+     1294, 1296, 1293, 1286, 1302, 1312, 1318, 1305, 1308, 1306,
 
-     1342, 1318, 1317, 1321, 1331, 1333, 1327, 1332, 1335, 1344,
-     1341, 1343, 1350, 1337, 1348, 1371, 1370, 1373, 1376, 1366,
-     1368, 1377, 1378, 1386, 1389, 1397, 1401, 1392, 1400, 1411,
-     1408, 1416, 1412, 1426, 1404, 1431, 4681, 1445, 1442, 1424,
-     1437, 1448, 1443, 1435, 1484, 4681, 1439, 4681, 4681, 1451,
-     4681, 4681, 1465, 1438, 1473, 1449, 1532, 1475, 1467, 1472,
-     1483, 1490, 1491, 1504, 1499, 1518, 1525, 1510, 1502, 1508,
-     1513, 1537, 1541, 1535, 1542, 1543, 1561, 1562, 1557, 1566,
-     1559, 1565, 1558, 1570, 1574, 1579, 1582, 1586, 1577, 4681,
-     1588, 1584, 1594, 1592, 1609, 4681, 1589, 1600, 1603, 1606,
+     1334, 1326, 1320, 1329, 1335, 1339, 1341, 1348, 1347, 1354,
+     1350, 1373, 1382, 1361, 1352, 1370, 1362, 1365, 1366, 1374,
+     1392, 1375, 1389, 1387, 1393, 1399, 1398, 1412, 1402, 1411,
+     1410, 1414, 1409, 1421, 1420, 1419, 1436, 1440, 1447, 1432,
+     1446, 1449, 1442, 1455, 1459, 1461, 1454, 1489, 1457, 5006,
+     1468, 1474, 1479, 1476, 1488, 1481, 1482, 1530, 5006, 1485,
+     5006, 5006, 1487, 5006, 5006, 1501, 1505, 1493, 1517, 1579,
+     1514, 1518, 1523, 1526, 1533, 1540, 1550, 1528, 1557, 1562,
+     1563, 1569, 1567, 1574, 1592, 1601, 1584, 1585, 1577, 1605,
+     1534, 1544, 1613, 1611, 1614, 1615, 1618, 1626, 1627, 1621,
 
-     1613, 1611, 1619, 1625, 1623, 1630, 1633, 1634, 1637, 1639,
-     1640, 1618, 1667, 1661, 1652, 1660, 1668, 1653, 1676, 1682,
-     1680, 1666, 1678, 1686, 1669, 1685, 1690, 1687, 1693, 1696,
-     1695, 1694, 1744, 1721, 1712, 1705, 1716, 1701, 1723, 1742,
-     1732, 1746, 1757, 1763, 1752, 1754, 1764, 1771, 1774, 1802,
-     1780, 1782, 1788, 1793, 1792, 1798, 1799, 1795, 1740, 1807,
-     4681, 1790, 1815, 1812, 1819, 1838, 1817, 1839, 1830, 1842,
-     1833, 1837, 1841, 1856, 4681, 1835, 1855, 1852, 1866, 1879,
-     1880, 1863, 1860, 1890, 4681, 1895, 1888, 1893, 1882, 1881,
-     1899, 1883, 1898, 1900, 1907, 1917, 1908, 1918, 1912, 1919,
+     1625, 1639, 1628, 5006, 1637, 1648, 1642, 1658, 1650, 1668,
+     5006, 1641, 1667, 1649, 1660, 1666, 1664, 1673, 1677, 1678,
+     1683, 1692, 1676, 1706, 1693, 1700, 1720, 1722, 1717, 1705,
+     1718, 1726, 1715, 1733, 1729, 1732, 1719, 1725, 1747, 1746,
+     1750, 1754, 1740, 1764, 1751, 1745, 1757, 1756, 1801, 1782,
+     1760, 1763, 1765, 1784, 1791, 1794, 1796, 1799, 1815, 1819,
+     1811, 1813, 1829, 1839, 1823, 1847, 1842, 1831, 1850, 1856,
+     1858, 1857, 1852, 1851, 1869, 1867, 1872, 5006, 1875, 1887,
+     1874, 1884, 1899, 1879, 1889, 1900, 1891, 1902, 1892, 1894,
+     1913, 1917, 5006, 1911, 1915, 1926, 1918, 1938, 1942, 1919,
 
-     1935, 1924, 1928, 1916, 1939, 1944, 1945, 1940, 1951, 1946,
-     1941, 1960, 1963, 1955, 1961, 1956, 1972, 1977,  120, 1973,
-     1983, 1974, 1969, 4681,   76, 1981, 1988, 1978, 2010, 2011,
-     2004, 2000, 2012, 2018, 2002, 2005, 2013, 2015, 2033, 2025,
-     2029, 2027, 2045, 2044, 2041, 2050, 2054, 2040, 2056, 2061,
-     2059, 2074, 2063, 2076, 2060, 2083, 2084, 2077, 2075, 2087,
-     2095, 2091, 2085, 2103, 2106, 4681, 2121, 2105, 2112, 2109,
-     2126, 2138, 2118, 2128, 2134, 2132, 2148, 2139, 2146, 2153,
-     2158, 2147, 2155, 2145, 2161, 2164, 2157, 2173, 2183, 2175,
-     4681, 2189, 2180, 2185, 2184, 2187, 2200, 2191, 2211, 2190,
+     1950, 1952, 5006, 1956, 1957, 1959, 1944, 1939, 1953, 1960,
+     1955, 1967, 1970, 1986, 1977, 1989, 1996, 1997, 1980, 2002,
+     1983, 1990, 1988, 1999, 2013, 2016, 2019, 2011, 2020, 2015,
+     2034, 2038, 2029, 2049, 2032, 2036, 2040,  120, 2035, 2046,
+     2041, 2045, 5006,   76, 2061, 2042, 2054, 2087, 2089, 2081,
+     2085, 2077, 2078, 2088, 2079, 2076, 2083, 2080, 2096, 2082,
+     2105, 2104, 2127, 2125, 2122, 2119, 2131, 2117, 2132, 2137,
+     2120, 2138, 2121, 2146, 2136, 2156, 2159, 2168, 2164, 2160,
+     2157, 2162, 2182, 2166, 2165, 2187, 5006, 2186, 2183, 2191,
+     2184, 2189, 2229, 2200, 2216, 2207, 2213, 2232, 2234, 2225,
 
-     2209, 2216, 2221, 4681, 2220, 2232, 2222, 2234, 2219, 2240,
-     2246, 2244, 2225, 2248, 2247, 2249, 2256, 2242, 2259, 2263,
-     4681, 2266, 2267, 2272, 2283, 2276, 2269, 2278, 2291, 2275,
-     2284, 2302, 2281, 2286, 2282, 2313, 2297, 2294, 2305, 2315,
-     2303, 2330, 4681, 2343, 2322, 2328, 2346, 2311, 2341, 2347,
-     2334, 2337, 2333, 2349, 2360, 2353, 2357, 2362, 2361, 2363,
-     2381, 2354, 2372, 2380, 2390, 2396, 2384, 2394, 2398, 2399,
-     2389, 2409, 2404, 2419, 2426, 4681, 2420, 2428, 2421, 2415,
-     2443, 2438, 2425, 2430, 2424, 2437, 2439, 2462, 2440, 2454,
-     2455, 2460, 2461, 2442, 2453, 2477, 2480, 2487, 2471, 2483,
+     2228, 2236, 2239, 2240, 2224, 2223, 2243, 2246, 2249, 2265,
+     2268, 2247, 5006, 2267, 2263, 2261, 2287, 2266, 2270, 2283,
+     2285, 2290, 2275, 2301, 2288, 2319, 5006, 2317, 2316, 2304,
+     2322, 2305, 2324, 2328, 2329, 2314, 2331, 2330, 2332, 2339,
+     2327, 2347, 2335, 5006, 2343, 2372, 2366, 2377, 2367, 2356,
+     2368, 2378, 2361, 2359, 2388, 2387, 2365, 2384, 2373, 2389,
+     2393, 2394, 2404, 2405, 2402, 2421, 5006, 2439, 2415, 2428,
+     2431, 2416, 2442, 2423, 2434, 2437, 2441, 2444, 2454, 2447,
+     2450, 2469, 2457, 2460, 2464, 2461, 2480, 2463, 2488, 2491,
+     2494, 2483, 2502, 2489, 2506, 2487, 2514, 2517, 2521, 2522,
 
-     2476, 2493, 2489, 2495, 2488, 2501, 4681, 2506, 4681, 2504,
-     2512, 2521, 4681, 2525, 4681, 2527, 4681, 2526, 2531, 2515,
-     2516, 2520, 2533, 2522, 2544, 2535, 2545, 2547, 2539, 2559,
-     2548, 2565, 4681, 2558, 2564, 2579, 2561, 2573, 2575, 2582,
-     2594, 2583, 2592, 2587, 2590, 2589, 2607, 4681, 2574, 2614,
-     2606, 2603, 2626, 2628, 2622, 2634, 2630, 2611, 2645, 2641,
-     2646, 2633, 2639, 2649, 2659, 2654, 2660, 2652, 2662, 2666,
-     2663, 2668, 2685, 2670, 2687, 2702, 2681, 2686, 2695, 4681,
-     2690, 2696, 2709, 2704, 4681, 4681, 2680, 2722, 2714, 2708,
-     2728, 2715, 2741, 2729, 2743, 2740, 2739, 2731, 2736, 2746,
+     5006, 2524, 2509, 2525, 2518, 2515, 2547, 2537, 2536, 2539,
+     2541, 2543, 2550, 2544, 2546, 2553, 2557, 2559, 2561, 2560,
+     2564, 2568, 2585, 2589, 2584, 2591, 2607, 5006, 2594, 2598,
+     2596, 2606, 2595, 2608, 5006, 2611, 5006, 2625, 2618, 2635,
+     5006, 2632, 5006, 2639, 5006, 2640, 2646, 2633, 2624, 2636,
+     2653, 2654, 2644, 2641, 2663, 2656, 2668, 2680, 2667, 2660,
+     5006, 2671, 2683, 2681, 2688, 2692, 2694, 2690, 2698, 2700,
+     2696, 2676, 2710, 2704, 2708, 2732, 2727, 5006, 2716, 2735,
+     2726, 2724, 2752, 2746, 2729, 2739, 2742, 2725, 2761, 2772,
+     2775, 2760, 2762, 2763, 2779, 2790, 2769, 2788, 2780, 2789,
 
-     2747, 2751, 2756, 2763, 2758, 4681, 2766, 2764, 2792, 2783,
-     2774, 2796, 2784, 2795, 4681, 4681, 2799, 2787, 2790, 2786,
-     2806, 2802, 2810, 4681, 2816, 2811, 2825, 2834, 2835, 2832,
-     2821, 2831, 2820, 2837, 2838, 2842, 2853, 2848, 2852, 2866,
-     2856, 2871, 2876, 4681, 2873, 2884, 2877, 2880, 2879, 2878,
-     2881, 2886, 2905, 2875, 2904, 2894, 2924, 2907, 2906, 2909,
-     2910, 2915, 2926, 2930, 2942, 2936, 4681, 2944, 2931, 2947,
-     2920, 2948, 2958, 2954, 2965, 2940, 2941, 2953, 2943, 2982,
-     2963, 2992, 2974, 4681, 2986, 2983, 2981, 2990, 2998, 2976,
-     3011, 2988, 3010, 4681, 3013, 3003, 3008, 3020, 3031, 3037,
+     2777, 2798, 2803, 2786, 2797, 2799, 2802, 2808, 2811, 2813,
+     5006, 2827, 2822, 2826, 2835, 2825, 5006, 5006, 2842, 2840,
+     2846, 2849, 2839, 2853, 2870, 2854, 2850, 2856, 2864, 2873,
+     2867, 2874, 2862, 2875, 2894, 2880, 2898, 2904, 2915, 2890,
+     5006, 2902, 2910, 2914, 2912, 2906, 2920, 2921, 2935, 5006,
+     5006, 2932, 2923, 2925, 2930, 2960, 2942, 2946, 5006, 2948,
+     2962, 2967, 2969, 2973, 2970, 2954, 2965, 2982, 2976, 2981,
+     2971, 2999, 2993, 3006, 3001, 2996, 3010, 3018, 3019, 3021,
+     5006, 3015, 3025, 3017, 3026, 3023, 3035, 3039, 3050, 3048,
+     3040, 3046, 3036, 3038, 3051, 3049, 3044, 3069, 3059, 3080,
 
-     3023, 3016, 3029, 3030, 3033, 3040, 3043, 3051, 3050, 3062,
-     3047, 3058, 3069, 3080, 3086, 3085, 3057, 3075, 3094, 3079,
-     3088, 3089, 3073, 3107, 3082, 3109, 3096, 4681, 3114, 3097,
-     3111, 3116, 3115, 3121, 3123, 4681, 3124, 4681, 3118, 4681,
-     3125, 3126, 3113, 3146, 3140, 3142, 3135, 3160, 3150, 3149,
-     4681, 3167, 3153, 3166, 3169, 4681, 3170, 4681, 4681, 3172,
-     3176, 3157, 3180, 3187, 3183, 4681, 3184, 3192, 3199, 3195,
-     3188, 3205, 3208, 3211, 3206, 3210, 4681, 3219, 3226, 3207,
-     3231, 4681, 3215, 3241, 3233, 3238, 3247, 3256, 3257, 3227,
-     3244, 3267, 3268, 4681, 3250, 3252, 3275, 3270, 3278, 3279,
+     3083, 3081, 3093, 3087, 5006, 3096, 3076, 3097, 3073, 3101,
+     3103, 3106, 3122, 3091, 3095, 3099, 3102, 3118, 3105, 3121,
+     3126, 3117, 5006, 3131, 3150, 3142, 3144, 3143, 3129, 3158,
+     3146, 3149, 5006, 3170, 3164, 3160, 3174, 3183, 3184, 3179,
+     3173, 3178, 3191, 3177, 3186, 3197, 3199, 3200, 3208, 3203,
+     3220, 3228, 3221, 3231, 3213, 3224, 3246, 3233, 3249, 3247,
+     3226, 3242, 3248, 3245, 3258, 3251, 3241, 3271, 3255, 3274,
+     3268, 5006, 3283, 3287, 3291, 3292, 3276, 3293, 3289, 3300,
+     3302, 5006, 3303, 5006, 3285, 5006, 3305, 3309, 3314, 3313,
+     3310, 3312, 3321, 3337, 3275, 3329, 5006, 3345, 3332, 3338,
 
-     3271, 3289, 4681, 3294, 3298, 4681, 3291, 3265, 3295, 4681,
-     3307, 4681, 3309, 3305, 3302, 3310, 3323, 3324, 3335, 3322,
-     3339, 3340, 3331, 3348, 3347, 4681, 4681, 3350, 3352, 3356,
-     3349, 3346, 3358, 3353, 4681, 3362, 3373, 3342, 3366, 3389,
-     3377, 3380, 3397, 3398, 3384, 3401, 3383, 3393, 4681, 3391,
-     3400, 3410, 3405, 3413, 4681, 3403, 3432, 3425, 3427, 3430,
-     3444, 3447, 3448, 3436, 3450, 3451, 3437, 3453, 3455, 3454,
-     4681, 3461, 3460, 3465, 3467, 3468, 3463, 3476, 3488, 3485,
-     3472, 3497, 4681, 3498, 3475, 3506, 3496, 3502, 3503, 3492,
-     3509, 3499, 3516, 3512, 3528, 3529, 3526, 3546, 3541, 4681,
+     3344, 5006, 3351, 5006, 5006, 3339, 3348, 3349, 3365, 3359,
+     3361, 3367, 5006, 3372, 3371, 3384, 3374, 3375, 3381, 3388,
+     3392, 3380, 3394, 3397, 5006, 3398, 3411, 3408, 3407, 5006,
+     3415, 3405, 3410, 3423, 3431, 3434, 3440, 3430, 3427, 3450,
+     3444, 5006, 3432, 3438, 3462, 3453, 3461, 3473, 3459, 3480,
+     3458, 3475, 3488, 3474, 3486, 5006, 3489, 3491, 5006, 3479,
+     3485, 3477, 5006, 3497, 5006, 3516, 3511, 3502, 3519, 3531,
+     3524, 3534, 3517, 3535, 3532, 3529, 3540, 3544, 3521, 5006,
+     5006, 3545, 3538, 3550, 3556, 3558, 3555, 3571, 3575, 5006,
+     3553, 3581, 3564, 3574, 3583, 3572, 3577, 3592, 3591, 3579,
 
-     3530, 4681, 3542, 3557, 3556, 3561, 4681, 3544, 3548, 4681,
-     3563, 3569, 3571, 3576, 4681, 3579, 3567, 3594, 3580, 3585,
-     3583, 3603, 4681, 3578, 3597, 3611, 3608, 3596, 3610, 3605,
-     3612, 3619, 3622, 4681, 3618, 3615, 3637, 3640, 3649, 4681,
-     4681, 3635, 4681, 4681, 3650, 4681, 4681, 3652, 3653, 4681,
-     3654, 4681, 3660, 3658, 3655, 3643, 3661, 4681, 3668, 4681,
-     4681, 3664, 3670, 3675, 3678, 3673, 3674, 3690, 3682, 3685,
-     3692, 3695, 3696, 3701, 3691, 3713, 3705, 3698, 3700, 3702,
-     3712, 3723, 3725, 3721, 3739, 3745, 3746, 4681, 4681, 3729,
-     3740, 3732, 3735, 3748, 3741, 3742, 3764, 4681, 3774, 3768,
+     3602, 3585, 3604, 5006, 3601, 3603, 3606, 3605, 3628, 3614,
+     5006, 3609, 3634, 3629, 3630, 3632, 3638, 3643, 3646, 3636,
+     3647, 3648, 3658, 3641, 3677, 3678, 3661, 5006, 3674, 3681,
+     3663, 3683, 3666, 3685, 3686, 3698, 3692, 3675, 3695, 5006,
+     3673, 3688, 3693, 3717, 3708, 3728, 3705, 3732, 3720, 3722,
+     3735, 3711, 3724, 3718, 3738, 3742, 3741, 3744, 3758, 3746,
+     3748, 5006, 3754, 5006, 3767, 3777, 3786, 3782, 5006, 3773,
+     3780, 5006, 3775, 5006, 3790, 3792, 3801, 3795, 5006, 3796,
+     3784, 3805, 3800, 3815, 3807, 3830, 5006, 3832, 3834, 3808,
+     3833, 3820, 3827, 3839, 3824, 3845, 3849, 3846, 5006, 3853,
 
-     3763, 3762, 3775, 3767, 3779, 3786, 3800, 3781, 3782, 3784,
-     3792, 4681, 3795, 4681, 4681, 3796, 3815, 3817, 3806, 3810,
-     4681, 3829, 3813, 3831, 3834, 4681, 4681, 4681, 3835, 3824,
-     3838, 3844, 3845, 3833, 3856, 4681, 3839, 3848, 3862, 3842,
-     3868, 3870, 3882, 3885, 3886, 4681, 4681, 3891, 3884, 3887,
-     3881, 3878, 3894, 3895, 3889, 4681, 3896, 3897, 3898, 3921,
-     3905, 3922, 4681, 3916, 3918, 3917, 3939, 3932, 3940, 3934,
-     3945, 4681, 3937, 3943, 4681, 3947, 4681, 4681, 3933, 3951,
-     3968, 3954, 3955, 3975, 3958, 3970, 3990, 3987, 3985, 4681,
-     4681, 3982, 4681, 4681, 3974, 3994, 3978, 3973, 4008, 4004,
+     3857, 3859, 3866, 3873, 5006, 5006, 3877, 5006, 5006, 5006,
+     3881, 5006, 5006, 3880, 3882, 5006, 3883, 5006, 3891, 3887,
+     3876, 3868, 3889, 5006, 3897, 5006, 3895, 3893, 3898, 5006,
+     3899, 5006, 3901, 3921, 3915, 3922, 3930, 3931, 3932, 3924,
+     3916, 3925, 3933, 3935, 3939, 3926, 3941, 3956, 3943, 3955,
+     3954, 3952, 3963, 3960, 3958, 3979, 3981, 3988, 3989, 5006,
+     5006, 3971, 3982, 3990, 3994, 3992, 4002, 4005, 3998, 5006,
+     3993, 4015, 4003, 4016, 4017, 4018, 4030, 4021, 4033, 4038,
+     4029, 4037, 4034, 4039, 5006, 4049, 5006, 5006, 4050, 4051,
+     4055, 4056, 4057, 5006, 4065, 4072, 4074, 5006, 4085, 4081,
 
-     4005, 3998, 4009, 4012, 4011, 4002, 4010, 4015, 4034, 4025,
-     4026, 4681, 4044, 4681, 4032, 4048, 4052, 4049, 4681, 4051,
-     4053, 4037, 4681, 4681, 4681, 4061, 4068, 4054, 4681, 4077,
-     4075, 4070, 4081, 4076, 4071, 4074, 4100, 4681, 4087, 4090,
-     4107, 4101, 4096, 4097, 4111, 4115, 4103, 4122, 4117, 4125,
-     4126, 4681, 4135, 4121, 4118, 4150, 4151, 4138, 4142, 4139,
-     4155, 4148, 4156, 4145, 4174, 4162, 4171, 4681, 4173, 4166,
-     4681, 4176, 4187, 4194, 4195, 4196, 4197, 4681, 4199, 4681,
-     4203, 4681, 4205, 4206, 4681, 4681, 4200, 4209, 4210, 4681,
-     4213, 4198, 4212, 4229, 4223, 4236, 4681, 4681, 4231, 4234,
+     4088, 4089, 5006, 5006, 5006, 4090, 4082, 4084, 4098, 4101,
+     4086, 4099, 5006, 4095, 4114, 4116, 4108, 4124, 4129, 4140,
+     4133, 4139, 4142, 5006, 5006, 4144, 4141, 4147, 4146, 4134,
+     4150, 4148, 4151, 5006, 4154, 4165, 4173, 4161, 4178, 4188,
+     4182, 5006, 4174, 4175, 4177, 4194, 4190, 4198, 4200, 4201,
+     5006, 4202, 4217, 4192, 5006, 4223, 5006, 4212, 5006, 5006,
+     4216, 4231, 4234, 4240, 4241, 4242, 4227, 4233, 4235, 4246,
+     4244, 5006, 5006, 4243, 4256, 5006, 5006, 4260, 4261, 4262,
+     4259, 4267, 4255, 4265, 4282, 4272, 4294, 4296, 4269, 4293,
+     4283, 4274, 4304, 4299, 4308, 5006, 4311, 5006, 4315, 4302,
 
-     4245, 4681, 4681, 4681, 4248, 4681, 4250, 4681, 4252, 4238,
-     4681, 4239, 4259, 4235, 4255, 4262, 4264, 4280, 4271, 4267,
-     4681, 4288, 4681, 4292, 4681, 4281, 4294, 4681, 4303, 4286,
-     4296, 4287, 4284, 4289, 4681, 4681, 4681, 4314, 4304, 4312,
-     4307, 4317, 4320, 4313, 4322, 4342, 4334, 4341, 4345, 4329,
-     4333, 4359, 4344, 4681, 4351, 4355, 4361, 4363, 4353, 4370,
-     4357, 4365, 4368, 4378, 4385, 4377, 4384, 4394, 4381, 4401,
-     4404, 4408, 4410, 4403, 4411, 4417, 4412, 4405, 4414, 4438,
-     4426, 4430, 4681, 4442, 4429, 4431, 4439, 4453, 4456, 4436,
-     4458, 4463, 4457, 4460, 4449, 4471, 4466, 4485, 4477, 4494,
+     4312, 4323, 4321, 4327, 5006, 4335, 4325, 4320, 5006, 5006,
+     5006, 4346, 4348, 4347, 5006, 4352, 4358, 4350, 4359, 4360,
+     4363, 4362, 4341, 4369, 5006, 4372, 4373, 4382, 4394, 4386,
+     4385, 4383, 4396, 4400, 4390, 4403, 4387, 4411, 4414, 5006,
+     4420, 4415, 4423, 4412, 4418, 4434, 4436, 4425, 4437, 4428,
+     4454, 4445, 4438, 4451, 4441, 4463, 4452, 4466, 5006, 4473,
+     4455, 5006, 4472, 4475, 4481, 4480, 4488, 4491, 4487, 5006,
+     4494, 5006, 4497, 5006, 4495, 4496, 4503, 4501, 5006, 5006,
+     4502, 4509, 4507, 5006, 4515, 4499, 4513, 4519, 4526, 4524,
+     4522, 5006, 5006, 4521, 4550, 4552, 4551, 5006, 5006, 5006,
 
-     4478, 4681, 4498, 4501, 4483, 4488, 4508, 4495, 4512, 4510,
-     4513, 4520, 4516, 4517, 4525, 4681, 4537, 4681, 4681, 4540,
-     4529, 4530, 4546, 4550, 4681, 4681, 4681, 4589, 4596, 4603,
-     4610, 4617,   82, 4624, 4631, 4638, 4645, 4652, 4659, 4666,
-     4673
+     4556, 5006, 4553, 5006, 4546, 5006, 4559, 4548, 5006, 4547,
+     4561, 4564, 4542, 4566, 4568, 4571, 4580, 4577, 4597, 5006,
+     5006, 4599, 5006, 4600, 4601, 5006, 4590, 4604, 5006, 5006,
+     4610, 4595, 4606, 4594, 4607, 4603, 5006, 5006, 5006, 5006,
+     4614, 4615, 4626, 4624, 4629, 4628, 4623, 4634, 4654, 4650,
+     4652, 4653, 4638, 4645, 4668, 4655, 5006, 4673, 4664, 4671,
+     4672, 4675, 4665, 4674, 4680, 4684, 4691, 4695, 4687, 4692,
+     4707, 4690, 4722, 4720, 4721, 4724, 4713, 4717, 4727, 4730,
+     4719, 4736, 4745, 4739, 4747, 5006, 4756, 4743, 4748, 4763,
+     4741, 4766, 4754, 4777, 4779, 4781, 4784, 4782, 4792, 4788,
+
+     4789, 4783, 4794, 4793, 5006, 4809, 4819, 4798, 4808, 4829,
+     4813, 4815, 4836, 4831, 4826, 4838, 4843, 4840, 5006, 4844,
+     5006, 5006, 4845, 4854, 4856, 4852, 4855, 5006, 5006, 5006,
+     4914, 4921, 4928, 4935, 4942,   82, 4949, 4956, 4963, 4970,
+     4977, 4984, 4991, 4998
     } ;
 
-static yyconst flex_int16_t yy_def[1642] =
+static yyconst flex_int16_t yy_def[1745] =
     {   0,
-     1627,    1, 1628, 1628, 1629, 1629, 1630, 1630, 1631, 1631,
-     1632, 1632, 1627, 1633, 1627, 1627, 1627, 1627, 1634, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1635,
-     1627, 1627, 1627, 1635, 1636, 1627, 1627, 1627, 1636, 1637,
-     1627, 1627, 1627, 1627, 1637, 1638, 1627, 1627, 1627, 1638,
-     1639, 1627, 1640, 1627, 1639, 1639, 1633, 1633, 1627, 1641,
-     1634, 1641, 1634, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1730,    1, 1731, 1731, 1732, 1732, 1733, 1733, 1734, 1734,
+     1735, 1735, 1730, 1736, 1730, 1730, 1730, 1730, 1737, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1738,
+     1730, 1730, 1730, 1738, 1739, 1730, 1730, 1730, 1739, 1740,
+     1730, 1730, 1730, 1730, 1740, 1741, 1730, 1730, 1730, 1741,
+     1742, 1730, 1743, 1730, 1742, 1742, 1736, 1736, 1730, 1744,
+     1737, 1744, 1737, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1635, 1635, 1636, 1636, 1637, 1637, 1627, 1638,
-     1638, 1639, 1639, 1640, 1640, 1639, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1639, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1738, 1738, 1739, 1739, 1740, 1740, 1730,
+     1741, 1741, 1742, 1742, 1743, 1743, 1742, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1742, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1639, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1742, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
-     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1639, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1742, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1639, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1627, 1633,
-     1627, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627,
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1742, 1736, 1736, 1736, 1736, 1736, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736,
+     1730, 1730, 1736, 1730, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1639, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736,
+     1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1742, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1627, 1639, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1730, 1742, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1633,
-     1633, 1633, 1627, 1633, 1627, 1633, 1627, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627,
-     1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736,
+     1736, 1736, 1736, 1736, 1730, 1736, 1730, 1736, 1736, 1736,
+     1730, 1736, 1730, 1736, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1730, 1736, 1736, 1736, 1736, 1736, 1730, 1730, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730,
+     1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1633, 1627,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1627, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1627, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633,
-     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1730, 1736, 1730, 1736, 1730, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736,
 
-     1633, 1633, 1627, 1633, 1633, 1627, 1633, 1633, 1633, 1627,
-     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633,
-     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627,
+     1736, 1730, 1736, 1730, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736, 1730, 1736,
+     1736, 1736, 1730, 1736, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730,
+     1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
 
-     1633, 1627, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1627,
-     1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1627,
-     1627, 1633, 1627, 1627, 1633, 1627, 1627, 1633, 1633, 1627,
-     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627,
-     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1627, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
+     1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736,
+     1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1730, 1736, 1730, 1736, 1736, 1736, 1736, 1730, 1736,
+     1736, 1730, 1736, 1730, 1736, 1736, 1736, 1736, 1730, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1627, 1633, 1627, 1627, 1633, 1633, 1633, 1633, 1633,
-     1627, 1633, 1633, 1633, 1633, 1627, 1627, 1627, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633,
-     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1627, 1633, 1633, 1627, 1633, 1627, 1627, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627,
-     1627, 1633, 1627, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1736, 1730, 1730, 1736, 1730, 1730, 1730,
+     1736, 1730, 1730, 1736, 1736, 1730, 1736, 1730, 1736, 1736,
+     1736, 1736, 1736, 1730, 1736, 1730, 1736, 1736, 1736, 1730,
+     1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730,
+     1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1730, 1736, 1730, 1730, 1736, 1736,
+     1736, 1736, 1736, 1730, 1736, 1736, 1736, 1730, 1736, 1736,
 
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1627, 1633, 1627, 1633, 1633, 1633, 1633, 1627, 1633,
-     1633, 1633, 1627, 1627, 1627, 1633, 1633, 1633, 1627, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1633,
-     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627,
-     1633, 1627, 1633, 1633, 1627, 1627, 1633, 1633, 1633, 1627,
-     1633, 1633, 1633, 1633, 1633, 1633, 1627, 1627, 1633, 1633,
+     1736, 1736, 1730, 1730, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1730, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1730, 1736, 1736, 1736, 1730, 1736, 1730, 1736, 1730, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1730, 1730, 1736, 1736, 1730, 1730, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1730, 1736, 1730, 1736, 1736,
 
-     1633, 1627, 1627, 1627, 1633, 1627, 1633, 1627, 1633, 1633,
-     1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1627, 1633, 1627, 1633, 1627, 1633, 1633, 1627, 1633, 1633,
-     1633, 1633, 1633, 1633, 1627, 1627, 1627, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
+     1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736, 1730, 1730,
+     1730, 1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736,
+     1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730,
+     1736, 1730, 1736, 1730, 1736, 1736, 1736, 1736, 1730, 1730,
+     1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1730, 1730, 1736, 1736, 1736, 1736, 1730, 1730, 1730,
 
-     1633, 1627, 1633, 1633, 1633, 1633, 1633, 1633, 1633, 1633,
-     1633, 1633, 1633, 1633, 1633, 1627, 1633, 1627, 1627, 1633,
-     1633, 1633, 1633, 1633, 1627, 1627,    0, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627
+     1736, 1730, 1736, 1730, 1736, 1730, 1736, 1736, 1730, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730,
+     1730, 1736, 1730, 1736, 1736, 1730, 1736, 1736, 1730, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1730, 1730, 1730, 1730,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736,
+
+     1736, 1736, 1736, 1736, 1730, 1736, 1736, 1736, 1736, 1736,
+     1736, 1736, 1736, 1736, 1736, 1736, 1736, 1736, 1730, 1736,
+     1730, 1730, 1736, 1736, 1736, 1736, 1736, 1730, 1730,    0,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730
     } ;
 
-static yyconst flex_int16_t yy_nxt[4747] =
+static yyconst flex_int16_t yy_nxt[5072] =
     {   0,
        14,   15,   16,   17,   18,   19,   18,   14,   14,   14,
        14,   18,   20,   14,   21,   22,   23,   24,   14,   25,
@@ -979,522 +1012,558 @@ static yyconst flex_int16_t yy_nxt[4747] =
        38,   14,   14,   14,   14,   41,   42,   43,   41,   42,
        43,   46,   47,   46,   47,   48,   87,   48,   51,   52,
        53,   54,   67,   18,   51,   52,   53,   54,   68,   18,
-       57,   58,   59,   57,   58,   59,   69,  123,  123,  125,
+       57,   58,   59,   57,   58,   59,   69,  124,  124,  126,
 
-       70,   44,  125,   87,   44,  130,  130,   49,   72,   49,
-       72,   72,   69,   72,  133,   55,   70,   67,   72,   67,
-       67,   55,   67,   85,   74,   75,   60,   67,  725,   60,
+       70,   44,  126,   87,   44,  131,  131,   49,   72,   49,
+       72,   72,   69,   72,  134,   55,   70,   67,   72,   67,
+       67,   55,   67,   85,   74,   75,   60,   67,  748,   60,
        15,   16,   17,   62,   63,   64,   15,   16,   17,   62,
        63,   64,   76,   86,   94,   73,   68,   96,   68,   65,
-       85,   74,   75,  133,   77,   65,   68,   88,   68,   68,
-      131,   78,  123,  123,   95,   89,  129,   66,   79,   76,
-       86,   94,  125,   66,   96,  125,   65,  130,  130,  128,
-       68,   77,   65,   68,   88,  138,   68,   90,   78,  119,
-       91,   95,   89,   97,  120,   79,   80,   92,  104,   93,
+       85,   74,   75,  134,   77,   65,   68,   88,   68,   68,
+      132,   78,  124,  124,   95,   89,  130,   66,   79,   76,
+       86,   94,  126,   66,   96,  126,   65,  131,  131,  129,
+       68,   77,   65,   68,   88,  139,   68,   90,   78,  120,
+       91,   95,   89,   97,  121,   79,   80,   92,  104,   93,
 
        81,   98,   68,   82,   68,   83,   84,   99,   68,  101,
-       68,  100,  138,  102,   90,  126,  119,   91,   68,   68,
-       97,  120,  274,   80,   92,  104,   93,   81,   98,  103,
-       82,  153,   83,   84,   99,   68,  101,  105,  100,  109,
-      102,  124,  116,  106,  117,  127,  107,  127,  127,  110,
-      127,   68,  111,  108,   68,   68,  103,  212,  153,  118,
-       72,   68,   72,   72,  105,   72,  109,  112,   68,  116,
-      106,  117,  136,  107,  121,   68,  110,  113,  122,  111,
-      108,  114,  115,   68,  212,  133,  118,  133,  132,   68,
-      132,  132,  131,  132,  112,  129,  139,  135,  137,  136,
+       68,  100,  139,  102,   90,  127,  120,   91,   68,   68,
+       97,  121,  281,   80,   92,  104,   93,   81,   98,  103,
+       82,  125,   83,   84,   99,   68,  101,  105,  100,  128,
+      102,  128,  128,  106,  128,  109,  107,   68,  117,  110,
+      118,   68,  134,  108,  132,   68,  103,  161,  133,  111,
+      133,  133,  112,  133,  105,  119,  130,  185,  113,  199,
+      106,   68,  109,  107,   68,  117,  110,  118,  114,  138,
+      108,  122,  115,  116,  137,  123,  111,  129,   68,  112,
+       68,   72,  119,   72,   72,  113,   72,  134,   68,  128,
 
-       68,  121,  140,   68,  113,  122,  145,  128,  114,  115,
-       67,   68,   67,   67,   72,   67,   72,   72,  141,   72,
-       67,  142,   68,  139,   72,  137,   68,   68,  143,  140,
-      144,  149,  146,  145,   68,  147,  126,  151,  152,   68,
-       68,  154,  150,   68,   68,  141,   68,   68,  142,   68,
-      124,   73,  148,  156,  155,  143,  157,  144,  149,  146,
-      159,  167,  252,   68,  151,  152,   68,   68,  154,  150,
-      158,  163,  161,  165,  160,  164,   68,   68,   68,  148,
-      156,  155,   68,  157,   68,  168,  170,   68,  167,  252,
-      166,   68,  162,  169,   68,   68,  171,  158,  163,  161,
+       68,  128,  128,   68,  128,  114,  138,   68,  122,  115,
+      116,  137,  123,   67,  140,   67,   67,   72,   67,   72,
+       72,   68,   72,   67,  141,  143,  144,   72,  136,  145,
+      147,  146,  149,  127,   68,   68,  125,  142,  148,   68,
+       68,  140,  151,  152,   68,  156,   68,   68,   68,  150,
+       68,  141,  143,  144,   73,   68,  145,  147,  146,  153,
+      155,  157,  154,   68,  142,  148,  168,   68,   68,  151,
+      152,   68,  156,  162,   68,  158,  150, 1730,  159,   68,
+      169,   68,  167,   68,  163,   68,  153,  155,  157,  154,
+      165, 1730,  160,  168,  166,  170,  171,  175,  172,   68,
 
-      165,  160,  164,   68,  172,   68,   68,   68,  182,  173,
-       68,   68,  168,  170,  177,  174,  178,  166,  175,  162,
-      169,   68,  176,  171,   68,  179,  180, 1627, 1627,  181,
-       68,  172,   68,  183,   68,  184,  173,   68,   68,   68,
-       68,  177,  174,  178,  189,  175,  187, 1627,   68,  176,
-      186,  192,  179,  180,  191,  185,  181,   68,  188,   68,
-      183,   68,  184,  193,   68,  190,   68, 1627, 1627,   68,
-     1627,  189,   68,  187,  196,  194,   68,  186,  192,  195,
-     1627,  191,  185,  204,  127,  188,  127,  127, 1627,  127,
-      193,  132,  190,  132,  132,   72,  132,   72,   72,  133,
+      162,  174,  158,   68,  164,  159,   68,  169,   68,  167,
+       68,  163,  173, 1730,   68,   68, 1730,  165,   68,  160,
+       68,  166,  170,  171,  175,  172,   68,  176,  174,  177,
+      179,  164,  181,  178,  180,  182,   68,   68,  186,  173,
+      183,   68,  208,  184,  191, 1730,   68,   68,   68,  187,
+       68,   68,   68,   68,  176,  189,  177,  179,  192,  181,
+      178,  180,  182,  190,   68,  186,  194,  183,  196,  188,
+      184,  191,  195,   68,   68,   68,  187,   68,  197,  193,
+     1730, 1730,  189,   68, 1730,  192,  198,   68,   68,  133,
+      190,  133,  133,  194,  133,  196,  188,  200,   72,  195,
 
-       72,   68,  194,  197,  198,   68,  195,  199,  201,  200,
-      213,  203, 1627,  202,   68,   68,   68, 1627,   68,   68,
-      205, 1627,  214,   68,  215,  217,  222,  216,   68,  218,
-      197,  198,  135,   68,  199,   68,  200,  213,  203,   68,
-      202,  206,   68,  219,   68,  227, 1627,   68,   68,  214,
-       68,  215,  217,  222,  216,   68,  218,  220, 1627, 1627,
-      221,  223, 1627,  224,  225, 1627,  226,  231,  206,  207,
-      219,   68,   68,  228,  208,  233,   68,   68,  234,  209,
-      236,   68, 1627,   68,  220,  210,  211,  221,  223,   68,
-      224,  225,   68,  226,  229,  235,  207,  232,   68,   68,
+       72,   72,  134,   72,  201,  197,  193,  202,   68,   68,
+      203,  204,  205,  198,  207,   68, 1730,  206,   68,  209,
+     1730,  217,   68,   68,  200,  216,  219,  218, 1730,   68,
+       68,  201,  220,  222,  202,  136,   68,  203,  204,  221,
+      210,  207,  227,   68,  206,  223,   68,   68,  217,   68,
+     1730,   68,  216,  219,  218,   68,  228,   68, 1730,  220,
+      222,   68,  224,  232,   68,  225,  221,  210,  211,  227,
+      226, 1730,  223,  212,  230,  229,  231,   68,  213,   68,
+      233,   68,   68,  228,  214,  215,  234,   68,  236,  224,
+      239,   68,  225,  238,   68,  211,  235,  226,  237,   68,
 
-      228,  208,  233,  237,  230,  239,  209, 1627,  238,   68,
-     1627,   68,  210,  211,  240,   68,  241,   68,  242,  243,
-      246,   68,  235,   68,  232,   68,   68,  244,   68,  245,
-      250,  230,  239,  251,   68,  238,   68,   68,   68,   68,
-       68,  240,   68,  241,  247,  242,  243,  246,  253,   68,
-      248,  249,  254,  257,  244,  255,  245,  256,  260,   68,
-      251,   68, 1627,   68,  258,  267,  263,  269,   68, 1627,
-      266,  247,   68,  261, 1627,  253,   68,  248,  249,   68,
-      257,  133,  255,   68,  256,  265,  259,   68,  264,   68,
-      262,  268,  267,  263,  269,   68,   68,  270,   68,  272,
+      212,  230,  229,  231,  240,  213,   68,  233,  241,  242,
+      243,  214,  215, 1730,  244,  245,   68,   68, 1730,   68,
+      238,   68,   68,  235,  246,  237,   68,  247,  248, 1730,
+       68,  240,   68,  256,  249,   68,  250,  243,  252,   68,
+       68,  244,  245,  251,  253,   68,  257,   68,   68,   68,
+       68,  246,  258,   68,  247,  248,   68,  254,  255,  260,
+       68,  249,  259,  250,   68,  252,   68,  261,  262,  264,
+      251,  253,  263,  257,  266,   68,  267,   68,  272,  258,
+      270,  269,   68,   68,  254,  255,  274,  271,   68,  259,
+       68,  265, 1730,  268,  261,  262,  134,  273,   68,  263,
 
-      261,   68,  273,   68,   68,  271,  279,   68,  275,  282,
-      276,  277,  265,  259,  283,  264,   68,  262,  268,  278,
-      280,  281,   68,   68,  270,  284,  272,   68,   68,  273,
-       68,   68,  271,  279,   68,  275,   68,  276,  277,   68,
-       68,  283,  285,   68,  286,  288,  278,  280,  281,  287,
-      293,   68,  284,  289,   68,  291,   68,  290,  292,   68,
-      295,  300,  296,  294,   68, 1627, 1627,   68,  297,  285,
-      306,   68,  288,   68, 1627,   68,  287,  293,   68,   68,
-      289,   68,  291,   68,  290,  292,   68,  302,  300,  296,
-      294,   68,  301,  298,  303,  297,  299,   68,   68,  304,
+       68,   68,  276,  267,  275,   68,   68,  270,  269,   68,
+      278,   68,   68,  277,  271,  279,   68,   68,  265,   68,
+      268,  280, 1730,  282,  273,  283, 1730,  284,  288,  276,
+      287,  275,   68,  285,  286,  289,  291,  278,   68,   68,
+      277,  293,  279,  290, 1730,   68,   68,   68,  280,   68,
+      282,   68,  283,   68,  284,  288,   68,  287,   68,  292,
+      285,  286,   68,  291,  294,  295,   68,  296,  297,  299,
+      290,   68,   68,   68,   68,  298,  300,  303,   68,  301,
+      304,   68,   68,  302, 1730,  305,  292,  306,   68,  314,
+      307,  294,  295,  308,  296,  297,  299,   68,   68,   68,
 
-      305,   68,  308,   68,  307,  309,  310,  311,  312,   68,
-      317, 1627,   68,  314,  302,  313,  327, 1627,   68,  301,
-      298,  303,  319,  299,   68,   68,  304,  305,   68,  308,
-      328,  307,  309,  310,  311,   68,  315,   68,  316,   68,
-      314,   68,  313,  318,   68,   68,  322,   68,   68,  319,
-       68,  320,   68,  321,  326,  323,  329,  328,  324,   68,
-      325,  330,   68,  315,  331,  316,   68, 1627,   68,  349,
-      318,  332,   68,  322, 1627,   68,   68,  333,  320,  335,
-      321,  326,  323,  329,   68,  324,  346,  325,  330,  344,
-      343,  331,   68,  334,   68, 1627,  347,  345,  332,  351,
+       68,   68,  298,  300,   68,  310,  301,  304,   68,  309,
+      302,   68,  305,  311,  306,   68,   68,  307,  315,   68,
+      308,  312,  313,  316,  320,  318,  317,  323,   68,  319,
+     1730, 1730,  310,   68,  322,  321,  309,   68,  326,   68,
+      311,  328,   68,  324, 1730,  315,   68,   68,  312,  313,
+      316,   68,  318,  317,  323, 1730,  319,   68,   68,  325,
+       68,  322,  321,   68,  327,  329,   68,  330,  328,   68,
+      324,   68,  331,  332,  337,  335,  333,  336,  334, 1730,
+      339, 1730,  338,  340,   68,   68,  325,   68,   68,   68,
+      342,  327,  329,   68,  330,   68,   68,  353,  341,  331,
 
