import unbound 1.5.10vendor/unbound/1.5.10

87 files changed, 6224 insertions, 3614 deletions

diff --git a/Makefile.in b/Makefile.in
index b064e655df00..77e38eaa5142 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -81,7 +81,7 @@ LINTFLAGS+=@NETBSD_LINTFLAGS@
 # compat with OpenBSD
 LINTFLAGS+="-Dsigset_t=long"
 # FreeBSD
-LINTFLAGS+="-D__uint16_t=uint16_t" "-DEVP_PKEY_ASN1_METHOD=int" "-D_RuneLocale=int" "-D__va_list=va_list"
+LINTFLAGS+="-D__uint16_t=uint16_t" "-DEVP_PKEY_ASN1_METHOD=int" "-D_RuneLocale=int" "-D__va_list=va_list" "-D__uint32_t=uint32_t"
 
 INSTALL=$(SHELL) $(srcdir)/install-sh
 
@@ -228,7 +228,7 @@ SVCUNINST_OBJ_LINK=$(SVCUNINST_OBJ) w_inst.lo rsrc_svcuninst.o \
 $(COMPAT_OBJ_WITHOUT_CTIMEARC4)
 ANCHORUPD_SRC=winrc/anchor-update.c
 ANCHORUPD_OBJ=anchor-update.lo
-ANCHORUPD_OBJ_LINK=$(ANCHORUPD_OBJ) rsrc_anchorupd.o $(COMPAT_OBJ_WITHOUT_CTIMEARC4)
+ANCHORUPD_OBJ_LINK=$(ANCHORUPD_OBJ) rsrc_anchorupd.o $(COMPAT_OBJ_WITHOUT_CTIMEARC4) wire2str.lo str2wire.lo parseutil.lo sbuffer.lo  rrdef.lo keyraw.lo  parse.lo
 RSRC_OBJ=rsrc_svcinst.o rsrc_svcuninst.o rsrc_anchorupd.o rsrc_unbound.o \
 	rsrc_unbound_host.o rsrc_unbound_anchor.o rsrc_unbound_control.o \
 	rsrc_unbound_checkconf.o
@@ -704,11 +704,12 @@ listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h
  $(srcdir)/util/rbtree.h  $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h
 localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/as112.h
+ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/netevent.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/util/as112.h
 mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
@@ -759,7 +760,7 @@ fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
  $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h  \
- $(srcdir)/services/localzone.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
@@ -956,7 +957,8 @@ unitldns.lo unitldns.o: $(srcdir)/testcode/unitldns.c config.h $(srcdir)/util/lo
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
+ $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h $(srcdir)/util/locks.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h $(srcdir)/daemon/cachedump.h \
  $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
@@ -1063,7 +1065,8 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
  $(srcdir)/libunbound/libworker.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
+ $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h $(srcdir)/util/locks.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
@@ -1134,8 +1137,8 @@ context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbou
  $(srcdir)/libunbound/unbound.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/sldns/sbuffer.h
 libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
@@ -1143,7 +1146,7 @@ libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbou
  $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h \
  $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/util/ub_event.h \
- $(srcdir)/services/localzone.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/sldns/sbuffer.h
 libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/libunbound/libworker.h \
@@ -1153,11 +1156,12 @@ libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/li
  $(srcdir)/libunbound/unbound-event.h $(srcdir)/services/outside_network.h $(srcdir)/util/netevent.h \
   $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/services/localzone.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h \
- $(srcdir)/util/random.h $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/sldns/str2wire.h
 unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
@@ -1225,7 +1229,6 @@ snprintf.lo snprintf.o: $(srcdir)/compat/snprintf.c config.h
 strlcat.lo strlcat.o: $(srcdir)/compat/strlcat.c config.h
 strlcpy.lo strlcpy.o: $(srcdir)/compat/strlcpy.c config.h
 strptime.lo strptime.o: $(srcdir)/compat/strptime.c config.h
-strsep.lo strsep.o: $(srcdir)/compat/strsep.c config.h
 getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h
 getentropy_osx.lo getentropy_osx.o: $(srcdir)/compat/getentropy_osx.c config.h
 getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h
@@ -1237,3 +1240,4 @@ arc4_lock.lo arc4_lock.o: $(srcdir)/compat/arc4_lock.c config.h $(srcdir)/util/l
 sha512.lo sha512.o: $(srcdir)/compat/sha512.c config.h
 reallocarray.lo reallocarray.o: $(srcdir)/compat/reallocarray.c config.h
 isblank.lo isblank.o: $(srcdir)/compat/isblank.c config.h
+strsep.lo strsep.o: $(srcdir)/compat/strsep.c config.h
diff --git a/acx_python.m4 b/acx_python.m4
index 254ff2096280..4e83d7764bcd 100644
--- a/acx_python.m4
+++ b/acx_python.m4
@@ -54,7 +54,7 @@ $ac_distutils_result])
         AC_MSG_CHECKING([for Python library path])
         if test -z "$PYTHON_LDFLAGS"; then
                 PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
-                        print(get_config_var('BLDLIBRARY'));"`
+                        print('-L'+get_config_var('LIBDIR')+' -L'+get_config_var('LIBDEST')+' '+get_config_var('BLDLIBRARY'));"`
         fi
         AC_MSG_RESULT([$PYTHON_LDFLAGS])
         AC_SUBST([PYTHON_LDFLAGS])
diff --git a/compat/arc4random.c b/compat/arc4random.c
index 2c859f184929..a09665c5df22 100644
--- a/compat/arc4random.c
+++ b/compat/arc4random.c
@@ -48,6 +48,9 @@
 #else				/* !__GNUC__ */
 #define inline
 #endif				/* !__GNUC__ */
+#ifndef MAP_ANON
+#define MAP_ANON MAP_ANONYMOUS
+#endif
 
 #define KEYSZ	32
 #define IVSZ	8
diff --git a/compat/getentropy_linux.c b/compat/getentropy_linux.c
index f8c5e0f7ee59..b86c0fba2a1f 100644
--- a/compat/getentropy_linux.c
+++ b/compat/getentropy_linux.c
@@ -60,6 +60,9 @@
 #include <sys/auxv.h>
 #endif
 #include <sys/vfs.h>
+#ifndef MAP_ANON
+#define MAP_ANON MAP_ANONYMOUS
+#endif
 
 #define REPEAT 5
 #define min(a, b) (((a) < (b)) ? (a) : (b))
diff --git a/config.h.in b/config.h.in
index b982629ea4d2..04fc74396e95 100644
--- a/config.h.in
+++ b/config.h.in
@@ -51,6 +51,9 @@
 /* Define to 1 if you have the `chroot' function. */
 #undef HAVE_CHROOT
 
+/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
+#undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
+
 /* Define to 1 if you have the `ctime_r' function. */
 #undef HAVE_CTIME_R
 
@@ -110,9 +113,18 @@
 /* Define to 1 if you have the `endprotoent' function. */
 #undef HAVE_ENDPROTOENT
 
+/* Define to 1 if you have the `endpwent' function. */
+#undef HAVE_ENDPWENT
+
 /* Define to 1 if you have the `endservent' function. */
 #undef HAVE_ENDSERVENT
 
+/* Define to 1 if you have the `ERR_free_strings' function. */
+#undef HAVE_ERR_FREE_STRINGS
+
+/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
+#undef HAVE_ERR_LOAD_CRYPTO_STRINGS
+
 /* Define to 1 if you have the `event_base_free' function. */
 #undef HAVE_EVENT_BASE_FREE
 
@@ -128,6 +140,9 @@
 /* Define to 1 if you have the <event.h> header file. */
 #undef HAVE_EVENT_H
 
+/* Define to 1 if you have the `EVP_cleanup' function. */
+#undef HAVE_EVP_CLEANUP
+
 /* Define to 1 if you have the `EVP_MD_CTX_new' function. */
 #undef HAVE_EVP_MD_CTX_NEW
 
@@ -254,24 +269,48 @@
 /* Use libnettle for crypto */
 #undef HAVE_NETTLE
 
+/* Define to 1 if you have the <nettle/dsa-compat.h> header file. */
+#undef HAVE_NETTLE_DSA_COMPAT_H
+
 /* Use libnss for crypto */
 #undef HAVE_NSS
 
+/* Define to 1 if you have the `OpenSSL_add_all_digests' function. */
+#undef HAVE_OPENSSL_ADD_ALL_DIGESTS
+
+/* Define to 1 if you have the <openssl/bn.h> header file. */
+#undef HAVE_OPENSSL_BN_H
+
 /* Define to 1 if you have the `OPENSSL_config' function. */
 #undef HAVE_OPENSSL_CONFIG
 
 /* Define to 1 if you have the <openssl/conf.h> header file. */
 #undef HAVE_OPENSSL_CONF_H
 
+/* Define to 1 if you have the <openssl/dh.h> header file. */
+#undef HAVE_OPENSSL_DH_H
+
+/* Define to 1 if you have the <openssl/dsa.h> header file. */
+#undef HAVE_OPENSSL_DSA_H
+
 /* Define to 1 if you have the <openssl/engine.h> header file. */
 #undef HAVE_OPENSSL_ENGINE_H
 
 /* Define to 1 if you have the <openssl/err.h> header file. */
 #undef HAVE_OPENSSL_ERR_H
 
+/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
+#undef HAVE_OPENSSL_INIT_CRYPTO
+
+/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
+#undef HAVE_OPENSSL_INIT_SSL
+
 /* Define to 1 if you have the <openssl/rand.h> header file. */
 #undef HAVE_OPENSSL_RAND_H
 
+/* Define to 1 if you have the <openssl/rsa.h> header file. */
+#undef HAVE_OPENSSL_RSA_H
+
 /* Define to 1 if you have the <openssl/ssl.h> header file. */
 #undef HAVE_OPENSSL_SSL_H
 
@@ -296,6 +335,9 @@
 /* Define to 1 if you have the `random' function. */
 #undef HAVE_RANDOM
 
+/* Define to 1 if you have the `RAND_cleanup' function. */
+#undef HAVE_RAND_CLEANUP
+
 /* Define to 1 if you have the `reallocarray' function. */
 #undef HAVE_REALLOCARRAY
 
@@ -610,6 +652,12 @@
 /* Define if you want to use internal select based events */
 #undef USE_MINI_EVENT
 
+/* Define this to enable client TCP Fast Open. */
+#undef USE_MSG_FASTOPEN
+
+/* Define this to enable client TCP Fast Open. */
+#undef USE_OSX_MSG_FASTOPEN
+
 /* Define this to enable SHA256 and SHA512 support. */
 #undef USE_SHA2
 
@@ -635,6 +683,9 @@
 #endif
 
 
+/* Define this to enable server TCP Fast Open. */
+#undef USE_TCP_FASTOPEN
+
 /* Whether the windows socket API is used */
 #undef USE_WINSOCK
 
diff --git a/configure b/configure
index 5b65237ddc2e..54f93db12417 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.5.9.
+# Generated by GNU Autoconf 2.69 for unbound 1.5.10.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.5.9'
-PACKAGE_STRING='unbound 1.5.9'
+PACKAGE_VERSION='1.5.10'
+PACKAGE_STRING='unbound 1.5.10'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''
 
@@ -834,6 +834,8 @@ enable_gost
 enable_ecdsa
 enable_dsa
 enable_event_api
+enable_tfo_client
+enable_tfo_server
 with_libevent
 with_libexpat
 enable_static_exe
@@ -1399,7 +1401,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.5.9 to adapt to many kinds of systems.
+\`configure' configures unbound 1.5.10 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1464,7 +1466,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.5.9:";;
+     short | recursive ) echo "Configuration of unbound 1.5.10:";;
    esac
   cat <<\_ACEOF
 
@@ -1500,6 +1502,8 @@ Optional Features:
   --disable-dsa           Disable DSA support
   --enable-event-api      Enable (experimental) pluggable event base
                           libunbound API installed to unbound-event.h
+  --enable-tfo-client     Enable TCP Fast Open for client mode
+  --enable-tfo-server     Enable TCP Fast Open for server mode
   --enable-static-exe     enable to compile executables statically against
                           (event) libs, for debug purposes
   --enable-lock-checks    enable to check lock and unlock calls, for debug
@@ -1652,7 +1656,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.5.9
+unbound configure 1.5.10
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2361,7 +2365,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.5.9, which was
+It was created by unbound $as_me 1.5.10, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2713,11 +2717,11 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=5
 
-UNBOUND_VERSION_MICRO=9
+UNBOUND_VERSION_MICRO=10
 
 
 LIBUNBOUND_CURRENT=6
-LIBUNBOUND_REVISION=1
+LIBUNBOUND_REVISION=2
 LIBUNBOUND_AGE=4
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2766,6 +2770,7 @@ LIBUNBOUND_AGE=4
 # 1.5.7 had 5:10:3
 # 1.5.8 had 6:0:4 # adds ub_ctx_set_stub
 # 1.5.9 had 6:1:4
+# 1.5.10 had 6:2:4
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -4054,7 +4059,7 @@ esac
 # are we on MinGW?
 if uname -s 2>&1 | grep MINGW32 >/dev/null; then on_mingw="yes"
 else
-	if echo $target | grep mingw32 >/dev/null; then on_mingw="yes"
+	if echo $host $target | grep mingw32 >/dev/null; then on_mingw="yes"
 	else on_mingw="no"; fi
 fi
 
@@ -4064,7 +4069,7 @@ fi
 if test $on_mingw = "no"; then
   ub_conf_file=`eval echo "${sysconfdir}/unbound/unbound.conf"`
 else
-  ub_conf_file="C:\\Program Files\\Unbound\\service.conf"
+  ub_conf_file="C:\\Program Files (x86)\\Unbound\\service.conf"
 fi
 
 # Check whether --with-conf_file was given.
@@ -4195,7 +4200,7 @@ else
   if test $on_mingw = no; then
     UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
 else
-    UNBOUND_ROOTKEY_FILE="C:\\Program Files\\Unbound\\root.key"
+    UNBOUND_ROOTKEY_FILE="C:\\Program Files (x86)\\Unbound\\root.key"
 fi
 
 fi
@@ -4217,7 +4222,7 @@ else
   if test $on_mingw = no; then
     UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
 else
-    UNBOUND_ROOTCERT_FILE="C:\\Program Files\\Unbound\\icannbundle.pem"
+    UNBOUND_ROOTCERT_FILE="C:\\Program Files (x86)\\Unbound\\icannbundle.pem"
 fi
 
 fi
@@ -16714,7 +16719,7 @@ $as_echo "$PYTHON_CPPFLAGS" >&6; }
 $as_echo_n "checking for Python library path... " >&6; }
         if test -z "$PYTHON_LDFLAGS"; then
                 PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
-                        print(get_config_var('BLDLIBRARY'));"`
+                        print('-L'+get_config_var('LIBDIR')+' -L'+get_config_var('LIBDEST')+' '+get_config_var('BLDLIBRARY'));"`
         fi
         { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_LDFLAGS" >&5
 $as_echo "$PYTHON_LDFLAGS" >&6; }
@@ -17033,6 +17038,19 @@ if test "${with_nettle+set}" = set; then :
 
 $as_echo "#define HAVE_NETTLE 1" >>confdefs.h
 
+	for ac_header in nettle/dsa-compat.h
+do :
+  ac_fn_c_check_header_compile "$LINENO" "nettle/dsa-compat.h" "ac_cv_header_nettle_dsa_compat_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_nettle_dsa_compat_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_NETTLE_DSA_COMPAT_H 1
+_ACEOF
+
+fi
+
+done
+
 	if test "$withval" != "" -a "$withval" != "yes"; then
 		CPPFLAGS="$CPPFLAGS -I$withval/include/nettle"
 		LDFLAGS="$LDFLAGS -L$withval/lib"
@@ -17397,6 +17415,47 @@ fi
 rm -f core conftest.err conftest.$ac_objext \
     conftest$ac_exeext conftest.$ac_ext
 SSLLIB="-lssl"
+
+# check if -lcrypt32 is needed because CAPIENG needs that. (on windows)
+BAKLIBS="$LIBS"
+LIBS="-lssl $LIBS"
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if libssl needs -lcrypt32" >&5
+$as_echo_n "checking if libssl needs -lcrypt32... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char HMAC_Update ();
+int
+main ()
+{
+return HMAC_Update ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	LIBS="$BAKLIBS"
+
+else
+
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+	LIBS="$BAKLIBS"
+	LIBS="$LIBS -lcrypt32"
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LibreSSL" >&5
 $as_echo_n "checking for LibreSSL... " >&6; }
 if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/null; then
@@ -17462,44 +17521,49 @@ else
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 fi
-for ac_header in openssl/conf.h
+for ac_header in openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h
 do :
-  ac_fn_c_check_header_compile "$LINENO" "openssl/conf.h" "ac_cv_header_openssl_conf_h" "$ac_includes_default
+  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
 "
-if test "x$ac_cv_header_openssl_conf_h" = xyes; then :
+if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
   cat >>confdefs.h <<_ACEOF
-#define HAVE_OPENSSL_CONF_H 1
+#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
 _ACEOF
 
 fi
 
 done
 
-for ac_header in openssl/engine.h
+for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup
 do :
-  ac_fn_c_check_header_compile "$LINENO" "openssl/engine.h" "ac_cv_header_openssl_engine_h" "$ac_includes_default
-"
-if test "x$ac_cv_header_openssl_engine_h" = xyes; then :
+  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
+ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
+if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
   cat >>confdefs.h <<_ACEOF
-#define HAVE_OPENSSL_ENGINE_H 1
+#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
 _ACEOF
 
 fi
-
 done
 
-for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new
+
+# these check_funcs need -lssl
+BAKLIBS="$LIBS"
+LIBS="-lssl $LIBS"
+for ac_func in OPENSSL_init_ssl
 do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+  ac_fn_c_check_func "$LINENO" "OPENSSL_init_ssl" "ac_cv_func_OPENSSL_init_ssl"
+if test "x$ac_cv_func_OPENSSL_init_ssl" = xyes; then :
   cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define HAVE_OPENSSL_INIT_SSL 1
 _ACEOF
 
 fi
 done
 
+LIBS="$BAKLIBS"
+
 ac_fn_c_check_decl "$LINENO" "SSL_COMP_get_compression_methods" "ac_cv_have_decl_SSL_COMP_get_compression_methods" "
 $ac_includes_default
 #ifdef HAVE_OPENSSL_ERR_H
@@ -17900,6 +17964,82 @@ case "$enable_event_api" in
       ;;
 esac
 
+# Check whether --enable-tfo-client was given.
+if test "${enable_tfo_client+set}" = set; then :
+  enableval=$enable_tfo_client;
+fi
+
+case "$enable_tfo_client" in
+	yes)
+		case `uname` in
+			Linux) ac_fn_c_check_decl "$LINENO" "MSG_FASTOPEN" "ac_cv_have_decl_MSG_FASTOPEN" "$ac_includes_default
+#include <netinet/tcp.h>
+
+"
+if test "x$ac_cv_have_decl_MSG_FASTOPEN" = xyes; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO" >&5
+$as_echo "$as_me: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO" >&2;}
+else
+  as_fn_error $? "TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client" "$LINENO" 5
+fi
+
+
+cat >>confdefs.h <<_ACEOF
+#define USE_MSG_FASTOPEN 1
+_ACEOF
+
+			  ;;
+			Darwin) ac_fn_c_check_decl "$LINENO" "CONNECT_RESUME_ON_READ_WRITE" "ac_cv_have_decl_CONNECT_RESUME_ON_READ_WRITE" "$ac_includes_default
+#include <sys/socket.h>
+
+"
+if test "x$ac_cv_have_decl_CONNECT_RESUME_ON_READ_WRITE" = xyes; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO" >&5
+$as_echo "$as_me: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO" >&2;}
+else
+  as_fn_error $? "TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client" "$LINENO" 5
+fi
+
+
+cat >>confdefs.h <<_ACEOF
+#define USE_OSX_MSG_FASTOPEN 1
+_ACEOF
+
+			  ;;
+		esac
+	;;
+	no|*)
+		;;
+esac
+
+# Check whether --enable-tfo-server was given.
+if test "${enable_tfo_server+set}" = set; then :
+  enableval=$enable_tfo_server;
+fi
+
+case "$enable_tfo_server" in
+	yes)
+	      ac_fn_c_check_decl "$LINENO" "TCP_FASTOPEN" "ac_cv_have_decl_TCP_FASTOPEN" "$ac_includes_default
+#include <netinet/tcp.h>
+
+"
+if test "x$ac_cv_have_decl_TCP_FASTOPEN" = xyes; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support server mode TFO" >&5
+$as_echo "$as_me: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support server mode TFO" >&2;}
+else
+  as_fn_error $? "TCP Fast Open is not available for server mode: please rerun without --enable-tfo-server" "$LINENO" 5
+fi
+
+
+cat >>confdefs.h <<_ACEOF
+#define USE_TCP_FASTOPEN 1
+_ACEOF
+
+		;;
+	no|*)
+		;;
+esac
+
 # check for libevent
 
 # Check whether --with-libevent was given.
@@ -18314,10 +18454,8 @@ if test x_$enable_static_exe = x_yes; then
 	staticexe="-static"
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
-		# for static crosscompile, include gdi32 and zlib here.
-		if test "`uname`" = "Linux"; then
-			LIBS="$LIBS -lgdi32 -lz"
-		fi
+		# for static compile, include gdi32 and zlib here.
+		LIBS="$LIBS -lgdi32 -lz"
 	fi
 fi
 
@@ -18762,7 +18900,7 @@ if test "$ac_res" != no; then :
 
 fi
 
-for ac_func in tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync
+for ac_func in tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -19801,12 +19939,12 @@ _ACEOF
 
 
 
-version=1.5.9
+version=1.5.10
 
 date=`date +'%b %e, %Y'`
 
 
-ac_config_files="$ac_config_files Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h"
+ac_config_files="$ac_config_files Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h contrib/libunbound.pc"
 
 ac_config_headers="$ac_config_headers config.h"
 
@@ -20316,7 +20454,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.5.9, which was
+This file was extended by unbound $as_me 1.5.10, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -20382,7 +20520,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.5.9
+unbound config.status 1.5.10
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -20804,6 +20942,7 @@ do
     "doc/unbound-host.1") CONFIG_FILES="$CONFIG_FILES doc/unbound-host.1" ;;
     "smallapp/unbound-control-setup.sh") CONFIG_FILES="$CONFIG_FILES smallapp/unbound-control-setup.sh" ;;
     "dnstap/dnstap_config.h") CONFIG_FILES="$CONFIG_FILES dnstap/dnstap_config.h" ;;
+    "contrib/libunbound.pc") CONFIG_FILES="$CONFIG_FILES contrib/libunbound.pc" ;;
     "config.h") CONFIG_HEADERS="$CONFIG_HEADERS config.h" ;;
 
   *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
diff --git a/configure.ac b/configure.ac
index 37e3993e6f99..fc2c67684ad0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10,14 +10,14 @@ sinclude(dnstap/dnstap.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[5])
-m4_define([VERSION_MICRO],[9])
+m4_define([VERSION_MICRO],[10])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=6
-LIBUNBOUND_REVISION=1
+LIBUNBOUND_REVISION=2
 LIBUNBOUND_AGE=4
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -66,6 +66,7 @@ LIBUNBOUND_AGE=4
 # 1.5.7 had 5:10:3
 # 1.5.8 had 6:0:4 # adds ub_ctx_set_stub
 # 1.5.9 had 6:1:4
+# 1.5.10 had 6:2:4
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -107,7 +108,7 @@ esac
 # are we on MinGW?
 if uname -s 2>&1 | grep MINGW32 >/dev/null; then on_mingw="yes"
 else 
-	if echo $target | grep mingw32 >/dev/null; then on_mingw="yes"
+	if echo $host $target | grep mingw32 >/dev/null; then on_mingw="yes"
 	else on_mingw="no"; fi
 fi
 
@@ -117,7 +118,7 @@ fi
 if test $on_mingw = "no"; then
   ub_conf_file=`eval echo "${sysconfdir}/unbound/unbound.conf"`
 else
-  ub_conf_file="C:\\Program Files\\Unbound\\service.conf"
+  ub_conf_file="C:\\Program Files (x86)\\Unbound\\service.conf"
 fi
 AC_ARG_WITH([conf_file],
         AC_HELP_STRING([--with-conf-file=path], 
@@ -187,7 +188,7 @@ AC_ARG_WITH(rootkey-file,
 if test $on_mingw = no; then
     UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
 else
-    UNBOUND_ROOTKEY_FILE="C:\\Program Files\\Unbound\\root.key"
+    UNBOUND_ROOTKEY_FILE="C:\\Program Files (x86)\\Unbound\\root.key"
 fi
 )
 AC_SUBST(UNBOUND_ROOTKEY_FILE)
@@ -201,7 +202,7 @@ AC_ARG_WITH(rootcert-file,
 if test $on_mingw = no; then
     UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
 else
-    UNBOUND_ROOTCERT_FILE="C:\\Program Files\\Unbound\\icannbundle.pem"
+    UNBOUND_ROOTCERT_FILE="C:\\Program Files (x86)\\Unbound\\icannbundle.pem"
 fi
 )
 AC_SUBST(UNBOUND_ROOTCERT_FILE)
@@ -629,6 +630,7 @@ AC_ARG_WITH([nettle], AC_HELP_STRING([--with-nettle=path],
 	[
 	USE_NETTLE="yes"
 	AC_DEFINE(HAVE_NETTLE, 1, [Use libnettle for crypto])
+	AC_CHECK_HEADERS([nettle/dsa-compat.h],,, [AC_INCLUDES_DEFAULT])
 	if test "$withval" != "" -a "$withval" != "yes"; then
 		CPPFLAGS="$CPPFLAGS -I$withval/include/nettle"
 		LDFLAGS="$LDFLAGS -L$withval/lib"
@@ -646,6 +648,20 @@ if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
 ACX_WITH_SSL
 ACX_LIB_SSL
 SSLLIB="-lssl"
+
+# check if -lcrypt32 is needed because CAPIENG needs that. (on windows)
+BAKLIBS="$LIBS"
+LIBS="-lssl $LIBS"
+AC_MSG_CHECKING([if libssl needs -lcrypt32])
+AC_TRY_LINK_FUNC([HMAC_Update], [
+	AC_MSG_RESULT([no])
+	LIBS="$BAKLIBS"
+], [
+	AC_MSG_RESULT([yes])
+	LIBS="$BAKLIBS"
+	LIBS="$LIBS -lcrypt32"
+])
+
 AC_MSG_CHECKING([for LibreSSL])
 if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/null; then
 	AC_MSG_RESULT([yes])
@@ -656,9 +672,15 @@ if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/
 else
 	AC_MSG_RESULT([no])
 fi
-AC_CHECK_HEADERS([openssl/conf.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([openssl/engine.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new])
+AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup])
+
+# these check_funcs need -lssl
+BAKLIBS="$LIBS"
+LIBS="-lssl $LIBS"
+AC_CHECK_FUNCS([OPENSSL_init_ssl])
+LIBS="$BAKLIBS"
+
 AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_OPENSSL_ERR_H
@@ -865,6 +887,42 @@ case "$enable_event_api" in
       ;;
 esac
 
+AC_ARG_ENABLE(tfo-client, AC_HELP_STRING([--enable-tfo-client], [Enable TCP Fast Open for client mode]))
+case "$enable_tfo_client" in
+	yes)
+		case `uname` in
+			Linux) AC_CHECK_DECL([MSG_FASTOPEN], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO])],
+			                     [AC_MSG_ERROR([TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client])], 
+			                     [AC_INCLUDES_DEFAULT 
+#include <netinet/tcp.h>
+])
+					AC_DEFINE_UNQUOTED([USE_MSG_FASTOPEN], [1], [Define this to enable client TCP Fast Open.])
+			  ;;
+			Darwin) AC_CHECK_DECL([CONNECT_RESUME_ON_READ_WRITE], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO])], 
+			                      [AC_MSG_ERROR([TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client])], 
+			                      [AC_INCLUDES_DEFAULT
+#include <sys/socket.h>
+])
+					AC_DEFINE_UNQUOTED([USE_OSX_MSG_FASTOPEN], [1], [Define this to enable client TCP Fast Open.])
+			  ;;
+		esac
+	;;
+	no|*)
+		;;
+esac
+
+AC_ARG_ENABLE(tfo-server, AC_HELP_STRING([--enable-tfo-server], [Enable TCP Fast Open for server mode]))
+case "$enable_tfo_server" in
+	yes)
+	      AC_CHECK_DECL([TCP_FASTOPEN], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support server mode TFO])], [AC_MSG_ERROR([TCP Fast Open is not available for server mode: please rerun without --enable-tfo-server])], [AC_INCLUDES_DEFAULT
+#include <netinet/tcp.h>
+	      ])
+		AC_DEFINE_UNQUOTED([USE_TCP_FASTOPEN], [1], [Define this to enable server TCP Fast Open.])
+		;;
+	no|*)
+		;;
+esac
+
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
     [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
@@ -985,10 +1043,8 @@ if test x_$enable_static_exe = x_yes; then
 	staticexe="-static"
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
-		# for static crosscompile, include gdi32 and zlib here.
-		if test "`uname`" = "Linux"; then
-			LIBS="$LIBS -lgdi32 -lz"
-		fi
+		# for static compile, include gdi32 and zlib here.
+		LIBS="$LIBS -lgdi32 -lz"
 	fi
 fi
 
@@ -1082,7 +1138,7 @@ AC_INCLUDES_DEFAULT
 #endif
 ])
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
 AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
@@ -1523,6 +1579,6 @@ dnl if this is a distro tarball, that was already done by makedist.sh
 AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AC_SUBST(date, [`date +'%b %e, %Y'`])
 
-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h contrib/libunbound.pc])
 AC_CONFIG_HEADER([config.h])
 AC_OUTPUT
diff --git a/contrib/libunbound.pc.in b/contrib/libunbound.pc.in
new file mode 100644
index 000000000000..c0d1286401cc
--- /dev/null
+++ b/contrib/libunbound.pc.in
@@ -0,0 +1,13 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: unbound
+Description: Library with validating, recursive, and caching DNS resolver
+URL: http://www.unbound.net
+Version: @PACKAGE_VERSION@
+Requires: 
+Libs: -L${libdir} -lunbound @SSLLIB@ @LIBS@
+Libs.private: @LDFLAGS@
+Cflags: -I${includedir} 
diff --git a/daemon/acl_list.c b/daemon/acl_list.c
index 84d099ca5092..d09b46e5e046 100644
--- a/daemon/acl_list.c
+++ b/daemon/acl_list.c
@@ -45,6 +45,8 @@
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
+#include "services/localzone.h"
+#include "sldns/str2wire.h"
 
 struct acl_list* 
 acl_list_create(void)
@@ -71,21 +73,21 @@ acl_list_delete(struct acl_list* acl)
 }
 
 /** insert new address into acl_list structure */
-static int
+static struct acl_addr*
 acl_list_insert(struct acl_list* acl, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int net, enum acl_access control, 
 	int complain_duplicates)
 {
-	struct acl_addr* node = regional_alloc(acl->region,
+	struct acl_addr* node = regional_alloc_zero(acl->region,
 		sizeof(struct acl_addr));
 	if(!node)
-		return 0;
+		return NULL;
 	node->control = control;
 	if(!addr_tree_insert(&acl->tree, &node->node, addr, addrlen, net)) {
 		if(complain_duplicates)
 			verbose(VERB_QUERY, "duplicate acl address ignored.");
 	}
-	return 1;
+	return node;
 }
 
 /** apply acl_list string */
@@ -125,6 +127,156 @@ acl_list_str_cfg(struct acl_list* acl, const char* str, const char* s2,
 	return 1;
 }
 
+/** find or create node (NULL on parse or error) */
+static struct acl_addr*
+acl_find_or_create(struct acl_list* acl, const char* str)
+{
+	struct acl_addr* node;
+	struct sockaddr_storage addr;
+	int net;
+	socklen_t addrlen;
+	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
+		log_err("cannot parse netblock: %s", str);
+		return NULL;
+	}
+	/* find or create node */
+	if(!(node=(struct acl_addr*)addr_tree_find(&acl->tree, &addr,
+		addrlen, net))) {
+		/* create node, type 'allow' since otherwise tags are
+		 * pointless, can override with specific access-control: cfg */
+		if(!(node=(struct acl_addr*)acl_list_insert(acl, &addr,
+			addrlen, net, acl_allow, 1))) {
+			log_err("out of memory");
+			return NULL;
+		}
+	}
+	return node;
+}
+
+/** apply acl_tag string */
+static int
+acl_list_tags_cfg(struct acl_list* acl, const char* str, uint8_t* bitmap,
+	size_t bitmaplen)
+{
+	struct acl_addr* node;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	node->taglen = bitmaplen;
+	node->taglist = regional_alloc_init(acl->region, bitmap, bitmaplen);
+	if(!node->taglist) {
+		log_err("out of memory");
+		return 0;
+	}
+	return 1;
+}
+
+/** apply acl_tag_action string */
+static int
+acl_list_tag_action_cfg(struct acl_list* acl, struct config_file* cfg,
+	const char* str, const char* tag, const char* action)
+{
+	struct acl_addr* node;
+	int tagid;
+	enum localzone_type t;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	/* allocate array if not yet */
+	if(!node->tag_actions) {
+		node->tag_actions = (uint8_t*)regional_alloc_zero(acl->region,
+			sizeof(*node->tag_actions)*cfg->num_tags);
+		if(!node->tag_actions) {
+			log_err("out of memory");
+			return 0;
+		}
+		node->tag_actions_size = (size_t)cfg->num_tags;
+	}
+	/* parse tag */
+	if((tagid=find_tag_id(cfg, tag)) == -1) {
+		log_err("cannot parse tag (define-tag it): %s %s", str, tag);
+		return 0;
+	}
+	if((size_t)tagid >= node->tag_actions_size) {
+		log_err("tagid too large for array %s %s", str, tag);
+		return 0;
+	}
+	if(!local_zone_str2type(action, &t)) {
+		log_err("cannot parse access control action type: %s %s %s",
+			str, tag, action);
+		return 0;
+	}
+	node->tag_actions[tagid] = (uint8_t)t;
+	return 1;
+}
+
+/** check wire data parse */
+static int
+check_data(const char* data)
+{
+	char buf[65536];
+	uint8_t rr[LDNS_RR_BUF_SIZE];
+	size_t len = sizeof(rr);
+	int res;
+	snprintf(buf, sizeof(buf), "%s %s", "example.com.", data);
+	res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600, NULL, 0,
+		NULL, 0);
+	if(res == 0)
+		return 1;
+	log_err("rr data [char %d] parse error %s",
+		(int)LDNS_WIREPARSE_OFFSET(res)-13,
+		sldns_get_errorstr_parse(res));
+	return 0;
+}
+
+/** apply acl_tag_data string */
+static int
+acl_list_tag_data_cfg(struct acl_list* acl, struct config_file* cfg,
+	const char* str, const char* tag, const char* data)
+{
+	struct acl_addr* node;
+	int tagid;
+	char* dupdata;
+	if(!(node=acl_find_or_create(acl, str)))
+		return 0;
+	/* allocate array if not yet */
+	if(!node->tag_datas) {
+		node->tag_datas = (struct config_strlist**)regional_alloc_zero(
+			acl->region, sizeof(*node->tag_datas)*cfg->num_tags);
+		if(!node->tag_datas) {
+			log_err("out of memory");
+			return 0;
+		}
+		node->tag_datas_size = (size_t)cfg->num_tags;
+	}
+	/* parse tag */
+	if((tagid=find_tag_id(cfg, tag)) == -1) {
+		log_err("cannot parse tag (define-tag it): %s %s", str, tag);
+		return 0;
+	}
+	if((size_t)tagid >= node->tag_datas_size) {
+		log_err("tagid too large for array %s %s", str, tag);
+		return 0;
+	}
+
+	/* check data? */
+	if(!check_data(data)) {
+		log_err("cannot parse access-control-tag data: %s %s '%s'",
+			str, tag, data);
+		return 0;
+	}
+
+	dupdata = regional_strdup(acl->region, data);
+	if(!dupdata) {
+		log_err("out of memory");
+		return 0;
+	}
+	if(!cfg_region_strlist_insert(acl->region,
+		&(node->tag_datas[tagid]), dupdata)) {
+		log_err("out of memory");
+		return 0;
+	}
+	return 1;
+}
+
 /** read acl_list config */
 static int 
 read_acl_list(struct acl_list* acl, struct config_file* cfg)
@@ -138,6 +290,77 @@ read_acl_list(struct acl_list* acl, struct config_file* cfg)
 	return 1;
 }
 
+/** read acl tags config */
+static int 
+read_acl_tags(struct acl_list* acl, struct config_file* cfg)
+{
+	struct config_strbytelist* np, *p = cfg->acl_tags;
+	cfg->acl_tags = NULL;
+	while(p) {
+		log_assert(p->str && p->str2);
+		if(!acl_list_tags_cfg(acl, p->str, p->str2, p->str2len)) {
+			config_del_strbytelist(p);
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
+/** read acl tag actions config */
+static int 
+read_acl_tag_actions(struct acl_list* acl, struct config_file* cfg)
+{
+	struct config_str3list* p, *np;
+	p = cfg->acl_tag_actions;
+	cfg->acl_tag_actions = NULL;
+	while(p) {
+		log_assert(p->str && p->str2 && p->str3);
+		if(!acl_list_tag_action_cfg(acl, cfg, p->str, p->str2,
+			p->str3)) {
+			config_deltrplstrlist(p);
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p->str3);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
+/** read acl tag datas config */
+static int 
+read_acl_tag_datas(struct acl_list* acl, struct config_file* cfg)
+{
+	struct config_str3list* p, *np;
+	p = cfg->acl_tag_datas;
+	cfg->acl_tag_datas = NULL;
+	while(p) {
+		log_assert(p->str && p->str2 && p->str3);
+		if(!acl_list_tag_data_cfg(acl, cfg, p->str, p->str2, p->str3)) {
+			config_deltrplstrlist(p);
+			return 0;
+		}
+		/* free the items as we go to free up memory */
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p->str3);
+		free(p);
+		p = np;
+	}
+	return 1;
+}
+
 int 
 acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
 {
@@ -145,6 +368,12 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
 	addr_tree_init(&acl->tree);
 	if(!read_acl_list(acl, cfg))
 		return 0;
+	if(!read_acl_tags(acl, cfg))
+		return 0;
+	if(!read_acl_tag_actions(acl, cfg))
+		return 0;
+	if(!read_acl_tag_datas(acl, cfg))
+		return 0;
 	/* insert defaults, with '0' to ignore them if they are duplicates */
 	if(!acl_list_str_cfg(acl, "0.0.0.0/0", "refuse", 0))
 		return 0;
@@ -163,13 +392,18 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
 }
 
 enum acl_access 
-acl_list_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
+acl_get_control(struct acl_addr* acl)
+{
+	if(acl) return acl->control;
+	return acl_deny;
+}
+
+struct acl_addr*
+acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
         socklen_t addrlen)
 {
-	struct acl_addr* r = (struct acl_addr*)addr_tree_lookup(&acl->tree,
+	return (struct acl_addr*)addr_tree_lookup(&acl->tree,
 		addr, addrlen);
-	if(r) return r->control;
-	return acl_deny;
 }
 
 size_t 
diff --git a/daemon/acl_list.h b/daemon/acl_list.h
index 2323697d5b84..fc0e9cabf3df 100644
--- a/daemon/acl_list.h
+++ b/daemon/acl_list.h
@@ -87,6 +87,19 @@ struct acl_addr {
 	struct addr_tree_node node;
 	/** access control on this netblock */
 	enum acl_access control;
+	/** tag bitlist */
+	uint8_t* taglist;
+	/** length of the taglist (in bytes) */
+	size_t taglen;
+	/** array per tagnumber of localzonetype(in one byte). NULL if none. */
+	uint8_t* tag_actions;
+	/** size of the tag_actions_array */
+	size_t tag_actions_size;
+	/** array per tagnumber, with per tag a list of rdata strings.
+	 * NULL if none.  strings are like 'A 127.0.0.1' 'AAAA ::1' */
+	struct config_strlist** tag_datas;
+	/** size of the tag_datas array */
+	size_t tag_datas_size;
 };
 
 /**
@@ -110,14 +123,22 @@ void acl_list_delete(struct acl_list* acl);
 int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg);
 
 /**
- * Lookup address to see its access control status.
+ * Lookup access control status for acl structure.
+ * @param acl: structure for acl storage.
+ * @return: what to do with message from this address.
+ */
+enum acl_access acl_get_control(struct acl_addr* acl);
+
+/**
+ * Lookup address to see its acl structure
  * @param acl: structure for address storage.
  * @param addr: address to check
  * @param addrlen: length of addr.
- * @return: what to do with message from this address.
+ * @return: acl structure from this address.
  */
-enum acl_access acl_list_lookup(struct acl_list* acl, 
-	struct sockaddr_storage* addr, socklen_t addrlen);
+struct acl_addr*
+acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
+        socklen_t addrlen);
 
 /**
  * Get memory used by acl structure.
diff --git a/daemon/daemon.c b/daemon/daemon.c
index 1036fcde2001..2ed9af8fe66f 100644
--- a/daemon/daemon.c
+++ b/daemon/daemon.c
@@ -204,17 +204,29 @@ daemon_init(void)
 	signal_handling_record();
 	checklock_start();
 #ifdef HAVE_SSL
+#  ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
+#  endif
 	ERR_load_SSL_strings();
 #  ifdef USE_GOST
 	(void)sldns_key_EVP_load_gost_id();
 #  endif
+#  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 	OpenSSL_add_all_algorithms();
+#  else
+	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
+		| OPENSSL_INIT_ADD_ALL_DIGESTS
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 	/* grab the COMP method ptr because openssl leaks it */
 	comp_meth = (void*)SSL_COMP_get_compression_methods();
 #  endif
+#  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
+#  else
+	(void)OPENSSL_init_ssl(0, NULL);
+#  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	if(!ub_openssl_lock_init())
 		fatal_exit("could not init openssl locks");
@@ -404,6 +416,8 @@ daemon_create_workers(struct daemon* daemon)
 	}
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
+	if(!daemon->workers)
+		fatal_exit("out of memory during daemon init");
 	if(daemon->cfg->dnstap) {
 #ifdef USE_DNSTAP
 		daemon->dtenv = dt_create(daemon->cfg->dnstap_socket_path,
@@ -586,13 +600,12 @@ daemon_cleanup(struct daemon* daemon)
 	log_thread_set(NULL);
 	/* clean up caches because
 	 * a) RRset IDs will be recycled after a reload, causing collisions
-	 * b) validation config can change, thus rrset, msg, keycache clear 
-	 * The infra cache is kept, the timing and edns info is still valid */
+	 * b) validation config can change, thus rrset, msg, keycache clear */
 	slabhash_clear(&daemon->env->rrset_cache->table);
 	slabhash_clear(daemon->env->msg_cache);
 	local_zones_delete(daemon->local_zones);
 	daemon->local_zones = NULL;
-	/* key cache is cleared by module desetup during next daemon_init() */
+	/* key cache is cleared by module desetup during next daemon_fork() */
 	daemon_remote_clear(daemon->rc);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
@@ -656,8 +669,12 @@ daemon_delete(struct daemon* daemon)
 #  endif
 	CONF_modules_free();
 #  endif
+#  ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
 	CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
+#  endif
+#  ifdef HAVE_ERR_FREE_STRINGS
 	ERR_free_strings();
+#  endif
 #  if OPENSSL_VERSION_NUMBER < 0x10100000
 	RAND_cleanup();
 #  endif
diff --git a/daemon/remote.c b/daemon/remote.c
index 7690ee8b1875..3fe6650b4ba6 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -46,9 +46,12 @@
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
 #endif
-#ifndef HEADER_DH_H
+#ifdef HAVE_OPENSSL_DH_H
 #include <openssl/dh.h>
 #endif
+#ifdef HAVE_OPENSSL_BN_H
+#include <openssl/bn.h>
+#endif
 
 #include <ctype.h>
 #include "daemon/remote.h"
@@ -144,7 +147,7 @@ timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
  * (some openssl versions reject DH that is 'too small', eg. 512).
  */
 #ifndef S_SPLINT_S
-DH *get_dh2048()
+static DH *get_dh2048(void)
 {
 	static unsigned char dh2048_p[]={
 		0xE7,0x36,0x28,0x3B,0xE4,0xC3,0x32,0x1C,0x01,0xC3,0x67,0xD6,
@@ -173,14 +176,31 @@ DH *get_dh2048()
 	static unsigned char dh2048_g[]={
 		0x02,
 		};
-	DH *dh;
-
-	if ((dh=DH_new()) == NULL) return(NULL);
-	dh->p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL);
-	dh->g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL);
-	if ((dh->p == NULL) || (dh->g == NULL))
-		{ DH_free(dh); return(NULL); }
-	return(dh);
+	DH *dh = NULL;
+	BIGNUM *p = NULL, *g = NULL;
+
+	dh = DH_new();
+	p = BN_bin2bn(dh2048_p, sizeof(dh2048_p), NULL);
+	g = BN_bin2bn(dh2048_g, sizeof(dh2048_g), NULL);
+	if (!dh || !p || !g)
+		goto err;
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+	dh->p = p;
+	dh->g = g;
+#else
+	if (!DH_set0_pqg(dh, p, NULL, g))
+		goto err;
+#endif
+	return dh;
+err:
+	if (p)
+		BN_free(p);
+	if (g)
+		BN_free(g);
+	if (dh)
+		DH_free(dh);
+	return NULL;
 }
 #endif /* SPLINT */
 
@@ -225,6 +245,7 @@ daemon_remote_create(struct config_file* cfg)
 		/* No certificates are requested */
 		if(!SSL_CTX_set_cipher_list(rc->ctx, "aNULL")) {
 			log_crypto_err("Failed to set aNULL cipher list");
+			daemon_remote_delete(rc);
 			return NULL;
 		}
 
@@ -233,6 +254,7 @@ daemon_remote_create(struct config_file* cfg)
 		 */
 		if(!SSL_CTX_set_tmp_dh(rc->ctx,get_dh2048())) {
 			log_crypto_err("Wanted to set DH param, but failed");
+			daemon_remote_delete(rc);
 			return NULL;
 		}
 		return rc;
@@ -359,8 +381,12 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 		if(fd != -1) {
 #ifdef HAVE_CHOWN
 			if (cfg->username && cfg->username[0] &&
-				cfg_uid != (uid_t)-1)
-				chown(ip, cfg_uid, cfg_gid);
+				cfg_uid != (uid_t)-1) {
+				if(chown(ip, cfg_uid, cfg_gid) == -1)
+					log_err("cannot chown %u.%u %s: %s",
+					  (unsigned)cfg_uid, (unsigned)cfg_gid,
+					  ip, strerror(errno));
+			}
 			chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP));
 #else
 			(void)cfg;
diff --git a/daemon/remote.h b/daemon/remote.h
index b25bfb1af611..190286d474a4 100644
--- a/daemon/remote.h
+++ b/daemon/remote.h
@@ -56,8 +56,8 @@ struct comm_reply;
 struct comm_point;
 struct daemon_remote;
 
-/** number of seconds timeout on incoming remote control handshake */
-#define REMOTE_CONTROL_TCP_TIMEOUT 120
+/** number of milliseconds timeout on incoming remote control handshake */
+#define REMOTE_CONTROL_TCP_TIMEOUT 120000
 
 /**
  * a busy control command connection, SSL state
diff --git a/daemon/unbound.c b/daemon/unbound.c
index d1de67369827..73e9fcbb6234 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -93,10 +93,13 @@ void* unbound_start_brk = 0;
 #endif
 
 /** print usage. */
-static void usage()
+static void usage(void)
 {
 	const char** m;
 	const char *evnm="event", *evsys="", *evmethod="";
+	time_t t;
+	struct timeval now;
+	struct ub_event_base* base;
 	printf("usage:  unbound [options]\n");
 	printf("	start unbound daemon DNS resolver.\n");
 	printf("-h	this help\n");
@@ -110,11 +113,16 @@ static void usage()
 	printf("   	service - used to start from services control panel\n");
 #endif
 	printf("Version %s\n", PACKAGE_VERSION);
-	ub_get_event_sys(NULL, &evnm, &evsys, &evmethod);
+	base = ub_default_event_base(0,&t,&now);
+	ub_get_event_sys(base, &evnm, &evsys, &evmethod);
 	printf("linked libs: %s %s (it uses %s), %s\n", 
 		evnm, evsys, evmethod,
 #ifdef HAVE_SSL
+#  ifdef SSLEAY_VERSION
 		SSLeay_version(SSLEAY_VERSION)
+#  else
+		OpenSSL_version(OPENSSL_VERSION)
+#  endif
 #elif defined(HAVE_NSS)
 		NSS_GetVersion()
 #elif defined(HAVE_NETTLE)
@@ -127,6 +135,7 @@ static void usage()
 	printf("\n");
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+	ub_event_base_free(base);
 }
 
 #ifndef unbound_testbound
@@ -539,7 +548,9 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 			log_warn("unable to initgroups %s: %s",
 				cfg->username, strerror(errno));
 #  endif /* HAVE_INITGROUPS */
+#  ifdef HAVE_ENDPWENT
 		endpwent();
+#  endif
 
 #ifdef HAVE_SETRESGID
 		if(setresgid(cfg_gid,cfg_gid,cfg_gid) != 0)
diff --git a/daemon/worker.c b/daemon/worker.c
index 33a6883f9219..70d07ba8e8f7 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -773,6 +773,8 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_flip(c->buffer);
 		return 1;
 	}
 
@@ -804,6 +806,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct query_info qinfo;
 	struct edns_data edns;
 	enum acl_access acl;
+	struct acl_addr* acladdr;
 	int rc = 0;
 
 	if(error != NETEVENT_NOERROR) {
@@ -816,8 +819,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		dt_msg_send_client_query(&worker->dtenv, &repinfo->addr, c->type,
 			c->buffer);
 #endif
-	acl = acl_list_lookup(worker->daemon->acl, &repinfo->addr, 
+	acladdr = acl_addr_lookup(worker->daemon->acl, &repinfo->addr, 
 		repinfo->addrlen);
+	acl = acl_get_control(acladdr);
 	if((ret=deny_refuse_all(c, acl, worker, repinfo)) != -1)
 	{
 		if(ret == 1)
@@ -941,7 +945,11 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		goto send_reply;
 	}
 	if(local_zones_answer(worker->daemon->local_zones, &qinfo, &edns, 
-		c->buffer, worker->scratchpad, repinfo)) {
+		c->buffer, worker->scratchpad, repinfo,	
+		acladdr->taglist, acladdr->taglen, acladdr->tag_actions,
+		acladdr->tag_actions_size, acladdr->tag_datas,
+		acladdr->tag_datas_size, worker->daemon->cfg->tagname,
+		worker->daemon->cfg->num_tags)) {
 		regional_free_all(worker->scratchpad);
 		if(sldns_buffer_limit(c->buffer) == 0) {
 			comm_point_drop_reply(repinfo);
diff --git a/dns64/dns64.c b/dns64/dns64.c
index 2fde67841bb3..5fa2096b8c5e 100644
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -872,7 +872,7 @@ static struct module_func_block dns64_block = {
  * Function for returning the above function block.
  */
 struct module_func_block *
-dns64_get_funcblock()
+dns64_get_funcblock(void)
 {
 	return &dns64_block;
 }
diff --git a/doc/Changelog b/doc/Changelog
index 76ba1e661ec6..039eade55b63 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,8 +1,219 @@
+20 September 2016: Wouter
+	- iana portlist update.
+	- Fix #835: fix --disable-dsa with nettle verify.
+	- tag for 1.5.10rc1 release.
+
+15 September 2016: Wouter
+	- Fix 883: error for duplicate local zone entry.
+	- Test for openssl init_crypto and init_ssl functions.
+
+15 September 2016: Ralph
+	- fix potential memory leak in daemon/remote.c and nullpointer
+	  dereference in validator/autotrust.
+	- iana portlist update.
+
+13 September 2016: Wouter
+	- Silenced flex-generated sign-unsigned warning print with gcc
+	  diagnostic pragma.
+	- Fix for new splint on FreeBSD.  Fix cast for sockaddr_un.sun_len.
+
+9 September 2016: Wouter
+	- Fix #831: workaround for spurious fread_chk warning against petal.c
+
+5 September 2016: Ralph
+	- Take configured minimum TTL into consideration when reducing TTL
+	  to original TTL from RRSIG.
+
+5 September 2016: Wouter
+	- Fix #829: doc of sldns_wire2str_rdata_buf() return value has an
+	  off-by-one typo, from Jinmei Tatuya (Infoblox).
+	- Fix incomplete prototypes reported by Dag-Erling Smørgrav.
+	- Fix #828: missing type in access-control-tag-action redirect results
+	  in NXDOMAIN.
+
+2 September 2016: Wouter
+	- Fix compile with openssl 1.1.0 with api=1.1.0.
+
+1 September 2016: Wouter
+	- RFC 7958 is now out, updated docs for unbound-anchor.
+	- Fix for compile without warnings with openssl 1.1.0.
+	- Fix #826: Fix refuse_non_local could result in a broken response.
+	- iana portlist update.
+
+29 August 2016: Wouter
+	- Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A.
+	  Siewior.
+	- Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
+
+25 August 2016: Ralph
+	- Clarify local-zone-override entry in unbound.conf.5 
+	
+25 August 2016: Wouter
+	- 64bit build option for makedist windows compile, -w64.
+
+24 August 2016: Ralph
+	- Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter
+	  in each iteration in find_tag_datas().
+	- unbound.conf.5 entries for define-tag, access-control-tag,
+	  access-control-tag-action, access-control-tag-data, local-zone-tag,
+	  and local-zone-override.
+	  
+23 August 2016: Wouter
+	- Fix #804: unbound stops responding after outage.  Fixes queries
+	  that attempt to wait for an empty list of subqueries.
+	- Fix #804: lower num_target_queries for iterator also for failed
+	  lookups.
+
+8 August 2016: Wouter
+	- Note that OPENPGPKEY type is RFC 7929.
+
+4 August 2016: Wouter
+	- Fix #807: workaround for possible some "unused" function parameters
+	  in test code, from Jinmei Tatuya.
+
+3 August 2016: Wouter
+	- use sendmsg instead of sendto for TFO.
+
+28 July 2016: Wouter
+	- Fix #806: wrong comment removed.
+
+26 July 2016: Wouter
+	- nicer ratelimit-below-domain explanation.
+
+22 July 2016: Wouter
+	- Fix #801: missing error condition handling in
+	  daemon_create_workers().
+	- Fix #802: workaround for function parameters that are "unused"
+	  without log_assert.
+	- Fix #803: confusing (and incorrect) code comment in daemon_cleanup().
+
+20 July 2016: Wouter
+	- Fix typo in unbound.conf.
+
+18 July 2016: Wouter
+	- Fix #798: Client-side TCP fast open fails (Linux).
+
+14 July 2016: Wouter
+	- TCP Fast open patch from Sara Dickinson.
+	- Fixed unbound.doxygen for 1.8.11.
+
+7 July 2016: Wouter
+	- access-control-tag-data implemented. verbose(4) prints tag debug.
+
+5 July 2016: Wouter
+	- Fix dynamic link of anchor-update.exe on windows.
+	- Fix detect of mingw for MXE package build.
+	- Fixes for 64bit windows compile.
+	- Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and
+	  --with-libunbound-only --with-nettle.
+
+4 July 2016: Wouter
+	- For #787: prefer-ip6 option for unbound.conf prefers to send
+	  upstream queries to ipv6 servers.
+	- Fix #787: outgoing-interface netblock/64 ipv6 option to use linux
+	  freebind to use 64bits of entropy for every query with random local
+	  part.
+
+30 June 2016: Wouter
+	- Document always_transparent, always_refuse, always_nxdomain types.
+
+29 June 2016: Wouter
+	- Fix static compile on windows missing gdi32.
+
+28 June 2016: Wouter
+	- Create a pkg-config file for libunbound in contrib.
+
+27 June 2016: Wouter
+	- Fix #784: Build configure assumess that having getpwnam means there
+	  is endpwent function available.
+	- Updated repository with newer flex and bison output.
+
+24 June 2016: Ralph
+	- Possibility to specify local-zone type for an acl/tag pair
+	- Possibility to specify (override) local-zone type for a source address
+	  block
+16 June 2016: Ralph
+	- Decrease dp attempts at each QNAME minimisation iteration
+
+16 June 2016: Wouter
+	- Fix tcp timeouts in tv.usec.
+
+15 June 2016: Wouter
+	- TCP_TIMEOUT is specified in milliseconds.
+	- If more than half of tcp connections are in use, a shorter timeout
+	  is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
+
+14 June 2016: Ralph
+	- QNAME minimisation unit test for dropped QTYPE=A queries.
+
+14 June 2016: Wouter
+	- Fix 775: unbound-host and unbound-anchor crash on windows, ignore
+	  null delete for wsaevent.
+	- Fix spelling in freebind option man page text.
+	- Fix windows link of ssl with crypt32.
+	- Fix 779: Union casting is non-portable.
+	- Fix 780: MAP_ANON not defined in HP-UX 11.31.
+	- Fix 781: prealloc() is an HP-UX system library call.
+
+13 June 2016: Ralph
+	- Use QTYPE=A for QNAME minimisation.
+	- Keep track of number of time-outs when performing QNAME minimisation.
+	  Stop minimising when number of time-outs for a QNAME/QTYPE pair is
+	  more than three.
+
+13 June 2016: Wouter
+	- Fix #778: unbound 1.5.9: -h segfault (null deref).
+	- Fix directory: fix for unbound-checkconf, it restores cwd.
+
+10 June 2016: Wouter
+	- And delete service.conf.shipped on uninstall.
+	- In unbound.conf directory: dir immediately changes to that directory,
+	  so that include: file below that is relative to that directory.
+	  With chroot, make the directory an absolute path inside chroot.
+	- keep debug symbols in windows build.
+	- do not delete service.conf on windows uninstall.
+	- document directory immediate fix and allow EXECUTABLE syntax in it
+	  on windows.
+
+9 June 2016: Wouter
+	- Trunk is called 1.5.10 (with previous fixes already in there to 2
+	  june).
+	- Revert fix for NetworkService account on windows due to breakage
+	  it causes.
+	- Fix that windows install will not overwrite existing service.conf
+	  file (and ignore gui config choices if it exists).
+
+7 June 2016: Ralph
+	- Lookup localzones by taglist from acl.
+	- Possibility to lookup local_zone, regardless the taglist.
+	- Added local_zone/taglist/acl unit test.
+
+7 June 2016: Wouter
+	- Fix #773: Non-standard Python location build failure with pyunbound.
+	- Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
+
+6 June 2016: Wouter
+	- Better help text from -h (from Ray Griffith).
+	- access-control-tag config directive.
+	- local-zone-override config directive.
+	- access-control-tag-action and access-control-tag-data config
+	  directives.
+	- free acl-tags, acltag-action and acltag-data config lists during
+	  initialisation to free up memory for more entries.
+
+3 June 2016: Wouter
+	- Fix to not ignore return value of chown() in daemon startup.
+
 2 June 2016: Wouter
 	- Fix libubound for edns optlist feature.
 	- Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc.
 	- Fix #752: retry resource temporarily unavailable on control pipe.
 	- un-document localzone tags.
+	- tag for release 1.5.9rc1.
+	  And this also became release 1.5.9.
+	- Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to
+	  Program Files with (x86) appended.
+	- re-documented localzone tags in example.conf.
 
 31 May 2016: Wouter
 	- Fix windows service to be created run with limited rights, as a
diff --git a/doc/README b/doc/README
index 7d0dd3712bca..66e2f34d2bda 100644
--- a/doc/README
+++ b/doc/README
@@ -1,4 +1,4 @@
-README for Unbound 1.5.9
+README for Unbound 1.5.10
 Copyright 2007 NLnet Labs
 http://unbound.net
 
diff --git a/doc/example.conf.in b/doc/example.conf.in
index 6e00bdf69de4..c520c881f0e9 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.5.9.
+# See unbound.conf(5) man page, version 1.5.10.
 #
 # this is a comment.
 
