diff --git a/external/unbound/CMakeLists.txt b/external/unbound/CMakeLists.txt
deleted file mode 100644
index fdfa0a0f..00000000
--- a/external/unbound/CMakeLists.txt
+++ /dev/null
@@ -1,201 +0,0 @@
-cmake_minimum_required(VERSION 2.8.7)
-
-project(unbound C)
-
-find_package(OpenSSL REQUIRED)
-find_package(Threads)
-
-include(configure_checks.cmake)
-
-if (WIN32)
-  set(USE_MINI_EVENT 1)
-  set(USE_WINSOCK 1)
-else ()
-  find_package(PkgConfig REQUIRED)
-  pkg_check_modules(LIBEVENT2 REQUIRED libevent)
-endif ()
-
-set(RETSIGTYPE void)
-
-add_definitions(-D_GNU_SOURCE)
-
-option(USE_ECDSA "Use ECDSA algorithms" ON)
-option(USE_SHA2 "Enable SHA2 support" ON)
-set(ENABLE_DNSTAP 0)
-set(HAVE_SSL 1)
-if (CMAKE_USE_PTHREADS_INIT AND NOT CMAKE_USE_WIN32_THREADS_INIT)
-  set(HAVE_PTHREAD 1)
-else ()
-  set(HAVE_PTHREAD 0)
-endif ()
-if (CMAKE_USE_WIN32_THREADS_INIT)
-  set(HAVE_WINDOWS_THREADS 1)
-else ()
-  set(HAVE_WINDOWS_THREADS 0)
-endif ()
-configure_file(
-  "${CMAKE_CURRENT_SOURCE_DIR}/config.h.cmake.in"
-  "${CMAKE_CURRENT_BINARY_DIR}/config.h")
-configure_file(
-  "${CMAKE_CURRENT_SOURCE_DIR}/dnstap/dnstap_config.h.in"
-  "${CMAKE_CURRENT_BINARY_DIR}/dnstap/dnstap_config.h")
-
-set(common_src
-  services/cache/dns.c
-  services/cache/infra.c
-  services/cache/rrset.c
-  util/data/dname.c
-  util/data/msgencode.c
-  util/data/msgparse.c
-  util/data/msgreply.c
-  util/data/packed_rrset.c
-  iterator/iterator.c
-  iterator/iter_delegpt.c
-  iterator/iter_donotq.c
-  iterator/iter_fwd.c
-  iterator/iter_hints.c
-  iterator/iter_priv.c
-  iterator/iter_resptype.c
-  iterator/iter_scrub.c
-  iterator/iter_utils.c
-  services/listen_dnsport.c
-  services/localzone.c
-  services/mesh.c
-  services/modstack.c
-  services/outbound_list.c
-  services/outside_network.c
-  util/alloc.c
-  util/config_file.c
-  util/configlexer.c
-  util/configparser.c
-  util/fptr_wlist.c
-  util/locks.c
-  util/log.c
-  util/mini_event.c
-  util/module.c
-  util/netevent.c
-  util/net_help.c
-  util/random.c
-  util/rbtree.c
-  util/regional.c
-  util/rtt.c
-  util/storage/dnstree.c
-  util/storage/lookup3.c
-  util/storage/lruhash.c
-  util/storage/slabhash.c
-  util/timehist.c
-  util/tube.c
-  util/winsock_event.c
-  validator/autotrust.c
-  validator/val_anchor.c
-  validator/validator.c
-  validator/val_kcache.c
-  validator/val_kentry.c
-  validator/val_neg.c
-  validator/val_nsec3.c
-  validator/val_nsec.c
-  validator/val_secalgo.c
-  validator/val_sigcrypt.c
-  validator/val_utils.c
-  dns64/dns64.c
-
-  #$(CHECKLOCK_SRC)
-  testcode/checklocks.c)
-
-set(compat_src)
-
-foreach (symbol IN ITEMS ctime_r gmtime_r inet_aton inet_ntop inet_pton malloc memcmp memmove snprintf strlcat strlcpy strptime explicit_bzero arc4random arc4random_uniform sha512)
-  string(TOUPPER "${symbol}" upper_sym)
-  if (NOT HAVE_${upper_sym})
-    list(APPEND compat_src
-      compat/${symbol}.c)
-  endif ()
-endforeach ()
-
-if (NOT HAVE_ARC4RANDOM)
-  list(APPEND compat_src
-    compat/arc4_lock.c)
-endif ()
-
-if (CMAKE_SYSTEM_NAME MATCHES "Linux")
-  list(APPEND compat_src
-    compat/getentropy_linux.c)
-elseif (APPLE)
-  list(APPEND compat_src
-    compat/getentropy_osx.c)
-#elseif (SunOS)
-#  list(APPEND compat_src
-#    compat/getentropy_solaris.c)
-elseif (WIN32)
-  list(APPEND compat_src
-    compat/getentropy_win.c)
-endif ()
-
-if (NOT HAVE_GETADDRINFO)
-  list(APPEND compat_src
-    compat/fake-rfc2553.c)
-endif ()
-
-set(sldns_src
-  ldns/keyraw.c
-  ldns/sbuffer.c
-  ldns/wire2str.c
-  ldns/parse.c
-  ldns/parseutil.c
-  ldns/rrdef.c
-  ldns/str2wire.c)
-
-set(libunbound_src
-  libunbound/context.c
-  libunbound/libunbound.c
-  libunbound/libworker.c)
-
-include_directories("${CMAKE_CURRENT_SOURCE_DIR}")
-include_directories("${CMAKE_CURRENT_BINARY_DIR}")
-include_directories(SYSTEM ${OPENSSL_INCLUDE_DIR})
-if (LIBEVENT2_FOUND)
-  include_directories(SYSTEM ${LIBEVENT2_INCLUDE_DIRS})
-  link_directories(${LIBEVENT2_LIBRARY_DIRS})
-endif ()
-add_library(unbound
-  ${common_src}
-  ${sldns_src}
-  ${compat_src}
-  ${libunbound_src})
-target_link_libraries(unbound
-  LINK_PRIVATE
-    ${OPENSSL_LIBRARIES}
-    ${CMAKE_THREAD_LIBS_INIT})
-if (LIBEVENT2_FOUND)
-  target_link_libraries(unbound
-    LINK_PRIVATE
-      ${LIBEVENT2_LIBRARIES})
-endif ()
-
-if (WIN32)
-  target_link_libraries(unbound
-    LINK_PRIVATE
-      iphlpapi
-      ws2_32)
-endif ()
-
-# XXX: Hack for static builds.
-set(LIBEVENT2_LIBDIR
-  "${LIBEVENT2_LIBDIR}"
-  PARENT_SCOPE)
-
-if (MINGW)
-  # There is no variable for this (probably due to the fact that the pthread
-  # library is implicit with a link in msys).
-  find_library(win32pthread
-    NAMES libwinpthread-1.dll)
-  foreach (input IN LISTS win32pthread OPENSSL_LIBRARIES)
-    # Copy shared libraries into the build tree so that no PATH manipulation is
-    # necessary.
-    get_filename_component(name "${input}" NAME)
-    configure_file(
-      "${input}"
-      "${CMAKE_BINARY_DIR}/bin/${name}"
-      COPYONLY)
-  endforeach ()
-endif ()
diff --git a/external/unbound/Makefile.in b/external/unbound/Makefile.in
index 02532a95..8ca74367 100644
--- a/external/unbound/Makefile.in
+++ b/external/unbound/Makefile.in
@@ -131,12 +131,12 @@ compat/memcmp.c compat/memmove.c compat/snprintf.c compat/strlcat.c \
 compat/strlcpy.c compat/strptime.c compat/getentropy_linux.c \
 compat/getentropy_osx.c compat/getentropy_solaris.c compat/getentropy_win.c \
 compat/explicit_bzero.c compat/arc4random.c compat/arc4random_uniform.c \
-compat/arc4_lock.c compat/sha512.c
+compat/arc4_lock.c compat/sha512.c compat/reallocarray.c
 COMPAT_OBJ=$(LIBOBJS:.o=.lo)
 COMPAT_OBJ_WITHOUT_CTIME=$(LIBOBJ_WITHOUT_CTIME:.o=.lo)
 COMPAT_OBJ_WITHOUT_CTIMEARC4=$(LIBOBJ_WITHOUT_CTIMEARC4:.o=.lo)
-SLDNS_SRC=ldns/keyraw.c ldns/sbuffer.c ldns/wire2str.c ldns/parse.c \
-ldns/parseutil.c ldns/rrdef.c ldns/str2wire.c
+SLDNS_SRC=sldns/keyraw.c sldns/sbuffer.c sldns/wire2str.c sldns/parse.c \
+sldns/parseutil.c sldns/rrdef.c sldns/str2wire.c
 SLDNS_OBJ=keyraw.lo sbuffer.lo wire2str.lo parse.lo parseutil.lo rrdef.lo \
 str2wire.lo
 UNITTEST_SRC=testcode/unitanchor.c testcode/unitdname.c \
@@ -459,8 +459,8 @@ strip:
 	$(STRIP) unbound$(EXEEXT)
 	$(STRIP) unbound-checkconf$(EXEEXT)
 	$(STRIP) unbound-control$(EXEEXT)
-	$(STRIP) unbound-host$(EXEEXT)
-	$(STRIP) unbound-anchor$(EXEEXT)
+	$(STRIP) unbound-host$(EXEEXT) || $(STRIP) .libs/unbound-host$(EXEEXT)
+	$(STRIP) unbound-anchor$(EXEEXT) || $(STRIP) .libs/unbound-anchor$(EXEEXT)
 
 pythonmod-install:
 	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
@@ -576,6 +576,7 @@ depend:
 			-e 's?$$(srcdir)/util/configlexer.c?util/configlexer.c?g' \
 			-e 's?$$(srcdir)/util/configparser.c?util/configparser.c?g' \
 			-e 's?$$(srcdir)/util/configparser.h?util/configparser.h?g' \
+			-e 's?$$(srcdir)/dnstap/dnstap_config.h??g' \
 			-e 's?$$(srcdir)/pythonmod/pythonmod.h?$$(PYTHONMOD_HEADER)?g' \
 			-e 's!\(.*\)\.o[ :]*!\1.lo \1.o: !g' \
 			> $(DEPEND_TMP)
@@ -596,89 +597,89 @@ dns.lo dns.o: $(srcdir)/services/cache/dns.c config.h $(srcdir)/iterator/iter_de
  $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/services/cache/dns.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h
-infra.lo infra.o: $(srcdir)/services/cache/infra.c config.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
+infra.lo infra.o: $(srcdir)/services/cache/infra.c config.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/rtt.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lookup3.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h
 rrset.lo rrset.o: $(srcdir)/services/cache/rrset.c config.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/regional.h $(srcdir)/util/alloc.h
 dname.lo dname.o: $(srcdir)/util/data/dname.c config.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/storage/lookup3.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/storage/lookup3.h $(srcdir)/sldns/sbuffer.h
 msgencode.lo msgencode.o: $(srcdir)/util/data/msgencode.c config.h $(srcdir)/util/data/msgencode.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h
 msgparse.lo msgparse.o: $(srcdir)/util/data/msgparse.c config.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parseutil.h \
- $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/wire2str.h
 msgreply.lo msgreply.o: $(srcdir)/util/data/msgreply.c config.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h
 packed_rrset.lo packed_rrset.o: $(srcdir)/util/data/packed_rrset.c config.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
- $(srcdir)/util/net_help.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/net_help.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h
 iterator.lo iterator.o: $(srcdir)/iterator/iterator.c config.h $(srcdir)/iterator/iterator.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/iterator/iter_utils.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/iterator/iter_utils.h \
  $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_donotq.h \
  $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_scrub.h $(srcdir)/iterator/iter_priv.h \
  $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/config_file.h $(srcdir)/ldns/wire2str.h \
- $(srcdir)/ldns/parseutil.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/config_file.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h
 iter_delegpt.lo iter_delegpt.o: $(srcdir)/iterator/iter_delegpt.c config.h $(srcdir)/iterator/iter_delegpt.h \
  $(srcdir)/util/log.h $(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
 iter_donotq.lo iter_donotq.o: $(srcdir)/iterator/iter_donotq.c config.h $(srcdir)/iterator/iter_donotq.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
 iter_fwd.lo iter_fwd.o: $(srcdir)/iterator/iter_fwd.c config.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
 iter_hints.lo iter_hints.o: $(srcdir)/iterator/iter_hints.c config.h $(srcdir)/iterator/iter_hints.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/str2wire.h \
- $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/sldns/wire2str.h
 iter_priv.lo iter_priv.o: $(srcdir)/iterator/iter_priv.c config.h $(srcdir)/iterator/iter_priv.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/sbuffer.h
 iter_resptype.lo iter_resptype.o: $(srcdir)/iterator/iter_resptype.c config.h \
  $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
  $(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/dname.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h
+ $(srcdir)/util/data/dname.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h
 iter_scrub.lo iter_scrub.o: $(srcdir)/iterator/iter_scrub.c config.h $(srcdir)/iterator/iter_scrub.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/iterator/iter_priv.h $(srcdir)/util/rbtree.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/util/alloc.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/util/alloc.h $(srcdir)/sldns/sbuffer.h
 iter_utils.lo iter_utils.o: $(srcdir)/iterator/iter_utils.c config.h $(srcdir)/iterator/iter_utils.h \
  $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_donotq.h \
  $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_priv.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
@@ -686,54 +687,56 @@ iter_utils.lo iter_utils.o: $(srcdir)/iterator/iter_utils.c config.h $(srcdir)/i
  $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/sbuffer.h
 listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
- $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/rbtree.h  $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h
 localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h
 mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h $(srcdir)/services/outbound_list.h \
  $(srcdir)/services/cache/dns.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
 modstack.lo modstack.o: $(srcdir)/services/modstack.c config.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/tube.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h
 outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/netevent.h
+ $(srcdir)/util/netevent.h 
 outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/ldns/sbuffer.h \
+  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rtt.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/dnstap/dnstap.h \
  
 alloc.lo alloc.o: $(srcdir)/util/alloc.c config.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/configyyrename.h $(srcdir)/util/config_file.h util/configparser.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/parseutil.h \
- $(srcdir)/util/iana_ports.inc
+ $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/sldns/parseutil.h $(srcdir)/util/iana_ports.inc
 configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
  $(srcdir)/util/config_file.h util/configparser.h
 configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
@@ -741,44 +744,46 @@ configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/conf
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_nsec3.h \
- $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
- $(srcdir)/validator/autotrust.h $(srcdir)/util/storage/dnstree.h $(srcdir)/libunbound/libworker.h \
- $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h $(srcdir)/util/config_file.h
+ $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h  \
+ $(srcdir)/services/localzone.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
+ $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h \
+ $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h
 locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
-log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/ldns/sbuffer.h
+log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
 mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 module.lo module.o: $(srcdir)/util/module.c config.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
 netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/netevent.h $(srcdir)/util/log.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/dnstap/dnstap.h  \
  $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/ldns/parseutil.h \
- $(srcdir)/ldns/wire2str.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/wire2str.h \
  
 random.lo random.o: $(srcdir)/util/random.c config.h $(srcdir)/util/random.h $(srcdir)/util/log.h
 rbtree.lo rbtree.o: $(srcdir)/util/rbtree.c config.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 regional.lo regional.o: $(srcdir)/util/regional.c config.h $(srcdir)/util/log.h $(srcdir)/util/regional.h
 rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h
@@ -789,7 +794,7 @@ lookup3.lo lookup3.o: $(srcdir)/util/storage/lookup3.c config.h $(srcdir)/util/s
 lruhash.lo lruhash.o: $(srcdir)/util/storage/lruhash.c config.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h
 slabhash.lo slabhash.o: $(srcdir)/util/storage/slabhash.c config.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
@@ -797,43 +802,43 @@ timehist.lo timehist.o: $(srcdir)/util/timehist.c config.h $(srcdir)/util/timehi
 tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/services/mesh.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h \
  $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 winsock_event.lo winsock_event.o: $(srcdir)/util/winsock_event.c config.h
 autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/validator/autotrust.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/dname.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/validator/val_kcache.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/keyraw.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h \
  
 val_anchor.lo val_anchor.o: $(srcdir)/validator/val_anchor.c config.h $(srcdir)/validator/val_anchor.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_sigcrypt.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/validator/autotrust.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
 validator.lo validator.o: $(srcdir)/validator/validator.c config.h $(srcdir)/validator/validator.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
  $(srcdir)/util/rbtree.h $(srcdir)/validator/val_kcache.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_nsec3.h \
  $(srcdir)/validator/val_neg.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/autotrust.h \
  $(srcdir)/services/cache/dns.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/sldns/wire2str.h
 val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/validator/val_kcache.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/validator/val_kentry.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
 val_kentry.lo val_kentry.o: $(srcdir)/validator/val_kentry.c config.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/keyraw.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
  
 val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h \
  $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
@@ -841,72 +846,78 @@ val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
 val_nsec3.lo val_nsec3.o: $(srcdir)/validator/val_nsec3.c config.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/validator.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kentry.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/validator/val_nsec.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/validator/val_nsec.h $(srcdir)/sldns/sbuffer.h
 val_nsec.lo val_nsec.o: $(srcdir)/validator/val_nsec.c config.h $(srcdir)/validator/val_nsec.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/validator/val_utils.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h
-val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/validator/val_secalgo.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h
+val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/sbuffer.h \
  
 val_sigcrypt.lo val_sigcrypt.o: $(srcdir)/validator/val_sigcrypt.c config.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h $(srcdir)/validator/validator.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/util/data/dname.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parseutil.h $(srcdir)/ldns/wire2str.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/util/data/dname.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
  
 val_utils.lo val_utils.o: $(srcdir)/validator/val_utils.c config.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_kentry.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h \
  $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/regional.h
 dns64.lo dns64.o: $(srcdir)/dns64/dns64.c config.h $(srcdir)/dns64/dns64.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/regional.h
 checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/checklocks.h
+dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/dnstap/dnstap.pb-c.h
+dnstap.pb-c.lo dnstap.pb-c.o: $(srcdir)/dnstap/dnstap.pb-c.c $(srcdir)/dnstap/dnstap.pb-c.h
 unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/unitmain.h \
- $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h
 unitdname.lo unitdname.o: $(srcdir)/testcode/unitdname.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 unitlruhash.lo unitlruhash.o: $(srcdir)/testcode/unitlruhash.c config.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h
 unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/util/log.h \
+ $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/random.h
 unitmsgparse.lo unitmsgparse.o: $(srcdir)/testcode/unitmsgparse.c config.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/unitmain.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/alloc.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/testcode/readhex.h \
- $(srcdir)/testcode/testpkts.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/testcode/testpkts.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 unitneg.lo unitneg.o: $(srcdir)/testcode/unitneg.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/dname.h $(srcdir)/testcode/unitmain.h $(srcdir)/validator/val_neg.h $(srcdir)/util/rbtree.h \
- $(srcdir)/ldns/rrdef.h
+ $(srcdir)/sldns/rrdef.h
 unitregional.lo unitregional.o: $(srcdir)/testcode/unitregional.c config.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/log.h $(srcdir)/util/regional.h
 unitslabhash.lo unitslabhash.o: $(srcdir)/testcode/unitslabhash.c config.h $(srcdir)/testcode/unitmain.h \
@@ -916,84 +927,89 @@ unitverify.lo unitverify.o: $(srcdir)/testcode/unitverify.c config.h $(srcdir)/u
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/validator/val_secalgo.h \
  $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h \
  $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/testcode/testpkts.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/alloc.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 readhex.lo readhex.o: $(srcdir)/testcode/readhex.c config.h $(srcdir)/testcode/readhex.h $(srcdir)/util/log.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parseutil.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 unitldns.lo unitldns.o: $(srcdir)/testcode/unitldns.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
 cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h \
  $(srcdir)/daemon/cachedump.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h \
- $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
+ $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/sldns/str2wire.h
 daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/daemon/remote.h \
+  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/util/random.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/ldns/keyraw.h
+ $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h
 remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
  $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/localzone.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
  $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
  $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/iterator/iter_delegpt.h $(srcdir)/services/outside_network.h $(srcdir)/ldns/str2wire.h \
- $(srcdir)/ldns/parseutil.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/services/outside_network.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/daemon/daemon.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/outside_network.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
 unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
- $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
+ $(srcdir)/daemon/remote.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/util/net_help.h $(srcdir)/util/mini_event.h \
  $(srcdir)/util/rbtree.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
@@ -1006,22 +1022,24 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
 testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h \
  $(srcdir)/daemon/remote.h \
- $(srcdir)/util/config_file.h $(srcdir)/ldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/util/log.h \
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/util/log.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
@@ -1036,132 +1054,136 @@ acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/ac
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
 daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/daemon/remote.h \
+  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/util/random.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/ldns/keyraw.h
+ $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/daemon/daemon.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/outside_network.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h \
- $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
 replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/testcode/testpkts.h \
- $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h
+ $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/testcode/fake_event.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h  \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 lock_verify.lo lock_verify.o: $(srcdir)/testcode/lock_verify.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
 pktview.lo pktview.o: $(srcdir)/testcode/pktview.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/testcode/readhex.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/ldns/parseutil.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/testcode/readhex.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/parseutil.h
 readhex.lo readhex.o: $(srcdir)/testcode/readhex.c config.h $(srcdir)/testcode/readhex.h $(srcdir)/util/log.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parseutil.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
 memstats.lo memstats.o: $(srcdir)/testcode/memstats.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
 unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/localzone.h \
- $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/sldns/sbuffer.h
 worker_cb.lo worker_cb.o: $(srcdir)/smallapp/worker_cb.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h
 context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/rtt.h $(srcdir)/sldns/sbuffer.h
 libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/libworker.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h \
  $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/services/localzone.h \
  $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/sldns/sbuffer.h
 libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h \
  $(srcdir)/libunbound/libworker.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/netevent.h $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/util/netevent.h  $(srcdir)/services/mesh.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/str2wire.h
 unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/wire2str.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/ldns/rrdef.h
+ $(srcdir)/sldns/rrdef.h
 streamtcp.lo streamtcp.o: $(srcdir)/testcode/streamtcp.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/wire2str.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
  
 perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 delayer.lo delayer.o: $(srcdir)/testcode/delayer.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
- $(srcdir)/util/config_file.h $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
 unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h \
- $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h
+ $(srcdir)/util/log.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h
 unbound-anchor.lo unbound-anchor.o: $(srcdir)/smallapp/unbound-anchor.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/sldns/rrdef.h \
  
 petal.lo petal.o: $(srcdir)/testcode/petal.c config.h \
  
 pythonmod_utils.lo pythonmod_utils.o: $(srcdir)/pythonmod/pythonmod_utils.c config.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
- $(srcdir)/ldns/sbuffer.h
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h
 win_svc.lo win_svc.o: $(srcdir)/winrc/win_svc.c config.h $(srcdir)/winrc/win_svc.h $(srcdir)/winrc/w_inst.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/ldns/sbuffer.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/daemon/remote.h \
+  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/winsock_event.h
 w_inst.lo w_inst.o: $(srcdir)/winrc/w_inst.c config.h $(srcdir)/winrc/w_inst.h $(srcdir)/winrc/win_svc.h
 unbound-service-install.lo unbound-service-install.o: $(srcdir)/winrc/unbound-service-install.c config.h \
@@ -1169,20 +1191,20 @@ unbound-service-install.lo unbound-service-install.o: $(srcdir)/winrc/unbound-se
 unbound-service-remove.lo unbound-service-remove.o: $(srcdir)/winrc/unbound-service-remove.c config.h \
  $(srcdir)/winrc/w_inst.h
 anchor-update.lo anchor-update.o: $(srcdir)/winrc/anchor-update.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/wire2str.h
-keyraw.lo keyraw.o: $(srcdir)/ldns/keyraw.c config.h $(srcdir)/ldns/keyraw.h \
- $(srcdir)/ldns/rrdef.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/wire2str.h
+keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/rrdef.h \
  
-sbuffer.lo sbuffer.o: $(srcdir)/ldns/sbuffer.c config.h $(srcdir)/ldns/sbuffer.h
-wire2str.lo wire2str.o: $(srcdir)/ldns/wire2str.c config.h $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/str2wire.h \
- $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/pkthdr.h $(srcdir)/ldns/parseutil.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/keyraw.h \
+sbuffer.lo sbuffer.o: $(srcdir)/sldns/sbuffer.c config.h $(srcdir)/sldns/sbuffer.h
+wire2str.lo wire2str.o: $(srcdir)/sldns/wire2str.c config.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/keyraw.h \
  
-parse.lo parse.o: $(srcdir)/ldns/parse.c config.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/parseutil.h \
- $(srcdir)/ldns/sbuffer.h
-parseutil.lo parseutil.o: $(srcdir)/ldns/parseutil.c config.h $(srcdir)/ldns/parseutil.h
-rrdef.lo rrdef.o: $(srcdir)/ldns/rrdef.c config.h $(srcdir)/ldns/rrdef.h $(srcdir)/ldns/parseutil.h
-str2wire.lo str2wire.o: $(srcdir)/ldns/str2wire.c config.h $(srcdir)/ldns/str2wire.h $(srcdir)/ldns/rrdef.h \
- $(srcdir)/ldns/wire2str.h $(srcdir)/ldns/sbuffer.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/parseutil.h
+parse.lo parse.o: $(srcdir)/sldns/parse.c config.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/sbuffer.h
+parseutil.lo parseutil.o: $(srcdir)/sldns/parseutil.c config.h $(srcdir)/sldns/parseutil.h
+rrdef.lo rrdef.o: $(srcdir)/sldns/rrdef.c config.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h
+str2wire.lo str2wire.o: $(srcdir)/sldns/str2wire.c config.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h
 ctime_r.lo ctime_r.o: $(srcdir)/compat/ctime_r.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 fake-rfc2553.lo fake-rfc2553.o: $(srcdir)/compat/fake-rfc2553.c $(srcdir)/compat/fake-rfc2553.h config.h
 gmtime_r.lo gmtime_r.o: $(srcdir)/compat/gmtime_r.c config.h
@@ -1195,6 +1217,7 @@ memmove.lo memmove.o: $(srcdir)/compat/memmove.c config.h
 snprintf.lo snprintf.o: $(srcdir)/compat/snprintf.c config.h
 strlcat.lo strlcat.o: $(srcdir)/compat/strlcat.c config.h
 strlcpy.lo strlcpy.o: $(srcdir)/compat/strlcpy.c config.h
+reallocarray.lo reallocarray.o: $(srcdir)/compat/reallocarray.c config.h
 strptime.lo strptime.o: $(srcdir)/compat/strptime.c config.h
 getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h \
  
diff --git a/external/unbound/acx_nlnetlabs.m4 b/external/unbound/acx_nlnetlabs.m4
index e1cf83a7..decf0f58 100644
--- a/external/unbound/acx_nlnetlabs.m4
+++ b/external/unbound/acx_nlnetlabs.m4
@@ -2,7 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 26
+# Version 27
+# 2015-03-17 AHX_CONFIG_REALLOCARRAY added
 # 2013-09-19 FLTO help text improved.
 # 2013-07-18 Enable ACX_CHECK_COMPILER_FLAG to test for -Wstrict-prototypes
 # 2013-06-25 FLTO has --disable-flto option.
@@ -1213,6 +1214,16 @@ struct tm *gmtime_r(const time_t *timep, struct tm *result);
 #endif
 ])
 
+dnl provide reallocarray compat prototype.
+dnl $1: unique name for compat code
+AC_DEFUN([AHX_CONFIG_REALLOCARRAY],
+[
+#ifndef HAVE_REALLOCARRAY
+#define reallocarray reallocarray$1
+void* reallocarray(void *ptr, size_t nmemb, size_t size);
+#endif
+])
+
 dnl provide w32 compat definition for sleep
 AC_DEFUN([AHX_CONFIG_W32_SLEEP],
 [
diff --git a/external/unbound/compat/getentropy_linux.c b/external/unbound/compat/getentropy_linux.c
index 32d58a7c..76f0f9df 100644
--- a/external/unbound/compat/getentropy_linux.c
+++ b/external/unbound/compat/getentropy_linux.c
@@ -77,6 +77,9 @@ int	getentropy(void *buf, size_t len);
 extern int main(int, char *argv[]);
 #endif
 static int gotdata(char *buf, size_t len);
+#ifdef SYS_getrandom
+static int getentropy_getrandom(void *buf, size_t len);
+#endif
 static int getentropy_urandom(void *buf, size_t len);
 #ifdef SYS__sysctl
 static int getentropy_sysctl(void *buf, size_t len);
@@ -93,6 +96,17 @@ getentropy(void *buf, size_t len)
 		return -1;
 	}
 
+#ifdef SYS_getrandom
+	/*
+	 * Try descriptor-less getrandom()
+	 */
+	ret = getentropy_getrandom(buf, len);
+	if (ret != -1)
+		return (ret);
+	if (errno != ENOSYS)
+		return (-1);
+#endif
+
 	/*
 	 * Try to get entropy with /dev/urandom
 	 *
@@ -178,6 +192,25 @@ gotdata(char *buf, size_t len)
 	return 0;
 }
 
+#ifdef SYS_getrandom
+static int
+getentropy_getrandom(void *buf, size_t len)
+{
+	int pre_errno = errno;
+	int ret;
+	if (len > 256)
+		return (-1);
+	do {
+		ret = syscall(SYS_getrandom, buf, len, 0);
+	} while (ret == -1 && errno == EINTR);
+
+	if (ret != (int)len)
+		return (-1);
+	errno = pre_errno;
+	return (0);
+}
+#endif
+
 static int
 getentropy_urandom(void *buf, size_t len)
 {
@@ -251,7 +284,7 @@ getentropy_sysctl(void *buf, size_t len)
 		struct __sysctl_args args = {
 			.name = mib,
 			.nlen = 3,
-			.oldval = buf + i,
+			.oldval = (char *)buf + i,
 			.oldlenp = &chunk,
 		};
 		if (syscall(SYS__sysctl, &args) != 0)
@@ -474,22 +507,24 @@ getentropy_fallback(void *buf, size_t len)
 
 			HD(cnt);
 		}
-#ifdef AT_RANDOM
+#ifdef HAVE_GETAUXVAL
+#  ifdef AT_RANDOM
 		/* Not as random as you think but we take what we are given */
 		p = (char *) getauxval(AT_RANDOM);
 		if (p)
 			HR(p, 16);
-#endif
-#ifdef AT_SYSINFO_EHDR
+#  endif
+#  ifdef AT_SYSINFO_EHDR
 		p = (char *) getauxval(AT_SYSINFO_EHDR);
 		if (p)
 			HR(p, pgs);
-#endif
-#ifdef AT_BASE
+#  endif
+#  ifdef AT_BASE
 		p = (char *) getauxval(AT_BASE);
 		if (p)
 			HD(p);
-#endif
+#  endif
+#endif /* HAVE_GETAUXVAL */
 
 		SHA512_Final(results, &ctx);
 		memcpy((char*)buf + i, results, min(sizeof(results), len - i));
diff --git a/external/unbound/compat/reallocarray.c b/external/unbound/compat/reallocarray.c
new file mode 100644
index 00000000..04d5d71c
--- /dev/null
+++ b/external/unbound/compat/reallocarray.c
@@ -0,0 +1,39 @@
+/*	$OpenBSD: reallocarray.c,v 1.1 2014/05/08 21:43:49 deraadt Exp $	*/
+/*
+ * Copyright (c) 2008 Otto Moerbeek <otto@drijf.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "config.h"
+#include <sys/types.h>
+#include <errno.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+/*
+ * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX
+ * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW
+ */
+#define MUL_NO_OVERFLOW	((size_t)1 << (sizeof(size_t) * 4))
+
+void *
+reallocarray(void *optr, size_t nmemb, size_t size)
+{
+	if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
+	    nmemb > 0 && SIZE_MAX / nmemb < size) {
+		errno = ENOMEM;
+		return NULL;
+	}
+	return realloc(optr, size * nmemb);
+}
diff --git a/external/unbound/config.guess b/external/unbound/config.guess
index c0adba94..b79252d6 100755
--- a/external/unbound/config.guess
+++ b/external/unbound/config.guess
@@ -1,14 +1,12 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
-#   2011, 2012 Free Software Foundation, Inc.
+#   Copyright 1992-2013 Free Software Foundation, Inc.
 
-timestamp='2012-06-10'
+timestamp='2013-06-10'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
+# the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful, but
@@ -22,19 +20,17 @@ timestamp='2012-06-10'
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
-
-
-# Originally written by Per Bothner.  Please send patches (context
-# diff format) to <config-patches@gnu.org> and include a ChangeLog
-# entry.
+# the same distribution terms that you use for the rest of that
+# program.  This Exception is an additional permission under section 7
+# of the GNU General Public License, version 3 ("GPLv3").
 #
-# This script attempts to guess a canonical system name similar to
-# config.sub.  If it succeeds, it prints the system name on stdout, and
-# exits with 0.  Otherwise, it exits with 1.
+# Originally written by Per Bothner.
 #
 # You can get the latest version of this script from:
 # http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+#
+# Please send patches with a ChangeLog entry to config-patches@gnu.org.
+
 
 me=`echo "$0" | sed -e 's,.*/,,'`
 
@@ -54,9 +50,7 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000,
-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012
-Free Software Foundation, Inc.
+Copyright 1992-2013 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -138,6 +132,27 @@ UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
 UNAME_SYSTEM=`(uname -s) 2>/dev/null`  || UNAME_SYSTEM=unknown
 UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
 
+case "${UNAME_SYSTEM}" in
+Linux|GNU|GNU/*)
+	# If the system lacks a compiler, then just pick glibc.
+	# We could probably try harder.
+	LIBC=gnu
+
+	eval $set_cc_for_build
+	cat <<-EOF > $dummy.c
+	#include <features.h>
+	#if defined(__UCLIBC__)
+	LIBC=uclibc
+	#elif defined(__dietlibc__)
+	LIBC=dietlibc
+	#else
+	LIBC=gnu
+	#endif
+	EOF
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
+	;;
+esac
+
 # Note: order is significant - the case branches are not exclusive.
 
 case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
@@ -200,6 +215,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
 	echo "${machine}-${os}${release}"
 	exit ;;
+    *:Bitrig:*:*)
+	UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'`
+	echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE}
+	exit ;;
     *:OpenBSD:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
 	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
@@ -302,7 +321,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
 	echo arm-acorn-riscix${UNAME_RELEASE}
 	exit ;;
-    arm:riscos:*:*|arm:RISCOS:*:*)
+    arm*:riscos:*:*|arm*:RISCOS:*:*)
 	echo arm-unknown-riscos
 	exit ;;
     SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
@@ -801,6 +820,9 @@ EOF
     i*:CYGWIN*:*)
 	echo ${UNAME_MACHINE}-pc-cygwin
 	exit ;;
+    *:MINGW64*:*)
+	echo ${UNAME_MACHINE}-pc-mingw64
+	exit ;;
     *:MINGW*:*)
 	echo ${UNAME_MACHINE}-pc-mingw32
 	exit ;;
@@ -852,21 +874,21 @@ EOF
 	exit ;;
     *:GNU:*:*)
 	# the GNU system
-	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
+	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
 	exit ;;
     *:GNU/*:*:*)
 	# other systems with GNU libc and userland
-	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-gnu
+	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
 	exit ;;
     i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
 	exit ;;
     aarch64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     aarch64_be:Linux:*:*)
 	UNAME_MACHINE=aarch64_be
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     alpha:Linux:*:*)
 	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
@@ -879,59 +901,54 @@ EOF
 	  EV68*) UNAME_MACHINE=alphaev68 ;;
 	esac
 	objdump --private-headers /bin/sh | grep -q ld.so.1
-	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
-	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
+	if test "$?" = 0 ; then LIBC="gnulibc1" ; fi
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    arc:Linux:*:* | arceb:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     arm*:Linux:*:*)
 	eval $set_cc_for_build
 	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
 	    | grep -q __ARM_EABI__
 	then
-	    echo ${UNAME_MACHINE}-unknown-linux-gnu
+	    echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	else
 	    if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
 		| grep -q __ARM_PCS_VFP
 	    then
-		echo ${UNAME_MACHINE}-unknown-linux-gnueabi
+		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi
 	    else
-		echo ${UNAME_MACHINE}-unknown-linux-gnueabihf
+		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf
 	    fi
 	fi
 	exit ;;
     avr32*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     cris:Linux:*:*)
-	echo ${UNAME_MACHINE}-axis-linux-gnu
+	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
 	exit ;;
     crisv32:Linux:*:*)
-	echo ${UNAME_MACHINE}-axis-linux-gnu
+	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
 	exit ;;
     frv:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     hexagon:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     i*86:Linux:*:*)
-	LIBC=gnu
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#ifdef __dietlibc__
-	LIBC=dietlibc
-	#endif
-EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
-	echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
+	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
 	exit ;;
     ia64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     m32r*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     m68*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     mips:Linux:*:* | mips64:Linux:*:*)
 	eval $set_cc_for_build
@@ -950,54 +967,63 @@ EOF
 	#endif
 EOF
 	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
-	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
+	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
 	;;
+    or1k:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     or32:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     padre:Linux:*:*)
-	echo sparc-unknown-linux-gnu
+	echo sparc-unknown-linux-${LIBC}
 	exit ;;
     parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-gnu
+	echo hppa64-unknown-linux-${LIBC}
 	exit ;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
-	  PA7*) echo hppa1.1-unknown-linux-gnu ;;
-	  PA8*) echo hppa2.0-unknown-linux-gnu ;;
-	  *)    echo hppa-unknown-linux-gnu ;;
+	  PA7*) echo hppa1.1-unknown-linux-${LIBC} ;;
+	  PA8*) echo hppa2.0-unknown-linux-${LIBC} ;;
+	  *)    echo hppa-unknown-linux-${LIBC} ;;
 	esac
 	exit ;;
     ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-gnu
+	echo powerpc64-unknown-linux-${LIBC}
 	exit ;;
     ppc:Linux:*:*)
-	echo powerpc-unknown-linux-gnu
+	echo powerpc-unknown-linux-${LIBC}
+	exit ;;
+    ppc64le:Linux:*:*)
+	echo powerpc64le-unknown-linux-${LIBC}
+	exit ;;
+    ppcle:Linux:*:*)
+	echo powerpcle-unknown-linux-${LIBC}
 	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
-	echo ${UNAME_MACHINE}-ibm-linux
+	echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
 	exit ;;
     sh64*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     sh*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     sparc:Linux:*:* | sparc64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     tile*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     vax:Linux:*:*)
-	echo ${UNAME_MACHINE}-dec-linux-gnu
+	echo ${UNAME_MACHINE}-dec-linux-${LIBC}
 	exit ;;
     x86_64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     xtensa*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
@@ -1201,6 +1227,9 @@ EOF
     BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
 	echo i586-pc-haiku
 	exit ;;
+    x86_64:Haiku:*:*)
+	echo x86_64-unknown-haiku
+	exit ;;
     SX-4:SUPER-UX:*:*)
 	echo sx4-nec-superux${UNAME_RELEASE}
 	exit ;;
@@ -1227,19 +1256,21 @@ EOF
 	exit ;;
     *:Darwin:*:*)
 	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
-	case $UNAME_PROCESSOR in
-	    i386)
-		eval $set_cc_for_build
-		if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
-		  if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
-		      (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
-		      grep IS_64BIT_ARCH >/dev/null
-		  then
-		      UNAME_PROCESSOR="x86_64"
-		  fi
-		fi ;;
-	    unknown) UNAME_PROCESSOR=powerpc ;;
-	esac
+	eval $set_cc_for_build
+	if test "$UNAME_PROCESSOR" = unknown ; then
+	    UNAME_PROCESSOR=powerpc
+	fi
+	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+	    if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		grep IS_64BIT_ARCH >/dev/null
+	    then
+		case $UNAME_PROCESSOR in
+		    i386) UNAME_PROCESSOR=x86_64 ;;
+		    powerpc) UNAME_PROCESSOR=powerpc64 ;;
+		esac
+	    fi
+	fi
 	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
 	exit ;;
     *:procnto*:*:* | *:QNX:[0123456789]*:*)
@@ -1330,9 +1361,6 @@ EOF
 	exit ;;
 esac
 
-#echo '(No uname command or uname output not recognized.)' 1>&2
-#echo "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" 1>&2
-
 eval $set_cc_for_build
 cat >$dummy.c <<EOF
 #ifdef _SEQUENT_
diff --git a/external/unbound/config.h.in b/external/unbound/config.h.in
index 2b7770b5..723b3ad0 100644
--- a/external/unbound/config.h.in
+++ b/external/unbound/config.h.in
@@ -42,7 +42,7 @@
 /* Whether the C compiler accepts the "unused" attribute */
 #undef HAVE_ATTR_UNUSED
 
-/* Define to 1 if your system has a working `chown' function. */
+/* Define to 1 if you have the `chown' function. */
 #undef HAVE_CHOWN
 
 /* Define to 1 if you have the `chroot' function. */
@@ -70,6 +70,10 @@
    if you don't. */
 #undef HAVE_DECL_NID_X9_62_PRIME256V1
 
+/* Define to 1 if you have the declaration of `reallocarray', and to 0 if you
+   don't. */
+#undef HAVE_DECL_REALLOCARRAY
+
 /* Define to 1 if you have the declaration of `sk_SSL_COMP_pop_free', and to 0
    if you don't. */
 #undef HAVE_DECL_SK_SSL_COMP_POP_FREE
@@ -146,6 +150,9 @@
 /* Whether getaddrinfo is available */
 #undef HAVE_GETADDRINFO
 
+/* Define to 1 if you have the `getauxval' function. */
+#undef HAVE_GETAUXVAL
+
 /* Define to 1 if you have the `getentropy' function. */
 #undef HAVE_GETENTROPY
 
@@ -263,6 +270,9 @@
 /* Define to 1 if you have the `random' function. */
 #undef HAVE_RANDOM
 
+/* Define to 1 if you have the `reallocarray' function. */
+#undef HAVE_REALLOCARRAY
+
 /* Define to 1 if you have the `recvmsg' function. */
 #undef HAVE_RECVMSG
 
@@ -350,6 +360,9 @@
 /* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
 #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST
 
+/* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
+#undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
+
 /* Define if you have Swig libraries and header files. */
 #undef HAVE_SWIG
 
@@ -380,6 +393,9 @@
 /* Define to 1 if you have the <sys/uio.h> header file. */
 #undef HAVE_SYS_UIO_H
 
+/* Define to 1 if you have the <sys/un.h> header file. */
+#undef HAVE_SYS_UN_H
+
 /* Define to 1 if you have the <sys/wait.h> header file. */
 #undef HAVE_SYS_WAIT_H
 
@@ -793,6 +809,10 @@
 #define ARG_LL "%I64"
 #endif
 
+#ifndef AF_LOCAL
+#define AF_LOCAL AF_UNIX
+#endif
+
 
  
 #ifdef HAVE_ATTR_FORMAT
@@ -876,6 +896,12 @@ struct tm *gmtime_r(const time_t *timep, struct tm *result);
 #endif
 
 
+#ifndef HAVE_REALLOCARRAY
+#define reallocarray reallocarrayunbound
+void* reallocarray(void *ptr, size_t nmemb, size_t size);
+#endif
+
+
 #if !defined(HAVE_SLEEP) || defined(HAVE_WINDOWS_H)
 #define sleep(x) Sleep((x)*1000) /* on win32 */
 #endif /* HAVE_SLEEP */
@@ -941,6 +967,9 @@ uint32_t arc4random(void);
 #  if !HAVE_DECL_ARC4RANDOM_UNIFORM && defined(HAVE_ARC4RANDOM_UNIFORM)
 uint32_t arc4random_uniform(uint32_t upper_bound);
 #  endif
+#  if !HAVE_DECL_REALLOCARRAY
+void *reallocarray(void *ptr, size_t nmemb, size_t size);
+#  endif
 #endif /* HAVE_LIBRESSL */
 #ifndef HAVE_ARC4RANDOM
 void explicit_bzero(void* buf, size_t len);
diff --git a/external/unbound/config.sub b/external/unbound/config.sub
index 6205f842..d2a96130 100755
--- a/external/unbound/config.sub
+++ b/external/unbound/config.sub
@@ -1,24 +1,18 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
-#   2011, 2012 Free Software Foundation, Inc.
+#   Copyright 1992-2013 Free Software Foundation, Inc.
 
-timestamp='2012-04-18'
+timestamp='2013-08-10'
 
-# This file is (in principle) common to ALL GNU software.
-# The presence of a machine in this file suggests that SOME GNU software
-# can handle that machine.  It does not imply ALL GNU software can.
-#
-# This file is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
+# This file is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <http://www.gnu.org/licenses/>.
@@ -26,11 +20,12 @@ timestamp='2012-04-18'
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
+# the same distribution terms that you use for the rest of that
+# program.  This Exception is an additional permission under section 7
+# of the GNU General Public License, version 3 ("GPLv3").
 
 
-# Please send patches to <config-patches@gnu.org>.  Submit a context
-# diff and a properly formatted GNU ChangeLog entry.
+# Please send patches with a ChangeLog entry to config-patches@gnu.org.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
 # Supply the specified configuration type as an argument.
@@ -73,9 +68,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000,
-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012
-Free Software Foundation, Inc.
+Copyright 1992-2013 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -123,7 +116,7 @@ esac
 maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
   nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
-  linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
+  linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
   knetbsd*-gnu* | netbsd*-gnu* | \
   kopensolaris*-gnu* | \
   storm-chaos* | os2-emx* | rtmk-nova*)
@@ -156,7 +149,7 @@ case $os in
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis | -knuth | -cray | -microblaze)
+	-apple | -axis | -knuth | -cray | -microblaze*)
 		os=
 		basic_machine=$1
 		;;
@@ -259,10 +252,12 @@ case $basic_machine in
 	| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \
 	| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
 	| am33_2.0 \
-	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr | avr32 \
-        | be32 | be64 \
+	| arc | arceb \
+	| arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \
+	| avr | avr32 \
+	| be32 | be64 \
 	| bfin \
-	| c4x | clipper \
+	| c4x | c8051 | clipper \
 	| d10v | d30v | dlx | dsp16xx \
 	| epiphany \
 	| fido | fr30 | frv \
@@ -273,7 +268,7 @@ case $basic_machine in
 	| le32 | le64 \
 	| lm32 \
 	| m32c | m32r | m32rle | m68000 | m68k | m88k \
-	| maxq | mb | microblaze | mcore | mep | metag \
+	| maxq | mb | microblaze | microblazeel | mcore | mep | metag \
 	| mips | mipsbe | mipseb | mipsel | mipsle \
 	| mips16 \
 	| mips64 | mips64el \
@@ -291,16 +286,17 @@ case $basic_machine in
 	| mipsisa64r2 | mipsisa64r2el \
 	| mipsisa64sb1 | mipsisa64sb1el \
 	| mipsisa64sr71k | mipsisa64sr71kel \
+	| mipsr5900 | mipsr5900el \
 	| mipstx39 | mipstx39el \
 	| mn10200 | mn10300 \
 	| moxie \
 	| mt \
 	| msp430 \
 	| nds32 | nds32le | nds32be \
-	| nios | nios2 \
+	| nios | nios2 | nios2eb | nios2el \
 	| ns16k | ns32k \
 	| open8 \
-	| or32 \
+	| or1k | or32 \
 	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle \
 	| pyramid \
@@ -370,13 +366,13 @@ case $basic_machine in
 	| aarch64-* | aarch64_be-* \
 	| alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \
 	| alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \
-	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* \
+	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \
 	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
 	| avr-* | avr32-* \
 	| be32-* | be64-* \
 	| bfin-* | bs2000-* \
 	| c[123]* | c30-* | [cjt]90-* | c4x-* \
-	| clipper-* | craynv-* | cydra-* \
+	| c8051-* | clipper-* | craynv-* | cydra-* \
 	| d10v-* | d30v-* | dlx-* \
 	| elxsi-* \
 	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
@@ -389,7 +385,8 @@ case $basic_machine in
 	| lm32-* \
 	| m32c-* | m32r-* | m32rle-* \
 	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* | microblaze-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
+	| microblaze-* | microblazeel-* \
 	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
 	| mips16-* \
 	| mips64-* | mips64el-* \
@@ -407,12 +404,13 @@ case $basic_machine in
 	| mipsisa64r2-* | mipsisa64r2el-* \
 	| mipsisa64sb1-* | mipsisa64sb1el-* \
 	| mipsisa64sr71k-* | mipsisa64sr71kel-* \
+	| mipsr5900-* | mipsr5900el-* \
 	| mipstx39-* | mipstx39el-* \
 	| mmix-* \
 	| mt-* \
 	| msp430-* \
 	| nds32-* | nds32le-* | nds32be-* \
-	| nios-* | nios2-* \
+	| nios-* | nios2-* | nios2eb-* | nios2el-* \
 	| none-* | np1-* | ns16k-* | ns32k-* \
 	| open8-* \
 	| orion-* \
@@ -788,11 +786,15 @@ case $basic_machine in
 		basic_machine=ns32k-utek
 		os=-sysv
 		;;
-	microblaze)
+	microblaze*)
 		basic_machine=microblaze-xilinx
 		;;
+	mingw64)
+		basic_machine=x86_64-pc
+		os=-mingw64
+		;;
 	mingw32)
-		basic_machine=i386-pc
+		basic_machine=i686-pc
 		os=-mingw32
 		;;
 	mingw32ce)
@@ -828,7 +830,7 @@ case $basic_machine in
 		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
 		;;
 	msys)
-		basic_machine=i386-pc
+		basic_machine=i686-pc
 		os=-msys
 		;;
 	mvs)
@@ -1004,7 +1006,7 @@ case $basic_machine in
 		;;
 	ppc64)	basic_machine=powerpc64-unknown
 		;;
-	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
+	ppc64-* | ppc64p7-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
 		basic_machine=powerpc64le-unknown
@@ -1019,7 +1021,11 @@ case $basic_machine in
 		basic_machine=i586-unknown
 		os=-pw32
 		;;
-	rdos)
+	rdos | rdos64)
+		basic_machine=x86_64-pc
+		os=-rdos
+		;;
+	rdos32)
 		basic_machine=i386-pc
 		os=-rdos
 		;;
@@ -1346,21 +1352,21 @@ case $os in
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
 	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
 	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
-	      | -sym* | -kopensolaris* \
+	      | -sym* | -kopensolaris* | -plan9* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
 	      | -aos* | -aros* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
 	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
-	      | -openbsd* | -solidbsd* \
+	      | -bitrig* | -openbsd* | -solidbsd* \
 	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
 	      | -chorusos* | -chorusrdb* | -cegcc* \
 	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -linux-gnu* | -linux-android* \
-	      | -linux-newlib* | -linux-uclibc* \
+	      | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
+	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* \
 	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
@@ -1492,9 +1498,6 @@ case $os in
 	-aros*)
 		os=-aros
 		;;
-	-kaos*)
-		os=-kaos
-		;;
 	-zvmoe)
 		os=-zvmoe
 		;;
@@ -1543,6 +1546,9 @@ case $basic_machine in
 	c4x-* | tic4x-*)
 		os=-coff
 		;;
+	c8051-*)
+		os=-elf
+		;;
 	hexagon-*)
 		os=-elf
 		;;
@@ -1586,6 +1592,9 @@ case $basic_machine in
 	mips*-*)
 		os=-elf
 		;;
+	or1k-*)
+		os=-elf
+		;;
 	or32-*)
 		os=-coff
 		;;
diff --git a/external/unbound/configure b/external/unbound/configure
index bdfc14f2..425466eb 100755
--- a/external/unbound/configure
+++ b/external/unbound/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.5.1.
+# Generated by GNU Autoconf 2.69 for unbound 1.5.4.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.5.1'
-PACKAGE_STRING='unbound 1.5.1'
+PACKAGE_VERSION='1.5.4'
+PACKAGE_STRING='unbound 1.5.4'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''
 
@@ -733,6 +733,7 @@ UNBOUND_PIDFILE
 UNBOUND_SHARE_DIR
 UNBOUND_CHROOT_DIR
 UNBOUND_RUN_DIR
+ub_conf_dir
 ub_conf_file
 EGREP
 GREP
@@ -1387,7 +1388,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.5.1 to adapt to many kinds of systems.
+\`configure' configures unbound 1.5.4 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1452,7 +1453,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.5.1:";;
+     short | recursive ) echo "Configuration of unbound 1.5.4:";;
    esac
   cat <<\_ACEOF
 
@@ -1627,7 +1628,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.5.1
+unbound configure 1.5.4
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2336,7 +2337,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.5.1, which was
+It was created by unbound $as_me 1.5.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2688,11 +2689,11 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=5
 
-UNBOUND_VERSION_MICRO=1
+UNBOUND_VERSION_MICRO=4
 
 
 LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=3
+LIBUNBOUND_REVISION=7
 LIBUNBOUND_AGE=3
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2732,7 +2733,10 @@ LIBUNBOUND_AGE=3
 # 1.4.21 had 4:1:2
 # 1.4.22 had 4:1:2
 # 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
-# 1.5.1 had 5:4:3
+# 1.5.1 had 5:3:3
+# 1.5.2 had 5:5:3
+# 1.5.3 had 5:6:3
+# 1.5.4 had 5:7:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -4047,6 +4051,30 @@ cat >>confdefs.h <<_ACEOF
 #define CONFIGFILE "$hdr_config"
 _ACEOF
 
+ub_conf_dir=`$as_dirname -- "$ub_conf_file" ||
+$as_expr X"$ub_conf_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+	 X"$ub_conf_file" : 'X\(//\)[^/]' \| \
+	 X"$ub_conf_file" : 'X\(//\)$' \| \
+	 X"$ub_conf_file" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X"$ub_conf_file" |
+    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)[^/].*/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\).*/{
+	    s//\1/
+	    q
+	  }
+	  s/.*/./; q'`
+
 
 # Determine run, chroot directory and pidfile locations
 
@@ -13713,7 +13741,7 @@ CC="$lt_save_CC"
 
 
 # Checks for header files.
-for ac_header in stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h
+for ac_header in stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h
 do :
   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
 ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
@@ -16701,6 +16729,16 @@ fi
 cat >>confdefs.h <<_ACEOF
 #define HAVE_DECL_ARC4RANDOM_UNIFORM $ac_have_decl
 _ACEOF
+ac_fn_c_check_decl "$LINENO" "reallocarray" "ac_cv_have_decl_reallocarray" "$ac_includes_default"
+if test "x$ac_cv_have_decl_reallocarray" = xyes; then :
+  ac_have_decl=1
+else
+  ac_have_decl=0
+fi
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_REALLOCARRAY $ac_have_decl
+_ACEOF
 
 else
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
@@ -17818,6 +17856,22 @@ $as_echo "no" >&6; }
 
 fi
 
+fi
+
+ac_fn_c_check_member "$LINENO" "struct sockaddr_un" "sun_len" "ac_cv_member_struct_sockaddr_un_sun_len" "
+$ac_includes_default
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+
+"
+if test "x$ac_cv_member_struct_sockaddr_un_sun_len" = xyes; then :
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_STRUCT_SOCKADDR_UN_SUN_LEN 1
+_ACEOF
+
+
 fi
 
 ac_fn_c_check_member "$LINENO" "struct in_pktinfo" "ipi_spec_dst" "ac_cv_member_struct_in_pktinfo_ipi_spec_dst" "
@@ -17916,7 +17970,7 @@ if test "$ac_res" != no; then :
 
 fi
 
-for ac_func in tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent
+for ac_func in tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -18093,6 +18147,20 @@ esac
 fi
 
 
+ac_fn_c_check_func "$LINENO" "reallocarray" "ac_cv_func_reallocarray"
+if test "x$ac_cv_func_reallocarray" = xyes; then :
+  $as_echo "#define HAVE_REALLOCARRAY 1" >>confdefs.h
+
+else
+  case " $LIBOBJS " in
+  *" reallocarray.$ac_objext "* ) ;;
+  *) LIBOBJS="$LIBOBJS reallocarray.$ac_objext"
+ ;;
+esac
+
+fi
+
+
 LIBOBJ_WITHOUT_CTIMEARC4="$LIBOBJS"
 
 if test "$USE_NSS" = "no"; then
@@ -18211,6 +18279,62 @@ done
 					# this lib needed for sha2 on solaris
 					LIBS="$LIBS -lmd"
 				fi
+				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing clock_gettime" >&5
+$as_echo_n "checking for library containing clock_gettime... " >&6; }
+if ${ac_cv_search_clock_gettime+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char clock_gettime ();
+int
+main ()
+{
+return clock_gettime ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' rt; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_clock_gettime=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_clock_gettime+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_clock_gettime+:} false; then :
+
+else
+  ac_cv_search_clock_gettime=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_clock_gettime" >&5
+$as_echo "$ac_cv_search_clock_gettime" >&6; }
+ac_res=$ac_cv_search_clock_gettime
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
 			;;
 			Linux|*)
 				case " $LIBOBJS " in
@@ -18253,6 +18377,17 @@ _ACEOF
 
 fi
 
+done
+
+				for ac_func in getauxval
+do :
+  ac_fn_c_check_func "$LINENO" "getauxval" "ac_cv_func_getauxval"
+if test "x$ac_cv_func_getauxval" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_GETAUXVAL 1
+_ACEOF
+
+fi
 done
 
 				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing clock_gettime" >&5
@@ -18752,7 +18887,7 @@ _ACEOF
 
 
 
-version=1.5.1
+version=1.5.4
 
 date=`date +'%b %e, %Y'`
 
@@ -19267,7 +19402,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.5.1, which was
+This file was extended by unbound $as_me 1.5.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -19333,7 +19468,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.5.1
+unbound config.status 1.5.4
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/external/unbound/configure.ac b/external/unbound/configure.ac
index 7e5da1a9..60281383 100644
--- a/external/unbound/configure.ac
+++ b/external/unbound/configure.ac
@@ -10,14 +10,14 @@ sinclude(dnstap/dnstap.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[5])
-m4_define([VERSION_MICRO],[1])
+m4_define([VERSION_MICRO],[4])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=5
-LIBUNBOUND_REVISION=3
+LIBUNBOUND_REVISION=7
 LIBUNBOUND_AGE=3
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -57,7 +57,10 @@ LIBUNBOUND_AGE=3
 # 1.4.21 had 4:1:2
 # 1.4.22 had 4:1:2
 # 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
-# 1.5.1 had 5:4:3
+# 1.5.1 had 5:3:3
+# 1.5.2 had 5:5:3
+# 1.5.3 had 5:6:3
+# 1.5.4 had 5:7:3
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -118,6 +121,8 @@ AC_ARG_WITH([conf_file],
 AC_SUBST(ub_conf_file)
 ACX_ESCAPE_BACKSLASH($ub_conf_file, hdr_config)
 AC_DEFINE_UNQUOTED(CONFIGFILE, ["$hdr_config"], [Pathname to the Unbound configuration file])
+ub_conf_dir=`AS_DIRNAME(["$ub_conf_file"])`
+AC_SUBST(ub_conf_dir)
 
 # Determine run, chroot directory and pidfile locations
 AC_ARG_WITH(run-dir, 
@@ -266,7 +271,7 @@ AC_CHECK_TOOL(STRIP, strip)
 ACX_LIBTOOL_C_ONLY
 
 # Checks for header files.
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h],,, [AC_INCLUDES_DEFAULT])
 
 # check for types.  
 # Using own tests for int64* because autoconf builtin only give 32bit.
@@ -564,7 +569,7 @@ if grep OPENSSL_VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL
 	AC_DEFINE([HAVE_LIBRESSL], [1], [Define if we have LibreSSL])
 	# libressl provides these compat functions, but they may also be
 	# declared by the OS in libc.  See if they have been declared.
-	AC_CHECK_DECLS([strlcpy,strlcat,arc4random,arc4random_uniform])
+	AC_CHECK_DECLS([strlcpy,strlcat,arc4random,arc4random_uniform,reallocarray])
 else
 	AC_MSG_RESULT([no])
 fi
@@ -938,6 +943,12 @@ if test $ac_cv_func_daemon = yes; then
 ])
 fi
 
+AC_CHECK_MEMBERS([struct sockaddr_un.sun_len],,,[
+AC_INCLUDES_DEFAULT
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+])
 AC_CHECK_MEMBERS([struct in_pktinfo.ipi_spec_dst],,,[
 AC_INCLUDES_DEFAULT
 #if HAVE_SYS_PARAM_H
@@ -969,7 +980,7 @@ AC_INCLUDES_DEFAULT
 #endif
 ])
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid sbrk chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
 AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
@@ -985,6 +996,7 @@ AC_REPLACE_FUNCS(strlcat)
 AC_REPLACE_FUNCS(strlcpy)
 AC_REPLACE_FUNCS(memmove)
 AC_REPLACE_FUNCS(gmtime_r)
+AC_REPLACE_FUNCS(reallocarray)
 LIBOBJ_WITHOUT_CTIMEARC4="$LIBOBJS"
 AC_SUBST(LIBOBJ_WITHOUT_CTIMEARC4)
 if test "$USE_NSS" = "no"; then
@@ -1012,6 +1024,7 @@ if test "$USE_NSS" = "no"; then
 					# this lib needed for sha2 on solaris
 					LIBS="$LIBS -lmd"
 				fi
+				AC_SEARCH_LIBS([clock_gettime], [rt])
 			;;
 			Linux|*)
 				AC_LIBOBJ(getentropy_linux)
@@ -1020,6 +1033,7 @@ if test "$USE_NSS" = "no"; then
 					AC_LIBOBJ(sha512)
 				])
 				AC_CHECK_HEADERS([sys/sysctl.h],,, [AC_INCLUDES_DEFAULT])
+				AC_CHECK_FUNCS([getauxval])
 				AC_SEARCH_LIBS([clock_gettime], [rt])
 			;;
 			esac
@@ -1205,6 +1219,10 @@ dnl includes
 #else
 #define ARG_LL "%I64"
 #endif
+
+#ifndef AF_LOCAL
+#define AF_LOCAL AF_UNIX
+#endif
 ]
 
 AHX_CONFIG_FORMAT_ATTRIBUTE
@@ -1219,6 +1237,7 @@ AHX_CONFIG_MEMMOVE(unbound)
 AHX_CONFIG_STRLCAT(unbound)
 AHX_CONFIG_STRLCPY(unbound)
 AHX_CONFIG_GMTIME_R(unbound)
+AHX_CONFIG_REALLOCARRAY(unbound)
 AHX_CONFIG_W32_SLEEP
 AHX_CONFIG_W32_USLEEP
 AHX_CONFIG_W32_RANDOM
@@ -1252,6 +1271,9 @@ uint32_t arc4random(void);
 #  if !HAVE_DECL_ARC4RANDOM_UNIFORM && defined(HAVE_ARC4RANDOM_UNIFORM)
 uint32_t arc4random_uniform(uint32_t upper_bound);
 #  endif
+#  if !HAVE_DECL_REALLOCARRAY
+void *reallocarray(void *ptr, size_t nmemb, size_t size);
+#  endif
 #endif /* HAVE_LIBRESSL */
 #ifndef HAVE_ARC4RANDOM
 void explicit_bzero(void* buf, size_t len);
diff --git a/external/unbound/contrib/README b/external/unbound/contrib/README
index 49dee02e..34c8cc46 100644
--- a/external/unbound/contrib/README
+++ b/external/unbound/contrib/README
@@ -29,4 +29,5 @@ distribution but may be helpful.
   works like the BIND feature (removes AAAA records unless AAAA-only domain).
   Useful for certain 'broken IPv6 default route' scenarios.
   Patch from Stephane Lapie for ASAHI Net.
-
+* unbound_smf22.tar.gz: Solaris SMF installation/removal scripts.
+  Contributed by Yuri Voinov.
diff --git a/external/unbound/contrib/create_unbound_ad_servers.sh b/external/unbound/contrib/create_unbound_ad_servers.sh
index c3b05c60..d31f078b 100644
--- a/external/unbound/contrib/create_unbound_ad_servers.sh
+++ b/external/unbound/contrib/create_unbound_ad_servers.sh
@@ -36,4 +36,4 @@ echo "Done."
 #  the unbound_ad_servers file:
 #
 #   include: $dst_dir/unbound_ad_servers
-#
+#
\ No newline at end of file
diff --git a/external/unbound/contrib/unbound_cache.cmd b/external/unbound/contrib/unbound_cache.cmd
index 0f006938..532162b1 100644
--- a/external/unbound/contrib/unbound_cache.cmd
+++ b/external/unbound/contrib/unbound_cache.cmd
@@ -2,7 +2,7 @@
 rem --------------------------------------------------------------
 rem -- DNS cache save/load script
 rem --
-rem -- Version 1.0
+rem -- Version 1.2
 rem -- By Yuri Voinov (c) 2014
 rem --------------------------------------------------------------
 
@@ -19,47 +19,87 @@ exit 1
 
 :start
 
-set arg=%1
+rem arg1 - command (optional)
+rem arg2 - file name (optional)
+set arg1=%1
+set arg2=%2
 
-if /I "%arg%" == "-h" goto help
+if /I "%arg1%" == "-h" goto help
 
-if "%arg%" == "" (
+if "%arg1%" == "" (
 echo Loading cache from %program_path%\%fname%
+dir /a %program_path%\%fname%
 type %program_path%\%fname%|%uc% load_cache
 goto end
 )
 
-if /I "%arg%" == "-s" (
+if defined %arg2% (goto Not_Defined) else (goto Defined)
+
+rem If file not specified; use default dump file
+:Not_defined
+if /I "%arg1%" == "-s" (
 echo Saving cache to %program_path%\%fname%
 %uc% dump_cache>%program_path%\%fname%
+dir /a %program_path%\%fname%
 echo ok
 goto end
 )
 
-if /I "%arg%" == "-l" (
+if /I "%arg1%" == "-l" (
+echo Loading cache from %program_path%\%fname%
+dir /a %program_path%\%fname%
+type %program_path%\%fname%|%uc% load_cache
+goto end
+)
+
+if /I "%arg1%" == "-r" (
+echo Saving cache to %program_path%\%fname%
+dir /a %program_path%\%fname%
+%uc% dump_cache>%program_path%\%fname%
+echo ok
 echo Loading cache from %program_path%\%fname%
 type %program_path%\%fname%|%uc% load_cache
 goto end
 )
 
-if /I "%arg%" == "-r" (
-echo Saving cache to %program_path%\%fname%
-%uc% dump_cache>%program_path%\%fname%
+rem If file name specified; use this filename
+:Defined
+if /I "%arg1%" == "-s" (
+echo Saving cache to %arg2%
+%uc% dump_cache>%arg2%
+dir /a %arg2%
 echo ok
-echo Loading cache from %program_path%\%fname%
-type %program_path%\%fname%|%uc% load_cache
+goto end
+)
+
+if /I "%arg1%" == "-l" (
+echo Loading cache from %arg2%
+dir /a %arg2%
+type %arg2%|%uc% load_cache
+goto end
+)
+
+if /I "%arg1%" == "-r" (
+echo Saving cache to %arg2%
+dir /a %arg2%
+%uc% dump_cache>%arg2%
+echo ok
+echo Loading cache from %arg2%
+type %arg2%|%uc% load_cache
 goto end
 )
 
 :help
-echo Usage: unbound_cache.cmd [-s] or [-l] or [-r] or [-h]
+echo Usage: unbound_cache.cmd [-s] or [-l] or [-r] or [-h] [filename]
 echo.
 echo l - Load - default mode. Warming up Unbound DNS cache from saved file. cache-ttl must be high value.
 echo s - Save - save Unbound DNS cache contents to plain file with domain names.
 echo r - Reload - reloadind new cache entries and refresh existing cache
 echo h - this screen.
+echo filename - file to save/load dumped cache. If not specified, %program_path%\%fname% will be used instead.
 echo Note: Run without any arguments will be in default mode.
 echo       Also, unbound-control must be configured.
 exit 1
 
 :end
+exit 0
diff --git a/external/unbound/contrib/unbound_cache.sh b/external/unbound/contrib/unbound_cache.sh
index 238d90e3..b3e876ba 100644
--- a/external/unbound/contrib/unbound_cache.sh
+++ b/external/unbound/contrib/unbound_cache.sh
@@ -1,13 +1,13 @@
 #!/sbin/sh
-#
+
 # --------------------------------------------------------------
 # -- DNS cache save/load script
 # --
-# -- Version 1.0
+# -- Version 1.2
 # -- By Yuri Voinov (c) 2006, 2014
 # --------------------------------------------------------------
 #
-# ident   "@(#)unbound_cache.sh     1.1     14/04/26 YV"
+# ident   "@(#)unbound_cache.sh     1.2     14/10/30 YV"
 #
 
 #############
@@ -27,9 +27,10 @@ BASENAME=`which basename`
 CAT=`which cat`
 CUT=`which cut`
 ECHO=`which echo`
+EXPR=`which expr`
 GETOPT=`which getopt`
 ID=`which id`
-PRINTF=`which printf`
+LS=`which ls`
 
 ###############
 # Subroutines #
@@ -38,12 +39,13 @@ PRINTF=`which printf`
 usage_note ()
 {
 # Script usage note
- $ECHO "Usage: `$BASENAME $0` [-s] or [-l] or [-r] or [-h]"
- $ECHO
+ $ECHO "Usage: `$BASENAME $0` [-s] or [-l] or [-r] or [-h] [filename]"
+ $ECHO .
  $ECHO "l - Load - default mode. Warming up Unbound DNS cache from saved file. cache-ttl must be high value."
  $ECHO "s - Save - save Unbound DNS cache contents to plain file with domain names."
  $ECHO "r - Reload - reloadind new cache entries and refresh existing cache"
  $ECHO "h - this screen."
+ $ECHO "filename - file to save/load dumped cache. If not specified, $CONF/$FNAME will be used instead."
  $ECHO "Note: Run without any arguments will be in default mode."
  $ECHO "      Also, unbound-control must be configured."
  exit 0
@@ -68,7 +70,12 @@ check_uc ()
 
 check_saved_file ()
 {
- if [ ! -f "$CONF/$FNAME" ]; then
+ filename=$1
+ if [ ! -z "$filename" -a ! -f "$filename" ]; then
+  $ECHO .
+  $ECHO "ERROR: File $filename does not exists. Save it first."
+  exit 1
+ elif [ ! -f "$CONF/$FNAME" ]; then
   $ECHO .
   $ECHO "ERROR: File $CONF/$FNAME does not exists. Save it first."
   exit 1
@@ -78,24 +85,42 @@ check_saved_file ()
 save_cache ()
 {
  # Save unbound cache
- $PRINTF "Saving cache in $CONF/$FNAME..."
- $UC dump_cache>$CONF/$FNAME
+ filename=$1
+ if [ -z "$filename" ]; then
+  $ECHO "Saving cache in $CONF/$FNAME..."
+  $UC dump_cache>$CONF/$FNAME
+  $LS -lh $CONF/$FNAME
+ else
+  $ECHO "Saving cache in $filename..."
+  $UC dump_cache>$filename
+  $LS -lh $filename
+ fi
  $ECHO "ok"
 }
 
 load_cache ()
 {
- # Load saved cache contents and warmup DNS cache
- $PRINTF "Loading cache from saved $CONF/$FNAME..."
- check_saved_file
- $CAT $CONF/$FNAME|$UC load_cache
+ # Load saved cache contents and warmup cache
+ filename=$1
+ if [ -z "$filename" ]; then
+  $ECHO "Loading cache from saved $CONF/$FNAME..."
+  $LS -lh $CONF/$FNAME
+  check_saved_file $filename
+  $CAT $CONF/$FNAME|$UC load_cache
+ else
+  $ECHO "Loading cache from saved $filename..."
+  $LS -lh $filename
+  check_saved_file $filename
+  $CAT $filename|$UC load_cache
+ fi
 }
 
 reload_cache ()
 {
  # Reloading and refresh existing cache and saved dump
- save_cache
- load_cache
+ filename=$1
+ save_cache $filename
+ load_cache $filename
 }
 
 ##############
@@ -109,27 +134,41 @@ root_check
 check_uc
 
 # Check command-line arguments
-if [ "x$1" = "x" ]; then
-# If arguments list empty, load cache by default
+if [ "x$*" = "x" ]; then
+ # If arguments list empty,load cache by default
  load_cache
 else
- arg_list=$1
+ arg_list=$*
  # Parse command line
  set -- `$GETOPT sSlLrRhH: $arg_list` || {
   usage_note 1>&2
  }
 
-  # Read arguments
+ # Read arguments
  for i in $arg_list
   do
    case $i in
-    -s | -S) save_cache;;
-    -l | -L) load_cache;;
-    -r | -R) reload_cache;;
+    -s | -S) save="1";;
+    -l | -L) save="0";;
+    -r | -R) save="2";;
     -h | -H | \?) usage_note;;
+    *) shift
+       file=$1
+       break;;
    esac
-   break
+   shift
   done
+
+ # Remove trailing --
+ shift `$EXPR $OPTIND - 1`
 fi
 