-       68,   68,   68,  133,  333,  348,  335,   68,   68,  353,
-      437,   68,   68,  346, 1627,  352,  344,  343,  350,  356,
-      334,  336,  337,  347,  345,   68,  351,   68,  355,  354,
-      358,  338,  348,  339,  340,  341,   68,   68,  342, 1627,
-       68,   68,  352,  357,  361,  350,   68, 1627,  336,  337,
-       68,   68,   68,  366,   68,  355,  354,  358,  338,  364,
-      339,  340,  341,  359,  360,  342,  362,  363,  368,  369,
-      357,  361,   68,  365,  367, 1627,   68,   68,   68,  371,
-      366,   68,  370,   68, 1627,  372,  364,   68,  373,  375,
-      374,  377,   68,  362,  363,  368,  369,   68,   68,  378,
+      332,  337,  335,  333,  352,  334,  343,  339,   68,  338,
+      340,   68,  354,  344,   68,   68,   68,  342,  134,  355,
+      356,  357, 1730,  361,  353,  341,   68,   68,   68,  358,
+      359,  352,   68,  343,   68,   68,  360,  362,  364,  354,
+      344,  345,  346,   68,  363,   68,  355,  356,  357,   68,
+      361,  347,  366,  348,  349,  350, 1730,  359,  351,  365,
+       68, 1730,  367,  360,  362,  364,   68,  371,  345,  346,
+      368,  375,   68,   68,   68,   68,  369,  370,  347,  372,
+      348,  349,  350,   68,  373,  351,  365,  374,  378,  367,
+       68,  379,   68,  376,  371,   68,   68,  368,  375,  377,
 
-      365,  367,  376,  381,  380,  379,  371,   68,   68,  370,
-      382,   68,  372,  400,   68,  373,   68,  374,  377,   68,
-       68,   68,  383,   68,  384,  385,  378,  386,  387,  376,
-       68,  380,  379,  389,   68,  388,  391,  382,  390,   68,
-       68,   68,   68,  393,   68,  397, 1627,  392,   68,  383,
-       68,  384,  385,   68,  386,  387,  394,  398,   68,   68,
-      389,   68,  388,  391,   68,  390,   68,  399,  395,  396,
-      393,   68,  397,  401,  392,   68,   68,  405,  404,   68,
-      402,  403,   68,  394,  398,   68,   68,   68,  406,   68,
-      408,  407, 1627, 1627,  399,  395,  396, 1627,   68, 1627,
+       68,   68,  382,  381,  380,   68,  372,  384,   68,   68,
+      383,  373,  385,  387,  374,  378,   68,  386,  379,  388,
+      376,   68,  392, 1730,   68,   68,  377,  389,  390,  382,
+      381,  380,  391,   68,  384,  393,   68,  383,   68,  394,
+      387,   68,   68,   68,  386,   68,  388,  396,  395,   68,
+      397,  398, 1730,   68,  389,  390,  400,   68,   68,  391,
+      401,  399,  393,   68, 1730,  402,  394,   68,  408,  405,
+       68,   68,  403,   68,  396,  395,   68,  397,  398,  404,
+      409,   68,   68,  400,   68,  411,   68,  401,  399,  410,
+      416,   68,  402,  406,  407,  408,  405,   68,   68,  403,
 
-      401,   68,   68,  415,  405,  404,  414,  402,  403, 1627,
-       68,  416,  418,   68,   68,  406,  419,  408,  407,  409,
-      417, 1627,  420,   68,  410,  421,  411,   68,  422,  423,
-      415, 1627,  426,  414,  412,  424,   68,  433,  428,  418,
-       68,   68,   68,  419,  413,   68,  409,  417,   68,  420,
-       68,  410,  421,  411,   68,  422,  423,  425,  427,  426,
-       68,  412,  424,   68,  429,  428,  430,  431,   68,   68,
-      448,  413,  432,  434,   68,  436,  445,  435,  441,   68,
-      446,  438,   68,  439,  425,  427,   68,  440,   68,   68,
-       68,  429,  442,  430,  431,  133,   68,   68,   68,  432,
+       68,   68,  412,  414,   68,  413,  404,  409,   68,  415,
+      417,   68,  411,   68,   68,   68,  410,  416,  418,  420,
+      406,  407,   68,  419, 1730, 1730,  432,   68,  426, 1730,
+      414, 1730,  413,   68,   68,   68,  415,  417,  427,  428,
+       68, 1730, 1730, 1730,  430,  418,  420,  431,  429,   68,
+      419,  421,   68,  432,   68,  426,  422,  433,  423,   68,
+      434,  435,  439, 1730,  436,  427,  424,   68,   68,  437,
+       68,  430,  438,   68,  431,  429,  425,   68,  421,   68,
+       68,   68,  440,  422,  433,  423,   68,  434,  435,  439,
+      441,  436,  442,  424,  443,  444,  437,  445,  446,  438,
 
-      434,  447,  436,  449,  435,  441,  443,   68,  438,  444,
-      439,   68,  450,  451,  440,   68,   68,   68,  452,  442,
-      453,  454,  455,  456,  457, 1627,  461,   68,  447,  458,
-       68,  459,  460,  443,  463, 1627,  444,  467,  462,   68,
-       68,  469, 1627,   68,   68,   68,   68,   68,  454,  455,
-      456,   68,   68,   68,  471,   68,  458,   68,  459,  460,
-       68,  463,  464,   68,  467,  462,  468,  465,  472,  470,
-      474,  466,   68,  477,  475,   68,  479,  476,   68, 1627,
-     1627,  471,  491,  483,   68,  480,   68,   68,   68,  464,
-      473,   68,   68,  468,  465,  472,  470,  474,  466,   68,
+       68, 1730,  447,  425,   68,  450,   68,  449,   68,  440,
+      448,   68,  451,   68,  453,  452,  455,  441,  134,  442,
+      463,  443,  444,  454,   68,  446,   68,   68,   68,  447,
+       68,  461,   68,  456,  449,   68,  457,  448,   68,  451,
+       68,  453,  452,  455,   68,  458,  462,  460,  464,  459,
+      454,   68,  465,  466,  470,  468,  467, 1730,   68,  472,
+      456,   68,   68,  457,  469,  471,  474,  475, 1730,  483,
+     1730,  473, 1730,   68,  460,   68,   68,   68,   68,   68,
+      476,   68,  468,  467,   68,   68,  472,   68,   68,   68,
+      477,  469,  471,   68,  475,  478,  481,   68,  473,  479,
 
-      477,  475,  481,  478,  476,   68,   68,   68,  482,  485,
-      483,  484,  480,   68, 1627,  486,  487,  473,   68,  488,
-       68,  489,   68, 1627,  493,  490,   68,  492, 1627,  481,
-      478,  497,   68, 1627,  499,  482,  485,   68,  484,  494,
-       68,   68,  486,  487,  509,   68,  488,  498,   68,  495,
-      504,  493,   68,  496,  492,   68,   68,  502,  497,   68,
-      500,  499,  501,  503,  505,   68,  494,  506, 1627,   68,
-       68,   68,  507,   68,  498,   68,  508,  504,  510,   68,
-       68,   68,   68,  511,  502,  512,   68,  500,   68,  501,
-      503,  505,  514,  515,  506,  513,  518, 1627,  516,  507,
+       68,  480,  482,  484, 1730,   68, 1730,  476,  485,  488,
+      489,  486,  493, 1730,   68,   68, 1730,  477,  490, 1730,
+      495,   68,  478,  481,   68,  494,  479,   68,  480,  482,
+      484,   68,   68,  487,   68,  485,  488,  489,  486,  491,
+       68,  492,  497,   68,   68,  490,   68,  495,  496,  498,
+       68,  500,  494,  501,  499,  503,   68,  502,   68,  504,
+      487,  506, 1730, 1730,   68, 1730,  491,   68,  492,  497,
+      507,  505,   68,   68,  512,  496,  498,   68,  500,   68,
+      501,  499,  513,  514,  502,   68,   68,  508,   68,  510,
+       68,  515,   68,  511,  516,  520,  517,  507,  505,   68,
 
-     1627,  517,  519,  508,   68,  510,   68,  520,   68,   68,
-      511,   68,  512,  521,   68,   68,   68,  522,  524,  514,
-      515,  523,  513,  518,   68,  516,  528,   68,  517,  519,
-       68,  525,  527,  526,  520,   68,  530, 1627,   68,   68,
-      521,  529,   68,  531,  522,  524,   68,  535,  523,   68,
-       68,  532,  533,  528,  133,  548,  550,  534,  525,  527,
-      526, 1627,   68,  530,   68,  545,  536,  537,  529,   68,
-      531,  539,  538,   68,  535,   68,   68,   68,  532,  546,
-       68,   68,  548,   68,  534,  547,   68,   68,  549,   68,
-     1627,  557,  545,  536,  537, 1627,  558,  560,  539,  538,
+       68,  512,  509,   68,   68,  518,  524,  519,   68,  513,
+      514,   68,   68,   68,  508,  521,  522,  527,  515,  523,
+       68,  516,  520,  517,  526,   68,  529,   68,  525,  509,
+       68,   68,  518,  528,  519,  534,   68,   68,  533,  531,
+       68,  530,  521,  522,  527,  532,  523,   68,   68,   68,
+       68,  526,   68,  529,  535,  525,  536,   68,   68,   68,
+      528,  538,  534,  537,  539,  533,  531,  541,  530,  540,
+       68,  542,  532,  543,   68,  549,  544,  548,   68, 1730,
+       68,  535, 1730,  536,   68,   68,  545,   68,  538,  550,
+      537,  539,   68,  134,  541,   68,  540,   68,  542,   68,
 
-      540,  561, 1627,   68,  541,   68,  546,  542,  559,  562,
-       68,   68,  547,   68,  543,  549,  563,  544,  557, 1627,
-     1627,   68,   68,  558,  560,  564,  567,  540,   68,   68,
-      565,  541,  570,  568,  542,  559,  562,   68,  569,  566,
-       68,  543,   68,  563,  544,  551,   68,  552,   68,  571,
-      553,   68,  564,  567,  575,  554,   68,  565,  574,  570,
-      568,  555,  556,   68,  573,  569,  566,  572,  576,  577,
-       68,  578,  551,   68,  552,   68,  571,  553,  580,   68,
-       68,   68,  554,  579,  581,  574,  583,  582,  555,  556,
-      585,  573,  584,  587,  572,   68,   68,   68,  578,   68,
+      543,  546,  551,  544,  548,  552,   68,  553,  565,  547,
+      554,  561,   68,  545,   68,  562,  550,   68,  555,   68,
+       68,  563,  564,   68,  566,   68,   68,   68,  546,  551,
+      574,   68,  552, 1730,  553,  565,  547,  554,  561,   68,
+      577,  594,  562,   68,  578,  555,  556,  575,  563,  564,
+      557,  595,   68,  558,  581,   68,   68,  574,  579,  576,
+      559,   68,  580,  560,   68, 1730,   68,  577,   68,  582,
+     1730,   68,   68,  556,  575, 1730,  583,  557,   68,  584,
+      558,  581,   68, 1730, 1730,  579,  576,  559,   68,  580,
+      560,  567,  568,  592,  569,   68,  582,  570,  586,  585,
 
-       68,  586,  589,   68,   68,  580,  591,  588,   68,  590,
-      579,  581,   68,  583,  582,   68,  596,   68,  592,  584,
-       68,  595,   68,  593,   68,  610,   68,   68,  586,  589,
-       68,  594,   68,  591,  588,  597,  590,  598,   68,  601,
-      602,   68,  600,  596,   68,  592,  599,   68,  595,   68,
-      593,   68,  603,  605,  607, 1627,   68,   68,  594,  606,
-      604,   68,  597,   68,  598,  609,  601,  602,   68,  600,
-      608,   68,   68,  599,  611,   68,  612,   68,   68,  603,
-      605,  607,  613,  614,  615,  616,  606,  604,  617,  618,
-       68,   68,  609,  622,  619,  620,  624,  608,   68,   68,
+       68,   68,  571,  583,  587,   68,  584,   68,  572,  573,
+      590,  588,   68,  589,  591,   68,  593,   68,  567,  568,
+      592,  569,   68,   68,  570,  586,  585,  596,  597,  571,
+       68,  587,  603,  598,  599,  572,  573,  590,  588,   68,
+      589,  591,  601,   68,  604,  602,  605,  600, 1730,   68,
+     1730,   68,   68,   68,  596,  597,   68,  607,  606,   68,
+      598,  599,  608,   68,   68,   68,   68,  609, 1730,  601,
+      610,  604,  602,  614,  600,   68,  611,   68, 1730,   68,
+       68,  616,  612,  615,  607,  606,   68,   68,   68,  608,
+      613,  617,  621,  620,  609,  619,   68,  610,   68,  618,
 
-      623,  625,  621,  612,   68,   68,   68,   68,  627,  613,
-      614,  615,  616,  626,   68,  617,   68,  641,   68,  630,
-       68,  619,  620,   68,   68,   68,  628,  623,  133,  621,
-      629,   68,   68,   68,   68,  627,  637, 1627,  638,   68,
-      626,  639,  640,   68,  641, 1627,  630,  644,  642, 1627,
-       68,  666, 1627,  628,   68, 1627, 1627,  629,  631,   68,
-      632,   68, 1627,  637,  633,  638,  634,  643,  639,  640,
-       68,  635,  645,  646,  644,  642,  636,  649,   68,  648,
-       68,  653,   68,  647,   68,  631,  650,  632,  652,  651,
-       68,  633,   68,  634,  643,   68,  658,  668,  635,  645,
+      614,  625,   68,  611,   68,   68,   68,  622,  616,  612,
+      615,   68,  624,  623,   68,   68,   68,  613,  617,  621,
+      620,   68,  619,  626,  627,  628,  618,  629,  625,  630,
+       68,   68,  631, 1730,  622,  632,  637, 1730,   68,  624,
+      623,  633,  634,   68,   68,  636,  638,  635,  639,  640,
+      626,  627,  628,   68,  641,   68,   68,   68,   68,  631,
+       68,  643,  632,   68,   68,  644,  645,   68,  633,  634,
+       68,   68,  636,  638,  635,  639,  640,  642,   68,  646,
+      648,  647,  649,   68,   68,   68,  658,  650,   68,   68,
+     1730,  660,  134,  645,   68,   68, 1730,  657,   68,  659,
 
-      646,   68,   68,  636,  649,  661,  648,  659,  662,   68,
-      647,  660,   68,  650,  654,  652,  651,  663,   68,  655,
-       68,  656,  667,  658,  664,  665,   68, 1627,   68,  669,
-       68,   68,  661,   68,  659,  662,   68,   68,  660,  657,
-       68,  654,  670,  671,  663,   68,  655,  673,  656,  667,
-       68,  664,  665,   68,  672,   68,  669,   68,  676,  674,
-      675,  679,  678,  680,  677,  681,  657, 1627,   68,  670,
-      671,   68,  688,   68,  673,   68,   68,   68,  683,   68,
-       68,  672,  684,  687,  682,  676,  674,  675,  679,  678,
-       68,  677,  681,   68,   68,  685,  686,  689,   68,  688,
+      661,   68,   68,   68,  642, 1730,  646,  648,  647,  649,
+     1730,  664, 1730,  658,  650,  651,  662,  652,  660,  663,
+       68,  653,   68,  654,  657,  665,  659,  661,  655,   68,
+      673,  666,   68,  656,   68,  668,  669,   68,  664,   68,
+     1730,  667,  651,  662,  652,  670,  663,  679,  653,   68,
+      654,   68,  665,   68,  671,  655,  672,   68,  666,  674,
+      656,   68,  668,  669,  675,  678,  676,   68,  667,   68,
+      682,  684,  670,  683,  679,  680,  685,   68,  687,  681,
+       68,  671,  689,  672,  677,   68,  674,  688,   68,   68,
+       68,  675,  678,  676,   68,   68,   68,  682,  684,  686,
 
-      692,   68,  690,  693,   68,  683,  691,  694,  695,  684,
-      687,  682,  696,  697,  699,  698,  700,   68,   68,   68,
-       68,   68,  685,  686,  701,  703,   68,  692,   68,  704,
-      693,   68,  705,   68,  694,  695,   68,   68,   68,  696,
-      697,  699,  698,  700,  702,   68,   68,  710,  706,  707,
-       68,  701,  703,  708,   68,   68,   68,   68,  709,  705,
-      712,  713,   68,  711,  717,  715,   68,  718,  716,  714,
-      719,  702,  721,   68,  710,  706,  707,   68,   68,   68,
-      708,  720,   68,   68,   68,  709,  722,  712,  713,   68,
-      711,  717,  715,   68,   68,  716,  714,  723,   68,   68,
+      683,  690,  680,  685,  691,   68,  681,   68,  692,  694,
+       68,  677,   68,   68,  688,  693,  695,   68,  698,  700,
+      696,  697,   68,  699,  702,   68,  686,   68,  690,   68,
+       68,  691,   68,  701,  706,  692,  694,   68,   68,  709,
+       68,  703,  693,  695,  704,  698,  700,  696,  697,   68,
+      699,   68,  705,   68,  707,   68,   68,   68,  708,  711,
+      701,  706,  710,  712,   68,  718,  709,  713,  703,  714,
+     1730,  704,  715,  716,  720,  717,   68,   68, 1730,  705,
+       68,  707,   68,  722,  719,  708,  723,  721,   68,  710,
+       68,   68,  718,   68,   68,   68,  714,   68,   68,  715,
 
-      724,   68,  726,  727,  728,  729,  730,   68,  720,  732,
-       68,   68,   68,  722,  731,   68,   68,  733,  734,   68,
-      735,   68, 1627, 1627,  723,  736,   68,  724,  739,  726,
-      727,  728,  729,  730,  738,  740,  732,  737,   68,  741,
-       68,  731,   68,   68,  743,  742,  745,  735,   68,   68,
-       68,   68,  736,   68,  744,  739,   68,  747,  746,  749,
-      748,  738,  740,   68,  737,   68,  741,   68,  751,  752,
-     1627,   68,  742,  745, 1627,  750,  753,  754,   68,   68,
-      759,  744,   68,   68,  747,  746,  749,  748,   68,  755,
-      756,  758,   68,  757,   68,  751,  752,   68,   68,   68,
+      716,  720,  717,  724,  725,   68,  726,  727,   68,  729,
+      722,  719,  731,  723,  721,   68,  730,  728,   68,  733,
+      732,   68, 1730,  734,   68,  738,   68,   68,   68,  735,
+      724,  725,  736,  726,   68,   68,  729,   68,  740,  731,
+       68,  741,  739,  730,  728,  742,  733,  732,  737,   68,
+      734,   68,  738,   68,   68,  743,  735,   68,   68,  736,
+      744,  746,  745,  747,  749,  740,  750,   68,  754,  739,
+       68,  751,   68,   68,   68,  737,   68, 1730,   68,   68,
+       68,  752,  743,   68,   68,  755,  753,   68,  746,  745,
+      747,  749,   68,  750,  756,  754,  757,  758,  751,   68,
 
-      762,   68,  750,  753,  754,  763, 1627,  759,  766,  760,
-      761,  767,   68,   68,   68,   68,  755,  756,  758,  764,
-      757,   68,   68,   68,  765,   68,  769,  762,  770,   68,
-      771,  772,  763,   68,  768,  766,  760,  761,  767,  780,
-      773,   68,  774,   68,   68,  775,  764,   68,  777,  776,
-       68,  765,  778,  769,  779,  782,   68,  771,  772,   68,
-      781,  768,  783,  786,   68,  784,   68,  773,  789,  774,
-       68,  790,   68,  791,  788,  777,   68,   68,  785,  778,
-      787,  779,  782,   68,   68,   68,   68,  781,  792,  783,
-      786,   68,  784,   68, 1627,   68,   68,  797, 1627,   68,
+     1730,  759,  760,  761,  762,  763,  764,  767,  752,  765,
+      766,  768,  755,  753,   68,   68,   68,   68,   68,   68,
+       68,   68,  769,   68,  758,   68,   68,   68,  759,  760,
+      761,  762,  763,  764,   68,  770,  765,  766,  768,  771,
+      773,  772,   68,   68,  774,  775,  776, 1730, 1730,  769,
+      779,  781,  777,  778,  780,   68,  783,   68,   68,   68,
+       68,  782,  770,   68, 1730,   68,  771,  773,  772,   68,
+       68,  774,  775,  776,   68,   68,   68,  779,  781,  777,
+      778,  780,  784,  783,   68,  785,  786,  787,  782,  789,
+      788,  790,  792,  795,   68,   68,  793,   68,   68,  791,
 
-      791,  788,   68,  793,  798,  785,  799,  787,  794,  801,
-      795,   68,  796,   68,  800,  792,  804,  802,   68,  803,
-      807,   68,   68,   68,  797,   68,  806,   68,   68,   68,
-      793,  798,  809,  799,  810,  794,  801,  795,   68,  796,
-      805,  800,  808,  804,  802,  813,  803,   68,  811,   68,
-      814,  815,  812,  806,   68,  817,  818,   68,   68,   68,
-       68,  810,  816,   68,  819,  821,  820,  805,  822,  808,
-       68,  823,   68,  826,  827,  811,  824,  814,   68,  812,
-       68,  825,   68,  818,   68,   68,   68,   68,  828,  816,
-      829,  819,  821,  820,   68,  822,  830,   68,  823,  831,
+       68, 1730,   68,   68,   68,  799,   68,  794,  796,  784,
+      797, 1730,  785,  786,  787,  798,  789,  788,  790,  792,
+       68,   68,   68,  793,   68,   68,  791,   68,  803,   68,
+      802,  804,  799,  805,  794,  796,  800,  797,   68,  806,
+      801,  808,  798, 1730,  809,   68,  807, 1730,  810,  813,
+      815,   68,  814,  816,   68,  803,  812,  802,  804,  811,
+      805,   68,   68,   68, 1730,  817,   68,   68,  808,  823,
+       68,  809,   68,  807,   68,  810,  813,   68,   68,  814,
+      818,   68,  824,  812,   68,   68,  811,   68,  819,  825,
+      826,  829,  817,  820,  827,  821,  823,  822,  828,   68,
 
-      832,   68,  833,  824,   68,   68,  834,   68,  825,  836,
-       68,  839,  837,   68,   68,  828,   68,  838,  835,   68,
-       68,   68,   68,  830,   68,  840,  831,  832,  841,   68,
-      842,  844,   68,  834,  843,   68,  852,  845,  839,  837,
-       68,   68,  849,   68,  838,  835,  846,  850,  853,   68,
-      847,   68,  840,   68,  848,  841,  855,  842,  844,  851,
-       68,  843,  854,  852,  845, 1627,   68,  856,   68,  849,
-      857,   68,   68,  846,  850,   68,  859,  862,  858,   68,
-      866,   68,  860,  855,   68,   68,  851,   68,  861,  854,
-      863,   68,   68,  864,  856,   68,  868,  857,   68,   68,
+      830,   68,  831,   68,   68,   68,   68,  818,   68,  824,
+      832,  834,  835,   68,  836,  819,  825,  826,  829,  833,
+      820,   68,  821,   68,  822,   68,   68,  830,   68,  831,
+      837,  838,  839,  841,  840,  843,  842,  832,  834,   68,
+      845,  836,   68,   68,  844,  846,  833,  847,  849,  848,
+      854,  850,   68,  853,   68,   68,  851,   68,  838,  839,
+       68,  840,   68,  842,  852,   68,   68,   68,   68,   68,
+       68,  844,  846,   68,  847,  849,  848,   68,  850,  855,
+      853,   68,  856,  851,  857,   68,  859,  858, 1730,  861,
+      860,  852,  862,  863,   68,  864,  867,   68, 1730,   68,
 
-       68,   68,  867,  859,  862,  858,  865,  866,  869,  860,
-       68,  877,  870,  871,  872,  861,  874,  863,   68,   68,
-      864,  875,   68,  868,  873,  876,  878,   68,   68,  867,
-     1627,  880,   68,  865,   68,  869,   68,   68,  879,  870,
-      871,  872,   68,  874,  881,  883,  882,   68,  875,  886,
-      884,  873,  876,   68,  885,  887,  891,   68,   68,   68,
-      888,  889,   68,   68,   68,  879,   68,  890,   68,  892,
-      893,  881,  883,  882,  898,   68,   68,   68,   68,  899,
-       68,   68,  887,  891,  894,  895,  897,  888,  889,  900,
-      896,   68,   68,   68,  890,  903,  901,  893,   68,   68,
+     1730,  870,  869,   68,   68,   68,   68,  868, 1730,  856,
+       68,   68,  865,  859,  858,   68,   68,  860,  866,  862,
+      863,  874,   68,  867,  871,   68,   68,   68,  870,  869,
+      872,   68,   68,  873,  868,  879,  875,  876,  884,  865,
+       68,  882,   68,   68,  881,  866,  877,  880,  874,  883,
+      878,  871, 1730,   68,   68, 1730,  885,  872, 1730,   68,
+      873,   68,  879,  875,  876,  884,   68,  886,  882,   68,
+      889,  881,   68,  888,  880,   68,  890,   68,  887,   68,
+       68,  891,   68,  885,  892,   68,  893,  896,   68,  895,
+      894, 1730,   68,  898,  886,   68, 1730,  889,   68,   68,
 
-       68,  898,  902,  904,  906,  907,  899,  905,  910,   68,
-      908,  894,  895,  897,   68,   68,  900,  896,   68,  909,
-      912,   68,  903,  901,  913,   68,   68,   68,  914,  902,
-      904,   68,  907,   68,  905,  911,  915,  908,  916,   68,
-      917,  919,   68,  918,   68,  921,  909,  912,  923,  922,
-       68,  913,  920,   68,   68,  924, 1627,  926,   68,   68,
-       68,  928,  911,   68,   68,   68,  925,  917,  919,   68,
-      918,   68,  921,   68,  929,  923,  922,   68,  930,  920,
-      927,  931,   68,   68,  926,   68,   68,  932,  928,  933,
-      940,  934,  935,  925,  942,  938,   68,   68, 1627,   68,
+      888,   68,   68,  890,  899,  887,  897,   68,  891,  900,
+      901,  892,  902,  893,  896,  904,  895,  894,   68,  906,
+      898,   68,  903,  905,  908,   68,   68,   68,  909,   68,
+      907,  899,   68,  897,  910,  911,  900,  901,  912,  902,
+       68,  913,  904,  914,   68,  915,  906,   68,  918,  903,
+      905,  924,   68,   68,  916,   68,   68,  907,  917,   68,
+       68,  910,   68,   68, 1730,  912,  919,  923,  913,  920,
+      914, 1730,  915,  922,   68,   68,  925,   68,  921,   68,
+      932,   68,   68,  926,   68,   68,  929,  927,   68,  928,
+      931,   68,  930,  919,  923,   68,  920,   68,   68,   68,
 
-      944,  929,   68,   68,  936,  930,  937,  927,  931,  946,
-      939,   68,   68,   68,  932,  943,  933,   68,  934,  935,
-       68,   68,  938,  941,  945,   68,  947,   68,   68,  948,
-       68,  936,   68,  937,  949,  953,  946,  939,  954, 1627,
-      950,   68,  943,  951,   68,   68,  956,  957,  959,   68,
-      941,  945,   68,  947,  955,  952,  948, 1627,  960,  958,
-       68,  949,  961,  967,   68,  954,   68,  950,   68,  962,
-      951,   68,   68,  956,  957,  964,  966,   68,  968,   68,
-      963,  955,  952,   68,   68,  960,  958,   68,  965,  961,
-       68,  984,   68,  973,  970,  969,  962,   68,   68,  971,
+      922,  933,   68,  925,  934,  921,   68,  932,  935,  941,
+      926,  936,  942,  929,  927,  945,  928,  931, 1730,  930,
+      937,  943,   68,   68,  938,  940,  944,   68,  933,   68,
+      948,  934,   68,   68,   68,  935,   68,  939,  936,  942,
+      946,  947,  949,  950,   68,   68,   68,  937,  943,   68,
+      951,  938,  940,  944,  952,  959,   68,  948,  953,  954,
+      955,  956,   68,   68,  939, 1730, 1730,  946,  947,  957,
+       68,   68,  960,   68,   68,  961,  966,   68,   68,   68,
+      958,  952,   68,  977,   68,  953,  954,  955,  956,  962,
+      963,   68,   68,  969,   68,  964,  957,  965,   68,  960,
 
-       68,   68,  964,  966,   68,  968,   68,  963,   68,  975,
-      972,  974,  976, 1627,  980,  965,  979,  977,   68,   68,
-      973,  970,  969,   68,   68,   68,  971,  978,   68,  981,
-      986,  983,  982,   68,   68,  987,  985,  972,  974,  976,
-       68,  980,   68,  979,  977,  989,   68,   68,  988,  992,
-      993,  994,   68,   68,  978,  996,  981,  986,  983,  982,
-       68,  990,  987,  985,  991,  997,   68,   68, 1001,   68,
-      995,  998,  989, 1004,   68,  988,  992,   68,   68,   68,
-     1000,   68,  996,  999,   68,   68, 1627, 1003,  990,   68,
-     1002,  991,  997, 1005,   68, 1001,   68,  995,  998, 1006,
+      967,   68,  961,  966,  970,   68,   68,  958,  968,   68,
+      973,  979,  976,  975,   68, 1730,  962,  963,   68,   68,
+      969,   68,  964,  971,  965,  972,   68,  967,   68,  974,
+       68,  970,   68,  980,   68,  968,   68,  973,   68,  976,
+      975,  978,   68,  981,  982,  991,   68,  984,   68,  985,
+      971,  983,  972,  990,   68,  986,  974, 1730,  993,  992,
+      980,  994,   68,   68,   68,   68,  987,   68,  978,  988,
+       68,  982,  991,   68,  984,  995,  985,   68,  983,  996,
+       68,  989,  986, 1730,   68,  993,  992,  997,  994,  998,
+       68, 1005,  999,  987, 1000, 1001,  988, 1002,   68,   68,
 
-     1007,   68,   68, 1009,   68, 1008, 1627, 1000, 1010, 1011,
-      999, 1014,   68, 1017, 1003, 1012, 1016, 1002, 1013, 1015,
-     1005,   68,   68, 1627,   68,   68, 1021, 1007,   68, 1018,
-       68, 1028, 1008,   68,   68, 1010, 1011,   68, 1014, 1019,
-       68, 1022, 1012, 1016,   68, 1013, 1015, 1020,   68,   68,
-     1023, 1024, 1025, 1021,   68, 1026, 1018, 1027,   68,   68,
-     1032, 1030, 1029,   68, 1627, 1031, 1019, 1036, 1022,   68,
-       68, 1033,   68,   68, 1020,   68,   68, 1023, 1024, 1025,
-       68, 1034, 1026, 1035, 1027, 1037,   68, 1038, 1030, 1029,
-       68,   68, 1031, 1039,   68, 1040, 1042, 1627, 1033, 1043,
+       68,   68,  995, 1003, 1004, 1006, 1007,   68,  989, 1013,
+       68, 1010, 1730,   68,  997,   68,  998,   68,   68,  999,
+     1011, 1000, 1001, 1012,   68, 1730,   68,   68,   68, 1008,
+     1003, 1004, 1006, 1007, 1009,   68,   68,   68, 1010, 1014,
+       68,   68, 1015, 1017, 1019, 1016,   68, 1011, 1018,   68,
+     1012,   68, 1022, 1023, 1024, 1020, 1008, 1032, 1021, 1027,
+       68, 1009, 1025,   68,   68,   68, 1014, 1033, 1730, 1015,
+     1017, 1019, 1016,   68, 1031, 1018, 1026,   68,   68, 1022,
+       68, 1024, 1020, 1028,   68, 1021, 1027,   68,   68, 1025,
+     1029,   68,   68, 1030,   68, 1034, 1036, 1035, 1038, 1037,
 
-     1041, 1044, 1046, 1627,   68, 1051, 1049, 1045, 1034,   68,
-     1035,   68, 1037,   68,   68,   68,   68,   68,   68,   68,
-     1039, 1056,   68, 1042,   68, 1047, 1043, 1041, 1044, 1046,
-     1050, 1052,   68, 1049, 1045, 1627, 1054, 1058, 1048, 1053,
-     1055, 1059,   68,   68,   68,   68, 1057,   68,   68, 1060,
-     1061, 1062, 1047,   68, 1064, 1627, 1065, 1050,   68, 1066,
-     1063, 1068,   68, 1054,   68, 1048, 1053, 1055,   68,   68,
-     1067, 1073, 1074, 1057,   68, 1076, 1627, 1061,   68,   68,
-       68,   68,   68, 1065, 1075,   68,   68, 1063, 1069, 1070,
-     1071,   68,   68, 1077, 1082, 1072,   68, 1067, 1073, 1074,
+       68, 1031,   68, 1026, 1039,   68, 1040, 1041,   68, 1048,
+     1028,   68,   68,   68, 1042, 1730, 1043, 1029,   68, 1047,
+     1030, 1050, 1034, 1036, 1035, 1038, 1037, 1053,   68, 1051,
+     1044, 1039,   68, 1040, 1041, 1045,   68, 1052, 1046, 1049,
+       68, 1042,   68, 1043,   68, 1054, 1047, 1058,   68, 1055,
+       68, 1057,   68,   68, 1059, 1056, 1051, 1044,   68,   68,
+     1060,   68, 1045,   68, 1052, 1046, 1049, 1061,   68, 1062,
+       68, 1730, 1054,   68, 1058, 1063, 1055, 1065, 1057, 1064,
+       68, 1059, 1056, 1066,   68, 1067,   68, 1060, 1070, 1068,
+     1069, 1071,   68, 1072, 1075, 1730, 1062, 1730,   68, 1074,
 
-     1078,   68, 1076,   68, 1079, 1080, 1081, 1083, 1084, 1627,
-     1091, 1075,   68, 1086,   68, 1069, 1070, 1071, 1085,   68,
-       68,   68, 1072, 1087,   68, 1088,   68, 1078,   68, 1090,
-       68, 1079, 1080, 1081, 1083, 1084,   68, 1089, 1093, 1092,
-     1086,   68, 1094, 1096, 1627, 1085,   68, 1097,   68,   68,
-     1087,   68, 1088, 1095,   68, 1098, 1090, 1101,   68, 1100,
-     1099,   68, 1103, 1102, 1089, 1093, 1092,   68,   68,   68,
-     1096,   68, 1104, 1106, 1097,   68, 1109, 1105,   68, 1107,
-     1095,   68, 1098, 1108, 1101,   68, 1100, 1099,   68,   68,
-     1102, 1110, 1113, 1111, 1114,   68,   68, 1112, 1115, 1104,
+       68, 1073, 1063,   68, 1065,   68, 1064,   68,   68,   68,
+     1066,   68, 1067, 1078,   68, 1070, 1068, 1069, 1071,   68,
+       68, 1075, 1076, 1077, 1079, 1080, 1074, 1081, 1073, 1082,
+     1730,   68, 1084, 1083,   68, 1085, 1086,   68, 1730,   68,
+     1087, 1730, 1088, 1089,   68, 1098, 1730, 1097,   68, 1076,
+     1077, 1079, 1080,   68, 1081,   68,   68,   68, 1090,   68,
+     1083,   68, 1085,   68,   68, 1091, 1092, 1087, 1093, 1088,
+     1089, 1095, 1096,   68,   68, 1101,   68,   68,   68, 1100,
+     1102, 1094,   68, 1099,   68, 1090,   68,   68,   68,   68,
+     1103, 1104, 1091, 1092, 1105, 1093, 1106,   68, 1095, 1096,
 
-       68, 1116, 1117, 1118, 1105, 1627, 1107,   68, 1126, 1120,
-     1108,   68, 1119,   68, 1121, 1122, 1123,   68,   68, 1124,
-       68, 1114, 1127,   68,   68, 1115,   68,   68, 1125, 1117,
-     1118, 1129,   68, 1128,   68,   68, 1120, 1135, 1130, 1119,
-     1132, 1133, 1122, 1131, 1136,   68, 1124,   68, 1134,   68,
-     1140,   68,   68,   68,   68, 1125,   68, 1142, 1129,   68,
-     1128,   68,   68,   68,   68, 1130, 1137, 1132, 1133, 1138,
-     1131, 1136, 1139,   68, 1143, 1134, 1141, 1140,   68, 1144,
-       68, 1149, 1146, 1151,   68, 1152, 1147,   68,   68, 1148,
-     1145,   68, 1153, 1137, 1155,   68, 1138, 1150,   68, 1139,
+     1107, 1108, 1101, 1109, 1111, 1110, 1100,   68, 1094, 1112,
+     1099,   68, 1113, 1115,   68, 1114, 1125, 1103,   68,   68,
+     1730,   68, 1120, 1106, 1730,   68, 1121, 1123, 1108,   68,
+     1122,   68, 1110,   68,   68,   68, 1112,   68, 1127,   68,
+       68,   68, 1114,   68,   68, 1116, 1117, 1118, 1128, 1120,
+     1124, 1129, 1119, 1121, 1123,   68,   68, 1122, 1126,   68,
+       68, 1130, 1132, 1133,   68, 1127, 1134,   68, 1131,   68,
+     1135, 1139, 1116, 1117, 1118, 1128, 1137, 1124, 1129, 1119,
+       68,   68,   68, 1136,   68, 1126, 1138,   68,   68, 1132,
+     1133, 1140, 1141, 1134, 1142, 1131,   68, 1135,   68, 1144,
 
-     1154, 1143, 1156, 1141,   68,   68, 1144,   68,   68, 1146,
-       68, 1158, 1152, 1147,   68, 1159, 1148, 1145,   68, 1153,
-     1160,   68,   68, 1157, 1150,   68,   68, 1154, 1161, 1156,
-       68, 1162, 1164,   68, 1163, 1166, 1168,   68, 1158, 1167,
-     1170, 1165, 1159,   68,   68,   68,   68, 1160,   68,   68,
-     1157, 1169, 1171,   68, 1173, 1161, 1177,   68, 1162, 1164,
-     1174, 1163, 1166, 1168,   68,   68, 1167, 1170, 1165,   68,
-     1172,   68, 1175, 1176, 1179, 1178,   68, 1182, 1169,   68,
-     1181, 1173,   68, 1177, 1180,   68, 1183, 1174,   68, 1627,
-       68, 1188, 1187, 1184,   68,   68, 1193, 1172, 1185, 1175,
+     1143, 1146,   68, 1137, 1145, 1147, 1148, 1730,   68, 1150,
+     1136,   68,   68, 1138, 1730,   68,   68,   68, 1140, 1141,
+     1154,   68,   68, 1149,   68, 1151, 1144, 1143, 1146,   68,
+     1152, 1145, 1147, 1148, 1153,   68, 1150,   68,   68, 1156,
+     1155,   68, 1159, 1157, 1163, 1160,   68, 1154, 1158, 1161,
+     1149,   68, 1151, 1162, 1166, 1169, 1164, 1152,   68,   68,
+     1165, 1153,   68, 1167,   68, 1168,   68, 1155, 1170,   68,
+     1157,   68, 1160, 1171, 1172, 1158, 1161, 1173, 1174,   68,
+       68, 1176, 1197,   68,   68,   68,   68,   68, 1175,   68,
+     1167, 1177, 1168,   68, 1730, 1170,   68, 1178, 1730, 1179,
 
-     1176, 1186, 1178,   68, 1182,   68,   68, 1181,   68,   68,
-     1190, 1180, 1189,   68, 1191, 1192,   68,   68, 1188, 1187,
-     1184, 1627, 1194, 1193, 1195, 1185, 1196,   68, 1186,   68,
-     1199, 1197,   68,   68, 1200, 1627,   68, 1190, 1198, 1189,
-       68, 1191, 1192,   68, 1201,   68, 1202,   68,   68, 1194,
-     1627, 1195, 1203, 1196, 1204, 1206, 1205, 1199, 1197, 1207,
-       68,   68,   68, 1210, 1215, 1198, 1208, 1627, 1211,   68,
-     1209, 1201, 1212,   68, 1214, 1213, 1218,   68,   68, 1203,
-       68, 1204, 1206, 1205,   68,   68,   68,   68,   68, 1217,
-       68,   68, 1219, 1208,   68, 1211,   68, 1209, 1216, 1212,
+     1171, 1172, 1180, 1181, 1173, 1184,   68, 1182, 1188,   68,
+     1183, 1730,   68,   68,   68, 1175, 1730, 1185, 1177, 1187,
+     1190,   68, 1186,   68, 1178,   68, 1179,   68, 1189,   68,
+       68,   68, 1184, 1192, 1182, 1188, 1195, 1183,   68, 1193,
+       68,   68, 1194,   68, 1185, 1191, 1187,   68,   68, 1186,
+       68,   68,   68, 1196, 1198, 1189, 1207, 1199, 1202,   68,
+     1192, 1201, 1204, 1195, 1203, 1205, 1193,   68, 1200, 1194,
+       68, 1209, 1191, 1206, 1210,   68,   68,   68, 1211, 1730,
+     1196, 1198,   68,   68, 1199, 1202,   68,   68, 1201,   68,
+     1212, 1203, 1205, 1208, 1215, 1200, 1214,   68, 1209,   68,
 
-       68, 1214, 1213, 1218,   68, 1220, 1221, 1222, 1223, 1627,
-     1225,   68, 1627, 1224, 1234,   68, 1217, 1226,   68, 1219,
-     1227,   68,   68, 1228, 1627, 1216, 1229,   68, 1232,   68,
-     1230,   68, 1220, 1221, 1222,   68,   68, 1225,   68,   68,
-     1224,   68, 1231,   68, 1226, 1233, 1235, 1227,   68, 1236,
-     1228,   68, 1237, 1229, 1238, 1232, 1239, 1230, 1240, 1241,
-     1242, 1243, 1244,   68, 1246,   68, 1247, 1245,   68, 1231,
-       68, 1250, 1233, 1235,   68,   68, 1236, 1249, 1252, 1237,
-     1254, 1238,   68, 1239, 1248,   68,   68, 1242,   68,   68,
-     1255,   68,   68,   68, 1245, 1251, 1258, 1253,   68,   68,
+     1206, 1210, 1213,   68, 1217,   68, 1220, 1216, 1730,   68,
+       68, 1218,   68,   68, 1223, 1219, 1228, 1212,   68,   68,
+     1208, 1215,   68, 1214, 1224, 1221,   68, 1226, 1222, 1213,
+       68, 1217,   68, 1220, 1216,   68,   68, 1225, 1218, 1230,
+     1227, 1223, 1219,   68, 1231,   68,   68, 1229,   68,   68,
+     1232, 1224, 1221,   68, 1226, 1222, 1233, 1236, 1235, 1234,
+     1237,   68, 1238, 1239, 1225,   68, 1230, 1227,   68,   68,
+       68, 1231,   68, 1240, 1229, 1244,   68, 1232,   68, 1241,
+     1243, 1246,   68, 1233, 1730, 1235, 1234, 1237,   68, 1238,
+     1239,   68, 1242, 1245, 1250, 1247,   68,   68, 1248,   68,
 
-     1256,   68, 1259,   68, 1249,   68,   68, 1254, 1260, 1261,
-       68, 1248, 1262,   68,   68, 1257, 1264, 1255, 1263, 1266,
-     1627, 1627, 1251,   68, 1253, 1265,   68, 1256, 1267, 1259,
-       68, 1269, 1270, 1268,   68,   68,   68,   68, 1271, 1262,
-       68,   68, 1257, 1264,   68, 1263, 1266,   68, 1272, 1273,
-       68, 1274, 1265, 1275,   68, 1267, 1276, 1627, 1269, 1270,
-     1268, 1277, 1278, 1280,   68, 1271,   68,   68,   68, 1279,
-     1283, 1284, 1627, 1281, 1627, 1272, 1273, 1285, 1274,   68,
-       68, 1282,   68, 1276,   68, 1286,   68, 1288, 1277, 1278,
-     1289, 1627, 1290, 1296,   68,   68, 1279, 1283, 1284,   68,
+       68, 1249, 1244, 1254, 1256, 1252, 1241, 1253, 1246, 1251,
+     1730,   68,   68,   68, 1257,   68, 1255,   68,   68, 1242,
+     1245, 1250, 1247,   68,   68, 1248,   68,   68, 1249,   68,
+     1254, 1256, 1252, 1258, 1253,   68, 1251, 1259, 1260, 1261,
+       68, 1257, 1262, 1255, 1263, 1264, 1730, 1265, 1267,   68,
+     1266, 1269, 1271, 1268,   68,   68, 1272,   68, 1273,   68,
+     1258, 1274,   68, 1270, 1259, 1260, 1261,   68, 1275,   68,
+       68, 1263,   68,   68, 1265, 1267,   68, 1266,   68, 1271,
+     1268, 1276,   68,   68, 1277, 1273, 1279, 1278,   68, 1280,
+     1270,   68, 1730,   68,   68, 1275,   68, 1281, 1282, 1284,
 
-     1281,   68, 1287, 1292, 1285,   68, 1291,   68, 1282,   68,
-     1293, 1297, 1286, 1294,   68, 1295,   68,   68,   68, 1290,
-     1296,   68, 1298,   68, 1299, 1301, 1304, 1300, 1303, 1287,
-     1292, 1307,   68, 1291,   68,   68, 1302, 1293, 1297, 1305,
-     1294,   68, 1295,   68, 1308, 1306,   68, 1311,   68,   68,
-       68, 1299, 1301,   68, 1300, 1303,   68,   68, 1307, 1309,
-       68, 1312, 1310, 1302, 1314, 1315, 1305, 1316, 1313, 1627,
-     1317, 1627, 1306,   68, 1311,   68, 1319, 1320,   68, 1321,
-     1322,   68, 1318, 1323, 1326, 1327, 1309,   68,   68, 1310,
-       68,   68,   68,   68, 1325, 1313,   68, 1317,   68,   68,
+     1283, 1285,   68, 1287, 1286, 1289, 1288, 1730, 1276,   68,
+       68, 1277,   68,   68, 1278,   68, 1280,   68, 1290,   68,
+     1299,   68, 1291,   68, 1281, 1282, 1284, 1283, 1285,   68,
+       68, 1286, 1289, 1288, 1292, 1293, 1295, 1296, 1294,   68,
+       68,   68,   68,   68,   68, 1290, 1298,   68, 1300, 1291,
+     1304, 1297,   68, 1301, 1305, 1302, 1303, 1306, 1308, 1309,
+     1307, 1292, 1293, 1295, 1296, 1294,   68,   68,   68, 1310,
+       68, 1311,   68, 1298,   68, 1300,   68, 1304, 1297,   68,
+     1301,   68, 1302, 1303,   68,   68,   68, 1307, 1312, 1313,
+     1315, 1314, 1316, 1317, 1318, 1319,   68, 1730, 1311,   68,
 