@@ -52,6 +52,15 @@ server:
 	# outgoing-interface: 192.0.2.153
 	# outgoing-interface: 2001:DB8::5
 	# outgoing-interface: 2001:DB8::6
+	
+	# Specify a netblock to use remainder 64 bits as random bits for
+	# upstream queries.  Uses freebind option (Linux).
+	# outgoing-interface: 2001:DB8::/64
+	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
+	# And: ip -6 route add local 2001:db8::/64 dev lo
+	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
+	# Set this to yes to prefer ipv6 upstream servers over ipv4.
+	# prefer-ip6: no
 
 	# number of ports to allocate per thread, determines the size of the
 	# port range that can be open simultaneously.  About double the
@@ -162,6 +171,10 @@ server:
 
 	# the maximum number of hosts that are cached (roundtrip, EDNS, lame).
 	# infra-cache-numhosts: 10000
+	
+	# define a number of tags here, use with local-zone, access-control.
+	# repeat the define-tag statement to add additional tags.
+	# define-tag: "tag1 tag2 tag3"
 
 	# Enable IPv4, "yes" or "no".
 	# do-ip4: yes
@@ -203,6 +216,20 @@ server:
 	# access-control: ::1 allow
 	# access-control: ::ffff:127.0.0.1 allow
 
+	# tag access-control with list of tags (in "" with spaces between)
+	# Clients using this access control element use localzones that
+	# are tagged with one of these tags.
+	# access-control-tag: 192.0.2.0/24 "tag2 tag3"
+
+	# set action for particular tag for given access control element
+	# if you have multiple tag values, the tag used to lookup the action
+	# is the first tag match between access-control-tag and local-zone-tag
+	# where "first" comes from the order of the define-tag values.
+	# access-control-tag-action: 192.0.2.0/24 tag3 refuse
+
+	# set redirect data for particular tag for access control element
+	# access-control-tag-data: 192.0.2.0/24 tag2 "A 127.0.0.1"
+
 	# if given, a chroot(2) is done to the given directory.
 	# i.e. you can chroot to the working directory, for example,
 	# for extra security, but make sure all files are in that directory.
@@ -236,6 +263,8 @@ server:
 	# the working directory. The relative files in this config are
 	# relative to this directory. If you give "" the working directory
 	# is not changed.
+	# If you give a server: directory: dir before include: file statements
+	# then those includes can be relative to the working directory.
 	# directory: "@UNBOUND_RUN_DIR@"
 
 	# the log file, "" means log to stderr.
@@ -322,6 +351,7 @@ server:
 	# Domains (and domains in them) without support for dns-0x20 and
 	# the fallback fails because they keep sending different answers.
 	# caps-whitelist: "licdn.com"
+	# caps-whitelist: "senderbase.org"
 
 	# Enforce privacy of these addresses. Strips them away from answers.
 	# It may cause DNSSEC validation to additionally mark it as bogus.
@@ -550,6 +580,8 @@ server:
 	# o typetransparent resolves normally for other types and other names
 	# o inform resolves normally, but logs client IP address
 	# o inform_deny drops queries and logs client IP address
+	# o always_transparent, always_refuse, always_nxdomain, resolve in
+	#   that way but ignore local data for that name.
 	#
 	# defaults are localhost address, reverse for 127.0.0.1 and ::1
 	# and nxdomain for AS112 zones. If you configure one of these zones
@@ -576,6 +608,12 @@ server:
 	# you need to do the reverse notation yourself.
 	# local-data-ptr: "192.0.2.3 www.example.com"
 
+	# tag a localzone with a list of tag names (in "" with spaces between)
+	# local-zone-tag: "example.com" "tag2 tag3"
+
+	# add a netblock specific override to a localzone, with zone type
+	# local-zone-override: "example.com" 192.0.2.0/24 refuse
+
 	# service clients over SSL (on the TCP sockets), with plain DNS inside
 	# the SSL stream.  Give the certificate to use and private key.
 	# default is "" (disabled).  requires restart to take effect.
@@ -609,7 +647,7 @@ server:
 	# ratelimit-for-domain: example.com 1000
 	# override the ratelimits for all domains below a domain name
 	# can give this multiple times, the name closest to the zone is used.
-	# ratelimit-below-domain: example 1000
+	# ratelimit-below-domain: com 1000
 
 # Python config section. To enable:
 # o use --with-pythonmodule to configure before compiling.
diff --git a/doc/libunbound.3.in b/doc/libunbound.3.in
index 163a6fa44d0d..1bf3fc2c880b 100644
--- a/doc/libunbound.3.in
+++ b/doc/libunbound.3.in
@@ -1,4 +1,4 @@
-.TH "libunbound" "3" "Jun  9, 2016" "NLnet Labs" "unbound 1.5.9"
+.TH "libunbound" "3" "Sep 27, 2016" "NLnet Labs" "unbound 1.5.10"
 .\"
 .\" libunbound.3 -- unbound library functions manual
 .\"
@@ -43,7 +43,7 @@
 .B ub_ctx_zone_remove,
 .B ub_ctx_data_add,
 .B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.5.9 functions.
+\- Unbound DNS validating resolver 1.5.10 functions.
 .SH "SYNOPSIS"
 .B #include <unbound.h>
 .LP
diff --git a/doc/unbound-anchor.8.in b/doc/unbound-anchor.8.in
index 1dabc725fa59..7403caa41455 100644
--- a/doc/unbound-anchor.8.in
+++ b/doc/unbound-anchor.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "Jun  9, 2016" "NLnet Labs" "unbound 1.5.9"
+.TH "unbound-anchor" "8" "Sep 27, 2016" "NLnet Labs" "unbound 1.5.10"
 .\"
 .\" unbound-anchor.8 -- unbound anchor maintenance utility manual
 .\"
@@ -16,6 +16,8 @@
 .SH "DESCRIPTION"
 .B Unbound\-anchor
 performs setup or update of the root trust anchor for DNSSEC validation.
+The program fetches the trust anchor with the method from RFC7958 when
+regular RFC5011 update fails to bring it up to date.
 It can be run (as root) from the commandline, or run as part of startup
 scripts.  Before you start the \fIunbound\fR(8) DNS server.
 .P
@@ -39,8 +41,8 @@ update certificate files.
 .P
 It tests if the root anchor file works, and if not, and an update is possible,
 attempts to update the root anchor using the root update certificate.
-It performs a https fetch of root-anchors.xml and checks the results, if
-all checks are successful, it updates the root anchor file.  Otherwise
+It performs a https fetch of root-anchors.xml and checks the results (RFC7958), 
+if all checks are successful, it updates the root anchor file.  Otherwise
 the root anchor file is unchanged.  It performs RFC5011 tracking if the
 DNSSEC information available via the DNS makes that possible.
 .P
diff --git a/doc/unbound-checkconf.8.in b/doc/unbound-checkconf.8.in
index a4cdf3b9ea96..03f5b3cd36a6 100644
--- a/doc/unbound-checkconf.8.in
+++ b/doc/unbound-checkconf.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "Jun  9, 2016" "NLnet Labs" "unbound 1.5.9"
+.TH "unbound-checkconf" "8" "Sep 27, 2016" "NLnet Labs" "unbound 1.5.10"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
diff --git a/doc/unbound-control.8.in b/doc/unbound-control.8.in
index 3b24b1fa9a8c..9089db9b55e5 100644
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "Jun  9, 2016" "NLnet Labs" "unbound 1.5.9"
+.TH "unbound-control" "8" "Sep 27, 2016" "NLnet Labs" "unbound 1.5.10"
 .\"
 .\" unbound-control.8 -- unbound remote control manual
 .\"
diff --git a/doc/unbound-host.1.in b/doc/unbound-host.1.in
index 700382eb9f15..04d19addb0a2 100644
--- a/doc/unbound-host.1.in
+++ b/doc/unbound-host.1.in
@@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "Jun  9, 2016" "NLnet Labs" "unbound 1.5.9"
+.TH "unbound\-host" "1" "Sep 27, 2016" "NLnet Labs" "unbound 1.5.10"
 .\"
 .\" unbound-host.1 -- unbound DNS lookup utility
 .\"
diff --git a/doc/unbound.8.in b/doc/unbound.8.in
index 35385b9f1a0d..78e497d5d0ef 100644
--- a/doc/unbound.8.in
+++ b/doc/unbound.8.in
@@ -1,4 +1,4 @@
-.TH "unbound" "8" "Jun  9, 2016" "NLnet Labs" "unbound 1.5.9"
+.TH "unbound" "8" "Sep 27, 2016" "NLnet Labs" "unbound 1.5.10"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -9,7 +9,7 @@
 .\"
 .SH "NAME"
 .B unbound
-\- Unbound DNS validating resolver 1.5.9.
+\- Unbound DNS validating resolver 1.5.10.
 .SH "SYNOPSIS"
 .B unbound
 .RB [ \-h ]
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index b7f241b80056..f813c44edc98 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "Jun  9, 2016" "NLnet Labs" "unbound 1.5.9"
+.TH "unbound.conf" "5" "Sep 27, 2016" "NLnet Labs" "unbound 1.5.10"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
@@ -72,7 +72,8 @@ Processing continues as if the text from the included file was copied into
 the config file at that point.  If also using chroot, using full path names
 for the included files works, relative pathnames for the included names work
 if the directory where the daemon is started equals its chroot/working 
-directory.  Wildcards can be used to include multiple files, see \fIglob\fR(7).
+directory or is specified before the include statement with directory: dir.
+Wildcards can be used to include multiple files, see \fIglob\fR(7).
 .SS "Server Options"
 These options are part of the
 .B server:
@@ -126,7 +127,7 @@ Detect source interface on UDP queries and copy them to replies.  This
 feature is experimental, and needs support in your OS for particular socket
 options.  Default value is no.
 .TP
-.B outgoing\-interface: \fI<ip address>
+.B outgoing\-interface: \fI<ip address or ip6 netblock>
 Interface to use to connect to the network. This interface is used to send
 queries to authoritative servers and receive their replies. Can be given 
 multiple times to work on several interfaces. If none are given the 
@@ -136,12 +137,28 @@ and
 .B outgoing\-interface:
 lines, the interfaces are then used for both purposes. Outgoing queries are 
 sent via a random outgoing interface to counter spoofing.
+.IP
+If an IPv6 netblock is specified instead of an individual IPv6 address,
+outgoing UDP queries will use a randomised source address taken from the
+netblock to counter spoofing. Requires the IPv6 netblock to be routed to the
+host running unbound, and requires OS support for unprivileged non-local binds
+(currently only supported on Linux). Several netblocks may be specified with
+multiple
+.B outgoing\-interface:
+options, but do not specify both an individual IPv6 address and an IPv6
+netblock, or the randomisation will be compromised.  Consider combining with
+.B prefer\-ip6: yes
+to increase the likelihood of IPv6 nameservers being selected for queries.
+On Linux you need these two commands to be able to use the freebind socket
+option to receive traffic for the ip6 netblock:
+ip -6 addr add mynetblock/64 dev lo &&
+ip -6 route add local mynetblock/64 dev lo
 .TP
 .B outgoing\-range: \fI<number>
 Number of ports to open. This number of file descriptors can be opened per 
 thread. Must be at least 1. Default depends on compile options. Larger 
 numbers need extra resources from the operating system.  For performance a
-a very large value is best, use libevent to make this possible.
+very large value is best, use libevent to make this possible.
 .TP
 .B outgoing\-port\-permit: \fI<port number or range>
 Permit unbound to open this port or range of ports for use to send queries.
@@ -281,7 +298,7 @@ permissions on some systems.  The option uses IP_BINDANY on FreeBSD systems.
 If yes, then use IP_FREEBIND socket option on sockets where unbound
 is listening to incoming traffic.  Default no.  Allows you to bind to
 IP addresses that are nonlocal or do not exist, like when the network
-interface or IP adress is down.  Exists only on Linux, where the similar
+interface or IP address is down.  Exists only on Linux, where the similar
 ip\-transparent option is also available.
 .TP
 .B rrset\-cache\-size: \fI<number>
@@ -329,6 +346,10 @@ Lower limit for dynamic retransmit timeout calculation in infrastructure
 cache. Default is 50 milliseconds. Increase this value if using forwarders
 needing more time to do recursive name resolution.
 .TP
+.B define\-tag: \fI<"list of tags">
+Define the tags that can be used with local\-zone and access\-control.
+Enclose the list between quotes ("") and put spaces between tags.
+.TP
 .B do\-ip4: \fI<yes or no>
 Enable or disable whether ip4 queries are answered or issued. Default is yes.
 .TP
@@ -339,6 +360,10 @@ IPv6 to the internet nameservers.  With this option you can disable the
 ipv6 transport for sending DNS traffic, it does not impact the contents of
 the DNS traffic, which may have ip4 and ip6 addresses in it.
 .TP
+.B prefer\-ip6: \fI<yes or no>
+If enabled, prefer IPv6 transport for sending DNS queries to internet
+nameservers. Default is no.
+.TP
 .B do\-udp: \fI<yes or no>
 Enable or disable whether UDP queries are answered or issued. Default is yes.
 .TP
@@ -432,6 +457,23 @@ allowed full recursion but only the static data.  With deny_non_local,
 messages that are disallowed are dropped, with refuse_non_local they
 receive error code REFUSED.
 .TP
+.B access\-control\-tag: \fI<IP netblock> <"list of tags">
+Assign tags to access-control elements. Clients using this access control
+element use localzones that are tagged with one of these tags. Tags must be
+defined in \fIdefine\-tags\fR.  Enclose list of tags in quotes ("") and put
+spaces between tags. If access\-control\-tag is configured for a netblock that
+does not have an access\-control, an access\-control element with action
+\fIallow\fR is configured for this netblock.
+.TP
+.B access\-control\-tag\-action: \fI<IP netblock> <tag> <action>
+Set action for particular tag for given access control element. If you have
+multiple tag values, the tag used to lookup the action is the first tag match
+between access\-control\-tag and local\-zone\-tag where "first" comes from the
+order of the define-tag values.
+.TP
+.B access\-control\-tag\-data: \fI<IP netblock> <tag> <"resource record string">
+Set redirect data for particular tag for given access control element.
+.TP
 .B chroot: \fI<directory>
 If chroot is enabled, you should pass the configfile (from the
 commandline) as a full path from the original root. After the
@@ -469,6 +511,8 @@ requires privileges, then a reload will fail; a restart is needed.
 Sets the working directory for the program. Default is "@UNBOUND_RUN_DIR@".
 On Windows the string "%EXECUTABLE%" tries to change to the directory
 that unbound.exe resides in.
+If you give a server: directory: dir before include: file statements
+then those includes can be relative to the working directory.
 .TP
 .B logfile: \fI<filename>
 If "" is given, logging goes to stderr, or nowhere once daemonized.
@@ -883,6 +927,7 @@ address space are not validated.  This is usually required whenever
 Configure a local zone. The type determines the answer to give if
 there is no match from local\-data. The types are deny, refuse, static,
 transparent, redirect, nodefault, typetransparent, inform, inform_deny,
+always_transparent, always_refuse, always_nxdomain,
 and are explained below. After that the default settings are listed. Use
 local\-data: to enter data into the local zone. Answers for local zones
 are authoritative DNS answers. By default the zones are class IN.
@@ -943,6 +988,15 @@ logged, eg. to run antivirus on them.
 The query is dropped, like 'deny', and logged, like 'inform'.  Ie. find
 infected machines without answering the queries.
 .TP 10
+\h'5'\fIalways_transparent\fR 
+Like transparent, but ignores local data and resolves normally.
+.TP 10
+\h'5'\fIalways_refuse\fR 
+Like refuse, but ignores local data and refuses the query.
+.TP 10
+\h'5'\fIalways_nxdomain\fR 
+Like static, but ignores local data and returns nxdomain for the query.
+.TP 10
 \h'5'\fInodefault\fR 
 Used to turn off default contents for AS112 zones. The other types
 also turn off default contents for the zone. The 'nodefault' option 
@@ -1060,6 +1114,18 @@ Configure local data shorthand for a PTR record with the reversed IPv4 or
 IPv6 address and the host name.  For example "192.0.2.4 www.example.com".
 TTL can be inserted like this: "2001:DB8::4 7200 www.example.com"
 .TP 5
+.B local\-zone\-tag: \fI<zone> <"list of tags">
+Assign tags to localzones. Tagged localzones will only be applied when the
+used access-control element has a matching tag. Tags must be defined in
+\fIdefine\-tags\fR.  Enclose list of tags in quotes ("") and put spaces between
+tags.
+.TP 5
+.B local\-zone\-override: \fI<zone> <IP netblock> <type>
+Override the localzone type for queries from addresses matching netblock. 
+Use this localzone type, regardless the type configured for the local-zone
+(both tagged and untagged) and regardless the type configured using
+access\-control\-tag\-action.
+.TP 5
 .B ratelimit: \fI<number or 0>
 Enable ratelimiting of queries sent to nameserver for performing recursion.
 If 0, the default, it is disabled.  This option is experimental at this time.
diff --git a/doc/unbound.doxygen b/doc/unbound.doxygen
index 43f2e38d83c1..fe39876816b5 100644
--- a/doc/unbound.doxygen
+++ b/doc/unbound.doxygen
@@ -623,7 +623,9 @@ EXCLUDE                = ./build \
                          pythonmod/examples/resip.py \
                          libunbound/python/unbound.py \
                          libunbound/python/libunbound_wrap.c \
-                         ./ldns-src
+                         ./ldns-src \
+			 doc/control_proto_spec.txt \
+			 doc/requirements.txt
 
 # The EXCLUDE_SYMLINKS tag can be used select whether or not files or
 # directories that are symbolic links (a Unix filesystem feature) are excluded
diff --git a/iterator/iter_hints.c b/iterator/iter_hints.c
index 217dfa2578ba..5fd90177aff0 100644
--- a/iterator/iter_hints.c
+++ b/iterator/iter_hints.c
@@ -147,6 +147,7 @@ compile_time_root_prime(int do_ip4, int do_ip6)
 	if(!ah(dp, "B.ROOT-SERVERS.NET.", "2001:500:84::b")) goto failed;
 	if(!ah(dp, "C.ROOT-SERVERS.NET.", "2001:500:2::c")) goto failed;
 	if(!ah(dp, "D.ROOT-SERVERS.NET.", "2001:500:2d::d")) goto failed;
+	if(!ah(dp, "E.ROOT-SERVERS.NET.", "2001:500:a8::e")) goto failed;
 	if(!ah(dp, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) goto failed;
 	if(!ah(dp, "H.ROOT-SERVERS.NET.", "2001:500:1::53")) goto failed;
 	if(!ah(dp, "I.ROOT-SERVERS.NET.", "2001:7fe::53")) goto failed;
diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
index a5aefa9602c2..874dd6850e4e 100644
--- a/iterator/iter_utils.c
+++ b/iterator/iter_utils.c
@@ -360,6 +360,39 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 		}
 	}
 	*selected_rtt = low_rtt;
+
+	if (env->cfg->prefer_ip6) {
+		int got_num6 = 0;
+		int low_rtt6 = 0;
+		int i;
+		prev = NULL;
+		a = dp->result_list;
+		for(i = 0; i < got_num; i++) {
+			swap_to_front = 0;
+			if(a->addr.ss_family == AF_INET6) {
+				got_num6++;
+				swap_to_front = 1;
+				if(low_rtt6 == 0 || a->sel_rtt < low_rtt6) {
+					low_rtt6 = a->sel_rtt;
+				}
+			}
+			/* swap to front if IPv6, or move to next result */
+			if(swap_to_front && prev) {
+				n = a->next_result;
+				prev->next_result = n;
+				a->next_result = dp->result_list;
+				dp->result_list = a;
+				a = n;
+			} else {
+				prev = a;
+				a = a->next_result;
+			}
+		}
+		if(got_num6 > 0) {
+			got_num = got_num6;
+			*selected_rtt = low_rtt6;
+		}
+	}
 	return got_num;
 }
 
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 139cae4bae0a..cc7e9378c9e7 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -148,6 +148,7 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->qchase = qstate->qinfo;
 	outbound_list_init(&iq->outlist);
 	iq->minimise_count = 0;
+	iq->minimise_timeout_count = 0;
 	if (qstate->env->cfg->qname_minimisation)
 		iq->minimisation_state = INIT_MINIMISE_STATE;
 	else
@@ -215,6 +216,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) {
 		/* mark address as failed. */
 		struct delegpt_ns* dpns = NULL;
+		super_iq->num_target_queries--; 
 		if(super_iq->dp)
 			dpns = delegpt_find_ns(super_iq->dp, 
 				qstate->qinfo.qname, qstate->qinfo.qname_len);
@@ -234,7 +236,6 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 				log_err("out of memory adding missing");
 		}
 		dpns->resolved = 1; /* mark as failed */
-		super_iq->num_target_queries--; 
 	}
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) {
 		/* prime failed to get delegation */
@@ -2008,7 +2009,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 				iq->dp->name))) {
 			iq->qinfo_out.qname = iq->dp->name;
 			iq->qinfo_out.qname_len = iq->dp->namelen;
-			iq->qinfo_out.qtype = LDNS_RR_TYPE_NS;
+			iq->qinfo_out.qtype = LDNS_RR_TYPE_A;
 			iq->qinfo_out.qclass = iq->qchase.qclass;
 			iq->minimise_count = 0;
 		}
@@ -2023,6 +2024,9 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->qinfo_out.qname = iq->qchase.qname;
 		iq->qinfo_out.qname_len = iq->qchase.qname_len;
 		iq->minimise_count++;
+		iq->minimise_timeout_count = 0;
+
+		iter_dec_attempts(iq->dp, 1);
 
 		/* Limit number of iterations for QNAMEs with more
 		 * than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB
@@ -2059,8 +2063,9 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 				&iq->qinfo_out.qname_len, 
 				labdiff-1);
 		}
-		if(labdiff < 1 || 
-			(labdiff < 2 && iq->qchase.qtype == LDNS_RR_TYPE_DS))
+		if(labdiff < 1 || (labdiff < 2 
+			&& (iq->qchase.qtype == LDNS_RR_TYPE_DS
+			|| iq->qchase.qtype == LDNS_RR_TYPE_A)))
 			/* Stop minimising this query, resolve "as usual" */
 			iq->minimisation_state = DONOT_MINIMISE_STATE;
 		else {
@@ -2077,10 +2082,17 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 				return 1;
 		}
 	}
-	if(iq->minimisation_state == SKIP_MINIMISE_STATE)
-		/* Do not increment qname, continue incrementing next 
-		 * iteration */
-		iq->minimisation_state = MINIMISE_STATE;
+	if(iq->minimisation_state == SKIP_MINIMISE_STATE) {
+		iq->minimise_timeout_count++;
+		if(iq->minimise_timeout_count < MAX_MINIMISE_TIMEOUT_COUNT)
+			/* Do not increment qname, continue incrementing next 
+			 * iteration */
+			iq->minimisation_state = MINIMISE_STATE;
+		else
+			/* Too many time-outs detected for this QNAME and QTYPE.
+			 * We give up, disable QNAME minimisation. */
+			iq->minimisation_state = DONOT_MINIMISE_STATE;
+	}
 	if(iq->minimisation_state == DONOT_MINIMISE_STATE)
 		iq->qinfo_out = iq->qchase;
 
@@ -2158,7 +2170,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	iq->num_current_queries--;
 	if(iq->response == NULL) {
 		/* Don't increment qname when QNAME minimisation is enabled */
-		if (qstate->env->cfg->qname_minimisation)
+		if(qstate->env->cfg->qname_minimisation)
 			iq->minimisation_state = SKIP_MINIMISE_STATE;
 		iq->chase_to_rd = 0;
 		iq->dnssec_lame_query = 0;
@@ -2649,6 +2661,10 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	log_query_info(VERB_ALGO, "processTargetResponse", &qstate->qinfo);
 	log_query_info(VERB_ALGO, "processTargetResponse super", &forq->qinfo);
 
+	/* Tell the originating event that this target query has finished
+	 * (regardless if it succeeded or not). */
+	foriq->num_target_queries--;
+
 	/* check to see if parent event is still interested (in orig name).  */
 	if(!foriq->dp) {
 		verbose(VERB_ALGO, "subq: parent not interested, was reset");
@@ -2664,10 +2680,6 @@ processTargetResponse(struct module_qstate* qstate, int id,
 		return;
 	}
 
-	/* Tell the originating event that this target query has finished
-	 * (regardless if it succeeded or not). */
-	foriq->num_target_queries--;
-
 	/* if iq->query_for_pside_glue then add the pside_glue (marked lame) */
 	if(iq->pside_glue) {
 		/* if the pside_glue is NULL, then it could not be found,
diff --git a/iterator/iterator.h b/iterator/iterator.h
index 7c32a74f800b..5585f578958d 100644
--- a/iterator/iterator.h
+++ b/iterator/iterator.h
@@ -69,6 +69,9 @@ struct rbtree_t;
  * QNAMEs with a lot of labels.
 */
 #define MAX_MINIMISE_COUNT	10
+/* max number of time-outs for minimised query. Prevents resolving failures
+ * when the QNAME minimisation QTYPE is blocked. */
+#define MAX_MINIMISE_TIMEOUT_COUNT 3
 /**
  * number of labels from QNAME that are always send individually when using
  * QNAME minimisation, even when the number of labels of the QNAME is bigger
@@ -377,6 +380,11 @@ struct iter_qstate {
 	 * outgoing queries when QNAME minimisation is enabled.
 	 */
 	int minimise_count;
+
+	/**
+	 * Count number of time-outs. Used to prevent resolving failures when
+	 * the QNAME minimisation QTYPE is blocked. */
+	int minimise_timeout_count;
 };
 
 /**
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index 2af392706b68..6f535414407d 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -608,7 +608,8 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch, NULL)) {
+		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
+		NULL, 0, NULL, 0)) {
 		regional_free_all(w->env->scratch);
 		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
 			w->back->udp_buff, sec_status_insecure, NULL);
@@ -678,7 +679,8 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch, NULL)) {
+		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
+		NULL, 0, NULL, 0)) {
 		regional_free_all(w->env->scratch);
 		free(qinfo.qname);
 		libworker_event_done_cb(q, LDNS_RCODE_NOERROR,
@@ -798,7 +800,8 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(w->ctx->local_zones, &qinfo, &edns, 
-		w->back->udp_buff, w->env->scratch, NULL)) {
+		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
+		NULL, 0, NULL, 0)) {
 		regional_free_all(w->env->scratch);
 		q->msg_security = sec_status_insecure;
 		add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL);
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index 3083876eead4..6637483b9dcf 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -43,6 +43,9 @@
 #  include <sys/types.h>
 #endif
 #include <sys/time.h>
+#ifdef USE_TCP_FASTOPEN
+#include <netinet/tcp.h>
+#endif
 #include "services/listen_dnsport.h"
 #include "services/outside_network.h"
 #include "util/netevent.h"
@@ -184,14 +187,6 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #else
 		(void)reuseport;
 #endif /* defined(SO_REUSEPORT) */
-#ifdef IP_FREEBIND
-		if (freebind &&
-		    setsockopt(s, IPPROTO_IP, IP_FREEBIND, (void*)&on,
-		    (socklen_t)sizeof(on)) < 0) {
-			log_warn("setsockopt(.. IP_FREEBIND ..) failed: %s",
-			strerror(errno));
-		}
-#endif /* IP_FREEBIND */
 #ifdef IP_TRANSPARENT
 		if (transparent &&
 		    setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on,
@@ -209,6 +204,14 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		}
 #endif /* IP_TRANSPARENT || IP_BINDANY */
 	}
+#ifdef IP_FREEBIND
+	if(freebind &&
+	    setsockopt(s, IPPROTO_IP, IP_FREEBIND, (void*)&on,
+	    (socklen_t)sizeof(on)) < 0) {
+		log_warn("setsockopt(.. IP_FREEBIND ..) failed: %s",
+		strerror(errno));
+	}
+#endif /* IP_FREEBIND */
 	if(rcv) {
 #ifdef SO_RCVBUF
 		int got;
@@ -509,6 +512,9 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 #if defined(SO_REUSEADDR) || defined(SO_REUSEPORT) || defined(IPV6_V6ONLY) || defined(IP_TRANSPARENT) || defined(IP_BINDANY) || defined(IP_FREEBIND)
 	int on = 1;
 #endif
+#ifdef USE_TCP_FASTOPEN
+	int qlen;
+#endif
 #if !defined(IP_TRANSPARENT) && !defined(IP_BINDANY)
 	(void)transparent;
 #endif
@@ -669,6 +675,22 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 #endif
 		return -1;
 	}
+#ifdef USE_TCP_FASTOPEN
+	/* qlen specifies how many outstanding TFO requests to allow. Limit is a defense
+	   against IP spoofing attacks as suggested in RFC7413 */
+#ifdef __APPLE__
+	/* OS X implementation only supports qlen of 1 via this call. Actual
+	   value is configured by the net.inet.tcp.fastopen_backlog kernel parm. */
+	qlen = 1;
+#else
+	/* 5 is recommended on linux */
+	qlen = 5;
+#endif
+	if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen, 
+		  sizeof(qlen))) == -1 ) {
+		log_err("Setting TCP Fast Open as server failed: %s", strerror(errno));
+	}
+#endif
 	return s;
 }
 
@@ -682,7 +704,7 @@ create_local_accept_sock(const char *path, int* noproto)
 	verbose(VERB_ALGO, "creating unix socket %s", path);
 #ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
 	/* this member exists on BSDs, not Linux */
-	usock.sun_len = (socklen_t)sizeof(usock);
+	usock.sun_len = (unsigned)sizeof(usock);
 #endif
 	usock.sun_family = AF_LOCAL;
 	/* length is 92-108, 104 on FreeBSD */
diff --git a/services/localzone.c b/services/localzone.c
index fcf6e8dfd7e0..3268477d769c 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -184,8 +184,11 @@ lz_enter_zone_dname(struct local_zones* zones, uint8_t* nm, size_t len,
 		log_warn("duplicate local-zone");
 		lock_rw_unlock(&z->lock);
 		local_zone_delete(z);
+		/* find the correct zone, so not an error for duplicate */
+		z = local_zones_find(zones, nm, len, labs, c);
+		lock_rw_wrlock(&z->lock);
 		lock_rw_unlock(&zones->lock);
-		return NULL;
+		return z;
 	}
 	lock_rw_unlock(&zones->lock);
 	return z;
@@ -525,7 +528,7 @@ lz_enter_zone_tag(struct local_zones* zones, char* zname, uint8_t* list,
 	dname_labs = dname_count_labels(dname);
 	
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, dname, dname_len, dname_labs, rr_class);
+	z = local_zones_find(zones, dname, dname_len, dname_labs, rr_class);
 	if(!z) {
 		lock_rw_unlock(&zones->lock);
 		log_err("no local-zone for tag %s", zname);
@@ -542,6 +545,89 @@ lz_enter_zone_tag(struct local_zones* zones, char* zname, uint8_t* list,
 	return r;
 }
 
+/** enter override into zone */
+static int
+lz_enter_override(struct local_zones* zones, char* zname, char* netblock,
+	char* type, uint16_t rr_class)
+{
+	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
+	size_t dname_len = sizeof(dname);
+	int dname_labs;
+	struct sockaddr_storage addr;
+	int net;
+	socklen_t addrlen;
+	struct local_zone* z;
+	enum localzone_type t;
+
+	/* parse zone name */
+	if(sldns_str2wire_dname_buf(zname, dname, &dname_len) != 0) {
+		log_err("cannot parse zone name in local-zone-override: %s %s",
+			zname, netblock);
+		return 0;
+	}
+	dname_labs = dname_count_labels(dname);
+
+	/* parse netblock */
+	if(!netblockstrtoaddr(netblock, UNBOUND_DNS_PORT, &addr, &addrlen,
+		&net)) {
+		log_err("cannot parse netblock in local-zone-override: %s %s",
+			zname, netblock);
+		return 0;
+	}
+
+	/* parse zone type */
+	if(!local_zone_str2type(type, &t)) {
+		log_err("cannot parse type in local-zone-override: %s %s %s",
+			zname, netblock, type);
+		return 0;
+	}
+
+	/* find localzone entry */
+	lock_rw_rdlock(&zones->lock);
+	z = local_zones_find(zones, dname, dname_len, dname_labs, rr_class);
+	if(!z) {
+		lock_rw_unlock(&zones->lock);
+		log_err("no local-zone for local-zone-override %s", zname);
+		return 0;
+	}
+	lock_rw_wrlock(&z->lock);
+	lock_rw_unlock(&zones->lock);
+
+	/* create netblock addr_tree if not present yet */
+	if(!z->override_tree) {
+		z->override_tree = (struct rbtree_t*)regional_alloc_zero(
+			z->region, sizeof(*z->override_tree));
+		if(!z->override_tree) {
+			lock_rw_unlock(&z->lock);
+			log_err("out of memory");
+			return 0;
+		}
+		addr_tree_init(z->override_tree);
+	}
+	/* add new elem to tree */
+	if(z->override_tree) {
+		struct local_zone_override* n;
+		n = (struct local_zone_override*)regional_alloc_zero(
+			z->region, sizeof(*n));
+		if(!n) {
+			lock_rw_unlock(&z->lock);
+			log_err("out of memory");
+			return 0;
+		}
+		n->type = t;
+		if(!addr_tree_insert(z->override_tree,
+			(struct addr_tree_node*)n, &addr, addrlen, net)) {
+			lock_rw_unlock(&z->lock);
+			log_err("duplicate local-zone-override %s %s",
+				zname, netblock);
+			return 1;
+		}
+	}
+
+	lock_rw_unlock(&z->lock);
+	return 1;
+}
+
 /** parse local-zone: statements */
 static int
 lz_enter_zones(struct local_zones* zones, struct config_file* cfg)
@@ -720,6 +806,19 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg)
 	return 1;
 }
 
+/** parse local-zone-override: statements */
+static int
+lz_enter_overrides(struct local_zones* zones, struct config_file* cfg)
+{
+	struct config_str3list* p;
+	for(p = cfg->local_zone_overrides; p; p = p->next) {
+		if(!lz_enter_override(zones, p->str, p->str2, p->str3,
+			LDNS_RR_CLASS_IN))
+			return 0;
+	}
+	return 1;
+}
+
 /** setup parent pointers, so that a lookup can be done for closest match */
 static void
 init_parents(struct local_zones* zones)
@@ -749,6 +848,9 @@ init_parents(struct local_zones* zones)
                                 break;
                         }
                 prev = node;
+
+		if(node->override_tree)
+			addr_tree_init_parents(node->override_tree);
 		lock_rw_unlock(&node->lock);
         }
 	lock_rw_unlock(&zones->lock);
@@ -887,6 +989,10 @@ local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
 	if(!lz_enter_defaults(zones, cfg)) {
 		return 0;
 	}
+	/* enter local zone overrides */
+	if(!lz_enter_overrides(zones, cfg)) {
+		return 0;
+	}
 	/* create implicit transparent zone from data. */
 	if(!lz_setup_implicit(zones, cfg)) {
 		return 0;
@@ -911,33 +1017,41 @@ struct local_zone*
 local_zones_lookup(struct local_zones* zones,
         uint8_t* name, size_t len, int labs, uint16_t dclass)
 {
+	return local_zones_tags_lookup(zones, name, len, labs,
+		dclass, NULL, 0, 1);
+}
+
+struct local_zone* 
+local_zones_tags_lookup(struct local_zones* zones,
+        uint8_t* name, size_t len, int labs, uint16_t dclass,
+	uint8_t* taglist, size_t taglen, int ignoretags)
+{
 	rbnode_t* res = NULL;
 	struct local_zone *result;
 	struct local_zone key;
+	int m;
 	key.node.key = &key;
 	key.dclass = dclass;
 	key.name = name;
 	key.namelen = len;
 	key.namelabs = labs;
-	if(rbtree_find_less_equal(&zones->ztree, &key, &res)) {
-		/* exact */
-		return (struct local_zone*)res;
-	} else {
-	        /* smaller element (or no element) */
-                int m;
-                result = (struct local_zone*)res;
-                if(!result || result->dclass != dclass)
-                        return NULL;
-                /* count number of labels matched */
-                (void)dname_lab_cmp(result->name, result->namelabs, key.name,
-                        key.namelabs, &m);
-                while(result) { /* go up until qname is subdomain of zone */
-                        if(result->namelabs <= m)
-                                break;
-                        result = result->parent;
-                }
-		return result;
-	}
+	rbtree_find_less_equal(&zones->ztree, &key, &res);
+	result = (struct local_zone*)res;
+	/* exact or smaller element (or no element) */
+	if(!result || result->dclass != dclass)
+		return NULL;
+	/* count number of labels matched */
+	(void)dname_lab_cmp(result->name, result->namelabs, key.name,
+		key.namelabs, &m);
+	while(result) { /* go up until qname is zone or subdomain of zone */
+		if(result->namelabs <= m)
+			if(ignoretags || !result->taglist ||
+				taglist_intersect(result->taglist, 
+				result->taglen, taglist, taglen))
+				break;
+		result = result->parent;
+	}
+	return result;
 }
 
 struct local_zone* 
@@ -1009,6 +1123,18 @@ void local_zones_print(struct local_zones* zones)
 			log_nametypeclass(0, "inform_deny zone", 
 				z->name, 0, z->dclass);
 			break;
+		case local_zone_always_transparent:
+			log_nametypeclass(0, "always_transparent zone", 
+				z->name, 0, z->dclass);
+			break;
+		case local_zone_always_refuse:
+			log_nametypeclass(0, "always_refuse zone", 
+				z->name, 0, z->dclass);
+			break;
+		case local_zone_always_nxdomain:
+			log_nametypeclass(0, "always_nxdomain zone", 
+				z->name, 0, z->dclass);
+			break;
 		default:
 			log_nametypeclass(0, "badtyped zone", 
 				z->name, 0, z->dclass);
@@ -1054,11 +1180,99 @@ local_encode(struct query_info* qinfo, struct edns_data* edns,
 	return 1;
 }
 
+/** find local data tag string match for the given type in the list */
+static int
+find_tag_datas(struct query_info* qinfo, struct config_strlist* list,
+	struct ub_packed_rrset_key* r, struct regional* temp,
+	uint8_t* zname, size_t zlen)
+{
+	struct config_strlist* p;
+	char buf[65536];
+	uint8_t rr[LDNS_RR_BUF_SIZE];
+	size_t len;
+	int res;
+	struct packed_rrset_data* d;
+	for(p=list; p; p=p->next) {
+		len = sizeof(rr);
+		/* does this element match the type? */
+		snprintf(buf, sizeof(buf), ". %s", p->str);
+		res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600,
+			zname, zlen, NULL, 0);
+		if(res != 0)
+			/* parse errors are already checked before, in
+			 * acllist check_data, skip this for robustness */
+			continue;
+		if(len < 1 /* . */ + 8 /* typeclassttl*/ + 2 /*rdatalen*/)
+			continue;
+		if(sldns_wirerr_get_type(rr, len, 1) != qinfo->qtype)
+			continue;
+		
+		/* do we have entries already? if not setup key */
+		if(r->rk.dname == NULL) {
+			r->entry.key = r;
+			r->rk.dname = qinfo->qname;
+			r->rk.dname_len = qinfo->qname_len;
+			r->rk.type = htons(qinfo->qtype);
+			r->rk.rrset_class = htons(qinfo->qclass);
+			r->rk.flags = 0;
+			d = (struct packed_rrset_data*)regional_alloc_zero(
+				temp, sizeof(struct packed_rrset_data)
+				+ sizeof(size_t) + sizeof(uint8_t*) +
+				sizeof(time_t));
+			if(!d) return 0; /* out of memory */
+			r->entry.data = d;
+			d->ttl = sldns_wirerr_get_ttl(rr, len, 1);
+			d->rr_len = (size_t*)((uint8_t*)d +
+				sizeof(struct packed_rrset_data));
+			d->rr_data = (uint8_t**)&(d->rr_len[1]);
+			d->rr_ttl = (time_t*)&(d->rr_data[1]);
+		}
+		d = (struct packed_rrset_data*)r->entry.data;
+		/* add entry to the data */
+		if(d->count != 0) {
+			size_t* oldlen = d->rr_len;
+			uint8_t** olddata = d->rr_data;
+			time_t* oldttl = d->rr_ttl;
+			/* increase arrays for lookup */
+			/* this is of course slow for very many records,
+			 * but most redirects are expected with few records */
+			d->rr_len = (size_t*)regional_alloc_zero(temp,
+				(d->count+1)*sizeof(size_t));
+			d->rr_data = (uint8_t**)regional_alloc_zero(temp,
+				(d->count+1)*sizeof(uint8_t*));
+			d->rr_ttl = (time_t*)regional_alloc_zero(temp,
+				(d->count+1)*sizeof(time_t));
+			if(!d->rr_len || !d->rr_data || !d->rr_ttl)
+				return 0; /* out of memory */
+			/* first one was allocated after struct d, but new
+			 * ones get their own array increment alloc, so
+			 * copy old content */
+			memmove(d->rr_len, oldlen, d->count*sizeof(size_t));
+			memmove(d->rr_data, olddata, d->count*sizeof(uint8_t*));
+			memmove(d->rr_ttl, oldttl, d->count*sizeof(time_t));
+		}
+
+		d->rr_len[d->count] = sldns_wirerr_get_rdatalen(rr, len, 1)+2;
+		d->rr_ttl[d->count] = sldns_wirerr_get_ttl(rr, len, 1);
+		d->rr_data[d->count] = regional_alloc_init(temp,
+			sldns_wirerr_get_rdatawl(rr, len, 1),
+			d->rr_len[d->count]);
+		if(!d->rr_data[d->count])
+			if(!d) return 0; /* out of memory */
+		d->count++;
+	}
+	if(r->rk.dname)
+		return 1;
+	return 0;
+}
+
 /** answer local data match */
 static int
 local_data_answer(struct local_zone* z, struct query_info* qinfo,
 	struct edns_data* edns, sldns_buffer* buf, struct regional* temp,
-	int labs, struct local_data** ldp)
+	int labs, struct local_data** ldp, enum localzone_type lz_type,
+	int tag, struct config_strlist** tag_datas, size_t tag_datas_size,
+	char** tagname, int num_tags)
 {
 	struct local_data key;
 	struct local_data* ld;
@@ -1067,10 +1281,21 @@ local_data_answer(struct local_zone* z, struct query_info* qinfo,
 	key.name = qinfo->qname;
 	key.namelen = qinfo->qname_len;
 	key.namelabs = labs;
-	if(z->type == local_zone_redirect) {
+	if(lz_type == local_zone_redirect) {
 		key.name = z->name;
 		key.namelen = z->namelen;
 		key.namelabs = z->namelabs;
+		if(tag != -1 && (size_t)tag<tag_datas_size && tag_datas[tag]) {
+			struct ub_packed_rrset_key r;
+			memset(&r, 0, sizeof(r));
+			if(find_tag_datas(qinfo, tag_datas[tag], &r, temp,
+				z->name, z->namelen)) {
+				verbose(VERB_ALGO, "redirect with tag data [%d] %s",
+					tag, (tag<num_tags?tagname[tag]:"null"));
+				return local_encode(qinfo, edns, buf, temp,
+					&r, 1, LDNS_RCODE_NOERROR);
+			}
+		}
 	}
 	ld = (struct local_data*)rbtree_search(&z->data, &key.node);
 	*ldp = ld;
@@ -1080,7 +1305,7 @@ local_data_answer(struct local_zone* z, struct query_info* qinfo,
 	lr = local_data_find_type(ld, qinfo->qtype);
 	if(!lr)
 		return 0;
-	if(z->type == local_zone_redirect) {
+	if(lz_type == local_zone_redirect) {
 		/* convert rrset name to query name; like a wildcard */
 		struct ub_packed_rrset_key r = *lr->rrset;
 		r.rk.dname = qinfo->qname;
@@ -1100,25 +1325,28 @@ local_data_answer(struct local_zone* z, struct query_info* qinfo,
  * @param buf: buffer for answer.
  * @param temp: temp region for encoding
  * @param ld: local data, if NULL, no such name exists in localdata.
+ * @param lz_type: type of the local zone
  * @return 1 if a reply is to be sent, 0 if not.
  */
 static int
 lz_zone_answer(struct local_zone* z, struct query_info* qinfo,
 	struct edns_data* edns, sldns_buffer* buf, struct regional* temp,
-	struct local_data* ld)
+	struct local_data* ld, enum localzone_type lz_type)
 {
-	if(z->type == local_zone_deny || z->type == local_zone_inform_deny) {
+	if(lz_type == local_zone_deny || lz_type == local_zone_inform_deny) {
 		/** no reply at all, signal caller by clearing buffer. */
 		sldns_buffer_clear(buf);
 		sldns_buffer_flip(buf);
 		return 1;
-	} else if(z->type == local_zone_refuse) {
+	} else if(lz_type == local_zone_refuse
+		|| lz_type == local_zone_always_refuse) {
 		error_encode(buf, (LDNS_RCODE_REFUSED|BIT_AA), qinfo,
 			*(uint16_t*)sldns_buffer_begin(buf),
 		       sldns_buffer_read_u16_at(buf, 2), edns);
 		return 1;
-	} else if(z->type == local_zone_static ||
-		z->type == local_zone_redirect) {
+	} else if(lz_type == local_zone_static ||
+		lz_type == local_zone_redirect ||
+		lz_type == local_zone_always_nxdomain) {
 		/* for static, reply nodata or nxdomain
 		 * for redirect, reply nodata */
 		/* no additional section processing,
@@ -1126,7 +1354,8 @@ lz_zone_answer(struct local_zone* z, struct query_info* qinfo,
 		 * or using closest match for NSEC.
 		 * or using closest match for returning delegation downwards
 		 */
-		int rcode = ld?LDNS_RCODE_NOERROR:LDNS_RCODE_NXDOMAIN;
+		int rcode = (ld || lz_type == local_zone_redirect)?
+			LDNS_RCODE_NOERROR:LDNS_RCODE_NXDOMAIN;
 		if(z->soa)
 			return local_encode(qinfo, edns, buf, temp, 
 				z->soa, 0, rcode);
@@ -1134,11 +1363,12 @@ lz_zone_answer(struct local_zone* z, struct query_info* qinfo,
 			*(uint16_t*)sldns_buffer_begin(buf), 
 			sldns_buffer_read_u16_at(buf, 2), edns);
 		return 1;
-	} else if(z->type == local_zone_typetransparent) {
+	} else if(lz_type == local_zone_typetransparent
+		|| lz_type == local_zone_always_transparent) {
 		/* no NODATA or NXDOMAINS for this zone type */
 		return 0;
 	}
-	/* else z->type == local_zone_transparent */
+	/* else lz_type == local_zone_transparent */
 
 	/* if the zone is transparent and the name exists, but the type
 	 * does not, then we should make this noerror/nodata */
@@ -1172,21 +1402,70 @@ lz_inform_print(struct local_zone* z, struct query_info* qinfo,
 	log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
 }
 
+enum localzone_type
+lz_type(uint8_t *taglist, size_t taglen, uint8_t *taglist2, size_t taglen2,
+	uint8_t *tagactions, size_t tagactionssize, enum localzone_type lzt,
+	struct comm_reply* repinfo, struct rbtree_t* override_tree, int* tag,
+	char** tagname, int num_tags)
+{
+	size_t i, j;
+	uint8_t tagmatch;
+	struct local_zone_override* lzo;	
+	if(repinfo && override_tree) {
+		lzo = (struct local_zone_override*)addr_tree_lookup(
+			override_tree, &repinfo->addr, repinfo->addrlen);
+		if(lzo && lzo->type) {
+			verbose(VERB_ALGO, "local zone override to type %s",
+				local_zone_type2str(lzo->type));
+			return lzo->type;
+		}
+	}
+	if(!taglist || !taglist2)
+		return lzt;
+	for(i=0; i<taglen && i<taglen2; i++) {
+		tagmatch = (taglist[i] & taglist2[i]);
+		for(j=0; j<8 && tagmatch>0; j++) {
+			if((tagmatch & 0x1)) {
+				*tag = (int)(i*8+j);
+				verbose(VERB_ALGO, "matched tag [%d] %s",
+					*tag, (*tag<num_tags?tagname[*tag]:"null"));
+				/* does this tag have a tag action? */
+				if(i*8+j < tagactionssize && tagactions
+				   && tagactions[i*8+j] != 0) {
+				  verbose(VERB_ALGO, "tag action [%d] %s to type %s",
+					*tag, (*tag<num_tags?tagname[*tag]:"null"),
+				  	local_zone_type2str(
+					(enum localzone_type)
+					tagactions[i*8+j]));
+				  return (enum localzone_type)tagactions[i*8+j];
+				}
+				return lzt;
+			}
+			tagmatch >>= 1;	
+		}
+	}
+	return lzt;
+}
+
 int 
 local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
 	struct edns_data* edns, sldns_buffer* buf, struct regional* temp,
-	struct comm_reply* repinfo)
+	struct comm_reply* repinfo, uint8_t* taglist, size_t taglen,
+	uint8_t* tagactions, size_t tagactionssize,
+	struct config_strlist** tag_datas, size_t tag_datas_size,
+	char** tagname, int num_tags)
 {
 	/* see if query is covered by a zone,
 	 * 	if so:	- try to match (exact) local data 
 	 * 		- look at zone type for negative response. */
 	int labs = dname_count_labels(qinfo->qname);
-	struct local_data* ld;
+	struct local_data* ld = NULL;
 	struct local_zone* z;
-	int r;
+	enum localzone_type lzt;
+	int r, tag = -1;
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, qinfo->qname,
-		qinfo->qname_len, labs, qinfo->qclass);
+	z = local_zones_tags_lookup(zones, qinfo->qname,
+		qinfo->qname_len, labs, qinfo->qclass, taglist, taglen, 0);
 	if(!z) {
 		lock_rw_unlock(&zones->lock);
 		return 0;
@@ -1194,15 +1473,22 @@ local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
 	lock_rw_rdlock(&z->lock);
 	lock_rw_unlock(&zones->lock);
 
-	if((z->type == local_zone_inform || z->type == local_zone_inform_deny)
+	lzt = lz_type(taglist, taglen, z->taglist, z->taglen, tagactions,
+		tagactionssize, z->type, repinfo, z->override_tree, &tag,
+		tagname, num_tags);
+
+	if((lzt == local_zone_inform || lzt == local_zone_inform_deny)
 		&& repinfo)
 		lz_inform_print(z, qinfo, repinfo);
 
-	if(local_data_answer(z, qinfo, edns, buf, temp, labs, &ld)) {
+	if(lzt != local_zone_always_refuse && lzt != local_zone_always_transparent
+		&& lzt != local_zone_always_nxdomain
+		&& local_data_answer(z, qinfo, edns, buf, temp, labs, &ld, lzt,
+		tag, tag_datas, tag_datas_size, tagname, num_tags)) {
 		lock_rw_unlock(&z->lock);
 		return 1;
 	}
-	r = lz_zone_answer(z, qinfo, edns, buf, temp, ld);
+	r = lz_zone_answer(z, qinfo, edns, buf, temp, ld, lzt);
 	lock_rw_unlock(&z->lock);
 	return r;
 }
@@ -1219,6 +1505,9 @@ const char* local_zone_type2str(enum localzone_type t)
 		case local_zone_nodefault: return "nodefault";
 		case local_zone_inform: return "inform";
 		case local_zone_inform_deny: return "inform_deny";
+		case local_zone_always_transparent: return "always_transparent";
+		case local_zone_always_refuse: return "always_refuse";
+		case local_zone_always_nxdomain: return "always_nxdomain";
 	}
 	return "badtyped"; 
 }
@@ -1241,6 +1530,12 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
 		*t = local_zone_inform;
 	else if(strcmp(type, "inform_deny") == 0)
 		*t = local_zone_inform_deny;
+	else if(strcmp(type, "always_transparent") == 0)
+		*t = local_zone_always_transparent;
+	else if(strcmp(type, "always_refuse") == 0)
+		*t = local_zone_always_refuse;
+	else if(strcmp(type, "always_nxdomain") == 0)
+		*t = local_zone_always_nxdomain;
 	else return 0;
 	return 1;
 }
diff --git a/services/localzone.h b/services/localzone.h
index 964df19383c0..69fdbee2d7a3 100644
--- a/services/localzone.h
+++ b/services/localzone.h
@@ -43,6 +43,7 @@
 #define SERVICES_LOCALZONE_H
 #include "util/rbtree.h"
 #include "util/locks.h"
+#include "util/storage/dnstree.h"
 struct ub_packed_rrset_key;
 struct regional;
 struct config_file;
@@ -50,6 +51,7 @@ struct edns_data;
 struct query_info;
 struct sldns_buffer;
 struct comm_reply;
+struct config_strlist;
 
 /**
  * Local zone type
@@ -75,7 +77,13 @@ enum localzone_type {
 	/** log client address, but no block (transparent) */
 	local_zone_inform,
 	/** log client address, and block (drop) */
-	local_zone_inform_deny
+	local_zone_inform_deny,
+	/** resolve normally, even when there is local data */	
+	local_zone_always_transparent,
+	/** answer with error, even when there is local data */	
+	local_zone_always_refuse,
+	/** answer with nxdomain, even when there is local data */
+	local_zone_always_nxdomain
 };
 
 /**
@@ -119,6 +127,9 @@ struct local_zone {
 	uint8_t* taglist;
 	/** length of the taglist (in bytes) */
 	size_t taglen;
+	/** netblock addr_tree with struct local_zone_override information
+	 * or NULL if there are no override elements */
+	struct rbtree_t* override_tree;
 
 	/** in this region the zone's data is allocated.
 	 * the struct local_zone itself is malloced. */
@@ -158,6 +169,16 @@ struct local_rrset {
 };
 
 /**
+ * Local zone override information
+ */
+struct local_zone_override {
+	/** node in addrtree */
+	struct addr_tree_node node;
+	/** override for local zone type */
+	enum localzone_type type;
+};
+
+/**
  * Create local zones storage
  * @return new struct or NULL on error.
  */
@@ -202,6 +223,24 @@ int local_data_cmp(const void* d1, const void* d2);
 void local_zone_delete(struct local_zone* z);
 
 /**
+ * Lookup zone that contains the given name, class and taglist.
+ * User must lock the tree or result zone.
+ * @param zones: the zones tree
+ * @param name: dname to lookup
+ * @param len: length of name.
+ * @param labs: labelcount of name.
+ * @param dclass: class to lookup.
+ * @param taglist: taglist to lookup.
+ * @param taglen: lenth of taglist.
+ * @param ignoretags: lookup zone by name and class, regardless the
+ * local-zone's tags.
+ * @return closest local_zone or NULL if no covering zone is found.
+ */
+struct local_zone* local_zones_tags_lookup(struct local_zones* zones, 
+	uint8_t* name, size_t len, int labs, uint16_t dclass, 
+	uint8_t* taglist, size_t taglen, int ignoretags);
+
+/**
  * Lookup zone that contains the given name, class.
  * User must lock the tree or result zone.
  * @param zones: the zones tree
@@ -230,13 +269,24 @@ void local_zones_print(struct local_zones* zones);
  * @param buf: buffer with query ID and flags, also for reply.
  * @param temp: temporary storage region.
  * @param repinfo: source address for checks. may be NULL.
+ * @param taglist: taglist for checks. May be NULL.
+ * @param taglen: length of the taglist.
+ * @param tagactions: local zone actions for tags. May be NULL.
+ * @param tagactionssize: length of the tagactions.
+ * @param tag_datas: array per tag of strlist with rdata strings. or NULL.
+ * @param tag_datas_size: size of tag_datas array.
+ * @param tagname: array of tag name strings (for debug output).
+ * @param num_tags: number of items in tagname array.
  * @return true if answer is in buffer. false if query is not answered 
  * by authority data. If the reply should be dropped altogether, the return 
  * value is true, but the buffer is cleared (empty).
  */
 int local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
 	struct edns_data* edns, struct sldns_buffer* buf, struct regional* temp,
-	struct comm_reply* repinfo);
+	struct comm_reply* repinfo, uint8_t* taglist, size_t taglen,
+	uint8_t* tagactions, size_t tagactionssize,
+	struct config_strlist** tag_datas, size_t tag_datas_size,
+	char** tagname, int num_tags);
 
 /**
  * Parse the string into localzone type.
diff --git a/services/mesh.c b/services/mesh.c
index 8f74cbe822b0..b0434b3ff0c3 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1069,6 +1069,12 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
 		*ev = module_event_pass;
 		return 1;
 	}
+	if(s == module_wait_subquery && mstate->sub_set.count == 0) {
+		log_err("module cannot wait for subquery, subquery list empty");
+		log_query_info(VERB_QUERY, "pass error for qstate",
+			&mstate->s.qinfo);
+		s = module_error;
+	}
 	if(s == module_error && mstate->s.return_rcode == LDNS_RCODE_NOERROR) {
 		/* error is bad, handle pass back up below */
 		mstate->s.return_rcode = LDNS_RCODE_SERVFAIL;
diff --git a/services/outside_network.c b/services/outside_network.c
index d9e34f46999d..dd25ab39ba70 100644
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -243,7 +243,33 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
 		return 0;
 
 	fd_set_nonblock(s);
+#ifdef USE_OSX_MSG_FASTOPEN
+	/* API for fast open is different here. We use a connectx() function and 
+	   then writes can happen as normal even using SSL.*/
+	/* connectx requires that the len be set in the sockaddr struct*/
+	struct sockaddr_in *addr_in = (struct sockaddr_in *)&w->addr;
+	addr_in->sin_len = w->addrlen;
+	sa_endpoints_t endpoints;
+	endpoints.sae_srcif = 0;
+	endpoints.sae_srcaddr = NULL;
+	endpoints.sae_srcaddrlen = 0;
+	endpoints.sae_dstaddr = (struct sockaddr *)&w->addr;
+	endpoints.sae_dstaddrlen = w->addrlen;
+	if (connectx(s, &endpoints, SAE_ASSOCID_ANY,  
+	             CONNECT_DATA_IDEMPOTENT | CONNECT_RESUME_ON_READ_WRITE,
+	             NULL, 0, NULL, NULL) == -1) {
+#else /* USE_OSX_MSG_FASTOPEN*/
+#ifdef USE_MSG_FASTOPEN
+	pend->c->tcp_do_fastopen = 1;
+	/* Only do TFO for TCP in which case no connect() is required here.
+	   Don't combine client TFO with SSL, since OpenSSL can't 
+	   currently support doing a handshake on fd that already isn't connected*/
+	if (w->outnet->sslctx && w->ssl_upstream) {
+		if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
+#else /* USE_MSG_FASTOPEN*/
 	if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
+#endif /* USE_MSG_FASTOPEN*/
+#endif /* USE_OSX_MSG_FASTOPEN*/
 #ifndef USE_WINSOCK
 #ifdef EINPROGRESS
 		if(errno != EINPROGRESS) {
@@ -263,6 +289,9 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
 			return 0;
 		}
 	}
+#ifdef USE_MSG_FASTOPEN
+	}
+#endif /* USE_MSG_FASTOPEN */
 	if(w->outnet->sslctx && w->ssl_upstream) {
 		pend->c->ssl = outgoing_ssl_fd(w->outnet->sslctx, s);
 		if(!pend->c->ssl) {
@@ -591,7 +620,9 @@ static int setup_if(struct port_if* pif, const char* addrstr,
 	pif->avail_ports = (int*)memdup(avail, (size_t)numavail*sizeof(int));
 	if(!pif->avail_ports)
 		return 0;
-	if(!ipstrtoaddr(addrstr, UNBOUND_DNS_PORT, &pif->addr, &pif->addrlen))
+	if(!ipstrtoaddr(addrstr, UNBOUND_DNS_PORT, &pif->addr, &pif->addrlen) &&
+	   !netblockstrtoaddr(addrstr, UNBOUND_DNS_PORT,
+			      &pif->addr, &pif->addrlen, &pif->pfxlen))
 		return 0;
 	pif->maxout = (int)numfd;
 	pif->inuse = 0;
@@ -893,26 +924,49 @@ pending_delete(struct outside_network* outnet, struct pending* p)
 	free(p);
 }
 
+static void
+sai6_putrandom(struct sockaddr_in6 *sa, int pfxlen, struct ub_randstate *rnd)
+{
+	int i, last;
+	if(!(pfxlen > 0 && pfxlen < 128))
+		return;
+	for(i = 0; i < (128 - pfxlen) / 8; i++) {
+		sa->sin6_addr.s6_addr[15-i] = (uint8_t)ub_random_max(rnd, 256);
+	}
+	last = pfxlen & 7;
+	if(last != 0) {
+		sa->sin6_addr.s6_addr[15-i] |=
+			((0xFF >> last) & ub_random_max(rnd, 256));
+	}
+}
+
 /**
  * Try to open a UDP socket for outgoing communication.
  * Sets sockets options as needed.
  * @param addr: socket address.
  * @param addrlen: length of address.
+ * @param pfxlen: length of network prefix (for address randomisation).
  * @param port: port override for addr.
  * @param inuse: if -1 is returned, this bool means the port was in use.
+ * @param rnd: random state (for address randomisation).
  * @return fd or -1
  */
 static int
-udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int port, 
-	int* inuse)
+udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int pfxlen,
+	int port, int* inuse, struct ub_randstate* rnd)
 {
 	int fd, noproto;
 	if(addr_is_ip6(addr, addrlen)) {
-		struct sockaddr_in6* sa = (struct sockaddr_in6*)addr;
-		sa->sin6_port = (in_port_t)htons((uint16_t)port);
+		int freebind = 0;
+		struct sockaddr_in6 sa = *(struct sockaddr_in6*)addr;
+		sa.sin6_port = (in_port_t)htons((uint16_t)port);
+		if(pfxlen != 0) {
+			freebind = 1;
+			sai6_putrandom(&sa, pfxlen, rnd);
+		}
 		fd = create_udp_sock(AF_INET6, SOCK_DGRAM, 
-			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
-			0, 0, 0, NULL, 0, 0);
+			(struct sockaddr*)&sa, addrlen, 1, inuse, &noproto,
+			0, 0, 0, NULL, 0, freebind);
 	} else {
 		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
 		sa->sin_port = (in_port_t)htons((uint16_t)port);
@@ -978,7 +1032,8 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 		/* try to open new port, if fails, loop to try again */
 		log_assert(pif->inuse < pif->maxout);
 		portno = pif->avail_ports[my_port - pif->inuse];
-		fd = udp_sockport(&pif->addr, pif->addrlen, portno, &inuse);
+		fd = udp_sockport(&pif->addr, pif->addrlen, pif->pfxlen,
+			portno, &inuse, outnet->rnd);
 		if(fd == -1 && !inuse) {
 			/* nonrecoverable error making socket */
 			return 0;
@@ -1361,6 +1416,7 @@ serviced_perturb_qname(struct ub_randstate* rnd, uint8_t* qbuf, size_t len)
 	long int random = 0;
 	int bits = 0;
 	log_assert(len >= 10 + 5 /* offset qname, root, qtype, qclass */);
+	(void)len;
 	lablen = *d++;
 	while(lablen) {
 		while(lablen--) {
diff --git a/services/outside_network.h b/services/outside_network.h
index 9a3270ee19a6..d6a448c0b68b 100644
--- a/services/outside_network.h
+++ b/services/outside_network.h
@@ -165,6 +165,10 @@ struct port_if {
 	/** length of addr field */
 	socklen_t addrlen;
 