-exit 0
+if [ "$save" = "1" ]; then
+ save_cache $file
+elif [ "$save" = "0" ]; then
+ load_cache $file
+elif [ "$save" = "2" ]; then
+ reload_cache $file
+fi
+
+exit 0
\ No newline at end of file
diff --git a/external/unbound/contrib/unbound_cacti.tar.gz b/external/unbound/contrib/unbound_cacti.tar.gz
index cc29476c..36bbdecd 100644
Binary files a/external/unbound/contrib/unbound_cacti.tar.gz and b/external/unbound/contrib/unbound_cacti.tar.gz differ
diff --git a/external/unbound/contrib/unbound_munin_ b/external/unbound/contrib/unbound_munin_
index 1f9f39a3..69e9f311 100755
--- a/external/unbound/contrib/unbound_munin_
+++ b/external/unbound/contrib/unbound_munin_
@@ -210,6 +210,7 @@ exist_config ( ) {
 	if grep '^'$1'=' $state >/dev/null 2>&1; then
 		echo "$mn.label $2"
 		echo "$mn.min 0"
+		echo "$mn.type ABSOLUTE"
 	fi
 }
 
@@ -218,6 +219,7 @@ p_config ( ) {
 	mn=`echo $1 | sed $ABBREV | tr . _`
 	echo $mn.label "$2"
 	echo $mn.min 0
+	echo $mn.type $3
 }
 
 if test "$1" = "config" ; then
@@ -228,20 +230,21 @@ if test "$1" = "config" ; then
 	hits)
 		echo "graph_title Unbound DNS traffic and cache hits"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
 			sed -e 's/=.*//'`; do
 			exist_config $x "queries handled by `basename $x .num.queries`"
 		done
-		p_config "total.num.queries" "total queries from clients"
-		p_config "total.num.cachehits" "cache hits"
-		p_config "total.num.prefetch" "cache prefetch"
-		p_config "num.query.tcp" "TCP queries"
-		p_config "num.query.tcpout" "TCP out queries"
-		p_config "num.query.ipv6" "IPv6 queries"
-		p_config "unwanted.queries" "queries that failed acl"
-		p_config "unwanted.replies" "unwanted or unsolicited replies"
+		p_config "total.num.queries" "total queries from clients" "ABSOLUTE"
+		p_config "total.num.cachehits" "cache hits" "ABSOLUTE"
+		p_config "total.num.prefetch" "cache prefetch" "ABSOLUTE"
+		p_config "num.query.tcp" "TCP queries" "ABSOLUTE"
+		p_config "num.query.tcpout" "TCP out queries" "ABSOLUTE"
+		p_config "num.query.ipv6" "IPv6 queries" "ABSOLUTE"
+		p_config "unwanted.queries" "queries that failed acl" "ABSOLUTE"
+		p_config "unwanted.replies" "unwanted or unsolicited replies" "ABSOLUTE"
 		echo "u_replies.warning $warn"
 		echo "u_replies.critical $crit"
 		echo "graph_info DNS queries to the recursive resolver. The unwanted replies could be innocent duplicate packets, late replies, or spoof threats."
@@ -250,11 +253,12 @@ if test "$1" = "config" ; then
 		echo "graph_title Unbound requestlist size"
 		echo "graph_args --base 1000 -l 0"
 		echo "graph_vlabel number of queries"
+		echo "graph_scale no"
 		echo "graph_category DNS"
-		p_config "total.requestlist.avg" "Average size of queue on insert"
-		p_config "total.requestlist.max" "Max size of queue (in 5 min)"
-		p_config "total.requestlist.overwritten" "Number of queries replaced by new ones"
-		p_config "total.requestlist.exceeded" "Number of queries dropped due to lack of space"
+		p_config "total.requestlist.avg" "Average size of queue on insert" "GAUGE"
+		p_config "total.requestlist.max" "Max size of queue (in 5 min)" "GAUGE"
+		p_config "total.requestlist.overwritten" "Number of queries replaced by new ones" "GAUGE"
+		p_config "total.requestlist.exceeded" "Number of queries dropped due to lack of space" "GAUGE"
 		echo "graph_info The queries that did not hit the cache and need recursion service take up space in the requestlist. If there are too many queries, first queries get overwritten, and at last resort dropped."
 		;;
 	memory)
@@ -262,128 +266,144 @@ if test "$1" = "config" ; then
 		echo "graph_args --base 1024 -l 0"
 		echo "graph_vlabel memory used in bytes"
 		echo "graph_category DNS"
-		p_config "mem.total.sbrk" "Total memory"
-		p_config "mem.cache.rrset" "RRset cache memory"
-		p_config "mem.cache.message" "Message cache memory"
-		p_config "mem.mod.iterator" "Iterator module memory"
-		p_config "mem.mod.validator" "Validator module and key cache memory"
-		p_config "msg.cache.count" "msg cache count"
-		p_config "rrset.cache.count" "rrset cache count"
-		p_config "infra.cache.count" "infra cache count"
-		p_config "key.cache.count" "key cache count"
+		p_config "mem.total.sbrk" "Total memory" "GAUGE"
+		p_config "mem.cache.rrset" "RRset cache memory" "GAUGE"
+		p_config "mem.cache.message" "Message cache memory" "GAUGE"
+		p_config "mem.mod.iterator" "Iterator module memory" "GAUGE"
+		p_config "mem.mod.validator" "Validator module and key cache memory" "GAUGE"
+		p_config "msg.cache.count" "msg cache count" "GAUGE"
+		p_config "rrset.cache.count" "rrset cache count" "GAUGE"
+		p_config "infra.cache.count" "infra cache count" "GAUGE"
+		p_config "key.cache.count" "key cache count" "GAUGE"
 		echo "graph_info The memory used by unbound."
 		;;
 	by_type)
 		echo "graph_title Unbound DNS queries by type"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.query.type" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.query.type.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
 		echo "graph_info queries by DNS RR type queried for"
 		;;
 	by_class)
 		echo "graph_title Unbound DNS queries by class"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.query.class" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.query.class.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
 		echo "graph_info queries by DNS RR class queried for."
 		;;
 	by_opcode)
 		echo "graph_title Unbound DNS queries by opcode"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.query.opcode" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.query.opcode.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
 		echo "graph_info queries by opcode in the query packet."
 		;;
 	by_rcode)
 		echo "graph_title Unbound DNS answers by return code"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel answer packets / second"
+		echo "graph_vlabel answer packets / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		for x in `grep "^num.answer.rcode" $state`; do
 			nm=`echo $x | sed -e 's/=.*$//'`
 			tp=`echo $nm | sed -e s/num.answer.rcode.//`
-			p_config "$nm" "$tp"
+			p_config "$nm" "$tp" "ABSOLUTE"
 		done
-		p_config "num.answer.secure" "answer secure"
-		p_config "num.answer.bogus" "answer bogus"
-		p_config "num.rrset.bogus" "num rrsets marked bogus"
-		echo "graph_info answers sorted by return value. rrsets bogus is the number of rrsets marked bogus per second by the validator"
+		p_config "num.answer.secure" "answer secure" "ABSOLUTE"
+		p_config "num.answer.bogus" "answer bogus" "ABSOLUTE"
+		p_config "num.rrset.bogus" "num rrsets marked bogus" "ABSOLUTE"
+		echo "graph_info answers sorted by return value. rrsets bogus is the number of rrsets marked bogus per \${graph_period} by the validator"
 		;;
 	by_flags)
 		echo "graph_title Unbound DNS incoming queries by flags"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
-		p_config "num.query.flags.QR" "QR (query reply) flag"
-		p_config "num.query.flags.AA" "AA (auth answer) flag"
-		p_config "num.query.flags.TC" "TC (truncated) flag"
-		p_config "num.query.flags.RD" "RD (recursion desired) flag"
-		p_config "num.query.flags.RA" "RA (rec avail) flag"
-		p_config "num.query.flags.Z" "Z (zero) flag"
-		p_config "num.query.flags.AD" "AD (auth data) flag"
-		p_config "num.query.flags.CD" "CD (check disabled) flag"
-		p_config "num.query.edns.present" "EDNS OPT present"
-		p_config "num.query.edns.DO" "DO (DNSSEC OK) flag"
+		p_config "num.query.flags.QR" "QR (query reply) flag" "ABSOLUTE"
+		p_config "num.query.flags.AA" "AA (auth answer) flag" "ABSOLUTE"
+		p_config "num.query.flags.TC" "TC (truncated) flag" "ABSOLUTE"
+		p_config "num.query.flags.RD" "RD (recursion desired) flag" "ABSOLUTE"
+		p_config "num.query.flags.RA" "RA (rec avail) flag" "ABSOLUTE"
+		p_config "num.query.flags.Z" "Z (zero) flag" "ABSOLUTE"
+		p_config "num.query.flags.AD" "AD (auth data) flag" "ABSOLUTE"
+		p_config "num.query.flags.CD" "CD (check disabled) flag" "ABSOLUTE"
+		p_config "num.query.edns.present" "EDNS OPT present" "ABSOLUTE"
+		p_config "num.query.edns.DO" "DO (DNSSEC OK) flag" "ABSOLUTE"
 		echo "graph_info This graphs plots the flags inside incoming queries. For example, if QR, AA, TC, RA, Z flags are set, the query can be rejected. RD, AD, CD and DO are legitimately set by some software."
 		;;
 	histogram)
 		echo "graph_title Unbound DNS histogram of reply time"
 		echo "graph_args --base 1000 -l 0"
-		echo "graph_vlabel queries / second"
+		echo "graph_vlabel queries / \${graph_period}"
+		echo "graph_scale no"
 		echo "graph_category DNS"
 		echo hcache.label "cache hits"
 		echo hcache.min 0
+		echo hcache.type ABSOLUTE
 		echo hcache.draw AREA
 		echo hcache.colour 999999
 		echo h64ms.label "0 msec - 66 msec"
 		echo h64ms.min 0
+		echo h64ms.type ABSOLUTE
 		echo h64ms.draw STACK
 		echo h64ms.colour 0000FF
 		echo h128ms.label "66 msec - 131 msec"
 		echo h128ms.min 0
+		echo h128ms.type ABSOLUTE
 		echo h128ms.colour 1F00DF
 		echo h128ms.draw STACK
 		echo h256ms.label "131 msec - 262 msec"
 		echo h256ms.min 0
+		echo h256ms.type ABSOLUTE
 		echo h256ms.draw STACK
 		echo h256ms.colour 3F00BF
 		echo h512ms.label "262 msec - 524 msec"
 		echo h512ms.min 0
+		echo h512ms.type ABSOLUTE
 		echo h512ms.draw STACK
 		echo h512ms.colour 5F009F
 		echo h1s.label "524 msec - 1 sec"
 		echo h1s.min 0
+		echo h1s.type ABSOLUTE
 		echo h1s.draw STACK
 		echo h1s.colour 7F007F
 		echo h2s.label "1 sec - 2 sec"
 		echo h2s.min 0
+		echo h2s.type ABSOLUTE
 		echo h2s.draw STACK
 		echo h2s.colour 9F005F
 		echo h4s.label "2 sec - 4 sec"
 		echo h4s.min 0
+		echo h4s.type ABSOLUTE
 		echo h4s.draw STACK
 		echo h4s.colour BF003F
 		echo h8s.label "4 sec - 8 sec"
 		echo h8s.min 0
+		echo h8s.type ABSOLUTE
 		echo h8s.draw STACK
 		echo h8s.colour DF001F
 		echo h16s.label "8 sec - ..."
 		echo h16s.min 0
+		echo h16s.type ABSOLUTE
 		echo h16s.draw STACK
 		echo h16s.colour FF0000
 		echo "graph_info Histogram of the reply times for queries."
@@ -404,20 +424,6 @@ if test $value = 0 || test $value = "0.000000"; then
 fi
 elapsed="$value"
 
-# print value for $1 / elapsed
-print_qps ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	get_value $1
-	echo "$mn.value" `echo scale=6';' $value / $elapsed | bc `
-}
-
-# print qps if line already found in $2
-print_qps_line ( ) {
-	mn=`echo $1 | sed $ABBREV | tr . _`
-	value="`echo $2 | sed -e 's/^.*=//'`"
-	echo "$mn.value" `echo scale=6';' $value / $elapsed | bc `
-}
-
 # print value for $1
 print_value ( ) {
 	mn=`echo $1 | sed $ABBREV | tr . _`
@@ -425,6 +431,14 @@ print_value ( ) {
 	echo "$mn.value" $value
 }
 
+# print value if line already found in $2
+print_value_line ( ) {
+	mn=`echo $1 | sed $ABBREV | tr . _`
+	value="`echo $2 | sed -e 's/^.*=//'`"
+	echo "$mn.value" $value
+}
+
+
 case $id in
 hits)
 	for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
@@ -433,7 +447,7 @@ hits)
 		num.query.tcpout num.query.ipv6 unwanted.queries \
 		unwanted.replies; do
 		if grep "^"$x"=" $state >/dev/null 2>&1; then
-			print_qps $x
+			print_value $x
 		fi
 	done
 	;;
@@ -467,38 +481,38 @@ memory)
 by_type)
 	for x in `grep "^num.query.type" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
 	;;
 by_class)
 	for x in `grep "^num.query.class" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
 	;;
 by_opcode)
 	for x in `grep "^num.query.opcode" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
 	;;
 by_rcode)
 	for x in `grep "^num.answer.rcode" $state`; do
 		nm=`echo $x | sed -e 's/=.*$//'`
-		print_qps_line $nm $x
+		print_value_line $nm $x
 	done
-	print_qps "num.answer.secure"
-	print_qps "num.answer.bogus"
-	print_qps "num.rrset.bogus"
+	print_value "num.answer.secure"
+	print_value "num.answer.bogus"
+	print_value "num.rrset.bogus"
 	;;
 by_flags)
 	for x in num.query.flags.QR num.query.flags.AA num.query.flags.TC num.query.flags.RD num.query.flags.RA num.query.flags.Z num.query.flags.AD num.query.flags.CD num.query.edns.present num.query.edns.DO; do
-		print_qps $x
+		print_value $x
 	done
 	;;
 histogram)
 	get_value total.num.cachehits
-	echo hcache.value `echo scale=6';' $value / $elapsed | bc `
+	echo hcache.value $value
 	r=0
 	for x in histogram.000000.000000.to.000000.000001 \
 		histogram.000000.000001.to.000000.000002 \
@@ -520,21 +534,21 @@ histogram)
 		get_value $x
 		r=`expr $r + $value`
 	done
-	echo h64ms.value `echo scale=6';' $r / $elapsed | bc `
+	echo h64ms.value $r
 	get_value histogram.000000.065536.to.000000.131072
-	echo h128ms.value `echo scale=6';' $value / $elapsed | bc `
+	echo h128ms.value $value
 	get_value histogram.000000.131072.to.000000.262144
-	echo h256ms.value `echo scale=6';' $value / $elapsed | bc `
+	echo h256ms.value $value
 	get_value histogram.000000.262144.to.000000.524288
-	echo h512ms.value `echo scale=6';' $value / $elapsed | bc `
+	echo h512ms.value $value
 	get_value histogram.000000.524288.to.000001.000000
-	echo h1s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h1s.value $value
 	get_value histogram.000001.000000.to.000002.000000
-	echo h2s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h2s.value $value
 	get_value histogram.000002.000000.to.000004.000000
-	echo h4s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h4s.value $value
 	get_value histogram.000004.000000.to.000008.000000
-	echo h8s.value `echo scale=6';' $value / $elapsed | bc `
+	echo h8s.value $value
 	r=0
 	for x in histogram.000008.000000.to.000016.000000 \
 		histogram.000016.000000.to.000032.000000 \
@@ -555,6 +569,6 @@ histogram)
 		get_value $x
 		r=`expr $r + $value`
 	done
-	echo h16s.value `echo scale=6';' $r / $elapsed | bc `
+	echo h16s.value $r
 	;;
 esac
diff --git a/external/unbound/contrib/unbound_smf22.tar.gz b/external/unbound/contrib/unbound_smf22.tar.gz
new file mode 100644
index 00000000..e4c51c3d
Binary files /dev/null and b/external/unbound/contrib/unbound_smf22.tar.gz differ
diff --git a/external/unbound/contrib/warmup.cmd b/external/unbound/contrib/warmup.cmd
index d7df0182..b3895a86 100644
--- a/external/unbound/contrib/warmup.cmd
+++ b/external/unbound/contrib/warmup.cmd
@@ -1,68 +1,153 @@
 @echo off
 
 rem --------------------------------------------------------------
-rem -- Warm up DNS cache script by your own MRU domains
+rem -- Warm up DNS cache script by your own MRU domains or from
+rem -- file when it specified as script argument.
 rem --
-rem -- Version 1.0
+rem -- Version 1.1
 rem -- By Yuri Voinov (c) 2014
 rem --------------------------------------------------------------
 
+rem DNS host address
+set address="127.0.0.1"
+
 rem Check dig installed
 for /f "delims=" %%a in ('where dig') do @set dig=%%a
 if /I "%dig%"=="" echo Dig not found. If installed, add path to PATH environment variable. & exit 1
 echo Dig found: %dig%
 
-echo Warming up cache by MRU domains...
-rem dig -f my_domains 1>nul 2>nul
-rem echo Done.
+set arg=%1%
 
+if defined %arg% (goto builtin) else (goto from_file)
+
+:builtin
+echo Warming up cache by MRU domains...
 for %%a in (
-mail.ru
-my.mail.ru
-mra.mail.ru
+2gis.ru
+admir.kz
+adobe.com
 agent.mail.ru
-news.mail.ru
-icq.com
-lenta.ru
-gazeta.ru
-peerbet.ru
-www.opennet.ru
-snob.ru
+aimp.ru
+akamai.com
+akamai.net
+almaty.tele2.kz
+aol.com
+apple.com
+arin.com
 artlebedev.ru
-mail.google.com
-translate.google.com
+auto.mail.ru
+beeline.kz
+bing.com
+blogspot.com
+comodo.com
+dnscrypt.org
 drive.google.com
+drive.mail.ru
+facebook.com
+farmanager.com
+fb.com
+firefox.com
+forum.farmanager.com
+gazeta.ru
+getsharex.com
+gismeteo.ru
 google.com
 google.kz
-drive.google.com
-blogspot.com
-farmanager.com
-forum.farmanager.com
+google.ru
+googlevideo.com
+goto.kz
+iana.org
+icq.com
+imap.mail.ru
+instagram.com
+intel.com
+irr.kz
+java.com
+kaspersky.com
+kaspersky.ru
+kcell.kz
+krisha.kz
+lady.mail.ru
+lenta.ru
+libreoffice.org
+linkedin.com
+livejournal.com
+mail.google.com
+mail.ru
+microsoft.com
+mozilla.org
+mra.mail.ru
+munin-monitoring.org
+my.mail.ru
+news.bbcimg.co.uk
+news.mail.ru
+newsimg.bbc.net.uk
+nvidia.com
+odnoklassniki.ru
+ok.ru
+opencsw.org
+opendns.com
+opendns.org
+opennet.ru
+opera.com
+oracle.com
+peerbet.ru
+piriform.com
 plugring.farmanager.com
+privoxy.org
+qip.ru
+raidcall.com
+rambler.ru
+reddit.com
+ru.wikipedia.org
+shallalist.de
+skype.com
+snob.ru
+squid-cache.org
+squidclamav.darold.net
+squidguard.org
+ssl.comodo.com
+ssl.verisign.com
 symantec.com
 symantecliveupdate.com
-shalla.de
-torstatus.blutmagie.de
-torproject.org
-dnscrypt.org
-unbound.net
-getsharex.com
-skype.com
-vlc.org
-aimp.ru
-mozilla.org
-libreoffice.org
-piriform.com
-raidcall.com
-nvidia.com
-intel.com
-microsoft.com
-windowsupdate.com
-ru.wikipedia.org
-www.bbc.co.uk
+tele2.kz
 tengrinews.kz
-) do "%dig%" %%a 1>nul 2>nul
+thunderbird.com
+torproject.org
+torstatus.blutmagie.de
+translate.google.com
+unbound.net
+verisign.com
+vk.com
+vk.me
+vk.ru
+vkontakte.com
+vkontakte.ru
+vlc.org
+watsapp.net
+weather.mail.ru
+windowsupdate.com
+www.baidu.com
+www.bbc.co.uk
+www.internic.net
+www.opennet.ru
+www.topgear.com
+ya.ru
+yahoo.com
+yandex.com
+yandex.ru
+youtube.com
+ytimg.com
+) do "%dig%" %%a @%address% 1>nul 2>nul
+goto end
 
+:from_file
+echo Warming up cache from %1% file...
+%dig% -f %arg% @%address% 1>nul 2>nul 
+
+:end
 echo Saving cache...
-unbound_cache.cmd -s
+if exist unbound_cache.cmd unbound_cache.cmd -s
 echo Done.
+
+exit 0
\ No newline at end of file
diff --git a/external/unbound/contrib/warmup.sh b/external/unbound/contrib/warmup.sh
index 820f019d..b4d9135a 100644
--- a/external/unbound/contrib/warmup.sh
+++ b/external/unbound/contrib/warmup.sh
@@ -1,65 +1,150 @@
 #!/bin/sh
 
 # --------------------------------------------------------------
-# -- Warm up DNS cache script by your own MRU domains
+# -- Warm up DNS cache script by your own MRU domains or from
+# -- file when it specified as script argument.
 # --
-# -- Version 1.0
+# -- Version 1.1
 # -- By Yuri Voinov (c) 2014
 # --------------------------------------------------------------
 
+# Default DNS host address
+address="127.0.0.1"
+
+cat=`which cat`
 dig=`which dig`
 
+if [ -z "$1" ]; then
 echo "Warming up cache by MRU domains..."
-$dig -f - >/dev/null 2>&1 <<EOT
-mail.ru
-my.mail.ru
-mra.mail.ru
+$dig -f - @$address >/dev/null 2>&1 <<EOT
+2gis.ru
+admir.kz
+adobe.com
 agent.mail.ru
-news.mail.ru
-icq.com
-lenta.ru
-gazeta.ru
-peerbet.ru
-www.opennet.ru
-snob.ru
+aimp.ru
+akamai.com
+akamai.net
+almaty.tele2.kz
+aol.com
+apple.com
+arin.com
 artlebedev.ru
-mail.google.com
-translate.google.com
+auto.mail.ru
+beeline.kz
+bing.com
+blogspot.com
+clamav.net
+comodo.com
+dnscrypt.org
 drive.google.com
+drive.mail.ru
+facebook.com
+farmanager.com
+fb.com
+firefox.com
+forum.farmanager.com
+gazeta.ru
+getsharex.com
+gismeteo.ru
 google.com
 google.kz
-drive.google.com
-blogspot.com
-farmanager.com
-forum.farmanager.com
+google.ru
+googlevideo.com
+goto.kz
+iana.org
+icq.com
+imap.mail.ru
+instagram.com
+instagram.com
+intel.com
+irr.kz
+java.com
+kaspersky.com
+kaspersky.ru
+kcell.kz
+krisha.kz
+lady.mail.ru
+lenta.ru
+libreoffice.org
+linkedin.com
+livejournal.com
+mail.google.com
+mail.ru
+microsoft.com
+mozilla.org
+mra.mail.ru
+munin-monitoring.org
+my.mail.ru
+news.bbcimg.co.uk
+news.mail.ru
+newsimg.bbc.net.uk
+nvidia.com
+odnoklassniki.ru
+ok.ru
+opencsw.org
+opendns.com
+opendns.org
+opennet.ru
+opera.com
+oracle.com
+peerbet.ru
+piriform.com
 plugring.farmanager.com
+privoxy.org
+qip.ru
+raidcall.com
+rambler.ru
+reddit.com
+ru.wikipedia.org
+shallalist.de
+skype.com
+snob.ru
+squid-cache.org
+squidclamav.darold.net
+squidguard.org
+ssl.comodo.com
+ssl.verisign.com
 symantec.com
 symantecliveupdate.com
-shalla.de
-torstatus.blutmagie.de
-torproject.org
-dnscrypt.org
-unbound.net
-getsharex.com
-skype.com
-vlc.org
-aimp.ru
-mozilla.org
-libreoffice.org
-piriform.com
-raidcall.com
-nvidia.com
-intel.com
-microsoft.com
-windowsupdate.com
-ru.wikipedia.org
-www.bbc.co.uk
+tele2.kz
 tengrinews.kz
+thunderbird.com
+torproject.org
+torstatus.blutmagie.de
+translate.google.com
+unbound.net
+verisign.com
+vk.com
+vk.me
+vk.ru
+vkontakte.com
+vkontakte.ru
+vlc.org
+watsapp.net
+weather.mail.ru
+windowsupdate.com
+www.baidu.com
+www.bbc.co.uk
+www.internic.net
+www.opennet.ru
+www.topgear.com
+ya.ru
+yahoo.com
+yandex.com
+yandex.ru
+youtube.com
+ytimg.com
 EOT
+else
+ echo "Warming up cache from $1 file..."
+ $cat $1 | $dig -f - @$address >/dev/null 2>&1 
+fi
+
 echo "Done."
 
 echo "Saving cache..."
-/usr/local/bin/unbound_cache.sh -s
+script=`which unbound_cache.sh`
+[ -f "$script" ] && $script -s
 echo "Done."
 
 exit 0
diff --git a/external/unbound/daemon/cachedump.c b/external/unbound/daemon/cachedump.c
index 20a46ae4..4b0a583a 100644
--- a/external/unbound/daemon/cachedump.c
+++ b/external/unbound/daemon/cachedump.c
@@ -56,9 +56,9 @@
 #include "iterator/iter_utils.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
 
 /** dump one rrset zonefile line */
 static int
@@ -223,6 +223,8 @@ copy_msg(struct regional* region, struct lruhash_entry* e,
 	struct query_info** k, struct reply_info** d)
 {
 	struct reply_info* rep = (struct reply_info*)e->data;
+	if(rep->rrset_count > RR_COUNT_MAX)
+		return 0; /* to protect against integer overflow */
 	*d = (struct reply_info*)regional_alloc_init(region, e->data,
 		sizeof(struct reply_info) + 
 		sizeof(struct rrset_ref) * (rep->rrset_count-1) +
@@ -470,6 +472,10 @@ load_rrset(SSL* ssl, sldns_buffer* buf, struct worker* worker)
 		log_warn("bad rrset without contents");
 		return 0;
 	}
+	if(rr_count > RR_COUNT_MAX || rrsig_count > RR_COUNT_MAX) {
+		log_warn("bad rrset with too many rrs");
+		return 0;
+	}
 	d->count = (size_t)rr_count;
 	d->rrsig_count = (size_t)rrsig_count;
 	d->security = (enum sec_status)security;
@@ -646,6 +652,10 @@ load_msg(SSL* ssl, sldns_buffer* buf, struct worker* worker)
 	rep.ttl = (time_t)ttl;
 	rep.prefetch_ttl = PREFETCH_TTL_CALC(rep.ttl);
 	rep.security = (enum sec_status)security;
+	if(an > RR_COUNT_MAX || ns > RR_COUNT_MAX || ar > RR_COUNT_MAX) {
+		log_warn("error too many rrsets");
+		return 0; /* protect against integer overflow in alloc */
+	}
 	rep.an_numrrsets = (size_t)an;
 	rep.ns_numrrsets = (size_t)ns;
 	rep.ar_numrrsets = (size_t)ar;
diff --git a/external/unbound/daemon/daemon.c b/external/unbound/daemon/daemon.c
index f693a028..0cd37ae8 100644
--- a/external/unbound/daemon/daemon.c
+++ b/external/unbound/daemon/daemon.c
@@ -84,7 +84,7 @@
 #include "util/random.h"
 #include "util/tube.h"
 #include "util/net_help.h"
-#include "ldns/keyraw.h"
+#include "sldns/keyraw.h"
 #include <signal.h>
 
 /** How many quit requests happened. */
diff --git a/external/unbound/daemon/remote.c b/external/unbound/daemon/remote.c
index ff3d769d..24008bf1 100644
--- a/external/unbound/daemon/remote.c
+++ b/external/unbound/daemon/remote.c
@@ -46,6 +46,10 @@
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
 #endif
+#ifndef HEADER_DH_H
+#include <openssl/dh.h>
+#endif
+
 #include <ctype.h>
 #include "daemon/remote.h"
 #include "daemon/worker.h"
@@ -74,14 +78,17 @@
 #include "iterator/iter_delegpt.h"
 #include "services/outbound_list.h"
 #include "services/outside_network.h"
-#include "ldns/str2wire.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
-#include "ldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
+#include "sldns/sbuffer.h"
 
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -131,6 +138,41 @@ timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
 #endif
 }
 
+/*
+ * The following function was generated using the openssl utility, using
+ * the command : "openssl dhparam -dsaparam -C 512"
+ */
+#ifndef S_SPLINT_S
+DH *get_dh512()
+{
+	static unsigned char dh512_p[]={
+		0xC9,0xD7,0x05,0xDA,0x5F,0xAB,0x14,0xE8,0x11,0x56,0x77,0x85,
+		0xB1,0x24,0x2C,0x95,0x60,0xEA,0xE2,0x10,0x6F,0x0F,0x84,0xEC,
+		0xF4,0x45,0xE8,0x90,0x7A,0xA7,0x03,0xFF,0x5B,0x88,0x53,0xDE,
+		0xC4,0xDE,0xBC,0x42,0x78,0x71,0x23,0x7E,0x24,0xA5,0x5E,0x4E,
+		0xEF,0x6F,0xFF,0x5F,0xAF,0xBE,0x8A,0x77,0x62,0xB4,0x65,0x82,
+		0x7E,0xC9,0xED,0x2F,
+	};
+	static unsigned char dh512_g[]={
+		0x8D,0x3A,0x52,0xBC,0x8A,0x71,0x94,0x33,0x2F,0xE1,0xE8,0x4C,
+		0x73,0x47,0x03,0x4E,0x7D,0x40,0xE5,0x84,0xA0,0xB5,0x6D,0x10,
+		0x6F,0x90,0x43,0x05,0x1A,0xF9,0x0B,0x6A,0xD1,0x2A,0x9C,0x25,
+		0x0A,0xB9,0xD1,0x14,0xDC,0x35,0x1C,0x48,0x7C,0xC6,0x0C,0x6D,
+		0x32,0x1D,0xD3,0xC8,0x10,0xA8,0x82,0x14,0xA2,0x1C,0xF4,0x53,
+		0x23,0x3B,0x1C,0xB9,
+	};
+	DH *dh;
+
+	if ((dh=DH_new()) == NULL) return(NULL);
+	dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
+	dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
+	if ((dh->p == NULL) || (dh->g == NULL))
+	{ DH_free(dh); return(NULL); }
+	dh->length = 160;
+	return(dh);
+}
+#endif /* SPLINT */
+
 struct daemon_remote*
 daemon_remote_create(struct config_file* cfg)
 {
@@ -165,6 +207,24 @@ daemon_remote_create(struct config_file* cfg)
 		daemon_remote_delete(rc);
 		return NULL;
 	}
+
+	if (cfg->remote_control_use_cert == 0) {
+		/* No certificates are requested */
+		if(!SSL_CTX_set_cipher_list(rc->ctx, "aNULL")) {
+			log_crypto_err("Failed to set aNULL cipher list");
+			return NULL;
+		}
+
+		/* Since we have no certificates and hence no source of
+		 * DH params, let's generate and set them
+		 */
+		if(!SSL_CTX_set_tmp_dh(rc->ctx,get_dh512())) {
+			log_crypto_err("Wanted to set DH param, but failed");
+			return NULL;
+		}
+		return rc;
+	}
+	rc->use_cert = 1;
 	s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
 	s_key = fname_after_chroot(cfg->server_key_file, cfg, 1);
 	if(!s_cert || !s_key) {
@@ -241,10 +301,12 @@ void daemon_remote_delete(struct daemon_remote* rc)
  * @param nr: port nr
  * @param list: list head
  * @param noproto_is_err: if lack of protocol support is an error.
+ * @param cfg: config with username for chown of unix-sockets.
  * @return false on failure.
  */
 static int
-add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err)
+add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
+	struct config_file* cfg)
 {
 	struct addrinfo hints;
 	struct addrinfo* res;
@@ -255,29 +317,52 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err)
 	snprintf(port, sizeof(port), "%d", nr);
 	port[sizeof(port)-1]=0;
 	memset(&hints, 0, sizeof(hints));
-	hints.ai_socktype = SOCK_STREAM;
-	hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
-	if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
-#ifdef USE_WINSOCK
-		if(!noproto_is_err && r == EAI_NONAME) {
-			/* tried to lookup the address as name */
-			return 1; /* return success, but do nothing */
-		}
-#endif /* USE_WINSOCK */
-                log_err("control interface %s:%s getaddrinfo: %s %s",
-			ip?ip:"default", port, gai_strerror(r),
-#ifdef EAI_SYSTEM
-			r==EAI_SYSTEM?(char*)strerror(errno):""
+
+	if(ip[0] == '/') {
+		/* This looks like a local socket */
+		fd = create_local_accept_sock(ip, &noproto);
+		/*
+		 * Change socket ownership and permissions so users other
+		 * than root can access it provided they are in the same
+		 * group as the user we run as.
+		 */
+		if(fd != -1) {
+#ifdef HAVE_CHOWN
+			if (cfg->username && cfg->username[0] &&
+				cfg_uid != (uid_t)-1)
+				chown(ip, cfg_uid, cfg_gid);
+			chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP));
 #else
-			""
+			(void)cfg;
+#endif
+		}
+	} else {
+		hints.ai_socktype = SOCK_STREAM;
+		hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
+		if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
+#ifdef USE_WINSOCK
+			if(!noproto_is_err && r == EAI_NONAME) {
+				/* tried to lookup the address as name */
+				return 1; /* return success, but do nothing */
+			}
+#endif /* USE_WINSOCK */
+			log_err("control interface %s:%s getaddrinfo: %s %s",
+				ip?ip:"default", port, gai_strerror(r),
+#ifdef EAI_SYSTEM
+				r==EAI_SYSTEM?(char*)strerror(errno):""
+#else
+				""
 #endif
 			);
-		return 0;
+			return 0;
+		}
+
+		/* open fd */
+		fd = create_tcp_accept_sock(res, 1, &noproto, 0,
+			cfg->ip_transparent);
+		freeaddrinfo(res);
 	}
 
-	/* open fd */
-	fd = create_tcp_accept_sock(res, 1, &noproto, 0);
-	freeaddrinfo(res);
 	if(fd == -1 && noproto) {
 		if(!noproto_is_err)
 			return 1; /* return success, but do nothing */
@@ -314,7 +399,7 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
 	if(cfg->control_ifs) {
 		struct config_strlist* p;
 		for(p = cfg->control_ifs; p; p = p->next) {
-			if(!add_open(p->str, cfg->control_port, &l, 1)) {
+			if(!add_open(p->str, cfg->control_port, &l, 1, cfg)) {
 				listening_ports_free(l);
 				return NULL;
 			}
@@ -322,12 +407,12 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
 	} else {
 		/* defaults */
 		if(cfg->do_ip6 &&
-			!add_open("::1", cfg->control_port, &l, 0)) {
+			!add_open("::1", cfg->control_port, &l, 0, cfg)) {
 			listening_ports_free(l);
 			return NULL;
 		}
 		if(cfg->do_ip4 &&
-			!add_open("127.0.0.1", cfg->control_port, &l, 1)) {
+			!add_open("127.0.0.1", cfg->control_port, &l, 1, cfg)) {
 			listening_ports_free(l);
 			return NULL;
 		}
@@ -641,6 +726,8 @@ print_stats(SSL* ssl, const char* nm, struct stats_info* s)
 		(long long)avg.tv_sec, (int)avg.tv_usec)) return 0;
 	if(!ssl_printf(ssl, "%s.recursion.time.median"SQ"%g\n", nm, 
 		s->mesh_time_median)) return 0;
+	if(!ssl_printf(ssl, "%s.tcpusage"SQ"%lu\n", nm,
+		(unsigned long)s->svr.tcp_accept_usage)) return 0;
 	return 1;
 }
 
@@ -1990,7 +2077,7 @@ dump_infra_host(struct lruhash_entry* e, void* arg)
 		d->rtt.srtt, d->rtt.rttvar, rtt_notimeout(&d->rtt), d->rtt.rto,
 		d->timeout_A, d->timeout_AAAA, d->timeout_other,
 		(int)d->edns_lame_known, (int)d->edns_version,
-		(int)(a->now<d->probedelay?d->probedelay-a->now:0),
+		(int)(a->now<d->probedelay?(d->probedelay - a->now):0),
 		(int)d->isdnsseclame, (int)d->rec_lame, (int)d->lame_type_A,
 		(int)d->lame_other)) {
 		a->ssl_failed = 1;
@@ -2434,7 +2521,9 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
 	s->shake_state = rc_none;
 
 	/* once handshake has completed, check authentication */
-	if(SSL_get_verify_result(s->ssl) == X509_V_OK) {
+	if (!rc->use_cert) {
+		verbose(VERB_ALGO, "unauthenticated remote control connection");
+	} else if(SSL_get_verify_result(s->ssl) == X509_V_OK) {
 		X509* x = SSL_get_peer_certificate(s->ssl);
 		if(!x) {
 			verbose(VERB_DETAIL, "remote control connection "
diff --git a/external/unbound/daemon/remote.h b/external/unbound/daemon/remote.h
index cc670b70..b25bfb1a 100644
--- a/external/unbound/daemon/remote.h
+++ b/external/unbound/daemon/remote.h
@@ -89,6 +89,8 @@ struct daemon_remote {
 	struct worker* worker;
 	/** commpoints for accepting remote control connections */
 	struct listen_list* accept_list;
+	/* if certificates are used */
+	int use_cert;
 	/** number of active commpoints that are handling remote control */
 	int active;
 	/** max active commpoints */
diff --git a/external/unbound/daemon/stats.c b/external/unbound/daemon/stats.c
index d3f41de0..838cf05a 100644
--- a/external/unbound/daemon/stats.c
+++ b/external/unbound/daemon/stats.c
@@ -50,12 +50,13 @@
 #include "daemon/daemon.h"
 #include "services/mesh.h"
 #include "services/outside_network.h"
+#include "services/listen_dnsport.h"
 #include "util/config_file.h"
 #include "util/tube.h"
 #include "util/timehist.h"
 #include "util/net_help.h"
 #include "validator/validator.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
 #include "validator/val_kcache.h"
@@ -140,6 +141,7 @@ void
 server_stats_compile(struct worker* worker, struct stats_info* s, int reset)
 {
 	int i;
+	struct listen_list* lp;
 
 	s->svr = worker->stats;
 	s->mesh_num_states = worker->env.mesh->all.count;
@@ -174,6 +176,13 @@ server_stats_compile(struct worker* worker, struct stats_info* s, int reset)
 		s->svr.key_cache_count = count_slabhash_entries(worker->env.key_cache->slab);
 	else	s->svr.key_cache_count = 0;
 
+	/* get tcp accept usage */
+	s->svr.tcp_accept_usage = 0;
+	for(lp = worker->front->cps; lp; lp = lp->next) {
+		if(lp->com->type == comm_tcp_accept)
+			s->svr.tcp_accept_usage += lp->com->cur_tcp_count;
+	}
+
 	if(reset && !worker->env.cfg->stat_cumulative) {
 		worker_stats_clear(worker);
 	}
@@ -247,6 +256,7 @@ void server_stats_add(struct stats_info* total, struct stats_info* a)
 		total->svr.rrset_bogus += a->svr.rrset_bogus;
 		total->svr.unwanted_replies += a->svr.unwanted_replies;
 		total->svr.unwanted_queries += a->svr.unwanted_queries;
+		total->svr.tcp_accept_usage += a->svr.tcp_accept_usage;
 		for(i=0; i<STATS_QTYPE_NUM; i++)
 			total->svr.qtype[i] += a->svr.qtype[i];
 		for(i=0; i<STATS_QCLASS_NUM; i++)
diff --git a/external/unbound/daemon/stats.h b/external/unbound/daemon/stats.h
index 5ea00a0d..6985446c 100644
--- a/external/unbound/daemon/stats.h
+++ b/external/unbound/daemon/stats.h
@@ -129,6 +129,8 @@ struct server_stats {
 	size_t unwanted_replies;
 	/** unwanted traffic received on client-facing ports */
 	size_t unwanted_queries;
+	/** usage of tcp accept list */
+	size_t tcp_accept_usage;
 
 	/** histogram data exported to array 
 	 * if the array is the same size, no data is lost, and
diff --git a/external/unbound/daemon/unbound.c b/external/unbound/daemon/unbound.c
index 5ded5a96..8e07c389 100644
--- a/external/unbound/daemon/unbound.c
+++ b/external/unbound/daemon/unbound.c
@@ -443,18 +443,10 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 {
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;
-	uid_t uid;
-	gid_t gid;
-	/* initialize, but not to 0 (root) */
-	memset(&uid, 112, sizeof(uid));
-	memset(&gid, 112, sizeof(gid));
-	log_assert(cfg);
 
 	if(cfg->username && cfg->username[0]) {
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
-		uid = pwd->pw_uid;
-		gid = pwd->pw_gid;
 		/* endpwent below, in case we need pwd for setusercontext */
 	}
 #endif
@@ -511,33 +503,28 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #ifdef HAVE_KILL
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		writepid(daemon->pidfile, getpid());
-		if(!(cfg->chrootdir && cfg->chrootdir[0]) || 
-			(cfg->chrootdir && cfg->chrootdir[0] && 
-			strncmp(daemon->pidfile, cfg->chrootdir, 
-			strlen(cfg->chrootdir))==0)) {
-			/* delete of pidfile could potentially work,
-			 * chown to get permissions */
-			if(cfg->username && cfg->username[0]) {
-			  if(chown(daemon->pidfile, uid, gid) == -1) {
+		if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
+#  ifdef HAVE_CHOWN
+			if(chown(daemon->pidfile, cfg_uid, cfg_gid) == -1) {
 				log_err("cannot chown %u.%u %s: %s",
-					(unsigned)uid, (unsigned)gid,
+					(unsigned)cfg_uid, (unsigned)cfg_gid,
 					daemon->pidfile, strerror(errno));
-			  }
 			}
+#  endif /* HAVE_CHOWN */
 		}
 	}
 #else
 	(void)daemon;
-#endif
+#endif /* HAVE_KILL */
 
 	/* Set user context */
 #ifdef HAVE_GETPWNAM
-	if(cfg->username && cfg->username[0]) {
+	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
 #ifdef HAVE_SETUSERCONTEXT
 		/* setusercontext does initgroups, setuid, setgid, and
 		 * also resource limits from login config, but we
 		 * still call setresuid, setresgid to be sure to set all uid*/
-		if(setusercontext(NULL, pwd, uid, (unsigned)
+		if(setusercontext(NULL, pwd, cfg_uid, (unsigned)
 			LOGIN_SETALL & ~LOGIN_SETUSER & ~LOGIN_SETGROUP) != 0)
 			log_warn("unable to setusercontext %s: %s",
 				cfg->username, strerror(errno));
@@ -599,29 +586,29 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 
 	/* drop permissions after chroot, getpwnam, pidfile, syslog done*/
 #ifdef HAVE_GETPWNAM
-	if(cfg->username && cfg->username[0]) {
+	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
 #  ifdef HAVE_INITGROUPS
-		if(initgroups(cfg->username, gid) != 0)
+		if(initgroups(cfg->username, cfg_gid) != 0)
 			log_warn("unable to initgroups %s: %s",
 				cfg->username, strerror(errno));
 #  endif /* HAVE_INITGROUPS */
 		endpwent();
 
 #ifdef HAVE_SETRESGID
-		if(setresgid(gid,gid,gid) != 0)
+		if(setresgid(cfg_gid,cfg_gid,cfg_gid) != 0)
 #elif defined(HAVE_SETREGID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setregid(gid,gid) != 0)
+		if(setregid(cfg_gid,cfg_gid) != 0)
 #else /* use setgid */
-		if(setgid(gid) != 0)
+		if(setgid(cfg_gid) != 0)
 #endif /* HAVE_SETRESGID */
 			fatal_exit("unable to set group id of %s: %s", 
 				cfg->username, strerror(errno));
 #ifdef HAVE_SETRESUID
-		if(setresuid(uid,uid,uid) != 0)
+		if(setresuid(cfg_uid,cfg_uid,cfg_uid) != 0)
 #elif defined(HAVE_SETREUID) && !defined(DARWIN_BROKEN_SETREUID)
-		if(setreuid(uid,uid) != 0)
+		if(setreuid(cfg_uid,cfg_uid) != 0)
 #else /* use setuid */
-		if(setuid(uid) != 0)
+		if(setuid(cfg_uid) != 0)
 #endif /* HAVE_SETRESUID */
 			fatal_exit("unable to set user id of %s: %s", 
 				cfg->username, strerror(errno));
@@ -666,6 +653,8 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
 			log_warn("Continuing with default config settings");
 		}
 		apply_settings(daemon, cfg, cmdline_verbose, debug_mode);
+		if(!done_setup)
+			config_lookup_uid(cfg);
 	
 		/* prepare */
 		if(!daemon_open_shared_ports(daemon))
diff --git a/external/unbound/daemon/worker.c b/external/unbound/daemon/worker.c
index 59ae9dfc..93481354 100644
--- a/external/unbound/daemon/worker.c
+++ b/external/unbound/daemon/worker.c
@@ -71,7 +71,7 @@
 #include "validator/val_anchor.h"
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
@@ -900,7 +900,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		goto send_reply;
 	}
 	if(local_zones_answer(worker->daemon->local_zones, &qinfo, &edns, 
-		c->buffer, worker->scratchpad)) {
+		c->buffer, worker->scratchpad, repinfo)) {
 		regional_free_all(worker->scratchpad);
 		if(sldns_buffer_limit(c->buffer) == 0) {
 			comm_point_drop_reply(repinfo);
diff --git a/external/unbound/dns64/dns64.c b/external/unbound/dns64/dns64.c
index eaaa26f7..63cc8084 100644
--- a/external/unbound/dns64/dns64.c
+++ b/external/unbound/dns64/dns64.c
@@ -590,6 +590,10 @@ dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
 	 * for the RRs themselves. Each RR has a length, TTL, pointer to wireformat
 	 * data, 2 bytes of data length, and 16 bytes of IPv6 address.
 	 */
+	if(fd->count > RR_COUNT_MAX) {
+		*dd_out = NULL;
+		return; /* integer overflow protection in alloc */
+	}
 	if (!(dd = *dd_out = regional_alloc(region,
 		  sizeof(struct packed_rrset_data)
 		  + fd->count * (sizeof(size_t) + sizeof(time_t) +
@@ -713,6 +717,8 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 		if(i<rep->an_numrrsets && fk->rk.type == htons(LDNS_RR_TYPE_A)) {
 			/* also sets dk->entry.hash */
 			dns64_synth_aaaa_data(fk, fd, dk, &dd, super->region, dns64_env);
+			if(!dd)
+				return;
 			/* Delete negative AAAA record from cache stored by
 			 * the iterator module */
 			rrset_cache_remove(super->env->rrset_cache, dk->rk.dname, 
diff --git a/external/unbound/dnstap/dnstap.c b/external/unbound/dnstap/dnstap.c
index b2dc053b..b62dc5b8 100644
--- a/external/unbound/dnstap/dnstap.c
+++ b/external/unbound/dnstap/dnstap.c
@@ -39,7 +39,7 @@
 #include "config.h"
 #include <string.h>
 #include <sys/time.h>
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
 #include "util/netevent.h"
diff --git a/external/unbound/doc/Changelog b/external/unbound/doc/Changelog
index c82ae8ad..31f84c44 100644
--- a/external/unbound/doc/Changelog
+++ b/external/unbound/doc/Changelog
@@ -1,3 +1,173 @@
+26 March 2015: Wouter
+	- remote.c probedelay line is easier to read.
+	- rename ldns subdirectory to sldns to avoid name collision.
+
+25 March 2015: Wouter
+	- Fix #657:  libunbound(3) recommends deprecated
+	  CRYPTO_set_id_callback.
+	- If unknown trust anchor algorithm, and libressl is used, error
+	  message encourages upgrade of the libressl package.
+
+23 March 2015: Wouter
+	- Fix segfault on user not found at startup (from Maciej Soltysiak).
+
+20 March 2015: Wouter
+	- Fixed to add integer overflow checks on allocation (defense in depth).
+
+19 March 2015: Wouter
+	- Add ip-transparent config option for bind to non-local addresses.
+
+17 March 2015: Wouter
+	- Use reallocarray for integer overflow protection, patch submitted
+	  by Loganaden Velvindron.
+
+16 March 2015: Wouter
+	- Fixup compile on cygwin, more portable openssl thread id.
+
+12 March 2015: Wouter
+	- Updated default keylength in unbound-control-setup to 3k.
+
+10 March 2015: Wouter
+	- Fix lintian warning in unbound-checkconf man page (from Andreas
+	  Schulze).
+	- print svnroot when building windows dist.
+	- iana portlist update.
+	- Fix warning on sign compare in getentropy_linux.
+
+9 March 2015: Wouter
+	- Fix #644: harden-algo-downgrade option, if turned off, fixes the
+	  reported excessive validation failure when multiple algorithms
+	  are present.  It allows the weakest algorithm to validate the zone.
+	- iana portlist update.
+
+5 March 2015: Wouter
+	- contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
+	  scripts.  Contributed by Yuri Voinov.
+	- Document that incoming-num-tcp increase is good for large servers.
+	- stats reports tcp usage, of incoming-num-tcp buffers.
+
+4 March 2015: Wouter
+	- Patch from Brad Smith that syncs compat/getentropy_linux with
+	  OpenBSD's version (2015-03-04).
+	- 0x20 fallback improved: servfail responses do not count as missing
+	  comparisons (except if all responses are errors),
+	  inability to find nameservers does not fail equality comparisons,
+	  many nameservers does not try to compare more than max-sent-count,
+	  parse failures start 0x20 fallback procedure.
+	- store caps_response with best response in case downgrade response
+	  happens to be the last one.
+	- Document windows 8 tests.
+
+3 March 2015: Wouter
+	- tag 1.5.3rc1
+	[ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ]
+
+2 March 2015: Wouter
+	- iana portlist update.
+
+20 February 2015: Wouter
+	- Use the getrandom syscall introduced in Linux 3.17 (from Heiner
+	  Kallweit).
+	- Fix #645 Portability to Solaris 10, use AF_LOCAL.
+	- Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
+	- Fix #647 crash in 1.5.2 because pwd.db no longer accessible after
+	  reload.
+
+19 February 2015: Wouter
+	- 1.5.2 release tag.
+	- svn trunk contains 1.5.3 under development.
+
+13 February 2015: Wouter
+	- Fix #643: doc/example.conf.in: unnecessary whitespace.
+
+12 February 2015: Wouter
+	- tag 1.5.2rc1
+
+11 February 2015: Wouter
+	- iana portlist update.
+
+10 February 2015: Wouter
+	- Fix scrubber with harden-glue turned off to reject NS (and other
+	  not-address) records.
+
+9 February 2015: Wouter
+	- Fix validation failure in case upstream forwarder (ISC BIND) does
+	  not have the same trust anchors and decides to insert unsigned NS
+	  record in authority section.
+
+2 February 2015: Wouter
+	- infra-cache-min-rtt patch from Florian Riehm, for expected long
+	  uplink roundtrip times.
+
+30 January 2015: Wouter
+	- Fix 0x20 capsforid fallback to omit gratuitous NS and additional
+	  section changes.
+	- Portability fix for Solaris ('sun' is not usable for a variable).
+
+29 January 2015: Wouter
+	- Fix pyunbound byte string representation for python3.
+
+26 January 2015: Wouter
+	- Fix unintended use of gcc extension for incomplete enum types,
+	  compile with pedantic c99 compliance (from Daniel Dickman).
+
+23 January 2015: Wouter
+	- windows port fixes, no AF_LOCAL, no chown, no chmod(grp).
+
+16 January 2015: Wouter
+	- unit test for local unix connection.  Documentation and log_addr
+	  does not inspect port for AF_LOCAL.
+	- unbound-checkconf -f prints chroot with pidfile path.
+
+13 January 2015: Wouter
+	- iana portlist update.
+
+12 January 2015: Wouter
+	- Cast sun_len sizeof to socklen_t.
+	- Fix pyunbound ord call, portable for python 2 and 3.
+
+7 January 2015: Wouter
+	- Fix warnings in pythonmod changes.
+
+6 January 2015: Wouter
+	- iana portlist update.
+	- patch for remote control over local sockets, from Dag-Erling
+	  Smorgrav, Ilya Bakulin.  Use control-interface: /path/sock and
+	  control-use-cert: no.
+	- Fixup that patch and uid lookup (only for daemon).
+	- coded the default of control-use-cert, to yes.
+
+5 January 2015: Wouter
+	- getauxval test for ppc64 linux compatibility.
+	- make strip works for unbound-host and unbound-anchor.
+	- patch from Stephane Lapie that adds to the python API, that
+	  exposes struct delegpt, and adds the find_delegation function.
+	- print query name when max target count is exceeded.
+	- patch from Stuart Henderson that fixes DESTDIR in
+	  unbound-control-setup for installs where config is not in
+	  the prefix location.
+	- Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing
+	  IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne).
+	- Updated contrib warmup.cmd/sh to support two modes - load
+	  from pre-defined list of domains or (with filename as argument)
+	  load from user-specified list of domains, and updated contrib
+	  unbound_cache.sh/cmd to support loading/save/reload cache to/from
+	  default path or (with secondary argument) arbitrary path/filename,
+	  from Yuri Voinov.
+	- Patch from Philip Paeps to contrib/unbound_munin_ that uses
+	  type ABSOLUTE.  Allows munin.conf: [idleserver.example.net]
+	  unbound_munin_hits.graph_period minute
+
+9 December 2014: Wouter
+	- svn trunk has 1.5.2 in development.
+	- config.guess and config.sub update from libtoolize.
+	- local-zone: example.com inform makes unbound log a message with
+	  client IP for queries in that zone.  Eg. for finding infected hosts.
+
+8 December 2014: Wouter
+	- Fix CVE-2014-8602: denial of service by making resolver chase
+	  endless series of delegations.
+
 1 December 2014: Wouter
 	- Fix bug#632: unbound fails to build on AArch64, protects
 	  getentropy compat code from calling sysctl if it is has been removed.
diff --git a/external/unbound/doc/example.conf.in b/external/unbound/doc/example.conf.in
index 03f6184a..69b3cf39 100644
--- a/external/unbound/doc/example.conf.in
+++ b/external/unbound/doc/example.conf.in
@@ -87,6 +87,10 @@ server:
 	
 	# use SO_REUSEPORT to distribute queries over threads.
 	# so-reuseport: no
+	
+	# use IP_TRANSPARENT so the interface: addresses can be non-local
+	# and you can config non-existing IPs that are going to work later on
+	# ip-transparent: no
 
 	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
 	# is set with msg-buffer-size). 1480 can solve fragmentation (timeouts).
@@ -138,6 +142,9 @@ server:
 	# the time to live (TTL) value for cached roundtrip times, lameness and
 	# EDNS version information for hosts. In seconds.
 	# infra-host-ttl: 900
+	
+	# minimum wait time for responses, increase if uplink is long. In msec.
+	# infra-cache-min-rtt: 50
 
 	# the number of slabs to use for the Infrastructure cache.
 	# the number of slabs must be a power of 2.
@@ -281,6 +288,11 @@ server:
 	# implementation of draft-wijngaards-dnsext-resolver-side-mitigation.
 	# harden-referral-path: no
 
+	# Harden against algorithm downgrade when multiple algorithms are
+	# advertised in the DS record.  If no, allows the weakest algorithm
+	# to validate the zone.
+	# harden-algo-downgrade: yes
+
 	# Use 0x20-encoded random bits in the query to foil spoof attempts.
 	# This feature is an experimental implementation of draft dns-0x20.
 	# use-caps-for-id: no
@@ -437,7 +449,7 @@ server:
 	# the amount of memory to use for the negative cache (used for DLV).
 	# plain value in bytes or you can append k, m or G. default is "1Mb". 
 	# neg-cache-size: 1m
-	
+
 	# By default, for a number of zones a small default 'nothing here'
 	# reply is built-in.  Query traffic is thus blocked.  If you
 	# wish to serve such zone you can unblock them by uncommenting one
@@ -497,6 +509,7 @@ server:
 	# o redirect serves the zone data for any subdomain in the zone.
 	# o nodefault can be used to normally resolve AS112 zones.
 	# o typetransparent resolves normally for other types and other names
+	# o inform resolves normally, but logs client IP address
 	#
 	# defaults are localhost address, reverse for 127.0.0.1 and ::1
 	# and nxdomain for AS112 zones. If you configure one of these zones
@@ -552,6 +565,10 @@ remote-control:
 	# set up the keys and certificates with unbound-control-setup.
 	# control-enable: no
 
+	# Set to no and use an absolute path as control-interface to use
+	# a unix local named pipe for unbound-control.
+	# control-use-cert: yes
+
 	# what interfaces are listened to for remote control.
 	# give 0.0.0.0 and ::0 to listen to all interfaces.
 	# control-interface: 127.0.0.1
diff --git a/external/unbound/doc/ietf67-design-02.odp b/external/unbound/doc/ietf67-design-02.odp
index 8321b556..4be2c7d4 100644
Binary files a/external/unbound/doc/ietf67-design-02.odp and b/external/unbound/doc/ietf67-design-02.odp differ
diff --git a/external/unbound/doc/libunbound.3.in b/external/unbound/doc/libunbound.3.in
index 7f693e95..1cefbea5 100644
--- a/external/unbound/doc/libunbound.3.in
+++ b/external/unbound/doc/libunbound.3.in
@@ -175,6 +175,7 @@ to read them.
 Before you call this, use the openssl functions CRYPTO_set_id_callback and
 CRYPTO_set_locking_callback to set up asyncronous operation if you use
 lib openssl (the application calls these functions once for initialisation).
+Openssl 1.0.0 or later uses the CRYPTO_THREADID_set_callback function.
 .TP
 .B ub_ctx_delete
 Delete validation context and free associated resources.
diff --git a/external/unbound/doc/unbound-checkconf.8.in b/external/unbound/doc/unbound-checkconf.8.in
index 6d0e5451..f38049a0 100644
--- a/external/unbound/doc/unbound-checkconf.8.in
+++ b/external/unbound/doc/unbound-checkconf.8.in
@@ -13,6 +13,7 @@ unbound\-checkconf
 .SH "SYNOPSIS"
 .B unbound\-checkconf
 .RB [ \-h ]
+.RB [ \-f ]
 .RB [ \-o
 .IR option ]
 .RI [ cfgfile ]
@@ -29,6 +30,9 @@ The available options are:
 .B \-h
 Show the version and commandline option help.
 .TP
+.B \-f
+Print full pathname, with chroot applied to it.  Use with the \-o option.
+.TP
 .B \-o\fI option
 If given, after checking the config file the value of this option is 
 printed to stdout.  For "" (disabled) options an empty line is printed.
diff --git a/external/unbound/doc/unbound-control.8.in b/external/unbound/doc/unbound-control.8.in
index b050ac7b..259eee1d 100644
--- a/external/unbound/doc/unbound-control.8.in
+++ b/external/unbound/doc/unbound-control.8.in
@@ -322,6 +322,11 @@ less than this time.  Because of big outliers (usually queries to non
 responsive servers), the average can be bigger than the median.  This median
 has been calculated by interpolation from a histogram.
 .TP
+.I threadX.tcpusage
+The currently held tcp buffers for incoming connections.  A spot value on
+the time of the request.  This helps you spot if the incoming\-num\-tcp
+buffers are full.
+.TP
 .I total.num.queries
 summed over threads.
 .TP
@@ -355,6 +360,9 @@ summed over threads.
 .I total.recursion.time.median
 averaged over threads.
 .TP
+.I total.tcpusage
+summed over threads.
+.TP
 .I time.now
 current time in seconds since 1970.
 .TP
diff --git a/external/unbound/doc/unbound.conf.5.in b/external/unbound/doc/unbound.conf.5.in
index 67ff89b0..91b8b24a 100644
--- a/external/unbound/doc/unbound.conf.5.in
+++ b/external/unbound/doc/unbound.conf.5.in
@@ -164,12 +164,14 @@ By default only ports above 1024 that have not been assigned by IANA are used.
 Give a port number or a range of the form "low\-high", without spaces.
 .TP
 .B outgoing\-num\-tcp: \fI<number>
-Number of outgoing TCP buffers to allocate per thread. Default is 10. If set
-to 0, or if do\-tcp is "no", no TCP queries to authoritative servers are done.
+Number of outgoing TCP buffers to allocate per thread. Default is 10. If
+set to 0, or if do\-tcp is "no", no TCP queries to authoritative servers
+are done.  For larger installations increasing this value is a good idea.
 .TP
 .B incoming\-num\-tcp: \fI<number>
-Number of incoming TCP buffers to allocate per thread. Default is 10. If set
-to 0, or if do\-tcp is "no", no TCP queries from clients are accepted.
+Number of incoming TCP buffers to allocate per thread. Default is
+10. If set to 0, or if do\-tcp is "no", no TCP queries from clients are
+accepted. For larger installations increasing this value is a good idea.
 .TP
 .B edns\-buffer\-size: \fI<number>
 Number of bytes size to advertise as the EDNS reassembly buffer size.
@@ -265,6 +267,16 @@ it then attempts to open the port and passes the option if it was available
 at compile time, if that works it is used, if it fails, it continues
 silently (unless verbosity 3) without the option.
 .TP
+.B ip\-transparent: \fI<yes or no>
+If yes, then use IP_TRANSPARENT socket option on sockets where unbound
+is listening for incoming traffic.  Default no.  Allows you to bind to
+non\-local interfaces.  For example for non\-existant IP addresses that
+are going to exist later on, with host failover configuration.  This is
+a lot like interface\-automatic, but that one services all interfaces
+and with this option you can select which (future) interfaces unbound
+provides service on.  This option needs unbound to be started with root
+permissions on some systems.
+.TP
 .B rrset\-cache\-size: \fI<number>
 Number of bytes size of the RRset cache. Default is 4 megabytes.
 A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
@@ -301,6 +313,11 @@ by threads. Must be set to a power of 2.
 .B infra\-cache\-numhosts: \fI<number>
 Number of hosts for which information is cached. Default is 10000.
 .TP
+.B infra\-cache\-min\-rtt: \fI<msec>
+Lower limit for dynamic retransmit timeout calculation in infrastructure
+cache. Default is 50 milliseconds. Increase this value if using forwarders
+needing more time to do recursive name resolution.
+.TP
 .B do\-ip4: \fI<yes or no>
 Enable or disable whether ip4 queries are answered or issued. Default is yes.
 .TP
@@ -543,6 +560,13 @@ extra query load that is generated.  Experimental option.
 If you enable it consider adding more numbers after the target\-fetch\-policy
 to increase the max depth that is checked to.
 .TP
+.B harden\-algo\-downgrade: \fI<yes or no>
+Harden against algorithm downgrade when multiple algorithms are
+advertised in the DS record.  If no, allows the weakest algorithm to
+validate the zone.  Default is yes.  Zone signers must produce zones
+that allow this feature to work, but sometimes they do not, and turning
+this option off avoids that validation failure.
+.TP
 .B use\-caps\-for\-id: \fI<yes or no>
 Use 0x20\-encoded random bits in the query to foil spoof attempts.
 This perturbs the lowercase and uppercase of query names sent to 
@@ -791,7 +815,7 @@ data leakage about the local network to the upstream DNS servers.
 .B local\-zone: \fI<zone> <type>
 Configure a local zone. The type determines the answer to give if
 there is no match from local\-data. The types are deny, refuse, static,
-transparent, redirect, nodefault, typetransparent, and are explained
+transparent, redirect, nodefault, typetransparent, inform, and are explained
 below. After that the default settings are listed. Use local\-data: to
 enter data into the local zone. Answers for local zones are authoritative
 DNS answers. By default the zones are class IN.
@@ -841,6 +865,13 @@ local\-data: "example.com. A 127.0.0.1"
 queries for www.example.com and www.foo.example.com are redirected, so
 that users with web browsers cannot access sites with suffix example.com.
 .TP 10
+\h'5'\fIinform\fR 
+The query is answered normally.  The client IP address (@portnumber)
+is printed to the logfile.  The log message is: timestamp, unbound-pid,
+info: zonename inform IP@port queryname type class.  This option can be
+used for normal resolution, but machines looking up infected names are
+logged, eg. to run antivirus on them.
+.TP 10
 \h'5'\fInodefault\fR 
 Used to turn off default contents for AS112 zones. The other types
 also turn off default contents for the zone. The 'nodefault' option 
@@ -958,36 +989,47 @@ to setup SSLv3 / TLSv1 security for the connection.  The
 section for options.  To setup the correct self\-signed certificates use the
 \fIunbound\-control\-setup\fR(8) utility.
 .TP 5
-.B control\-enable:     \fI<yes or no>
+.B control\-enable: \fI<yes or no>
 The option is used to enable remote control, default is "no".
 If turned off, the server does not listen for control commands.
 .TP 5
-.B control\-interface: <ip address>
-Give IPv4 or IPv6 addresses to listen on for control commands.
+.B control\-interface: \fI<ip address or path>
+Give IPv4 or IPv6 addresses or local socket path to listen on for
+control commands.
 By default localhost (127.0.0.1 and ::1) is listened to.
 Use 0.0.0.0 and ::0 to listen to all interfaces.
+If you change this and permissions have been dropped, you must restart
+the server for the change to take effect.
 .TP 5
-.B control\-port: <port number>
-The port number to listen on for control commands, default is 8953.
-If you change this port number, and permissions have been dropped,
-a reload is not sufficient to open the port again, you must then restart.
+.B control\-port: \fI<port number>
+The port number to listen on for IPv4 or IPv6 control interfaces,
+default is 8953.
+If you change this and permissions have been dropped, you must restart
+the server for the change to take effect.
 .TP 5
-.B server\-key\-file: "<private key file>"
+.B control\-use\-cert: \fI<yes or no>
+Whether to require certificate authentication of control connections.
+The default is "yes".
+This should not be changed unless there are other mechanisms in place
+to prevent untrusted users from accessing the remote control
+interface.
+.TP 5
+.B server\-key\-file: \fI<private key file>
 Path to the server private key, by default unbound_server.key.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
 This file is used by the unbound server, but not by \fIunbound\-control\fR.
 .TP 5
-.B server\-cert\-file: "<certificate file.pem>"
+.B server\-cert\-file: \fI<certificate file.pem>
 Path to the server self signed certificate, by default unbound_server.pem.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
 This file is used by the unbound server, and also by \fIunbound\-control\fR.
 .TP 5
-.B control\-key\-file: "<private key file>"
+.B control\-key\-file: \fI<private key file>
 Path to the control client private key, by default unbound_control.key.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
 This file is used by \fIunbound\-control\fR.
 .TP 5
-.B control\-cert\-file: "<certificate file.pem>"
+.B control\-cert\-file: \fI<certificate file.pem>
 Path to the control client certificate, by default unbound_control.pem.
 This certificate has to be signed with the server certificate.
 This file is generated by the \fIunbound\-control\-setup\fR utility.
diff --git a/external/unbound/iterator/iter_delegpt.c b/external/unbound/iterator/iter_delegpt.c
index b212ec07..0e251ff5 100644
--- a/external/unbound/iterator/iter_delegpt.c
+++ b/external/unbound/iterator/iter_delegpt.c
@@ -47,8 +47,8 @@
 #include "util/data/packed_rrset.h"
 #include "util/data/msgreply.h"
 #include "util/net_help.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
 
 struct delegpt* 
 delegpt_create(struct regional* region)
diff --git a/external/unbound/iterator/iter_fwd.c b/external/unbound/iterator/iter_fwd.c
index 01212124..0feee032 100644
--- a/external/unbound/iterator/iter_fwd.c
+++ b/external/unbound/iterator/iter_fwd.c
@@ -46,8 +46,8 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "ldns/rrdef.h"
-#include "ldns/str2wire.h"
+#include "sldns/rrdef.h"
+#include "sldns/str2wire.h"
 
 int
 fwd_cmp(const void* k1, const void* k2)
diff --git a/external/unbound/iterator/iter_hints.c b/external/unbound/iterator/iter_hints.c
index 57b57c2e..25cae072 100644
--- a/external/unbound/iterator/iter_hints.c
+++ b/external/unbound/iterator/iter_hints.c
@@ -46,9 +46,9 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "ldns/rrdef.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 struct iter_hints* 
 hints_create(void)
diff --git a/external/unbound/iterator/iter_priv.c b/external/unbound/iterator/iter_priv.c
index 9e09a84b..90bea174 100644
--- a/external/unbound/iterator/iter_priv.c
+++ b/external/unbound/iterator/iter_priv.c
@@ -49,8 +49,8 @@
 #include "util/data/msgparse.h"
 #include "util/net_help.h"
 #include "util/storage/dnstree.h"
-#include "ldns/str2wire.h"
-#include "ldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/sbuffer.h"
 
 struct iter_priv* priv_create(void)
 {
diff --git a/external/unbound/iterator/iter_resptype.c b/external/unbound/iterator/iter_resptype.c
index 45f91938..f146a2b6 100644
--- a/external/unbound/iterator/iter_resptype.c
+++ b/external/unbound/iterator/iter_resptype.c
@@ -45,8 +45,8 @@
 #include "services/cache/dns.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "ldns/rrdef.h"
-#include "ldns/pkthdr.h"
+#include "sldns/rrdef.h"
+#include "sldns/pkthdr.h"
 
 enum response_type 
 response_type_from_cache(struct dns_msg* msg, 
diff --git a/external/unbound/iterator/iter_scrub.c b/external/unbound/iterator/iter_scrub.c
index b2248bc0..e9db1948 100644
--- a/external/unbound/iterator/iter_scrub.c
+++ b/external/unbound/iterator/iter_scrub.c
@@ -53,7 +53,7 @@
 #include "util/data/dname.h"
 #include "util/data/msgreply.h"
 #include "util/alloc.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** RRset flag used during scrubbing. The RRset is OK. */
 #define RRSET_SCRUB_OK	0x80
@@ -680,7 +680,9 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				 * (we dont want its glue that was approved
 				 * during the normalize action) */
 				del_addi = 1;
-			} else if(!env->cfg->harden_glue) {
+			} else if(!env->cfg->harden_glue && (
+				rrset->type == LDNS_RR_TYPE_A ||
+				rrset->type == LDNS_RR_TYPE_AAAA)) {
 				/* store in cache! Since it is relevant
 				 * (from normalize) it will be picked up 
 				 * from the cache to be used later */
diff --git a/external/unbound/iterator/iter_utils.c b/external/unbound/iterator/iter_utils.c
index 9d0aa698..5ec5752b 100644
--- a/external/unbound/iterator/iter_utils.c
+++ b/external/unbound/iterator/iter_utils.c
@@ -64,7 +64,7 @@
 #include "validator/val_kentry.h"
 #include "validator/val_utils.h"
 #include "validator/val_sigcrypt.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** time when nameserver glue is said to be 'recent' */
 #define SUSPICION_RECENT_EXPIRY 86400
@@ -714,6 +714,48 @@ reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region)
 	return 1;
 }
 
+void 
+caps_strip_reply(struct reply_info* rep)
+{
+	size_t i;
+	if(!rep) return;
+	/* see if message is a referral, in which case the additional and
+	 * NS record cannot be removed */
+	/* referrals have the AA flag unset (strict check, not elsewhere in
+	 * unbound, but for 0x20 this is very convenient). */
+	if(!(rep->flags&BIT_AA))
+		return;
+	/* remove the additional section from the reply */
+	if(rep->ar_numrrsets != 0) {
+		verbose(VERB_ALGO, "caps fallback: removing additional section");
+		rep->rrset_count -= rep->ar_numrrsets;
+		rep->ar_numrrsets = 0;
+	}
+	/* is there an NS set in the authority section to remove? */
+	/* the failure case (Cisco firewalls) only has one rrset in authsec */
+	for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
+		struct ub_packed_rrset_key* s = rep->rrsets[i];
+		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS) {
+			/* remove NS rrset and break from loop (loop limits
+			 * have changed) */
+			/* move last rrset into this position (there is no
+			 * additional section any more) */
+			verbose(VERB_ALGO, "caps fallback: removing NS rrset");
+			if(i < rep->rrset_count-1)
+				rep->rrsets[i]=rep->rrsets[rep->rrset_count-1];
+			rep->rrset_count --;
+			rep->ns_numrrsets --;
+			break;
+		}
+	}
+}
+
+int caps_failed_rcode(struct reply_info* rep)
+{
+	return !(FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR ||
+		FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN);
+}
+
 void 
 iter_store_parentside_rrset(struct module_env* env, 
 	struct ub_packed_rrset_key* rrset)
diff --git a/external/unbound/iterator/iter_utils.h b/external/unbound/iterator/iter_utils.h
index d7c2b68a..3a4df3e4 100644
--- a/external/unbound/iterator/iter_utils.h
+++ b/external/unbound/iterator/iter_utils.h
@@ -222,6 +222,23 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
  */
 int reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region);
 