-     1324, 1328,   68, 1319, 1320, 1329,   68, 1322,   68, 1318,
-     1323,   68,   68,   68, 1330, 1331,   68, 1334, 1332, 1333,
-       68, 1325, 1335,   68, 1336, 1337, 1340, 1324,   68,   68,
-       68, 1339, 1329,   68,   68, 1338,   68, 1344,   68,   68,
-       68, 1330, 1331,   68, 1334, 1332, 1333, 1341, 1342, 1335,
-       68,   68, 1337, 1340, 1343, 1345, 1346, 1347, 1339,   68,
-     1348,   68, 1338,   68, 1344, 1350, 1351,   68, 1352, 1349,
-       68, 1354, 1353,   68, 1341, 1342, 1355,   68,   68,   68,
-       68, 1343, 1345,   68,   68, 1356,   68, 1348, 1357, 1358,
-     1627, 1359, 1350, 1351, 1361, 1352, 1349, 1363, 1354, 1353,
+     1321,   68, 1320, 1324,   68, 1325, 1326, 1327, 1329, 1730,
+     1322,   68,   68,   68, 1328,   68,   68, 1315, 1314,   68,
+     1317,   68, 1319,   68,   68, 1323,   68, 1321, 1330, 1320,
+       68,   68, 1325,   68, 1327, 1329,   68, 1322, 1331, 1332,
+     1335, 1328, 1333,   68, 1334, 1336,   68, 1338, 1339,   68,
+     1340, 1337, 1323, 1346, 1341,   68,   68, 1730,   68, 1730,
+       68, 1343,   68, 1347, 1344, 1331,   68, 1335, 1342, 1333,
+       68, 1334, 1336,   68, 1338, 1339,   68, 1340, 1337,   68,
+       68, 1341,   68, 1345,   68, 1348,   68, 1349, 1343, 1350,
+     1347, 1344,   68, 1351, 1352, 1342,   68, 1730, 1356, 1354,
 
-       68,   68,   68, 1355, 1360,   68,   68, 1364, 1366, 1362,
-     1365, 1627,   68,   68, 1367, 1357, 1358,   68, 1359,   68,
-       68, 1361,   68, 1368,   68, 1369, 1627, 1370, 1372, 1371,
-       68, 1360, 1373,   68,   68, 1366, 1362, 1365,   68, 1374,
-     1375, 1367, 1377, 1376,   68, 1378, 1627, 1379,   68, 1627,
-     1368,   68, 1369,   68, 1370,   68, 1371, 1380, 1381, 1373,
-     1382, 1383,   68, 1384, 1387, 1386, 1374,   68, 1389,   68,
-     1376,   68,   68,   68, 1379, 1385,   68,   68, 1388, 1390,
-       68, 1391,   68,   68, 1380, 1381,   68, 1382, 1383, 1392,
-     1384, 1387, 1386, 1627,   68, 1389, 1393, 1394, 1395, 1396,
+     1355, 1730, 1353, 1730, 1357,   68, 1360, 1361, 1358, 1362,
+     1345,   68, 1348,   68, 1349,   68, 1350, 1363,   68, 1370,
+       68, 1352,   68, 1364,   68, 1356, 1354, 1355,   68, 1353,
+       68, 1357, 1359,   68,   68, 1358, 1362, 1366,   68,   68,
+     1365, 1730, 1367,   68, 1363,   68,   68, 1368, 1369, 1371,
+     1364, 1372, 1373,   68, 1374, 1375, 1377, 1730,   68, 1359,
+     1730, 1376,   68, 1378, 1366,   68, 1381, 1365,   68, 1367,
+       68,   68,   68, 1380, 1368, 1369, 1371,   68, 1372, 1373,
+     1379, 1374, 1375,   68,   68, 1382, 1383,   68, 1376, 1384,
+     1378,   68, 1385, 1387, 1388,   68, 1386,   68, 1389, 1390,
 
-       68, 1398, 1385, 1397, 1399, 1388,   68, 1627,   68, 1627,
-     1403, 1401, 1402, 1400, 1627, 1627,   68, 1407, 1405,   68,
-       68, 1404,   68,   68,   68,   68, 1396,   68, 1398,   68,
-     1397, 1399,   68,   68,   68,   68,   68, 1403, 1401, 1402,
-     1400, 1406, 1408,   68, 1407, 1405, 1409, 1411, 1404, 1410,
-     1412, 1414, 1413, 1415,   68,   68,   68, 1417, 1419,   68,
-       68, 1416, 1627, 1421, 1420, 1423, 1424, 1418, 1406, 1408,
-       68,   68,   68, 1409, 1411,   68, 1410,   68,   68, 1413,
-     1415,   68, 1422,   68, 1417,   68, 1425, 1426, 1416,   68,
-     1421, 1420,   68,   68, 1418, 1427,   68, 1428, 1429, 1431,
+     1380, 1392, 1395, 1391,   68, 1393,   68, 1379, 1394, 1730,
+     1398,   68, 1382, 1383,   68,   68, 1384, 1399,   68,   68,
+       68,   68, 1396, 1386, 1397,   68, 1390,   68, 1392,   68,
+     1391,   68, 1393,   68, 1400,   68,   68,   68, 1402,   68,
+     1401, 1403, 1404, 1405, 1399, 1407, 1730, 1406, 1408, 1396,
+     1730, 1397, 1413,   68,   68, 1411, 1409, 1412, 1410,   68,
+       68, 1400,   68,   68,   68, 1402, 1730, 1401,   68,   68,
+       68,   68, 1407,   68, 1406, 1408, 1414,   68, 1417,   68,
+     1415,   68, 1411, 1409, 1412, 1410, 1416, 1418, 1419, 1420,
+       68, 1421,   68,   68,   68, 1422,   68, 1423,   68, 1424,
 
-     1430, 1627, 1432, 1433, 1436, 1627,   68, 1435,   68, 1422,
-     1434,   68,   68,   68, 1426, 1438,   68, 1440, 1444, 1627,
-       68, 1627, 1427,   68, 1442,   68, 1431, 1430,   68, 1432,
-     1433, 1436,   68, 1437, 1435, 1439,   68, 1434, 1443, 1441,
-       68, 1445,   68,   68, 1440, 1444,   68,   68,   68,   68,
-       68, 1442, 1446,   68, 1447, 1627, 1448, 1449, 1450, 1452,
-     1437, 1451, 1439,   68,   68, 1443, 1441, 1453, 1445, 1454,
-       68, 1455,   68, 1457, 1460,   68, 1456, 1458, 1466, 1446,
-     1459, 1447,   68, 1448, 1449, 1450,   68,   68, 1451,   68,
-       68,   68,   68, 1461, 1453, 1462, 1454, 1464, 1455,   68,
+     1425,   68, 1426, 1414, 1434, 1417, 1730, 1415, 1730,   68,
+     1433, 1427, 1430, 1416, 1418, 1419, 1420,   68, 1421,   68,
+       68, 1436, 1422, 1428, 1423, 1429,   68,   68,   68, 1426,
+       68,   68,   68, 1431, 1432, 1435,   68, 1433, 1427, 1430,
+       68,   68, 1437,   68, 1442, 1443, 1438, 1439, 1436, 1730,
+     1428, 1441, 1429,   68,   68,   68,   68, 1440, 1444,   68,
+     1431, 1432, 1435, 1445, 1446, 1450, 1451,   68,   68, 1437,
+     1447,   68,   68, 1438, 1439,   68,   68,   68, 1441, 1448,
+     1454, 1449, 1452, 1455, 1440, 1444, 1453,   68,   68,   68,
+     1445, 1446, 1450,   68,   68,   68, 1457, 1447, 1456, 1459,
 
-     1457, 1460, 1463, 1456, 1458, 1465,   68, 1459,   68,   68,
-     1467, 1468,   68,   68,   68,   68, 1470, 1469, 1471,   68,
-     1461, 1472, 1462, 1473, 1464,   68, 1627, 1474,   68, 1463,
-     1475, 1476, 1465, 1478,   68,   68, 1480, 1467,   68,   68,
-     1477,   68, 1481, 1470, 1469,   68, 1482, 1479, 1472,   68,
-     1473, 1484, 1483,   68, 1474,   68,   68, 1475, 1476,   68,
-       68, 1485, 1486,   68,   68, 1488, 1490, 1477, 1487, 1481,
-     1489, 1491, 1492,   68, 1479, 1493,   68,   68, 1484, 1483,
-       68, 1494, 1497,   68, 1498, 1627,   68, 1627,   68,   68,
-     1495, 1496, 1488,   68,   68, 1487, 1499, 1489, 1491, 1492,
+     1460, 1730, 1461,   68, 1463, 1730, 1448, 1454, 1449, 1452,
+       68, 1458,   68, 1453, 1464, 1462, 1466, 1465, 1467,   68,
+       68, 1468,   68,   68,   68, 1456,   68,   68,   68, 1461,
+     1469, 1463, 1470,   68, 1471, 1472,   68,   68, 1458,   68,
+     1473, 1464, 1462, 1466, 1465, 1467,   68, 1474, 1468, 1475,
+     1476, 1478,   68, 1477,   68, 1730, 1479, 1469, 1730, 1470,
+     1482, 1471,   68, 1480, 1484, 1730, 1481,   68, 1486, 1483,
+     1730,   68,   68, 1730, 1485, 1730, 1475,   68,   68,   68,
+       68, 1489,   68, 1479,   68,   68,   68, 1482,   68,   68,
+     1480, 1484,   68, 1481, 1487, 1486, 1483, 1488, 1490,   68,
 
-       68, 1500, 1493, 1501,   68, 1502, 1503, 1504, 1627,   68,
-     1506,   68,   68, 1505,   68, 1507, 1508, 1495, 1496, 1510,
-     1511, 1627, 1509, 1499, 1627,   68, 1512, 1514, 1500, 1513,
-     1501, 1627,   68,   68,   68,   68,   68,   68,   68, 1515,
-     1505,   68, 1507,   68,   68, 1521, 1510,   68,   68, 1509,
-       68,   68, 1519, 1512, 1514, 1518, 1513, 1516, 1517, 1523,
-     1522,   68, 1520, 1525, 1526, 1524, 1515,   68, 1527,   68,
-     1528, 1529,   68,   68,   68, 1627,   68,   68, 1535, 1519,
-     1532, 1530, 1518,   68, 1516, 1517,   68, 1522,   68, 1520,
-       68, 1526, 1524,   68, 1531, 1527, 1533,   68, 1529, 1536,
+     1491, 1485, 1492,   68, 1493, 1496, 1494, 1495, 1489, 1498,
+     1497,   68,   68,   68, 1730,   68,   68, 1500, 1503, 1499,
+       68, 1487, 1501, 1505, 1488, 1490,   68, 1491,   68, 1492,
+       68, 1493,   68, 1494, 1495, 1504,   68, 1497,   68,   68,
+       68, 1502, 1514, 1507, 1500, 1503, 1499, 1506, 1508, 1501,
+       68, 1509, 1510, 1511,   68,   68, 1512, 1515, 1513, 1516,
+     1517,   68, 1504, 1518, 1730,   68, 1525, 1730, 1502,   68,
+     1507,   68,   68,   68, 1506, 1508, 1730, 1521,   68,   68,
+       68,   68,   68, 1512,   68, 1513, 1516, 1517, 1519, 1520,
+     1523, 1522, 1524,   68,   68, 1526, 1531,   68,   68,   68,
 
-       68, 1534,   68, 1537, 1538,   68, 1539, 1532, 1530,   68,
-     1540, 1541, 1542, 1544, 1627, 1627, 1545, 1543,   68,   68,
-     1627, 1531,   68, 1533,   68,   68,   68,   68, 1534, 1546,
-       68, 1538,   68, 1539,   68, 1547, 1548, 1549, 1541, 1542,
-     1544,   68,   68, 1545, 1543,   68, 1550, 1551, 1553, 1552,
-       68,   68,   68, 1554, 1555,   68, 1546, 1556,   68, 1559,
-       68, 1557, 1547, 1548, 1549, 1558, 1560,   68, 1564, 1561,
-     1565,   68,   68, 1550, 1551, 1553, 1552, 1562, 1566,   68,
-       68, 1555,   68,   68, 1556, 1563, 1559, 1568, 1557,   68,
-     1569,   68, 1558,   68, 1567,   68, 1561,   68, 1570,   68,
+       68, 1527, 1528,   68, 1521,   68, 1529,   68, 1530, 1532,
+       68, 1534,   68, 1540, 1533, 1519, 1520, 1523, 1522, 1524,
+       68,   68, 1526, 1531, 1535, 1538, 1730, 1541, 1527, 1528,
+     1536,   68,   68, 1529,   68, 1530, 1532,   68, 1534, 1537,
+       68, 1533,   68, 1542, 1539, 1543,   68, 1544, 1546,   68,
+       68, 1535, 1538,   68, 1541, 1545, 1547, 1536,   68,   68,
+     1549,   68, 1548,   68, 1730,   68, 1537, 1550, 1551, 1557,
+     1542, 1539, 1543,   68, 1544, 1546, 1555, 1558, 1552,   68,
+     1559, 1553, 1545, 1547,   68,   68,   68, 1549,   68, 1548,
+       68, 1554, 1556, 1562, 1550, 1551,   68,   68,   68, 1561,
 
-     1574,   68, 1571,   68, 1562, 1566,   68, 1573,   68, 1572,
-     1575, 1576, 1563, 1577, 1568,   68,   68, 1569, 1582,   68,
-     1578, 1567,   68,   68, 1579, 1570, 1580, 1574, 1583, 1571,
-     1584, 1627,   68, 1581, 1573, 1585, 1572, 1575, 1576,   68,
-     1577,   68,   68,   68, 1586, 1587,   68, 1578,   68,   68,
-       68, 1579,   68, 1580, 1589,   68, 1588, 1584, 1590, 1591,
-     1581, 1592, 1585, 1593,   68, 1594, 1596,   68,   68,   68,
-     1597, 1586, 1595, 1599,   68, 1598,   68,   68, 1600, 1601,
-       68, 1589, 1602, 1588, 1603, 1590, 1591,   68, 1592, 1627,
-     1593,   68, 1594, 1596,   68,   68,   68, 1597,   68, 1595,
+       68,   68, 1560, 1555, 1558, 1552, 1564,   68, 1553, 1563,
+       68,   68, 1565, 1566, 1570, 1567, 1568, 1571, 1554, 1556,
+       68,   68, 1572,   68,   68,   68, 1561, 1569,   68, 1560,
+     1573, 1574,   68, 1564,   68, 1576, 1563, 1577,   68, 1565,
+     1566,   68, 1567, 1568, 1571, 1579, 1575, 1580, 1730,   68,
+       68, 1578,   68,   68, 1569, 1581,   68, 1573,   68, 1583,
+     1582,   68, 1576,   68, 1577, 1584,   68, 1587, 1585, 1586,
+     1589, 1588,   68, 1575,   68,   68,   68, 1592, 1578,   68,
+     1590, 1591, 1581,   68, 1593, 1594, 1583, 1582, 1595,   68,
+       68, 1598,   68,   68, 1587, 1585, 1586, 1597, 1588, 1599,
 
-     1599,   68, 1598, 1604,   68, 1600, 1601, 1605, 1607,   68,
-     1606, 1603, 1627, 1610, 1608,   68,   68, 1609, 1611, 1627,
-     1612,   68, 1615,   68, 1616, 1613,   68, 1618, 1619, 1627,
-     1604, 1627,   68,   68, 1605, 1607,   68, 1606, 1617,   68,
-     1610, 1608, 1614, 1620, 1609, 1611,   68, 1612,   68, 1615,
-       68,   68, 1613, 1621,   68,   68, 1622, 1625,   68, 1623,
-     1624, 1626, 1627,   68, 1627, 1617, 1627,   68,   68, 1614,
-     1620, 1627, 1627, 1627, 1627,   68, 1627, 1627,   68, 1627,
-     1621, 1627, 1627, 1622,   68, 1627, 1623, 1624,   68,   40,
-       40,   40,   40,   40,   40,   40,   45,   45,   45,   45,
+     1596,   68, 1600, 1601,   68, 1602, 1604, 1590, 1591, 1603,
+       68,   68, 1594,   68, 1606, 1595, 1605, 1607,   68,   68,
+     1609, 1608, 1612, 1610, 1597,   68,   68, 1596, 1730,   68,
+     1601, 1611,   68,   68,   68,   68, 1603,   68, 1618,   68,
+       68,   68, 1613, 1605, 1607,   68, 1614,   68, 1608, 1612,
+     1610,   68, 1619,   68, 1615, 1616, 1617,   68, 1611,   68,
+       68, 1620,   68, 1621,   68, 1618, 1622, 1623, 1624, 1613,
+     1626, 1625, 1629, 1614, 1627, 1630, 1628, 1730, 1631, 1619,
+       68, 1615, 1616, 1617,   68,   68,   68, 1634,   68,   68,
+       68,   68, 1632, 1622,   68, 1624, 1635,   68, 1625,   68,
 
-       45,   45,   45,   50,   50,   50,   50,   50,   50,   50,
-       56,   56,   56,   56,   56,   56,   56,   61,   61,   61,
-       61,   61,   61,   61,   71,   71, 1627,   71,   71,   71,
-       71,  123,  123, 1627, 1627, 1627,  123,  123,  125,  125,
-     1627, 1627,  125, 1627,  125,  127, 1627, 1627, 1627, 1627,
-     1627,  127,  130,  130, 1627, 1627, 1627,  130,  130,  132,
-     1627, 1627, 1627, 1627, 1627,  132,  134,  134, 1627,  134,
-      134,  134,  134,   72,   72, 1627,   72,   72,   72,   72,
-       13, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1633, 1627,   68, 1628,   68, 1631,   68, 1636, 1637,   68,
+     1638, 1639, 1640, 1641, 1634,   68, 1642, 1643,   68, 1632,
+     1644, 1730, 1645, 1635, 1646, 1730, 1730, 1633,   68, 1649,
+     1648, 1730,   68,   68, 1636,   68, 1647,   68,   68,   68,
+     1641,   68,   68, 1642,   68,   68, 1650, 1644,   68, 1645,
+     1651, 1646,   68,   68, 1652, 1654, 1649, 1648, 1653, 1655,
+     1656,   68,   68, 1647,   68, 1657,   68,   68, 1659, 1660,
+     1658, 1662,   68, 1650, 1661, 1663,   68, 1651, 1667, 1668,
+     1664, 1652, 1654,   68, 1730, 1653, 1655, 1656,   68, 1670,
+       68,   68,   68,   68, 1666, 1659, 1660, 1658, 1662, 1665,
 
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627
+     1669, 1661,   68,   68, 1671, 1672,   68, 1664, 1677,   68,
+       68,   68,   68,   68, 1673, 1674, 1670, 1676,   68, 1675,
+     1679, 1666,   68, 1678, 1685,   68, 1665, 1669,   68,   68,
+       68, 1671, 1672,   68, 1680, 1677, 1681, 1682, 1686, 1730,
+     1683, 1673, 1674, 1684, 1676,   68, 1675, 1679, 1687, 1688,
+     1678,   68, 1690, 1697, 1730,   68, 1730,   68,   68,   68,
+       68, 1680,   68, 1681, 1682,   68, 1689, 1683,   68, 1691,
+     1684, 1692, 1693, 1694,   68, 1687, 1688,   68, 1695,   68,
+     1697,   68, 1698,   68, 1699,   68,   68, 1696, 1730, 1700,
+     1730, 1701,   68, 1689,   68, 1730, 1691, 1702, 1692, 1693,
+
+     1694,   68, 1703, 1705,   68, 1695, 1706, 1707, 1730, 1698,
+     1709, 1699, 1704, 1708, 1696,   68, 1700,   68, 1701,   68,
+       68,   68,   68, 1710, 1702, 1711,   68,   68, 1713, 1703,
+       68,   68,   68, 1706, 1707, 1712,   68, 1709, 1714, 1704,
+     1708, 1715, 1719, 1716, 1720, 1717,   68,   68, 1718, 1721,
+     1710,   68, 1711,   68, 1722, 1713, 1730,   68, 1723, 1730,
+     1724, 1725, 1712, 1728,   68, 1714, 1729,   68, 1715,   68,
+     1716, 1720, 1717, 1730,   68, 1718,   68, 1730,   68, 1730,
+     1730,   68,   68,   68, 1726, 1723, 1727, 1724, 1725, 1730,
+       68, 1730,   68,   68,   68, 1730, 1730, 1730, 1730, 1730,
+
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1726, 1730, 1727,   40,   40,   40,   40,   40,   40,
+       40,   45,   45,   45,   45,   45,   45,   45,   50,   50,
+       50,   50,   50,   50,   50,   56,   56,   56,   56,   56,
+       56,   56,   61,   61,   61,   61,   61,   61,   61,   71,
+       71, 1730,   71,   71,   71,   71,  124,  124, 1730, 1730,
+     1730,  124,  124,  126,  126, 1730, 1730,  126, 1730,  126,
+      128, 1730, 1730, 1730, 1730, 1730,  128,  131,  131, 1730,
+     1730, 1730,  131,  131,  133, 1730, 1730, 1730, 1730, 1730,
+      133,  135,  135, 1730,  135,  135,  135,  135,   72,   72,
+
+     1730,   72,   72,   72,   72,   13, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730
     } ;
 
-static yyconst flex_int16_t yy_chk[4747] =
+static yyconst flex_int16_t yy_chk[5072] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -1504,520 +1573,556 @@ static yyconst flex_int16_t yy_chk[4747] =
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    3,    3,    3,    4,    4,
         4,    5,    5,    6,    6,    5,   24,    6,    7,    7,
-        7,    7, 1633,    7,    8,    8,    8,    8,   24,    8,
+        7,    7, 1736,    7,    8,    8,    8,    8,   24,    8,
         9,    9,    9,   10,   10,   10,   15,   44,   44,   49,
 
        15,    3,   49,   24,    4,   60,   60,    5,   19,    6,
-       19,   19,   69,   19,  625,    7,   69,   39,   19,   39,
-       39,    8,   39,   23,   20,   20,    9,   39,  619,   10,
+       19,   19,   69,   19,  644,    7,   69,   39,   19,   39,
+       39,    8,   39,   23,   20,   20,    9,   39,  638,   10,
        11,   11,   11,   11,   11,   11,   12,   12,   12,   12,
        12,   12,   20,   23,   27,   19,   23,   29,   20,   11,
-       23,   20,   20,  132,   21,   12,   27,   25,  619,   29,
-      130,   21,  124,  124,   28,   25,  129,   11,   21,   20,
-       23,   27,  126,   12,   29,  126,   11,  131,  131,  127,
+       23,   20,   20,  133,   21,   12,   27,   25,  638,   29,
+      131,   21,  125,  125,   28,   25,  130,   11,   21,   20,
+       23,   27,  127,   12,   29,  127,   11,  132,  132,  128,
        21,   21,   12,   25,   25,   75,   28,   26,   21,   37,
        26,   28,   25,   30,   37,   21,   22,   26,   32,   26,
 
        22,   30,   37,   22,   32,   22,   22,   30,   75,   31,
-       26,   30,   75,   31,   26,  125,   37,   26,   22,   30,
-       30,   37,  205,   22,   26,   32,   26,   22,   30,   31,
-       22,   89,   22,   22,   30,   31,   31,   33,   30,   34,
-       31,  123,   36,   33,   36,   55,   33,   55,   55,   34,
-       55,  205,   34,   33,   89,   33,   31,  148,   89,   36,
-       63,   34,   63,   63,   33,   63,   34,   35,   36,   36,
-       33,   36,   65,   33,   38,   67,   34,   35,   38,   34,
-       33,   35,   35,  148,  148,   65,   36,   61,   66,   35,
-       66,   66,   56,   66,   35,   51,   76,   63,   74,   65,
+       26,   30,   75,   31,   26,  126,   37,   26,   22,   30,
+       30,   37,  209,   22,   26,   32,   26,   22,   30,   31,
+       22,  124,   22,   22,   30,   31,   31,   33,   30,   55,
+       31,   55,   55,   33,   55,   34,   33,   67,   36,   34,
+       36,  209,   61,   33,   56,   33,   31,   93,   66,   34,
+       66,   66,   34,   66,   33,   36,   51,  114,   35,  139,
+       33,   34,   34,   33,   36,   36,   34,   36,   35,   74,
+       33,   38,   35,   35,   65,   38,   34,   50,   93,   34,
+       35,   63,   36,   63,   63,   35,   63,   65,  114,  129,
 
-       38,   38,   77,   76,   35,   38,   82,   50,   35,   35,
-       68,   82,   68,   68,   71,   68,   71,   71,   78,   71,
-       68,   79,   74,   76,   71,   74,   77,   78,   80,   77,
-       81,   85,   83,   82,   79,   84,   45,   87,   88,   81,
-       83,   90,   86,   80,   85,   78,   87,   88,   79,   86,
-       40,   71,   84,   92,   91,   80,   92,   81,   85,   83,
-       93,   99,  185,   90,   87,   88,   84,   91,   90,   86,
-       92,   96,   95,   97,   94,   96,   97,   92,   14,   84,
-       92,   91,   94,   92,   99,  100,  102,  185,   99,  185,
-       98,   93,   95,  101,   95,   96,  103,   92,   96,   95,
+      139,  129,  129,   74,  129,   35,   74,   38,   38,   35,
+       35,   65,   38,   68,   76,   68,   68,   71,   68,   71,
+       71,   76,   71,   68,   77,   78,   79,   71,   63,   80,
+       82,   81,   84,   45,   78,   82,   40,   77,   83,   79,
+       81,   76,   85,   86,   80,   90,   83,   14,   77,   84,
+       86,   77,   78,   79,   71,   85,   80,   82,   81,   87,
+       89,   91,   88,   84,   77,   83,   98,   90,   87,   85,
+       86,   88,   90,   94,   91,   92,   84,   13,   92,   98,
+       99,   94,   97,   89,   95,   97,   87,   89,   91,   88,
+       96,    0,   92,   98,   96,  100,  101,  105,  102,   92,
 
-       97,   94,   96,   98,  104,  100,  102,  101,  113,  105,
-      103,  104,  100,  102,  108,  106,  109,   98,  107,   95,
-      101,  108,  107,  103,  106,  110,  111,   13,    0,  112,
-      109,  104,  105,  114,  111,  115,  105,  110,  112,  113,
-      107,  108,  106,  109,  119,  107,  117,    0,  114,  107,
-      116,  121,  110,  111,  120,  115,  112,  117,  118,  116,
-      114,  115,  115,  122,  118,  119,  121,    0,    0,  119,
-        0,  119,  122,  117,  138,  136,  120,  116,  121,  137,
-        0,  120,  115,  145,  128,  118,  128,  128,    0,  128,
-      122,  133,  119,  133,  133,  134,  133,  134,  134,  136,
+       94,  104,   92,   99,   95,   92,   95,   99,  104,   97,
+      101,   95,  103,    0,   96,  100,    0,   96,  102,   92,
+      105,   96,  100,  101,  105,  102,  103,  106,  104,  107,
+      108,   95,  110,  107,  109,  111,  106,  108,  115,  103,
+      112,  109,  147,  113,  119,    0,  110,  111,  112,  116,
+      119,  107,  113,  115,  106,  117,  107,  108,  120,  110,
+      107,  109,  111,  118,  117,  115,  121,  112,  123,  116,
+      113,  119,  122,  147,  118,  116,  116,  123,  137,  120,
+        0,    0,  117,  120,    0,  120,  138,  122,  121,  134,
+      118,  134,  134,  121,  134,  123,  116,  140,  135,  122,
 
-      134,  137,  136,  139,  140,  138,  137,  141,  143,  142,
-      149,  144,    0,  143,  145,  139,  142,    0,  149,  141,
-      146,    0,  150,  140,  151,  153,  157,  152,  151,  154,
-      139,  140,  134,  144,  141,  157,  142,  149,  144,  143,
-      143,  146,  154,  155,  150,  162,    0,  153,  146,  150,
-      152,  151,  153,  157,  152,  155,  154,  156,    0,    0,
-      156,  158,    0,  159,  160,    0,  161,  165,  146,  147,
-      155,  160,  156,  163,  147,  167,  162,  161,  168,  147,
-      170,  167,    0,  158,  156,  147,  147,  156,  158,  159,
-      159,  160,  147,  161,  164,  169,  147,  166,  165,  163,
+      135,  135,  137,  135,  141,  137,  120,  142,  138,  140,
+      143,  144,  145,  138,  146,  142,    0,  145,  144,  148,
+        0,  151,  143,  141,  140,  150,  153,  152,    0,  151,
+      153,  141,  154,  156,  142,  135,  146,  143,  144,  155,
+      148,  146,  160,  145,  145,  157,  156,  148,  151,  152,
+        0,  150,  150,  153,  152,  154,  161,  157,    0,  154,
+      156,  155,  158,  164,  160,  158,  155,  148,  149,  160,
+      159,    0,  157,  149,  162,  161,  163,  158,  149,  159,
+      165,  162,  161,  161,  149,  149,  166,  163,  167,  158,
+      170,  149,  158,  169,  164,  149,  166,  159,  168,  169,
 
-      163,  147,  167,  171,  164,  173,  147,    0,  172,  168,
-        0,  170,  147,  147,  174,  166,  175,  169,  176,  177,
-      180,  174,  169,  176,  166,  164,  173,  178,  172,  179,
-      183,  164,  173,  184,  171,  172,  179,  175,  177,  178,
-      184,  174,  180,  175,  181,  176,  177,  180,  186,  181,
-      182,  182,  187,  190,  178,  188,  179,  189,  192,  182,
-      184,  183,    0,  188,  191,  198,  194,  200,  186,    0,
-      197,  181,  189,  193,    0,  186,  200,  182,  182,  190,
-      190,  194,  188,  187,  189,  196,  191,  198,  195,  192,
-      193,  199,  198,  194,  200,  191,  195,  201,  193,  203,
+      149,  162,  161,  163,  171,  149,  165,  165,  172,  173,
+      174,  149,  149,    0,  175,  176,  168,  166,    0,  167,
+      169,  170,  176,  166,  177,  168,  171,  178,  179,    0,
+      174,  171,  178,  186,  180,  175,  181,  174,  183,  172,
+      173,  175,  176,  182,  184,  177,  187,  179,  181,  184,
+      182,  177,  188,  187,  178,  179,  180,  185,  185,  190,
+      183,  180,  189,  181,  186,  183,  185,  191,  192,  194,
+      182,  184,  193,  187,  195,  191,  196,  188,  200,  188,
+      198,  197,  189,  192,  185,  185,  202,  199,  198,  189,
+      190,  194,    0,  196,  191,  192,  197,  201,  193,  193,
 
-      193,  197,  204,  199,  196,  202,  210,  202,  206,  213,
-      207,  208,  196,  191,  214,  195,  201,  193,  199,  209,
-      211,  212,  208,  203,  201,  215,  203,  214,  204,  204,
-      210,  209,  202,  210,  206,  206,  207,  207,  208,  212,
-      213,  214,  216,  211,  217,  219,  209,  211,  212,  218,
-      224,  215,  215,  220,  219,  222,  218,  221,  223,  220,
-      226,  230,  227,  225,  216,    0,    0,  223,  228,  216,
-      235,  221,  219,  224,    0,  217,  218,  224,  225,  230,
-      220,  222,  222,  228,  221,  223,  227,  232,  230,  227,
-      225,  226,  231,  229,  233,  228,  229,  235,  231,  234,
+      194,  196,  204,  196,  203,  195,  199,  198,  197,  200,
+      206,  204,  206,  205,  199,  207,  203,  202,  194,  201,
+      196,  208,    0,  210,  201,  211,    0,  212,  216,  204,
+      215,  203,  205,  213,  214,  217,  219,  206,  212,  207,
+      205,  221,  207,  218,    0,  213,  216,  208,  208,  210,
+      210,  211,  211,  215,  212,  216,  218,  215,  214,  220,
+      213,  214,  219,  219,  222,  223,  217,  224,  225,  227,
+      218,  222,  221,  224,  223,  226,  228,  231,  227,  229,
+      232,  220,  225,  230,    0,  233,  220,  234,  229,  240,
+      234,  222,  223,  235,  224,  225,  227,  234,  230,  228,
 
-      234,  232,  237,  229,  236,  237,  238,  239,  240,  233,
-      245,    0,  237,  242,  232,  241,  252,    0,  238,  231,
-      229,  233,  247,  229,  234,  239,  234,  234,  236,  237,
-      253,  236,  237,  238,  239,  240,  243,  241,  244,  242,
-      242,  245,  241,  246,  247,  244,  249,  252,  243,  247,
-      246,  248,  253,  248,  251,  250,  254,  253,  250,  249,
-      250,  255,  254,  243,  256,  244,  250,    0,  255,  267,
-      246,  257,  251,  249,    0,  248,  256,  258,  248,  259,
-      248,  251,  250,  254,  257,  250,  264,  250,  255,  262,
-      261,  256,  259,  258,  264,    0,  265,  263,  257,  269,
+      233,  226,  226,  228,  232,  237,  229,  232,  231,  236,
+      230,  235,  233,  238,  234,  236,  240,  234,  241,  237,
+      235,  239,  239,  242,  245,  243,  242,  248,  238,  244,
+        0,    0,  237,  242,  247,  246,  236,  243,  251,  248,
+      238,  253,  241,  249,    0,  241,  239,  244,  239,  239,
+      242,  245,  243,  242,  248,    0,  244,  246,  249,  250,
+      247,  247,  246,  253,  252,  254,  250,  254,  253,  251,
+      249,  252,  255,  256,  259,  257,  256,  258,  256,    0,
+      261,    0,  260,  262,  256,  255,  250,  261,  260,  254,
+      264,  252,  254,  257,  254,  262,  259,  268,  263,  255,
 
-      267,  258,  261,  263,  258,  266,  259,  262,  265,  271,
-      350,  269,  266,  264,    0,  270,  262,  261,  268,  274,
-      258,  260,  260,  265,  263,  268,  269,  270,  273,  272,
-      276,  260,  266,  260,  260,  260,  272,  350,  260,    0,
-      271,  273,  270,  275,  278,  268,  260,    0,  260,  260,
-      274,  278,  276,  283,  275,  273,  272,  276,  260,  281,
-      260,  260,  260,  277,  277,  260,  279,  280,  285,  286,
-      275,  278,  281,  282,  284,    0,  283,  279,  280,  287,
-      283,  285,  286,  284,    0,  288,  281,  286,  289,  291,
-      290,  293,  277,  279,  280,  285,  286,  287,  282,  294,
+      256,  259,  257,  256,  267,  256,  264,  261,  258,  260,
+      262,  263,  269,  265,  264,  268,  267,  264,  269,  270,
+      271,  272,    0,  276,  268,  263,  265,  270,  272,  273,
+      274,  267,  271,  264,  274,  276,  275,  277,  279,  269,
+      265,  266,  266,  275,  278,  279,  270,  271,  272,  277,
+      276,  266,  281,  266,  266,  266,    0,  274,  266,  280,
+      273,    0,  282,  275,  277,  279,  266,  285,  266,  266,
+      283,  289,  280,  282,  285,  278,  284,  284,  266,  286,
+      266,  266,  266,  281,  287,  266,  280,  288,  292,  282,
+      286,  293,  283,  290,  285,  287,  289,  283,  289,  291,
 
-      282,  284,  292,  297,  296,  295,  287,  288,  290,  286,
-      298,  289,  288,  318,  293,  289,  298,  290,  293,  295,
-      291,  294,  299,  292,  300,  301,  294,  302,  303,  292,
-      296,  296,  295,  305,  297,  304,  308,  298,  307,  300,
-      299,  304,  308,  310,  318,  315,    0,  309,  301,  299,
-      303,  300,  301,  302,  302,  303,  311,  316,  315,  305,
-      305,  310,  304,  308,  307,  307,  309,  317,  313,  314,
-      310,  311,  315,  319,  309,  313,  314,  323,  322,  316,
-      320,  321,  319,  311,  316,  320,  317,  321,  324,  323,
-      326,  325,    0,    0,  317,  313,  314,    0,  326,    0,
+      288,  292,  295,  294,  293,  284,  286,  297,  291,  293,
+      296,  287,  298,  300,  288,  292,  290,  299,  293,  301,
+      290,  294,  305,    0,  295,  297,  291,  302,  303,  295,
+      294,  293,  304,  296,  297,  306,  300,  296,  299,  307,
+      300,  306,  303,  298,  299,  301,  301,  309,  308,  302,
+      310,  311,    0,  305,  302,  303,  313,  307,  304,  304,
+      315,  312,  306,  308,    0,  316,  307,  312,  323,  319,
+      309,  316,  317,  311,  309,  308,  310,  310,  311,  318,
+      324,  323,  313,  313,  319,  326,  315,  315,  312,  325,
+      331,  317,  316,  321,  322,  323,  319,  318,  324,  317,
 
-      319,  322,  325,  329,  323,  322,  328,  320,  321,    0,
-      324,  330,  331,  328,  329,  324,  332,  326,  325,  327,
-      330,    0,  333,  332,  327,  334,  327,  334,  335,  336,
-      329,    0,  339,  328,  327,  337,  331,  346,  341,  331,
-      339,  336,  330,  332,  327,  327,  327,  330,  333,  333,
-      337,  327,  334,  327,  335,  335,  336,  338,  340,  339,
-      341,  327,  337,  340,  342,  341,  343,  344,  346,  338,
-      359,  327,  345,  347,  343,  349,  357,  348,  354,  344,
-      357,  351,  342,  352,  338,  340,  348,  353,  347,  349,
-      354,  342,  355,  343,  344,  345,  351,  359,  352,  345,
+      321,  322,  327,  329,  326,  328,  318,  324,  329,  330,
+      332,  325,  326,  331,  328,  330,  325,  331,  333,  335,
+      321,  322,  332,  334,    0,    0,  342,  335,  337,    0,
+      329,    0,  328,  327,  334,  337,  330,  332,  338,  339,
+      333,    0,    0,    0,  340,  333,  335,  341,  339,  338,
+      334,  336,  342,  342,  341,  337,  336,  343,  336,  343,
+      344,  345,  349,    0,  346,  338,  336,  349,  340,  347,
+      339,  340,  348,  345,  341,  339,  336,  336,  336,  346,
+      348,  347,  350,  336,  343,  336,  344,  344,  345,  349,
+      351,  346,  352,  336,  353,  354,  347,  355,  356,  348,
 
-      347,  358,  349,  360,  348,  354,  356,  357,  351,  356,
-      352,  353,  361,  362,  353,  358,  355,  356,  363,  355,
-      364,  365,  366,  367,  368,    0,  372,  365,  358,  369,
-      360,  370,  371,  356,  374,    0,  356,  376,  373,  371,
-      362,  378,    0,  361,  366,  363,  367,  374,  365,  366,
-      367,  364,  369,  370,  380,  368,  369,  372,  370,  371,
-      373,  374,  375,  376,  376,  373,  377,  375,  381,  379,
-      382,  375,  378,  385,  383,  377,  387,  384,  380,    0,
-        0,  380,  398,  391,  385,  388,  375,  379,  383,  375,
-      381,  381,  382,  377,  375,  381,  379,  382,  375,  384,
+      352,    0,  357,  336,  350,  360,  353,  359,  351,  350,
+      358,  357,  361,  356,  363,  362,  365,  351,  354,  352,
+      371,  353,  354,  364,  358,  356,  359,  361,  355,  357,
+      362,  369,  360,  366,  359,  364,  366,  358,  363,  361,
+      365,  363,  362,  365,  366,  367,  370,  368,  372,  367,
+      364,  371,  373,  374,  378,  376,  375,    0,  369,  380,
+      366,  368,  375,  366,  377,  379,  382,  383,    0,  389,
+        0,  381,    0,  370,  368,  372,  367,  376,  381,  373,
+      384,  380,  376,  375,  374,  378,  380,  377,  379,  383,
+      385,  377,  379,  384,  383,  385,  387,  382,  381,  385,
 
-      385,  383,  389,  386,  384,  391,  388,  387,  390,  393,
-      391,  392,  388,  398,    0,  394,  395,  381,  386,  396,
-      392,  397,  393,    0,  400,  397,  389,  399,    0,  389,
-      386,  402,  390,    0,  404,  390,  393,  394,  392,  400,
-      395,  396,  394,  395,  414,  399,  396,  403,  400,  401,
-      409,  400,  397,  401,  399,  403,  402,  407,  402,  404,
-      405,  404,  406,  408,  410,  407,  400,  411,    0,  405,
-      408,  406,  412,  409,  403,  414,  413,  409,  415,  411,
-      401,  412,  410,  416,  407,  417,  415,  405,  413,  406,
-      408,  410,  419,  420,  411,  418,  423,    0,  421,  412,
+      389,  386,  388,  390,    0,  387,    0,  384,  391,  393,
+      394,  392,  398,    0,  385,  388,    0,  385,  395,    0,
+      400,  390,  385,  387,  394,  399,  385,  386,  386,  388,
+      390,  393,  391,  392,  392,  391,  393,  394,  392,  396,
+      395,  397,  402,  398,  400,  395,  399,  400,  401,  403,
+      396,  405,  399,  406,  404,  408,  397,  407,  403,  408,
+      392,  410,    0,    0,  402,    0,  396,  404,  397,  402,
+      411,  409,  401,  405,  414,  401,  403,  406,  405,  407,
+      406,  404,  415,  416,  407,  409,  408,  412,  411,  413,
+      415,  417,  410,  413,  418,  422,  419,  411,  409,  414,
 
-        0,  422,  424,  413,  420,  415,  421,  425,  417,  416,
-      416,  418,  417,  426,  419,  422,  423,  427,  429,  419,
-      420,  428,  418,  423,  424,  421,  433,  425,  422,  424,
-      428,  430,  432,  431,  425,  426,  435,    0,  429,  427,
-      426,  434,  435,  436,  427,  429,  431,  440,  428,  430,
-      433,  436,  438,  433,  432,  454,  456,  439,  430,  432,
-      431,    0,  440,  435,  434,  447,  441,  442,  434,  436,
-      436,  444,  443,  444,  440,  441,  454,  447,  436,  450,
-      439,  443,  454,  438,  439,  453,  442,  456,  455,  450,
-        0,  458,  447,  441,  442,    0,  459,  461,  444,  443,
+      417,  414,  412,  418,  419,  420,  426,  421,  416,  415,
+      416,  412,  420,  422,  412,  423,  424,  429,  417,  425,
+      413,  418,  422,  419,  428,  424,  431,  423,  427,  412,
+      421,  425,  420,  430,  421,  436,  427,  426,  435,  433,
+      429,  432,  423,  424,  429,  434,  425,  433,  431,  430,
+      428,  428,  432,  431,  437,  427,  438,  436,  435,  434,
+      430,  440,  436,  439,  441,  435,  433,  443,  432,  442,
+      440,  444,  434,  445,  437,  451,  446,  449,  438,    0,
+      443,  437,    0,  438,  441,  439,  447,  442,  440,  452,
+      439,  441,  447,  444,  443,  449,  442,  445,  444,  446,
 
-      445,  462,    0,  453,  445,  459,  450,  445,  460,  463,
-      460,  455,  453,  458,  445,  455,  464,  445,  458,    0,
-        0,  461,  445,  459,  461,  465,  468,  445,  462,  463,
-      466,  445,  471,  469,  445,  460,  463,  465,  470,  467,
-      469,  445,  464,  464,  445,  457,  470,  457,  468,  472,
-      457,  471,  465,  468,  476,  457,  466,  466,  475,  471,
-      469,  457,  457,  467,  474,  470,  467,  473,  477,  478,
-      457,  479,  457,  474,  457,  472,  472,  457,  481,  473,
-      475,  476,  457,  480,  482,  475,  484,  483,  457,  457,
-      486,  474,  485,  488,  473,  479,  483,  481,  479,  477,
+      445,  448,  453,  446,  449,  454,  451,  455,  468,  448,
+      456,  460,  452,  447,  454,  463,  452,  453,  457,  456,
+      457,  466,  467,  460,  469,  463,  455,  448,  448,  453,
+      471,  468,  454,    0,  455,  468,  448,  456,  460,  466,
+      474,  491,  463,  467,  475,  457,  458,  472,  466,  467,
+      458,  492,  471,  458,  478,  469,  472,  471,  476,  473,
+      458,  473,  477,  458,  474,    0,  478,  474,  458,  479,
+        0,  475,  491,  458,  472,    0,  480,  458,  476,  481,
+      458,  478,  492,    0,    0,  476,  473,  458,  477,  477,
+      458,  470,  470,  489,  470,  479,  479,  470,  483,  482,
 
-      478,  487,  491,  482,  480,  481,  493,  489,  484,  492,
-      480,  482,  485,  484,  483,  489,  498,  486,  494,  485,
-      487,  497,  492,  495,  488,  512,  491,  497,  487,  491,
-      494,  495,  493,  493,  489,  499,  492,  500,  498,  503,
-      504,  499,  502,  498,  500,  494,  501,  495,  497,  502,
-      495,  501,  505,  507,  509,    0,  512,  503,  495,  508,
-      506,  505,  499,  504,  500,  511,  503,  504,  506,  502,
-      510,  507,  508,  501,  513,  509,  514,  510,  511,  505,
-      507,  509,  515,  516,  517,  518,  508,  506,  519,  520,
-      515,  518,  511,  524,  521,  522,  526,  510,  516,  514,
+      480,  481,  470,  480,  484,  483,  481,  482,  470,  470,
+      487,  485,  484,  486,  488,  489,  490,  470,  470,  470,
+      489,  470,  487,  488,  470,  483,  482,  493,  494,  470,
+      485,  484,  500,  495,  496,  470,  470,  487,  485,  486,
+      486,  488,  498,  490,  501,  499,  502,  497,    0,  494,
+        0,  493,  495,  496,  493,  494,  497,  505,  503,  500,
+      495,  496,  506,  501,  498,  499,  503,  507,    0,  498,
+      508,  501,  499,  512,  497,  505,  509,  502,    0,  512,
+      507,  514,  510,  513,  505,  503,  506,  514,  509,  506,
+      510,  515,  519,  518,  507,  517,  508,  508,  515,  516,
 