+	/** prefix length of network address (in bits), for randomisation.
+	 * if 0, no randomisation. */
+	int pfxlen;
+
 	/** the available ports array. These are unused.
 	 * Only the first total-inuse part is filled. */
 	int* avail_ports;
diff --git a/sldns/keyraw.c b/sldns/keyraw.c
index 8d28bf40ab32..e8f2da089d6a 100644
--- a/sldns/keyraw.c
+++ b/sldns/keyraw.c
@@ -23,6 +23,15 @@
 #ifdef HAVE_OPENSSL_ENGINE_H
 #  include <openssl/engine.h>
 #endif
+#ifdef HAVE_OPENSSL_BN_H
+#include <openssl/bn.h>
+#endif
+#ifdef HAVE_OPENSSL_RSA_H
+#include <openssl/rsa.h>
+#endif
+#ifdef HAVE_OPENSSL_DSA_H
+#include <openssl/dsa.h>
+#endif
 #endif /* HAVE_SSL */
 
 size_t
@@ -215,6 +224,7 @@ sldns_key_buf2dsa_raw(unsigned char* key, size_t len)
 		BN_free(Y);
 		return NULL;
 	}
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
 #ifndef S_SPLINT_S
 	dsa->p = P;
 	dsa->q = Q;
@@ -222,6 +232,25 @@ sldns_key_buf2dsa_raw(unsigned char* key, size_t len)
 	dsa->pub_key = Y;
 #endif /* splint */
 
+#else /* OPENSSL_VERSION_NUMBER */
+	if (!DSA_set0_pqg(dsa, P, Q, G)) {
+		/* QPG not yet attached, need to free */
+		BN_free(Q);
+		BN_free(P);
+		BN_free(G);
+
+		DSA_free(dsa);
+		BN_free(Y);
+		return NULL;
+	}
+	if (!DSA_set0_key(dsa, Y, NULL)) {
+		/* QPG attached, cleaned up by DSA_fre() */
+		DSA_free(dsa);
+		BN_free(Y);
+		return NULL;
+	}
+#endif
+
 	return dsa;
 }
 
@@ -273,11 +302,21 @@ sldns_key_buf2rsa_raw(unsigned char* key, size_t len)
 		BN_free(modulus);
 		return NULL;
 	}
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
 #ifndef S_SPLINT_S
 	rsa->n = modulus;
 	rsa->e = exponent;
 #endif /* splint */
 
+#else /* OPENSSL_VERSION_NUMBER */
+	if (!RSA_set0_key(rsa, modulus, exponent, NULL)) {
+		BN_free(exponent);
+		BN_free(modulus);
+		RSA_free(rsa);
+		return NULL;
+	}
+#endif
+
 	return rsa;
 }
 
diff --git a/sldns/rrdef.h b/sldns/rrdef.h
index 3365f15fa05e..00c01e63a403 100644
--- a/sldns/rrdef.h
+++ b/sldns/rrdef.h
@@ -195,7 +195,7 @@ enum sldns_enum_rr_type
         LDNS_RR_TYPE_TALINK = 58,
 	LDNS_RR_TYPE_CDS = 59, /** RFC 7344 */
 	LDNS_RR_TYPE_CDNSKEY = 60, /** RFC 7344 */
-	LDNS_RR_TYPE_OPENPGPKEY = 61, /* draft-ietf-dane-openpgpkey */
+	LDNS_RR_TYPE_OPENPGPKEY = 61, /* RFC 7929 */
 	LDNS_RR_TYPE_CSYNC = 62, /* RFC 7477 */
 
 	LDNS_RR_TYPE_SPF = 99, /* RFC 4408 */
diff --git a/sldns/wire2str.h b/sldns/wire2str.h
index 67f543566267..c477f06610d8 100644
--- a/sldns/wire2str.h
+++ b/sldns/wire2str.h
@@ -118,7 +118,7 @@ int sldns_str_print(char** str, size_t* slen, const char* format, ...)
  * @param str_len: the size of the string buffer.  If more is needed, it'll
  * 	silently truncate the output to fit in the buffer.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_pkt_buf(uint8_t* data, size_t data_len, char* str,
 	size_t str_len);
@@ -351,7 +351,7 @@ int sldns_wire2str_edns_option_code_print(char** str, size_t* str_len,
  * @param str_len: the size of the string buffer.  If more is needed, it'll
  * 	silently truncate the output to fit in the buffer.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rr_buf(uint8_t* rr, size_t rr_len, char* str,
 	size_t str_len);
@@ -369,7 +369,7 @@ int sldns_wire2str_rr_buf(uint8_t* rr, size_t rr_len, char* str,
  * @param str_len: the size of the string buffer.  If more is needed, it'll
  * 	silently truncate the output to fit in the buffer.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rr_unknown_buf(uint8_t* rr, size_t rr_len, char* str,
 	size_t str_len);
@@ -389,7 +389,7 @@ int sldns_wire2str_rr_unknown_buf(uint8_t* rr, size_t rr_len, char* str,
  * @param str_len: the size of the string buffer.  If more is needed, it'll
  * 	silently truncate the output to fit in the buffer.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rr_comment_buf(uint8_t* rr, size_t rr_len, size_t dname_len,
 	char* str, size_t str_len);
@@ -406,7 +406,7 @@ int sldns_wire2str_rr_comment_buf(uint8_t* rr, size_t rr_len, size_t dname_len,
  * 	silently truncate the output to fit in the buffer.
  * @param rrtype: rr type of the data
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rdata_buf(uint8_t* rdata, size_t rdata_len, char* str,
 	size_t str_len, uint16_t rrtype);
@@ -417,7 +417,7 @@ int sldns_wire2str_rdata_buf(uint8_t* rdata, size_t rdata_len, char* str,
  * @param str: the string to write to.
  * @param len: length of str.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_type_buf(uint16_t rrtype, char* str, size_t len);
 
@@ -427,7 +427,7 @@ int sldns_wire2str_type_buf(uint16_t rrtype, char* str, size_t len);
  * @param str: the string to write to.
  * @param len: length of str.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_class_buf(uint16_t rrclass, char* str, size_t len);
 
@@ -437,7 +437,7 @@ int sldns_wire2str_class_buf(uint16_t rrclass, char* str, size_t len);
  * @param str: the string to write to.
  * @param len: length of str.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rcode_buf(int rcode, char* str, size_t len);
 
@@ -448,7 +448,7 @@ int sldns_wire2str_rcode_buf(int rcode, char* str, size_t len);
  * @param str: the string to write to.
  * @param len: length of string.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_dname_buf(uint8_t* dname, size_t dname_len, char* str,
 	size_t len);
diff --git a/smallapp/unbound-anchor.c b/smallapp/unbound-anchor.c
index 81bb896f7170..00ab5e2ae0ef 100644
--- a/smallapp/unbound-anchor.c
+++ b/smallapp/unbound-anchor.c
@@ -37,7 +37,8 @@
  * \file
  *
  * This file checks to see that the current 5011 keys work to prime the
- * current root anchor.  If not a certificate is used to update the anchor.
+ * current root anchor.  If not a certificate is used to update the anchor,
+ * with RFC7958 https xml fetch.
  *
  * This is a concept solution for distribution of the DNSSEC root
  * trust anchor.  It is a small tool, called "unbound-anchor", that
@@ -47,7 +48,7 @@
  * Management-Abstract:
  *    * first run: fill root.key file with hardcoded DS record.
  *    * mostly: use RFC5011 tracking, quick . DNSKEY UDP query.
- *    * failover: use builtin certificate, do https and update.
+ *    * failover: use RFC7958 builtin certificate, do https and update.
  * Special considerations:
  *    * 30-days RFC5011 timer saves a lot of https traffic.
  *    * DNSKEY probe must be NOERROR, saves a lot of https traffic.
@@ -77,7 +78,7 @@
  * the file contains a list of normal DNSKEY/DS records, and uses that to
  * bootstrap 5011 (the KSK is made VALID).
  *
- * The certificate update is done by fetching root-anchors.xml and
+ * The certificate RFC7958 update is done by fetching root-anchors.xml and
  * root-anchors.p7s via SSL.  The HTTPS certificate can be logged but is
  * not validated (https for channel security; the security comes from the
  * certificate).  The 'data.iana.org' domain name A and AAAA are resolved
@@ -171,7 +172,7 @@ struct ip_list {
 
 /** Give unbound-anchor usage, and exit (1). */
 static void
-usage()
+usage(void)
 {
 	printf("Usage:	unbound-anchor [opts]\n");
 	printf("	Setup or update root anchor. "
@@ -1836,7 +1837,7 @@ write_unsigned_root(const char* root_anchor_file)
 #ifdef HAVE_FSYNC
 	fsync(fileno(out));
 #else
-	FlushFileBuffers((HANDLE)_fileno(out));
+	FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
 #endif
 	fclose(out);
 }
@@ -1868,7 +1869,7 @@ write_root_anchor(const char* root_anchor_file, BIO* ds)
 #ifdef HAVE_FSYNC
 	fsync(fileno(out));
 #else
-	FlushFileBuffers((HANDLE)_fileno(out));
+	FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
 #endif
 	fclose(out);
 }
@@ -2310,10 +2311,22 @@ int main(int argc, char* argv[])
 	if(argc != 0)
 		usage();
 
+#ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
+#endif
 	ERR_load_SSL_strings();
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 	OpenSSL_add_all_algorithms();
+#else
+	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
+		| OPENSSL_INIT_ADD_ALL_DIGESTS
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
+#else
+	(void)OPENSSL_init_ssl(0, NULL);
+#endif
 
 	if(dolist) do_list_builtin();
 
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index b1c70f50787b..51f8e648ab7a 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -72,7 +72,7 @@
 
 /** Give checkconf usage, and exit (1). */
 static void
-usage()
+usage(void)
 {
 	printf("Usage:	unbound-checkconf [file]\n");
 	printf("	Checks unbound configuration file for errors.\n");
@@ -161,6 +161,7 @@ warn_hosts(const char* typ, struct config_stub* list)
 static void
 interfacechecks(struct config_file* cfg)
 {
+	int d;
 	struct sockaddr_storage a;
 	socklen_t alen;
 	int i, j;
@@ -177,8 +178,8 @@ interfacechecks(struct config_file* cfg)
 		}
 	}
 	for(i=0; i<cfg->num_out_ifs; i++) {
-		if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, 
-			&a, &alen)) {
+		if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen) &&
+		   !netblockstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen, &d)) {
 			fatal_exit("cannot parse outgoing-interface "
 				"specified as '%s'", cfg->out_ifs[i]);
 		}
@@ -330,6 +331,8 @@ morechecks(struct config_file* cfg, const char* fname)
 		fatal_exit("num_threads value weird");
 	if(!cfg->do_ip4 && !cfg->do_ip6)
 		fatal_exit("ip4 and ip6 are both disabled, pointless");
+	if(!cfg->do_ip6 && cfg->prefer_ip6)
+		fatal_exit("cannot prefer and disable ip6, pointless");
 	if(!cfg->do_udp && !cfg->do_tcp)
 		fatal_exit("udp and tcp are both disabled, pointless");
 	if(cfg->edns_buffer_size > cfg->msg_buffer_size)
@@ -436,7 +439,9 @@ morechecks(struct config_file* cfg, const char* fname)
 	if(cfg->username && cfg->username[0]) {
 		if(getpwnam(cfg->username) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
+#  ifdef HAVE_ENDPWENT
 		endpwent();
+#  endif
 	}
 #endif
 	if(cfg->remote_control_enable && cfg->remote_control_use_cert) {
@@ -481,14 +486,22 @@ check_hints(struct config_file* cfg)
 static void
 checkconf(const char* cfgfile, const char* opt, int final)
 {
+	char oldwd[PATH_MAX];
 	struct config_file* cfg = config_create();
 	if(!cfg)
 		fatal_exit("out of memory");
+	oldwd[0] = 0;
+	if(!getcwd(oldwd, sizeof(oldwd))) {
+		log_err("cannot getcwd: %s", strerror(errno));
+		oldwd[0] = 0;
+	}
 	if(!config_read(cfg, cfgfile, NULL)) {
 		/* config_read prints messages to stderr */
 		config_delete(cfg);
 		exit(1);
 	}
+	if(oldwd[0] && chdir(oldwd) == -1)
+		log_err("cannot chdir(%s): %s", oldwd, strerror(errno));
 	if(opt) {
 		print_option(cfg, opt, final);
 		config_delete(cfg);
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 23e265c7074b..19268edabde7 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -65,7 +65,7 @@
 
 /** Give unbound-control usage, and exit (1). */
 static void
-usage()
+usage(void)
 {
 	printf("Usage:	unbound-control [options] command\n");
 	printf("	Remote control utility for unbound server.\n");
@@ -212,7 +212,7 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 		struct sockaddr_un* usock = (struct sockaddr_un *) &addr;
 		usock->sun_family = AF_LOCAL;
 #ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
-		usock->sun_len = (socklen_t)sizeof(usock);
+		usock->sun_len = (unsigned)sizeof(usock);
 #endif
 		(void)strlcpy(usock->sun_path, svr, sizeof(usock->sun_path));
 		addrlen = (socklen_t)sizeof(struct sockaddr_un);
@@ -418,10 +418,22 @@ int main(int argc, char* argv[])
 		cfgfile = CONFIGFILE;
 #endif
 
+#ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
+#endif
 	ERR_load_SSL_strings();
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 	OpenSSL_add_all_algorithms();
+#else
+	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
+		| OPENSSL_INIT_ADD_ALL_DIGESTS
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
+#else
+	(void)OPENSSL_init_ssl(0, NULL);
+#endif
 
 	if(!RAND_status()) {
                 /* try to seed it */
diff --git a/smallapp/unbound-host.c b/smallapp/unbound-host.c
index 30fef51fdc6f..d7a36a23193e 100644
--- a/smallapp/unbound-host.c
+++ b/smallapp/unbound-host.c
@@ -72,7 +72,7 @@ static int verb = 0;
 
 /** Give unbound-host usage, and exit (1). */
 static void
-usage()
+usage(void)
 {
 	printf("Usage:	unbound-host [-vdhr46] [-c class] [-t type] hostname\n");
 	printf("                     [-y key] [-f keyfile] [-F namedkeyfile]\n");
@@ -91,7 +91,7 @@ usage()
 	printf("    -F keyfile		read named.conf-style trust anchors.\n");
 	printf("    -C config		use the specified unbound.conf (none read by default)\n");
 	printf("    -r			read forwarder information from /etc/resolv.conf\n");
-	printf("      			breaks validation if the fwder does not do DNSSEC.\n");
+	printf("      			breaks validation if the forwarder does not do DNSSEC.\n");
 	printf("    -v			be more verbose, shows nodata and security.\n");
 	printf("    -d			debug, traces the action, -d -d shows more.\n");
 	printf("    -4			use ipv4 network, avoid ipv6.\n");
diff --git a/testcode/fake_event.c b/testcode/fake_event.c
index 1578b7ddca2f..7e0d075cd0fa 100644
--- a/testcode/fake_event.c
+++ b/testcode/fake_event.c
@@ -1130,6 +1130,7 @@ void outnet_serviced_query_stop(struct serviced_query* sq, void* cb_arg)
 	while(p) {
 		if(p == pend) {
 			log_assert(p->cb_arg == cb_arg);
+			(void)cb_arg;
 			log_info("serviced pending delete");
 			if(prev)
 				prev->next = p->next;
diff --git a/testcode/lock_verify.c b/testcode/lock_verify.c
index 786d523c3118..de2882b24c11 100644
--- a/testcode/lock_verify.c
+++ b/testcode/lock_verify.c
@@ -105,7 +105,7 @@ static int verb = 0;
 
 /** print program usage help */
 static void
-usage()
+usage(void)
 {
 	printf("lock_verify <trace files>\n");
 }
diff --git a/testcode/memstats.c b/testcode/memstats.c
index fc56c0d3c1af..1cca02e74dcf 100644
--- a/testcode/memstats.c
+++ b/testcode/memstats.c
@@ -66,7 +66,7 @@ struct codeline {
 
 /** print usage and exit */
 static void
-usage()
+usage(void)
 {
 	printf("usage:	memstats <logfile>\n");
 	printf("statistics are printed on stdout.\n");
diff --git a/testcode/petal.c b/testcode/petal.c
index 24d94a556969..b30549365f51 100644
--- a/testcode/petal.c
+++ b/testcode/petal.c
@@ -70,7 +70,7 @@ static int verb = 0;
 
 /** Give petal usage, and exit (1). */
 static void
-usage()
+usage(void)
 {
 	printf("Usage:	petal [opts]\n");
 	printf("	https daemon serves files from ./'host'/filename\n");
@@ -429,6 +429,7 @@ static void
 provide_file_chunked(SSL* ssl, char* fname)
 {
 	char buf[16384];
+	char* tmpbuf = NULL;
 	char* at = buf;
 	size_t avail = sizeof(buf);
 	size_t r;
@@ -471,9 +472,13 @@ provide_file_chunked(SSL* ssl, char* fname)
 	}
 
 	do {
-		char tmpbuf[sizeof(buf)];
+		size_t red;
+		free(tmpbuf);
+		tmpbuf = malloc(avail-16);
+		if(!tmpbuf)
+			break;
 		/* read chunk; space-16 for xxxxCRLF..CRLF0CRLFCRLF (3 spare)*/
-		size_t red = in?fread(tmpbuf, 1, avail-16, in):0;
+		red = in?fread(tmpbuf, 1, avail-16, in):0;
 		/* prepare chunk */
 		snprintf(at, avail, "%x\r\n", (unsigned)red);
 		r = strlen(at);
@@ -514,6 +519,7 @@ provide_file_chunked(SSL* ssl, char* fname)
 		avail = sizeof(buf);
 	} while(in && !feof(in) && !ferror(in));
 
+	free(tmpbuf);
 	if(in) fclose(in);
 }
 
@@ -634,14 +640,30 @@ int main(int argc, char* argv[])
 #ifdef SIGPIPE
 	(void)signal(SIGPIPE, SIG_IGN);
 #endif
+#ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
+#endif
 	ERR_load_SSL_strings();
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 	OpenSSL_add_all_algorithms();
+#else
+	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
+		| OPENSSL_INIT_ADD_ALL_DIGESTS
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
+#else
+	(void)OPENSSL_init_ssl(0, NULL);
+#endif
 
 	do_service(addr, port, key, cert);
 
+#ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
 	CRYPTO_cleanup_all_ex_data();
+#endif
+#ifdef HAVE_ERR_FREE_STRINGS
 	ERR_free_strings();
+#endif
 	return 0;
 }
diff --git a/testcode/signit.c b/testcode/signit.c
index af4e0fe37cb3..0eca0e088ee4 100644
--- a/testcode/signit.c
+++ b/testcode/signit.c
@@ -63,7 +63,7 @@ struct keysets {
 
 /** print usage and exit */
 static void
-usage()
+usage(void)
 {
 	printf("usage:	signit expi ince keytag owner keyfile\n");
 	printf("present rrset data on stdin.\n");
diff --git a/testcode/streamtcp.c b/testcode/streamtcp.c
index b78506beb5df..05dcf98a85ec 100644
--- a/testcode/streamtcp.c
+++ b/testcode/streamtcp.c
@@ -406,8 +406,18 @@ int main(int argc, char** argv)
 	}
 	if(usessl) {
 		ERR_load_SSL_strings();
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 		OpenSSL_add_all_algorithms();
-		SSL_library_init();
+#else
+		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
+			| OPENSSL_INIT_ADD_ALL_DIGESTS
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
+		(void)SSL_library_init();
+#else
+		(void)OPENSSL_init_ssl(0, NULL);
+#endif
 	}
 	send_em(svr, udp, usessl, noanswer, argc, argv);
 	checklock_stop();
diff --git a/testcode/testbound.c b/testcode/testbound.c
index 674b39ac8942..00502eea8849 100644
--- a/testcode/testbound.c
+++ b/testcode/testbound.c
@@ -67,7 +67,7 @@ static struct config_strlist* cfgfiles = NULL;
 
 /** give commandline usage for testbound. */
 static void
-testbound_usage()
+testbound_usage(void)
 {
 	printf("usage: testbound [options]\n");
 	printf("\ttest the unbound daemon.\n");
diff --git a/testcode/testpkts.c b/testcode/testpkts.c
index d1960a4108b5..c9ad9d069b56 100644
--- a/testcode/testpkts.c
+++ b/testcode/testpkts.c
@@ -239,7 +239,7 @@ static void adjustline(char* line, struct entry* e,
 }
 
 /** create new entry */
-static struct entry* new_entry()
+static struct entry* new_entry(void)
 {
 	struct entry* e = (struct entry*)malloc(sizeof(struct entry));
 	if(!e) error("out of memory");
diff --git a/testcode/unitmain.c b/testcode/unitmain.c
index e8bb898b0d74..988346a1efc9 100644
--- a/testcode/unitmain.c
+++ b/testcode/unitmain.c
@@ -568,6 +568,9 @@ void unit_show_feature(const char* feature)
 	printf("test %s functions\n", feature);
 }
 
+#ifdef USE_ECDSA_EVP_WORKAROUND
+void ecdsa_evp_workaround_init(void);
+#endif
 /**
  * Main unit test program. Setup, teardown and report errors.
  * @param argc: arg count.
@@ -585,10 +588,15 @@ main(int argc, char* argv[])
 	}
 	printf("Start of %s unit test.\n", PACKAGE_STRING);
 #ifdef HAVE_SSL
+#  ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
+#  endif
 #  ifdef USE_GOST
 	(void)sldns_key_EVP_load_gost_id();
 #  endif
+#  ifdef USE_ECDSA_EVP_WORKAROUND
+	ecdsa_evp_workaround_init();
+#  endif
 #elif defined(HAVE_NSS)
 	if(NSS_NoDB_Init(".") != SECSuccess)
 		fatal_exit("could not init NSS");
@@ -617,13 +625,21 @@ main(int argc, char* argv[])
 	sldns_key_EVP_unload_gost();
 #  endif
 #  ifdef HAVE_OPENSSL_CONFIG
+#  ifdef HAVE_EVP_CLEANUP
 	EVP_cleanup();
+#  endif
 	ENGINE_cleanup();
 	CONF_modules_free();
 #  endif
+#  ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
 	CRYPTO_cleanup_all_ex_data();
+#  endif
+#  ifdef HAVE_ERR_FREE_STRINGS
 	ERR_free_strings();
+#  endif
+#  ifdef HAVE_RAND_CLEANUP
 	RAND_cleanup();
+#  endif
 #elif defined(HAVE_NSS)
 	if(NSS_Shutdown() != SECSuccess)
 		fatal_exit("could not shutdown NSS");
diff --git a/testdata/iter_resolve_minimised.rpl b/testdata/iter_resolve_minimised.rpl
index 305064646e8b..fc42bae81d94 100644
--- a/testdata/iter_resolve_minimised.rpl
+++ b/testdata/iter_resolve_minimised.rpl
@@ -30,7 +30,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-com. IN NS
+com. IN A
 SECTION AUTHORITY
 com.	IN NS	a.gtld-servers.net.
 SECTION ADDITIONAL
@@ -46,8 +46,8 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-com. IN NS
-SECTION ANSWER
+com. IN A
+SECTION AUTHORITY
 com.	IN NS	a.gtld-servers.net.
 SECTION ADDITIONAL
 a.gtld-servers.net.	IN 	A	192.5.6.30
@@ -58,7 +58,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-example.com. IN NS
+example.com. IN A
 SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
@@ -74,8 +74,8 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
+example.com. IN A
+SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
 ns.example.com.		IN 	A	1.2.3.4
@@ -86,8 +86,8 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-www.example.com. IN NS
-SECTION ANSWER
+www.example.com. IN A
+SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
 ns.example.com.		IN 	A	1.2.3.4
@@ -98,9 +98,9 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-www.example.com. IN A
+www.example.com. IN AAAA
 SECTION ANSWER
-www.example.com. IN A	10.20.30.40
+www.example.com. IN AAAA ::123
 SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
@@ -112,35 +112,35 @@ STEP 10 QUERY
 ENTRY_BEGIN
 REPLY RD
 SECTION QUESTION
-www.example.com. IN A
+www.example.com. IN AAAA
 ENTRY_END
 
 STEP 20 CHECK_OUT_QUERY
 ENTRY_BEGIN
 MATCH qname qtype opcode
 SECTION QUESTION
-com. IN NS
+com. IN A
 ENTRY_END
 
 STEP 30 CHECK_OUT_QUERY
 ENTRY_BEGIN
 MATCH qname qtype opcode
 SECTION QUESTION
-example.com. IN NS
+example.com. IN A
 ENTRY_END
 
 STEP 40 CHECK_OUT_QUERY
 ENTRY_BEGIN
 MATCH qname qtype opcode
 SECTION QUESTION
-www.example.com. IN NS
+www.example.com. IN A
 ENTRY_END
 
 STEP 50 CHECK_OUT_QUERY
 ENTRY_BEGIN
 MATCH qname qtype opcode
 SECTION QUESTION
-www.example.com. IN A
+www.example.com. IN AAAA
 ENTRY_END
 
 STEP 60 CHECK_ANSWER
@@ -148,9 +148,9 @@ ENTRY_BEGIN
 MATCH all
 REPLY QR RD RA NOERROR
 SECTION QUESTION
-www.example.com. IN A
+www.example.com. IN AAAA
 SECTION ANSWER
-www.example.com. IN A	10.20.30.40
+www.example.com. IN AAAA ::123
 SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
diff --git a/testdata/iter_resolve_minimised_nx.rpl b/testdata/iter_resolve_minimised_nx.rpl
index 4d91bb235bdc..cb877bc250b4 100644
--- a/testdata/iter_resolve_minimised_nx.rpl
+++ b/testdata/iter_resolve_minimised_nx.rpl
@@ -30,7 +30,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-com. IN NS
+com. IN A
 SECTION AUTHORITY
 com.	IN NS	a.gtld-servers.net.
 SECTION ADDITIONAL
@@ -46,8 +46,8 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-com. IN NS
-SECTION ANSWER
+com. IN A
+SECTION AUTHORITY
 com.	IN NS	a.gtld-servers.net.
 SECTION ADDITIONAL
 a.gtld-servers.net.	IN 	A	192.5.6.30
@@ -58,7 +58,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-example.com. IN NS
+example.com. IN A
 SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
@@ -74,8 +74,8 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
+example.com. IN A
+SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
 ns.example.com.		IN 	A	1.2.3.4
@@ -86,7 +86,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NXDOMAIN
 SECTION QUESTION
-ent.example.com. IN NS
+ent.example.com. IN A
 SECTION AUTHORITY
 example.com. SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
 ENTRY_END
diff --git a/testdata/iter_resolve_minimised_refused.rpl b/testdata/iter_resolve_minimised_refused.rpl
index dde546f11734..82852a4380cd 100644
--- a/testdata/iter_resolve_minimised_refused.rpl
+++ b/testdata/iter_resolve_minimised_refused.rpl
@@ -30,7 +30,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-com. IN NS
+com. IN A
 SECTION AUTHORITY
 com.	IN NS	a.gtld-servers.net.
 SECTION ADDITIONAL
@@ -46,8 +46,8 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-com. IN NS
-SECTION ANSWER
+com. IN A
+SECTION AUTHORITY
 com.	IN NS	a.gtld-servers.net.
 SECTION ADDITIONAL
 a.gtld-servers.net.	IN 	A	192.5.6.30
@@ -58,7 +58,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-example.com. IN NS
+example.com. IN A
 SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
@@ -74,7 +74,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR REFUSED
 SECTION QUESTION
-refused.example.com. IN NS
+refused.example.com. IN A
 ENTRY_END
 
 ENTRY_BEGIN
@@ -82,7 +82,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR REFUSED
 SECTION QUESTION
-www.refused.example.com. IN NS
+www.refused.example.com. IN A
 ENTRY_END
 
 ENTRY_BEGIN
@@ -90,9 +90,9 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-www.refused.example.com. IN A
+www.refused.example.com. IN AAAA
 SECTION ANSWER
-www.refused.example.com. IN A	10.20.30.40
+www.refused.example.com. IN AAAA	::1
 SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
@@ -104,7 +104,7 @@ STEP 10 QUERY
 ENTRY_BEGIN
 REPLY RD
 SECTION QUESTION
-www.refused.example.com. IN A
+www.refused.example.com. IN AAAA
 ENTRY_END
 
 STEP 20 CHECK_ANSWER
@@ -112,9 +112,9 @@ ENTRY_BEGIN
 MATCH all
 REPLY QR RD RA NOERROR
 SECTION QUESTION
-www.refused.example.com. IN A
+www.refused.example.com. IN AAAA
 SECTION ANSWER
-www.refused.example.com. IN A	10.20.30.40
+www.refused.example.com. IN AAAA ::1
 SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
diff --git a/testdata/iter_resolve_minimised_timeout.rpl b/testdata/iter_resolve_minimised_timeout.rpl
new file mode 100644
index 000000000000..2a166aff0e71
--- /dev/null
+++ b/testdata/iter_resolve_minimised_timeout.rpl
@@ -0,0 +1,152 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: yes
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test iterative qname minimised resolve of www.example.com. Simulate broken nameserver that drops QTYPE=A queries.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN AAAA
+SECTION ANSWER
+www.example.com. IN AAAA ::123
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN AAAA
+ENTRY_END
+
+STEP 20 CHECK_OUT_QUERY
+ENTRY_BEGIN
+MATCH qname qtype opcode
+SECTION QUESTION
+com. IN A
+ENTRY_END
+
+STEP 30 CHECK_OUT_QUERY
+ENTRY_BEGIN
+MATCH qname qtype opcode
+SECTION QUESTION
+example.com. IN A
+ENTRY_END
+
+STEP 40 CHECK_OUT_QUERY
+ENTRY_BEGIN
+MATCH qname qtype opcode
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 41 TIMEOUT
+STEP 42 TIMEOUT
+STEP 43 TIMEOUT
+
+STEP 50 CHECK_OUT_QUERY
+ENTRY_BEGIN
+MATCH qname qtype opcode
+SECTION QUESTION
+www.example.com. IN AAAA
+ENTRY_END
+
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN AAAA
+SECTION ANSWER
+www.example.com. IN AAAA ::123
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/local_acl_override.rpl b/testdata/local_acl_override.rpl
new file mode 100644
index 000000000000..b72afe6b0101
--- /dev/null
+++ b/testdata/local_acl_override.rpl
@@ -0,0 +1,93 @@
+; config options
+server:
+	local-zone: "1.example." transparent
+	local-zone: "2.example." transparent
+	access-control: 10.10.10.0/24 allow
+
+	local-zone-override: "1.example." 10.10.10.20/32 refuse
+	local-zone-override: "2.example." 10.10.10.30/32 refuse
+	local-zone-override: "2.example." 10.10.10.40/32 always_nxdomain
+
+forward-zone:
+	name: "example."
+	forward-addr: 1.2.3.4
+
+CONFIG_END
+SCENARIO_BEGIN Test local data queries
+
+RANGE_BEGIN 0 100
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+1.example. IN TXT
+SECTION ANSWER 
+1.example. IN TXT "data 1"
+ENTRY_END
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+2.example. IN TXT
+SECTION ANSWER 
+2.example. IN TXT "data 2"
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY ADDRESS 10.10.10.10
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+1.example. IN TXT
+ENTRY_END
+STEP 2 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA
+SECTION QUESTION
+1.example. IN TXT
+SECTION ANSWER
+1.example. IN TXT "data 1"
+ENTRY_END
+
+STEP 3 QUERY ADDRESS 10.10.10.20
+ENTRY_BEGIN
+SECTION QUESTION
+1.example. IN TXT
+ENTRY_END
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA REFUSED
+SECTION QUESTION
+1.example. IN TXT
+ENTRY_END
+
+STEP 5 QUERY ADDRESS 10.10.10.30
+ENTRY_BEGIN
+SECTION QUESTION
+2.example. IN TXT
+ENTRY_END
+STEP 6 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA REFUSED
+SECTION QUESTION
+2.example. IN TXT
+ENTRY_END
+
+STEP 7 QUERY ADDRESS 10.10.10.40
+ENTRY_BEGIN
+SECTION QUESTION
+2.example. IN TXT
+ENTRY_END
+STEP 8 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA NXDOMAIN
+SECTION QUESTION
+2.example. IN TXT
+ENTRY_END
+SCENARIO_END
diff --git a/testdata/local_acl_taglist.rpl b/testdata/local_acl_taglist.rpl
new file mode 100644
index 000000000000..834abe81e4f3
--- /dev/null
+++ b/testdata/local_acl_taglist.rpl
@@ -0,0 +1,169 @@
+; config options
+server:
+	define-tag: "tag1 tag2 tag3"
+	define-tag: "tag4"
+	local-zone: "example." redirect
+	local-data: 'example. IN TXT "data 0"'
+	local-zone: "d.example." static
+	local-data: 'd.example. IN TXT "data 1"'
+	local-zone: "c.d.example." redirect
+	local-data: 'c.d.example. IN TXT "data 2"'
+	local-zone: "b.c.d.example." redirect
+	local-data: 'b.c.d.example. IN TXT "data 3"'
+	local-zone: "foo." redirect
+	local-data: 'foo. IN TXT "data plain 4"'
+
+	; no tags for local-zones example. and c.d.example.
+	local-zone-tag: "d.example." "tag1 tag2"
+	local-zone-tag: "b.c.d.example." "tag3"
+	local-zone-tag: "foo." "tag4"
+
+	access-control: 10.10.10.0/24 allow
+	access-control-tag: 10.10.10.20/32 "tag1"
+	access-control-tag: 10.10.10.30/32 "tag2 tag3"
+	access-control-tag: 10.10.10.40/32 "tag3"
+
+	access-control-tag: 10.10.10.50/32 "tag4"
+	access-control-tag-data: 10.10.10.50/32 "tag4" 'TXT "data tag4"'
+	access-control-tag: 10.10.10.60/32 "tag4"
+	
+
+CONFIG_END
+SCENARIO_BEGIN Test local data queries
+
+STEP 1 QUERY ADDRESS 10.10.10.10
+ENTRY_BEGIN
+SECTION QUESTION
+d.example. IN TXT
+ENTRY_END
+STEP 2 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+d.example. IN TXT
+SECTION ANSWER
+d.example. IN TXT "data 0"
+ENTRY_END
+
+STEP 3 QUERY ADDRESS 10.10.10.20
+ENTRY_BEGIN
+SECTION QUESTION
+d.example. IN TXT
+ENTRY_END
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+d.example. IN TXT
+SECTION ANSWER
+d.example. IN TXT "data 1"
+ENTRY_END
+
+STEP 5 QUERY ADDRESS 10.10.10.30
+ENTRY_BEGIN
+SECTION QUESTION
+d.example. IN TXT
+ENTRY_END
+STEP 6 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+d.example. IN TXT
+SECTION ANSWER
+d.example. IN TXT "data 1"
+ENTRY_END
+
+STEP 7 QUERY ADDRESS 10.10.10.40
+ENTRY_BEGIN
+SECTION QUESTION
+d.example. IN TXT
+ENTRY_END
+STEP 8 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+d.example. IN TXT
+SECTION ANSWER
+d.example. IN TXT "data 0"
+ENTRY_END
+
+STEP 9 QUERY ADDRESS 10.10.10.20
+ENTRY_BEGIN
+SECTION QUESTION
+c.d.example. IN TXT
+ENTRY_END
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+c.d.example. IN TXT
+SECTION ANSWER
+c.d.example. IN TXT "data 2"
+ENTRY_END
+
+STEP 11 QUERY ADDRESS 10.10.10.20
+ENTRY_BEGIN
+SECTION QUESTION
+a.b.c.d.example. IN TXT
+ENTRY_END
+STEP 12 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+a.b.c.d.example. IN TXT
+SECTION ANSWER
+a.b.c.d.example. IN TXT "data 2"
+ENTRY_END
+
+STEP 13 QUERY ADDRESS 10.10.10.30
+ENTRY_BEGIN
+SECTION QUESTION
+a.b.c.d.example. IN TXT
+ENTRY_END
+STEP 14 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+a.b.c.d.example. IN TXT
+SECTION ANSWER
+a.b.c.d.example. IN TXT "data 3"
+ENTRY_END
+
+STEP 15 QUERY ADDRESS 10.10.10.50
+ENTRY_BEGIN
+SECTION QUESTION
+www.foo. IN TXT
+ENTRY_END
+STEP 16 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+www.foo. IN TXT
+SECTION ANSWER
+www.foo. IN TXT "data tag4"
+ENTRY_END
+
+STEP 17 QUERY ADDRESS 10.10.10.60
+ENTRY_BEGIN
+SECTION QUESTION
+www.foo. IN TXT
+ENTRY_END
+STEP 18 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+www.foo. IN TXT
+SECTION ANSWER
+www.foo. IN TXT "data plain 4"
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/local_acl_taglist_action.rpl b/testdata/local_acl_taglist_action.rpl
new file mode 100644
index 000000000000..9977e0213571
--- /dev/null
+++ b/testdata/local_acl_taglist_action.rpl
@@ -0,0 +1,125 @@
+; config options
+server:
+	define-tag: "tag1 tag2 tag3"
+	local-zone: "example." static
+	local-data: 'example. IN TXT "data 0"'
+
+	local-zone-tag: "example." "tag1 tag2 tag3"
+
+	access-control: 10.10.10.0/24 allow
+	access-control-tag: 10.10.10.10/32 "tag1"
+	access-control-tag: 10.10.10.20/32 "tag2 tag3"
+	access-control-tag: 10.10.10.30/32 "tag3"
+	access-control-tag: 10.10.10.40/32 "tag3"
+	access-control-tag: 10.10.10.50/32 "tag3"
+
+	access-control-tag-action: 10.10.10.10/32 tag1 always_refuse 
+	access-control-tag-action: 10.10.10.20/32 tag2 always_nxdomain 
+	access-control-tag-action: 10.10.10.30/32 tag3 always_refuse 
+	access-control-tag-action: 10.10.10.50/32 tag3 always_transparent 
+
+forward-zone:
+	name: "example."
+	forward-addr: 1.2.3.4
+
+CONFIG_END
+SCENARIO_BEGIN Test local data queries
+
+RANGE_BEGIN 0 100
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example. IN TXT
+SECTION ANSWER 
+example. IN TXT "data 1"
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY ADDRESS 10.10.10.10
+ENTRY_BEGIN
+SECTION QUESTION
+example. IN TXT
+ENTRY_END
+STEP 2 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA REFUSED
+SECTION QUESTION
+example. IN TXT
+ENTRY_END
+
+STEP 3 QUERY ADDRESS 10.10.10.20
+ENTRY_BEGIN
+SECTION QUESTION
+example. IN TXT
+ENTRY_END
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA NXDOMAIN
+SECTION QUESTION
+example. IN TXT
+ENTRY_END
+
+STEP 5 QUERY ADDRESS 10.10.10.30
+ENTRY_BEGIN
+SECTION QUESTION
+example. IN TXT
+ENTRY_END
+STEP 6 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA REFUSED
+SECTION QUESTION
+example. IN TXT
+ENTRY_END
+
+STEP 7 QUERY ADDRESS 10.10.10.40
+ENTRY_BEGIN
+SECTION QUESTION
+example. IN TXT
+ENTRY_END
+STEP 8 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA
+SECTION QUESTION
+example. IN TXT
+SECTION ANSWER
+example. IN TXT "data 0"
+ENTRY_END
+
+STEP 9 QUERY ADDRESS 10.10.10.50
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+example. IN TXT
+ENTRY_END
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA
+SECTION QUESTION
+example. IN TXT
+SECTION ANSWER
+example. IN TXT "data 1"
+ENTRY_END
+
+STEP 11 QUERY ADDRESS 10.10.10.60
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+example. IN TXT
+ENTRY_END
+STEP 12 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA
+SECTION QUESTION
+example. IN TXT
+SECTION ANSWER
+example. IN TXT "data 1"
+ENTRY_END
+SCENARIO_END
diff --git a/util/alloc.c b/util/alloc.c
index 05d2fa36207b..a1152a7cf9fa 100644
--- a/util/alloc.c
+++ b/util/alloc.c
@@ -64,7 +64,7 @@ alloc_setup_special(alloc_special_t* t)
  * @param alloc: the structure to fill up.
  */
 static void
-prealloc(struct alloc_cache* alloc)
+prealloc_setup(struct alloc_cache* alloc)
 {
 	alloc_special_t* p;
 	int i;
@@ -216,7 +216,7 @@ alloc_special_obtain(struct alloc_cache* alloc)
 		}
 	}
 	/* allocate new */
-	prealloc(alloc);
+	prealloc_setup(alloc);
 	if(!(p = (alloc_special_t*)malloc(sizeof(alloc_special_t)))) {
 		log_err("alloc_special_obtain: out of memory");
 		return NULL;
diff --git a/util/config_file.c b/util/config_file.c
index 3e72bcad06b1..b13a49c7b157 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -212,6 +212,7 @@ config_create(void)
 	cfg->local_zones = NULL;
 	cfg->local_zones_nodefault = NULL;
 	cfg->local_data = NULL;
+	cfg->local_zone_overrides = NULL;
 	cfg->unblock_lan_zones = 0;
 	cfg->insecure_lan_zones = 0;
 	cfg->python_script = NULL;
@@ -640,6 +641,14 @@ config_collate_cat(struct config_strlist* list)
 		func(buf, arg); \
 	} \
 	}
+/** compare and print list option */
+#define O_LS3(opt, name, lst) if(strcmp(opt, name)==0) { \
+	struct config_str3list* p = cfg->lst; \
+	for(p = cfg->lst; p; p = p->next) { \
+		snprintf(buf, len, "%s %s %s", p->str, p->str2, p->str3); \
+		func(buf, arg); \
+	} \
+	}
 /** compare and print taglist option */
 #define O_LTG(opt, name, lst) if(strcmp(opt, name)==0) { \
 	char* tmpstr = NULL; \
@@ -784,6 +793,10 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "qname-minimisation", qname_minimisation)
 	else O_IFC(opt, "define-tag", num_tags, tagname)
 	else O_LTG(opt, "local-zone-tag", local_zone_tags)
+	else O_LTG(opt, "access-control-tag", acl_tags)
+	else O_LS3(opt, "local-zone-override", local_zone_overrides)
+	else O_LS3(opt, "access-control-tag-action", acl_tag_actions)
+	else O_LS3(opt, "access-control-tag-data", acl_tag_datas)
 	/* not here:
 	 * outgoing-permit, outgoing-avoid - have list of ports
 	 * local-zone - zones and nodefault variables
@@ -936,6 +949,20 @@ config_deldblstrlist(struct config_str2list* p)
 }
 
 void
+config_deltrplstrlist(struct config_str3list* p)
+{
+	struct config_str3list *np;
+	while(p) {
+		np = p->next;
+		free(p->str);
+		free(p->str2);
+		free(p->str3);
+		free(p);
+		p = np;
+	}
+}
+
+void
 config_delstub(struct config_stub* p)
 {
 	if(!p) return;
@@ -969,8 +996,7 @@ config_del_strarray(char** array, int num)
 	free(array);
 }
 
-/** delete stringbytelist */
-static void
+void
 config_del_strbytelist(struct config_strbytelist* p)
 {
 	struct config_strbytelist* np;
@@ -1020,8 +1046,12 @@ config_delete(struct config_file* cfg)
 	config_deldblstrlist(cfg->local_zones);
 	config_delstrlist(cfg->local_zones_nodefault);
 	config_delstrlist(cfg->local_data);
+	config_deltrplstrlist(cfg->local_zone_overrides);
 	config_del_strarray(cfg->tagname, cfg->num_tags);
 	config_del_strbytelist(cfg->local_zone_tags);
+	config_del_strbytelist(cfg->acl_tags);
+	config_deltrplstrlist(cfg->acl_tag_actions);
+	config_deltrplstrlist(cfg->acl_tag_datas);
 	config_delstrlist(cfg->control_ifs);
 	free(cfg->server_key_file);
 	free(cfg->server_cert_file);
@@ -1180,6 +1210,23 @@ int cfg_strlist_append(struct config_strlist_head* list, char* item)
 }
 
 int 
+cfg_region_strlist_insert(struct regional* region,
+	struct config_strlist** head, char* item)
+{
+	struct config_strlist *s;
+	if(!item || !head)
+		return 0;
+	s = (struct config_strlist*)regional_alloc_zero(region,
+		sizeof(struct config_strlist));
+	if(!s)
+		return 0;
+	s->str = item;
+	s->next = *head;
+	*head = s;
+	return 1;
+}
+
+int 
 cfg_strlist_insert(struct config_strlist** head, char* item)
 {
 	struct config_strlist *s;
@@ -1210,6 +1257,24 @@ cfg_str2list_insert(struct config_str2list** head, char* item, char* i2)
 	return 1;
 }
 
+int 
+cfg_str3list_insert(struct config_str3list** head, char* item, char* i2,
+	char* i3)
+{
+	struct config_str3list *s;
+	if(!item || !i2 || !i3 || !head)
+		return 0;
+	s = (struct config_str3list*)calloc(1, sizeof(struct config_str3list));
+	if(!s)
+		return 0;
+	s->str = item;
+	s->str2 = i2;
+	s->str3 = i3;
+	s->next = *head;
+	*head = s;
+	return 1;
+}
+
 int
 cfg_strbytelist_insert(struct config_strbytelist** head, char* item,
 	uint8_t* i2, size_t i2len)
@@ -1373,6 +1438,7 @@ cfg_set_bit(uint8_t* bitlist, size_t len, int id)
 {
 	int pos = id/8;
 	log_assert((size_t)pos < len);
+	(void)len;
 	bitlist[pos] |= 1<<(id%8);
 }
 
diff --git a/util/config_file.h b/util/config_file.h
index a51cdb464c0c..07edff7b4cf4 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -44,10 +44,12 @@
 struct config_stub;
 struct config_strlist;
 struct config_str2list;
+struct config_str3list;
 struct config_strbytelist;
 struct module_qstate;
 struct sock_list;
 struct ub_packed_rrset_key;
+struct regional;
 
 /**
  * The configuration options.
@@ -73,6 +75,8 @@ struct config_file {
 	int do_ip4;
 	/** do ip6 query support. */
 	int do_ip6;
+	/** prefer ip6 upstream queries. */
+	int prefer_ip6;
 	/** do udp query support. */
 	int do_udp;
 	/** do tcp query support. */
@@ -292,12 +296,20 @@ struct config_file {
 	struct config_strlist* local_zones_nodefault;
 	/** local data RRs configured */
 	struct config_strlist* local_data;
+	/** local zone override types per netblock */
+	struct config_str3list* local_zone_overrides;
 	/** unblock lan zones (reverse lookups for AS112 zones) */
 	int unblock_lan_zones;
 	/** insecure lan zones (don't validate AS112 zones) */
 	int insecure_lan_zones;
 	/** list of zonename, tagbitlist */
 	struct config_strbytelist* local_zone_tags;
+	/** list of aclname, tagbitlist */
+	struct config_strbytelist* acl_tags;
+	/** list of aclname, tagname, localzonetype */
+	struct config_str3list* acl_tag_actions;
+	/** list of aclname, tagname, redirectdata */
+	struct config_str3list* acl_tag_datas;
 	/** tag list, array with tagname[i] is malloced string */
 	char** tagname;
 	/** number of items in the taglist */
@@ -434,6 +446,21 @@ struct config_str2list {
 };
 
 /**
+ * List of three strings for config options
+ */
+struct config_str3list {
+	/** next item in list */
+	struct config_str3list* next;
+	/** first string */
+	char* str;
+	/** second string */
+	char* str2;
+	/** third string */
+	char* str3;
+};
+
+
+/**
  * List of string, bytestring for config options
  */
 struct config_strbytelist {
@@ -575,6 +602,10 @@ int cfg_strlist_append(struct config_strlist_head* list, char* item);
  */
 int cfg_strlist_insert(struct config_strlist** head, char* item);
 
+/** insert with region for allocation. */
+int cfg_region_strlist_insert(struct regional* region,
+	struct config_strlist** head, char* item);
+
 /**
  * Insert string into str2list.
  * @param head: pointer to str2list head variable.
@@ -585,8 +616,19 @@ int cfg_strlist_insert(struct config_strlist** head, char* item);
 int cfg_str2list_insert(struct config_str2list** head, char* item, char* i2);
 
 /**
+ * Insert string into str3list.
+ * @param head: pointer to str3list head variable.
+ * @param item: new item. malloced by caller. If NULL the insertion fails.
+ * @param i2: 2nd string, malloced by caller. If NULL the insertion fails.
+ * @param i3: 3rd string, malloced by caller. If NULL the insertion fails.
+ * @return: true on success.
+ */
+int cfg_str3list_insert(struct config_str3list** head, char* item, char* i2,
+	char* i3);
+
+/**
  * Insert string into strbytelist.
- * @param head: pointer to str2list head variable.
+ * @param head: pointer to strbytelist head variable.
  * @param item: new item. malloced by caller. If NULL the insertion fails.
  * @param i2: 2nd string, malloced by caller. If NULL the insertion fails.
  * @param i2len: length of the i2 bytestring.
@@ -619,6 +661,15 @@ void config_delstrlist(struct config_strlist* list);
 void config_deldblstrlist(struct config_str2list* list);
 
 /**
+ * Delete items in config triple string list.
+ * @param list: list.
+ */
+void config_deltrplstrlist(struct config_str3list* list);
+
+/** delete stringbytelist */
+void config_del_strbytelist(struct config_strbytelist* list);
+
+/**
  * Delete a stub item
  * @param p: stub item
  */
diff --git a/util/configlexer.c b/util/configlexer.c
index bd510369c25f..533420463aa8 100644
--- a/util/configlexer.c
+++ b/util/configlexer.c
@@ -184,7 +184,7 @@ extern FILE *yyin, *yyout;
 	do \
 		{ \
 		/* Undo effects of setting up yytext. */ \
-        yy_size_t yyless_macro_arg = (n); \
+        int yyless_macro_arg = (n); \
         YY_LESS_LINENO(yyless_macro_arg);\
 		*yy_cp = (yy_hold_char); \
 		YY_RESTORE_YY_MORE_OFFSET \
@@ -378,8 +378,8 @@ static void yy_fatal_error (yyconst char msg[]  );
 	*yy_cp = '\0'; \
 	(yy_c_buf_p) = yy_cp;
 
-#define YY_NUM_RULES 183
-#define YY_END_OF_BUFFER 184
+#define YY_NUM_RULES 188
+#define YY_END_OF_BUFFER 189
 /* This struct is not used in this scanner,
    but its presence is necessary. */
 struct yy_trans_info
@@ -387,211 +387,214 @@ struct yy_trans_info
 	flex_int32_t yy_verify;
 	flex_int32_t yy_nxt;
 	};
-static yyconst flex_int16_t yy_accept[1847] =
+static yyconst flex_int16_t yy_accept[1880] =
     {   0,
-        1,    1,  165,  165,  169,  169,  173,  173,  177,  177,
-        1,    1,  184,  181,    1,  163,  163,  182,    2,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  182,
-      165,  166,  166,  167,  182,  169,  170,  170,  171,  182,
-      176,  173,  174,  174,  175,  182,  177,  178,  178,  179,
-      182,  180,  164,    2,  168,  180,  182,  181,    0,    1,
-        2,    2,    2,    2,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  165,    0,  169,    0,
-      176,    0,  173,  177,    0,  180,    0,    2,    2,  180,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  181,  181,  181,  180,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  180,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,   74,  181,  181,  181,  181,  181,  181,    7,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  180,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  180,  181,  181,  181,  181,  181,   34,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  143,  181,
-       13,   14,  181,   16,   15,  181,  181,  181,  181,  181,
-
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  134,  181,  181,  181,
-      181,  181,  181,  181,    3,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  180,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  172,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,   37,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,   38,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,   18,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,   89,  172,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-       88,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,   72,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,   23,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,   35,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,   36,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,   25,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  157,  181,  181,  181,  181,  181,  181,   29,
-      181,   30,  181,  181,  181,   75,  181,   76,  181,   73,
-
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,    6,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  141,
-      181,  181,  181,  181,   91,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,   26,  181,
-      181,  181,  181,  181,  181,  117,  181,  116,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  181,  181,   39,  181,  181,  181,  181,  181,  181,
-      181,  181,   78,   77,  181,  181,  181,  181,  181,  181,
-      181,  113,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,   57,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,   61,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,   33,  181,  181,  181,  181,  181,  181,  181,  115,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,    5,
-
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  109,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  127,  181,  110,  181,  181,  139,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,   24,  181,  181,
-      181,  181,   80,  181,   81,   79,  181,  181,  181,  181,
-      181,  181,  181,   87,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  111,  181,  181,  181,
-
-      181,  181,  138,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,   71,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,   31,  181,  181,   20,  181,  181,  181,   17,  181,
-       96,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,   46,   48,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  144,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-       82,  181,  181,  181,  181,  181,  181,   86,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  181,  181,  181,  181,  181,   90,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      133,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  100,  181,  104,  181,  181,  181,  181,
-       85,  181,  181,   67,  181,  125,  181,  181,  181,  181,
-      181,  140,  181,  181,  181,  181,  181,  181,  181,  149,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  103,  181,  181,  181,  181,  181,   49,   50,  181,
-      181,   32,   56,  105,  181,  118,  142,  114,  181,  181,
-
-       42,  181,  107,  181,  181,  181,  181,  181,    8,  181,
-      181,  181,   70,  181,  181,  181,  181,  159,  181,  124,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,   92,  148,
-      181,  181,  181,  181,  181,  181,  181,  181,  135,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  106,  181,   41,   43,  181,  181,
-      181,  181,  181,  181,  181,   69,  181,  181,  181,  181,
-      158,  181,  181,  181,  181,  129,   21,   22,  181,  181,
-
-      181,  181,  181,  181,  181,   66,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  131,  128,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,   40,  181,  181,
-      181,  181,  181,  181,  181,   12,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,   11,  181,  181,   19,  181,
-      181,  181,  162,  181,   44,  181,  137,  130,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,   99,
-       98,  181,  181,  132,  126,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,   51,  181,  181,  136,  181,  181,
-
-      181,  181,  181,  181,  181,  181,   45,  181,  181,  181,
-       93,   95,  119,  181,  181,  181,   97,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  145,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      120,  181,  181,   27,  181,  181,  181,    4,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  147,  181,  181,  123,  181,
-      181,  181,  181,  181,  181,  181,   54,  181,   28,  181,
-       10,  181,  181,  181,  181,  181,  121,   58,  181,  181,
-      181,  102,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      146,   83,  181,  181,  181,  181,   60,   64,   59,  181,
-       52,  181,    9,  181,  181,  160,  181,  181,  101,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-       65,   63,  181,   53,  181,  112,  181,  122,  181,  181,
-       94,   47,  181,  181,  181,  181,  181,  181,  181,   84,
-       62,   55,  161,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,   68,  181,  156,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-
-      181,  108,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      152,  181,  181,  181,  181,  181,  181,  181,  181,  181,
-      181,  181,  181,  181,  150,  181,  153,  154,  181,  181,
-      181,  181,  181,  151,  155,    0
+        1,    1,  170,  170,  174,  174,  178,  178,  182,  182,
+        1,    1,  189,  186,    1,  168,  168,  187,    2,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  187,
+      170,  171,  171,  172,  187,  174,  175,  175,  176,  187,
+      181,  178,  179,  179,  180,  187,  182,  183,  183,  184,
+      187,  185,  169,    2,  173,  185,  187,  186,    0,    1,
+        2,    2,    2,    2,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  170,    0,  174,    0,
+      181,    0,  178,  182,    0,  185,    0,    2,    2,  185,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  185,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  185,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,   75,  186,  186,  186,  186,  186,  186,    7,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  185,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  185,  186,  186,  186,  186,  186,   35,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  148,
+      186,   13,   14,  186,   17,   16,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  135,  186,
+      186,  186,  186,  186,  186,  186,    3,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  185,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  177,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,   38,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,   39,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+       19,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,   90,  177,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,   89,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,   73,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,   24,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,   36,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,   37,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,   26,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  162,  186,  186,
+      186,  186,  186,  186,   30,  186,   31,  186,  186,  186,
+
+       76,  186,   77,  186,   74,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+        6,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  142,  186,  186,  186,  186,   92,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,   27,  186,  186,  186,  186,  186,  186,
+      118,  186,  117,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,   15,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,   40,
+      186,  186,  186,  186,  186,  186,  186,  186,   79,   78,
+      186,  186,  186,  186,  186,  186,  186,  114,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,   58,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,   62,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,   34,  186,  186,
+      186,  186,  186,  186,  186,  186,  116,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,    5,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  110,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  128,  186,
+      111,  186,  186,  140,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,   25,  186,  186,  186,  186,   81,
+      186,   82,   80,  186,  186,  186,  186,  186,  186,  186,
+       88,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+
+      186,  186,  186,  112,  186,  186,  186,  186,  186,  186,
+      139,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,   72,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,   32,
+      186,  186,   21,  186,  186,  186,   18,  186,   97,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,   47,   49,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  149,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,   83,  186,
+      186,  186,  186,  186,  186,   87,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,   91,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  134,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  101,  186,  105,  186,  186,  186,  186,  186,
+       86,  186,  186,   68,  186,  126,  186,  186,  186,  186,
+      186,  141,  186,  186,  186,  186,  186,  186,  186,  154,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  104,  186,  186,  186,  186,  186,   50,   51,  186,
+
+      186,   33,   57,  106,  186,  119,  186,  143,  115,  186,
+      186,   43,  186,  108,  186,  186,  186,  186,  186,    8,
+      186,  186,  186,   71,  186,  186,  186,  186,  164,  186,
+      125,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+       93,  153,  186,  186,  186,  186,  186,  186,  186,  186,
+      136,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  107,  186,  186,   42,
+       44,  186,  186,  186,  186,  186,  186,  186,   70,  186,
+
+      186,  186,  186,  163,  186,  186,  186,  186,  130,   22,
+       23,  186,  186,  186,  186,  186,  186,  186,   67,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      132,  129,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,   41,  186,  186,  186,  186,  186,  186,  186,   12,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+       11,  186,  186,   20,  186,  186,  186,  167,  186,   45,
+      186,  138,  131,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  100,   99,  186,  186,  186,  133,
+      127,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+       52,  186,  186,  186,  137,  186,  186,  186,  186,  186,
+      186,  186,  186,   46,  186,  186,  186,   94,   96,  120,
+      186,  186,  186,   98,  186,  186,  144,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  150,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  121,
+      186,  186,  186,   28,  186,  186,  186,    4,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  152,  186,  186,
+      124,  186,  186,  186,  186,  186,  186,  186,   55,  186,
+
+       29,  147,  186,   10,  186,  186,  186,  186,  186,  122,
+       59,  186,  186,  186,  103,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  151,   84,  186,  186,  186,
+      186,   61,   65,   60,  186,   53,  186,    9,  186,  186,
+      165,  186,  186,  102,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,   66,   64,  186,
+       54,  186,  113,  186,  123,  186,  186,  186,  186,   95,
+       48,  186,  186,  186,  186,  186,  186,  186,   85,   63,
+       56,  166,  186,  186,  186,  146,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+
+      186,  186,  186,   69,  186,  145,  161,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  109,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  157,  186,  186,  186,  186,  186,  186,
+      186,  186,  186,  186,  186,  186,  186,  155,  186,  158,
+      159,  186,  186,  186,  186,  186,  156,  160,    0
     } ;
 
 static yyconst YY_CHAR yy_ec[256] =
@@ -637,15 +640,15 @@ static yyconst YY_CHAR yy_meta[66] =
         1,    1,    1,    1,    1
     } ;
 