+/**
+ * Remove unused bits from the reply if possible.
+ * So that caps-for-id (0x20) fallback is more likely to be successful.
+ * This removes like, the additional section, and NS record in the authority
+ * section if those records are gratuitous (not for a referral).
+ * @param rep: the reply to strip stuff out of.
+ */
+void caps_strip_reply(struct reply_info* rep);
+
+/**
+ * see if reply has a 'useful' rcode for capsforid comparison, so
+ * not SERVFAIL or REFUSED, and thus NOERROR or NXDOMAIN.
+ * @param rep: reply to check.
+ * @return true if the rcode is a bad type of message.
+ */
+int caps_failed_rcode(struct reply_info* rep);
+
 /**
  * Store parent-side rrset in seperate rrset cache entries for later 
  * last-resort * lookups in case the child-side versions of this information 
diff --git a/external/unbound/iterator/iterator.c b/external/unbound/iterator/iterator.c
index 843948a2..02de86e1 100644
--- a/external/unbound/iterator/iterator.c
+++ b/external/unbound/iterator/iterator.c
@@ -61,10 +61,10 @@
 #include "util/data/msgencode.h"
 #include "util/fptr_wlist.h"
 #include "util/config_file.h"
-#include "ldns/rrdef.h"
-#include "ldns/wire2str.h"
-#include "ldns/parseutil.h"
-#include "ldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/wire2str.h"
+#include "sldns/parseutil.h"
+#include "sldns/sbuffer.h"
 
 int 
 iter_init(struct module_env* env, int id)
@@ -120,6 +120,7 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->query_restart_count = 0;
 	iq->referral_count = 0;
 	iq->sent_count = 0;
+	iq->target_count = NULL;
 	iq->wait_priming_stub = 0;
 	iq->refetch_glue = 0;
 	iq->dnssec_expected = 0;
@@ -307,6 +308,8 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 	if(num_an + num_ns == 0)
 		return 1;
 	verbose(VERB_ALGO, "prepending %d rrsets", (int)num_an + (int)num_ns);
+	if(num_an > RR_COUNT_MAX || num_ns > RR_COUNT_MAX ||
+		msg->rep->rrset_count > RR_COUNT_MAX) return 0; /* overflow */
 	sets = regional_alloc(region, (num_an+num_ns+msg->rep->rrset_count) *
 		sizeof(struct ub_packed_rrset_key*));
 	if(!sets) 
@@ -454,6 +457,26 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 1;
 }
 
+/** create target count structure for this query */
+static void
+target_count_create(struct iter_qstate* iq)
+{
+	if(!iq->target_count) {
+		iq->target_count = (int*)calloc(2, sizeof(int));
+		/* if calloc fails we simply do not track this number */
+		if(iq->target_count)
+			iq->target_count[0] = 1;
+	}
+}
+
+static void
+target_count_increase(struct iter_qstate* iq, int num)
+{
+	target_count_create(iq);
+	if(iq->target_count)
+		iq->target_count[1] += num;
+}
+
 /**
  * Generate a subrequest.
  * Generate a local request event. Local events are tied to this module, and
@@ -529,6 +552,10 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq = (struct iter_qstate*)subq->minfo[id];
 		memset(subiq, 0, sizeof(*subiq));
 		subiq->num_target_queries = 0;
+		target_count_create(iq);
+		subiq->target_count = iq->target_count;
+		if(iq->target_count)
+			iq->target_count[0] ++; /* extra reference */
 		subiq->num_current_queries = 0;
 		subiq->depth = iq->depth+1;
 		outbound_list_init(&subiq->outlist);
@@ -1356,6 +1383,14 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	if(iq->depth == ie->max_dependency_depth)
 		return 0;
+	if(iq->depth > 0 && iq->target_count &&
+		iq->target_count[1] > MAX_TARGET_COUNT) {
+		char s[LDNS_MAX_DOMAINLEN+1];
+		dname_str(qstate->qinfo.qname, s);
+		verbose(VERB_QUERY, "request %s has exceeded the maximum "
+			"number of glue fetches %d", s, iq->target_count[1]);
+		return 0;
+	}
 
 	iter_mark_cycle_targets(qstate, iq->dp);
 	missing = (int)delegpt_count_missing_targets(iq->dp);
@@ -1538,6 +1573,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += qs;
+		target_count_increase(iq, qs);
 		if(qs != 0) {
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0; /* and wait for them */
@@ -1547,6 +1583,14 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "maxdepth and need more nameservers, fail");
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
+	if(iq->depth > 0 && iq->target_count &&
+		iq->target_count[1] > MAX_TARGET_COUNT) {
+		char s[LDNS_MAX_DOMAINLEN+1];
+		dname_str(qstate->qinfo.qname, s);
+		verbose(VERB_QUERY, "request %s has exceeded the maximum "
+			"number of glue fetches %d", s, iq->target_count[1]);
+		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
+	}
 	/* mark cycle targets for parent-side lookups */
 	iter_mark_pside_cycle_targets(qstate, iq->dp);
 	/* see if we can issue queries to get nameserver addresses */
@@ -1576,6 +1620,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(query_count != 0) { /* suspend to await results */
 			verbose(VERB_ALGO, "try parent-side glue lookup");
 			iq->num_target_queries += query_count;
+			target_count_increase(iq, query_count);
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0;
 		}
@@ -1731,6 +1776,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += extra;
+		target_count_increase(iq, extra);
 		if(iq->num_target_queries > 0) {
 			/* wait to get all targets, we want to try em */
 			verbose(VERB_ALGO, "wait for all targets for fallback");
@@ -1743,11 +1789,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * the original query is one that matched too, so we have
 		 * caps_server+1 number of matching queries now */
 		if(iq->caps_server+1 >= naddr*3 ||
-			iq->caps_server+1 >= MAX_SENT_COUNT) {
+			iq->caps_server*2+2 >= MAX_SENT_COUNT) {
+			/* *2 on sentcount check because ipv6 may fail */
 			/* we're done, process the response */
 			verbose(VERB_ALGO, "0x20 fallback had %d responses "
 				"match for %d wanted, done.", 
 				(int)iq->caps_server+1, (int)naddr*3);
+			iq->response = iq->caps_response;
 			iq->caps_fallback = 0;
 			iter_dec_attempts(iq->dp, 3); /* space for fallback */
 			iq->num_current_queries++; /* RespState decrements it*/
@@ -1771,6 +1819,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* errors ignored, these targets are not strictly necessary for
 		 * this result, we do not have to reply with SERVFAIL */
 		iq->num_target_queries += extra;
+		target_count_increase(iq, extra);
 	}
 
 	/* Add the current set of unused targets to our queue. */
@@ -1816,10 +1865,29 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 					return 1;
 				}
 				iq->num_target_queries += qs;
+				target_count_increase(iq, qs);
 			}
 			/* Since a target query might have been made, we 
 			 * need to check again. */
 			if(iq->num_target_queries == 0) {
+				/* if in capsforid fallback, instead of last
+				 * resort, we agree with the current reply
+				 * we have (if any) (our count of addrs bad)*/
+				if(iq->caps_fallback && iq->caps_reply) {
+					/* we're done, process the response */
+					verbose(VERB_ALGO, "0x20 fallback had %d responses, "
+						"but no more servers except "
+						"last resort, done.", 
+						(int)iq->caps_server+1);
+					iq->response = iq->caps_response;
+					iq->caps_fallback = 0;
+					iter_dec_attempts(iq->dp, 3); /* space for fallback */
+					iq->num_current_queries++; /* RespState decrements it*/
+					iq->referral_count++; /* make sure we don't loop */
+					iq->sent_count = 0;
+					iq->state = QUERY_RESP_STATE;
+					return 1;
+				}
 				return processLastResort(qstate, iq, ie, id);
 			}
 		}
@@ -2483,6 +2551,12 @@ processClassResponse(struct module_qstate* qstate, int id,
 			/* copy appropriate rcode */
 			to->rep->flags = from->rep->flags;
 			/* copy rrsets */
+			if(from->rep->rrset_count > RR_COUNT_MAX ||
+				to->rep->rrset_count > RR_COUNT_MAX) {
+				log_err("malloc failed (too many rrsets) in collect ANY"); 
+				foriq->state = FINISHED_STATE;
+				return; /* integer overflow protection */
+			}
 			dest = regional_alloc(forq->region, sizeof(dest[0])*n);
 			if(!dest) {
 				log_err("malloc failed in collect ANY"); 
@@ -2779,6 +2853,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->caps_fallback = 1;
 			iq->caps_server = 0;
 			iq->caps_reply = NULL;
+			iq->caps_response = NULL;
 			iq->state = QUERYTARGETS_STATE;
 			iq->num_current_queries--;
 			/* need fresh attempts for the 0x20 fallback, if
@@ -2821,8 +2896,19 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* normalize and sanitize: easy to delete items from linked lists */
 	if(!scrub_message(pkt, prs, &iq->qchase, iq->dp->name, 
-		qstate->env->scratch, qstate->env, ie))
+		qstate->env->scratch, qstate->env, ie)) {
+		/* if 0x20 enabled, start fallback, but we have no message */
+		if(event == module_event_capsfail && !iq->caps_fallback) {
+			iq->caps_fallback = 1;
+			iq->caps_server = 0;
+			iq->caps_reply = NULL;
+			iq->caps_response = NULL;
+			iq->state = QUERYTARGETS_STATE;
+			iq->num_current_queries--;
+			verbose(VERB_DETAIL, "Capsforid: scrub failed, starting fallback with no response");
+		}
 		goto handle_it;
+	}
 
 	/* allocate response dns_msg in region */
 	iq->response = dns_alloc_msg(pkt, prs, qstate->region);
@@ -2836,11 +2922,15 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->response->rep);
 	
 	if(event == module_event_capsfail || iq->caps_fallback) {
+		/* for fallback we care about main answer, not additionals */
+		/* removing that makes comparison more likely to succeed */
+		caps_strip_reply(iq->response->rep);
 		if(!iq->caps_fallback) {
 			/* start fallback */
 			iq->caps_fallback = 1;
 			iq->caps_server = 0;
 			iq->caps_reply = iq->response->rep;
+			iq->caps_response = iq->response;
 			iq->state = QUERYTARGETS_STATE;
 			iq->num_current_queries--;
 			verbose(VERB_DETAIL, "Capsforid: starting fallback");
@@ -2849,8 +2939,24 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* check if reply is the same, otherwise, fail */
 			if(!iq->caps_reply) {
 				iq->caps_reply = iq->response->rep;
+				iq->caps_response = iq->response;
 				iq->caps_server = -1; /*become zero at ++,
 				so that we start the full set of trials */
+			} else if(caps_failed_rcode(iq->caps_reply) &&
+				!caps_failed_rcode(iq->response->rep)) {
+				/* prefer to upgrade to non-SERVFAIL */
+				iq->caps_reply = iq->response->rep;
+				iq->caps_response = iq->response;
+			} else if(!caps_failed_rcode(iq->caps_reply) &&
+				caps_failed_rcode(iq->response->rep)) {
+				/* if we have non-SERVFAIL as answer then 
+				 * we can ignore SERVFAILs for the equality
+				 * comparison */
+				/* no instructions here, skip other else */
+			} else if(caps_failed_rcode(iq->caps_reply) &&
+				caps_failed_rcode(iq->response->rep)) {
+				/* failure is same as other failure in fallbk*/
+				/* no instructions here, skip other else */
 			} else if(!reply_equal(iq->response->rep, iq->caps_reply,
 				qstate->env->scratch)) {
 				verbose(VERB_DETAIL, "Capsforid fallback: "
@@ -2928,6 +3034,8 @@ iter_clear(struct module_qstate* qstate, int id)
 	iq = (struct iter_qstate*)qstate->minfo[id];
 	if(iq) {
 		outbound_list_clear(&iq->outlist);
+		if(iq->target_count && --iq->target_count[0] == 0)
+			free(iq->target_count);
 		iq->num_current_queries = 0;
 	}
 	qstate->minfo[id] = NULL;
diff --git a/external/unbound/iterator/iterator.h b/external/unbound/iterator/iterator.h
index 0b91760d..cb8043fd 100644
--- a/external/unbound/iterator/iterator.h
+++ b/external/unbound/iterator/iterator.h
@@ -52,6 +52,8 @@ struct iter_donotq;
 struct iter_prep_list;
 struct iter_priv;
 
+/** max number of targets spawned for a query and its subqueries */
+#define MAX_TARGET_COUNT	32
 /** max number of query restarts. Determines max number of CNAME chain. */
 #define MAX_RESTART_COUNT       8
 /** max number of referrals. Makes sure resolver does not run away */
@@ -233,6 +235,7 @@ struct iter_qstate {
 	/** state for capsfail: stored query for comparisons. Can be NULL if
 	 * no response had been seen prior to starting the fallback. */
 	struct reply_info* caps_reply;
+	struct dns_msg* caps_response;
 
 	/** Current delegation message - returned for non-RD queries */
 	struct dns_msg* deleg_msg;
@@ -251,6 +254,10 @@ struct iter_qstate {
 
 	/** number of queries fired off */
 	int sent_count;
+	
+	/** number of target queries spawned in [1], for this query and its
+	 * subqueries, the malloced-array is shared, [0] refcount. */
+	int* target_count;
 
 	/**
 	 * The query must store NS records from referrals as parentside RRs
diff --git a/external/unbound/libunbound/context.c b/external/unbound/libunbound/context.c
index c21f9418..4469b5bb 100644
--- a/external/unbound/libunbound/context.c
+++ b/external/unbound/libunbound/context.c
@@ -49,7 +49,7 @@
 #include "services/cache/infra.h"
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 int 
 context_finalize(struct ub_ctx* ctx)
@@ -360,7 +360,7 @@ context_serialize_cancel(struct ctx_query* q, uint32_t* len)
 	/* format of cancel:
 	 * 	o uint32 cmd
 	 * 	o uint32 async-id */
-	uint8_t* p = (uint8_t*)malloc(2*sizeof(uint32_t));
+	uint8_t* p = (uint8_t*)reallocarray(NULL, sizeof(uint32_t), 2);
 	if(!p) return NULL;
 	*len = 2*sizeof(uint32_t);
 	sldns_write_uint32(p, UB_LIBCMD_CANCEL);
diff --git a/external/unbound/libunbound/libunbound.c b/external/unbound/libunbound/libunbound.c
index 91a663a7..eff27de1 100644
--- a/external/unbound/libunbound/libunbound.c
+++ b/external/unbound/libunbound/libunbound.c
@@ -61,7 +61,7 @@
 #include "services/localzone.h"
 #include "services/cache/infra.h"
 #include "services/cache/rrset.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #ifdef HAVE_PTHREAD
 #include <signal.h>
 #endif
diff --git a/external/unbound/libunbound/libworker.c b/external/unbound/libunbound/libworker.c
index e388e795..72b61531 100644
--- a/external/unbound/libunbound/libworker.c
+++ b/external/unbound/libunbound/libworker.c
@@ -70,8 +70,8 @@
 #include "util/tube.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
 
 /** handle new query command for bg worker */
 static void handle_newq(struct libworker* w, uint8_t* buf, uint32_t len);
@@ -606,7 +606,7 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
+		w->back->udp_buff, w->env->scratch, NULL)) {
 		regional_free_all(w->env->scratch);
 		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
 			w->back->udp_buff, sec_status_insecure, NULL);
@@ -676,7 +676,7 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
+		w->back->udp_buff, w->env->scratch, NULL)) {
 		regional_free_all(w->env->scratch);
 		free(qinfo.qname);
 		libworker_event_done_cb(q, LDNS_RCODE_NOERROR,
@@ -796,7 +796,7 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(w->ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch)) {
+		w->back->udp_buff, w->env->scratch, NULL)) {
 		regional_free_all(w->env->scratch);
 		q->msg_security = sec_status_insecure;
 		add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL);
diff --git a/external/unbound/libunbound/python/libunbound.i b/external/unbound/libunbound/python/libunbound.i
index 313c7486..1bef79f2 100644
--- a/external/unbound/libunbound/python/libunbound.i
+++ b/external/unbound/libunbound/python/libunbound.i
@@ -44,6 +44,10 @@
 
 %pythoncode %{
    import encodings.idna
+   try:
+       import builtins
+   except ImportError:
+       import __builtin__ as builtins
 
    # Ensure compatibility with older python versions
    if 'bytes' not in vars():
@@ -52,7 +56,7 @@
    def ord(s):
        if isinstance(s, int):
            return s
-       return __builtins__.ord(s)
+       return builtins.ord(s)
 %}
 
 //%include "doc.i"
@@ -699,7 +703,7 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
          while (idx < slen):
             complen = ord(s[idx])
             # In python 3.x `str()` converts the string to unicode which is the expected text string type
-            res.append(str(s[idx+1:idx+1+complen]))
+            res.append(str(s[idx+1:idx+1+complen].decode()))
             idx += complen + 1
 
          return res
diff --git a/external/unbound/libunbound/worker.h b/external/unbound/libunbound/worker.h
index 824012a0..a5315019 100644
--- a/external/unbound/libunbound/worker.h
+++ b/external/unbound/libunbound/worker.h
@@ -42,7 +42,7 @@
 #ifndef LIBUNBOUND_WORKER_H
 #define LIBUNBOUND_WORKER_H
 
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "util/data/packed_rrset.h" /* for enum sec_status */
 struct comm_reply;
 struct comm_point;
diff --git a/external/unbound/makedist.sh b/external/unbound/makedist.sh
index 6ece3260..f0601766 100755
--- a/external/unbound/makedist.sh
+++ b/external/unbound/makedist.sh
@@ -232,6 +232,7 @@ if [ "$DOWIN" = "yes" ]; then
 		cd ..
 	fi
 
+        info "SVNROOT  is $SVNROOT"
 	info "Exporting source from SVN."
 	svn export "$SVNROOT" unbound || error_cleanup "SVN command failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from SVN"
diff --git a/external/unbound/pythonmod/interface.i b/external/unbound/pythonmod/interface.i
index 4f1a25f2..b2dd0890 100644
--- a/external/unbound/pythonmod/interface.i
+++ b/external/unbound/pythonmod/interface.i
@@ -26,6 +26,9 @@
    #include "util/storage/lruhash.h"
    #include "services/cache/dns.h"
    #include "services/mesh.h"
+   #include "iterator/iter_delegpt.h"
+   #include "iterator/iter_hints.h"
+   #include "iterator/iter_utils.h"
    #include "ldns/wire2str.h"
    #include "ldns/str2wire.h"
    #include "ldns/pkthdr.h"
@@ -671,6 +674,99 @@ struct config_file {
    char* python_script;
 };
 
+/* ************************************************************************************ * 
+   ASN: Adding structures related to forwards_lookup and dns_cache_find_delegation
+ * ************************************************************************************ */
+struct delegpt_ns {
+    struct delegpt_ns* next;
+    int resolved;
+    uint8_t got4;
+    uint8_t got6;
+    uint8_t lame;
+    uint8_t done_pside4;
+    uint8_t done_pside6;
+};
+
+struct delegpt_addr {
+    struct delegpt_addr* next_result;
+    struct delegpt_addr* next_usable;
+    struct delegpt_addr* next_target;
+    int attempts;
+    int sel_rtt;
+    int bogus;
+    int lame;
+};
+
+struct delegpt {
+    int namelabs;
+    struct delegpt_ns* nslist;
+    struct delegpt_addr* target_list;
+    struct delegpt_addr* usable_list;
+    struct delegpt_addr* result_list;
+    int bogus;
+    uint8_t has_parent_side_NS;
+    uint8_t dp_type_mlc;
+};
+
+
+%inline %{
+   PyObject* _get_dp_dname(struct delegpt* dp) {
+      return PyString_FromStringAndSize((char*)dp->name, dp->namelen);
+   } 
+   PyObject* _get_dp_dname_components(struct delegpt* dp) {
+      return GetNameAsLabelList((char*)dp->name, dp->namelen);
+   }
+   PyObject* _get_dpns_dname(struct delegpt_ns* dpns) {
+      return PyString_FromStringAndSize((char*)dpns->name, dpns->namelen);
+   }
+   PyObject* _get_dpns_dname_components(struct delegpt_ns* dpns) {
+      return GetNameAsLabelList((char*)dpns->name, dpns->namelen);
+   }
+
+  PyObject* _delegpt_addr_addr_get(struct delegpt_addr* target) {
+     char dest[64];
+     delegpt_addr_addr2str(target, dest, 64);
+     if (dest[0] == 0)
+        return Py_None;
+     return PyString_FromString(dest);
+  }
+
+%}
+
+%extend delegpt {
+   %pythoncode %{
+        __swig_getmethods__["dname"] = _unboundmodule._get_dp_dname
+        if _newclass:dname = _swig_property(_unboundmodule._get_dp_dname)
+
+        __swig_getmethods__["dname_list"] = _unboundmodule._get_dp_dname_components
+        if _newclass:dname_list = _swig_property(_unboundmodule._get_dp_dname_components)
+
+        def _get_dname_str(self): return dnameAsStr(self.dname)
+        __swig_getmethods__["dname_str"] = _get_dname_str
+        if _newclass:dname_str = _swig_property(_get_dname_str)
+   %}
+}
+%extend delegpt_ns {
+   %pythoncode %{
+        __swig_getmethods__["dname"] = _unboundmodule._get_dpns_dname
+        if _newclass:dname = _swig_property(_unboundmodule._get_dpns_dname)
+
+        __swig_getmethods__["dname_list"] = _unboundmodule._get_dpns_dname_components
+        if _newclass:dname_list = _swig_property(_unboundmodule._get_dpns_dname_components)
+
+        def _get_dname_str(self): return dnameAsStr(self.dname)
+        __swig_getmethods__["dname_str"] = _get_dname_str
+        if _newclass:dname_str = _swig_property(_get_dname_str)
+   %}
+}
+%extend delegpt_addr {
+   %pythoncode %{
+        def _addr_get(self): return _delegpt_addr_addr_get(self)
+        __swig_getmethods__["addr"] = _addr_get
+        if _newclass:addr = _swig_property(_addr_get)
+   %}
+}
+
 /* ************************************************************************************ * 
    Enums
  * ************************************************************************************ */
@@ -879,6 +975,65 @@ int set_return_msg(struct module_qstate* qstate,
             return status 
 
 %}
+/* ************************************************************************************ * 
+   ASN: Delegation pointer related functions
+ * ************************************************************************************ */
+
+/* Functions which we will need to lookup delegations */
+struct delegpt* dns_cache_find_delegation(struct module_env* env,
+        uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
+        struct regional* region, struct dns_msg** msg, uint32_t timenow);
+int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
+        struct delegpt* dp);
+struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints,
+        uint8_t* qname, uint16_t qclass, struct delegpt* dp);
+
+/* Custom function to perform logic similar to the one in daemon/cachedump.c */
+struct delegpt* find_delegation(struct module_qstate* qstate, char *nm, size_t nmlen);
+
+%{
+#define BIT_RD 0x100
+
+struct delegpt* find_delegation(struct module_qstate* qstate, char *nm, size_t nmlen)
+{
+    struct delegpt *dp;
+    struct dns_msg *msg = NULL;
+    struct regional* region = qstate->env->scratch;
+    char b[260];
+    struct query_info qinfo;
+    struct iter_hints_stub* stub;
+    uint32_t timenow = *qstate->env->now;
+
+    regional_free_all(region);
+    qinfo.qname = (uint8_t*)nm;
+    qinfo.qname_len = nmlen;
+    qinfo.qtype = LDNS_RR_TYPE_A;
+    qinfo.qclass = LDNS_RR_CLASS_IN;
+
+    while(1) {
+        dp = dns_cache_find_delegation(qstate->env, (uint8_t*)nm, nmlen, qinfo.qtype, qinfo.qclass, region, &msg, timenow);
+        if(!dp)
+            return NULL;
+        if(iter_dp_is_useless(&qinfo, BIT_RD, dp)) {
+            if (dname_is_root((uint8_t*)nm))
+                return NULL;
+            nm = (char*)dp->name;
+            nmlen = dp->namelen;
+            dname_remove_label((uint8_t**)&nm, &nmlen);
+            dname_str((uint8_t*)nm, b);
+            continue;
+        }
+        stub = hints_lookup_stub(qstate->env->hints, qinfo.qname, qinfo.qclass, dp);
+        if (stub) {
+            return stub->dp;
+        } else {
+            return dp;
+        }
+    }
+    return NULL;
+}
+%}
+
 /* ************************************************************************************ * 
    Functions
  * ************************************************************************************ */
diff --git a/external/unbound/pythonmod/pythonmod.c b/external/unbound/pythonmod/pythonmod.c
index 359eea0c..190d41a8 100644
--- a/external/unbound/pythonmod/pythonmod.c
+++ b/external/unbound/pythonmod/pythonmod.c
@@ -45,7 +45,7 @@
 #endif
 
 #include "config.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 #undef _POSIX_C_SOURCE
 #undef _XOPEN_SOURCE
diff --git a/external/unbound/pythonmod/pythonmod_utils.c b/external/unbound/pythonmod/pythonmod_utils.c
index 1091dcf1..5120074e 100644
--- a/external/unbound/pythonmod/pythonmod_utils.c
+++ b/external/unbound/pythonmod/pythonmod_utils.c
@@ -48,7 +48,8 @@
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
 #include "util/regional.h"
-#include "ldns/sbuffer.h"
+#include "iterator/iter_delegpt.h"
+#include "sldns/sbuffer.h"
 
 #undef _POSIX_C_SOURCE
 #undef _XOPEN_SOURCE
@@ -176,3 +177,17 @@ void reply_addr2str(struct comm_reply* reply, char* dest, int maxlen)
 	   return;
 	dest[maxlen-1] = 0;
 }
+
+/* Convert target->addr to string */
+void delegpt_addr_addr2str(struct delegpt_addr* target, char *dest, int maxlen)
+{
+	int af = (int)((struct sockaddr_in*) &(target->addr))->sin_family;
+	void* sinaddr = &((struct sockaddr_in*) &(target->addr))->sin_addr;
+
+	if(af == AF_INET6)
+		sinaddr = &((struct sockaddr_in6*)&(target->addr))->sin6_addr;
+	dest[0] = 0;
+	if (inet_ntop(af, sinaddr, dest, (socklen_t)maxlen) == 0)
+	   return;
+	dest[maxlen-1] = 0;
+}
diff --git a/external/unbound/pythonmod/pythonmod_utils.h b/external/unbound/pythonmod/pythonmod_utils.h
index a901f391..768eb46d 100644
--- a/external/unbound/pythonmod/pythonmod_utils.h
+++ b/external/unbound/pythonmod/pythonmod_utils.h
@@ -42,6 +42,7 @@
 #define PYTHONMOD_UTILS_H
 
 #include "util/module.h"
+struct delegpt_addr;
 
 /**
  *  Store the reply_info and query_info pair in message cache (qstate->msg_cache)
@@ -86,4 +87,7 @@ int createResponse(struct module_qstate* qstate, sldns_buffer* pkt);
  */
 void reply_addr2str(struct comm_reply* reply, char* dest, int maxlen);
 
+/* Convert target->addr to string */
+void delegpt_addr_addr2str(struct delegpt_addr* target, char *dest, int maxlen);
+
 #endif /* PYTHONMOD_UTILS_H */
diff --git a/external/unbound/services/cache/dns.c b/external/unbound/services/cache/dns.c
index 4692744a..cec2629e 100644
--- a/external/unbound/services/cache/dns.c
+++ b/external/unbound/services/cache/dns.c
@@ -50,7 +50,7 @@
 #include "util/net_help.h"
 #include "util/regional.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** store rrsets in the rrset cache. 
  * @param env: module environment with caches.
@@ -366,6 +366,8 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		sizeof(struct reply_info)-sizeof(struct rrset_ref));
 	if(!msg->rep)
 		return NULL;
+	if(capacity > RR_COUNT_MAX)
+		return NULL; /* integer overflow protection */
 	msg->rep->flags = BIT_QR; /* with QR, no AA */
 	msg->rep->qdcount = 1;
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
@@ -453,6 +455,8 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
 	if(!msg->rep)
 		return NULL;
+	if(num > RR_COUNT_MAX)
+		return NULL; /* integer overflow protection */
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
 		regional_alloc(region,
 		num * sizeof(struct ub_packed_rrset_key*));
diff --git a/external/unbound/services/cache/infra.c b/external/unbound/services/cache/infra.c
index 07f2103d..61bab3fe 100644
--- a/external/unbound/services/cache/infra.c
+++ b/external/unbound/services/cache/infra.c
@@ -39,7 +39,7 @@
  * This file contains the infrastructure cache.
  */
 #include "config.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
 #include "services/cache/infra.h"
 #include "util/storage/slabhash.h"
 #include "util/storage/lookup3.h"
diff --git a/external/unbound/services/cache/rrset.c b/external/unbound/services/cache/rrset.c
index 5f52dbce..2c855295 100644
--- a/external/unbound/services/cache/rrset.c
+++ b/external/unbound/services/cache/rrset.c
@@ -40,7 +40,7 @@
  */
 #include "config.h"
 #include "services/cache/rrset.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
 #include "util/storage/slabhash.h"
 #include "util/config_file.h"
 #include "util/data/packed_rrset.h"
@@ -304,10 +304,11 @@ rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
 {
 	hashvalue_t* h;
 	size_t i;
-	if(!(h = (hashvalue_t*)regional_alloc(scratch, 
-		sizeof(hashvalue_t)*count)))
+	if(count > RR_COUNT_MAX || !(h = (hashvalue_t*)regional_alloc(scratch, 
+		sizeof(hashvalue_t)*count))) {
 		log_warn("rrset LRU: memory allocation failed");
-	else 	/* store hash values */
+		h = NULL;
+	} else 	/* store hash values */
 		for(i=0; i<count; i++)
 			h[i] = ref[i].key->entry.hash;
 	/* unlock */
diff --git a/external/unbound/services/listen_dnsport.c b/external/unbound/services/listen_dnsport.c
index b7ffb6d3..276c0fb3 100644
--- a/external/unbound/services/listen_dnsport.c
+++ b/external/unbound/services/listen_dnsport.c
@@ -49,13 +49,17 @@
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
 #include <fcntl.h>
 
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+
 /** number of queued TCP connections for listen() */
 #define TCP_BACKLOG 256 
 
@@ -92,10 +96,10 @@ verbose_print_addr(struct addrinfo *addr)
 int
 create_udp_sock(int family, int socktype, struct sockaddr* addr,
         socklen_t addrlen, int v6only, int* inuse, int* noproto,
-	int rcv, int snd, int listen, int* reuseport)
+	int rcv, int snd, int listen, int* reuseport, int transparent)
 {
 	int s;
-#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_USE_MIN_MTU)
+#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_USE_MIN_MTU)  || defined(IP_TRANSPARENT)
 	int on=1;
 #endif
 #ifdef IPV6_MTU
@@ -109,6 +113,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #endif
 #ifndef IPV6_V6ONLY
 	(void)v6only;
+#endif
+#ifndef IP_TRANSPARENT
+	(void)transparent;
 #endif
 	if((s = socket(family, socktype, 0)) == -1) {
 		*inuse = 0;
@@ -173,6 +180,14 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #else
 		(void)reuseport;
 #endif /* defined(SO_REUSEPORT) */
+#ifdef IP_TRANSPARENT
+		if (transparent &&
+		    setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on,
+		    (socklen_t)sizeof(on)) < 0) {
+			log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s",
+			strerror(errno));
+		}
+#endif /* IP_TRANSPARENT */
 	}
 	if(rcv) {
 #ifdef SO_RCVBUF
@@ -368,29 +383,47 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
  * (and also uses the interface mtu to determine the size of the packets).
  * So there won't be any EMSGSIZE error.  Against DNS fragmentation attacks.
  * FreeBSD already has same semantics without setting the option. */
-#    if defined(IP_PMTUDISC_OMIT)
-		int action = IP_PMTUDISC_OMIT;
-#    else
-		int action = IP_PMTUDISC_DONT;
-#    endif
+		int omit_set = 0;
+		int action;
+#   if defined(IP_PMTUDISC_OMIT)
+		action = IP_PMTUDISC_OMIT;
 		if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, 
 			&action, (socklen_t)sizeof(action)) < 0) {
-			log_err("setsockopt(..., IP_MTU_DISCOVER, "
-#    if defined(IP_PMTUDISC_OMIT)
-				"IP_PMTUDISC_OMIT"
-#    else
-				"IP_PMTUDISC_DONT"
-#    endif
-				"...) failed: %s",
-				strerror(errno));
+
+			if (errno != EINVAL) {
+				log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_OMIT...) failed: %s",
+					strerror(errno));
+
 #    ifndef USE_WINSOCK
-			close(s);
+				close(s);
 #    else
-			closesocket(s);
+				closesocket(s);
 #    endif
-			*noproto = 0;
-			*inuse = 0;
-			return -1;
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
+		}
+		else
+		{
+		    omit_set = 1;
+		}
+#   endif
+		if (omit_set == 0) {
+   			action = IP_PMTUDISC_DONT;
+			if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER,
+				&action, (socklen_t)sizeof(action)) < 0) {
+				log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_DONT...) failed: %s",
+					strerror(errno));
+#    ifndef USE_WINSOCK
+				close(s);
+#    else
+				closesocket(s);
+#    endif
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
 		}
 #  elif defined(IP_DONTFRAG)
 		int off = 0;
@@ -450,12 +483,15 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 
 int
 create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
-	int* reuseport)
+	int* reuseport, int transparent)
 {
 	int s;
-#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_V6ONLY)
+#if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_V6ONLY) || defined(IP_TRANSPARENT)
 	int on = 1;
-#endif /* SO_REUSEADDR || IPV6_V6ONLY */
+#endif
+#ifndef IP_TRANSPARENT
+	(void)transparent;
+#endif
 	verbose_print_addr(addr);
 	*noproto = 0;
 	if((s = socket(addr->ai_family, addr->ai_socktype, 0)) == -1) {
@@ -530,6 +566,14 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 #else
 	(void)v6only;
 #endif /* IPV6_V6ONLY */
+#ifdef IP_TRANSPARENT
+	if (transparent &&
+	    setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on,
+	    (socklen_t)sizeof(on)) < 0) {
+		log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s",
+			strerror(errno));
+	}
+#endif /* IP_TRANSPARENT */
 	if(bind(s, addr->ai_addr, addr->ai_addrlen) != 0) {
 #ifndef USE_WINSOCK
 		/* detect freebsd jail with no ipv6 permission */
@@ -571,13 +615,70 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 	return s;
 }
 
+int
+create_local_accept_sock(const char *path, int* noproto)
+{
+#ifdef HAVE_SYS_UN_H
+	int s;
+	struct sockaddr_un usock;
+
+	verbose(VERB_ALGO, "creating unix socket %s", path);
+#ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
+	/* this member exists on BSDs, not Linux */
+	usock.sun_len = (socklen_t)sizeof(usock);
+#endif
+	usock.sun_family = AF_LOCAL;
+	/* length is 92-108, 104 on FreeBSD */
+	(void)strlcpy(usock.sun_path, path, sizeof(usock.sun_path));
+
+	if ((s = socket(AF_LOCAL, SOCK_STREAM, 0)) == -1) {
+		log_err("Cannot create local socket %s (%s)",
+			path, strerror(errno));
+		return -1;
+	}
+
+	if (unlink(path) && errno != ENOENT) {
+		/* The socket already exists and cannot be removed */
+		log_err("Cannot remove old local socket %s (%s)",
+			path, strerror(errno));
+		return -1;
+	}
+
+	if (bind(s, (struct sockaddr *)&usock,
+		(socklen_t)sizeof(struct sockaddr_un)) == -1) {
+		log_err("Cannot bind local socket %s (%s)",
+			path, strerror(errno));
+		return -1;
+	}
+
+	if (!fd_set_nonblock(s)) {
+		log_err("Cannot set non-blocking mode");
+		return -1;
+	}
+
+	if (listen(s, TCP_BACKLOG) == -1) {
+		log_err("can't listen: %s", strerror(errno));
+		return -1;
+	}
+
+	(void)noproto; /*unused*/
+	return s;
+#else
+	(void)path;
+	log_err("Local sockets are not supported");
+	*noproto = 1;
+	return -1;
+#endif
+}
+
+
 /**
  * Create socket from getaddrinfo results
  */
 static int
 make_sock(int stype, const char* ifname, const char* port, 
 	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
-	int* reuseport)
+	int* reuseport, int transparent)
 {
 	struct addrinfo *res = NULL;
 	int r, s, inuse, noproto;
@@ -605,14 +706,15 @@ make_sock(int stype, const char* ifname, const char* port,
 		s = create_udp_sock(res->ai_family, res->ai_socktype,
 			(struct sockaddr*)res->ai_addr, res->ai_addrlen,
 			v6only, &inuse, &noproto, (int)rcv, (int)snd, 1,
-			reuseport);
+			reuseport, transparent);
 		if(s == -1 && inuse) {
 			log_err("bind: address already in use");
 		} else if(s == -1 && noproto && hints->ai_family == AF_INET6){
 			*noip6 = 1;
 		}
 	} else	{
-		s = create_tcp_accept_sock(res, v6only, &noproto, reuseport);
+		s = create_tcp_accept_sock(res, v6only, &noproto, reuseport,
+			transparent);
 		if(s == -1 && noproto && hints->ai_family == AF_INET6){
 			*noip6 = 1;
 		}
@@ -625,7 +727,7 @@ make_sock(int stype, const char* ifname, const char* port,
 static int
 make_sock_port(int stype, const char* ifname, const char* port, 
 	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
-	int* reuseport)
+	int* reuseport, int transparent)
 {
 	char* s = strchr(ifname, '@');
 	if(s) {
@@ -647,10 +749,10 @@ make_sock_port(int stype, const char* ifname, const char* port,
 		(void)strlcpy(p, s+1, sizeof(p));
 		p[strlen(s+1)]=0;
 		return make_sock(stype, newif, p, hints, v6only, noip6,
-			rcv, snd, reuseport);
+			rcv, snd, reuseport, transparent);
 	}
 	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv, snd,
-		reuseport);
+		reuseport, transparent);
 }
 
 /**
@@ -744,19 +846,20 @@ set_recvpktinfo(int s, int family)
  * @param ssl_port: ssl service port number
  * @param reuseport: try to set SO_REUSEPORT if nonNULL and true.
  * 	set to false on exit if reuseport failed due to no kernel support.
+ * @param transparent: set IP_TRANSPARENT socket option.
  * @return: returns false on error.
  */
 static int
 ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, 
 	struct addrinfo *hints, const char* port, struct listen_port** list,
-	size_t rcv, size_t snd, int ssl_port, int* reuseport)
+	size_t rcv, size_t snd, int ssl_port, int* reuseport, int transparent)
 {
 	int s, noip6=0;
 	if(!do_udp && !do_tcp)
 		return 0;
 	if(do_auto) {
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv, snd, reuseport)) == -1) {
+			&noip6, rcv, snd, reuseport, transparent)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -783,7 +886,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	} else if(do_udp) {
 		/* regular udp socket */
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6, rcv, snd, reuseport)) == -1) {
+			&noip6, rcv, snd, reuseport, transparent)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -804,7 +907,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 			atoi(strchr(ifname, '@')+1) == ssl_port) ||
 			(!strchr(ifname, '@') && atoi(port) == ssl_port));
 		if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, 
-			&noip6, 0, 0, reuseport)) == -1) {
+			&noip6, 0, 0, reuseport, transparent)) == -1) {
 			if(noip6) {
 				/*log_warn("IPv6 protocol not available");*/
 				return 1;
@@ -960,7 +1063,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 				do_auto, cfg->do_udp, do_tcp, 
 				&hints, portbuf, &list,
 				cfg->so_rcvbuf, cfg->so_sndbuf,
-				cfg->ssl_port, reuseport)) {
+				cfg->ssl_port, reuseport,
+				cfg->ip_transparent)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -971,7 +1075,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 				do_auto, cfg->do_udp, do_tcp, 
 				&hints, portbuf, &list,
 				cfg->so_rcvbuf, cfg->so_sndbuf,
-				cfg->ssl_port, reuseport)) {
+				cfg->ssl_port, reuseport,
+				cfg->ip_transparent)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -984,7 +1089,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list, 
 				cfg->so_rcvbuf, cfg->so_sndbuf,
-				cfg->ssl_port, reuseport)) {
+				cfg->ssl_port, reuseport,
+				cfg->ip_transparent)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -995,7 +1101,8 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list, 
 				cfg->so_rcvbuf, cfg->so_sndbuf,
-				cfg->ssl_port, reuseport)) {
+				cfg->ssl_port, reuseport,
+				cfg->ip_transparent)) {
 				listening_ports_free(list);
 				return NULL;
 			}
diff --git a/external/unbound/services/listen_dnsport.h b/external/unbound/services/listen_dnsport.h
index 075f6d28..676f0c63 100644
--- a/external/unbound/services/listen_dnsport.h
+++ b/external/unbound/services/listen_dnsport.h
@@ -189,11 +189,12 @@ void listen_start_accept(struct listen_dnsport* listen);
  * 	set SO_REUSEADDR on it.
  * @param reuseport: if nonNULL and true, try to set SO_REUSEPORT on
  * 	listening UDP port.  Set to false on return if it failed to do so.
+ * @param transparent: set IP_TRANSPARENT socket option.
  * @return: the socket. -1 on error.
  */
 int create_udp_sock(int family, int socktype, struct sockaddr* addr, 
 	socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv,
-	int snd, int listen, int* reuseport);
+	int snd, int listen, int* reuseport, int transparent);
 
 /**
  * Create and bind TCP listening socket
@@ -202,9 +203,19 @@ int create_udp_sock(int family, int socktype, struct sockaddr* addr,
  * @param noproto: if error caused by lack of protocol support.
  * @param reuseport: if nonNULL and true, try to set SO_REUSEPORT on
  * 	listening UDP port.  Set to false on return if it failed to do so.
+ * @param transparent: set IP_TRANSPARENT socket option.
  * @return: the socket. -1 on error.
  */
 int create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
-	int* reuseport);
+	int* reuseport, int transparent);
+
+/**
+ * Create and bind local listening socket
+ * @param path: path to the socket.
+ * @param noproto: on error, this is set true if cause is that local sockets
+ *	are not supported.
+ * @return: the socket. -1 on error.
+ */
+int create_local_accept_sock(const char* path, int* noproto);
 
 #endif /* LISTEN_DNSPORT_H */
diff --git a/external/unbound/services/localzone.c b/external/unbound/services/localzone.c
index d285a127..51491656 100644
--- a/external/unbound/services/localzone.c
+++ b/external/unbound/services/localzone.c
@@ -40,14 +40,15 @@
  */
 #include "config.h"
 #include "services/localzone.h"
-#include "ldns/str2wire.h"
-#include "ldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/sbuffer.h"
 #include "util/regional.h"
 #include "util/config_file.h"
 #include "util/data/dname.h"
 #include "util/data/packed_rrset.h"
 #include "util/data/msgencode.h"
 #include "util/net_help.h"
+#include "util/netevent.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgparse.h"
 
@@ -1022,6 +1023,10 @@ void local_zones_print(struct local_zones* zones)
 			log_nametypeclass(0, "static zone", 
 				z->name, 0, z->dclass);
 			break;
+		case local_zone_inform:
+			log_nametypeclass(0, "inform zone", 
+				z->name, 0, z->dclass);
+			break;
 		default:
 			log_nametypeclass(0, "badtyped zone", 
 				z->name, 0, z->dclass);
@@ -1169,9 +1174,25 @@ lz_zone_answer(struct local_zone* z, struct query_info* qinfo,
 	return 0;
 }
 
+/** print log information for an inform zone query */
+static void
+lz_inform_print(struct local_zone* z, struct query_info* qinfo,
+	struct comm_reply* repinfo)
+{
+	char ip[128], txt[512];
+	char zname[LDNS_MAX_DOMAINLEN+1];
+	uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
+	dname_str(z->name, zname);
+	addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
+	snprintf(txt, sizeof(txt), "%s inform %s@%u", zname, ip,
+		(unsigned)port);
+	log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
+}
+
 int 
 local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
-	struct edns_data* edns, sldns_buffer* buf, struct regional* temp)
+	struct edns_data* edns, sldns_buffer* buf, struct regional* temp,
+	struct comm_reply* repinfo)
 {
 	/* see if query is covered by a zone,
 	 * 	if so:	- try to match (exact) local data 
@@ -1190,6 +1211,9 @@ local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
 	lock_rw_rdlock(&z->lock);
 	lock_rw_unlock(&zones->lock);
 
+	if(z->type == local_zone_inform && repinfo)
+		lz_inform_print(z, qinfo, repinfo);
+
 	if(local_data_answer(z, qinfo, edns, buf, temp, labs, &ld)) {
 		lock_rw_unlock(&z->lock);
 		return 1;
@@ -1209,6 +1233,7 @@ const char* local_zone_type2str(enum localzone_type t)
 		case local_zone_typetransparent: return "typetransparent";
 		case local_zone_static: return "static";
 		case local_zone_nodefault: return "nodefault";
+		case local_zone_inform: return "inform";
 	}
 	return "badtyped"; 
 }
@@ -1227,6 +1252,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
 		*t = local_zone_typetransparent;
 	else if(strcmp(type, "redirect") == 0)
 		*t = local_zone_redirect;
+	else if(strcmp(type, "inform") == 0)
+		*t = local_zone_inform;
 	else return 0;
 	return 1;
 }
diff --git a/external/unbound/services/localzone.h b/external/unbound/services/localzone.h
index 788fbfb3..29ba8663 100644
--- a/external/unbound/services/localzone.h
+++ b/external/unbound/services/localzone.h
@@ -49,6 +49,7 @@ struct config_file;
 struct edns_data;
 struct query_info;
 struct sldns_buffer;
+struct comm_reply;
 
 /**
  * Local zone type
@@ -70,7 +71,9 @@ enum localzone_type {
 	local_zone_redirect,
 	/** remove default AS112 blocking contents for zone
 	 * nodefault is used in config not during service. */
-	local_zone_nodefault
+	local_zone_nodefault,
+	/** log client address, but no block (transparent) */
+	local_zone_inform
 };
 
 /**
@@ -220,12 +223,14 @@ void local_zones_print(struct local_zones* zones);
  * @param edns: edns info (parsed).
  * @param buf: buffer with query ID and flags, also for reply.
  * @param temp: temporary storage region.
+ * @param repinfo: source address for checks. may be NULL.
  * @return true if answer is in buffer. false if query is not answered 
  * by authority data. If the reply should be dropped altogether, the return 
  * value is true, but the buffer is cleared (empty).
  */
 int local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
-	struct edns_data* edns, struct sldns_buffer* buf, struct regional* temp);
+	struct edns_data* edns, struct sldns_buffer* buf, struct regional* temp,
+	struct comm_reply* repinfo);
 
 /**
  * Parse the string into localzone type.
diff --git a/external/unbound/services/mesh.c b/external/unbound/services/mesh.c
index a69aced2..8076874a 100644
--- a/external/unbound/services/mesh.c
+++ b/external/unbound/services/mesh.c
@@ -55,7 +55,7 @@
 #include "util/fptr_wlist.h"
 #include "util/alloc.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** subtract timers and the values do not overflow or become negative */
 static void
diff --git a/external/unbound/services/outside_network.c b/external/unbound/services/outside_network.c
index 5bb52ff9..dc3d2f40 100644
--- a/external/unbound/services/outside_network.c
+++ b/external/unbound/services/outside_network.c
@@ -57,7 +57,7 @@
 #include "util/net_help.h"
 #include "util/random.h"
 #include "util/fptr_wlist.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include "dnstap/dnstap.h"
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
@@ -893,13 +893,13 @@ udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int port,
 		sa->sin6_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET6, SOCK_DGRAM, 
 			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
-			0, 0, 0, NULL);
+			0, 0, 0, NULL, 0);
 	} else {
 		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
 		sa->sin_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET, SOCK_DGRAM, 
 			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
-			0, 0, 0, NULL);
+			0, 0, 0, NULL, 0);
 	}
 	return fd;
 }
diff --git a/external/unbound/ldns/keyraw.c b/external/unbound/sldns/keyraw.c
similarity index 99%
rename from external/unbound/ldns/keyraw.c
rename to external/unbound/sldns/keyraw.c
index 1ff07742..59e8000f 100644
--- a/external/unbound/ldns/keyraw.c
+++ b/external/unbound/sldns/keyraw.c
@@ -11,8 +11,8 @@
  */
 
 #include "config.h"
-#include "ldns/keyraw.h"
-#include "ldns/rrdef.h"
+#include "sldns/keyraw.h"
+#include "sldns/rrdef.h"
 
 #ifdef HAVE_SSL
 #include <openssl/ssl.h>
diff --git a/external/unbound/ldns/keyraw.h b/external/unbound/sldns/keyraw.h
similarity index 100%
rename from external/unbound/ldns/keyraw.h
rename to external/unbound/sldns/keyraw.h
diff --git a/external/unbound/ldns/parse.c b/external/unbound/sldns/parse.c
similarity index 99%
rename from external/unbound/ldns/parse.c
rename to external/unbound/sldns/parse.c
index a605e549..35dee719 100644
--- a/external/unbound/ldns/parse.c
+++ b/external/unbound/sldns/parse.c
@@ -8,9 +8,9 @@
  * See the file LICENSE for the license
  */
 #include "config.h"
-#include "ldns/parse.h"
-#include "ldns/parseutil.h"
-#include "ldns/sbuffer.h"
+#include "sldns/parse.h"
+#include "sldns/parseutil.h"
+#include "sldns/sbuffer.h"
 
 #include <limits.h>
 #include <strings.h>
diff --git a/external/unbound/ldns/parse.h b/external/unbound/sldns/parse.h
similarity index 100%
rename from external/unbound/ldns/parse.h
rename to external/unbound/sldns/parse.h
diff --git a/external/unbound/ldns/parseutil.c b/external/unbound/sldns/parseutil.c
similarity index 99%
rename from external/unbound/ldns/parseutil.c
rename to external/unbound/sldns/parseutil.c
index 28b344ed..2a2ebbb0 100644
--- a/external/unbound/ldns/parseutil.c
+++ b/external/unbound/sldns/parseutil.c
@@ -13,7 +13,7 @@
  */
 
 #include "config.h"
-#include "ldns/parseutil.h"
+#include "sldns/parseutil.h"
 #include <sys/time.h>
 #include <time.h>
 #include <ctype.h>
diff --git a/external/unbound/ldns/parseutil.h b/external/unbound/sldns/parseutil.h
similarity index 100%
rename from external/unbound/ldns/parseutil.h
rename to external/unbound/sldns/parseutil.h
diff --git a/external/unbound/ldns/pkthdr.h b/external/unbound/sldns/pkthdr.h
similarity index 100%
rename from external/unbound/ldns/pkthdr.h
rename to external/unbound/sldns/pkthdr.h
diff --git a/external/unbound/ldns/rrdef.c b/external/unbound/sldns/rrdef.c
similarity index 99%
rename from external/unbound/ldns/rrdef.c
rename to external/unbound/sldns/rrdef.c
index 9b4bf7cf..72161d7b 100644
--- a/external/unbound/ldns/rrdef.c
+++ b/external/unbound/sldns/rrdef.c
@@ -13,8 +13,8 @@
  * Defines resource record types and constants.
  */
 #include "config.h"
-#include "ldns/rrdef.h"
-#include "ldns/parseutil.h"
+#include "sldns/rrdef.h"
+#include "sldns/parseutil.h"
 
 /* classes  */
 static sldns_lookup_table sldns_rr_classes_data[] = {
diff --git a/external/unbound/ldns/rrdef.h b/external/unbound/sldns/rrdef.h
similarity index 100%
rename from external/unbound/ldns/rrdef.h
rename to external/unbound/sldns/rrdef.h
diff --git a/external/unbound/ldns/sbuffer.c b/external/unbound/sldns/sbuffer.c
similarity index 99%
rename from external/unbound/ldns/sbuffer.c
rename to external/unbound/sldns/sbuffer.c
index 3d087bfe..a7fe53aa 100644
--- a/external/unbound/ldns/sbuffer.c
+++ b/external/unbound/sldns/sbuffer.c
@@ -12,7 +12,7 @@
  * This file contains the definition of sldns_buffer, and functions to manipulate those.
  */
 #include "config.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include <stdarg.h>
 
 sldns_buffer *
diff --git a/external/unbound/ldns/sbuffer.h b/external/unbound/sldns/sbuffer.h
similarity index 100%
rename from external/unbound/ldns/sbuffer.h
rename to external/unbound/sldns/sbuffer.h
diff --git a/external/unbound/ldns/str2wire.c b/external/unbound/sldns/str2wire.c
similarity index 99%
rename from external/unbound/ldns/str2wire.c
rename to external/unbound/sldns/str2wire.c
index 931e28f8..8cda8c75 100644
--- a/external/unbound/ldns/str2wire.c
+++ b/external/unbound/sldns/str2wire.c
@@ -12,11 +12,11 @@
  * Parses text to wireformat.
  */
 #include "config.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parse.h"
-#include "ldns/parseutil.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parse.h"
+#include "sldns/parseutil.h"
 #include <ctype.h>
 #ifdef HAVE_TIME_H
 #include <time.h>
diff --git a/external/unbound/ldns/str2wire.h b/external/unbound/sldns/str2wire.h
similarity index 99%
rename from external/unbound/ldns/str2wire.h
rename to external/unbound/sldns/str2wire.h
index 94c89338..527074a1 100644
--- a/external/unbound/ldns/str2wire.h
+++ b/external/unbound/sldns/str2wire.h
@@ -16,7 +16,7 @@
 #define LDNS_STR2WIRE_H
 
 /* include rrdef for MAX_DOMAINLEN constant */
-#include <ldns/rrdef.h>
+#include <sldns/rrdef.h>
 
 #ifdef __cplusplus
 extern "C" {
diff --git a/external/unbound/ldns/wire2str.c b/external/unbound/sldns/wire2str.c
similarity index 99%
rename from external/unbound/ldns/wire2str.c
rename to external/unbound/sldns/wire2str.c
index 81e173c7..cec3bc7b 100644
--- a/external/unbound/ldns/wire2str.c
+++ b/external/unbound/sldns/wire2str.c
@@ -15,13 +15,13 @@
  * representation, as well as functions to print them.
  */
 #include "config.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
-#include "ldns/rrdef.h"
-#include "ldns/pkthdr.h"
-#include "ldns/parseutil.h"
-#include "ldns/sbuffer.h"
-#include "ldns/keyraw.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
+#include "sldns/rrdef.h"
+#include "sldns/pkthdr.h"
+#include "sldns/parseutil.h"
+#include "sldns/sbuffer.h"
+#include "sldns/keyraw.h"
 #ifdef HAVE_TIME_H
 #include <time.h>
 #endif
diff --git a/external/unbound/ldns/wire2str.h b/external/unbound/sldns/wire2str.h
similarity index 100%
rename from external/unbound/ldns/wire2str.h
rename to external/unbound/sldns/wire2str.h
diff --git a/external/unbound/smallapp/unbound-anchor.c b/external/unbound/smallapp/unbound-anchor.c
index 9df0d95b..576a30f6 100644
--- a/external/unbound/smallapp/unbound-anchor.c
+++ b/external/unbound/smallapp/unbound-anchor.c
@@ -116,7 +116,7 @@
 
 #include "config.h"
 #include "libunbound/unbound.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
 #include <expat.h>
 #ifndef HAVE_EXPAT_H
 #error "need libexpat to parse root-anchors.xml file."
@@ -915,7 +915,10 @@ read_data_chunk(SSL* ssl, size_t len)
 {
 	size_t got = 0;
 	int r;
-	char* data = malloc(len+1);
+	char* data;
+	if(len >= 0xfffffff0)
+		return NULL; /* to protect against integer overflow in malloc*/
+	data = malloc(len+1);
 	if(!data) {
 		if(verb) printf("out of memory\n");
 		return NULL;
diff --git a/external/unbound/smallapp/unbound-checkconf.c b/external/unbound/smallapp/unbound-checkconf.c
index e83867f2..0524edea 100644
--- a/external/unbound/smallapp/unbound-checkconf.c
+++ b/external/unbound/smallapp/unbound-checkconf.c
@@ -53,7 +53,7 @@
 #include "iterator/iter_hints.h"
 #include "validator/validator.h"
 #include "services/localzone.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
@@ -78,6 +78,7 @@ usage()
 	printf("	Checks unbound configuration file for errors.\n");
 	printf("file	if omitted %s is used.\n", CONFIGFILE);
 	printf("-o option	print value of option to stdout.\n");
+	printf("-f 		output full pathname with chroot applied, eg. with -o pidfile.\n");
 	printf("-h		show this usage help.\n");
 	printf("Version %s\n", PACKAGE_VERSION);
 	printf("BSD licensed, see LICENSE in source package for details.\n");
@@ -90,10 +91,15 @@ usage()
  * @param cfg: config
  * @param opt: option name without trailing :. 
  *	This is different from config_set_option.
+ * @param final: if final pathname with chroot applied has to be printed.
  */
 static void
-print_option(struct config_file* cfg, const char* opt)
+print_option(struct config_file* cfg, const char* opt, int final)
 {
+	if(strcmp(opt, "pidfile") == 0 && final) {
+		printf("%s\n", fname_after_chroot(cfg->pidfile, cfg, 1));
+		return;
+	}
 	if(!config_get_option(cfg, opt, config_print_func, stdout))
 		fatal_exit("cannot print option '%s'", opt);
 }
@@ -416,7 +422,7 @@ morechecks(struct config_file* cfg, const char* fname)
 		endpwent();
 	}
 #endif
-	if(cfg->remote_control_enable) {
+	if(cfg->remote_control_enable && cfg->remote_control_use_cert) {
 		check_chroot_string("server-key-file", &cfg->server_key_file,
 			cfg->chrootdir, cfg);
 		check_chroot_string("server-cert-file", &cfg->server_cert_file,
@@ -456,7 +462,7 @@ check_hints(struct config_file* cfg)
 
 /** check config file */
 static void
-checkconf(const char* cfgfile, const char* opt)
+checkconf(const char* cfgfile, const char* opt, int final)
 {
 	struct config_file* cfg = config_create();
 	if(!cfg)
@@ -467,7 +473,7 @@ checkconf(const char* cfgfile, const char* opt)
 		exit(1);
 	}
 	if(opt) {
-		print_option(cfg, opt);
+		print_option(cfg, opt, final);
 		config_delete(cfg);
 		return;
 	}
@@ -493,6 +499,7 @@ extern char* optarg;
 int main(int argc, char* argv[])
 {
 	int c;
+	int final = 0;
 	const char* f;
 	const char* opt = NULL;
 	const char* cfgfile = CONFIGFILE;
@@ -505,8 +512,11 @@ int main(int argc, char* argv[])
 		cfgfile = CONFIGFILE;
 #endif /* USE_WINSOCK */
 	/* parse the options */
-	while( (c=getopt(argc, argv, "ho:")) != -1) {
+	while( (c=getopt(argc, argv, "fho:")) != -1) {
 		switch(c) {
+		case 'f':
+			final = 1;
+			break;
 		case 'o':
 			opt = optarg;
 			break;
@@ -523,7 +533,7 @@ int main(int argc, char* argv[])
 	if(argc == 1)
 		f = argv[0];
 	else	f = cfgfile;
-	checkconf(f, opt);
+	checkconf(f, opt, final);
 	checklock_stop();
 	return 0;
 }
diff --git a/external/unbound/smallapp/unbound-control-setup.sh.in b/external/unbound/smallapp/unbound-control-setup.sh.in
index 79605dc6..682ab260 100644
--- a/external/unbound/smallapp/unbound-control-setup.sh.in
+++ b/external/unbound/smallapp/unbound-control-setup.sh.in
@@ -36,8 +36,7 @@
 # settings:
 
 # directory for files
-prefix=@prefix@
-DESTDIR=@sysconfdir@/unbound
+DESTDIR=@ub_conf_dir@
 
 # issuer and subject name for certificates
 SERVERNAME=unbound
@@ -47,7 +46,7 @@ CLIENTNAME=unbound-control
 DAYS=7200
 
 # size of keys in bits
-BITS=1536
+BITS=3072
 
 # hash algorithm
 HASH=sha256
diff --git a/external/unbound/smallapp/unbound-control.c b/external/unbound/smallapp/unbound-control.c
index ff86184a..3b47d3bf 100644
--- a/external/unbound/smallapp/unbound-control.c
+++ b/external/unbound/smallapp/unbound-control.c
@@ -59,6 +59,10 @@
 #include "util/locks.h"
 #include "util/net_help.h"
 
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+
 /** Give unbound-control usage, and exit (1). */
 static void
 usage()
@@ -136,32 +140,40 @@ static void ssl_err(const char* s)
 static SSL_CTX*
 setup_ctx(struct config_file* cfg)
 {
-	char* s_cert, *c_key, *c_cert;
+	char* s_cert=NULL, *c_key=NULL, *c_cert=NULL;
 	SSL_CTX* ctx;
 
-	s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
-	c_key = fname_after_chroot(cfg->control_key_file, cfg, 1);
-	c_cert = fname_after_chroot(cfg->control_cert_file, cfg, 1);
-	if(!s_cert || !c_key || !c_cert)
-		fatal_exit("out of memory");
+	if(cfg->remote_control_use_cert) {
+		s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
+		c_key = fname_after_chroot(cfg->control_key_file, cfg, 1);
+		c_cert = fname_after_chroot(cfg->control_cert_file, cfg, 1);
+		if(!s_cert || !c_key || !c_cert)
+			fatal_exit("out of memory");
+	}
         ctx = SSL_CTX_new(SSLv23_client_method());
 	if(!ctx)
 		ssl_err("could not allocate SSL_CTX pointer");
         if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2))
 		ssl_err("could not set SSL_OP_NO_SSLv2");
-        if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3))
-		ssl_err("could not set SSL_OP_NO_SSLv3");
-	if(!SSL_CTX_use_certificate_file(ctx,c_cert,SSL_FILETYPE_PEM) ||
-		!SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM)
-		|| !SSL_CTX_check_private_key(ctx))
-		ssl_err("Error setting up SSL_CTX client key and cert");
-	if (SSL_CTX_load_verify_locations(ctx, s_cert, NULL) != 1)
-		ssl_err("Error setting up SSL_CTX verify, server cert");
-	SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
+        if(cfg->remote_control_use_cert) {
+		if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3))
+			ssl_err("could not set SSL_OP_NO_SSLv3");
+		if(!SSL_CTX_use_certificate_file(ctx,c_cert,SSL_FILETYPE_PEM) ||
+		    !SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM)
+		    || !SSL_CTX_check_private_key(ctx))
+			ssl_err("Error setting up SSL_CTX client key and cert");
+		if (SSL_CTX_load_verify_locations(ctx, s_cert, NULL) != 1)
+			ssl_err("Error setting up SSL_CTX verify, server cert");
+		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
 
-	free(s_cert);
-	free(c_key);
-	free(c_cert);
+		free(s_cert);
+		free(c_key);
+		free(c_cert);
+	} else {
+		/* Use ciphers that don't require authentication  */
+		if(!SSL_CTX_set_cipher_list(ctx, "aNULL"))
+			ssl_err("Error setting NULL cipher!");
+	}
 	return ctx;
 }
 
@@ -171,6 +183,7 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 {
 	struct sockaddr_storage addr;
 	socklen_t addrlen;
+	int addrfamily = 0;
 	int fd;
 	/* use svr or the first config entry */
 	if(!svr) {
@@ -189,12 +202,25 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 	if(strchr(svr, '@')) {
 		if(!extstrtoaddr(svr, &addr, &addrlen))
 			fatal_exit("could not parse IP@port: %s", svr);
+#ifdef HAVE_SYS_UN_H
+	} else if(svr[0] == '/') {
+		struct sockaddr_un* usock = (struct sockaddr_un *) &addr;
+		usock->sun_family = AF_LOCAL;
+#ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
+		usock->sun_len = (socklen_t)sizeof(usock);
+#endif
+		(void)strlcpy(usock->sun_path, svr, sizeof(usock->sun_path));
+		addrlen = (socklen_t)sizeof(struct sockaddr_un);
+		addrfamily = AF_LOCAL;
+#endif
 	} else {
 		if(!ipstrtoaddr(svr, cfg->control_port, &addr, &addrlen))
 			fatal_exit("could not parse IP: %s", svr);
 	}
-	fd = socket(addr_is_ip6(&addr, addrlen)?AF_INET6:AF_INET, 
-		SOCK_STREAM, 0);
+
+	if(addrfamily == 0)
+		addrfamily = addr_is_ip6(&addr, addrlen)?AF_INET6:AF_INET;
+	fd = socket(addrfamily, SOCK_STREAM, 0);
 	if(fd == -1) {
 #ifndef USE_WINSOCK
 		fatal_exit("socket: %s", strerror(errno));
@@ -223,7 +249,7 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 
 /** setup SSL on the connection */
 static SSL*
-setup_ssl(SSL_CTX* ctx, int fd)
+setup_ssl(SSL_CTX* ctx, int fd, struct config_file* cfg)
 {
 	SSL* ssl;
 	X509* x;
@@ -249,10 +275,13 @@ setup_ssl(SSL_CTX* ctx, int fd)
 	/* check authenticity of server */
 	if(SSL_get_verify_result(ssl) != X509_V_OK)
 		ssl_err("SSL verification failed");
-	x = SSL_get_peer_certificate(ssl);
-	if(!x)
-		ssl_err("Server presented no peer certificate");
-	X509_free(x);
+	if(cfg->remote_control_use_cert) {
+		x = SSL_get_peer_certificate(ssl);
+		if(!x)
+			ssl_err("Server presented no peer certificate");
+		X509_free(x);
+	}
+
 	return ssl;
 }
 
@@ -330,11 +359,11 @@ go(const char* cfgfile, char* svr, int quiet, int argc, char* argv[])
 	if(!cfg->remote_control_enable)
 		log_warn("control-enable is 'no' in the config file.");
 	ctx = setup_ctx(cfg);
-	
+
 	/* contact server */
 	fd = contact_server(svr, cfg, argc>0&&strcmp(argv[0],"status")==0);
-	ssl = setup_ssl(ctx, fd);
-	
+	ssl = setup_ssl(ctx, fd, cfg);
+
 	/* send command */
 	ret = go_cmd(ssl, quiet, argc, argv);
 
diff --git a/external/unbound/smallapp/unbound-host.c b/external/unbound/smallapp/unbound-host.c
index 95973410..30fef51f 100644
--- a/external/unbound/smallapp/unbound-host.c
+++ b/external/unbound/smallapp/unbound-host.c
@@ -60,8 +60,8 @@
 #define unbound_lite_wrapstr(s) s
 #endif
 #include "libunbound/unbound.h"
-#include "ldns/rrdef.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/wire2str.h"
 #ifdef HAVE_NSS
 /* nss3 */
 #include "nss.h"
diff --git a/external/unbound/testcode/asynclook.c b/external/unbound/testcode/asynclook.c
index 7e9ee775..53448973 100644
--- a/external/unbound/testcode/asynclook.c
+++ b/external/unbound/testcode/asynclook.c
@@ -48,7 +48,7 @@
 #include "libunbound/context.h"
 #include "util/locks.h"
 #include "util/log.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
 #ifdef UNBOUND_ALLOC_LITE
 #undef malloc
 #undef calloc
diff --git a/external/unbound/testcode/delayer.c b/external/unbound/testcode/delayer.c
index 7a90fc04..050cbd23 100644
--- a/external/unbound/testcode/delayer.c
+++ b/external/unbound/testcode/delayer.c
@@ -50,7 +50,7 @@
 #include <sys/time.h>
 #include "util/net_help.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include <signal.h>
 
 /** number of reads per select for delayer */
diff --git a/external/unbound/testcode/do-tests.sh b/external/unbound/testcode/do-tests.sh
index 84d2ef56..6ea12cd2 100755
--- a/external/unbound/testcode/do-tests.sh
+++ b/external/unbound/testcode/do-tests.sh
@@ -14,7 +14,7 @@ NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
 test_tool_avail "dig"
 test_tool_avail "ldns-testns"
 
-# test for ipv6, uses streamptcp peculiarity.
+# test for ipv6, uses streamtcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
 	HAVE_IPV6=no
 else
diff --git a/external/unbound/testcode/fake_event.c b/external/unbound/testcode/fake_event.c
index de453aaa..4335a8f2 100644
--- a/external/unbound/testcode/fake_event.c
+++ b/external/unbound/testcode/fake_event.c
@@ -60,9 +60,9 @@
 #include "testcode/testpkts.h"
 #include "util/log.h"
 #include "util/fptr_wlist.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
 #include <signal.h>
 struct worker;
 struct daemon_remote;
diff --git a/external/unbound/testcode/perf.c b/external/unbound/testcode/perf.c
index c51eee4b..320cbc93 100644
--- a/external/unbound/testcode/perf.c
+++ b/external/unbound/testcode/perf.c
@@ -50,9 +50,9 @@
 #include "util/data/msgencode.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgparse.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
 #include <sys/time.h>
 
 /** usage information for perf */
diff --git a/external/unbound/testcode/pktview.c b/external/unbound/testcode/pktview.c
index e59283fa..12e0d8ed 100644
--- a/external/unbound/testcode/pktview.c
+++ b/external/unbound/testcode/pktview.c
@@ -45,8 +45,8 @@
 #include "util/data/msgparse.h"
 #include "testcode/unitmain.h"
 #include "testcode/readhex.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parseutil.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parseutil.h"
 
 /** usage information for pktview */
 static void usage(char* argv[])
diff --git a/external/unbound/testcode/readhex.c b/external/unbound/testcode/readhex.c
index d9aba09b..e871def0 100644
--- a/external/unbound/testcode/readhex.c
+++ b/external/unbound/testcode/readhex.c
@@ -41,8 +41,8 @@
 #include <ctype.h>
 #include "testcode/readhex.h"
 #include "util/log.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parseutil.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parseutil.h"
 
 /** skip whitespace */
 static void
diff --git a/external/unbound/testcode/replay.c b/external/unbound/testcode/replay.c
index 5c119714..01b17a7f 100644
--- a/external/unbound/testcode/replay.c
+++ b/external/unbound/testcode/replay.c
@@ -50,7 +50,7 @@
 #include "testcode/replay.h"
 #include "testcode/testpkts.h"
 #include "testcode/fake_event.h"
-#include "ldns/str2wire.h"
+#include "sldns/str2wire.h"
 