-      525,  527,  523,  514,  522,  513,  517,  525,  529,  515,
-      516,  517,  518,  528,  519,  519,  523,  538,  521,  532,
-      520,  521,  522,  526,  524,  528,  530,  525,  527,  523,
-      531,  529,  532,  531,  530,  529,  534,    0,  535,  538,
-      528,  536,  537,  536,  538,    0,  532,  541,  539,    0,
-      535,  559,    0,  530,  537,    0,    0,  531,  533,  534,
-      533,  539,    0,  534,  533,  535,  533,  540,  536,  537,
-      541,  533,  542,  543,  541,  539,  533,  545,  559,  544,
-      540,  549,  533,  543,  542,  533,  546,  533,  548,  547,
-      545,  533,  546,  533,  540,  543,  551,  562,  533,  542,
+      512,  523,  517,  509,  516,  513,  510,  520,  514,  510,
+      513,  518,  522,  521,  523,  519,  520,  510,  515,  519,
+      518,  521,  517,  524,  525,  526,  516,  527,  523,  528,
+      522,  525,  529,    0,  520,  530,  535,    0,  526,  522,
+      521,  531,  532,  530,  524,  534,  536,  533,  537,  538,
+      524,  525,  526,  533,  539,  529,  531,  537,  527,  529,
+      528,  541,  530,  538,  532,  542,  543,  535,  531,  532,
+      536,  534,  534,  536,  533,  537,  538,  540,  543,  544,
+      546,  545,  547,  546,  540,  539,  551,  548,  541,  545,
+        0,  553,  542,  543,  548,  547,    0,  550,  551,  552,
 
-      543,  544,  547,  533,  545,  554,  544,  552,  555,  548,
-      543,  553,  549,  546,  550,  548,  547,  556,  551,  550,
-      552,  550,  560,  551,  557,  558,  553,    0,  562,  563,
-      555,  554,  554,  558,  552,  555,  556,  557,  553,  550,
-      550,  550,  564,  565,  556,  560,  550,  567,  550,  560,
-      564,  557,  558,  563,  566,  567,  563,  565,  570,  568,
-      569,  573,  572,  574,  571,  576,  550,    0,  569,  564,
-      565,  571,  583,  576,  567,  572,  566,  568,  578,  573,
-      570,  566,  579,  582,  577,  570,  568,  569,  573,  572,
-      578,  571,  576,  577,  574,  580,  581,  584,  583,  583,
+      554,  552,  544,  553,  540,    0,  544,  546,  545,  547,
+        0,  557,    0,  551,  548,  549,  555,  549,  553,  556,
+      550,  549,  554,  549,  550,  558,  552,  554,  549,  555,
+      565,  559,  556,  549,  557,  560,  561,  558,  557,  549,
+        0,  559,  549,  555,  549,  562,  556,  568,  549,  561,
+      549,  562,  558,  559,  563,  549,  564,  560,  559,  566,
+      549,  565,  560,  561,  566,  567,  566,  563,  559,  568,
+      571,  573,  562,  572,  568,  569,  574,  564,  576,  570,
+      567,  563,  579,  564,  566,  566,  566,  577,  569,  574,
+      573,  566,  567,  566,  570,  572,  571,  571,  573,  575,
 
-      587,  582,  586,  587,  579,  578,  586,  588,  589,  579,
-      582,  577,  590,  591,  593,  592,  594,  580,  581,  590,
-      589,  592,  580,  581,  595,  597,  587,  587,  584,  598,
-      587,  588,  599,  586,  588,  589,  593,  591,  594,  590,
-      591,  593,  592,  594,  596,  595,  597,  604,  600,  601,
-      599,  595,  597,  602,  604,  596,  598,  600,  603,  599,
-      606,  607,  602,  605,  611,  609,  603,  612,  610,  608,
-      613,  596,  615,  601,  604,  600,  601,  605,  608,  611,
-      602,  614,  606,  607,  610,  603,  616,  606,  607,  609,
-      605,  611,  609,  614,  616,  610,  608,  617,  612,  615,
+      572,  580,  569,  574,  581,  576,  570,  575,  582,  584,
+      577,  566,  581,  579,  577,  583,  585,  584,  588,  590,
+      586,  587,  582,  589,  592,  580,  575,  585,  580,  587,
+      589,  581,  590,  591,  597,  582,  584,  583,  586,  600,
+      588,  594,  583,  585,  595,  588,  590,  586,  587,  594,
+      589,  591,  596,  595,  598,  592,  597,  600,  599,  602,
+      591,  597,  601,  604,  596,  608,  600,  604,  594,  605,
+        0,  595,  605,  606,  610,  607,  598,  608,    0,  596,
+      599,  598,  607,  612,  609,  599,  613,  611,  601,  601,
+      602,  609,  608,  611,  604,  605,  605,  606,  610,  605,
 
-      618,  613,  620,  621,  622,  623,  626,  623,  614,  628,
-      617,  620,  622,  616,  627,  618,  628,  629,  630,  626,
-      631,  621,    0,    0,  617,  632,  627,  618,  635,  620,
-      621,  622,  623,  626,  634,  636,  628,  633,  632,  637,
-      635,  627,  631,  636,  639,  638,  641,  631,  629,  630,
-      633,  637,  632,  638,  640,  635,  634,  643,  642,  645,
-      644,  634,  636,  640,  633,  642,  637,  641,  647,  648,
-        0,  639,  638,  641,    0,  646,  649,  650,  648,  645,
-      655,  640,  644,  643,  643,  642,  645,  644,  646,  651,
-      652,  654,  647,  653,  649,  647,  648,  651,  655,  650,
+      606,  610,  607,  614,  615,  612,  616,  617,  613,  619,
+      612,  609,  621,  613,  611,  615,  620,  618,  619,  623,
+      622,  621,    0,  624,  614,  628,  623,  616,  622,  625,
+      614,  615,  626,  616,  617,  618,  619,  624,  630,  621,
+      620,  631,  629,  620,  618,  632,  623,  622,  627,  628,
+      624,  625,  628,  630,  626,  633,  625,  627,  629,  626,
+      634,  636,  635,  637,  639,  630,  640,  633,  646,  629,
+      635,  641,  631,  639,  636,  627,  632,    0,  637,  641,
+      646,  642,  633,  642,  640,  647,  645,  634,  636,  635,
+      637,  639,  647,  640,  648,  646,  649,  650,  641,  645,
 
-      658,  653,  646,  649,  650,  659,    0,  655,  662,  656,
-      657,  663,  652,  659,  654,  658,  651,  652,  654,  660,
-      653,  656,  657,  663,  661,  660,  665,  658,  667,  662,
-      668,  669,  659,  661,  664,  662,  656,  657,  663,  676,
-      670,  664,  671,  668,  665,  672,  660,  670,  673,  672,
-      669,  661,  674,  665,  675,  678,  673,  668,  669,  667,
-      677,  664,  679,  682,  671,  680,  674,  670,  685,  671,
-      676,  686,  675,  687,  684,  673,  672,  678,  681,  674,
-      683,  675,  678,  684,  679,  682,  677,  677,  688,  679,
-      682,  680,  680,  683,    0,  687,  681,  690,    0,  685,
+        0,  651,  652,  653,  654,  655,  656,  659,  642,  657,
+      658,  660,  647,  645,  656,  652,  653,  655,  658,  650,
+      660,  657,  661,  651,  650,  648,  654,  649,  651,  652,
+      653,  654,  655,  656,  659,  662,  657,  658,  660,  663,
+      665,  664,  662,  661,  666,  667,  668,    0,    0,  661,
+      671,  673,  669,  670,  672,  668,  675,  666,  671,  673,
+      665,  674,  662,  664,    0,  663,  663,  665,  664,  667,
+      669,  666,  667,  668,  675,  670,  672,  671,  673,  669,
+      670,  672,  676,  675,  674,  677,  678,  679,  674,  681,
+      680,  682,  684,  688,  676,  681,  685,  677,  680,  683,
 
-      687,  684,  686,  689,  692,  681,  693,  683,  689,  695,
-      689,  688,  689,  690,  694,  688,  698,  696,  693,  697,
-      701,  689,  695,  694,  690,  696,  700,  692,  700,  698,
-      689,  692,  703,  693,  705,  689,  695,  689,  697,  689,
-      699,  694,  702,  698,  696,  708,  697,  701,  706,  699,
-      709,  710,  707,  700,  702,  712,  713,  709,  705,  703,
-      707,  705,  711,  713,  714,  716,  715,  699,  717,  702,
-      706,  718,  708,  722,  723,  706,  719,  709,  710,  707,
-      718,  720,  712,  713,  711,  715,  714,  716,  724,  711,
-      725,  714,  716,  715,  717,  717,  726,  719,  718,  727,
+      682,    0,  679,  685,  684,  692,  678,  686,  689,  676,
+      690,    0,  677,  678,  679,  691,  681,  680,  682,  684,
+      683,  689,  691,  685,  688,  686,  683,  692,  695,  690,
+      694,  696,  692,  697,  686,  689,  693,  690,  694,  698,
+      693,  700,  691,    0,  701,  696,  699,    0,  702,  705,
+      707,  697,  706,  708,  695,  695,  704,  694,  696,  703,
+      697,  706,  705,  700,    0,  709,  701,  693,  700,  712,
+      698,  701,  699,  699,  702,  702,  705,  703,  704,  706,
+      710,  707,  714,  704,  708,  712,  703,  709,  711,  715,
+      716,  718,  709,  711,  717,  711,  712,  711,  717,  716,
 
-      728,  720,  729,  719,  722,  723,  730,  727,  720,  732,
-      724,  735,  733,  730,  726,  724,  728,  734,  731,  733,
-      735,  725,  731,  726,  734,  736,  727,  728,  737,  729,
-      738,  740,  738,  730,  739,  737,  748,  741,  735,  733,
-      732,  741,  745,  739,  734,  731,  742,  746,  749,  748,
-      744,  736,  736,  740,  744,  737,  751,  738,  740,  747,
-      745,  739,  750,  748,  741,    0,  746,  752,  742,  745,
-      753,  753,  751,  742,  746,  752,  755,  758,  754,  749,
-      762,  744,  756,  751,  747,  750,  747,  754,  757,  750,
-      759,  756,  762,  760,  752,  757,  764,  753,  755,  759,
+      719,  715,  720,  710,  718,  714,  711,  710,  719,  714,
+      721,  723,  724,  723,  725,  711,  715,  716,  718,  722,
+      711,  720,  711,  721,  711,  717,  725,  719,  722,  720,
+      726,  728,  729,  731,  730,  733,  732,  721,  723,  724,
+      735,  725,  730,  732,  734,  736,  722,  737,  739,  738,
+      745,  740,  736,  743,  729,  728,  741,  726,  728,  729,
+      731,  730,  733,  732,  742,  741,  734,  735,  738,  737,
+      739,  734,  736,  743,  737,  739,  738,  740,  740,  746,
+      743,  745,  747,  741,  748,  742,  750,  749,    0,  752,
+      751,  742,  753,  754,  750,  755,  757,  754,    0,  753,
 
-      758,  760,  763,  755,  758,  754,  761,  762,  765,  756,
-      763,  773,  766,  767,  768,  757,  770,  759,  764,  761,
-      760,  771,  767,  764,  769,  772,  774,  771,  765,  763,
-        0,  777,  768,  761,  766,  765,  769,  770,  775,  766,
-      767,  768,  773,  770,  778,  780,  779,  772,  771,  782,
-      781,  769,  772,  780,  781,  783,  787,  774,  777,  779,
-      784,  785,  785,  783,  775,  775,  778,  786,  784,  788,
-      789,  778,  780,  779,  794,  786,  782,  787,  789,  795,
-      794,  781,  783,  787,  790,  791,  793,  784,  785,  796,
-      792,  795,  790,  791,  786,  799,  797,  789,  792,  793,
+        0,  760,  759,  757,  747,  749,  751,  758,    0,  747,
+      746,  759,  756,  750,  749,  748,  752,  751,  756,  753,
+      754,  764,  758,  757,  761,  756,  755,  760,  760,  759,
+      762,  761,  762,  763,  758,  769,  765,  766,  774,  756,
+      765,  772,  763,  764,  771,  756,  768,  770,  764,  773,
+      768,  761,    0,  769,  772,    0,  775,  762,    0,  766,
+      763,  774,  769,  765,  766,  774,  770,  776,  772,  771,
+      779,  771,  775,  778,  770,  776,  780,  768,  777,  777,
+      773,  781,  778,  775,  782,  780,  783,  786,  781,  785,
+      784,    0,  779,  788,  776,  783,    0,  779,  784,  786,
 
-      788,  794,  798,  800,  802,  803,  795,  801,  806,  799,
-      804,  790,  791,  793,  801,  796,  796,  792,  797,  805,
-      810,  800,  799,  797,  811,  798,  805,  803,  812,  798,
-      800,  802,  803,  804,  801,  808,  814,  804,  816,  806,
-      818,  820,  810,  819,  808,  822,  805,  810,  824,  823,
-      811,  811,  821,  820,  821,  825,    0,  827,  822,  812,
-      824,  829,  808,  814,  818,  816,  826,  818,  820,  819,
-      819,  823,  822,  826,  830,  824,  823,  829,  831,  821,
-      828,  832,  825,  827,  827,  828,  831,  834,  829,  835,
-      842,  836,  837,  826,  844,  840,  834,  830,    0,  837,
+      778,  788,  785,  780,  789,  777,  787,  782,  781,  790,
+      791,  782,  792,  783,  786,  794,  785,  784,  787,  796,
+      788,  792,  793,  795,  798,  796,  789,  794,  799,  790,
+      797,  789,  791,  787,  800,  802,  790,  791,  803,  792,
+      793,  804,  794,  805,  795,  806,  796,  803,  808,  793,
+      795,  814,  797,  806,  807,  798,  805,  797,  807,  799,
+      800,  800,  802,  804,    0,  803,  809,  813,  804,  810,
+      805,    0,  806,  812,  809,  808,  815,  810,  811,  811,
+      822,  812,  814,  816,  815,  807,  819,  817,  813,  818,
+      821,  816,  820,  809,  813,  817,  810,  818,  820,  819,
 
-      846,  830,  835,  832,  838,  831,  839,  828,  832,  849,
-      841,  838,  849,  839,  834,  845,  835,  836,  836,  837,
-      840,  842,  840,  843,  847,  844,  850,  846,  845,  851,
-      843,  838,  841,  839,  852,  854,  849,  841,  855,    0,
-      853,  852,  845,  853,  851,  847,  857,  858,  860,  858,
-      843,  847,  850,  850,  856,  853,  851,    0,  861,  859,
-      855,  852,  862,  868,  853,  855,  854,  853,  857,  863,
-      853,  862,  856,  857,  858,  865,  867,  863,  869,  860,
-      864,  856,  853,  859,  861,  861,  859,  864,  866,  862,
-      868,  887,  866,  874,  871,  870,  863,  865,  867,  872,
+      812,  823,  821,  815,  824,  811,  822,  822,  825,  830,
+      816,  826,  831,  819,  817,  834,  818,  821,    0,  820,
+      827,  832,  825,  823,  827,  829,  833,  824,  823,  826,
+      839,  824,  829,  833,  831,  825,  830,  827,  826,  831,
+      836,  838,  840,  842,  832,  827,  834,  827,  832,  836,
+      844,  827,  829,  833,  846,  853,  839,  839,  847,  848,
+      849,  850,  849,  838,  827,    0,    0,  836,  838,  851,
+      842,  848,  854,  840,  850,  855,  860,  844,  846,  854,
+      852,  846,  853,  872,  847,  847,  848,  849,  850,  856,
+      857,  851,  852,  864,  856,  858,  851,  859,  860,  854,
 
-      869,  871,  865,  867,  870,  869,  872,  864,  874,  876,
-      873,  875,  877,    0,  882,  866,  881,  878,  887,  877,
-      874,  871,  870,  873,  878,  875,  872,  879,  881,  883,
-      889,  884,  883,  879,  882,  890,  888,  873,  875,  877,
-      876,  882,  884,  881,  878,  892,  890,  883,  891,  894,
-      895,  896,  889,  892,  879,  898,  883,  889,  884,  883,
-      888,  893,  890,  888,  893,  899,  891,  894,  903,  898,
-      897,  900,  892,  907,  899,  891,  894,  897,  896,  893,
-      902,  895,  898,  901,  900,  901,    0,  905,  893,  902,
-      904,  893,  899,  908,  903,  903,  905,  897,  900,  909,
+      862,  855,  855,  860,  865,  859,  857,  852,  863,  862,
+      868,  874,  871,  870,  872,    0,  856,  857,  858,  864,
+      864,  863,  858,  866,  859,  867,  865,  862,  868,  869,
+      866,  865,  867,  875,  871,  863,  869,  868,  870,  871,
+      870,  873,  874,  876,  877,  885,  875,  880,  873,  881,
+      866,  879,  867,  884,  879,  882,  869,    0,  887,  886,
+      875,  888,  882,  888,  881,  877,  883,  885,  873,  883,
+      876,  877,  885,  880,  880,  889,  881,  886,  879,  890,
+      887,  883,  882,    0,  884,  887,  886,  891,  888,  892,
+      883,  899,  893,  883,  894,  895,  883,  896,  892,  889,
 
-      910,  904,  908,  912,  907,  911,    0,  902,  913,  914,
-      901,  918,  911,  921,  905,  914,  920,  904,  917,  919,
-      908,  910,  913,    0,  920,  918,  926,  910,  919,  922,
-      909,  933,  911,  914,  912,  913,  914,  917,  918,  923,
-      922,  927,  914,  920,  921,  917,  919,  925,  923,  926,
-      928,  929,  930,  926,  925,  931,  922,  932,  933,  931,
-      937,  935,  934,  927,    0,  936,  923,  941,  927,  932,
-      930,  938,  928,  929,  925,  934,  935,  928,  929,  930,
-      936,  939,  931,  940,  932,  942,  938,  943,  935,  934,
-      939,  937,  936,  945,  941,  946,  948,    0,  938,  949,
+      893,  894,  889,  897,  898,  900,  901,  897,  883,  907,
+      890,  904,    0,  891,  891,  901,  892,  895,  899,  893,
+      905,  894,  895,  906,  904,    0,  898,  900,  896,  902,
+      897,  898,  900,  901,  903,  905,  902,  906,  904,  908,
+      907,  903,  909,  912,  914,  910,  908,  905,  913,  909,
+      906,  910,  916,  919,  920,  915,  902,  927,  915,  923,
+      913,  903,  921,  916,  914,  912,  908,  928,    0,  909,
+      912,  914,  910,  915,  926,  913,  922,  923,  920,  916,
+      919,  920,  915,  924,  921,  915,  923,  922,  927,  921,
+      925,  924,  926,  925,  928,  929,  931,  930,  933,  932,
 
-      947,  950,  952,    0,  940,  956,  954,  951,  939,  942,
-      940,  945,  942,  954,  943,  947,  950,  949,  948,  951,
-      945,  961,  946,  948,  952,  953,  949,  947,  950,  952,
-      955,  957,  956,  954,  951,    0,  959,  963,  953,  958,
-      960,  964,  955,  953,  959,  958,  962,  960,  961,  965,
-      966,  968,  953,  962,  970,    0,  971,  955,  971,  972,
-      969,  974,  957,  959,  963,  953,  958,  960,  964,  969,
-      973,  976,  977,  962,  966,  979,    0,  966,  976,  977,
-      965,  979,  968,  971,  978,  970,  972,  969,  975,  975,
-      975,  978,  974,  980,  986,  975,  973,  973,  976,  977,
+      933,  926,  929,  922,  934,  931,  935,  936,  925,  942,
+      924,  930,  932,  934,  937,    0,  938,  925,  936,  940,
+      925,  944,  929,  931,  930,  933,  932,  947,  940,  945,
+      938,  934,  935,  935,  936,  939,  937,  946,  939,  943,
+      942,  937,  938,  938,  946,  948,  940,  953,  943,  949,
+      945,  952,  944,  939,  954,  949,  945,  938,  947,  948,
+      955,  953,  939,  954,  946,  939,  943,  956,  955,  957,
+      952,    0,  948,  949,  953,  958,  949,  961,  952,  960,
+      957,  954,  949,  962,  958,  963,  960,  955,  966,  964,
+      965,  967,  966,  968,  971,    0,  957,    0,  956,  970,
 
-      981,  981,  979,  975,  982,  983,  985,  987,  988,    0,
-      996,  978,  983,  990,  990,  975,  975,  975,  989,  987,
-      980,  986,  975,  991,  985,  992,  992,  981,  988,  995,
-      982,  982,  983,  985,  987,  988,  989,  993,  998,  997,
-      990,  996,  999, 1001,    0,  989,  997, 1002,  993,  991,
-      991,  995,  992, 1000, 1002, 1003,  995, 1006,  998, 1005,
-     1004, 1001, 1008, 1007,  993,  998,  997, 1003, 1004,  999,
-     1001, 1005, 1009, 1010, 1002, 1000, 1013, 1009, 1006, 1011,
-     1000, 1007, 1003, 1012, 1006, 1011, 1005, 1004, 1009, 1008,
-     1007, 1014, 1016, 1015, 1017, 1017, 1012, 1015, 1018, 1009,
+      961,  969,  958,  967,  961,  962,  960,  963,  965,  971,
+      962,  964,  963,  974,  969,  966,  964,  965,  967,  970,
+      968,  971,  972,  973,  975,  976,  970,  977,  969,  978,
+        0,  973,  980,  979,  976,  982,  983,  972,    0,  975,
+      984,    0,  985,  986,  974,  994,    0,  993,  977,  972,
+      973,  975,  976,  982,  977,  984,  978,  979,  987,  980,
+      979,  986,  982,  983,  985,  988,  989,  984,  990,  985,
+      986,  991,  992,  987,  993,  997,  994,  988,  991,  996,
+      998,  990,  997,  995,  992,  987,  990,  996,  989,  995,
+      999, 1000,  988,  989, 1001,  990, 1002,  999,  991,  992,
 
-     1010, 1019, 1020, 1021, 1009,    0, 1011, 1013, 1030, 1023,
-     1012, 1023, 1022, 1018, 1024, 1025, 1026, 1020, 1014, 1027,
-     1025, 1017, 1031, 1016, 1015, 1018, 1021, 1022, 1029, 1020,
-     1021, 1033, 1019, 1032, 1027, 1030, 1023, 1042, 1034, 1022,
-     1037, 1039, 1025, 1035, 1043, 1024, 1027, 1026, 1041, 1031,
-     1047, 1043, 1029, 1033, 1032, 1029, 1039, 1049, 1033, 1034,
-     1032, 1035, 1037, 1041, 1042, 1034, 1044, 1037, 1039, 1045,
-     1035, 1043, 1046, 1047, 1050, 1041, 1048, 1047, 1045, 1052,
-     1046, 1057, 1053, 1061, 1044, 1062, 1054, 1050, 1049, 1055,
-     1052, 1053, 1063, 1044, 1065, 1062, 1045, 1060, 1048, 1046,
+     1003, 1004,  997, 1006, 1008, 1007,  996,  998,  990, 1009,
+      995, 1009, 1010, 1012, 1007, 1011, 1019,  999, 1000, 1002,
+        0, 1001, 1014, 1002,    0, 1004, 1015, 1017, 1004, 1014,
+     1016, 1003, 1007, 1015, 1006, 1008, 1009, 1016, 1021, 1010,
+     1017, 1011, 1011, 1019, 1012, 1013, 1013, 1013, 1022, 1014,
+     1018, 1024, 1013, 1015, 1017, 1022, 1018, 1016, 1020, 1020,
+     1013, 1025, 1027, 1028, 1021, 1021, 1029, 1029, 1026, 1024,
+     1030, 1035, 1013, 1013, 1013, 1022, 1032, 1018, 1024, 1013,
+     1026, 1028, 1027, 1031, 1031, 1020, 1034, 1032, 1025, 1027,
+     1028, 1036, 1037, 1029, 1038, 1026, 1030, 1030, 1036, 1040,
 
-     1064, 1050, 1067, 1048, 1054, 1052, 1052, 1055, 1057, 1053,
-     1060, 1069, 1062, 1054, 1061, 1070, 1055, 1052, 1063, 1063,
-     1071, 1065, 1067, 1068, 1060, 1064, 1071, 1064, 1072, 1067,
-     1068, 1073, 1075, 1070, 1074, 1078, 1080, 1069, 1069, 1079,
-     1083, 1076, 1070, 1072, 1075, 1080, 1073, 1071, 1076, 1074,
-     1068, 1081, 1084, 1083, 1086, 1072, 1090, 1078, 1073, 1075,
-     1087, 1074, 1078, 1080, 1079, 1090, 1079, 1083, 1076, 1081,
-     1085, 1085, 1088, 1089, 1092, 1091, 1086, 1096, 1081, 1084,
-     1095, 1086, 1091, 1090, 1093, 1087, 1097, 1087, 1095,    0,
-     1096, 1101, 1100, 1098, 1088, 1089, 1108, 1085, 1099, 1088,
+     1039, 1042, 1035, 1032, 1041, 1043, 1044,    0, 1034, 1046,
+     1031, 1041, 1037, 1034,    0, 1044, 1042, 1040, 1036, 1037,
+     1050, 1038, 1039, 1045, 1045, 1047, 1040, 1039, 1042, 1043,
+     1048, 1041, 1043, 1044, 1049, 1046, 1046, 1047, 1048, 1052,
+     1051, 1050, 1054, 1053, 1058, 1055, 1049, 1050, 1053, 1056,
+     1045, 1055, 1047, 1057, 1060, 1063, 1059, 1048, 1051, 1053,
+     1059, 1049, 1056, 1061, 1061, 1062, 1052, 1051, 1064, 1054,
+     1053, 1058, 1055, 1065, 1066, 1053, 1056, 1067, 1068, 1067,
+     1062, 1070, 1095, 1064, 1057, 1060, 1063, 1059, 1069, 1066,
+     1061, 1071, 1062, 1069,    0, 1064, 1065, 1073,    0, 1074,
 
-     1089, 1099, 1091, 1108, 1096, 1092, 1093, 1095, 1098, 1101,
-     1104, 1093, 1102, 1097, 1105, 1107, 1099, 1100, 1101, 1100,
-     1098,    0, 1109, 1108, 1111, 1099, 1113, 1102, 1099, 1107,
-     1116, 1114, 1104, 1109, 1117,    0, 1105, 1104, 1115, 1102,
-     1115, 1105, 1107, 1114, 1118, 1111, 1119, 1113, 1116, 1109,
-        0, 1111, 1120, 1113, 1121, 1123, 1122, 1116, 1114, 1124,
-     1120, 1117, 1118, 1129, 1134, 1115, 1125,    0, 1130, 1123,
-     1128, 1118, 1131, 1119, 1133, 1132, 1138, 1121, 1122, 1120,
-     1138, 1121, 1123, 1122, 1132, 1125, 1124, 1131, 1128, 1137,
-     1129, 1134, 1139, 1125, 1130, 1130, 1133, 1128, 1136, 1131,
+     1065, 1066, 1075, 1076, 1067, 1079, 1071, 1077, 1085, 1068,
+     1078,    0, 1070, 1095, 1077, 1069,    0, 1080, 1071, 1083,
+     1088, 1073, 1081, 1085, 1073, 1074, 1074, 1079, 1087, 1075,
+     1076, 1078, 1079, 1090, 1077, 1085, 1093, 1078, 1080, 1091,
+     1081, 1083, 1092, 1087, 1080, 1089, 1083, 1088, 1091, 1081,
+     1092, 1090, 1089, 1094, 1096, 1087, 1108, 1098, 1100, 1093,
+     1090, 1099, 1103, 1093, 1101, 1106, 1091, 1096, 1098, 1092,
+     1099, 1110, 1089, 1107, 1111, 1094, 1100, 1106, 1112,    0,
+     1094, 1096, 1101, 1098, 1098, 1100, 1107, 1108, 1099, 1103,
+     1114, 1101, 1106, 1109, 1117, 1098, 1116, 1110, 1110, 1111,
 
-     1136, 1133, 1132, 1138, 1139, 1140, 1141, 1142, 1143,    0,
-     1145, 1137,    0, 1144, 1156, 1141, 1137, 1146, 1142, 1139,
-     1147, 1147, 1145, 1148,    0, 1136, 1150, 1140, 1153, 1150,
-     1151, 1148, 1140, 1141, 1142, 1143, 1144, 1145, 1151, 1146,
-     1144, 1156, 1152, 1153, 1146, 1154, 1157, 1147, 1152, 1158,
-     1148, 1154, 1159, 1150, 1160, 1153, 1161, 1151, 1162, 1163,
-     1164, 1165, 1166, 1158, 1168, 1159, 1169, 1167, 1160, 1152,
-     1157, 1173, 1154, 1157, 1164, 1167, 1158, 1172, 1175, 1159,
-     1177, 1160, 1161, 1161, 1170, 1162, 1163, 1164, 1165, 1166,
-     1178, 1168, 1170, 1169, 1167, 1174, 1180, 1176, 1173, 1172,
+     1107, 1111, 1115, 1109, 1119, 1112, 1122, 1118,    0, 1115,
+     1114, 1120, 1117, 1118, 1126, 1121, 1132, 1114, 1122, 1119,
+     1109, 1117, 1116, 1116, 1127, 1123, 1120, 1129, 1124, 1115,
+     1121, 1119, 1123, 1122, 1118, 1124, 1126, 1128, 1120, 1134,
+     1131, 1126, 1121, 1132, 1135, 1129, 1128, 1133, 1133, 1127,
+     1136, 1127, 1123, 1131, 1129, 1124, 1137, 1140, 1139, 1138,
+     1141, 1134, 1143, 1144, 1128, 1139, 1134, 1131, 1138, 1135,
+     1143, 1135, 1136, 1145, 1133, 1149, 1144, 1136, 1137, 1146,
+     1148, 1151, 1141, 1137,    0, 1139, 1138, 1141, 1140, 1143,
+     1144, 1146, 1147, 1150, 1154, 1152, 1151, 1149, 1152, 1147,
 
-     1179, 1177, 1181, 1174, 1172, 1175, 1176, 1177, 1182, 1184,
-     1181, 1170, 1185, 1185, 1178, 1179, 1187, 1178, 1186, 1189,
-        0,    0, 1174, 1180, 1176, 1188, 1179, 1179, 1190, 1181,
-     1190, 1192, 1193, 1191, 1187, 1182, 1184, 1192, 1194, 1185,
-     1188, 1189, 1179, 1187, 1186, 1186, 1189, 1191, 1195, 1196,
-     1194, 1197, 1188, 1198, 1193, 1190, 1199,    0, 1192, 1193,
-     1191, 1201, 1203, 1205, 1197, 1194, 1195, 1196, 1201, 1204,
-     1208, 1209,    0, 1206,    0, 1195, 1196, 1211, 1197, 1199,
-     1203, 1206, 1208, 1199, 1198, 1212, 1209, 1214, 1201, 1203,
-     1216,    0, 1217, 1224, 1205, 1204, 1204, 1208, 1209, 1206,
+     1145, 1153, 1149, 1160, 1162, 1157, 1146, 1158, 1151, 1155,
+        0, 1148, 1154, 1152, 1164, 1162, 1161, 1160, 1150, 1147,
+     1150, 1154, 1152, 1161, 1155, 1152, 1153, 1157, 1153, 1158,
+     1160, 1162, 1157, 1166, 1158, 1164, 1155, 1167, 1168, 1169,
+     1168, 1164, 1170, 1161, 1171, 1172,    0, 1173, 1175, 1167,
+     1174, 1177, 1179, 1176, 1166, 1173, 1182, 1169, 1183, 1179,
+     1166, 1184, 1171, 1178, 1167, 1168, 1169, 1176, 1185, 1170,
+     1175, 1171, 1172, 1174, 1173, 1175, 1183, 1174, 1177, 1179,
+     1176, 1186, 1178, 1182, 1187, 1183, 1189, 1188, 1184, 1191,
+     1178, 1191,    0, 1187, 1185, 1185, 1186, 1192, 1193, 1195,
 
-     1206, 1211, 1213, 1219, 1211, 1217, 1218, 1212, 1206, 1213,
-     1220, 1225, 1212, 1221, 1214, 1222, 1224, 1216, 1219, 1217,
-     1224, 1221, 1226, 1220, 1227, 1229, 1232, 1228, 1231, 1213,
-     1219, 1236, 1218, 1218, 1228, 1225, 1230, 1220, 1225, 1233,
-     1221, 1222, 1222, 1230, 1237, 1235, 1227, 1242, 1229, 1226,
-     1231, 1227, 1229, 1236, 1228, 1231, 1235, 1232, 1236, 1238,
-     1233, 1245, 1239, 1230, 1249, 1251, 1233, 1253, 1248,    0,
-     1254,    0, 1235, 1242, 1242, 1237, 1256, 1257, 1238, 1259,
-     1262, 1256, 1255, 1263, 1266, 1267, 1238, 1239, 1245, 1239,
-     1248, 1249, 1251, 1255, 1265, 1248, 1254, 1254, 1253, 1257,
+     1194, 1196, 1193, 1198, 1197, 1200, 1199,    0, 1186, 1188,
+     1196, 1187, 1194, 1189, 1188, 1197, 1191, 1200, 1201, 1192,
+     1212, 1195, 1202, 1202, 1192, 1193, 1195, 1194, 1196, 1199,
+     1198, 1197, 1200, 1199, 1203, 1205, 1207, 1208, 1206, 1205,
+     1201, 1206, 1203, 1208, 1207, 1201, 1210, 1212, 1213, 1202,
+     1217, 1209, 1210, 1214, 1218, 1215, 1216, 1219, 1221, 1222,
+     1220, 1203, 1205, 1207, 1208, 1206, 1209, 1214, 1215, 1223,
+     1216, 1224, 1213, 1210, 1220, 1213, 1217, 1217, 1209, 1224,
+     1214, 1218, 1215, 1216, 1219, 1221, 1222, 1220, 1225, 1226,
+     1229, 1227, 1230, 1231, 1232, 1233, 1223,    0, 1224, 1227,
 
-     1264, 1268, 1262, 1256, 1257, 1269, 1259, 1262, 1263, 1255,
-     1263, 1266, 1267, 1264, 1270, 1271, 1265, 1274, 1272, 1273,
-     1269, 1265, 1275, 1270, 1276, 1277, 1280, 1264, 1268, 1275,
-     1271, 1279, 1269, 1272, 1273, 1278, 1278, 1284, 1279, 1274,
-     1280, 1270, 1271, 1277, 1274, 1272, 1273, 1281, 1282, 1275,
-     1281, 1276, 1277, 1280, 1283, 1285, 1286, 1287, 1279, 1284,
-     1290, 1282, 1278, 1283, 1284, 1292, 1293, 1290, 1294, 1291,
-     1292, 1296, 1295, 1293, 1281, 1282, 1297, 1285, 1291, 1295,
-     1296, 1283, 1285, 1286, 1287, 1299, 1294, 1290, 1300, 1301,
-        0, 1302, 1292, 1293, 1304, 1294, 1291, 1306, 1296, 1295,
+     1235, 1231, 1234, 1237, 1233, 1238, 1239, 1241, 1243,    0,
+     1236, 1241, 1229, 1238, 1242, 1225, 1226, 1229, 1227, 1230,
+     1231, 1232, 1233, 1234, 1235, 1236, 1242, 1235, 1244, 1234,
+     1237, 1243, 1238, 1239, 1241, 1243, 1236, 1236, 1245, 1246,
+     1249, 1242, 1247, 1247, 1248, 1250, 1245, 1252, 1253, 1252,
+     1254, 1251, 1236, 1260, 1255, 1244, 1254,    0, 1249,    0,
+     1250, 1257, 1253, 1261, 1258, 1245, 1246, 1249, 1256, 1247,
+     1248, 1248, 1250, 1251, 1252, 1253, 1255, 1254, 1251, 1257,
+     1256, 1255, 1258, 1259, 1260, 1263, 1261, 1265, 1257, 1266,
+     1261, 1258, 1263, 1267, 1268, 1256, 1259,    0, 1273, 1270,
 
-     1302, 1301, 1297, 1297, 1303, 1304, 1300, 1307, 1309, 1305,
-     1308,    0, 1299, 1303, 1310, 1300, 1301, 1305, 1302, 1308,
-     1309, 1304, 1310, 1311, 1306, 1313,    0, 1316, 1318, 1317,
-     1311, 1303, 1319, 1313, 1316, 1309, 1305, 1308, 1307, 1320,
-     1322, 1310, 1324, 1323, 1319, 1325,    0, 1329, 1320,    0,
-     1311, 1323, 1313, 1317, 1316, 1318, 1317, 1330, 1331, 1319,
-     1332, 1333, 1330, 1334, 1338, 1337, 1320, 1322, 1340, 1324,
-     1323, 1334, 1325, 1329, 1329, 1335, 1331, 1337, 1339, 1341,
-     1340, 1342, 1332, 1333, 1330, 1331, 1338, 1332, 1333, 1343,
-     1334, 1338, 1337,    0, 1335, 1340, 1344, 1345, 1348, 1349,
+     1271,    0, 1268,    0, 1275, 1265, 1278, 1280, 1276, 1281,
+     1259, 1270, 1263, 1273, 1265, 1266, 1266, 1282, 1271, 1290,
+     1268, 1268, 1281, 1283, 1267, 1273, 1270, 1271, 1275, 1268,
+     1276, 1275, 1277, 1278, 1280, 1276, 1281, 1285, 1283, 1277,
+     1284,    0, 1286, 1282, 1282, 1285, 1290, 1288, 1289, 1291,
+     1283, 1292, 1293, 1284, 1294, 1295, 1297,    0, 1292, 1277,
+        0, 1296, 1295, 1298, 1285, 1293, 1302, 1284, 1286, 1286,
+     1288, 1291, 1289, 1301, 1288, 1289, 1291, 1294, 1292, 1293,
+     1300, 1294, 1295, 1296, 1298, 1303, 1304, 1297, 1296, 1307,
+     1298, 1300, 1311, 1315, 1317, 1301, 1314, 1302, 1319, 1320,
 
-     1339, 1351, 1335, 1350, 1352, 1339, 1341,    0, 1342,    0,
-     1357, 1354, 1355, 1353,    0,    0, 1352, 1361, 1359, 1351,
-     1343, 1358, 1349, 1344, 1345, 1350, 1349, 1355, 1351, 1348,
-     1350, 1352, 1353, 1354, 1357, 1358, 1359, 1357, 1354, 1355,
-     1353, 1360, 1362, 1361, 1361, 1359, 1364, 1366, 1358, 1365,
-     1367, 1369, 1368, 1370, 1364, 1366, 1365, 1373, 1376, 1360,
-     1362, 1371,    0, 1380, 1379, 1382, 1383, 1374, 1360, 1362,
-     1368, 1379, 1370, 1364, 1366, 1373, 1365, 1367, 1369, 1368,
-     1370, 1374, 1381, 1371, 1373, 1376, 1384, 1385, 1371, 1380,
-     1380, 1379, 1382, 1383, 1374, 1386, 1385, 1387, 1388, 1392,
+     1301, 1322, 1327, 1321, 1303, 1323, 1322, 1300, 1325,    0,
+     1331, 1304, 1303, 1304, 1321, 1307, 1307, 1333, 1314, 1311,
+     1315, 1317, 1328, 1314, 1329, 1320, 1320, 1323, 1322, 1319,
+     1321, 1328, 1323, 1327, 1334, 1325, 1329, 1331, 1336, 1333,
+     1335, 1337, 1338, 1339, 1333, 1341,    0, 1340, 1342, 1328,
+        0, 1329, 1347, 1335, 1341, 1345, 1343, 1346, 1344, 1334,
+     1336, 1334, 1340, 1342, 1346, 1336,    0, 1335, 1337, 1338,
+     1339, 1343, 1341, 1344, 1340, 1342, 1348, 1345, 1351, 1347,
+     1349, 1349, 1345, 1343, 1346, 1344, 1350, 1352, 1353, 1354,
+     1352, 1355, 1351, 1350, 1348, 1356, 1355, 1357, 1354, 1358,
 
-     1389,    0, 1395, 1395, 1398,    0, 1381, 1397, 1386, 1381,
-     1396, 1398, 1395, 1384, 1385, 1400, 1397, 1402, 1406,    0,
-     1392,    0, 1386, 1389, 1404, 1388, 1392, 1389, 1387, 1395,
-     1395, 1398, 1396, 1399, 1397, 1401, 1402, 1396, 1405, 1403,
-     1406, 1407, 1400, 1401, 1402, 1406, 1399, 1403, 1407, 1405,
-     1404, 1404, 1408, 1408, 1409,    0, 1410, 1411, 1413, 1416,
-     1399, 1415, 1401, 1410, 1411, 1405, 1403, 1417, 1407, 1418,
-     1415, 1420, 1409, 1422, 1428, 1422, 1421, 1426, 1435, 1408,
-     1427, 1409, 1413, 1410, 1411, 1413, 1416, 1418, 1415, 1420,
-     1417, 1421, 1428, 1430, 1417, 1431, 1418, 1433, 1420, 1426,
+     1359, 1353, 1362, 1348, 1371, 1351,    0, 1349,    0, 1362,
+     1369, 1363, 1366, 1350, 1352, 1353, 1354, 1356, 1355, 1357,
+     1363, 1373, 1356, 1364, 1357, 1365, 1358, 1359, 1364, 1362,
+     1366, 1371, 1365, 1367, 1368, 1372, 1369, 1369, 1363, 1366,
+     1367, 1373, 1374, 1368, 1379, 1380, 1375, 1376, 1373,    0,
+     1364, 1378, 1365, 1372, 1374, 1375, 1376, 1377, 1381, 1378,
+     1367, 1368, 1372, 1382, 1383, 1390, 1391, 1381, 1377, 1374,
+     1384, 1379, 1383, 1375, 1376, 1382, 1380, 1384, 1378, 1386,
+     1395, 1389, 1392, 1396, 1377, 1381, 1393, 1386, 1389, 1390,
+     1382, 1383, 1390, 1391, 1392, 1393, 1399, 1384, 1397, 1401,
 
-     1422, 1428, 1432, 1421, 1426, 1434, 1427, 1427, 1432, 1435,
-     1436, 1437, 1436, 1431, 1434, 1430, 1440, 1439, 1441, 1433,
-     1430, 1442, 1431, 1443, 1433, 1439,    0, 1444, 1440, 1432,
-     1445, 1446, 1434, 1448, 1443, 1444, 1450, 1436, 1437, 1442,
-     1447, 1447, 1451, 1440, 1439, 1441, 1453, 1449, 1442, 1445,
-     1443, 1455, 1454, 1446, 1444, 1449, 1455, 1445, 1446, 1454,
-     1448, 1456, 1457, 1450, 1451, 1459, 1461, 1447, 1458, 1451,
-     1460, 1462, 1463, 1453, 1449, 1464, 1458, 1460, 1455, 1454,
-     1459, 1465, 1467, 1464, 1469,    0, 1462,    0, 1456, 1457,
-     1466, 1466, 1459, 1461, 1463, 1458, 1470, 1460, 1462, 1463,
+     1402,    0, 1406, 1395, 1408,    0, 1386, 1395, 1389, 1392,
+     1396, 1400, 1397, 1393, 1409, 1407, 1411, 1410, 1412, 1400,
+     1407, 1414, 1408, 1399, 1411, 1397, 1401, 1402, 1406, 1406,
+     1415, 1408, 1416, 1414, 1417, 1418, 1409, 1412, 1400, 1410,
+     1419, 1409, 1407, 1411, 1410, 1412, 1417, 1420, 1414, 1421,
+     1422, 1426, 1415, 1423, 1416,    0, 1427, 1415,    0, 1416,
+     1430, 1417, 1418, 1428, 1432,    0, 1429, 1419, 1435, 1431,
+        0, 1421, 1430,    0, 1433,    0, 1421, 1422, 1420, 1427,
+     1423, 1438, 1426, 1427, 1429, 1428, 1432, 1430, 1431, 1433,
+     1428, 1432, 1435, 1429, 1436, 1435, 1431, 1437, 1439, 1438,
 
-     1466, 1472, 1464, 1473, 1470, 1474, 1475, 1476,    0, 1467,
-     1479, 1469, 1465, 1477, 1472, 1481, 1483, 1466, 1466, 1487,
-     1488,    0, 1484, 1470,    0, 1473, 1489, 1492, 1472, 1491,
-     1473,    0, 1474, 1475, 1476, 1477, 1492, 1479, 1487, 1493,
-     1477, 1481, 1481, 1483, 1484, 1500, 1487, 1488, 1489, 1484,
-     1493, 1491, 1496, 1489, 1492, 1495, 1491, 1494, 1494, 1505,
-     1501, 1495, 1499, 1509, 1510, 1507, 1493, 1494, 1512, 1499,
-     1513, 1514, 1500, 1514, 1496,    0, 1510, 1512, 1520, 1496,
-     1517, 1515, 1495, 1501, 1494, 1494, 1505, 1501, 1507, 1499,
-     1509, 1510, 1507, 1515, 1516, 1512, 1518, 1513, 1514, 1522,
+     1440, 1433, 1441, 1436, 1443, 1446, 1444, 1445, 1438, 1448,
+     1447, 1437, 1443, 1444,    0, 1445, 1439, 1450, 1454, 1449,
+     1441, 1436, 1452, 1458, 1437, 1439, 1440, 1440, 1447, 1441,
+     1454, 1443, 1446, 1444, 1445, 1456, 1448, 1447, 1449, 1450,
+     1452, 1453, 1469, 1462, 1450, 1454, 1449, 1461, 1463, 1452,
+     1458, 1464, 1465, 1466, 1461, 1453, 1467, 1470, 1468, 1471,
+     1474, 1456, 1456, 1475,    0, 1467, 1483,    0, 1453, 1462,
+     1462, 1468, 1463, 1469, 1461, 1463,    0, 1479, 1464, 1465,
+     1466, 1474, 1471, 1467, 1470, 1468, 1471, 1474, 1478, 1478,
+     1481, 1480, 1482, 1483, 1475, 1484, 1489, 1481, 1478, 1479,
 