-static yyconst flex_uint16_t yy_base[1861] =
+static yyconst flex_uint16_t yy_base[1894] =
     {   0,
         0,    0,   63,   66,   69,   71,   77,   83,   88,   91,
-      129,  135,  355,  314,   95, 5329, 5329, 5329,  107,  110,
+      129,  135,  355,  314,   95, 5425, 5425, 5425,  107,  110,
       142,  180,  108,   50,  145,  172,  118,  148,  121,  181,
       197,  166,  241,  137,  225,  260,  233,  228,  257,  116,
-      263, 5329, 5329, 5329,   94,  244, 5329, 5329, 5329,   96,
-      221,  251, 5329, 5329, 5329,  304,  212, 5329, 5329, 5329,
-      102,  208, 5329,  308, 5329,  268,  318,  206,  322,  111,
+      263, 5425, 5425, 5425,   94,  244, 5425, 5425, 5425,   96,
+      221,  251, 5425, 5425, 5425,  304,  212, 5425, 5425, 5425,
+      102,  208, 5425,  308, 5425,  268,  318,  206,  322,  111,
         0,  326,    0,    0,  201,  170,  217,  317,  193,  309,
       318,  310,  183,  312,  336,  311,  307,  341,  343,  245,
       335,  350,  363,  156,  346,  370,  371,  357,  358,  376,
@@ -675,385 +678,395 @@ static yyconst flex_uint16_t yy_base[1861] =
      1018, 1024, 1032, 1039, 1052, 1001, 1037, 1042, 1049, 1041,
      1057, 1066, 1051, 1061, 1065, 1067, 1068, 1069, 1089, 1097,
      1078, 1103, 1107, 1085, 1099, 1098, 1105, 1113, 1115, 1100,
-     1118, 5329, 1122, 1117, 1131, 1134, 1132, 1141, 5329, 1135,
-     1136, 1137, 1158, 1148, 1162, 1161, 1164, 1154, 1149, 1165,
-     1170, 1175, 1168, 1177, 1184, 1230, 1185, 1187, 1191, 1220,
-     1212, 1201, 1222, 1183, 1226, 1228, 1232, 1245, 1218, 1202,
-     1235, 1252, 1247, 1253, 1265, 1279, 1264, 1259, 1271, 1270,
-     1281, 1273, 1286, 1282, 1287, 1274, 1297, 1296, 1291, 1319,
-     1309, 1320, 1325, 1331, 1328, 1330, 1335, 1311, 1334, 1329,
-
-     1344, 1337, 1338, 1347, 1346, 1345, 1349, 1372, 1351, 1378,
-     1364, 1376, 1371, 1387, 1377, 1389, 1391, 1383, 1407, 1396,
-     1405, 1412, 1404, 1419, 1423, 1427, 1428, 1411, 1422, 1431,
-     1432, 1438, 1435, 1470, 1448, 1456, 1446, 1462, 1473, 1478,
-     1475, 1453, 1479, 1466, 1467, 1463, 1487, 1488, 1486, 1501,
-     1499, 1505, 1483, 1502, 1504, 1524, 1526, 1522, 1531, 1511,
-     1518, 1528, 1532, 1535, 1549, 1560, 1564, 1543, 1566, 1562,
-     1558, 1570, 1574, 1576, 1557, 1581, 1585, 5329, 1583, 1586,
-     1591, 1599, 1596, 1619, 1608, 1602, 1600, 1648, 5329, 1609,
-     5329, 5329, 1615, 5329, 5329, 1622, 1628, 1635, 1623, 1697,
-
-     1649, 1638, 1644, 1661, 1645, 1666, 1662, 1680, 1678, 1681,
-     1700, 1687, 1683, 1702, 1691, 1713, 1712, 1722, 1718, 1717,
-     1729, 1737, 1641, 1745, 1743, 1747, 1744, 1749, 1736, 1750,
-     1751, 1748, 1765, 1760, 1770, 1764, 5329, 1777, 1779, 1766,
-     1775, 1797, 1784, 1806, 5329, 1780, 1795, 1787, 1785, 1796,
-     1810, 1811, 1815, 1813, 1802, 1825, 1827, 1833, 1843, 1829,
-     1836, 1855, 1857, 1858, 1840, 1852, 1860, 1848, 1870, 1876,
-     1875, 1856, 1867, 1877, 1861, 1890, 1893, 1884, 1891, 1887,
-     1885, 1886, 1896, 1941, 1914, 1920, 1913, 1904, 1933, 1934,
-     1927, 1907, 1931, 1959, 1938, 1970, 1961, 1955, 1960, 1964,
-
-     1968, 1943, 1998, 1971, 1987, 1980, 1988, 2002, 2008, 2001,
-     2018, 2015, 2011, 2012, 5329, 2021, 2017, 2022, 2010, 2026,
-     2047, 2027, 2048, 2039, 2049, 2037, 2060, 2042, 2053, 2054,
-     2064, 5329, 2051, 2059, 2073, 2066, 2090, 2091, 2092, 2098,
-     2076, 2089, 5329, 2109, 2106, 2105, 2097, 2093, 2112, 2094,
-     2128, 2121, 2125, 2138, 2139, 2133, 2140, 2144, 2141, 2129,
-     2148, 2135, 2160, 2161, 2169, 2158, 2159, 5329, 2165, 2186,
-     2173, 2185, 2198, 2199, 2178, 2201, 2188, 2190, 2191,  120,
-     2196, 2210, 2202, 2208, 5329,   76, 2213, 2217, 2216, 2226,
-     2242, 2234, 2240, 2235, 2237, 2247, 2241, 2231, 2248, 2258,
-
-     2238, 2270, 2266, 2263, 2265, 2267, 2285, 2283, 2282, 2277,
-     2292, 2278, 2290, 2297, 2284, 2301, 2308, 2316, 2312, 2310,
-     2317, 2324, 2322, 2319, 2315, 2323, 2339, 2340, 2333, 2347,
-     5329, 2344, 2343, 2354, 2349, 2359, 2361, 2379, 2358, 2376,
-     2386, 2365, 2384, 2398, 2394, 2392, 2396, 2406, 2399, 2404,
-     2388, 2400, 2403, 2414, 2411, 2428, 2451, 2436, 2435, 5329,
-     2443, 2424, 2430, 2441, 2453, 2458, 2457, 2473, 2468, 2434,
-     2431, 2486, 2474, 2488, 5329, 2487, 2492, 2483, 2491, 2484,
-     2493, 2500, 2506, 2501, 2507, 2514, 2518, 2524, 2508, 2530,
-     2531, 5329, 2534, 2541, 2535, 2546, 2545, 2528, 2532, 2544,
-
-     2549, 2533, 2550, 2564, 2555, 2567, 2562, 2565, 2568, 2560,
-     2572, 2581, 2597, 2577, 2593, 5329, 2582, 2614, 2594, 2608,
-     2617, 2604, 2626, 2625, 2612, 2613, 2607, 2620, 2631, 2624,
-     2628, 2645, 2639, 2635, 2647, 2652, 2653, 2651, 2659, 2666,
-     2672, 2665, 2662, 2675, 2676, 2680, 2691, 2689, 2709, 2686,
-     2705, 5329, 2708, 2707, 2694, 2710, 2713, 2703, 2724, 2729,
-     2725, 2726, 2720, 2731, 2735, 2730, 2736, 2740, 2742, 2747,
-     2751, 2743, 2733, 2775, 2777, 2767, 2778, 2781, 2771, 2786,
-     2774, 2813, 5329, 2769, 2790, 2794, 2793, 2798, 2804, 5329,
-     2809, 5329, 2823, 2829, 2833, 5329, 2834, 5329, 2835, 5329,
-
-     2836, 2837, 2826, 2822, 2844, 2843, 2852, 2851, 2849, 2871,
-     2855, 2862, 2876, 2864, 2879, 5329, 2863, 2874, 2885, 2882,
-     2875, 2896, 2908, 2898, 2903, 2892, 2924, 2901, 2930, 5329,
-     2913, 2929, 2912, 2928, 5329, 2909, 2936, 2926, 2922, 2944,
-     2945, 2941, 2943, 2954, 2951, 2963, 2971, 2974, 2964, 2961,
-     2965, 2978, 2988, 2972, 2989, 2987, 2991, 2979, 2984, 2993,
-     3003, 3007, 3012, 3030, 3008, 3009, 3018, 3006, 5329, 3037,
-     3033, 3026, 3035, 3039, 3031, 5329, 3023, 5329, 3049, 3058,
-     3062, 3055, 3054, 3053, 3074, 3064, 3081, 3079, 3075, 3080,
-     3069, 3070, 3076, 3097, 3090, 3094, 3103, 3089, 3114, 3113,
-
-     3128, 3125, 3108, 5329, 3131, 3120, 3132, 3127, 3124, 3150,
-     3135, 3154, 5329, 5329, 3141, 3153, 3151, 3155, 3171, 3156,
-     3161, 5329, 3165, 3182, 3168, 3184, 3192, 3178, 3180, 3193,
-     3191, 3188, 3210, 3209, 3211, 3206, 3214, 3215, 3204, 3220,
-     3228, 3229, 3234, 5329, 3235, 3230, 3243, 3233, 3241, 3242,
-     3252, 3248, 3253, 3262, 3254, 3250, 3276, 3286, 3266, 3269,
-     3275, 3283, 3277, 3294, 3299, 3296, 3290, 3302, 5329, 3310,
-     3289, 3312, 3293, 3309, 3324, 3316, 3328, 3311, 3326, 3323,
-     3329, 5329, 3321, 3333, 3330, 3337, 3343, 3339, 3360, 5329,
-     3356, 3372, 3362, 3368, 3369, 3353, 3381, 3358, 3385, 5329,
-
-     3386, 3397, 3380, 3387, 3402, 3407, 3410, 3411, 3406, 3399,
-     3398, 3408, 3427, 3404, 3413, 3431, 3421, 3426, 3435, 3446,
-     3442, 3441, 3444, 3456, 3440, 3462, 3468, 3465, 3474, 3479,
-     3454, 3472, 3489, 3478, 3482, 3481, 3469, 3495, 3475, 3502,
-     3488, 5329, 3501, 3509, 3512, 3514, 3498, 3513, 3521, 3517,
-     3524, 5329, 3525, 5329, 3529, 3522, 5329, 3531, 3535, 3527,
-     3546, 3545, 3548, 3538, 3559, 3570, 3554, 5329, 3575, 3553,
-     3569, 3574, 5329, 3577, 5329, 5329, 3573, 3565, 3589, 3582,
-     3592, 3605, 3584, 5329, 3601, 3597, 3611, 3604, 3600, 3606,
-     3610, 3624, 3603, 3626, 3623, 3627, 5329, 3637, 3644, 3634,
-
-     3648, 3649, 5329, 3645, 3657, 3639, 3662, 3675, 3673, 3676,
-     3669, 3663, 3664, 3688, 3682, 3672, 5329, 3679, 3697, 3701,
-     3712, 3702, 3696, 3692, 3721, 3725, 3706, 3722, 3728, 3723,
-     3724, 5329, 3737, 3741, 5329, 3743, 3740, 3749, 5329, 3766,
-     5329, 3768, 3720, 3750, 3762, 3778, 3770, 3780, 3763, 3777,
-     3783, 3773, 3784, 3795, 3792, 5329, 5329, 3791, 3787, 3794,
-     3815, 3805, 3802, 3828, 3821, 3825, 5329, 3806, 3822, 3811,
-     3830, 3832, 3823, 3819, 3836, 3847, 3850, 3855, 3840, 3852,
-     5329, 3846, 3856, 3857, 3854, 3858, 3867, 5329, 3886, 3887,
-     3878, 3881, 3893, 3898, 3889, 3900, 3894, 3897, 3901, 3904,
-
-     3911, 3913, 3912, 3919, 3923, 3915, 5329, 3924, 3930, 3916,
-     3941, 3926, 3939, 3946, 3947, 3952, 3950, 3940, 3951, 3954,
-     5329, 3938, 3937, 3965, 3979, 3984, 3967, 3988, 3972, 3990,
-     3992, 3977, 3995, 3968, 3996, 3981, 4007, 3999, 3994, 4015,
-     4017, 4036, 4029, 5329, 4018, 5329, 4026, 4039, 4041, 4045,
-     5329, 4028, 4048, 5329, 4037, 5329, 4044, 4056, 4032, 4065,
-     4069, 5329, 4078, 4066, 4081, 4073, 4072, 4068, 4088, 5329,
-     4090, 4095, 4091, 4092, 4083, 4106, 4107, 4108, 4118, 4105,
-     4121, 5329, 4110, 4124, 4135, 4131, 4134, 5329, 5329, 4130,
-     4140, 5329, 5329, 5329, 4142, 5329, 5329, 5329, 4138, 4146,
-
-     5329, 4149, 5329, 4156, 4158, 4148, 4150, 4155, 5329, 4161,
-     4162, 4178, 5329, 4170, 4185, 4166, 4175, 5329, 4192, 5329,
-     4189, 4193, 4182, 4198, 4200, 4204, 4208, 4201, 4197, 4202,
-     4206, 4220, 4221, 4216, 4210, 4225, 4212, 4224, 4233, 4230,
-     4235, 4237, 4245, 4251, 4253, 4250, 4266, 4268, 5329, 5329,
-     4259, 4257, 4265, 4270, 4280, 4271, 4281, 4273, 5329, 4288,
-     4294, 4297, 4295, 4293, 4301, 4296, 4286, 4309, 4329, 4315,
-     4320, 4321, 4322, 4314, 5329, 4324, 5329, 5329, 4325, 4341,
-     4350, 4338, 4337, 4357, 4354, 5329, 4348, 4362, 4359, 4356,
-     5329, 4373, 4360, 4374, 4376, 5329, 5329, 5329, 4377, 4370,
-
-     4382, 4383, 4389, 4380, 4387, 5329, 4393, 4397, 4406, 4398,
-     4412, 4417, 4427, 4423, 4430, 4431, 5329, 5329, 4419, 4438,
-     4433, 4436, 4434, 4447, 4440, 4444, 4439, 5329, 4442, 4455,
-     4464, 4470, 4471, 4482, 4472, 5329, 4465, 4466, 4468, 4485,
-     4469, 4492, 4490, 4494, 4498, 5329, 4496, 4507, 5329, 4512,
-     4504, 4509, 5329, 4521, 5329, 4526, 5329, 5329, 4513, 4534,
-     4538, 4527, 4537, 4542, 4528, 4530, 4554, 4552, 4555, 5329,
-     5329, 4550, 4562, 5329, 5329, 4558, 4549, 4565, 4557, 4560,
-     4564, 4572, 4569, 4587, 4579, 4573, 4602, 4592, 4599, 4589,
-     4584, 4611, 4597, 4601, 5329, 4612, 4615, 5329, 4605, 4613,
-
-     4629, 4625, 4626, 4627, 4630, 4637, 5329, 4640, 4639, 4638,
-     5329, 5329, 5329, 4650, 4657, 4653, 5329, 4654, 4660, 4652,
-     4675, 4667, 4678, 4673, 4679, 4668, 4674, 5329, 4684, 4677,
-     4697, 4694, 4699, 4696, 4690, 4705, 4702, 4701, 4714, 4718,
-     5329, 4716, 4717, 5329, 4731, 4726, 4715, 5329, 4732, 4734,
-     4725, 4750, 4751, 4736, 4744, 4742, 4757, 4754, 4752, 4764,
-     4763, 4761, 4774, 4769, 4776, 5329, 4785, 4773, 5329, 4793,
-     4783, 4799, 4802, 4805, 4806, 4803, 5329, 4809, 5329, 4810,
-     5329, 4815, 4807, 4813, 4816, 4812, 5329, 5329, 4819, 4818,
-     4823, 5329, 4836, 4835, 4843, 4834, 4837, 4839, 4838, 4855,
-
-     5329, 5329, 4849, 4858, 4867, 4868, 5329, 5329, 5329, 4871,
-     5329, 4873, 5329, 4875, 4874, 5329, 4881, 4876, 5329, 4879,
-     4889, 4890, 4887, 4880, 4894, 4899, 4906, 4907, 4903, 4910,
-     5329, 5329, 4913, 5329, 4923, 5329, 4925, 5329, 4915, 4928,
-     5329, 5329, 4932, 4945, 4917, 4938, 4934, 4930, 4944, 5329,
-     5329, 5329, 5329, 4942, 4947, 4952, 4951, 4949, 4959, 4965,
-     4957, 4970, 4966, 4974, 4988, 4984, 4991, 4973, 4987, 5003,
-     4992, 5329, 4990, 5329, 4994, 5007, 5011, 5008, 5014, 5001,
-     5010, 5012, 5023, 5029, 5025, 5021, 5038, 5040, 5045, 5050,
-     5052, 5056, 5041, 5049, 5062, 5067, 5066, 5071, 5068, 5072,
-
-     5065, 5329, 5070, 5077, 5081, 5093, 5102, 5104, 5088, 5110,
-     5112, 5114, 5115, 5097, 5121, 5118, 5128, 5131, 5127, 5134,
-     5329, 5139, 5142, 5137, 5138, 5159, 5148, 5149, 5162, 5151,
-     5165, 5170, 5173, 5174, 5329, 5177, 5329, 5329, 5180, 5169,
-     5179, 5191, 5193, 5329, 5329, 5329, 5237, 5244, 5251, 5258,
-     5265,   82, 5272, 5279, 5286, 5293, 5300, 5307, 5314, 5321
+     1118, 5425, 1122, 1117, 1131, 1134, 1132, 1141, 5425, 1136,
+     1135, 1137, 1161, 1158, 1164, 1163, 1176, 1157, 1165, 1168,
+     1170, 1178, 1172, 1184, 1188, 1234, 1186, 1190, 1194, 1226,
+     1216, 1198, 1211, 1199, 1227, 1214, 1220, 1237, 1230, 1241,
+     1239, 1256, 1251, 1257, 1269, 1278, 1268, 1264, 1262, 1277,
+     1281, 1274, 1292, 1291, 1290, 1279, 1305, 1295, 1307, 1315,
+     1301, 1316, 1324, 1331, 1329, 1333, 1335, 1317, 1334, 1332,
+
+     1344, 1341, 1342, 1328, 1350, 1349, 1343, 1370, 1361, 1363,
+     1362, 1381, 1369, 1371, 1376, 1384, 1389, 1390, 1391, 1394,
+     1403, 1411, 1398, 1418, 1425, 1426, 1422, 1414, 1420, 1406,
+     1430, 1440, 1436, 1438, 1444, 1445, 1447, 1441, 1455, 1466,
+     1477, 1473, 1459, 1474, 1461, 1462, 1471, 1472, 1491, 1485,
+     1482, 1496, 1493, 1517, 1506, 1507, 1509, 1511, 1505, 1522,
+     1512, 1521, 1518, 1523, 1524, 1539, 1542, 1554, 1543, 1553,
+     1555, 1548, 1558, 1565, 1567, 1551, 1575, 1570, 5425, 1569,
+     1573, 1597, 1592, 1587, 1581, 1599, 1591, 1585, 1633, 5425,
+     1598, 5425, 5425, 1600, 5425, 5425, 1612, 1616, 1619, 1620,
+
+     1682, 1624, 1635, 1636, 1627, 1641, 1651, 1663, 1660, 1665,
+     1671, 1678, 1672, 1668, 1687, 1692, 1688, 1709, 1695, 1703,
+     1702, 1719, 1725, 1730, 1735, 1729, 1731, 1733, 1734, 1722,
+     1738, 1746, 1736, 1748, 1745, 1758, 1775, 1757, 5425, 1765,
+     1768, 1780, 1764, 1785, 1772, 1795, 5425, 1767, 1784, 1769,
+     1799, 1796, 1800, 1812, 1804, 1810, 1805, 1825, 1815, 1803,
+     1838, 1823, 1826, 1845, 1848, 1850, 1830, 1846, 1855, 1841,
+     1863, 1867, 1856, 1851, 1853, 1875, 1868, 1874, 1879, 1877,
+     1880, 1878, 1876, 1885, 1889, 1934, 1907, 1894, 1902, 1895,
+     1926, 1925, 1927, 1919, 1924, 1944, 1941, 1958, 1957, 1960,
+
+     1959, 1964, 1970, 1914, 1987, 1967, 1991, 1984, 1990, 2003,
+     1994, 2000, 2005, 1997, 1931, 2006, 5425, 1922, 2009, 2015,
+     2025, 2032, 2036, 2026, 2035, 2031, 2039, 2030, 2046, 2040,
+     2042, 2055, 2054, 5425, 2058, 2052, 2065, 2079, 2081, 2083,
+     2085, 2089, 2093, 2082, 5425, 2087, 2100, 2097, 2096, 2091,
+     2109, 2104, 2113, 2131, 2114, 2132, 2138, 2136, 2123, 2141,
+     1942, 2140, 2126, 2145, 2155, 2158, 2159, 2165, 2175, 2176,
+     5425, 2166, 2185, 2172, 2182, 2191, 2193, 2186, 2190, 2195,
+     2202, 2207,  120, 2205, 2215, 2206, 2210, 5425,   76, 2212,
+     2221, 2211, 2200, 2234, 2239, 2240, 2233, 2241, 2249, 2242,
+
+     2237, 2252, 2250, 2251, 2273, 2261, 2262, 2279, 2267, 2289,
+     2286, 2288, 2282, 2298, 2281, 2284, 2300, 2302, 2314, 2311,
+     2306, 2315, 2316, 2320, 2327, 2328, 2317, 2318, 2332, 2343,
+     2337, 2333, 2347, 5425, 2369, 2354, 2363, 2355, 2367, 2361,
+     2389, 2359, 2370, 2386, 2379, 2382, 2397, 2400, 2398, 2399,
+     2406, 2408, 2405, 2409, 2394, 2419, 2424, 2433, 2418, 2457,
+     2428, 1982, 2430, 5425, 2436, 2427, 2425, 2449, 2478, 2445,
+     2434, 2454, 2465, 2464, 2463, 2483, 2472, 2494, 5425, 2492,
+     2491, 2484, 2497, 2481, 2507, 2508, 2512, 2500, 2511, 2509,
+     2521, 2524, 2514, 2523, 2530, 5425, 2535, 2546, 2528, 2549,
+
+     2545, 2539, 2550, 2563, 2547, 2542, 2553, 2564, 2548, 2559,
+     2552, 2581, 2569, 2574, 2575, 2595, 2583, 2580, 2601, 5425,
+     2585, 2617, 2605, 2607, 2616, 2609, 2625, 2620, 2608, 2610,
+     2612, 2622, 2643, 2635, 2634, 2651, 2639, 2641, 2644, 2649,
+     2659, 2650, 2667, 2656, 2668, 2661, 2680, 2677, 2687, 2676,
+     2700, 2702, 2706, 2707, 2709, 5425, 2711, 2713, 2694, 2718,
+     2701, 2703, 2747, 2752, 2727, 2732, 2729, 2734, 2735, 2730,
+     2739, 2744, 2745, 2748, 2756, 2760, 2750, 2768, 2773, 2772,
+     2786, 2783, 2785, 2780, 2792, 2791, 2803, 5425, 2794, 2798,
+     2797, 2813, 2806, 2810, 5425, 2816, 5425, 2818, 2837, 2831,
+
+     5425, 2835, 5425, 2839, 5425, 2843, 2841, 2832, 2827, 2849,
+     2850, 2833, 2851, 2860, 2856, 2845, 2870, 2882, 2866, 2883,
+     5425, 2871, 2877, 2894, 2887, 2876, 2879, 2893, 2897, 2898,
+     2906, 2905, 2908, 2909, 5425, 2916, 2931, 2915, 2933, 5425,
+     2913, 2940, 2935, 2925, 2953, 2950, 2943, 2942, 2949, 2938,
+     2970, 2957, 2978, 2964, 2966, 2967, 2983, 2993, 2969, 2990,
+     2999, 2996, 2984, 2998, 3004, 2989, 3009, 3000, 3008, 3012,
+     3014, 3019, 3016, 5425, 3038, 3039, 3027, 3040, 3041, 3036,
+     5425, 3055, 5425, 3049, 3054, 3051, 3046, 3063, 3066, 3079,
+     3077, 3096, 3087, 3074, 3082, 3080, 3089, 3084, 3093, 5425,
+
+     3083, 3099, 3118, 3112, 3115, 3126, 3132, 3125, 3111, 5425,
+     3140, 3123, 3144, 3142, 3143, 3153, 3149, 3169, 5425, 5425,
+     3146, 3152, 3139, 3158, 3186, 3167, 3170, 5425, 3171, 3189,
+     3182, 3190, 3196, 3194, 3179, 3185, 3207, 3197, 3212, 3213,
+     3214, 3216, 3236, 3221, 3224, 3231, 3244, 3246, 3245, 5425,
+     3250, 3238, 3254, 3256, 3252, 3258, 3263, 3251, 3265, 3277,
+     3260, 3273, 3289, 3295, 3282, 3279, 3281, 3296, 3285, 3310,
+     3311, 3313, 3318, 3316, 5425, 3322, 3302, 3325, 3306, 3324,
+     3326, 3338, 3343, 3321, 3339, 3340, 3344, 5425, 3336, 3348,
+     3360, 3346, 3373, 3358, 3354, 3379, 5425, 3352, 3390, 3377,
+
+     3386, 3385, 3371, 3401, 3382, 3395, 5425, 3405, 3399, 3396,
+     3407, 3419, 3422, 3425, 3426, 3418, 3413, 3417, 3430, 3444,
+     3421, 3424, 3454, 3441, 3440, 3446, 3458, 3453, 3465, 3468,
+     3470, 3451, 3473, 3480, 3475, 3494, 3497, 3477, 3486, 3500,
+     3489, 3504, 3493, 3485, 3513, 3495, 3519, 3506, 5425, 3520,
+     3525, 3529, 3534, 3516, 3532, 3537, 3533, 3540, 5425, 3543,
+     5425, 3551, 3545, 5425, 3546, 3541, 3535, 3562, 3556, 3560,
+     3573, 3575, 3590, 3578, 5425, 3587, 3576, 3582, 3584, 5425,
+     3595, 5425, 5425, 3581, 3583, 3616, 3608, 3612, 3626, 3627,
+     5425, 3622, 3610, 3631, 3624, 3615, 3634, 3635, 3638, 3618,
+
+     3649, 3621, 3652, 5425, 3661, 3665, 3651, 3670, 3673, 3674,
+     5425, 3668, 3681, 3658, 3685, 3687, 3693, 3699, 3688, 3701,
+     3691, 3700, 3709, 3711, 5425, 3710, 3716, 3686, 3723, 3720,
+     3714, 3727, 3737, 3738, 3732, 3743, 3751, 3736, 3746, 5425,
+     3761, 3763, 5425, 3747, 3756, 3759, 5425, 3771, 5425, 3778,
+     3774, 3767, 3772, 3791, 3787, 3797, 3788, 3802, 3795, 3799,
+     3813, 3809, 3801, 5425, 5425, 3810, 3811, 3825, 3829, 3819,
+     3814, 3839, 3837, 3843, 5425, 3824, 3840, 3827, 3838, 3855,
+     3844, 3847, 3861, 3864, 3858, 3870, 3852, 3865, 5425, 3871,
+     3859, 3874, 3882, 3869, 3885, 5425, 3899, 3901, 3900, 3902,
+
+     3905, 3914, 3907, 3917, 3908, 3909, 3919, 3924, 3925, 3920,
+     3937, 3930, 3938, 3953, 3935, 5425, 3950, 3956, 3940, 3958,
+     3942, 3957, 3965, 3972, 3970, 3952, 3974, 3975, 3976, 5425,
+     3984, 3982, 3981, 3987, 3993, 3998, 4006, 3986, 4009, 4013,
+     4007, 4021, 4002, 4011, 4014, 4023, 4015, 4034, 4036, 4033,
+     4056, 4054, 5425, 4039, 5425, 4055, 4066, 4060, 4068, 4051,
+     5425, 4061, 4070, 5425, 4053, 5425, 4072, 4084, 4080, 4078,
+     4101, 5425, 4108, 4095, 4111, 4098, 4099, 4096, 4117, 5425,
+     4116, 4121, 4114, 4125, 4126, 4135, 4127, 4136, 4128, 4123,
+     4153, 5425, 4145, 4160, 4168, 4158, 4167, 5425, 5425, 4157,
+
+     4173, 5425, 5425, 5425, 4170, 5425, 4163, 5425, 5425, 4172,
+     4175, 5425, 4178, 5425, 4183, 4188, 4187, 4184, 4186, 5425,
+     4190, 4195, 4212, 5425, 4210, 4224, 4205, 4211, 5425, 4221,
+     5425, 4220, 4227, 4214, 4230, 4231, 4240, 4242, 4232, 4243,
+     4233, 4237, 4251, 4260, 4246, 4268, 4270, 4248, 4257, 4267,
+     4258, 4269, 4285, 4271, 4278, 4276, 4294, 4291, 4302, 4310,
+     5425, 5425, 4295, 4296, 4297, 4305, 4308, 4313, 4312, 4327,
+     5425, 4320, 4322, 4329, 4335, 4316, 4341, 4337, 4346, 4345,
+     4352, 4348, 4354, 4351, 4362, 4356, 5425, 4373, 4368, 5425,
+     5425, 4364, 4371, 4385, 4375, 4381, 4388, 4400, 5425, 4391,
+
+     4401, 4407, 4397, 5425, 4413, 4402, 4416, 4419, 5425, 5425,
+     5425, 4422, 4398, 4426, 4425, 4431, 4432, 4433, 5425, 4427,
+     4434, 4440, 4429, 4438, 4455, 4457, 4474, 4468, 4475, 4476,
+     5425, 5425, 4466, 4478, 4477, 4480, 4483, 4471, 4482, 4484,
+     4487, 5425, 4491, 4470, 4507, 4513, 4514, 4524, 4518, 5425,
+     4509, 4510, 4512, 4529, 4516, 4533, 4534, 4532, 4536, 4541,
+     5425, 4539, 4540, 5425, 4560, 4556, 4557, 5425, 4573, 5425,
+     4576, 5425, 5425, 4558, 4580, 4579, 4577, 4586, 4588, 4571,
+     4596, 4594, 4592, 4591, 5425, 5425, 4624, 4605, 4598, 5425,
+     5425, 4607, 4609, 4623, 4613, 4615, 4603, 4602, 4614, 4637,
+
+     4629, 4642, 4646, 4636, 4644, 4639, 4641, 4656, 4657, 4658,
+     5425, 4661, 4679, 4675, 5425, 4663, 4687, 4685, 4684, 4676,
+     4695, 4683, 4688, 5425, 4690, 4686, 4694, 5425, 5425, 5425,
+     4722, 4728, 4721, 5425, 4726, 4732, 5425, 4725, 4715, 4705,
+     4716, 4739, 4720, 4743, 4742, 4741, 5425, 4753, 4758, 4750,
+     4747, 4766, 4760, 4762, 4771, 4777, 4757, 4786, 4769, 5425,
+     4790, 4791, 4787, 5425, 4795, 4785, 4774, 5425, 4806, 4802,
+     4798, 4811, 4821, 4804, 4814, 4808, 4827, 4833, 4829, 4825,
+     4819, 4841, 4835, 4832, 4846, 4852, 4845, 5425, 4849, 4855,
+     5425, 4853, 4861, 4860, 4877, 4881, 4883, 4879, 5425, 4886,
+
+     5425, 5425, 4888, 5425, 4890, 4880, 4882, 4893, 4895, 5425,
+     5425, 4897, 4898, 4907, 5425, 4899, 4903, 4909, 4916, 4921,
+     4913, 4917, 4920, 4924, 4930, 5425, 5425, 4922, 4952, 4953,
+     4950, 5425, 5425, 5425, 4959, 5425, 4957, 5425, 4963, 4956,
+     5425, 4966, 4958, 5425, 4949, 4962, 4974, 4968, 4978, 4977,
+     4981, 4972, 4986, 4991, 4998, 4992, 5010, 5425, 5425, 5012,
+     5425, 5015, 5425, 5016, 5425, 5005, 5019, 5009, 5021, 5425,
+     5425, 5023, 4995, 5013, 5030, 5022, 5034, 5029, 5425, 5425,
+     5425, 5425, 5051, 5038, 5046, 5425, 5048, 5050, 5047, 5049,
+     5053, 5056, 5073, 5064, 5062, 5070, 5084, 5087, 5090, 5074,
+
+     5089, 5106, 5091, 5425, 5094, 5425, 5425, 5093, 5107, 5110,
+     5111, 5100, 5116, 5114, 5123, 5117, 5132, 5127, 5124, 5143,
+     5134, 5157, 5144, 5155, 5159, 5147, 5151, 5163, 5161, 5162,
+     5173, 5169, 5175, 5170, 5425, 5172, 5179, 5182, 5190, 5204,
+     5202, 5193, 5210, 5213, 5217, 5208, 5197, 5218, 5219, 5220,
+     5229, 5228, 5231, 5425, 5246, 5247, 5238, 5240, 5235, 5242,
+     5245, 5265, 5268, 5263, 5271, 5276, 5273, 5425, 5277, 5425,
+     5425, 5278, 5262, 5275, 5285, 5287, 5425, 5425, 5425, 5333,
+     5340, 5347, 5354, 5361,   82, 5368, 5375, 5382, 5389, 5396,
+     5403, 5410, 5417
+
     } ;
 
-static yyconst flex_int16_t yy_def[1861] =
+static yyconst flex_int16_t yy_def[1894] =
     {   0,
-     1846,    1, 1847, 1847, 1848, 1848, 1849, 1849, 1850, 1850,
-     1851, 1851, 1846, 1852, 1846, 1846, 1846, 1846, 1853, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1854, 1846, 1846, 1846, 1854, 1855, 1846, 1846, 1846, 1855,
-     1856, 1846, 1846, 1846, 1846, 1856, 1857, 1846, 1846, 1846,
-     1857, 1858, 1846, 1859, 1846, 1858, 1858, 1852, 1852, 1846,
-     1860, 1853, 1860, 1853, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1854, 1854, 1855, 1855,
-     1856, 1856, 1846, 1857, 1857, 1858, 1858, 1859, 1859, 1858,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1858, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1858, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1858, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1858, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852,
-     1846, 1846, 1852, 1846, 1846, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1858, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1846, 1858, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1846,
-     1852, 1846, 1852, 1852, 1852, 1846, 1852, 1846, 1852, 1846,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846,
-     1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852,
-     1852, 1852, 1852, 1852, 1852, 1846, 1852, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1846, 1846, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1846, 1852, 1852, 1846, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852,
-     1852, 1852, 1846, 1852, 1846, 1846, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852,
-
-     1852, 1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1846, 1852, 1852, 1852, 1846, 1852,
-     1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1846, 1846, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1846, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1846, 1852, 1846, 1852, 1852, 1852, 1852,
-     1846, 1852, 1852, 1846, 1852, 1846, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1846, 1846, 1852,
-     1852, 1846, 1846, 1846, 1852, 1846, 1846, 1846, 1852, 1852,
-
-     1846, 1852, 1846, 1852, 1852, 1852, 1852, 1852, 1846, 1852,
-     1852, 1852, 1846, 1852, 1852, 1852, 1852, 1846, 1852, 1846,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1846,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1846, 1852, 1846, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852,
-     1846, 1852, 1852, 1852, 1852, 1846, 1846, 1846, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1846, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1846, 1852,
-     1852, 1852, 1846, 1852, 1846, 1852, 1846, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846,
-     1846, 1852, 1852, 1846, 1846, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1846, 1852, 1852, 1846, 1852, 1852,
-
-     1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1852,
-     1846, 1846, 1846, 1852, 1852, 1852, 1846, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1846, 1852, 1852, 1846, 1852, 1852, 1852, 1846, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1846, 1852, 1852, 1846, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1846, 1852, 1846, 1852,
-     1846, 1852, 1852, 1852, 1852, 1852, 1846, 1846, 1852, 1852,
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1846, 1846, 1852, 1852, 1852, 1852, 1846, 1846, 1846, 1852,
-     1846, 1852, 1846, 1852, 1852, 1846, 1852, 1852, 1846, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1846, 1846, 1852, 1846, 1852, 1846, 1852, 1846, 1852, 1852,
-     1846, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1846,
-     1846, 1846, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1846, 1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-
-     1852, 1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1846, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852, 1852,
-     1852, 1852, 1852, 1852, 1846, 1852, 1846, 1846, 1852, 1852,
-     1852, 1852, 1852, 1846, 1846,    0, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846
+     1879,    1, 1880, 1880, 1881, 1881, 1882, 1882, 1883, 1883,
+     1884, 1884, 1879, 1885, 1879, 1879, 1879, 1879, 1886, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1887, 1879, 1879, 1879, 1887, 1888, 1879, 1879, 1879, 1888,
+     1889, 1879, 1879, 1879, 1879, 1889, 1890, 1879, 1879, 1879,
+     1890, 1891, 1879, 1892, 1879, 1891, 1891, 1885, 1885, 1879,
+     1893, 1886, 1893, 1886, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1887, 1887, 1888, 1888,
+     1889, 1889, 1879, 1890, 1890, 1891, 1891, 1892, 1892, 1891,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1891, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1891, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1891, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1891, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1879, 1879, 1885, 1879, 1879, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1891, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1891, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885,
+     1885, 1885, 1885, 1885, 1879, 1885, 1879, 1885, 1885, 1885,
+
+     1879, 1885, 1879, 1885, 1879, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1879,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+     1879, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1879,
+     1885, 1879, 1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1879, 1885, 1885, 1885, 1879, 1885, 1879, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1879, 1879, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+     1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1879, 1885, 1879, 1885, 1885, 1885, 1885, 1885,
+     1879, 1885, 1885, 1879, 1885, 1879, 1885, 1885, 1885, 1885,
+     1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1879, 1885, 1885, 1885, 1885, 1885, 1879, 1879, 1885,
+
+     1885, 1879, 1879, 1879, 1885, 1879, 1885, 1879, 1879, 1885,
+     1885, 1879, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1879, 1885,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1879,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1879, 1879,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1885, 1885, 1879, 1885, 1885, 1885, 1879, 1885, 1879,
+     1885, 1879, 1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1879, 1879, 1885, 1885, 1885, 1879,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1879, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1879, 1879, 1879,
+     1885, 1885, 1885, 1879, 1885, 1885, 1879, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879,
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1879, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1885,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885,
+
+     1879, 1879, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1879,
+     1879, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1879, 1879, 1885, 1885, 1885,
+     1885, 1879, 1879, 1879, 1885, 1879, 1885, 1879, 1885, 1885,
+     1879, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1879, 1885,
+     1879, 1885, 1879, 1885, 1879, 1885, 1885, 1885, 1885, 1879,
+     1879, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1879,
+     1879, 1879, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+
+     1885, 1885, 1885, 1879, 1885, 1879, 1879, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1879, 1885, 1885, 1885, 1885, 1885, 1885,
+     1885, 1885, 1885, 1885, 1885, 1885, 1885, 1879, 1885, 1879,
+     1879, 1885, 1885, 1885, 1885, 1885, 1879, 1879,    0, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879
+
     } ;
 
-static yyconst flex_uint16_t yy_nxt[5395] =
+static yyconst flex_uint16_t yy_nxt[5491] =
     {   0,
        14,   15,   16,   17,   18,   19,   18,   14,   14,   14,
        14,   18,   20,   14,   21,   22,   23,   24,   14,   25,
@@ -1068,7 +1081,7 @@ static yyconst flex_uint16_t yy_nxt[5395] =
 
        71,   45,  129,   88,   45,  134,  134,   50,   73,   50,
        73,   73,   70,   73,  137,   56,   71,   68,   73,   68,
-       68,   56,   68,   86,   75,   76,   61,   68,  796,   61,
+       68,   56,   68,   86,   75,   76,   61,   68,  800,   61,
        15,   16,   17,   63,   64,   65,   15,   16,   17,   63,
        64,   65,   77,   87,   95,   74,   69,   97,   69,   66,
        86,   75,   76,  137,   78,   66,   69,   89,   69,   69,
@@ -1093,40 +1106,40 @@ static yyconst flex_uint16_t yy_nxt[5395] =
       140,  136,  136,   68,  136,   68,   68,   73,   68,   73,
        73,  144,   73,   68,  147,  148,  156,   73,  157,  150,
       151,  149,  153,  154,  145,   69,  139,   69,   69,   69,
-       69,  161,   69,  297, 1846,   69,   69, 1846,  144,  193,
+       69,  161,   69,  297, 1879,   69,   69, 1879,  144,  193,
       155,  147,  148,  156,   74,  157,  150,  151,  149,  153,
       158,  145,  159,   69,   69,  162,  168,  163,  161,   69,
       164,   69,   69,  174,   69,  171,  169,  155,   69,  172,
-       69,  175,  173,  165,  166,   69,   69,  158, 1846,  159,
+       69,  175,  173,  165,  166,   69,   69,  158, 1879,  159,
 
       182,   69,  162,  168,  163,  176,  170,  164,   69,   69,
       174,  178,  171,  169,   69,  177,  172,  180,  175,  173,
       165,  166,  179,   69,   69,   69,  181,  182,  183,   69,
       184,   69,  176,  170,  185,   69,   69,   69,  178,  186,
-     1846,  187,  177,  188,  180,  189,   69,  192,  190,  179,
+     1879,  187,  177,  188,  180,  189,   69,  192,  190,  179,
        69,  195,   69,  181,  191,  183,   69,  184,  194,   69,
        69,  185,   69,  199,  202,  198,  186,   69,  187,   69,
       188,  196,  189,   69,  192,  190,   69,   69,  195,  197,
-      200,  191,  203, 1846,  204,  194,   69, 1846,   69, 1846,
-      199,  202,  198,   69, 1846,  207, 1846,   69,  196, 1846,
+      200,  191,  203, 1879,  204,  194,   69, 1879,   69, 1879,
+      199,  202,  198,   69, 1879,  207, 1879,   69,  196, 1879,
 
-      205,  201, 1846,  206, 1846,   69,  197,  200, 1846,  203,
+      205,  201, 1879,  206, 1879,   69,  197,  200, 1879,  203,
       131,  204,  131,  131,  136,  131,  136,  136,   73,  136,
        73,   73,  208,   73,  137,   69,   69,  205,  201,  209,
-      206,  210,  211,  212,   69,  213,  214, 1846,  227,   69,
-       69,  215,  216,  218,   69,  217,   69, 1846,   69,  208,
-      226, 1846,  219,   69, 1846,  139,  209,  228,  210,  211,
+      206,  210,  211,  212,   69,  213,  214, 1879,  227,   69,
+       69,  215,  216,  218,   69,  217,   69, 1879,   69,  208,
+      226, 1879,  219,   69, 1879,  139,  209,  228,  210,  211,
       212,  231,  213,  230,   69,  227,  229,   69,  215,  216,
        69,   69,  217,  220,   69,  233,   69,  226,  232,   69,
        69,  237,  234,   69,  228,  235,   69,   69,  231,  236,
-      230,   69,  238,  229,  239, 1846,  243,   69,   69,  240,
+      230,   69,  238,  229,  239, 1879,  243,   69,   69,  240,
 
       220,  221,  233,   69,  244,  232,  222,   69,  237,  234,
       245,  223,  235,  241,   69,  242,  236,  224,  225,  238,
        69,  239,   69,  243,   69,  248,  240,  251,  221,  246,
       249,  253,  252,  222,  254,   69,   69,  245,  223,  247,
-      241,  250,  242,  255,  224,  225,  257,   69,   69, 1846,
-      256,  259, 1846,  270,   69, 1846,   69,  249,   69,  252,
+      241,  250,  242,  255,  224,  225,  257,   69,   69, 1879,
+      256,  259, 1879,  270,   69, 1879,   69,  249,   69,  252,
        69,  261,   69,   69,   69,   69,  247,   69,  250,  258,
       255,  262,   69,  257,  260,  263,   69,  256,  259,   69,
        69,  264,  265,  266,   69,   69,  267,  272,  261,   69,
@@ -1134,524 +1147,533 @@ static yyconst flex_uint16_t yy_nxt[5395] =
 
       273,  260,  263,   69,  274,   69,  278,  275,  264,  265,
       266,  276,   69,  267,  272,   69,   69,  277,  280,  271,
-       69,  268,  269,  281,  283,  284,   69,  273,  279, 1846,
-      286,  287,  288,   69,  275,   69, 1846,   69,  276,  137,
+       69,  268,  269,  281,  283,  284,   69,  273,  279, 1879,
+      286,  287,  288,   69,  275,   69, 1879,   69,  276,  137,
       282,  285,  289,  292,  291,  305,  296,  290,   69,   69,
       281,  283,  284,   69,   69,  279,   69,   69,  287,  294,
        69,   69,   69,   69,  293,  295,   69,  282,  285,  289,
-      292,  291,   69,  296,  290,  298,   69,  299,  300, 1846,
-     1846,  301,  302,   69,  303,  309,  294,  306,  308,   69,
-       69,  293,  295,   69,  304, 1846,  307,  321, 1846, 1846,
+      292,  291,   69,  296,  290,  298,   69,  299,  300, 1879,
+     1879,  301,  302,   69,  303,  309,  294,  306,  308,   69,
+       69,  293,  295,   69,  304, 1879,  307,  321, 1879, 1879,
 
        69,   69,  298,   69,  299,  300,   69,   69,  301,  302,
        69,  303,   69,  310,  306,  308,   69,  311,  312,  313,
        69,  304,   69,  307,   69,  314,   69,  316,   69,  315,
-      318,  326,  317,   69,  319,  320,   69, 1846, 1846,   69,
-      310,  322,  346,   69,  311,  312,  313, 1846,  323,   69,
+      318,  326,  317,   69,  319,  320,   69, 1879, 1879,   69,
+      310,  322,  346,   69,  311,  312,  313, 1879,  323,   69,
        69,   69,  314,   69,  316,   69,  315,  318,  326,  317,
       327,  319,  320,   69,  324,   69,   69,  325,  322,  328,
       329,  333,  336,   69,   69,  323,  330,  331,  334,  339,
-     1846,  335,  337,   69,   69,   69, 1846,  327,   69,  338,
+     1879,  335,  337,   69,   69,   69, 1879,  327,   69,  338,
       340,  324,  341,  343,  325,   69,  328,  329,  333,  336,
 
        69,   69,  342,  330,  331,  334,   69,   69,  335,  337,
       344,  348,   69,  351,   69,   69,  338,  340,   69,  341,
       343,  345,  349,  347,  350,   69,   69,  355,   69,  342,
-       69,  352, 1846,   69,  353,  356,  354,  344,  348, 1846,
-      351, 1846,   69,  357,  361,   69,   69,  379,  345,  349,
-      347,  350,  373,  360,  355,  362,   69, 1846,  352,  358,
+       69,  352, 1879,   69,  353,  356,  354,  344,  348, 1879,
+      351, 1879,   69,  357,  361,   69,   69,  379,  345,  349,
+      347,  350,  373,  360,  355,  362,   69, 1879,  352,  358,
        69,  353,  365,  354,   69,   69,   69,  359,   69,  363,
       357,  361,  374,   69,  378,   69,  376,  375,   69,  373,
-      360,   69,  362,  137,   69,  364,  358, 1846,  377,  365,
-       69,  380, 1846,   69,  359,   69,  363,  383, 1846,  374,
+      360,   69,  362,  137,   69,  364,  358, 1879,  377,  365,
+       69,  380, 1879,   69,  359,   69,  363,  383, 1879,  374,
 
        69,  378,  381,  376,  375,  382,  385,  387,  384,   69,
-     1846,  389,  364,  366,  367,  377,  399,   69,  380,   69,
+     1879,  389,  364,  366,  367,  377,  399,   69,  380,   69,
        69,  386,   69,  368,  383,  369,  370,  371,   69,  381,
       372,  388,  382,  391,  387,  384,  390,   69,   69,   69,
       366,  367,   69,  399,   69,  392,  393,   69,  386,  394,
       368,  395,  369,  370,  371,   69,   69,  372,  388,  396,
       391,  404,   69,  390,  397,  398,  400,  401,  408,  402,
-       69,  407, 1846,  405,   69,   69,  394,   69,  395,   69,
+       69,  407, 1879,  405,   69,   69,  394,   69,  395,   69,
        69,  406,  403,  411,  410,  412,  396,   69,  404,   69,
        69,  397,  398,  400,  401,   69,  402,  409,  407,   69,
 