 /** max length of lines in file */
 #define MAX_LINE_LEN 10240
diff --git a/external/unbound/testcode/streamtcp.c b/external/unbound/testcode/streamtcp.c
index d93ab966..c5919428 100644
--- a/external/unbound/testcode/streamtcp.c
+++ b/external/unbound/testcode/streamtcp.c
@@ -51,9 +51,9 @@
 #include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
 #include "util/data/dname.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 #include <openssl/ssl.h>
 #include <openssl/rand.h>
 #include <openssl/err.h>
diff --git a/external/unbound/testcode/testbed.sh b/external/unbound/testcode/testbed.sh
deleted file mode 100755
index 62ce2059..00000000
--- a/external/unbound/testcode/testbed.sh
+++ /dev/null
@@ -1,133 +0,0 @@
-#!/usr/bin/env bash
-# Testbed for NSD.
-# By Wouter Wijngaards, NLnet Labs, 2006.
-# BSD License.
-
-# this version prefers gmake if available.
-# adds variable LDNS for the LDNS path to use.
-
-# global settings
-CONFIGURE_FLAGS=""
-REPORT_FILE=testdata/testbed.report
-LOG_FILE=testdata/testbed.log
-HOST_FILE=testdata/host_file.$USER
-
-if test ! -f $HOST_FILE; then
-	echo "No such file: $HOST_FILE"
-	exit 1
-fi
-
-function echossh() # like ssh but echos.
-{
-	echo "> ssh $*"
-	ssh $*
-}
-
-# Compile and run NSD on platforms
-function dotest() 
-# parameters: <host> <dir>
-# host is name of ssh host
-# dir is directory of nsd trunk on host
-{
-	echo "$1 begin on "`date` | tee -a $REPORT_FILE
-
-	DISABLE=""
-	if test $IP6 = no; then
-		DISABLE="--disable-ipv6"
-	fi
-	if test x$LDNS != x; then
-		DISABLE="--with-ldns=$LDNS $DISABLE"
-	fi
-	if test x$LIBEVENT != x; then
-		DISABLE="--with-libevent=$LIBEVENT $DISABLE"
-	fi
-
-	cat >makeconf.mak.$$ << EOF 
-#configure:	configure.ac
-#	$AC_CMD
-#	touch configure
-Makefile:	Makefile.in #configure
-	./configure $CONFIGURE_FLAGS $DISABLE
-	touch Makefile 
-EOF
-	scp makeconf.mak.$$ $1:$2
-	# determine make to use
-	tempx=`ssh $1 "cd $2; which gmake"`
-	MAKE_CMD=`ssh $1 "cd $2; if test -f '$tempx'; then echo $tempx; else echo $MAKE_CMD; fi"`
-
-	if test $SVN = yes; then
-		echossh $1 "cd $2; svn up"
-		echossh $1 "cd $2; $MAKE_CMD -f makeconf.mak.$$ configure"
-	else
-		# svn and autoconf locally
-		echo "fake svn via svnexport, tar, autoconf, bison, flex."
-		svn export svn+ssh://open.nlnetlabs.nl/svn/nsd/trunk unbound_ttt
-		(cd unbound_ttt; $AC_CMD; rm -r autom4te* .c-mode-rc.el .cvsignore)
-		if test $FIXCONFIGURE = yes; then
-			echo fixing up configure length test.
-			(cd unbound_ttt; mv configure oldconf; sed -e 's?while (test "X"?lt_cv_sys_max_cmd_len=65500; echo skip || while (test "X"?' <oldconf >configure; chmod +x ./configure)
-		fi
-		du unbound_ttt
-		rsync -vrcpz --rsync-path=/home/wouter/bin/rsync unbound_ttt $1:unbound_ttt
-		# tar czf unbound_ttt.tgz unbound_ttt
-		rm -rf unbound_ttt
-		# ls -al unbound_ttt.tgz
-		# scp unbound_ttt.tgz $1:unbound_ttt.tar.gz
-		# rm unbound_ttt.tgz
-		# echossh $1 "gtar xzf unbound_ttt.tar.gz && rm unbound_ttt.tar.gz"
-	fi
-	echossh $1 "cd $2; $MAKE_CMD -f makeconf.mak.$$ Makefile"
-	echossh $1 "cd $2; $MAKE_CMD all tests"
-	echossh $1 "cd $2; $MAKE_CMD doc"
-	if test $RUN_TEST = yes; then
-	echossh $1 "cd $2; bash testcode/do-tests.sh"
-	echossh $1 "cd $2/testdata; sh ../testcode/mini_tpkg.sh -q report" | tee -a $REPORT_FILE
-	fi
-	echossh $1 "cd $2; rm -f makeconf.mak.$$"
-	rm -f makeconf.mak.$$
-	echo "$1 end on "`date` | tee -a $REPORT_FILE
-}
-
-echo "on "`date`" by $USER." > $REPORT_FILE
-echo "on "`date`" by $USER." > $LOG_FILE
-
-# read host names
-declare -a hostname desc dir vars
-IFS='	'
-i=0
-while read a b c d; do
-	if echo $a | grep "^#" >/dev/null; then
-		continue # skip it
-	fi
-	# append after arrays
-	hostname[$i]=$a
-	desc[$i]=$b
-	dir[$i]=$c
-	vars[$i]=$d
-	i=$(($i+1))
-done <$HOST_FILE
-echo "testing on $i hosts"
-
-# do the test
-for((i=0; i<${#hostname[*]}; i=$i+1)); do
-	if echo ${hostname[$i]} | grep "^#" >/dev/null; then
-		continue # skip it
-	fi
-	# echo "hostname=[${hostname[$i]}]"
-	# echo "desc=[${desc[$i]}]"
-	# echo "dir=[${dir[$i]}]"
-	# echo "vars=[${vars[$i]}]"
-	AC_CMD="libtoolize -c --force; autoconf && autoheader"
-	MAKE_CMD="make"
-	SVN=yes
-	IP6=yes
-	FIXCONFIGURE=no
-	RUN_TEST=yes
-	LDNS=
-	LIBEVENT=
-	eval ${vars[$i]}
-	echo "*** ${hostname[$i]} ${desc[$i]} ***" | tee -a $LOG_FILE | tee -a $REPORT_FILE
-	dotest ${hostname[$i]} ${dir[$i]} 2>&1 | tee -a $LOG_FILE
-done
-
-echo "done"
diff --git a/external/unbound/testcode/testbed.txt b/external/unbound/testcode/testbed.txt
deleted file mode 100644
index b0175049..00000000
--- a/external/unbound/testcode/testbed.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-Testbed.sh help page.
-
-Testbed helps in running the test packages (using tpkg(1)) on several systems.
-The script is specially written for unbound (edit it to change to different
-software). It is licensed BSD.
-
-The hosts to run on are listed in host_file.<username>. You need to have
-public-key authorized ssh access to these systems (or type your password lots
-and lots of times). The host_file describes the directories and environment
-of each host. You need only user-level access to the host.
-
-The host_file is very restrictive in formatting. Comments are lines starting
-with the # mark. The entries must be separated by tabs. Please list the
-hostname<tab>description<tab>checkoutdir<tab>variables
-
-hostname:	network hostname to ssh to.
-desc:		pretty text to describe the machine architecture.
-checkoutdir:	directory on the remote host where a svn checkout is present.
-variables:	zero or more variables separated by spaces. BLA=value BAR=val.
-
-Only important variable for unbound is the LDNS=<dir> variable that if present
-forces --with-ldns=<dir> to be passed to ./configure. In case LDNS is not
-installed on the system itself, but present somewhere else.
-
-You can also set LIBEVENT=<dir> for the libevent directory, if it is
-installed in a nonstandard location.
-
-*** Running the testbed
-
-Run by executing the script. It will take all the hosts from the file in 
-turn and update the svn directory there, possible autoreconf if necessary,
-possibly ./configure <args> if necessary, make the executables.
-Then it will run the testcode/do-tests script. This script should execute
-the tests that this host is capable of running.
-
-in testdata/testbed.log has a line-by-line log. See your make errors here.
-in testdata/testbed.report has only the tpkg reports. Summary.
-
diff --git a/external/unbound/testcode/testbound.c b/external/unbound/testcode/testbound.c
index daf8ddd4..fa361c4e 100644
--- a/external/unbound/testcode/testbound.c
+++ b/external/unbound/testcode/testbound.c
@@ -47,7 +47,7 @@
 #include "testcode/fake_event.h"
 #include "daemon/remote.h"
 #include "util/config_file.h"
-#include "ldns/keyraw.h"
+#include "sldns/keyraw.h"
 #include <ctype.h>
 
 /** signal that this is a testbound compile */
diff --git a/external/unbound/testcode/testpkts.c b/external/unbound/testcode/testpkts.c
index a494d9f0..d1960a41 100644
--- a/external/unbound/testcode/testpkts.c
+++ b/external/unbound/testcode/testpkts.c
@@ -27,11 +27,11 @@ struct sockaddr_storage;
 #include <ctype.h>
 #include "testcode/testpkts.h"
 #include "util/net_help.h"
-#include "ldns/sbuffer.h"
-#include "ldns/rrdef.h"
-#include "ldns/pkthdr.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/pkthdr.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 /** max size of a packet */
 #define MAX_PACKETLEN 65536
diff --git a/external/unbound/testcode/unitanchor.c b/external/unbound/testcode/unitanchor.c
index 8047eb2b..8819c5ab 100644
--- a/external/unbound/testcode/unitanchor.c
+++ b/external/unbound/testcode/unitanchor.c
@@ -43,8 +43,8 @@
 #include "util/data/dname.h"
 #include "testcode/unitmain.h"
 #include "validator/val_anchor.h"
-#include "ldns/sbuffer.h"
-#include "ldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/rrdef.h"
 
 /** test empty set */
 static void
diff --git a/external/unbound/testcode/unitdname.c b/external/unbound/testcode/unitdname.c
index 83d829fa..238c3edf 100644
--- a/external/unbound/testcode/unitdname.c
+++ b/external/unbound/testcode/unitdname.c
@@ -42,8 +42,8 @@
 #include "util/log.h"
 #include "testcode/unitmain.h"
 #include "util/data/dname.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
 
 /** put dname into buffer */
 static sldns_buffer*
diff --git a/external/unbound/testcode/unitldns.c b/external/unbound/testcode/unitldns.c
index 65170a82..e27e46ea 100644
--- a/external/unbound/testcode/unitldns.c
+++ b/external/unbound/testcode/unitldns.c
@@ -41,9 +41,9 @@
 #include "config.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 /** verbose this unit test */
 static int vbmp = 0; 
diff --git a/external/unbound/testcode/unitmain.c b/external/unbound/testcode/unitmain.c
index 4673214a..09ebba32 100644
--- a/external/unbound/testcode/unitmain.c
+++ b/external/unbound/testcode/unitmain.c
@@ -61,8 +61,8 @@
 #include "nss.h"
 #endif
 
-#include "ldns/rrdef.h"
-#include "ldns/keyraw.h"
+#include "sldns/rrdef.h"
+#include "sldns/keyraw.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 
diff --git a/external/unbound/testcode/unitmsgparse.c b/external/unbound/testcode/unitmsgparse.c
index b33a2408..ba4e234c 100644
--- a/external/unbound/testcode/unitmsgparse.c
+++ b/external/unbound/testcode/unitmsgparse.c
@@ -51,9 +51,9 @@
 #include "util/net_help.h"
 #include "testcode/readhex.h"
 #include "testcode/testpkts.h"
-#include "ldns/sbuffer.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 /** verbose message parse unit test */
 static int vbmp = 0;
diff --git a/external/unbound/testcode/unitneg.c b/external/unbound/testcode/unitneg.c
index d3968409..36fa6b90 100644
--- a/external/unbound/testcode/unitneg.c
+++ b/external/unbound/testcode/unitneg.c
@@ -45,7 +45,7 @@
 #include "util/data/dname.h"
 #include "testcode/unitmain.h"
 #include "validator/val_neg.h"
-#include "ldns/rrdef.h"
+#include "sldns/rrdef.h"
 
 /** verbose unit test for negative cache */
 static int negverbose = 0;
diff --git a/external/unbound/testcode/unitverify.c b/external/unbound/testcode/unitverify.c
index 2074f3c4..078af0a9 100644
--- a/external/unbound/testcode/unitverify.c
+++ b/external/unbound/testcode/unitverify.c
@@ -56,10 +56,10 @@
 #include "util/net_help.h"
 #include "util/module.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
-#include "ldns/keyraw.h"
-#include "ldns/str2wire.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/keyraw.h"
+#include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 /** verbose signature test */
 static int vsig = 0;
diff --git a/external/unbound/testdata/ctrl_pipe.tpkg b/external/unbound/testdata/ctrl_pipe.tpkg
new file mode 100644
index 00000000..877fcf90
Binary files /dev/null and b/external/unbound/testdata/ctrl_pipe.tpkg differ
diff --git a/external/unbound/testdata/fwd_capsid_strip.tpkg b/external/unbound/testdata/fwd_capsid_strip.tpkg
new file mode 100644
index 00000000..c0be8a3c
Binary files /dev/null and b/external/unbound/testdata/fwd_capsid_strip.tpkg differ
diff --git a/external/unbound/testdata/val_spurious_ns.rpl b/external/unbound/testdata/val_spurious_ns.rpl
new file mode 100644
index 00000000..741fd1af
--- /dev/null
+++ b/external/unbound/testdata/val_spurious_ns.rpl
@@ -0,0 +1,151 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with spurious unsigned NS in auth section 
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+SECTION AUTHORITY
+; removed by spurious NS record removal code
+;;example.com.	IN NS	ns.example.com.
+;;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END
diff --git a/external/unbound/testdata/val_ta_algo_dnskey_dp.rpl b/external/unbound/testdata/val_ta_algo_dnskey_dp.rpl
new file mode 100644
index 00000000..b23c0f1b
--- /dev/null
+++ b/external/unbound/testdata/val_ta_algo_dnskey_dp.rpl
@@ -0,0 +1,182 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.	3600	IN	DNSKEY	256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}"
+	trust-anchor: "example.com.	3600	IN	DS	30899 5 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	harden-algo-downgrade: no
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with multiple algorithm trust anchor without harden 
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+example.com.	3600	IN	DNSKEY	256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 512b}
+example.com.	3600	IN	RRSIG	DNSKEY 3 2 3600 20070926134150 20070829134150 2854 example.com. AKIIYDOGHogglFqJK94ZtOnF7EfGikgAyloMNRSMCrQgFaFkmcOyjrc= ;{id = 2854}
+example.com.	3600	IN	RRSIG	DNSKEY 5 2 3600 20070926134150 20070829134150 30899 example.com. J55fsz1GGMnngc4r50xvXDUdaVMlfcLKLVsfMhwNLF+ERac5XV/lLRAc/aSER+qQdsSo0CrjYjy1wat7YQpDAA== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. JNWECShNE+nCLQwOXJJ3xpUkh2G+FCh5nk8uYAHIVQRse/BIvCMSlvRrtVyw9RnXvk5RR2bEgN0pRdLWW7ug5Q== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. JNWECShNE+nCLQwOXJJ3xpUkh2G+FCh5nk8uYAHIVQRse/BIvCMSlvRrtVyw9RnXvk5RR2bEgN0pRdLWW7ug5Q== ;{id = 30899}
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+SCENARIO_END
diff --git a/external/unbound/testdata/val_ta_algo_missing_dp.rpl b/external/unbound/testdata/val_ta_algo_missing_dp.rpl
new file mode 100644
index 00000000..2cf0556f
--- /dev/null
+++ b/external/unbound/testdata/val_ta_algo_missing_dp.rpl
@@ -0,0 +1,185 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.	3600	IN	DNSKEY	256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}"
+	trust-anchor: "example.com.	3600	IN	DS	30899 5 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512"
+	trust-anchor: "example.com.	3600	IN	DS	30899 7 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	harden-algo-downgrade: no
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with multiple algorithm missing one
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+example.com.	3600	IN	DNSKEY	256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 512b}
+example.com.	3600	IN	RRSIG	DNSKEY 3 2 3600 20070926134150 20070829134150 2854 example.com. AKIIYDOGHogglFqJK94ZtOnF7EfGikgAyloMNRSMCrQgFaFkmcOyjrc= ;{id = 2854}
+example.com.	3600	IN	RRSIG	DNSKEY 5 2 3600 20070926134150 20070829134150 30899 example.com. J55fsz1GGMnngc4r50xvXDUdaVMlfcLKLVsfMhwNLF+ERac5XV/lLRAc/aSER+qQdsSo0CrjYjy1wat7YQpDAA== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. JNWECShNE+nCLQwOXJJ3xpUkh2G+FCh5nk8uYAHIVQRse/BIvCMSlvRrtVyw9RnXvk5RR2bEgN0pRdLWW7ug5Q== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com.	3600	IN	A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. JNWECShNE+nCLQwOXJJ3xpUkh2G+FCh5nk8uYAHIVQRse/BIvCMSlvRrtVyw9RnXvk5RR2bEgN0pRdLWW7ug5Q== ;{id = 30899}
+www.example.com.	3600	IN	RRSIG	A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20070926134150 20070829134150 30899 example.com. YTqtYba73HIOQuPr5oDyIX9pfmz1ybEBjwlD/jUgcPmFINUOZ9FeqG6ywgRKwn4AizkKTK00p1sxZYMKxl91wg== ;{id = 30899}
+
+SECTION ADDITIONAL
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.com. Dn1ziMKrc3NdJkSv8g61Y9WNk3+BAuwCwnYzAZiHmkejkSCPViLJN7+f4Conp9l8LkTl50ZnLgoYrrUYNhMj6w== ;{id = 30899}
+ENTRY_END
+
+SCENARIO_END
diff --git a/external/unbound/util/alloc.c b/external/unbound/util/alloc.c
index 4b81beb4..66bdc7db 100644
--- a/external/unbound/util/alloc.c
+++ b/external/unbound/util/alloc.c
@@ -367,8 +367,12 @@ void *unbound_stat_malloc(size_t size)
 /** calloc with stats */
 void *unbound_stat_calloc(size_t nmemb, size_t size)
 {
-	size_t s = (nmemb*size==0)?(size_t)1:nmemb*size;
-	void* res = calloc(1, s+16);
+	size_t s;
+	void* res;
+	if(nmemb != 0 && INT_MAX/nmemb < size)
+		return NULL; /* integer overflow check */
+	s = (nmemb*size==0)?(size_t)1:nmemb*size;
+	res = calloc(1, s+16);
 	if(!res) return NULL;
 	log_info("stat %p=calloc(%u, %u)", res+16, (unsigned)nmemb, (unsigned)size);
 	unbound_mem_alloc += s;
@@ -503,8 +507,12 @@ void *unbound_stat_malloc_lite(size_t size, const char* file, int line,
 void *unbound_stat_calloc_lite(size_t nmemb, size_t size, const char* file,
         int line, const char* func)
 {
-	size_t req = nmemb * size;
-	void* res = malloc(req+lite_pad*2+sizeof(size_t));
+	size_t req;
+	void* res;
+	if(nmemb != 0 && INT_MAX/nmemb < size)
+		return NULL; /* integer overflow check */
+	req = nmemb * size;
+	res = malloc(req+lite_pad*2+sizeof(size_t));
 	if(!res) return NULL;
 	memmove(res, lite_pre, lite_pad);
 	memmove(res+lite_pad, &req, sizeof(size_t));
diff --git a/external/unbound/util/alloc.h b/external/unbound/util/alloc.h
index ffd605c5..43fc30f9 100644
--- a/external/unbound/util/alloc.h
+++ b/external/unbound/util/alloc.h
@@ -177,8 +177,8 @@ void alloc_set_id_cleanup(struct alloc_cache* alloc, void (*cleanup)(void*),
 	void* arg);
 
 #ifdef UNBOUND_ALLOC_LITE
-#  include <ldns/ldns.h>
-#  include <ldns/packet.h>
+#  include <sldns/ldns.h>
+#  include <sldns/packet.h>
 #  ifdef HAVE_OPENSSL_SSL_H
 #    include <openssl/ssl.h>
 #  endif
diff --git a/external/unbound/util/config_file.c b/external/unbound/util/config_file.c
index 35bc6452..9c6b43ca 100644
--- a/external/unbound/util/config_file.c
+++ b/external/unbound/util/config_file.c
@@ -55,11 +55,20 @@
 #include "util/regional.h"
 #include "util/fptr_wlist.h"
 #include "util/data/dname.h"
-#include "ldns/wire2str.h"
-#include "ldns/parseutil.h"
+#include "util/rtt.h"
+#include "sldns/wire2str.h"
+#include "sldns/parseutil.h"
 #ifdef HAVE_GLOB_H
 # include <glob.h>
 #endif
+#ifdef HAVE_PWD_H
+#include <pwd.h>
+#endif
+
+/** from cfg username, after daemonise setup performed */
+uid_t cfg_uid = (uid_t)-1;
+/** from cfg username, after daemonise setup performed */
+gid_t cfg_gid = (gid_t)-1;
 
 /** global config during parsing */
 struct config_parser_state* cfg_parser = 0;
@@ -126,6 +135,7 @@ config_create(void)
 	cfg->prefetch_key = 0;
 	cfg->infra_cache_slabs = 4;
 	cfg->infra_cache_numhosts = 10000;
+	cfg->infra_cache_min_rtt = 50;
 	cfg->delay_close = 0;
 	if(!(cfg->outgoing_avail_ports = (int*)calloc(65536, sizeof(int))))
 		goto error_exit;
@@ -146,6 +156,7 @@ config_create(void)
 	cfg->so_rcvbuf = 0;
 	cfg->so_sndbuf = 0;
 	cfg->so_reuseport = 0;
+	cfg->ip_transparent = 0;
 	cfg->num_ifs = 0;
 	cfg->ifs = NULL;
 	cfg->num_out_ifs = 0;
@@ -159,6 +170,7 @@ config_create(void)
 	cfg->harden_dnssec_stripped = 1;
 	cfg->harden_below_nxdomain = 0;
 	cfg->harden_referral_path = 0;
+	cfg->harden_algo_downgrade = 1;
 	cfg->use_caps_bits_for_id = 0;
 	cfg->private_address = NULL;
 	cfg->private_domain = NULL;
@@ -196,6 +208,7 @@ config_create(void)
 	cfg->remote_control_enable = 0;
 	cfg->control_ifs = NULL;
 	cfg->control_port = UNBOUND_CONTROL_PORT;
+	cfg->remote_control_use_cert = 1;
 	cfg->minimal_responses = 0;
 	cfg->rrset_roundrobin = 0;
 	cfg->max_udp_size = 4096;
@@ -361,6 +374,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_MEMSIZE("so-rcvbuf:", so_rcvbuf)
 	else S_MEMSIZE("so-sndbuf:", so_sndbuf)
 	else S_YNO("so-reuseport:", so_reuseport)
+	else S_YNO("ip-transparent:", ip_transparent)
 	else S_MEMSIZE("rrset-cache-size:", rrset_cache_size)
 	else S_POW2("rrset-cache-slabs:", rrset_cache_slabs)
 	else S_YNO("prefetch:", prefetch)
@@ -369,6 +383,10 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	{ IS_NUMBER_OR_ZERO; cfg->max_ttl = atoi(val); MAX_TTL=(time_t)cfg->max_ttl;}
 	else if(strcmp(opt, "cache-min-ttl:") == 0)
 	{ IS_NUMBER_OR_ZERO; cfg->min_ttl = atoi(val); MIN_TTL=(time_t)cfg->min_ttl;}
+	else if(strcmp(opt, "infra-cache-min-rtt:") == 0) {
+	    IS_NUMBER_OR_ZERO; cfg->infra_cache_min_rtt = atoi(val);
+	    RTT_MIN_TIMEOUT=cfg->infra_cache_min_rtt;
+	}
 	else S_NUMBER_OR_ZERO("infra-host-ttl:", host_ttl)
 	else S_POW2("infra-cache-slabs:", infra_cache_slabs)
 	else S_SIZET_NONZERO("infra-cache-numhosts:", infra_cache_numhosts)
@@ -389,6 +407,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("harden-dnssec-stripped:", harden_dnssec_stripped)
 	else S_YNO("harden-below-nxdomain:", harden_below_nxdomain)
 	else S_YNO("harden-referral-path:", harden_referral_path)
+	else S_YNO("harden-algo-downgrade:", harden_algo_downgrade)
 	else S_YNO("use-caps-for-id", use_caps_bits_for_id)
 	else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold)
 	else S_STRLIST("private-address:", private_address)
@@ -437,7 +456,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	{ IS_NUMBER_OR_ZERO; cfg->val_sig_skew_max = (int32_t)atoi(val); }
 	else if (strcmp(opt, "outgoing-interface:") == 0) {
 		char* d = strdup(val);
-		char** oi = (char**)malloc((cfg->num_out_ifs+1)*sizeof(char*));
+		char** oi = 
+		(char**)reallocarray(NULL, (size_t)cfg->num_out_ifs+1, sizeof(char*));
 		if(!d || !oi) { free(d); free(oi); return -1; }
 		if(cfg->out_ifs && cfg->num_out_ifs) {
 			memmove(oi, cfg->out_ifs, cfg->num_out_ifs*sizeof(char*));
@@ -609,6 +629,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_MEM(opt, "so-rcvbuf", so_rcvbuf)
 	else O_MEM(opt, "so-sndbuf", so_sndbuf)
 	else O_YNO(opt, "so-reuseport", so_reuseport)
+	else O_YNO(opt, "ip-transparent", ip_transparent)
 	else O_MEM(opt, "rrset-cache-size", rrset_cache_size)
 	else O_DEC(opt, "rrset-cache-slabs", rrset_cache_slabs)
 	else O_YNO(opt, "prefetch-key", prefetch_key)
@@ -617,6 +638,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_DEC(opt, "cache-min-ttl", min_ttl)
 	else O_DEC(opt, "infra-host-ttl", host_ttl)
 	else O_DEC(opt, "infra-cache-slabs", infra_cache_slabs)
+	else O_DEC(opt, "infra-cache-min-rtt", infra_cache_min_rtt)
 	else O_MEM(opt, "infra-cache-numhosts", infra_cache_numhosts)
 	else O_UNS(opt, "delay-close", delay_close)
 	else O_YNO(opt, "do-ip4", do_ip4)
@@ -646,6 +668,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "harden-dnssec-stripped", harden_dnssec_stripped)
 	else O_YNO(opt, "harden-below-nxdomain", harden_below_nxdomain)
 	else O_YNO(opt, "harden-referral-path", harden_referral_path)
+	else O_YNO(opt, "harden-algo-downgrade", harden_algo_downgrade)
 	else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
 	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
 	else O_YNO(opt, "do-not-query-localhost", donotquery_localhost)
@@ -799,6 +822,7 @@ config_read(struct config_file* cfg, const char* filename, const char* chroot)
 		errno=EINVAL;
 		return 0;
 	}
+
 	return 1;
 }
 
@@ -981,7 +1005,7 @@ int cfg_condense_ports(struct config_file* cfg, int** avail)
 	*avail = NULL;
 	if(num == 0)
 		return 0;
-	*avail = (int*)malloc(sizeof(int)*num);
+	*avail = (int*)reallocarray(NULL, (size_t)num, sizeof(int));
 	if(!*avail)
 		return 0;
 	for(i=0; i<65536; i++) {
@@ -1181,12 +1205,29 @@ config_apply(struct config_file* config)
 {
 	MAX_TTL = (time_t)config->max_ttl;
 	MIN_TTL = (time_t)config->min_ttl;
+	RTT_MIN_TIMEOUT = config->infra_cache_min_rtt;
 	EDNS_ADVERTISED_SIZE = (uint16_t)config->edns_buffer_size;
 	MINIMAL_RESPONSES = config->minimal_responses;
 	RRSET_ROUNDROBIN = config->rrset_roundrobin;
 	log_set_time_asc(config->log_time_ascii);
 }
 
+void config_lookup_uid(struct config_file* cfg)
+{
+#ifdef HAVE_GETPWNAM
+	/* translate username into uid and gid */
+	if(cfg->username && cfg->username[0]) {
+		struct passwd *pwd;
+		if((pwd = getpwnam(cfg->username)) != NULL) {
+			cfg_uid = pwd->pw_uid;
+			cfg_gid = pwd->pw_gid;
+		}
+	}
+#else
+	(void)cfg;
+#endif
+}
+
 /** 
  * Calculate string length of full pathname in original filesys
  * @param fname: the path name to convert.
diff --git a/external/unbound/util/config_file.h b/external/unbound/util/config_file.h
index 49ffbdde..a3479b28 100644
--- a/external/unbound/util/config_file.h
+++ b/external/unbound/util/config_file.h
@@ -119,6 +119,8 @@ struct config_file {
 	size_t infra_cache_slabs;
 	/** max number of hosts in the infra cache */
 	size_t infra_cache_numhosts;
+	/** min value for infra cache rtt */
+	int infra_cache_min_rtt;
 	/** delay close of udp-timeouted ports, if 0 no delayclose. in msec */
 	int delay_close;
 
@@ -134,6 +136,8 @@ struct config_file {
 	size_t so_sndbuf;
 	/** SO_REUSEPORT requested on port 53 sockets */
 	int so_reuseport;
+	/** IP_TRANSPARENT socket option requested on port 53 sockets */
+	int ip_transparent;
 
 	/** number of interfaces to open. If 0 default all interfaces. */
 	int num_ifs;
@@ -171,6 +175,8 @@ struct config_file {
 	int harden_below_nxdomain;
 	/** harden the referral path, query for NS,A,AAAA and validate */
 	int harden_referral_path;
+	/** harden against algorithm downgrade */
+	int harden_algo_downgrade;
 	/** use 0x20 bits in query as random ID bits */
 	int use_caps_bits_for_id;
 	/** strip away these private addrs from answers, no DNS Rebinding */
@@ -282,6 +288,8 @@ struct config_file {
 	struct config_strlist* control_ifs;
 	/** port number for the control port */
 	int control_port;
+	/** use certificates for remote control */
+	int remote_control_use_cert;
 	/** private key file for server */
 	char* server_key_file;
 	/** certificate file for server */
@@ -339,6 +347,11 @@ struct config_file {
 	int dnstap_log_forwarder_response_messages;
 };
 
+/** from cfg username, after daemonise setup performed */
+extern uid_t cfg_uid;
+/** from cfg username, after daemonise setup performed */
+extern gid_t cfg_gid;
+
 /**
  * Stub config options
  */
@@ -422,6 +435,12 @@ void config_delete(struct config_file* config);
  */
 void config_apply(struct config_file* config);
 
+/**
+ * Find username, sets cfg_uid and cfg_gid.
+ * @param config: the config structure.
+ */
+void config_lookup_uid(struct config_file* config);
+
 /**
  * Set the given keyword to the given value.
  * @param config: where to store config
diff --git a/external/unbound/util/configlexer.c b/external/unbound/util/configlexer.c
index 4a0380e6..fcade1ac 100644
--- a/external/unbound/util/configlexer.c
+++ b/external/unbound/util/configlexer.c
@@ -363,8 +363,8 @@ static void yy_fatal_error (yyconst char msg[]  );
 	*yy_cp = '\0'; \
 	(yy_c_buf_p) = yy_cp;
 
-#define YY_NUM_RULES 162
-#define YY_END_OF_BUFFER 163
+#define YY_NUM_RULES 166
+#define YY_END_OF_BUFFER 167
 /* This struct is not used in this scanner,
    but its presence is necessary. */
 struct yy_trans_info
@@ -372,185 +372,190 @@ struct yy_trans_info
 	flex_int32_t yy_verify;
 	flex_int32_t yy_nxt;
 	};
-static yyconst flex_int16_t yy_accept[1611] =
+static yyconst flex_int16_t yy_accept[1655] =
     {   0,
-        1,    1,  144,  144,  148,  148,  152,  152,  156,  156,
-        1,    1,  163,  160,    1,  142,  142,  161,    2,  161,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  144,
-      145,  145,  146,  161,  148,  149,  149,  150,  161,  155,
-      152,  153,  153,  154,  161,  156,  157,  157,  158,  161,
-      159,  143,    2,  147,  161,  159,  160,    0,    1,    2,
-        2,    2,    2,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+        1,    1,  148,  148,  152,  152,  156,  156,  160,  160,
+        1,    1,  167,  164,    1,  146,  146,  165,    2,  165,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  148,
+      149,  149,  150,  165,  152,  153,  153,  154,  165,  159,
+      156,  157,  157,  158,  165,  160,  161,  161,  162,  165,
+      163,  147,    2,  151,  165,  163,  164,    0,    1,    2,
+        2,    2,    2,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  144,    0,  148,    0,  155,    0,  152,  156,
-        0,  159,    0,    2,    2,  159,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  159,  160,  160,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  148,    0,  152,    0,  159,    0,  156,  160,
+        0,  163,    0,    2,    2,  163,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  163,  164,  164,  164,  164,  164,  164,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  159,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  163,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
 
-      160,  160,  160,  160,  160,   65,  160,  160,  160,  160,
-      160,    6,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  159,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,   68,  164,  164,
+      164,  164,  164,    6,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  163,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  159,  160,  160,  160,  160,   29,  160,  160,  160,
-      160,  160,  160,  160,  160,  129,  160,   12,   13,  160,
-       15,   14,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  122,
-      160,  160,  160,  160,  160,    3,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  163,  164,  164,  164,  164,   30,
+      164,  164,  164,  164,  164,  164,  164,  164,  133,  164,
+       12,   13,  164,   15,   14,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  126,  164,  164,  164,  164,  164,    3,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  159,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      151,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   32,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   33,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      163,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  155,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+       33,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+       34,  164,  164,  164,  164,  164,  164,  164,  164,  164,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,   80,  151,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   79,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   63,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,   83,
+      155,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,   82,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,   66,  164,
 
-      160,  160,   20,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   30,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-       31,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,   22,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,   20,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,   31,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+       32,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,   22,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
 
-      160,  160,  160,  160,   26,  160,   27,  160,  160,  160,
-       66,  160,   67,  160,   64,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-        5,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   82,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,   23,  160,  160,  160,
-      160,  107,  106,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,   26,  164,   27,  164,
+      164,  164,   69,  164,   70,  164,   67,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,    5,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,   85,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+       23,  164,  164,  164,  164,  164,  110,  109,  164,  164,
 
-      160,  160,   34,  160,  160,  160,  160,  160,  160,  160,
-      160,   69,   68,  160,  160,  160,  160,  160,  160,  160,
-      103,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   50,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,   54,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  105,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,    4,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,   35,  164,  164,
+      164,  164,  164,  164,  164,  164,   72,   71,  164,  164,
+      164,  164,  164,  164,  164,  106,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,   52,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,   56,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  108,  164,  164,
 
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  100,  160,  160,  160,  160,  160,  160,
-      160,  116,  101,  160,  127,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,   21,  160,  160,  160,  160,
-       71,  160,   72,   70,  160,  160,  160,  160,  160,  160,
-       78,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      102,  160,  160,  160,  160,  126,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,   62,  160,  160,
-      160,  160,  160,  160,  160,  160,   28,  160,  160,   17,
+      164,  164,  164,  164,  164,  164,  164,    4,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  103,  164,  164,  164,  164,  164,  164,  164,  119,
+      164,  104,  164,  131,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,   21,  164,  164,  164,  164,   74,
+      164,   75,   73,  164,  164,  164,  164,  164,  164,  164,
+       81,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  105,  164,  164,  164,  164,  130,  164,  164,
 
-      160,  160,  160,   16,  160,   87,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   41,
-       42,  160,  160,  160,  160,  160,  160,  130,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,   73,  160,  160,  160,  160,  160,   77,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,   81,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  121,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,   91,  160,   95,  160,  160,  160,  160,   76,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,   65,
+      164,  164,  164,  164,  164,  164,  164,  164,   28,  164,
+      164,   17,  164,  164,  164,   16,  164,   90,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,   42,   43,  164,  164,  164,  164,  164,  164,  164,
+      134,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,   76,  164,  164,  164,  164,  164,
+      164,   80,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,   84,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
 
-      160,  114,  160,  160,  160,  128,  160,  160,  160,  160,
-      160,  160,  160,  135,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,   94,  160,  160,  160,  160,   43,
-       44,  160,   49,   96,  160,  108,  104,  160,  160,   37,
-      160,   98,  160,  160,  160,  160,  160,    7,  160,   61,
-      113,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,   83,  134,  160,  160,
-      160,  160,  160,  160,  160,  160,  123,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,   97,
+      125,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,   94,  164,   98,
+      164,  164,  164,  164,   79,  164,  164,  117,  164,  164,
+      164,  164,  132,  164,  164,  164,  164,  164,  164,  164,
+      139,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,   97,  164,  164,  164,  164,  164,   44,   45,
+      164,   29,   51,   99,  164,  111,  107,  164,  164,   38,
+      164,  101,  164,  164,  164,  164,  164,    7,  164,   64,
+      116,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
 
-      160,   36,   38,  160,  160,  160,  160,  160,   60,  160,
-      160,  160,  160,  117,   18,   19,  160,  160,  160,  160,
-      160,  160,  160,   58,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  119,  160,  160,  160,  160,  160,  160,
-      160,  160,   35,  160,  160,  160,  160,  160,  160,   11,
-      160,  160,  160,  160,  160,  160,  160,   10,  160,  160,
-       39,  160,  125,  118,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,   90,   89,  160,  120,  115,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,   45,  160,  124,  160,
+      164,  164,  164,  164,  164,  164,  164,   86,  138,  164,
+      164,  164,  164,  164,  164,  164,  164,  127,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  100,  164,   37,   39,  164,  164,  164,  164,
+      164,   63,  164,  164,  164,  164,  121,   18,   19,  164,
+      164,  164,  164,  164,  164,  164,   61,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  123,  120,  164,  164,
+      164,  164,  164,  164,  164,  164,   36,  164,  164,  164,
+      164,  164,  164,  164,   11,  164,  164,  164,  164,  164,
+      164,  164,  164,   10,  164,  164,   40,  164,  129,  122,
 
-      160,  160,  160,   40,  160,  160,  160,   84,   86,  109,
-      160,  160,  160,   88,  160,  160,  160,  160,  160,  160,
-      160,  160,  131,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,   24,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  133,  160,  160,  112,  160,  160,  160,  160,  160,
-      160,  160,   25,  160,    9,  160,  160,  110,   51,  160,
-      160,  160,   93,  160,  160,  160,  160,  160,  160,  132,
-       74,  160,  160,  160,   53,   57,   52,  160,   46,  160,
-        8,  160,  160,   92,  160,  160,  160,  160,  160,  160,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,   93,   92,  164,  124,  118,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,   46,  164,  128,  164,  164,  164,
+      164,   41,  164,  164,  164,   87,   89,  112,  164,  164,
+      164,   91,  164,  164,  164,  164,  164,  164,  164,  164,
+      135,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,   24,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  137,  164,  164,  115,  164,  164,  164,  164,  164,
 
-      160,  160,  160,   56,  160,   47,  160,  111,  160,  160,
-       85,  160,  160,  160,  160,  160,  160,   75,   55,   48,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,   59,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,   99,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  138,  160,  160,  160,  160,  160,
-      160,  160,  160,  160,  160,  160,  160,  160,  136,  160,
+      164,  164,   49,  164,   25,  164,    9,  164,  164,  113,
+       53,  164,  164,  164,   96,  164,  164,  164,  164,  164,
+      164,  136,   77,  164,  164,  164,  164,   55,   59,   54,
+      164,   47,  164,    8,  164,  164,   95,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,   60,   58,  164,   48,
+      164,  114,  164,  164,   88,  164,  164,  164,  164,  164,
+      164,   78,   57,   50,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+       62,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
 
-      139,  140,  160,  160,  160,  160,  160,  137,  141,    0
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  102,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  142,  164,
+      164,  164,  164,  164,  164,  164,  164,  164,  164,  164,
+      164,  164,  140,  164,  143,  144,  164,  164,  164,  164,
+      164,  141,  145,    0
     } ;
 
 static yyconst flex_int32_t yy_ec[256] =
@@ -593,373 +598,381 @@ static yyconst flex_int32_t yy_meta[40] =
         1,    1,    1,    1,    1,    1,    1,    1,    1
     } ;
 
-static yyconst flex_int16_t yy_base[1625] =
+static yyconst flex_int16_t yy_base[1669] =
     {   0,
         0,    0,   37,   40,   44,   51,   63,   75,   56,   68,
-       87,  108, 2844, 2315,   50, 3201, 3201, 3201,  129,   94,
+       87,  108, 2501, 2145,   50, 3281, 3281, 3281,  129,   94,
        70,  104,  130,   90,   92,  115,  127,   95,   84,  111,
-      137,  148,   50,  150,  155,  157,  163,  171,  178, 2213,
-     3201, 3201, 3201,   70, 2102, 3201, 3201, 3201,   42, 1930,
-     1613, 3201, 3201, 3201,  195, 1340, 3201, 3201, 3201,  141,
-     1156, 3201,  202, 3201,  206,  122, 1017,  212,  120,    0,
+      137,  148,   50,  150,  155,  157,  163,  171,  178, 2001,
+     3281, 3281, 3281,   70, 1900, 3281, 3281, 3281,   42, 1856,
+     1448, 3281, 3281, 3281,  195, 1202, 3281, 3281, 3281,  141,
+     1174, 3281,  202, 3281,  206,  122, 1044,  212,  120,    0,
       223,    0,    0,  103,  147,  154,  158,  192,  199,  207,
       208,  205,  209,  221,  218,  220,  224,  225,  229,  230,
       231,  238,  251,  236,  247,  250,  237,  248,  256,  259,
 
       167,  263,  254,  249,  264,  265,  271,  273,  274,  125,
       275,  277,  284,  278,  281,  285,  288,  286,  289,  292,
-      296,  298,  987,  308,  860,  315,  829,  326,  692,  342,
+      296,  298, 1016,  308,  746,  315,  650,  326,  474,  368,
       319,  301,  330,  334,    0,  327,  331,  337,  314,  305,
       333,  335,  343,  340,  346,  349,  370,  350,  339,  352,
-       49,  356,  354,  353,  361,  363,  362,  366,  364,  368,
-      373,  377,  381,  392,  399,  386,  383,  401,  397,  405,
-      408,  406,  182,  407,  409,  410,  385,  411,  414,  412,
-      416,  418,  424,  420,  421,  422,  430,  428,  431,  441,
-      444,  450,  433,  446,  448,  449,  456,  454,  453,  455,
+       49,  356,  354,  353,  361,  363,  362,  366,  372,  365,
+      377,  386,  382,  394,  401,  388,  387,  403,  399,  407,
+      410,  406,  182,  395,  411,  342,  412,  409,  414,  416,
+      418,  419,  427,  423,  426,  425,  435,  429,  433,  441,
+      436,  444,  447,  446,  450,  451,  457,  455,  453,  456,
 
-      461,  460,  463,  464,  474,  475,  477,  470,  472,  479,
-      480,  481,  488,  489,  491,  493,  499,  495,  496,  497,
-      500,  501,  504,  505,  507,  511,  517,  512,  508,  521,
-      510,  516,  523,  534,  527,  538,  532,  533,  542,  540,
-      545,  543,  546,  547,  558,  554,  555,  559,  556,  557,
-      563,  571,  575,  565,  568,  569,  577,  579,  581,  599,
-      585,  583,  587,  590,  589,  596,  610,  597,  606,  607,
-      624,  603,  612,  625,  627,  628,  632,  631,  634,  636,
-      635,  637,  638,  640,  641,  644,  645,  656,  659,  648,
-      665,  662,  667,  664,  670,  593,  677,  673,  675,  674,
+      462,  461,  464,  471,  476,  477,  479,  465,  475,  482,
+      483,  484,  494,  488,  491,  495,  501,  497,  498,  499,
+      505,  503,  506,  507,  508,  509,  515,  519,  513,  512,
+      514,  527,  528,  530,  531,  536,  537,  538,  539,  543,
+      545,  546,  549,  547,  553,  561,  557,  559,  560,  566,
+      567,  569,  575,  571,  568,  572,  579,  581,  582,  584,
+      602,  591,  587,  590,  574,  597,  599,  608,  600,  607,
+      609,  615,  613,  623,  630,  626,  627,  631,  634,  635,
+      636,  639,  638,  641,  643,  644,  646,  647,  657,  659,
+      660,  670,  666,  667,  648,  673,  664,  674,  681,  679,
 
-      676,  646,  682,  678,  688, 3201,  690,  679,  685,  692,
-      695, 3201,  696,  697,  698,  703,  702,  709,  705,  706,
-      711,  714,  715,  719,  713,  720,  740,  722,  721,  731,
-      735,  725,  733,  727,  743,  747,  749,  750,  751,  753,
-      754,  755,  757,  758,  763,  774,  760,  768,  771,  778,
-      779,  780,  782,  781,  787,  783,  794,  788,  798,  804,
-      800,  806,  808,  814,  810,  811,  813,  820,  818,  819,
-      812,  826,  823,  825,  830,  834,  827,  841,  837,  840,
-      844,  847,  849,  850,  851,  853,  859,  857,  858,  866,
-      868,  856,  864,  871,  872,  877,  884,  885,  881,  886,
+      680,  682,  683,  684,  686,  688,  692, 3281,  695,  690,
+      697,  698,  701, 3281,  699,  702,  703,  710,  704,  721,
+      706,  708,  714,  723,  718,  720,  726,  728,  748,  731,
+      729,  739,  737,  732,  757,  736,  759,  738,  743,  750,
+      762,  741,  766,  767,  768,  769,  773,  775,  778,  779,
+      772,  783,  780,  786,  788,  789,  793,  794,  800,  801,
+      803,  806,  812,  809,  816,  822,  811,  818,  820,  826,
+      825,  828,  819,  835,  831,  827,  834,  843,  838,  840,
+      850,  848,  849,  847,  853,  855,  859,  860,  862,  866,
+      863,  867,  872,  877,  865,  871,  879,  878,  886,  893,
 
-      892,  893,  888,  894,  897,  898,  899,  900,  901,  902,
-      906,  908,  909,  917,  903,  913,  919,  925,  927,  928,
-      910,  930,  931,  934,  933,  937,  941,  935,  945,  947,
-      948,  949,  955,  957,  950,  959, 3201,  969,  963,  965,
-      966,  970,  972,  951,  991, 3201,  973, 3201, 3201,  975,
-     3201, 3201,  974,  979,  982,  994, 1014,  993,  981,  980,
-     1001, 1007,  995, 1008,  997, 1019, 1022, 1023, 1011, 1015,
-     1027, 1029, 1024, 1036, 1037, 1041, 1043, 1049, 1045, 1046,
-     1047, 1050, 1051, 1056, 1053, 1063, 1057, 1064, 1066, 3201,
-     1067, 1068, 1071, 1073, 1075, 3201, 1074, 1076, 1077, 1079,
+      894,  887,  895,  902,  903,  880,  904,  890,  900,  907,
+      909,  910,  911,  912,  915,  916,  922,  919,  923,  921,
+      928,  930,  932,  934,  936,  937,  940,  943,  941,  942,
+      951,  952,  954,  956,  955,  958,  962,  957,  964, 3281,
+      972,  971,  968,  974,  976,  977,  979, 1005, 3281,  981,
+     3281, 3281,  982, 3281, 3281,  985,  983,  986,  993, 1028,
+      997,  991,  987,  998, 1007, 1008, 1018, 1011, 1020, 1000,
+     1031, 1022, 1013, 1023, 1037, 1038, 1034, 1025, 1048, 1051,
+     1057, 1059, 1055, 1056, 1060, 1061, 1063, 1065, 1064, 1067,
+     1072, 1078, 1074, 3281, 1076, 1075, 1082, 1077, 1084, 3281,
 
-     1080, 1083, 1084, 1087, 1089, 1090, 1092, 1094, 1100, 1096,
-     1097, 1110, 1117, 1114, 1104, 1113, 1115, 1119, 1121, 1129,
-     1127, 1126, 1128, 1136, 1132, 1134, 1138, 1135, 1139, 1142,
-     1145, 1146, 1170, 1147, 1148, 1149, 1153, 1154, 1157, 1158,
-     1162, 1165, 1177, 1178, 1176, 1164, 1184, 1187, 1194, 1195,
-     1197, 1191, 1155, 1199, 1204, 1206, 1208, 1188, 1211, 1212,
-     3201, 1218, 1217, 1215, 1219, 1223, 1224, 1226, 1225, 1231,
-     1227, 1237, 1229, 1245, 3201, 1230, 1239, 1233, 1241, 1250,
-     1253, 1252, 1259, 1267, 3201, 1269, 1270, 1263, 1265, 1256,
-     1272, 1273, 1277, 1278, 1279, 1281, 1284, 1287, 1289, 1288,
+     1085, 1086, 1088, 1090, 1094, 1097, 1096, 1098, 1100, 1101,
+     1099, 1107, 1113, 1103, 1111, 1127, 1129, 1126, 1112, 1128,
+     1132, 1114, 1133, 1141, 1139, 1138, 1144, 1148, 1145, 1147,
+     1150, 1151, 1154, 1152, 1153, 1155, 1178, 1159, 1160, 1161,
+     1164, 1162, 1168, 1170, 1172, 1173, 1180, 1191, 1190, 1192,
+     1193, 1197, 1205, 1208, 1198, 1201, 1211, 1212, 1217, 1215,
+     1219, 1221, 1222, 1229, 1226, 3281, 1236, 1237, 1223, 1232,
+     1233, 1239, 1243, 1244, 1246, 1247, 1248, 1249, 1251, 1255,
+     3281, 1254, 1256, 1257, 1261, 1262, 1264, 1270, 1275, 1282,
+     3281, 1285, 1286, 1278, 1283, 1271, 1289, 1288, 1294, 1295,
 
-     1292, 1291, 1293, 1296, 1300, 1299, 1302, 1301, 1305, 1303,
-     1242, 1315, 1322, 1311, 1321, 1318, 1324, 1323, 1329, 1327,
-     1330, 1328, 1331, 3201,  239, 1332, 1333, 1334, 1341, 1349,
-     1350, 1343, 1351, 1353, 1352, 1359, 1342, 1363, 1360, 1364,
-     1366, 1368, 1371, 1372, 1373, 1377, 1375, 1381, 1383, 1382,
-     1384, 1385, 1391, 1394, 1392, 1396, 1397, 1398, 1399, 1400,
-     1402, 1406, 1405, 1410, 3201, 1427, 1412, 1415, 1413, 1424,
-     1435, 1428, 1431, 1432, 1442, 1438, 1440, 1443, 1449, 1446,
-     1451, 1452, 1436, 1458, 1462, 1459, 1461, 1460, 1468, 3201,
-     1463, 1470, 1471, 1472, 1473, 1475, 1477, 1480, 1481, 1488,
+     1296, 1297, 1301, 1304, 1305, 1293, 1312, 1306, 1308, 1310,
+     1316, 1317, 1318, 1319, 1325, 1104, 1320, 1326, 1336, 1333,
+     1335, 1338, 1339, 1340, 1345, 1342, 1346, 1343, 1344, 3281,
+      239, 1347, 1349, 1350, 1356, 1359, 1358, 1365, 1366, 1367,
+     1368, 1371, 1373, 1374, 1376, 1377, 1378, 1381, 1385, 1382,
+     1389, 1391, 1394, 1392, 1398, 1399, 1400, 1403, 1402, 1409,
+     1406, 1411, 1412, 1416, 1417, 1414, 1418, 1420, 1422, 1425,
+     1424, 1432, 3281, 1435, 1431, 1434, 1436, 1443, 1451, 1447,
+     1452, 1449, 1454, 1460, 1457, 1459, 1465, 1467, 1469, 1471,
+     1461, 1472, 1479, 1482, 1480, 1483, 1484, 1481, 3281, 1491,
 
-     1482, 1494, 3201, 1496, 1490, 1484, 1501, 1502, 1505, 1507,
-     1509, 1510, 1511, 1513, 1514, 1517, 1515, 1520, 1524, 3201,
-     1528, 1532, 1529, 1540, 1536, 1525, 1537, 1539, 1541, 1542,
-     1551, 1543, 1547, 1550, 1552, 1549, 1554, 1555, 1557, 1559,
-     3201, 1571, 1572, 1574, 1414, 1562, 1583, 1556, 1575, 1558,
-     1584, 1585, 1587, 1588, 1589, 1590, 1593, 1595, 1591, 1597,
-     1596, 1599, 1600, 1608, 1598, 1617, 1618, 1619, 1601, 1623,
-     1629, 1632, 1620, 3201, 1631, 1634, 1635, 1636, 1642, 1644,
-     1638, 1640, 1645, 1646, 1647, 1656, 1648, 1650, 1654, 1658,
-     1652, 1660, 1661, 1662, 1670, 1664, 1672, 1674, 1678, 1680,
+     1473, 1486, 1489, 1494, 1497, 1496, 1499, 1501, 1507, 1508,
+     1512, 3281, 1515, 1509, 1516, 1520, 1521, 1525, 1522, 1529,
+     1530, 1531, 1532, 1533, 1542, 1534, 1539, 1537, 3281, 1551,
+     1553, 1549, 1560, 1547, 1557, 1558, 1562, 1559, 1563, 1570,
+     1564, 1567, 1571, 1572, 1568, 1566, 1574, 1575, 1577, 1578,
+     3281, 1595, 1593, 1596, 1597, 1598, 1606, 1581, 1603, 1605,
+     1582, 1607, 1610, 1609, 1611, 1613, 1616, 1618, 1619, 1620,
+     1621, 1622, 1623, 1632, 1638, 1626, 1640, 1630, 1642, 1629,
+     1646, 1652, 1658, 1654, 3281, 1657, 1659, 1660, 1661, 1662,
+     1668, 1670, 1664, 1666, 1671, 1672, 1673, 1687, 1674, 1676,
 
-     1682, 1684, 1686, 1694, 3201, 1690, 3201, 1691, 1692, 1700,
-     3201, 1702, 3201, 1704, 3201, 1707, 1711, 1699, 1697, 1705,
-     1713, 1709, 1716, 1717, 1720, 1723, 1725, 1726, 1727, 1728,
-     3201, 1729, 1734, 1731, 1735, 1738, 1739, 1740, 1744, 1756,
-     1741, 1743, 1753, 1754, 3201, 1750, 1762, 1764, 1765, 1766,
-     1773, 1770, 1771, 1777, 1767, 1778, 1788, 1786, 1779, 1789,
-     1790, 1791, 1793, 1794, 1801, 1798, 1795, 1802, 1804, 1805,
-     1806, 1807, 1814, 1811, 1812, 1815, 3201, 1823, 1821, 1817,
-     1825, 3201, 3201, 1834, 1827, 1835, 1837, 1839, 1842, 1843,
-     1845, 1849, 1847, 1850, 1851, 1856, 1857, 1858, 1859, 1862,
+     1680, 1684, 1678, 1686, 1689, 1700, 1705, 1690, 1696, 1702,
+     1688, 1713, 1714, 1716, 1698, 1722, 3281, 1706, 3281, 1721,
+     1727, 1730, 3281, 1732, 3281, 1734, 3281, 1735, 1736, 1729,
+     1715, 1739, 1741, 1742, 1748, 1723, 1749, 1745, 1751, 1752,
+     1754, 1755, 3281, 1758, 1761, 1763, 1759, 1765, 1766, 1768,
+     1769, 1777, 1771, 1783, 1780, 1782, 1784, 3281, 1787, 1788,
+     1792, 1793, 1796, 1800, 1798, 1797, 1805, 1801, 1809, 1820,
+     1807, 1816, 1817, 1818, 1819, 1827, 1821, 1823, 1830, 1832,
+     1825, 1831, 1833, 1835, 1840, 1841, 1847, 1839, 1845, 1846,
+     3281, 1850, 1848, 1857, 1860, 1858, 3281, 3281, 1862, 1868,
 
-     1860, 1866, 3201, 1872, 1868, 1878, 1869, 1865, 1887, 1879,
-     1888, 3201, 3201, 1881, 1880, 1890, 1894, 1900, 1896, 1898,
-     3201, 1899, 1901, 1902, 1904, 1906, 1914, 1903, 1910, 1918,
-     1915, 1920, 1921, 1927, 1924, 1928, 1931, 1935, 1939, 3201,
-     1940, 1942, 1943, 1945, 1944, 1947, 1948, 1951, 1952, 1957,
-     1954, 1965, 1967, 1958, 1966, 1960, 1971, 1968, 1973, 1976,
-     1983, 1981, 3201, 1987, 1986, 1994, 1990, 1992, 1995, 1998,
-     1997, 1999, 2000, 2001, 2002, 2006, 2003, 2007, 2010, 3201,
-     2013, 2018, 2012, 2024, 2025, 2014, 2032, 2026, 2028, 3201,
-     2036, 2042, 2035, 2038, 2047, 2043, 2049, 2039, 2050, 2051,
+     1870, 1866, 1876, 1873, 1877, 1878, 1884, 1881, 1883, 1888,
+     1890, 1891, 1893, 1894, 1895, 1897, 1898, 3281, 1904, 1902,
+     1911, 1909, 1907, 1919, 1910, 1921, 3281, 3281, 1917, 1922,
+     1926, 1928, 1934, 1932, 1931, 3281, 1933, 1936, 1937, 1938,
+     1941, 1945, 1939, 1950, 1952, 1955, 1956, 1958, 1964, 1960,
+     1957, 1961, 1974, 1963, 1977, 3281, 1971, 1979, 1981, 1982,
+     1983, 1984, 1985, 1986, 1988, 1989, 1990, 1995, 2003, 1999,
+     2002, 2004, 2007, 2008, 2012, 2014, 2015, 2022, 2023, 3281,
+     2030, 2016, 2032, 2018, 2036, 2037, 2044, 2033, 2029, 2031,
+     2040, 2041, 2042, 2054, 2048, 2056, 2050, 3281, 2058, 2062,
 
-     2053, 2054, 2057, 2062, 2056, 2064, 2069, 2071, 2078, 2075,
-     2081, 2082, 2079, 2083, 2089, 2086, 2087, 2088, 2092, 2099,
-     2093, 2101, 2097, 3201, 2103, 2108, 2111, 2112, 2114, 2116,
-     2104, 3201, 3201, 2120, 3201, 2121, 2124, 2125, 2126, 2128,
-     2129, 2127, 2134, 2141, 2130, 3201, 2137, 2140, 2142, 2143,
-     3201, 2154, 3201, 3201, 2147, 2155, 2156, 2159, 2162, 2166,
-     3201, 2163, 2157, 2167, 2169, 2171, 2172, 2174, 2176, 2175,
-     3201, 2180, 2179, 2178, 2188, 3201, 2187, 2193, 2182, 2189,
-     2198, 2199, 2202, 2203, 2205, 2211, 2209, 3201, 2210, 2212,
-     2216, 2218, 2219, 2220, 2223, 2224, 3201, 2233, 2234, 3201,
+     2064, 2059, 2068, 2065, 2071, 2069, 2073, 3281, 2075, 2081,
+     2078, 2083, 2085, 2082, 2088, 2086, 2092, 2093, 2094, 2096,
+     2099, 2101, 2103, 2105, 2110, 2111, 2118, 2116, 2122, 2128,
+     2120, 2124, 2132, 2126, 2129, 2130, 2134, 2140, 2139, 2148,
+     2137, 3281, 2141, 2151, 2153, 2154, 2157, 2158, 2147, 3281,
+     2163, 3281, 2155, 3281, 2165, 2170, 2166, 2171, 2172, 2173,
+     2174, 2176, 2184, 2175, 3281, 2182, 2185, 2187, 2188, 3281,
+     2199, 3281, 3281, 2191, 2193, 2200, 2201, 2204, 2208, 2212,
+     3281, 2202, 2213, 2214, 2216, 2217, 2219, 2220, 2222, 2221,
+     2223, 2224, 3281, 2230, 2226, 2227, 2237, 3281, 2239, 2241,
 
-     2227, 2217, 2235, 3201, 2241, 3201, 2242, 2243, 2244, 2245,
-     2250, 2246, 2253, 2256, 2257, 2259, 2260, 2263, 2266, 3201,
-     3201, 2267, 2271, 2277, 2268, 2279, 2282, 3201, 2265, 2283,
-     2272, 2285, 2286, 2287, 2292, 2294, 2297, 2289, 2298, 2296,
-     2299, 3201, 2302, 2306, 2307, 2309, 2310, 3201, 2312, 2313,
-     2314, 2317, 2319, 2324, 2333, 2329, 2335, 2337, 2338, 2340,
-     2344, 2341, 3201, 2345, 2347, 2348, 2352, 2353, 2349, 2356,
-     2361, 2364, 2354, 2366, 3201, 2369, 2358, 2374, 2370, 2376,
-     2378, 2372, 2380, 2381, 2382, 2385, 2386, 2389, 2390, 2396,
-     2399, 3201, 2392, 3201, 2401, 2405, 2413, 2414, 3201, 2394,
+     2229, 2242, 2248, 2249, 2251, 2252, 2257, 2263, 2259, 3281,
+     2260, 2261, 2266, 2262, 2269, 2271, 2267, 2268, 3281, 2282,
+     2283, 3281, 2272, 2284, 2286, 3281, 2289, 3281, 2290, 2291,
+     2292, 2294, 2298, 2299, 2301, 2293, 2305, 2310, 2307, 2314,
+     2311, 3281, 3281, 2316, 2322, 2323, 2318, 2326, 2327, 2329,
+     3281, 2331, 2333, 2334, 2335, 2336, 2337, 2342, 2340, 2343,
+     2345, 2346, 2348, 2349, 3281, 2352, 2353, 2354, 2359, 2364,
+     2361, 3281, 2363, 2366, 2365, 2367, 2370, 2371, 2385, 2387,
+     2379, 2389, 2391, 2394, 2395, 2397, 2399, 2400, 3281, 2401,
+     2403, 2404, 2408, 2409, 2405, 2410, 2415, 2418, 2420, 2422,
 
-     2407, 3201, 2417, 2411, 2422, 3201, 2425, 2418, 2426, 2428,
-     2429, 2430, 2433, 3201, 2431, 2436, 2438, 2441, 2442, 2444,
-     2445, 2447, 2455, 2451, 3201, 2453, 2454, 2456, 2458, 3201,
-     3201, 2466, 3201, 3201, 2471, 3201, 3201, 2463, 2473, 3201,
-     2475, 3201, 2481, 2477, 2479, 2461, 2480, 3201, 2487, 3201,
-     3201, 2484, 2488, 2482, 2492, 2494, 2499, 2501, 2491, 2502,
-     2504, 2505, 2506, 2507, 2508, 2510, 2513, 2511, 2514, 2519,
-     2515, 2521, 2523, 2524, 2525, 2527, 3201, 3201, 2531, 2536,
-     2533, 2538, 2540, 2542, 2543, 2544, 3201, 2547, 2548, 2550,
-     2552, 2553, 2556, 2559, 2564, 2573, 2560, 2566, 2567, 3201,
+     3281, 2425, 2412, 2428, 2426, 2430, 2432, 2433, 2434, 2436,
+     2440, 2441, 2443, 2444, 2446, 2454, 2451, 3281, 2448, 3281,
+     2450, 2461, 2469, 2465, 3281, 2463, 2467, 3281, 2470, 2471,
+     2472, 2481, 3281, 2483, 2475, 2484, 2486, 2477, 2487, 2493,
+     3281, 2495, 2497, 2502, 2503, 2490, 2504, 2505, 2496, 2507,
+     2519, 2511, 3281, 2513, 2515, 2526, 2522, 2523, 3281, 3281,
+     2527, 3281, 3281, 3281, 2532, 3281, 3281, 2533, 2535, 3281,
+     2537, 3281, 2544, 2540, 2542, 2524, 2543, 3281, 2550, 3281,
+     3281, 2547, 2551, 2545, 2555, 2557, 2562, 2564, 2554, 2565,
+     2567, 2568, 2569, 2570, 2571, 2573, 2576, 2574, 2577, 2582,
 
-     2569, 3201, 3201, 2574, 2576, 2581, 2577, 2582, 3201, 2584,
-     2586, 2590, 2596, 3201, 3201, 3201, 2597, 2591, 2593, 2599,
-     2601, 2603, 2607, 3201, 2608, 2609, 2611, 2610, 2618, 2620,
-     2626, 2628, 2630, 3201, 2636, 2633, 2634, 2632, 2635, 2638,
-     2640, 2612, 3201, 2644, 2642, 2643, 2648, 2653, 2649, 3201,
-     2651, 2656, 2660, 2662, 2664, 2661, 2667, 3201, 2665, 2666,
-     3201, 2677, 3201, 3201, 2668, 2680, 2682, 2684, 2687, 2690,
-     2673, 2678, 2698, 2695, 2696, 3201, 3201, 2697, 3201, 3201,
-     2699, 2701, 2702, 2704, 2705, 2708, 2709, 2710, 2711, 2712,
-     2715, 2721, 2714, 2722, 2723, 2725, 3201, 2733, 3201, 2729,
+     2578, 2584, 2586, 2587, 2588, 2590, 2606, 3281, 3281, 2594,
+     2599, 2596, 2601, 2603, 2607, 2608, 2609, 3281, 2616, 2611,
+     2622, 2613, 2619, 2623, 2624, 2625, 2631, 2638, 2632, 2634,
+     2635, 2636, 3281, 2639, 3281, 3281, 2642, 2643, 2648, 2645,
+     2651, 3281, 2653, 2655, 2664, 2666, 3281, 3281, 3281, 2667,
+     2657, 2661, 2671, 2672, 2659, 2673, 3281, 2675, 2680, 2682,
+     2683, 2689, 2692, 2699, 2696, 2701, 3281, 3281, 2702, 2703,
+     2704, 2684, 2705, 2706, 2708, 2710, 3281, 2712, 2711, 2717,
+     2716, 2718, 2723, 2719, 3281, 2721, 2726, 2731, 2733, 2734,
+     2736, 2737, 2739, 3281, 2738, 2741, 3281, 2749, 3281, 3281,
 
-     2738, 2735, 2740, 3201, 2741, 2742, 2727, 3201, 3201, 3201,
-     2746, 2743, 2753, 3201, 2755, 2756, 2757, 2758, 2759, 2766,
-     2764, 2768, 3201, 2769, 2770, 2772, 2773, 2774, 2775, 2776,
-     2781, 2779, 2780, 2792, 2793, 3201, 2796, 2783, 2787, 2801,
-     2807, 2797, 2802, 2804, 2811, 2808, 2812, 2813, 2823, 2819,
-     2822, 3201, 2826, 2815, 3201, 2827, 2828, 2830, 2839, 2843,
-     2835, 2845, 3201, 2846, 3201, 2849, 2850, 3201, 3201, 2851,
-     2853, 2856, 3201, 2857, 2854, 2858, 2860, 2863, 2864, 3201,
-     3201, 2865, 2867, 2871, 3201, 3201, 3201, 2880, 3201, 2882,
-     3201, 2888, 2868, 3201, 2873, 2890, 2870, 2881, 2876, 2893,
+     2742, 2751, 2753, 2758, 2760, 2764, 2755, 2761, 2770, 2767,
+     2768, 3281, 3281, 2771, 3281, 3281, 2769, 2774, 2776, 2778,
+     2781, 2783, 2780, 2784, 2785, 2788, 2790, 2793, 2796, 2797,
+     2800, 2802, 2803, 2805, 3281, 2807, 3281, 2806, 2813, 2814,
+     2819, 3281, 2820, 2815, 2808, 3281, 3281, 3281, 2816, 2830,
+     2832, 3281, 2834, 2835, 2822, 2837, 2836, 2845, 2838, 2847,
+     3281, 2848, 2849, 2851, 2852, 2853, 2855, 2857, 2858, 2860,
+     2859, 2869, 2861, 2873, 2870, 3281, 2878, 2874, 2879, 2882,
+     2884, 2886, 2887, 2888, 2890, 2891, 2892, 2893, 2900, 2896,
+     2907, 3281, 2910, 2898, 3281, 2911, 2904, 2915, 2922, 2924,
 
-     2894, 2892, 2901, 3201, 2903, 3201, 2905, 3201, 2906, 2907,
-     3201, 2914, 2910, 2912, 2913, 2915, 2919, 3201, 3201, 3201,
-     2916, 2921, 2923, 2925, 2922, 2926, 2927, 2928, 2930, 2937,
-     2934, 2945, 2931, 2938, 2954, 2947, 3201, 2948, 2951, 2960,
-     2962, 2958, 2964, 2959, 2965, 2966, 2967, 2968, 2969, 2971,
-     2982, 2973, 2974, 2984, 2986, 2990, 2983, 2998, 2997, 2994,
-     2999, 3000, 3008, 3004, 3007, 3201, 3005, 3006, 3009, 3011,
-     3012, 3016, 3014, 3026, 3029, 3017, 3031, 3015, 3036, 3032,
-     3037, 3040, 3041, 3042, 3201, 3043, 3045, 3047, 3049, 3051,
-     3053, 3054, 3055, 3058, 3060, 3063, 3065, 3069, 3201, 3070,
+     2926, 2927, 3281, 2929, 3281, 2930, 3281, 2934, 2935, 3281,
+     3281, 2936, 2938, 2941, 3281, 2942, 2939, 2943, 2945, 2948,
+     2949, 3281, 3281, 2950, 2952, 2956, 2960, 3281, 3281, 3281,
+     2966, 3281, 2967, 3281, 2973, 2953, 3281, 2958, 2975, 2961,
+     2977, 2978, 2979, 2980, 2981, 2983, 3281, 3281, 2988, 3281,
+     2990, 3281, 2991, 2993, 3281, 3001, 2995, 2997, 2998, 3004,
+     3005, 3281, 3281, 3281, 3006, 3007, 3011, 3012, 3008, 3013,
+     3014, 3015, 3019, 3016, 3023, 3032, 3020, 3033, 3040, 3036,
+     3281, 3034, 3038, 3046, 3047, 3044, 3043, 3051, 3052, 3053,
+     3054, 3055, 3059, 3060, 3064, 3061, 3062, 3071, 3074, 3077,
 
-     3201, 3201, 3074, 3071, 3077, 3081, 3083, 3201, 3201, 3201,
-     3109, 3116, 3123, 3130, 3137,   94, 3144, 3151, 3158, 3165,
-     3172, 3179, 3186, 3193
+     3073, 3086, 3084, 3087, 3085, 3088, 3095, 3089, 3093, 3281,
+     3091, 3097, 3098, 3099, 3100, 3105, 3102, 3113, 3118, 3115,
+     3122, 3109, 3124, 3125, 3126, 3111, 3131, 3127, 3281, 3134,
+     3135, 3137, 3138, 3141, 3143, 3144, 3147, 3150, 3145, 3154,
+     3159, 3160, 3281, 3161, 3281, 3281, 3164, 3151, 3155, 3172,
+     3176, 3281, 3281, 3281, 3189, 3196, 3203, 3210, 3217,   94,
+     3224, 3231, 3238, 3245, 3252, 3259, 3266, 3273
     } ;
 
-static yyconst flex_int16_t yy_def[1625] =
+static yyconst flex_int16_t yy_def[1669] =
     {   0,
-     1610,    1, 1611, 1611, 1612, 1612, 1613, 1613, 1614, 1614,
-     1615, 1615, 1610, 1616, 1610, 1610, 1610, 1610, 1617, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1618,
-     1610, 1610, 1610, 1618, 1619, 1610, 1610, 1610, 1619, 1620,
-     1610, 1610, 1610, 1610, 1620, 1621, 1610, 1610, 1610, 1621,
-     1622, 1610, 1623, 1610, 1622, 1622, 1616, 1616, 1610, 1624,
-     1617, 1624, 1617, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1654,    1, 1655, 1655, 1656, 1656, 1657, 1657, 1658, 1658,
+     1659, 1659, 1654, 1660, 1654, 1654, 1654, 1654, 1661, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1662,
+     1654, 1654, 1654, 1662, 1663, 1654, 1654, 1654, 1663, 1664,
+     1654, 1654, 1654, 1654, 1664, 1665, 1654, 1654, 1654, 1665,
+     1666, 1654, 1667, 1654, 1666, 1666, 1660, 1660, 1654, 1668,
+     1661, 1668, 1661, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1618, 1618, 1619, 1619, 1620, 1620, 1610, 1621,
-     1621, 1622, 1622, 1623, 1623, 1622, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1622, 1616, 1616, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1662, 1662, 1663, 1663, 1664, 1664, 1654, 1665,
+     1665, 1666, 1666, 1667, 1667, 1666, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1666, 1660, 1660, 1660, 1660, 1660, 1660,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1622, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1666, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
 
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1622, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660,
+     1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1666, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1622, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1610, 1610, 1616,
-     1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1666, 1660, 1660, 1660, 1660, 1654,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660,
+     1654, 1654, 1660, 1654, 1654, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660, 1654,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1622, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1666, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1622, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654,
+     1666, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660,
 
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
 
-     1616, 1616, 1616, 1616, 1610, 1616, 1610, 1616, 1616, 1616,
-     1610, 1616, 1610, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616,
-     1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1654, 1660,
+     1660, 1660, 1654, 1660, 1654, 1660, 1654, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1654, 1660, 1660, 1660, 1660, 1660, 1654, 1654, 1660, 1660,
 
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1654, 1654, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660,
 
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1610, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1610, 1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1610,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654,
+     1660, 1654, 1660, 1654, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660, 1654,
+     1660, 1654, 1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1654, 1660, 1660, 1660, 1660, 1654, 1660, 1660,
 
-     1616, 1616, 1616, 1610, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1616, 1610, 1616, 1616, 1616, 1616, 1610, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660,
+     1660, 1654, 1660, 1660, 1660, 1654, 1660, 1654, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1654, 1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660,
+     1660, 1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
 
-     1616, 1610, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1610,
-     1610, 1616, 1610, 1610, 1616, 1610, 1610, 1616, 1616, 1610,
-     1616, 1610, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1610,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1610, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1654,
+     1660, 1660, 1660, 1660, 1654, 1660, 1660, 1654, 1660, 1660,
+     1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660, 1654, 1654,
+     1660, 1654, 1654, 1654, 1660, 1654, 1654, 1660, 1660, 1654,
+     1660, 1654, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1654,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
 
-     1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1610, 1616,
-     1616, 1616, 1616, 1610, 1610, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616,
-     1610, 1616, 1610, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1610, 1616, 1610, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1610, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1654, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1654, 1660, 1654, 1654, 1660, 1660, 1660, 1660,
+     1660, 1654, 1660, 1660, 1660, 1660, 1654, 1654, 1654, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1654, 1654, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1654, 1660, 1660, 1654, 1660, 1654, 1654,
 
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1610, 1610, 1610,
-     1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1610, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1610, 1616, 1610, 1616, 1616, 1610, 1610, 1616,
-     1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616, 1610,
-     1610, 1616, 1616, 1616, 1610, 1610, 1610, 1616, 1610, 1616,
-     1610, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616, 1616,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1654, 1654, 1660, 1654, 1654, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1654, 1660, 1654, 1660, 1660, 1660,
+     1660, 1654, 1660, 1660, 1660, 1654, 1654, 1654, 1660, 1660,
+     1660, 1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1654, 1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660,
 
-     1616, 1616, 1616, 1610, 1616, 1610, 1616, 1610, 1616, 1616,
-     1610, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1610, 1610,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1610, 1616, 1616, 1616, 1616, 1616,
-     1616, 1616, 1616, 1616, 1616, 1616, 1616, 1616, 1610, 1616,
+     1660, 1660, 1654, 1660, 1654, 1660, 1654, 1660, 1660, 1654,
+     1654, 1660, 1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660,
+     1660, 1654, 1654, 1660, 1660, 1660, 1660, 1654, 1654, 1654,
+     1660, 1654, 1660, 1654, 1660, 1660, 1654, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1654, 1654, 1660, 1654,
+     1660, 1654, 1660, 1660, 1654, 1660, 1660, 1660, 1660, 1660,
+     1660, 1654, 1654, 1654, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1654, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
 