-     1516, 1519, 1517, 1524, 1526, 1520, 1527, 1517, 1515, 1519,
-     1529, 1530, 1531, 1533,    0,    0, 1534, 1532, 1518, 1526,
-        0, 1516, 1533, 1518, 1530, 1532, 1522, 1534, 1519, 1538,
-     1524, 1526, 1527, 1527, 1531, 1539, 1540, 1541, 1530, 1531,
-     1533, 1529, 1539, 1534, 1532, 1541, 1542, 1543, 1545, 1544,
-     1540, 1544, 1538, 1546, 1547, 1542, 1538, 1548, 1543, 1551,
-     1545, 1549, 1539, 1540, 1541, 1550, 1552, 1550, 1557, 1553,
-     1558, 1551, 1547, 1542, 1543, 1545, 1544, 1555, 1559, 1548,
-     1546, 1547, 1553, 1549, 1548, 1556, 1551, 1561, 1549, 1555,
-     1562, 1559, 1550, 1556, 1560, 1561, 1553, 1552, 1563, 1557,
+     1480, 1485, 1486, 1484, 1479, 1482, 1487, 1489, 1488, 1490,
+     1486, 1492, 1492, 1500, 1491, 1478, 1478, 1481, 1480, 1482,
+     1485, 1491, 1484, 1489, 1493, 1497,    0, 1501, 1485, 1486,
+     1494, 1490, 1487, 1487, 1488, 1488, 1490, 1494, 1492, 1495,
+     1500, 1491, 1493, 1502, 1499, 1503, 1495, 1504, 1507, 1497,
+     1501, 1493, 1497, 1499, 1501, 1506, 1508, 1494, 1508, 1503,
+     1513, 1502, 1512, 1507,    0, 1504, 1495, 1514, 1516, 1522,
+     1502, 1499, 1503, 1506, 1504, 1507, 1520, 1523, 1517, 1523,
+     1524, 1518, 1506, 1508, 1512, 1514, 1513, 1513, 1518, 1512,
+     1516, 1519, 1521, 1528, 1514, 1516, 1517, 1519, 1520, 1527,
 
-     1567, 1558, 1564, 1562, 1555, 1559, 1563, 1566, 1560, 1565,
-     1568, 1569, 1556, 1570, 1561, 1566, 1564, 1562, 1575, 1569,
-     1571, 1560, 1567, 1565, 1572, 1563, 1573, 1567, 1576, 1564,
-     1577,    0, 1568, 1574, 1566, 1578, 1565, 1568, 1569, 1570,
-     1570, 1574, 1571, 1578, 1579, 1580, 1572, 1571, 1573, 1575,
-     1577, 1572, 1579, 1573, 1582, 1576, 1581, 1577, 1584, 1585,
-     1574, 1586, 1578, 1587, 1581, 1588, 1590, 1585, 1582, 1586,
-     1591, 1579, 1589, 1593, 1590, 1592, 1580, 1587, 1594, 1595,
-     1584, 1582, 1596, 1581, 1597, 1584, 1585, 1595, 1586,    0,
-     1587, 1588, 1588, 1590, 1589, 1593, 1591, 1591, 1594, 1589,
+     1522, 1521, 1526, 1520, 1523, 1517, 1530, 1524, 1518, 1529,
+     1526, 1527, 1531, 1532, 1536, 1533, 1534, 1537, 1519, 1521,
+     1528, 1532, 1538, 1531, 1530, 1537, 1527, 1535, 1535, 1526,
+     1539, 1541, 1529, 1530, 1533, 1543, 1529, 1544, 1534, 1531,
+     1532, 1536, 1533, 1534, 1537, 1546, 1542, 1547,    0, 1538,
+     1544, 1545, 1539, 1542, 1535, 1548, 1545, 1539, 1541, 1550,
+     1549, 1543, 1543, 1548, 1544, 1551, 1550, 1554, 1552, 1553,
+     1556, 1555, 1546, 1542, 1547, 1549, 1553, 1558, 1545, 1555,
+     1557, 1557, 1548, 1552, 1560, 1561, 1550, 1549, 1563, 1554,
+     1557, 1566, 1551, 1561, 1554, 1552, 1553, 1565, 1555, 1567,
 
-     1593, 1592, 1592, 1598, 1597, 1594, 1595, 1599, 1601, 1596,
-     1600, 1597,    0, 1605, 1603, 1599, 1601, 1604, 1606,    0,
-     1607, 1605, 1610, 1598, 1611, 1608, 1606, 1613, 1614,    0,
-     1598,    0, 1600, 1608, 1599, 1601, 1603, 1600, 1612, 1604,
-     1605, 1603, 1609, 1615, 1604, 1606, 1607, 1607, 1610, 1610,
-     1609, 1611, 1608, 1617, 1613, 1614, 1620, 1623, 1612, 1621,
-     1622, 1624,    0, 1615,    0, 1612,    0, 1621, 1622, 1609,
-     1615,    0,    0,    0,    0, 1617,    0,    0, 1620,    0,
-     1617,    0,    0, 1620, 1623,    0, 1621, 1622, 1624, 1628,
-     1628, 1628, 1628, 1628, 1628, 1628, 1629, 1629, 1629, 1629,
+     1564, 1556, 1568, 1569, 1558, 1571, 1575, 1557, 1557, 1573,
+     1563, 1560, 1561, 1564, 1577, 1563, 1576, 1578, 1566, 1565,
+     1582, 1581, 1586, 1583, 1565, 1569, 1567, 1564,    0, 1568,
+     1569, 1585, 1571, 1575, 1576, 1573, 1573, 1586, 1591, 1578,
+     1581, 1577, 1587, 1576, 1578, 1583, 1588, 1582, 1581, 1586,
+     1583, 1587, 1594, 1585, 1589, 1589, 1590, 1588, 1585, 1594,
+     1591, 1595, 1590, 1596, 1589, 1591, 1597, 1601, 1603, 1587,
+     1607, 1605, 1611, 1588, 1608, 1612, 1610,    0, 1613, 1594,
+     1613, 1589, 1589, 1590, 1605, 1610, 1608, 1616, 1595, 1597,
+     1596, 1603, 1614, 1597, 1601, 1603, 1617, 1607, 1605, 1611,
 
-     1629, 1629, 1629, 1630, 1630, 1630, 1630, 1630, 1630, 1630,
-     1631, 1631, 1631, 1631, 1631, 1631, 1631, 1632, 1632, 1632,
-     1632, 1632, 1632, 1632, 1634, 1634,    0, 1634, 1634, 1634,
-     1634, 1635, 1635,    0,    0,    0, 1635, 1635, 1636, 1636,
-        0,    0, 1636,    0, 1636, 1637,    0,    0,    0,    0,
-        0, 1637, 1638, 1638,    0,    0,    0, 1638, 1638, 1639,
-        0,    0,    0,    0,    0, 1639, 1640, 1640,    0, 1640,
-     1640, 1640, 1640, 1641, 1641,    0, 1641, 1641, 1641, 1641,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
+     1615, 1608, 1612, 1610, 1614, 1613, 1615, 1618, 1619, 1616,
+     1622, 1624, 1625, 1627, 1616, 1618, 1628, 1631, 1617, 1614,
+     1632,    0, 1633, 1617, 1634,    0,    0, 1615, 1627, 1641,
+     1636,    0, 1634, 1632, 1618, 1619, 1635, 1622, 1624, 1625,
+     1627, 1636, 1628, 1628, 1633, 1635, 1642, 1632, 1631, 1633,
+     1643, 1634, 1641, 1642, 1644, 1646, 1641, 1636, 1645, 1647,
+     1648, 1647, 1644, 1635, 1643, 1649, 1646, 1645, 1651, 1652,
+     1650, 1654, 1648, 1642, 1653, 1655, 1653, 1643, 1660, 1661,
+     1656, 1644, 1646, 1654,    0, 1645, 1647, 1648, 1650, 1663,
+     1651, 1652, 1649, 1656, 1659, 1651, 1652, 1650, 1654, 1658,
 
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627, 1627,
-     1627, 1627, 1627, 1627, 1627, 1627
+     1662, 1653, 1659, 1663, 1664, 1665, 1655, 1656, 1670, 1660,
+     1661, 1658, 1664, 1662, 1666, 1667, 1663, 1669, 1665, 1668,
+     1672, 1659, 1666, 1671, 1678, 1669, 1658, 1662, 1672, 1667,
+     1670, 1664, 1665, 1668, 1673, 1670, 1674, 1675, 1679,    0,
+     1676, 1666, 1667, 1677, 1669, 1671, 1668, 1672, 1680, 1681,
+     1671, 1677, 1683, 1691,    0, 1678,    0, 1681, 1674, 1675,
+     1673, 1673, 1676, 1674, 1675, 1679, 1682, 1676, 1680, 1684,
+     1677, 1685, 1687, 1688, 1682, 1680, 1681, 1684, 1689, 1691,
+     1691, 1688, 1692, 1683, 1693, 1685, 1689, 1690,    0, 1694,
+        0, 1695, 1693, 1682, 1687,    0, 1684, 1696, 1685, 1687,
+
+     1688, 1690, 1697, 1699, 1692, 1689, 1700, 1701,    0, 1692,
+     1703, 1693, 1698, 1702, 1690, 1694, 1694, 1695, 1695, 1696,
+     1698, 1702, 1697, 1704, 1696, 1706, 1700, 1701, 1708, 1697,
+     1699, 1704, 1703, 1700, 1701, 1707, 1708, 1703, 1709, 1698,
+     1702, 1710, 1714, 1711, 1715, 1712, 1709, 1706, 1713, 1716,
+     1704, 1711, 1706, 1712, 1717, 1708,    0, 1707, 1718,    0,
+     1720, 1723, 1707, 1726, 1715, 1709, 1727, 1710, 1710, 1714,
+     1711, 1715, 1712,    0, 1713, 1713, 1716,    0, 1718,    0,
+        0, 1717, 1720, 1723, 1724, 1718, 1725, 1720, 1723,    0,
+     1726,    0, 1724, 1727, 1725,    0,    0,    0,    0,    0,
+
+        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
+        0, 1724,    0, 1725, 1731, 1731, 1731, 1731, 1731, 1731,
+     1731, 1732, 1732, 1732, 1732, 1732, 1732, 1732, 1733, 1733,
+     1733, 1733, 1733, 1733, 1733, 1734, 1734, 1734, 1734, 1734,
+     1734, 1734, 1735, 1735, 1735, 1735, 1735, 1735, 1735, 1737,
+     1737,    0, 1737, 1737, 1737, 1737, 1738, 1738,    0,    0,
+        0, 1738, 1738, 1739, 1739,    0,    0, 1739,    0, 1739,
+     1740,    0,    0,    0,    0,    0, 1740, 1741, 1741,    0,
+        0,    0, 1741, 1741, 1742,    0,    0,    0,    0,    0,
+     1742, 1743, 1743,    0, 1743, 1743, 1743, 1743, 1744, 1744,
+
+        0, 1744, 1744, 1744, 1744, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730, 1730,
+     1730
     } ;
 
 static yy_state_type yy_last_accepting_state;
@@ -2218,7 +2323,7 @@ static void config_end_include(void)
 #define YY_NO_INPUT 1
 #endif
 
-#line 2220 "<stdout>"
+#line 2325 "<stdout>"
 
 #define INITIAL 0
 #define quotedstring 1
@@ -2405,7 +2510,7 @@ YY_DECL
     
 #line 197 "util/configlexer.lex"
 
-#line 2407 "<stdout>"
+#line 2512 "<stdout>"
 
 	if ( !(yy_init) )
 		{
@@ -2464,13 +2569,13 @@ yy_match:
 			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 				{
 				yy_current_state = (int) yy_def[yy_current_state];
-				if ( yy_current_state >= 1628 )
+				if ( yy_current_state >= 1731 )
 					yy_c = yy_meta[(unsigned int) yy_c];
 				}
 			yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
 			++yy_cp;
 			}
-		while ( yy_base[yy_current_state] != 4681 );
+		while ( yy_base[yy_current_state] != 5006 );
 
 yy_find_action:
 		yy_act = yy_accept[yy_current_state];
@@ -2640,620 +2745,670 @@ YY_RULE_SETUP
 case 29:
 YY_RULE_SETUP
 #line 229 "util/configlexer.lex"
-{ YDVAR(1, VAR_CHROOT) }
+{ YDVAR(1, VAR_IP_TRANSPARENT) }
 	YY_BREAK
 case 30:
 YY_RULE_SETUP
 #line 230 "util/configlexer.lex"
-{ YDVAR(1, VAR_USERNAME) }
+{ YDVAR(1, VAR_CHROOT) }
 	YY_BREAK
 case 31:
 YY_RULE_SETUP
 #line 231 "util/configlexer.lex"
-{ YDVAR(1, VAR_DIRECTORY) }
+{ YDVAR(1, VAR_USERNAME) }
 	YY_BREAK
 case 32:
 YY_RULE_SETUP
 #line 232 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOGFILE) }
+{ YDVAR(1, VAR_DIRECTORY) }
 	YY_BREAK
 case 33:
 YY_RULE_SETUP
 #line 233 "util/configlexer.lex"
-{ YDVAR(1, VAR_PIDFILE) }
+{ YDVAR(1, VAR_LOGFILE) }
 	YY_BREAK
 case 34:
 YY_RULE_SETUP
 #line 234 "util/configlexer.lex"
-{ YDVAR(1, VAR_ROOT_HINTS) }
+{ YDVAR(1, VAR_PIDFILE) }
 	YY_BREAK
 case 35:
 YY_RULE_SETUP
 #line 235 "util/configlexer.lex"
-{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
+{ YDVAR(1, VAR_ROOT_HINTS) }
 	YY_BREAK
 case 36:
 YY_RULE_SETUP
 #line 236 "util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_BUFFER_SIZE) }
+{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
 	YY_BREAK
 case 37:
 YY_RULE_SETUP
 #line 237 "util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_CACHE_SIZE) }
+{ YDVAR(1, VAR_MSG_BUFFER_SIZE) }
 	YY_BREAK
 case 38:
 YY_RULE_SETUP
 #line 238 "util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_CACHE_SLABS) }
+{ YDVAR(1, VAR_MSG_CACHE_SIZE) }
 	YY_BREAK
 case 39:
 YY_RULE_SETUP
 #line 239 "util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_CACHE_SIZE) }
+{ YDVAR(1, VAR_MSG_CACHE_SLABS) }
 	YY_BREAK
 case 40:
 YY_RULE_SETUP
 #line 240 "util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_CACHE_SLABS) }
+{ YDVAR(1, VAR_RRSET_CACHE_SIZE) }
 	YY_BREAK
 case 41:
 YY_RULE_SETUP
 #line 241 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MAX_TTL) }
+{ YDVAR(1, VAR_RRSET_CACHE_SLABS) }
 	YY_BREAK
 case 42:
 YY_RULE_SETUP
 #line 242 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MIN_TTL) }
+{ YDVAR(1, VAR_CACHE_MAX_TTL) }
 	YY_BREAK
 case 43:
 YY_RULE_SETUP
 #line 243 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_HOST_TTL) }
+{ YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) }
 	YY_BREAK
 case 44:
 YY_RULE_SETUP
 #line 244 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_LAME_TTL) }
+{ YDVAR(1, VAR_CACHE_MIN_TTL) }
 	YY_BREAK
 case 45:
 YY_RULE_SETUP
 #line 245 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
+{ YDVAR(1, VAR_INFRA_HOST_TTL) }
 	YY_BREAK
 case 46:
 YY_RULE_SETUP
 #line 246 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
+{ YDVAR(1, VAR_INFRA_LAME_TTL) }
 	YY_BREAK
 case 47:
 YY_RULE_SETUP
 #line 247 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
+{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
 	YY_BREAK
 case 48:
 YY_RULE_SETUP
 #line 248 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
+{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
 	YY_BREAK
 case 49:
 YY_RULE_SETUP
 #line 249 "util/configlexer.lex"
-{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
+{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
 	YY_BREAK
 case 50:
 YY_RULE_SETUP
 #line 250 "util/configlexer.lex"
-{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
+{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
 	YY_BREAK
 case 51:
 YY_RULE_SETUP
 #line 251 "util/configlexer.lex"
-{ YDVAR(1, VAR_DELAY_CLOSE) }
+{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
 	YY_BREAK
 case 52:
 YY_RULE_SETUP
 #line 252 "util/configlexer.lex"
-{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
+{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
 	YY_BREAK
 case 53:
 YY_RULE_SETUP
 #line 253 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
+{ YDVAR(1, VAR_DELAY_CLOSE) }
 	YY_BREAK
 case 54:
 YY_RULE_SETUP
 #line 254 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
+{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
 	YY_BREAK
 case 55:
 YY_RULE_SETUP
 #line 255 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_GLUE) }
+{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
 	YY_BREAK
 case 56:
 YY_RULE_SETUP
 #line 256 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
+{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
 	YY_BREAK
 case 57:
 YY_RULE_SETUP
 #line 257 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
+{ YDVAR(1, VAR_HARDEN_GLUE) }
 	YY_BREAK
 case 58:
 YY_RULE_SETUP
 #line 258 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
 	YY_BREAK
 case 59:
 YY_RULE_SETUP
 #line 259 "util/configlexer.lex"
-{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 	YY_BREAK
 case 60:
 YY_RULE_SETUP
 #line 260 "util/configlexer.lex"
-{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
+{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
 	YY_BREAK
 case 61:
 YY_RULE_SETUP
 #line 261 "util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
+{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 	YY_BREAK
 case 62:
 YY_RULE_SETUP
 #line 262 "util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
+{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 	YY_BREAK
 case 63:
 YY_RULE_SETUP
 #line 263 "util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH_KEY) }
+{ YDVAR(1, VAR_CAPS_WHITELIST) }
 	YY_BREAK
 case 64:
 YY_RULE_SETUP
 #line 264 "util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH) }
+{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 	YY_BREAK
 case 65:
 YY_RULE_SETUP
 #line 265 "util/configlexer.lex"
-{ YDVAR(0, VAR_STUB_ZONE) }
+{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
 	YY_BREAK
 case 66:
 YY_RULE_SETUP
 #line 266 "util/configlexer.lex"
-{ YDVAR(1, VAR_NAME) }
+{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 	YY_BREAK
 case 67:
 YY_RULE_SETUP
 #line 267 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_ADDR) }
+{ YDVAR(1, VAR_PREFETCH_KEY) }
 	YY_BREAK
 case 68:
 YY_RULE_SETUP
 #line 268 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_HOST) }
+{ YDVAR(1, VAR_PREFETCH) }
 	YY_BREAK
 case 69:
 YY_RULE_SETUP
 #line 269 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_PRIME) }
+{ YDVAR(0, VAR_STUB_ZONE) }
 	YY_BREAK
 case 70:
 YY_RULE_SETUP
 #line 270 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_FIRST) }
+{ YDVAR(1, VAR_NAME) }
 	YY_BREAK
 case 71:
 YY_RULE_SETUP
 #line 271 "util/configlexer.lex"
-{ YDVAR(0, VAR_FORWARD_ZONE) }
+{ YDVAR(1, VAR_STUB_ADDR) }
 	YY_BREAK
 case 72:
 YY_RULE_SETUP
 #line 272 "util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_ADDR) }
+{ YDVAR(1, VAR_STUB_HOST) }
 	YY_BREAK
 case 73:
 YY_RULE_SETUP
 #line 273 "util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_HOST) }
+{ YDVAR(1, VAR_STUB_PRIME) }
 	YY_BREAK
 case 74:
 YY_RULE_SETUP
 #line 274 "util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_FIRST) }
+{ YDVAR(1, VAR_STUB_FIRST) }
 	YY_BREAK
 case 75:
 YY_RULE_SETUP
 #line 275 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
+{ YDVAR(0, VAR_FORWARD_ZONE) }
 	YY_BREAK
 case 76:
 YY_RULE_SETUP
 #line 276 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
+{ YDVAR(1, VAR_FORWARD_ADDR) }
 	YY_BREAK
 case 77:
 YY_RULE_SETUP
 #line 277 "util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL) }
+{ YDVAR(1, VAR_FORWARD_HOST) }
 	YY_BREAK
 case 78:
 YY_RULE_SETUP
 #line 278 "util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_IDENTITY) }
+{ YDVAR(1, VAR_FORWARD_FIRST) }
 	YY_BREAK
 case 79:
 YY_RULE_SETUP
 #line 279 "util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_VERSION) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
 	YY_BREAK
 case 80:
 YY_RULE_SETUP
 #line 280 "util/configlexer.lex"
-{ YDVAR(1, VAR_IDENTITY) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
 	YY_BREAK
 case 81:
 YY_RULE_SETUP
 #line 281 "util/configlexer.lex"
-{ YDVAR(1, VAR_VERSION) }
+{ YDVAR(2, VAR_ACCESS_CONTROL) }
 	YY_BREAK
 case 82:
 YY_RULE_SETUP
 #line 282 "util/configlexer.lex"
-{ YDVAR(1, VAR_MODULE_CONF) }
+{ YDVAR(1, VAR_HIDE_IDENTITY) }
 	YY_BREAK
 case 83:
 YY_RULE_SETUP
 #line 283 "util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR) }
+{ YDVAR(1, VAR_HIDE_VERSION) }
 	YY_BREAK
 case 84:
 YY_RULE_SETUP
 #line 284 "util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
+{ YDVAR(1, VAR_IDENTITY) }
 	YY_BREAK
 case 85:
 YY_RULE_SETUP
 #line 285 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_VERSION) }
 	YY_BREAK
 case 86:
 YY_RULE_SETUP
 #line 286 "util/configlexer.lex"
-{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_MODULE_CONF) }
 	YY_BREAK
 case 87:
 YY_RULE_SETUP
 #line 287 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
+{ YDVAR(1, VAR_DLV_ANCHOR) }
 	YY_BREAK
 case 88:
 YY_RULE_SETUP
 #line 288 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR) }
+{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
 	YY_BREAK
 case 89:
 YY_RULE_SETUP
 #line 289 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
+{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 90:
 YY_RULE_SETUP
 #line 290 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
+{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 91:
 YY_RULE_SETUP
 #line 291 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
+{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
 	YY_BREAK
 case 92:
 YY_RULE_SETUP
 #line 292 "util/configlexer.lex"
-{ YDVAR(1, VAR_BOGUS_TTL) }
+{ YDVAR(1, VAR_TRUST_ANCHOR) }
 	YY_BREAK
 case 93:
 YY_RULE_SETUP
 #line 293 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
+{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
 	YY_BREAK
 case 94:
 YY_RULE_SETUP
 #line 294 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
 	YY_BREAK
 case 95:
 YY_RULE_SETUP
 #line 295 "util/configlexer.lex"
-{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 	YY_BREAK
 case 96:
 YY_RULE_SETUP
 #line 296 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
+{ YDVAR(1, VAR_BOGUS_TTL) }
 	YY_BREAK
 case 97:
 YY_RULE_SETUP
 #line 297 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
+{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 	YY_BREAK
 case 98:
 YY_RULE_SETUP
 #line 298 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
+{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
 	YY_BREAK
 case 99:
 YY_RULE_SETUP
 #line 299 "util/configlexer.lex"
-{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
+{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
 	YY_BREAK
 case 100:
 YY_RULE_SETUP
 #line 300 "util/configlexer.lex"
-{ 
-				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
+{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 	YY_BREAK
 case 101:
 YY_RULE_SETUP
-#line 302 "util/configlexer.lex"
-{ YDVAR(1, VAR_ADD_HOLDDOWN) }
+#line 301 "util/configlexer.lex"
+{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 	YY_BREAK
 case 102:
 YY_RULE_SETUP
-#line 303 "util/configlexer.lex"
-{ YDVAR(1, VAR_DEL_HOLDDOWN) }
+#line 302 "util/configlexer.lex"
+{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 	YY_BREAK
 case 103:
 YY_RULE_SETUP
-#line 304 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEEP_MISSING) }
+#line 303 "util/configlexer.lex"
+{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
 	YY_BREAK
 case 104:
 YY_RULE_SETUP
-#line 305 "util/configlexer.lex"
-{ YDVAR(1, VAR_USE_SYSLOG) }
+#line 304 "util/configlexer.lex"
+{ 
+				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 	YY_BREAK
 case 105:
 YY_RULE_SETUP
 #line 306 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_TIME_ASCII) }
+{ YDVAR(1, VAR_ADD_HOLDDOWN) }
 	YY_BREAK
 case 106:
 YY_RULE_SETUP
 #line 307 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_QUERIES) }
+{ YDVAR(1, VAR_DEL_HOLDDOWN) }
 	YY_BREAK
 case 107:
 YY_RULE_SETUP
 #line 308 "util/configlexer.lex"
-{ YDVAR(2, VAR_LOCAL_ZONE) }
+{ YDVAR(1, VAR_KEEP_MISSING) }
 	YY_BREAK
 case 108:
 YY_RULE_SETUP
 #line 309 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA) }
+{ YDVAR(1, VAR_USE_SYSLOG) }
 	YY_BREAK
 case 109:
 YY_RULE_SETUP
 #line 310 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
+{ YDVAR(1, VAR_LOG_TIME_ASCII) }
 	YY_BREAK
 case 110:
 YY_RULE_SETUP
 #line 311 "util/configlexer.lex"
-{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
+{ YDVAR(1, VAR_LOG_QUERIES) }
 	YY_BREAK
 case 111:
 YY_RULE_SETUP
 #line 312 "util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
+{ YDVAR(2, VAR_LOCAL_ZONE) }
 	YY_BREAK
 case 112:
 YY_RULE_SETUP
 #line 313 "util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
+{ YDVAR(1, VAR_LOCAL_DATA) }
 	YY_BREAK
 case 113:
 YY_RULE_SETUP
 #line 314 "util/configlexer.lex"
-{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
+{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
 	YY_BREAK
 case 114:
 YY_RULE_SETUP
 #line 315 "util/configlexer.lex"
-{ YDVAR(0, VAR_REMOTE_CONTROL) }
+{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
 	YY_BREAK
 case 115:
 YY_RULE_SETUP
 #line 316 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_ENABLE) }
+{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
 	YY_BREAK
 case 116:
 YY_RULE_SETUP
 #line 317 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_INTERFACE) }
+{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
 	YY_BREAK
 case 117:
 YY_RULE_SETUP
 #line 318 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_PORT) }
+{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
 	YY_BREAK
 case 118:
 YY_RULE_SETUP
 #line 319 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_USE_CERT) }
+{ YDVAR(0, VAR_REMOTE_CONTROL) }
 	YY_BREAK
 case 119:
 YY_RULE_SETUP
 #line 320 "util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_KEY_FILE) }
+{ YDVAR(1, VAR_CONTROL_ENABLE) }
 	YY_BREAK
 case 120:
 YY_RULE_SETUP
 #line 321 "util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_CERT_FILE) }
+{ YDVAR(1, VAR_CONTROL_INTERFACE) }
 	YY_BREAK
 case 121:
 YY_RULE_SETUP
 #line 322 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
+{ YDVAR(1, VAR_CONTROL_PORT) }
 	YY_BREAK
 case 122:
 YY_RULE_SETUP
 #line 323 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
+{ YDVAR(1, VAR_CONTROL_USE_CERT) }
 	YY_BREAK
 case 123:
 YY_RULE_SETUP
 #line 324 "util/configlexer.lex"
-{ YDVAR(1, VAR_PYTHON_SCRIPT) }
+{ YDVAR(1, VAR_SERVER_KEY_FILE) }
 	YY_BREAK
 case 124:
 YY_RULE_SETUP
 #line 325 "util/configlexer.lex"
-{ YDVAR(0, VAR_PYTHON) }
+{ YDVAR(1, VAR_SERVER_CERT_FILE) }
 	YY_BREAK
 case 125:
 YY_RULE_SETUP
 #line 326 "util/configlexer.lex"
-{ YDVAR(1, VAR_DOMAIN_INSECURE) }
+{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
 	YY_BREAK
 case 126:
 YY_RULE_SETUP
 #line 327 "util/configlexer.lex"
-{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
+{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
 	YY_BREAK
 case 127:
 YY_RULE_SETUP
 #line 328 "util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
+{ YDVAR(1, VAR_PYTHON_SCRIPT) }
 	YY_BREAK
 case 128:
 YY_RULE_SETUP
 #line 329 "util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_UDP_SIZE) }
+{ YDVAR(0, VAR_PYTHON) }
 	YY_BREAK
 case 129:
 YY_RULE_SETUP
 #line 330 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_PREFIX) }
+{ YDVAR(1, VAR_DOMAIN_INSECURE) }
 	YY_BREAK
 case 130:
 YY_RULE_SETUP
 #line 331 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_SYNTHALL) }
+{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
 	YY_BREAK
 case 131:
 YY_RULE_SETUP
 #line 332 "util/configlexer.lex"
-{ YDVAR(0, VAR_DNSTAP) }
+{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
 	YY_BREAK
 case 132:
 YY_RULE_SETUP
 #line 333 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_ENABLE) }
+{ YDVAR(1, VAR_MAX_UDP_SIZE) }
 	YY_BREAK
 case 133:
 YY_RULE_SETUP
 #line 334 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
+{ YDVAR(1, VAR_DNS64_PREFIX) }
 	YY_BREAK
 case 134:
 YY_RULE_SETUP
 #line 335 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
+{ YDVAR(1, VAR_DNS64_SYNTHALL) }
 	YY_BREAK
 case 135:
 YY_RULE_SETUP
 #line 336 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
+{ YDVAR(0, VAR_DNSTAP) }
 	YY_BREAK
 case 136:
 YY_RULE_SETUP
 #line 337 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
+{ YDVAR(1, VAR_DNSTAP_ENABLE) }
 	YY_BREAK
 case 137:
 YY_RULE_SETUP
 #line 338 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_VERSION) }
+{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
 	YY_BREAK
 case 138:
 YY_RULE_SETUP
 #line 339 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
+{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
 	YY_BREAK
 case 139:
 YY_RULE_SETUP
-#line 341 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
+#line 340 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
 	YY_BREAK
 case 140:
 YY_RULE_SETUP
-#line 343 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
+#line 341 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
 	YY_BREAK
 case 141:
 YY_RULE_SETUP
-#line 345 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+#line 342 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_VERSION) }
 	YY_BREAK
 case 142:
 YY_RULE_SETUP
-#line 347 "util/configlexer.lex"
+#line 343 "util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
 	YY_BREAK
 case 143:
 YY_RULE_SETUP
+#line 345 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
+	YY_BREAK
+case 144:
+YY_RULE_SETUP
+#line 347 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
+	YY_BREAK
+case 145:
+YY_RULE_SETUP
 #line 349 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+	YY_BREAK
+case 146:
+YY_RULE_SETUP
+#line 351 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+	YY_BREAK
+case 147:
+YY_RULE_SETUP
+#line 353 "util/configlexer.lex"
 {
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
 	YY_BREAK
-case 144:
-/* rule 144 can match eol */
+case 148:
 YY_RULE_SETUP
-#line 351 "util/configlexer.lex"
+#line 355 "util/configlexer.lex"
+{ YDVAR(1, VAR_RATELIMIT) }
+	YY_BREAK
+case 149:
+YY_RULE_SETUP
+#line 356 "util/configlexer.lex"
+{ YDVAR(1, VAR_RATELIMIT_SLABS) }
+	YY_BREAK
+case 150:
+YY_RULE_SETUP
+#line 357 "util/configlexer.lex"
+{ YDVAR(1, VAR_RATELIMIT_SIZE) }
+	YY_BREAK
+case 151:
+YY_RULE_SETUP
+#line 358 "util/configlexer.lex"
+{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
+	YY_BREAK
+case 152:
+YY_RULE_SETUP
+#line 359 "util/configlexer.lex"
+{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
+	YY_BREAK
+case 153:
+YY_RULE_SETUP
+#line 360 "util/configlexer.lex"
+{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
+	YY_BREAK
+case 154:
+/* rule 154 can match eol */
+YY_RULE_SETUP
+#line 361 "util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++; }
 	YY_BREAK
 /* Quoted strings. Strip leading and ending quotes */
-case 145:
+case 155:
 YY_RULE_SETUP
-#line 354 "util/configlexer.lex"
+#line 364 "util/configlexer.lex"
 { BEGIN(quotedstring); LEXOUT(("QS ")); }
 	YY_BREAK
 case YY_STATE_EOF(quotedstring):
-#line 355 "util/configlexer.lex"
+#line 365 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 146:
+case 156:
 YY_RULE_SETUP
-#line 360 "util/configlexer.lex"
+#line 370 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 147:
-/* rule 147 can match eol */
+case 157:
+/* rule 157 can match eol */
 YY_RULE_SETUP
-#line 361 "util/configlexer.lex"
+#line 371 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end \""); 
 			  cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 148:
+case 158:
 YY_RULE_SETUP
-#line 363 "util/configlexer.lex"
+#line 373 "util/configlexer.lex"
 {
         LEXOUT(("QE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -3266,34 +3421,34 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* Single Quoted strings. Strip leading and ending quotes */
-case 149:
+case 159:
 YY_RULE_SETUP
-#line 375 "util/configlexer.lex"
+#line 385 "util/configlexer.lex"
 { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
 	YY_BREAK
 case YY_STATE_EOF(singlequotedstr):
-#line 376 "util/configlexer.lex"
+#line 386 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 150:
+case 160:
 YY_RULE_SETUP
-#line 381 "util/configlexer.lex"
+#line 391 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 151:
-/* rule 151 can match eol */
+case 161:
+/* rule 161 can match eol */
 YY_RULE_SETUP
-#line 382 "util/configlexer.lex"
+#line 392 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end '"); 
 			     cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 152:
+case 162:
 YY_RULE_SETUP
-#line 384 "util/configlexer.lex"
+#line 394 "util/configlexer.lex"
 {
         LEXOUT(("SQE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -3306,38 +3461,38 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* include: directive */
-case 153:
+case 163:
 YY_RULE_SETUP
-#line 396 "util/configlexer.lex"
+#line 406 "util/configlexer.lex"
 { 
 	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
 	YY_BREAK
 case YY_STATE_EOF(include):
-#line 398 "util/configlexer.lex"
+#line 408 "util/configlexer.lex"
 {
         yyerror("EOF inside include directive");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 154:
+case 164:
 YY_RULE_SETUP
-#line 402 "util/configlexer.lex"
+#line 412 "util/configlexer.lex"
 { LEXOUT(("ISP ")); /* ignore */ }
 	YY_BREAK
-case 155:
-/* rule 155 can match eol */
+case 165:
+/* rule 165 can match eol */
 YY_RULE_SETUP
-#line 403 "util/configlexer.lex"
+#line 413 "util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++;}
 	YY_BREAK
-case 156:
+case 166:
 YY_RULE_SETUP
-#line 404 "util/configlexer.lex"
+#line 414 "util/configlexer.lex"
 { LEXOUT(("IQS ")); BEGIN(include_quoted); }
 	YY_BREAK
-case 157:
+case 167:
 YY_RULE_SETUP
-#line 405 "util/configlexer.lex"
+#line 415 "util/configlexer.lex"
 {
 	LEXOUT(("Iunquotedstr(%s) ", yytext));
 	config_start_include_glob(yytext);
@@ -3345,27 +3500,27 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 case YY_STATE_EOF(include_quoted):
-#line 410 "util/configlexer.lex"
+#line 420 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 158:
+case 168:
 YY_RULE_SETUP
-#line 414 "util/configlexer.lex"
+#line 424 "util/configlexer.lex"
 { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 159:
-/* rule 159 can match eol */
+case 169:
+/* rule 169 can match eol */
 YY_RULE_SETUP
-#line 415 "util/configlexer.lex"
+#line 425 "util/configlexer.lex"
 { yyerror("newline before \" in include name"); 
 				  cfg_parser->line++; BEGIN(inc_prev); }
 	YY_BREAK
-case 160:
+case 170:
 YY_RULE_SETUP
-#line 417 "util/configlexer.lex"
+#line 427 "util/configlexer.lex"
 {
 	LEXOUT(("IQE "));
 	yytext[yyleng - 1] = '\0';
@@ -3375,7 +3530,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case YY_STATE_EOF(INITIAL):
 case YY_STATE_EOF(val):
-#line 423 "util/configlexer.lex"
+#line 433 "util/configlexer.lex"
 {
 	LEXOUT(("LEXEOF "));
 	yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
@@ -3387,33 +3542,33 @@ case YY_STATE_EOF(val):
 	}
 }
 	YY_BREAK
-case 161:
+case 171:
 YY_RULE_SETUP
-#line 434 "util/configlexer.lex"
+#line 444 "util/configlexer.lex"
 { LEXOUT(("unquotedstr(%s) ", yytext)); 
 			if(--num_args == 0) { BEGIN(INITIAL); }
 			yylval.str = strdup(yytext); return STRING_ARG; }
 	YY_BREAK
-case 162:
+case 172:
 YY_RULE_SETUP
-#line 438 "util/configlexer.lex"
+#line 448 "util/configlexer.lex"
 {
 	ub_c_error_msg("unknown keyword '%s'", yytext);
 	}
 	YY_BREAK
-case 163:
+case 173:
 YY_RULE_SETUP
-#line 442 "util/configlexer.lex"
+#line 452 "util/configlexer.lex"
 {
 	ub_c_error_msg("stray '%s'", yytext);
 	}
 	YY_BREAK
-case 164:
+case 174:
 YY_RULE_SETUP
-#line 446 "util/configlexer.lex"
+#line 456 "util/configlexer.lex"
 ECHO;
 	YY_BREAK
-#line 3415 "<stdout>"
+#line 3570 "<stdout>"
 
 	case YY_END_OF_BUFFER:
 		{
@@ -3703,7 +3858,7 @@ static int yy_get_next_buffer (void)
 		while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 			{
 			yy_current_state = (int) yy_def[yy_current_state];
-			if ( yy_current_state >= 1628 )
+			if ( yy_current_state >= 1731 )
 				yy_c = yy_meta[(unsigned int) yy_c];
 			}
 		yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
@@ -3731,11 +3886,11 @@ static int yy_get_next_buffer (void)
 	while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 		{
 		yy_current_state = (int) yy_def[yy_current_state];
-		if ( yy_current_state >= 1628 )
+		if ( yy_current_state >= 1731 )
 			yy_c = yy_meta[(unsigned int) yy_c];
 		}
 	yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
-	yy_is_jam = (yy_current_state == 1627);
+	yy_is_jam = (yy_current_state == 1730);
 
 		return yy_is_jam ? 0 : yy_current_state;
 }
@@ -4368,7 +4523,7 @@ void yyfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 446 "util/configlexer.lex"
+#line 456 "util/configlexer.lex"
 
 
 
diff --git a/util/configlexer.lex b/util/configlexer.lex
index dbde8113c491..5622f217087b 100644
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -226,6 +226,7 @@ interface-automatic{COLON}	{ YDVAR(1, VAR_INTERFACE_AUTOMATIC) }
 so-rcvbuf{COLON}		{ YDVAR(1, VAR_SO_RCVBUF) }
 so-sndbuf{COLON}		{ YDVAR(1, VAR_SO_SNDBUF) }
 so-reuseport{COLON}		{ YDVAR(1, VAR_SO_REUSEPORT) }
+ip-transparent{COLON}		{ YDVAR(1, VAR_IP_TRANSPARENT) }
 chroot{COLON}			{ YDVAR(1, VAR_CHROOT) }
 username{COLON}			{ YDVAR(1, VAR_USERNAME) }
 directory{COLON}		{ YDVAR(1, VAR_DIRECTORY) }
@@ -239,6 +240,7 @@ msg-cache-slabs{COLON}		{ YDVAR(1, VAR_MSG_CACHE_SLABS) }
 rrset-cache-size{COLON}		{ YDVAR(1, VAR_RRSET_CACHE_SIZE) }
 rrset-cache-slabs{COLON}	{ YDVAR(1, VAR_RRSET_CACHE_SLABS) }
 cache-max-ttl{COLON}     	{ YDVAR(1, VAR_CACHE_MAX_TTL) }
+cache-max-negative-ttl{COLON}   { YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) }
 cache-min-ttl{COLON}     	{ YDVAR(1, VAR_CACHE_MIN_TTL) }
 infra-host-ttl{COLON}		{ YDVAR(1, VAR_INFRA_HOST_TTL) }
 infra-lame-ttl{COLON}		{ YDVAR(1, VAR_INFRA_LAME_TTL) }
@@ -256,7 +258,9 @@ harden-glue{COLON}		{ YDVAR(1, VAR_HARDEN_GLUE) }
 harden-dnssec-stripped{COLON}	{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
 harden-below-nxdomain{COLON}	{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+harden-algo-downgrade{COLON}	{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
 unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
 private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
@@ -348,6 +352,12 @@ dnstap-log-forwarder-query-messages{COLON}	{
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
 dnstap-log-forwarder-response-messages{COLON}	{
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
+ratelimit{COLON}		{ YDVAR(1, VAR_RATELIMIT) }
+ratelimit-slabs{COLON}		{ YDVAR(1, VAR_RATELIMIT_SLABS) }
+ratelimit-size{COLON}		{ YDVAR(1, VAR_RATELIMIT_SIZE) }
+ratelimit-for-domain{COLON}	{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
+ratelimit-below-domain{COLON}	{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
+ratelimit-factor{COLON}		{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
 <INITIAL,val>{NEWLINE}		{ LEXOUT(("NL\n")); cfg_parser->line++; }
 
 	/* Quoted strings. Strip leading and ending quotes */
diff --git a/util/configparser.c b/util/configparser.c
index 0d7328f873a9..f1ba75516765 100644
--- a/util/configparser.c
+++ b/util/configparser.c
@@ -274,7 +274,17 @@ extern int yydebug;
      VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 402,
      VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 403,
      VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 404,
-     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405
+     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405,
+     VAR_HARDEN_ALGO_DOWNGRADE = 406,
+     VAR_IP_TRANSPARENT = 407,
+     VAR_RATELIMIT = 408,
+     VAR_RATELIMIT_SLABS = 409,
+     VAR_RATELIMIT_SIZE = 410,
+     VAR_RATELIMIT_FOR_DOMAIN = 411,
+     VAR_RATELIMIT_BELOW_DOMAIN = 412,
+     VAR_RATELIMIT_FACTOR = 413,
+     VAR_CAPS_WHITELIST = 414,
+     VAR_CACHE_MAX_NEGATIVE_TTL = 415
    };
 #endif
 /* Tokens.  */
@@ -426,6 +436,16 @@ extern int yydebug;
 #define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 403
 #define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 404
 #define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 405
+#define VAR_HARDEN_ALGO_DOWNGRADE 406
+#define VAR_IP_TRANSPARENT 407
+#define VAR_RATELIMIT 408
+#define VAR_RATELIMIT_SLABS 409
+#define VAR_RATELIMIT_SIZE 410
+#define VAR_RATELIMIT_FOR_DOMAIN 411
+#define VAR_RATELIMIT_BELOW_DOMAIN 412
+#define VAR_RATELIMIT_FACTOR 413
+#define VAR_CAPS_WHITELIST 414
+#define VAR_CACHE_MAX_NEGATIVE_TTL 415
 
 
 
@@ -439,7 +459,7 @@ typedef union YYSTYPE
 
 
 /* Line 387 of yacc.c  */
-#line 443 "util/configparser.c"
+#line 463 "util/configparser.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -467,7 +487,7 @@ int yyparse ();
 /* Copy the second part of user declarations.  */
 
 /* Line 390 of yacc.c  */
-#line 471 "util/configparser.c"
+#line 491 "util/configparser.c"
 
 #ifdef short
 # undef short
@@ -687,20 +707,20 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  2
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   280
+#define YYLAST   301
 
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  151
+#define YYNTOKENS  161
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  156
+#define YYNNTS  166
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  297
+#define YYNRULES  317
 /* YYNRULES -- Number of states.  */
-#define YYNSTATES  435
+#define YYNSTATES  467
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   405
+#define YYMAXUTOK   415
 
 #define YYTRANSLATE(YYX)						\
   ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
@@ -748,7 +768,8 @@ static const yytype_uint8 yytranslate[] =
      115,   116,   117,   118,   119,   120,   121,   122,   123,   124,
      125,   126,   127,   128,   129,   130,   131,   132,   133,   134,
      135,   136,   137,   138,   139,   140,   141,   142,   143,   144,
-     145,   146,   147,   148,   149,   150
+     145,   146,   147,   148,   149,   150,   151,   152,   153,   154,
+     155,   156,   157,   158,   159,   160
 };
 