       405,  413,  415,   69,   69,   69,   69,   69,  406,  403,
-      411,  410,  412,  414,  417,  416,   69,  418, 1846,  419,
-      421,  420, 1846,   69,  409,  422, 1846,   69,  413,  415,
-      425,  423,  424, 1846,  426,   69,   69,   69,   69, 1846,
+      411,  410,  412,  414,  417,  416,   69,  418, 1879,  419,
+      421,  420, 1879,   69,  409,  422, 1879,   69,  413,  415,
+      425,  423,  424, 1879,  426,   69,   69,   69,   69, 1879,
       414,   69,  416,   69,  418,   69,  419,  421,  420,  427,
       428,   69,  422,   69,  429,   69,   69,  425,  423,  424,
-       69,  426,  434,  430,  431,  435,  432,  433,  436,   69,
-       69,  439,   69,   69,   69,   69,  427,  428,  437,   69,
-      438,  429,  441,  440,  445,  443,   69,   69, 1846,  434,
-      430,  431,   69,  432,  433,  436,   69,  442, 1846,   69,
-
-       69,  444,   69,   69,  446,  437,   69,  438,   69,  441,
-      440,  445,  443,   69,  447,   69,  453,  454,  455,  461,
-     1846,   69,   69,   69,  442,   69,  458,  456,  444,   69,
-     1846,  446,  459, 1846,  460,  467,  457, 1846,  462,   69,
-       69,  447,  448,  453,  454,  455,  461,  449,  466,  450,
-       69,  468, 1846,  458,  463,  464,   69,  451,   69,  459,
-       69,  460,  467,  457,   69,  462,   69,  452,   69,  448,
-       69,  465,  469,   69,  449,  466,  450,  470,  468,  471,
-      472,  463,  464,   69,  451,   69,  473,  474,  475,  477,
-       69,   69,  478,  480,  452,  476,  479,   69,  465,  469,
-
-      483,  482,   69,  137,  470,  481,  471,  472,   69,   69,
-      485,   69,   69,  484,  474,  475,  477,   69,  486,   69,
-       69,  487,  476,  479,   69,   69,  488,  483,  482,   69,
-      489,  491,  481,  490,   69,   69,  492,  485,  493,  494,
-      484,  495,  496,  497,  499,  486, 1846,   69,  487,   69,
-      498,  500,  501,  504,  502, 1846, 1846,   69,   69, 1846,
-      490,  505, 1846,   69, 1846, 1846,   69,   69,   69,   69,
-      497,  499,   69,   69,  506,   69,   69,  498,  503,  501,
-      510,  502,   69,   69,   69,   69,  507,   69,  505,   69,
-      511,  508,  513,  512,  515,  509,  514,  516, 1846,  520,
-
-     1846,  506,   69,  517, 1846,  503,  518,  510, 1846,   69,
-       69,  525,  522,  507,   69,   69,   69,  511,  508,  513,
-      512,   69,  509,  514,  516,   69,  520,   69,  519,   69,
-      517,  521,  523,  518,   69,  524,  526,  527,  532,  522,
-      530,  528,   69,   69,  529,   69, 1846,  531,  533,   69,
-       69,  535,  534,  540, 1846,  519, 1846,   69,  521,  523,
-       69,   69,  524,  526,  527,   69,   69,  530,  528,   69,
-       69,  529,  538,   69,  531,  533,   69,  536,  535,  534,
-      539,  537,  541,  547,   69,  544,   69,  542,  546,  545,
-      558,   69,  548,  551,   69,  549,  550, 1846, 1846,  538,
-
-       69,   69,  543,  553,   69,   69,  554,  539,   69,  541,
-      547,   69, 1846,   69,  542,  546,   69,   69,  552,  548,
-      551,   69,  549,  550,   69,   69,   69,  555,  556,  543,
-      553,  557,  559,  554,  560, 1846,  561,   69,  565,   69,
-       69,  562,   69,   69,  563,  552, 1846,  564,  566,   69,
-      568,  569,  567, 1846,  555,  556,   69, 1846,  557,  559,
-       69,  560,   69,  561,   69,  565,   69,  570,  562,   69,
-       69,  563,  573,   69,  564,  566,  571,  568,  569,  567,
-      572,   69,  575,  576,  574, 1846,  577,   69,  578,  580,
-      584,  579, 1846,  581,  570,   69,   69, 1846,   69,  573,
-
-       69,  582,   69,  571,   69,  583,  586,  572,  137,  575,
-      576,  574,   69,  577,   69,  578,  580,  585,  579,   69,
-      581,   69,  587,   69,   69,  588,  589,  590,  582,   69,
-      603,  591,  583,  586,   69,  598,  592,   69,   69, 1846,
-       69, 1846,  600,  599,  585,  601,   69,   69,  633,  587,
-      602, 1846,  588,   69,  590, 1846,  615,   69,  591, 1846,
-       69,   69,  598,  592,  593,  611,   69,  612,  594,  600,
-      599,  595,  601,   69,  617,  614,   69,  602,  596,   69,
-      613,  597,   69,   69,  616, 1846,   69,   69, 1846, 1846,
-      619,  593,  611, 1846,  612,  594,  623,  620,  595,   69,
-
-       69,  617,  614,  622,   69,  596,  618,  613,  597,  604,
-      605,  616,  606, 1846,  621,  607,   69,  619,   69,   69,
-      608,   69,  625,  623,  620,   69,  609,  610, 1846,   69,
-      622,  627,  624,  618,  628,   69,  604,  605,   69,  606,
-       69,  621,  607,  626,  629,  631,  630,  608,  632,  625,
-       69,   69,  634,  609,  610,   69,   69,  635,  627,  624,
-       69,  628, 1846,  637,  636,  639,  640,   69,  638,  641,
-      626,  629,  631,  630,   69,   69,  643,  645,  642,  644,
-      649,   69,   69,   69,  635,   69,   69,   69,   69,   69,
-      637,  636,  639,  640,  646,  638,  641,  647,   69,  648,
-
-      650, 1846,   69,   69,   69,  642,  644,  649,   69,  651,
-      652,  656,  655,   69, 1846,   69,  658,   69,   69,  657,
-      653,  646,   69,   69,  647,   69,  648,  650,  654,  659,
-      662,  661,  664,   69,   69,   69,  651,  652,  656,  655,
-       69,  660,  663,  658,   69,  665,  657,  653,   69,   69,
-      667,   69,  666,   69,  668,  654,  659,  662,  661,  664,
-      669,  670,  671,   69,  672,   69, 1846,   69,  660,  663,
-      674,   69,  665,  673,   69,  675,  676,  667,   69,  666,
-      677,   69,  678,  679,  683,  681,   69,  669,  670,  680,
-       69,  682,  684,   69,   69,   69,   69,  674,   69,   69,
-
-      673,  685,  675,  676,  686,   69,  688,  677,   69,  678,
-      687,  691,  681,   69,   69,   69,  680,  689,  682,  684,
-      690, 1846,   69,   69,   69,   69,  699,  692,   69,   69,
-     1846,  137,  706,  688,   69,  700, 1846,  687,  691,  701,
-      702, 1846,   69,  705,  689,   69, 1846,  690,  703, 1846,
-      717,   69,   69,  699,  692,  693,  707,  694,   69,  706,
-      704,  695,  700,  696,  709,   69,  701,  702,  697,   69,
-      705,   69,   69,  698,  708,  703,   69,  712, 1846,   69,
-      713,   69,  693,  707,  694,  716,  710,  704,  695,  715,
-      696,  709,  714,   69,  722,  697,  711,   69,   69,   69,
-
-      698,  708,   69,  723,  712,  724,   69,  713,   69,   69,
-      718,  725,  716,  710,  726,  719,  715,  720,   69,  714,
-      728,  722,  731,  711,  727,   69,   69,  732,  733, 1846,
-      723,  734,  724,  737,  736,  721,   69,  718,  725,   69,
-       69,  726,  719,  729,  720,  730,   69,  728,   69,   69,
-       69,  727,  735,   69,  732,   69,   69,  739,  734,   69,
-       69,  736,  721,  738,   69,   69,  741,  743,  740,  742,
-      729,  748,  730,  745,  747,   69,  744,   69,  746,  735,
-       69,  749,  752,  757,  739,   69,   69,   69,  750,   69,
-      738,   69,   69,  741,  743,  740,  742,   69,   69,  751,
-
-      745,  747,   69,  744,   69,  746,  753,  754,  749,  752,
-      756,   69,  755,  758,   69,  750,  759, 1846,  761,  763,
-      760,  762,  764, 1846,  765,  767,  751,   69,   69,   69,
-       69,   69,   69,  753,  754,   69,   69,  756,  766,  755,
-      758,  770,  768,   69,   69,  761,  763,   69,  762,  764,
-       69,  765,  767,  769,  771,  775,  772,  774,  777,   69,
-      773,  776,  778,   69,  779,  766,   69,   69,  770,  768,
-     1846,   69, 1846,   69,  783,  784,   69,   69,   69,   69,
-      769,  771,   69,  772,  774,  777,   69,  773,  776,  778,
-      780,  779,  781,  782,  785,  787,   69,   69,   69,   69,
-
-      786,  783,  784,   69,  791,  789,  790,   69,  788, 1846,
-     1846,   69,  792, 1846,  795,  794,   69,  780,  793,  781,
-      782,  785,  787,   69,   69,  797,   69,  786,   69,   69,
-      798,  791,  799,  804,   69,  788,   69,   69,  801,   69,
-       69,  795,  794,  802,  800,  793,   69,  803,   69,  805,
-      806,   69,  797, 1846,   69,   69,  807,  798, 1846,  799,
-      808,  812,  809,  810,   69,  801,  813,  811,  815,   69,
-      802,  800,   69,   69,  803,   69,   69,  806,   69,   69,
-       69,  816,  819,  807,  814,   69,   69,  808,  812,  809,
-      810,  817,  818,  813,  811,  815,   69,  821,  820,  822,
-
-      823,   69,  824,   69,   69,   69,  825,  826,   69,  819,
-      827,  814, 1846,  828,  829,   69,   69,  830,  817,  818,
-       69,   69,   69,   69,  821,  820,  822,  823,   69,  824,
-       69,  832,  833,  825,  826,   69,  834,  827,  831,   69,
-      828,  829,  836,  835,  830,  837,   69,  839,   69,  838,
-       69,  845,  840,   69,   69,   69,  841,   69,  832,  833,
-       69,   69,   69,  834,  843,  831,  842,  844,  846,  836,
-      835,   69,  837,  847,  839,  849,  838,   69,   69,  840,
-      848,   69,   69,  841,  850,   69,  851,   69,  853,  856,
-      852,  843,   69,  842,  844,  846,   69,   69,  855,   69,
-
-      847,  854,  849,   69,  857,  858,  859,  848,  860, 1846,
-      867,  850,  861,  865,   69,  853,  856,   69,  862,  863,
-      864,  868,   69, 1846,   69,  855,   69,  869,  854,  866,
-       69,  857,   69,  859,   69,  860,   69,   69,   69,  861,
-      865,   69,   69,  870,   69,  862,  863,  864,  876,   69,
-      879, 1846,   69, 1846,  869, 1846,  866,  877,  878,  880,
-      882,  881,   69,  888,  883, 1846,   69,  889,   69,   69,
-      870,  871,   69,   69,   69,  876,  872,  879,  873,   69,
-      874,   69,  875,  884,  877,  878,  880,  885,  881,   69,
-      888,   69,  886,  887,  889,   69,   69,  890,  871,  892,
-
-      891,  893,  896,  872,  898,  873,   69,  874,  894,  875,
-      884,   69,   69,  895,  885,  897,  899,  900, 1846,  886,
-      887,   69,   69,  902,   69,   69,   69,  891,  893,   69,
-       69,   69,  901,  903,  904,  894,  905,  906,   69,   69,
-      895,  909,  897,  899,   69,   69,   69,  907,  910,  908,
-      902,  911,   69,  912,  915,  916,   69,  919,  914,  901,
-      903,  904,   69,  905,  906,  913,   69,  918,   69,   69,
-       69,   69,   69,   69,  907, 1846,  908,  925,  911,   69,
-      917,  915,   69,   69,   69,  914,  922,   69,   69,  920,
-      923,  924,  913,   69,  918,  921,  927,  929,   69,  926,
-
-       69,  928,   69,   69,  925,   69,   69,  917,  930,  932,
-       69,  931,  933,  922,  936,   69,  920,  923,  924,   69,
-       69,  934,  921,  927,  929,  935,  926,  937,  928,  939,
-      938,   69,   69,  940,  942,   69,  932, 1846,  931,  933,
-      941,  936,   69,  943,  944,   69,   69,  946, 1846,  945,
-       69,   69,   69,  947,  937,   69,  939,  938,   69,  948,
-      949,  942,   69,   69,   69,  951,   69,  941,  950,   69,
-      943,  944,  952,   69,  946,  956,  945,   69,  953,  954,
-      947,  955,  960,   69,  957,   69,  948,  949,  958,   69,
-       69,   69,  951,  962,  959,  950,  965,   69,  967,  952,
-
-       69,  961,  956,   69,   69,  953,  954,  964,  955,  960,
-       69,  957,  963,   69,   69,  958,  966,  968,   69,  969,
-      962,  959,  970,  971,   69,  967,  972,   69,  961,   69,
-     1846,  975,   69,  974,  964,  976,  977,  984,  973,  963,
-      978,   69, 1846,   69,  968,   69,   69,   69,   69,  970,
-      971,   69,  983,  972, 1846,  979,  980,  981,   69,  991,
-      974,  982,   69,   69,   69,  973,  985,   69,   69,   69,
-      986,   69,  987,   69,   69,  990,  989,  988,   69,  983,
-       69,   69,  979,  980,  981,   69,  991,  992,  982,   69,
-      994,  993, 1846,  985,  995,  997,  996,  986,  999,  987,
-
-     1003, 1004,  990,  989,  988,   69,  998,   69, 1006,   69,
-     1005, 1008,   69,   69,  992,   69,   69,  994,  993,   69,
-     1846,  995,  997,  996,   69,  999, 1000, 1003,   69, 1007,
-     1001,   69,   69,  998, 1846, 1006,   69, 1005, 1009, 1010,
-     1012, 1011,   69, 1002, 1846, 1013, 1014,   69, 1846, 1016,
-     1015,   69, 1017, 1000, 1846, 1846, 1007, 1001, 1018, 1020,
-       69,   69, 1022, 1846,   69, 1009, 1010,   69, 1011, 1019,
-     1002,   69,   69,   69,   69,   69, 1016, 1015, 1021, 1017,
-     1023,   69,   69, 1024, 1026, 1018, 1020,   69, 1025,   69,
-       69, 1027, 1030,   69, 1028, 1029, 1019, 1032, 1033, 1031,
-
-       69,   69,   69, 1846, 1846, 1021, 1034, 1023, 1039,   69,
-     1024, 1026,   69,   69,   69, 1025, 1038,   69, 1027, 1030,
-       69, 1028, 1029,   69, 1032, 1033, 1031, 1035, 1036, 1037,
-       69, 1040, 1041, 1034,   69, 1039,   69, 1042, 1043,   69,
-     1044,   69, 1045, 1038, 1047, 1046,   69,   69, 1048, 1049,
-       69,   69, 1054, 1050, 1035, 1036, 1037, 1055, 1051, 1041,
-       69, 1052,   69, 1056,   69, 1043,   69,   69,   69, 1045,
-     1057, 1047, 1046, 1053,   69, 1048, 1049, 1059, 1060,   69,
-     1050,   69,   69,   69, 1055, 1051, 1061, 1058, 1052,   69,
-     1056, 1063,   69, 1062, 1065, 1066, 1064, 1057, 1069,   69,
-
-     1053,   69,   69,   69, 1059, 1068, 1067, 1070, 1071,   69,
-       69, 1846,   69, 1061, 1058, 1072,   69,   69, 1063, 1846,
-     1062, 1065,   69, 1064, 1073,   69,   69,   69, 1074,   69,
-     1075,   69, 1068, 1067, 1070, 1071, 1076, 1077, 1081, 1078,
-     1079,   69, 1072, 1080,   69,   69,   69,   69, 1082, 1083,
-       69, 1073, 1084, 1085, 1089, 1074,   69, 1075, 1088, 1086,
-     1090,   69, 1087, 1076,   69, 1081, 1078, 1079,   69,   69,
-     1080,   69, 1091,   69, 1094,   69, 1083,   69, 1092, 1084,
-     1085, 1089, 1093, 1095, 1098, 1088, 1086,   69, 1099, 1087,
-     1100,   69,   69,   69, 1096, 1104,   69, 1097, 1103, 1091,
-
-       69, 1094,   69, 1105, 1102, 1092, 1101,   69,   69, 1093,
-     1095, 1098,   69,   69,   69, 1109, 1110,   69,   69,   69,
-     1106, 1096, 1104, 1108, 1097, 1103, 1107,   69,   69, 1112,
-     1105, 1102,   69, 1101, 1111,   69, 1846, 1117, 1118, 1120,
-     1113,   69, 1109, 1110, 1121, 1115,   69, 1106, 1116, 1119,
-     1108,   69,   69, 1107, 1114, 1122, 1112, 1123,   69, 1124,
-     1127, 1111,   69,   69, 1117,   69,   69, 1113, 1125,   69,
-       69, 1121, 1115,   69, 1126, 1116, 1119, 1128, 1131,   69,
-     1129, 1114, 1122, 1132, 1136, 1130, 1124, 1127,   69,   69,
-     1133,   69,   69,   69,   69, 1125, 1134, 1135, 1139,   69,
-
-     1137, 1126, 1142,   69, 1128, 1846,   69, 1129, 1138,   69,
-     1132, 1136, 1130, 1143, 1140, 1846,   69, 1133,   69, 1141,
-       69, 1148,   69, 1134, 1135, 1139,   69, 1137, 1144,   69,
-       69,   69, 1145, 1150, 1146, 1138, 1147, 1151, 1149, 1152,
-     1143, 1140,   69, 1153,   69, 1154, 1141,   69,   69,   69,
-     1156, 1155,   69,   69, 1157, 1144, 1158, 1159,   69, 1145,
-     1150, 1146, 1160, 1147, 1151, 1149,   69,   69,   69, 1163,
-     1153,   69,   69,   69, 1162, 1161, 1167, 1156, 1155,   69,
-       69,   69, 1164, 1158, 1159, 1166,   69, 1168,   69, 1160,
-       69,   69,   69, 1169, 1173, 1165, 1163, 1178, 1170, 1171,
-
-       69, 1162, 1161, 1167,   69, 1175, 1172,   69, 1174, 1164,
-     1176, 1177, 1166,   69,   69,   69, 1179, 1180, 1181, 1182,
-     1184,   69, 1165, 1186,   69, 1170, 1171,   69,   69, 1183,
-     1193,   69,   69, 1172,   69, 1174, 1185,   69, 1177, 1846,
-       69, 1197, 1191, 1179, 1846, 1181, 1195,   69,   69,   69,
-       69, 1187, 1188, 1189,   69, 1199, 1183, 1192, 1190,   69,
-     1194,   69,   69, 1185,   69, 1196,   69,   69,   69, 1191,
-     1200,   69, 1201, 1195, 1198,   69, 1202,   69, 1187, 1188,
-     1189,   69, 1199, 1203, 1192, 1190, 1205, 1194, 1204, 1206,
-     1207,   69, 1196, 1208,   69, 1209,   69, 1200,   69, 1201,
-
-       69, 1198, 1211, 1202, 1212, 1214,   69,   69, 1846, 1215,
-       69, 1213, 1210, 1205, 1216, 1204, 1206, 1207,   69,   69,
-     1208, 1217, 1209,   69,   69,   69, 1219, 1218, 1221, 1211,
-     1220, 1222, 1214, 1224, 1846,   69,   69,   69, 1213, 1210,
-       69, 1223,   69, 1226,   69,   69,   69, 1227,   69,   69,
-     1225,   69, 1232, 1219, 1218, 1221, 1228, 1220, 1222,   69,
-     1224, 1229, 1231, 1230,   69,   69, 1233, 1235, 1223,   69,
-     1226, 1234, 1236,   69, 1227, 1238, 1239, 1225,   69,   69,
-       69, 1240,   69, 1228,   69, 1241, 1242, 1237, 1229, 1231,
-     1230, 1243,   69, 1233,   69, 1244, 1245, 1247, 1234, 1236,
-
-       69, 1246, 1250,   69, 1248, 1249,   69,   69, 1251, 1252,
-       69, 1253,   69,   69, 1237, 1254,   69,   69, 1243,   69,
-       69, 1255, 1244, 1256, 1247, 1257,   69,   69, 1246, 1258,
-     1259, 1248, 1249,   69, 1261, 1251,   69, 1260, 1253,   69,
-       69, 1263, 1254, 1264, 1262, 1265, 1267,   69, 1255, 1846,
-       69,   69,   69, 1272, 1266,   69, 1258, 1259, 1268,   69,
-       69, 1261,   69,   69, 1260,   69, 1269,   69, 1263,   69,
-     1264, 1262, 1265,   69, 1270, 1273,   69, 1274, 1271, 1275,
-     1272, 1266, 1278,   69,   69, 1268,   69, 1276, 1281, 1279,
-     1283,   69,   69, 1269, 1280, 1288, 1284,   69, 1277, 1282,
-
-     1846, 1270, 1273,   69, 1286, 1271, 1275,   69,   69, 1278,
-     1285,   69,   69,   69, 1276,   69, 1279, 1283, 1287, 1289,
-       69, 1280,   69, 1291, 1292, 1277, 1282,   69, 1290, 1294,
-       69, 1286, 1293, 1295, 1846,   69, 1846, 1285,   69,   69,
-     1297,   69,   69,   69,   69, 1287, 1289, 1296,   69,   69,
-     1291, 1292, 1298, 1301, 1299, 1290, 1294, 1302, 1300, 1293,
-     1295,   69,   69, 1303,   69,   69, 1304, 1297, 1307, 1305,
-     1306, 1315,   69, 1846, 1296,   69, 1308,   69, 1309, 1298,
-     1301, 1299,   69,   69, 1302, 1300,   69,   69, 1310, 1311,
-     1303, 1318, 1312, 1304, 1314,   69, 1305, 1306, 1313, 1325,
-
-       69,   69,   69, 1308, 1316, 1309, 1317,   69, 1846, 1319,
-       69,   69, 1321,   69,   69, 1310, 1311,   69, 1318, 1312,
-       69, 1314, 1320, 1846, 1322, 1313,   69, 1324, 1323, 1328,
-       69, 1316, 1846, 1317,   69,   69, 1319, 1326, 1327,   69,
-       69, 1331, 1329, 1332,   69, 1330, 1341, 1333, 1846, 1320,
-       69, 1322, 1846, 1334, 1324, 1323, 1328, 1335,   69,   69,
-       69,   69,   69,   69, 1326, 1327,   69, 1336, 1331, 1329,
-     1332, 1337, 1330, 1341, 1333,   69, 1338, 1846,   69,   69,
-     1334,   69, 1343, 1339, 1335, 1340, 1342,   69,   69, 1344,
-     1345, 1346, 1348, 1347, 1336, 1351, 1846, 1350, 1337, 1349,
-
-       69,   69, 1354, 1338,   69, 1356,   69, 1355,   69, 1343,
-     1339,   69, 1340, 1342, 1352,   69,   69, 1345,   69, 1348,
-     1347,   69,   69, 1353, 1350,   69, 1349, 1357, 1358,   69,
-       69, 1359,   69,   69, 1355, 1360, 1362, 1361, 1364, 1846,
-       69, 1352, 1363,   69,   69, 1365, 1369, 1370, 1367,   69,
-     1353, 1846, 1368,   69, 1357, 1358, 1366,   69, 1359,   69,
-       69,   69, 1371,   69, 1361, 1364,   69, 1846,   69, 1363,
-       69, 1373, 1365, 1369,   69, 1367, 1372, 1374,   69, 1368,
-     1376, 1380, 1375, 1366,   69,   69, 1379, 1378,   69, 1371,
-       69, 1377,   69,   69,   69,   69,   69, 1382, 1373, 1381,
-
-     1388, 1383, 1384, 1372, 1374,   69, 1385, 1376, 1380, 1375,
-     1387, 1389, 1392, 1379, 1378, 1393,   69, 1386, 1377,   69,
-     1390, 1391, 1394, 1396,   69,   69, 1381,   69, 1383, 1384,
-     1397,   69,   69, 1385, 1398,   69,   69, 1387,   69,   69,
-     1400, 1401,   69, 1395, 1386, 1399, 1402, 1390, 1391,   69,
-       69,   69, 1403,   69,   69, 1404, 1405,   69, 1846, 1407,
-     1406,   69,   69, 1409,   69, 1413, 1411, 1400,   69, 1414,
-     1395, 1415, 1399, 1402, 1408,   69,   69,   69,   69,   69,
-     1410, 1412, 1404, 1405,   69,   69, 1407, 1406,   69,   69,
-       69, 1416,   69, 1411, 1417, 1418, 1414, 1419, 1415, 1420,
-
-     1424, 1408, 1422,   69, 1426,   69,   69, 1410, 1412, 1421,
-       69, 1425, 1423, 1428, 1431,   69, 1846,   69, 1416,   69,
-     1427, 1417,   69, 1429, 1419, 1430,   69, 1424,   69, 1422,
-       69, 1426,   69,   69,   69, 1432, 1421,   69, 1425, 1423,
-     1428, 1431, 1433, 1434, 1435,   69, 1437, 1427, 1439, 1436,
-     1429, 1438, 1430,   69, 1442,   69,   69, 1440, 1445, 1846,
-     1444, 1846, 1432, 1447,   69, 1441,   69,   69, 1443, 1433,
-       69, 1435, 1446, 1437,   69,   69, 1436,   69, 1438,   69,
-     1449, 1442,   69,   69, 1440, 1445,   69, 1444, 1448, 1450,
-     1447, 1451, 1441, 1452,   69, 1443, 1453, 1454, 1455, 1446,
-
-     1456, 1846, 1459,   69,   69, 1457,   69,   69, 1460, 1458,
-       69,   69, 1466, 1846, 1461, 1448,   69, 1846, 1451,   69,
-     1452,   69, 1463, 1453, 1454, 1455,   69, 1456,   69,   69,
-       69, 1462, 1457,   69, 1465, 1460, 1458, 1468, 1467, 1464,
-     1469, 1461, 1470,   69,   69,   69,   69, 1472,   69, 1463,
-     1471, 1846, 1474, 1475, 1476, 1473,   69, 1477, 1462,   69,
-     1478, 1465,   69, 1479, 1468, 1467, 1464, 1469,   69,   69,
-     1480, 1483,   69,   69, 1472, 1481,   69, 1471,   69, 1474,
-       69, 1476, 1473, 1482,   69, 1485,   69,   69,   69, 1486,
-     1487, 1484, 1488,   69,   69, 1489,   69, 1480, 1483,   69,
-
-       69, 1490, 1481, 1491,   69, 1492, 1493, 1494,   69, 1846,
-     1482, 1496, 1485,   69, 1495, 1497,   69, 1487, 1484, 1498,
-       69, 1506, 1489,   69, 1499, 1501, 1500,   69, 1490, 1502,
-       69,   69, 1492, 1493, 1494,   69,   69, 1504,   69,   69,
-       69, 1495,   69, 1503,   69, 1507,   69, 1505,   69, 1508,
-       69, 1499, 1501, 1500,   69, 1509, 1502, 1510,   69,   69,
-     1512, 1517,   69,   69, 1504, 1511, 1513, 1515,   69, 1516,
-     1503,   69, 1507,   69, 1505,   69, 1508, 1518, 1514, 1846,
-     1519, 1846, 1509,   69, 1510, 1527, 1521, 1512,   69,   69,
-     1520,   69, 1511, 1513, 1515,   69, 1516,   69, 1522, 1528,
-
-     1524, 1523, 1525,   69,   69, 1514,   69, 1519,   69,   69,
-     1526,   69, 1527, 1521, 1529, 1530, 1535, 1520,   69,   69,
-     1536, 1531, 1532, 1534,   69, 1522,   69, 1524, 1523, 1525,
-     1533,   69,   69,   69,   69,   69, 1537, 1526, 1541,   69,
-     1846, 1529, 1530, 1535, 1538, 1542, 1539,   69, 1531, 1532,
-     1534, 1540,   69,   69, 1543, 1545, 1544, 1533,   69,   69,
-       69, 1546,   69,   69, 1547, 1541, 1548,   69, 1549, 1550,
-     1553, 1538, 1542, 1539, 1551,   69,   69, 1552, 1540,   69,
-     1554, 1543, 1545, 1544, 1555, 1557,   69, 1558,   69, 1559,
-     1556, 1547,   69, 1548,   69,   69, 1550,   69,   69, 1562,
-
-       69, 1551, 1561, 1560, 1552, 1563, 1565, 1554,   69, 1846,
-     1564,   69,   69, 1567,   69,   69, 1559, 1556,   69, 1566,
-       69,   69, 1568, 1570, 1569,   69, 1562,   69, 1571, 1561,
-     1560,   69, 1563, 1565, 1572,   69,   69, 1564, 1846, 1573,
-     1567, 1574, 1575, 1576,   69, 1577, 1566, 1846, 1578, 1568,
-       69, 1569, 1579, 1846, 1580,   69, 1585,   69, 1846, 1582,
-     1583,   69, 1584, 1846, 1846,   69, 1573, 1846,   69,   69,
-     1576,   69,   69, 1581,   69, 1578,   69,   69,   69, 1579,
-       69, 1580,   69, 1585, 1586,   69, 1582, 1583, 1587, 1584,
-     1588, 1589, 1591,   69, 1590, 1592, 1595, 1593, 1594, 1596,
-
-     1581, 1598,   69,   69,   69, 1846,   69,   69,   69,   69,
-       69, 1586, 1597, 1599, 1600, 1587, 1601, 1588, 1589, 1591,
-       69, 1590, 1592,   69, 1593, 1594, 1596, 1603,   69, 1604,
-       69, 1602,   69, 1606,   69, 1605,   69, 1607, 1611, 1597,
-     1599, 1600,   69, 1601, 1608,   69, 1609,   69, 1612, 1846,
-       69,   69, 1610, 1613, 1603, 1615, 1604, 1614, 1602,   69,
-     1606, 1616, 1605, 1617,   69,   69,   69, 1619,   69, 1620,
-     1618, 1608,   69, 1609, 1621,   69,   69, 1622, 1623, 1610,
-       69, 1624, 1615, 1628, 1614, 1632, 1625,   69,   69, 1627,
-       69, 1626,   69,   69, 1619,   69,   69, 1618,   69, 1629,
-
-       69, 1621,   69,   69, 1622, 1623, 1630,   69, 1624, 1631,
-       69,   69, 1632, 1625, 1633, 1635, 1627,   69, 1626, 1634,
-     1636, 1637,   69, 1641, 1644,   69, 1629,   69, 1639, 1642,
-       69, 1638, 1640, 1630, 1643,   69, 1631,   69, 1648,   69,
-       69, 1633, 1635,   69, 1645, 1646, 1634, 1636, 1637,   69,
-       69,   69, 1647,   69, 1649, 1639, 1642, 1650, 1638, 1640,
-     1651, 1643, 1652,   69,   69,   69, 1654,   69,   69, 1655,
-     1657, 1645, 1646, 1656, 1653,   69,   69,   69,   69, 1647,
-     1658, 1649, 1660, 1659, 1650, 1666, 1664, 1651,   69, 1652,
-       69,   69,   69, 1654, 1662,   69, 1655, 1657,   69, 1661,
-
-     1656, 1653, 1663, 1668, 1665,   69,   69, 1658, 1669, 1670,
-     1659,   69,   69,   69, 1667,   69,   69,   69, 1675, 1671,
-     1673, 1662,   69, 1672, 1674, 1677, 1661, 1679,   69, 1663,
-     1668, 1665,   69, 1680,   69,   69, 1670,   69, 1676,   69,
-       69, 1667, 1681,   69, 1684, 1675, 1671, 1673, 1678, 1683,
-     1672, 1674,   69,   69,   69,   69,   69, 1682, 1686, 1685,
-     1680, 1687, 1688,   69,   69, 1676, 1689, 1690, 1692,   69,
-       69, 1684,   69, 1691,   69, 1678, 1683, 1693, 1695, 1696,
-       69, 1698,   69, 1694, 1682, 1686, 1685, 1701,   69,   69,
-       69, 1697,   69, 1689, 1690,   69, 1702, 1699, 1700,   69,
-
-     1691,   69,   69, 1703, 1693, 1695, 1696,   69, 1705, 1704,
-     1694,   69,   69, 1707,   69, 1706, 1708, 1709, 1697, 1710,
-     1711,   69, 1712,   69, 1699, 1700, 1713, 1716, 1717, 1719,
-     1703,   69, 1714, 1715, 1846, 1705, 1704,   69, 1718, 1720,
-       69,   69, 1706,   69,   69,   69, 1710,   69,   69, 1712,
-       69,   69, 1721,   69,   69, 1717,   69,   69, 1722, 1714,
-     1715,   69, 1723, 1724, 1725, 1718, 1720, 1726, 1727, 1731,
-     1728, 1729,   69,   69,   69,   69,   69,   69, 1732, 1721,
-     1730,   69, 1734, 1733, 1846, 1722, 1736,   69, 1735, 1723,
-     1724, 1725, 1738,   69, 1726, 1727,   69, 1728, 1729, 1737,
-
-     1741, 1742, 1739, 1743, 1846,   69,   69, 1730, 1740,   69,
-     1733,   69,   69,   69,   69, 1735, 1744,   69,   69,   69,
-     1745, 1750, 1747, 1748, 1751,   69, 1737,   69,   69, 1739,
-     1743, 1746,   69, 1749, 1752, 1740, 1753,   69, 1754, 1846,
-     1755,   69, 1758, 1744,   69,   69, 1756, 1745,   69, 1747,
-     1748,   69, 1757,   69, 1759,   69, 1846, 1763, 1746, 1761,
-     1749,   69, 1846,   69, 1760, 1754,   69, 1755,   69, 1758,
-       69, 1762,   69, 1756, 1765, 1766,   69, 1772, 1764, 1767,
-       69, 1759,   69,   69, 1763,   69, 1761,   69, 1768,   69,
-       69, 1760, 1769, 1770, 1773,   69, 1771,   69, 1762, 1774,
-
-     1775, 1765, 1766,   69,   69, 1764, 1767, 1776,   69, 1777,
-     1779,   69,   69, 1778, 1783, 1768, 1781, 1780, 1784, 1769,
-     1770, 1773,   69, 1771, 1782,   69,   69, 1775,   69,   69,
-       69, 1787,   69, 1785, 1776, 1788, 1777, 1793, 1786,   69,
-     1778,   69, 1789, 1781, 1780,   69,   69, 1790,   69,   69,
-       69, 1782,   69, 1791, 1794, 1792, 1801, 1796, 1787,   69,
-     1785,   69, 1788,   69, 1793, 1786, 1797,   69, 1798, 1789,
-     1795, 1800, 1799, 1802, 1790, 1806,   69, 1846,   69,   69,
-     1791, 1794, 1792,   69, 1796, 1803, 1809,   69,   69, 1808,
-       69, 1846, 1846, 1797,   69, 1798, 1804, 1795, 1800, 1799,
-
-       69, 1805, 1807,   69,   69,   69,   69, 1810,   69,   69,
-       69, 1811, 1803, 1809, 1813,   69, 1808, 1812, 1815,   69,
-     1814, 1846, 1816, 1804, 1817, 1846,   69, 1820, 1805, 1807,
-     1818,   69, 1821, 1819, 1810,   69, 1822, 1846, 1811, 1846,
-       69, 1813,   69, 1825, 1812, 1815, 1823, 1814,   69, 1816,
-       69, 1817,   69,   69, 1820, 1827,   69, 1818, 1828,   69,
-     1819, 1824, 1835, 1822, 1826,   69,   69, 1829, 1830,   69,
-     1825, 1831,   69, 1823, 1834,   69,   69,   69, 1832, 1833,
-       69, 1837, 1827, 1836, 1838, 1828,   69,   69, 1824,   69,
-     1846, 1826, 1839, 1840, 1829, 1830, 1841,   69, 1831, 1842,
-
-       69, 1834, 1844,   69, 1845, 1832, 1833,   69,   69, 1843,
-     1836,   69,   69, 1846, 1846,   69, 1846,   69,   69, 1839,
-     1840, 1846, 1846, 1841, 1846, 1846, 1842, 1846, 1846,   69,
-     1846,   69, 1846, 1846, 1846, 1846, 1843,   41,   41,   41,
-       41,   41,   41,   41,   46,   46,   46,   46,   46,   46,
-       46,   51,   51,   51,   51,   51,   51,   51,   57,   57,
-       57,   57,   57,   57,   57,   62,   62,   62,   62,   62,
-       62,   62,   72,   72, 1846,   72,   72,   72,   72,  127,
-      127, 1846, 1846, 1846,  127,  127,  129,  129, 1846, 1846,
-      129, 1846,  129,  131, 1846, 1846, 1846, 1846, 1846,  131,
-
-      134,  134, 1846, 1846, 1846,  134,  134,  136, 1846, 1846,
-     1846, 1846, 1846,  136,  138,  138, 1846,  138,  138,  138,
-      138,   73,   73, 1846,   73,   73,   73,   73,   13, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846
-
+       69,  426,  435,  430,  431,  432,  434,  433,  436,   69,
+       69, 1879,   69,   69,   69,   69,  427,  428,  437,   69,
+      438,  429,  439,  440, 1879,  444,  441, 1879,  446,  435,
+      430,  431,  432,  434,  433,   69,   69, 1879,  442,   69,
+
+      443,   69,   69,   69,  445,  437,   69,  438,   69,  439,
+       69,  447,  444,  441,   69,  446,   69,  454,  448, 1879,
+      455,  456,   69,  461,   69,  442,   69,  443,   69,  460,
+      459,  445,   69,  457, 1879,  462,   69,   69,  447,  463,
+      464, 1879,  458,  465,  454,  448,  449,  455,  456,   69,
+      461,  450,   69,  451,   69,  469,  460,  459,   69, 1879,
+      467,  452,  462,  466,   69,   69,  463,  464,   69,  458,
+      465,  453,   69,  449,  468,   69,  470,   69,  450,   69,
+      451,  471,  469,  472,  473,  474,  477,  467,  452,   69,
+      466,  475,  479,  476,   69,   69,  478,  480,  453,  481,
+
+       69,  468,   69,  470,  483,  484,   69,  137,  471,  486,
+      472,  473,   69,  477,  482,   69,   69,   69,  475,   69,
+      476,  485,  489,  478,  480,  491,  490,  492,   69,   69,
+       69,  483,  484,   69,  487,  493,  486,  488,  494,   69,
+      495,  482,  497,   69,  496,   69, 1879,  500,  485,  498,
+      499,  501,  491,   69,   69,   69,  502,  505,  503,  504,
+     1879,  487,   69, 1879,  488,  506,   69,   69,  507,   69,
+       69,   69,   69,   69,  500,  512,  498,  499,  516,   69,
+       69,   69,   69,  502,  508,  503,  504,   69,   69,  509,
+      511,  513,  506,  510,  515,  507,  517,  514,  518,   69,
+
+       69,   69,  512, 1879,  519,  526,  521,   69,   69,   69,
+      523,  508, 1879,  533,   69,  522,  509,  511,  513,   69,
+      510,  515,   69,  517,  514,  518,  520,   69,   69,   69,
+      524,  519,   69,  521,  525,  527,   69,  523,  530,  528,
+      529,   69,  522,  531,   69,  532,  534,  535,  542,   69,
+      536,  538,   69,  520,  537,  539,   69,  524,   69, 1879,
+       69,  525,  527,   69,   69,  530,  528,  529,   69,  540,
+      531,  541,  532,  534,   69,  543,   69,  536,   69,   69,
+      544,  537,   69,   69,  546,   69,  548,  550,  547,  549,
+      551,  552, 1879,   69, 1879,  545,  540,   69,  541,   69,
+
+       69,  553,  543,  554,   69,  556,  555,  544,  557,   69,
+       69,   69,   69,  548,  550,   69,  549,  551,  552,  559,
+       69,  563,  545,   69,  560,  558,  564,  565,  553,   69,
+      554,   69,  556,  555,   69,  557,  561,  562,  566,  567,
+      571,  570,  569,   69,   69,   69,  559,   69,  563,   69,
+       69,  568,  558,  564,  565,   69,   69,  572,  573,   69,
+       69,   69,   69,  561,  562,  566,  567,  571,  570,  569,
+      574,  576,  575,  578,  579,  577,  586,   69,  568,  580,
+       69,   69,  581,  582,  572,  573,   69,  583,  591,   69,
+      585,   69,   69,   69, 1879,  584,  137,  574,  576,  575,
+
+      578,  579,  577,   69,  587,   69,  580,   69,   69,  581,
+      582,   69,  588,   69,  583,  589,  590,  585,  592,   69,
+      593,  594,  584,   69,  600,   69, 1879,  605,  601,   69,
+       69,  587,  602,  603,  604,   69,   69,   69,   69,  588,
+      613,  616,  589,  590, 1879,  592, 1879,  593,  594,  595,
+       69,  600,  617,  596,   69,  601,  597,   69,   69,  602,
+      603,  604,   69,  598,  614,   69,  599,  613,  616,  618,
+     1879,   69,  615,   69,   69,  619,  595,  621, 1879,   69,
+      596,  625, 1879,  597, 1879, 1879,  620,  622,  624,   69,
+      598,  614,  623,  599,  606,  607,  618,  608,   69,  615,
+
+      609,   69,  619,   69,  621,  610,   69,  630,  625,   69,
+       69,  611,  612,  620,  622,  624,   69,  626,  628,  623,
+       69,  606,  607,  627,  608,   69,   69,  609,  629,  631,
+       69,  632,  610,   69,  630,  633,  634,  635,  611,  612,
+       69,   69,  636,  637,  626,  628, 1879,   69,  638, 1879,
+      627,  641,  639,  640,  642,  629,  631,   69,  632,  645,
+       69, 1879,  633,   69,  643,  646,  644,   69,   69,   69,
+      637,   69,   69,   69,   69,  638,   69,  647,  641,  639,
+      640,  642,  648,   69,   69,  650,   69,  649,  651,  653,
+     1879,  643,  646,  644,  652,   69,   69,  654,  655,  658,
+
+      659,  660,   69,   69,  647,   69,   69,   69, 1879,  656,
+       69, 1879,  650,   69,  649,  651,  653,  657,   69,  665,
+      670,  652,   69,   69,  654,  655,  658,  659,  660,  662,
+      661,  663,  664,   69,   69,  667,  656,   69,   69,  666,
+      669,   69,   69,   69,  657,  668,  665,  670,   69,  671,
+       69,  673,  674,   69,  672,  675,  662,  661,  663,  664,
+      677,   69,  667,   69,   69,  676,  666,  669,   69,  678,
+      683,  679,  668,  680,  682,  681,   69,  685,  673,   69,
+      684,  672,  686,   69,   69,  688,   69,  677,   69,   69,
+      689,   69,  676,   69,   69,  691,  678,  683,  679,  687,
+
+      680,   69,  681,  690,  685,   69,   69,  684,  692,  703,
+      694,  693,   69,   69,   69,   69,   69,  137,   69,  702,
+      695,  720,  691,   69, 1879, 1879,  687,   69,  704,  736,
+      690,  705,   69,   69, 1879,  692,  703,  694,  693, 1879,
+       69,  706,  734,  708,  709,   69,  702,  695,  696,  710,
+      697,  707,   69,  779,  698,  704,  699,   69,  705,  711,
+       69,  700,   69,   69,   69,   69,  701,  712,  706,   69,
+      708,  709,   69,  715,  713,  696,  710,  697,  707,   69,
+       69,  698,   69,  699,  714,  716,  711,  719,  700,  718,
+      725,  717,  881,  701,  712,   69,   69,   69,   69,  721,
+
+      715,  713,   69, 1879,  722,   69,  723,  726,   69,  727,
+      730,  714,  716,  728,  719,  729,  718,  725,  717,  731,
+       69,  735,   69,  737,  724,   69,  721,  733,   69,   69,
+      732,  722,   69,  723,  726,   69,  727,  730,   69,  740,
+      728,   69,  729,   69,   69,  738,  731,   69,  735,  739,
+      737,  724,  741,   69,  733,  743,  742,  732,  744,  745,
+      746,  751,  747,   69,   69, 1879, 1879,  749,   69,   69,
+       69,  748,  738,   69,   69,  750,  739,   69,   69,  741,
+       69,  753,  743,  742,   69,  744,  745,  746,  752,  747,
+       69,  754,   69,   69,  749,  755,   69,  756,  748,  757,
+
+      760,  759,  750,   69, 1879,  758,  761,  763,  753,  765,
+      767,  764,  766, 1879,  762,  752,  768,   69,  754,   69,
+       69,   69,  755,   69,  756,   69,  757,   69,  759,   69,
+      770,   69,  758,  761,   69,   69,  765,  767,   69,  766,
+      769,  762,   69,  768,  771,  772,  773,   69,  774, 1879,
+      777,   69,   69,  776,  775,  781, 1879,  770,  778,  782,
+      780,   69, 1879, 1879,   69, 1879, 1879,  769, 1879,   69,
+       69,  771,  772,  773,   69,  774,   69,  777,   69,   69,
+      776,  775,  781,   69,  783,  778,  782,  780,  784,  786,
+      785,  787,  788,   69,  791,  789,   69,   69,  793,  790,
+
+      794,  796, 1879,   69,   69,  792, 1879,  808, 1879, 1879,
+       69,  783,  795,   69,   69,  784,  786,  785,  787,  788,
+       69,  791,  789,   69,   69,  797,  790,  798,   69,   69,
+      799,   69,  792,   69,  801,  802,  803,  805,   69,  795,
+       69,  809,  807,   69,   69,   69,  804,  806,   69,   69,
+       69, 1879,  797,   69,  798,  810,  811,  799,  812,   69,
+     1879,  801,  802,  803,  805,  814,  813,  816,  815,  807,
+      817,   69,   69,  804,  806,   69,  818,   69,   69,   69,
+       69,  819,  810,  811,  820,  812,  821,   69,   69,   69,
+       69,  822,  814,  813,  816,  815,  823,  817,  824,   69,
+
+       69,  825,  826,  818,  831,   69,  827,  828,  819, 1879,
+      830,   69,  829,  821, 1879, 1879,  832,   69,  822,   69,
+       69,  836,   69,  823,   69,  824,   69,   69,  825,  826,
+      834,  831,  833,  827,  828,  837,   69,  830,   69,  829,
+       69,  835,  838,  832,   69,  840,  839,  842,  836,   69,
+      843,  841,   69,   69,   69,   69,   69,  834,   69,  833,
+      845,  844,  837,  846,  847,   69,   69,  848,  835,  838,
+       69,   69,  840,  839,  842,   69,  849,  843,  841,  850,
+     1879,   69,  851,  853,  854,   69,  852,  845,  844,  857,
+      846,  847,   69,   69,  848,  858,  855,   69,  859,   69,
+
+      856,   69,  861,  860,  862,   69,  850,   69,   69,  851,
+      853,  854,  863,  852,  864,  865,  857,   69,  866, 1879,
+       69,  868,  858,  870,   69,  859,  871,   69,  867,  861,
+      860,  872,   69,  874,  869,   69,   69,   69,   69,  863,
+      880,  864,  865,   69,   69,  866,   69,   69,  868,  873,
+      870,  883,  882,  884,  885,  867,   69,   69, 1879, 1879,
+      874,  869,   69,   69,  890,   69,   69,  880,   69,  886,
+      889,   69,   69,  891,   69, 1879,  873,  875,  883,  882,
+      884,  885,  876,   69,  877,  887,  878,   69,  879,  888,
+      892,  890,   69,  893,  895,   69,  886,  889,  896,  894,
+
+      891,   69,   69,   69,  875,  897,  898,  899,  901,  876,
+       69,  877,  902,  878,  900,  879,   69,  892,  903,   69,
+      893,   69,   69,  905,  904,  896,  894,  907,  908,   69,
+       69,  906,   69,  898,  899,   69,  910,  909,   69,  902,
+      912,  900,  914,  911,  916,   69,   69,   69,  913,   69,
+       69,  904,   69,  915,  907,  908,  917, 1879,  906,   69,
+      924,   69,   69,  910,  909,  918,   69,  912,   69,  919,
+      911,  916,  920,   69,  921,  913,  923,   69,  922,  927,
+       69,  929,  928,   69,   69,   69,   69,   69,   69,  925,
+       69,   69,  918,  930,  935,  926,  919,   69, 1879,  920,
+
+      931,   69,   69,  923,  933,  922,  927,   69,  929,  928,
+      932,  934,   69,   69,  936,  938,  925,  937,   69,   69,
+      930,   69,  926,   69,  939,  941,  942,  931,  940,  943,
+      947,  933,  945,   69,  944,  946, 1879,  932,  934,   69,
+      948,  936,  938,   69,  937,   69,   69,   69,   69,  949,
+       69,  950,  941,  942,   69,   69,  943,  947,   69,  951,
+       69,  944,  946,   69,  952,  953,  954,  948,  955,  957,
+     1879,  956,   69,   69,  962,  958,  949,   69,  950,   69,
+      960,   69,   69,  961,  963,  959,  951,   69,   69,   69,
+      964,  952,  953,  954,   69,  955,  957,   69,  956,   69,
+
+      965,  962,  958,  966,  967,   69,   69,  960,  968,  970,
+      961,  963,  959,  971,   69,   69,  969,  964,   69,  972,
+     1879,  973,  974,  976, 1879,   69,  978,  965,  975, 1879,
+      966,  967,   69,  979,  977,  968, 1879,  989,   69,   69,
+       69,   69, 1879,  969,   69,   69,  972,   69,  973,   69,
+      976,   69,  988,  978,  980,  975,   69,  984,  981,  982,
+      979,  977,  985,  983,  987,   69,  986,   69,   69,  990,
+       69, 1879,   69,   69,  991,  992,  996,   69,  993,  988,
+      997,  994,   69,   69,  984,   69,   69,  998,   69,  985,
+       69,  987,  995,  986,   69,  999,  990, 1000,   69, 1001,
+
+     1002,  991,  992,  996, 1003,  993,   69,  997,  994, 1010,
+       69,   69, 1004, 1011,  998, 1005, 1006, 1014,   69,  995,
+     1007,   69,  999,   69,   69, 1009, 1001, 1002, 1012,   69,
+       69, 1003,   69, 1008, 1016,   69,   69, 1013, 1018, 1004,
+     1011,   69, 1005, 1006,   69, 1015, 1019, 1007,   69, 1017,
+     1020,   69, 1009, 1022,   69, 1012,   69, 1021, 1023, 1027,
+     1008, 1016, 1028, 1024, 1013,   69, 1026, 1879, 1030,   69,
+       69,   69, 1015,   69, 1025,   69, 1017,   69, 1031,   69,
+     1022,   69, 1879,   69, 1021, 1023, 1027,   69,   69,   69,
+     1024, 1029, 1032, 1026,   69, 1030, 1034, 1033,   69, 1035,
+
+     1036, 1025, 1037, 1039,   69, 1031, 1038, 1040,   69,   69,
+     1041, 1044, 1046, 1042,   69,   69, 1048,   69, 1029, 1032,
+       69,   69, 1045, 1034, 1033,   69, 1035, 1036, 1043, 1037,
+     1039,   69,   69, 1038, 1040,   69,   69, 1041, 1044, 1047,
+     1042, 1049, 1050,   69,   69, 1051,   69,   69, 1053, 1045,
+     1052,   69, 1054,   69,   69, 1043, 1056, 1060, 1055, 1061,
+     1879, 1879, 1062,   69, 1066, 1063, 1047, 1057, 1049,   69,
+     1058,   69, 1051,   69, 1064, 1053,   69, 1052,   69, 1054,
+       69,   69, 1059, 1056, 1065, 1055, 1061,   69,   69, 1062,
+     1067,   69, 1063, 1068, 1057,   69, 1069, 1058, 1070, 1071,
+
+     1072, 1064,   69, 1073,   69,   69, 1074,   69,   69, 1059,
+     1075, 1065, 1076, 1077, 1080, 1083,   69, 1067, 1879, 1879,
+     1068,   69,   69, 1069, 1082, 1070, 1071,   69,   69, 1078,
+     1073,   69, 1081, 1074,   69, 1079,   69,   69,   69, 1076,
+     1077, 1080,   69, 1084, 1086, 1085,   69,   69, 1087, 1088,
+       69, 1082,   69, 1090,   69, 1089, 1078,   69, 1091, 1081,
+     1097, 1092, 1079, 1094, 1093,   69, 1879, 1099, 1098, 1879,
+     1084, 1086, 1085, 1100,   69, 1087,   69,   69,   69,   69,
+     1090, 1095, 1089, 1101,   69, 1091, 1096,   69, 1092,   69,
+     1094, 1093,   69,   69, 1099, 1098, 1102, 1105, 1107, 1103,
+
+     1100,   69, 1104, 1106,   69, 1108, 1109, 1879, 1095, 1110,
+     1101, 1112,   69, 1096, 1111,   69, 1113,   69,   69, 1114,
+       69,   69,   69, 1102, 1105,   69, 1103,   69, 1115, 1104,
+     1116,   69, 1108, 1109,   69, 1118, 1110,   69, 1112, 1117,
+     1124, 1111, 1119, 1113, 1120, 1122, 1114, 1125, 1123,   69,
+       69, 1127, 1126,   69, 1879, 1115,   69, 1116, 1121, 1128,
+     1130,   69, 1118,   69,   69, 1134, 1117, 1124, 1136, 1119,
+       69, 1120, 1122, 1131, 1129, 1123, 1135,   69,   69, 1126,
+       69,   69,   69, 1132,   69, 1121, 1128,   69, 1137, 1133,
+       69,   69, 1134, 1138, 1139, 1136,   69, 1879, 1143, 1140,
+
+     1131, 1129, 1141, 1135, 1142,   69, 1144,   69,   69,   69,
+     1132, 1148, 1145, 1147, 1146, 1137, 1133,   69, 1149, 1879,
+       69, 1139, 1150,   69,   69, 1143, 1140,   69,   69, 1141,
+     1151, 1142,   69, 1144,   69,   69, 1152, 1153, 1148, 1145,
+     1147, 1146, 1879, 1155, 1156,   69, 1154, 1879, 1158, 1150,
+       69,   69,   69, 1157,   69, 1159, 1161, 1151, 1163,   69,
+     1160, 1879,   69, 1152, 1153, 1164, 1162, 1879, 1166,   69,
+     1879, 1156, 1879, 1154,   69, 1158,   69, 1169, 1167, 1165,
+     1157, 1170,   69,   69,   69, 1163, 1168, 1160,   69,   69,
+       69, 1173,   69, 1162,   69, 1166,   69, 1171,   69, 1174,
+
+     1175,   69, 1176,   69, 1169, 1167, 1165, 1180, 1170, 1178,
+     1172,   69, 1179, 1168, 1177,   69, 1181,   69, 1173,   69,
+       69, 1182, 1183,   69, 1171, 1185, 1174,   69, 1184, 1187,
+     1186, 1188, 1189,   69,   69, 1191, 1178, 1172, 1192, 1179,
+       69, 1177, 1190, 1181,   69, 1193, 1879, 1200,   69,   69,
+     1879,   69, 1198, 1879,   69, 1184,   69, 1186, 1188,   69,
+       69, 1202,   69,   69,   69, 1192, 1194, 1195, 1196, 1190,
+     1199, 1204, 1210, 1197,   69, 1201,   69,   69,   69, 1198,
+     1203,   69,   69, 1205,   69, 1206,   69, 1208, 1202, 1207,
+       69, 1209,   69, 1194, 1195, 1196,   69, 1199,   69, 1210,
+
+     1197, 1211, 1201, 1212, 1213, 1214, 1220, 1203, 1215,   69,
+     1205,   69, 1206, 1216, 1208,   69, 1207,   69, 1209, 1217,
+       69, 1219, 1218,   69,   69, 1222, 1223, 1221,   69, 1224,
+     1212, 1213, 1214,   69,   69, 1215, 1225,   69, 1227,   69,
+     1216, 1879, 1226,   69, 1228,   69, 1217, 1229, 1219, 1218,
+     1232,   69, 1222, 1230, 1221,   69,   69,   69, 1231,   69,
+       69, 1233,   69,   69,   69, 1227, 1234, 1235,   69, 1226,
+     1236, 1228, 1237, 1239, 1229, 1238, 1240, 1232,   69,   69,
+     1230, 1243,   69, 1244,   69, 1231, 1247, 1246, 1233,   69,
+     1241,   69,   69, 1234, 1235, 1242,   69, 1236, 1245, 1237,
+
+     1239, 1248, 1238,   69, 1250, 1249,   69, 1253,   69, 1252,
+     1244,   69, 1254,   69, 1251,   69, 1256, 1241,   69, 1255,
+     1258, 1257, 1242,   69,   69, 1245, 1260,   69, 1259, 1261,
+     1879,   69,   69,   69, 1262,   69, 1252, 1263,   69, 1254,
+     1264, 1251,   69, 1256,   69, 1265, 1255, 1266, 1257, 1267,
+     1269,   69, 1275, 1268,   69, 1259, 1261,   69,   69, 1271,
+     1270, 1262, 1879,   69, 1263, 1272, 1276,   69, 1273, 1274,
+       69,   69,   69,   69, 1266,   69, 1267, 1269,   69,   69,
+     1268,   69, 1277,   69,   69, 1278, 1271, 1270, 1280,   69,
+     1279, 1281, 1272, 1276,   69, 1273, 1274, 1282,   69, 1284,
+
+       69, 1879, 1287, 1283, 1288, 1286, 1289, 1290, 1291, 1277,
+     1285,   69, 1278,   69,   69, 1280,   69, 1279, 1281,   69,
+       69,   69,   69, 1292, 1294,   69, 1284, 1879,   69, 1287,
+     1283, 1288, 1286,   69, 1290, 1291, 1293, 1285, 1296, 1295,
+     1297, 1298, 1879, 1299, 1300, 1879,   69, 1301,   69, 1879,
+       69, 1294, 1307,   69,   69, 1305,   69, 1302, 1303,   69,
+       69, 1304,   69, 1293,   69,   69, 1295, 1297, 1298,   69,
+     1299, 1300,   69,   69, 1301, 1306,   69, 1309, 1310, 1307,
+     1311, 1879, 1305, 1308, 1302, 1303, 1312,   69, 1304,   69,
+       69, 1313, 1316, 1315, 1314, 1317,   69, 1330, 1324,   69,
+
+     1319, 1318, 1306,   69, 1309, 1310,   69, 1311,   69, 1320,
+     1308,   69,   69, 1312, 1879, 1321, 1325, 1322, 1313,   69,
+     1315, 1314, 1317,   69,   69,   69,   69, 1319, 1318,   69,
+     1327,   69, 1323, 1326, 1334, 1331, 1320,   69,   69,   69,
+     1328, 1329, 1321, 1325, 1322, 1333, 1332,   69,   69,   69,
+     1879, 1336,   69, 1335,   69, 1337, 1341, 1327,   69, 1323,
+     1326,   69, 1331, 1338, 1340,   69, 1339, 1328, 1329, 1342,
+       69, 1345, 1333, 1332,   69,   69,   69, 1343, 1336, 1344,
+     1335,   69, 1337, 1341,   69,   69, 1347, 1346, 1348,   69,
+     1338, 1340, 1352, 1339,   69, 1349, 1342,   69, 1345,   69,
+
+     1350,   69, 1353, 1351, 1343,   69, 1344, 1354, 1355,   69,
+       69, 1358,   69, 1347, 1346, 1348,   69, 1357, 1356, 1352,
+     1360, 1364, 1349, 1359, 1361,   69,   69, 1350, 1362,   69,
+     1351, 1365, 1363,   69, 1354,   69, 1366,   69, 1358,   69,
+       69, 1367, 1368, 1369, 1357, 1356, 1370,   69,   69,   69,
+     1359,   69,   69, 1371, 1372, 1362, 1374,   69, 1365, 1363,
+     1373, 1375,   69,   69, 1376,   69, 1879,   69, 1367, 1368,
+     1369, 1377, 1380, 1378, 1379,   69,   69,   69,   69, 1381,
+     1371,   69,   69, 1374, 1382,   69, 1383, 1373, 1375, 1384,
+       69, 1376, 1390,   69, 1387, 1385,   69,   69, 1377,   69,
+
+     1378, 1379,   69,   69, 1388, 1386, 1381,   69,   69,   69,
+     1392, 1382,   69, 1383, 1389, 1393, 1384, 1391, 1398, 1390,
+       69, 1387, 1385,   69, 1394, 1879, 1397, 1395, 1399, 1396,
+     1402, 1388, 1386, 1401, 1400, 1403, 1404,   69,   69,   69,
+       69, 1389, 1393,   69, 1391,   69,   69,   69, 1406, 1408,
+     1405, 1394,   69, 1397, 1395,   69, 1396,   69,   69, 1407,
+     1401, 1400,   69,   69, 1409, 1410, 1411, 1412,   69, 1414,
+     1413, 1415, 1879,   69, 1416,   69,   69, 1405,   69, 1417,
+       69, 1420, 1421, 1879, 1418, 1879, 1407, 1424,   69, 1879,
+       69,   69, 1410, 1411,   69,   69,   69, 1413, 1415, 1419,
+
+     1422, 1416, 1428,   69, 1429, 1423, 1417, 1427,   69, 1421,
+       69, 1418,   69,   69,   69, 1425, 1426, 1431, 1879,   69,
+       69, 1433,   69, 1432,   69,   69, 1419, 1422, 1430, 1428,
+     1435,   69, 1423, 1434, 1427, 1438,   69, 1436, 1437, 1440,
+       69, 1441, 1425, 1426,   69,   69, 1439,   69, 1433,   69,
+     1432,   69,   69,   69, 1442, 1430, 1443, 1435, 1444,   69,
+     1434,   69, 1438, 1445, 1436, 1437, 1440, 1450, 1441, 1446,
+     1447,   69,   69, 1439,   69, 1448, 1456,   69, 1449, 1879,
+     1451, 1442, 1453, 1443, 1879, 1444, 1457, 1454, 1452,   69,
+     1455,   69,   69,   69,   69, 1879, 1446, 1447,   69,   69,
+
+     1458, 1460, 1448, 1456,   69, 1449,   69, 1451,   69, 1453,
+       69, 1459, 1461, 1457, 1454, 1452,   69, 1455,   69, 1462,
+     1463, 1465,   69, 1464, 1466, 1471, 1467, 1458, 1460, 1468,
+     1478, 1469, 1879,   69,   69, 1470,   69,   69, 1459,   69,
+     1879, 1472, 1475, 1879, 1477, 1879,   69, 1463, 1465,   69,
+     1464, 1466,   69, 1467,   69,   69, 1468, 1473, 1469,   69,
+     1474,   69, 1470,   69,   69,   69,   69, 1476, 1472, 1475,
+     1479, 1477, 1480,   69,   69, 1482, 1481, 1483, 1879, 1879,
+     1484, 1487, 1485,   69, 1473, 1486, 1490, 1474, 1489, 1491,
+     1492,   69, 1488, 1879, 1476,   69,   69, 1479,   69, 1480,
+
+     1493,   69, 1496, 1481, 1483,   69,   69, 1484,   69, 1485,
+       69,   69, 1486,   69, 1494, 1489,   69, 1495, 1498, 1488,
+     1497,   69,   69, 1499,   69,   69,   69, 1493,   69, 1496,
+     1500, 1501, 1504,   69, 1502, 1879, 1505, 1503, 1879, 1507,
+     1506, 1494, 1509,   69, 1495, 1498, 1508, 1497,   69,   69,
+       69, 1510,   69, 1511, 1879, 1512, 1514, 1500,   69,   69,
+     1515, 1502,   69, 1505, 1503,   69, 1507, 1506,   69,   69,
+       69,   69, 1513, 1508, 1516,   69, 1517, 1518,   69, 1519,
+       69,   69, 1512, 1514,   69, 1521,   69, 1515, 1522,   69,
+     1520, 1523, 1529, 1524, 1525,   69,   69, 1526,   69, 1513,
+
+     1527, 1516, 1531, 1517, 1518,   69,   69,   69,   69,   69,
+     1530, 1528, 1521, 1532,   69, 1522,   69, 1520, 1523, 1529,
+     1524, 1525, 1533,   69, 1526, 1535, 1534, 1527, 1538,   69,
+     1536, 1542,   69,   69,   69,   69, 1537, 1530, 1528, 1541,
+       69, 1540, 1543,   69, 1539, 1546,   69, 1544,   69, 1533,
+       69,   69, 1535, 1534,   69, 1538, 1550, 1536,   69, 1551,
+       69, 1545, 1879, 1537, 1548,   69, 1541,   69, 1540, 1543,
+     1547, 1539, 1546,   69, 1544,   69, 1549, 1552, 1555,   69,
+     1553, 1554, 1879,   69,   69, 1560,   69, 1556, 1545,   69,
+       69, 1548,   69, 1557,   69, 1559, 1561, 1547, 1558, 1564,
+
+       69, 1562,   69, 1549, 1552, 1555,   69, 1553, 1554,   69,
+     1563,   69, 1560,   69, 1556, 1565, 1567, 1566, 1568,   69,
+     1557, 1569, 1559,   69, 1570, 1558,   69, 1572, 1562,   69,
+     1573, 1575, 1571, 1879, 1574,   69,   69, 1563,   69,   69,
+       69, 1577, 1565, 1567, 1566,   69, 1576, 1578, 1569, 1585,
+     1582,   69, 1580, 1581,   69, 1584, 1583,   69, 1575, 1571,
+       69, 1574, 1579,   69,   69,   69, 1586,   69, 1577,   69,
+       69,   69,   69, 1576, 1578, 1587,   69, 1582,   69, 1580,
+     1581, 1588, 1584, 1583, 1589, 1593, 1590, 1591, 1879, 1579,
+     1592, 1879, 1594,   69, 1879,   69, 1595, 1597, 1879, 1602,
+
+     1599, 1598, 1587, 1596,   69, 1601,   69, 1879,   69,   69,
+     1600, 1589,   69,   69,   69,   69,   69, 1592,   69, 1594,
+       69,   69,   69, 1595, 1597,   69, 1602, 1599, 1598,   69,
+     1596, 1603, 1601, 1604, 1605, 1879, 1606, 1600, 1607, 1608,
+     1611, 1609, 1610, 1615, 1879,   69, 1612,   69,   69, 1614,
+       69,   69,   69, 1613,   69, 1616,   69, 1617, 1603, 1618,
+     1604, 1605,   69, 1606, 1619, 1607, 1608,   69, 1609, 1610,
+       69,   69,   69, 1612,   69, 1620, 1614,   69,   69,   69,
+     1613, 1621, 1616, 1622, 1617, 1623, 1618, 1624, 1628, 1625,
+     1879, 1619, 1626, 1627,   69,   69,   69, 1629,   69, 1630,
+
+     1631, 1633, 1620, 1634, 1879, 1639, 1635, 1879, 1621,   69,
+     1622,   69, 1623, 1647,   69,   69, 1625,   69,   69, 1626,
+     1627, 1632, 1638, 1640,   69, 1879,   69, 1631, 1646,   69,
+       69, 1636,   69, 1635,   69, 1637,   69, 1641, 1642, 1643,
+       69,   69, 1644,   69, 1648,   69, 1645,   69, 1632, 1638,
+     1640,   69,   69,   69, 1651, 1646, 1649, 1879, 1652, 1650,
+     1654,   69,   69, 1653, 1641, 1642, 1643,   69, 1879, 1644,
+     1655, 1648, 1660, 1645,   69,   69, 1657,   69, 1656,   69,
+       69, 1651,   69, 1649,   69, 1652, 1650, 1654, 1658, 1659,
+     1653, 1662, 1663, 1661,   69,   69,   69, 1655, 1664,   69,
+
+     1665,   69, 1667, 1657, 1666, 1656, 1668, 1669, 1670, 1672,
+     1671, 1879, 1682,   69,   69, 1658, 1659,   69, 1662, 1663,
+     1661,   69,   69,   69,   69,   69,   69, 1665,   69, 1667,
+     1673, 1666,   69,   69, 1669, 1670, 1672, 1671, 1674, 1879,
+     1675, 1676, 1677,   69, 1678, 1680, 1681, 1679, 1683, 1685,
+     1686, 1879, 1688,   69,   69, 1684, 1879, 1673,   69,   69,
+       69, 1691, 1692,   69,   69, 1674,   69, 1675, 1676, 1677,
+       69, 1678, 1680, 1681, 1679, 1683, 1685,   69, 1687,   69,
+       69,   69, 1684, 1689, 1690,   69, 1693, 1694,   69, 1692,
+     1696,   69, 1695, 1697, 1698,   69,   69, 1699,   69, 1700,
+
+       69, 1701, 1702, 1703,   69, 1687, 1704,   69, 1706,   69,
+     1689, 1690,   69, 1693, 1694,   69, 1705, 1696, 1707, 1695,
+     1697, 1698, 1710,   69,   69,   69, 1700, 1708,   69,   69,
+     1703, 1709, 1711,   69, 1712, 1706,   69, 1713, 1715, 1714,
+       69, 1717,   69, 1705,   69, 1707,   69, 1716, 1718,   69,
+     1719, 1721,   69, 1723, 1708, 1720, 1726,   69, 1709,   69,
+     1727, 1712, 1722,   69, 1713,   69, 1714,   69, 1717, 1729,
+       69,   69, 1879,   69, 1716, 1718, 1731, 1719, 1721,   69,
+     1724, 1725, 1720,   69,   69, 1728, 1730,   69, 1732, 1722,
+       69,   69, 1733,   69, 1734, 1735, 1729, 1736,   69,   69,
+
+     1737, 1738, 1740, 1731, 1741, 1739, 1879, 1724, 1725, 1744,
+     1879, 1742, 1728, 1730, 1879,   69, 1743,   69,   69,   69,
+       69,   69, 1735, 1745,   69, 1748,   69, 1737,   69, 1740,
+     1746,   69, 1739,   69, 1747,   69,   69,   69, 1742, 1749,
+     1750,   69, 1751, 1743, 1752,   69, 1756,   69, 1753, 1754,
+     1745,   69, 1748, 1757,   69,   69, 1755, 1746,   69,   69,
+       69, 1747,   69, 1758, 1759, 1760, 1749, 1750,   69, 1751,
+     1761, 1752, 1762, 1756, 1763, 1753, 1754, 1765, 1767, 1770,
+     1757, 1764, 1768, 1755, 1766, 1879, 1769,   69,   69, 1771,
+       69,   69, 1760, 1772,   69,   69,   69,   69, 1774, 1762,
+
+       69,   69, 1788, 1879,   69, 1767,   69, 1776, 1764, 1768,
+       69, 1766,   69, 1769, 1777,   69,   69, 1773, 1775,   69,
+     1772, 1779, 1778, 1780,   69, 1774, 1781, 1782, 1783,   69,
+       69, 1784, 1786,   69, 1776, 1785,   69, 1787, 1789, 1879,
+     1879, 1777, 1879,   69, 1773, 1775, 1790,   69,   69, 1778,
+       69,   69, 1791,   69,   69, 1783, 1793,   69, 1784,   69,
+       69,   69, 1785, 1792, 1787, 1789, 1794,   69,   69, 1795,
+     1797, 1796,   69, 1790, 1798, 1804,   69, 1799, 1800, 1791,
+     1801, 1806, 1805, 1793,   69,   69,   69,   69,   69,   69,
+     1792,   69, 1802, 1794,   69, 1807, 1795, 1797, 1796, 1803,
+
+       69, 1798,   69, 1808, 1799, 1800, 1809, 1801,   69, 1805,
+     1810,   69,   69, 1812, 1816, 1811, 1813, 1817, 1879, 1802,
+     1814, 1879,   69, 1815, 1819,   69, 1803,   69,   69,   69,
+     1808,   69,   69, 1809, 1879, 1879, 1818, 1810,   69, 1821,
+     1826, 1823, 1811, 1813,   69,   69, 1820, 1814,   69,   69,
+     1815, 1819,   69, 1822,   69,   69, 1824, 1825, 1834, 1827,
+     1830,   69,   69, 1818, 1828,   69, 1821, 1826, 1823, 1829,
+       69, 1831,   69, 1820, 1835, 1832, 1839, 1833, 1879, 1836,
+     1822,   69,   69, 1824, 1825,   69, 1827, 1830, 1842,   69,
+     1879, 1828, 1837,   69, 1841,   69, 1829,   69, 1831,   69,
+
+       69,   69, 1832, 1838, 1833, 1840, 1836,   69,   69, 1843,
+       69,   69, 1844,   69, 1845, 1842, 1846,   69, 1847, 1837,
+       69, 1841, 1849, 1848, 1879, 1850, 1852, 1853,   69, 1854,
+     1838,   69, 1840, 1851, 1879,   69, 1843, 1855, 1856, 1844,
+       69, 1845,   69, 1846, 1858, 1847,   69, 1864,   69, 1849,
+     1848,   69, 1850, 1852, 1853,   69,   69,   69,   69, 1857,
+     1851, 1859, 1860, 1861, 1855, 1856,   69,   69, 1862,   69,
+     1863, 1858, 1865,   69, 1864, 1866,   69, 1867,   69, 1868,
+       69, 1869, 1870,   69,   69,   69, 1857, 1871, 1859, 1860,
+     1861, 1872, 1875, 1873, 1874, 1862, 1877, 1863, 1878, 1865,
+
+       69,   69, 1866,   69, 1867, 1876,   69, 1879, 1869,   69,
+     1879,   69, 1879,   69,   69,   69,   69, 1879, 1872, 1875,
+     1873, 1874, 1879,   69, 1879,   69, 1879, 1879, 1879, 1879,
+     1879, 1879, 1876,   41,   41,   41,   41,   41,   41,   41,
+       46,   46,   46,   46,   46,   46,   46,   51,   51,   51,
+       51,   51,   51,   51,   57,   57,   57,   57,   57,   57,
+       57,   62,   62,   62,   62,   62,   62,   62,   72,   72,
+     1879,   72,   72,   72,   72,  127,  127, 1879, 1879, 1879,
+      127,  127,  129,  129, 1879, 1879,  129, 1879,  129,  131,
+     1879, 1879, 1879, 1879, 1879,  131,  134,  134, 1879, 1879,
+
+     1879,  134,  134,  136, 1879, 1879, 1879, 1879, 1879,  136,
+      138,  138, 1879,  138,  138,  138,  138,   73,   73, 1879,
+       73,   73,   73,   73,   13, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879
     } ;
 
-static yyconst flex_int16_t yy_chk[5395] =
+static yyconst flex_int16_t yy_chk[5491] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -1661,15 +1683,15 @@ static yyconst flex_int16_t yy_chk[5395] =
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    3,    3,    3,    4,    4,
         4,    5,    5,    6,    6,    5,   24,    6,    7,    7,
-        7,    7, 1852,    7,    8,    8,    8,    8,   24,    8,
+        7,    7, 1885,    7,    8,    8,    8,    8,   24,    8,
         9,    9,    9,   10,   10,   10,   15,   45,   45,   50,
 