-     1610, 1610, 1616, 1616, 1616, 1616, 1616, 1610, 1610,    0,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1654, 1660,
+     1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660, 1660,
+     1660, 1660, 1654, 1660, 1654, 1654, 1660, 1660, 1660, 1660,
+     1660, 1654, 1654,    0, 1654, 1654, 1654, 1654, 1654, 1654,
+     1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654
     } ;
 
-static yyconst flex_int16_t yy_nxt[3241] =
+static yyconst flex_int16_t yy_nxt[3321] =
     {   0,
        14,   15,   16,   17,   18,   19,   18,   14,   14,   14,
        14,   18,   20,   21,   14,   22,   23,   24,   25,   14,
@@ -983,7 +996,7 @@ static yyconst flex_int16_t yy_nxt[3241] =
       107,  103,  110,   68,  113,  111,  139,  108,  114,  115,
        68,  121,  169,  118,   68,  122,  127,  119,  127,  127,
 
-      239,  127,  120,   72,   68,   72,   72,  132,   72,  132,
+      240,  127,  120,   72,   68,   72,   72,  132,   72,  132,
       132,   68,  132,   67,  135,   67,   67,   68,   67,   68,
        68,   68,  141,   67,   72,  142,   72,   72,  147,   72,
        68,  143,   68,   68,   72,   73,   68,   68,  144,  145,
@@ -999,327 +1012,336 @@ static yyconst flex_int16_t yy_nxt[3241] =
       192,  125,  130,  130,  190,  198,   68,  127,  193,  127,
       127,  132,  127,  132,  132,   72,  132,   72,   72,  133,
        72,  197,  194,   68,  196,   68,  135,   68,  195,   68,
-      201,   68,   68,  204,  131,   68,  202,  203,   68,  205,
+      201,   68,   68,  204,   68,   68,  202,  203,   68,  205,
       199,   68,   68,  212,   68,   68,   68,  200,   68,  214,
-      213,  217,  216,   68,   68,   68,   68,  224,   68,  218,
-       68,  206,   68,  223,  227,   68,  207,  220,  219,   68,
-      221,  208,  222,   68,  228,   68,  209,   68,   68,  229,
+      213,  217,  216,   68,   68,   68,  243,   68,   68,  218,
+      131,  206,   68,  223,   68,  224,  207,  220,  219,   68,
+      221,  208,  222,  228,   68,  229,  209,  226,   68,   68,
 
-      225,  226,  210,  211,   68,  243,  231,  232,  234,   68,
-      230,   68,  236,   68,  235,  237,  233,   68,   68,   68,
-       68,   68,   68,   68,   68,  238,   68,  241,   68,  246,
-       68,  250,   68,   68,   68,  252,   68,  254,  244,  240,
-       68,  253,   68,   68,  242,   68,  245,  261,  248,  249,
-      247,  258,  251,   68,  257,  256,   68,  260,  133,  255,
-       68,   68,   68,  266,  262,   68,   68,   68,   68,  265,
-      263,  267,   68,   68,  259,   68,   68,  273,  272,  264,
-      268,  270,   68,  274,   68,  269,   68,   68,  275,   68,
-      276,   68,   68,   68,  279,  282,  280,  271,  277,  278,
+       68,  230,  210,  211,  225,  227,   68,   68,  232,  233,
+      235,   68,  231,   68,  237,   68,  236,  238,   68,   68,
+      234,   68,   68,   68,   68,  239,   68,  241,   68,  242,
+       68,   68,  244,  247,  251,   68,  245,   68,   68,   68,
+      253,   68,  255,  259,  254,   68,  246,   68,   68,  249,
+      250,  261,  248,   68,  258,  252,   68,  257,  133,   68,
+      256,  262,   68,   68,  267,   68,  260,   68,   68,   68,
+      264,  266,  268,   68,   68,  129,   68,   68,  263,  273,
+      269,  265,  271,   68,  274,  275,  270,   68,   68,   68,
+      276,   68,  277,  278,   68,   68,   68,  280,  272,  281,
 
-       68,   68,  281,   68,  284,   68,  286,   68,   68,   68,
-      285,   68,   68,   68,  291,  283,   68,   68,  295,   68,
-       68,  293,   68,   68,   68,  290,  288,  287,   68,   68,
-      289,  294,  296,   68,  292,   68,  297,  298,  306,   68,
-      299,  302,  300,  301,   68,   68,   68,  303,  304,  305,
-       68,  312,   68,  307,   68,   68,  314,   68,   68,   68,
-      310,  308,  313,  311,  309,  317,   68,   68,   68,   68,
-       68,   68,  319,  315,  320,   68,  321,   68,  327,  316,
-       68,   68,  322,   68,  326,  323,  318,   68,  324,   68,
-      325,   68,  328,   68,  333,   68,  331,   68,  329,  133,
+       68,  283,  279,   68,  285,  282,   68,   68,  287,   68,
+       68,   68,  286,   68,  284,   68,  292,   68,   68,   68,
+       68,   68,  297,  294,   68,   68,   68,   68,  289,  288,
+      291,   68,  290,  296,  298,  302,  293,  299,  295,   68,
+       68,  300,   68,   68,  301,  306,  307,  308,   68,   68,
+       68,   68,  309,  304,  305,   68,  314,   68,   68,   68,
+      303,   68,  316,  315,  313,   68,  312,  310,  319,   68,
+      311,   68,   68,   68,  317,  322,  321,  323,   68,   68,
+       68,   68,  329,   68,   68,  318,   68,   68,  330,  320,
+      328,   68,  324,   68,   68,  325,   68,  335,  326,   68,
 
-      330,   68,   68,  332,  344,   68,  380,  335,   68,   68,
-      334,   68,  343,  336,  337,   68,  347,  349,   68,   68,
-      345,  346,   68,  338,   68,  339,  340,  341,  348,  350,
-      342,  353,  356,  351,  352,  354,   68,   68,  355,   68,
-       68,  359,  360,   68,   68,  358,   68,   68,   68,   68,
-       68,  365,   68,   68,  366,  357,   68,   68,   68,  386,
-       68,  364,  362,  361,  363,  369,  371,  368,   68,  374,
-      367,   68,  375,  372,   68,  373,   68,   68,  370,   68,
-      376,  378,   68,  377,  381,   68,   68,   68,   68,   68,
-       68,   68,  385,  129,   68,  379,  383,   68,  384,  387,
+      327,  331,  133,   68,  332,  348,  333,  334,  346,   68,
+      337,   68,   68,  336,   68,  351,  338,  339,  345,   68,
+       68,   68,  355,  347,  349,   68,  340,   68,  341,  342,
+      343,  350,  352,  344,  353,   68,  354,  358,   68,   68,
+      361,  362,   68,   68,  360,  356,   68,   68,   68,  357,
+       68,   68,  367,   68,  359,   68,   68,  368,   68,   68,
+       68,  380,  128,  364,  365,  366,  363,  371,  373,   68,
+      370,   68,   68,  369,  374,  375,   68,  377,   68,   68,
+      372,  376,   68,  379,  378,   68,   68,  383,  384,  382,
+      381,   68,   68,   68,   68,   68,   68,  389,   68,  388,
 
-       68,  389,   68,  390,   68,  392,  382,   68,   68,   68,
-       68,  388,  391,  393,   68,   68,  400,   68,   68,  394,
-      398,   68,  399,   68,  397,   68,   68,   68,  395,  396,
-      404,   68,   68,   68,   68,  401,  406,   68,  416,   68,
-      402,  407,  405,   68,  403,   68,  420,   68,  417,  415,
-      418,  408,   68,  409,  414,   68,  422,  419,  410,   68,
-      411,   68,   68,   68,  421,   68,   68,   68,  412,   68,
-       68,  428,   68,  424,  423,  133,  429,  425,  413,  432,
-       68,  433,  426,   68,  434,  431,   68,  427,  430,  437,
-       68,   68,   68,   68,   68,   68,  436,  440,  435,   68,
+       68,  386,   68,  390,   68,  392,  387,   68,  393,   68,
+       68,   68,  385,   68,   68,   68,   68,  395,   68,  396,
+       68,  391,   68,  394,  402,  397,   68,  401,  403,  400,
+       68,  398,   68,   68,  399,   68,  404,  409,   68,  407,
+       68,   68,  405,   68,   68,  408,  419,  406,   68,   68,
+       68,   68,  421,   68,  410,   68,  420,  418,  126,  411,
+       68,  412,   68,  417,  422,  426,  413,  427,  414,   68,
+      423,   68,  425,  424,   68,  430,  415,  428,   68,   68,
+       68,   68,  436,  431,   68,  133,  416,   68,  432,  435,
+       68,   68,   68,  429,  440,   68,  434,  439,   68,  433,
 
-       68,  445,  442,  438,  439,  446,   68,  450,  441,  448,
-       68,  443,   68,  447,  444,  449,   68,  451,   68,  452,
-       68,  453,   68,   68,   68,   68,   68,  457,  455,  456,
-       68,   68,   68,  461,  458,   68,  459,   68,   68,   68,
-      462,  128,   68,  454,  460,  464,   68,  467,  469,   68,
-      465,  463,   68,   68,  466,  471,   68,  468,  470,   68,
-      472,   68,   68,   68,  474,   68,  479,  476,   68,   68,
-       68,   68,  126,  481,  475,  480,   68,  478,   68,  477,
-       68,  482,  473,   68,   68,  483,  484,  487,  486,   68,
-      485,  489,  491,   68,  488,  490,   68,   68,   68,  495,
+       68,   68,  437,  443,  441,   68,   68,  448,  445,  438,
+      442,  449,   68,   68,  451,   68,  444,  452,   68,  453,
+      454,   68,  446,   68,   68,  447,  450,  455,   68,  456,
+       68,   68,   68,  460,   68,  458,  459,   68,   68,   68,
+       68,  461,  464,   68,  457,  462,   68,   68,  465,  467,
+       68,  463,   68,  466,  468,   68,  470,  473,  469,   68,
+       68,   68,   68,  476,  475,   68,  472,   68,  471,  474,
+      478,   68,   68,  483,   68,   68,  480,   68,   68,   68,
+      479,  484,  485,   68,   68,  477,  482,  486,  481,   68,
+       68,   68,   68,  491,  487,  488,  490,  489,   68,   68,
 
-       68,  493,  492,  496,   68,   68,   68,  497,  499,   68,
-       68,   68,   68,   68,   68,   68,  494,  504,   68,  498,
-       68,   68,   68,  505,  509,   68,  511,  500,  501,   68,
-      502,   68,  503,  506,  510,  512,  508,   68,  507,   68,
-       68,  516,   68,   68,  514,   68,   68,   68,  513,   68,
-      518,  519,  520,   68,  521,  517,  515,   68,  522,   68,
-       68,  133,   68,   68,  524,  523,  527,   68,  525,   68,
-      528,   68,  531,  529,  526,   68,  533,   68,   68,  534,
-      532,   68,   68,  530,   68,   68,   68,   68,  539,  535,
-      537,   68,   68,   68,   68,  547,  536,  548,  549,  124,
+      493,  495,   68,  492,  494,   68,   68,   68,  496,  499,
+      497,  502,   68,  500,   68,   68,   68,  501,  503,   68,
+      504,   68,   68,   68,   68,  498,  508,   68,   68,  513,
+      505,   68,  509,   68,   68,   68,  515,  516,  506,  510,
+       68,  507,   68,  512,   68,  511,   68,  518,   68,   68,
+      514,  517,   68,   68,   68,   68,  522,  523,  525,  526,
+      519,  521,  524,   68,   68,  520,   68,  133,   68,   68,
+       68,  528,  531,  532,   68,  529,   68,  535,  533,  537,
+       68,  527,  530,   68,   68,  536,   68,  538,   68,   68,
+      534,   68,  539,   68,   68,   68,  541,   68,   68,   68,
 
-      545,  550,  538,   68,  546,   68,   68,   68,  540,   68,
-      557,  558,  541,   68,  562,  542,  560,  559,  561,   68,
-       68,  563,  543,   68,  564,  544,   68,   68,  551,   68,
-      552,   68,  565,  553,   68,   68,   68,  566,  554,   68,
-      567,   68,  571,  568,  555,  556,  569,  570,   68,   68,
-      576,  572,  575,   68,  574,   68,  577,   68,   68,   68,
-      578,   68,   68,   68,  579,   68,  573,  580,   68,   68,
-      581,  587,  584,  583,  585,   68,   68,  586,   68,   68,
-       68,  582,  589,   68,  591,   68,   68,   68,   68,   68,
-      593,   68,   68,  596,  590,   68,   68,  588,  594,   68,
+      554,  552,  553,   68,  540,   68,  551,  542,  549,   68,
+       68,  550,   68,  565,  562,  571,  543,   68,  566,   68,
+       68,  563,  544,   68,  564,   68,  545,  567,  124,  546,
+       68,  568,   68,  570,   68,   68,  547,   68,  569,  548,
+       68,  555,  556,   68,  557,  574,   68,  558,  572,   68,
+       68,  577,  559,  573,  575,  579,   68,  576,  560,  561,
+       68,  578,  581,   68,  582,  580,  583,   68,   68,   68,
+      584,   68,   68,   68,  585,   68,   68,   68,  591,   68,
+      586,  587,  589,  590,   68,  593,   68,   68,   68,   68,
+       68,  595,  592,  588,   68,  597,   68,   68,   68,  599,
 
-      592,   68,   68,  602,   68,  601,   68,  595,   68,   68,
-      597,  598,   68,  605,  599,  600,   68,  610,  607,  603,
-      606,  604,   68,  609,  611,   68,   68,   68,  608,   68,
-      612,   68,  615,   68,  617,  613,  618,  614,   68,   68,
-       68,   68,  619,  622,   68,  624,   68,   68,   68,  625,
-      133,   68,  616,  621,   68,  627,  620,   68,   68,   68,
-       68,   68,  626,  636,  623,   68,   68,   68,  133,   68,
-       68,  640,  630,  628,   68,  637,   68,   68,  643,  659,
-      639,  629,   68,  641,  642,  631,  638,  632,   68,   68,
-       68,  633,  644,  634,  645,  647,   68,  649,  635,   68,
+       68,  596,   68,  602,  598,  594,   68,  600,   68,   68,
+       68,   68,   68,   68,  608,   68,   68,  607,  601,   68,
+      611,  603,  604,   68,   68,   68,   68,  724,  605,  606,
+      609,  613,  610,  612,  616,  614,  617,  615,   68,   68,
+       68,   68,  618,  619,   68,   68,  623,  622,  624,  621,
+       68,   68,  620,   68,  625,  628,   68,   68,  630,   68,
+       68,  631,  133,   68,   68,   68,   68,   68,  626,  627,
+      633,   68,   68,   68,   68,  643,   68,  629,  632,  647,
+       68,  636,   68,  634,   68,   68,  133,  644,  650,  635,
+       68,  646,   68,  637,  648,  638,  649,  652,  645,  639,
 
-       68,  652,  648,   68,  646,  651,   68,   68,  653,   68,
-      650,   68,  660,  654,  657,  655,   68,  658,   68,  664,
-       68,  661,  665,   68,   68,  667,  662,   68,  666,   68,
-       68,   68,  668,  656,  663,   68,   68,   68,   68,   68,
-      671,   68,   68,   68,  670,   68,  669,  673,  675,   68,
-      678,   68,  679,   68,   68,  672,  674,   68,  683,  676,
-      682,  680,   68,  677,   68,   68,  716,  684,   68,  681,
-      685,   68,  687,  686,  688,   68,  689,   68,  693,   68,
-      690,   68,   68,  691,   68,   68,  692,  696,  695,   68,
-       68,   68,  694,   68,  698,  699,   68,  700,  703,   68,
+      651,  640,   68,   68,   68,   68,  641,  653,  654,   68,
+       68,  642,  659,   68,  131,  658,  655,   68,  665,  657,
+       68,  660,  664,   68,   68,  656,  661,   68,  662,   68,
+      668,   68,  669,   68,   68,   68,  667,  666,   68,  670,
+      673,   68,  674,  675,   68,   68,  663,  671,   68,   68,
+      679,   68,  676,  672,  677,   68,   68,  678,   68,   68,
+       68,   68,  688,   68,  684,  682,   68,   68,   68,   68,
+      680,  681,  687,   68,   68,  686,   68,  683,  692,  693,
+      685,  694,   68,   68,  691,  689,  690,   68,  696,  697,
+       68,  695,  698,  702,   68,   68,  699,   68,   68,  700,
 
-       68,   68,  702,   68,   68,   68,  697,  706,   68,  701,
-      704,   68,   68,   68,   68,   68,  711,   68,  705,  712,
-      714,  707,  717,   68,  708,  710,  715,   68,  709,  718,
-       68,  713,  720,   68,   68,   68,   68,  724,  719,   68,
-       68,   68,   68,   68,   68,   68,   68,  723,  732,  721,
-      722,  726,  131,   68,   68,   68,  733,  725,  729,  727,
-      730,   68,   68,   68,   68,   68,  731,  734,  728,  735,
-      737,   68,   68,  740,  741,   68,   68,  736,   68,  738,
-       68,  745,  743,   68,   68,   68,  739,   68,  746,   68,
-      742,  747,  749,   68,   68,   68,   68,   68,  744,  748,
+       68,   68,  701,  704,  705,   68,   68,   68,   68,   68,
+      703,  707,  708,   68,  709,  712,   68,   68,   68,  711,
+       68,  706,   68,  714,   68,  710,  713,  715,   68,   68,
+       68,   68,   68,  726,  720,  721,  716,   68,   68,  717,
+      723,  719,  718,  727,  725,   68,  729,   68,   68,  722,
+       68,   68,   68,  733,   68,   68,   68,   68,   68,   68,
+      728,   68,   68,  741,  732,  731,  742,  735,   68,  730,
+       68,   68,  734,  738,  736,  743,  739,   68,   68,   68,
+       68,  737,  740,   68,  746,   68,   68,  751,   68,   68,
+       68,  744,  745,   68,   68,  747,  753,   68,  755,  756,
 
-      752,  754,  751,   68,   68,  750,   68,  756,   68,   68,
-       68,   68,   68,  753,   68,  757,  755,   68,   68,  758,
-      764,  760,   68,  759,   68,   68,   68,   68,  848,  761,
-      763,  767,  762,  765,  768,  770,   68,  766,  769,   68,
-       68,  772,  773,   68,   68,  771,  774,   68,   68,  778,
-       68,  779,   68,  777,   68,   68,  776,  780,   68,  775,
-      781,   68,  782,   68,   68,  787,  786,  783,  784,  788,
-       68,   68,   68,   68,   68,   68,  789,  790,  785,  796,
-       68,  791,   68,   68,   68,   68,  792,   68,  793,   68,
-      794,  795,   68,   68,   68,  801,   68,  797,  799,  805,
+      749,   68,  748,   68,   68,  750,   68,  752,  757,  759,
+       68,   68,   68,  754,   68,   68,  762,  758,   68,  761,
+      764,   68,  760,   68,   68,  766,   68,  767,   68,   68,
+       68,  763,   68,  765,   68,  770,   68,   68,  768,  769,
+      775,  771,  779,   68,   68,  772,   68,   68,   68,  129,
+      774,  773,  776,  778,  781,   68,  777,  780,  784,   68,
+      783,   68,  785,   68,   68,  787,   68,  790,  782,   68,
+      791,   68,   68,   68,  788,  789,  792,   68,  786,   68,
+      794,   68,  793,   68,   68,   68,  799,  797,  796,  800,
+      795,   68,   68,   68,   68,   68,   68,  801,   68,  802,
 
-       68,  798,   68,  802,  800,  807,   68,  809,   68,  806,
-      803,  808,  811,   68,   68,  810,  813,   68,  804,   68,
-      815,   68,   68,   68,  814,   68,   68,   68,  817,   68,
-      820,  819,   68,  818,  812,  824,   68,   68,  822,  825,
-       68,   68,  816,  823,   68,  821,  826,  827,   68,   68,
-      831,   68,   68,   68,   68,   68,  829,  828,  834,   68,
-      830,   68,   68,   68,   68,  838,   68,   68,   68,   68,
-       68,   68,  851,  832,   68,  835,  843,  833,  844,  836,
-      837,  839,  845,   68,   68,  841,   68,   68,  849,  853,
-      850,  840,  842,  846,  847,   68,   68,   68,  852,   68,
+      809,   68,  798,   68,  807,  803,   68,  808,   68,   68,
+      804,   68,  805,   68,  806,  811,  810,  813,  817,   68,
+       68,   68,  814,  819,   68,  812,  821,   68,   68,  815,
+      820,  823,   68,   68,   68,  818,  825,   68,  816,  826,
+      827,   68,   68,   68,   68,   68,   68,  822,  829,   68,
+      831,   68,  830,  824,   68,  832,  835,  834,  836,   68,
+      837,   68,  828,   68,  833,   68,  838,  839,  840,   68,
+       68,   68,   68,  843,   68,   68,   68,  846,   68,   68,
+       68,  842,   68,   68,   68,  850,   68,   68,  841,   68,
+       68,  844,  854,   68,   68,  856,  847,  864,  845,  848,
 
-       68,   68,   68,   68,  856,   68,  859,   68,   68,   68,
-       68,   68,   68,   68,  129,  855,  865,  862,  857,  866,
-       68,  858,  854,  860,  863,  867,  861,  864,  868,   68,
-       68,   68,   68,  876,  872,   68,  874,  871,  869,  875,
-      873,   68,  877,   68,   68,  870,   68,   68,   68,  881,
-       68,  878,   68,  882,   68,  883,   68,   68,   68,   68,
-       68,  879,   68,  889,   68,  888,   68,  880,   68,  884,
-       68,  885,   68,   68,   68,  897,   68,  887,  894,  890,
-      899,  891,   68,  886,   68,  892,   68,  898,  896,  893,
-       68,  903,   68,  895,   68,  901,   68,  900,   68,  904,
+      851,  849,  857,  852,  853,   68,  858,   68,   68,   68,
+       68,  861,  855,  863,  859,   68,  860,   68,   68,   68,
+      867,   68,   68,   68,  862,   68,  865,  869,   68,  872,
+       68,   68,   68,   68,   68,   68,  866,  868,   68,  870,
+      879,   68,   68,  871,   68,  875,  873,  876,  877,  874,
+       68,  880,   68,  878,   68,  881,  882,  884,   68,  888,
+      885,  883,  886,  887,   68,  889,   68,  890,  891,   68,
+       68,   68,   68,   68,   68,  896,   68,  893,   68,  897,
+       68,  898,   68,   68,   68,   68,   68,  894,   68,  892,
+       68,  903,   68,  895,  904,  899,   68,  900,   68,   68,
 
-      905,  907,   68,   68,   68,  910,   68,  911,  909,   68,
-      902,   68,   68,  912,   68,  913,   68,   68,  906,   68,
-      908,   68,  914,   68,  915,   68,  916,  921,   68,   68,
-      919,  918,   68,  923,  917,   68,  920,   68,   68,   68,
-       68,   68,  926,   68,  931,  928,   68,   68,  925,  922,
-       68,   68,   68,   68,  935,   68,   68,  924,  927,  929,
-      930,  936,   68,  937,  940,   68,   68,  932,   68,  939,
-      933,  934,  941,  938,   68,  943,   68,   68,   68,   68,
-      949,  946,   68,   68,  947,   68,  942,  950,  944,   68,
-       68,   68,  951,  954,  952,  955,  948,  945,   68,  956,
+       68,   68,   68,  902,  909,  905,  914,  906,   68,  901,
+       68,  907,   68,  912,   68,  908,  911,   68,   68,  910,
+      917,  915,  913,  916,  918,   68,   68,   68,   68,  922,
+      921,  919,  920,   68,   68,   68,  923,  926,  924,   68,
+      925,   68,   68,  927,   68,  928,   68,   68,   68,  930,
+      929,   68,  932,   68,   68,  937,  931,   68,  934,  936,
+       68,   68,  938,   68,   68,  933,   68,   68,  941,  935,
+       68,   68,  943,   68,  940,   68,  946,   68,   68,  939,
+       68,   68,  950,   68,  952,  942,  951,  945,  944,   68,
+      954,  947,   68,  956,   68,   68,   68,  948,  949,   68,
 
-       68,   68,   68,   68,  953,   68,   68,   68,  960,  957,
-       68,  962,  963,   68,   68,  964,   68,   68,   68,   68,
-      958,  971,  959,   68,   68,  965,   68,   68,  961,   68,
-      969,  968,  970,   68,  966,   68,  967,   68,  977,   68,
-      976,  978,  981,  972,  973,  980,   68,   68,  974,   68,
-      975,   68,  982,  979,   68,   68,  989,   68,  990,   68,
-      984,   68,   68,   68,  986,  983,  988,  987,   68,   68,
-       68,   68,   68,  985,   68,  997,  992,   68,   68, 1000,
-       68,   68,  991,  994,   68, 1002,  993, 1003,  998,  996,
-       68,   68,   68,   68, 1005,  995,  999, 1004, 1001,   68,
+       68,  959,  957,  953,   68,   68,  955,  965,   68,   68,
+       68,  962,   68,   68,  963,  966,  960,   68,  967,   68,
+      972,   68,  968,  958,  970,  961,  964,  971,   68,   68,
+       68,   68,   68,   68,  977,   68,  976,   68,  969,   68,
+      979,  980,   68,   68,   68,   68,  973,   68,  974,  981,
+      975,   68,   68,   68,  988,  982,  978,   68,   68,   68,
+       68,  985,   68,  983,  986,  984,  987,  992,  128,   68,
+       68,  989,   68,  998,   68,  993,  994,  990,   68,  991,
+       68,  995,   68,  999,  996,   68,  997, 1000,   68,   68,
+       68, 1007, 1008,   68, 1001,   68,   68, 1002, 1004, 1006,
 
-       68, 1009,   68, 1007, 1006, 1010,   68, 1013,   68, 1008,
-       68,   68,   68,   68,   68,   68,   68, 1017,   68, 1018,
-     1011, 1019,   68, 1020, 1014, 1012,   68,   68, 1015, 1024,
-       68, 1016,   68,   68, 1028, 1021,   68, 1023, 1022,   68,
-       68, 1025,  128,   68, 1026, 1027, 1032,   68, 1029, 1031,
-     1033,   68,   68, 1035,   68,   68,   68,   68, 1030,   68,
-       68, 1034, 1037,   68,   68, 1038,   68, 1036, 1041,   68,
-       68, 1039,   68, 1042, 1047, 1040, 1046,   68,   68,   68,
-       68, 1045, 1051,   68, 1053,   68, 1043, 1054,   68, 1044,
-     1055, 1048, 1050,   68, 1057,   68, 1056, 1049,   68,   68,
+       68, 1005,   68,   68, 1003,   68,   68,   68, 1015,   68,
+       68, 1018,  126, 1010,   68, 1009,   68, 1012, 1020,   68,
+     1011,   68,   68,   68, 1014, 1016, 1023, 1021, 1017,   68,
+     1013,   68, 1019,   68,   68, 1024, 1025, 1027,   68, 1022,
+       68, 1031, 1026,   68,   68,   68,   68, 1028,   68,   68,
+       68,   68, 1035,   68, 1036, 1037, 1029,   68, 1038, 1030,
+     1032, 1033,   68, 1042,   68, 1034, 1039,   68,   68,   68,
+       68, 1046,   68,   68, 1040,   68,   68, 1041, 1051, 1049,
+     1044, 1043, 1045,   68, 1047, 1050,   68, 1048, 1052,   68,
+     1054,   68, 1053,   68,   68,   68,   68,   68,   68, 1056,
 
-     1052, 1059,   68, 1061,   68, 1063,   68,   68, 1062,   68,
-       68,   68,   68,   68,   68,   68, 1058, 1071,   68,   68,
-     1073, 1064,   68, 1065,   68,   68,   68, 1060, 1066, 1076,
-       68, 1067, 1068, 1069, 1075, 1070,   68,   68,   68, 1077,
-       68, 1072, 1074, 1078,   68, 1081, 1079,   68,   68, 1085,
-       68,   68, 1080, 1084,   68,   68, 1083, 1087, 1088,   68,
-     1089,   68,   68,   68, 1082,   68,   68, 1086,   68,   68,
-     1090, 1091, 1095, 1097,   68, 1100,   68, 1092, 1096, 1098,
-     1094,   68, 1093,   68, 1099, 1103, 1104,   68, 1105, 1107,
-       68,   68, 1106,   68,   68,   68, 1110, 1102,   68,   68,
+       68,   68,   68, 1060, 1057, 1055, 1065,   68, 1058, 1061,
+     1066,   68, 1059,  124,   68,   68,   68, 1064, 1070,   68,
+       68, 1063, 1062, 1072,   68, 1073,   68,   68,   68, 1075,
+       68, 1074, 1067, 1068,   68,   68, 1069, 1077, 1076, 1079,
+     1071,   68,   68,   68,   68,   68, 1078, 1081,   68,   68,
+     1082, 1083,   68,   68,   68, 1080,   68, 1084, 1085, 1086,
+       68, 1088,   68, 1089, 1087, 1093,   68, 1091,   68, 1095,
+       68,   68, 1090, 1098,   68, 1092,   68,   68, 1100, 1097,
+       68,   68, 1096,   68, 1103,   68, 1094,   68, 1107, 1101,
+       68, 1099, 1106,   68,   68,   68, 1110,   68,   68, 1111,
 
-       68,   68, 1101, 1112,   68,   68, 1115, 1109, 1117,   68,
-     1111,   68, 1113,   68,  126,   68,   68, 1108, 1119, 1120,
-       68, 1118, 1121,   68,   68, 1125,   68, 1116,   68, 1114,
-     1122, 1123,   68,   68, 1124, 1128,   68,   68,   68,   68,
-       68,   68,   68, 1133, 1126, 1127,   68, 1130, 1135,   68,
-     1137, 1134,   68,   68,   68,   68, 1136, 1129, 1131,   68,
-     1132, 1138, 1144, 1140, 1141, 1142,   68,   68,   68,   68,
-     1139,   68, 1146, 1143,   68,   68, 1147, 1148,   68,   68,
-     1151,   68, 1149,   68,   68, 1145,   68,   68,   68, 1150,
-       68,   68,   68, 1159,   68, 1153, 1154, 1158, 1155,   68,
+       68, 1105, 1109, 1102,   68,   68,   68, 1104,   68, 1112,
+     1108,   68, 1119,   68, 1117,   68, 1122,   68, 1113, 1114,
+     1118, 1116,   68,   68, 1115, 1125, 1120, 1126,   68, 1127,
+       68, 1121,   68, 1128,   68, 1129,   68, 1124,   68, 1132,
+       68,   68,   68, 1123,   68, 1134,   68, 1137, 1131,   68,
+     1133,   68,   68,   68, 1135, 1139, 1141,   68, 1130,   68,
+       68, 1140, 1142,   68, 1143,   68,   68,   68, 1147,   68,
+       68, 1136, 1144, 1138, 1145,   68, 1146,   68,   68, 1149,
+     1148, 1151,   68,   68,   68,   68,   68,   68,   68, 1150,
+     1156, 1158, 1153, 1157,   68, 1160,   68,   68, 1152,   68,
 
-       68,   68, 1152, 1156, 1163,   68, 1165, 1157, 1160, 1161,
-       68,   68, 1166, 1162,   68,   68, 1167,   68, 1171, 1168,
-     1164,   68,   68,   68,   68,  124, 1172, 1175,   68,   68,
-       68,   68,   68, 1169, 1179,   68,   68, 1170, 1174,   68,
-     1177, 1173, 1176, 1178, 1180,   68,   68,   68, 1181, 1185,
-     1182, 1183, 1184,   68,   68,   68,   68,   68,   68, 1187,
-     1188, 1192,   68, 1186, 1194,   68, 1191, 1193,   68,   68,
-     1189,   68,   68, 1196, 1199,   68, 1197,   68,   68,   68,
-       68, 1190, 1202,   68,   68, 1198, 1200, 1195, 1201,   68,
-     1203,   68, 1204, 1206,   68,   68, 1205,   68,   68,   68,
+       68, 1159, 1154,   68, 1155,   68, 1161, 1168, 1163, 1164,
+     1165,   68,   68,   68,   68, 1162,   68, 1170, 1166, 1167,
+       68, 1173, 1171, 1172,   68,   68,   68, 1175,   68,   68,
+     1169,   68,   68,   68,   68,   68,   68, 1176,   68,   68,
+     1185,   68,   68, 1178, 1179, 1174, 1180, 1184, 1181,   68,
+     1177,   68, 1189,   68,   68, 1182, 1183, 1186, 1187, 1191,
+       68,   68, 1192,   68,   68, 1188, 1193, 1190, 1194,   68,
+     1197,   68,   68,   68,   68,   68, 1198, 1201,   68,   68,
+       68,   68, 1195,   68,   68, 1205, 1202, 1200, 1206, 1196,
+     1203, 1199, 1207, 1204,   68,   68,   68, 1210,   68, 1208,
 
-     1208,   68, 1207, 1211,   68, 1214,   68, 1209,   68,   68,
-       68,   68, 1210, 1215,   68, 1217, 1216, 1212,   68,   68,
-     1213,   68,   68, 1225,   68,   68,   68,   68, 1226,   68,
-     1219,   68, 1229, 1223, 1218, 1230,   68, 1221, 1220, 1227,
-     1222,   68, 1228, 1224, 1231,   68, 1233,   68, 1234,   68,
-       68, 1236,   68,   68, 1232, 1237,   68,   68, 1240,   68,
-       68,   68, 1239, 1242,   68,   68,   68, 1244,   68, 1235,
-       68, 1245, 1238,   68, 1246, 1248,   68, 1250,   68, 1241,
-     1251,   68,   68, 1243,   68, 1249,   68, 1253,   68, 1247,
-       68, 1254,   68,   68,   68, 1256, 1252,   68,   68, 1260,
+     1209,   68,   68,   68,   68,   68,   68, 1213, 1214, 1218,
+       68,   68, 1220,   68, 1212, 1217, 1211,   68, 1215,   68,
+     1219, 1222,   68,   68, 1221, 1225,   68, 1223,   68, 1216,
+       68, 1226, 1224, 1228,   68,   68, 1229, 1227,   68,   68,
+     1233,   68, 1230,   68, 1232,   68,   68,   68,   68,   68,
+     1235, 1241,   68, 1238,   68,   68, 1231,   68,   68, 1242,
+       68,   68, 1237, 1244,   68,   68,   68, 1239, 1234, 1236,
+     1240,   68, 1243,   68, 1253,   68,   68,   68,   68,   68,
+     1246, 1254,   68,   68, 1258, 1249, 1245, 1247, 1251, 1248,
+     1255,   68, 1250, 1256, 1252, 1257, 1259,   68, 1260,   68,
 
-     1255,   68,   68, 1265,   68, 1258,   68, 1262,   68, 1257,
-     1263,   68, 1261,   68, 1259, 1266, 1264,   68, 1269,   68,
-     1270, 1273, 1268,   68, 1267,   68,   68, 1271, 1276,   68,
-       68, 1274, 1275, 1277,   68, 1272, 1278,   68,   68, 1280,
-       68,   68,   68,   68, 1279,   68, 1284, 1285,   68, 1287,
-       68, 1286, 1281,   68,   68, 1282,   68,   68, 1288,   68,
-     1290, 1283, 1293,   68, 1292,   68,   68,   68,   68, 1294,
-       68, 1296, 1298,   68, 1289,   68, 1297, 1291,   68, 1299,
-     1301, 1295, 1300,   68, 1302,   68, 1303,   68, 1304,   68,
-     1305,   68,   68,   68,   68, 1307,   68, 1308, 1309,   68,
+     1262,   68, 1263,   68, 1261, 1264,   68,   68, 1266,   68,
+     1267,   68,   68,   68, 1270,   68,   68,   68, 1269, 1272,
+       68,   68,   68, 1274,   68, 1275, 1265,   68, 1276, 1278,
+       68, 1268,   68, 1280,   68, 1271, 1281,   68,   68, 1273,
+       68, 1283,   68, 1277,   68,   68,   68, 1284,   68, 1286,
+     1282, 1279,   68,   68, 1285,   68,   68, 1290,   68, 1288,
+       68, 1295,   68,   68, 1292, 1293,   68, 1296, 1291, 1289,
+     1287, 1298, 1294,   68, 1299,   68, 1300,   68, 1301,   68,
+     1297,   68,   68,   68,   68, 1305, 1302,   68, 1306,   68,
+     1303, 1304, 1308,   68, 1309,   68,   68, 1311,   68,   68,
 
-       68, 1310, 1311,   68,   68, 1314,   68, 1306, 1312, 1313,
-     1315,   68, 1316,   68,   68, 1317,   68,   68,   68,   68,
-       68, 1324,   68,   68, 1322,   68,   68,   68, 1319, 1320,
-     1321,   68, 1318,   68, 1325,   68,   68,   68, 1334,   68,
-     1323, 1332, 1333,   68, 1328,   68, 1327, 1330,   68, 1326,
-       68, 1329,   68, 1331,   68,   68,   68, 1342, 1343,   68,
-       68, 1339,   68, 1335,   68,   68, 1336, 1337,   68, 1344,
-     1338,   68,   68, 1341, 1340, 1350,   68, 1345,   68,   68,
-     1351,   68, 1346, 1347, 1348,   68,   68, 1352,   68,   68,
-     1349, 1357, 1358,   68,   68, 1361,   68, 1353,   68, 1354,
+     1654, 1310,   68, 1313, 1307,   68, 1315,   68,   68,   68,
+     1312, 1316, 1317, 1318,   68,   68,   68,   68, 1314,   68,
+     1319, 1322, 1320,   68, 1324,   68, 1325,   68, 1323, 1326,
+     1321,   68, 1328, 1329,   68,   68,   68, 1331,   68,   68,
+     1332, 1327, 1330, 1333,   68,   68, 1335,   68, 1336,   68,
+     1334, 1337,   68, 1338,   68,   68,   68,   68, 1340,   68,
+     1341, 1342,   68,   68, 1343, 1344,   68,   68, 1347,   68,
+     1339, 1345, 1346, 1348,   68, 1349,   68,   68, 1350,   68,
+       68,   68,   68,   68, 1357,   68,   68, 1355,   68,   68,
+       68, 1352, 1353, 1354,   68, 1351,   68, 1358,   68,   68,
 
-     1355, 1363,   68,   68, 1359,   68, 1356, 1364,   68,   68,
-     1365,   68, 1360,   68, 1367,   68, 1368, 1362, 1369,   68,
-       68,   68,   68,   68,   68, 1366, 1373, 1371, 1374, 1376,
-       68, 1377,   68, 1378, 1370, 1372, 1388, 1375,   68, 1379,
-       68, 1380,   68, 1381,   68,   68,   68,   68,   68, 1382,
-       68, 1383,   68, 1384,   68,   68,   68, 1387, 1386, 1389,
-       68,   68, 1385,   68, 1391,   68, 1393, 1390,   68, 1392,
-     1394, 1397,   68,   68,   68, 1399,   68,   68,   68,   68,
-       68, 1400, 1395, 1398, 1401,   68, 1402, 1396, 1404,   68,
-       68, 1403,   68, 1406,   68, 1408,   68, 1407, 1409,   68,
+       68, 1367,   68, 1356, 1365, 1366,   68, 1361,   68, 1360,
+     1363,   68, 1359,   68, 1362,   68, 1364, 1368,   68,   68,
+       68,   68, 1376,   68, 1373,   68, 1369, 1377,   68, 1370,
+     1371,   68, 1378, 1372,   68,   68,   68,   68, 1375, 1374,
+     1380, 1379, 1385,   68,   68, 1386,   68,   68,   68, 1381,
+       68,   68, 1383, 1382,   68,   68, 1384,   68, 1393, 1394,
+       68, 1388, 1387,   68, 1397,   68, 1389,   68, 1390,   68,
+     1391,   68, 1395,   68, 1392, 1399,   68, 1400,   68,   68,
+     1401, 1396, 1403,   68,   68,   68, 1398,   68, 1404, 1405,
+     1406, 1402,   68, 1407,   68,   68,   68, 1409, 1654, 1410,
 
-     1405, 1410,   68, 1411, 1412, 1413, 1414,   68,   68,   68,
-       68,   68, 1415,   68,   68, 1416,   68,   68, 1419, 1423,
-       68,   68,   68,   68,   68, 1427,   68,   68, 1417, 1418,
-     1425, 1422, 1420,   68,   68,   68, 1421,   68, 1429,   68,
-     1424,   68, 1426, 1428, 1432,   68, 1430,   68, 1434, 1436,
-       68, 1437,   68,   68,   68,   68, 1443, 1433,   68, 1435,
-     1431, 1438, 1439, 1442, 1441,   68, 1440,   68,   68,   68,
-       68,   68, 1445, 1450, 1444, 1448,   68, 1446,   68, 1452,
-       68,   68,   68, 1455,   68,   68,   68,   68,   68, 1449,
-     1447,   68,   68,   68, 1456,   68, 1459, 1454, 1460,   68,
+     1412,   68, 1408, 1413,   68, 1420, 1414, 1415,   68, 1417,
+     1411,   68, 1416,   68,   68,   68,   68,   68,   68, 1418,
+       68, 1419,   68,   68,   68, 1423, 1422, 1425,   68,   68,
+       68,   68, 1421,   68, 1424,   68, 1430, 1428,   68, 1429,
+     1431, 1426, 1427,   68, 1435,   68,   68, 1437,   68,   68,
+       68,   68, 1432,   68,   68, 1436, 1439, 1438, 1433, 1440,
+     1442,   68, 1434,   68, 1444,   68, 1441,   68, 1445, 1446,
+       68, 1447,   68,   68, 1443, 1448,   68, 1451, 1452,   68,
+       68,   68,   68,   68, 1453, 1449,   68, 1450,   68, 1454,
+       68, 1457,   68,   68, 1461,   68,   68,   68, 1455, 1456,
 
-     1453, 1451, 1457, 1463,   68,   68, 1458, 1465,   68,   68,
-     1464, 1462, 1468,   68,   68, 1466,   68, 1461, 1469,   68,
-       68, 1467, 1473,   68,   68,   68, 1471,   68, 1470, 1475,
-     1477,   68, 1474, 1480,   68,   68, 1472, 1481,   68,   68,
-       68, 1485,   68, 1610, 1476, 1484, 1482,   68, 1478, 1479,
-     1486,   68, 1488, 1483, 1487,   68, 1489,   68,   68, 1490,
-     1491,   68,   68,   68, 1494,   68,   68, 1492,   68,   68,
-       68, 1493,   68, 1495, 1496,   68,   68,   68, 1504,   68,
-       68, 1502,   68,   68, 1497,   68, 1498, 1505,   68, 1499,
-     1500, 1506,   68,   68,   68, 1509, 1501, 1503, 1507, 1508,
+       68, 1465,   68, 1466, 1463,   68, 1458, 1460,   68,   68,
+     1459, 1462,   68, 1468,   68,   68, 1464,   68,   68,   68,
+       68, 1467, 1474, 1471, 1476,   68,   68,   68,   68, 1469,
+     1477,   68,   68, 1482,   68, 1472, 1475, 1473, 1470, 1480,
+     1478, 1479,   68, 1483,   68, 1481,   68,   68,   68,   68,
+       68, 1485, 1490, 1484, 1488, 1487, 1486,   68, 1492,   68,
+       68,   68, 1495,   68,   68,   68, 1489,   68, 1496,   68,
+       68,   68,   68,   68, 1497, 1491, 1494, 1501, 1500, 1493,
+     1503,   68,   68, 1498, 1505,   68,   68, 1506, 1499, 1507,
+       68,   68, 1504, 1510,   68, 1511,   68, 1502,   68,   68,
 
-       68, 1511,   68, 1510,   68,   68,   68, 1512, 1513, 1514,
-     1515, 1516, 1518,   68, 1519,   68, 1520,   68,   68,   68,
-     1522, 1523,   68, 1517,   68,   68,   68,   68,   68, 1525,
-     1521,   68, 1529,   68,   68,   68, 1524,   68,   68,   68,
-       68, 1537,   68,   68, 1526, 1527,   68, 1528, 1531,   68,
-       68, 1539, 1533, 1530, 1534, 1536, 1532,   68, 1538,   68,
-       68, 1543, 1540,   68, 1535, 1542,   68, 1547, 1541, 1548,
-       68,   68,   68, 1544,   68, 1545,   68,   68,   68,   68,
-       68,   68, 1546,   68, 1549,   68,   68, 1560, 1557, 1550,
-     1551, 1552, 1554, 1555,   68,   68,   68, 1553,   68, 1558,
+       68, 1515,   68,   68,   68,   68, 1508, 1519,   68, 1517,
+       68, 1513,   68, 1509, 1654, 1516,   68, 1512, 1522,   68,
+     1514, 1523,   68,   68, 1518, 1520, 1521,   68, 1525, 1524,
+     1526, 1654, 1527, 1528,   68, 1529,   68, 1530,   68,   68,
+     1532,   68,   68, 1533, 1531, 1534,   68,   68,   68, 1537,
+       68,   68, 1535,   68,   68,   68, 1536,   68, 1538, 1539,
+       68,   68,   68, 1547,   68,   68, 1545, 1548,   68, 1540,
+       68, 1541,   68,   68, 1542, 1543, 1549, 1550,   68,   68,
+     1553, 1544, 1546, 1551, 1552,   68, 1555,   68, 1554,   68,
+       68,   68,   68,   68, 1562,   68, 1559, 1560, 1556, 1563,
 
-     1556, 1561,   68, 1562, 1559, 1565,   68, 1563, 1566,   68,
-       68,   68,   68, 1567, 1564, 1570,   68,   68,   68,   68,
-       68,   68, 1573,   68,   68, 1577,   68,   68,   68,   68,
-     1568, 1569, 1572, 1578, 1582, 1571, 1576, 1574,   68, 1580,
-     1575,   68, 1581,   68,   68, 1579, 1584, 1585,   68,   68,
-     1583, 1586,   68,   68,   68,   68, 1587,   68, 1589,   68,
-     1591,   68, 1592,   68, 1595,   68,   68,   68, 1598, 1599,
-       68, 1588,   68, 1590, 1601,   68, 1602,   68, 1593, 1600,
-     1594,   68,   68,   68, 1596, 1597,   68, 1604, 1603,   68,
-     1610, 1605, 1608,   68, 1609,   68, 1610, 1610, 1610, 1610,
+       68, 1564,   68,   68, 1557,   68, 1566,   68, 1567,   68,
+       68, 1558, 1561,   68, 1569, 1565,   68,   68,   68,   68,
+       68, 1568, 1573,   68,   68,   68,   68,   68,   68, 1570,
+     1581,   68,   68, 1572, 1571,   68, 1575, 1582, 1577, 1574,
+     1583, 1578, 1580, 1576,   68,   68,   68, 1587,   68, 1584,
+       68, 1579,   68, 1591, 1592,   68,   68, 1585,   68,   68,
+     1586, 1589, 1588,   68,   68,   68,   68,   68, 1594, 1590,
+     1593,   68,   68,   68,   68, 1604,   68, 1601, 1596, 1598,
+     1599, 1602, 1595,   68, 1597,   68,   68, 1654, 1605,   68,
+     1600, 1606, 1603, 1609, 1607, 1610,   68,   68,   68,   68,
 
-     1610, 1610, 1606, 1610, 1610, 1610, 1610, 1610, 1607,   40,
+       68,   68, 1614,   68, 1608,   68, 1611,   68, 1617,   68,
+       68,   68,   68, 1621,   68, 1654, 1612,   68, 1616, 1613,
+     1615,   68, 1622,   68, 1620,   68, 1624,   68, 1618, 1619,
+       68, 1625, 1626, 1623,   68, 1629,   68,   68,   68,   68,
+     1628, 1627, 1632,   68, 1630, 1631,   68,   68, 1633,   68,
+       68, 1635, 1636,   68, 1639,   68,   68,   68, 1634,   68,
+     1642, 1643,   68,   68, 1644, 1645,   68,   68, 1637, 1638,
+     1646,   68,   68,   68, 1640, 1641,   68, 1654, 1648, 1647,
+     1654, 1649, 1650, 1652,   68, 1654, 1651, 1653,   68,   40,
        40,   40,   40,   40,   40,   40,   45,   45,   45,   45,
+
        45,   45,   45,   50,   50,   50,   50,   50,   50,   50,
        56,   56,   56,   56,   56,   56,   56,   61,   61,   61,
-       61,   61,   61,   61,   71,   71, 1610,   71,   71,   71,
-       71,  123,  123, 1610, 1610, 1610,  123,  123,  125,  125,
-     1610, 1610,  125, 1610,  125,  127, 1610, 1610, 1610, 1610,
-     1610,  127,  130,  130, 1610, 1610, 1610,  130,  130,  132,
-     1610, 1610, 1610, 1610, 1610,  132,  134,  134, 1610,  134,
-      134,  134,  134,   72,   72, 1610,   72,   72,   72,   72,
+       61,   61,   61,   61,   71,   71, 1654,   71,   71,   71,
+       71,  123,  123, 1654, 1654, 1654,  123,  123,  125,  125,
+     1654, 1654,  125, 1654,  125,  127, 1654, 1654, 1654, 1654,
+     1654,  127,  130,  130, 1654, 1654, 1654,  130,  130,  132,
+     1654, 1654, 1654, 1654, 1654,  132,  134,  134, 1654,  134,
+      134,  134,  134,   72,   72, 1654,   72,   72,   72,   72,
+       13, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654,
+     1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654,
 
-       13, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610
+     1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654,
+     1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654
     } ;
 
-static yyconst flex_int16_t yy_chk[3241] =
+static yyconst flex_int16_t yy_chk[3321] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -1330,7 +1352,7 @@ static yyconst flex_int16_t yy_chk[3241] =
         9,  151,   33,    6,    7,    7,    7,    7,    9,    7,
        10,   10,   10,   44,   44,    7,    8,    8,    8,    8,
        10,    8,   21,   33,  151,   21,   21,    8,   11,   11,
-       11,   11,   11,   11, 1616,   20,   29,   20,   20,   11,
+       11,   11,   11,   11, 1660,   20,   29,   20,   20,   11,
 
        20,   29,   24,   21,   25,   20,   24,   28,   11,   12,
        12,   12,   12,   12,   12,   74,   22,   22,   74,   25,
@@ -1348,7 +1370,7 @@ static yyconst flex_int16_t yy_chk[3241] =
        81,   83,   78,   68,   71,   79,   71,   71,   84,   71,
        85,   80,   86,   84,   71,   71,   87,   88,   81,   82,
        83,   89,   90,   91,   85,   89,   84,   90,   94,   97,
-       92,  625,   86,   92,   87,   88,   92,   91,   93,   95,
+       92,  631,   86,   92,   87,   88,   92,   91,   93,   95,
        98,  104,   96,   93,   95,   96,  103,   94,   99,   96,
        92,  100,   99,   97,   98,  102,  105,  106,  100,  103,
       105,  104,  102,  107,   95,  108,  109,  111,  107,  112,
@@ -1359,324 +1381,333 @@ static yyconst flex_int16_t yy_chk[3241] =
       121,  126,  131,  131,  119,  140,  139,  128,  122,  128,
       128,  133,  128,  133,  133,  134,  133,  134,  134,  136,
       134,  139,  136,  137,  138,  141,  134,  142,  137,  138,
-      143,  149,  144,  145,  130,  143,  143,  144,  145,  146,
+      143,  149,  144,  145,  176,  143,  143,  144,  145,  146,
       141,  146,  148,  148,  150,  154,  153,  142,  152,  150,
-      149,  153,  152,  155,  157,  156,  159,  159,  158,  154,
-      160,  146,  147,  158,  162,  161,  147,  156,  155,  162,
-      156,  147,  157,  163,  163,  167,  147,  177,  166,  164,
+      149,  153,  152,  155,  157,  156,  176,  160,  158,  154,
+      130,  146,  147,  158,  159,  159,  147,  156,  155,  161,
+      156,  147,  157,  162,  163,  163,  147,  160,  162,  167,
 
-      160,  161,  147,  147,  164,  177,  165,  166,  168,  169,
-      164,  165,  170,  168,  169,  171,  167,  170,  172,  174,
-      171,  175,  176,  178,  180,  172,  179,  175,  181,  180,
-      182,  183,  184,  185,  186,  185,  183,  187,  178,  174,
-      188,  186,  187,  189,  176,  193,  179,  193,  182,  182,
-      181,  191,  184,  190,  190,  189,  191,  192,  194,  188,
-      195,  196,  192,  197,  193,  199,  198,  200,  197,  196,
-      194,  198,  202,  201,  191,  203,  204,  204,  203,  195,
-      199,  201,  208,  205,  209,  200,  205,  206,  206,  207,
-      207,  210,  211,  212,  210,  213,  211,  202,  208,  209,
+      166,  164,  147,  147,  159,  161,  164,  174,  165,  166,
+      168,  169,  164,  165,  170,  168,  169,  171,  172,  170,
+      167,  178,  171,  175,  177,  172,  179,  174,  180,  175,
+      181,  182,  177,  180,  183,  184,  178,  186,  185,  183,
+      185,  188,  187,  191,  186,  189,  179,  187,  191,  182,
+      182,  192,  181,  190,  190,  184,  192,  189,  194,  193,
+      188,  193,  195,  196,  197,  199,  191,  198,  200,  197,
+      194,  196,  198,  202,  201,  129,  203,  208,  193,  203,
+      199,  195,  201,  204,  204,  205,  200,  209,  205,  206,
+      206,  207,  207,  208,  210,  211,  212,  210,  202,  211,
 
-      213,  214,  212,  215,  215,  216,  217,  218,  219,  220,
-      216,  217,  221,  222,  222,  214,  223,  224,  226,  225,
-      229,  224,  231,  226,  228,  221,  219,  218,  232,  227,
-      220,  225,  227,  230,  223,  233,  228,  229,  235,  235,
-      229,  232,  230,  231,  237,  238,  234,  233,  234,  234,
-      236,  240,  240,  236,  239,  242,  242,  241,  243,  244,
-      238,  237,  241,  239,  237,  245,  246,  247,  249,  250,
-      245,  248,  247,  243,  248,  251,  248,  254,  252,  244,
-      255,  256,  249,  252,  251,  250,  246,  253,  250,  257,
-      250,  258,  253,  259,  258,  262,  256,  261,  254,  263,
+      214,  213,  209,  215,  215,  212,  213,  216,  217,  218,
+      219,  220,  216,  217,  214,  222,  222,  221,  223,  224,
+      225,  226,  227,  224,  230,  229,  231,  227,  219,  218,
+      221,  228,  220,  226,  228,  231,  223,  229,  225,  232,
+      233,  230,  234,  235,  230,  235,  235,  236,  236,  237,
+      238,  239,  237,  233,  234,  240,  241,  241,  242,  244,
+      232,  243,  243,  242,  240,  245,  239,  238,  246,  247,
+      238,  248,  249,  246,  244,  249,  248,  249,  250,  251,
+      255,  252,  253,  254,  256,  245,  265,  253,  254,  247,
+      252,  257,  250,  258,  259,  251,  260,  259,  251,  263,
 
-      255,  265,  264,  257,  262,  296,  296,  259,  266,  268,
-      258,  260,  261,  260,  260,  272,  265,  267,  269,  270,
-      263,  264,  267,  260,  273,  260,  260,  260,  266,  268,
-      260,  271,  274,  269,  270,  272,  271,  274,  273,  275,
-      276,  277,  277,  278,  277,  276,  279,  281,  280,  282,
-      283,  282,  284,  285,  283,  275,  286,  287,  302,  302,
-      290,  281,  279,  278,  280,  286,  287,  285,  288,  290,
-      284,  289,  291,  288,  292,  289,  294,  291,  286,  293,
-      292,  294,  295,  293,  297,  298,  300,  299,  301,  297,
-      304,  308,  301,  129,  303,  295,  299,  309,  300,  303,
+      251,  255,  264,  262,  256,  265,  257,  258,  263,  266,
+      260,  267,  269,  259,  261,  268,  261,  261,  262,  270,
+      268,  271,  272,  264,  266,  273,  261,  272,  261,  261,
+      261,  267,  269,  261,  270,  274,  271,  275,  276,  277,
+      278,  278,  275,  278,  277,  273,  279,  280,  281,  274,
+      283,  282,  283,  284,  276,  285,  286,  284,  287,  288,
+      295,  295,  127,  280,  281,  282,  279,  287,  288,  289,
+      286,  290,  291,  285,  289,  290,  297,  292,  293,  294,
+      287,  291,  292,  294,  293,  296,  298,  298,  299,  297,
+      296,  300,  301,  299,  302,  303,  304,  304,  305,  303,
 
-      305,  305,  307,  307,  310,  309,  298,  311,  313,  314,
-      315,  304,  308,  310,  317,  316,  318,  319,  320,  311,
-      316,  318,  317,  321,  315,  325,  322,  323,  313,  314,
-      322,  324,  326,  329,  328,  319,  324,  332,  330,  334,
-      320,  325,  323,  330,  321,  333,  333,  331,  330,  329,
-      331,  326,  327,  327,  328,  335,  335,  332,  327,  336,
-      327,  337,  338,  339,  334,  340,  341,  342,  327,  343,
-      344,  341,  347,  337,  336,  345,  342,  338,  327,  345,
-      348,  346,  339,  349,  347,  344,  346,  340,  343,  350,
-      350,  351,  352,  354,  353,  356,  349,  353,  348,  355,
+      306,  301,  310,  305,  307,  307,  302,  309,  309,  311,
+      312,  315,  300,  313,  316,  317,  319,  311,  321,  312,
+      322,  306,  318,  310,  319,  313,  323,  318,  320,  317,
+      325,  315,  326,  320,  316,  324,  321,  326,  327,  324,
+      328,  331,  322,  330,  334,  325,  332,  323,  336,  333,
+      338,  332,  333,  342,  327,  339,  332,  331,  125,  328,
+      329,  329,  340,  330,  334,  338,  329,  339,  329,  335,
+      335,  337,  337,  336,  341,  342,  329,  340,  343,  344,
+      345,  346,  348,  343,  351,  347,  329,  348,  344,  347,
+      349,  350,  353,  341,  352,  352,  346,  351,  354,  345,
 
-      358,  357,  355,  351,  352,  357,  357,  361,  354,  359,
-      359,  356,  361,  358,  356,  360,  360,  362,  362,  363,
-      363,  364,  365,  366,  371,  367,  364,  368,  366,  367,
-      369,  370,  368,  372,  369,  373,  370,  374,  372,  377,
-      373,  127,  375,  365,  371,  375,  376,  376,  378,  379,
-      375,  374,  380,  378,  375,  380,  381,  377,  379,  382,
-      381,  383,  384,  385,  382,  386,  387,  384,  392,  388,
-      389,  387,  125,  389,  383,  388,  393,  386,  390,  385,
-      391,  390,  381,  394,  395,  391,  392,  395,  394,  396,
-      393,  397,  398,  399,  396,  397,  397,  398,  400,  401,
+      355,  356,  349,  355,  353,  357,  358,  359,  357,  350,
+      354,  359,  359,  360,  361,  361,  356,  362,  362,  363,
+      364,  364,  358,  367,  363,  358,  360,  365,  365,  366,
+      368,  373,  369,  370,  366,  368,  369,  371,  370,  376,
+      372,  371,  374,  375,  367,  372,  377,  374,  375,  377,
+      379,  373,  380,  376,  377,  378,  378,  381,  377,  384,
+      382,  383,  381,  384,  383,  385,  380,  386,  379,  382,
+      385,  387,  388,  390,  389,  391,  387,  395,  390,  392,
+      386,  391,  392,  396,  393,  384,  389,  393,  388,  394,
+      398,  397,  406,  398,  394,  395,  397,  396,  399,  402,
 
-      403,  400,  399,  401,  401,  402,  404,  402,  404,  405,
-      406,  407,  408,  409,  410,  415,  400,  409,  411,  403,
-      412,  413,  421,  410,  414,  416,  416,  405,  406,  414,
-      407,  417,  408,  411,  415,  417,  413,  418,  412,  419,
-      420,  421,  422,  423,  419,  425,  424,  428,  418,  426,
-      423,  424,  425,  427,  426,  422,  420,  429,  427,  430,
-      431,  432,  435,  444,  429,  428,  432,  433,  430,  434,
-      433,  436,  436,  434,  431,  439,  438,  440,  441,  439,
-      436,  438,  442,  435,  443,  447,  453,  450,  444,  440,
-      442,  454,  460,  459,  455,  453,  441,  454,  455,  123,
+      400,  401,  408,  399,  400,  400,  401,  403,  402,  404,
+      403,  406,  409,  404,  404,  405,  407,  405,  407,  410,
+      408,  411,  412,  413,  414,  403,  412,  415,  416,  417,
+      409,  418,  413,  420,  417,  419,  419,  420,  410,  414,
+      421,  411,  422,  416,  423,  415,  424,  422,  425,  426,
+      418,  421,  427,  429,  430,  428,  426,  427,  429,  430,
+      423,  425,  428,  431,  432,  424,  433,  435,  434,  438,
+      436,  432,  435,  436,  437,  433,  439,  439,  437,  441,
+      443,  431,  434,  442,  441,  439,  444,  442,  445,  446,
+      438,  447,  443,  450,  453,  457,  445,  456,  458,  463,
 
-      447,  456,  443,  445,  450,  458,  456,  463,  445,  465,
-      458,  459,  445,  461,  463,  445,  461,  460,  462,  462,
-      464,  464,  445,  469,  465,  445,  457,  470,  457,   67,
-      457,  466,  466,  457,  467,  468,  473,  467,  457,  471,
-      468,  472,  472,  469,  457,  457,  470,  471,  474,  475,
-      477,  473,  476,  476,  475,  477,  478,  479,  480,  481,
-      479,  478,  482,  483,  480,  485,  474,  481,  484,  487,
-      482,  488,  485,  484,  486,  486,  488,  487,  489,  491,
-      492,  483,  491,  493,  493,  494,  497,  495,  498,  499,
-      495,  500,  501,  498,  492,  502,  503,  489,  495,  504,
+      459,  457,  458,  462,  444,  459,  456,  446,  450,  461,
+      464,  453,  470,  464,  461,  470,  447,  448,  465,  465,
+      466,  462,  448,  468,  463,  473,  448,  466,  123,  448,
+      467,  467,  469,  469,  472,  474,  448,  478,  468,  448,
+      460,  460,  460,  471,  460,  473,  477,  460,  471,  475,
+      476,  476,  460,  472,  474,  478,   67,  475,  460,  460,
+      479,  477,  480,  480,  481,  479,  482,  483,  484,  481,
+      483,  482,  485,  486,  484,  487,  489,  488,  490,  490,
+      485,  486,  488,  489,  491,  492,  493,  496,  495,  498,
+      492,  495,  491,  487,  497,  497,  499,  501,  502,  499,
 
-      494,  505,  506,  504,  507,  503,  508,  497,  510,  511,
-      499,  500,  509,  507,  501,  502,  515,  512,  509,  505,
-      508,  506,  512,  511,  513,  516,  514,  517,  510,  513,
-      514,  518,  517,  519,  519,  515,  520,  516,  522,  521,
-      523,  520,  521,  524,  525,  526,  526,  528,  524,  527,
-      527,  529,  518,  523,  530,  529,  522,  531,  532,  534,
-      535,  536,  528,  534,  525,  537,  538,  553,   61,  539,
-      540,  538,  532,  530,  541,  535,  546,  542,  541,  553,
-      537,  531,  533,  539,  540,  533,  536,  533,  545,  543,
-      544,  533,  542,  533,  543,  544,  547,  546,  533,  548,
+      503,  496,  504,  502,  498,  493,  505,  499,  507,  506,
+      508,  511,  509,  510,  508,  514,  616,  507,  501,  512,
+      511,  503,  504,  515,  519,  513,  522,  616,  505,  506,
+      509,  513,  510,  512,  516,  514,  517,  515,  518,  516,
+      520,  517,  518,  519,  521,  523,  523,  522,  524,  521,
+      526,  525,  520,  524,  525,  528,  527,  529,  530,  530,
+      528,  531,  531,  532,  534,  535,  533,  536,  526,  527,
+      533,  538,  539,  540,  542,  538,  541,  529,  532,  542,
+      543,  536,  544,  534,  545,  546,   61,  539,  545,  535,
+      537,  541,  547,  537,  543,  537,  544,  547,  540,  537,
 
-      558,  549,  545,  552,  543,  548,  549,  550,  550,  551,
-      547,  554,  554,  550,  551,  550,  555,  552,  556,  558,
-      557,  555,  559,  559,  560,  562,  556,  564,  560,  563,
-      562,  565,  563,  550,  557,  566,  567,  569,  568,  571,
-      566,  573,  576,  570,  565,  578,  564,  568,  570,  572,
-      573,  577,  574,  579,  611,  567,  569,  574,  579,  571,
-      578,  576,  580,  572,  582,  581,  611,  580,  590,  577,
-      581,  583,  583,  582,  584,  588,  586,  589,  588,  584,
-      586,  586,  587,  587,  591,  592,  587,  591,  590,  593,
-      594,  595,  589,  596,  593,  594,  597,  595,  598,  598,
+      546,  537,  549,  548,  550,  551,  537,  547,  548,  552,
+      555,  537,  553,  556,   56,  552,  549,  553,  556,  551,
+      554,  554,  555,  557,  558,  550,  554,  560,  554,  559,
+      559,  561,  560,  562,  563,  569,  558,  557,  565,  561,
+      564,  564,  565,  567,  570,  571,  554,  562,  567,  568,
+      571,  572,  568,  563,  569,  573,  574,  570,  575,  576,
+      577,  578,  580,  579,  576,  574,  582,  580,  583,  584,
+      572,  573,  579,  585,  586,  578,  587,  575,  585,  586,
+      577,  587,  588,  596,  584,  582,  583,  589,  589,  590,
+      594,  588,  592,  594,  590,  595,  592,  592,  593,  593,
 
-      600,  599,  597,  602,  601,  603,  592,  601,  604,  596,
-      599,  606,  605,  608,  607,  610,  606,  609,  600,  607,
-      609,  602,  612,  614,  603,  605,  610,  612,  604,  613,
-      616,  608,  615,  615,  613,  618,  617,  619,  614,  620,
-      622,  619,  621,  623,  626,  627,  628,  618,  629,  616,
-      617,  621,   56,  629,  637,  632,  630,  620,  626,  622,
-      627,  630,  631,  633,  635,  634,  628,  631,  623,  632,
-      634,  636,  639,  637,  638,  638,  640,  633,  641,  635,
-      642,  642,  640,  643,  644,  645,  636,  647,  643,  646,
-      639,  644,  646,  648,  650,  649,  651,  652,  641,  645,
+      598,  597,  593,  596,  597,  606,  599,  600,  601,  602,
+      595,  599,  600,  603,  601,  604,  604,  605,  608,  603,
+      609,  598,  610,  606,  607,  602,  605,  607,  611,  612,
+      613,  614,  617,  618,  612,  613,  608,  615,  618,  609,
+      615,  611,  610,  619,  617,  620,  621,  621,  619,  614,
+      622,  623,  624,  625,  626,  628,  629,  625,  627,  632,
+      620,  633,  634,  635,  624,  623,  636,  627,  635,  622,
+      637,  636,  626,  632,  628,  637,  633,  638,  639,  640,
+      641,  629,  634,  642,  640,  643,  644,  645,  645,  646,
+      647,  638,  639,  648,  650,  641,  647,  649,  649,  650,
 
-      649,  651,  648,  653,  655,  647,  654,  653,  656,  657,
-      658,  659,  660,  650,  661,  654,  652,  663,  662,  655,
-      661,  657,  664,  656,  667,  669,  745,  668,  745,  658,
-      660,  664,  659,  662,  666,  668,  670,  663,  667,  666,
-      672,  670,  671,  673,  674,  669,  671,  671,  683,  675,
-      676,  676,  677,  674,  675,  678,  673,  677,  680,  672,
-      678,  679,  679,  681,  682,  684,  683,  680,  681,  685,
-      684,  686,  688,  687,  685,  691,  686,  687,  682,  691,
-      689,  688,  692,  693,  694,  695,  688,  696,  688,  697,
-      688,  689,  698,  699,  701,  696,  706,  692,  694,  700,
+      643,  651,  642,  652,  654,  644,  653,  646,  651,  653,
+      655,  656,  657,  648,  659,  658,  656,  652,  661,  655,
+      658,  660,  654,  662,  663,  660,  666,  661,  664,  665,
+      667,  657,  668,  659,  669,  664,  671,  670,  662,  663,
+      669,  665,  674,  675,  672,  666,  676,  674,  677,   51,
+      668,  667,  670,  672,  676,  678,  671,  675,  679,  680,
+      678,  682,  679,  679,  681,  681,  683,  684,  677,  685,
+      685,  686,  684,  691,  682,  683,  686,  687,  680,  688,
+      688,  689,  687,  690,  692,  701,  693,  691,  690,  694,
+      689,  693,  695,  698,  694,  696,  697,  695,  702,  696,
 
-      700,  693,  705,  697,  695,  702,  702,  705,  704,  701,
-      698,  704,  707,  707,  708,  706,  709,  709,  699,  710,
-      711,  711,  712,  713,  710,  714,  715,  717,  713,  716,
-      716,  715,  718,  714,  708,  721,  719,  726,  718,  722,
-      721,  723,  712,  719,  722,  717,  723,  724,  725,  727,
-      728,  728,  724,  729,  730,  732,  726,  725,  731,  733,
-      727,  736,  734,  731,  735,  735,  737,  738,  748,  739,
-      750,  740,  748,  729,  746,  732,  740,  730,  742,  733,
-      734,  736,  742,  742,  743,  738,  744,  749,  746,  750,
-      747,  737,  739,  743,  744,  747,  751,  752,  749,  753,
+      701,  703,  692,  700,  698,  697,  704,  700,  706,  705,
+      697,  707,  697,  708,  697,  703,  702,  705,  709,  709,
+      710,  714,  706,  711,  711,  704,  714,  713,  715,  707,
+      713,  716,  716,  717,  719,  710,  718,  718,  708,  719,
+      720,  720,  721,  722,  723,  724,  726,  715,  722,  728,
+      724,  727,  723,  717,  725,  725,  728,  727,  730,  734,
+      731,  732,  721,  730,  726,  731,  732,  733,  734,  735,
+      736,  738,  733,  737,  737,  739,  741,  740,  746,  742,
+      745,  736,  740,  743,  744,  744,  747,  748,  735,  749,
+      750,  738,  748,  758,  761,  750,  741,  758,  739,  742,
 
-      754,  755,  756,  759,  753,  757,  756,  758,  761,  760,
-      765,  762,  763,  769,   51,  752,  762,  759,  754,  763,
-      764,  755,  751,  757,  760,  764,  758,  761,  765,  766,
-      767,  768,  773,  773,  769,  770,  771,  768,  766,  772,
-      770,  771,  775,  775,  772,  767,  776,  777,  778,  779,
-      781,  776,  782,  779,  779,  780,  780,  783,  784,  785,
-      787,  777,  788,  786,  791,  785,  789,  778,  786,  781,
-      790,  782,  792,  793,  794,  794,  796,  784,  791,  787,
-      796,  788,  795,  783,  797,  789,  798,  795,  793,  790,
-      799,  800,  800,  792,  801,  798,  802,  797,  803,  801,
+      745,  743,  752,  746,  747,  753,  752,  752,  754,  755,
+      756,  755,  749,  757,  753,  759,  754,  760,  757,  762,
+      761,  764,  763,  765,  756,  766,  759,  763,  767,  766,
+      768,  769,  770,  771,  772,  773,  760,  762,  776,  764,
+      773,  780,  778,  765,  774,  769,  767,  770,  771,  768,
+      775,  774,  777,  772,  779,  775,  776,  778,  781,  782,
+      779,  777,  780,  781,  782,  783,  784,  784,  786,  786,
+      783,  787,  788,  789,  790,  791,  793,  788,  794,  791,
+      791,  792,  792,  795,  796,  797,  799,  789,  800,  787,
+      803,  797,  801,  790,  798,  793,  802,  794,  804,  798,
 