 #if YYDEBUG
@@ -768,56 +789,60 @@ static const yytype_uint16 yyprhs[] =
      185,   187,   189,   191,   193,   195,   197,   199,   201,   203,
      205,   207,   209,   211,   213,   215,   217,   219,   221,   223,
      225,   227,   229,   231,   233,   235,   237,   239,   241,   243,
-     246,   247,   249,   251,   253,   255,   257,   259,   262,   263,
-     265,   267,   269,   271,   274,   277,   280,   283,   286,   289,
-     292,   295,   298,   301,   304,   307,   310,   313,   316,   319,
-     322,   325,   328,   331,   334,   337,   340,   343,   346,   349,
-     352,   355,   358,   361,   364,   367,   370,   373,   376,   379,
-     382,   385,   388,   391,   394,   397,   400,   403,   406,   409,
-     412,   415,   418,   421,   424,   427,   430,   433,   436,   439,
-     442,   445,   448,   451,   454,   457,   460,   463,   466,   469,
-     472,   475,   478,   481,   484,   487,   490,   493,   496,   499,
-     502,   505,   509,   512,   515,   518,   521,   524,   527,   530,
-     533,   536,   539,   542,   545,   548,   551,   554,   557,   560,
-     563,   567,   570,   573,   576,   579,   582,   585,   588,   591,
-     594,   597,   600,   603,   606,   609,   612,   615,   617,   620,
-     621,   623,   625,   627,   629,   631,   633,   635,   637,   640,
-     643,   646,   649,   652,   655,   658,   661,   663,   666,   667,
-     669,   671,   673,   675,   677,   679,   681,   683,   685,   687,
-     689,   691,   694,   697,   700,   703,   706,   709,   712,   715,
-     718,   721,   724,   727,   729,   732,   733,   735
+     245,   247,   249,   251,   253,   255,   257,   259,   261,   263,
+     266,   267,   269,   271,   273,   275,   277,   279,   282,   283,
+     285,   287,   289,   291,   294,   297,   300,   303,   306,   309,
+     312,   315,   318,   321,   324,   327,   330,   333,   336,   339,
+     342,   345,   348,   351,   354,   357,   360,   363,   366,   369,
+     372,   375,   378,   381,   384,   387,   390,   393,   396,   399,
+     402,   405,   408,   411,   414,   417,   420,   423,   426,   429,
+     432,   435,   438,   441,   444,   447,   450,   453,   456,   459,
+     462,   465,   468,   471,   474,   477,   480,   483,   486,   489,
+     492,   495,   498,   501,   504,   507,   510,   513,   516,   519,
+     522,   525,   528,   531,   534,   538,   541,   544,   547,   550,
+     553,   556,   559,   562,   565,   568,   571,   574,   577,   580,
+     583,   586,   589,   592,   595,   599,   602,   605,   608,   611,
+     614,   617,   620,   623,   626,   629,   633,   637,   640,   643,
+     646,   649,   652,   655,   658,   661,   664,   667,   669,   672,
+     673,   675,   677,   679,   681,   683,   685,   687,   689,   692,
+     695,   698,   701,   704,   707,   710,   713,   715,   718,   719,
+     721,   723,   725,   727,   729,   731,   733,   735,   737,   739,
+     741,   743,   746,   749,   752,   755,   758,   761,   764,   767,
+     770,   773,   776,   779,   781,   784,   785,   787
 };
 
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int16 yyrhs[] =
 {
-     152,     0,    -1,    -1,   152,   153,    -1,   154,   155,    -1,
-     157,   158,    -1,   160,   161,    -1,   303,   304,    -1,   277,
-     278,    -1,   288,   289,    -1,    11,    -1,   155,   156,    -1,
-      -1,   163,    -1,   164,    -1,   168,    -1,   171,    -1,   177,
-      -1,   178,    -1,   179,    -1,   180,    -1,   169,    -1,   190,
-      -1,   191,    -1,   192,    -1,   193,    -1,   194,    -1,   212,
-      -1,   213,    -1,   214,    -1,   218,    -1,   219,    -1,   174,
-      -1,   220,    -1,   221,    -1,   224,    -1,   222,    -1,   223,
-      -1,   226,    -1,   227,    -1,   228,    -1,   239,    -1,   203,
-      -1,   204,    -1,   205,    -1,   206,    -1,   229,    -1,   242,
-      -1,   199,    -1,   201,    -1,   243,    -1,   248,    -1,   249,
-      -1,   250,    -1,   175,    -1,   211,    -1,   257,    -1,   258,
-      -1,   200,    -1,   253,    -1,   187,    -1,   170,    -1,   195,
-      -1,   240,    -1,   246,    -1,   230,    -1,   241,    -1,   260,
-      -1,   261,    -1,   176,    -1,   165,    -1,   186,    -1,   233,
-      -1,   166,    -1,   172,    -1,   173,    -1,   196,    -1,   197,
-      -1,   259,    -1,   232,    -1,   234,    -1,   235,    -1,   167,
-      -1,   262,    -1,   215,    -1,   238,    -1,   188,    -1,   202,
-      -1,   244,    -1,   245,    -1,   247,    -1,   252,    -1,   198,
-      -1,   254,    -1,   255,    -1,   256,    -1,   207,    -1,   210,
-      -1,   236,    -1,   237,    -1,   208,    -1,   231,    -1,   251,
-      -1,   189,    -1,   181,    -1,   182,    -1,   183,    -1,   184,
-      -1,   185,    -1,   263,    -1,   264,    -1,   265,    -1,   209,
-      -1,   216,    -1,   217,    -1,   266,    -1,   267,    -1,   225,
-      -1,    38,    -1,   158,   159,    -1,    -1,   268,    -1,   269,
-      -1,   270,    -1,   272,    -1,   271,    -1,    44,    -1,   161,
-     162,    -1,    -1,   273,    -1,   274,    -1,   275,    -1,   276,
+     162,     0,    -1,    -1,   162,   163,    -1,   164,   165,    -1,
+     167,   168,    -1,   170,   171,    -1,   323,   324,    -1,   297,
+     298,    -1,   308,   309,    -1,    11,    -1,   165,   166,    -1,
+      -1,   173,    -1,   174,    -1,   178,    -1,   181,    -1,   187,
+      -1,   188,    -1,   189,    -1,   190,    -1,   179,    -1,   200,
+      -1,   201,    -1,   202,    -1,   203,    -1,   204,    -1,   223,
+      -1,   224,    -1,   225,    -1,   229,    -1,   230,    -1,   184,
+      -1,   231,    -1,   232,    -1,   235,    -1,   233,    -1,   234,
+      -1,   237,    -1,   238,    -1,   239,    -1,   252,    -1,   213,
+      -1,   214,    -1,   215,    -1,   216,    -1,   240,    -1,   255,
+      -1,   209,    -1,   211,    -1,   256,    -1,   262,    -1,   263,
+      -1,   264,    -1,   185,    -1,   222,    -1,   271,    -1,   272,
+      -1,   210,    -1,   267,    -1,   197,    -1,   180,    -1,   205,
+      -1,   253,    -1,   259,    -1,   241,    -1,   254,    -1,   274,
+      -1,   275,    -1,   186,    -1,   175,    -1,   196,    -1,   245,
+      -1,   176,    -1,   182,    -1,   183,    -1,   206,    -1,   207,
+      -1,   273,    -1,   243,    -1,   247,    -1,   248,    -1,   177,
+      -1,   276,    -1,   226,    -1,   251,    -1,   198,    -1,   212,
+      -1,   257,    -1,   258,    -1,   261,    -1,   266,    -1,   208,
+      -1,   268,    -1,   269,    -1,   270,    -1,   217,    -1,   221,
+      -1,   249,    -1,   250,    -1,   218,    -1,   242,    -1,   265,
+      -1,   199,    -1,   191,    -1,   192,    -1,   193,    -1,   194,
+      -1,   195,    -1,   277,    -1,   278,    -1,   279,    -1,   219,
+      -1,   227,    -1,   228,    -1,   280,    -1,   281,    -1,   236,
+      -1,   244,    -1,   220,    -1,   282,    -1,   284,    -1,   283,
+      -1,   285,    -1,   286,    -1,   287,    -1,   246,    -1,   260,
+      -1,    38,    -1,   168,   169,    -1,    -1,   288,    -1,   289,
+      -1,   290,    -1,   292,    -1,   291,    -1,    44,    -1,   171,
+     172,    -1,    -1,   293,    -1,   294,    -1,   295,    -1,   296,
       -1,    13,    10,    -1,    12,    10,    -1,    76,    10,    -1,
       79,    10,    -1,    97,    10,    -1,    14,    10,    -1,    16,
       10,    -1,    67,    10,    -1,    15,    10,    -1,    80,    10,
@@ -832,74 +857,79 @@ static const yytype_int16 yyrhs[] =
       10,    -1,    64,    10,    -1,    55,    10,    -1,   103,    10,
       -1,    48,    10,    -1,    49,    10,    -1,    50,    10,    -1,
       51,    10,    -1,   114,    10,    -1,   118,    10,    -1,   119,
-      10,    -1,   115,    10,    -1,    61,    10,    -1,    26,    10,
-      -1,    27,    10,    -1,    28,    10,    -1,    99,    10,    -1,
-     133,    10,    -1,   134,    10,    -1,    29,    10,    -1,    30,
-      10,    -1,    32,    10,    -1,    33,    10,    -1,    35,    10,
-      -1,    36,    10,    -1,    34,    10,    -1,   135,    10,    -1,
-      41,    10,    -1,    42,    10,    -1,    43,    10,    -1,    52,
-      10,    -1,    71,    10,    -1,   120,    10,    -1,    85,    10,
-      -1,    78,    10,    -1,    86,    10,    -1,    87,    10,    -1,
-     116,    10,    -1,   117,    10,    -1,   101,    10,    -1,    47,
-      10,    -1,    69,    10,    -1,    72,    10,    10,    -1,    53,
-      10,    -1,    56,    10,    -1,   106,    10,    -1,   107,    10,
-      -1,    70,    10,    -1,   108,    10,    -1,    57,    10,    -1,
-      58,    10,    -1,    59,    10,    -1,   121,    10,    -1,   109,
-      10,    -1,    65,    10,    -1,   112,    10,    -1,   113,    10,
-      -1,   111,    10,    -1,    62,    10,    -1,    63,    10,    -1,
-      84,    10,    -1,    73,    10,    10,    -1,    74,    10,    -1,
-      98,    10,    -1,   130,    10,    -1,   131,    10,    -1,   132,
-      10,    -1,   136,    10,    -1,   137,    10,    -1,    37,    10,
-      -1,    39,    10,    -1,    40,    10,    -1,   129,    10,    -1,
-     100,    10,    -1,    37,    10,    -1,    45,    10,    -1,    46,
-      10,    -1,   128,    10,    -1,    88,    -1,   278,   279,    -1,
-      -1,   280,    -1,   282,    -1,   281,    -1,   284,    -1,   285,
-      -1,   286,    -1,   287,    -1,   283,    -1,    89,    10,    -1,
-      91,    10,    -1,    90,    10,    -1,    96,    10,    -1,    92,
-      10,    -1,    93,    10,    -1,    94,    10,    -1,    95,    10,
-      -1,   138,    -1,   289,   290,    -1,    -1,   291,    -1,   292,
-      -1,   293,    -1,   294,    -1,   295,    -1,   296,    -1,   297,
-      -1,   298,    -1,   299,    -1,   300,    -1,   301,    -1,   302,
-      -1,   139,    10,    -1,   140,    10,    -1,   141,    10,    -1,
-     142,    10,    -1,   143,    10,    -1,   144,    10,    -1,   145,
-      10,    -1,   146,    10,    -1,   147,    10,    -1,   148,    10,
-      -1,   149,    10,    -1,   150,    10,    -1,   104,    -1,   304,
-     305,    -1,    -1,   306,    -1,   105,    10,    -1
+      10,    -1,   152,    10,    -1,   115,    10,    -1,    61,    10,
+      -1,    26,    10,    -1,    27,    10,    -1,    28,    10,    -1,
+      99,    10,    -1,   133,    10,    -1,   134,    10,    -1,    29,
+      10,    -1,    30,    10,    -1,    32,    10,    -1,    33,    10,
+      -1,    35,    10,    -1,    36,    10,    -1,    34,    10,    -1,
+     135,    10,    -1,    41,    10,    -1,    42,    10,    -1,    43,
+      10,    -1,    52,    10,    -1,    71,    10,    -1,   120,    10,
+      -1,    85,    10,    -1,   151,    10,    -1,    78,    10,    -1,
+     159,    10,    -1,    86,    10,    -1,    87,    10,    -1,   116,
+      10,    -1,   117,    10,    -1,   101,    10,    -1,    47,    10,
+      -1,    69,    10,    -1,    72,    10,    10,    -1,    53,    10,
+      -1,    56,    10,    -1,   106,    10,    -1,   107,    10,    -1,
+      70,    10,    -1,   160,    10,    -1,   108,    10,    -1,    57,
+      10,    -1,    58,    10,    -1,    59,    10,    -1,   121,    10,
+      -1,   109,    10,    -1,    65,    10,    -1,   112,    10,    -1,
+     113,    10,    -1,   111,    10,    -1,    62,    10,    -1,    63,
+      10,    -1,    84,    10,    -1,    73,    10,    10,    -1,    74,
+      10,    -1,    98,    10,    -1,   130,    10,    -1,   131,    10,
+      -1,   132,    10,    -1,   136,    10,    -1,   137,    10,    -1,
+     153,    10,    -1,   155,    10,    -1,   154,    10,    -1,   156,
+      10,    10,    -1,   157,    10,    10,    -1,   158,    10,    -1,
+      37,    10,    -1,    39,    10,    -1,    40,    10,    -1,   129,
+      10,    -1,   100,    10,    -1,    37,    10,    -1,    45,    10,
+      -1,    46,    10,    -1,   128,    10,    -1,    88,    -1,   298,
+     299,    -1,    -1,   300,    -1,   302,    -1,   301,    -1,   304,
+      -1,   305,    -1,   306,    -1,   307,    -1,   303,    -1,    89,
+      10,    -1,    91,    10,    -1,    90,    10,    -1,    96,    10,
+      -1,    92,    10,    -1,    93,    10,    -1,    94,    10,    -1,
+      95,    10,    -1,   138,    -1,   309,   310,    -1,    -1,   311,
+      -1,   312,    -1,   313,    -1,   314,    -1,   315,    -1,   316,
+      -1,   317,    -1,   318,    -1,   319,    -1,   320,    -1,   321,
+      -1,   322,    -1,   139,    10,    -1,   140,    10,    -1,   141,
+      10,    -1,   142,    10,    -1,   143,    10,    -1,   144,    10,
+      -1,   145,    10,    -1,   146,    10,    -1,   147,    10,    -1,
+     148,    10,    -1,   149,    10,    -1,   150,    10,    -1,   104,
+      -1,   324,   325,    -1,    -1,   326,    -1,   105,    10,    -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   123,   123,   123,   124,   124,   125,   125,   126,   126,
-     130,   135,   136,   137,   137,   137,   138,   138,   139,   139,
-     139,   140,   140,   140,   141,   141,   141,   142,   142,   143,
-     143,   144,   144,   145,   145,   146,   146,   147,   147,   148,
-     148,   149,   149,   150,   150,   150,   151,   151,   151,   152,
-     152,   152,   153,   153,   154,   154,   155,   155,   156,   156,
-     157,   157,   157,   158,   158,   159,   159,   160,   160,   160,
-     161,   161,   162,   162,   163,   163,   164,   164,   164,   165,
-     165,   166,   166,   167,   167,   168,   168,   169,   169,   170,
-     170,   170,   171,   171,   172,   172,   172,   173,   173,   173,
-     174,   174,   174,   175,   175,   175,   176,   176,   176,   177,
-     177,   177,   178,   178,   178,   179,   179,   180,   182,   194,
-     195,   196,   196,   196,   196,   196,   198,   210,   211,   212,
-     212,   212,   212,   214,   223,   232,   243,   252,   261,   270,
-     283,   298,   307,   316,   325,   334,   343,   352,   361,   370,
-     379,   388,   397,   406,   413,   420,   429,   438,   452,   461,
-     470,   477,   484,   491,   499,   506,   513,   520,   527,   535,
-     543,   551,   558,   565,   574,   583,   590,   597,   605,   613,
-     623,   636,   647,   655,   668,   677,   686,   695,   705,   713,
-     726,   735,   743,   752,   760,   773,   782,   789,   799,   809,
-     819,   829,   839,   849,   859,   866,   873,   882,   891,   900,
-     907,   917,   934,   941,   959,   972,   985,   994,  1003,  1012,
-    1022,  1032,  1041,  1050,  1057,  1066,  1075,  1084,  1092,  1105,
-    1113,  1136,  1143,  1158,  1168,  1178,  1185,  1192,  1201,  1211,
-    1218,  1225,  1234,  1244,  1254,  1261,  1268,  1277,  1282,  1283,
-    1284,  1284,  1284,  1285,  1285,  1285,  1286,  1286,  1288,  1298,
-    1307,  1314,  1324,  1331,  1338,  1345,  1352,  1357,  1358,  1359,
-    1359,  1360,  1360,  1361,  1361,  1362,  1363,  1364,  1365,  1366,
-    1367,  1369,  1377,  1384,  1392,  1400,  1407,  1414,  1423,  1432,
-    1441,  1450,  1459,  1468,  1473,  1474,  1475,  1477
+       0,   127,   127,   127,   128,   128,   129,   129,   130,   130,
+     134,   139,   140,   141,   141,   141,   142,   142,   143,   143,
+     143,   144,   144,   144,   145,   145,   145,   146,   146,   147,
+     147,   148,   148,   149,   149,   150,   150,   151,   151,   152,
+     152,   153,   153,   154,   154,   154,   155,   155,   155,   156,
+     156,   156,   157,   157,   158,   158,   159,   159,   160,   160,
+     161,   161,   161,   162,   162,   163,   163,   164,   164,   164,
+     165,   165,   166,   166,   167,   167,   168,   168,   168,   169,
+     169,   170,   170,   171,   171,   172,   172,   173,   173,   174,
+     174,   174,   175,   175,   176,   176,   176,   177,   177,   177,
+     178,   178,   178,   179,   179,   179,   180,   180,   180,   181,
+     181,   181,   182,   182,   182,   183,   183,   184,   184,   185,
+     185,   185,   186,   186,   187,   187,   188,   188,   190,   202,
+     203,   204,   204,   204,   204,   204,   206,   218,   219,   220,
+     220,   220,   220,   222,   231,   240,   251,   260,   269,   278,
+     291,   306,   315,   324,   333,   342,   351,   360,   369,   378,
+     387,   396,   405,   414,   421,   428,   437,   446,   460,   469,
+     478,   485,   492,   499,   507,   514,   521,   528,   535,   543,
+     551,   559,   566,   573,   582,   591,   598,   605,   613,   621,
+     631,   641,   654,   665,   673,   686,   695,   704,   713,   723,
+     731,   744,   753,   761,   770,   778,   791,   800,   807,   817,
+     827,   837,   847,   857,   867,   877,   887,   894,   901,   908,
+     917,   926,   935,   942,   952,   969,   976,   994,  1007,  1020,
+    1029,  1038,  1047,  1056,  1066,  1076,  1085,  1094,  1101,  1110,
+    1119,  1128,  1136,  1149,  1157,  1181,  1188,  1203,  1213,  1223,
+    1230,  1237,  1246,  1255,  1263,  1276,  1289,  1302,  1311,  1321,
+    1328,  1335,  1344,  1354,  1364,  1371,  1378,  1387,  1392,  1393,
+    1394,  1394,  1394,  1395,  1395,  1395,  1396,  1396,  1398,  1408,
+    1417,  1424,  1434,  1441,  1448,  1455,  1462,  1467,  1468,  1469,
+    1469,  1470,  1470,  1471,  1471,  1472,  1473,  1474,  1475,  1476,
+    1477,  1479,  1487,  1494,  1502,  1510,  1517,  1524,  1533,  1542,
+    1551,  1560,  1569,  1578,  1583,  1584,  1585,  1587
 };
 #endif
 
@@ -960,11 +990,15 @@ static const char *const yytname[] =
   "VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES",
   "VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES",
   "VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES",
-  "VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES", "$accept", "toplevelvars",
-  "toplevelvar", "serverstart", "contents_server", "content_server",
-  "stubstart", "contents_stub", "content_stub", "forwardstart",
-  "contents_forward", "content_forward", "server_num_threads",
-  "server_verbosity", "server_statistics_interval",
+  "VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES",
+  "VAR_HARDEN_ALGO_DOWNGRADE", "VAR_IP_TRANSPARENT", "VAR_RATELIMIT",
+  "VAR_RATELIMIT_SLABS", "VAR_RATELIMIT_SIZE", "VAR_RATELIMIT_FOR_DOMAIN",
+  "VAR_RATELIMIT_BELOW_DOMAIN", "VAR_RATELIMIT_FACTOR",
+  "VAR_CAPS_WHITELIST", "VAR_CACHE_MAX_NEGATIVE_TTL", "$accept",
+  "toplevelvars", "toplevelvar", "serverstart", "contents_server",
+  "content_server", "stubstart", "contents_stub", "content_stub",
+  "forwardstart", "contents_forward", "content_forward",
+  "server_num_threads", "server_verbosity", "server_statistics_interval",
   "server_statistics_cumulative", "server_extended_statistics",
   "server_port", "server_interface", "server_outgoing_interface",
   "server_outgoing_range", "server_outgoing_port_permit",
@@ -981,24 +1015,26 @@ static const char *const yytname[] =
   "server_trust_anchor", "server_domain_insecure", "server_hide_identity",
   "server_hide_version", "server_identity", "server_version",
   "server_so_rcvbuf", "server_so_sndbuf", "server_so_reuseport",
-  "server_edns_buffer_size", "server_msg_buffer_size",
-  "server_msg_cache_size", "server_msg_cache_slabs",
-  "server_num_queries_per_thread", "server_jostle_timeout",
-  "server_delay_close", "server_unblock_lan_zones",
-  "server_rrset_cache_size", "server_rrset_cache_slabs",
-  "server_infra_host_ttl", "server_infra_lame_ttl",
-  "server_infra_cache_numhosts", "server_infra_cache_lame_size",
-  "server_infra_cache_slabs", "server_infra_cache_min_rtt",
-  "server_target_fetch_policy", "server_harden_short_bufsize",
-  "server_harden_large_queries", "server_harden_glue",
-  "server_harden_dnssec_stripped", "server_harden_below_nxdomain",
-  "server_harden_referral_path", "server_use_caps_for_id",
-  "server_private_address", "server_private_domain", "server_prefetch",
-  "server_prefetch_key", "server_unwanted_reply_threshold",
-  "server_do_not_query_address", "server_do_not_query_localhost",
-  "server_access_control", "server_module_conf",
-  "server_val_override_date", "server_val_sig_skew_min",
-  "server_val_sig_skew_max", "server_cache_max_ttl",
+  "server_ip_transparent", "server_edns_buffer_size",
+  "server_msg_buffer_size", "server_msg_cache_size",
+  "server_msg_cache_slabs", "server_num_queries_per_thread",
+  "server_jostle_timeout", "server_delay_close",
+  "server_unblock_lan_zones", "server_rrset_cache_size",
+  "server_rrset_cache_slabs", "server_infra_host_ttl",
+  "server_infra_lame_ttl", "server_infra_cache_numhosts",
+  "server_infra_cache_lame_size", "server_infra_cache_slabs",
+  "server_infra_cache_min_rtt", "server_target_fetch_policy",
+  "server_harden_short_bufsize", "server_harden_large_queries",
+  "server_harden_glue", "server_harden_dnssec_stripped",
+  "server_harden_below_nxdomain", "server_harden_referral_path",
+  "server_harden_algo_downgrade", "server_use_caps_for_id",
+  "server_caps_whitelist", "server_private_address",
+  "server_private_domain", "server_prefetch", "server_prefetch_key",
+  "server_unwanted_reply_threshold", "server_do_not_query_address",
+  "server_do_not_query_localhost", "server_access_control",
+  "server_module_conf", "server_val_override_date",
+  "server_val_sig_skew_min", "server_val_sig_skew_max",
+  "server_cache_max_ttl", "server_cache_max_negative_ttl",
   "server_cache_min_ttl", "server_bogus_ttl",
   "server_val_clean_additional", "server_val_permissive_mode",
   "server_ignore_cd_flag", "server_val_log_level",
@@ -1007,15 +1043,17 @@ static const char *const yytname[] =
   "server_key_cache_slabs", "server_neg_cache_size", "server_local_zone",
   "server_local_data", "server_local_data_ptr", "server_minimal_responses",
   "server_rrset_roundrobin", "server_max_udp_size", "server_dns64_prefix",
-  "server_dns64_synthall", "stub_name", "stub_host", "stub_addr",
-  "stub_first", "stub_prime", "forward_name", "forward_host",
-  "forward_addr", "forward_first", "rcstart", "contents_rc", "content_rc",
-  "rc_control_enable", "rc_control_port", "rc_control_interface",
-  "rc_control_use_cert", "rc_server_key_file", "rc_server_cert_file",
-  "rc_control_key_file", "rc_control_cert_file", "dtstart", "contents_dt",
-  "content_dt", "dt_dnstap_enable", "dt_dnstap_socket_path",
-  "dt_dnstap_send_identity", "dt_dnstap_send_version",
-  "dt_dnstap_identity", "dt_dnstap_version",
+  "server_dns64_synthall", "server_ratelimit", "server_ratelimit_size",
+  "server_ratelimit_slabs", "server_ratelimit_for_domain",
+  "server_ratelimit_below_domain", "server_ratelimit_factor", "stub_name",
+  "stub_host", "stub_addr", "stub_first", "stub_prime", "forward_name",
+  "forward_host", "forward_addr", "forward_first", "rcstart",
+  "contents_rc", "content_rc", "rc_control_enable", "rc_control_port",
+  "rc_control_interface", "rc_control_use_cert", "rc_server_key_file",
+  "rc_server_cert_file", "rc_control_key_file", "rc_control_cert_file",
+  "dtstart", "contents_dt", "content_dt", "dt_dnstap_enable",
+  "dt_dnstap_socket_path", "dt_dnstap_send_identity",
+  "dt_dnstap_send_version", "dt_dnstap_identity", "dt_dnstap_version",
   "dt_dnstap_log_resolver_query_messages",
   "dt_dnstap_log_resolver_response_messages",
   "dt_dnstap_log_client_query_messages",
@@ -1046,28 +1084,29 @@ static const yytype_uint16 yytoknum[] =
      375,   376,   377,   378,   379,   380,   381,   382,   383,   384,
      385,   386,   387,   388,   389,   390,   391,   392,   393,   394,
      395,   396,   397,   398,   399,   400,   401,   402,   403,   404,
-     405
+     405,   406,   407,   408,   409,   410,   411,   412,   413,   414,
+     415
 };
 # endif
 
 /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_uint16 yyr1[] =
 {
-       0,   151,   152,   152,   153,   153,   153,   153,   153,   153,
-     154,   155,   155,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   156,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   157,   158,
-     158,   159,   159,   159,   159,   159,   160,   161,   161,   162,
-     162,   162,   162,   163,   164,   165,   166,   167,   168,   169,
-     170,   171,   172,   173,   174,   175,   176,   177,   178,   179,
+       0,   161,   162,   162,   163,   163,   163,   163,   163,   163,
+     164,   165,   165,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   166,   166,
+     166,   166,   166,   166,   166,   166,   166,   166,   167,   168,
+     168,   169,   169,   169,   169,   169,   170,   171,   171,   172,
+     172,   172,   172,   173,   174,   175,   176,   177,   178,   179,
      180,   181,   182,   183,   184,   185,   186,   187,   188,   189,
      190,   191,   192,   193,   194,   195,   196,   197,   198,   199,
      200,   201,   202,   203,   204,   205,   206,   207,   208,   209,
@@ -1077,12 +1116,14 @@ static const yytype_uint16 yyr1[] =
      240,   241,   242,   243,   244,   245,   246,   247,   248,   249,
      250,   251,   252,   253,   254,   255,   256,   257,   258,   259,
      260,   261,   262,   263,   264,   265,   266,   267,   268,   269,
-     270,   271,   272,   273,   274,   275,   276,   277,   278,   278,
-     279,   279,   279,   279,   279,   279,   279,   279,   280,   281,
-     282,   283,   284,   285,   286,   287,   288,   289,   289,   290,
-     290,   290,   290,   290,   290,   290,   290,   290,   290,   290,
-     290,   291,   292,   293,   294,   295,   296,   297,   298,   299,
-     300,   301,   302,   303,   304,   304,   305,   306
+     270,   271,   272,   273,   274,   275,   276,   277,   278,   279,
+     280,   281,   282,   283,   284,   285,   286,   287,   288,   289,
+     290,   291,   292,   293,   294,   295,   296,   297,   298,   298,
+     299,   299,   299,   299,   299,   299,   299,   299,   300,   301,
+     302,   303,   304,   305,   306,   307,   308,   309,   309,   310,
+     310,   310,   310,   310,   310,   310,   310,   310,   310,   310,
+     310,   311,   312,   313,   314,   315,   316,   317,   318,   319,
+     320,   321,   322,   323,   324,   324,   325,   326
 };
 
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
@@ -1099,6 +1140,7 @@ static const yytype_uint8 yyr2[] =
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     2,
        0,     1,     1,     1,     1,     1,     1,     2,     0,     1,
        1,     1,     1,     2,     2,     2,     2,     2,     2,     2,
@@ -1109,9 +1151,10 @@ static const yytype_uint8 yyr2[] =
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     3,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     3,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       3,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     3,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     3,     3,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     1,     2,     0,
        1,     1,     1,     1,     1,     1,     1,     1,     2,     2,
        2,     2,     2,     2,     2,     2,     1,     2,     0,     1,
@@ -1125,8 +1168,8 @@ static const yytype_uint8 yyr2[] =
    means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-       2,     0,     1,    10,   118,   126,   247,   293,   266,     3,
-      12,   120,   128,   249,   268,   295,     4,     5,     6,     8,
+       2,     0,     1,    10,   128,   136,   267,   313,   286,     3,
+      12,   130,   138,   269,   288,   315,     4,     5,     6,     8,
        9,     7,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
@@ -1137,46 +1180,48 @@ static const yytype_uint16 yydefact[] =
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,    11,    13,    14,
       70,    73,    82,    15,    21,    61,    16,    74,    75,    32,
       54,    69,    17,    18,    19,    20,   104,   105,   106,   107,
      108,    71,    60,    86,   103,    22,    23,    24,    25,    26,
       62,    76,    77,    92,    48,    58,    49,    87,    42,    43,
-      44,    45,    96,   100,   112,    97,    55,    27,    28,    29,
-      84,   113,   114,    30,    31,    33,    34,    36,    37,    35,
-     117,    38,    39,    40,    46,    65,   101,    79,    72,    80,
-      81,    98,    99,    85,    41,    63,    66,    47,    50,    88,
-      89,    64,    90,    51,    52,    53,   102,    91,    59,    93,
-      94,    95,    56,    57,    78,    67,    68,    83,   109,   110,
-     111,   115,   116,     0,     0,     0,     0,     0,   119,   121,
-     122,   123,   125,   124,     0,     0,     0,     0,   127,   129,
-     130,   131,   132,     0,     0,     0,     0,     0,     0,     0,
-       0,   248,   250,   252,   251,   257,   253,   254,   255,   256,
+      44,    45,    96,   100,   112,   119,    97,    55,    27,    28,
+      29,    84,   113,   114,    30,    31,    33,    34,    36,    37,
+      35,   117,    38,    39,    40,    46,    65,   101,    79,   118,
+      72,   126,    80,    81,    98,    99,    85,    41,    63,    66,
+      47,    50,    88,    89,    64,   127,    90,    51,    52,    53,
+     102,    91,    59,    93,    94,    95,    56,    57,    78,    67,
+      68,    83,   109,   110,   111,   115,   116,   120,   122,   121,
+     123,   124,   125,     0,     0,     0,     0,     0,   129,   131,
+     132,   133,   135,   134,     0,     0,     0,     0,   137,   139,
+     140,   141,   142,     0,     0,     0,     0,     0,     0,     0,
+       0,   268,   270,   272,   271,   277,   273,   274,   275,   276,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,   267,   269,   270,   271,   272,   273,   274,   275,
-     276,   277,   278,   279,   280,     0,   294,   296,   134,   133,
-     138,   141,   139,   147,   148,   149,   150,   160,   161,   162,
-     163,   164,   182,   183,   184,   188,   189,   144,   190,   191,
-     194,   192,   193,   196,   197,   198,   209,   173,   174,   175,
-     176,   199,   212,   169,   171,   213,   218,   219,   220,   145,
-     181,   227,   228,   170,   223,   157,   140,   165,   210,   216,
-     200,     0,     0,   231,   146,   135,   156,   203,   136,   142,
-     143,   166,   167,   229,   202,   204,   205,   137,   232,   185,
-     208,   158,   172,   214,   215,   217,   222,   168,   226,   224,
-     225,   177,   180,   206,   207,   178,   179,   201,   221,   159,
-     151,   152,   153,   154,   155,   233,   234,   235,   186,   187,
-     195,   236,   237,   238,   239,   240,   242,   241,   243,   244,
-     245,   246,   258,   260,   259,   262,   263,   264,   265,   261,
-     281,   282,   283,   284,   285,   286,   287,   288,   289,   290,
-     291,   292,   297,   211,   230
+       0,     0,   287,   289,   290,   291,   292,   293,   294,   295,
+     296,   297,   298,   299,   300,     0,   314,   316,   144,   143,
+     148,   151,   149,   157,   158,   159,   160,   170,   171,   172,
+     173,   174,   193,   194,   195,   199,   200,   154,   201,   202,
+     205,   203,   204,   207,   208,   209,   222,   183,   184,   185,
+     186,   210,   225,   179,   181,   226,   232,   233,   234,   155,
+     192,   241,   242,   180,   237,   167,   150,   175,   223,   229,
+     211,     0,     0,   245,   156,   145,   166,   215,   146,   152,
+     153,   176,   177,   243,   213,   217,   218,   147,   246,   196,
+     221,   168,   182,   227,   228,   231,   236,   178,   240,   238,
+     239,   187,   191,   219,   220,   188,   189,   212,   235,   169,
+     161,   162,   163,   164,   165,   247,   248,   249,   197,   198,
+     206,   250,   251,   214,   190,   252,   254,   253,     0,     0,
+     257,   216,   230,   258,   259,   260,   262,   261,   263,   264,
+     265,   266,   278,   280,   279,   282,   283,   284,   285,   281,
+     301,   302,   303,   304,   305,   306,   307,   308,   309,   310,
+     311,   312,   317,   224,   244,   255,   256
 };
 
 /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     1,     9,    10,    16,   127,    11,    17,   238,    12,
-      18,   248,   128,   129,   130,   131,   132,   133,   134,   135,
-     136,   137,   138,   139,   140,   141,   142,   143,   144,   145,
+      -1,     1,     9,    10,    16,   137,    11,    17,   258,    12,
+      18,   268,   138,   139,   140,   141,   142,   143,   144,   145,
      146,   147,   148,   149,   150,   151,   152,   153,   154,   155,
      156,   157,   158,   159,   160,   161,   162,   163,   164,   165,
      166,   167,   168,   169,   170,   171,   172,   173,   174,   175,
@@ -1185,83 +1230,89 @@ static const yytype_int16 yydefgoto[] =
      196,   197,   198,   199,   200,   201,   202,   203,   204,   205,
      206,   207,   208,   209,   210,   211,   212,   213,   214,   215,
      216,   217,   218,   219,   220,   221,   222,   223,   224,   225,
-     226,   227,   228,   229,   230,   231,   232,   239,   240,   241,
-     242,   243,   249,   250,   251,   252,    13,    19,   261,   262,
-     263,   264,   265,   266,   267,   268,   269,    14,    20,   282,
-     283,   284,   285,   286,   287,   288,   289,   290,   291,   292,
-     293,   294,    15,    21,   296,   297
+     226,   227,   228,   229,   230,   231,   232,   233,   234,   235,
+     236,   237,   238,   239,   240,   241,   242,   243,   244,   245,
+     246,   247,   248,   249,   250,   251,   252,   259,   260,   261,
+     262,   263,   269,   270,   271,   272,    13,    19,   281,   282,
+     283,   284,   285,   286,   287,   288,   289,    14,    20,   302,
+     303,   304,   305,   306,   307,   308,   309,   310,   311,   312,
+     313,   314,    15,    21,   316,   317
 };
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -125
+#define YYPACT_NINF -81
 static const yytype_int16 yypact[] =
 {
-    -125,     0,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,    93,   -36,   -32,   -62,
-    -124,  -103,    -4,    -3,    -2,    -1,     2,    25,    26,    27,
-      29,    30,    31,    32,    33,    35,    36,    37,    38,    39,
-      40,    41,    42,    43,    44,    45,    46,    47,    48,    49,
-      50,    51,    52,    53,    55,    56,    57,    58,    59,    60,
-      61,    62,    63,    64,    65,    66,    67,    68,    69,    70,
-      71,    72,    73,    74,    75,    76,    77,    79,    80,    81,
-      82,    84,    85,    87,    88,    89,    90,    91,    92,   120,
-     121,   122,   123,   127,   129,   171,   172,   173,   174,   175,
-     176,   177,   178,   179,   183,   187,   188,   211,   212,   221,
-     222,   223,   224,   225,   226,   227,   228,   229,   230,   231,
-     232,   233,   234,   235,   236,   237,   238,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,   239,   240,   241,   242,   243,  -125,  -125,
-    -125,  -125,  -125,  -125,   244,   245,   246,   247,  -125,  -125,
-    -125,  -125,  -125,   248,   249,   250,   251,   252,   253,   254,
-     255,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-     256,   257,   258,   259,   260,   261,   262,   263,   264,   265,
-     266,   267,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,   268,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,   269,   270,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125
+     -81,   116,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -12,    89,    47,   -13,
+      22,   -80,    16,    17,    18,    23,    24,    78,   107,   120,
+     121,   122,   123,   124,   125,   126,   127,   128,   139,   140,
+     141,   142,   143,   145,   146,   147,   148,   149,   163,   164,
+     166,   167,   168,   169,   170,   171,   172,   173,   174,   175,
+     176,   177,   178,   180,   181,   182,   183,   184,   185,   186,
+     187,   188,   189,   190,   191,   192,   193,   195,   196,   197,
+     198,   199,   200,   201,   202,   203,   204,   205,   206,   207,
+     209,   211,   212,   213,   214,   215,   216,   217,   218,   219,
+     220,   221,   222,   223,   224,   225,   226,   227,   228,   229,
+     230,   231,   232,   233,   234,   235,   236,   237,   238,   239,
+     240,   241,   242,   243,   245,   246,   247,   248,   249,   250,
+     251,   252,   253,   254,   255,   256,   257,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   258,   259,   260,   261,   262,   -81,   -81,
+     -81,   -81,   -81,   -81,   263,   264,   265,   266,   -81,   -81,
+     -81,   -81,   -81,   267,   268,   269,   270,   271,   272,   273,
+     274,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     275,   276,   277,   278,   279,   280,   281,   282,   283,   284,
+     285,   286,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   287,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   288,   289,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   290,   291,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81
 };
 
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int8 yypgoto[] =
 {
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,  -125,
-    -125,  -125,  -125,  -125,  -125,  -125
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
@@ -1270,83 +1321,87 @@ static const yytype_int8 yypgoto[] =
 #define YYTABLE_NINF -1
 static const yytype_uint16 yytable[] =
 {
-       2,   233,   295,   234,   235,   244,   298,   299,   300,   301,
-       0,     3,   302,   245,   246,   270,   271,   272,   273,   274,
-     275,   276,   277,   278,   279,   280,   281,   253,   254,   255,
-     256,   257,   258,   259,   260,   303,   304,   305,     4,   306,
-     307,   308,   309,   310,     5,   311,   312,   313,   314,   315,
-     316,   317,   318,   319,   320,   321,   322,   323,   324,   325,
-     326,   327,   328,   329,   236,   330,   331,   332,   333,   334,
-     335,   336,   337,   338,   339,   340,   341,   342,   343,   344,
-     345,   346,   347,   348,   349,   350,   351,   352,     6,   353,
-     354,   355,   356,   237,   357,   358,   247,   359,   360,   361,
-     362,   363,   364,     0,     7,    22,    23,    24,    25,    26,
-      27,    28,    29,    30,    31,    32,    33,    34,    35,    36,
-      37,    38,    39,    40,    41,    42,    43,    44,    45,    46,
-     365,   366,   367,   368,    47,    48,    49,   369,     8,   370,
-      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    68,    69,
-      70,    71,    72,    73,    74,    75,    76,    77,    78,    79,
-      80,    81,    82,    83,    84,    85,    86,    87,    88,    89,
-      90,   371,   372,   373,   374,   375,   376,   377,   378,   379,
-      91,    92,    93,   380,    94,    95,    96,   381,   382,    97,
-      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
-     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
-     118,   383,   384,   119,   120,   121,   122,   123,   124,   125,
-     126,   385,   386,   387,   388,   389,   390,   391,   392,   393,
-     394,   395,   396,   397,   398,   399,   400,   401,   402,   403,
-     404,   405,   406,   407,   408,   409,   410,   411,   412,   413,
-     414,   415,   416,   417,   418,   419,   420,   421,   422,   423,
-     424,   425,   426,   427,   428,   429,   430,   431,   432,   433,
-     434
+      22,    23,    24,    25,    26,    27,    28,    29,    30,    31,
+      32,    33,    34,    35,    36,    37,    38,    39,    40,    41,
+      42,    43,    44,    45,    46,   315,   318,   319,   320,    47,
+      48,    49,     0,   321,   322,    50,    51,    52,    53,    54,
+      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,    67,    68,    69,    70,    71,    72,    73,    74,
+      75,    76,    77,    78,    79,    80,    81,    82,    83,    84,
+      85,    86,    87,    88,    89,    90,   273,   274,   275,   276,
+     277,   278,   279,   280,   264,    91,    92,    93,   323,    94,
+      95,    96,   265,   266,    97,    98,    99,   100,   101,   102,
+     103,   104,   105,   106,   107,   108,   109,   110,   111,   112,
+     113,   114,   115,   116,   117,   118,     2,   324,   119,   120,
+     121,   122,   123,   124,   125,   126,   253,     3,   254,   255,
+     325,   326,   327,   328,   329,   330,   331,   332,   333,   127,
+     128,   129,   130,   131,   132,   133,   134,   135,   136,   334,
+     335,   336,   337,   338,     4,   339,   340,   341,   342,   343,
+       5,   290,   291,   292,   293,   294,   295,   296,   297,   298,
+     299,   300,   301,   344,   345,   267,   346,   347,   348,   349,
+     350,   351,   352,   353,   354,   355,   356,   357,   358,   256,
+     359,   360,   361,   362,   363,   364,   365,   366,   367,   368,
+     369,   370,   371,   372,     6,   373,   374,   375,   376,   377,
+     378,   379,   380,   381,   382,   383,   384,   385,   257,   386,
+       7,   387,   388,   389,   390,   391,   392,   393,   394,   395,
+     396,   397,   398,   399,   400,   401,   402,   403,   404,   405,
+     406,   407,   408,   409,   410,   411,   412,   413,   414,   415,
+     416,   417,   418,   419,     8,   420,   421,   422,   423,   424,
+     425,   426,   427,   428,   429,   430,   431,   432,   433,   434,
+     435,   436,   437,   438,   439,   440,   441,   442,   443,   444,
+     445,   446,   447,   448,   449,   450,   451,   452,   453,   454,
+     455,   456,   457,   458,   459,   460,   461,   462,   463,   464,
+     465,   466
 };
 
 #define yypact_value_is_default(Yystate) \
-  (!!((Yystate) == (-125)))
+  (!!((Yystate) == (-81)))
 