        15,    3,   50,   24,    4,   61,   61,    5,   19,    6,
-       19,   19,   70,   19,  686,    7,   70,   40,   19,   40,
-       40,    8,   40,   23,   20,   20,    9,   40,  680,   10,
+       19,   19,   70,   19,  689,    7,   70,   40,   19,   40,
+       40,    8,   40,   23,   20,   20,    9,   40,  683,   10,
        11,   11,   11,   11,   11,   11,   12,   12,   12,   12,
        12,   12,   20,   23,   27,   19,   23,   29,   20,   11,
-       23,   20,   20,  136,   21,   12,   27,   25,  680,   29,
+       23,   20,   20,  136,   21,   12,   27,   25,  683,   29,
       134,   21,   34,   94,   28,   25,  133,   11,   21,   20,
        23,   27,  131,   12,   29,   34,   11,  128,  128,  129,
        21,   21,   12,   25,   25,   76,   28,   26,   21,   34,
@@ -1780,473 +1802,482 @@ static yyconst flex_int16_t yy_chk[5395] =
       331,  329,  330,    0,  333,  320,  326,  325,  330,    0,
       320,  322,  322,  327,  324,  323,  325,  327,  326,  334,
       335,  328,  328,  329,  336,  334,  331,  331,  329,  330,
-      333,  333,  342,  337,  338,  343,  340,  341,  344,  335,
-      337,  347,  336,  340,  341,  342,  334,  335,  345,  338,
-      346,  336,  349,  348,  353,  351,  344,  349,    0,  342,
-      337,  338,  348,  340,  341,  344,  343,  350,    0,  346,
-
-      345,  352,  347,  350,  354,  345,  353,  346,  351,  349,
-      348,  353,  351,  352,  355,  354,  357,  358,  359,  364,
-        0,  364,  355,  357,  350,  358,  361,  360,  352,  359,
-        0,  354,  362,    0,  363,  370,  360,    0,  365,  362,
-      370,  355,  356,  357,  358,  359,  364,  356,  369,  356,
-      361,  371,    0,  361,  366,  367,  369,  356,  360,  362,
-      363,  363,  370,  360,  365,  365,  366,  356,  356,  356,
-      367,  368,  372,  371,  356,  369,  356,  373,  371,  374,
-      375,  366,  367,  368,  356,  373,  376,  377,  378,  380,
-      372,  374,  381,  383,  356,  379,  382,  378,  368,  372,
-
-      386,  385,  377,  375,  373,  384,  374,  375,  380,  379,
-      388,  382,  386,  387,  377,  378,  380,  376,  389,  381,
-      384,  389,  379,  382,  383,  385,  390,  386,  385,  389,
-      390,  392,  384,  391,  388,  387,  393,  388,  394,  395,
-      387,  396,  397,  398,  400,  389,    0,  391,  389,  398,
-      399,  401,  402,  405,  403,    0,    0,  390,  392,    0,
-      391,  406,    0,  393,    0,    0,  395,  400,  396,  394,
-      398,  400,  399,  397,  407,  402,  403,  399,  404,  402,
-      409,  403,  401,  406,  405,  404,  408,  407,  406,  409,
-      410,  408,  412,  411,  414,  408,  413,  415,    0,  418,
-
-        0,  407,  411,  416,    0,  404,  417,  409,    0,  413,
-      408,  423,  420,  408,  412,  415,  410,  410,  408,  412,
-      411,  418,  408,  413,  415,  414,  418,  416,  417,  417,
-      416,  419,  421,  417,  420,  422,  424,  425,  430,  420,
-      428,  426,  423,  421,  427,  419,    0,  429,  431,  428,
-      422,  433,  432,  437,    0,  417,    0,  424,  419,  421,
-      429,  425,  422,  424,  425,  426,  427,  428,  426,  430,
-      431,  427,  435,  433,  429,  431,  432,  434,  433,  432,
-      436,  434,  438,  442,  437,  440,  435,  439,  441,  440,
-      453,  442,  443,  446,  436,  444,  445,    0,    0,  435,
-
-      438,  446,  439,  448,  444,  445,  449,  436,  434,  438,
-      442,  439,    0,  441,  439,  441,  440,  443,  447,  443,
-      446,  453,  444,  445,  449,  447,  448,  450,  451,  439,
-      448,  452,  454,  449,  455,    0,  456,  451,  460,  450,
-      454,  457,  455,  452,  458,  447,    0,  459,  461,  460,
-      463,  464,  462,    0,  450,  451,  461,    0,  452,  454,
-      458,  455,  456,  456,  457,  460,  462,  465,  457,  459,
-      463,  458,  468,  464,  459,  461,  466,  463,  464,  462,
-      467,  468,  470,  471,  469,    0,  472,  465,  473,  475,
-      479,  474,    0,  476,  465,  475,  471,    0,  466,  468,
-
-      470,  476,  467,  466,  469,  477,  481,  467,  472,  470,
-      471,  469,  473,  472,  474,  473,  475,  480,  474,  476,
-      476,  479,  482,  477,  480,  483,  484,  485,  476,  481,
-      499,  486,  477,  481,  483,  490,  487,  482,  487,    0,
-      486,    0,  496,  493,  480,  497,  485,  490,  523,  482,
-      498,    0,  483,  493,  485,    0,  505,  484,  486,    0,
-      496,  499,  490,  487,  488,  501,  497,  502,  488,  496,
-      493,  488,  497,  498,  507,  504,  502,  498,  488,  523,
-      503,  488,  503,  505,  506,    0,  488,  501,    0,    0,
-      509,  488,  501,    0,  502,  488,  513,  510,  488,  504,
-
-      507,  507,  504,  512,  506,  488,  508,  503,  488,  500,
-      500,  506,  500,    0,  511,  500,  509,  509,  508,  510,
-      500,  513,  515,  513,  510,  512,  500,  500,    0,  515,
-      512,  517,  514,  508,  518,  500,  500,  500,  511,  500,
-      514,  511,  500,  516,  519,  521,  520,  500,  522,  515,
-      517,  516,  524,  500,  500,  520,  519,  525,  517,  514,
-      518,  518,    0,  527,  526,  529,  530,  521,  528,  531,
-      516,  519,  521,  520,  529,  522,  533,  535,  532,  534,
-      540,  525,  527,  524,  525,  526,  532,  528,  530,  531,
-      527,  526,  529,  530,  536,  528,  531,  538,  534,  539,
-
-      541,    0,  536,  533,  540,  532,  534,  540,  535,  542,
-      543,  547,  546,  541,    0,  538,  549,  539,  546,  548,
-      544,  536,  543,  549,  538,  548,  539,  541,  544,  550,
-      553,  552,  555,  547,  550,  542,  542,  543,  547,  546,
-      555,  551,  554,  549,  544,  556,  548,  544,  551,  552,
-      558,  554,  557,  553,  559,  544,  550,  553,  552,  555,
-      560,  561,  562,  556,  563,  557,    0,  560,  551,  554,
-      565,  558,  556,  564,  561,  566,  567,  558,  565,  557,
-      568,  559,  569,  570,  574,  572,  568,  560,  561,  571,
-      566,  573,  575,  562,  572,  563,  564,  565,  567,  575,
-
-      564,  576,  566,  567,  577,  573,  579,  568,  569,  569,
-      578,  582,  572,  571,  570,  574,  571,  580,  573,  575,
-      581,    0,  578,  581,  582,  580,  585,  583,  576,  579,
-        0,  577,  592,  579,  583,  586,    0,  578,  582,  587,
-      588,    0,  588,  591,  580,  592,    0,  581,  589,    0,
-      602,  587,  585,  585,  583,  584,  593,  584,  586,  592,
-      590,  584,  586,  584,  595,  591,  587,  588,  584,  593,
-      591,  589,  590,  584,  594,  589,  595,  597,    0,  584,
-      598,  602,  584,  593,  584,  601,  596,  590,  584,  600,
-      584,  595,  599,  598,  604,  584,  596,  594,  599,  597,
-
-      584,  594,  600,  605,  597,  606,  601,  598,  596,  604,
-      603,  607,  601,  596,  608,  603,  600,  603,  606,  599,
-      610,  604,  613,  596,  609,  605,  607,  614,  616,    0,
-      605,  617,  606,  620,  619,  603,  603,  603,  607,  610,
-      608,  608,  603,  611,  603,  612,  609,  610,  619,  613,
-      614,  609,  618,  612,  614,  617,  611,  622,  617,  616,
-      618,  619,  603,  621,  620,  622,  624,  626,  623,  625,
-      611,  631,  612,  628,  630,  626,  627,  624,  629,  618,
-      628,  633,  636,  641,  622,  621,  623,  625,  634,  633,
-      621,  629,  630,  624,  626,  623,  625,  634,  627,  635,
-
-      628,  630,  631,  627,  636,  629,  637,  638,  633,  636,
-      640,  635,  639,  642,  641,  634,  644,    0,  645,  646,
-      644,  645,  647,    0,  648,  650,  635,  642,  637,  638,
-      639,  648,  650,  637,  638,  647,  640,  640,  649,  639,
-      642,  653,  651,  646,  645,  645,  646,  644,  645,  647,
-      649,  648,  650,  652,  654,  658,  655,  657,  660,  652,
-      656,  659,  661,  653,  662,  649,  651,  660,  653,  651,
-        0,  656,    0,  662,  666,  667,  654,  655,  657,  659,
-      652,  654,  658,  655,  657,  660,  661,  656,  659,  661,
-      663,  662,  664,  665,  669,  671,  666,  667,  663,  664,
-
-      670,  666,  667,  669,  675,  673,  674,  665,  672,    0,
-        0,  671,  676,    0,  679,  678,  675,  663,  677,  664,
-      665,  669,  671,  672,  670,  681,  677,  670,  678,  679,
-      682,  675,  683,  690,  681,  672,  673,  674,  687,  676,
-      683,  679,  678,  688,  684,  677,  684,  689,  682,  691,
-      692,  687,  681,    0,  689,  688,  693,  682,    0,  683,
-      694,  698,  695,  696,  690,  687,  699,  697,  701,  698,
-      688,  684,  692,  694,  689,  695,  701,  692,  693,  697,
-      691,  702,  705,  693,  700,  696,  699,  694,  698,  695,
-      696,  703,  704,  699,  697,  701,  700,  707,  706,  708,
-
-      709,  704,  710,  705,  703,  706,  711,  712,  702,  705,
-      713,  700,    0,  714,  715,  710,  712,  716,  703,  704,
-      709,  708,  715,  707,  707,  706,  708,  709,  713,  710,
-      711,  718,  719,  711,  712,  714,  720,  713,  717,  716,
-      714,  715,  722,  721,  716,  723,  717,  725,  720,  724,
-      719,  732,  726,  725,  718,  721,  727,  724,  718,  719,
-      723,  726,  722,  720,  729,  717,  728,  730,  733,  722,
-      721,  729,  723,  734,  725,  736,  724,  727,  728,  726,
-      735,  733,  732,  727,  737,  730,  738,  735,  739,  742,
-      738,  729,  734,  728,  730,  733,  739,  736,  741,  737,
-
-      734,  740,  736,  742,  743,  744,  745,  735,  746,    0,
-      753,  737,  747,  751,  740,  739,  742,  738,  748,  749,
-      750,  754,  743,    0,  741,  741,  751,  755,  740,  752,
-      746,  743,  745,  745,  747,  746,  744,  749,  752,  747,
-      751,  753,  750,  756,  748,  748,  749,  750,  758,  755,
-      762,    0,  754,    0,  755,    0,  752,  759,  761,  763,
-      765,  764,  762,  770,  765,    0,  756,  771,  763,  771,
-      756,  757,  770,  759,  758,  758,  757,  762,  757,  764,
-      757,  761,  757,  766,  759,  761,  763,  767,  764,  757,
-      770,  765,  768,  769,  771,  767,  766,  772,  757,  774,
-
-      773,  776,  779,  757,  781,  757,  769,  757,  777,  757,
-      766,  768,  773,  778,  767,  780,  782,  783,    0,  768,
-      769,  778,  780,  785,  772,  776,  774,  773,  776,  779,
-      777,  781,  784,  786,  787,  777,  788,  789,  782,  784,
-      778,  793,  780,  782,  783,  785,  789,  790,  794,  791,
-      785,  795,  786,  796,  799,  800,  787,  803,  798,  784,
-      786,  787,  788,  788,  789,  797,  798,  802,  790,  791,
-      799,  802,  793,  795,  790,    0,  791,  808,  795,  794,
-      801,  799,  800,  797,  796,  798,  805,  801,  803,  804,
-      806,  807,  797,  805,  802,  804,  810,  812,  810,  809,
-
-      807,  811,  804,  808,  808,  806,  809,  801,  813,  815,
-      811,  814,  817,  805,  819,  814,  804,  806,  807,  812,
-      817,  818,  804,  810,  812,  818,  809,  820,  811,  822,
-      821,  815,  819,  823,  825,  813,  815,    0,  814,  817,
-      824,  819,  822,  826,  827,  827,  820,  829,    0,  828,
-      825,  826,  818,  830,  820,  821,  822,  821,  828,  831,
-      832,  825,  830,  824,  823,  834,  831,  824,  833,  829,
-      826,  827,  835,  834,  829,  839,  828,  833,  836,  837,
-      830,  838,  843,  832,  840,  835,  831,  832,  841,  838,
-      836,  837,  834,  845,  842,  833,  848,  839,  850,  835,
-
-      843,  844,  839,  842,  840,  836,  837,  847,  838,  843,
-      841,  840,  846,  844,  845,  841,  849,  851,  846,  853,
-      845,  842,  854,  855,  850,  850,  856,  848,  844,  847,
-        0,  859,  855,  858,  847,  859,  860,  866,  857,  846,
-      860,  858,    0,  851,  851,  854,  853,  849,  856,  854,
-      855,  857,  865,  856,    0,  861,  862,  863,  863,  873,
-      858,  864,  859,  861,  862,  857,  867,  860,  866,  864,
-      868,  873,  869,  865,  867,  872,  871,  870,  868,  865,
-      869,  872,  861,  862,  863,  870,  873,  874,  864,  871,
-      876,  875,    0,  867,  877,  879,  878,  868,  881,  869,
-
-      884,  885,  872,  871,  870,  876,  880,  884,  887,  879,
-      886,  889,  881,  874,  874,  875,  877,  876,  875,  878,
-        0,  877,  879,  878,  880,  881,  882,  884,  885,  888,
-      882,  887,  886,  880,    0,  887,  888,  886,  891,  893,
-      895,  894,  889,  882,    0,  897,  899,  891,    0,  902,
-      901,  882,  903,  882,    0,    0,  888,  882,  904,  906,
-      904,  893,  908,    0,  903,  891,  893,  894,  894,  905,
-      882,  895,  897,  899,  901,  902,  902,  901,  907,  903,
-      909,  906,  905,  910,  912,  904,  906,  909,  911,  908,
-      907,  913,  917,  911,  914,  915,  905,  919,  920,  918,
-
-      912,  917,  914,    0,    0,  907,  921,  909,  926,  910,
-      910,  912,  918,  921,  913,  911,  925,  915,  913,  917,
-      920,  914,  915,  919,  919,  920,  918,  922,  923,  924,
-      926,  927,  928,  921,  922,  926,  924,  929,  931,  928,
-      932,  925,  933,  925,  936,  934,  923,  936,  937,  938,
-      933,  931,  941,  939,  922,  923,  924,  942,  940,  928,
-      939,  940,  927,  943,  938,  931,  934,  932,  929,  933,
-      944,  936,  934,  940,  937,  937,  938,  946,  947,  942,
-      939,  943,  940,  941,  942,  940,  948,  945,  940,  945,
-      943,  950,  944,  949,  952,  953,  951,  944,  956,  950,
-
-      940,  946,  949,  951,  946,  955,  954,  957,  958,  947,
-      954,    0,  948,  948,  945,  959,  952,  958,  950,    0,
-      949,  952,  959,  951,  960,  956,  953,  955,  961,  957,
-      962,  960,  955,  954,  957,  958,  963,  964,  968,  965,
-      966,  961,  959,  967,  968,  962,  965,  966,  970,  971,
-      963,  960,  972,  973,  977,  961,  967,  962,  975,  974,
-      979,  977,  974,  963,  972,  968,  965,  966,  964,  975,
-      967,  971,  980,  973,  983,  970,  971,  974,  981,  972,
-      973,  977,  982,  984,  986,  975,  974,  979,  987,  974,
-      988,  984,  983,  982,  985,  992,  980,  985,  991,  980,
-
-      981,  983,  986,  993,  990,  981,  989,  991,  992,  982,
-      984,  986,  985,  989,  993,  997,  998,  988,  990,  987,
-      994,  985,  992,  996,  985,  991,  995,  998,  995, 1000,
-      993,  990,  996,  989,  999,  994,    0, 1003, 1005, 1007,
-     1001,  997,  997,  998, 1008, 1002, 1003,  994, 1002, 1006,
-      996, 1000,  999,  995, 1001, 1009, 1000, 1010, 1006, 1011,
-     1015,  999, 1009, 1002, 1003, 1008, 1001, 1001, 1012, 1005,
-     1007, 1008, 1002, 1011, 1012, 1002, 1006, 1016, 1019, 1015,
-     1017, 1001, 1009, 1020, 1025, 1018, 1011, 1015, 1010, 1017,
-     1021, 1016, 1012, 1018, 1020, 1012, 1023, 1024, 1028, 1021,
-
-     1026, 1012, 1031, 1023, 1016,    0, 1025, 1017, 1027, 1019,
-     1020, 1025, 1018, 1032, 1029,    0, 1028, 1021, 1029, 1030,
-     1024, 1037, 1026, 1023, 1024, 1028, 1032, 1026, 1033, 1031,
-     1027, 1030, 1034, 1039, 1035, 1027, 1036, 1040, 1038, 1041,
-     1032, 1029, 1039, 1042, 1036, 1043, 1030, 1034, 1033, 1035,
-     1046, 1045, 1037, 1038, 1047, 1033, 1048, 1049, 1040, 1034,
-     1039, 1035, 1050, 1036, 1040, 1038, 1041, 1042, 1046, 1053,
-     1042, 1048, 1043, 1045, 1052, 1051, 1056, 1046, 1045, 1049,
-     1050, 1047, 1054, 1048, 1049, 1055, 1052, 1057, 1056, 1050,
-     1051, 1053, 1055, 1058, 1062, 1054, 1053, 1067, 1059, 1060,
-
-     1054, 1052, 1051, 1056, 1059, 1064, 1061, 1060, 1063, 1054,
-     1065, 1066, 1055, 1061, 1057, 1063, 1068, 1070, 1071, 1072,
-     1074, 1062, 1054, 1076, 1058, 1059, 1060, 1071, 1067, 1073,
-     1080, 1073, 1064, 1061, 1066, 1063, 1075, 1065, 1066,    0,
-     1068, 1085, 1078, 1068,    0, 1071, 1083, 1074, 1070, 1078,
-     1072, 1077, 1077, 1077, 1076, 1087, 1073, 1079, 1077, 1083,
-     1081, 1080, 1075, 1075, 1079, 1084, 1077, 1081, 1085, 1078,
-     1088, 1084, 1089, 1083, 1086, 1086, 1091, 1088, 1077, 1077,
-     1077, 1087, 1087, 1092, 1079, 1077, 1094, 1081, 1093, 1095,
-     1096, 1096, 1084, 1097, 1091, 1098, 1098, 1088, 1089, 1089,
-
-     1093, 1086, 1101, 1091, 1102, 1104, 1094, 1095,    0, 1105,
-     1092, 1103, 1099, 1094, 1106, 1093, 1095, 1096, 1103, 1097,
-     1097, 1107, 1098, 1099, 1101, 1104, 1109, 1108, 1111, 1101,
-     1110, 1112, 1104, 1114,    0, 1102, 1111, 1110, 1103, 1099,
-     1105, 1113, 1114, 1116, 1109, 1106, 1112, 1117, 1107, 1108,
-     1115, 1115, 1122, 1109, 1108, 1111, 1118, 1110, 1112, 1117,
-     1114, 1119, 1121, 1120, 1118, 1113, 1123, 1124, 1113, 1116,
-     1116, 1123, 1125, 1119, 1117, 1127, 1128, 1115, 1125, 1122,
-     1121, 1129, 1123, 1118, 1120, 1129, 1130, 1126, 1119, 1121,
-     1120, 1131, 1131, 1123, 1124, 1132, 1133, 1135, 1123, 1125,
-
-     1126, 1134, 1138, 1128, 1136, 1137, 1127, 1137, 1139, 1140,
-     1132, 1141, 1129, 1139, 1126, 1143, 1134, 1130, 1131, 1136,
-     1135, 1144, 1132, 1145, 1135, 1146, 1141, 1133, 1134, 1147,
-     1148, 1136, 1137, 1138, 1150, 1139, 1147, 1149, 1141, 1143,
-     1140, 1153, 1143, 1155, 1151, 1156, 1159, 1144, 1144,    0,
-     1145, 1148, 1146, 1164, 1158, 1150, 1147, 1148, 1160, 1149,
-     1156, 1150, 1151, 1153, 1149, 1160, 1161, 1155, 1153, 1158,
-     1155, 1151, 1156, 1159, 1162, 1165, 1164, 1166, 1163, 1167,
-     1164, 1158, 1170, 1162, 1161, 1160, 1163, 1169, 1174, 1171,
-     1178, 1170, 1167, 1161, 1172, 1183, 1179, 1165, 1169, 1177,
-
-        0, 1162, 1165, 1178, 1181, 1163, 1167, 1171, 1166, 1170,
-     1180, 1177, 1172, 1169, 1169, 1174, 1171, 1178, 1182, 1185,
-     1180, 1172, 1183, 1187, 1188, 1169, 1177, 1179, 1186, 1190,
-     1181, 1181, 1189, 1191,    0, 1186,    0, 1180, 1189, 1185,
-     1193, 1193, 1188, 1182, 1190, 1182, 1185, 1192, 1191, 1187,
-     1187, 1188, 1194, 1198, 1195, 1186, 1190, 1199, 1196, 1189,
-     1191, 1195, 1192, 1200, 1194, 1196, 1201, 1193, 1205, 1202,
-     1204, 1213, 1200,    0, 1192, 1198, 1206, 1206, 1207, 1194,
-     1198, 1195, 1199, 1204, 1199, 1196, 1201, 1202, 1208, 1209,
-     1200, 1216, 1210, 1201, 1212, 1205, 1202, 1204, 1211, 1224,
-
-     1207, 1212, 1213, 1206, 1214, 1207, 1215, 1211,    0, 1218,
-     1216, 1209, 1220, 1208, 1210, 1208, 1209, 1218, 1216, 1210,
-     1215, 1212, 1219,    0, 1221, 1211, 1214, 1223, 1222, 1227,
-     1224, 1214,    0, 1215, 1223, 1219, 1218, 1225, 1226, 1220,
-     1222, 1229, 1228, 1230, 1227, 1228, 1243, 1231,    0, 1219,
-     1221, 1221,    0, 1233, 1223, 1222, 1227, 1234, 1243, 1225,
-     1228, 1230, 1231, 1226, 1225, 1226, 1229, 1236, 1229, 1228,
-     1230, 1237, 1228, 1243, 1231, 1233, 1238,    0, 1237, 1234,
-     1233, 1236, 1245, 1240, 1234, 1242, 1244, 1238, 1244, 1246,
-     1247, 1248, 1250, 1249, 1236, 1253,    0, 1252, 1237, 1251,
-
-     1245, 1249, 1258, 1238, 1240, 1260, 1242, 1259, 1247, 1245,
-     1240, 1252, 1242, 1244, 1254, 1250, 1246, 1247, 1248, 1250,
-     1249, 1251, 1253, 1255, 1252, 1259, 1251, 1261, 1262, 1258,
-     1255, 1263, 1260, 1254, 1259, 1264, 1266, 1265, 1269,    0,
-     1263, 1254, 1268, 1262, 1268, 1270, 1274, 1275, 1272, 1270,
-     1255,    0, 1273, 1261, 1261, 1262, 1271, 1274, 1263, 1265,
-     1269, 1273, 1276, 1266, 1265, 1269, 1264,    0, 1271, 1268,
-     1272, 1278, 1270, 1274, 1275, 1272, 1277, 1279, 1279, 1273,
-     1282, 1286, 1280, 1271, 1282, 1276, 1285, 1284, 1277, 1276,
-     1280, 1283, 1285, 1278, 1283, 1284, 1286, 1289, 1278, 1287,
-
-     1295, 1290, 1291, 1277, 1279, 1287, 1292, 1282, 1286, 1280,
-     1294, 1296, 1299, 1285, 1284, 1300, 1291, 1293, 1283, 1292,
-     1297, 1298, 1301, 1303, 1289, 1290, 1287, 1295, 1290, 1291,
-     1304, 1293, 1297, 1292, 1305, 1298, 1294, 1294, 1296, 1299,
-     1308, 1309, 1300, 1302, 1293, 1306, 1310, 1297, 1298, 1301,
-     1303, 1302, 1311, 1306, 1310, 1312, 1313, 1304,    0, 1315,
-     1314, 1305, 1308, 1316, 1312, 1320, 1318, 1308, 1309, 1322,
-     1302, 1323, 1306, 1310, 1315, 1323, 1322, 1313, 1318, 1311,
-     1317, 1319, 1312, 1313, 1314, 1315, 1315, 1314, 1317, 1319,
-     1316, 1324, 1320, 1318, 1325, 1326, 1322, 1327, 1323, 1328,
-
-     1332, 1315, 1330, 1324, 1334, 1327, 1334, 1317, 1319, 1329,
-     1329, 1333, 1331, 1336, 1339, 1332,    0, 1325, 1324, 1336,
-     1335, 1325, 1326, 1337, 1327, 1338, 1328, 1332, 1330, 1330,
-     1331, 1334, 1339, 1333, 1335, 1340, 1329, 1338, 1333, 1331,
-     1336, 1339, 1341, 1342, 1343, 1337, 1347, 1335, 1349, 1345,
-     1337, 1348, 1338, 1340, 1352, 1341, 1345, 1350, 1357,    0,
-     1355,    0, 1340, 1359, 1347, 1350, 1352, 1343, 1353, 1341,
-     1359, 1343, 1358, 1347, 1342, 1355, 1345, 1348, 1348, 1349,
-     1361, 1352, 1357, 1350, 1350, 1357, 1353, 1355, 1360, 1363,
-     1359, 1364, 1350, 1365, 1358, 1353, 1366, 1367, 1368, 1358,
-
-     1369,    0, 1373, 1360, 1364, 1371, 1368, 1361, 1374, 1372,
-     1367, 1366, 1380,    0, 1375, 1360, 1363,    0, 1364, 1365,
-     1365, 1375, 1377, 1366, 1367, 1368, 1369, 1369, 1371, 1373,
-     1374, 1376, 1371, 1372, 1379, 1374, 1372, 1383, 1381, 1378,
-     1384, 1375, 1385, 1380, 1376, 1377, 1378, 1387, 1383, 1377,
-     1386,    0, 1391, 1395, 1399, 1390, 1379, 1400, 1376, 1381,
-     1402, 1379, 1384, 1404, 1383, 1381, 1378, 1384, 1390, 1386,
-     1405, 1408, 1387, 1385, 1387, 1406, 1399, 1386, 1391, 1391,
-     1395, 1399, 1390, 1407, 1400, 1411, 1406, 1402, 1407, 1412,
-     1414, 1410, 1415, 1408, 1404, 1416, 1405, 1405, 1408, 1410,
-
-     1411, 1417, 1406, 1419, 1416, 1421, 1422, 1423, 1414,    0,
-     1407, 1425, 1411, 1417, 1424, 1426, 1412, 1414, 1410, 1427,
-     1423, 1435, 1416, 1415, 1428, 1430, 1429, 1421, 1417, 1431,
-     1419, 1422, 1421, 1422, 1423, 1429, 1424, 1433, 1425, 1428,
-     1430, 1424, 1426, 1432, 1431, 1436, 1427, 1434, 1435, 1437,
-     1437, 1428, 1430, 1429, 1434, 1438, 1431, 1439, 1432, 1433,
-     1441, 1446, 1438, 1436, 1433, 1440, 1442, 1444, 1440, 1445,
-     1432, 1439, 1436, 1441, 1434, 1442, 1437, 1447, 1443,    0,
-     1448,    0, 1438, 1443, 1439, 1458, 1452, 1441, 1446, 1444,
-     1451, 1445, 1440, 1442, 1444, 1452, 1445, 1451, 1453, 1460,
-
-     1455, 1454, 1456, 1453, 1447, 1443, 1448, 1448, 1454, 1456,
-     1457, 1458, 1458, 1452, 1461, 1462, 1467, 1451, 1455, 1457,
-     1468, 1463, 1464, 1466, 1467, 1453, 1460, 1455, 1454, 1456,
-     1465, 1464, 1461, 1463, 1466, 1462, 1469, 1457, 1473, 1465,
-        0, 1461, 1462, 1467, 1470, 1474, 1471, 1468, 1463, 1464,
-     1466, 1472, 1474, 1470, 1476, 1480, 1479, 1465, 1471, 1472,
-     1473, 1481, 1476, 1479, 1482, 1473, 1483, 1469, 1484, 1485,
-     1489, 1470, 1474, 1471, 1487, 1483, 1482, 1488, 1472, 1480,
-     1490, 1476, 1480, 1479, 1492, 1494, 1487, 1495, 1481, 1499,
-     1493, 1482, 1485, 1483, 1490, 1484, 1485, 1489, 1493, 1502,
-
-     1488, 1487, 1501, 1500, 1488, 1503, 1505, 1490, 1500,    0,
-     1504, 1492, 1494, 1508, 1495, 1499, 1499, 1493, 1504, 1507,
-     1501, 1502, 1509, 1511, 1510, 1505, 1502, 1503, 1512, 1501,
-     1500, 1507, 1503, 1505, 1513, 1508, 1510, 1504,    0, 1514,
-     1508, 1515, 1516, 1519, 1509, 1520, 1507,    0, 1521, 1509,
-     1511, 1510, 1522,    0, 1523, 1512, 1529, 1519,    0, 1525,
-     1526, 1514, 1527,    0,    0, 1513, 1514,    0, 1515, 1516,
-     1519, 1521, 1523, 1524, 1522, 1521, 1520, 1527, 1525, 1522,
-     1529, 1523, 1526, 1529, 1530, 1524, 1525, 1526, 1531, 1527,
-     1532, 1533, 1535, 1530, 1534, 1537, 1540, 1538, 1539, 1541,
-
-     1524, 1543, 1531, 1537, 1538,    0, 1539, 1541, 1532, 1533,
-     1535, 1530, 1542, 1544, 1545, 1531, 1547, 1532, 1533, 1535,
-     1534, 1534, 1537, 1540, 1538, 1539, 1541, 1550, 1543, 1551,
-     1542, 1548, 1544, 1554, 1547, 1552, 1545, 1556, 1562, 1542,
-     1544, 1545, 1551, 1547, 1559, 1548, 1560, 1552, 1563,    0,
-     1550, 1559, 1561, 1564, 1550, 1566, 1551, 1565, 1548, 1554,
-     1554, 1567, 1552, 1568, 1556, 1562, 1565, 1572, 1566, 1573,
-     1569, 1559, 1560, 1560, 1576, 1563, 1561, 1577, 1577, 1561,
-     1564, 1578, 1566, 1582, 1565, 1586, 1579, 1577, 1572, 1581,
-     1568, 1580, 1567, 1569, 1572, 1579, 1576, 1569, 1580, 1583,
-
-     1573, 1576, 1581, 1578, 1577, 1577, 1584, 1583, 1578, 1585,
-     1582, 1586, 1586, 1579, 1587, 1589, 1581, 1585, 1580, 1588,
-     1590, 1591, 1591, 1596, 1600, 1584, 1583, 1590, 1593, 1597,
-     1588, 1592, 1594, 1584, 1599, 1593, 1585, 1589, 1604, 1594,
-     1587, 1587, 1589, 1599, 1601, 1602, 1588, 1590, 1591, 1592,
-     1596, 1600, 1603, 1597, 1605, 1593, 1597, 1606, 1592, 1594,
-     1608, 1599, 1609, 1602, 1603, 1604, 1614, 1601, 1605, 1615,
-     1618, 1601, 1602, 1616, 1610, 1606, 1610, 1609, 1608, 1603,
-     1619, 1605, 1621, 1620, 1606, 1627, 1625, 1608, 1614, 1609,
-     1620, 1616, 1618, 1614, 1623, 1615, 1615, 1618, 1619, 1622,
-
-     1616, 1610, 1624, 1630, 1626, 1622, 1626, 1619, 1631, 1632,
-     1620, 1624, 1627, 1621, 1629, 1630, 1623, 1625, 1637, 1633,
-     1635, 1623, 1629, 1634, 1636, 1639, 1622, 1642, 1635, 1624,
-     1630, 1626, 1632, 1643, 1634, 1631, 1632, 1633, 1638, 1638,
-     1637, 1629, 1645, 1636, 1649, 1637, 1633, 1635, 1640, 1647,
-     1634, 1636, 1639, 1647, 1642, 1643, 1640, 1646, 1651, 1650,
-     1643, 1652, 1653, 1651, 1646, 1638, 1654, 1655, 1657, 1645,
-     1649, 1649, 1650, 1656, 1654, 1640, 1647, 1658, 1660, 1661,
-     1656, 1663, 1655, 1659, 1646, 1651, 1650, 1665, 1652, 1653,
-     1659, 1662, 1658, 1654, 1655, 1657, 1667, 1664, 1664, 1662,
-
-     1656, 1661, 1660, 1668, 1658, 1660, 1661, 1664, 1671, 1670,
-     1659, 1668, 1663, 1673, 1665, 1672, 1674, 1675, 1662, 1676,
-     1678, 1671, 1680, 1667, 1664, 1664, 1682, 1685, 1686, 1690,
-     1668, 1670, 1683, 1684,    0, 1671, 1670, 1672, 1689, 1691,
-     1673, 1676, 1672, 1674, 1675, 1683, 1676, 1678, 1680, 1680,
-     1686, 1684, 1693, 1682, 1685, 1686, 1690, 1689, 1694, 1683,
-     1684, 1691, 1695, 1696, 1697, 1689, 1691, 1698, 1698, 1704,
-     1699, 1700, 1696, 1694, 1693, 1697, 1699, 1698, 1705, 1693,
-     1703, 1695, 1710, 1706,    0, 1694, 1714, 1703, 1712, 1695,
-     1696, 1697, 1717, 1700, 1698, 1698, 1704, 1699, 1700, 1715,
-
-     1721, 1722, 1718, 1723,    0, 1705, 1706, 1703, 1720, 1710,
-     1706, 1712, 1715, 1714, 1718, 1712, 1724, 1720, 1724, 1717,
-     1725, 1730, 1727, 1728, 1733, 1723, 1715, 1721, 1722, 1718,
-     1723, 1726, 1725, 1729, 1735, 1720, 1737, 1726, 1739,    0,
-     1740, 1729, 1745, 1724, 1727, 1728, 1743, 1725, 1730, 1727,
-     1728, 1733, 1744, 1739, 1746, 1745,    0, 1754, 1726, 1748,
-     1729, 1735,    0, 1737, 1747, 1739, 1740, 1740, 1748, 1745,
-     1743, 1749, 1747, 1743, 1756, 1757, 1746, 1763, 1755, 1758,
-     1754, 1746, 1749, 1744, 1754, 1755, 1748, 1758, 1759, 1757,
-     1756, 1747, 1760, 1761, 1764, 1761, 1762, 1759, 1749, 1765,
-
-     1766, 1756, 1757, 1760, 1763, 1755, 1758, 1767, 1762, 1768,
-     1770, 1768, 1764, 1769, 1776, 1759, 1773, 1771, 1777, 1760,
-     1761, 1764, 1766, 1762, 1775, 1769, 1765, 1766, 1773, 1767,
-     1771, 1780, 1775, 1778, 1767, 1781, 1768, 1786, 1779, 1780,
-     1769, 1770, 1782, 1773, 1771, 1776, 1778, 1783, 1781, 1777,
-     1782, 1775, 1779, 1784, 1787, 1785, 1794, 1789, 1780, 1786,
-     1778, 1783, 1781, 1785, 1786, 1779, 1790, 1784, 1791, 1782,
-     1788, 1793, 1792, 1795, 1783, 1799, 1787,    0, 1788, 1793,
-     1784, 1787, 1785, 1789, 1789, 1796, 1803, 1794, 1790, 1801,
-     1791,    0,    0, 1790, 1792, 1791, 1797, 1788, 1793, 1792,
-
-     1795, 1798, 1800, 1801, 1797, 1796, 1799, 1804, 1803, 1798,
-     1800, 1805, 1796, 1803, 1807, 1804, 1801, 1806, 1809, 1805,
-     1808,    0, 1810, 1797, 1811,    0, 1809, 1814, 1798, 1800,
-     1812, 1806, 1815, 1813, 1804, 1814, 1816,    0, 1805,    0,
-     1807, 1807, 1808, 1819, 1806, 1809, 1817, 1808, 1810, 1810,
-     1811, 1811, 1812, 1813, 1814, 1822, 1816, 1812, 1823, 1815,
-     1813, 1818, 1830, 1816, 1820, 1819, 1817, 1824, 1825, 1818,
-     1819, 1826, 1820, 1817, 1829, 1824, 1825, 1822, 1827, 1828,
-     1823, 1832, 1822, 1831, 1833, 1823, 1827, 1828, 1818, 1830,
-        0, 1820, 1834, 1836, 1824, 1825, 1839, 1826, 1826, 1840,
-
-     1829, 1829, 1842, 1831, 1843, 1827, 1828, 1840, 1832, 1841,
-     1831, 1833, 1834,    0,    0, 1836,    0, 1841, 1839, 1834,
-     1836,    0,    0, 1839,    0,    0, 1840,    0,    0, 1842,
-        0, 1843,    0,    0,    0,    0, 1841, 1847, 1847, 1847,
-     1847, 1847, 1847, 1847, 1848, 1848, 1848, 1848, 1848, 1848,
-     1848, 1849, 1849, 1849, 1849, 1849, 1849, 1849, 1850, 1850,
-     1850, 1850, 1850, 1850, 1850, 1851, 1851, 1851, 1851, 1851,
-     1851, 1851, 1853, 1853,    0, 1853, 1853, 1853, 1853, 1854,
-     1854,    0,    0,    0, 1854, 1854, 1855, 1855,    0,    0,
-     1855,    0, 1855, 1856,    0,    0,    0,    0,    0, 1856,
-
-     1857, 1857,    0,    0,    0, 1857, 1857, 1858,    0,    0,
-        0,    0,    0, 1858, 1859, 1859,    0, 1859, 1859, 1859,
-     1859, 1860, 1860,    0, 1860, 1860, 1860, 1860, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846, 1846,
-     1846, 1846, 1846, 1846
-
+      333,  333,  342,  337,  338,  340,  341,  340,  343,  335,
+      337,    0,  336,  341,  340,  342,  334,  335,  344,  338,
+      345,  336,  346,  347,    0,  351,  348,    0,  353,  342,
+      337,  338,  340,  341,  340,  348,  344,    0,  349,  343,
+
+      350,  346,  345,  349,  352,  344,  350,  345,  351,  346,
+      353,  354,  351,  348,  347,  353,  352,  357,  355,    0,
+      358,  359,  354,  363,  357,  349,  355,  350,  358,  362,
+      361,  352,  359,  360,    0,  364,  362,  364,  354,  365,
+      366,    0,  360,  367,  357,  355,  356,  358,  359,  363,
+      363,  356,  366,  356,  361,  371,  362,  361,  367,    0,
+      369,  356,  364,  368,  360,  365,  365,  366,  369,  360,
+      367,  356,  356,  356,  370,  368,  372,  371,  356,  370,
+      356,  373,  371,  374,  375,  376,  379,  369,  356,  373,
+      368,  377,  381,  378,  372,  374,  380,  382,  356,  383,
+
+      379,  370,  378,  372,  385,  386,  377,  375,  373,  388,
+      374,  375,  382,  379,  384,  380,  376,  386,  377,  381,
+      378,  387,  390,  380,  382,  391,  390,  392,  385,  384,
+      383,  385,  386,  388,  389,  393,  388,  389,  394,  391,
+      395,  384,  397,  387,  396,  389,    0,  400,  387,  398,
+      399,  401,  391,  390,  392,  398,  402,  405,  403,  404,
+        0,  389,  393,    0,  389,  406,  404,  395,  407,  394,
+      400,  396,  399,  397,  400,  410,  398,  399,  414,  402,
+      403,  407,  401,  402,  408,  403,  404,  406,  405,  408,
+      409,  411,  406,  408,  413,  407,  415,  412,  416,  409,
+
+      411,  410,  410,    0,  417,  423,  418,  413,  408,  414,
+      420,  408,    0,  430,  415,  419,  408,  409,  411,  412,
+      408,  413,  416,  415,  412,  416,  417,  417,  418,  419,
+      421,  417,  420,  418,  422,  424,  423,  420,  427,  425,
+      426,  421,  419,  428,  430,  429,  431,  432,  438,  422,
+      433,  435,  428,  417,  434,  435,  424,  421,  429,    0,
+      427,  422,  424,  425,  426,  427,  425,  426,  431,  436,
+      428,  437,  429,  431,  433,  439,  434,  433,  432,  438,
+      440,  434,  435,  436,  441,  437,  442,  444,  441,  443,
+      445,  446,    0,  439,    0,  440,  436,  443,  437,  445,
+
+      446,  447,  439,  448,  440,  450,  449,  440,  451,  447,
+      448,  442,  444,  442,  444,  441,  443,  445,  446,  453,
+      451,  457,  440,  450,  454,  452,  458,  459,  447,  449,
+      448,  453,  450,  449,  452,  451,  455,  456,  460,  461,
+      465,  464,  463,  459,  455,  456,  453,  457,  457,  458,
+      461,  462,  452,  458,  459,  454,  463,  466,  467,  462,
+      460,  464,  465,  455,  456,  460,  461,  465,  464,  463,
+      468,  470,  469,  472,  473,  471,  480,  466,  462,  474,
+      467,  469,  475,  476,  466,  467,  472,  477,  485,  476,
+      478,  470,  468,  471,    0,  477,  473,  468,  470,  469,
+
+      472,  473,  471,  474,  481,  475,  474,  480,  478,  475,
+      476,  481,  482,  477,  477,  483,  484,  478,  486,  485,
+      487,  488,  477,  488,  491,  484,    0,  500,  494,  487,
+      483,  481,  497,  498,  499,  482,  491,  486,  494,  482,
+      502,  505,  483,  484,    0,  486,    0,  487,  488,  489,
+      497,  491,  506,  489,  498,  494,  489,  499,  500,  497,
+      498,  499,  502,  489,  503,  505,  489,  502,  505,  507,
+        0,  489,  504,  503,  504,  508,  489,  510,    0,  506,
+      489,  514,    0,  489,    0,    0,  509,  511,  513,  507,
+      489,  503,  512,  489,  501,  501,  507,  501,  509,  504,
+
+      501,  508,  508,  510,  510,  501,  514,  519,  514,  511,
+      513,  501,  501,  509,  511,  513,  512,  515,  517,  512,
+      501,  501,  501,  516,  501,  515,  517,  501,  518,  520,
+      516,  521,  501,  519,  519,  522,  523,  524,  501,  501,
+      521,  520,  525,  526,  515,  517,    0,  518,  527,    0,
+      516,  530,  528,  529,  531,  518,  520,  522,  521,  534,
+      530,    0,  522,  523,  532,  535,  533,  526,  524,  527,
+      526,  528,  529,  525,  533,  527,  531,  536,  530,  528,
+      529,  531,  537,  535,  532,  540,  534,  538,  541,  543,
+        0,  532,  535,  533,  542,  538,  536,  544,  545,  548,
+
+      549,  550,  543,  540,  536,  548,  541,  550,    0,  546,
+      545,    0,  540,  537,  538,  541,  543,  546,  542,  555,
+      560,  542,  549,  544,  544,  545,  548,  549,  550,  552,
+      551,  553,  554,  546,  552,  557,  546,  551,  553,  556,
+      559,  560,  555,  557,  546,  558,  555,  560,  556,  561,
+      554,  563,  564,  559,  562,  565,  552,  551,  553,  554,
+      567,  562,  557,  558,  563,  566,  556,  559,  567,  568,
+      573,  569,  558,  570,  572,  571,  561,  575,  563,  570,
+      574,  562,  576,  564,  568,  578,  565,  567,  566,  574,
+      579,  575,  566,  569,  573,  581,  568,  573,  569,  577,
+
+      570,  571,  571,  580,  575,  572,  577,  574,  582,  588,
+      584,  583,  578,  576,  583,  580,  582,  579,  581,  587,
+      585,  604,  581,  584,    0,    0,  577,  585,  589,  618,
+      580,  590,  588,  590,    0,  582,  588,  584,  583,    0,
+      589,  591,  615,  593,  594,  587,  587,  585,  586,  595,
+      586,  592,  604,  661,  586,  589,  586,  594,  590,  596,
+      618,  586,  595,  592,  591,  593,  586,  597,  591,  615,
+      593,  594,  586,  599,  598,  586,  595,  586,  592,  597,
+      661,  586,  596,  586,  598,  600,  596,  603,  586,  602,
+      606,  601,  762,  586,  597,  599,  598,  601,  600,  605,
+
+      599,  598,  602,    0,  605,  606,  605,  607,  603,  608,
+      611,  598,  600,  609,  603,  610,  602,  606,  601,  612,
+      762,  616,  608,  619,  605,  605,  605,  614,  609,  607,
+      613,  605,  611,  605,  607,  614,  608,  611,  612,  622,
+      609,  610,  610,  613,  616,  620,  612,  619,  616,  621,
+      619,  605,  623,  620,  614,  625,  624,  613,  626,  627,
+      628,  633,  629,  621,  624,    0,    0,  631,  628,  626,
+      622,  630,  620,  625,  623,  632,  621,  627,  630,  623,
+      631,  636,  625,  624,  629,  626,  627,  628,  635,  629,
+      636,  637,  633,  632,  631,  638,  635,  639,  630,  640,
+
+      643,  642,  632,  637,    0,  641,  644,  647,  636,  648,
+      649,  647,  648,    0,  646,  635,  650,  638,  637,  639,
+      644,  640,  638,  641,  639,  646,  640,  642,  642,  650,
+      652,  643,  641,  644,  649,  648,  648,  649,  647,  648,
+      651,  646,  652,  650,  653,  654,  655,  651,  656,    0,
+      659,  653,  655,  658,  657,  663,    0,  652,  660,  664,
+      662,  659,    0,    0,  663,    0,    0,  651,    0,  654,
+      656,  653,  654,  655,  658,  656,  657,  659,  662,  660,
+      658,  657,  663,  664,  665,  660,  664,  662,  666,  668,
+      667,  669,  670,  665,  674,  672,  666,  667,  676,  673,
+
+      677,  679,    0,  668,  672,  675,    0,  693,    0,    0,
+      674,  665,  678,  669,  670,  666,  668,  667,  669,  670,
+      675,  674,  672,  673,  678,  680,  673,  681,  679,  676,
+      682,  677,  675,  680,  684,  685,  686,  690,  693,  678,
+      681,  694,  692,  684,  686,  682,  687,  691,  687,  692,
+      690,    0,  680,  685,  681,  695,  696,  682,  697,  691,
+        0,  684,  685,  686,  690,  699,  698,  701,  700,  692,
+      702,  697,  694,  687,  691,  701,  703,  695,  696,  698,
+      700,  704,  695,  696,  705,  697,  706,  699,  703,  704,
+      702,  707,  699,  698,  701,  700,  708,  702,  709,  706,
+
+      707,  710,  711,  703,  716,  709,  712,  713,  704,    0,
+      715,  705,  714,  706,    0,    0,  717,  708,  707,  715,
+      713,  721,  716,  708,  711,  709,  712,  710,  710,  711,
+      719,  716,  718,  712,  713,  722,  714,  715,  717,  714,
+      718,  720,  723,  717,  721,  725,  724,  727,  721,  720,
+      728,  726,  719,  722,  723,  727,  728,  719,  724,  718,
+      730,  729,  722,  731,  732,  725,  726,  733,  720,  723,
+      729,  732,  725,  724,  727,  731,  735,  728,  726,  736,
+        0,  730,  737,  739,  740,  733,  738,  730,  729,  742,
+      731,  732,  736,  738,  733,  743,  741,  742,  744,  740,
+
+      741,  737,  746,  745,  747,  739,  736,  735,  743,  737,
+      739,  740,  748,  738,  749,  750,  742,  745,  751,    0,
+      746,  753,  743,  755,  744,  744,  756,  741,  752,  746,
+      745,  757,  755,  759,  754,  747,  749,  750,  748,  748,
+      761,  749,  750,  753,  751,  751,  752,  754,  753,  758,
+      755,  765,  763,  766,  767,  752,  759,  756,    0,    0,
+      759,  754,  757,  767,  771,  766,  761,  761,  763,  768,
+      770,  758,  771,  772,  765,    0,  758,  760,  765,  763,
+      766,  767,  760,  770,  760,  769,  760,  768,  760,  769,
+      773,  771,  772,  774,  776,  760,  768,  770,  777,  775,
+
+      772,  775,  774,  773,  760,  778,  780,  781,  783,  760,
+      777,  760,  784,  760,  782,  760,  769,  773,  785,  784,
+      774,  776,  782,  787,  786,  777,  775,  789,  790,  781,
+      780,  788,  778,  780,  781,  783,  792,  791,  788,  784,
+      794,  782,  797,  793,  799,  785,  786,  790,  795,  789,
+      787,  786,  793,  798,  789,  790,  800,    0,  788,  791,
+      807,  794,  792,  792,  791,  801,  799,  794,  795,  802,
+      793,  799,  803,  797,  804,  795,  806,  802,  805,  809,
+      806,  811,  810,  801,  798,  805,  809,  800,  803,  808,
+      811,  807,  801,  812,  817,  808,  802,  810,    0,  803,
+
+      813,  804,  808,  806,  815,  805,  809,  813,  811,  810,
+      814,  816,  814,  815,  818,  821,  808,  819,  818,  812,
+      812,  817,  808,  821,  822,  823,  824,  813,  822,  825,
+      829,  815,  827,  816,  826,  828,    0,  814,  816,  819,
+      830,  818,  821,  823,  819,  824,  829,  826,  830,  831,
+      831,  832,  823,  824,  825,  822,  825,  829,  828,  833,
+      832,  826,  828,  827,  834,  835,  836,  830,  837,  839,
+        0,  838,  835,  834,  844,  840,  831,  837,  832,  838,
+      842,  833,  839,  843,  845,  841,  833,  840,  842,  836,
+      846,  834,  835,  836,  844,  837,  839,  841,  838,  846,
+
+      847,  844,  840,  848,  849,  843,  845,  842,  850,  852,
+      843,  845,  841,  853,  850,  848,  851,  846,  847,  854,
+        0,  855,  857,  859,    0,  849,  861,  847,  858,    0,
+      848,  849,  859,  862,  860,  850,    0,  870,  851,  861,
+      852,  862,    0,  851,  853,  854,  854,  855,  855,  857,
+      859,  858,  869,  861,  863,  858,  860,  865,  863,  864,
+      862,  860,  866,  864,  868,  865,  867,  867,  870,  871,
+      866,    0,  868,  869,  872,  873,  877,  871,  874,  869,
+      878,  875,  872,  873,  865,  863,  874,  879,  877,  866,
+      864,  868,  876,  867,  875,  880,  871,  881,  876,  882,
+
+      883,  872,  873,  877,  884,  874,  878,  878,  875,  890,
+      880,  879,  885,  891,  879,  886,  887,  894,  884,  876,
+      887,  882,  880,  883,  881,  889,  882,  883,  892,  886,
+      885,  884,  889,  887,  898,  891,  890,  893,  900,  885,
+      891,  887,  886,  887,  893,  896,  902,  887,  894,  899,
+      904,  892,  889,  907,  896,  892,  898,  906,  908,  912,
+      887,  898,  913,  909,  893,  909,  911,    0,  915,  900,
+      908,  912,  896,  902,  910,  899,  899,  904,  916,  907,
+      907,  906,    0,  916,  906,  908,  912,  910,  911,  913,
+      909,  914,  917,  911,  915,  915,  919,  918,  914,  920,
+
+      922,  910,  923,  925,  919,  916,  924,  926,  917,  922,
+      927,  930,  932,  928,  926,  923,  934,  927,  914,  917,
+      918,  920,  931,  919,  918,  925,  920,  922,  929,  923,
+      925,  928,  924,  924,  926,  929,  930,  927,  930,  933,
+      928,  936,  937,  932,  931,  938,  933,  934,  941,  931,
+      939,  941,  942,  938,  936,  929,  944,  946,  943,  947,
+        0,    0,  948,  944,  952,  949,  933,  945,  936,  937,
+      945,  939,  938,  943,  950,  941,  950,  939,  942,  942,
+      948,  947,  945,  944,  951,  943,  947,  949,  946,  948,
+      953,  945,  949,  954,  945,  952,  955,  945,  956,  957,
+
+      958,  950,  954,  959,  955,  956,  960,  959,  951,  945,
+      961,  951,  962,  963,  966,  969,  953,  953,    0,    0,
+      954,  957,  963,  955,  968,  956,  957,  966,  960,  964,
+      959,  958,  967,  960,  962,  965,  964,  961,  968,  962,
+      963,  966,  965,  970,  972,  971,  969,  967,  973,  975,
+      970,  968,  971,  977,  973,  976,  964,  972,  978,  967,
+      984,  979,  965,  980,  979,  977,    0,  986,  985,    0,
+      970,  972,  971,  987,  980,  973,  975,  976,  978,  979,
+      977,  982,  976,  988,  987,  978,  982,  984,  979,  986,
+      980,  979,  985,  982,  986,  985,  989,  991,  993,  990,
+
+      987,  988,  990,  992,  989,  994,  995,    0,  982,  996,
+      988,  998,  994,  982,  997,  991,  999,  990,  996, 1001,
+      995, 1001,  998,  989,  991,  993,  990,  997, 1002,  990,
+     1003,  999,  994,  995,  992, 1005,  996, 1002,  998, 1004,
+     1009,  997, 1006,  999, 1007, 1008, 1001, 1011, 1008, 1009,
+     1004, 1013, 1012, 1005,    0, 1002, 1003, 1003, 1007, 1014,
+     1016, 1012, 1005, 1008, 1006, 1021, 1004, 1009, 1023, 1006,
+     1007, 1007, 1008, 1017, 1015, 1008, 1022, 1023, 1011, 1012,
+     1014, 1015, 1013, 1018, 1021, 1007, 1014, 1017, 1024, 1018,
+     1022, 1016, 1021, 1025, 1026, 1023, 1024,    0, 1031, 1027,
+
+     1017, 1015, 1029, 1022, 1030, 1026, 1032, 1018, 1027, 1029,
+     1018, 1036, 1033, 1035, 1034, 1024, 1018, 1035, 1037,    0,
+     1031, 1026, 1038, 1036, 1025, 1031, 1027, 1030, 1032, 1029,
+     1039, 1030, 1034, 1032, 1033, 1038, 1040, 1041, 1036, 1033,
+     1035, 1034,    0, 1043, 1044, 1037, 1042,    0, 1046, 1038,
+     1039, 1040, 1041, 1045, 1042, 1047, 1049, 1039, 1052, 1044,
+     1048,    0, 1045, 1040, 1041, 1053, 1051,    0, 1055, 1046,
+        0, 1044,    0, 1042, 1043, 1046, 1052, 1058, 1056, 1054,
+     1045, 1059, 1047, 1049, 1048, 1052, 1057, 1048, 1051, 1058,
+     1055, 1061, 1053, 1051, 1054, 1055, 1056, 1060, 1061, 1062,
+
+     1063, 1057, 1064, 1059, 1058, 1056, 1054, 1068, 1059, 1066,
+     1060, 1062, 1067, 1057, 1065, 1060, 1069, 1066, 1061, 1067,
+     1065, 1070, 1071, 1069, 1060, 1073, 1062, 1063, 1072, 1076,
+     1074, 1077, 1078, 1064, 1068, 1080, 1066, 1060, 1081, 1067,
+     1077, 1065, 1079, 1069, 1079, 1082,    0, 1086, 1070, 1071,
+        0, 1072, 1084,    0, 1074, 1072, 1073, 1074, 1077, 1084,
+     1076, 1089, 1080, 1078, 1081, 1081, 1083, 1083, 1083, 1079,
+     1085, 1091, 1098, 1083, 1089, 1087, 1082, 1085, 1086, 1084,
+     1090, 1083, 1087, 1092, 1092, 1093, 1090, 1095, 1089, 1094,
+     1098, 1096, 1095, 1083, 1083, 1083, 1094, 1085, 1091, 1098,
+
+     1083, 1099, 1087, 1100, 1101, 1102, 1109, 1090, 1103, 1103,
+     1092, 1093, 1093, 1104, 1095, 1100, 1094, 1096, 1096, 1105,
+     1105, 1108, 1106, 1102, 1101, 1111, 1112, 1110, 1099, 1113,
+     1100, 1101, 1102, 1106, 1110, 1103, 1114, 1109, 1116, 1104,
+     1104,    0, 1115, 1108, 1117, 1111, 1105, 1118, 1108, 1106,
+     1121, 1117, 1111, 1119, 1110, 1118, 1116, 1112, 1120, 1121,
+     1113, 1122, 1122, 1114, 1115, 1116, 1123, 1124, 1119, 1115,
+     1125, 1117, 1126, 1128, 1118, 1127, 1129, 1121, 1125, 1124,
+     1119, 1131, 1120, 1132, 1126, 1120, 1135, 1134, 1122, 1132,
+     1130, 1128, 1123, 1123, 1124, 1130, 1127, 1125, 1133, 1126,
+
+     1128, 1136, 1127, 1129, 1137, 1136, 1130, 1140, 1131, 1139,
+     1132, 1133, 1141, 1135, 1138, 1138, 1143, 1130, 1134, 1142,
+     1145, 1144, 1130, 1144, 1139, 1133, 1147, 1141, 1146, 1148,
+        0, 1143, 1136, 1146, 1150, 1137, 1139, 1151, 1140, 1141,
+     1152, 1138, 1142, 1143, 1148, 1153, 1142, 1154, 1144, 1155,
+     1157, 1145, 1166, 1156, 1154, 1146, 1148, 1147, 1150, 1160,
+     1158, 1150,    0, 1151, 1151, 1162, 1167, 1152, 1163, 1165,
+     1155, 1157, 1153, 1167, 1154, 1156, 1155, 1157, 1158, 1166,
+     1156, 1160, 1168, 1163, 1165, 1169, 1160, 1158, 1171, 1162,
+     1170, 1172, 1162, 1167, 1169, 1163, 1165, 1173, 1170, 1176,
+
+     1168,    0, 1178, 1174, 1179, 1177, 1181, 1184, 1185, 1168,
+     1176, 1171, 1169, 1172, 1177, 1171, 1174, 1170, 1172, 1184,
+     1178, 1185, 1179, 1186, 1188, 1176, 1176,    0, 1173, 1178,
+     1174, 1179, 1177, 1181, 1184, 1185, 1187, 1176, 1190, 1189,
+     1192, 1193,    0, 1194, 1195,    0, 1187, 1196, 1193,    0,
+     1188, 1188, 1202, 1196, 1186, 1200, 1200, 1197, 1198, 1202,
+     1192, 1199, 1195, 1187, 1189, 1190, 1189, 1192, 1193, 1194,
+     1194, 1195, 1197, 1198, 1196, 1201, 1199, 1205, 1206, 1202,
+     1207,    0, 1200, 1203, 1197, 1198, 1208, 1201, 1199, 1207,
+     1203, 1209, 1213, 1212, 1210, 1214, 1214, 1228, 1221, 1205,
+
+     1216, 1215, 1201, 1206, 1205, 1206, 1212, 1207, 1208, 1217,
+     1203, 1209, 1210, 1208,    0, 1218, 1222, 1219, 1209, 1213,
+     1212, 1210, 1214, 1215, 1228, 1216, 1219, 1216, 1215, 1221,
+     1224, 1217, 1220, 1223, 1232, 1229, 1217, 1218, 1222, 1220,
+     1226, 1227, 1218, 1222, 1219, 1231, 1230, 1223, 1226, 1224,
+        0, 1234, 1231, 1233, 1227, 1235, 1238, 1224, 1230, 1220,
+     1223, 1229, 1229, 1236, 1237, 1232, 1236, 1226, 1227, 1239,
+     1235, 1244, 1231, 1230, 1238, 1233, 1234, 1241, 1234, 1242,
+     1233, 1236, 1235, 1238, 1239, 1244, 1246, 1245, 1248, 1237,
+     1236, 1237, 1253, 1236, 1245, 1250, 1239, 1246, 1244, 1241,
+
+     1251, 1242, 1254, 1252, 1241, 1252, 1242, 1255, 1256, 1248,
+     1253, 1259, 1251, 1246, 1245, 1248, 1250, 1258, 1257, 1253,
+     1261, 1266, 1250, 1260, 1261, 1255, 1257, 1251, 1262, 1254,
+     1252, 1267, 1263, 1259, 1255, 1256, 1268, 1260, 1259, 1263,
+     1258, 1269, 1270, 1271, 1258, 1257, 1272, 1262, 1266, 1267,
+     1260, 1261, 1271, 1273, 1274, 1262, 1277, 1270, 1267, 1263,
+     1276, 1278, 1276, 1268, 1279, 1278,    0, 1269, 1269, 1270,
+     1271, 1280, 1283, 1281, 1282, 1273, 1279, 1272, 1277, 1284,
+     1273, 1274, 1281, 1277, 1285, 1282, 1286, 1276, 1278, 1287,
+     1287, 1279, 1294, 1280, 1291, 1288, 1285, 1291, 1280, 1283,
+
+     1281, 1282, 1284, 1288, 1292, 1290, 1284, 1294, 1286, 1290,
+     1297, 1285, 1292, 1286, 1293, 1298, 1287, 1295, 1303, 1294,
+     1293, 1291, 1288, 1295, 1299,    0, 1302, 1300, 1304, 1301,
+     1307, 1292, 1290, 1306, 1305, 1308, 1309, 1297, 1299, 1298,
+     1300, 1293, 1298, 1301, 1295, 1303, 1305, 1306, 1311, 1313,
+     1310, 1299, 1302, 1302, 1300, 1304, 1301, 1307, 1310, 1312,
+     1306, 1305, 1308, 1309, 1314, 1315, 1317, 1318, 1312, 1320,
+     1319, 1321,    0, 1315, 1322, 1311, 1313, 1310, 1319, 1323,
+     1321, 1325, 1326,    0, 1324,    0, 1312, 1329, 1317,    0,
+     1326, 1314, 1315, 1317, 1318, 1322, 1320, 1319, 1321, 1324,
+
+     1327, 1322, 1334, 1323, 1335, 1328, 1323, 1333, 1325, 1326,
+     1324, 1324, 1327, 1328, 1329, 1331, 1332, 1337,    0, 1333,
+     1332, 1339, 1331, 1338, 1338, 1334, 1324, 1327, 1336, 1334,
+     1341, 1335, 1328, 1340, 1333, 1344, 1336, 1342, 1343, 1346,
+     1343, 1347, 1331, 1332, 1337, 1341, 1345, 1339, 1339, 1344,
+     1338, 1340, 1345, 1347, 1348, 1336, 1349, 1341, 1350, 1342,
+     1340, 1346, 1344, 1351, 1342, 1343, 1346, 1358, 1347, 1352,
+     1354, 1350, 1348, 1345, 1349, 1356, 1365, 1354, 1357,    0,
+     1359, 1348, 1360, 1349,    0, 1350, 1367, 1362, 1359, 1360,
+     1363, 1365, 1352, 1356, 1351,    0, 1352, 1354, 1358, 1362,
+
+     1368, 1370, 1356, 1365, 1357, 1357, 1359, 1359, 1363, 1360,
+     1367, 1369, 1371, 1367, 1362, 1359, 1370, 1363, 1369, 1373,
+     1374, 1376, 1368, 1375, 1377, 1383, 1378, 1368, 1370, 1379,
+     1390, 1381,    0, 1374, 1378, 1382, 1376, 1377, 1369, 1371,
+        0, 1384, 1387,    0, 1389,    0, 1373, 1374, 1376, 1375,
+     1375, 1377, 1383, 1378, 1381, 1379, 1379, 1385, 1381, 1382,
+     1386, 1390, 1382, 1384, 1385, 1387, 1389, 1388, 1384, 1387,
+     1391, 1389, 1393, 1386, 1388, 1395, 1394, 1396,    0,    0,
+     1397, 1405, 1400, 1393, 1385, 1401, 1411, 1386, 1410, 1413,
+     1415, 1391, 1407,    0, 1388, 1400, 1396, 1391, 1394, 1393,
+
+     1416, 1407, 1419, 1394, 1396, 1397, 1395, 1397, 1405, 1400,
+     1410, 1401, 1401, 1411, 1417, 1410, 1413, 1418, 1422, 1407,
+     1421, 1415, 1418, 1423, 1419, 1417, 1416, 1416, 1421, 1419,
+     1425, 1426, 1430, 1422, 1427,    0, 1432, 1428,    0, 1434,
+     1433, 1417, 1436, 1427, 1418, 1422, 1435, 1421, 1425, 1428,
+     1423, 1437, 1434, 1438,    0, 1439, 1441, 1425, 1432, 1430,
+     1442, 1427, 1426, 1432, 1428, 1433, 1434, 1433, 1435, 1436,
+     1439, 1441, 1440, 1435, 1443, 1442, 1444, 1445, 1437, 1446,
+     1438, 1440, 1439, 1441, 1445, 1448, 1448, 1442, 1449, 1443,
+     1447, 1450, 1456, 1451, 1452, 1449, 1451, 1453, 1444, 1440,
+
+     1454, 1443, 1458, 1444, 1445, 1450, 1446, 1452, 1447, 1454,
+     1457, 1455, 1448, 1459, 1456, 1449, 1455, 1447, 1450, 1456,
+     1451, 1452, 1460, 1453, 1453, 1464, 1463, 1454, 1467, 1458,
+     1465, 1472, 1457, 1463, 1464, 1465, 1466, 1457, 1455, 1470,
+     1459, 1469, 1473, 1466, 1468, 1476, 1467, 1474, 1460, 1460,
+     1469, 1468, 1464, 1463, 1476, 1467, 1480, 1465, 1472, 1481,
+     1473, 1475,    0, 1466, 1478, 1470, 1470, 1474, 1469, 1473,
+     1477, 1468, 1476, 1475, 1474, 1478, 1479, 1482, 1485, 1477,
+     1483, 1484,    0, 1480, 1479, 1493, 1482, 1486, 1475, 1484,
+     1481, 1478, 1483, 1488, 1486, 1492, 1494, 1477, 1489, 1497,
+
+     1485, 1495, 1492, 1479, 1482, 1485, 1489, 1483, 1484, 1493,
+     1496, 1488, 1493, 1495, 1486, 1498, 1501, 1500, 1502, 1496,
+     1488, 1503, 1492, 1494, 1505, 1489, 1497, 1507, 1495, 1500,
+     1508, 1513, 1506,    0, 1512, 1503, 1513, 1496, 1498, 1501,
+     1506, 1515, 1498, 1501, 1500, 1502, 1514, 1516, 1503, 1524,
+     1521, 1505, 1518, 1520, 1507, 1523, 1522, 1508, 1513, 1506,
+     1512, 1512, 1517, 1515, 1514, 1520, 1525, 1523, 1515, 1516,
+     1517, 1518, 1521, 1514, 1516, 1526, 1524, 1521, 1522, 1518,
+     1520, 1527, 1523, 1522, 1528, 1534, 1529, 1530,    0, 1517,
+     1533,    0, 1535, 1525,    0, 1526, 1536, 1538,    0, 1544,
+
+     1540, 1539, 1526, 1537, 1533, 1543, 1528,    0, 1544, 1538,
+     1541, 1528, 1527, 1529, 1530, 1535, 1534, 1533, 1536, 1535,
+     1539, 1537, 1540, 1536, 1538, 1541, 1544, 1540, 1539, 1543,
+     1537, 1545, 1543, 1546, 1547,    0, 1548, 1541, 1549, 1551,
+     1554, 1552, 1553, 1558,    0, 1545, 1555, 1551, 1552, 1557,
+     1553, 1546, 1547, 1556, 1555, 1559, 1549, 1560, 1545, 1562,
+     1546, 1547, 1548, 1548, 1563, 1549, 1551, 1554, 1552, 1553,
+     1558, 1556, 1557, 1555, 1559, 1565, 1557, 1562, 1563, 1560,
+     1556, 1566, 1559, 1567, 1560, 1569, 1562, 1571, 1577, 1574,
+        0, 1563, 1575, 1576, 1566, 1567, 1574, 1578, 1565, 1579,
+
+     1580, 1582, 1565, 1583,    0, 1589, 1584,    0, 1566, 1580,
+     1567, 1569, 1569, 1598, 1571, 1577, 1574, 1576, 1575, 1575,
+     1576, 1581, 1588, 1592, 1578,    0, 1579, 1580, 1597, 1584,
+     1583, 1587, 1582, 1584, 1581, 1587, 1589, 1593, 1593, 1594,
+     1598, 1597, 1595, 1588, 1599, 1592, 1596, 1593, 1581, 1588,
+     1592, 1595, 1599, 1596, 1602, 1597, 1600,    0, 1603, 1601,
+     1605, 1594, 1587, 1604, 1593, 1593, 1594, 1601,    0, 1595,
+     1606, 1599, 1612, 1596, 1604, 1600, 1608, 1606, 1607, 1607,
+     1602, 1602, 1605, 1600, 1603, 1603, 1601, 1605, 1609, 1610,
+     1604, 1614, 1616, 1613, 1608, 1609, 1610, 1606, 1617, 1612,
+
+     1618, 1616, 1620, 1608, 1619, 1607, 1621, 1622, 1623, 1626,
+     1625,    0, 1640, 1614, 1620, 1609, 1610, 1613, 1614, 1616,
+     1613, 1622, 1619, 1618, 1626, 1617, 1623, 1618, 1625, 1620,
+     1627, 1619, 1627, 1621, 1622, 1623, 1626, 1625, 1631,    0,
+     1632, 1633, 1635, 1640, 1636, 1638, 1639, 1636, 1641, 1643,
+     1644,    0, 1646, 1639, 1641, 1642,    0, 1627, 1643, 1633,
+     1631, 1650, 1651, 1638, 1635, 1631, 1632, 1632, 1633, 1635,
+     1636, 1636, 1638, 1639, 1636, 1641, 1643, 1642, 1645, 1646,
+     1645, 1644, 1642, 1648, 1649, 1651, 1652, 1653, 1650, 1651,
+     1655, 1648, 1654, 1656, 1657, 1657, 1649, 1658, 1653, 1659,
+
+     1654, 1661, 1662, 1663, 1652, 1645, 1665, 1659, 1667, 1655,
+     1648, 1649, 1667, 1652, 1653, 1656, 1666, 1655, 1669, 1654,
+     1656, 1657, 1672, 1666, 1658, 1663, 1659, 1670, 1661, 1662,
+     1663, 1671, 1673, 1665, 1674, 1667, 1671, 1675, 1677, 1676,
+     1670, 1679, 1674, 1666, 1669, 1669, 1676, 1678, 1680, 1672,
+     1681, 1683, 1675, 1685, 1670, 1682, 1687, 1681, 1671, 1673,
+     1689, 1674, 1684, 1680, 1675, 1677, 1676, 1679, 1679, 1692,
+     1684, 1678,    0, 1683, 1678, 1680, 1694, 1681, 1683, 1682,
+     1686, 1686, 1682, 1687, 1685, 1690, 1693, 1689, 1695, 1684,
+     1686, 1692, 1696, 1690, 1697, 1698, 1692, 1700, 1694, 1693,
+
+     1703, 1705, 1707, 1694, 1708, 1706,    0, 1686, 1686, 1713,
+        0, 1709, 1690, 1693,    0, 1695, 1712, 1698, 1706, 1696,
+     1707, 1697, 1698, 1714, 1700, 1718, 1703, 1703, 1705, 1707,
+     1716, 1708, 1706, 1709, 1717, 1712, 1713, 1716, 1709, 1719,
+     1720, 1717, 1721, 1712, 1722, 1714, 1725, 1718, 1723, 1723,
+     1714, 1721, 1718, 1728, 1719, 1722, 1724, 1716, 1723, 1720,
+     1728, 1717, 1724, 1729, 1730, 1731, 1719, 1720, 1725, 1721,
+     1735, 1722, 1737, 1725, 1739, 1723, 1723, 1742, 1745, 1748,
+     1728, 1740, 1746, 1724, 1743,    0, 1747, 1745, 1731, 1749,
+     1729, 1730, 1731, 1750, 1740, 1737, 1743, 1735, 1752, 1737,
+
+     1746, 1739, 1773,    0, 1742, 1745, 1748, 1754, 1740, 1746,
+     1752, 1743, 1747, 1747, 1755, 1750, 1749, 1751, 1753, 1751,
+     1750, 1757, 1756, 1760, 1753, 1752, 1762, 1764, 1766, 1754,
+     1756, 1767, 1769, 1773, 1754, 1768, 1755, 1772, 1774,    0,
+        0, 1755,    0, 1766, 1751, 1753, 1775, 1768, 1757, 1756,
+     1760, 1774, 1776, 1762, 1764, 1766, 1778, 1767, 1767, 1769,
+     1776, 1772, 1768, 1777, 1772, 1774, 1783, 1778, 1775, 1784,
+     1787, 1785, 1777, 1775, 1788, 1794, 1784, 1789, 1790, 1776,
+     1791, 1796, 1795, 1778, 1785, 1789, 1787, 1790, 1788, 1783,
+     1777, 1791, 1792, 1783, 1792, 1797, 1784, 1787, 1785, 1793,
+
+     1795, 1788, 1794, 1798, 1789, 1790, 1799, 1791, 1796, 1795,
+     1800, 1793, 1800, 1802, 1809, 1801, 1803, 1810,    0, 1792,
+     1805,    0, 1797, 1808, 1812, 1798, 1793, 1801, 1799, 1803,
+     1798, 1808, 1805, 1799,    0,    0, 1811, 1800, 1812, 1814,
+     1819, 1816, 1801, 1803, 1802, 1809, 1813, 1805, 1810, 1811,
+     1808, 1812, 1814, 1815, 1813, 1816, 1817, 1818, 1827, 1820,
+     1823, 1815, 1819, 1811, 1821, 1818, 1814, 1819, 1816, 1822,
+     1817, 1824, 1821, 1813, 1828, 1825, 1832, 1826,    0, 1829,
+     1815, 1820, 1823, 1817, 1818, 1826, 1820, 1823, 1836, 1827,
+        0, 1821, 1830, 1824, 1834, 1822, 1822, 1825, 1824, 1829,
+
+     1830, 1828, 1825, 1831, 1826, 1833, 1829, 1832, 1834, 1837,
+     1836, 1831, 1838, 1833, 1839, 1836, 1840, 1837, 1841, 1830,
+     1838, 1834, 1843, 1842,    0, 1844, 1846, 1847, 1839, 1848,
+     1831, 1842, 1833, 1845,    0, 1847, 1837, 1849, 1850, 1838,
+     1841, 1839, 1840, 1840, 1852, 1841, 1846, 1859, 1843, 1843,
+     1842, 1844, 1844, 1846, 1847, 1845, 1848, 1849, 1850, 1851,
+     1845, 1853, 1855, 1856, 1849, 1850, 1852, 1851, 1857, 1853,
+     1858, 1852, 1860, 1859, 1859, 1861, 1857, 1862, 1858, 1863,
+     1860, 1864, 1865, 1861, 1855, 1856, 1851, 1866, 1853, 1855,
+     1856, 1867, 1873, 1869, 1872, 1857, 1875, 1858, 1876, 1860,
+
+     1873, 1864, 1861, 1862, 1862, 1874, 1863,    0, 1864, 1865,
+        0, 1867,    0, 1874, 1866, 1869, 1872,    0, 1867, 1873,
+     1869, 1872,    0, 1875,    0, 1876,    0,    0,    0,    0,
+        0,    0, 1874, 1880, 1880, 1880, 1880, 1880, 1880, 1880,
+     1881, 1881, 1881, 1881, 1881, 1881, 1881, 1882, 1882, 1882,
+     1882, 1882, 1882, 1882, 1883, 1883, 1883, 1883, 1883, 1883,
+     1883, 1884, 1884, 1884, 1884, 1884, 1884, 1884, 1886, 1886,
+        0, 1886, 1886, 1886, 1886, 1887, 1887,    0,    0,    0,
+     1887, 1887, 1888, 1888,    0,    0, 1888,    0, 1888, 1889,
+        0,    0,    0,    0,    0, 1889, 1890, 1890,    0,    0,
+
+        0, 1890, 1890, 1891,    0,    0,    0,    0,    0, 1891,
+     1892, 1892,    0, 1892, 1892, 1892, 1892, 1893, 1893,    0,
+     1893, 1893, 1893, 1893, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879,
+     1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879, 1879
     } ;
 