-      802,  804,  806,  808,  809,  809,  804,  810,  808,  819,
-      799,  818,  810,  812,  812,  814,  814,  820,  803,  816,
-      806,  822,  816,  817,  817,  821,  818,  823,  823,  824,
-      821,  820,  825,  825,  819,  826,  822,  827,  828,  829,
-      830,  832,  828,  834,  834,  830,  833,  835,  827,  824,
-      836,  837,  838,  841,  838,  842,  839,  826,  829,  832,
-      833,  839,  846,  840,  843,  843,  844,  835,  840,  842,
-      836,  837,  844,  841,  847,  847,  848,  849,  850,  855,
-      851,  850,  852,  853,  850,  851,  846,  852,  848,  854,
-      856,  859,  853,  856,  854,  857,  850,  849,  858,  858,
+      811,  805,  808,  796,  803,  799,  808,  800,  809,  795,
+      815,  801,  806,  806,  810,  802,  805,  807,  818,  804,
+      811,  809,  807,  810,  812,  812,  813,  831,  814,  816,
+      815,  813,  814,  820,  816,  836,  818,  822,  820,  821,
+      821,  830,  822,  824,  824,  826,  826,  828,  829,  829,
+      828,  832,  831,  833,  834,  836,  830,  838,  833,  835,
+      835,  837,  837,  839,  840,  832,  841,  842,  840,  834,
+      844,  847,  842,  845,  839,  846,  846,  848,  849,  838,
+      850,  851,  850,  853,  852,  841,  851,  845,  844,  852,
+      854,  847,  855,  856,  856,  854,  857,  848,  849,  859,
 
-      857,  860,  861,  862,  855,  863,  864,  867,  862,  859,
-      866,  864,  865,  865,  868,  866,  869,  870,  871,  872,
-      860,  873,  861,  874,  875,  867,  873,  876,  863,  880,
-      871,  870,  872,  879,  868,  878,  869,  881,  880,  885,
-      879,  880,  885,  874,  875,  884,  884,  886,  876,  887,
-      878,  888,  886,  881,  889,  890,  892,  891,  893,  893,
-      888,  892,  894,  895,  890,  887,  891,  890,  896,  897,
-      898,  899,  901,  889,  900,  900,  895,  908,  902,  904,
-      905,  907,  894,  897,  904,  906,  896,  907,  901,  899,
-      906,  910,  915,  914,  909,  898,  902,  908,  905,  909,
+      860,  860,  857,  853,  861,  862,  855,  864,  863,  866,
+      865,  863,  864,  868,  863,  865,  861,  867,  866,  871,
+      871,  869,  867,  859,  869,  862,  863,  870,  872,  873,
+      874,  875,  870,  877,  876,  878,  875,  881,  868,  876,
+      878,  879,  879,  882,  880,  883,  872,  884,  873,  880,
+      874,  888,  885,  886,  887,  881,  877,  889,  890,  887,
+      893,  884,  892,  882,  885,  883,  886,  892,   50,  894,
+      896,  888,  895,  899,  899,  893,  894,  889,  902,  890,
+      900,  895,  901,  900,  895,  904,  896,  901,  903,  905,
+      906,  907,  908,  908,  902,  909,  907,  903,  905,  906,
 
-      911,  914,  916,  911,  910,  915,  917,  918,  919,  911,
-      920,  922,  918,  923,  924,  928,  925,  923,  926,  924,
-      916,  925,  929,  926,  919,  917,  927,  931,  920,  930,
-      930,  922,  932,  933,  934,  927,  935,  929,  928,  934,
-      936,  931,   50,  937,  932,  933,  938,  938,  935,  937,
-      939,  939,  941,  942,  942,  943,  945,  944,  936,  946,
-      947,  941,  944,  948,  949,  945,  951,  943,  948,  950,
-      954,  946,  956,  949,  953,  947,  952,  952,  955,  953,
-      958,  951,  957,  957,  959,  959,  949,  960,  960,  950,
-      961,  954,  956,  962,  964,  961,  962,  955,  965,  964,
+      910,  905,  911,  912,  904,  913,  914,  915,  915,  916,
+      917,  919,   45,  910,  920,  909,  919,  912,  921,  923,
+      911,  922,  925,  921,  914,  916,  924,  922,  917,  929,
+      913,  924,  920,  926,  930,  925,  926,  929,  931,  923,
+      932,  933,  926,  935,  934,  937,  933,  930,  938,  939,
+      940,  943,  938,  941,  939,  940,  931,  942,  941,  932,
+      934,  935,  944,  945,  945,  937,  942,  946,  947,  951,
+      948,  949,  950,  952,  943,  954,  949,  944,  954,  952,
+      947,  946,  948,  957,  950,  953,  953,  951,  955,  955,
+      958,  958,  957,  959,  960,  961,  962,  963,  964,  960,
 
-      958,  966,  967,  968,  968,  970,  966,  969,  969,  971,
-      970,  972,  973,  974,  975,  977,  965,  976,  976,  978,
-      978,  971,  979,  971,  983,  981,  986,  967,  971,  982,
-      982,  972,  973,  974,  981,  975,  984,  985,  988,  983,
-      989,  977,  979,  984,  987,  987,  985,  993,  991,  992,
-      994,  998,  986,  991,  992,  996,  989,  994,  995,  995,
-      996,  997,  999, 1000,  988, 1001, 1002,  993, 1005, 1003,
-      997,  998, 1002, 1004, 1004, 1006, 1006,  999, 1003, 1005,
-     1001, 1007, 1000, 1008, 1005, 1009, 1010, 1010, 1011, 1012,
-     1009, 1013, 1011, 1011, 1012, 1014, 1015, 1008, 1016, 1017,
+      965,  966,  967,  964,  961,  959,  968,  968,  962,  965,
+      969,  970,  963,   40,  971,  969,  972,  967,  973,  973,
+      974,  966,  965,  975,  975,  976,  976,  977,  982,  978,
+      984,  977,  970,  971,  978,  979,  972,  981,  979,  983,
+      974,  989,  981,  990,  983,  988,  982,  985,  985,  986,
+      986,  987,  991,  992,  993,  984,  987,  988,  988,  988,
+      995,  989,  997,  990,  988,  994,  994,  992,  996,  996,
+      999, 1002,  991, 1000, 1000,  993, 1001, 1004, 1002,  999,
+     1003, 1006,  997, 1005, 1005, 1007,  995, 1009, 1010, 1003,
+     1011, 1001, 1009, 1010, 1014, 1012, 1013, 1013, 1016, 1014,
 
-     1018, 1015, 1007, 1017, 1019, 1021, 1020, 1014, 1022, 1023,
-     1016, 1020, 1018, 1022,   45, 1025, 1031, 1013, 1025, 1026,
-     1026, 1023, 1027, 1027, 1028, 1031, 1029, 1021, 1030, 1019,
-     1028, 1029, 1034, 1036, 1030, 1037, 1037, 1038, 1039, 1042,
-     1040, 1041, 1045, 1042, 1034, 1036, 1043, 1039, 1044, 1047,
-     1047, 1043, 1048, 1044, 1049, 1050, 1045, 1038, 1040, 1055,
-     1041, 1047, 1056, 1049, 1050, 1052, 1052, 1056, 1057, 1063,
-     1048, 1058, 1058, 1055, 1059, 1062, 1059, 1060, 1060, 1064,
-     1064, 1065, 1062, 1066, 1067, 1057, 1068, 1070, 1069, 1063,
-     1074, 1073, 1072, 1073, 1079, 1066, 1067, 1072, 1068, 1077,
+     1015, 1007, 1012, 1004, 1017, 1018, 1019, 1006, 1020, 1015,
+     1011, 1021, 1022, 1022, 1020, 1023, 1024, 1024, 1016, 1017,
+     1021, 1019, 1025, 1026, 1018, 1027, 1023, 1028, 1028, 1029,
+     1027, 1023, 1031, 1029, 1029, 1030, 1032, 1026, 1034, 1033,
+     1030, 1035, 1036, 1025, 1033, 1035, 1037, 1038, 1032, 1041,
+     1034, 1039, 1038, 1043, 1036, 1040, 1043,   14, 1031, 1049,
+     1040, 1041, 1044, 1044, 1045, 1045, 1046, 1053, 1049, 1047,
+     1048, 1037, 1046, 1039, 1047, 1051, 1048, 1055, 1057, 1053,
+     1051, 1056, 1056, 1058, 1059, 1060, 1061, 1064, 1062, 1055,
+     1061, 1063, 1058, 1062, 1066, 1066, 1063, 1067, 1057, 1068,
 
-     1075, 1080, 1065, 1069, 1078, 1078, 1080, 1070, 1074, 1075,
-     1081, 1082, 1081, 1077, 1083, 1084, 1082, 1085, 1086, 1083,
-     1079, 1087, 1089, 1086, 1090,   40, 1087, 1091, 1091, 1102,
-     1092, 1093, 1094, 1084, 1094, 1095, 1096, 1085, 1090, 1101,
-     1093, 1089, 1092, 1093, 1095, 1098, 1099, 1103, 1096, 1102,
-     1098, 1099, 1101, 1105, 1107, 1108, 1109, 1110, 1112, 1105,
-     1107, 1111, 1111, 1103, 1113, 1113, 1110, 1112, 1114, 1115,
-     1108, 1116, 1117, 1115, 1118, 1118, 1116, 1129, 1119, 1122,
-     1125, 1109, 1123, 1123, 1131, 1117, 1119, 1114, 1122, 1124,
-     1124, 1126, 1125, 1127, 1127, 1130, 1126, 1132, 1133, 1134,
+     1069, 1064, 1059, 1074, 1060, 1075, 1066, 1076, 1068, 1069,
+     1071, 1071, 1076, 1077, 1082, 1067, 1078, 1078, 1074, 1075,
+     1079, 1082, 1079, 1080, 1080, 1083, 1084, 1084, 1085, 1086,
+     1077, 1087, 1088, 1090, 1089, 1091, 1092, 1085, 1095, 1096,
+     1095, 1101, 1094, 1087, 1088, 1083, 1089, 1094, 1090, 1097,
+     1086, 1099, 1100, 1100, 1102, 1091, 1092, 1096, 1097, 1102,
+     1103, 1104, 1103, 1105, 1106, 1099, 1104, 1101, 1105, 1107,
+     1108, 1109, 1111, 1112, 1114, 1108, 1109, 1113, 1113, 1117,
+     1118, 1115, 1106, 1116, 1123, 1116, 1114, 1112, 1117, 1107,
+     1115, 1111, 1118, 1115, 1120, 1121, 1124, 1123, 1125, 1120,
 
-     1130, 1138, 1129, 1133, 1135, 1136, 1136, 1131, 1140, 1137,
-     1139, 1141, 1132, 1137, 1143, 1139, 1138, 1134, 1144, 1145,
-     1135, 1146, 1147, 1149, 1149, 1150, 1151,   14, 1150, 1152,
-     1141, 1153, 1153, 1146, 1140, 1154, 1154, 1144, 1143, 1151,
-     1145, 1156, 1152, 1147, 1155, 1155, 1157, 1157, 1158, 1158,
-     1159, 1160, 1160, 1162, 1156, 1161, 1161, 1164, 1165, 1165,
-     1166, 1169, 1164, 1167, 1167, 1168, 1173, 1169, 1170, 1159,
-     1177, 1170, 1162, 1171, 1171, 1172, 1172, 1174, 1174, 1166,
-     1176, 1176, 1179, 1168, 1182, 1173, 1178, 1178, 1180, 1171,
-     1181, 1179, 1183, 1184, 1185, 1181, 1177, 1186, 1187, 1185,
+     1121, 1127, 1129, 1130, 1131, 1136, 1132, 1127, 1129, 1133,
+     1133, 1134, 1135, 1135, 1125, 1132, 1124, 1137, 1130, 1139,
+     1134, 1137, 1138, 1141, 1136, 1140, 1140, 1138, 1144, 1131,
+     1147, 1141, 1139, 1145, 1145, 1146, 1146, 1144, 1148, 1149,
+     1150, 1150, 1147, 1152, 1149, 1153, 1154, 1155, 1156, 1157,
+     1153, 1159, 1159, 1156, 1158, 1160, 1148, 1161, 1162, 1160,
+     1163, 1164, 1155, 1162, 1166, 1167, 1168, 1157, 1152, 1154,
+     1158, 1169, 1161, 1171, 1173, 1173, 1170, 1175, 1174, 1176,
+     1164, 1174, 1177, 1178, 1178, 1168, 1163, 1166, 1170, 1167,
+     1175, 1181, 1169, 1176, 1171, 1177, 1179, 1179, 1180, 1180,
 
-     1180, 1188, 1189, 1190, 1193, 1183, 1200, 1187, 1190, 1182,
-     1188, 1191, 1186, 1195, 1184, 1191, 1189, 1196, 1196, 1201,
-     1197, 1200, 1195, 1204, 1193, 1197, 1198, 1198, 1204, 1203,
-     1208, 1201, 1203, 1205, 1205, 1198, 1207, 1207, 1209, 1209,
-     1210, 1211, 1212, 1215, 1208, 1213, 1213, 1215, 1216, 1217,
-     1217, 1216, 1210, 1218, 1219, 1211, 1220, 1221, 1218, 1222,
-     1220, 1212, 1223, 1224, 1222, 1226, 1227, 1223, 1228, 1224,
-     1229, 1227, 1229, 1246, 1219, 1238, 1228, 1221, 1232, 1232,
-     1238, 1226, 1235, 1235, 1239, 1239, 1241, 1241, 1243, 1244,
-     1244, 1245, 1247, 1243, 1254, 1246, 1252, 1247, 1249, 1249,
+     1182, 1182, 1183, 1183, 1181, 1184, 1184, 1185, 1186, 1186,
+     1187, 1187, 1188, 1190, 1191, 1191, 1192, 1195, 1190, 1193,
+     1193, 1194, 1196, 1195, 1203, 1196, 1185, 1197, 1197, 1198,
+     1198, 1188, 1199, 1200, 1200, 1192, 1202, 1202, 1205, 1194,
+     1204, 1204, 1206, 1197, 1207, 1208, 1209, 1205, 1210, 1207,
+     1203, 1199, 1211, 1212, 1206, 1213, 1214, 1211, 1215, 1209,
+     1219, 1216, 1221, 1217, 1213, 1214, 1216, 1217, 1212, 1210,
+     1208, 1221, 1215, 1222, 1222, 1226, 1223, 1224, 1224, 1227,
+     1219, 1223, 1229, 1230, 1231, 1229, 1224, 1235, 1230, 1238,
+     1226, 1227, 1232, 1232, 1234, 1234, 1236, 1236, 1237, 1239,
 
-     1253, 1252, 1253, 1259, 1255, 1256, 1256, 1245, 1254, 1255,
-     1257, 1257, 1258, 1258, 1260, 1259, 1261, 1262, 1263, 1264,
-     1265, 1266, 1266, 1268, 1264, 1267, 1269, 1271, 1261, 1262,
-     1263, 1270, 1260, 1272, 1267, 1273, 1274, 1275, 1276, 1276,
-     1265, 1274, 1275, 1279, 1270, 1281, 1269, 1272, 1280, 1268,
-     1282, 1271, 1283, 1273, 1284, 1285, 1286, 1286, 1288, 1288,
-     1289, 1283, 1290, 1279, 1291, 1292, 1280, 1281, 1293, 1289,
-     1282, 1294, 1297, 1285, 1284, 1295, 1295, 1290, 1298, 1299,
-     1296, 1301, 1291, 1292, 1293, 1296, 1304, 1297, 1305, 1307,
-     1294, 1305, 1306, 1306, 1308, 1310, 1310, 1298, 1311, 1299,
+       13, 1235, 1246, 1238, 1231, 1240, 1240, 1242, 1249, 1243,
+     1237, 1242, 1243, 1244, 1244, 1245, 1247, 1248, 1239, 1250,
+     1245, 1248, 1246, 1252, 1250, 1254, 1251, 1255, 1249, 1252,
+     1247, 1251, 1255, 1256, 1257, 1258, 1276, 1258, 1256, 1261,
+     1261, 1254, 1257, 1265, 1265, 1268, 1269, 1269, 1271, 1271,
+     1268, 1273, 1274, 1274, 1275, 1277, 1273, 1284, 1276, 1282,
+     1277, 1279, 1279, 1283, 1282, 1283, 1289, 1285, 1286, 1286,
+     1275, 1284, 1285, 1287, 1287, 1288, 1288, 1290, 1289, 1291,
+     1292, 1293, 1294, 1295, 1296, 1296, 1298, 1294, 1297, 1299,
+     1301, 1291, 1292, 1293, 1300, 1290, 1302, 1297, 1303, 1304,
 
-     1301, 1312, 1312, 1318, 1307, 1319, 1304, 1313, 1313, 1317,
-     1317, 1320, 1308, 1321, 1319, 1322, 1320, 1311, 1321, 1323,
-     1325, 1326, 1328, 1327, 1342, 1318, 1326, 1323, 1327, 1329,
-     1329, 1330, 1330, 1331, 1322, 1325, 1342, 1328, 1331, 1332,
-     1332, 1333, 1333, 1335, 1338, 1336, 1337, 1339, 1335, 1336,
-     1340, 1337, 1341, 1338, 1345, 1346, 1344, 1341, 1340, 1344,
-     1347, 1349, 1339, 1351, 1346, 1348, 1348, 1345, 1352, 1347,
-     1349, 1353, 1353, 1356, 1354, 1355, 1355, 1359, 1360, 1357,
-     1365, 1356, 1351, 1354, 1357, 1371, 1359, 1352, 1362, 1362,
-     1372, 1360, 1366, 1366, 1367, 1368, 1368, 1367, 1369, 1369,
+     1305, 1306, 1306, 1295, 1304, 1305, 1310, 1300, 1312, 1299,
+     1302, 1311, 1298, 1313, 1301, 1314, 1303, 1307, 1307, 1315,
+     1316, 1317, 1317, 1320, 1314, 1322, 1310, 1319, 1319, 1311,
+     1312, 1323, 1320, 1313, 1321, 1324, 1325, 1326, 1316, 1315,
+     1322, 1321, 1327, 1327, 1329, 1328, 1330, 1331, 1332, 1323,
+     1328, 1334, 1325, 1324, 1337, 1338, 1326, 1340, 1338, 1339,
+     1339, 1330, 1329, 1341, 1343, 1343, 1331, 1344, 1332, 1351,
+     1334, 1355, 1340, 1352, 1337, 1345, 1345, 1346, 1346, 1350,
+     1350, 1341, 1352, 1353, 1354, 1356, 1344, 1358, 1353, 1354,
+     1355, 1351, 1359, 1356, 1360, 1361, 1372, 1359,    0, 1360,
 
-     1365, 1370, 1370, 1371, 1372, 1373, 1374, 1374, 1375, 1378,
-     1373, 1381, 1375, 1382, 1383, 1378, 1384, 1385, 1382, 1386,
-     1386, 1387, 1388, 1389, 1390, 1390, 1393, 1391, 1381, 1381,
-     1388, 1385, 1383, 1392, 1394, 1395, 1384, 1396, 1392, 1407,
-     1387, 1400, 1389, 1391, 1395, 1398, 1393, 1402, 1398, 1401,
-     1401, 1402, 1403, 1405, 1406, 1412, 1412, 1396, 1411, 1400,
-     1394, 1403, 1405, 1411, 1407, 1413, 1406, 1415, 1416, 1417,
-     1418, 1419, 1415, 1420, 1413, 1418, 1421, 1416, 1420, 1422,
-     1422, 1424, 1425, 1426, 1426, 1427, 1428, 1429, 1430, 1419,
-     1417, 1432, 1433, 1431, 1427, 1438, 1430, 1425, 1431, 1439,
+     1362, 1362, 1358, 1363, 1363, 1372, 1364, 1365, 1365, 1369,
+     1361, 1364, 1366, 1366, 1369, 1370, 1371, 1373, 1374, 1370,
+     1375, 1371, 1376, 1379, 1378, 1375, 1374, 1378, 1381, 1380,
+     1382, 1384, 1373, 1386, 1376, 1383, 1383, 1381, 1387, 1382,
+     1384, 1379, 1380, 1388, 1389, 1389, 1390, 1391, 1391, 1392,
+     1395, 1393, 1386, 1396, 1401, 1390, 1393, 1392, 1387, 1395,
+     1398, 1398, 1388, 1402, 1402, 1403, 1396, 1407, 1403, 1404,
+     1404, 1405, 1405, 1408, 1401, 1406, 1406, 1409, 1410, 1410,
+     1411, 1417, 1409, 1414, 1411, 1407, 1418, 1408, 1419, 1414,
+     1420, 1418, 1423, 1421, 1422, 1422, 1424, 1425, 1417, 1417,
 
-     1424, 1421, 1428, 1434, 1434, 1435, 1429, 1437, 1437, 1442,
-     1435, 1433, 1440, 1440, 1443, 1438, 1444, 1432, 1441, 1441,
-     1446, 1439, 1445, 1445, 1447, 1448, 1443, 1454, 1442, 1447,
-     1449, 1450, 1446, 1451, 1451, 1449, 1444, 1453, 1453, 1456,
-     1457, 1458, 1458,   13, 1448, 1457, 1454, 1461, 1450, 1450,
-     1459, 1459, 1461, 1456, 1460, 1460, 1462, 1462, 1464, 1464,
-     1466, 1466, 1467, 1470, 1471, 1471, 1475, 1467, 1472, 1474,
-     1476, 1470, 1477, 1472, 1474, 1478, 1479, 1482, 1483, 1483,
-     1493, 1479, 1497, 1484, 1475, 1495, 1476, 1484, 1499, 1477,
-     1477, 1488, 1488, 1498, 1490, 1493, 1478, 1482, 1490, 1492,
+     1426, 1426, 1427, 1427, 1424, 1428, 1419, 1421, 1429, 1430,
+     1420, 1423, 1431, 1429, 1432, 1433, 1425, 1434, 1438, 1436,
+     1445, 1428, 1436, 1432, 1439, 1439, 1440, 1444, 1449, 1430,
+     1440, 1441, 1443, 1449, 1455, 1433, 1438, 1434, 1431, 1444,
+     1441, 1443, 1450, 1450, 1451, 1445, 1453, 1454, 1457, 1456,
+     1459, 1453, 1458, 1451, 1456, 1455, 1454, 1458, 1460, 1460,
+     1462, 1463, 1464, 1464, 1465, 1466, 1457, 1467, 1465, 1468,
+     1469, 1471, 1470, 1473, 1466, 1459, 1463, 1470, 1469, 1462,
+     1472, 1472, 1475, 1467, 1474, 1474, 1478, 1475, 1468, 1477,
+     1477, 1479, 1473, 1480, 1480, 1481, 1481, 1471, 1482, 1483,
 
-     1492, 1496, 1496, 1495, 1502, 1500, 1501, 1497, 1498, 1499,
-     1500, 1501, 1503, 1503, 1505, 1505, 1507, 1507, 1509, 1510,
-     1510, 1512, 1513, 1502, 1514, 1515, 1512, 1516, 1521, 1514,
-     1509, 1517, 1521, 1522, 1525, 1523, 1513, 1524, 1526, 1527,
-     1528, 1529, 1529, 1533, 1515, 1516, 1531, 1517, 1523, 1530,
-     1534, 1531, 1525, 1522, 1526, 1528, 1524, 1532, 1530, 1536,
-     1538, 1535, 1532, 1539, 1527, 1534, 1535, 1540, 1533, 1541,
-     1542, 1544, 1540, 1536, 1541, 1538, 1543, 1545, 1546, 1547,
-     1548, 1549, 1539, 1550, 1542, 1552, 1553, 1553, 1550, 1543,
-     1544, 1545, 1547, 1548, 1551, 1557, 1554, 1546, 1555, 1551,
+     1484, 1485, 1485, 1486, 1487, 1488, 1478, 1489, 1490, 1487,
+     1494, 1483, 1489, 1479,    0, 1486, 1497, 1482, 1491, 1491,
+     1484, 1493, 1493, 1496, 1488, 1490, 1490, 1498, 1496, 1494,
+     1497,    0, 1498, 1499, 1499, 1500, 1500, 1501, 1501, 1502,
+     1504, 1504, 1506, 1506, 1502, 1508, 1508, 1509, 1512, 1513,
+     1513, 1517, 1509, 1514, 1516, 1518, 1512, 1519, 1514, 1516,
+     1520, 1521, 1524, 1525, 1525, 1536, 1521, 1526, 1526, 1517,
+     1538, 1518, 1527, 1540, 1519, 1519, 1527, 1531, 1531, 1533,
+     1536, 1520, 1524, 1533, 1535, 1535, 1539, 1539, 1538, 1541,
+     1542, 1543, 1544, 1545, 1546, 1546, 1543, 1544, 1540, 1549,
 
-     1549, 1554, 1556, 1555, 1552, 1558, 1560, 1556, 1559, 1559,
-     1558, 1561, 1562, 1560, 1557, 1563, 1564, 1567, 1568, 1565,
-     1563, 1569, 1567, 1570, 1571, 1571, 1573, 1578, 1572, 1576,
-     1561, 1562, 1565, 1572, 1576, 1564, 1570, 1568, 1574, 1574,
-     1569, 1575, 1575, 1577, 1580, 1573, 1578, 1579, 1579, 1581,
-     1577, 1580, 1582, 1583, 1584, 1586, 1581, 1587, 1583, 1588,
-     1586, 1589, 1587, 1590, 1590, 1591, 1592, 1593, 1593, 1594,
-     1594, 1582, 1595, 1584, 1596, 1596, 1597, 1597, 1588, 1595,
-     1589, 1598, 1600, 1604, 1591, 1592, 1603, 1600, 1598, 1605,
-        0, 1603, 1606, 1606, 1607, 1607,    0,    0,    0,    0,
+     1549, 1551, 1551, 1553, 1541, 1554, 1554, 1557, 1556, 1558,
+     1559, 1542, 1545, 1556, 1558, 1553, 1560, 1561, 1565, 1566,
+     1569, 1557, 1565, 1567, 1568, 1570, 1571, 1572, 1574, 1559,
+     1573, 1573, 1577, 1561, 1560, 1575, 1567, 1574, 1569, 1566,
+     1575, 1570, 1572, 1568, 1576, 1578, 1582, 1579, 1580, 1576,
+     1583, 1571, 1579, 1584, 1585, 1587, 1586, 1577, 1584, 1585,
+     1578, 1582, 1580, 1588, 1589, 1590, 1591, 1592, 1587, 1583,
+     1586, 1593, 1594, 1596, 1597, 1597, 1595, 1594, 1589, 1591,
+     1592, 1595, 1588, 1598, 1590, 1601, 1599,    0, 1598, 1600,
+     1593, 1599, 1596, 1602, 1600, 1603, 1603, 1605, 1602, 1604,
 
-        0,    0, 1604,    0,    0,    0,    0,    0, 1605, 1611,
-     1611, 1611, 1611, 1611, 1611, 1611, 1612, 1612, 1612, 1612,
-     1612, 1612, 1612, 1613, 1613, 1613, 1613, 1613, 1613, 1613,
-     1614, 1614, 1614, 1614, 1614, 1614, 1614, 1615, 1615, 1615,
-     1615, 1615, 1615, 1615, 1617, 1617,    0, 1617, 1617, 1617,
-     1617, 1618, 1618,    0,    0,    0, 1618, 1618, 1619, 1619,
-        0,    0, 1619,    0, 1619, 1620,    0,    0,    0,    0,
-        0, 1620, 1621, 1621,    0,    0,    0, 1621, 1621, 1622,
-        0,    0,    0,    0,    0, 1622, 1623, 1623,    0, 1623,
-     1623, 1623, 1623, 1624, 1624,    0, 1624, 1624, 1624, 1624,
+     1606, 1608, 1607, 1611, 1601, 1609, 1604, 1607, 1611, 1612,
+     1613, 1614, 1615, 1615, 1617,    0, 1605, 1616, 1609, 1606,
+     1608, 1622, 1616, 1626, 1614, 1618, 1618, 1620, 1612, 1613,
+     1619, 1619, 1620, 1617, 1621, 1623, 1623, 1624, 1625, 1628,
+     1622, 1621, 1626, 1627, 1624, 1625, 1630, 1631, 1627, 1632,
+     1633, 1630, 1631, 1634, 1634, 1635, 1636, 1639, 1628, 1637,
+     1637, 1638, 1638, 1648, 1639, 1640, 1640, 1649, 1632, 1633,
+     1641, 1641, 1642, 1644, 1635, 1636, 1647,    0, 1644, 1642,
+        0, 1647, 1648, 1650, 1650,    0, 1649, 1651, 1651, 1655,
+     1655, 1655, 1655, 1655, 1655, 1655, 1656, 1656, 1656, 1656,
 
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610,
-     1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610, 1610
+     1656, 1656, 1656, 1657, 1657, 1657, 1657, 1657, 1657, 1657,
+     1658, 1658, 1658, 1658, 1658, 1658, 1658, 1659, 1659, 1659,
+     1659, 1659, 1659, 1659, 1661, 1661,    0, 1661, 1661, 1661,
+     1661, 1662, 1662,    0,    0,    0, 1662, 1662, 1663, 1663,
+        0,    0, 1663,    0, 1663, 1664,    0,    0,    0,    0,
+        0, 1664, 1665, 1665,    0,    0,    0, 1665, 1665, 1666,
+        0,    0,    0,    0,    0, 1666, 1667, 1667,    0, 1667,
+     1667, 1667, 1667, 1668, 1668,    0, 1668, 1668, 1668, 1668,
+     1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654,
+     1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654,
+
+     1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654,
+     1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654, 1654
     } ;
 
 static yy_state_type yy_last_accepting_state;
@@ -1877,7 +1908,7 @@ static void config_end_include(void)
 #define YY_NO_INPUT 1
 #endif
 
-#line 1879 "<stdout>"
+#line 1910 "<stdout>"
 
 #define INITIAL 0
 #define quotedstring 1
@@ -2064,7 +2095,7 @@ YY_DECL
     
 #line 197 "./util/configlexer.lex"
 
-#line 2066 "<stdout>"
+#line 2097 "<stdout>"
 
 	if ( !(yy_init) )
 		{
@@ -2123,13 +2154,13 @@ yy_match:
 			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 				{
 				yy_current_state = (int) yy_def[yy_current_state];
-				if ( yy_current_state >= 1611 )
+				if ( yy_current_state >= 1655 )
 					yy_c = yy_meta[(unsigned int) yy_c];
 				}
 			yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
 			++yy_cp;
 			}
-		while ( yy_base[yy_current_state] != 3201 );
+		while ( yy_base[yy_current_state] != 3281 );
 
 yy_find_action:
 		yy_act = yy_accept[yy_current_state];
@@ -2299,610 +2330,630 @@ YY_RULE_SETUP
 case 29:
 YY_RULE_SETUP
 #line 229 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CHROOT) }
+{ YDVAR(1, VAR_IP_TRANSPARENT) }
 	YY_BREAK
 case 30:
 YY_RULE_SETUP
 #line 230 "./util/configlexer.lex"
-{ YDVAR(1, VAR_USERNAME) }
+{ YDVAR(1, VAR_CHROOT) }
 	YY_BREAK
 case 31:
 YY_RULE_SETUP
 #line 231 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DIRECTORY) }
+{ YDVAR(1, VAR_USERNAME) }
 	YY_BREAK
 case 32:
 YY_RULE_SETUP
 #line 232 "./util/configlexer.lex"
-{ YDVAR(1, VAR_LOGFILE) }
+{ YDVAR(1, VAR_DIRECTORY) }
 	YY_BREAK
 case 33:
 YY_RULE_SETUP
 #line 233 "./util/configlexer.lex"
-{ YDVAR(1, VAR_PIDFILE) }
+{ YDVAR(1, VAR_LOGFILE) }
 	YY_BREAK
 case 34:
 YY_RULE_SETUP
 #line 234 "./util/configlexer.lex"
-{ YDVAR(1, VAR_ROOT_HINTS) }
+{ YDVAR(1, VAR_PIDFILE) }
 	YY_BREAK
 case 35:
 YY_RULE_SETUP
 #line 235 "./util/configlexer.lex"
-{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
+{ YDVAR(1, VAR_ROOT_HINTS) }
 	YY_BREAK
 case 36:
 YY_RULE_SETUP
 #line 236 "./util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_BUFFER_SIZE) }
+{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
 	YY_BREAK
 case 37:
 YY_RULE_SETUP
 #line 237 "./util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_CACHE_SIZE) }
+{ YDVAR(1, VAR_MSG_BUFFER_SIZE) }
 	YY_BREAK
 case 38:
 YY_RULE_SETUP
 #line 238 "./util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_CACHE_SLABS) }
+{ YDVAR(1, VAR_MSG_CACHE_SIZE) }
 	YY_BREAK
 case 39:
 YY_RULE_SETUP
 #line 239 "./util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_CACHE_SIZE) }
+{ YDVAR(1, VAR_MSG_CACHE_SLABS) }
 	YY_BREAK
 case 40:
 YY_RULE_SETUP
 #line 240 "./util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_CACHE_SLABS) }
+{ YDVAR(1, VAR_RRSET_CACHE_SIZE) }
 	YY_BREAK
 case 41:
 YY_RULE_SETUP
 #line 241 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MAX_TTL) }
+{ YDVAR(1, VAR_RRSET_CACHE_SLABS) }
 	YY_BREAK
 case 42:
 YY_RULE_SETUP
 #line 242 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MIN_TTL) }
+{ YDVAR(1, VAR_CACHE_MAX_TTL) }
 	YY_BREAK
 case 43:
 YY_RULE_SETUP
 #line 243 "./util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_HOST_TTL) }
+{ YDVAR(1, VAR_CACHE_MIN_TTL) }
 	YY_BREAK
 case 44:
 YY_RULE_SETUP
 #line 244 "./util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_LAME_TTL) }
+{ YDVAR(1, VAR_INFRA_HOST_TTL) }
 	YY_BREAK
 case 45:
 YY_RULE_SETUP
 #line 245 "./util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
+{ YDVAR(1, VAR_INFRA_LAME_TTL) }
 	YY_BREAK
 case 46:
 YY_RULE_SETUP
 #line 246 "./util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
+{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
 	YY_BREAK
 case 47:
 YY_RULE_SETUP
 #line 247 "./util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
+{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
 	YY_BREAK
 case 48:
 YY_RULE_SETUP
 #line 248 "./util/configlexer.lex"
-{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
+{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
 	YY_BREAK
 case 49:
 YY_RULE_SETUP
 #line 249 "./util/configlexer.lex"
-{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
+{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
 	YY_BREAK
 case 50:
 YY_RULE_SETUP
 #line 250 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DELAY_CLOSE) }
+{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
 	YY_BREAK
 case 51:
 YY_RULE_SETUP
 #line 251 "./util/configlexer.lex"
-{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
+{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
 	YY_BREAK
 case 52:
 YY_RULE_SETUP
 #line 252 "./util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
+{ YDVAR(1, VAR_DELAY_CLOSE) }
 	YY_BREAK
 case 53:
 YY_RULE_SETUP
 #line 253 "./util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
+{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
 	YY_BREAK
 case 54:
 YY_RULE_SETUP
 #line 254 "./util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_GLUE) }
+{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
 	YY_BREAK
 case 55:
 YY_RULE_SETUP
 #line 255 "./util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
+{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
 	YY_BREAK
 case 56:
 YY_RULE_SETUP
 #line 256 "./util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
+{ YDVAR(1, VAR_HARDEN_GLUE) }
 	YY_BREAK
 case 57:
 YY_RULE_SETUP
 #line 257 "./util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
 	YY_BREAK
 case 58:
 YY_RULE_SETUP
 #line 258 "./util/configlexer.lex"
-{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 	YY_BREAK
 case 59:
 YY_RULE_SETUP
 #line 259 "./util/configlexer.lex"
-{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
+{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
 	YY_BREAK
 case 60:
 YY_RULE_SETUP
 #line 260 "./util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
+{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 	YY_BREAK
 case 61:
 YY_RULE_SETUP
 #line 261 "./util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
+{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 	YY_BREAK
 case 62:
 YY_RULE_SETUP
 #line 262 "./util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH_KEY) }
+{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 	YY_BREAK
 case 63:
 YY_RULE_SETUP
 #line 263 "./util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH) }
+{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
 	YY_BREAK
 case 64:
 YY_RULE_SETUP
 #line 264 "./util/configlexer.lex"
-{ YDVAR(0, VAR_STUB_ZONE) }
+{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 	YY_BREAK
 case 65:
 YY_RULE_SETUP
 #line 265 "./util/configlexer.lex"
-{ YDVAR(1, VAR_NAME) }
+{ YDVAR(1, VAR_PREFETCH_KEY) }
 	YY_BREAK
 case 66:
 YY_RULE_SETUP
 #line 266 "./util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_ADDR) }
+{ YDVAR(1, VAR_PREFETCH) }
 	YY_BREAK
 case 67:
 YY_RULE_SETUP
 #line 267 "./util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_HOST) }
+{ YDVAR(0, VAR_STUB_ZONE) }
 	YY_BREAK
 case 68:
 YY_RULE_SETUP
 #line 268 "./util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_PRIME) }
+{ YDVAR(1, VAR_NAME) }
 	YY_BREAK
 case 69:
 YY_RULE_SETUP
 #line 269 "./util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_FIRST) }
+{ YDVAR(1, VAR_STUB_ADDR) }
 	YY_BREAK
 case 70:
 YY_RULE_SETUP
 #line 270 "./util/configlexer.lex"
-{ YDVAR(0, VAR_FORWARD_ZONE) }
+{ YDVAR(1, VAR_STUB_HOST) }
 	YY_BREAK
 case 71:
 YY_RULE_SETUP
 #line 271 "./util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_ADDR) }
+{ YDVAR(1, VAR_STUB_PRIME) }
 	YY_BREAK
 case 72:
 YY_RULE_SETUP
 #line 272 "./util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_HOST) }
+{ YDVAR(1, VAR_STUB_FIRST) }
 	YY_BREAK
 case 73:
 YY_RULE_SETUP
 #line 273 "./util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_FIRST) }
+{ YDVAR(0, VAR_FORWARD_ZONE) }
 	YY_BREAK
 case 74:
 YY_RULE_SETUP
 #line 274 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
+{ YDVAR(1, VAR_FORWARD_ADDR) }
 	YY_BREAK
 case 75:
 YY_RULE_SETUP
 #line 275 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
+{ YDVAR(1, VAR_FORWARD_HOST) }
 	YY_BREAK
 case 76:
 YY_RULE_SETUP
 #line 276 "./util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL) }
+{ YDVAR(1, VAR_FORWARD_FIRST) }
 	YY_BREAK
 case 77:
 YY_RULE_SETUP
 #line 277 "./util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_IDENTITY) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
 	YY_BREAK
 case 78:
 YY_RULE_SETUP
 #line 278 "./util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_VERSION) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
 	YY_BREAK
 case 79:
 YY_RULE_SETUP
 #line 279 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IDENTITY) }
+{ YDVAR(2, VAR_ACCESS_CONTROL) }
 	YY_BREAK
 case 80:
 YY_RULE_SETUP
 #line 280 "./util/configlexer.lex"
-{ YDVAR(1, VAR_VERSION) }
+{ YDVAR(1, VAR_HIDE_IDENTITY) }
 	YY_BREAK
 case 81:
 YY_RULE_SETUP
 #line 281 "./util/configlexer.lex"
-{ YDVAR(1, VAR_MODULE_CONF) }
+{ YDVAR(1, VAR_HIDE_VERSION) }
 	YY_BREAK
 case 82:
 YY_RULE_SETUP
 #line 282 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR) }
+{ YDVAR(1, VAR_IDENTITY) }
 	YY_BREAK
 case 83:
 YY_RULE_SETUP
 #line 283 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
+{ YDVAR(1, VAR_VERSION) }
 	YY_BREAK
 case 84:
 YY_RULE_SETUP
 #line 284 "./util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_MODULE_CONF) }
 	YY_BREAK
 case 85:
 YY_RULE_SETUP
 #line 285 "./util/configlexer.lex"
-{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_DLV_ANCHOR) }
 	YY_BREAK
 case 86:
 YY_RULE_SETUP
 #line 286 "./util/configlexer.lex"
-{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
+{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
 	YY_BREAK
 case 87:
 YY_RULE_SETUP
 #line 287 "./util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR) }
+{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 88:
 YY_RULE_SETUP
 #line 288 "./util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
+{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 89:
 YY_RULE_SETUP
 #line 289 "./util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
+{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
 	YY_BREAK
 case 90:
 YY_RULE_SETUP
 #line 290 "./util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
+{ YDVAR(1, VAR_TRUST_ANCHOR) }
 	YY_BREAK
 case 91:
 YY_RULE_SETUP
 #line 291 "./util/configlexer.lex"
-{ YDVAR(1, VAR_BOGUS_TTL) }
+{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
 	YY_BREAK
 case 92:
 YY_RULE_SETUP
 #line 292 "./util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
 	YY_BREAK
 case 93:
 YY_RULE_SETUP
 #line 293 "./util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 	YY_BREAK
 case 94:
 YY_RULE_SETUP
 #line 294 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
+{ YDVAR(1, VAR_BOGUS_TTL) }
 	YY_BREAK
 case 95:
 YY_RULE_SETUP
 #line 295 "./util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
+{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 	YY_BREAK
 case 96:
 YY_RULE_SETUP
 #line 296 "./util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
+{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
 	YY_BREAK
 case 97:
 YY_RULE_SETUP
 #line 297 "./util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
+{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
 	YY_BREAK
 case 98:
 YY_RULE_SETUP
 #line 298 "./util/configlexer.lex"
-{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
+{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 	YY_BREAK
 case 99:
 YY_RULE_SETUP
 #line 299 "./util/configlexer.lex"
-{ 
-				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
+{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 	YY_BREAK
 case 100:
 YY_RULE_SETUP
-#line 301 "./util/configlexer.lex"
-{ YDVAR(1, VAR_ADD_HOLDDOWN) }
+#line 300 "./util/configlexer.lex"
+{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 	YY_BREAK
 case 101:
 YY_RULE_SETUP
-#line 302 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DEL_HOLDDOWN) }
+#line 301 "./util/configlexer.lex"
+{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
 	YY_BREAK
 case 102:
 YY_RULE_SETUP
-#line 303 "./util/configlexer.lex"
-{ YDVAR(1, VAR_KEEP_MISSING) }
+#line 302 "./util/configlexer.lex"
+{ 
+				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 	YY_BREAK
 case 103:
 YY_RULE_SETUP
 #line 304 "./util/configlexer.lex"
-{ YDVAR(1, VAR_USE_SYSLOG) }
+{ YDVAR(1, VAR_ADD_HOLDDOWN) }
 	YY_BREAK
 case 104:
 YY_RULE_SETUP
 #line 305 "./util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_TIME_ASCII) }
+{ YDVAR(1, VAR_DEL_HOLDDOWN) }
 	YY_BREAK
 case 105:
 YY_RULE_SETUP
 #line 306 "./util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_QUERIES) }
+{ YDVAR(1, VAR_KEEP_MISSING) }
 	YY_BREAK
 case 106:
 YY_RULE_SETUP
 #line 307 "./util/configlexer.lex"
-{ YDVAR(2, VAR_LOCAL_ZONE) }
+{ YDVAR(1, VAR_USE_SYSLOG) }
 	YY_BREAK
 case 107:
 YY_RULE_SETUP
 #line 308 "./util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA) }
+{ YDVAR(1, VAR_LOG_TIME_ASCII) }
 	YY_BREAK
 case 108:
 YY_RULE_SETUP
 #line 309 "./util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
+{ YDVAR(1, VAR_LOG_QUERIES) }
 	YY_BREAK
 case 109:
 YY_RULE_SETUP
 #line 310 "./util/configlexer.lex"
-{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
+{ YDVAR(2, VAR_LOCAL_ZONE) }
 	YY_BREAK
 case 110:
 YY_RULE_SETUP
 #line 311 "./util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
+{ YDVAR(1, VAR_LOCAL_DATA) }
 	YY_BREAK
 case 111:
 YY_RULE_SETUP
 #line 312 "./util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
+{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
 	YY_BREAK
 case 112:
 YY_RULE_SETUP
 #line 313 "./util/configlexer.lex"
-{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
+{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
 	YY_BREAK
 case 113:
 YY_RULE_SETUP
 #line 314 "./util/configlexer.lex"
-{ YDVAR(0, VAR_REMOTE_CONTROL) }
+{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
 	YY_BREAK
 case 114:
 YY_RULE_SETUP
 #line 315 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_ENABLE) }
+{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
 	YY_BREAK
 case 115:
 YY_RULE_SETUP
 #line 316 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_INTERFACE) }
+{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
 	YY_BREAK
 case 116:
 YY_RULE_SETUP
 #line 317 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_PORT) }
+{ YDVAR(0, VAR_REMOTE_CONTROL) }
 	YY_BREAK
 case 117:
 YY_RULE_SETUP
 #line 318 "./util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_KEY_FILE) }
+{ YDVAR(1, VAR_CONTROL_ENABLE) }
 	YY_BREAK
 case 118:
 YY_RULE_SETUP
 #line 319 "./util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_CERT_FILE) }
+{ YDVAR(1, VAR_CONTROL_INTERFACE) }
 	YY_BREAK
 case 119:
 YY_RULE_SETUP
 #line 320 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
+{ YDVAR(1, VAR_CONTROL_PORT) }
 	YY_BREAK
 case 120:
 YY_RULE_SETUP
 #line 321 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
+{ YDVAR(1, VAR_CONTROL_USE_CERT) }
 	YY_BREAK
 case 121:
 YY_RULE_SETUP
 #line 322 "./util/configlexer.lex"
-{ YDVAR(1, VAR_PYTHON_SCRIPT) }
+{ YDVAR(1, VAR_SERVER_KEY_FILE) }
 	YY_BREAK
 case 122:
 YY_RULE_SETUP
 #line 323 "./util/configlexer.lex"
-{ YDVAR(0, VAR_PYTHON) }
+{ YDVAR(1, VAR_SERVER_CERT_FILE) }
 	YY_BREAK
 case 123:
 YY_RULE_SETUP
 #line 324 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DOMAIN_INSECURE) }
+{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
 	YY_BREAK
 case 124:
 YY_RULE_SETUP
 #line 325 "./util/configlexer.lex"
-{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
+{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
 	YY_BREAK
 case 125:
 YY_RULE_SETUP
 #line 326 "./util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
+{ YDVAR(1, VAR_PYTHON_SCRIPT) }
 	YY_BREAK
 case 126:
 YY_RULE_SETUP
 #line 327 "./util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_UDP_SIZE) }
+{ YDVAR(0, VAR_PYTHON) }
 	YY_BREAK
 case 127:
 YY_RULE_SETUP
 #line 328 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_PREFIX) }
+{ YDVAR(1, VAR_DOMAIN_INSECURE) }
 	YY_BREAK
 case 128:
 YY_RULE_SETUP
 #line 329 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_SYNTHALL) }
+{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
 	YY_BREAK
 case 129:
 YY_RULE_SETUP
 #line 330 "./util/configlexer.lex"
-{ YDVAR(0, VAR_DNSTAP) }
+{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
 	YY_BREAK
 case 130:
 YY_RULE_SETUP
 #line 331 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_ENABLE) }
+{ YDVAR(1, VAR_MAX_UDP_SIZE) }
 	YY_BREAK
 case 131:
 YY_RULE_SETUP
 #line 332 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
+{ YDVAR(1, VAR_DNS64_PREFIX) }
 	YY_BREAK
 case 132:
 YY_RULE_SETUP
 #line 333 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
+{ YDVAR(1, VAR_DNS64_SYNTHALL) }
 	YY_BREAK
 case 133:
 YY_RULE_SETUP
 #line 334 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
+{ YDVAR(0, VAR_DNSTAP) }
 	YY_BREAK
 case 134:
 YY_RULE_SETUP
 #line 335 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
+{ YDVAR(1, VAR_DNSTAP_ENABLE) }
 	YY_BREAK
 case 135:
 YY_RULE_SETUP
 #line 336 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_VERSION) }
+{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
 	YY_BREAK
 case 136:
 YY_RULE_SETUP
 #line 337 "./util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
+{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
 	YY_BREAK
 case 137:
 YY_RULE_SETUP
-#line 339 "./util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
+#line 338 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
 	YY_BREAK
 case 138:
 YY_RULE_SETUP
-#line 341 "./util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
+#line 339 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
 	YY_BREAK
 case 139:
 YY_RULE_SETUP
-#line 343 "./util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+#line 340 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_VERSION) }
 	YY_BREAK
 case 140:
 YY_RULE_SETUP
-#line 345 "./util/configlexer.lex"
+#line 341 "./util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
 	YY_BREAK
 case 141:
 YY_RULE_SETUP
+#line 343 "./util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
+	YY_BREAK
+case 142:
+YY_RULE_SETUP
+#line 345 "./util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
+	YY_BREAK
+case 143:
+YY_RULE_SETUP
 #line 347 "./util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+	YY_BREAK
+case 144:
+YY_RULE_SETUP
+#line 349 "./util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+	YY_BREAK
+case 145:
+YY_RULE_SETUP
+#line 351 "./util/configlexer.lex"
 {
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
 	YY_BREAK
-case 142:
-/* rule 142 can match eol */
+case 146:
+/* rule 146 can match eol */
 YY_RULE_SETUP
-#line 349 "./util/configlexer.lex"
+#line 353 "./util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++; }
 	YY_BREAK
 /* Quoted strings. Strip leading and ending quotes */
-case 143:
+case 147:
 YY_RULE_SETUP
-#line 352 "./util/configlexer.lex"
+#line 356 "./util/configlexer.lex"
 { BEGIN(quotedstring); LEXOUT(("QS ")); }
 	YY_BREAK
 case YY_STATE_EOF(quotedstring):
-#line 353 "./util/configlexer.lex"
+#line 357 "./util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 144:
+case 148:
 YY_RULE_SETUP
-#line 358 "./util/configlexer.lex"
+#line 362 "./util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 145:
-/* rule 145 can match eol */
+case 149:
+/* rule 149 can match eol */
 YY_RULE_SETUP
-#line 359 "./util/configlexer.lex"
+#line 363 "./util/configlexer.lex"
 { yyerror("newline inside quoted string, no end \""); 
 			  cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 146:
+case 150:
 YY_RULE_SETUP
-#line 361 "./util/configlexer.lex"
+#line 365 "./util/configlexer.lex"
 {
         LEXOUT(("QE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -2915,34 +2966,34 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* Single Quoted strings. Strip leading and ending quotes */
-case 147:
+case 151:
 YY_RULE_SETUP
-#line 373 "./util/configlexer.lex"
+#line 377 "./util/configlexer.lex"
 { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
 	YY_BREAK
 case YY_STATE_EOF(singlequotedstr):
-#line 374 "./util/configlexer.lex"
+#line 378 "./util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 148:
+case 152:
 YY_RULE_SETUP
-#line 379 "./util/configlexer.lex"
+#line 383 "./util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 149:
-/* rule 149 can match eol */
+case 153:
+/* rule 153 can match eol */
 YY_RULE_SETUP
-#line 380 "./util/configlexer.lex"
+#line 384 "./util/configlexer.lex"
 { yyerror("newline inside quoted string, no end '"); 
 			     cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 150:
+case 154:
 YY_RULE_SETUP
-#line 382 "./util/configlexer.lex"
+#line 386 "./util/configlexer.lex"
 {
         LEXOUT(("SQE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -2955,38 +3006,38 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* include: directive */
-case 151:
+case 155:
 YY_RULE_SETUP
-#line 394 "./util/configlexer.lex"
+#line 398 "./util/configlexer.lex"
 { 
 	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
 	YY_BREAK
 case YY_STATE_EOF(include):
-#line 396 "./util/configlexer.lex"
+#line 400 "./util/configlexer.lex"
 {
         yyerror("EOF inside include directive");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 152:
+case 156:
 YY_RULE_SETUP
-#line 400 "./util/configlexer.lex"
+#line 404 "./util/configlexer.lex"
 { LEXOUT(("ISP ")); /* ignore */ }
 	YY_BREAK
-case 153:
-/* rule 153 can match eol */
+case 157:
+/* rule 157 can match eol */
 YY_RULE_SETUP
-#line 401 "./util/configlexer.lex"
+#line 405 "./util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++;}
 	YY_BREAK
-case 154:
+case 158:
 YY_RULE_SETUP
-#line 402 "./util/configlexer.lex"
+#line 406 "./util/configlexer.lex"
 { LEXOUT(("IQS ")); BEGIN(include_quoted); }
 	YY_BREAK
-case 155:
+case 159:
 YY_RULE_SETUP
-#line 403 "./util/configlexer.lex"
+#line 407 "./util/configlexer.lex"
 {
 	LEXOUT(("Iunquotedstr(%s) ", yytext));
 	config_start_include_glob(yytext);
@@ -2994,27 +3045,27 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 case YY_STATE_EOF(include_quoted):
-#line 408 "./util/configlexer.lex"
+#line 412 "./util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 156:
+case 160:
 YY_RULE_SETUP
-#line 412 "./util/configlexer.lex"
+#line 416 "./util/configlexer.lex"
 { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 157:
-/* rule 157 can match eol */
+case 161:
+/* rule 161 can match eol */
 YY_RULE_SETUP
-#line 413 "./util/configlexer.lex"
+#line 417 "./util/configlexer.lex"
 { yyerror("newline before \" in include name"); 
 				  cfg_parser->line++; BEGIN(inc_prev); }
 	YY_BREAK
-case 158:
+case 162:
 YY_RULE_SETUP
-#line 415 "./util/configlexer.lex"
+#line 419 "./util/configlexer.lex"
 {
 	LEXOUT(("IQE "));
 	yytext[yyleng - 1] = '\0';
@@ -3024,7 +3075,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case YY_STATE_EOF(INITIAL):
 case YY_STATE_EOF(val):
-#line 421 "./util/configlexer.lex"
+#line 425 "./util/configlexer.lex"
 {
 	LEXOUT(("LEXEOF "));
 	yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
@@ -3036,33 +3087,33 @@ case YY_STATE_EOF(val):
 	}
 }
 	YY_BREAK
-case 159:
+case 163:
 YY_RULE_SETUP
-#line 432 "./util/configlexer.lex"
+#line 436 "./util/configlexer.lex"
 { LEXOUT(("unquotedstr(%s) ", yytext)); 
 			if(--num_args == 0) { BEGIN(INITIAL); }
 			yylval.str = strdup(yytext); return STRING_ARG; }
 	YY_BREAK
-case 160:
+case 164:
 YY_RULE_SETUP
-#line 436 "./util/configlexer.lex"
+#line 440 "./util/configlexer.lex"
 {
 	ub_c_error_msg("unknown keyword '%s'", yytext);
 	}
 	YY_BREAK
-case 161:
+case 165:
 YY_RULE_SETUP
-#line 440 "./util/configlexer.lex"
+#line 444 "./util/configlexer.lex"
 {
 	ub_c_error_msg("stray '%s'", yytext);
 	}
 	YY_BREAK
-case 162:
+case 166:
 YY_RULE_SETUP
-#line 444 "./util/configlexer.lex"
+#line 448 "./util/configlexer.lex"
 ECHO;
 	YY_BREAK
-#line 3064 "<stdout>"
+#line 3115 "<stdout>"
 
 	case YY_END_OF_BUFFER:
 		{
@@ -3352,7 +3403,7 @@ static int yy_get_next_buffer (void)
 		while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 			{
 			yy_current_state = (int) yy_def[yy_current_state];
-			if ( yy_current_state >= 1611 )
+			if ( yy_current_state >= 1655 )
 				yy_c = yy_meta[(unsigned int) yy_c];
 			}
 		yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
@@ -3380,11 +3431,11 @@ static int yy_get_next_buffer (void)
 	while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 		{
 		yy_current_state = (int) yy_def[yy_current_state];
-		if ( yy_current_state >= 1611 )
+		if ( yy_current_state >= 1655 )
 			yy_c = yy_meta[(unsigned int) yy_c];
 		}
 	yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
-	yy_is_jam = (yy_current_state == 1610);
+	yy_is_jam = (yy_current_state == 1654);
 
 		return yy_is_jam ? 0 : yy_current_state;
 }
@@ -4017,7 +4068,7 @@ void yyfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 444 "./util/configlexer.lex"
+#line 448 "./util/configlexer.lex"
 
 
 
diff --git a/external/unbound/util/configlexer.lex b/external/unbound/util/configlexer.lex
index 7ee7b9bd..5b1389df 100644
--- a/external/unbound/util/configlexer.lex
+++ b/external/unbound/util/configlexer.lex
@@ -226,6 +226,7 @@ interface-automatic{COLON}	{ YDVAR(1, VAR_INTERFACE_AUTOMATIC) }
 so-rcvbuf{COLON}		{ YDVAR(1, VAR_SO_RCVBUF) }
 so-sndbuf{COLON}		{ YDVAR(1, VAR_SO_SNDBUF) }
 so-reuseport{COLON}		{ YDVAR(1, VAR_SO_REUSEPORT) }
+ip-transparent{COLON}		{ YDVAR(1, VAR_IP_TRANSPARENT) }
 chroot{COLON}			{ YDVAR(1, VAR_CHROOT) }
 username{COLON}			{ YDVAR(1, VAR_USERNAME) }
 directory{COLON}		{ YDVAR(1, VAR_DIRECTORY) }
@@ -245,6 +246,7 @@ infra-lame-ttl{COLON}		{ YDVAR(1, VAR_INFRA_LAME_TTL) }
 infra-cache-slabs{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
 infra-cache-numhosts{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
 infra-cache-lame-size{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
+infra-cache-min-rtt{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
 num-queries-per-thread{COLON}	{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
 jostle-timeout{COLON}		{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
 delay-close{COLON}		{ YDVAR(1, VAR_DELAY_CLOSE) }
@@ -255,6 +257,7 @@ harden-glue{COLON}		{ YDVAR(1, VAR_HARDEN_GLUE) }
 harden-dnssec-stripped{COLON}	{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
 harden-below-nxdomain{COLON}	{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+harden-algo-downgrade{COLON}	{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
@@ -315,6 +318,7 @@ remote-control{COLON}		{ YDVAR(0, VAR_REMOTE_CONTROL) }
 control-enable{COLON}		{ YDVAR(1, VAR_CONTROL_ENABLE) }
 control-interface{COLON}	{ YDVAR(1, VAR_CONTROL_INTERFACE) }
 control-port{COLON}		{ YDVAR(1, VAR_CONTROL_PORT) }
+control-use-cert{COLON}		{ YDVAR(1, VAR_CONTROL_USE_CERT) }
 server-key-file{COLON}		{ YDVAR(1, VAR_SERVER_KEY_FILE) }
 server-cert-file{COLON}		{ YDVAR(1, VAR_SERVER_CERT_FILE) }
 control-key-file{COLON}		{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
diff --git a/external/unbound/util/configparser.c b/external/unbound/util/configparser.c
index 6285e3f6..745a9ba7 100644
--- a/external/unbound/util/configparser.c
+++ b/external/unbound/util/configparser.c
@@ -220,59 +220,63 @@ extern int yydebug;
      VAR_SERVER_CERT_FILE = 348,
      VAR_CONTROL_KEY_FILE = 349,
      VAR_CONTROL_CERT_FILE = 350,
-     VAR_EXTENDED_STATISTICS = 351,
-     VAR_LOCAL_DATA_PTR = 352,
-     VAR_JOSTLE_TIMEOUT = 353,
-     VAR_STUB_PRIME = 354,
-     VAR_UNWANTED_REPLY_THRESHOLD = 355,
-     VAR_LOG_TIME_ASCII = 356,
-     VAR_DOMAIN_INSECURE = 357,
-     VAR_PYTHON = 358,
-     VAR_PYTHON_SCRIPT = 359,
-     VAR_VAL_SIG_SKEW_MIN = 360,
-     VAR_VAL_SIG_SKEW_MAX = 361,
-     VAR_CACHE_MIN_TTL = 362,
-     VAR_VAL_LOG_LEVEL = 363,
-     VAR_AUTO_TRUST_ANCHOR_FILE = 364,
-     VAR_KEEP_MISSING = 365,
-     VAR_ADD_HOLDDOWN = 366,
-     VAR_DEL_HOLDDOWN = 367,
-     VAR_SO_RCVBUF = 368,
-     VAR_EDNS_BUFFER_SIZE = 369,
-     VAR_PREFETCH = 370,
-     VAR_PREFETCH_KEY = 371,
-     VAR_SO_SNDBUF = 372,
-     VAR_SO_REUSEPORT = 373,
-     VAR_HARDEN_BELOW_NXDOMAIN = 374,
-     VAR_IGNORE_CD_FLAG = 375,
-     VAR_LOG_QUERIES = 376,
-     VAR_TCP_UPSTREAM = 377,
-     VAR_SSL_UPSTREAM = 378,
-     VAR_SSL_SERVICE_KEY = 379,
-     VAR_SSL_SERVICE_PEM = 380,
-     VAR_SSL_PORT = 381,
-     VAR_FORWARD_FIRST = 382,
-     VAR_STUB_FIRST = 383,
-     VAR_MINIMAL_RESPONSES = 384,
-     VAR_RRSET_ROUNDROBIN = 385,
-     VAR_MAX_UDP_SIZE = 386,
-     VAR_DELAY_CLOSE = 387,
-     VAR_UNBLOCK_LAN_ZONES = 388,
-     VAR_DNS64_PREFIX = 389,
-     VAR_DNS64_SYNTHALL = 390,
-     VAR_DNSTAP = 391,
-     VAR_DNSTAP_ENABLE = 392,
-     VAR_DNSTAP_SOCKET_PATH = 393,
-     VAR_DNSTAP_SEND_IDENTITY = 394,
-     VAR_DNSTAP_SEND_VERSION = 395,
-     VAR_DNSTAP_IDENTITY = 396,
-     VAR_DNSTAP_VERSION = 397,
-     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 398,
-     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 399,
-     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 400,
-     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 401,
-     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 402,
-     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 403
+     VAR_CONTROL_USE_CERT = 351,
+     VAR_EXTENDED_STATISTICS = 352,
+     VAR_LOCAL_DATA_PTR = 353,
+     VAR_JOSTLE_TIMEOUT = 354,
+     VAR_STUB_PRIME = 355,
+     VAR_UNWANTED_REPLY_THRESHOLD = 356,
+     VAR_LOG_TIME_ASCII = 357,
+     VAR_DOMAIN_INSECURE = 358,
+     VAR_PYTHON = 359,
+     VAR_PYTHON_SCRIPT = 360,
+     VAR_VAL_SIG_SKEW_MIN = 361,
+     VAR_VAL_SIG_SKEW_MAX = 362,
+     VAR_CACHE_MIN_TTL = 363,
+     VAR_VAL_LOG_LEVEL = 364,
+     VAR_AUTO_TRUST_ANCHOR_FILE = 365,
+     VAR_KEEP_MISSING = 366,
+     VAR_ADD_HOLDDOWN = 367,
+     VAR_DEL_HOLDDOWN = 368,
+     VAR_SO_RCVBUF = 369,
+     VAR_EDNS_BUFFER_SIZE = 370,
+     VAR_PREFETCH = 371,
+     VAR_PREFETCH_KEY = 372,
+     VAR_SO_SNDBUF = 373,
+     VAR_SO_REUSEPORT = 374,
+     VAR_HARDEN_BELOW_NXDOMAIN = 375,
+     VAR_IGNORE_CD_FLAG = 376,
+     VAR_LOG_QUERIES = 377,
+     VAR_TCP_UPSTREAM = 378,
+     VAR_SSL_UPSTREAM = 379,
+     VAR_SSL_SERVICE_KEY = 380,
+     VAR_SSL_SERVICE_PEM = 381,
+     VAR_SSL_PORT = 382,
+     VAR_FORWARD_FIRST = 383,
+     VAR_STUB_FIRST = 384,
+     VAR_MINIMAL_RESPONSES = 385,
+     VAR_RRSET_ROUNDROBIN = 386,
+     VAR_MAX_UDP_SIZE = 387,
+     VAR_DELAY_CLOSE = 388,
+     VAR_UNBLOCK_LAN_ZONES = 389,
+     VAR_INFRA_CACHE_MIN_RTT = 390,
+     VAR_DNS64_PREFIX = 391,
+     VAR_DNS64_SYNTHALL = 392,
+     VAR_DNSTAP = 393,
+     VAR_DNSTAP_ENABLE = 394,
+     VAR_DNSTAP_SOCKET_PATH = 395,
+     VAR_DNSTAP_SEND_IDENTITY = 396,
+     VAR_DNSTAP_SEND_VERSION = 397,
+     VAR_DNSTAP_IDENTITY = 398,
+     VAR_DNSTAP_VERSION = 399,
+     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 400,
+     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 401,
+     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 402,
+     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 403,
+     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 404,
+     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405,
+     VAR_HARDEN_ALGO_DOWNGRADE = 406,
+     VAR_IP_TRANSPARENT = 407
    };
 #endif
 /* Tokens.  */
@@ -369,59 +373,63 @@ extern int yydebug;
 #define VAR_SERVER_CERT_FILE 348
 #define VAR_CONTROL_KEY_FILE 349
 #define VAR_CONTROL_CERT_FILE 350
-#define VAR_EXTENDED_STATISTICS 351
-#define VAR_LOCAL_DATA_PTR 352
-#define VAR_JOSTLE_TIMEOUT 353
-#define VAR_STUB_PRIME 354
-#define VAR_UNWANTED_REPLY_THRESHOLD 355
-#define VAR_LOG_TIME_ASCII 356
-#define VAR_DOMAIN_INSECURE 357
-#define VAR_PYTHON 358
-#define VAR_PYTHON_SCRIPT 359
-#define VAR_VAL_SIG_SKEW_MIN 360
-#define VAR_VAL_SIG_SKEW_MAX 361
-#define VAR_CACHE_MIN_TTL 362
-#define VAR_VAL_LOG_LEVEL 363
-#define VAR_AUTO_TRUST_ANCHOR_FILE 364
-#define VAR_KEEP_MISSING 365
-#define VAR_ADD_HOLDDOWN 366
-#define VAR_DEL_HOLDDOWN 367
-#define VAR_SO_RCVBUF 368
-#define VAR_EDNS_BUFFER_SIZE 369
-#define VAR_PREFETCH 370
-#define VAR_PREFETCH_KEY 371
-#define VAR_SO_SNDBUF 372
-#define VAR_SO_REUSEPORT 373
-#define VAR_HARDEN_BELOW_NXDOMAIN 374
-#define VAR_IGNORE_CD_FLAG 375
-#define VAR_LOG_QUERIES 376
-#define VAR_TCP_UPSTREAM 377
-#define VAR_SSL_UPSTREAM 378
-#define VAR_SSL_SERVICE_KEY 379
-#define VAR_SSL_SERVICE_PEM 380
-#define VAR_SSL_PORT 381
-#define VAR_FORWARD_FIRST 382
-#define VAR_STUB_FIRST 383
-#define VAR_MINIMAL_RESPONSES 384
-#define VAR_RRSET_ROUNDROBIN 385
-#define VAR_MAX_UDP_SIZE 386
-#define VAR_DELAY_CLOSE 387
-#define VAR_UNBLOCK_LAN_ZONES 388
-#define VAR_DNS64_PREFIX 389
-#define VAR_DNS64_SYNTHALL 390
-#define VAR_DNSTAP 391
-#define VAR_DNSTAP_ENABLE 392
-#define VAR_DNSTAP_SOCKET_PATH 393
-#define VAR_DNSTAP_SEND_IDENTITY 394
-#define VAR_DNSTAP_SEND_VERSION 395
-#define VAR_DNSTAP_IDENTITY 396
-#define VAR_DNSTAP_VERSION 397
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 398
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 399
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 400
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 401
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 402
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 403
+#define VAR_CONTROL_USE_CERT 351
+#define VAR_EXTENDED_STATISTICS 352
+#define VAR_LOCAL_DATA_PTR 353
+#define VAR_JOSTLE_TIMEOUT 354
+#define VAR_STUB_PRIME 355
+#define VAR_UNWANTED_REPLY_THRESHOLD 356
+#define VAR_LOG_TIME_ASCII 357
+#define VAR_DOMAIN_INSECURE 358
+#define VAR_PYTHON 359
+#define VAR_PYTHON_SCRIPT 360
+#define VAR_VAL_SIG_SKEW_MIN 361
+#define VAR_VAL_SIG_SKEW_MAX 362
+#define VAR_CACHE_MIN_TTL 363
+#define VAR_VAL_LOG_LEVEL 364
+#define VAR_AUTO_TRUST_ANCHOR_FILE 365
+#define VAR_KEEP_MISSING 366
+#define VAR_ADD_HOLDDOWN 367
+#define VAR_DEL_HOLDDOWN 368
+#define VAR_SO_RCVBUF 369
+#define VAR_EDNS_BUFFER_SIZE 370
+#define VAR_PREFETCH 371
+#define VAR_PREFETCH_KEY 372
+#define VAR_SO_SNDBUF 373
+#define VAR_SO_REUSEPORT 374
+#define VAR_HARDEN_BELOW_NXDOMAIN 375
+#define VAR_IGNORE_CD_FLAG 376
+#define VAR_LOG_QUERIES 377
+#define VAR_TCP_UPSTREAM 378
+#define VAR_SSL_UPSTREAM 379
+#define VAR_SSL_SERVICE_KEY 380
+#define VAR_SSL_SERVICE_PEM 381
+#define VAR_SSL_PORT 382
+#define VAR_FORWARD_FIRST 383
+#define VAR_STUB_FIRST 384
+#define VAR_MINIMAL_RESPONSES 385
+#define VAR_RRSET_ROUNDROBIN 386
+#define VAR_MAX_UDP_SIZE 387
+#define VAR_DELAY_CLOSE 388
+#define VAR_UNBLOCK_LAN_ZONES 389
+#define VAR_INFRA_CACHE_MIN_RTT 390
+#define VAR_DNS64_PREFIX 391
+#define VAR_DNS64_SYNTHALL 392
+#define VAR_DNSTAP 393
+#define VAR_DNSTAP_ENABLE 394
+#define VAR_DNSTAP_SOCKET_PATH 395
+#define VAR_DNSTAP_SEND_IDENTITY 396
+#define VAR_DNSTAP_SEND_VERSION 397
+#define VAR_DNSTAP_IDENTITY 398
+#define VAR_DNSTAP_VERSION 399
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 400
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 401
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 402
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 403
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 404
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 405
+#define VAR_HARDEN_ALGO_DOWNGRADE 406
+#define VAR_IP_TRANSPARENT 407
 
 
 
@@ -435,7 +443,7 @@ typedef union YYSTYPE
 
 
 /* Line 387 of yacc.c  */
-#line 439 "util/configparser.c"
+#line 447 "util/configparser.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -463,7 +471,7 @@ int yyparse ();
 /* Copy the second part of user declarations.  */
 
 /* Line 390 of yacc.c  */
-#line 467 "util/configparser.c"
+#line 475 "util/configparser.c"
 
 #ifdef short
 # undef short
@@ -683,20 +691,20 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  2
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   276
+#define YYLAST   283
 
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  149
+#define YYNTOKENS  153
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  154
+#define YYNNTS  158
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  293
+#define YYNRULES  301
 /* YYNRULES -- Number of states.  */
-#define YYNSTATES  429
+#define YYNSTATES  441
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   403
+#define YYMAXUTOK   407
 
 #define YYTRANSLATE(YYX)						\
   ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
@@ -744,7 +752,7 @@ static const yytype_uint8 yytranslate[] =
      115,   116,   117,   118,   119,   120,   121,   122,   123,   124,
      125,   126,   127,   128,   129,   130,   131,   132,   133,   134,
      135,   136,   137,   138,   139,   140,   141,   142,   143,   144,
-     145,   146,   147,   148
+     145,   146,   147,   148,   149,   150,   151,   152
 };
 
 #if YYDEBUG
@@ -763,138 +771,142 @@ static const yytype_uint16 yyprhs[] =
      165,   167,   169,   171,   173,   175,   177,   179,   181,   183,
      185,   187,   189,   191,   193,   195,   197,   199,   201,   203,
      205,   207,   209,   211,   213,   215,   217,   219,   221,   223,
-     225,   227,   229,   231,   233,   235,   237,   239,   241,   244,
-     245,   247,   249,   251,   253,   255,   257,   260,   261,   263,
-     265,   267,   269,   272,   275,   278,   281,   284,   287,   290,
-     293,   296,   299,   302,   305,   308,   311,   314,   317,   320,
-     323,   326,   329,   332,   335,   338,   341,   344,   347,   350,
-     353,   356,   359,   362,   365,   368,   371,   374,   377,   380,
-     383,   386,   389,   392,   395,   398,   401,   404,   407,   410,
-     413,   416,   419,   422,   425,   428,   431,   434,   437,   440,
-     443,   446,   449,   452,   455,   458,   461,   464,   467,   470,
-     473,   476,   479,   482,   485,   488,   491,   494,   497,   500,
-     504,   507,   510,   513,   516,   519,   522,   525,   528,   531,
-     534,   537,   540,   543,   546,   549,   552,   555,   558,   562,
-     565,   568,   571,   574,   577,   580,   583,   586,   589,   592,
-     595,   598,   601,   604,   607,   610,   612,   615,   616,   618,
-     620,   622,   624,   626,   628,   630,   633,   636,   639,   642,
-     645,   648,   651,   653,   656,   657,   659,   661,   663,   665,
-     667,   669,   671,   673,   675,   677,   679,   681,   684,   687,
-     690,   693,   696,   699,   702,   705,   708,   711,   714,   717,
-     719,   722,   723,   725
+     225,   227,   229,   231,   233,   235,   237,   239,   241,   243,
+     245,   247,   250,   251,   253,   255,   257,   259,   261,   263,
+     266,   267,   269,   271,   273,   275,   278,   281,   284,   287,
+     290,   293,   296,   299,   302,   305,   308,   311,   314,   317,
+     320,   323,   326,   329,   332,   335,   338,   341,   344,   347,
+     350,   353,   356,   359,   362,   365,   368,   371,   374,   377,
+     380,   383,   386,   389,   392,   395,   398,   401,   404,   407,
+     410,   413,   416,   419,   422,   425,   428,   431,   434,   437,
+     440,   443,   446,   449,   452,   455,   458,   461,   464,   467,
+     470,   473,   476,   479,   482,   485,   488,   491,   494,   497,
+     500,   503,   506,   509,   512,   515,   519,   522,   525,   528,
+     531,   534,   537,   540,   543,   546,   549,   552,   555,   558,
+     561,   564,   567,   570,   573,   577,   580,   583,   586,   589,
+     592,   595,   598,   601,   604,   607,   610,   613,   616,   619,
+     622,   625,   627,   630,   631,   633,   635,   637,   639,   641,
+     643,   645,   647,   650,   653,   656,   659,   662,   665,   668,
+     671,   673,   676,   677,   679,   681,   683,   685,   687,   689,
+     691,   693,   695,   697,   699,   701,   704,   707,   710,   713,
+     716,   719,   722,   725,   728,   731,   734,   737,   739,   742,
+     743,   745
 };
 