 #define yytable_value_is_error(Yytable_value) \
   YYID (0)
 
 static const yytype_int16 yycheck[] =
 {
-       0,    37,   105,    39,    40,    37,    10,    10,    10,    10,
-      -1,    11,    10,    45,    46,   139,   140,   141,   142,   143,
-     144,   145,   146,   147,   148,   149,   150,    89,    90,    91,
-      92,    93,    94,    95,    96,    10,    10,    10,    38,    10,
-      10,    10,    10,    10,    44,    10,    10,    10,    10,    10,
+      12,    13,    14,    15,    16,    17,    18,    19,    20,    21,
+      22,    23,    24,    25,    26,    27,    28,    29,    30,    31,
+      32,    33,    34,    35,    36,   105,    10,    10,    10,    41,
+      42,    43,    -1,    10,    10,    47,    48,    49,    50,    51,
+      52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
+      62,    63,    64,    65,    66,    67,    68,    69,    70,    71,
+      72,    73,    74,    75,    76,    77,    78,    79,    80,    81,
+      82,    83,    84,    85,    86,    87,    89,    90,    91,    92,
+      93,    94,    95,    96,    37,    97,    98,    99,    10,   101,
+     102,   103,    45,    46,   106,   107,   108,   109,   110,   111,
+     112,   113,   114,   115,   116,   117,   118,   119,   120,   121,
+     122,   123,   124,   125,   126,   127,     0,    10,   130,   131,
+     132,   133,   134,   135,   136,   137,    37,    11,    39,    40,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,   151,
+     152,   153,   154,   155,   156,   157,   158,   159,   160,    10,
+      10,    10,    10,    10,    38,    10,    10,    10,    10,    10,
+      44,   139,   140,   141,   142,   143,   144,   145,   146,   147,
+     148,   149,   150,    10,    10,   128,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,   100,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,   100,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    88,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,   129,    10,
+     104,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    88,    10,
-      10,    10,    10,   129,    10,    10,   128,    10,    10,    10,
-      10,    10,    10,    -1,   104,    12,    13,    14,    15,    16,
-      17,    18,    19,    20,    21,    22,    23,    24,    25,    26,
-      27,    28,    29,    30,    31,    32,    33,    34,    35,    36,
-      10,    10,    10,    10,    41,    42,    43,    10,   138,    10,
-      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
-      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
-      67,    68,    69,    70,    71,    72,    73,    74,    75,    76,
-      77,    78,    79,    80,    81,    82,    83,    84,    85,    86,
-      87,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      97,    98,    99,    10,   101,   102,   103,    10,    10,   106,
-     107,   108,   109,   110,   111,   112,   113,   114,   115,   116,
-     117,   118,   119,   120,   121,   122,   123,   124,   125,   126,
-     127,    10,    10,   130,   131,   132,   133,   134,   135,   136,
-     137,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,   138,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10
+      10,    10
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
    symbol of state STATE-NUM.  */
 static const yytype_uint16 yystos[] =
 {
-       0,   152,     0,    11,    38,    44,    88,   104,   138,   153,
-     154,   157,   160,   277,   288,   303,   155,   158,   161,   278,
-     289,   304,    12,    13,    14,    15,    16,    17,    18,    19,
+       0,   162,     0,    11,    38,    44,    88,   104,   138,   163,
+     164,   167,   170,   297,   308,   323,   165,   168,   171,   298,
+     309,   324,    12,    13,    14,    15,    16,    17,    18,    19,
       20,    21,    22,    23,    24,    25,    26,    27,    28,    29,
       30,    31,    32,    33,    34,    35,    36,    41,    42,    43,
       47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
@@ -1356,8 +1411,8 @@ static const yytype_uint16 yystos[] =
       87,    97,    98,    99,   101,   102,   103,   106,   107,   108,
      109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
      119,   120,   121,   122,   123,   124,   125,   126,   127,   130,
-     131,   132,   133,   134,   135,   136,   137,   156,   163,   164,
-     165,   166,   167,   168,   169,   170,   171,   172,   173,   174,
+     131,   132,   133,   134,   135,   136,   137,   151,   152,   153,
+     154,   155,   156,   157,   158,   159,   160,   166,   173,   174,
      175,   176,   177,   178,   179,   180,   181,   182,   183,   184,
      185,   186,   187,   188,   189,   190,   191,   192,   193,   194,
      195,   196,   197,   198,   199,   200,   201,   202,   203,   204,
@@ -1367,13 +1422,15 @@ static const yytype_uint16 yystos[] =
      235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
      245,   246,   247,   248,   249,   250,   251,   252,   253,   254,
      255,   256,   257,   258,   259,   260,   261,   262,   263,   264,
-     265,   266,   267,    37,    39,    40,   100,   129,   159,   268,
-     269,   270,   271,   272,    37,    45,    46,   128,   162,   273,
-     274,   275,   276,    89,    90,    91,    92,    93,    94,    95,
-      96,   279,   280,   281,   282,   283,   284,   285,   286,   287,
+     265,   266,   267,   268,   269,   270,   271,   272,   273,   274,
+     275,   276,   277,   278,   279,   280,   281,   282,   283,   284,
+     285,   286,   287,    37,    39,    40,   100,   129,   169,   288,
+     289,   290,   291,   292,    37,    45,    46,   128,   172,   293,
+     294,   295,   296,    89,    90,    91,    92,    93,    94,    95,
+      96,   299,   300,   301,   302,   303,   304,   305,   306,   307,
      139,   140,   141,   142,   143,   144,   145,   146,   147,   148,
-     149,   150,   290,   291,   292,   293,   294,   295,   296,   297,
-     298,   299,   300,   301,   302,   105,   305,   306,    10,    10,
+     149,   150,   310,   311,   312,   313,   314,   315,   316,   317,
+     318,   319,   320,   321,   322,   105,   325,   326,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
@@ -1387,7 +1444,8 @@ static const yytype_uint16 yystos[] =
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -2189,15 +2247,15 @@ yyreduce:
     {
         case 10:
 /* Line 1792 of yacc.c  */
-#line 131 "util/configparser.y"
+#line 135 "util/configparser.y"
     { 
 		OUTYY(("\nP(server:)\n")); 
 	}
     break;
 
-  case 118:
+  case 128:
 /* Line 1792 of yacc.c  */
-#line 183 "util/configparser.y"
+#line 191 "util/configparser.y"
     {
 		struct config_stub* s;
 		OUTYY(("\nP(stub_zone:)\n")); 
@@ -2210,9 +2268,9 @@ yyreduce:
 	}
     break;
 
-  case 126:
+  case 136:
 /* Line 1792 of yacc.c  */
-#line 199 "util/configparser.y"
+#line 207 "util/configparser.y"
     {
 		struct config_stub* s;
 		OUTYY(("\nP(forward_zone:)\n")); 
@@ -2225,9 +2283,9 @@ yyreduce:
 	}
     break;
 
-  case 133:
+  case 143:
 /* Line 1792 of yacc.c  */
-#line 215 "util/configparser.y"
+#line 223 "util/configparser.y"
     { 
 		OUTYY(("P(server_num_threads:%s)\n", (yyvsp[(2) - (2)].str))); 
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2237,9 +2295,9 @@ yyreduce:
 	}
     break;
 
-  case 134:
+  case 144:
 /* Line 1792 of yacc.c  */
-#line 224 "util/configparser.y"
+#line 232 "util/configparser.y"
     { 
 		OUTYY(("P(server_verbosity:%s)\n", (yyvsp[(2) - (2)].str))); 
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2249,9 +2307,9 @@ yyreduce:
 	}
     break;
 
-  case 135:
+  case 145:
 /* Line 1792 of yacc.c  */
-#line 233 "util/configparser.y"
+#line 241 "util/configparser.y"
     { 
 		OUTYY(("P(server_statistics_interval:%s)\n", (yyvsp[(2) - (2)].str))); 
 		if(strcmp((yyvsp[(2) - (2)].str), "") == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0)
@@ -2263,9 +2321,9 @@ yyreduce:
 	}
     break;
 
-  case 136:
+  case 146:
 /* Line 1792 of yacc.c  */
-#line 244 "util/configparser.y"
+#line 252 "util/configparser.y"
     {
 		OUTYY(("P(server_statistics_cumulative:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2275,9 +2333,9 @@ yyreduce:
 	}
     break;
 
-  case 137:
+  case 147:
 /* Line 1792 of yacc.c  */
-#line 253 "util/configparser.y"
+#line 261 "util/configparser.y"
     {
 		OUTYY(("P(server_extended_statistics:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2287,9 +2345,9 @@ yyreduce:
 	}
     break;
 
-  case 138:
+  case 148:
 /* Line 1792 of yacc.c  */
-#line 262 "util/configparser.y"
+#line 270 "util/configparser.y"
     {
 		OUTYY(("P(server_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2299,9 +2357,9 @@ yyreduce:
 	}
     break;
 
-  case 139:
+  case 149:
 /* Line 1792 of yacc.c  */
-#line 271 "util/configparser.y"
+#line 279 "util/configparser.y"
     {
 		OUTYY(("P(server_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->num_ifs == 0)
@@ -2315,9 +2373,9 @@ yyreduce:
 	}
     break;
 
-  case 140:
+  case 150:
 /* Line 1792 of yacc.c  */
-#line 284 "util/configparser.y"
+#line 292 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->num_out_ifs == 0)
@@ -2333,9 +2391,9 @@ yyreduce:
 	}
     break;
 
-  case 141:
+  case 151:
 /* Line 1792 of yacc.c  */
-#line 299 "util/configparser.y"
+#line 307 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_range:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2345,9 +2403,9 @@ yyreduce:
 	}
     break;
 
-  case 142:
+  case 152:
 /* Line 1792 of yacc.c  */
-#line 308 "util/configparser.y"
+#line 316 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_port_permit:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_mark_ports((yyvsp[(2) - (2)].str), 1, 
@@ -2357,9 +2415,9 @@ yyreduce:
 	}
     break;
 
-  case 143:
+  case 153:
 /* Line 1792 of yacc.c  */
-#line 317 "util/configparser.y"
+#line 325 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_port_avoid:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_mark_ports((yyvsp[(2) - (2)].str), 0, 
@@ -2369,9 +2427,9 @@ yyreduce:
 	}
     break;
 
-  case 144:
+  case 154:
 /* Line 1792 of yacc.c  */
-#line 326 "util/configparser.y"
+#line 334 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_num_tcp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2381,9 +2439,9 @@ yyreduce:
 	}
     break;
 
-  case 145:
+  case 155:
 /* Line 1792 of yacc.c  */
-#line 335 "util/configparser.y"
+#line 343 "util/configparser.y"
     {
 		OUTYY(("P(server_incoming_num_tcp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2393,9 +2451,9 @@ yyreduce:
 	}
     break;
 
-  case 146:
+  case 156:
 /* Line 1792 of yacc.c  */
-#line 344 "util/configparser.y"
+#line 352 "util/configparser.y"
     {
 		OUTYY(("P(server_interface_automatic:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2405,9 +2463,9 @@ yyreduce:
 	}
     break;
 
-  case 147:
+  case 157:
 /* Line 1792 of yacc.c  */
-#line 353 "util/configparser.y"
+#line 361 "util/configparser.y"
     {
 		OUTYY(("P(server_do_ip4:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2417,9 +2475,9 @@ yyreduce:
 	}
     break;
 
-  case 148:
+  case 158:
 /* Line 1792 of yacc.c  */
-#line 362 "util/configparser.y"
+#line 370 "util/configparser.y"
     {
 		OUTYY(("P(server_do_ip6:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2429,9 +2487,9 @@ yyreduce:
 	}
     break;
 
-  case 149:
+  case 159:
 /* Line 1792 of yacc.c  */
-#line 371 "util/configparser.y"
+#line 379 "util/configparser.y"
     {
 		OUTYY(("P(server_do_udp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2441,9 +2499,9 @@ yyreduce:
 	}
     break;
 
-  case 150:
+  case 160:
 /* Line 1792 of yacc.c  */
-#line 380 "util/configparser.y"
+#line 388 "util/configparser.y"
     {
 		OUTYY(("P(server_do_tcp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2453,9 +2511,9 @@ yyreduce:
 	}
     break;
 
-  case 151:
+  case 161:
 /* Line 1792 of yacc.c  */
-#line 389 "util/configparser.y"
+#line 397 "util/configparser.y"
     {
 		OUTYY(("P(server_tcp_upstream:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2465,9 +2523,9 @@ yyreduce:
 	}
     break;
 
-  case 152:
+  case 162:
 /* Line 1792 of yacc.c  */
-#line 398 "util/configparser.y"
+#line 406 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_upstream:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2477,9 +2535,9 @@ yyreduce:
 	}
     break;
 
-  case 153:
+  case 163:
 /* Line 1792 of yacc.c  */
-#line 407 "util/configparser.y"
+#line 415 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_service_key:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->ssl_service_key);
@@ -2487,9 +2545,9 @@ yyreduce:
 	}
     break;
 
-  case 154:
+  case 164:
 /* Line 1792 of yacc.c  */
-#line 414 "util/configparser.y"
+#line 422 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_service_pem:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->ssl_service_pem);
@@ -2497,9 +2555,9 @@ yyreduce:
 	}
     break;
 
-  case 155:
+  case 165:
 /* Line 1792 of yacc.c  */
-#line 421 "util/configparser.y"
+#line 429 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2509,9 +2567,9 @@ yyreduce:
 	}
     break;
 
-  case 156:
+  case 166:
 /* Line 1792 of yacc.c  */
-#line 430 "util/configparser.y"
+#line 438 "util/configparser.y"
     {
 		OUTYY(("P(server_do_daemonize:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2521,9 +2579,9 @@ yyreduce:
 	}
     break;
 
-  case 157:
+  case 167:
 /* Line 1792 of yacc.c  */
-#line 439 "util/configparser.y"
+#line 447 "util/configparser.y"
     {
 		OUTYY(("P(server_use_syslog:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2538,9 +2596,9 @@ yyreduce:
 	}
     break;
 
-  case 158:
+  case 168:
 /* Line 1792 of yacc.c  */
-#line 453 "util/configparser.y"
+#line 461 "util/configparser.y"
     {
 		OUTYY(("P(server_log_time_ascii:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2550,9 +2608,9 @@ yyreduce:
 	}
     break;
 
-  case 159:
+  case 169:
 /* Line 1792 of yacc.c  */
-#line 462 "util/configparser.y"
+#line 470 "util/configparser.y"
     {
 		OUTYY(("P(server_log_queries:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2562,9 +2620,9 @@ yyreduce:
 	}
     break;
 
-  case 160:
+  case 170:
 /* Line 1792 of yacc.c  */
-#line 471 "util/configparser.y"
+#line 479 "util/configparser.y"
     {
 		OUTYY(("P(server_chroot:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->chrootdir);
@@ -2572,9 +2630,9 @@ yyreduce:
 	}
     break;
 
-  case 161:
+  case 171:
 /* Line 1792 of yacc.c  */
-#line 478 "util/configparser.y"
+#line 486 "util/configparser.y"
     {
 		OUTYY(("P(server_username:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->username);
@@ -2582,9 +2640,9 @@ yyreduce:
 	}
     break;
 
-  case 162:
+  case 172:
 /* Line 1792 of yacc.c  */
-#line 485 "util/configparser.y"
+#line 493 "util/configparser.y"
     {
 		OUTYY(("P(server_directory:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->directory);
@@ -2592,9 +2650,9 @@ yyreduce:
 	}
     break;
 
-  case 163:
+  case 173:
 /* Line 1792 of yacc.c  */
-#line 492 "util/configparser.y"
+#line 500 "util/configparser.y"
     {
 		OUTYY(("P(server_logfile:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->logfile);
@@ -2603,9 +2661,9 @@ yyreduce:
 	}
     break;
 
-  case 164:
+  case 174:
 /* Line 1792 of yacc.c  */
-#line 500 "util/configparser.y"
+#line 508 "util/configparser.y"
     {
 		OUTYY(("P(server_pidfile:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->pidfile);
@@ -2613,9 +2671,9 @@ yyreduce:
 	}
     break;
 
-  case 165:
+  case 175:
 /* Line 1792 of yacc.c  */
-#line 507 "util/configparser.y"
+#line 515 "util/configparser.y"
     {
 		OUTYY(("P(server_root_hints:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->root_hints, (yyvsp[(2) - (2)].str)))
@@ -2623,9 +2681,9 @@ yyreduce:
 	}
     break;
 
-  case 166:
+  case 176:
 /* Line 1792 of yacc.c  */
-#line 514 "util/configparser.y"
+#line 522 "util/configparser.y"
     {
 		OUTYY(("P(server_dlv_anchor_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dlv_anchor_file);
@@ -2633,9 +2691,9 @@ yyreduce:
 	}
     break;
 
-  case 167:
+  case 177:
 /* Line 1792 of yacc.c  */
-#line 521 "util/configparser.y"
+#line 529 "util/configparser.y"
     {
 		OUTYY(("P(server_dlv_anchor:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, (yyvsp[(2) - (2)].str)))
@@ -2643,9 +2701,9 @@ yyreduce:
 	}
     break;
 
-  case 168:
+  case 178:
 /* Line 1792 of yacc.c  */
-#line 528 "util/configparser.y"
+#line 536 "util/configparser.y"
     {
 		OUTYY(("P(server_auto_trust_anchor_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
@@ -2654,9 +2712,9 @@ yyreduce:
 	}
     break;
 
-  case 169:
+  case 179:
 /* Line 1792 of yacc.c  */
-#line 536 "util/configparser.y"
+#line 544 "util/configparser.y"
     {
 		OUTYY(("P(server_trust_anchor_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
@@ -2665,9 +2723,9 @@ yyreduce:
 	}
     break;
 
-  case 170:
+  case 180:
 /* Line 1792 of yacc.c  */
-#line 544 "util/configparser.y"
+#line 552 "util/configparser.y"
     {
 		OUTYY(("P(server_trusted_keys_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
@@ -2676,9 +2734,9 @@ yyreduce:
 	}
     break;
 
-  case 171:
+  case 181:
 /* Line 1792 of yacc.c  */
-#line 552 "util/configparser.y"
+#line 560 "util/configparser.y"
     {
 		OUTYY(("P(server_trust_anchor:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->trust_anchor_list, (yyvsp[(2) - (2)].str)))
@@ -2686,9 +2744,9 @@ yyreduce:
 	}
     break;
 
-  case 172:
+  case 182:
 /* Line 1792 of yacc.c  */
-#line 559 "util/configparser.y"
+#line 567 "util/configparser.y"
     {
 		OUTYY(("P(server_domain_insecure:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->domain_insecure, (yyvsp[(2) - (2)].str)))
@@ -2696,9 +2754,9 @@ yyreduce:
 	}
     break;
 
-  case 173:
+  case 183:
 /* Line 1792 of yacc.c  */
-#line 566 "util/configparser.y"
+#line 574 "util/configparser.y"
     {
 		OUTYY(("P(server_hide_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2708,9 +2766,9 @@ yyreduce:
 	}
     break;
 
-  case 174:
+  case 184:
 /* Line 1792 of yacc.c  */
-#line 575 "util/configparser.y"
+#line 583 "util/configparser.y"
     {
 		OUTYY(("P(server_hide_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2720,9 +2778,9 @@ yyreduce:
 	}
     break;
 
-  case 175:
+  case 185:
 /* Line 1792 of yacc.c  */
-#line 584 "util/configparser.y"
+#line 592 "util/configparser.y"
     {
 		OUTYY(("P(server_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->identity);
@@ -2730,9 +2788,9 @@ yyreduce:
 	}
     break;
 
-  case 176:
+  case 186:
 /* Line 1792 of yacc.c  */
-#line 591 "util/configparser.y"
+#line 599 "util/configparser.y"
     {
 		OUTYY(("P(server_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->version);
@@ -2740,9 +2798,9 @@ yyreduce:
 	}
     break;
 
-  case 177:
+  case 187:
 /* Line 1792 of yacc.c  */
-#line 598 "util/configparser.y"
+#line 606 "util/configparser.y"
     {
 		OUTYY(("P(server_so_rcvbuf:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->so_rcvbuf))
@@ -2751,9 +2809,9 @@ yyreduce:
 	}
     break;
 
-  case 178:
+  case 188:
 /* Line 1792 of yacc.c  */
-#line 606 "util/configparser.y"
+#line 614 "util/configparser.y"
     {
 		OUTYY(("P(server_so_sndbuf:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->so_sndbuf))
@@ -2762,9 +2820,9 @@ yyreduce:
 	}
     break;
 
-  case 179:
+  case 189:
 /* Line 1792 of yacc.c  */
-#line 614 "util/configparser.y"
+#line 622 "util/configparser.y"
     {
         OUTYY(("P(server_so_reuseport:%s)\n", (yyvsp[(2) - (2)].str)));
         if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2775,9 +2833,22 @@ yyreduce:
     }
     break;
 
-  case 180:
+  case 190:
 /* Line 1792 of yacc.c  */
-#line 624 "util/configparser.y"
+#line 632 "util/configparser.y"
+    {
+        OUTYY(("P(server_ip_transparent:%s)\n", (yyvsp[(2) - (2)].str)));
+        if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
+            yyerror("expected yes or no.");
+        else cfg_parser->cfg->ip_transparent =
+            (strcmp((yyvsp[(2) - (2)].str), "yes")==0);
+        free((yyvsp[(2) - (2)].str));
+    }
+    break;
+
+  case 191:
+/* Line 1792 of yacc.c  */
+#line 642 "util/configparser.y"
     {
 		OUTYY(("P(server_edns_buffer_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2791,9 +2862,9 @@ yyreduce:
 	}
     break;
 
-  case 181:
+  case 192:
 /* Line 1792 of yacc.c  */
-#line 637 "util/configparser.y"
+#line 655 "util/configparser.y"
     {
 		OUTYY(("P(server_msg_buffer_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2805,9 +2876,9 @@ yyreduce:
 	}
     break;
 
-  case 182:
+  case 193:
 /* Line 1792 of yacc.c  */
-#line 648 "util/configparser.y"
+#line 666 "util/configparser.y"
     {
 		OUTYY(("P(server_msg_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->msg_cache_size))
@@ -2816,9 +2887,9 @@ yyreduce:
 	}
     break;
 
-  case 183:
+  case 194:
 /* Line 1792 of yacc.c  */
-#line 656 "util/configparser.y"
+#line 674 "util/configparser.y"
     {
 		OUTYY(("P(server_msg_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2832,9 +2903,9 @@ yyreduce:
 	}
     break;
 
-  case 184:
+  case 195:
 /* Line 1792 of yacc.c  */
-#line 669 "util/configparser.y"
+#line 687 "util/configparser.y"
     {
 		OUTYY(("P(server_num_queries_per_thread:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2844,9 +2915,9 @@ yyreduce:
 	}
     break;
 
-  case 185:
+  case 196:
 /* Line 1792 of yacc.c  */
-#line 678 "util/configparser.y"
+#line 696 "util/configparser.y"
     {
 		OUTYY(("P(server_jostle_timeout:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2856,9 +2927,9 @@ yyreduce:
 	}
     break;
 
-  case 186:
+  case 197:
 /* Line 1792 of yacc.c  */
-#line 687 "util/configparser.y"
+#line 705 "util/configparser.y"
     {
 		OUTYY(("P(server_delay_close:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2868,9 +2939,9 @@ yyreduce:
 	}
     break;
 
-  case 187:
+  case 198:
 /* Line 1792 of yacc.c  */
-#line 696 "util/configparser.y"
+#line 714 "util/configparser.y"
     {
 		OUTYY(("P(server_unblock_lan_zones:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2881,9 +2952,9 @@ yyreduce:
 	}
     break;
 
-  case 188:
+  case 199:
 /* Line 1792 of yacc.c  */
-#line 706 "util/configparser.y"
+#line 724 "util/configparser.y"
     {
 		OUTYY(("P(server_rrset_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->rrset_cache_size))
@@ -2892,9 +2963,9 @@ yyreduce:
 	}
     break;
 
-  case 189:
+  case 200:
 /* Line 1792 of yacc.c  */
-#line 714 "util/configparser.y"
+#line 732 "util/configparser.y"
     {
 		OUTYY(("P(server_rrset_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2908,9 +2979,9 @@ yyreduce:
 	}
     break;
 
-  case 190:
+  case 201:
 /* Line 1792 of yacc.c  */
-#line 727 "util/configparser.y"
+#line 745 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_host_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2920,9 +2991,9 @@ yyreduce:
 	}
     break;
 
-  case 191:
+  case 202:
 /* Line 1792 of yacc.c  */
-#line 736 "util/configparser.y"
+#line 754 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_lame_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		verbose(VERB_DETAIL, "ignored infra-lame-ttl: %s (option "
@@ -2931,9 +3002,9 @@ yyreduce:
 	}
     break;
 
-  case 192:
+  case 203:
 /* Line 1792 of yacc.c  */
-#line 744 "util/configparser.y"
+#line 762 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_numhosts:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2943,9 +3014,9 @@ yyreduce:
 	}
     break;
 
-  case 193:
+  case 204:
 /* Line 1792 of yacc.c  */
-#line 753 "util/configparser.y"
+#line 771 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_lame_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		verbose(VERB_DETAIL, "ignored infra-cache-lame-size: %s "
@@ -2954,9 +3025,9 @@ yyreduce:
 	}
     break;
 
-  case 194:
+  case 205:
 /* Line 1792 of yacc.c  */
-#line 761 "util/configparser.y"
+#line 779 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2970,9 +3041,9 @@ yyreduce:
 	}
     break;
 
-  case 195:
+  case 206:
 /* Line 1792 of yacc.c  */
-#line 774 "util/configparser.y"
+#line 792 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2982,9 +3053,9 @@ yyreduce:
 	}
     break;
 
-  case 196:
+  case 207:
 /* Line 1792 of yacc.c  */
-#line 783 "util/configparser.y"
+#line 801 "util/configparser.y"
     {
 		OUTYY(("P(server_target_fetch_policy:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->target_fetch_policy);
@@ -2992,9 +3063,9 @@ yyreduce:
 	}
     break;
 
-  case 197:
+  case 208:
 /* Line 1792 of yacc.c  */
-#line 790 "util/configparser.y"
+#line 808 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_short_bufsize:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3005,9 +3076,9 @@ yyreduce:
 	}
     break;
 
-  case 198:
+  case 209:
 /* Line 1792 of yacc.c  */
-#line 800 "util/configparser.y"
+#line 818 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_large_queries:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3018,9 +3089,9 @@ yyreduce:
 	}
     break;
 
-  case 199:
+  case 210:
 /* Line 1792 of yacc.c  */
-#line 810 "util/configparser.y"
+#line 828 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_glue:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3031,9 +3102,9 @@ yyreduce:
 	}
     break;
 
-  case 200:
+  case 211:
 /* Line 1792 of yacc.c  */
-#line 820 "util/configparser.y"
+#line 838 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_dnssec_stripped:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3044,9 +3115,9 @@ yyreduce:
 	}
     break;
 
-  case 201:
+  case 212:
 /* Line 1792 of yacc.c  */
-#line 830 "util/configparser.y"
+#line 848 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_below_nxdomain:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3057,9 +3128,9 @@ yyreduce:
 	}
     break;
 
-  case 202:
+  case 213:
 /* Line 1792 of yacc.c  */
-#line 840 "util/configparser.y"
+#line 858 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_referral_path:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3070,9 +3141,22 @@ yyreduce:
 	}
     break;
 
-  case 203:
+  case 214:
 /* Line 1792 of yacc.c  */
-#line 850 "util/configparser.y"
+#line 868 "util/configparser.y"
+    {
+		OUTYY(("P(server_harden_algo_downgrade:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->harden_algo_downgrade = 
+			(strcmp((yyvsp[(2) - (2)].str), "yes")==0);
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 215:
+/* Line 1792 of yacc.c  */
+#line 878 "util/configparser.y"
     {
 		OUTYY(("P(server_use_caps_for_id:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3083,9 +3167,19 @@ yyreduce:
 	}
     break;
 
-  case 204:
+  case 216:
 /* Line 1792 of yacc.c  */
-#line 860 "util/configparser.y"
+#line 888 "util/configparser.y"
+    {
+		OUTYY(("P(server_caps_whitelist:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, (yyvsp[(2) - (2)].str)))
+			yyerror("out of memory");
+	}
+    break;
+
+  case 217:
+/* Line 1792 of yacc.c  */
+#line 895 "util/configparser.y"
     {
 		OUTYY(("P(server_private_address:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_address, (yyvsp[(2) - (2)].str)))
@@ -3093,9 +3187,9 @@ yyreduce:
 	}
     break;
 
-  case 205:
+  case 218:
 /* Line 1792 of yacc.c  */
-#line 867 "util/configparser.y"
+#line 902 "util/configparser.y"
     {
 		OUTYY(("P(server_private_domain:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_domain, (yyvsp[(2) - (2)].str)))
@@ -3103,9 +3197,9 @@ yyreduce:
 	}
     break;
 
-  case 206:
+  case 219:
 /* Line 1792 of yacc.c  */
-#line 874 "util/configparser.y"
+#line 909 "util/configparser.y"
     {
 		OUTYY(("P(server_prefetch:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3115,9 +3209,9 @@ yyreduce:
 	}
     break;
 
-  case 207:
+  case 220:
 /* Line 1792 of yacc.c  */
-#line 883 "util/configparser.y"
+#line 918 "util/configparser.y"
     {
 		OUTYY(("P(server_prefetch_key:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3127,9 +3221,9 @@ yyreduce:
 	}
     break;
 
-  case 208:
+  case 221:
 /* Line 1792 of yacc.c  */
-#line 892 "util/configparser.y"
+#line 927 "util/configparser.y"
     {
 		OUTYY(("P(server_unwanted_reply_threshold:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3139,9 +3233,9 @@ yyreduce:
 	}
     break;
 
-  case 209:
+  case 222:
 /* Line 1792 of yacc.c  */
-#line 901 "util/configparser.y"
+#line 936 "util/configparser.y"
     {
 		OUTYY(("P(server_do_not_query_address:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->donotqueryaddrs, (yyvsp[(2) - (2)].str)))
@@ -3149,9 +3243,9 @@ yyreduce:
 	}
     break;
 
-  case 210:
+  case 223:
 /* Line 1792 of yacc.c  */
-#line 908 "util/configparser.y"
+#line 943 "util/configparser.y"
     {
 		OUTYY(("P(server_do_not_query_localhost:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3162,9 +3256,9 @@ yyreduce:
 	}
     break;
 
-  case 211:
+  case 224:
 /* Line 1792 of yacc.c  */
-#line 918 "util/configparser.y"
+#line 953 "util/configparser.y"
     {
 		OUTYY(("P(server_access_control:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)));
 		if(strcmp((yyvsp[(3) - (3)].str), "deny")!=0 && strcmp((yyvsp[(3) - (3)].str), "refuse")!=0 &&
@@ -3182,9 +3276,9 @@ yyreduce:
 	}
     break;
 
-  case 212:
+  case 225:
 /* Line 1792 of yacc.c  */
-#line 935 "util/configparser.y"
+#line 970 "util/configparser.y"
     {
 		OUTYY(("P(server_module_conf:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->module_conf);
@@ -3192,9 +3286,9 @@ yyreduce:
 	}
     break;
 
-  case 213:
+  case 226:
 /* Line 1792 of yacc.c  */
-#line 942 "util/configparser.y"
+#line 977 "util/configparser.y"
     {
 		OUTYY(("P(server_val_override_date:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strlen((yyvsp[(2) - (2)].str)) == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0) {
@@ -3213,9 +3307,9 @@ yyreduce:
 	}
     break;
 
-  case 214:
+  case 227:
 /* Line 1792 of yacc.c  */
-#line 960 "util/configparser.y"
+#line 995 "util/configparser.y"
     {
 		OUTYY(("P(server_val_sig_skew_min:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strlen((yyvsp[(2) - (2)].str)) == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0) {
@@ -3229,9 +3323,9 @@ yyreduce:
 	}
     break;
 
-  case 215:
+  case 228:
 /* Line 1792 of yacc.c  */
-#line 973 "util/configparser.y"
+#line 1008 "util/configparser.y"
     {
 		OUTYY(("P(server_val_sig_skew_max:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strlen((yyvsp[(2) - (2)].str)) == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0) {
@@ -3245,9 +3339,9 @@ yyreduce:
 	}
     break;
 
-  case 216:
+  case 229:
 /* Line 1792 of yacc.c  */
-#line 986 "util/configparser.y"
+#line 1021 "util/configparser.y"
     {
 		OUTYY(("P(server_cache_max_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3257,9 +3351,21 @@ yyreduce:
 	}
     break;
 
-  case 217:
+  case 230:
 /* Line 1792 of yacc.c  */
-#line 995 "util/configparser.y"
+#line 1030 "util/configparser.y"
+    {
+		OUTYY(("P(server_cache_max_negative_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->max_negative_ttl = atoi((yyvsp[(2) - (2)].str));
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 231:
+/* Line 1792 of yacc.c  */
+#line 1039 "util/configparser.y"
     {
 		OUTYY(("P(server_cache_min_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3269,9 +3375,9 @@ yyreduce:
 	}
     break;
 
-  case 218:
+  case 232:
 /* Line 1792 of yacc.c  */
-#line 1004 "util/configparser.y"
+#line 1048 "util/configparser.y"
     {
 		OUTYY(("P(server_bogus_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3281,9 +3387,9 @@ yyreduce:
 	}
     break;
 
-  case 219:
+  case 233:
 /* Line 1792 of yacc.c  */
-#line 1013 "util/configparser.y"
+#line 1057 "util/configparser.y"
     {
 		OUTYY(("P(server_val_clean_additional:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3294,9 +3400,9 @@ yyreduce:
 	}
     break;
 
-  case 220:
+  case 234:
 /* Line 1792 of yacc.c  */
-#line 1023 "util/configparser.y"
+#line 1067 "util/configparser.y"
     {
 		OUTYY(("P(server_val_permissive_mode:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3307,9 +3413,9 @@ yyreduce:
 	}
     break;
 
-  case 221:
+  case 235:
 /* Line 1792 of yacc.c  */
-#line 1033 "util/configparser.y"
+#line 1077 "util/configparser.y"
     {
 		OUTYY(("P(server_ignore_cd_flag:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3319,9 +3425,9 @@ yyreduce:
 	}
     break;
 
-  case 222:
+  case 236:
 /* Line 1792 of yacc.c  */
-#line 1042 "util/configparser.y"
+#line 1086 "util/configparser.y"
     {
 		OUTYY(("P(server_val_log_level:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3331,9 +3437,9 @@ yyreduce:
 	}
     break;
 
-  case 223:
+  case 237:
 /* Line 1792 of yacc.c  */
-#line 1051 "util/configparser.y"
+#line 1095 "util/configparser.y"
     {
 		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->val_nsec3_key_iterations);
@@ -3341,9 +3447,9 @@ yyreduce:
 	}
     break;
 
-  case 224:
+  case 238:
 /* Line 1792 of yacc.c  */
-#line 1058 "util/configparser.y"
+#line 1102 "util/configparser.y"
     {
 		OUTYY(("P(server_add_holddown:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3353,9 +3459,9 @@ yyreduce:
 	}
     break;
 
-  case 225:
+  case 239:
 /* Line 1792 of yacc.c  */
-#line 1067 "util/configparser.y"
+#line 1111 "util/configparser.y"
     {
 		OUTYY(("P(server_del_holddown:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3365,9 +3471,9 @@ yyreduce:
 	}
     break;
 
-  case 226:
+  case 240:
 /* Line 1792 of yacc.c  */
-#line 1076 "util/configparser.y"
+#line 1120 "util/configparser.y"
     {
 		OUTYY(("P(server_keep_missing:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3377,9 +3483,9 @@ yyreduce:
 	}
     break;
 
-  case 227:
+  case 241:
 /* Line 1792 of yacc.c  */
-#line 1085 "util/configparser.y"
+#line 1129 "util/configparser.y"
     {
 		OUTYY(("P(server_key_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->key_cache_size))
@@ -3388,9 +3494,9 @@ yyreduce:
 	}
     break;
 
-  case 228:
+  case 242:
 /* Line 1792 of yacc.c  */
-#line 1093 "util/configparser.y"
+#line 1137 "util/configparser.y"
     {
 		OUTYY(("P(server_key_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -3404,9 +3510,9 @@ yyreduce:
 	}
     break;
 
-  case 229:
+  case 243:
 /* Line 1792 of yacc.c  */
-#line 1106 "util/configparser.y"
+#line 1150 "util/configparser.y"
     {
 		OUTYY(("P(server_neg_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->neg_cache_size))
@@ -3415,19 +3521,20 @@ yyreduce:
 	}
     break;
 
-  case 230:
+  case 244:
 /* Line 1792 of yacc.c  */
-#line 1114 "util/configparser.y"
+#line 1158 "util/configparser.y"
     {
 		OUTYY(("P(server_local_zone:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)));
 		if(strcmp((yyvsp[(3) - (3)].str), "static")!=0 && strcmp((yyvsp[(3) - (3)].str), "deny")!=0 &&
 		   strcmp((yyvsp[(3) - (3)].str), "refuse")!=0 && strcmp((yyvsp[(3) - (3)].str), "redirect")!=0 &&
 		   strcmp((yyvsp[(3) - (3)].str), "transparent")!=0 && strcmp((yyvsp[(3) - (3)].str), "nodefault")!=0
 		   && strcmp((yyvsp[(3) - (3)].str), "typetransparent")!=0 &&
-		   strcmp((yyvsp[(3) - (3)].str), "inform")!=0)
+		   strcmp((yyvsp[(3) - (3)].str), "inform")!=0 && strcmp((yyvsp[(3) - (3)].str), "inform_deny")!=0)
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
-				"typetransparent, inform or nodefault");
+				"typetransparent, inform, inform_deny "
+				"or nodefault");
 		else if(strcmp((yyvsp[(3) - (3)].str), "nodefault")==0) {
 			if(!cfg_strlist_insert(&cfg_parser->cfg->
 				local_zones_nodefault, (yyvsp[(2) - (3)].str)))
@@ -3441,9 +3548,9 @@ yyreduce:
 	}
     break;
 
-  case 231:
+  case 245:
 /* Line 1792 of yacc.c  */
-#line 1137 "util/configparser.y"
+#line 1182 "util/configparser.y"
     {
 		OUTYY(("P(server_local_data:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[(2) - (2)].str)))
@@ -3451,9 +3558,9 @@ yyreduce:
 	}
     break;
 
-  case 232:
+  case 246:
 /* Line 1792 of yacc.c  */
-#line 1144 "util/configparser.y"
+#line 1189 "util/configparser.y"
     {
 		char* ptr;
 		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[(2) - (2)].str)));
@@ -3469,9 +3576,9 @@ yyreduce:
 	}
     break;
 
-  case 233:
+  case 247:
 /* Line 1792 of yacc.c  */
-#line 1159 "util/configparser.y"
+#line 1204 "util/configparser.y"
     {
 		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3482,9 +3589,9 @@ yyreduce:
 	}
     break;
 
-  case 234:
+  case 248:
 /* Line 1792 of yacc.c  */
-#line 1169 "util/configparser.y"
+#line 1214 "util/configparser.y"
     {
 		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3495,9 +3602,9 @@ yyreduce:
 	}
     break;
 
-  case 235:
+  case 249:
 /* Line 1792 of yacc.c  */
-#line 1179 "util/configparser.y"
+#line 1224 "util/configparser.y"
     {
 		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		cfg_parser->cfg->max_udp_size = atoi((yyvsp[(2) - (2)].str));
@@ -3505,9 +3612,9 @@ yyreduce:
 	}
     break;
 
-  case 236:
+  case 250:
 /* Line 1792 of yacc.c  */
-#line 1186 "util/configparser.y"
+#line 1231 "util/configparser.y"
     {
 		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dns64_prefix);
@@ -3515,9 +3622,9 @@ yyreduce:
 	}
     break;
 
-  case 237:
+  case 251:
 /* Line 1792 of yacc.c  */
-#line 1193 "util/configparser.y"
+#line 1238 "util/configparser.y"
     {
 		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3527,9 +3634,92 @@ yyreduce:
 	}
     break;
 
-  case 238:
+  case 252:
 /* Line 1792 of yacc.c  */
-#line 1202 "util/configparser.y"
+#line 1247 "util/configparser.y"
+    { 
+		OUTYY(("P(server_ratelimit:%s)\n", (yyvsp[(2) - (2)].str))); 
+		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->ratelimit = atoi((yyvsp[(2) - (2)].str));
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 253:
+/* Line 1792 of yacc.c  */
+#line 1256 "util/configparser.y"
+    {
+		OUTYY(("P(server_ratelimit_size:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->ratelimit_size))
+			yyerror("memory size expected");
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 254:
+/* Line 1792 of yacc.c  */
+#line 1264 "util/configparser.y"
+    {
+		OUTYY(("P(server_ratelimit_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(atoi((yyvsp[(2) - (2)].str)) == 0)
+			yyerror("number expected");
+		else {
+			cfg_parser->cfg->ratelimit_slabs = atoi((yyvsp[(2) - (2)].str));
+			if(!is_pow2(cfg_parser->cfg->ratelimit_slabs))
+				yyerror("must be a power of 2");
+		}
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 255:
+/* Line 1792 of yacc.c  */
+#line 1277 "util/configparser.y"
+    {
+		OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)));
+		if(atoi((yyvsp[(3) - (3)].str)) == 0 && strcmp((yyvsp[(3) - (3)].str), "0") != 0) {
+			yyerror("number expected");
+		} else {
+			if(!cfg_str2list_insert(&cfg_parser->cfg->
+				ratelimit_for_domain, (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)))
+				fatal_exit("out of memory adding "
+					"ratelimit-for-domain");
+		}
+	}
+    break;
+
+  case 256:
+/* Line 1792 of yacc.c  */
+#line 1290 "util/configparser.y"
+    {
+		OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)));
+		if(atoi((yyvsp[(3) - (3)].str)) == 0 && strcmp((yyvsp[(3) - (3)].str), "0") != 0) {
+			yyerror("number expected");
+		} else {
+			if(!cfg_str2list_insert(&cfg_parser->cfg->
+				ratelimit_below_domain, (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)))
+				fatal_exit("out of memory adding "
+					"ratelimit-below-domain");
+		}
+	}
+    break;
+
+  case 257:
+/* Line 1792 of yacc.c  */
+#line 1303 "util/configparser.y"
+    { 
+		OUTYY(("P(server_ratelimit_factor:%s)\n", (yyvsp[(2) - (2)].str))); 
+		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->ratelimit_factor = atoi((yyvsp[(2) - (2)].str));
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 258:
+/* Line 1792 of yacc.c  */
+#line 1312 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->stubs->name)
@@ -3540,9 +3730,9 @@ yyreduce:
 	}
     break;
 
-  case 239:
+  case 259:
 /* Line 1792 of yacc.c  */
-#line 1212 "util/configparser.y"
+#line 1322 "util/configparser.y"
     {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[(2) - (2)].str)))
@@ -3550,9 +3740,9 @@ yyreduce:
 	}
     break;
 
-  case 240:
+  case 260:
 /* Line 1792 of yacc.c  */
-#line 1219 "util/configparser.y"
+#line 1329 "util/configparser.y"
     {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[(2) - (2)].str)))
@@ -3560,9 +3750,9 @@ yyreduce:
 	}
     break;
 
-  case 241:
+  case 261:
 /* Line 1792 of yacc.c  */
-#line 1226 "util/configparser.y"
+#line 1336 "util/configparser.y"
     {
 		OUTYY(("P(stub-first:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3572,9 +3762,9 @@ yyreduce:
 	}
     break;
 
-  case 242:
+  case 262:
 /* Line 1792 of yacc.c  */
-#line 1235 "util/configparser.y"
+#line 1345 "util/configparser.y"
     {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3585,9 +3775,9 @@ yyreduce:
 	}
     break;
 
-  case 243:
+  case 263:
 /* Line 1792 of yacc.c  */
-#line 1245 "util/configparser.y"
+#line 1355 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->forwards->name)
@@ -3598,9 +3788,9 @@ yyreduce:
 	}
     break;
 
-  case 244:
+  case 264:
 /* Line 1792 of yacc.c  */
-#line 1255 "util/configparser.y"
+#line 1365 "util/configparser.y"
     {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[(2) - (2)].str)))
@@ -3608,9 +3798,9 @@ yyreduce:
 	}
     break;
 
-  case 245:
+  case 265:
 /* Line 1792 of yacc.c  */
-#line 1262 "util/configparser.y"
+#line 1372 "util/configparser.y"
     {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[(2) - (2)].str)))
@@ -3618,9 +3808,9 @@ yyreduce:
 	}
     break;
 
-  case 246:
+  case 266:
 /* Line 1792 of yacc.c  */
-#line 1269 "util/configparser.y"
+#line 1379 "util/configparser.y"
     {
 		OUTYY(("P(forward-first:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3630,17 +3820,17 @@ yyreduce:
 	}
     break;
 
-  case 247:
+  case 267:
 /* Line 1792 of yacc.c  */
-#line 1278 "util/configparser.y"
+#line 1388 "util/configparser.y"
     { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
     break;
 
-  case 258:
+  case 278:
 /* Line 1792 of yacc.c  */
-#line 1289 "util/configparser.y"
+#line 1399 "util/configparser.y"
     {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3651,9 +3841,9 @@ yyreduce:
 	}
     break;
 
-  case 259:
+  case 279:
 /* Line 1792 of yacc.c  */
-#line 1299 "util/configparser.y"
+#line 1409 "util/configparser.y"
     {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -3663,9 +3853,9 @@ yyreduce:
 	}
     break;
 
-  case 260:
+  case 280:
 /* Line 1792 of yacc.c  */
-#line 1308 "util/configparser.y"
+#line 1418 "util/configparser.y"
     {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->control_ifs, (yyvsp[(2) - (2)].str)))
@@ -3673,9 +3863,9 @@ yyreduce:
 	}
     break;
 
-  case 261:
+  case 281:
 /* Line 1792 of yacc.c  */
-#line 1315 "util/configparser.y"
+#line 1425 "util/configparser.y"
     {
 		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3686,9 +3876,9 @@ yyreduce:
 	}
     break;
 
-  case 262:
+  case 282:
 /* Line 1792 of yacc.c  */
-#line 1325 "util/configparser.y"
+#line 1435 "util/configparser.y"
     {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->server_key_file);
@@ -3696,9 +3886,9 @@ yyreduce:
 	}
     break;
 
-  case 263:
+  case 283:
 /* Line 1792 of yacc.c  */
-#line 1332 "util/configparser.y"
+#line 1442 "util/configparser.y"
     {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->server_cert_file);
@@ -3706,9 +3896,9 @@ yyreduce:
 	}
     break;
 
-  case 264:
+  case 284:
 /* Line 1792 of yacc.c  */
-#line 1339 "util/configparser.y"
+#line 1449 "util/configparser.y"
     {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->control_key_file);
@@ -3716,9 +3906,9 @@ yyreduce:
 	}
     break;
 
-  case 265:
+  case 285:
 /* Line 1792 of yacc.c  */
-#line 1346 "util/configparser.y"
+#line 1456 "util/configparser.y"
     {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->control_cert_file);
@@ -3726,17 +3916,17 @@ yyreduce:
 	}
     break;
 
-  case 266:
+  case 286:
 /* Line 1792 of yacc.c  */
-#line 1353 "util/configparser.y"
+#line 1463 "util/configparser.y"
     {
 		OUTYY(("\nP(dnstap:)\n"));
 	}
     break;
 
-  case 281:
+  case 301:
 /* Line 1792 of yacc.c  */
-#line 1370 "util/configparser.y"
+#line 1480 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3745,9 +3935,9 @@ yyreduce:
 	}
     break;
 
-  case 282:
+  case 302:
 /* Line 1792 of yacc.c  */
-#line 1378 "util/configparser.y"
+#line 1488 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dnstap_socket_path);
@@ -3755,9 +3945,9 @@ yyreduce:
 	}
     break;
 
-  case 283:
+  case 303:
 /* Line 1792 of yacc.c  */
-#line 1385 "util/configparser.y"
+#line 1495 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3766,9 +3956,9 @@ yyreduce:
 	}
     break;
 