 static yy_state_type yy_last_accepting_state;
@@ -2275,6 +2306,10 @@ char *yytext;
  * See LICENSE for the license.
  *
  */
+
+/* because flex keeps having sign-unsigned compare problems that are unfixed*/
+#pragma GCC diagnostic ignored "-Wsign-compare"
+
 #include <ctype.h>
 #include <string.h>
 #include <strings.h>
@@ -2443,7 +2478,7 @@ static void config_end_include(void)
 #endif
 
 #define YY_NO_INPUT 1
-#line 181 "util/configlexer.lex"
+#line 185 "util/configlexer.lex"
 #ifndef YY_NO_UNPUT
 #define YY_NO_UNPUT 1
 #endif
@@ -2451,7 +2486,7 @@ static void config_end_include(void)
 #define YY_NO_INPUT 1
 #endif
 
-#line 2453 "<stdout>"
+#line 2488 "<stdout>"
 
 #define INITIAL 0
 #define quotedstring 1
@@ -2672,9 +2707,9 @@ YY_DECL
 		}
 
 	{
-#line 201 "util/configlexer.lex"
+#line 205 "util/configlexer.lex"
 
-#line 2676 "<stdout>"
+#line 2711 "<stdout>"
 
 	while ( /*CONSTCOND*/1 )		/* loops until end-of-file is reached */
 		{
@@ -2707,13 +2742,13 @@ yy_match:
 			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 				{
 				yy_current_state = (int) yy_def[yy_current_state];
-				if ( yy_current_state >= 1847 )
+				if ( yy_current_state >= 1880 )
 					yy_c = yy_meta[(unsigned int) yy_c];
 				}
 			yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
 			++yy_cp;
 			}
-		while ( yy_base[yy_current_state] != 5329 );
+		while ( yy_base[yy_current_state] != 5425 );
 
 yy_find_action:
 		yy_act = yy_accept[yy_current_state];
@@ -2739,859 +2774,884 @@ do_action:	/* This label is used only to access EOF actions. */
 
 case 1:
 YY_RULE_SETUP
-#line 202 "util/configlexer.lex"
+#line 206 "util/configlexer.lex"
 { 
 	LEXOUT(("SP ")); /* ignore */ }
 	YY_BREAK
 case 2:
 YY_RULE_SETUP
-#line 204 "util/configlexer.lex"
+#line 208 "util/configlexer.lex"
 { 
 	/* note that flex makes the longest match and '.' is any but not nl */
 	LEXOUT(("comment(%s) ", yytext)); /* ignore */ }
 	YY_BREAK
 case 3:
 YY_RULE_SETUP
-#line 207 "util/configlexer.lex"
+#line 211 "util/configlexer.lex"
 { YDVAR(0, VAR_SERVER) }
 	YY_BREAK
 case 4:
 YY_RULE_SETUP
-#line 208 "util/configlexer.lex"
+#line 212 "util/configlexer.lex"
 { YDVAR(1, VAR_QNAME_MINIMISATION) }
 	YY_BREAK
 case 5:
 YY_RULE_SETUP
-#line 209 "util/configlexer.lex"
+#line 213 "util/configlexer.lex"
 { YDVAR(1, VAR_NUM_THREADS) }
 	YY_BREAK
 case 6:
 YY_RULE_SETUP
-#line 210 "util/configlexer.lex"
+#line 214 "util/configlexer.lex"
 { YDVAR(1, VAR_VERBOSITY) }
 	YY_BREAK
 case 7:
 YY_RULE_SETUP
-#line 211 "util/configlexer.lex"
+#line 215 "util/configlexer.lex"
 { YDVAR(1, VAR_PORT) }
 	YY_BREAK
 case 8:
 YY_RULE_SETUP
-#line 212 "util/configlexer.lex"
+#line 216 "util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_RANGE) }
 	YY_BREAK
 case 9:
 YY_RULE_SETUP
-#line 213 "util/configlexer.lex"
+#line 217 "util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_PORT_PERMIT) }
 	YY_BREAK
 case 10:
 YY_RULE_SETUP
-#line 214 "util/configlexer.lex"
+#line 218 "util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_PORT_AVOID) }
 	YY_BREAK
 case 11:
 YY_RULE_SETUP
-#line 215 "util/configlexer.lex"
+#line 219 "util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_NUM_TCP) }
 	YY_BREAK
 case 12:
 YY_RULE_SETUP
-#line 216 "util/configlexer.lex"
+#line 220 "util/configlexer.lex"
 { YDVAR(1, VAR_INCOMING_NUM_TCP) }
 	YY_BREAK
 case 13:
 YY_RULE_SETUP
-#line 217 "util/configlexer.lex"
+#line 221 "util/configlexer.lex"
 { YDVAR(1, VAR_DO_IP4) }
 	YY_BREAK
 case 14:
 YY_RULE_SETUP
-#line 218 "util/configlexer.lex"
+#line 222 "util/configlexer.lex"
 { YDVAR(1, VAR_DO_IP6) }
 	YY_BREAK
 case 15:
 YY_RULE_SETUP
-#line 219 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_UDP) }
+#line 223 "util/configlexer.lex"
+{ YDVAR(1, VAR_PREFER_IP6) }
 	YY_BREAK
 case 16:
 YY_RULE_SETUP
-#line 220 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_TCP) }
+#line 224 "util/configlexer.lex"
+{ YDVAR(1, VAR_DO_UDP) }
 	YY_BREAK
 case 17:
 YY_RULE_SETUP
-#line 221 "util/configlexer.lex"
-{ YDVAR(1, VAR_TCP_UPSTREAM) }
+#line 225 "util/configlexer.lex"
+{ YDVAR(1, VAR_DO_TCP) }
 	YY_BREAK
 case 18:
 YY_RULE_SETUP
-#line 222 "util/configlexer.lex"
-{ YDVAR(1, VAR_TCP_MSS) }
+#line 226 "util/configlexer.lex"
+{ YDVAR(1, VAR_TCP_UPSTREAM) }
 	YY_BREAK
 case 19:
 YY_RULE_SETUP
-#line 223 "util/configlexer.lex"
-{ YDVAR(1, VAR_OUTGOING_TCP_MSS) }
+#line 227 "util/configlexer.lex"
+{ YDVAR(1, VAR_TCP_MSS) }
 	YY_BREAK
 case 20:
 YY_RULE_SETUP
-#line 224 "util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_UPSTREAM) }
+#line 228 "util/configlexer.lex"
+{ YDVAR(1, VAR_OUTGOING_TCP_MSS) }
 	YY_BREAK
 case 21:
 YY_RULE_SETUP
-#line 225 "util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_SERVICE_KEY) }
+#line 229 "util/configlexer.lex"
+{ YDVAR(1, VAR_SSL_UPSTREAM) }
 	YY_BREAK
 case 22:
 YY_RULE_SETUP
-#line 226 "util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_SERVICE_PEM) }
+#line 230 "util/configlexer.lex"
+{ YDVAR(1, VAR_SSL_SERVICE_KEY) }
 	YY_BREAK
 case 23:
 YY_RULE_SETUP
-#line 227 "util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_PORT) }
+#line 231 "util/configlexer.lex"
+{ YDVAR(1, VAR_SSL_SERVICE_PEM) }
 	YY_BREAK
 case 24:
 YY_RULE_SETUP
-#line 228 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_DAEMONIZE) }
+#line 232 "util/configlexer.lex"
+{ YDVAR(1, VAR_SSL_PORT) }
 	YY_BREAK
 case 25:
 YY_RULE_SETUP
-#line 229 "util/configlexer.lex"
-{ YDVAR(1, VAR_INTERFACE) }
+#line 233 "util/configlexer.lex"
+{ YDVAR(1, VAR_DO_DAEMONIZE) }
 	YY_BREAK
 case 26:
 YY_RULE_SETUP
-#line 230 "util/configlexer.lex"
+#line 234 "util/configlexer.lex"
 { YDVAR(1, VAR_INTERFACE) }
 	YY_BREAK
 case 27:
 YY_RULE_SETUP
-#line 231 "util/configlexer.lex"
-{ YDVAR(1, VAR_OUTGOING_INTERFACE) }
+#line 235 "util/configlexer.lex"
+{ YDVAR(1, VAR_INTERFACE) }
 	YY_BREAK
 case 28:
 YY_RULE_SETUP
-#line 232 "util/configlexer.lex"
-{ YDVAR(1, VAR_INTERFACE_AUTOMATIC) }
+#line 236 "util/configlexer.lex"
+{ YDVAR(1, VAR_OUTGOING_INTERFACE) }
 	YY_BREAK
 case 29:
 YY_RULE_SETUP
-#line 233 "util/configlexer.lex"
-{ YDVAR(1, VAR_SO_RCVBUF) }
+#line 237 "util/configlexer.lex"
+{ YDVAR(1, VAR_INTERFACE_AUTOMATIC) }
 	YY_BREAK
 case 30:
 YY_RULE_SETUP
-#line 234 "util/configlexer.lex"
-{ YDVAR(1, VAR_SO_SNDBUF) }
+#line 238 "util/configlexer.lex"
+{ YDVAR(1, VAR_SO_RCVBUF) }
 	YY_BREAK
 case 31:
 YY_RULE_SETUP
-#line 235 "util/configlexer.lex"
-{ YDVAR(1, VAR_SO_REUSEPORT) }
+#line 239 "util/configlexer.lex"
+{ YDVAR(1, VAR_SO_SNDBUF) }
 	YY_BREAK
 case 32:
 YY_RULE_SETUP
-#line 236 "util/configlexer.lex"
-{ YDVAR(1, VAR_IP_TRANSPARENT) }
+#line 240 "util/configlexer.lex"
+{ YDVAR(1, VAR_SO_REUSEPORT) }
 	YY_BREAK
 case 33:
 YY_RULE_SETUP
-#line 237 "util/configlexer.lex"
-{ YDVAR(1, VAR_IP_FREEBIND) }
+#line 241 "util/configlexer.lex"
+{ YDVAR(1, VAR_IP_TRANSPARENT) }
 	YY_BREAK
 case 34:
 YY_RULE_SETUP
-#line 238 "util/configlexer.lex"
-{ YDVAR(1, VAR_CHROOT) }
+#line 242 "util/configlexer.lex"
+{ YDVAR(1, VAR_IP_FREEBIND) }
 	YY_BREAK
 case 35:
 YY_RULE_SETUP
-#line 239 "util/configlexer.lex"
-{ YDVAR(1, VAR_USERNAME) }
+#line 243 "util/configlexer.lex"
+{ YDVAR(1, VAR_CHROOT) }
 	YY_BREAK
 case 36:
 YY_RULE_SETUP
-#line 240 "util/configlexer.lex"
-{ YDVAR(1, VAR_DIRECTORY) }
+#line 244 "util/configlexer.lex"
+{ YDVAR(1, VAR_USERNAME) }
 	YY_BREAK
 case 37:
 YY_RULE_SETUP
-#line 241 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOGFILE) }
+#line 245 "util/configlexer.lex"
+{ YDVAR(1, VAR_DIRECTORY) }
 	YY_BREAK
 case 38:
 YY_RULE_SETUP
-#line 242 "util/configlexer.lex"
-{ YDVAR(1, VAR_PIDFILE) }
+#line 246 "util/configlexer.lex"
+{ YDVAR(1, VAR_LOGFILE) }
 	YY_BREAK
 case 39:
 YY_RULE_SETUP
-#line 243 "util/configlexer.lex"
-{ YDVAR(1, VAR_ROOT_HINTS) }
+#line 247 "util/configlexer.lex"
+{ YDVAR(1, VAR_PIDFILE) }
 	YY_BREAK
 case 40:
 YY_RULE_SETUP
-#line 244 "util/configlexer.lex"
-{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
+#line 248 "util/configlexer.lex"
+{ YDVAR(1, VAR_ROOT_HINTS) }
 	YY_BREAK
 case 41:
 YY_RULE_SETUP
-#line 245 "util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_BUFFER_SIZE) }
+#line 249 "util/configlexer.lex"
+{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
 	YY_BREAK
 case 42:
 YY_RULE_SETUP
-#line 246 "util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_CACHE_SIZE) }
+#line 250 "util/configlexer.lex"
+{ YDVAR(1, VAR_MSG_BUFFER_SIZE) }
 	YY_BREAK
 case 43:
 YY_RULE_SETUP
-#line 247 "util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_CACHE_SLABS) }
+#line 251 "util/configlexer.lex"
+{ YDVAR(1, VAR_MSG_CACHE_SIZE) }
 	YY_BREAK
 case 44:
 YY_RULE_SETUP
-#line 248 "util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_CACHE_SIZE) }
+#line 252 "util/configlexer.lex"
+{ YDVAR(1, VAR_MSG_CACHE_SLABS) }
 	YY_BREAK
 case 45:
 YY_RULE_SETUP
-#line 249 "util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_CACHE_SLABS) }
+#line 253 "util/configlexer.lex"
+{ YDVAR(1, VAR_RRSET_CACHE_SIZE) }
 	YY_BREAK
 case 46:
 YY_RULE_SETUP
-#line 250 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MAX_TTL) }
+#line 254 "util/configlexer.lex"
+{ YDVAR(1, VAR_RRSET_CACHE_SLABS) }
 	YY_BREAK
 case 47:
 YY_RULE_SETUP
-#line 251 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) }
+#line 255 "util/configlexer.lex"
+{ YDVAR(1, VAR_CACHE_MAX_TTL) }
 	YY_BREAK
 case 48:
 YY_RULE_SETUP
-#line 252 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MIN_TTL) }
+#line 256 "util/configlexer.lex"
+{ YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) }
 	YY_BREAK
 case 49:
 YY_RULE_SETUP
-#line 253 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_HOST_TTL) }
+#line 257 "util/configlexer.lex"
+{ YDVAR(1, VAR_CACHE_MIN_TTL) }
 	YY_BREAK
 case 50:
 YY_RULE_SETUP
-#line 254 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_LAME_TTL) }
+#line 258 "util/configlexer.lex"
+{ YDVAR(1, VAR_INFRA_HOST_TTL) }
 	YY_BREAK
 case 51:
 YY_RULE_SETUP
-#line 255 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
+#line 259 "util/configlexer.lex"
+{ YDVAR(1, VAR_INFRA_LAME_TTL) }
 	YY_BREAK
 case 52:
 YY_RULE_SETUP
-#line 256 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
+#line 260 "util/configlexer.lex"
+{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
 	YY_BREAK
 case 53:
 YY_RULE_SETUP
-#line 257 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
+#line 261 "util/configlexer.lex"
+{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
 	YY_BREAK
 case 54:
 YY_RULE_SETUP
-#line 258 "util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
+#line 262 "util/configlexer.lex"
+{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
 	YY_BREAK
 case 55:
 YY_RULE_SETUP
-#line 259 "util/configlexer.lex"
-{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
+#line 263 "util/configlexer.lex"
+{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
 	YY_BREAK
 case 56:
 YY_RULE_SETUP
-#line 260 "util/configlexer.lex"
-{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
+#line 264 "util/configlexer.lex"
+{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
 	YY_BREAK
 case 57:
 YY_RULE_SETUP
-#line 261 "util/configlexer.lex"
-{ YDVAR(1, VAR_DELAY_CLOSE) }
+#line 265 "util/configlexer.lex"
+{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
 	YY_BREAK
 case 58:
 YY_RULE_SETUP
-#line 262 "util/configlexer.lex"
-{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
+#line 266 "util/configlexer.lex"
+{ YDVAR(1, VAR_DELAY_CLOSE) }
 	YY_BREAK
 case 59:
 YY_RULE_SETUP
-#line 263 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
+#line 267 "util/configlexer.lex"
+{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
 	YY_BREAK
 case 60:
 YY_RULE_SETUP
-#line 264 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
+#line 268 "util/configlexer.lex"
+{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
 	YY_BREAK
 case 61:
 YY_RULE_SETUP
-#line 265 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_GLUE) }
+#line 269 "util/configlexer.lex"
+{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
 	YY_BREAK
 case 62:
 YY_RULE_SETUP
-#line 266 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
+#line 270 "util/configlexer.lex"
+{ YDVAR(1, VAR_HARDEN_GLUE) }
 	YY_BREAK
 case 63:
 YY_RULE_SETUP
-#line 267 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
+#line 271 "util/configlexer.lex"
+{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
 	YY_BREAK
 case 64:
 YY_RULE_SETUP
-#line 268 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+#line 272 "util/configlexer.lex"
+{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 	YY_BREAK
 case 65:
 YY_RULE_SETUP
-#line 269 "util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
+#line 273 "util/configlexer.lex"
+{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
 	YY_BREAK
 case 66:
 YY_RULE_SETUP
-#line 270 "util/configlexer.lex"
-{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+#line 274 "util/configlexer.lex"
+{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 	YY_BREAK
 case 67:
 YY_RULE_SETUP
-#line 271 "util/configlexer.lex"
-{ YDVAR(1, VAR_CAPS_WHITELIST) }
+#line 275 "util/configlexer.lex"
+{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 	YY_BREAK
 case 68:
 YY_RULE_SETUP
-#line 272 "util/configlexer.lex"
-{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
+#line 276 "util/configlexer.lex"
+{ YDVAR(1, VAR_CAPS_WHITELIST) }
 	YY_BREAK
 case 69:
 YY_RULE_SETUP
-#line 273 "util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
+#line 277 "util/configlexer.lex"
+{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 	YY_BREAK
 case 70:
 YY_RULE_SETUP
-#line 274 "util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
+#line 278 "util/configlexer.lex"
+{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
 	YY_BREAK
 case 71:
 YY_RULE_SETUP
-#line 275 "util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH_KEY) }
+#line 279 "util/configlexer.lex"
+{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 	YY_BREAK
 case 72:
 YY_RULE_SETUP
-#line 276 "util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH) }
+#line 280 "util/configlexer.lex"
+{ YDVAR(1, VAR_PREFETCH_KEY) }
 	YY_BREAK
 case 73:
 YY_RULE_SETUP
-#line 277 "util/configlexer.lex"
-{ YDVAR(0, VAR_STUB_ZONE) }
+#line 281 "util/configlexer.lex"
+{ YDVAR(1, VAR_PREFETCH) }
 	YY_BREAK
 case 74:
 YY_RULE_SETUP
-#line 278 "util/configlexer.lex"
-{ YDVAR(1, VAR_NAME) }
+#line 282 "util/configlexer.lex"
+{ YDVAR(0, VAR_STUB_ZONE) }
 	YY_BREAK
 case 75:
 YY_RULE_SETUP
-#line 279 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_ADDR) }
+#line 283 "util/configlexer.lex"
+{ YDVAR(1, VAR_NAME) }
 	YY_BREAK
 case 76:
 YY_RULE_SETUP
-#line 280 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_HOST) }
+#line 284 "util/configlexer.lex"
+{ YDVAR(1, VAR_STUB_ADDR) }
 	YY_BREAK
 case 77:
 YY_RULE_SETUP
-#line 281 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_PRIME) }
+#line 285 "util/configlexer.lex"
+{ YDVAR(1, VAR_STUB_HOST) }
 	YY_BREAK
 case 78:
 YY_RULE_SETUP
-#line 282 "util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_FIRST) }
+#line 286 "util/configlexer.lex"
+{ YDVAR(1, VAR_STUB_PRIME) }
 	YY_BREAK
 case 79:
 YY_RULE_SETUP
-#line 283 "util/configlexer.lex"
-{ YDVAR(0, VAR_FORWARD_ZONE) }
+#line 287 "util/configlexer.lex"
+{ YDVAR(1, VAR_STUB_FIRST) }
 	YY_BREAK
 case 80:
 YY_RULE_SETUP
-#line 284 "util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_ADDR) }
+#line 288 "util/configlexer.lex"
+{ YDVAR(0, VAR_FORWARD_ZONE) }
 	YY_BREAK
 case 81:
 YY_RULE_SETUP
-#line 285 "util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_HOST) }
+#line 289 "util/configlexer.lex"
+{ YDVAR(1, VAR_FORWARD_ADDR) }
 	YY_BREAK
 case 82:
 YY_RULE_SETUP
-#line 286 "util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_FIRST) }
+#line 290 "util/configlexer.lex"
+{ YDVAR(1, VAR_FORWARD_HOST) }
 	YY_BREAK
 case 83:
 YY_RULE_SETUP
-#line 287 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
+#line 291 "util/configlexer.lex"
+{ YDVAR(1, VAR_FORWARD_FIRST) }
 	YY_BREAK
 case 84:
 YY_RULE_SETUP
-#line 288 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
+#line 292 "util/configlexer.lex"
+{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
 	YY_BREAK
 case 85:
 YY_RULE_SETUP
-#line 289 "util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL) }
+#line 293 "util/configlexer.lex"
+{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
 	YY_BREAK
 case 86:
 YY_RULE_SETUP
-#line 290 "util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_IDENTITY) }
+#line 294 "util/configlexer.lex"
+{ YDVAR(2, VAR_ACCESS_CONTROL) }
 	YY_BREAK
 case 87:
 YY_RULE_SETUP
-#line 291 "util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_VERSION) }
+#line 295 "util/configlexer.lex"
+{ YDVAR(1, VAR_HIDE_IDENTITY) }
 	YY_BREAK
 case 88:
 YY_RULE_SETUP
-#line 292 "util/configlexer.lex"
-{ YDVAR(1, VAR_IDENTITY) }
+#line 296 "util/configlexer.lex"
+{ YDVAR(1, VAR_HIDE_VERSION) }
 	YY_BREAK
 case 89:
 YY_RULE_SETUP
-#line 293 "util/configlexer.lex"
-{ YDVAR(1, VAR_VERSION) }
+#line 297 "util/configlexer.lex"
+{ YDVAR(1, VAR_IDENTITY) }
 	YY_BREAK
 case 90:
 YY_RULE_SETUP
-#line 294 "util/configlexer.lex"
-{ YDVAR(1, VAR_MODULE_CONF) }
+#line 298 "util/configlexer.lex"
+{ YDVAR(1, VAR_VERSION) }
 	YY_BREAK
 case 91:
 YY_RULE_SETUP
-#line 295 "util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR) }
+#line 299 "util/configlexer.lex"
+{ YDVAR(1, VAR_MODULE_CONF) }
 	YY_BREAK
 case 92:
 YY_RULE_SETUP
-#line 296 "util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
+#line 300 "util/configlexer.lex"
+{ YDVAR(1, VAR_DLV_ANCHOR) }
 	YY_BREAK
 case 93:
 YY_RULE_SETUP
-#line 297 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
+#line 301 "util/configlexer.lex"
+{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
 	YY_BREAK
 case 94:
 YY_RULE_SETUP
-#line 298 "util/configlexer.lex"
-{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
+#line 302 "util/configlexer.lex"
+{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 95:
 YY_RULE_SETUP
-#line 299 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
+#line 303 "util/configlexer.lex"
+{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 96:
 YY_RULE_SETUP
-#line 300 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR) }
+#line 304 "util/configlexer.lex"
+{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
 	YY_BREAK
 case 97:
 YY_RULE_SETUP
-#line 301 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
+#line 305 "util/configlexer.lex"
+{ YDVAR(1, VAR_TRUST_ANCHOR) }
 	YY_BREAK
 case 98:
 YY_RULE_SETUP
-#line 302 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
+#line 306 "util/configlexer.lex"
+{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
 	YY_BREAK
 case 99:
 YY_RULE_SETUP
-#line 303 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
+#line 307 "util/configlexer.lex"
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
 	YY_BREAK
 case 100:
 YY_RULE_SETUP
-#line 304 "util/configlexer.lex"
-{ YDVAR(1, VAR_BOGUS_TTL) }
+#line 308 "util/configlexer.lex"
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 	YY_BREAK
 case 101:
 YY_RULE_SETUP
-#line 305 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
+#line 309 "util/configlexer.lex"
+{ YDVAR(1, VAR_BOGUS_TTL) }
 	YY_BREAK
 case 102:
 YY_RULE_SETUP
-#line 306 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+#line 310 "util/configlexer.lex"
+{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 	YY_BREAK
 case 103:
 YY_RULE_SETUP
-#line 307 "util/configlexer.lex"
-{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
+#line 311 "util/configlexer.lex"
+{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
 	YY_BREAK
 case 104:
 YY_RULE_SETUP
-#line 308 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
+#line 312 "util/configlexer.lex"
+{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
 	YY_BREAK
 case 105:
 YY_RULE_SETUP
-#line 309 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
+#line 313 "util/configlexer.lex"
+{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 	YY_BREAK
 case 106:
 YY_RULE_SETUP
-#line 310 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
+#line 314 "util/configlexer.lex"
+{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 	YY_BREAK
 case 107:
 YY_RULE_SETUP
-#line 311 "util/configlexer.lex"
-{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
+#line 315 "util/configlexer.lex"
+{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 	YY_BREAK
 case 108:
 YY_RULE_SETUP
-#line 312 "util/configlexer.lex"
+#line 316 "util/configlexer.lex"
+{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
+	YY_BREAK
+case 109:
+YY_RULE_SETUP
+#line 317 "util/configlexer.lex"
 { 
 				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 	YY_BREAK
-case 109:
+case 110:
 YY_RULE_SETUP
-#line 314 "util/configlexer.lex"
+#line 319 "util/configlexer.lex"
 { YDVAR(1, VAR_ADD_HOLDDOWN) }
 	YY_BREAK
-case 110:
+case 111:
 YY_RULE_SETUP
-#line 315 "util/configlexer.lex"
+#line 320 "util/configlexer.lex"
 { YDVAR(1, VAR_DEL_HOLDDOWN) }
 	YY_BREAK
-case 111:
+case 112:
 YY_RULE_SETUP
-#line 316 "util/configlexer.lex"
+#line 321 "util/configlexer.lex"
 { YDVAR(1, VAR_KEEP_MISSING) }
 	YY_BREAK
-case 112:
+case 113:
 YY_RULE_SETUP
-#line 317 "util/configlexer.lex"
+#line 322 "util/configlexer.lex"
 { YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
 	YY_BREAK
-case 113:
+case 114:
 YY_RULE_SETUP
-#line 318 "util/configlexer.lex"
+#line 323 "util/configlexer.lex"
 { YDVAR(1, VAR_USE_SYSLOG) }
 	YY_BREAK
-case 114:
+case 115:
 YY_RULE_SETUP
-#line 319 "util/configlexer.lex"
+#line 324 "util/configlexer.lex"
 { YDVAR(1, VAR_LOG_TIME_ASCII) }
 	YY_BREAK
-case 115:
+case 116:
 YY_RULE_SETUP
-#line 320 "util/configlexer.lex"
+#line 325 "util/configlexer.lex"
 { YDVAR(1, VAR_LOG_QUERIES) }
 	YY_BREAK
-case 116:
+case 117:
 YY_RULE_SETUP
-#line 321 "util/configlexer.lex"
+#line 326 "util/configlexer.lex"
 { YDVAR(2, VAR_LOCAL_ZONE) }
 	YY_BREAK
-case 117:
+case 118:
 YY_RULE_SETUP
-#line 322 "util/configlexer.lex"
+#line 327 "util/configlexer.lex"
 { YDVAR(1, VAR_LOCAL_DATA) }
 	YY_BREAK
-case 118:
+case 119:
 YY_RULE_SETUP
-#line 323 "util/configlexer.lex"
+#line 328 "util/configlexer.lex"
 { YDVAR(1, VAR_LOCAL_DATA_PTR) }
 	YY_BREAK
-case 119:
+case 120:
 YY_RULE_SETUP
-#line 324 "util/configlexer.lex"
+#line 329 "util/configlexer.lex"
 { YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
 	YY_BREAK
-case 120:
+case 121:
 YY_RULE_SETUP
-#line 325 "util/configlexer.lex"
+#line 330 "util/configlexer.lex"
 { YDVAR(1, VAR_INSECURE_LAN_ZONES) }
 	YY_BREAK
-case 121:
+case 122:
 YY_RULE_SETUP
-#line 326 "util/configlexer.lex"
+#line 331 "util/configlexer.lex"
 { YDVAR(1, VAR_STATISTICS_INTERVAL) }
 	YY_BREAK
-case 122:
+case 123:
 YY_RULE_SETUP
-#line 327 "util/configlexer.lex"
+#line 332 "util/configlexer.lex"
 { YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
 	YY_BREAK
-case 123:
+case 124:
 YY_RULE_SETUP
-#line 328 "util/configlexer.lex"
+#line 333 "util/configlexer.lex"
 { YDVAR(1, VAR_EXTENDED_STATISTICS) }
 	YY_BREAK
-case 124:
+case 125:
 YY_RULE_SETUP
-#line 329 "util/configlexer.lex"
+#line 334 "util/configlexer.lex"
 { YDVAR(0, VAR_REMOTE_CONTROL) }
 	YY_BREAK
-case 125:
+case 126:
 YY_RULE_SETUP
-#line 330 "util/configlexer.lex"
+#line 335 "util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_ENABLE) }
 	YY_BREAK
-case 126:
+case 127:
 YY_RULE_SETUP
-#line 331 "util/configlexer.lex"
+#line 336 "util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_INTERFACE) }
 	YY_BREAK
-case 127:
+case 128:
 YY_RULE_SETUP
-#line 332 "util/configlexer.lex"
+#line 337 "util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_PORT) }
 	YY_BREAK
-case 128:
+case 129:
 YY_RULE_SETUP
-#line 333 "util/configlexer.lex"
+#line 338 "util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_USE_CERT) }
 	YY_BREAK
-case 129:
+case 130:
 YY_RULE_SETUP
-#line 334 "util/configlexer.lex"
+#line 339 "util/configlexer.lex"
 { YDVAR(1, VAR_SERVER_KEY_FILE) }
 	YY_BREAK
-case 130:
+case 131:
 YY_RULE_SETUP
-#line 335 "util/configlexer.lex"
+#line 340 "util/configlexer.lex"
 { YDVAR(1, VAR_SERVER_CERT_FILE) }
 	YY_BREAK
-case 131:
+case 132:
 YY_RULE_SETUP
-#line 336 "util/configlexer.lex"
+#line 341 "util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_KEY_FILE) }
 	YY_BREAK
-case 132:
+case 133:
 YY_RULE_SETUP
-#line 337 "util/configlexer.lex"
+#line 342 "util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_CERT_FILE) }
 	YY_BREAK
-case 133:
+case 134:
 YY_RULE_SETUP
-#line 338 "util/configlexer.lex"
+#line 343 "util/configlexer.lex"
 { YDVAR(1, VAR_PYTHON_SCRIPT) }
 	YY_BREAK
-case 134:
+case 135:
 YY_RULE_SETUP
-#line 339 "util/configlexer.lex"
+#line 344 "util/configlexer.lex"
 { YDVAR(0, VAR_PYTHON) }
 	YY_BREAK
-case 135:
+case 136:
 YY_RULE_SETUP
-#line 340 "util/configlexer.lex"
+#line 345 "util/configlexer.lex"
 { YDVAR(1, VAR_DOMAIN_INSECURE) }
 	YY_BREAK
-case 136:
+case 137:
 YY_RULE_SETUP
-#line 341 "util/configlexer.lex"
+#line 346 "util/configlexer.lex"
 { YDVAR(1, VAR_MINIMAL_RESPONSES) }
 	YY_BREAK
-case 137:
+case 138:
 YY_RULE_SETUP
-#line 342 "util/configlexer.lex"
+#line 347 "util/configlexer.lex"
 { YDVAR(1, VAR_RRSET_ROUNDROBIN) }
 	YY_BREAK
-case 138:
+case 139:
 YY_RULE_SETUP
-#line 343 "util/configlexer.lex"
+#line 348 "util/configlexer.lex"
 { YDVAR(1, VAR_MAX_UDP_SIZE) }
 	YY_BREAK
-case 139:
+case 140:
 YY_RULE_SETUP
-#line 344 "util/configlexer.lex"
+#line 349 "util/configlexer.lex"
 { YDVAR(1, VAR_DNS64_PREFIX) }
 	YY_BREAK
-case 140:
+case 141:
 YY_RULE_SETUP
-#line 345 "util/configlexer.lex"
+#line 350 "util/configlexer.lex"
 { YDVAR(1, VAR_DNS64_SYNTHALL) }
 	YY_BREAK
-case 141:
+case 142:
 YY_RULE_SETUP
-#line 346 "util/configlexer.lex"
+#line 351 "util/configlexer.lex"
 { YDVAR(1, VAR_DEFINE_TAG) }
 	YY_BREAK
-case 142:
+case 143:
 YY_RULE_SETUP
-#line 347 "util/configlexer.lex"
+#line 352 "util/configlexer.lex"
 { YDVAR(2, VAR_LOCAL_ZONE_TAG) }
 	YY_BREAK
-case 143:
+case 144:
 YY_RULE_SETUP
-#line 348 "util/configlexer.lex"
+#line 353 "util/configlexer.lex"
+{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
+	YY_BREAK
+case 145:
+YY_RULE_SETUP
+#line 354 "util/configlexer.lex"
+{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
+	YY_BREAK
+case 146:
+YY_RULE_SETUP
+#line 355 "util/configlexer.lex"
+{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
+	YY_BREAK
+case 147:
+YY_RULE_SETUP
+#line 356 "util/configlexer.lex"
+{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
+	YY_BREAK
+case 148:
+YY_RULE_SETUP
+#line 357 "util/configlexer.lex"
 { YDVAR(0, VAR_DNSTAP) }
 	YY_BREAK
-case 144:
+case 149:
 YY_RULE_SETUP
-#line 349 "util/configlexer.lex"
+#line 358 "util/configlexer.lex"
 { YDVAR(1, VAR_DNSTAP_ENABLE) }
 	YY_BREAK
-case 145:
+case 150:
 YY_RULE_SETUP
-#line 350 "util/configlexer.lex"
+#line 359 "util/configlexer.lex"
 { YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
 	YY_BREAK
-case 146:
+case 151:
 YY_RULE_SETUP
-#line 351 "util/configlexer.lex"
+#line 360 "util/configlexer.lex"
 { YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
 	YY_BREAK
-case 147:
+case 152:
 YY_RULE_SETUP
-#line 352 "util/configlexer.lex"
+#line 361 "util/configlexer.lex"
 { YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
 	YY_BREAK
-case 148:
+case 153:
 YY_RULE_SETUP
-#line 353 "util/configlexer.lex"
+#line 362 "util/configlexer.lex"
 { YDVAR(1, VAR_DNSTAP_IDENTITY) }
 	YY_BREAK
-case 149:
+case 154:
 YY_RULE_SETUP
-#line 354 "util/configlexer.lex"
+#line 363 "util/configlexer.lex"
 { YDVAR(1, VAR_DNSTAP_VERSION) }
 	YY_BREAK
-case 150:
+case 155:
 YY_RULE_SETUP
-#line 355 "util/configlexer.lex"
+#line 364 "util/configlexer.lex"
 {
 		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
 	YY_BREAK
-case 151:
+case 156:
 YY_RULE_SETUP
-#line 357 "util/configlexer.lex"
+#line 366 "util/configlexer.lex"
 {
 		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
 	YY_BREAK
-case 152:
+case 157:
 YY_RULE_SETUP
-#line 359 "util/configlexer.lex"
+#line 368 "util/configlexer.lex"
 {
 		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
 	YY_BREAK
-case 153:
+case 158:
 YY_RULE_SETUP
-#line 361 "util/configlexer.lex"
+#line 370 "util/configlexer.lex"
 {
 		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
 	YY_BREAK
-case 154:
+case 159:
 YY_RULE_SETUP
-#line 363 "util/configlexer.lex"
+#line 372 "util/configlexer.lex"
 {
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
 	YY_BREAK
-case 155:
+case 160:
 YY_RULE_SETUP
-#line 365 "util/configlexer.lex"
+#line 374 "util/configlexer.lex"
 {
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
 	YY_BREAK
-case 156:
+case 161:
 YY_RULE_SETUP
-#line 367 "util/configlexer.lex"
+#line 376 "util/configlexer.lex"
 { YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
 	YY_BREAK
-case 157:
+case 162:
 YY_RULE_SETUP
-#line 368 "util/configlexer.lex"
+#line 377 "util/configlexer.lex"
 { YDVAR(1, VAR_RATELIMIT) }
 	YY_BREAK
-case 158:
+case 163:
 YY_RULE_SETUP
-#line 369 "util/configlexer.lex"
+#line 378 "util/configlexer.lex"
 { YDVAR(1, VAR_RATELIMIT_SLABS) }
 	YY_BREAK
-case 159:
+case 164:
 YY_RULE_SETUP
-#line 370 "util/configlexer.lex"
+#line 379 "util/configlexer.lex"
 { YDVAR(1, VAR_RATELIMIT_SIZE) }
 	YY_BREAK
-case 160:
+case 165:
 YY_RULE_SETUP
-#line 371 "util/configlexer.lex"
+#line 380 "util/configlexer.lex"
 { YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
 	YY_BREAK
-case 161:
+case 166:
 YY_RULE_SETUP
-#line 372 "util/configlexer.lex"
+#line 381 "util/configlexer.lex"
 { YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
 	YY_BREAK
-case 162:
+case 167:
 YY_RULE_SETUP
-#line 373 "util/configlexer.lex"
+#line 382 "util/configlexer.lex"
 { YDVAR(1, VAR_RATELIMIT_FACTOR) }
 	YY_BREAK
-case 163:
-/* rule 163 can match eol */
+case 168:
+/* rule 168 can match eol */
 YY_RULE_SETUP
-#line 374 "util/configlexer.lex"
+#line 383 "util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++; }
 	YY_BREAK
 /* Quoted strings. Strip leading and ending quotes */
-case 164:
+case 169:
 YY_RULE_SETUP
-#line 377 "util/configlexer.lex"
+#line 386 "util/configlexer.lex"
 { BEGIN(quotedstring); LEXOUT(("QS ")); }
 	YY_BREAK
 case YY_STATE_EOF(quotedstring):
-#line 378 "util/configlexer.lex"
+#line 387 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 165:
+case 170:
 YY_RULE_SETUP
-#line 383 "util/configlexer.lex"
+#line 392 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 166:
-/* rule 166 can match eol */
+case 171:
+/* rule 171 can match eol */
 YY_RULE_SETUP
-#line 384 "util/configlexer.lex"
+#line 393 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end \""); 
 			  cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 167:
+case 172:
 YY_RULE_SETUP
-#line 386 "util/configlexer.lex"
+#line 395 "util/configlexer.lex"
 {
         LEXOUT(("QE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -3604,34 +3664,34 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* Single Quoted strings. Strip leading and ending quotes */
-case 168:
+case 173:
 YY_RULE_SETUP
-#line 398 "util/configlexer.lex"
+#line 407 "util/configlexer.lex"
 { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
 	YY_BREAK
 case YY_STATE_EOF(singlequotedstr):
-#line 399 "util/configlexer.lex"
+#line 408 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 169:
+case 174:
 YY_RULE_SETUP
-#line 404 "util/configlexer.lex"
+#line 413 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 170:
-/* rule 170 can match eol */
+case 175:
+/* rule 175 can match eol */
 YY_RULE_SETUP
-#line 405 "util/configlexer.lex"
+#line 414 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end '"); 
 			     cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 171:
+case 176:
 YY_RULE_SETUP
-#line 407 "util/configlexer.lex"
+#line 416 "util/configlexer.lex"
 {
         LEXOUT(("SQE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -3644,38 +3704,38 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* include: directive */
-case 172:
+case 177:
 YY_RULE_SETUP
-#line 419 "util/configlexer.lex"
+#line 428 "util/configlexer.lex"
 { 
 	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
 	YY_BREAK
 case YY_STATE_EOF(include):
-#line 421 "util/configlexer.lex"
+#line 430 "util/configlexer.lex"
 {
         yyerror("EOF inside include directive");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 173:
+case 178:
 YY_RULE_SETUP
-#line 425 "util/configlexer.lex"
+#line 434 "util/configlexer.lex"
 { LEXOUT(("ISP ")); /* ignore */ }
 	YY_BREAK
-case 174:
-/* rule 174 can match eol */
+case 179:
+/* rule 179 can match eol */
 YY_RULE_SETUP
-#line 426 "util/configlexer.lex"
+#line 435 "util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++;}
 	YY_BREAK
-case 175:
+case 180:
 YY_RULE_SETUP
-#line 427 "util/configlexer.lex"
+#line 436 "util/configlexer.lex"
 { LEXOUT(("IQS ")); BEGIN(include_quoted); }
 	YY_BREAK
-case 176:
+case 181:
 YY_RULE_SETUP
-#line 428 "util/configlexer.lex"
+#line 437 "util/configlexer.lex"
 {
 	LEXOUT(("Iunquotedstr(%s) ", yytext));
 	config_start_include_glob(yytext);
@@ -3683,27 +3743,27 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 case YY_STATE_EOF(include_quoted):
-#line 433 "util/configlexer.lex"
+#line 442 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 177:
+case 182:
 YY_RULE_SETUP
-#line 437 "util/configlexer.lex"
+#line 446 "util/configlexer.lex"
 { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 178:
-/* rule 178 can match eol */
+case 183:
+/* rule 183 can match eol */
 YY_RULE_SETUP
-#line 438 "util/configlexer.lex"
+#line 447 "util/configlexer.lex"
 { yyerror("newline before \" in include name"); 
 				  cfg_parser->line++; BEGIN(inc_prev); }
 	YY_BREAK
-case 179:
+case 184:
 YY_RULE_SETUP
-#line 440 "util/configlexer.lex"
+#line 449 "util/configlexer.lex"
 {
 	LEXOUT(("IQE "));
 	yytext[yyleng - 1] = '\0';
@@ -3713,7 +3773,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case YY_STATE_EOF(INITIAL):
 case YY_STATE_EOF(val):
-#line 446 "util/configlexer.lex"
+#line 455 "util/configlexer.lex"
 {
 	LEXOUT(("LEXEOF "));
 	yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
@@ -3725,33 +3785,33 @@ case YY_STATE_EOF(val):
 	}
 }
 	YY_BREAK
-case 180:
+case 185:
 YY_RULE_SETUP
-#line 457 "util/configlexer.lex"
+#line 466 "util/configlexer.lex"
 { LEXOUT(("unquotedstr(%s) ", yytext)); 
 			if(--num_args == 0) { BEGIN(INITIAL); }
 			yylval.str = strdup(yytext); return STRING_ARG; }
 	YY_BREAK
-case 181:
+case 186:
 YY_RULE_SETUP
-#line 461 "util/configlexer.lex"
+#line 470 "util/configlexer.lex"
 {
 	ub_c_error_msg("unknown keyword '%s'", yytext);
 	}
 	YY_BREAK
-case 182:
+case 187:
 YY_RULE_SETUP
-#line 465 "util/configlexer.lex"
+#line 474 "util/configlexer.lex"
 {
 	ub_c_error_msg("stray '%s'", yytext);
 	}
 	YY_BREAK
-case 183:
+case 188:
 YY_RULE_SETUP
-#line 469 "util/configlexer.lex"
+#line 478 "util/configlexer.lex"
 ECHO;
 	YY_BREAK
-#line 3753 "<stdout>"
+#line 3813 "<stdout>"
 
 	case YY_END_OF_BUFFER:
 		{
@@ -3936,7 +3996,7 @@ static int yy_get_next_buffer (void)
 
 	else
 		{
-			yy_size_t num_to_read =
+			int num_to_read =
 			YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1;
 
 		while ( num_to_read <= 0 )
@@ -4042,7 +4102,7 @@ static int yy_get_next_buffer (void)
 		while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 			{
 			yy_current_state = (int) yy_def[yy_current_state];
-			if ( yy_current_state >= 1847 )
+			if ( yy_current_state >= 1880 )
 				yy_c = yy_meta[(unsigned int) yy_c];
 			}
 		yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
@@ -4070,11 +4130,11 @@ static int yy_get_next_buffer (void)
 	while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 		{
 		yy_current_state = (int) yy_def[yy_current_state];
-		if ( yy_current_state >= 1847 )
+		if ( yy_current_state >= 1880 )
 			yy_c = yy_meta[(unsigned int) yy_c];
 		}
 	yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
-	yy_is_jam = (yy_current_state == 1846);
+	yy_is_jam = (yy_current_state == 1879);
 
 		return yy_is_jam ? 0 : yy_current_state;
 }
@@ -4523,7 +4583,7 @@ static void yy_fatal_error (yyconst char* msg )
 	do \
 		{ \
 		/* Undo effects of setting up yytext. */ \
-        yy_size_t yyless_macro_arg = (n); \
+        int yyless_macro_arg = (n); \
         YY_LESS_LINENO(yyless_macro_arg);\
 		yytext[yyleng] = (yy_hold_char); \
 		(yy_c_buf_p) = yytext + yyless_macro_arg; \
@@ -4713,7 +4773,7 @@ void yyfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 469 "util/configlexer.lex"
+#line 478 "util/configlexer.lex"
 