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int16 yyrhs[] =
 {
-     150,     0,    -1,    -1,   150,   151,    -1,   152,   153,    -1,
-     155,   156,    -1,   158,   159,    -1,   299,   300,    -1,   274,
-     275,    -1,   284,   285,    -1,    11,    -1,   153,   154,    -1,
-      -1,   161,    -1,   162,    -1,   166,    -1,   169,    -1,   175,
-      -1,   176,    -1,   177,    -1,   178,    -1,   167,    -1,   188,
-      -1,   189,    -1,   190,    -1,   191,    -1,   192,    -1,   210,
-      -1,   211,    -1,   212,    -1,   216,    -1,   217,    -1,   172,
-      -1,   218,    -1,   219,    -1,   222,    -1,   220,    -1,   221,
-      -1,   223,    -1,   224,    -1,   225,    -1,   236,    -1,   201,
-      -1,   202,    -1,   203,    -1,   204,    -1,   226,    -1,   239,
-      -1,   197,    -1,   199,    -1,   240,    -1,   245,    -1,   246,
-      -1,   247,    -1,   173,    -1,   209,    -1,   254,    -1,   255,
-      -1,   198,    -1,   250,    -1,   185,    -1,   168,    -1,   193,
-      -1,   237,    -1,   243,    -1,   227,    -1,   238,    -1,   257,
-      -1,   258,    -1,   174,    -1,   163,    -1,   184,    -1,   230,
-      -1,   164,    -1,   170,    -1,   171,    -1,   194,    -1,   195,
-      -1,   256,    -1,   229,    -1,   231,    -1,   232,    -1,   165,
-      -1,   259,    -1,   213,    -1,   235,    -1,   186,    -1,   200,
-      -1,   241,    -1,   242,    -1,   244,    -1,   249,    -1,   196,
-      -1,   251,    -1,   252,    -1,   253,    -1,   205,    -1,   208,
-      -1,   233,    -1,   234,    -1,   206,    -1,   228,    -1,   248,
-      -1,   187,    -1,   179,    -1,   180,    -1,   181,    -1,   182,
-      -1,   183,    -1,   260,    -1,   261,    -1,   262,    -1,   207,
-      -1,   214,    -1,   215,    -1,   263,    -1,   264,    -1,    38,
-      -1,   156,   157,    -1,    -1,   265,    -1,   266,    -1,   267,
-      -1,   269,    -1,   268,    -1,    44,    -1,   159,   160,    -1,
-      -1,   270,    -1,   271,    -1,   272,    -1,   273,    -1,    13,
-      10,    -1,    12,    10,    -1,    76,    10,    -1,    79,    10,
-      -1,    96,    10,    -1,    14,    10,    -1,    16,    10,    -1,
-      67,    10,    -1,    15,    10,    -1,    80,    10,    -1,    81,
-      10,    -1,    31,    10,    -1,    60,    10,    -1,    75,    10,
-      -1,    17,    10,    -1,    18,    10,    -1,    19,    10,    -1,
-      20,    10,    -1,   122,    10,    -1,   123,    10,    -1,   124,
-      10,    -1,   125,    10,    -1,   126,    10,    -1,    77,    10,
-      -1,    66,    10,    -1,   101,    10,    -1,   121,    10,    -1,
-      21,    10,    -1,    22,    10,    -1,    23,    10,    -1,    24,
-      10,    -1,    25,    10,    -1,    68,    10,    -1,    82,    10,
-      -1,    83,    10,    -1,   109,    10,    -1,    54,    10,    -1,
-      64,    10,    -1,    55,    10,    -1,   102,    10,    -1,    48,
-      10,    -1,    49,    10,    -1,    50,    10,    -1,    51,    10,
-      -1,   113,    10,    -1,   117,    10,    -1,   118,    10,    -1,
-     114,    10,    -1,    61,    10,    -1,    26,    10,    -1,    27,
-      10,    -1,    28,    10,    -1,    98,    10,    -1,   132,    10,
-      -1,   133,    10,    -1,    29,    10,    -1,    30,    10,    -1,
-      32,    10,    -1,    33,    10,    -1,    35,    10,    -1,    36,
-      10,    -1,    34,    10,    -1,    41,    10,    -1,    42,    10,
-      -1,    43,    10,    -1,    52,    10,    -1,    71,    10,    -1,
-     119,    10,    -1,    85,    10,    -1,    78,    10,    -1,    86,
-      10,    -1,    87,    10,    -1,   115,    10,    -1,   116,    10,
-      -1,   100,    10,    -1,    47,    10,    -1,    69,    10,    -1,
-      72,    10,    10,    -1,    53,    10,    -1,    56,    10,    -1,
-     105,    10,    -1,   106,    10,    -1,    70,    10,    -1,   107,
-      10,    -1,    57,    10,    -1,    58,    10,    -1,    59,    10,
-      -1,   120,    10,    -1,   108,    10,    -1,    65,    10,    -1,
-     111,    10,    -1,   112,    10,    -1,   110,    10,    -1,    62,
-      10,    -1,    63,    10,    -1,    84,    10,    -1,    73,    10,
-      10,    -1,    74,    10,    -1,    97,    10,    -1,   129,    10,
-      -1,   130,    10,    -1,   131,    10,    -1,   134,    10,    -1,
-     135,    10,    -1,    37,    10,    -1,    39,    10,    -1,    40,
-      10,    -1,   128,    10,    -1,    99,    10,    -1,    37,    10,
-      -1,    45,    10,    -1,    46,    10,    -1,   127,    10,    -1,
-      88,    -1,   275,   276,    -1,    -1,   277,    -1,   279,    -1,
-     278,    -1,   280,    -1,   281,    -1,   282,    -1,   283,    -1,
-      89,    10,    -1,    91,    10,    -1,    90,    10,    -1,    92,
+     154,     0,    -1,    -1,   154,   155,    -1,   156,   157,    -1,
+     159,   160,    -1,   162,   163,    -1,   307,   308,    -1,   281,
+     282,    -1,   292,   293,    -1,    11,    -1,   157,   158,    -1,
+      -1,   165,    -1,   166,    -1,   170,    -1,   173,    -1,   179,
+      -1,   180,    -1,   181,    -1,   182,    -1,   171,    -1,   192,
+      -1,   193,    -1,   194,    -1,   195,    -1,   196,    -1,   215,
+      -1,   216,    -1,   217,    -1,   221,    -1,   222,    -1,   176,
+      -1,   223,    -1,   224,    -1,   227,    -1,   225,    -1,   226,
+      -1,   229,    -1,   230,    -1,   231,    -1,   243,    -1,   205,
+      -1,   206,    -1,   207,    -1,   208,    -1,   232,    -1,   246,
+      -1,   201,    -1,   203,    -1,   247,    -1,   252,    -1,   253,
+      -1,   254,    -1,   177,    -1,   214,    -1,   261,    -1,   262,
+      -1,   202,    -1,   257,    -1,   189,    -1,   172,    -1,   197,
+      -1,   244,    -1,   250,    -1,   233,    -1,   245,    -1,   264,
+      -1,   265,    -1,   178,    -1,   167,    -1,   188,    -1,   237,
+      -1,   168,    -1,   174,    -1,   175,    -1,   198,    -1,   199,
+      -1,   263,    -1,   235,    -1,   238,    -1,   239,    -1,   169,
+      -1,   266,    -1,   218,    -1,   242,    -1,   190,    -1,   204,
+      -1,   248,    -1,   249,    -1,   251,    -1,   256,    -1,   200,
+      -1,   258,    -1,   259,    -1,   260,    -1,   209,    -1,   213,
+      -1,   240,    -1,   241,    -1,   210,    -1,   234,    -1,   255,
+      -1,   191,    -1,   183,    -1,   184,    -1,   185,    -1,   186,
+      -1,   187,    -1,   267,    -1,   268,    -1,   269,    -1,   211,
+      -1,   219,    -1,   220,    -1,   270,    -1,   271,    -1,   228,
+      -1,   236,    -1,   212,    -1,    38,    -1,   160,   161,    -1,
+      -1,   272,    -1,   273,    -1,   274,    -1,   276,    -1,   275,
+      -1,    44,    -1,   163,   164,    -1,    -1,   277,    -1,   278,
+      -1,   279,    -1,   280,    -1,    13,    10,    -1,    12,    10,
+      -1,    76,    10,    -1,    79,    10,    -1,    97,    10,    -1,
+      14,    10,    -1,    16,    10,    -1,    67,    10,    -1,    15,
+      10,    -1,    80,    10,    -1,    81,    10,    -1,    31,    10,
+      -1,    60,    10,    -1,    75,    10,    -1,    17,    10,    -1,
+      18,    10,    -1,    19,    10,    -1,    20,    10,    -1,   123,
+      10,    -1,   124,    10,    -1,   125,    10,    -1,   126,    10,
+      -1,   127,    10,    -1,    77,    10,    -1,    66,    10,    -1,
+     102,    10,    -1,   122,    10,    -1,    21,    10,    -1,    22,
+      10,    -1,    23,    10,    -1,    24,    10,    -1,    25,    10,
+      -1,    68,    10,    -1,    82,    10,    -1,    83,    10,    -1,
+     110,    10,    -1,    54,    10,    -1,    64,    10,    -1,    55,
+      10,    -1,   103,    10,    -1,    48,    10,    -1,    49,    10,
+      -1,    50,    10,    -1,    51,    10,    -1,   114,    10,    -1,
+     118,    10,    -1,   119,    10,    -1,   152,    10,    -1,   115,
+      10,    -1,    61,    10,    -1,    26,    10,    -1,    27,    10,
+      -1,    28,    10,    -1,    99,    10,    -1,   133,    10,    -1,
+     134,    10,    -1,    29,    10,    -1,    30,    10,    -1,    32,
+      10,    -1,    33,    10,    -1,    35,    10,    -1,    36,    10,
+      -1,    34,    10,    -1,   135,    10,    -1,    41,    10,    -1,
+      42,    10,    -1,    43,    10,    -1,    52,    10,    -1,    71,
+      10,    -1,   120,    10,    -1,    85,    10,    -1,   151,    10,
+      -1,    78,    10,    -1,    86,    10,    -1,    87,    10,    -1,
+     116,    10,    -1,   117,    10,    -1,   101,    10,    -1,    47,
+      10,    -1,    69,    10,    -1,    72,    10,    10,    -1,    53,
+      10,    -1,    56,    10,    -1,   106,    10,    -1,   107,    10,
+      -1,    70,    10,    -1,   108,    10,    -1,    57,    10,    -1,
+      58,    10,    -1,    59,    10,    -1,   121,    10,    -1,   109,
+      10,    -1,    65,    10,    -1,   112,    10,    -1,   113,    10,
+      -1,   111,    10,    -1,    62,    10,    -1,    63,    10,    -1,
+      84,    10,    -1,    73,    10,    10,    -1,    74,    10,    -1,
+      98,    10,    -1,   130,    10,    -1,   131,    10,    -1,   132,
+      10,    -1,   136,    10,    -1,   137,    10,    -1,    37,    10,
+      -1,    39,    10,    -1,    40,    10,    -1,   129,    10,    -1,
+     100,    10,    -1,    37,    10,    -1,    45,    10,    -1,    46,
+      10,    -1,   128,    10,    -1,    88,    -1,   282,   283,    -1,
+      -1,   284,    -1,   286,    -1,   285,    -1,   288,    -1,   289,
+      -1,   290,    -1,   291,    -1,   287,    -1,    89,    10,    -1,
+      91,    10,    -1,    90,    10,    -1,    96,    10,    -1,    92,
       10,    -1,    93,    10,    -1,    94,    10,    -1,    95,    10,
-      -1,   136,    -1,   285,   286,    -1,    -1,   287,    -1,   288,
-      -1,   289,    -1,   290,    -1,   291,    -1,   292,    -1,   293,
-      -1,   294,    -1,   295,    -1,   296,    -1,   297,    -1,   298,
-      -1,   137,    10,    -1,   138,    10,    -1,   139,    10,    -1,
-     140,    10,    -1,   141,    10,    -1,   142,    10,    -1,   143,
-      10,    -1,   144,    10,    -1,   145,    10,    -1,   146,    10,
-      -1,   147,    10,    -1,   148,    10,    -1,   103,    -1,   300,
-     301,    -1,    -1,   302,    -1,   104,    10,    -1
+      -1,   138,    -1,   293,   294,    -1,    -1,   295,    -1,   296,
+      -1,   297,    -1,   298,    -1,   299,    -1,   300,    -1,   301,
+      -1,   302,    -1,   303,    -1,   304,    -1,   305,    -1,   306,
+      -1,   139,    10,    -1,   140,    10,    -1,   141,    10,    -1,
+     142,    10,    -1,   143,    10,    -1,   144,    10,    -1,   145,
+      10,    -1,   146,    10,    -1,   147,    10,    -1,   148,    10,
+      -1,   149,    10,    -1,   150,    10,    -1,   104,    -1,   308,
+     309,    -1,    -1,   310,    -1,   105,    10,    -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   121,   121,   121,   122,   122,   123,   123,   124,   124,
-     128,   133,   134,   135,   135,   135,   136,   136,   137,   137,
-     137,   138,   138,   138,   139,   139,   139,   140,   140,   141,
-     141,   142,   142,   143,   143,   144,   144,   145,   145,   146,
-     146,   147,   147,   148,   148,   148,   149,   149,   149,   150,
-     150,   150,   151,   151,   152,   152,   153,   153,   154,   154,
-     155,   155,   155,   156,   156,   157,   157,   158,   158,   158,
-     159,   159,   160,   160,   161,   161,   162,   162,   162,   163,
-     163,   164,   164,   165,   165,   166,   166,   167,   167,   168,
-     168,   168,   169,   169,   170,   170,   170,   171,   171,   171,
-     172,   172,   172,   173,   173,   173,   174,   174,   174,   175,
-     175,   175,   176,   176,   176,   177,   177,   179,   191,   192,
-     193,   193,   193,   193,   193,   195,   207,   208,   209,   209,
-     209,   209,   211,   220,   229,   240,   249,   258,   267,   280,
-     295,   304,   313,   322,   331,   340,   349,   358,   367,   376,
-     385,   394,   403,   410,   417,   426,   435,   449,   458,   467,
-     474,   481,   488,   496,   503,   510,   517,   524,   532,   540,
-     548,   555,   562,   571,   580,   587,   594,   602,   610,   620,
-     633,   644,   652,   665,   674,   683,   692,   702,   710,   723,
-     732,   740,   749,   757,   770,   777,   787,   797,   807,   817,
-     827,   837,   847,   854,   861,   870,   879,   888,   895,   905,
-     922,   929,   947,   960,   973,   982,   991,  1000,  1010,  1020,
-    1029,  1038,  1045,  1054,  1063,  1072,  1080,  1093,  1101,  1123,
-    1130,  1145,  1155,  1165,  1172,  1179,  1188,  1198,  1205,  1212,
-    1221,  1231,  1241,  1248,  1255,  1264,  1269,  1270,  1271,  1271,
-    1271,  1272,  1272,  1272,  1273,  1275,  1285,  1294,  1301,  1308,
-    1315,  1322,  1329,  1334,  1335,  1336,  1336,  1337,  1337,  1338,
-    1338,  1339,  1340,  1341,  1342,  1343,  1344,  1346,  1354,  1361,
-    1369,  1377,  1384,  1391,  1400,  1409,  1418,  1427,  1436,  1445,
-    1450,  1451,  1452,  1454
+       0,   124,   124,   124,   125,   125,   126,   126,   127,   127,
+     131,   136,   137,   138,   138,   138,   139,   139,   140,   140,
+     140,   141,   141,   141,   142,   142,   142,   143,   143,   144,
+     144,   145,   145,   146,   146,   147,   147,   148,   148,   149,
+     149,   150,   150,   151,   151,   151,   152,   152,   152,   153,
+     153,   153,   154,   154,   155,   155,   156,   156,   157,   157,
+     158,   158,   158,   159,   159,   160,   160,   161,   161,   161,
+     162,   162,   163,   163,   164,   164,   165,   165,   165,   166,
+     166,   167,   167,   168,   168,   169,   169,   170,   170,   171,
+     171,   171,   172,   172,   173,   173,   173,   174,   174,   174,
+     175,   175,   175,   176,   176,   176,   177,   177,   177,   178,
+     178,   178,   179,   179,   179,   180,   180,   181,   181,   182,
+     184,   196,   197,   198,   198,   198,   198,   198,   200,   212,
+     213,   214,   214,   214,   214,   216,   225,   234,   245,   254,
+     263,   272,   285,   300,   309,   318,   327,   336,   345,   354,
+     363,   372,   381,   390,   399,   408,   415,   422,   431,   440,
+     454,   463,   472,   479,   486,   493,   501,   508,   515,   522,
+     529,   537,   545,   553,   560,   567,   576,   585,   592,   599,
+     607,   615,   625,   635,   648,   659,   667,   680,   689,   698,
+     707,   717,   725,   738,   747,   755,   764,   772,   785,   794,
+     801,   811,   821,   831,   841,   851,   861,   871,   881,   888,
+     895,   904,   913,   922,   929,   939,   956,   963,   981,   994,
+    1007,  1016,  1025,  1034,  1044,  1054,  1063,  1072,  1079,  1088,
+    1097,  1106,  1114,  1127,  1135,  1158,  1165,  1180,  1190,  1200,
+    1207,  1214,  1223,  1233,  1240,  1247,  1256,  1266,  1276,  1283,
+    1290,  1299,  1304,  1305,  1306,  1306,  1306,  1307,  1307,  1307,
+    1308,  1308,  1310,  1320,  1329,  1336,  1346,  1353,  1360,  1367,
+    1374,  1379,  1380,  1381,  1381,  1382,  1382,  1383,  1383,  1384,
+    1385,  1386,  1387,  1388,  1389,  1391,  1399,  1406,  1414,  1422,
+    1429,  1436,  1445,  1454,  1463,  1472,  1481,  1490,  1495,  1496,
+    1497,  1499
 };
 #endif
 
@@ -933,32 +945,34 @@ static const char *const yytname[] =
   "VAR_PRIVATE_DOMAIN", "VAR_REMOTE_CONTROL", "VAR_CONTROL_ENABLE",
   "VAR_CONTROL_INTERFACE", "VAR_CONTROL_PORT", "VAR_SERVER_KEY_FILE",
   "VAR_SERVER_CERT_FILE", "VAR_CONTROL_KEY_FILE", "VAR_CONTROL_CERT_FILE",
-  "VAR_EXTENDED_STATISTICS", "VAR_LOCAL_DATA_PTR", "VAR_JOSTLE_TIMEOUT",
-  "VAR_STUB_PRIME", "VAR_UNWANTED_REPLY_THRESHOLD", "VAR_LOG_TIME_ASCII",
-  "VAR_DOMAIN_INSECURE", "VAR_PYTHON", "VAR_PYTHON_SCRIPT",
-  "VAR_VAL_SIG_SKEW_MIN", "VAR_VAL_SIG_SKEW_MAX", "VAR_CACHE_MIN_TTL",
-  "VAR_VAL_LOG_LEVEL", "VAR_AUTO_TRUST_ANCHOR_FILE", "VAR_KEEP_MISSING",
-  "VAR_ADD_HOLDDOWN", "VAR_DEL_HOLDDOWN", "VAR_SO_RCVBUF",
-  "VAR_EDNS_BUFFER_SIZE", "VAR_PREFETCH", "VAR_PREFETCH_KEY",
-  "VAR_SO_SNDBUF", "VAR_SO_REUSEPORT", "VAR_HARDEN_BELOW_NXDOMAIN",
-  "VAR_IGNORE_CD_FLAG", "VAR_LOG_QUERIES", "VAR_TCP_UPSTREAM",
-  "VAR_SSL_UPSTREAM", "VAR_SSL_SERVICE_KEY", "VAR_SSL_SERVICE_PEM",
-  "VAR_SSL_PORT", "VAR_FORWARD_FIRST", "VAR_STUB_FIRST",
-  "VAR_MINIMAL_RESPONSES", "VAR_RRSET_ROUNDROBIN", "VAR_MAX_UDP_SIZE",
-  "VAR_DELAY_CLOSE", "VAR_UNBLOCK_LAN_ZONES", "VAR_DNS64_PREFIX",
-  "VAR_DNS64_SYNTHALL", "VAR_DNSTAP", "VAR_DNSTAP_ENABLE",
-  "VAR_DNSTAP_SOCKET_PATH", "VAR_DNSTAP_SEND_IDENTITY",
-  "VAR_DNSTAP_SEND_VERSION", "VAR_DNSTAP_IDENTITY", "VAR_DNSTAP_VERSION",
+  "VAR_CONTROL_USE_CERT", "VAR_EXTENDED_STATISTICS", "VAR_LOCAL_DATA_PTR",
+  "VAR_JOSTLE_TIMEOUT", "VAR_STUB_PRIME", "VAR_UNWANTED_REPLY_THRESHOLD",
+  "VAR_LOG_TIME_ASCII", "VAR_DOMAIN_INSECURE", "VAR_PYTHON",
+  "VAR_PYTHON_SCRIPT", "VAR_VAL_SIG_SKEW_MIN", "VAR_VAL_SIG_SKEW_MAX",
+  "VAR_CACHE_MIN_TTL", "VAR_VAL_LOG_LEVEL", "VAR_AUTO_TRUST_ANCHOR_FILE",
+  "VAR_KEEP_MISSING", "VAR_ADD_HOLDDOWN", "VAR_DEL_HOLDDOWN",
+  "VAR_SO_RCVBUF", "VAR_EDNS_BUFFER_SIZE", "VAR_PREFETCH",
+  "VAR_PREFETCH_KEY", "VAR_SO_SNDBUF", "VAR_SO_REUSEPORT",
+  "VAR_HARDEN_BELOW_NXDOMAIN", "VAR_IGNORE_CD_FLAG", "VAR_LOG_QUERIES",
+  "VAR_TCP_UPSTREAM", "VAR_SSL_UPSTREAM", "VAR_SSL_SERVICE_KEY",
+  "VAR_SSL_SERVICE_PEM", "VAR_SSL_PORT", "VAR_FORWARD_FIRST",
+  "VAR_STUB_FIRST", "VAR_MINIMAL_RESPONSES", "VAR_RRSET_ROUNDROBIN",
+  "VAR_MAX_UDP_SIZE", "VAR_DELAY_CLOSE", "VAR_UNBLOCK_LAN_ZONES",
+  "VAR_INFRA_CACHE_MIN_RTT", "VAR_DNS64_PREFIX", "VAR_DNS64_SYNTHALL",
+  "VAR_DNSTAP", "VAR_DNSTAP_ENABLE", "VAR_DNSTAP_SOCKET_PATH",
+  "VAR_DNSTAP_SEND_IDENTITY", "VAR_DNSTAP_SEND_VERSION",
+  "VAR_DNSTAP_IDENTITY", "VAR_DNSTAP_VERSION",
   "VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES",
   "VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES",
   "VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES",
   "VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES",
   "VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES",
-  "VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES", "$accept", "toplevelvars",
-  "toplevelvar", "serverstart", "contents_server", "content_server",
-  "stubstart", "contents_stub", "content_stub", "forwardstart",
-  "contents_forward", "content_forward", "server_num_threads",
-  "server_verbosity", "server_statistics_interval",
+  "VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES",
+  "VAR_HARDEN_ALGO_DOWNGRADE", "VAR_IP_TRANSPARENT", "$accept",
+  "toplevelvars", "toplevelvar", "serverstart", "contents_server",
+  "content_server", "stubstart", "contents_stub", "content_stub",
+  "forwardstart", "contents_forward", "content_forward",
+  "server_num_threads", "server_verbosity", "server_statistics_interval",
   "server_statistics_cumulative", "server_extended_statistics",
   "server_port", "server_interface", "server_outgoing_interface",
   "server_outgoing_range", "server_outgoing_port_permit",
@@ -975,24 +989,26 @@ static const char *const yytname[] =
   "server_trust_anchor", "server_domain_insecure", "server_hide_identity",
   "server_hide_version", "server_identity", "server_version",
   "server_so_rcvbuf", "server_so_sndbuf", "server_so_reuseport",
-  "server_edns_buffer_size", "server_msg_buffer_size",
-  "server_msg_cache_size", "server_msg_cache_slabs",
-  "server_num_queries_per_thread", "server_jostle_timeout",
-  "server_delay_close", "server_unblock_lan_zones",
-  "server_rrset_cache_size", "server_rrset_cache_slabs",
-  "server_infra_host_ttl", "server_infra_lame_ttl",
-  "server_infra_cache_numhosts", "server_infra_cache_lame_size",
-  "server_infra_cache_slabs", "server_target_fetch_policy",
+  "server_ip_transparent", "server_edns_buffer_size",
+  "server_msg_buffer_size", "server_msg_cache_size",
+  "server_msg_cache_slabs", "server_num_queries_per_thread",
+  "server_jostle_timeout", "server_delay_close",
+  "server_unblock_lan_zones", "server_rrset_cache_size",
+  "server_rrset_cache_slabs", "server_infra_host_ttl",
+  "server_infra_lame_ttl", "server_infra_cache_numhosts",
+  "server_infra_cache_lame_size", "server_infra_cache_slabs",
+  "server_infra_cache_min_rtt", "server_target_fetch_policy",
   "server_harden_short_bufsize", "server_harden_large_queries",
   "server_harden_glue", "server_harden_dnssec_stripped",
   "server_harden_below_nxdomain", "server_harden_referral_path",
-  "server_use_caps_for_id", "server_private_address",
-  "server_private_domain", "server_prefetch", "server_prefetch_key",
-  "server_unwanted_reply_threshold", "server_do_not_query_address",
-  "server_do_not_query_localhost", "server_access_control",
-  "server_module_conf", "server_val_override_date",
-  "server_val_sig_skew_min", "server_val_sig_skew_max",
-  "server_cache_max_ttl", "server_cache_min_ttl", "server_bogus_ttl",
+  "server_harden_algo_downgrade", "server_use_caps_for_id",
+  "server_private_address", "server_private_domain", "server_prefetch",
+  "server_prefetch_key", "server_unwanted_reply_threshold",
+  "server_do_not_query_address", "server_do_not_query_localhost",
+  "server_access_control", "server_module_conf",
+  "server_val_override_date", "server_val_sig_skew_min",
+  "server_val_sig_skew_max", "server_cache_max_ttl",
+  "server_cache_min_ttl", "server_bogus_ttl",
   "server_val_clean_additional", "server_val_permissive_mode",
   "server_ignore_cd_flag", "server_val_log_level",
   "server_val_nsec3_keysize_iterations", "server_add_holddown",
@@ -1004,10 +1020,11 @@ static const char *const yytname[] =
   "stub_first", "stub_prime", "forward_name", "forward_host",
   "forward_addr", "forward_first", "rcstart", "contents_rc", "content_rc",
   "rc_control_enable", "rc_control_port", "rc_control_interface",
-  "rc_server_key_file", "rc_server_cert_file", "rc_control_key_file",
-  "rc_control_cert_file", "dtstart", "contents_dt", "content_dt",
-  "dt_dnstap_enable", "dt_dnstap_socket_path", "dt_dnstap_send_identity",
-  "dt_dnstap_send_version", "dt_dnstap_identity", "dt_dnstap_version",
+  "rc_control_use_cert", "rc_server_key_file", "rc_server_cert_file",
+  "rc_control_key_file", "rc_control_cert_file", "dtstart", "contents_dt",
+  "content_dt", "dt_dnstap_enable", "dt_dnstap_socket_path",
+  "dt_dnstap_send_identity", "dt_dnstap_send_version",
+  "dt_dnstap_identity", "dt_dnstap_version",
   "dt_dnstap_log_resolver_query_messages",
   "dt_dnstap_log_resolver_response_messages",
   "dt_dnstap_log_client_query_messages",
@@ -1037,43 +1054,45 @@ static const yytype_uint16 yytoknum[] =
      365,   366,   367,   368,   369,   370,   371,   372,   373,   374,
      375,   376,   377,   378,   379,   380,   381,   382,   383,   384,
      385,   386,   387,   388,   389,   390,   391,   392,   393,   394,
-     395,   396,   397,   398,   399,   400,   401,   402,   403
+     395,   396,   397,   398,   399,   400,   401,   402,   403,   404,
+     405,   406,   407
 };
 # endif
 
 /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_uint16 yyr1[] =
 {
-       0,   149,   150,   150,   151,   151,   151,   151,   151,   151,
-     152,   153,   153,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   154,   154,   154,
-     154,   154,   154,   154,   154,   154,   154,   155,   156,   156,
-     157,   157,   157,   157,   157,   158,   159,   159,   160,   160,
-     160,   160,   161,   162,   163,   164,   165,   166,   167,   168,
-     169,   170,   171,   172,   173,   174,   175,   176,   177,   178,
-     179,   180,   181,   182,   183,   184,   185,   186,   187,   188,
-     189,   190,   191,   192,   193,   194,   195,   196,   197,   198,
-     199,   200,   201,   202,   203,   204,   205,   206,   207,   208,
-     209,   210,   211,   212,   213,   214,   215,   216,   217,   218,
-     219,   220,   221,   222,   223,   224,   225,   226,   227,   228,
-     229,   230,   231,   232,   233,   234,   235,   236,   237,   238,
-     239,   240,   241,   242,   243,   244,   245,   246,   247,   248,
-     249,   250,   251,   252,   253,   254,   255,   256,   257,   258,
-     259,   260,   261,   262,   263,   264,   265,   266,   267,   268,
-     269,   270,   271,   272,   273,   274,   275,   275,   276,   276,
-     276,   276,   276,   276,   276,   277,   278,   279,   280,   281,
-     282,   283,   284,   285,   285,   286,   286,   286,   286,   286,
-     286,   286,   286,   286,   286,   286,   286,   287,   288,   289,
-     290,   291,   292,   293,   294,   295,   296,   297,   298,   299,
-     300,   300,   301,   302
+       0,   153,   154,   154,   155,   155,   155,   155,   155,   155,
+     156,   157,   157,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     158,   158,   158,   158,   158,   158,   158,   158,   158,   158,
+     159,   160,   160,   161,   161,   161,   161,   161,   162,   163,
+     163,   164,   164,   164,   164,   165,   166,   167,   168,   169,
+     170,   171,   172,   173,   174,   175,   176,   177,   178,   179,
+     180,   181,   182,   183,   184,   185,   186,   187,   188,   189,
+     190,   191,   192,   193,   194,   195,   196,   197,   198,   199,
+     200,   201,   202,   203,   204,   205,   206,   207,   208,   209,
+     210,   211,   212,   213,   214,   215,   216,   217,   218,   219,
+     220,   221,   222,   223,   224,   225,   226,   227,   228,   229,
+     230,   231,   232,   233,   234,   235,   236,   237,   238,   239,
+     240,   241,   242,   243,   244,   245,   246,   247,   248,   249,
+     250,   251,   252,   253,   254,   255,   256,   257,   258,   259,
+     260,   261,   262,   263,   264,   265,   266,   267,   268,   269,
+     270,   271,   272,   273,   274,   275,   276,   277,   278,   279,
+     280,   281,   282,   282,   283,   283,   283,   283,   283,   283,
+     283,   283,   284,   285,   286,   287,   288,   289,   290,   291,
+     292,   293,   293,   294,   294,   294,   294,   294,   294,   294,
+     294,   294,   294,   294,   294,   295,   296,   297,   298,   299,
+     300,   301,   302,   303,   304,   305,   306,   307,   308,   308,
+     309,   310
 };
 
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
@@ -1090,25 +1109,26 @@ static const yytype_uint8 yyr2[] =
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     2,     0,
-       1,     1,     1,     1,     1,     1,     2,     0,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     2,     0,     1,     1,     1,     1,     1,     1,     2,
+       0,     1,     1,     1,     1,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     3,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     3,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     1,     2,     0,     1,     1,     1,     1,     1,     1,
        1,     1,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     3,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     3,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     1,     2,     0,     1,     1,
+       1,     2,     0,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     2,     2,     2,     2,     2,
-       2,     2,     1,     2,     0,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     1,
-       2,     0,     1,     2
+       2,     2,     2,     2,     2,     2,     2,     1,     2,     0,
+       1,     2
 };
 
 /* YYDEFACT[STATE-NAME] -- Default reduction number in state STATE-NUM.
@@ -1116,8 +1136,8 @@ static const yytype_uint8 yyr2[] =
    means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-       2,     0,     1,    10,   117,   125,   245,   289,   262,     3,
-      12,   119,   127,   247,   264,   291,     4,     5,     6,     8,
+       2,     0,     1,    10,   120,   128,   251,   297,   270,     3,
+      12,   122,   130,   253,   272,   299,     4,     5,     6,     8,
        9,     7,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
@@ -1128,129 +1148,133 @@ static const yytype_uint16 yydefact[] =
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,    11,    13,    14,    70,
-      73,    82,    15,    21,    61,    16,    74,    75,    32,    54,
-      69,    17,    18,    19,    20,   104,   105,   106,   107,   108,
-      71,    60,    86,   103,    22,    23,    24,    25,    26,    62,
-      76,    77,    92,    48,    58,    49,    87,    42,    43,    44,
-      45,    96,   100,   112,    97,    55,    27,    28,    29,    84,
-     113,   114,    30,    31,    33,    34,    36,    37,    35,    38,
-      39,    40,    46,    65,   101,    79,    72,    80,    81,    98,
-      99,    85,    41,    63,    66,    47,    50,    88,    89,    64,
-      90,    51,    52,    53,   102,    91,    59,    93,    94,    95,
-      56,    57,    78,    67,    68,    83,   109,   110,   111,   115,
-     116,     0,     0,     0,     0,     0,   118,   120,   121,   122,
-     124,   123,     0,     0,     0,     0,   126,   128,   129,   130,
-     131,     0,     0,     0,     0,     0,     0,     0,   246,   248,
-     250,   249,   251,   252,   253,   254,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,   263,   265,
-     266,   267,   268,   269,   270,   271,   272,   273,   274,   275,
-     276,     0,   290,   292,   133,   132,   137,   140,   138,   146,
-     147,   148,   149,   159,   160,   161,   162,   163,   181,   182,
-     183,   187,   188,   143,   189,   190,   193,   191,   192,   194,
-     195,   196,   207,   172,   173,   174,   175,   197,   210,   168,
-     170,   211,   216,   217,   218,   144,   180,   225,   226,   169,
-     221,   156,   139,   164,   208,   214,   198,     0,     0,   229,
-     145,   134,   155,   201,   135,   141,   142,   165,   166,   227,
-     200,   202,   203,   136,   230,   184,   206,   157,   171,   212,
-     213,   215,   220,   167,   224,   222,   223,   176,   179,   204,
-     205,   177,   178,   199,   219,   158,   150,   151,   152,   153,
-     154,   231,   232,   233,   185,   186,   234,   235,   236,   237,
-     238,   240,   239,   241,   242,   243,   244,   255,   257,   256,
-     258,   259,   260,   261,   277,   278,   279,   280,   281,   282,
-     283,   284,   285,   286,   287,   288,   293,   209,   228
+       0,     0,     0,     0,     0,     0,     0,     0,     0,    11,
+      13,    14,    70,    73,    82,    15,    21,    61,    16,    74,
+      75,    32,    54,    69,    17,    18,    19,    20,   104,   105,
+     106,   107,   108,    71,    60,    86,   103,    22,    23,    24,
+      25,    26,    62,    76,    77,    92,    48,    58,    49,    87,
+      42,    43,    44,    45,    96,   100,   112,   119,    97,    55,
+      27,    28,    29,    84,   113,   114,    30,    31,    33,    34,
+      36,    37,    35,   117,    38,    39,    40,    46,    65,   101,
+      79,   118,    72,    80,    81,    98,    99,    85,    41,    63,
+      66,    47,    50,    88,    89,    64,    90,    51,    52,    53,
+     102,    91,    59,    93,    94,    95,    56,    57,    78,    67,
+      68,    83,   109,   110,   111,   115,   116,     0,     0,     0,
+       0,     0,   121,   123,   124,   125,   127,   126,     0,     0,
+       0,     0,   129,   131,   132,   133,   134,     0,     0,     0,
+       0,     0,     0,     0,     0,   252,   254,   256,   255,   261,
+     257,   258,   259,   260,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,   271,   273,   274,   275,
+     276,   277,   278,   279,   280,   281,   282,   283,   284,     0,
+     298,   300,   136,   135,   140,   143,   141,   149,   150,   151,
+     152,   162,   163,   164,   165,   166,   185,   186,   187,   191,
+     192,   146,   193,   194,   197,   195,   196,   199,   200,   201,
+     213,   175,   176,   177,   178,   202,   216,   171,   173,   217,
+     222,   223,   224,   147,   184,   231,   232,   172,   227,   159,
+     142,   167,   214,   220,   203,     0,     0,   235,   148,   137,
+     158,   207,   138,   144,   145,   168,   169,   233,   205,   208,
+     209,   139,   236,   188,   212,   160,   174,   218,   219,   221,
+     226,   170,   230,   228,   229,   179,   183,   210,   211,   180,
+     181,   204,   225,   161,   153,   154,   155,   156,   157,   237,
+     238,   239,   189,   190,   198,   240,   241,   206,   182,   242,
+     243,   244,   246,   245,   247,   248,   249,   250,   262,   264,
+     263,   266,   267,   268,   269,   265,   285,   286,   287,   288,
+     289,   290,   291,   292,   293,   294,   295,   296,   301,   215,
+     234
 };
 
 /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     1,     9,    10,    16,   126,    11,    17,   236,    12,
-      18,   246,   127,   128,   129,   130,   131,   132,   133,   134,
-     135,   136,   137,   138,   139,   140,   141,   142,   143,   144,
-     145,   146,   147,   148,   149,   150,   151,   152,   153,   154,
-     155,   156,   157,   158,   159,   160,   161,   162,   163,   164,
-     165,   166,   167,   168,   169,   170,   171,   172,   173,   174,
-     175,   176,   177,   178,   179,   180,   181,   182,   183,   184,
-     185,   186,   187,   188,   189,   190,   191,   192,   193,   194,
-     195,   196,   197,   198,   199,   200,   201,   202,   203,   204,
-     205,   206,   207,   208,   209,   210,   211,   212,   213,   214,
-     215,   216,   217,   218,   219,   220,   221,   222,   223,   224,
-     225,   226,   227,   228,   229,   230,   237,   238,   239,   240,
-     241,   247,   248,   249,   250,    13,    19,   258,   259,   260,
-     261,   262,   263,   264,   265,    14,    20,   278,   279,   280,
-     281,   282,   283,   284,   285,   286,   287,   288,   289,   290,
-      15,    21,   292,   293
+      -1,     1,     9,    10,    16,   129,    11,    17,   242,    12,
+      18,   252,   130,   131,   132,   133,   134,   135,   136,   137,
+     138,   139,   140,   141,   142,   143,   144,   145,   146,   147,
+     148,   149,   150,   151,   152,   153,   154,   155,   156,   157,
+     158,   159,   160,   161,   162,   163,   164,   165,   166,   167,
+     168,   169,   170,   171,   172,   173,   174,   175,   176,   177,
+     178,   179,   180,   181,   182,   183,   184,   185,   186,   187,
+     188,   189,   190,   191,   192,   193,   194,   195,   196,   197,
+     198,   199,   200,   201,   202,   203,   204,   205,   206,   207,
+     208,   209,   210,   211,   212,   213,   214,   215,   216,   217,
+     218,   219,   220,   221,   222,   223,   224,   225,   226,   227,
+     228,   229,   230,   231,   232,   233,   234,   235,   236,   243,
+     244,   245,   246,   247,   253,   254,   255,   256,    13,    19,
+     265,   266,   267,   268,   269,   270,   271,   272,   273,    14,
+      20,   286,   287,   288,   289,   290,   291,   292,   293,   294,
+     295,   296,   297,   298,    15,    21,   300,   301
 };
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -123
+#define YYPACT_NINF -81
 static const yytype_int16 yypact[] =
 {
-    -123,     0,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,    92,   -36,   -32,   -62,
-    -122,  -102,    -4,    -3,    -2,    -1,     2,    24,    25,    26,
-      27,    29,    30,    31,    32,    33,    35,    36,    37,    38,
-      39,    40,    41,    42,    43,    44,    45,    46,    47,    48,
-      49,    50,    51,    52,    54,    55,    56,    57,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    68,    69,
-      70,    71,    72,    73,    74,    75,    76,    77,    79,    80,
-      81,    83,    84,    86,    87,    88,    89,    90,    91,   119,
-     120,   121,   122,   127,   128,   170,   171,   172,   173,   174,
-     175,   176,   177,   181,   185,   186,   209,   210,   218,   219,
-     220,   221,   222,   223,   224,   225,   226,   227,   228,   229,
-     230,   231,   232,   233,   234,   235,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,   236,   237,   238,   239,   240,  -123,  -123,  -123,  -123,
-    -123,  -123,   241,   242,   243,   244,  -123,  -123,  -123,  -123,
-    -123,   245,   246,   247,   248,   249,   250,   251,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,   252,   253,   254,   255,
-     256,   257,   258,   259,   260,   261,   262,   263,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,   264,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,   265,   266,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123
+     -81,   116,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -12,    41,    47,    39,
+       3,   -80,    16,    17,    18,    22,    23,    24,    66,    67,
+      69,    72,    73,    78,   107,   126,   127,   128,   145,   146,
+     147,   148,   149,   151,   152,   153,   154,   155,   156,   157,
+     158,   159,   161,   162,   163,   164,   166,   167,   168,   169,
+     170,   171,   172,   173,   174,   175,   176,   177,   178,   179,
+     180,   181,   182,   183,   184,   185,   186,   187,   188,   189,
+     190,   191,   192,   193,   195,   196,   197,   198,   199,   200,
+     201,   202,   203,   204,   205,   206,   207,   208,   209,   211,
+     212,   213,   214,   215,   216,   217,   218,   219,   220,   221,
+     222,   223,   224,   225,   226,   227,   228,   229,   230,   231,
+     232,   233,   234,   235,   236,   237,   238,   239,   240,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   241,   242,   243,
+     245,   246,   -81,   -81,   -81,   -81,   -81,   -81,   247,   248,
+     249,   250,   -81,   -81,   -81,   -81,   -81,   251,   252,   253,
+     254,   255,   256,   257,   258,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   259,   260,   261,   262,   263,   264,
+     265,   266,   267,   268,   269,   270,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   271,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   272,   273,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81
 };
 
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int8 yypgoto[] =
 {
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,  -123,
-    -123,  -123,  -123,  -123
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
@@ -1259,108 +1283,111 @@ static const yytype_int8 yypgoto[] =
 #define YYTABLE_NINF -1
 static const yytype_uint16 yytable[] =
 {
-       2,   231,   291,   232,   233,   242,   294,   295,   296,   297,
-       0,     3,   298,   243,   244,   266,   267,   268,   269,   270,
-     271,   272,   273,   274,   275,   276,   277,   251,   252,   253,
-     254,   255,   256,   257,   299,   300,   301,   302,     4,   303,
-     304,   305,   306,   307,     5,   308,   309,   310,   311,   312,
-     313,   314,   315,   316,   317,   318,   319,   320,   321,   322,
-     323,   324,   325,   234,   326,   327,   328,   329,   330,   331,
-     332,   333,   334,   335,   336,   337,   338,   339,   340,   341,
-     342,   343,   344,   345,   346,   347,   348,   349,     6,   350,
-     351,   352,   235,   353,   354,   245,   355,   356,   357,   358,
-     359,   360,     0,     7,    22,    23,    24,    25,    26,    27,
-      28,    29,    30,    31,    32,    33,    34,    35,    36,    37,
-      38,    39,    40,    41,    42,    43,    44,    45,    46,   361,
-     362,   363,   364,    47,    48,    49,     8,   365,   366,    50,
-      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
-      61,    62,    63,    64,    65,    66,    67,    68,    69,    70,
-      71,    72,    73,    74,    75,    76,    77,    78,    79,    80,
-      81,    82,    83,    84,    85,    86,    87,    88,    89,    90,
-     367,   368,   369,   370,   371,   372,   373,   374,    91,    92,
-      93,   375,    94,    95,    96,   376,   377,    97,    98,    99,
-     100,   101,   102,   103,   104,   105,   106,   107,   108,   109,
-     110,   111,   112,   113,   114,   115,   116,   117,   118,   378,
-     379,   119,   120,   121,   122,   123,   124,   125,   380,   381,
-     382,   383,   384,   385,   386,   387,   388,   389,   390,   391,
-     392,   393,   394,   395,   396,   397,   398,   399,   400,   401,
-     402,   403,   404,   405,   406,   407,   408,   409,   410,   411,
-     412,   413,   414,   415,   416,   417,   418,   419,   420,   421,
-     422,   423,   424,   425,   426,   427,   428
+      22,    23,    24,    25,    26,    27,    28,    29,    30,    31,
+      32,    33,    34,    35,    36,    37,    38,    39,    40,    41,
+      42,    43,    44,    45,    46,   299,   302,   303,   304,    47,
+      48,    49,   305,   306,   307,    50,    51,    52,    53,    54,
+      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,    67,    68,    69,    70,    71,    72,    73,    74,
+      75,    76,    77,    78,    79,    80,    81,    82,    83,    84,
+      85,    86,    87,    88,    89,    90,   308,   309,   237,   310,
+     238,   239,   311,   312,   248,    91,    92,    93,   313,    94,
+      95,    96,   249,   250,    97,    98,    99,   100,   101,   102,
+     103,   104,   105,   106,   107,   108,   109,   110,   111,   112,
+     113,   114,   115,   116,   117,   118,     2,   314,   119,   120,
+     121,   122,   123,   124,   125,   126,     0,     3,   257,   258,
+     259,   260,   261,   262,   263,   264,   315,   316,   317,   127,
+     128,   240,   274,   275,   276,   277,   278,   279,   280,   281,
+     282,   283,   284,   285,     4,   318,   319,   320,   321,   322,
+       5,   323,   324,   325,   326,   327,   328,   329,   330,   331,
+     241,   332,   333,   334,   335,   251,   336,   337,   338,   339,
+     340,   341,   342,   343,   344,   345,   346,   347,   348,   349,
+     350,   351,   352,   353,   354,   355,   356,   357,   358,   359,
+     360,   361,   362,   363,     6,   364,   365,   366,   367,   368,
+     369,   370,   371,   372,   373,   374,   375,   376,   377,   378,
+       7,   379,   380,   381,   382,   383,   384,   385,   386,   387,
+     388,   389,   390,   391,   392,   393,   394,   395,   396,   397,
+     398,   399,   400,   401,   402,   403,   404,   405,   406,   407,
+     408,   409,   410,   411,     8,   412,   413,   414,   415,   416,
+     417,   418,   419,   420,   421,   422,   423,   424,   425,   426,
+     427,   428,   429,   430,   431,   432,   433,   434,   435,   436,
+     437,   438,   439,   440
 };
 
 #define yypact_value_is_default(Yystate) \
-  (!!((Yystate) == (-123)))
+  (!!((Yystate) == (-81)))
 
 #define yytable_value_is_error(Yytable_value) \
   YYID (0)
 
 static const yytype_int16 yycheck[] =
 {
-       0,    37,   104,    39,    40,    37,    10,    10,    10,    10,
-      -1,    11,    10,    45,    46,   137,   138,   139,   140,   141,
-     142,   143,   144,   145,   146,   147,   148,    89,    90,    91,
-      92,    93,    94,    95,    10,    10,    10,    10,    38,    10,
-      10,    10,    10,    10,    44,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    99,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    88,    10,
-      10,    10,   128,    10,    10,   127,    10,    10,    10,    10,
-      10,    10,    -1,   103,    12,    13,    14,    15,    16,    17,
-      18,    19,    20,    21,    22,    23,    24,    25,    26,    27,
-      28,    29,    30,    31,    32,    33,    34,    35,    36,    10,
-      10,    10,    10,    41,    42,    43,   136,    10,    10,    47,
-      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      68,    69,    70,    71,    72,    73,    74,    75,    76,    77,
-      78,    79,    80,    81,    82,    83,    84,    85,    86,    87,
-      10,    10,    10,    10,    10,    10,    10,    10,    96,    97,
-      98,    10,   100,   101,   102,    10,    10,   105,   106,   107,
-     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
-     118,   119,   120,   121,   122,   123,   124,   125,   126,    10,
-      10,   129,   130,   131,   132,   133,   134,   135,    10,    10,
+      12,    13,    14,    15,    16,    17,    18,    19,    20,    21,
+      22,    23,    24,    25,    26,    27,    28,    29,    30,    31,
+      32,    33,    34,    35,    36,   105,    10,    10,    10,    41,
+      42,    43,    10,    10,    10,    47,    48,    49,    50,    51,
+      52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
+      62,    63,    64,    65,    66,    67,    68,    69,    70,    71,
+      72,    73,    74,    75,    76,    77,    78,    79,    80,    81,
+      82,    83,    84,    85,    86,    87,    10,    10,    37,    10,
+      39,    40,    10,    10,    37,    97,    98,    99,    10,   101,
+     102,   103,    45,    46,   106,   107,   108,   109,   110,   111,
+     112,   113,   114,   115,   116,   117,   118,   119,   120,   121,
+     122,   123,   124,   125,   126,   127,     0,    10,   130,   131,
+     132,   133,   134,   135,   136,   137,    -1,    11,    89,    90,
+      91,    92,    93,    94,    95,    96,    10,    10,    10,   151,
+     152,   100,   139,   140,   141,   142,   143,   144,   145,   146,
+     147,   148,   149,   150,    38,    10,    10,    10,    10,    10,
+      44,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+     129,    10,    10,    10,    10,   128,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    88,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+     104,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10
+      10,    10,    10,    10,   138,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
    symbol of state STATE-NUM.  */
 static const yytype_uint16 yystos[] =
 {
-       0,   150,     0,    11,    38,    44,    88,   103,   136,   151,
-     152,   155,   158,   274,   284,   299,   153,   156,   159,   275,
-     285,   300,    12,    13,    14,    15,    16,    17,    18,    19,
+       0,   154,     0,    11,    38,    44,    88,   104,   138,   155,
+     156,   159,   162,   281,   292,   307,   157,   160,   163,   282,
+     293,   308,    12,    13,    14,    15,    16,    17,    18,    19,
       20,    21,    22,    23,    24,    25,    26,    27,    28,    29,
       30,    31,    32,    33,    34,    35,    36,    41,    42,    43,
       47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
       57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
       67,    68,    69,    70,    71,    72,    73,    74,    75,    76,
       77,    78,    79,    80,    81,    82,    83,    84,    85,    86,
-      87,    96,    97,    98,   100,   101,   102,   105,   106,   107,
-     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
-     118,   119,   120,   121,   122,   123,   124,   125,   126,   129,
-     130,   131,   132,   133,   134,   135,   154,   161,   162,   163,
-     164,   165,   166,   167,   168,   169,   170,   171,   172,   173,
-     174,   175,   176,   177,   178,   179,   180,   181,   182,   183,
-     184,   185,   186,   187,   188,   189,   190,   191,   192,   193,
-     194,   195,   196,   197,   198,   199,   200,   201,   202,   203,
-     204,   205,   206,   207,   208,   209,   210,   211,   212,   213,
-     214,   215,   216,   217,   218,   219,   220,   221,   222,   223,
-     224,   225,   226,   227,   228,   229,   230,   231,   232,   233,
-     234,   235,   236,   237,   238,   239,   240,   241,   242,   243,
-     244,   245,   246,   247,   248,   249,   250,   251,   252,   253,
-     254,   255,   256,   257,   258,   259,   260,   261,   262,   263,
-     264,    37,    39,    40,    99,   128,   157,   265,   266,   267,
-     268,   269,    37,    45,    46,   127,   160,   270,   271,   272,
-     273,    89,    90,    91,    92,    93,    94,    95,   276,   277,
-     278,   279,   280,   281,   282,   283,   137,   138,   139,   140,
-     141,   142,   143,   144,   145,   146,   147,   148,   286,   287,
-     288,   289,   290,   291,   292,   293,   294,   295,   296,   297,
-     298,   104,   301,   302,    10,    10,    10,    10,    10,    10,
+      87,    97,    98,    99,   101,   102,   103,   106,   107,   108,
+     109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
+     119,   120,   121,   122,   123,   124,   125,   126,   127,   130,
+     131,   132,   133,   134,   135,   136,   137,   151,   152,   158,
+     165,   166,   167,   168,   169,   170,   171,   172,   173,   174,
+     175,   176,   177,   178,   179,   180,   181,   182,   183,   184,
+     185,   186,   187,   188,   189,   190,   191,   192,   193,   194,
+     195,   196,   197,   198,   199,   200,   201,   202,   203,   204,
+     205,   206,   207,   208,   209,   210,   211,   212,   213,   214,
+     215,   216,   217,   218,   219,   220,   221,   222,   223,   224,
+     225,   226,   227,   228,   229,   230,   231,   232,   233,   234,
+     235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
+     245,   246,   247,   248,   249,   250,   251,   252,   253,   254,
+     255,   256,   257,   258,   259,   260,   261,   262,   263,   264,
+     265,   266,   267,   268,   269,   270,   271,    37,    39,    40,
+     100,   129,   161,   272,   273,   274,   275,   276,    37,    45,
+      46,   128,   164,   277,   278,   279,   280,    89,    90,    91,
+      92,    93,    94,    95,    96,   283,   284,   285,   286,   287,
+     288,   289,   290,   291,   139,   140,   141,   142,   143,   144,
+     145,   146,   147,   148,   149,   150,   294,   295,   296,   297,
+     298,   299,   300,   301,   302,   303,   304,   305,   306,   105,
+     309,   310,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
@@ -1373,7 +1400,8 @@ static const yytype_uint16 yystos[] =
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -2175,15 +2203,15 @@ yyreduce:
     {
         case 10:
 /* Line 1792 of yacc.c  */
-#line 129 "./util/configparser.y"
+#line 132 "./util/configparser.y"
     { 
 		OUTYY(("\nP(server:)\n")); 
 	}
     break;
 
-  case 117:
+  case 120:
 /* Line 1792 of yacc.c  */
-#line 180 "./util/configparser.y"
+#line 185 "./util/configparser.y"
     {
 		struct config_stub* s;
 		OUTYY(("\nP(stub_zone:)\n")); 
@@ -2196,9 +2224,9 @@ yyreduce:
 	}
     break;
 
-  case 125:
+  case 128:
 /* Line 1792 of yacc.c  */
-#line 196 "./util/configparser.y"
+#line 201 "./util/configparser.y"
     {
 		struct config_stub* s;
 		OUTYY(("\nP(forward_zone:)\n")); 
@@ -2211,9 +2239,9 @@ yyreduce:
 	}
     break;
 
-  case 132:
+  case 135:
 /* Line 1792 of yacc.c  */
-#line 212 "./util/configparser.y"
+#line 217 "./util/configparser.y"
     { 
 		OUTYY(("P(server_num_threads:%s)\n", (yyvsp[(2) - (2)].str))); 
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2223,9 +2251,9 @@ yyreduce:
 	}
     break;
 
-  case 133:
+  case 136:
 /* Line 1792 of yacc.c  */
-#line 221 "./util/configparser.y"
+#line 226 "./util/configparser.y"
     { 
 		OUTYY(("P(server_verbosity:%s)\n", (yyvsp[(2) - (2)].str))); 
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2235,9 +2263,9 @@ yyreduce:
 	}
     break;
 
-  case 134:
+  case 137:
 /* Line 1792 of yacc.c  */
-#line 230 "./util/configparser.y"
+#line 235 "./util/configparser.y"
     { 
 		OUTYY(("P(server_statistics_interval:%s)\n", (yyvsp[(2) - (2)].str))); 
 		if(strcmp((yyvsp[(2) - (2)].str), "") == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0)
@@ -2249,9 +2277,9 @@ yyreduce:
 	}
     break;
 
-  case 135:
+  case 138:
 /* Line 1792 of yacc.c  */
-#line 241 "./util/configparser.y"
+#line 246 "./util/configparser.y"
     {
 		OUTYY(("P(server_statistics_cumulative:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2261,9 +2289,9 @@ yyreduce:
 	}
     break;
 
-  case 136:
+  case 139:
 /* Line 1792 of yacc.c  */
-#line 250 "./util/configparser.y"
+#line 255 "./util/configparser.y"
     {
 		OUTYY(("P(server_extended_statistics:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2273,9 +2301,9 @@ yyreduce:
 	}
     break;
 
-  case 137:
+  case 140:
 /* Line 1792 of yacc.c  */
-#line 259 "./util/configparser.y"
+#line 264 "./util/configparser.y"
     {
 		OUTYY(("P(server_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2285,9 +2313,9 @@ yyreduce:
 	}
     break;
 
-  case 138:
+  case 141:
 /* Line 1792 of yacc.c  */
-#line 268 "./util/configparser.y"
+#line 273 "./util/configparser.y"
     {
 		OUTYY(("P(server_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->num_ifs == 0)
@@ -2301,9 +2329,9 @@ yyreduce:
 	}
     break;
 
-  case 139:
+  case 142:
 /* Line 1792 of yacc.c  */
-#line 281 "./util/configparser.y"
+#line 286 "./util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->num_out_ifs == 0)
@@ -2319,9 +2347,9 @@ yyreduce:
 	}
     break;
 
-  case 140:
+  case 143:
 /* Line 1792 of yacc.c  */
-#line 296 "./util/configparser.y"
+#line 301 "./util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_range:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2331,9 +2359,9 @@ yyreduce:
 	}
     break;
 
-  case 141:
+  case 144:
 /* Line 1792 of yacc.c  */
-#line 305 "./util/configparser.y"
+#line 310 "./util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_port_permit:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_mark_ports((yyvsp[(2) - (2)].str), 1, 
@@ -2343,9 +2371,9 @@ yyreduce:
 	}
     break;
 
-  case 142:
+  case 145:
 /* Line 1792 of yacc.c  */
-#line 314 "./util/configparser.y"
+#line 319 "./util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_port_avoid:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_mark_ports((yyvsp[(2) - (2)].str), 0, 
@@ -2355,9 +2383,9 @@ yyreduce:
 	}
     break;
 
-  case 143:
+  case 146:
 /* Line 1792 of yacc.c  */
-#line 323 "./util/configparser.y"
+#line 328 "./util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_num_tcp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2367,9 +2395,9 @@ yyreduce:
 	}
     break;
 
-  case 144:
+  case 147:
 /* Line 1792 of yacc.c  */
-#line 332 "./util/configparser.y"
+#line 337 "./util/configparser.y"
     {
 		OUTYY(("P(server_incoming_num_tcp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2379,9 +2407,9 @@ yyreduce:
 	}
     break;
 
-  case 145:
+  case 148:
 /* Line 1792 of yacc.c  */
-#line 341 "./util/configparser.y"
+#line 346 "./util/configparser.y"
     {
 		OUTYY(("P(server_interface_automatic:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2391,9 +2419,9 @@ yyreduce:
 	}
     break;
 
-  case 146:
+  case 149:
 /* Line 1792 of yacc.c  */
-#line 350 "./util/configparser.y"
+#line 355 "./util/configparser.y"
     {
 		OUTYY(("P(server_do_ip4:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2403,9 +2431,9 @@ yyreduce:
 	}
     break;
 
-  case 147:
+  case 150:
 /* Line 1792 of yacc.c  */
-#line 359 "./util/configparser.y"
+#line 364 "./util/configparser.y"
     {
 		OUTYY(("P(server_do_ip6:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2415,9 +2443,9 @@ yyreduce:
 	}
     break;
 
-  case 148:
+  case 151:
 /* Line 1792 of yacc.c  */
-#line 368 "./util/configparser.y"
+#line 373 "./util/configparser.y"
     {
 		OUTYY(("P(server_do_udp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2427,9 +2455,9 @@ yyreduce:
 	}
     break;
 
-  case 149:
+  case 152:
 /* Line 1792 of yacc.c  */
-#line 377 "./util/configparser.y"
+#line 382 "./util/configparser.y"
     {
 		OUTYY(("P(server_do_tcp:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2439,9 +2467,9 @@ yyreduce:
 	}
     break;
 
-  case 150:
+  case 153:
 /* Line 1792 of yacc.c  */
-#line 386 "./util/configparser.y"
+#line 391 "./util/configparser.y"
     {
 		OUTYY(("P(server_tcp_upstream:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2451,9 +2479,9 @@ yyreduce:
 	}
     break;
 
-  case 151:
+  case 154:
 /* Line 1792 of yacc.c  */
-#line 395 "./util/configparser.y"
+#line 400 "./util/configparser.y"
     {
 		OUTYY(("P(server_ssl_upstream:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2463,9 +2491,9 @@ yyreduce:
 	}
     break;
 
-  case 152:
+  case 155:
 /* Line 1792 of yacc.c  */
-#line 404 "./util/configparser.y"
+#line 409 "./util/configparser.y"
     {
 		OUTYY(("P(server_ssl_service_key:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->ssl_service_key);
@@ -2473,9 +2501,9 @@ yyreduce:
 	}
     break;
 
-  case 153:
+  case 156:
 /* Line 1792 of yacc.c  */
-#line 411 "./util/configparser.y"
+#line 416 "./util/configparser.y"
     {
 		OUTYY(("P(server_ssl_service_pem:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->ssl_service_pem);
@@ -2483,9 +2511,9 @@ yyreduce:
 	}
     break;
 
-  case 154:
+  case 157:
 /* Line 1792 of yacc.c  */
-#line 418 "./util/configparser.y"
+#line 423 "./util/configparser.y"
     {
 		OUTYY(("P(server_ssl_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2495,9 +2523,9 @@ yyreduce:
 	}
     break;
 
-  case 155:
+  case 158:
 /* Line 1792 of yacc.c  */
-#line 427 "./util/configparser.y"
+#line 432 "./util/configparser.y"
     {
 		OUTYY(("P(server_do_daemonize:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2507,9 +2535,9 @@ yyreduce:
 	}
     break;
 
-  case 156:
+  case 159:
 /* Line 1792 of yacc.c  */
-#line 436 "./util/configparser.y"
+#line 441 "./util/configparser.y"
     {
 		OUTYY(("P(server_use_syslog:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2524,9 +2552,9 @@ yyreduce:
 	}
     break;
 
-  case 157:
+  case 160:
 /* Line 1792 of yacc.c  */
-#line 450 "./util/configparser.y"
+#line 455 "./util/configparser.y"
     {
 		OUTYY(("P(server_log_time_ascii:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2536,9 +2564,9 @@ yyreduce:
 	}
     break;
 
-  case 158:
+  case 161:
 /* Line 1792 of yacc.c  */
-#line 459 "./util/configparser.y"
+#line 464 "./util/configparser.y"
     {
 		OUTYY(("P(server_log_queries:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2548,9 +2576,9 @@ yyreduce:
 	}
     break;
 
-  case 159:
+  case 162:
 /* Line 1792 of yacc.c  */
-#line 468 "./util/configparser.y"
+#line 473 "./util/configparser.y"
     {
 		OUTYY(("P(server_chroot:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->chrootdir);
@@ -2558,9 +2586,9 @@ yyreduce:
 	}
     break;
 
-  case 160:
+  case 163:
 /* Line 1792 of yacc.c  */
-#line 475 "./util/configparser.y"
+#line 480 "./util/configparser.y"
     {
 		OUTYY(("P(server_username:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->username);
@@ -2568,9 +2596,9 @@ yyreduce:
 	}
     break;
 
-  case 161:
+  case 164:
 /* Line 1792 of yacc.c  */
-#line 482 "./util/configparser.y"
+#line 487 "./util/configparser.y"
     {
 		OUTYY(("P(server_directory:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->directory);
@@ -2578,9 +2606,9 @@ yyreduce:
 	}
     break;
 
-  case 162:
+  case 165:
 /* Line 1792 of yacc.c  */
-#line 489 "./util/configparser.y"
+#line 494 "./util/configparser.y"
     {
 		OUTYY(("P(server_logfile:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->logfile);
@@ -2589,9 +2617,9 @@ yyreduce:
 	}
     break;
 
-  case 163:
+  case 166:
 /* Line 1792 of yacc.c  */
-#line 497 "./util/configparser.y"
+#line 502 "./util/configparser.y"
     {
 		OUTYY(("P(server_pidfile:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->pidfile);
@@ -2599,9 +2627,9 @@ yyreduce:
 	}
     break;
 
-  case 164:
+  case 167:
 /* Line 1792 of yacc.c  */
-#line 504 "./util/configparser.y"
+#line 509 "./util/configparser.y"
     {
 		OUTYY(("P(server_root_hints:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->root_hints, (yyvsp[(2) - (2)].str)))
@@ -2609,9 +2637,9 @@ yyreduce:
 	}
     break;
 
-  case 165:
+  case 168:
 /* Line 1792 of yacc.c  */
-#line 511 "./util/configparser.y"
+#line 516 "./util/configparser.y"
     {
 		OUTYY(("P(server_dlv_anchor_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dlv_anchor_file);
@@ -2619,9 +2647,9 @@ yyreduce:
 	}
     break;
 
-  case 166:
+  case 169:
 /* Line 1792 of yacc.c  */
-#line 518 "./util/configparser.y"
+#line 523 "./util/configparser.y"
     {
 		OUTYY(("P(server_dlv_anchor:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, (yyvsp[(2) - (2)].str)))
@@ -2629,9 +2657,9 @@ yyreduce:
 	}
     break;
 
-  case 167:
+  case 170:
 /* Line 1792 of yacc.c  */
-#line 525 "./util/configparser.y"
+#line 530 "./util/configparser.y"
     {
 		OUTYY(("P(server_auto_trust_anchor_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
@@ -2640,9 +2668,9 @@ yyreduce:
 	}
     break;
 
-  case 168:
+  case 171:
 /* Line 1792 of yacc.c  */
-#line 533 "./util/configparser.y"
+#line 538 "./util/configparser.y"
     {
 		OUTYY(("P(server_trust_anchor_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
@@ -2651,9 +2679,9 @@ yyreduce:
 	}
     break;
 
-  case 169:
+  case 172:
 /* Line 1792 of yacc.c  */
-#line 541 "./util/configparser.y"
+#line 546 "./util/configparser.y"
     {
 		OUTYY(("P(server_trusted_keys_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
@@ -2662,9 +2690,9 @@ yyreduce:
 	}
     break;
 
-  case 170:
+  case 173:
 /* Line 1792 of yacc.c  */
-#line 549 "./util/configparser.y"
+#line 554 "./util/configparser.y"
     {
 		OUTYY(("P(server_trust_anchor:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->trust_anchor_list, (yyvsp[(2) - (2)].str)))
@@ -2672,9 +2700,9 @@ yyreduce:
 	}
     break;
 
-  case 171:
+  case 174:
 /* Line 1792 of yacc.c  */
-#line 556 "./util/configparser.y"
+#line 561 "./util/configparser.y"
     {
 		OUTYY(("P(server_domain_insecure:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->domain_insecure, (yyvsp[(2) - (2)].str)))
@@ -2682,9 +2710,9 @@ yyreduce:
 	}
     break;
 
-  case 172:
+  case 175:
 /* Line 1792 of yacc.c  */
-#line 563 "./util/configparser.y"
+#line 568 "./util/configparser.y"
     {
 		OUTYY(("P(server_hide_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2694,9 +2722,9 @@ yyreduce:
 	}
     break;
 
-  case 173:
+  case 176:
 /* Line 1792 of yacc.c  */
-#line 572 "./util/configparser.y"
+#line 577 "./util/configparser.y"
     {
 		OUTYY(("P(server_hide_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2706,9 +2734,9 @@ yyreduce:
 	}
     break;
 
-  case 174:
+  case 177:
 /* Line 1792 of yacc.c  */
-#line 581 "./util/configparser.y"
+#line 586 "./util/configparser.y"
     {
 		OUTYY(("P(server_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->identity);
@@ -2716,9 +2744,9 @@ yyreduce:
 	}
     break;
 
-  case 175:
+  case 178:
 /* Line 1792 of yacc.c  */
-#line 588 "./util/configparser.y"
+#line 593 "./util/configparser.y"
     {
 		OUTYY(("P(server_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->version);
@@ -2726,9 +2754,9 @@ yyreduce:
 	}
     break;
 
-  case 176:
+  case 179:
 /* Line 1792 of yacc.c  */
-#line 595 "./util/configparser.y"
+#line 600 "./util/configparser.y"
     {
 		OUTYY(("P(server_so_rcvbuf:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->so_rcvbuf))
@@ -2737,9 +2765,9 @@ yyreduce:
 	}
     break;
 
-  case 177:
+  case 180:
 /* Line 1792 of yacc.c  */
-#line 603 "./util/configparser.y"
+#line 608 "./util/configparser.y"
     {
 		OUTYY(("P(server_so_sndbuf:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->so_sndbuf))
@@ -2748,9 +2776,9 @@ yyreduce:
 	}
     break;
 
-  case 178:
+  case 181:
 /* Line 1792 of yacc.c  */
-#line 611 "./util/configparser.y"
+#line 616 "./util/configparser.y"
     {
         OUTYY(("P(server_so_reuseport:%s)\n", (yyvsp[(2) - (2)].str)));
         if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2761,9 +2789,22 @@ yyreduce:
     }
     break;
 
-  case 179:
+  case 182:
 /* Line 1792 of yacc.c  */
-#line 621 "./util/configparser.y"
+#line 626 "./util/configparser.y"
+    {
+        OUTYY(("P(server_ip_transparent:%s)\n", (yyvsp[(2) - (2)].str)));
+        if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
+            yyerror("expected yes or no.");
+        else cfg_parser->cfg->ip_transparent =
+            (strcmp((yyvsp[(2) - (2)].str), "yes")==0);
+        free((yyvsp[(2) - (2)].str));
+    }
+    break;
+
+  case 183:
+/* Line 1792 of yacc.c  */
+#line 636 "./util/configparser.y"
     {
 		OUTYY(("P(server_edns_buffer_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2777,9 +2818,9 @@ yyreduce:
 	}
     break;
 
-  case 180:
+  case 184:
 /* Line 1792 of yacc.c  */
-#line 634 "./util/configparser.y"
+#line 649 "./util/configparser.y"
     {
 		OUTYY(("P(server_msg_buffer_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2791,9 +2832,9 @@ yyreduce:
 	}
     break;
 
-  case 181:
+  case 185:
 /* Line 1792 of yacc.c  */
-#line 645 "./util/configparser.y"
+#line 660 "./util/configparser.y"
     {
 		OUTYY(("P(server_msg_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->msg_cache_size))
@@ -2802,9 +2843,9 @@ yyreduce:
 	}
     break;
 
-  case 182:
+  case 186:
 /* Line 1792 of yacc.c  */
-#line 653 "./util/configparser.y"
+#line 668 "./util/configparser.y"
     {
 		OUTYY(("P(server_msg_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2818,9 +2859,9 @@ yyreduce:
 	}
     break;
 
-  case 183:
+  case 187:
 /* Line 1792 of yacc.c  */
-#line 666 "./util/configparser.y"
+#line 681 "./util/configparser.y"
     {
 		OUTYY(("P(server_num_queries_per_thread:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2830,9 +2871,9 @@ yyreduce:
 	}
     break;
 
-  case 184:
+  case 188:
 /* Line 1792 of yacc.c  */
-#line 675 "./util/configparser.y"
+#line 690 "./util/configparser.y"
     {
 		OUTYY(("P(server_jostle_timeout:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2842,9 +2883,9 @@ yyreduce:
 	}
     break;
 
-  case 185:
+  case 189:
 /* Line 1792 of yacc.c  */
-#line 684 "./util/configparser.y"
+#line 699 "./util/configparser.y"
     {
 		OUTYY(("P(server_delay_close:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2854,9 +2895,9 @@ yyreduce:
 	}
     break;
 