-  case 284:
+  case 304:
 /* Line 1792 of yacc.c  */
-#line 1393 "util/configparser.y"
+#line 1503 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3777,9 +3967,9 @@ yyreduce:
 	}
     break;
 
-  case 285:
+  case 305:
 /* Line 1792 of yacc.c  */
-#line 1401 "util/configparser.y"
+#line 1511 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dnstap_identity);
@@ -3787,9 +3977,9 @@ yyreduce:
 	}
     break;
 
-  case 286:
+  case 306:
 /* Line 1792 of yacc.c  */
-#line 1408 "util/configparser.y"
+#line 1518 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dnstap_version);
@@ -3797,9 +3987,9 @@ yyreduce:
 	}
     break;
 
-  case 287:
+  case 307:
 /* Line 1792 of yacc.c  */
-#line 1415 "util/configparser.y"
+#line 1525 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3809,9 +3999,9 @@ yyreduce:
 	}
     break;
 
-  case 288:
+  case 308:
 /* Line 1792 of yacc.c  */
-#line 1424 "util/configparser.y"
+#line 1534 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3821,9 +4011,9 @@ yyreduce:
 	}
     break;
 
-  case 289:
+  case 309:
 /* Line 1792 of yacc.c  */
-#line 1433 "util/configparser.y"
+#line 1543 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3833,9 +4023,9 @@ yyreduce:
 	}
     break;
 
-  case 290:
+  case 310:
 /* Line 1792 of yacc.c  */
-#line 1442 "util/configparser.y"
+#line 1552 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3845,9 +4035,9 @@ yyreduce:
 	}
     break;
 
-  case 291:
+  case 311:
 /* Line 1792 of yacc.c  */
-#line 1451 "util/configparser.y"
+#line 1561 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3857,9 +4047,9 @@ yyreduce:
 	}
     break;
 
-  case 292:
+  case 312:
 /* Line 1792 of yacc.c  */
-#line 1460 "util/configparser.y"
+#line 1570 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3869,17 +4059,17 @@ yyreduce:
 	}
     break;
 
-  case 293:
+  case 313:
 /* Line 1792 of yacc.c  */
-#line 1469 "util/configparser.y"
+#line 1579 "util/configparser.y"
     { 
 		OUTYY(("\nP(python:)\n")); 
 	}
     break;
 
-  case 297:
+  case 317:
 /* Line 1792 of yacc.c  */
-#line 1478 "util/configparser.y"
+#line 1588 "util/configparser.y"
     {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->python_script);
@@ -3889,7 +4079,7 @@ yyreduce:
 
 
 /* Line 1792 of yacc.c  */
-#line 3893 "util/configparser.c"
+#line 4083 "util/configparser.c"
       default: break;
     }
   /* User semantic actions sometimes alter yychar, and that requires
@@ -4121,7 +4311,7 @@ yyreturn:
 
 
 /* Line 2055 of yacc.c  */
-#line 1483 "util/configparser.y"
+#line 1593 "util/configparser.y"
 
 
 /* parse helper routines could be here */
diff --git a/util/configparser.h b/util/configparser.h
index 95b6f640e402..cd62350858ef 100644
--- a/util/configparser.h
+++ b/util/configparser.h
@@ -193,7 +193,17 @@ extern int yydebug;
      VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 402,
      VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 403,
      VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 404,
-     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405
+     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405,
+     VAR_HARDEN_ALGO_DOWNGRADE = 406,
+     VAR_IP_TRANSPARENT = 407,
+     VAR_RATELIMIT = 408,
+     VAR_RATELIMIT_SLABS = 409,
+     VAR_RATELIMIT_SIZE = 410,
+     VAR_RATELIMIT_FOR_DOMAIN = 411,
+     VAR_RATELIMIT_BELOW_DOMAIN = 412,
+     VAR_RATELIMIT_FACTOR = 413,
+     VAR_CAPS_WHITELIST = 414,
+     VAR_CACHE_MAX_NEGATIVE_TTL = 415
    };
 #endif
 /* Tokens.  */
@@ -345,6 +355,16 @@ extern int yydebug;
 #define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 403
 #define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 404
 #define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 405
+#define VAR_HARDEN_ALGO_DOWNGRADE 406
+#define VAR_IP_TRANSPARENT 407
+#define VAR_RATELIMIT 408
+#define VAR_RATELIMIT_SLABS 409
+#define VAR_RATELIMIT_SIZE 410
+#define VAR_RATELIMIT_FOR_DOMAIN 411
+#define VAR_RATELIMIT_BELOW_DOMAIN 412
+#define VAR_RATELIMIT_FACTOR 413
+#define VAR_CAPS_WHITELIST 414
+#define VAR_CACHE_MAX_NEGATIVE_TTL 415
 
 
 
@@ -358,7 +378,7 @@ typedef union YYSTYPE
 
 
 /* Line 2058 of yacc.c  */
-#line 362 "util/configparser.h"
+#line 382 "util/configparser.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
diff --git a/util/configparser.y b/util/configparser.y
index 396ea3c64d64..ad7f3d292cc8 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -118,6 +118,10 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES
 %token VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES
 %token VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES
+%token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
+%token VAR_RATELIMIT VAR_RATELIMIT_SLABS VAR_RATELIMIT_SIZE
+%token VAR_RATELIMIT_FOR_DOMAIN VAR_RATELIMIT_BELOW_DOMAIN VAR_RATELIMIT_FACTOR
+%token VAR_CAPS_WHITELIST VAR_CACHE_MAX_NEGATIVE_TTL
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -177,7 +181,11 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_minimal_responses | server_rrset_roundrobin | server_max_udp_size |
 	server_so_reuseport | server_delay_close | server_unblock_lan_zones |
 	server_dns64_prefix | server_dns64_synthall |
-	server_infra_cache_min_rtt
+	server_infra_cache_min_rtt | server_harden_algo_downgrade |
+	server_ip_transparent | server_ratelimit | server_ratelimit_slabs |
+	server_ratelimit_size | server_ratelimit_for_domain |
+	server_ratelimit_below_domain | server_ratelimit_factor |
+	server_caps_whitelist | server_cache_max_negative_ttl
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -620,6 +628,16 @@ server_so_reuseport: VAR_SO_REUSEPORT STRING_ARG
         free($2);
     }
     ;
+server_ip_transparent: VAR_IP_TRANSPARENT STRING_ARG
+    {
+        OUTYY(("P(server_ip_transparent:%s)\n", $2));
+        if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+            yyerror("expected yes or no.");
+        else cfg_parser->cfg->ip_transparent =
+            (strcmp($2, "yes")==0);
+        free($2);
+    }
+    ;
 server_edns_buffer_size: VAR_EDNS_BUFFER_SIZE STRING_ARG
 	{
 		OUTYY(("P(server_edns_buffer_size:%s)\n", $2));
@@ -846,6 +864,16 @@ server_harden_referral_path: VAR_HARDEN_REFERRAL_PATH STRING_ARG
 		free($2);
 	}
 	;
+server_harden_algo_downgrade: VAR_HARDEN_ALGO_DOWNGRADE STRING_ARG
+	{
+		OUTYY(("P(server_harden_algo_downgrade:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->harden_algo_downgrade = 
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG
 	{
 		OUTYY(("P(server_use_caps_for_id:%s)\n", $2));
@@ -856,6 +884,13 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG
 		free($2);
 	}
 	;
+server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
+	{
+		OUTYY(("P(server_caps_whitelist:%s)\n", $2));
+		if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, $2))
+			yyerror("out of memory");
+	}
+	;
 server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
 	{
 		OUTYY(("P(server_private_address:%s)\n", $2));
@@ -991,6 +1026,15 @@ server_cache_max_ttl: VAR_CACHE_MAX_TTL STRING_ARG
 		free($2);
 	}
 	;
+server_cache_max_negative_ttl: VAR_CACHE_MAX_NEGATIVE_TTL STRING_ARG
+	{
+		OUTYY(("P(server_cache_max_negative_ttl:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->max_negative_ttl = atoi($2);
+		free($2);
+	}
+	;
 server_cache_min_ttl: VAR_CACHE_MIN_TTL STRING_ARG
 	{
 		OUTYY(("P(server_cache_min_ttl:%s)\n", $2));
@@ -1117,10 +1161,11 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 		   strcmp($3, "refuse")!=0 && strcmp($3, "redirect")!=0 &&
 		   strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
 		   && strcmp($3, "typetransparent")!=0 &&
-		   strcmp($3, "inform")!=0)
+		   strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0)
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
-				"typetransparent, inform or nodefault");
+				"typetransparent, inform, inform_deny "
+				"or nodefault");
 		else if(strcmp($3, "nodefault")==0) {
 			if(!cfg_strlist_insert(&cfg_parser->cfg->
 				local_zones_nodefault, $2))
@@ -1198,6 +1243,71 @@ server_dns64_synthall: VAR_DNS64_SYNTHALL STRING_ARG
 		free($2);
 	}
 	;
+server_ratelimit: VAR_RATELIMIT STRING_ARG 
+	{ 
+		OUTYY(("P(server_ratelimit:%s)\n", $2)); 
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->ratelimit = atoi($2);
+		free($2);
+	}
+	;
+server_ratelimit_size: VAR_RATELIMIT_SIZE STRING_ARG
+	{
+		OUTYY(("P(server_ratelimit_size:%s)\n", $2));
+		if(!cfg_parse_memsize($2, &cfg_parser->cfg->ratelimit_size))
+			yyerror("memory size expected");
+		free($2);
+	}
+	;
+server_ratelimit_slabs: VAR_RATELIMIT_SLABS STRING_ARG
+	{
+		OUTYY(("P(server_ratelimit_slabs:%s)\n", $2));
+		if(atoi($2) == 0)
+			yyerror("number expected");
+		else {
+			cfg_parser->cfg->ratelimit_slabs = atoi($2);
+			if(!is_pow2(cfg_parser->cfg->ratelimit_slabs))
+				yyerror("must be a power of 2");
+		}
+		free($2);
+	}
+	;
+server_ratelimit_for_domain: VAR_RATELIMIT_FOR_DOMAIN STRING_ARG STRING_ARG
+	{
+		OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", $2, $3));
+		if(atoi($3) == 0 && strcmp($3, "0") != 0) {
+			yyerror("number expected");
+		} else {
+			if(!cfg_str2list_insert(&cfg_parser->cfg->
+				ratelimit_for_domain, $2, $3))
+				fatal_exit("out of memory adding "
+					"ratelimit-for-domain");
+		}
+	}
+	;
+server_ratelimit_below_domain: VAR_RATELIMIT_BELOW_DOMAIN STRING_ARG STRING_ARG
+	{
+		OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", $2, $3));
+		if(atoi($3) == 0 && strcmp($3, "0") != 0) {
+			yyerror("number expected");
+		} else {
+			if(!cfg_str2list_insert(&cfg_parser->cfg->
+				ratelimit_below_domain, $2, $3))
+				fatal_exit("out of memory adding "
+					"ratelimit-below-domain");
+		}
+	}
+	;
+server_ratelimit_factor: VAR_RATELIMIT_FACTOR STRING_ARG 
+	{ 
+		OUTYY(("P(server_ratelimit_factor:%s)\n", $2)); 
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->ratelimit_factor = atoi($2);
+		free($2);
+	}
+	;
 stub_name: VAR_NAME STRING_ARG
 	{
 		OUTYY(("P(name:%s)\n", $2));
diff --git a/util/data/dname.c b/util/data/dname.c
index d43bbf6d2407..79bf52ad4728 100644
--- a/util/data/dname.c
+++ b/util/data/dname.c
@@ -45,7 +45,7 @@
 #include "util/data/msgparse.h"
 #include "util/log.h"
 #include "util/storage/lookup3.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /* determine length of a dname in buffer, no compression pointers allowed */
 size_t
diff --git a/util/data/msgencode.c b/util/data/msgencode.c
index 26b5deabe4dc..f9a8c5f67296 100644
--- a/util/data/msgencode.c
+++ b/util/data/msgencode.c
@@ -47,7 +47,7 @@
 #include "util/log.h"
 #include "util/regional.h"
 #include "util/net_help.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** return code that means the function ran out of memory. negative so it does
  * not conflict with DNS rcodes. */
diff --git a/util/data/msgparse.c b/util/data/msgparse.c
index abe778a89fb6..108c9dacb39b 100644
--- a/util/data/msgparse.c
+++ b/util/data/msgparse.c
@@ -42,10 +42,10 @@
 #include "util/data/packed_rrset.h"
 #include "util/storage/lookup3.h"
 #include "util/regional.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
 
 /** smart comparison of (compressed, valid) dnames from packet */
 static int
diff --git a/util/data/msgparse.h b/util/data/msgparse.h
index 221a45aadd7b..44497c8ca381 100644
--- a/util/data/msgparse.h
+++ b/util/data/msgparse.h
@@ -63,8 +63,8 @@
 #ifndef UTIL_DATA_MSGPARSE_H
 #define UTIL_DATA_MSGPARSE_H
 #include "util/storage/lruhash.h"
-#include "ldns/pkthdr.h"
-#include "ldns/rrdef.h"
+#include "sldns/pkthdr.h"
+#include "sldns/rrdef.h"
 struct sldns_buffer;
 struct rrset_parse;
 struct rr_parse;
@@ -76,6 +76,8 @@ struct regional;
 extern time_t MAX_TTL;
 /** Minimum TTL that is allowed. */
 extern time_t MIN_TTL;
+/** Maximum Negative TTL that is allowed */
+extern time_t MAX_NEG_TTL;
 /** Negative cache time (for entries without any RRs.) */
 #define NORR_TTL 5 /* seconds */
 
diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index 68bcfd09ee39..06593ffe1b27 100644
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -50,13 +50,15 @@
 #include "util/regional.h"
 #include "util/data/msgparse.h"
 #include "util/data/msgencode.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
 
 /** MAX TTL default for messages and rrsets */
 time_t MAX_TTL = 3600 * 24 * 10; /* ten days */
 /** MIN TTL default for messages and rrsets */
 time_t MIN_TTL = 0;
+/** MAX Negative TTL, for SOA records in authority section */
+time_t MAX_NEG_TTL = 3600; /* one hour */
 
 /** allocate qinfo, return 0 on error */
 static int
@@ -87,6 +89,7 @@ construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
 	/* rrset_count-1 because the first ref is part of the struct. */
 	size_t s = sizeof(struct reply_info) - sizeof(struct rrset_ref) +
 		sizeof(struct ub_packed_rrset_key*) * total;
+	if(total >= RR_COUNT_MAX) return NULL; /* sanity check on numRRS*/
 	if(region)
 		rep = (struct reply_info*)regional_alloc(region, s);
 	else	rep = (struct reply_info*)malloc(s + 
@@ -152,10 +155,23 @@ repinfo_alloc_rrset_keys(struct reply_info* rep, struct alloc_cache* alloc,
 	return 1;
 }
 
+/** find the minimumttl in the rdata of SOA record */
+static time_t
+soa_find_minttl(struct rr_parse* rr)
+{
+	uint16_t rlen = sldns_read_uint16(rr->ttl_data+4);
+	if(rlen < 20)
+		return 0; /* rdata too small for SOA (dname, dname, 5*32bit) */
+	/* minimum TTL is the last 32bit value in the rdata of the record */
+	/* at position ttl_data + 4(ttl) + 2(rdatalen) + rdatalen - 4(timeval)*/
+	return (time_t)sldns_read_uint32(rr->ttl_data+6+rlen-4);
+}
+
 /** do the rdata copy */
 static int
 rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to, 
-	struct rr_parse* rr, time_t* rr_ttl, uint16_t type)
+	struct rr_parse* rr, time_t* rr_ttl, uint16_t type,
+	sldns_pkt_section section)
 {
 	uint16_t pkt_len;
 	const sldns_rr_descriptor* desc;
@@ -164,6 +180,14 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
 	/* RFC 2181 Section 8. if msb of ttl is set treat as if zero. */
 	if(*rr_ttl & 0x80000000U)
 		*rr_ttl = 0;
+	if(type == LDNS_RR_TYPE_SOA && section == LDNS_SECTION_AUTHORITY) {
+		/* negative response. see if TTL of SOA record larger than the
+		 * minimum-ttl in the rdata of the SOA record */
+		if(*rr_ttl > soa_find_minttl(rr))
+			*rr_ttl = soa_find_minttl(rr);
+		if(*rr_ttl > MAX_NEG_TTL)
+			*rr_ttl = MAX_NEG_TTL;
+	}
 	if(*rr_ttl < MIN_TTL)
 		*rr_ttl = MIN_TTL;
 	if(*rr_ttl < data->ttl)
@@ -253,7 +277,7 @@ parse_rr_copy(sldns_buffer* pkt, struct rrset_parse* pset,
 		data->rr_data[i] = nextrdata;
 		nextrdata += rr->size;
 		if(!rdata_copy(pkt, data, data->rr_data[i], rr, 
-			&data->rr_ttl[i], pset->type))
+			&data->rr_ttl[i], pset->type, pset->section))
 			return 0;
 		rr = rr->next;
 	}
@@ -264,7 +288,7 @@ parse_rr_copy(sldns_buffer* pkt, struct rrset_parse* pset,
 		data->rr_data[i] = nextrdata;
 		nextrdata += rr->size;
 		if(!rdata_copy(pkt, data, data->rr_data[i], rr, 
-			&data->rr_ttl[i], LDNS_RR_TYPE_RRSIG))
+			&data->rr_ttl[i], LDNS_RR_TYPE_RRSIG, pset->section))
 			return 0;
 		rr = rr->next;
 	}
@@ -277,7 +301,11 @@ parse_create_rrset(sldns_buffer* pkt, struct rrset_parse* pset,
 	struct packed_rrset_data** data, struct regional* region)
 {
 	/* allocate */
-	size_t s = sizeof(struct packed_rrset_data) + 
+	size_t s;
+	if(pset->rr_count > RR_COUNT_MAX || pset->rrsig_count > RR_COUNT_MAX ||
+		pset->size > RR_COUNT_MAX)
+		return 0; /* protect against integer overflow */
+	s = sizeof(struct packed_rrset_data) + 
 		(pset->rr_count + pset->rrsig_count) * 
 		(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t)) + 
 		pset->size;
@@ -794,13 +822,13 @@ log_query_info(enum verbosity_value v, const char* str,
 }
 
 int
-reply_check_cname_chain(struct reply_info* rep) 
+reply_check_cname_chain(struct query_info* qinfo, struct reply_info* rep) 
 {
 	/* check only answer section rrs for matching cname chain.
 	 * the cache may return changed rdata, but owner names are untouched.*/
 	size_t i;
-	uint8_t* sname = rep->rrsets[0]->rk.dname;
-	size_t snamelen = rep->rrsets[0]->rk.dname_len;
+	uint8_t* sname = qinfo->qname;
+	size_t snamelen = qinfo->qname_len;
 	for(i=0; i<rep->an_numrrsets; i++) {
 		uint16_t t = ntohs(rep->rrsets[i]->rk.type);
 		if(t == LDNS_RR_TYPE_DNAME)
diff --git a/util/data/msgreply.h b/util/data/msgreply.h
index e8d6d762e01a..708897950089 100644
--- a/util/data/msgreply.h
+++ b/util/data/msgreply.h
@@ -359,10 +359,11 @@ uint8_t* reply_find_final_cname_target(struct query_info* qinfo,
 
 /**
  * Check if cname chain in cached reply is still valid.
+ * @param qinfo: query info with query name.
  * @param rep: reply to check.
  * @return: true if valid, false if invalid.
  */
-int reply_check_cname_chain(struct reply_info* rep);
+int reply_check_cname_chain(struct query_info* qinfo, struct reply_info* rep);
 
 /**
  * Check security status of all RRs in the message.
diff --git a/util/data/packed_rrset.c b/util/data/packed_rrset.c
index 8074685764b1..0a5c9d3271b1 100644
--- a/util/data/packed_rrset.c
+++ b/util/data/packed_rrset.c
@@ -47,9 +47,9 @@
 #include "util/alloc.h"
 #include "util/regional.h"
 #include "util/net_help.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
 
 void
 ub_packed_rrset_parsedelete(struct ub_packed_rrset_key* pkey,
diff --git a/util/data/packed_rrset.h b/util/data/packed_rrset.h
index 5d7990a2b0b1..6039aef242ca 100644
--- a/util/data/packed_rrset.h
+++ b/util/data/packed_rrset.h
@@ -58,6 +58,12 @@ typedef uint64_t rrset_id_t;
  * from the SOA in the answer section from a direct SOA query or ANY query. */
 #define PACKED_RRSET_SOA_NEG 0x4
 
+/** number of rrs and rrsets for integer overflow protection.  More than
+ * this is not really possible (64K packet has much less RRs and RRsets) in
+ * a message.  And this is small enough that also multiplied there is no
+ * integer overflow. */
+#define RR_COUNT_MAX 0xffffff
+
 /**
  * The identifying information for an RRset.
  */
diff --git a/util/fptr_wlist.c b/util/fptr_wlist.c
index 5a77432c775e..1397e9c1359d 100644
--- a/util/fptr_wlist.c
+++ b/util/fptr_wlist.c
@@ -210,6 +210,7 @@ fptr_whitelist_hash_sizefunc(lruhash_sizefunc_t fptr)
 	else if(fptr == &ub_rrset_sizefunc) return 1;
 	else if(fptr == &infra_sizefunc) return 1;
 	else if(fptr == &key_entry_sizefunc) return 1;
+	else if(fptr == &rate_sizefunc) return 1;
 	else if(fptr == &test_slabhash_sizefunc) return 1;
 	return 0;
 }
@@ -221,6 +222,7 @@ fptr_whitelist_hash_compfunc(lruhash_compfunc_t fptr)
 	else if(fptr == &ub_rrset_compare) return 1;
 	else if(fptr == &infra_compfunc) return 1;
 	else if(fptr == &key_entry_compfunc) return 1;
+	else if(fptr == &rate_compfunc) return 1;
 	else if(fptr == &test_slabhash_compfunc) return 1;
 	return 0;
 }
@@ -232,6 +234,7 @@ fptr_whitelist_hash_delkeyfunc(lruhash_delkeyfunc_t fptr)
 	else if(fptr == &ub_rrset_key_delete) return 1;
 	else if(fptr == &infra_delkeyfunc) return 1;
 	else if(fptr == &key_entry_delkeyfunc) return 1;
+	else if(fptr == &rate_delkeyfunc) return 1;
 	else if(fptr == &test_slabhash_delkey) return 1;
 	return 0;
 }
@@ -243,6 +246,7 @@ fptr_whitelist_hash_deldatafunc(lruhash_deldatafunc_t fptr)
 	else if(fptr == &rrset_data_delete) return 1;
 	else if(fptr == &infra_deldatafunc) return 1;
 	else if(fptr == &key_entry_deldatafunc) return 1;
+	else if(fptr == &rate_deldatafunc) return 1;
 	else if(fptr == &test_slabhash_deldata) return 1;
 	return 0;
 }
diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index ce939d55ce54..fb3290cc48fd 100644
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -1066,7 +1066,6 @@
 1404,
 1405,
 1406,
-1407,
 1408,
 1409,
 1410,
@@ -3791,7 +3790,6 @@
 4321,
 4322,
 4323,
-4324,
 4325,
 4326,
 4327,
@@ -4015,6 +4013,7 @@
 4952,
 4969,
 4970,
+4980,
 4986,
 4987,
 4988,
@@ -4359,6 +4358,7 @@
 6072,
 6073,
 6074,
+6080,
 6081,
 6082,
 6083,
@@ -4433,6 +4433,7 @@
 6389,
 6390,
 6417,
+6419,
 6420,
 6421,
 6443,
@@ -4786,6 +4787,7 @@
 8379,
 8380,
 8383,
+8384,
 8400,
 8401,
 8402,
@@ -4802,6 +4804,7 @@
 8474,
 8500,
 8501,
+8503,
 8554,
 8555,
 8567,
@@ -4853,6 +4856,7 @@
 9000,
 9001,
 9002,
+9006,
 9007,
 9009,
 9020,
@@ -5031,6 +5035,7 @@
 10200,
 10201,
 10252,
+10253,
 10260,
 10288,
 10439,
@@ -5237,6 +5242,7 @@
 22005,
 22273,
 22305,
+22335,
 22343,
 22347,
 22350,
@@ -5376,6 +5382,7 @@
 40843,
 40853,
 41111,
+41230,
 41794,
 41795,
 42508,
diff --git a/util/log.c b/util/log.c
index f90efa71c75f..3ebd12025af9 100644
--- a/util/log.c
+++ b/util/log.c
@@ -40,7 +40,7 @@
 #include "config.h"
 #include "util/log.h"
 #include "util/locks.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include <stdarg.h>
 #ifdef HAVE_TIME_H
 #include <time.h>
@@ -164,6 +164,14 @@ void log_thread_set(int* num)
 	ub_thread_key_set(logkey, num);
 }
 
+int log_thread_get(void)
+{
+	unsigned int* tid;
+	if(!key_created) return 0;
+	tid = (unsigned int*)ub_thread_key_get(logkey);
+	return (int)(tid?*tid:0);
+}
+
 void log_ident_set(const char* id)
 {
 	ident = id;
diff --git a/util/log.h b/util/log.h
index ea283da7b262..8e85ee620b18 100644
--- a/util/log.h
+++ b/util/log.h
@@ -97,6 +97,15 @@ void log_file(FILE *f);
  */
 void log_thread_set(int* num);
 
+/**
+ * Get the thread id from logging system.  Set after log_init is
+ * initialised, or log_thread_set for newly created threads.
+ * This initialisation happens in unbound as a daemon, in daemon
+ * startup code, when that spawns threads.
+ * @return thread number, from 0 and up.  Before initialised, returns 0.
+ */
+int log_thread_get(void);
+
 /**
  * Set identity to print, default is 'unbound'. 
  * @param id: string to print. Name of executable.
diff --git a/util/net_help.c b/util/net_help.c
index e2b7c38783ab..8b39af6b3b0d 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -43,8 +43,8 @@
 #include "util/data/dname.h"
 #include "util/module.h"
 #include "util/regional.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
 #include <fcntl.h>
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
@@ -770,7 +770,7 @@ static lock_basic_t *ub_openssl_locks = NULL;
 static unsigned long
 ub_crypto_id_cb(void)
 {
-	return (unsigned long)ub_thread_self();
+	return (unsigned long)log_thread_get();
 }
 
 static void
@@ -789,8 +789,8 @@ int ub_openssl_lock_init(void)
 {
 #if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	int i;
-	ub_openssl_locks = (lock_basic_t*)malloc(
-		sizeof(lock_basic_t)*CRYPTO_num_locks());
+	ub_openssl_locks = (lock_basic_t*)reallocarray(
+		NULL, (size_t)CRYPTO_num_locks(), sizeof(lock_basic_t));
 	if(!ub_openssl_locks)
 		return 0;
 	for(i=0; i<CRYPTO_num_locks(); i++) {
diff --git a/util/netevent.c b/util/netevent.c
index c7ed30e6cd45..3bb8948889c5 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -43,8 +43,8 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/fptr_wlist.h"
-#include "ldns/pkthdr.h"
-#include "ldns/sbuffer.h"
+#include "sldns/pkthdr.h"
+#include "sldns/sbuffer.h"
 #include "dnstap/dnstap.h"
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
@@ -498,12 +498,16 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 	cmsg = CMSG_FIRSTHDR(&msg);
 	if(r->srctype == 4) {
 #ifdef IP_PKTINFO
+		void* cmsg_data;
 		msg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo));
 		log_assert(msg.msg_controllen <= sizeof(control));
 		cmsg->cmsg_level = IPPROTO_IP;
 		cmsg->cmsg_type = IP_PKTINFO;
 		memmove(CMSG_DATA(cmsg), &r->pktinfo.v4info,
 			sizeof(struct in_pktinfo));
+		/* unset the ifindex to not bypass the routing tables */
+		cmsg_data = CMSG_DATA(cmsg);
+		((struct in_pktinfo *) cmsg_data)->ipi_ifindex = 0;
 		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
 #elif defined(IP_SENDSRCADDR)
 		msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr));
@@ -518,12 +522,16 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 		msg.msg_control = NULL;
 #endif /* IP_PKTINFO or IP_SENDSRCADDR */
 	} else if(r->srctype == 6) {
+		void* cmsg_data;
 		msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
 		log_assert(msg.msg_controllen <= sizeof(control));
 		cmsg->cmsg_level = IPPROTO_IPV6;
 		cmsg->cmsg_type = IPV6_PKTINFO;
 		memmove(CMSG_DATA(cmsg), &r->pktinfo.v6info,
 			sizeof(struct in6_pktinfo));
+		/* unset the ifindex to not bypass the routing tables */
+		cmsg_data = CMSG_DATA(cmsg);
+		((struct in6_pktinfo *) cmsg_data)->ipi6_ifindex = 0;
 		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
 	} else {
 		/* try to pass all 0 to use default route */
@@ -879,12 +887,12 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
 	}
 
 	/* grab the tcp handler buffers */
+	c->cur_tcp_count++;
 	c->tcp_free = c_hdl->tcp_free;
 	if(!c->tcp_free) {
 		/* stop accepting incoming queries for now. */
 		comm_point_stop_listening(c);
 	}
-	/* addr is dropped. Not needed for tcp reply. */
 	setup_tcp_handler(c_hdl, new_fd);
 }
 
@@ -902,6 +910,7 @@ reclaim_tcp_handler(struct comm_point* c)
 	}
 	comm_point_close(c);
 	if(c->tcp_parent) {
+		c->tcp_parent->cur_tcp_count--;
 		c->tcp_free = c->tcp_parent->tcp_free;
 		c->tcp_parent->tcp_free = c;
 		if(!c->tcp_free) {
@@ -1528,6 +1537,7 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_udp;
@@ -1578,6 +1588,7 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_udp;
@@ -1639,6 +1650,7 @@ comm_point_create_tcp_handler(struct comm_base *base,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = parent;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_tcp;
@@ -1691,6 +1703,7 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num, size_t bufsize,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = num;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = (struct comm_point**)calloc((size_t)num,
 		sizeof(struct comm_point*));
 	if(!c->tcp_handlers) {
@@ -1758,6 +1771,7 @@ comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_tcp;
@@ -1810,6 +1824,7 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_local;
@@ -1857,6 +1872,7 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_raw;
diff --git a/util/netevent.h b/util/netevent.h
index 37322ab933f0..4b87cdba9e51 100644
--- a/util/netevent.h
+++ b/util/netevent.h
@@ -164,6 +164,8 @@ struct comm_point {
 	/* -------- TCP Accept -------- */
 	/** the number of TCP handlers for this tcp-accept socket */
 	int max_tcp_count;
+	/** current number of tcp handler in-use for this accept socket */
+	int cur_tcp_count;
 	/** malloced array of tcp handlers for a tcp-accept, 
 	    of size max_tcp_count. */
 	struct comm_point** tcp_handlers;
diff --git a/validator/autotrust.c b/validator/autotrust.c
index 5e1dc4ef3cdb..d90eec9eb0d1 100644
--- a/validator/autotrust.c
+++ b/validator/autotrust.c
@@ -57,11 +57,11 @@
 #include "services/mesh.h"
 #include "services/cache/rrset.h"
 #include "validator/val_kcache.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
-#include "ldns/keyraw.h"
-#include "ldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
+#include "sldns/keyraw.h"
+#include "sldns/rrdef.h"
 #include <stdarg.h>
 #include <ctype.h>
 
@@ -1184,7 +1184,7 @@ void autr_write_file(struct module_env* env, struct trust_anchor* tp)
 	verbose(VERB_ALGO, "autotrust: write to disk: %s", tempf);
 	out = fopen(tempf, "w");
 	if(!out) {
-		log_err("could not open autotrust file for writing, %s: %s",
+		fatal_exit("could not open autotrust file for writing, %s: %s",
 			tempf, strerror(errno));
 		return;
 	}
@@ -1192,11 +1192,11 @@ void autr_write_file(struct module_env* env, struct trust_anchor* tp)
 		/* failed to write contents (completely) */
 		fclose(out);
 		unlink(tempf);
-		log_err("could not completely write: %s", fname);
+		fatal_exit("could not completely write: %s", fname);
 		return;
 	}
 	if(fclose(out) != 0) {
-		log_err("could not complete write: %s: %s",
+		fatal_exit("could not complete write: %s: %s",
 			fname, strerror(errno));
 		unlink(tempf);
 		return;
@@ -1207,7 +1207,7 @@ void autr_write_file(struct module_env* env, struct trust_anchor* tp)
 	(void)unlink(fname); /* windows does not replace file with rename() */
 #endif
 	if(rename(tempf, fname) < 0) {
-		log_err("rename(%s to %s): %s", tempf, fname, strerror(errno));
+		fatal_exit("rename(%s to %s): %s", tempf, fname, strerror(errno));
 	}
 }
 
diff --git a/validator/val_anchor.c b/validator/val_anchor.c
index 3a67fff454ab..845b54a2e85e 100644
--- a/validator/val_anchor.c
+++ b/validator/val_anchor.c
@@ -48,9 +48,9 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
-#include "ldns/rrdef.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/str2wire.h"
 #ifdef HAVE_GLOB_H
 #include <glob.h>
 #endif
@@ -882,14 +882,14 @@ assemble_it(struct trust_anchor* ta, size_t num, uint16_t type)
 	memset(pd, 0, sizeof(*pd));
 	pd->count = num;
 	pd->trust = rrset_trust_ultimate;
-	pd->rr_len = (size_t*)malloc(num*sizeof(size_t));
+	pd->rr_len = (size_t*)reallocarray(NULL, num, sizeof(size_t));
 	if(!pd->rr_len) {
 		free(pd);
 		free(pkey->rk.dname);
 		free(pkey);
 		return NULL;
 	}
-	pd->rr_ttl = (time_t*)malloc(num*sizeof(time_t));
+	pd->rr_ttl = (time_t*)reallocarray(NULL, num, sizeof(time_t));
 	if(!pd->rr_ttl) {
 		free(pd->rr_len);
 		free(pd);
@@ -897,7 +897,7 @@ assemble_it(struct trust_anchor* ta, size_t num, uint16_t type)
 		free(pkey);
 		return NULL;
 	}
-	pd->rr_data = (uint8_t**)malloc(num*sizeof(uint8_t*));
+	pd->rr_data = (uint8_t**)reallocarray(NULL, num, sizeof(uint8_t*));
 	if(!pd->rr_data) {
 		free(pd->rr_ttl);
 		free(pd->rr_len);
@@ -1020,7 +1020,13 @@ anchors_assemble_rrsets(struct val_anchors* anchors)
 			dname_str(ta->name, b);
 			log_warn("trust anchor %s has no supported algorithms,"
 				" the anchor is ignored (check if you need to"
-				" upgrade unbound and openssl)", b);
+				" upgrade unbound and "
+#ifdef HAVE_LIBRESSL
+				"libressl"
+#else
+				"openssl"
+#endif
+				")", b);
 			(void)rbtree_delete(anchors->tree, &ta->node);
 			lock_basic_unlock(&ta->lock);
 			anchors_delfunc(&ta->node, NULL);
diff --git a/validator/val_kentry.c b/validator/val_kentry.c
index f99f18e894a1..93fe2145e6f8 100644
--- a/validator/val_kentry.c
+++ b/validator/val_kentry.c
@@ -45,8 +45,8 @@
 #include "util/storage/lookup3.h"
 #include "util/regional.h"
 #include "util/net_help.h"
-#include "ldns/rrdef.h"
-#include "ldns/keyraw.h"
+#include "sldns/rrdef.h"
+#include "sldns/keyraw.h"
 
 size_t 
 key_entry_sizefunc(void* key, void* data)
diff --git a/validator/val_neg.c b/validator/val_neg.c
index 1d7a5c56e85f..b1ff8d9a1ba5 100644
--- a/validator/val_neg.c
+++ b/validator/val_neg.c
@@ -59,8 +59,8 @@
 #include "util/config_file.h"
 #include "services/cache/rrset.h"
 #include "services/cache/dns.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
 
 int val_neg_data_compare(const void* a, const void* b)
 {
diff --git a/validator/val_nsec3.c b/validator/val_nsec3.c
index 548daf2bf0a7..80ca4d0ba36f 100644
--- a/validator/val_nsec3.c
+++ b/validator/val_nsec3.c
@@ -62,7 +62,7 @@
 #include "util/data/msgreply.h"
 /* we include nsec.h for the bitmap_has_type function */
 #include "validator/val_nsec.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** 
  * This function we get from ldns-compat or from base system 
diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
index 3437c8da6047..8ed403dfcf92 100644
--- a/validator/val_secalgo.c
+++ b/validator/val_secalgo.c
@@ -45,9 +45,9 @@
 #include "util/data/packed_rrset.h"
 #include "validator/val_secalgo.h"
 #include "util/log.h"
-#include "ldns/rrdef.h"
-#include "ldns/keyraw.h"
-#include "ldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/keyraw.h"
+#include "sldns/sbuffer.h"
 
 #if !defined(HAVE_SSL) && !defined(HAVE_NSS)
 #error "Need crypto library to do digital signature cryptography"
diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
index 5a4d0f471a84..7c643cab141d 100644
--- a/validator/val_sigcrypt.c
+++ b/validator/val_sigcrypt.c
@@ -51,10 +51,10 @@
 #include "util/module.h"
 #include "util/net_help.h"
 #include "util/regional.h"
-#include "ldns/keyraw.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
+#include "sldns/keyraw.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
 
 #include <ctype.h>
 #if !defined(HAVE_SSL) && !defined(HAVE_NSS)
@@ -1079,6 +1079,8 @@ int rrset_canonical_equal(struct regional* region,
 	fd.rr_data = fdata;
 	rbtree_init(&sortree1, &canonical_tree_compare);
 	rbtree_init(&sortree2, &canonical_tree_compare);
+	if(d1->count > RR_COUNT_MAX || d2->count > RR_COUNT_MAX)
+		return 1; /* protection against integer overflow */
 	rrs1 = regional_alloc(region, sizeof(struct canon_rr)*d1->count);
 	rrs2 = regional_alloc(region, sizeof(struct canon_rr)*d2->count);
 	if(!rrs1 || !rrs2) return 1; /* alloc failure */
@@ -1135,6 +1137,8 @@ rrset_canonical(struct regional* region, sldns_buffer* buf,
 			sizeof(rbtree_t));
 		if(!*sortree)
 			return 0;
+		if(d->count > RR_COUNT_MAX)
+			return 0; /* integer overflow protection */
 		rrs = regional_alloc(region, sizeof(struct canon_rr)*d->count);
 		if(!rrs) {
 			*sortree = NULL;
diff --git a/validator/validator.c b/validator/validator.c
index cc07cc2b1525..74068659f010 100644
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -58,8 +58,8 @@
 #include "util/regional.h"
 #include "util/config_file.h"
 #include "util/fptr_wlist.h"
-#include "ldns/rrdef.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/wire2str.h"
 
 /* forward decl for cache response and normal super inform calls of a DS */
 static void process_ds_response(struct module_qstate* qstate, 
@@ -226,6 +226,8 @@ val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
 	if(!vq->chase_reply)
 		return NULL;
+	if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX)
+		return NULL; /* protect against integer overflow */
 	vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
 		vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
 			* vq->orig_msg->rep->rrset_count);
@@ -517,8 +519,8 @@ validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
 				"has failed AUTHORITY rrset:", s->rk.dname,
 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
 			errinf(qstate, reason);
-			errinf_rrset(qstate, s);
 			errinf_origin(qstate, qstate->reply_origin);
+			errinf_rrset(qstate, s);
 			chase_reply->security = sec_status_bogus;
 			return 0;
 		}
@@ -1813,6 +1815,8 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 
 /**
  * Init DLV check.
+ * DLV is going to be decommissioned, but the code is still here for some time.
+ *
  * Called when a query is determined by other trust anchors to be insecure
  * (or indeterminate).  Then we look if there is a key in the DLV.
  * Performs aggressive negative cache check to see if there is no key.
@@ -2352,7 +2356,7 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
 	struct key_entry_key* kkey = NULL;
 	enum sec_status sec = sec_status_unchecked;
 	char* reason = NULL;
-	int downprot = 1;
+	int downprot = qstate->env->cfg->harden_algo_downgrade;
 
 	if(!dnskey_rrset) {
 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
diff --git a/winrc/README.txt b/winrc/README.txt
index e40204bb0f75..d36fff14cd79 100644
--- a/winrc/README.txt
+++ b/winrc/README.txt
@@ -10,7 +10,7 @@ See LICENSE for the license text file.
 Unbound is a recursive DNS server.  It does caching, full recursion, stub
 recursion, DNSSEC validation, NSEC3, IPv6.  More information can be found 
 at the http://unbound.net site.  Unbound has been built and tested on 
-Windows XP, Vista and 7.
+Windows XP, Vista, 7 and 8.
 
 At http://unbound.net/documentation is an install and configuration manual
 for windows.
diff --git a/winrc/anchor-update.c b/winrc/anchor-update.c
index 2b22e0142507..13d44fda686e 100644
--- a/winrc/anchor-update.c
+++ b/winrc/anchor-update.c
@@ -41,9 +41,9 @@
  */
 #include "config.h"
 #include "libunbound/unbound.h"
-#include "ldns/rrdef.h"
-#include "ldns/pkthdr.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/pkthdr.h"
+#include "sldns/wire2str.h"
 
 /** usage */
 static void
diff --git a/winrc/setup.nsi b/winrc/setup.nsi
index cd9fc76dfdab..bf47165f385a 100644
--- a/winrc/setup.nsi
+++ b/winrc/setup.nsi
@@ -75,25 +75,6 @@ section "Root anchor - DNSSEC" SectionRootKey
 	AddSize 2
 sectionEnd
 
-# the /o means it is not selected by default.
-section /o "DLV - dlv.isc.org" SectionDLV
-	# add estimated size for key (Kb)
-	AddSize 2
-	SetOutPath $INSTDIR
-
-	# libgcc exception lib used by NSISdl plugin (in crosscompile).
-	File /nonfatal "/oname=$PLUGINSDIR\libgcc_s_sjlj-1.dll" "/usr/i686-w64-mingw32/sys-root/mingw/bin/libgcc_s_sjlj-1.dll"
-
-	NSISdl::download "http://ftp.isc.org/www/dlv/dlv.isc.org.key" "$INSTDIR\dlv.isc.org.key"
-	Pop $R0 # result from Inetc::get
-	${If} $R0 != "success"
-		MessageBox MB_OK|MB_ICONEXCLAMATION "Download error (ftp.isc.org: $R0), click OK to abort installation" /SD IDOK
-		SetOutPath "C:\"
-		RMDir "$INSTDIR"  # doesnt work directory in use by us ...
-		Abort
-	${EndIf}
-sectionEnd
-
 section "-hidden.postinstall"
 	# copy files
 	setOutPath $INSTDIR
@@ -128,25 +109,10 @@ section "-hidden.postinstall"
 		WriteRegStr HKLM "Software\Unbound" "RootAnchor" ""
 	${EndIf}
 
-	# Store DLV choice
-	SectionGetFlags ${SectionDLV} $R0
-	IntOp $R0 $R0 & ${SF_SELECTED}
-	${If} $R0 == ${SF_SELECTED}
-		ClearErrors
-		FileOpen $R1 "$INSTDIR\service.conf" a
-		IfErrors done_dlv
-		FileSeek $R1 0 END
-		FileWrite $R1 "$\nserver: dlv-anchor-file: $\"$INSTDIR\dlv.isc.org.key$\"$\n"
-		FileClose $R1
-	  done_dlv:
-		WriteRegStr HKLM "Software\Unbound" "CronAction" "$\"$INSTDIR\anchor-update.exe$\" dlv.isc.org $\"$INSTDIR\dlv.isc.org.key$\""
-	${Else}
-		WriteRegStr HKLM "Software\Unbound" "CronAction" ""
-	${EndIf}
-
 	# store installation folder
 	WriteRegStr HKLM "Software\Unbound" "InstallLocation" "$INSTDIR"
 	WriteRegStr HKLM "Software\Unbound" "ConfigFile" "$INSTDIR\service.conf"
+	WriteRegStr HKLM "Software\Unbound" "CronAction" ""
 	WriteRegDWORD HKLM "Software\Unbound" "CronTime" 86400
 
 	# uninstaller
@@ -177,12 +143,10 @@ sectionEnd
 # set section descriptions
 LangString DESC_unbound ${LANG_ENGLISH} "The base unbound DNS(SEC) validating caching resolver. $\r$\n$\r$\nStarted at boot from the Services control panel, logs to the Application Log, and the config file is its Program Files folder."
 LangString DESC_rootkey ${LANG_ENGLISH} "Set up to use the DNSSEC root trust anchor. It is automatically updated. $\r$\n$\r$\nThis provides the main key that is used for security verification."
-LangString DESC_dlv ${LANG_ENGLISH} "Set up to use DLV with dlv.isc.org. Downloads the key during install. $\r$\n$\r$\nIt fetches additional public keys that are used for security verification by querying the isc.org server with names encountered."
 
 !insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN
   !insertmacro MUI_DESCRIPTION_TEXT ${SectionUnbound} $(DESC_unbound)
   !insertmacro MUI_DESCRIPTION_TEXT ${SectionRootKey} $(DESC_rootkey)
-  !insertmacro MUI_DESCRIPTION_TEXT ${SectionDLV} $(DESC_dlv)
 !insertmacro MUI_FUNCTION_DESCRIPTION_END
 
 # setup macros for uninstall functions.
@@ -214,7 +178,6 @@ section "un.Unbound"
 	Delete "$INSTDIR\unbound-website.url"
 	Delete "$INSTDIR\service.conf"
 	Delete "$INSTDIR\example.conf"
-	Delete "$INSTDIR\dlv.isc.org.key"
 	Delete "$INSTDIR\root.key"
 	RMDir "$INSTDIR"