-  case 186:
+  case 190:
 /* Line 1792 of yacc.c  */
-#line 693 "./util/configparser.y"
+#line 708 "./util/configparser.y"
     {
 		OUTYY(("P(server_unblock_lan_zones:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2867,9 +2908,9 @@ yyreduce:
 	}
     break;
 
-  case 187:
+  case 191:
 /* Line 1792 of yacc.c  */
-#line 703 "./util/configparser.y"
+#line 718 "./util/configparser.y"
     {
 		OUTYY(("P(server_rrset_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->rrset_cache_size))
@@ -2878,9 +2919,9 @@ yyreduce:
 	}
     break;
 
-  case 188:
+  case 192:
 /* Line 1792 of yacc.c  */
-#line 711 "./util/configparser.y"
+#line 726 "./util/configparser.y"
     {
 		OUTYY(("P(server_rrset_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2894,9 +2935,9 @@ yyreduce:
 	}
     break;
 
-  case 189:
+  case 193:
 /* Line 1792 of yacc.c  */
-#line 724 "./util/configparser.y"
+#line 739 "./util/configparser.y"
     {
 		OUTYY(("P(server_infra_host_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -2906,9 +2947,9 @@ yyreduce:
 	}
     break;
 
-  case 190:
+  case 194:
 /* Line 1792 of yacc.c  */
-#line 733 "./util/configparser.y"
+#line 748 "./util/configparser.y"
     {
 		OUTYY(("P(server_infra_lame_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		verbose(VERB_DETAIL, "ignored infra-lame-ttl: %s (option "
@@ -2917,9 +2958,9 @@ yyreduce:
 	}
     break;
 
-  case 191:
+  case 195:
 /* Line 1792 of yacc.c  */
-#line 741 "./util/configparser.y"
+#line 756 "./util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_numhosts:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2929,9 +2970,9 @@ yyreduce:
 	}
     break;
 
-  case 192:
+  case 196:
 /* Line 1792 of yacc.c  */
-#line 750 "./util/configparser.y"
+#line 765 "./util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_lame_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		verbose(VERB_DETAIL, "ignored infra-cache-lame-size: %s "
@@ -2940,9 +2981,9 @@ yyreduce:
 	}
     break;
 
-  case 193:
+  case 197:
 /* Line 1792 of yacc.c  */
-#line 758 "./util/configparser.y"
+#line 773 "./util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -2956,9 +2997,21 @@ yyreduce:
 	}
     break;
 
-  case 194:
+  case 198:
 /* Line 1792 of yacc.c  */
-#line 771 "./util/configparser.y"
+#line 786 "./util/configparser.y"
+    {
+		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->infra_cache_min_rtt = atoi((yyvsp[(2) - (2)].str));
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 199:
+/* Line 1792 of yacc.c  */
+#line 795 "./util/configparser.y"
     {
 		OUTYY(("P(server_target_fetch_policy:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->target_fetch_policy);
@@ -2966,9 +3019,9 @@ yyreduce:
 	}
     break;
 
-  case 195:
+  case 200:
 /* Line 1792 of yacc.c  */
-#line 778 "./util/configparser.y"
+#line 802 "./util/configparser.y"
     {
 		OUTYY(("P(server_harden_short_bufsize:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2979,9 +3032,9 @@ yyreduce:
 	}
     break;
 
-  case 196:
+  case 201:
 /* Line 1792 of yacc.c  */
-#line 788 "./util/configparser.y"
+#line 812 "./util/configparser.y"
     {
 		OUTYY(("P(server_harden_large_queries:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -2992,9 +3045,9 @@ yyreduce:
 	}
     break;
 
-  case 197:
+  case 202:
 /* Line 1792 of yacc.c  */
-#line 798 "./util/configparser.y"
+#line 822 "./util/configparser.y"
     {
 		OUTYY(("P(server_harden_glue:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3005,9 +3058,9 @@ yyreduce:
 	}
     break;
 
-  case 198:
+  case 203:
 /* Line 1792 of yacc.c  */
-#line 808 "./util/configparser.y"
+#line 832 "./util/configparser.y"
     {
 		OUTYY(("P(server_harden_dnssec_stripped:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3018,9 +3071,9 @@ yyreduce:
 	}
     break;
 
-  case 199:
+  case 204:
 /* Line 1792 of yacc.c  */
-#line 818 "./util/configparser.y"
+#line 842 "./util/configparser.y"
     {
 		OUTYY(("P(server_harden_below_nxdomain:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3031,9 +3084,9 @@ yyreduce:
 	}
     break;
 
-  case 200:
+  case 205:
 /* Line 1792 of yacc.c  */
-#line 828 "./util/configparser.y"
+#line 852 "./util/configparser.y"
     {
 		OUTYY(("P(server_harden_referral_path:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3044,9 +3097,22 @@ yyreduce:
 	}
     break;
 
-  case 201:
+  case 206:
 /* Line 1792 of yacc.c  */
-#line 838 "./util/configparser.y"
+#line 862 "./util/configparser.y"
+    {
+		OUTYY(("P(server_harden_algo_downgrade:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->harden_algo_downgrade = 
+			(strcmp((yyvsp[(2) - (2)].str), "yes")==0);
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 207:
+/* Line 1792 of yacc.c  */
+#line 872 "./util/configparser.y"
     {
 		OUTYY(("P(server_use_caps_for_id:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3057,9 +3123,9 @@ yyreduce:
 	}
     break;
 
-  case 202:
+  case 208:
 /* Line 1792 of yacc.c  */
-#line 848 "./util/configparser.y"
+#line 882 "./util/configparser.y"
     {
 		OUTYY(("P(server_private_address:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_address, (yyvsp[(2) - (2)].str)))
@@ -3067,9 +3133,9 @@ yyreduce:
 	}
     break;
 
-  case 203:
+  case 209:
 /* Line 1792 of yacc.c  */
-#line 855 "./util/configparser.y"
+#line 889 "./util/configparser.y"
     {
 		OUTYY(("P(server_private_domain:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_domain, (yyvsp[(2) - (2)].str)))
@@ -3077,9 +3143,9 @@ yyreduce:
 	}
     break;
 
-  case 204:
+  case 210:
 /* Line 1792 of yacc.c  */
-#line 862 "./util/configparser.y"
+#line 896 "./util/configparser.y"
     {
 		OUTYY(("P(server_prefetch:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3089,9 +3155,9 @@ yyreduce:
 	}
     break;
 
-  case 205:
+  case 211:
 /* Line 1792 of yacc.c  */
-#line 871 "./util/configparser.y"
+#line 905 "./util/configparser.y"
     {
 		OUTYY(("P(server_prefetch_key:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3101,9 +3167,9 @@ yyreduce:
 	}
     break;
 
-  case 206:
+  case 212:
 /* Line 1792 of yacc.c  */
-#line 880 "./util/configparser.y"
+#line 914 "./util/configparser.y"
     {
 		OUTYY(("P(server_unwanted_reply_threshold:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3113,9 +3179,9 @@ yyreduce:
 	}
     break;
 
-  case 207:
+  case 213:
 /* Line 1792 of yacc.c  */
-#line 889 "./util/configparser.y"
+#line 923 "./util/configparser.y"
     {
 		OUTYY(("P(server_do_not_query_address:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->donotqueryaddrs, (yyvsp[(2) - (2)].str)))
@@ -3123,9 +3189,9 @@ yyreduce:
 	}
     break;
 
-  case 208:
+  case 214:
 /* Line 1792 of yacc.c  */
-#line 896 "./util/configparser.y"
+#line 930 "./util/configparser.y"
     {
 		OUTYY(("P(server_do_not_query_localhost:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3136,9 +3202,9 @@ yyreduce:
 	}
     break;
 
-  case 209:
+  case 215:
 /* Line 1792 of yacc.c  */
-#line 906 "./util/configparser.y"
+#line 940 "./util/configparser.y"
     {
 		OUTYY(("P(server_access_control:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)));
 		if(strcmp((yyvsp[(3) - (3)].str), "deny")!=0 && strcmp((yyvsp[(3) - (3)].str), "refuse")!=0 &&
@@ -3156,9 +3222,9 @@ yyreduce:
 	}
     break;
 
-  case 210:
+  case 216:
 /* Line 1792 of yacc.c  */
-#line 923 "./util/configparser.y"
+#line 957 "./util/configparser.y"
     {
 		OUTYY(("P(server_module_conf:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->module_conf);
@@ -3166,9 +3232,9 @@ yyreduce:
 	}
     break;
 
-  case 211:
+  case 217:
 /* Line 1792 of yacc.c  */
-#line 930 "./util/configparser.y"
+#line 964 "./util/configparser.y"
     {
 		OUTYY(("P(server_val_override_date:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strlen((yyvsp[(2) - (2)].str)) == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0) {
@@ -3187,9 +3253,9 @@ yyreduce:
 	}
     break;
 
-  case 212:
+  case 218:
 /* Line 1792 of yacc.c  */
-#line 948 "./util/configparser.y"
+#line 982 "./util/configparser.y"
     {
 		OUTYY(("P(server_val_sig_skew_min:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strlen((yyvsp[(2) - (2)].str)) == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0) {
@@ -3203,9 +3269,9 @@ yyreduce:
 	}
     break;
 
-  case 213:
+  case 219:
 /* Line 1792 of yacc.c  */
-#line 961 "./util/configparser.y"
+#line 995 "./util/configparser.y"
     {
 		OUTYY(("P(server_val_sig_skew_max:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strlen((yyvsp[(2) - (2)].str)) == 0 || strcmp((yyvsp[(2) - (2)].str), "0") == 0) {
@@ -3219,9 +3285,9 @@ yyreduce:
 	}
     break;
 
-  case 214:
+  case 220:
 /* Line 1792 of yacc.c  */
-#line 974 "./util/configparser.y"
+#line 1008 "./util/configparser.y"
     {
 		OUTYY(("P(server_cache_max_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3231,9 +3297,9 @@ yyreduce:
 	}
     break;
 
-  case 215:
+  case 221:
 /* Line 1792 of yacc.c  */
-#line 983 "./util/configparser.y"
+#line 1017 "./util/configparser.y"
     {
 		OUTYY(("P(server_cache_min_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3243,9 +3309,9 @@ yyreduce:
 	}
     break;
 
-  case 216:
+  case 222:
 /* Line 1792 of yacc.c  */
-#line 992 "./util/configparser.y"
+#line 1026 "./util/configparser.y"
     {
 		OUTYY(("P(server_bogus_ttl:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3255,9 +3321,9 @@ yyreduce:
 	}
     break;
 
-  case 217:
+  case 223:
 /* Line 1792 of yacc.c  */
-#line 1001 "./util/configparser.y"
+#line 1035 "./util/configparser.y"
     {
 		OUTYY(("P(server_val_clean_additional:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3268,9 +3334,9 @@ yyreduce:
 	}
     break;
 
-  case 218:
+  case 224:
 /* Line 1792 of yacc.c  */
-#line 1011 "./util/configparser.y"
+#line 1045 "./util/configparser.y"
     {
 		OUTYY(("P(server_val_permissive_mode:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3281,9 +3347,9 @@ yyreduce:
 	}
     break;
 
-  case 219:
+  case 225:
 /* Line 1792 of yacc.c  */
-#line 1021 "./util/configparser.y"
+#line 1055 "./util/configparser.y"
     {
 		OUTYY(("P(server_ignore_cd_flag:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3293,9 +3359,9 @@ yyreduce:
 	}
     break;
 
-  case 220:
+  case 226:
 /* Line 1792 of yacc.c  */
-#line 1030 "./util/configparser.y"
+#line 1064 "./util/configparser.y"
     {
 		OUTYY(("P(server_val_log_level:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3305,9 +3371,9 @@ yyreduce:
 	}
     break;
 
-  case 221:
+  case 227:
 /* Line 1792 of yacc.c  */
-#line 1039 "./util/configparser.y"
+#line 1073 "./util/configparser.y"
     {
 		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->val_nsec3_key_iterations);
@@ -3315,9 +3381,9 @@ yyreduce:
 	}
     break;
 
-  case 222:
+  case 228:
 /* Line 1792 of yacc.c  */
-#line 1046 "./util/configparser.y"
+#line 1080 "./util/configparser.y"
     {
 		OUTYY(("P(server_add_holddown:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3327,9 +3393,9 @@ yyreduce:
 	}
     break;
 
-  case 223:
+  case 229:
 /* Line 1792 of yacc.c  */
-#line 1055 "./util/configparser.y"
+#line 1089 "./util/configparser.y"
     {
 		OUTYY(("P(server_del_holddown:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3339,9 +3405,9 @@ yyreduce:
 	}
     break;
 
-  case 224:
+  case 230:
 /* Line 1792 of yacc.c  */
-#line 1064 "./util/configparser.y"
+#line 1098 "./util/configparser.y"
     {
 		OUTYY(("P(server_keep_missing:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0)
@@ -3351,9 +3417,9 @@ yyreduce:
 	}
     break;
 
-  case 225:
+  case 231:
 /* Line 1792 of yacc.c  */
-#line 1073 "./util/configparser.y"
+#line 1107 "./util/configparser.y"
     {
 		OUTYY(("P(server_key_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->key_cache_size))
@@ -3362,9 +3428,9 @@ yyreduce:
 	}
     break;
 
-  case 226:
+  case 232:
 /* Line 1792 of yacc.c  */
-#line 1081 "./util/configparser.y"
+#line 1115 "./util/configparser.y"
     {
 		OUTYY(("P(server_key_cache_slabs:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -3378,9 +3444,9 @@ yyreduce:
 	}
     break;
 
-  case 227:
+  case 233:
 /* Line 1792 of yacc.c  */
-#line 1094 "./util/configparser.y"
+#line 1128 "./util/configparser.y"
     {
 		OUTYY(("P(server_neg_cache_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_parse_memsize((yyvsp[(2) - (2)].str), &cfg_parser->cfg->neg_cache_size))
@@ -3389,18 +3455,19 @@ yyreduce:
 	}
     break;
 
-  case 228:
+  case 234:
 /* Line 1792 of yacc.c  */
-#line 1102 "./util/configparser.y"
+#line 1136 "./util/configparser.y"
     {
 		OUTYY(("P(server_local_zone:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)));
 		if(strcmp((yyvsp[(3) - (3)].str), "static")!=0 && strcmp((yyvsp[(3) - (3)].str), "deny")!=0 &&
 		   strcmp((yyvsp[(3) - (3)].str), "refuse")!=0 && strcmp((yyvsp[(3) - (3)].str), "redirect")!=0 &&
 		   strcmp((yyvsp[(3) - (3)].str), "transparent")!=0 && strcmp((yyvsp[(3) - (3)].str), "nodefault")!=0
-		   && strcmp((yyvsp[(3) - (3)].str), "typetransparent")!=0)
+		   && strcmp((yyvsp[(3) - (3)].str), "typetransparent")!=0 &&
+		   strcmp((yyvsp[(3) - (3)].str), "inform")!=0)
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
-				"typetransparent or nodefault");
+				"typetransparent, inform or nodefault");
 		else if(strcmp((yyvsp[(3) - (3)].str), "nodefault")==0) {
 			if(!cfg_strlist_insert(&cfg_parser->cfg->
 				local_zones_nodefault, (yyvsp[(2) - (3)].str)))
@@ -3414,9 +3481,9 @@ yyreduce:
 	}
     break;
 
-  case 229:
+  case 235:
 /* Line 1792 of yacc.c  */
-#line 1124 "./util/configparser.y"
+#line 1159 "./util/configparser.y"
     {
 		OUTYY(("P(server_local_data:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[(2) - (2)].str)))
@@ -3424,9 +3491,9 @@ yyreduce:
 	}
     break;
 
-  case 230:
+  case 236:
 /* Line 1792 of yacc.c  */
-#line 1131 "./util/configparser.y"
+#line 1166 "./util/configparser.y"
     {
 		char* ptr;
 		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[(2) - (2)].str)));
@@ -3442,9 +3509,9 @@ yyreduce:
 	}
     break;
 
-  case 231:
+  case 237:
 /* Line 1792 of yacc.c  */
-#line 1146 "./util/configparser.y"
+#line 1181 "./util/configparser.y"
     {
 		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3455,9 +3522,9 @@ yyreduce:
 	}
     break;
 
-  case 232:
+  case 238:
 /* Line 1792 of yacc.c  */
-#line 1156 "./util/configparser.y"
+#line 1191 "./util/configparser.y"
     {
 		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3468,9 +3535,9 @@ yyreduce:
 	}
     break;
 
-  case 233:
+  case 239:
 /* Line 1792 of yacc.c  */
-#line 1166 "./util/configparser.y"
+#line 1201 "./util/configparser.y"
     {
 		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[(2) - (2)].str)));
 		cfg_parser->cfg->max_udp_size = atoi((yyvsp[(2) - (2)].str));
@@ -3478,9 +3545,9 @@ yyreduce:
 	}
     break;
 
-  case 234:
+  case 240:
 /* Line 1792 of yacc.c  */
-#line 1173 "./util/configparser.y"
+#line 1208 "./util/configparser.y"
     {
 		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dns64_prefix);
@@ -3488,9 +3555,9 @@ yyreduce:
 	}
     break;
 
-  case 235:
+  case 241:
 /* Line 1792 of yacc.c  */
-#line 1180 "./util/configparser.y"
+#line 1215 "./util/configparser.y"
     {
 		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3500,9 +3567,9 @@ yyreduce:
 	}
     break;
 
-  case 236:
+  case 242:
 /* Line 1792 of yacc.c  */
-#line 1189 "./util/configparser.y"
+#line 1224 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->stubs->name)
@@ -3513,9 +3580,9 @@ yyreduce:
 	}
     break;
 
-  case 237:
+  case 243:
 /* Line 1792 of yacc.c  */
-#line 1199 "./util/configparser.y"
+#line 1234 "./util/configparser.y"
     {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[(2) - (2)].str)))
@@ -3523,9 +3590,9 @@ yyreduce:
 	}
     break;
 
-  case 238:
+  case 244:
 /* Line 1792 of yacc.c  */
-#line 1206 "./util/configparser.y"
+#line 1241 "./util/configparser.y"
     {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[(2) - (2)].str)))
@@ -3533,9 +3600,9 @@ yyreduce:
 	}
     break;
 
-  case 239:
+  case 245:
 /* Line 1792 of yacc.c  */
-#line 1213 "./util/configparser.y"
+#line 1248 "./util/configparser.y"
     {
 		OUTYY(("P(stub-first:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3545,9 +3612,9 @@ yyreduce:
 	}
     break;
 
-  case 240:
+  case 246:
 /* Line 1792 of yacc.c  */
-#line 1222 "./util/configparser.y"
+#line 1257 "./util/configparser.y"
     {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3558,9 +3625,9 @@ yyreduce:
 	}
     break;
 
-  case 241:
+  case 247:
 /* Line 1792 of yacc.c  */
-#line 1232 "./util/configparser.y"
+#line 1267 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(cfg_parser->cfg->forwards->name)
@@ -3571,9 +3638,9 @@ yyreduce:
 	}
     break;
 
-  case 242:
+  case 248:
 /* Line 1792 of yacc.c  */
-#line 1242 "./util/configparser.y"
+#line 1277 "./util/configparser.y"
     {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[(2) - (2)].str)))
@@ -3581,9 +3648,9 @@ yyreduce:
 	}
     break;
 
-  case 243:
+  case 249:
 /* Line 1792 of yacc.c  */
-#line 1249 "./util/configparser.y"
+#line 1284 "./util/configparser.y"
     {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[(2) - (2)].str)))
@@ -3591,9 +3658,9 @@ yyreduce:
 	}
     break;
 
-  case 244:
+  case 250:
 /* Line 1792 of yacc.c  */
-#line 1256 "./util/configparser.y"
+#line 1291 "./util/configparser.y"
     {
 		OUTYY(("P(forward-first:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3603,17 +3670,17 @@ yyreduce:
 	}
     break;
 
-  case 245:
+  case 251:
 /* Line 1792 of yacc.c  */
-#line 1265 "./util/configparser.y"
+#line 1300 "./util/configparser.y"
     { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
     break;
 
-  case 255:
+  case 262:
 /* Line 1792 of yacc.c  */
-#line 1276 "./util/configparser.y"
+#line 1311 "./util/configparser.y"
     {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3624,9 +3691,9 @@ yyreduce:
 	}
     break;
 
-  case 256:
+  case 263:
 /* Line 1792 of yacc.c  */
-#line 1286 "./util/configparser.y"
+#line 1321 "./util/configparser.y"
     {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(atoi((yyvsp[(2) - (2)].str)) == 0)
@@ -3636,9 +3703,9 @@ yyreduce:
 	}
     break;
 
-  case 257:
+  case 264:
 /* Line 1792 of yacc.c  */
-#line 1295 "./util/configparser.y"
+#line 1330 "./util/configparser.y"
     {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->control_ifs, (yyvsp[(2) - (2)].str)))
@@ -3646,9 +3713,22 @@ yyreduce:
 	}
     break;
 
-  case 258:
+  case 265:
 /* Line 1792 of yacc.c  */
-#line 1302 "./util/configparser.y"
+#line 1337 "./util/configparser.y"
+    {
+		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[(2) - (2)].str)));
+		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->remote_control_use_cert =
+			(strcmp((yyvsp[(2) - (2)].str), "yes")==0);
+		free((yyvsp[(2) - (2)].str));
+	}
+    break;
+
+  case 266:
+/* Line 1792 of yacc.c  */
+#line 1347 "./util/configparser.y"
     {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->server_key_file);
@@ -3656,9 +3736,9 @@ yyreduce:
 	}
     break;
 
-  case 259:
+  case 267:
 /* Line 1792 of yacc.c  */
-#line 1309 "./util/configparser.y"
+#line 1354 "./util/configparser.y"
     {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->server_cert_file);
@@ -3666,9 +3746,9 @@ yyreduce:
 	}
     break;
 
-  case 260:
+  case 268:
 /* Line 1792 of yacc.c  */
-#line 1316 "./util/configparser.y"
+#line 1361 "./util/configparser.y"
     {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->control_key_file);
@@ -3676,9 +3756,9 @@ yyreduce:
 	}
     break;
 
-  case 261:
+  case 269:
 /* Line 1792 of yacc.c  */
-#line 1323 "./util/configparser.y"
+#line 1368 "./util/configparser.y"
     {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->control_cert_file);
@@ -3686,17 +3766,17 @@ yyreduce:
 	}
     break;
 
-  case 262:
+  case 270:
 /* Line 1792 of yacc.c  */
-#line 1330 "./util/configparser.y"
+#line 1375 "./util/configparser.y"
     {
 		OUTYY(("\nP(dnstap:)\n"));
 	}
     break;
 
-  case 277:
+  case 285:
 /* Line 1792 of yacc.c  */
-#line 1347 "./util/configparser.y"
+#line 1392 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3705,9 +3785,9 @@ yyreduce:
 	}
     break;
 
-  case 278:
+  case 286:
 /* Line 1792 of yacc.c  */
-#line 1355 "./util/configparser.y"
+#line 1400 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dnstap_socket_path);
@@ -3715,9 +3795,9 @@ yyreduce:
 	}
     break;
 
-  case 279:
+  case 287:
 /* Line 1792 of yacc.c  */
-#line 1362 "./util/configparser.y"
+#line 1407 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3726,9 +3806,9 @@ yyreduce:
 	}
     break;
 
-  case 280:
+  case 288:
 /* Line 1792 of yacc.c  */
-#line 1370 "./util/configparser.y"
+#line 1415 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3737,9 +3817,9 @@ yyreduce:
 	}
     break;
 
-  case 281:
+  case 289:
 /* Line 1792 of yacc.c  */
-#line 1378 "./util/configparser.y"
+#line 1423 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dnstap_identity);
@@ -3747,9 +3827,9 @@ yyreduce:
 	}
     break;
 
-  case 282:
+  case 290:
 /* Line 1792 of yacc.c  */
-#line 1385 "./util/configparser.y"
+#line 1430 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->dnstap_version);
@@ -3757,9 +3837,9 @@ yyreduce:
 	}
     break;
 
-  case 283:
+  case 291:
 /* Line 1792 of yacc.c  */
-#line 1392 "./util/configparser.y"
+#line 1437 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3769,9 +3849,9 @@ yyreduce:
 	}
     break;
 
-  case 284:
+  case 292:
 /* Line 1792 of yacc.c  */
-#line 1401 "./util/configparser.y"
+#line 1446 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3781,9 +3861,9 @@ yyreduce:
 	}
     break;
 
-  case 285:
+  case 293:
 /* Line 1792 of yacc.c  */
-#line 1410 "./util/configparser.y"
+#line 1455 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3793,9 +3873,9 @@ yyreduce:
 	}
     break;
 
-  case 286:
+  case 294:
 /* Line 1792 of yacc.c  */
-#line 1419 "./util/configparser.y"
+#line 1464 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3805,9 +3885,9 @@ yyreduce:
 	}
     break;
 
-  case 287:
+  case 295:
 /* Line 1792 of yacc.c  */
-#line 1428 "./util/configparser.y"
+#line 1473 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3817,9 +3897,9 @@ yyreduce:
 	}
     break;
 
-  case 288:
+  case 296:
 /* Line 1792 of yacc.c  */
-#line 1437 "./util/configparser.y"
+#line 1482 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[(2) - (2)].str)));
 		if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0)
@@ -3829,17 +3909,17 @@ yyreduce:
 	}
     break;
 
-  case 289:
+  case 297:
 /* Line 1792 of yacc.c  */
-#line 1446 "./util/configparser.y"
+#line 1491 "./util/configparser.y"
     { 
 		OUTYY(("\nP(python:)\n")); 
 	}
     break;
 
-  case 293:
+  case 301:
 /* Line 1792 of yacc.c  */
-#line 1455 "./util/configparser.y"
+#line 1500 "./util/configparser.y"
     {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[(2) - (2)].str)));
 		free(cfg_parser->cfg->python_script);
@@ -3849,7 +3929,7 @@ yyreduce:
 
 
 /* Line 1792 of yacc.c  */
-#line 3853 "util/configparser.c"
+#line 3933 "util/configparser.c"
       default: break;
     }
   /* User semantic actions sometimes alter yychar, and that requires
@@ -4081,7 +4161,7 @@ yyreturn:
 
 
 /* Line 2055 of yacc.c  */
-#line 1460 "./util/configparser.y"
+#line 1505 "./util/configparser.y"
 
 
 /* parse helper routines could be here */
diff --git a/external/unbound/util/configparser.h b/external/unbound/util/configparser.h
index 0ee72661..a8ab6ee5 100644
--- a/external/unbound/util/configparser.h
+++ b/external/unbound/util/configparser.h
@@ -139,59 +139,63 @@ extern int yydebug;
      VAR_SERVER_CERT_FILE = 348,
      VAR_CONTROL_KEY_FILE = 349,
      VAR_CONTROL_CERT_FILE = 350,
-     VAR_EXTENDED_STATISTICS = 351,
-     VAR_LOCAL_DATA_PTR = 352,
-     VAR_JOSTLE_TIMEOUT = 353,
-     VAR_STUB_PRIME = 354,
-     VAR_UNWANTED_REPLY_THRESHOLD = 355,
-     VAR_LOG_TIME_ASCII = 356,
-     VAR_DOMAIN_INSECURE = 357,
-     VAR_PYTHON = 358,
-     VAR_PYTHON_SCRIPT = 359,
-     VAR_VAL_SIG_SKEW_MIN = 360,
-     VAR_VAL_SIG_SKEW_MAX = 361,
-     VAR_CACHE_MIN_TTL = 362,
-     VAR_VAL_LOG_LEVEL = 363,
-     VAR_AUTO_TRUST_ANCHOR_FILE = 364,
-     VAR_KEEP_MISSING = 365,
-     VAR_ADD_HOLDDOWN = 366,
-     VAR_DEL_HOLDDOWN = 367,
-     VAR_SO_RCVBUF = 368,
-     VAR_EDNS_BUFFER_SIZE = 369,
-     VAR_PREFETCH = 370,
-     VAR_PREFETCH_KEY = 371,
-     VAR_SO_SNDBUF = 372,
-     VAR_SO_REUSEPORT = 373,
-     VAR_HARDEN_BELOW_NXDOMAIN = 374,
-     VAR_IGNORE_CD_FLAG = 375,
-     VAR_LOG_QUERIES = 376,
-     VAR_TCP_UPSTREAM = 377,
-     VAR_SSL_UPSTREAM = 378,
-     VAR_SSL_SERVICE_KEY = 379,
-     VAR_SSL_SERVICE_PEM = 380,
-     VAR_SSL_PORT = 381,
-     VAR_FORWARD_FIRST = 382,
-     VAR_STUB_FIRST = 383,
-     VAR_MINIMAL_RESPONSES = 384,
-     VAR_RRSET_ROUNDROBIN = 385,
-     VAR_MAX_UDP_SIZE = 386,
-     VAR_DELAY_CLOSE = 387,
-     VAR_UNBLOCK_LAN_ZONES = 388,
-     VAR_DNS64_PREFIX = 389,
-     VAR_DNS64_SYNTHALL = 390,
-     VAR_DNSTAP = 391,
-     VAR_DNSTAP_ENABLE = 392,
-     VAR_DNSTAP_SOCKET_PATH = 393,
-     VAR_DNSTAP_SEND_IDENTITY = 394,
-     VAR_DNSTAP_SEND_VERSION = 395,
-     VAR_DNSTAP_IDENTITY = 396,
-     VAR_DNSTAP_VERSION = 397,
-     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 398,
-     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 399,
-     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 400,
-     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 401,
-     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 402,
-     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 403
+     VAR_CONTROL_USE_CERT = 351,
+     VAR_EXTENDED_STATISTICS = 352,
+     VAR_LOCAL_DATA_PTR = 353,
+     VAR_JOSTLE_TIMEOUT = 354,
+     VAR_STUB_PRIME = 355,
+     VAR_UNWANTED_REPLY_THRESHOLD = 356,
+     VAR_LOG_TIME_ASCII = 357,
+     VAR_DOMAIN_INSECURE = 358,
+     VAR_PYTHON = 359,
+     VAR_PYTHON_SCRIPT = 360,
+     VAR_VAL_SIG_SKEW_MIN = 361,
+     VAR_VAL_SIG_SKEW_MAX = 362,
+     VAR_CACHE_MIN_TTL = 363,
+     VAR_VAL_LOG_LEVEL = 364,
+     VAR_AUTO_TRUST_ANCHOR_FILE = 365,
+     VAR_KEEP_MISSING = 366,
+     VAR_ADD_HOLDDOWN = 367,
+     VAR_DEL_HOLDDOWN = 368,
+     VAR_SO_RCVBUF = 369,
+     VAR_EDNS_BUFFER_SIZE = 370,
+     VAR_PREFETCH = 371,
+     VAR_PREFETCH_KEY = 372,
+     VAR_SO_SNDBUF = 373,
+     VAR_SO_REUSEPORT = 374,
+     VAR_HARDEN_BELOW_NXDOMAIN = 375,
+     VAR_IGNORE_CD_FLAG = 376,
+     VAR_LOG_QUERIES = 377,
+     VAR_TCP_UPSTREAM = 378,
+     VAR_SSL_UPSTREAM = 379,
+     VAR_SSL_SERVICE_KEY = 380,
+     VAR_SSL_SERVICE_PEM = 381,
+     VAR_SSL_PORT = 382,
+     VAR_FORWARD_FIRST = 383,
+     VAR_STUB_FIRST = 384,
+     VAR_MINIMAL_RESPONSES = 385,
+     VAR_RRSET_ROUNDROBIN = 386,
+     VAR_MAX_UDP_SIZE = 387,
+     VAR_DELAY_CLOSE = 388,
+     VAR_UNBLOCK_LAN_ZONES = 389,
+     VAR_INFRA_CACHE_MIN_RTT = 390,
+     VAR_DNS64_PREFIX = 391,
+     VAR_DNS64_SYNTHALL = 392,
+     VAR_DNSTAP = 393,
+     VAR_DNSTAP_ENABLE = 394,
+     VAR_DNSTAP_SOCKET_PATH = 395,
+     VAR_DNSTAP_SEND_IDENTITY = 396,
+     VAR_DNSTAP_SEND_VERSION = 397,
+     VAR_DNSTAP_IDENTITY = 398,
+     VAR_DNSTAP_VERSION = 399,
+     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 400,
+     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 401,
+     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 402,
+     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 403,
+     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 404,
+     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405,
+     VAR_HARDEN_ALGO_DOWNGRADE = 406,
+     VAR_IP_TRANSPARENT = 407
    };
 #endif
 /* Tokens.  */
@@ -288,59 +292,63 @@ extern int yydebug;
 #define VAR_SERVER_CERT_FILE 348
 #define VAR_CONTROL_KEY_FILE 349
 #define VAR_CONTROL_CERT_FILE 350
-#define VAR_EXTENDED_STATISTICS 351
-#define VAR_LOCAL_DATA_PTR 352
-#define VAR_JOSTLE_TIMEOUT 353
-#define VAR_STUB_PRIME 354
-#define VAR_UNWANTED_REPLY_THRESHOLD 355
-#define VAR_LOG_TIME_ASCII 356
-#define VAR_DOMAIN_INSECURE 357
-#define VAR_PYTHON 358
-#define VAR_PYTHON_SCRIPT 359
-#define VAR_VAL_SIG_SKEW_MIN 360
-#define VAR_VAL_SIG_SKEW_MAX 361
-#define VAR_CACHE_MIN_TTL 362
-#define VAR_VAL_LOG_LEVEL 363
-#define VAR_AUTO_TRUST_ANCHOR_FILE 364
-#define VAR_KEEP_MISSING 365
-#define VAR_ADD_HOLDDOWN 366
-#define VAR_DEL_HOLDDOWN 367
-#define VAR_SO_RCVBUF 368
-#define VAR_EDNS_BUFFER_SIZE 369
-#define VAR_PREFETCH 370
-#define VAR_PREFETCH_KEY 371
-#define VAR_SO_SNDBUF 372
-#define VAR_SO_REUSEPORT 373
-#define VAR_HARDEN_BELOW_NXDOMAIN 374
-#define VAR_IGNORE_CD_FLAG 375
-#define VAR_LOG_QUERIES 376
-#define VAR_TCP_UPSTREAM 377
-#define VAR_SSL_UPSTREAM 378
-#define VAR_SSL_SERVICE_KEY 379
-#define VAR_SSL_SERVICE_PEM 380
-#define VAR_SSL_PORT 381
-#define VAR_FORWARD_FIRST 382
-#define VAR_STUB_FIRST 383
-#define VAR_MINIMAL_RESPONSES 384
-#define VAR_RRSET_ROUNDROBIN 385
-#define VAR_MAX_UDP_SIZE 386
-#define VAR_DELAY_CLOSE 387
-#define VAR_UNBLOCK_LAN_ZONES 388
-#define VAR_DNS64_PREFIX 389
-#define VAR_DNS64_SYNTHALL 390
-#define VAR_DNSTAP 391
-#define VAR_DNSTAP_ENABLE 392
-#define VAR_DNSTAP_SOCKET_PATH 393
-#define VAR_DNSTAP_SEND_IDENTITY 394
-#define VAR_DNSTAP_SEND_VERSION 395
-#define VAR_DNSTAP_IDENTITY 396
-#define VAR_DNSTAP_VERSION 397
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 398
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 399
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 400
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 401
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 402
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 403
+#define VAR_CONTROL_USE_CERT 351
+#define VAR_EXTENDED_STATISTICS 352
+#define VAR_LOCAL_DATA_PTR 353
+#define VAR_JOSTLE_TIMEOUT 354
+#define VAR_STUB_PRIME 355
+#define VAR_UNWANTED_REPLY_THRESHOLD 356
+#define VAR_LOG_TIME_ASCII 357
+#define VAR_DOMAIN_INSECURE 358
+#define VAR_PYTHON 359
+#define VAR_PYTHON_SCRIPT 360
+#define VAR_VAL_SIG_SKEW_MIN 361
+#define VAR_VAL_SIG_SKEW_MAX 362
+#define VAR_CACHE_MIN_TTL 363
+#define VAR_VAL_LOG_LEVEL 364
+#define VAR_AUTO_TRUST_ANCHOR_FILE 365
+#define VAR_KEEP_MISSING 366
+#define VAR_ADD_HOLDDOWN 367
+#define VAR_DEL_HOLDDOWN 368
+#define VAR_SO_RCVBUF 369
+#define VAR_EDNS_BUFFER_SIZE 370
+#define VAR_PREFETCH 371
+#define VAR_PREFETCH_KEY 372
+#define VAR_SO_SNDBUF 373
+#define VAR_SO_REUSEPORT 374
+#define VAR_HARDEN_BELOW_NXDOMAIN 375
+#define VAR_IGNORE_CD_FLAG 376
+#define VAR_LOG_QUERIES 377
+#define VAR_TCP_UPSTREAM 378
+#define VAR_SSL_UPSTREAM 379
+#define VAR_SSL_SERVICE_KEY 380
+#define VAR_SSL_SERVICE_PEM 381
+#define VAR_SSL_PORT 382
+#define VAR_FORWARD_FIRST 383
+#define VAR_STUB_FIRST 384
+#define VAR_MINIMAL_RESPONSES 385
+#define VAR_RRSET_ROUNDROBIN 386
+#define VAR_MAX_UDP_SIZE 387
+#define VAR_DELAY_CLOSE 388
+#define VAR_UNBLOCK_LAN_ZONES 389
+#define VAR_INFRA_CACHE_MIN_RTT 390
+#define VAR_DNS64_PREFIX 391
+#define VAR_DNS64_SYNTHALL 392
+#define VAR_DNSTAP 393
+#define VAR_DNSTAP_ENABLE 394
+#define VAR_DNSTAP_SOCKET_PATH 395
+#define VAR_DNSTAP_SEND_IDENTITY 396
+#define VAR_DNSTAP_SEND_VERSION 397
+#define VAR_DNSTAP_IDENTITY 398
+#define VAR_DNSTAP_VERSION 399
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 400
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 401
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 402
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 403
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 404
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 405
+#define VAR_HARDEN_ALGO_DOWNGRADE 406
+#define VAR_IP_TRANSPARENT 407
 
 
 
@@ -354,7 +362,7 @@ typedef union YYSTYPE
 
 
 /* Line 2058 of yacc.c  */
-#line 358 "util/configparser.h"
+#line 366 "util/configparser.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
diff --git a/external/unbound/util/configparser.y b/external/unbound/util/configparser.y
index 7a92d9ee..fb94be9d 100644
--- a/external/unbound/util/configparser.y
+++ b/external/unbound/util/configparser.y
@@ -95,6 +95,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
+%token VAR_CONTROL_USE_CERT
 %token VAR_EXTENDED_STATISTICS VAR_LOCAL_DATA_PTR VAR_JOSTLE_TIMEOUT
 %token VAR_STUB_PRIME VAR_UNWANTED_REPLY_THRESHOLD VAR_LOG_TIME_ASCII
 %token VAR_DOMAIN_INSECURE VAR_PYTHON VAR_PYTHON_SCRIPT VAR_VAL_SIG_SKEW_MIN
@@ -106,6 +107,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_SSL_SERVICE_KEY VAR_SSL_SERVICE_PEM VAR_SSL_PORT VAR_FORWARD_FIRST
 %token VAR_STUB_FIRST VAR_MINIMAL_RESPONSES VAR_RRSET_ROUNDROBIN
 %token VAR_MAX_UDP_SIZE VAR_DELAY_CLOSE VAR_UNBLOCK_LAN_ZONES
+%token VAR_INFRA_CACHE_MIN_RTT
 %token VAR_DNS64_PREFIX VAR_DNS64_SYNTHALL
 %token VAR_DNSTAP VAR_DNSTAP_ENABLE VAR_DNSTAP_SOCKET_PATH
 %token VAR_DNSTAP_SEND_IDENTITY VAR_DNSTAP_SEND_VERSION
@@ -116,6 +118,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES
 %token VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES
 %token VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES
+%token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -174,7 +177,9 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_ssl_service_key | server_ssl_service_pem | server_ssl_port |
 	server_minimal_responses | server_rrset_roundrobin | server_max_udp_size |
 	server_so_reuseport | server_delay_close | server_unblock_lan_zones |
-	server_dns64_prefix | server_dns64_synthall
+	server_dns64_prefix | server_dns64_synthall |
+	server_infra_cache_min_rtt | server_harden_algo_downgrade |
+	server_ip_transparent
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -617,6 +622,16 @@ server_so_reuseport: VAR_SO_REUSEPORT STRING_ARG
         free($2);
     }
     ;
+server_ip_transparent: VAR_IP_TRANSPARENT STRING_ARG
+    {
+        OUTYY(("P(server_ip_transparent:%s)\n", $2));
+        if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+            yyerror("expected yes or no.");
+        else cfg_parser->cfg->ip_transparent =
+            (strcmp($2, "yes")==0);
+        free($2);
+    }
+    ;
 server_edns_buffer_size: VAR_EDNS_BUFFER_SIZE STRING_ARG
 	{
 		OUTYY(("P(server_edns_buffer_size:%s)\n", $2));
@@ -767,6 +782,15 @@ server_infra_cache_slabs: VAR_INFRA_CACHE_SLABS STRING_ARG
 		free($2);
 	}
 	;
+server_infra_cache_min_rtt: VAR_INFRA_CACHE_MIN_RTT STRING_ARG
+	{
+		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->infra_cache_min_rtt = atoi($2);
+		free($2);
+	}
+	;
 server_target_fetch_policy: VAR_TARGET_FETCH_POLICY STRING_ARG
 	{
 		OUTYY(("P(server_target_fetch_policy:%s)\n", $2));
@@ -834,6 +858,16 @@ server_harden_referral_path: VAR_HARDEN_REFERRAL_PATH STRING_ARG
 		free($2);
 	}
 	;
+server_harden_algo_downgrade: VAR_HARDEN_ALGO_DOWNGRADE STRING_ARG
+	{
+		OUTYY(("P(server_harden_algo_downgrade:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->harden_algo_downgrade = 
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG
 	{
 		OUTYY(("P(server_use_caps_for_id:%s)\n", $2));
@@ -1104,10 +1138,11 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 		if(strcmp($3, "static")!=0 && strcmp($3, "deny")!=0 &&
 		   strcmp($3, "refuse")!=0 && strcmp($3, "redirect")!=0 &&
 		   strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
-		   && strcmp($3, "typetransparent")!=0)
+		   && strcmp($3, "typetransparent")!=0 &&
+		   strcmp($3, "inform")!=0)
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
-				"typetransparent or nodefault");
+				"typetransparent, inform or nodefault");
 		else if(strcmp($3, "nodefault")==0) {
 			if(!cfg_strlist_insert(&cfg_parser->cfg->
 				local_zones_nodefault, $2))
@@ -1270,7 +1305,7 @@ contents_rc: contents_rc content_rc
 	| ;
 content_rc: rc_control_enable | rc_control_interface | rc_control_port |
 	rc_server_key_file | rc_server_cert_file | rc_control_key_file |
-	rc_control_cert_file
+	rc_control_cert_file | rc_control_use_cert
 	;
 rc_control_enable: VAR_CONTROL_ENABLE STRING_ARG
 	{
@@ -1298,6 +1333,16 @@ rc_control_interface: VAR_CONTROL_INTERFACE STRING_ARG
 			yyerror("out of memory");
 	}
 	;
+rc_control_use_cert: VAR_CONTROL_USE_CERT STRING_ARG
+	{
+		OUTYY(("P(control_use_cert:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->remote_control_use_cert =
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 rc_server_key_file: VAR_SERVER_KEY_FILE STRING_ARG
 	{
 		OUTYY(("P(rc_server_key_file:%s)\n", $2));
diff --git a/external/unbound/util/data/dname.c b/external/unbound/util/data/dname.c
index d43bbf6d..79bf52ad 100644
--- a/external/unbound/util/data/dname.c
+++ b/external/unbound/util/data/dname.c
@@ -45,7 +45,7 @@
 #include "util/data/msgparse.h"
 #include "util/log.h"
 #include "util/storage/lookup3.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /* determine length of a dname in buffer, no compression pointers allowed */
 size_t
diff --git a/external/unbound/util/data/msgencode.c b/external/unbound/util/data/msgencode.c
index 26b5deab..f9a8c5f6 100644
--- a/external/unbound/util/data/msgencode.c
+++ b/external/unbound/util/data/msgencode.c
@@ -47,7 +47,7 @@
 #include "util/log.h"
 #include "util/regional.h"
 #include "util/net_help.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** return code that means the function ran out of memory. negative so it does
  * not conflict with DNS rcodes. */
diff --git a/external/unbound/util/data/msgparse.c b/external/unbound/util/data/msgparse.c
index abe778a8..108c9dac 100644
--- a/external/unbound/util/data/msgparse.c
+++ b/external/unbound/util/data/msgparse.c
@@ -42,10 +42,10 @@
 #include "util/data/packed_rrset.h"
 #include "util/storage/lookup3.h"
 #include "util/regional.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
 
 /** smart comparison of (compressed, valid) dnames from packet */
 static int
diff --git a/external/unbound/util/data/msgparse.h b/external/unbound/util/data/msgparse.h
index 221a45aa..1a5ced35 100644
--- a/external/unbound/util/data/msgparse.h
+++ b/external/unbound/util/data/msgparse.h
@@ -63,8 +63,8 @@
 #ifndef UTIL_DATA_MSGPARSE_H
 #define UTIL_DATA_MSGPARSE_H
 #include "util/storage/lruhash.h"
-#include "ldns/pkthdr.h"
-#include "ldns/rrdef.h"
+#include "sldns/pkthdr.h"
+#include "sldns/rrdef.h"
 struct sldns_buffer;
 struct rrset_parse;
 struct rr_parse;
diff --git a/external/unbound/util/data/msgreply.c b/external/unbound/util/data/msgreply.c
index 68bcfd09..dc27be90 100644
--- a/external/unbound/util/data/msgreply.c
+++ b/external/unbound/util/data/msgreply.c
@@ -50,8 +50,8 @@
 #include "util/regional.h"
 #include "util/data/msgparse.h"
 #include "util/data/msgencode.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
 
 /** MAX TTL default for messages and rrsets */
 time_t MAX_TTL = 3600 * 24 * 10; /* ten days */
@@ -87,6 +87,7 @@ construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
 	/* rrset_count-1 because the first ref is part of the struct. */
 	size_t s = sizeof(struct reply_info) - sizeof(struct rrset_ref) +
 		sizeof(struct ub_packed_rrset_key*) * total;
+	if(total >= RR_COUNT_MAX) return NULL; /* sanity check on numRRS*/
 	if(region)
 		rep = (struct reply_info*)regional_alloc(region, s);
 	else	rep = (struct reply_info*)malloc(s + 
@@ -277,7 +278,11 @@ parse_create_rrset(sldns_buffer* pkt, struct rrset_parse* pset,
 	struct packed_rrset_data** data, struct regional* region)
 {
 	/* allocate */
-	size_t s = sizeof(struct packed_rrset_data) + 
+	size_t s;
+	if(pset->rr_count > RR_COUNT_MAX || pset->rrsig_count > RR_COUNT_MAX ||
+		pset->size > RR_COUNT_MAX)
+		return 0; /* protect against integer overflow */
+	s = sizeof(struct packed_rrset_data) + 
 		(pset->rr_count + pset->rrsig_count) * 
 		(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t)) + 
 		pset->size;
diff --git a/external/unbound/util/data/packed_rrset.c b/external/unbound/util/data/packed_rrset.c
index 80746857..0a5c9d32 100644
--- a/external/unbound/util/data/packed_rrset.c
+++ b/external/unbound/util/data/packed_rrset.c
@@ -47,9 +47,9 @@
 #include "util/alloc.h"
 #include "util/regional.h"
 #include "util/net_help.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
 
 void
 ub_packed_rrset_parsedelete(struct ub_packed_rrset_key* pkey,
diff --git a/external/unbound/util/data/packed_rrset.h b/external/unbound/util/data/packed_rrset.h
index 5d7990a2..6039aef2 100644
--- a/external/unbound/util/data/packed_rrset.h
+++ b/external/unbound/util/data/packed_rrset.h
@@ -58,6 +58,12 @@ typedef uint64_t rrset_id_t;
  * from the SOA in the answer section from a direct SOA query or ANY query. */
 #define PACKED_RRSET_SOA_NEG 0x4
 
+/** number of rrs and rrsets for integer overflow protection.  More than
+ * this is not really possible (64K packet has much less RRs and RRsets) in
+ * a message.  And this is small enough that also multiplied there is no
+ * integer overflow. */
+#define RR_COUNT_MAX 0xffffff
+
 /**
  * The identifying information for an RRset.
  */
diff --git a/external/unbound/util/iana_ports.inc b/external/unbound/util/iana_ports.inc
index d318477e..9cedc80e 100644
--- a/external/unbound/util/iana_ports.inc
+++ b/external/unbound/util/iana_ports.inc
@@ -3819,6 +3819,7 @@
 4359,
 4361,
 4362,
+4366,
 4368,
 4369,
 4370,
@@ -4358,6 +4359,7 @@
 6072,
 6073,
 6074,
+6080,
 6081,
 6082,
 6083,
@@ -4399,6 +4401,7 @@
 6163,
 6200,
 6201,
+6209,
 6222,
 6241,
 6242,
@@ -4488,6 +4491,8 @@
 6628,
 6633,
 6634,
+6635,
+6636,
 6653,
 6657,
 6670,
@@ -4671,6 +4676,7 @@
 7778,
 7779,
 7781,
+7784,
 7786,
 7787,
 7789,
@@ -4839,6 +4845,8 @@
 8912,
 8913,
 8954,
+8980,
+8981,
 8989,
 8990,
 8991,
@@ -4846,6 +4854,7 @@
 9000,
 9001,
 9002,
+9006,
 9007,
 9009,
 9020,
@@ -5230,6 +5239,7 @@
 22005,
 22273,
 22305,
+22335,
 22343,
 22347,
 22350,
diff --git a/external/unbound/util/log.c b/external/unbound/util/log.c
index f90efa71..3ebd1202 100644
--- a/external/unbound/util/log.c
+++ b/external/unbound/util/log.c
@@ -40,7 +40,7 @@
 #include "config.h"
 #include "util/log.h"
 #include "util/locks.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include <stdarg.h>
 #ifdef HAVE_TIME_H
 #include <time.h>
@@ -164,6 +164,14 @@ void log_thread_set(int* num)
 	ub_thread_key_set(logkey, num);
 }
 
+int log_thread_get(void)
+{
+	unsigned int* tid;
+	if(!key_created) return 0;
+	tid = (unsigned int*)ub_thread_key_get(logkey);
+	return (int)(tid?*tid:0);
+}
+
 void log_ident_set(const char* id)
 {
 	ident = id;
diff --git a/external/unbound/util/log.h b/external/unbound/util/log.h
index ea283da7..8e85ee62 100644
--- a/external/unbound/util/log.h
+++ b/external/unbound/util/log.h
@@ -97,6 +97,15 @@ void log_file(FILE *f);
  */
 void log_thread_set(int* num);
 
+/**
+ * Get the thread id from logging system.  Set after log_init is
+ * initialised, or log_thread_set for newly created threads.
+ * This initialisation happens in unbound as a daemon, in daemon
+ * startup code, when that spawns threads.
+ * @return thread number, from 0 and up.  Before initialised, returns 0.
+ */
+int log_thread_get(void);
+
 /**
  * Set identity to print, default is 'unbound'. 
  * @param id: string to print. Name of executable.
diff --git a/external/unbound/util/net_help.c b/external/unbound/util/net_help.c
index 8c2bac73..8b39af6b 100644
--- a/external/unbound/util/net_help.c
+++ b/external/unbound/util/net_help.c
@@ -43,8 +43,8 @@
 #include "util/data/dname.h"
 #include "util/module.h"
 #include "util/regional.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
 #include <fcntl.h>
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
@@ -156,7 +156,12 @@ log_addr(enum verbosity_value v, const char* str,
 		case AF_INET6: family="ip6";
 			sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
 			break;
-		case AF_UNIX: family="unix"; break;
+		case AF_LOCAL:
+			dest[0]=0;
+			(void)inet_ntop(af, sinaddr, dest,
+				(socklen_t)sizeof(dest));
+			verbose(v, "%s local %s", str, dest);
+			return; /* do not continue and try to get port */
 		default: break;
 	}
 	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
@@ -313,7 +318,7 @@ void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone,
 		case AF_INET6: family="";
 			sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
 			break;
-		case AF_UNIX: family="unix_family "; break;
+		case AF_LOCAL: family="local "; break;
 		default: break;
 	}
 	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
@@ -765,7 +770,7 @@ static lock_basic_t *ub_openssl_locks = NULL;
 static unsigned long
 ub_crypto_id_cb(void)
 {
-	return (unsigned long)ub_thread_self();
+	return (unsigned long)log_thread_get();
 }
 
 static void
@@ -784,8 +789,8 @@ int ub_openssl_lock_init(void)
 {
 #if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	int i;
-	ub_openssl_locks = (lock_basic_t*)malloc(
-		sizeof(lock_basic_t)*CRYPTO_num_locks());
+	ub_openssl_locks = (lock_basic_t*)reallocarray(
+		NULL, (size_t)CRYPTO_num_locks(), sizeof(lock_basic_t));
 	if(!ub_openssl_locks)
 		return 0;
 	for(i=0; i<CRYPTO_num_locks(); i++) {
diff --git a/external/unbound/util/netevent.c b/external/unbound/util/netevent.c
index c7ed30e6..9f1e8695 100644
--- a/external/unbound/util/netevent.c
+++ b/external/unbound/util/netevent.c
@@ -43,8 +43,8 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/fptr_wlist.h"
-#include "ldns/pkthdr.h"
-#include "ldns/sbuffer.h"
+#include "sldns/pkthdr.h"
+#include "sldns/sbuffer.h"
 #include "dnstap/dnstap.h"
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
@@ -879,12 +879,12 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
 	}
 
 	/* grab the tcp handler buffers */
+	c->cur_tcp_count++;
 	c->tcp_free = c_hdl->tcp_free;
 	if(!c->tcp_free) {
 		/* stop accepting incoming queries for now. */
 		comm_point_stop_listening(c);
 	}
-	/* addr is dropped. Not needed for tcp reply. */
 	setup_tcp_handler(c_hdl, new_fd);
 }
 
@@ -902,6 +902,7 @@ reclaim_tcp_handler(struct comm_point* c)
 	}
 	comm_point_close(c);
 	if(c->tcp_parent) {
+		c->tcp_parent->cur_tcp_count--;
 		c->tcp_free = c->tcp_parent->tcp_free;
 		c->tcp_parent->tcp_free = c;
 		if(!c->tcp_free) {
@@ -1528,6 +1529,7 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_udp;
@@ -1578,6 +1580,7 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_udp;
@@ -1639,6 +1642,7 @@ comm_point_create_tcp_handler(struct comm_base *base,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = parent;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_tcp;
@@ -1691,6 +1695,7 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num, size_t bufsize,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = num;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = (struct comm_point**)calloc((size_t)num,
 		sizeof(struct comm_point*));
 	if(!c->tcp_handlers) {
@@ -1758,6 +1763,7 @@ comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_tcp;
@@ -1810,6 +1816,7 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_local;
@@ -1857,6 +1864,7 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_raw;
diff --git a/external/unbound/util/netevent.h b/external/unbound/util/netevent.h
index 37322ab9..4b87cdba 100644
--- a/external/unbound/util/netevent.h
+++ b/external/unbound/util/netevent.h
@@ -164,6 +164,8 @@ struct comm_point {
 	/* -------- TCP Accept -------- */
 	/** the number of TCP handlers for this tcp-accept socket */
 	int max_tcp_count;
+	/** current number of tcp handler in-use for this accept socket */
+	int cur_tcp_count;
 	/** malloced array of tcp handlers for a tcp-accept, 
 	    of size max_tcp_count. */
 	struct comm_point** tcp_handlers;
diff --git a/external/unbound/util/rtt.c b/external/unbound/util/rtt.c
index 4b44fca5..5d86f133 100644
--- a/external/unbound/util/rtt.c
+++ b/external/unbound/util/rtt.c
@@ -42,6 +42,8 @@
 #include "config.h"
 #include "util/rtt.h"
 
+/* overwritten by config: infra_cache_min_rtt: */
+int RTT_MIN_TIMEOUT = 50;
 /** calculate RTO from rtt information */
 static int
 calc_rto(const struct rtt_info* rtt)
diff --git a/external/unbound/util/rtt.h b/external/unbound/util/rtt.h
index 57e904d1..d6da9860 100644
--- a/external/unbound/util/rtt.h
+++ b/external/unbound/util/rtt.h
@@ -56,7 +56,7 @@ struct rtt_info {
 };
 
 /** min retransmit timeout value, in milliseconds */
-#define RTT_MIN_TIMEOUT	50
+extern int RTT_MIN_TIMEOUT;
 /** max retransmit timeout value, in milliseconds */
 #define RTT_MAX_TIMEOUT 120000
 
diff --git a/external/unbound/validator/autotrust.c b/external/unbound/validator/autotrust.c
index 5e1dc4ef..bb572346 100644
--- a/external/unbound/validator/autotrust.c
+++ b/external/unbound/validator/autotrust.c
@@ -57,11 +57,11 @@
 #include "services/mesh.h"
 #include "services/cache/rrset.h"
 #include "validator/val_kcache.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
-#include "ldns/str2wire.h"
-#include "ldns/keyraw.h"
-#include "ldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
+#include "sldns/keyraw.h"
+#include "sldns/rrdef.h"
 #include <stdarg.h>
 #include <ctype.h>
 
diff --git a/external/unbound/validator/val_anchor.c b/external/unbound/validator/val_anchor.c
index 3a67fff4..845b54a2 100644
--- a/external/unbound/validator/val_anchor.c
+++ b/external/unbound/validator/val_anchor.c
@@ -48,9 +48,9 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/config_file.h"
-#include "ldns/sbuffer.h"
-#include "ldns/rrdef.h"
-#include "ldns/str2wire.h"
+#include "sldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/str2wire.h"
 #ifdef HAVE_GLOB_H
 #include <glob.h>
 #endif
@@ -882,14 +882,14 @@ assemble_it(struct trust_anchor* ta, size_t num, uint16_t type)
 	memset(pd, 0, sizeof(*pd));
 	pd->count = num;
 	pd->trust = rrset_trust_ultimate;
-	pd->rr_len = (size_t*)malloc(num*sizeof(size_t));
+	pd->rr_len = (size_t*)reallocarray(NULL, num, sizeof(size_t));
 	if(!pd->rr_len) {
 		free(pd);
 		free(pkey->rk.dname);
 		free(pkey);
 		return NULL;
 	}
-	pd->rr_ttl = (time_t*)malloc(num*sizeof(time_t));
+	pd->rr_ttl = (time_t*)reallocarray(NULL, num, sizeof(time_t));
 	if(!pd->rr_ttl) {
 		free(pd->rr_len);
 		free(pd);
@@ -897,7 +897,7 @@ assemble_it(struct trust_anchor* ta, size_t num, uint16_t type)
 		free(pkey);
 		return NULL;
 	}
-	pd->rr_data = (uint8_t**)malloc(num*sizeof(uint8_t*));
+	pd->rr_data = (uint8_t**)reallocarray(NULL, num, sizeof(uint8_t*));
 	if(!pd->rr_data) {
 		free(pd->rr_ttl);
 		free(pd->rr_len);
@@ -1020,7 +1020,13 @@ anchors_assemble_rrsets(struct val_anchors* anchors)
 			dname_str(ta->name, b);
 			log_warn("trust anchor %s has no supported algorithms,"
 				" the anchor is ignored (check if you need to"
-				" upgrade unbound and openssl)", b);
+				" upgrade unbound and "
+#ifdef HAVE_LIBRESSL
+				"libressl"
+#else
+				"openssl"
+#endif
+				")", b);
 			(void)rbtree_delete(anchors->tree, &ta->node);
 			lock_basic_unlock(&ta->lock);
 			anchors_delfunc(&ta->node, NULL);
diff --git a/external/unbound/validator/val_kentry.c b/external/unbound/validator/val_kentry.c
index f99f18e8..93fe2145 100644
--- a/external/unbound/validator/val_kentry.c
+++ b/external/unbound/validator/val_kentry.c
@@ -45,8 +45,8 @@
 #include "util/storage/lookup3.h"
 #include "util/regional.h"
 #include "util/net_help.h"
-#include "ldns/rrdef.h"
-#include "ldns/keyraw.h"
+#include "sldns/rrdef.h"
+#include "sldns/keyraw.h"
 
 size_t 
 key_entry_sizefunc(void* key, void* data)
diff --git a/external/unbound/validator/val_neg.c b/external/unbound/validator/val_neg.c
index 1d7a5c56..b1ff8d9a 100644
--- a/external/unbound/validator/val_neg.c
+++ b/external/unbound/validator/val_neg.c
@@ -59,8 +59,8 @@
 #include "util/config_file.h"
 #include "services/cache/rrset.h"
 #include "services/cache/dns.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
 
 int val_neg_data_compare(const void* a, const void* b)
 {
diff --git a/external/unbound/validator/val_nsec3.c b/external/unbound/validator/val_nsec3.c
index 548daf2b..80ca4d0b 100644
--- a/external/unbound/validator/val_nsec3.c
+++ b/external/unbound/validator/val_nsec3.c
@@ -62,7 +62,7 @@
 #include "util/data/msgreply.h"
 /* we include nsec.h for the bitmap_has_type function */
 #include "validator/val_nsec.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** 
  * This function we get from ldns-compat or from base system 
diff --git a/external/unbound/validator/val_secalgo.c b/external/unbound/validator/val_secalgo.c
index d89675f8..8ed403df 100644
--- a/external/unbound/validator/val_secalgo.c
+++ b/external/unbound/validator/val_secalgo.c
@@ -41,12 +41,13 @@
  * and do the library calls (for the crypto library in use).
  */
 #include "config.h"
-#include "validator/val_secalgo.h"
+/* packed_rrset on top to define enum types (forced by c99 standard) */
 #include "util/data/packed_rrset.h"
+#include "validator/val_secalgo.h"
 #include "util/log.h"
-#include "ldns/rrdef.h"
-#include "ldns/keyraw.h"
-#include "ldns/sbuffer.h"
+#include "sldns/rrdef.h"
+#include "sldns/keyraw.h"
+#include "sldns/sbuffer.h"
 
 #if !defined(HAVE_SSL) && !defined(HAVE_NSS)
 #error "Need crypto library to do digital signature cryptography"
diff --git a/external/unbound/validator/val_sigcrypt.c b/external/unbound/validator/val_sigcrypt.c
index 5a4d0f47..7c643cab 100644
--- a/external/unbound/validator/val_sigcrypt.c
+++ b/external/unbound/validator/val_sigcrypt.c
@@ -51,10 +51,10 @@
 #include "util/module.h"
 #include "util/net_help.h"
 #include "util/regional.h"
-#include "ldns/keyraw.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
+#include "sldns/keyraw.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
 
 #include <ctype.h>
 #if !defined(HAVE_SSL) && !defined(HAVE_NSS)
@@ -1079,6 +1079,8 @@ int rrset_canonical_equal(struct regional* region,
 	fd.rr_data = fdata;
 	rbtree_init(&sortree1, &canonical_tree_compare);
 	rbtree_init(&sortree2, &canonical_tree_compare);
+	if(d1->count > RR_COUNT_MAX || d2->count > RR_COUNT_MAX)
+		return 1; /* protection against integer overflow */
 	rrs1 = regional_alloc(region, sizeof(struct canon_rr)*d1->count);
 	rrs2 = regional_alloc(region, sizeof(struct canon_rr)*d2->count);
 	if(!rrs1 || !rrs2) return 1; /* alloc failure */
@@ -1135,6 +1137,8 @@ rrset_canonical(struct regional* region, sldns_buffer* buf,
 			sizeof(rbtree_t));
 		if(!*sortree)
 			return 0;
+		if(d->count > RR_COUNT_MAX)
+			return 0; /* integer overflow protection */
 		rrs = regional_alloc(region, sizeof(struct canon_rr)*d->count);
 		if(!rrs) {
 			*sortree = NULL;
diff --git a/external/unbound/validator/val_utils.c b/external/unbound/validator/val_utils.c
index ecf2dfaf..475b0c90 100644
--- a/external/unbound/validator/val_utils.c
+++ b/external/unbound/validator/val_utils.c
@@ -846,6 +846,18 @@ val_fill_reply(struct reply_info* chase, struct reply_info* orig,
 		chase->ar_numrrsets;
 }
 
+void val_reply_remove_auth(struct reply_info* rep, size_t index)
+{
+	log_assert(index < rep->rrset_count);
+	log_assert(index >= rep->an_numrrsets);
+	log_assert(index < rep->an_numrrsets+rep->ns_numrrsets);
+	memmove(rep->rrsets+index, rep->rrsets+index+1,
+		sizeof(struct ub_packed_rrset_key*)*
+		(rep->rrset_count - index - 1));
+	rep->ns_numrrsets--;
+	rep->rrset_count--;
+}
+
 void
 val_check_nonsecure(struct val_env* ve, struct reply_info* rep) 
 {
diff --git a/external/unbound/validator/val_utils.h b/external/unbound/validator/val_utils.h
index b0344eff..cdb87697 100644
--- a/external/unbound/validator/val_utils.h
+++ b/external/unbound/validator/val_utils.h
@@ -294,6 +294,13 @@ int val_chase_cname(struct query_info* qchase, struct reply_info* rep,
 void val_fill_reply(struct reply_info* chase, struct reply_info* orig, 
 	size_t cname_skip, uint8_t* name, size_t len, uint8_t* signer);
 
+/**
+ * Remove rrset with index from reply, from the authority section.
+ * @param rep: reply to remove it from.
+ * @param index: rrset to remove, must be in the authority section.
+ */
+void val_reply_remove_auth(struct reply_info* rep, size_t index);
+
 /**
  * Remove all unsigned or non-secure status rrsets from NS and AR sections.
  * So that unsigned data does not get let through to clients, when we have
diff --git a/external/unbound/validator/validator.c b/external/unbound/validator/validator.c
index 9d5d5c39..a02525fe 100644
--- a/external/unbound/validator/validator.c
+++ b/external/unbound/validator/validator.c
@@ -58,8 +58,8 @@
 #include "util/regional.h"
 #include "util/config_file.h"
 #include "util/fptr_wlist.h"
-#include "ldns/rrdef.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/wire2str.h"
 
 /* forward decl for cache response and normal super inform calls of a DS */
 static void process_ds_response(struct module_qstate* qstate, 
@@ -226,6 +226,8 @@ val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
 	if(!vq->chase_reply)
 		return NULL;
+	if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX)
+		return NULL; /* protect against integer overflow */
 	vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
 		vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
 			* vq->orig_msg->rep->rrset_count);
@@ -574,6 +576,61 @@ detect_wrongly_truncated(struct reply_info* rep)
 	return 1;
 }
 
+/**
+ * For messages that are not referrals, if the chase reply contains an
+ * unsigned NS record in the authority section it could have been
+ * inserted by a (BIND) forwarder that thinks the zone is insecure, and
+ * that has an NS record without signatures in cache.  Remove the NS
+ * record since the reply does not hinge on that record (in the authority
+ * section), but do not remove it if it removes the last record from the
+ * answer+authority sections.
+ * @param chase_reply: the chased reply, we have a key for this contents,
+ * 	so we should have signatures for these rrsets and not having
+ * 	signatures means it will be bogus.
+ * @param orig_reply: original reply, remove NS from there as well because
+ * 	we cannot mark the NS record as DNSSEC valid because it is not
+ * 	validated by signatures.
+ */
+static void
+remove_spurious_authority(struct reply_info* chase_reply,
+	struct reply_info* orig_reply)
+{
+	size_t i, found = 0;
+	int remove = 0;
+	/* if no answer and only 1 auth RRset, do not remove that one */
+	if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1)
+		return;
+	/* search authority section for unsigned NS records */
+	for(i = chase_reply->an_numrrsets;
+		i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) {
+		struct packed_rrset_data* d = (struct packed_rrset_data*)
+			chase_reply->rrsets[i]->entry.data;
+		if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
+			&& d->rrsig_count == 0) {
+			found = i;
+			remove = 1;
+			break;
+		}
+	}
+	/* see if we found the entry */
+	if(!remove) return;
+	log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record "
+		"(likely inserted by forwarder)", chase_reply->rrsets[found]);
+
+	/* find rrset in orig_reply */
+	for(i = orig_reply->an_numrrsets;
+		i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) {
+		if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
+			&& query_dname_compare(orig_reply->rrsets[i]->rk.dname,
+				chase_reply->rrsets[found]->rk.dname) == 0) {
+			/* remove from orig_msg */
+			val_reply_remove_auth(orig_reply, i);
+			break;
+		}
+	}
+	/* remove rrset from chase_reply */
+	val_reply_remove_auth(chase_reply, found);
+}
 
 /**
  * Given a "positive" response -- a response that contains an answer to the
@@ -1642,6 +1699,8 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 	}
 	subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
 		&vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
+	if(subtype != VAL_CLASS_REFERRAL)
+		remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
 
 	/* check signatures in the message; 
 	 * answer and authority must be valid, additional is only checked. */
@@ -2295,7 +2354,7 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
 	struct key_entry_key* kkey = NULL;
 	enum sec_status sec = sec_status_unchecked;
 	char* reason = NULL;
-	int downprot = 1;
+	int downprot = qstate->env->cfg->harden_algo_downgrade;
 
 	if(!dnskey_rrset) {
 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
diff --git a/external/unbound/winrc/README.txt b/external/unbound/winrc/README.txt
index e40204bb..d36fff14 100644
--- a/external/unbound/winrc/README.txt
+++ b/external/unbound/winrc/README.txt
@@ -10,7 +10,7 @@ See LICENSE for the license text file.
 Unbound is a recursive DNS server.  It does caching, full recursion, stub
 recursion, DNSSEC validation, NSEC3, IPv6.  More information can be found 
 at the http://unbound.net site.  Unbound has been built and tested on 
-Windows XP, Vista and 7.
+Windows XP, Vista, 7 and 8.
 
 At http://unbound.net/documentation is an install and configuration manual
 for windows.
diff --git a/external/unbound/winrc/anchor-update.c b/external/unbound/winrc/anchor-update.c
index 2b22e014..13d44fda 100644
--- a/external/unbound/winrc/anchor-update.c
+++ b/external/unbound/winrc/anchor-update.c
@@ -41,9 +41,9 @@
  */
 #include "config.h"
 #include "libunbound/unbound.h"
-#include "ldns/rrdef.h"
-#include "ldns/pkthdr.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/pkthdr.h"
+#include "sldns/wire2str.h"
 
 /** usage */
 static void
diff --git a/external/unbound/winrc/combined.ico b/external/unbound/winrc/combined.ico
index b0a4f4d1..aa65d11e 100644
Binary files a/external/unbound/winrc/combined.ico and b/external/unbound/winrc/combined.ico differ
diff --git a/external/unbound/winrc/gen_msg.bin b/external/unbound/winrc/gen_msg.bin
index ed8f79e6..6e560057 100644
Binary files a/external/unbound/winrc/gen_msg.bin and b/external/unbound/winrc/gen_msg.bin differ
diff --git a/external/unbound/winrc/setup_left.bmp b/external/unbound/winrc/setup_left.bmp
index a013276a..ddc17d07 100644
Binary files a/external/unbound/winrc/setup_left.bmp and b/external/unbound/winrc/setup_left.bmp differ
diff --git a/external/unbound/winrc/setup_top.bmp b/external/unbound/winrc/setup_top.bmp
index a7404c83..79998ec6 100644
Binary files a/external/unbound/winrc/setup_top.bmp and b/external/unbound/winrc/setup_top.bmp differ
diff --git a/external/unbound/winrc/unbound16.ico b/external/unbound/winrc/unbound16.ico
index 06d82e57..e62634b7 100644
Binary files a/external/unbound/winrc/unbound16.ico and b/external/unbound/winrc/unbound16.ico differ
diff --git a/external/unbound/winrc/unbound32.ico b/external/unbound/winrc/unbound32.ico
index 7e5b3a72..64272eed 100644
Binary files a/external/unbound/winrc/unbound32.ico and b/external/unbound/winrc/unbound32.ico differ
diff --git a/external/unbound/winrc/unbound48.ico b/external/unbound/winrc/unbound48.ico
index cb729146..074d12eb 100644
Binary files a/external/unbound/winrc/unbound48.ico and b/external/unbound/winrc/unbound48.ico differ
diff --git a/external/unbound/winrc/unbound64.ico b/external/unbound/winrc/unbound64.ico
index ca2362e5..c02f68f0 100644
Binary files a/external/unbound/winrc/unbound64.ico and b/external/unbound/winrc/unbound64.ico differ
diff --git a/external/unbound/winrc/unbound64.png b/external/unbound/winrc/unbound64.png
index 78d83156..b37bf3f1 100644
Binary files a/external/unbound/winrc/unbound64.png and b/external/unbound/winrc/unbound64.png differ