 
 
diff --git a/util/configlexer.lex b/util/configlexer.lex
index 58d642c1da22..369f9034a972 100644
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -7,6 +7,10 @@
  * See LICENSE for the license.
  *
  */
+
+/* because flex keeps having sign-unsigned compare problems that are unfixed*/
+#pragma GCC diagnostic ignored "-Wsign-compare"
+
 #include <ctype.h>
 #include <string.h>
 #include <strings.h>
@@ -216,6 +220,7 @@ outgoing-num-tcp{COLON}		{ YDVAR(1, VAR_OUTGOING_NUM_TCP) }
 incoming-num-tcp{COLON}		{ YDVAR(1, VAR_INCOMING_NUM_TCP) }
 do-ip4{COLON}			{ YDVAR(1, VAR_DO_IP4) }
 do-ip6{COLON}			{ YDVAR(1, VAR_DO_IP6) }
+prefer-ip6{COLON}		{ YDVAR(1, VAR_PREFER_IP6) }
 do-udp{COLON}			{ YDVAR(1, VAR_DO_UDP) }
 do-tcp{COLON}			{ YDVAR(1, VAR_DO_TCP) }
 tcp-upstream{COLON}		{ YDVAR(1, VAR_TCP_UPSTREAM) }
@@ -345,6 +350,10 @@ dns64-prefix{COLON}		{ YDVAR(1, VAR_DNS64_PREFIX) }
 dns64-synthall{COLON}		{ YDVAR(1, VAR_DNS64_SYNTHALL) }
 define-tag{COLON}		{ YDVAR(1, VAR_DEFINE_TAG) }
 local-zone-tag{COLON}		{ YDVAR(2, VAR_LOCAL_ZONE_TAG) }
+access-control-tag{COLON}	{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
+access-control-tag-action{COLON} { YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
+access-control-tag-data{COLON}	{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
+local-zone-override{COLON}	{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
 dnstap{COLON}			{ YDVAR(0, VAR_DNSTAP) }
 dnstap-enable{COLON}		{ YDVAR(1, VAR_DNSTAP_ENABLE) }
 dnstap-socket-path{COLON}	{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
diff --git a/util/configparser.c b/util/configparser.c
index 01e37d45c23c..1f9062d02ada 100644
--- a/util/configparser.c
+++ b/util/configparser.c
@@ -140,157 +140,162 @@ extern int yydebug;
     VAR_INTERFACE = 271,
     VAR_DO_IP4 = 272,
     VAR_DO_IP6 = 273,
-    VAR_DO_UDP = 274,
-    VAR_DO_TCP = 275,
-    VAR_TCP_MSS = 276,
-    VAR_OUTGOING_TCP_MSS = 277,
-    VAR_CHROOT = 278,
-    VAR_USERNAME = 279,
-    VAR_DIRECTORY = 280,
-    VAR_LOGFILE = 281,
-    VAR_PIDFILE = 282,
-    VAR_MSG_CACHE_SIZE = 283,
-    VAR_MSG_CACHE_SLABS = 284,
-    VAR_NUM_QUERIES_PER_THREAD = 285,
-    VAR_RRSET_CACHE_SIZE = 286,
-    VAR_RRSET_CACHE_SLABS = 287,
-    VAR_OUTGOING_NUM_TCP = 288,
-    VAR_INFRA_HOST_TTL = 289,
-    VAR_INFRA_LAME_TTL = 290,
-    VAR_INFRA_CACHE_SLABS = 291,
-    VAR_INFRA_CACHE_NUMHOSTS = 292,
-    VAR_INFRA_CACHE_LAME_SIZE = 293,
-    VAR_NAME = 294,
-    VAR_STUB_ZONE = 295,
-    VAR_STUB_HOST = 296,
-    VAR_STUB_ADDR = 297,
-    VAR_TARGET_FETCH_POLICY = 298,
-    VAR_HARDEN_SHORT_BUFSIZE = 299,
-    VAR_HARDEN_LARGE_QUERIES = 300,
-    VAR_FORWARD_ZONE = 301,
-    VAR_FORWARD_HOST = 302,
-    VAR_FORWARD_ADDR = 303,
-    VAR_DO_NOT_QUERY_ADDRESS = 304,
-    VAR_HIDE_IDENTITY = 305,
-    VAR_HIDE_VERSION = 306,
-    VAR_IDENTITY = 307,
-    VAR_VERSION = 308,
-    VAR_HARDEN_GLUE = 309,
-    VAR_MODULE_CONF = 310,
-    VAR_TRUST_ANCHOR_FILE = 311,
-    VAR_TRUST_ANCHOR = 312,
-    VAR_VAL_OVERRIDE_DATE = 313,
-    VAR_BOGUS_TTL = 314,
-    VAR_VAL_CLEAN_ADDITIONAL = 315,
-    VAR_VAL_PERMISSIVE_MODE = 316,
-    VAR_INCOMING_NUM_TCP = 317,
-    VAR_MSG_BUFFER_SIZE = 318,
-    VAR_KEY_CACHE_SIZE = 319,
-    VAR_KEY_CACHE_SLABS = 320,
-    VAR_TRUSTED_KEYS_FILE = 321,
-    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 322,
-    VAR_USE_SYSLOG = 323,
-    VAR_OUTGOING_INTERFACE = 324,
-    VAR_ROOT_HINTS = 325,
-    VAR_DO_NOT_QUERY_LOCALHOST = 326,
-    VAR_CACHE_MAX_TTL = 327,
-    VAR_HARDEN_DNSSEC_STRIPPED = 328,
-    VAR_ACCESS_CONTROL = 329,
-    VAR_LOCAL_ZONE = 330,
-    VAR_LOCAL_DATA = 331,
-    VAR_INTERFACE_AUTOMATIC = 332,
-    VAR_STATISTICS_INTERVAL = 333,
-    VAR_DO_DAEMONIZE = 334,
-    VAR_USE_CAPS_FOR_ID = 335,
-    VAR_STATISTICS_CUMULATIVE = 336,
-    VAR_OUTGOING_PORT_PERMIT = 337,
-    VAR_OUTGOING_PORT_AVOID = 338,
-    VAR_DLV_ANCHOR_FILE = 339,
-    VAR_DLV_ANCHOR = 340,
-    VAR_NEG_CACHE_SIZE = 341,
-    VAR_HARDEN_REFERRAL_PATH = 342,
-    VAR_PRIVATE_ADDRESS = 343,
-    VAR_PRIVATE_DOMAIN = 344,
-    VAR_REMOTE_CONTROL = 345,
-    VAR_CONTROL_ENABLE = 346,
-    VAR_CONTROL_INTERFACE = 347,
-    VAR_CONTROL_PORT = 348,
-    VAR_SERVER_KEY_FILE = 349,
-    VAR_SERVER_CERT_FILE = 350,
-    VAR_CONTROL_KEY_FILE = 351,
-    VAR_CONTROL_CERT_FILE = 352,
-    VAR_CONTROL_USE_CERT = 353,
-    VAR_EXTENDED_STATISTICS = 354,
-    VAR_LOCAL_DATA_PTR = 355,
-    VAR_JOSTLE_TIMEOUT = 356,
-    VAR_STUB_PRIME = 357,
-    VAR_UNWANTED_REPLY_THRESHOLD = 358,
-    VAR_LOG_TIME_ASCII = 359,
-    VAR_DOMAIN_INSECURE = 360,
-    VAR_PYTHON = 361,
-    VAR_PYTHON_SCRIPT = 362,
-    VAR_VAL_SIG_SKEW_MIN = 363,
-    VAR_VAL_SIG_SKEW_MAX = 364,
-    VAR_CACHE_MIN_TTL = 365,
-    VAR_VAL_LOG_LEVEL = 366,
-    VAR_AUTO_TRUST_ANCHOR_FILE = 367,
-    VAR_KEEP_MISSING = 368,
-    VAR_ADD_HOLDDOWN = 369,
-    VAR_DEL_HOLDDOWN = 370,
-    VAR_SO_RCVBUF = 371,
-    VAR_EDNS_BUFFER_SIZE = 372,
-    VAR_PREFETCH = 373,
-    VAR_PREFETCH_KEY = 374,
-    VAR_SO_SNDBUF = 375,
-    VAR_SO_REUSEPORT = 376,
-    VAR_HARDEN_BELOW_NXDOMAIN = 377,
-    VAR_IGNORE_CD_FLAG = 378,
-    VAR_LOG_QUERIES = 379,
-    VAR_TCP_UPSTREAM = 380,
-    VAR_SSL_UPSTREAM = 381,
-    VAR_SSL_SERVICE_KEY = 382,
-    VAR_SSL_SERVICE_PEM = 383,
-    VAR_SSL_PORT = 384,
-    VAR_FORWARD_FIRST = 385,
-    VAR_STUB_FIRST = 386,
-    VAR_MINIMAL_RESPONSES = 387,
-    VAR_RRSET_ROUNDROBIN = 388,
-    VAR_MAX_UDP_SIZE = 389,
-    VAR_DELAY_CLOSE = 390,
-    VAR_UNBLOCK_LAN_ZONES = 391,
-    VAR_INSECURE_LAN_ZONES = 392,
-    VAR_INFRA_CACHE_MIN_RTT = 393,
-    VAR_DNS64_PREFIX = 394,
-    VAR_DNS64_SYNTHALL = 395,
-    VAR_DNSTAP = 396,
-    VAR_DNSTAP_ENABLE = 397,
-    VAR_DNSTAP_SOCKET_PATH = 398,
-    VAR_DNSTAP_SEND_IDENTITY = 399,
-    VAR_DNSTAP_SEND_VERSION = 400,
-    VAR_DNSTAP_IDENTITY = 401,
-    VAR_DNSTAP_VERSION = 402,
-    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 403,
-    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 404,
-    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 405,
-    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 406,
-    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 407,
-    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 408,
-    VAR_HARDEN_ALGO_DOWNGRADE = 409,
-    VAR_IP_TRANSPARENT = 410,
-    VAR_DISABLE_DNSSEC_LAME_CHECK = 411,
-    VAR_RATELIMIT = 412,
-    VAR_RATELIMIT_SLABS = 413,
-    VAR_RATELIMIT_SIZE = 414,
-    VAR_RATELIMIT_FOR_DOMAIN = 415,
-    VAR_RATELIMIT_BELOW_DOMAIN = 416,
-    VAR_RATELIMIT_FACTOR = 417,
-    VAR_CAPS_WHITELIST = 418,
-    VAR_CACHE_MAX_NEGATIVE_TTL = 419,
-    VAR_PERMIT_SMALL_HOLDDOWN = 420,
-    VAR_QNAME_MINIMISATION = 421,
-    VAR_IP_FREEBIND = 422,
-    VAR_DEFINE_TAG = 423,
-    VAR_LOCAL_ZONE_TAG = 424
+    VAR_PREFER_IP6 = 274,
+    VAR_DO_UDP = 275,
+    VAR_DO_TCP = 276,
+    VAR_TCP_MSS = 277,
+    VAR_OUTGOING_TCP_MSS = 278,
+    VAR_CHROOT = 279,
+    VAR_USERNAME = 280,
+    VAR_DIRECTORY = 281,
+    VAR_LOGFILE = 282,
+    VAR_PIDFILE = 283,
+    VAR_MSG_CACHE_SIZE = 284,
+    VAR_MSG_CACHE_SLABS = 285,
+    VAR_NUM_QUERIES_PER_THREAD = 286,
+    VAR_RRSET_CACHE_SIZE = 287,
+    VAR_RRSET_CACHE_SLABS = 288,
+    VAR_OUTGOING_NUM_TCP = 289,
+    VAR_INFRA_HOST_TTL = 290,
+    VAR_INFRA_LAME_TTL = 291,
+    VAR_INFRA_CACHE_SLABS = 292,
+    VAR_INFRA_CACHE_NUMHOSTS = 293,
+    VAR_INFRA_CACHE_LAME_SIZE = 294,
+    VAR_NAME = 295,
+    VAR_STUB_ZONE = 296,
+    VAR_STUB_HOST = 297,
+    VAR_STUB_ADDR = 298,
+    VAR_TARGET_FETCH_POLICY = 299,
+    VAR_HARDEN_SHORT_BUFSIZE = 300,
+    VAR_HARDEN_LARGE_QUERIES = 301,
+    VAR_FORWARD_ZONE = 302,
+    VAR_FORWARD_HOST = 303,
+    VAR_FORWARD_ADDR = 304,
+    VAR_DO_NOT_QUERY_ADDRESS = 305,
+    VAR_HIDE_IDENTITY = 306,
+    VAR_HIDE_VERSION = 307,
+    VAR_IDENTITY = 308,
+    VAR_VERSION = 309,
+    VAR_HARDEN_GLUE = 310,
+    VAR_MODULE_CONF = 311,
+    VAR_TRUST_ANCHOR_FILE = 312,
+    VAR_TRUST_ANCHOR = 313,
+    VAR_VAL_OVERRIDE_DATE = 314,
+    VAR_BOGUS_TTL = 315,
+    VAR_VAL_CLEAN_ADDITIONAL = 316,
+    VAR_VAL_PERMISSIVE_MODE = 317,
+    VAR_INCOMING_NUM_TCP = 318,
+    VAR_MSG_BUFFER_SIZE = 319,
+    VAR_KEY_CACHE_SIZE = 320,
+    VAR_KEY_CACHE_SLABS = 321,
+    VAR_TRUSTED_KEYS_FILE = 322,
+    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 323,
+    VAR_USE_SYSLOG = 324,
+    VAR_OUTGOING_INTERFACE = 325,
+    VAR_ROOT_HINTS = 326,
+    VAR_DO_NOT_QUERY_LOCALHOST = 327,
+    VAR_CACHE_MAX_TTL = 328,
+    VAR_HARDEN_DNSSEC_STRIPPED = 329,
+    VAR_ACCESS_CONTROL = 330,
+    VAR_LOCAL_ZONE = 331,
+    VAR_LOCAL_DATA = 332,
+    VAR_INTERFACE_AUTOMATIC = 333,
+    VAR_STATISTICS_INTERVAL = 334,
+    VAR_DO_DAEMONIZE = 335,
+    VAR_USE_CAPS_FOR_ID = 336,
+    VAR_STATISTICS_CUMULATIVE = 337,
+    VAR_OUTGOING_PORT_PERMIT = 338,
+    VAR_OUTGOING_PORT_AVOID = 339,
+    VAR_DLV_ANCHOR_FILE = 340,
+    VAR_DLV_ANCHOR = 341,
+    VAR_NEG_CACHE_SIZE = 342,
+    VAR_HARDEN_REFERRAL_PATH = 343,
+    VAR_PRIVATE_ADDRESS = 344,
+    VAR_PRIVATE_DOMAIN = 345,
+    VAR_REMOTE_CONTROL = 346,
+    VAR_CONTROL_ENABLE = 347,
+    VAR_CONTROL_INTERFACE = 348,
+    VAR_CONTROL_PORT = 349,
+    VAR_SERVER_KEY_FILE = 350,
+    VAR_SERVER_CERT_FILE = 351,
+    VAR_CONTROL_KEY_FILE = 352,
+    VAR_CONTROL_CERT_FILE = 353,
+    VAR_CONTROL_USE_CERT = 354,
+    VAR_EXTENDED_STATISTICS = 355,
+    VAR_LOCAL_DATA_PTR = 356,
+    VAR_JOSTLE_TIMEOUT = 357,
+    VAR_STUB_PRIME = 358,
+    VAR_UNWANTED_REPLY_THRESHOLD = 359,
+    VAR_LOG_TIME_ASCII = 360,
+    VAR_DOMAIN_INSECURE = 361,
+    VAR_PYTHON = 362,
+    VAR_PYTHON_SCRIPT = 363,
+    VAR_VAL_SIG_SKEW_MIN = 364,
+    VAR_VAL_SIG_SKEW_MAX = 365,
+    VAR_CACHE_MIN_TTL = 366,
+    VAR_VAL_LOG_LEVEL = 367,
+    VAR_AUTO_TRUST_ANCHOR_FILE = 368,
+    VAR_KEEP_MISSING = 369,
+    VAR_ADD_HOLDDOWN = 370,
+    VAR_DEL_HOLDDOWN = 371,
+    VAR_SO_RCVBUF = 372,
+    VAR_EDNS_BUFFER_SIZE = 373,
+    VAR_PREFETCH = 374,
+    VAR_PREFETCH_KEY = 375,
+    VAR_SO_SNDBUF = 376,
+    VAR_SO_REUSEPORT = 377,
+    VAR_HARDEN_BELOW_NXDOMAIN = 378,
+    VAR_IGNORE_CD_FLAG = 379,
+    VAR_LOG_QUERIES = 380,
+    VAR_TCP_UPSTREAM = 381,
+    VAR_SSL_UPSTREAM = 382,
+    VAR_SSL_SERVICE_KEY = 383,
+    VAR_SSL_SERVICE_PEM = 384,
+    VAR_SSL_PORT = 385,
+    VAR_FORWARD_FIRST = 386,
+    VAR_STUB_FIRST = 387,
+    VAR_MINIMAL_RESPONSES = 388,
+    VAR_RRSET_ROUNDROBIN = 389,
+    VAR_MAX_UDP_SIZE = 390,
+    VAR_DELAY_CLOSE = 391,
+    VAR_UNBLOCK_LAN_ZONES = 392,
+    VAR_INSECURE_LAN_ZONES = 393,
+    VAR_INFRA_CACHE_MIN_RTT = 394,
+    VAR_DNS64_PREFIX = 395,
+    VAR_DNS64_SYNTHALL = 396,
+    VAR_DNSTAP = 397,
+    VAR_DNSTAP_ENABLE = 398,
+    VAR_DNSTAP_SOCKET_PATH = 399,
+    VAR_DNSTAP_SEND_IDENTITY = 400,
+    VAR_DNSTAP_SEND_VERSION = 401,
+    VAR_DNSTAP_IDENTITY = 402,
+    VAR_DNSTAP_VERSION = 403,
+    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 404,
+    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 405,
+    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 406,
+    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 407,
+    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 408,
+    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 409,
+    VAR_HARDEN_ALGO_DOWNGRADE = 410,
+    VAR_IP_TRANSPARENT = 411,
+    VAR_DISABLE_DNSSEC_LAME_CHECK = 412,
+    VAR_RATELIMIT = 413,
+    VAR_RATELIMIT_SLABS = 414,
+    VAR_RATELIMIT_SIZE = 415,
+    VAR_RATELIMIT_FOR_DOMAIN = 416,
+    VAR_RATELIMIT_BELOW_DOMAIN = 417,
+    VAR_RATELIMIT_FACTOR = 418,
+    VAR_CAPS_WHITELIST = 419,
+    VAR_CACHE_MAX_NEGATIVE_TTL = 420,
+    VAR_PERMIT_SMALL_HOLDDOWN = 421,
+    VAR_QNAME_MINIMISATION = 422,
+    VAR_IP_FREEBIND = 423,
+    VAR_DEFINE_TAG = 424,
+    VAR_LOCAL_ZONE_TAG = 425,
+    VAR_ACCESS_CONTROL_TAG = 426,
+    VAR_LOCAL_ZONE_OVERRIDE = 427,
+    VAR_ACCESS_CONTROL_TAG_ACTION = 428,
+    VAR_ACCESS_CONTROL_TAG_DATA = 429
   };
 #endif
 /* Tokens.  */
@@ -310,157 +315,162 @@ extern int yydebug;
 #define VAR_INTERFACE 271
 #define VAR_DO_IP4 272
 #define VAR_DO_IP6 273
-#define VAR_DO_UDP 274
-#define VAR_DO_TCP 275
-#define VAR_TCP_MSS 276
-#define VAR_OUTGOING_TCP_MSS 277
-#define VAR_CHROOT 278
-#define VAR_USERNAME 279
-#define VAR_DIRECTORY 280
-#define VAR_LOGFILE 281
-#define VAR_PIDFILE 282
-#define VAR_MSG_CACHE_SIZE 283
-#define VAR_MSG_CACHE_SLABS 284
-#define VAR_NUM_QUERIES_PER_THREAD 285
-#define VAR_RRSET_CACHE_SIZE 286
-#define VAR_RRSET_CACHE_SLABS 287
-#define VAR_OUTGOING_NUM_TCP 288
-#define VAR_INFRA_HOST_TTL 289
-#define VAR_INFRA_LAME_TTL 290
-#define VAR_INFRA_CACHE_SLABS 291
-#define VAR_INFRA_CACHE_NUMHOSTS 292
-#define VAR_INFRA_CACHE_LAME_SIZE 293
-#define VAR_NAME 294
-#define VAR_STUB_ZONE 295
-#define VAR_STUB_HOST 296
-#define VAR_STUB_ADDR 297
-#define VAR_TARGET_FETCH_POLICY 298
-#define VAR_HARDEN_SHORT_BUFSIZE 299
-#define VAR_HARDEN_LARGE_QUERIES 300
-#define VAR_FORWARD_ZONE 301
-#define VAR_FORWARD_HOST 302
-#define VAR_FORWARD_ADDR 303
-#define VAR_DO_NOT_QUERY_ADDRESS 304
-#define VAR_HIDE_IDENTITY 305
-#define VAR_HIDE_VERSION 306
-#define VAR_IDENTITY 307
-#define VAR_VERSION 308
-#define VAR_HARDEN_GLUE 309
-#define VAR_MODULE_CONF 310
-#define VAR_TRUST_ANCHOR_FILE 311
-#define VAR_TRUST_ANCHOR 312
-#define VAR_VAL_OVERRIDE_DATE 313
-#define VAR_BOGUS_TTL 314
-#define VAR_VAL_CLEAN_ADDITIONAL 315
-#define VAR_VAL_PERMISSIVE_MODE 316
-#define VAR_INCOMING_NUM_TCP 317
-#define VAR_MSG_BUFFER_SIZE 318
-#define VAR_KEY_CACHE_SIZE 319
-#define VAR_KEY_CACHE_SLABS 320
-#define VAR_TRUSTED_KEYS_FILE 321
-#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 322
-#define VAR_USE_SYSLOG 323
-#define VAR_OUTGOING_INTERFACE 324
-#define VAR_ROOT_HINTS 325
-#define VAR_DO_NOT_QUERY_LOCALHOST 326
-#define VAR_CACHE_MAX_TTL 327
-#define VAR_HARDEN_DNSSEC_STRIPPED 328
-#define VAR_ACCESS_CONTROL 329
-#define VAR_LOCAL_ZONE 330
-#define VAR_LOCAL_DATA 331
-#define VAR_INTERFACE_AUTOMATIC 332
-#define VAR_STATISTICS_INTERVAL 333
-#define VAR_DO_DAEMONIZE 334
-#define VAR_USE_CAPS_FOR_ID 335
-#define VAR_STATISTICS_CUMULATIVE 336
-#define VAR_OUTGOING_PORT_PERMIT 337
-#define VAR_OUTGOING_PORT_AVOID 338
-#define VAR_DLV_ANCHOR_FILE 339
-#define VAR_DLV_ANCHOR 340
-#define VAR_NEG_CACHE_SIZE 341
-#define VAR_HARDEN_REFERRAL_PATH 342
-#define VAR_PRIVATE_ADDRESS 343
-#define VAR_PRIVATE_DOMAIN 344
-#define VAR_REMOTE_CONTROL 345
-#define VAR_CONTROL_ENABLE 346
-#define VAR_CONTROL_INTERFACE 347
-#define VAR_CONTROL_PORT 348
-#define VAR_SERVER_KEY_FILE 349
-#define VAR_SERVER_CERT_FILE 350
-#define VAR_CONTROL_KEY_FILE 351
-#define VAR_CONTROL_CERT_FILE 352
-#define VAR_CONTROL_USE_CERT 353
-#define VAR_EXTENDED_STATISTICS 354
-#define VAR_LOCAL_DATA_PTR 355
-#define VAR_JOSTLE_TIMEOUT 356
-#define VAR_STUB_PRIME 357
-#define VAR_UNWANTED_REPLY_THRESHOLD 358
-#define VAR_LOG_TIME_ASCII 359
-#define VAR_DOMAIN_INSECURE 360
-#define VAR_PYTHON 361
-#define VAR_PYTHON_SCRIPT 362
-#define VAR_VAL_SIG_SKEW_MIN 363
-#define VAR_VAL_SIG_SKEW_MAX 364
-#define VAR_CACHE_MIN_TTL 365
-#define VAR_VAL_LOG_LEVEL 366
-#define VAR_AUTO_TRUST_ANCHOR_FILE 367
-#define VAR_KEEP_MISSING 368
-#define VAR_ADD_HOLDDOWN 369
-#define VAR_DEL_HOLDDOWN 370
-#define VAR_SO_RCVBUF 371
-#define VAR_EDNS_BUFFER_SIZE 372
-#define VAR_PREFETCH 373
-#define VAR_PREFETCH_KEY 374
-#define VAR_SO_SNDBUF 375
-#define VAR_SO_REUSEPORT 376
-#define VAR_HARDEN_BELOW_NXDOMAIN 377
-#define VAR_IGNORE_CD_FLAG 378
-#define VAR_LOG_QUERIES 379
-#define VAR_TCP_UPSTREAM 380
-#define VAR_SSL_UPSTREAM 381
-#define VAR_SSL_SERVICE_KEY 382
-#define VAR_SSL_SERVICE_PEM 383
-#define VAR_SSL_PORT 384
-#define VAR_FORWARD_FIRST 385
-#define VAR_STUB_FIRST 386
-#define VAR_MINIMAL_RESPONSES 387
-#define VAR_RRSET_ROUNDROBIN 388
-#define VAR_MAX_UDP_SIZE 389
-#define VAR_DELAY_CLOSE 390
-#define VAR_UNBLOCK_LAN_ZONES 391
-#define VAR_INSECURE_LAN_ZONES 392
-#define VAR_INFRA_CACHE_MIN_RTT 393
-#define VAR_DNS64_PREFIX 394
-#define VAR_DNS64_SYNTHALL 395
-#define VAR_DNSTAP 396
-#define VAR_DNSTAP_ENABLE 397
-#define VAR_DNSTAP_SOCKET_PATH 398
-#define VAR_DNSTAP_SEND_IDENTITY 399
-#define VAR_DNSTAP_SEND_VERSION 400
-#define VAR_DNSTAP_IDENTITY 401
-#define VAR_DNSTAP_VERSION 402
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 403
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 404
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 405
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 406
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 407
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 408
-#define VAR_HARDEN_ALGO_DOWNGRADE 409
-#define VAR_IP_TRANSPARENT 410
-#define VAR_DISABLE_DNSSEC_LAME_CHECK 411
-#define VAR_RATELIMIT 412
-#define VAR_RATELIMIT_SLABS 413
-#define VAR_RATELIMIT_SIZE 414
-#define VAR_RATELIMIT_FOR_DOMAIN 415
-#define VAR_RATELIMIT_BELOW_DOMAIN 416
-#define VAR_RATELIMIT_FACTOR 417
-#define VAR_CAPS_WHITELIST 418
-#define VAR_CACHE_MAX_NEGATIVE_TTL 419
-#define VAR_PERMIT_SMALL_HOLDDOWN 420
-#define VAR_QNAME_MINIMISATION 421
-#define VAR_IP_FREEBIND 422
-#define VAR_DEFINE_TAG 423
-#define VAR_LOCAL_ZONE_TAG 424
+#define VAR_PREFER_IP6 274
+#define VAR_DO_UDP 275
+#define VAR_DO_TCP 276
+#define VAR_TCP_MSS 277
+#define VAR_OUTGOING_TCP_MSS 278
+#define VAR_CHROOT 279
+#define VAR_USERNAME 280
+#define VAR_DIRECTORY 281
+#define VAR_LOGFILE 282
+#define VAR_PIDFILE 283
+#define VAR_MSG_CACHE_SIZE 284
+#define VAR_MSG_CACHE_SLABS 285
+#define VAR_NUM_QUERIES_PER_THREAD 286
+#define VAR_RRSET_CACHE_SIZE 287
+#define VAR_RRSET_CACHE_SLABS 288
+#define VAR_OUTGOING_NUM_TCP 289
+#define VAR_INFRA_HOST_TTL 290
+#define VAR_INFRA_LAME_TTL 291
+#define VAR_INFRA_CACHE_SLABS 292
+#define VAR_INFRA_CACHE_NUMHOSTS 293
+#define VAR_INFRA_CACHE_LAME_SIZE 294
+#define VAR_NAME 295
+#define VAR_STUB_ZONE 296
+#define VAR_STUB_HOST 297
+#define VAR_STUB_ADDR 298
+#define VAR_TARGET_FETCH_POLICY 299
+#define VAR_HARDEN_SHORT_BUFSIZE 300
+#define VAR_HARDEN_LARGE_QUERIES 301
+#define VAR_FORWARD_ZONE 302
+#define VAR_FORWARD_HOST 303
+#define VAR_FORWARD_ADDR 304
+#define VAR_DO_NOT_QUERY_ADDRESS 305
+#define VAR_HIDE_IDENTITY 306
+#define VAR_HIDE_VERSION 307
+#define VAR_IDENTITY 308
+#define VAR_VERSION 309
+#define VAR_HARDEN_GLUE 310
+#define VAR_MODULE_CONF 311
+#define VAR_TRUST_ANCHOR_FILE 312
+#define VAR_TRUST_ANCHOR 313
+#define VAR_VAL_OVERRIDE_DATE 314
+#define VAR_BOGUS_TTL 315
+#define VAR_VAL_CLEAN_ADDITIONAL 316
+#define VAR_VAL_PERMISSIVE_MODE 317
+#define VAR_INCOMING_NUM_TCP 318
+#define VAR_MSG_BUFFER_SIZE 319
+#define VAR_KEY_CACHE_SIZE 320
+#define VAR_KEY_CACHE_SLABS 321
+#define VAR_TRUSTED_KEYS_FILE 322
+#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 323
+#define VAR_USE_SYSLOG 324
+#define VAR_OUTGOING_INTERFACE 325
+#define VAR_ROOT_HINTS 326
+#define VAR_DO_NOT_QUERY_LOCALHOST 327
+#define VAR_CACHE_MAX_TTL 328
+#define VAR_HARDEN_DNSSEC_STRIPPED 329
+#define VAR_ACCESS_CONTROL 330
+#define VAR_LOCAL_ZONE 331
+#define VAR_LOCAL_DATA 332
+#define VAR_INTERFACE_AUTOMATIC 333
+#define VAR_STATISTICS_INTERVAL 334
+#define VAR_DO_DAEMONIZE 335
+#define VAR_USE_CAPS_FOR_ID 336
+#define VAR_STATISTICS_CUMULATIVE 337
+#define VAR_OUTGOING_PORT_PERMIT 338
+#define VAR_OUTGOING_PORT_AVOID 339
+#define VAR_DLV_ANCHOR_FILE 340
+#define VAR_DLV_ANCHOR 341
+#define VAR_NEG_CACHE_SIZE 342
+#define VAR_HARDEN_REFERRAL_PATH 343
+#define VAR_PRIVATE_ADDRESS 344
+#define VAR_PRIVATE_DOMAIN 345
+#define VAR_REMOTE_CONTROL 346
+#define VAR_CONTROL_ENABLE 347
+#define VAR_CONTROL_INTERFACE 348
+#define VAR_CONTROL_PORT 349
+#define VAR_SERVER_KEY_FILE 350
+#define VAR_SERVER_CERT_FILE 351
+#define VAR_CONTROL_KEY_FILE 352
+#define VAR_CONTROL_CERT_FILE 353
+#define VAR_CONTROL_USE_CERT 354
+#define VAR_EXTENDED_STATISTICS 355
+#define VAR_LOCAL_DATA_PTR 356
+#define VAR_JOSTLE_TIMEOUT 357
+#define VAR_STUB_PRIME 358
+#define VAR_UNWANTED_REPLY_THRESHOLD 359
+#define VAR_LOG_TIME_ASCII 360
+#define VAR_DOMAIN_INSECURE 361
+#define VAR_PYTHON 362
+#define VAR_PYTHON_SCRIPT 363
+#define VAR_VAL_SIG_SKEW_MIN 364
+#define VAR_VAL_SIG_SKEW_MAX 365
+#define VAR_CACHE_MIN_TTL 366
+#define VAR_VAL_LOG_LEVEL 367
+#define VAR_AUTO_TRUST_ANCHOR_FILE 368
+#define VAR_KEEP_MISSING 369
+#define VAR_ADD_HOLDDOWN 370
+#define VAR_DEL_HOLDDOWN 371
+#define VAR_SO_RCVBUF 372
+#define VAR_EDNS_BUFFER_SIZE 373
+#define VAR_PREFETCH 374
+#define VAR_PREFETCH_KEY 375
+#define VAR_SO_SNDBUF 376
+#define VAR_SO_REUSEPORT 377
+#define VAR_HARDEN_BELOW_NXDOMAIN 378
+#define VAR_IGNORE_CD_FLAG 379
+#define VAR_LOG_QUERIES 380
+#define VAR_TCP_UPSTREAM 381
+#define VAR_SSL_UPSTREAM 382
+#define VAR_SSL_SERVICE_KEY 383
+#define VAR_SSL_SERVICE_PEM 384
+#define VAR_SSL_PORT 385
+#define VAR_FORWARD_FIRST 386
+#define VAR_STUB_FIRST 387
+#define VAR_MINIMAL_RESPONSES 388
+#define VAR_RRSET_ROUNDROBIN 389
+#define VAR_MAX_UDP_SIZE 390
+#define VAR_DELAY_CLOSE 391
+#define VAR_UNBLOCK_LAN_ZONES 392
+#define VAR_INSECURE_LAN_ZONES 393
+#define VAR_INFRA_CACHE_MIN_RTT 394
+#define VAR_DNS64_PREFIX 395
+#define VAR_DNS64_SYNTHALL 396
+#define VAR_DNSTAP 397
+#define VAR_DNSTAP_ENABLE 398
+#define VAR_DNSTAP_SOCKET_PATH 399
+#define VAR_DNSTAP_SEND_IDENTITY 400
+#define VAR_DNSTAP_SEND_VERSION 401
+#define VAR_DNSTAP_IDENTITY 402
+#define VAR_DNSTAP_VERSION 403
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 404
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 405
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 406
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 407
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 408
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 409
+#define VAR_HARDEN_ALGO_DOWNGRADE 410
+#define VAR_IP_TRANSPARENT 411
+#define VAR_DISABLE_DNSSEC_LAME_CHECK 412
+#define VAR_RATELIMIT 413
+#define VAR_RATELIMIT_SLABS 414
+#define VAR_RATELIMIT_SIZE 415
+#define VAR_RATELIMIT_FOR_DOMAIN 416
+#define VAR_RATELIMIT_BELOW_DOMAIN 417
+#define VAR_RATELIMIT_FACTOR 418
+#define VAR_CAPS_WHITELIST 419
+#define VAR_CACHE_MAX_NEGATIVE_TTL 420
+#define VAR_PERMIT_SMALL_HOLDDOWN 421
+#define VAR_QNAME_MINIMISATION 422
+#define VAR_IP_FREEBIND 423
+#define VAR_DEFINE_TAG 424
+#define VAR_LOCAL_ZONE_TAG 425
+#define VAR_ACCESS_CONTROL_TAG 426
+#define VAR_LOCAL_ZONE_OVERRIDE 427
+#define VAR_ACCESS_CONTROL_TAG_ACTION 428
+#define VAR_ACCESS_CONTROL_TAG_DATA 429
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -471,7 +481,7 @@ union YYSTYPE
 
 	char*	str;
 
-#line 475 "util/configparser.c" /* yacc.c:355  */
+#line 485 "util/configparser.c" /* yacc.c:355  */
 };
 
 typedef union YYSTYPE YYSTYPE;
@@ -488,7 +498,7 @@ int yyparse (void);
 
 /* Copy the second part of user declarations.  */
 
-#line 492 "util/configparser.c" /* yacc.c:358  */
+#line 502 "util/configparser.c" /* yacc.c:358  */
 
 #ifdef short
 # undef short
@@ -730,21 +740,21 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  2
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   319
+#define YYLAST   337
 
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  170
+#define YYNTOKENS  175
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  175
+#define YYNNTS  180
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  335
+#define YYNRULES  345
 /* YYNSTATES -- Number of states.  */
-#define YYNSTATES  495
+#define YYNSTATES  517
 
 /* YYTRANSLATE[YYX] -- Symbol number corresponding to YYX as returned
    by yylex, with out-of-bounds checking.  */
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   424
+#define YYMAXUTOK   429
 
 #define YYTRANSLATE(YYX)                                                \
   ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
@@ -795,47 +805,48 @@ static const yytype_uint8 yytranslate[] =
      135,   136,   137,   138,   139,   140,   141,   142,   143,   144,
      145,   146,   147,   148,   149,   150,   151,   152,   153,   154,
      155,   156,   157,   158,   159,   160,   161,   162,   163,   164,
-     165,   166,   167,   168,   169
+     165,   166,   167,   168,   169,   170,   171,   172,   173,   174
 };
 
 #if YYDEBUG
   /* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   131,   131,   131,   132,   132,   133,   133,   134,   134,
-     138,   143,   144,   145,   145,   145,   146,   146,   147,   147,
-     147,   148,   148,   149,   149,   149,   150,   150,   150,   151,
-     151,   152,   152,   153,   153,   154,   154,   155,   155,   156,
-     156,   157,   157,   158,   158,   159,   159,   159,   160,   160,
-     160,   161,   161,   161,   162,   162,   163,   163,   164,   164,
-     165,   165,   166,   166,   166,   167,   167,   168,   168,   169,
-     169,   169,   170,   170,   171,   171,   172,   172,   173,   173,
-     173,   174,   174,   175,   175,   176,   176,   177,   177,   178,
-     178,   179,   179,   179,   180,   180,   181,   181,   181,   182,
-     182,   182,   183,   183,   183,   184,   184,   184,   185,   185,
-     185,   186,   186,   186,   187,   187,   188,   188,   189,   189,
-     190,   190,   191,   191,   191,   192,   192,   193,   193,   194,
-     194,   195,   195,   196,   196,   196,   197,   199,   211,   212,
-     213,   213,   213,   213,   213,   215,   227,   228,   229,   229,
-     229,   229,   231,   240,   249,   260,   269,   278,   287,   300,
-     315,   324,   333,   342,   351,   360,   369,   378,   387,   396,
-     405,   414,   423,   432,   441,   448,   455,   464,   473,   487,
-     496,   505,   512,   519,   526,   534,   541,   548,   555,   562,
-     570,   578,   586,   593,   600,   609,   618,   625,   632,   640,
-     648,   658,   668,   678,   691,   702,   710,   723,   732,   741,
-     750,   760,   770,   778,   791,   800,   808,   817,   825,   838,
-     847,   854,   864,   874,   884,   894,   904,   914,   924,   934,
-     941,   948,   955,   964,   973,   982,   989,   999,  1016,  1023,
-    1041,  1054,  1067,  1076,  1085,  1094,  1103,  1113,  1123,  1132,
-    1141,  1148,  1157,  1166,  1175,  1184,  1192,  1205,  1213,  1237,
-    1244,  1259,  1269,  1279,  1286,  1293,  1302,  1316,  1335,  1344,
-    1352,  1365,  1378,  1391,  1400,  1410,  1420,  1427,  1434,  1443,
-    1453,  1463,  1470,  1477,  1486,  1491,  1492,  1493,  1493,  1493,
-    1494,  1494,  1494,  1495,  1495,  1497,  1507,  1516,  1523,  1533,
-    1540,  1547,  1554,  1561,  1566,  1567,  1568,  1568,  1569,  1569,
-    1570,  1570,  1571,  1572,  1573,  1574,  1575,  1576,  1578,  1586,
-    1593,  1601,  1609,  1616,  1623,  1632,  1641,  1650,  1659,  1668,
-    1677,  1682,  1683,  1684,  1686,  1692
+       0,   133,   133,   133,   134,   134,   135,   135,   136,   136,
+     140,   145,   146,   147,   147,   147,   148,   148,   149,   149,
+     150,   150,   151,   151,   152,   152,   152,   153,   153,   153,
+     154,   154,   155,   155,   156,   156,   157,   157,   158,   158,
+     159,   159,   160,   160,   161,   161,   162,   162,   162,   163,
+     163,   163,   164,   164,   164,   165,   165,   166,   166,   167,
+     167,   168,   168,   169,   169,   169,   170,   170,   171,   171,
+     172,   172,   172,   173,   173,   174,   174,   175,   175,   176,
+     176,   176,   177,   177,   178,   178,   179,   179,   180,   180,
+     181,   181,   182,   182,   182,   183,   183,   184,   184,   184,
+     185,   185,   185,   186,   186,   186,   187,   187,   187,   188,
+     188,   188,   189,   189,   189,   190,   190,   191,   191,   192,
+     192,   193,   193,   194,   194,   194,   195,   195,   196,   196,
+     197,   197,   198,   198,   199,   199,   199,   200,   200,   201,
+     201,   202,   204,   216,   217,   218,   218,   218,   218,   218,
+     220,   232,   233,   234,   234,   234,   234,   236,   245,   254,
+     265,   274,   283,   292,   305,   320,   329,   338,   347,   356,
+     365,   374,   383,   392,   401,   410,   419,   428,   437,   446,
+     455,   462,   469,   478,   487,   501,   510,   519,   526,   533,
+     557,   565,   572,   579,   586,   593,   601,   609,   617,   624,
+     631,   640,   649,   656,   663,   671,   679,   689,   699,   709,
+     722,   733,   741,   754,   763,   772,   781,   791,   801,   809,
+     822,   831,   839,   848,   856,   869,   878,   885,   895,   905,
+     915,   925,   935,   945,   955,   965,   972,   979,   986,   995,
+    1004,  1013,  1020,  1030,  1047,  1054,  1072,  1085,  1098,  1107,
+    1116,  1125,  1134,  1144,  1154,  1163,  1172,  1179,  1188,  1197,
+    1206,  1215,  1223,  1236,  1244,  1272,  1279,  1294,  1304,  1314,
+    1321,  1328,  1337,  1351,  1370,  1389,  1401,  1413,  1425,  1434,
+    1442,  1455,  1468,  1481,  1490,  1500,  1510,  1517,  1524,  1533,
+    1543,  1553,  1560,  1567,  1576,  1581,  1582,  1583,  1583,  1583,
+    1584,  1584,  1584,  1585,  1585,  1587,  1597,  1606,  1613,  1623,
+    1630,  1637,  1644,  1651,  1656,  1657,  1658,  1658,  1659,  1659,
+    1660,  1660,  1661,  1662,  1663,  1664,  1665,  1666,  1668,  1676,
+    1683,  1691,  1699,  1706,  1713,  1722,  1731,  1740,  1749,  1758,
+    1767,  1772,  1773,  1774,  1776,  1782
 };
 #endif
 
@@ -847,9 +858,9 @@ static const char *const yytname[] =
   "$end", "error", "$undefined", "SPACE", "LETTER", "NEWLINE", "COMMENT",
   "COLON", "ANY", "ZONESTR", "STRING_ARG", "VAR_SERVER", "VAR_VERBOSITY",
   "VAR_NUM_THREADS", "VAR_PORT", "VAR_OUTGOING_RANGE", "VAR_INTERFACE",
-  "VAR_DO_IP4", "VAR_DO_IP6", "VAR_DO_UDP", "VAR_DO_TCP", "VAR_TCP_MSS",
-  "VAR_OUTGOING_TCP_MSS", "VAR_CHROOT", "VAR_USERNAME", "VAR_DIRECTORY",
-  "VAR_LOGFILE", "VAR_PIDFILE", "VAR_MSG_CACHE_SIZE",
+  "VAR_DO_IP4", "VAR_DO_IP6", "VAR_PREFER_IP6", "VAR_DO_UDP", "VAR_DO_TCP",
+  "VAR_TCP_MSS", "VAR_OUTGOING_TCP_MSS", "VAR_CHROOT", "VAR_USERNAME",
+  "VAR_DIRECTORY", "VAR_LOGFILE", "VAR_PIDFILE", "VAR_MSG_CACHE_SIZE",
   "VAR_MSG_CACHE_SLABS", "VAR_NUM_QUERIES_PER_THREAD",
   "VAR_RRSET_CACHE_SIZE", "VAR_RRSET_CACHE_SLABS", "VAR_OUTGOING_NUM_TCP",
   "VAR_INFRA_HOST_TTL", "VAR_INFRA_LAME_TTL", "VAR_INFRA_CACHE_SLABS",
@@ -903,17 +914,19 @@ static const char *const yytname[] =
   "VAR_RATELIMIT_BELOW_DOMAIN", "VAR_RATELIMIT_FACTOR",
   "VAR_CAPS_WHITELIST", "VAR_CACHE_MAX_NEGATIVE_TTL",
   "VAR_PERMIT_SMALL_HOLDDOWN", "VAR_QNAME_MINIMISATION", "VAR_IP_FREEBIND",
-  "VAR_DEFINE_TAG", "VAR_LOCAL_ZONE_TAG", "$accept", "toplevelvars",
-  "toplevelvar", "serverstart", "contents_server", "content_server",
-  "stubstart", "contents_stub", "content_stub", "forwardstart",
-  "contents_forward", "content_forward", "server_num_threads",
-  "server_verbosity", "server_statistics_interval",
-  "server_statistics_cumulative", "server_extended_statistics",
-  "server_port", "server_interface", "server_outgoing_interface",
-  "server_outgoing_range", "server_outgoing_port_permit",
-  "server_outgoing_port_avoid", "server_outgoing_num_tcp",
-  "server_incoming_num_tcp", "server_interface_automatic", "server_do_ip4",
-  "server_do_ip6", "server_do_udp", "server_do_tcp", "server_tcp_mss",
+  "VAR_DEFINE_TAG", "VAR_LOCAL_ZONE_TAG", "VAR_ACCESS_CONTROL_TAG",
+  "VAR_LOCAL_ZONE_OVERRIDE", "VAR_ACCESS_CONTROL_TAG_ACTION",
+  "VAR_ACCESS_CONTROL_TAG_DATA", "$accept", "toplevelvars", "toplevelvar",
+  "serverstart", "contents_server", "content_server", "stubstart",
+  "contents_stub", "content_stub", "forwardstart", "contents_forward",
+  "content_forward", "server_num_threads", "server_verbosity",
+  "server_statistics_interval", "server_statistics_cumulative",
+  "server_extended_statistics", "server_port", "server_interface",
+  "server_outgoing_interface", "server_outgoing_range",
+  "server_outgoing_port_permit", "server_outgoing_port_avoid",
+  "server_outgoing_num_tcp", "server_incoming_num_tcp",
+  "server_interface_automatic", "server_do_ip4", "server_do_ip6",
+  "server_do_udp", "server_do_tcp", "server_prefer_ip6", "server_tcp_mss",
   "server_outgoing_tcp_mss", "server_tcp_upstream", "server_ssl_upstream",
   "server_ssl_service_key", "server_ssl_service_pem", "server_ssl_port",
   "server_do_daemonize", "server_use_syslog", "server_log_time_ascii",
@@ -955,6 +968,8 @@ static const char *const yytname[] =
   "server_local_data", "server_local_data_ptr", "server_minimal_responses",
   "server_rrset_roundrobin", "server_max_udp_size", "server_dns64_prefix",
   "server_dns64_synthall", "server_define_tag", "server_local_zone_tag",
+  "server_access_control_tag", "server_access_control_tag_action",
+  "server_access_control_tag_data", "server_local_zone_override",
   "server_ratelimit", "server_ratelimit_size", "server_ratelimit_slabs",
   "server_ratelimit_for_domain", "server_ratelimit_below_domain",
   "server_ratelimit_factor", "server_qname_minimisation", "stub_name",
@@ -998,7 +1013,8 @@ static const yytype_uint16 yytoknum[] =
      385,   386,   387,   388,   389,   390,   391,   392,   393,   394,
      395,   396,   397,   398,   399,   400,   401,   402,   403,   404,
      405,   406,   407,   408,   409,   410,   411,   412,   413,   414,
-     415,   416,   417,   418,   419,   420,   421,   422,   423,   424
+     415,   416,   417,   418,   419,   420,   421,   422,   423,   424,
+     425,   426,   427,   428,   429
 };
 # endif
 
@@ -1016,21 +1032,22 @@ static const yytype_uint16 yytoknum[] =
      STATE-NUM.  */
 static const yytype_int16 yypact[] =
 {
-     -81,   118,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
-     -81,   -81,   -81,   -81,   -81,   -81,   -12,    39,    47,    40,
-      36,   -80,    18,    19,    20,    24,    25,    26,    69,    72,
-      73,    74,    75,    80,   109,   120,   129,   130,   149,   150,
-     151,   152,   153,   155,   156,   157,   158,   159,   161,   162,
-     163,   164,   165,   166,   180,   181,   182,   183,   184,   185,
-     186,   187,   188,   189,   190,   191,   192,   193,   194,   195,
-     196,   197,   199,   200,   201,   202,   203,   204,   205,   206,
-     207,   208,   209,   210,   211,   212,   213,   215,   216,   217,
-     218,   219,   220,   221,   222,   223,   224,   225,   226,   227,
-     228,   229,   230,   231,   232,   233,   234,   235,   236,   237,
-     238,   239,   240,   241,   242,   243,   244,   245,   246,   247,
-     248,   250,   251,   252,   253,   254,   255,   256,   257,   258,
-     259,   260,   261,   262,   263,   264,   265,   266,   267,   268,
-     269,   270,   271,   272,   273,   274,   -81,   -81,   -81,   -81,
+     -81,   130,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -12,    91,    47,   -13,
+      36,   -80,    19,    20,    21,    25,    26,    27,    81,   109,
+     110,   122,   125,   126,   127,   128,   129,   132,   153,   154,
+     155,   156,   157,   158,   159,   160,   162,   163,   164,   165,
+     166,   181,   182,   183,   185,   186,   187,   188,   189,   190,
+     191,   192,   193,   194,   195,   196,   197,   198,   199,   200,
+     201,   202,   203,   204,   205,   206,   207,   208,   209,   210,
+     212,   214,   215,   216,   217,   218,   219,   220,   221,   222,
+     223,   224,   225,   226,   228,   229,   230,   231,   232,   233,
+     234,   235,   236,   237,   238,   239,   240,   241,   242,   243,
+     244,   245,   246,   247,   248,   249,   250,   251,   252,   253,
+     254,   255,   256,   257,   258,   259,   260,   261,   263,   264,
+     265,   266,   267,   268,   269,   270,   271,   272,   273,   274,
+     275,   276,   277,   278,   279,   280,   281,   282,   283,   284,
+     285,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
@@ -1043,29 +1060,30 @@ static const yytype_int16 yypact[] =
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
-     -81,   275,   276,   277,   278,   279,   -81,   -81,   -81,   -81,
-     -81,   -81,   280,   281,   282,   283,   -81,   -81,   -81,   -81,
-     -81,   284,   285,   286,   287,   288,   289,   290,   291,   -81,
-     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   292,   293,
-     294,   295,   296,   297,   298,   299,   300,   301,   302,   303,
+     -81,   286,   287,   288,   289,   290,   -81,   -81,   -81,   -81,
+     -81,   -81,   291,   292,   293,   294,   -81,   -81,   -81,   -81,
+     -81,   295,   296,   297,   298,   299,   300,   301,   302,   -81,
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   303,   304,
+     305,   306,   307,   308,   309,   310,   311,   312,   313,   314,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
-     -81,   -81,   -81,   304,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   -81,   315,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
-     -81,   305,   306,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     -81,   -81,   316,   317,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
-     307,   308,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   309,
+     -81,   318,   319,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
+     320,   321,   322,   323,   324,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
-     -81,   -81,   -81,   -81,   -81
+     -81,   325,   326,   327,   -81,   -81,   -81
 };
 
   /* YYDEFACT[STATE-NUM] -- Default reduction number in state STATE-NUM.
@@ -1073,8 +1091,8 @@ static const yytype_int16 yypact[] =
      means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-       2,     0,     1,    10,   137,   145,   284,   330,   303,     3,
-      12,   139,   147,   286,   305,   332,     4,     5,     6,     8,
+       2,     0,     1,    10,   142,   150,   294,   340,   313,     3,
+      12,   144,   152,   296,   315,   342,     4,     5,     6,     8,
        9,     7,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
@@ -1087,42 +1105,44 @@ static const yytype_uint16 yydefact[] =
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,    11,    13,    14,    72,
-      75,    84,    15,    23,    63,    16,    76,    77,    34,    56,
-      71,    17,    18,    19,    20,    21,    22,   106,   107,   108,
-     109,   110,    73,    62,    88,   105,    24,    25,    26,    27,
-      28,    64,    78,    79,    94,    50,    60,    51,    89,    44,
-      45,    46,    47,    98,   102,   114,   122,   133,    99,    57,
-      29,    30,    31,    86,   115,   116,   117,    32,    33,    35,
-      36,    38,    39,    37,   120,    40,    41,    42,    48,    67,
-     103,    81,   121,    74,   129,    82,    83,   100,   101,    87,
-      43,    65,    68,    49,    52,    90,    91,    66,   130,    92,
-      53,    54,    55,   104,    93,    61,    95,    96,    97,   131,
-      58,    59,    80,    69,    70,    85,   111,   112,   113,   118,
-     119,   134,   135,   123,   125,   124,   126,   127,   128,   132,
-     136,     0,     0,     0,     0,     0,   138,   140,   141,   142,
-     144,   143,     0,     0,     0,     0,   146,   148,   149,   150,
-     151,     0,     0,     0,     0,     0,     0,     0,     0,   285,
-     287,   289,   288,   294,   290,   291,   292,   293,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-     304,   306,   307,   308,   309,   310,   311,   312,   313,   314,
-     315,   316,   317,     0,   331,   333,   153,   152,   157,   160,
-     158,   166,   167,   168,   169,   170,   171,   181,   182,   183,
-     184,   185,   205,   206,   207,   212,   213,   163,   214,   215,
-     218,   216,   217,   220,   221,   222,   235,   194,   195,   196,
-     197,   223,   238,   190,   192,   239,   245,   246,   247,   164,
-     204,   255,   256,   191,   250,   178,   159,   186,   236,   242,
-     224,     0,     0,   259,   165,   154,   177,   228,   155,   161,
-     162,   187,   188,   257,   226,   230,   231,   156,   260,   208,
-     234,   179,   193,   240,   241,   244,   249,   189,   253,   251,
-     252,   198,   203,   232,   233,   199,   200,   225,   248,   180,
-     172,   173,   174,   175,   176,   261,   262,   263,   209,   210,
-     211,   219,   264,   265,   227,   201,   335,   268,   270,   269,
-       0,     0,   273,   229,   243,   254,   274,   202,   266,     0,
-     275,   276,   277,   279,   278,   280,   281,   282,   283,   295,
-     297,   296,   299,   300,   301,   302,   298,   318,   319,   320,
-     321,   322,   323,   324,   325,   326,   327,   328,   329,   334,
-     237,   258,   271,   272,   267
+       0,    11,    13,    14,    73,    76,    85,    15,    24,    64,
+      16,    77,    78,    35,    57,    72,    17,    18,    20,    21,
+      19,    22,    23,   107,   108,   109,   110,   111,    74,    63,
+      89,   106,    25,    26,    27,    28,    29,    65,    79,    80,
+      95,    51,    61,    52,    90,    45,    46,    47,    48,    99,
+     103,   115,   123,   134,   100,    58,    30,    31,    32,    87,
+     116,   117,   118,    33,    34,    36,    37,    39,    40,    38,
+     121,    41,    42,    43,    49,    68,   104,    82,   122,    75,
+     130,    83,    84,   101,   102,    88,    44,    66,    69,    50,
+      53,    91,    92,    67,   131,    93,    54,    55,    56,   105,
+      94,    62,    96,    97,    98,   132,    59,    60,    81,    70,
+      71,    86,   112,   113,   114,   119,   120,   135,   136,   138,
+     140,   141,   139,   124,   126,   125,   127,   128,   129,   133,
+     137,     0,     0,     0,     0,     0,   143,   145,   146,   147,
+     149,   148,     0,     0,     0,     0,   151,   153,   154,   155,
+     156,     0,     0,     0,     0,     0,     0,     0,     0,   295,
+     297,   299,   298,   304,   300,   301,   302,   303,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+     314,   316,   317,   318,   319,   320,   321,   322,   323,   324,
+     325,   326,   327,     0,   341,   343,   158,   157,   162,   165,
+     163,   171,   172,   175,   173,   174,   176,   177,   187,   188,
+     189,   190,   191,   211,   212,   213,   218,   219,   168,   220,
+     221,   224,   222,   223,   226,   227,   228,   241,   200,   201,
+     202,   203,   229,   244,   196,   198,   245,   251,   252,   253,
+     169,   210,   261,   262,   197,   256,   184,   164,   192,   242,
+     248,   230,     0,     0,   265,   170,   159,   183,   234,   160,
+     166,   167,   193,   194,   263,   232,   236,   237,   161,   266,
+     214,   240,   185,   199,   246,   247,   250,   255,   195,   259,
+     257,   258,   204,   209,   238,   239,   205,   206,   231,   254,
+     186,   178,   179,   180,   181,   182,   267,   268,   269,   215,
+     216,   217,   225,   270,   271,   233,   207,   345,   278,   280,
+     279,     0,     0,   283,   235,   249,   260,   284,   208,   272,
+       0,     0,     0,     0,     0,   285,   286,   287,   289,   288,
+     290,   291,   292,   293,   305,   307,   306,   309,   310,   311,
+     312,   308,   328,   329,   330,   331,   332,   333,   334,   335,
+     336,   337,   338,   339,   344,   243,   264,   281,   282,   273,
+     274,     0,     0,     0,   277,   275,   276
 };
 
   /* YYPGOTO[NTERM-NUM].  */
@@ -1145,30 +1165,30 @@ static const yytype_int8 yypgoto[] =
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
      -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,
-     -81,   -81,   -81,   -81,   -81
+     -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81,   -81
 };
 
   /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     1,     9,    10,    16,   146,    11,    17,   276,    12,
-      18,   286,   147,   148,   149,   150,   151,   152,   153,   154,
-     155,   156,   157,   158,   159,   160,   161,   162,   163,   164,
-     165,   166,   167,   168,   169,   170,   171,   172,   173,   174,
-     175,   176,   177,   178,   179,   180,   181,   182,   183,   184,
-     185,   186,   187,   188,   189,   190,   191,   192,   193,   194,
-     195,   196,   197,   198,   199,   200,   201,   202,   203,   204,
-     205,   206,   207,   208,   209,   210,   211,   212,   213,   214,
-     215,   216,   217,   218,   219,   220,   221,   222,   223,   224,
-     225,   226,   227,   228,   229,   230,   231,   232,   233,   234,
-     235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
-     245,   246,   247,   248,   249,   250,   251,   252,   253,   254,
-     255,   256,   257,   258,   259,   260,   261,   262,   263,   264,
-     265,   266,   267,   268,   269,   277,   278,   279,   280,   281,
-     287,   288,   289,   290,    13,    19,   299,   300,   301,   302,
-     303,   304,   305,   306,   307,    14,    20,   320,   321,   322,
-     323,   324,   325,   326,   327,   328,   329,   330,   331,   332,
-      15,    21,   334,   335,   270
+      -1,     1,     9,    10,    16,   151,    11,    17,   286,    12,
+      18,   296,   152,   153,   154,   155,   156,   157,   158,   159,
+     160,   161,   162,   163,   164,   165,   166,   167,   168,   169,
+     170,   171,   172,   173,   174,   175,   176,   177,   178,   179,
+     180,   181,   182,   183,   184,   185,   186,   187,   188,   189,
+     190,   191,   192,   193,   194,   195,   196,   197,   198,   199,
+     200,   201,   202,   203,   204,   205,   206,   207,   208,   209,
+     210,   211,   212,   213,   214,   215,   216,   217,   218,   219,
+     220,   221,   222,   223,   224,   225,   226,   227,   228,   229,
+     230,   231,   232,   233,   234,   235,   236,   237,   238,   239,
+     240,   241,   242,   243,   244,   245,   246,   247,   248,   249,
+     250,   251,   252,   253,   254,   255,   256,   257,   258,   259,
+     260,   261,   262,   263,   264,   265,   266,   267,   268,   269,
+     270,   271,   272,   273,   274,   275,   276,   277,   278,   279,
+     287,   288,   289,   290,   291,   297,   298,   299,   300,    13,
+      19,   309,   310,   311,   312,   313,   314,   315,   316,   317,
+      14,    20,   330,   331,   332,   333,   334,   335,   336,   337,
+     338,   339,   340,   341,   342,    15,    21,   344,   345,   280
 };
 
   /* YYTABLE[YYPACT[STATE-NUM]] -- What to do in state STATE-NUM.  If
@@ -1178,94 +1198,98 @@ static const yytype_uint16 yytable[] =
 {
       22,    23,    24,    25,    26,    27,    28,    29,    30,    31,
       32,    33,    34,    35,    36,    37,    38,    39,    40,    41,
-      42,    43,    44,    45,    46,    47,    48,   333,   336,   337,
-     338,    49,    50,    51,   339,   340,   341,    52,    53,    54,
+      42,    43,    44,    45,    46,    47,    48,    49,   343,   346,
+     347,   348,    50,    51,    52,   349,   350,   351,    53,    54,
       55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
       65,    66,    67,    68,    69,    70,    71,    72,    73,    74,
       75,    76,    77,    78,    79,    80,    81,    82,    83,    84,
-      85,    86,    87,    88,    89,    90,    91,    92,   271,   342,
-     272,   273,   343,   344,   345,   346,   282,    93,    94,    95,
-     347,    96,    97,    98,   283,   284,    99,   100,   101,   102,
+      85,    86,    87,    88,    89,    90,    91,    92,    93,   301,
+     302,   303,   304,   305,   306,   307,   308,   292,    94,    95,
+      96,   352,    97,    98,    99,   293,   294,   100,   101,   102,
      103,   104,   105,   106,   107,   108,   109,   110,   111,   112,
-     113,   114,   115,   116,   117,   118,   119,   120,     2,   348,
-     121,   122,   123,   124,   125,   126,   127,   128,   129,     3,
-     349,   291,   292,   293,   294,   295,   296,   297,   298,   350,
-     351,   274,   130,   131,   132,   133,   134,   135,   136,   137,
-     138,   139,   140,   141,   142,   143,   144,   145,     4,   352,
-     353,   354,   355,   356,     5,   357,   358,   359,   360,   361,
-     275,   362,   363,   364,   365,   366,   367,   285,   308,   309,
-     310,   311,   312,   313,   314,   315,   316,   317,   318,   319,
-     368,   369,   370,   371,   372,   373,   374,   375,   376,   377,
-     378,   379,   380,   381,   382,   383,   384,   385,     6,   386,
-     387,   388,   389,   390,   391,   392,   393,   394,   395,   396,
-     397,   398,   399,   400,     7,   401,   402,   403,   404,   405,
-     406,   407,   408,   409,   410,   411,   412,   413,   414,   415,
-     416,   417,   418,   419,   420,   421,   422,   423,   424,   425,
-     426,   427,   428,   429,   430,   431,   432,   433,   434,     8,
-     435,   436,   437,   438,   439,   440,   441,   442,   443,   444,
-     445,   446,   447,   448,   449,   450,   451,   452,   453,   454,
-     455,   456,   457,   458,   459,   460,   461,   462,   463,   464,
-     465,   466,   467,   468,   469,   470,   471,   472,   473,   474,
-     475,   476,   477,   478,   479,   480,   481,   482,   483,   484,
-     485,   486,   487,   488,   489,   490,   491,   492,   493,   494
+     113,   114,   115,   116,   117,   118,   119,   120,   121,   353,
+     354,   122,   123,   124,   125,   126,   127,   128,   129,   130,
+       2,   281,   355,   282,   283,   356,   357,   358,   359,   360,
+       0,     3,   361,   131,   132,   133,   134,   135,   136,   137,
+     138,   139,   140,   141,   142,   143,   144,   145,   146,   147,
+     148,   149,   150,   362,   363,   364,   365,   366,   367,   368,
+     369,     4,   370,   371,   372,   373,   374,     5,   295,   318,
+     319,   320,   321,   322,   323,   324,   325,   326,   327,   328,
+     329,   375,   376,   377,   284,   378,   379,   380,   381,   382,
+     383,   384,   385,   386,   387,   388,   389,   390,   391,   392,
+     393,   394,   395,   396,   397,   398,   399,   400,   401,   402,
+     403,     6,   404,   285,   405,   406,   407,   408,   409,   410,
+     411,   412,   413,   414,   415,   416,   417,     7,   418,   419,
+     420,   421,   422,   423,   424,   425,   426,   427,   428,   429,
+     430,   431,   432,   433,   434,   435,   436,   437,   438,   439,
+     440,   441,   442,   443,   444,   445,   446,   447,   448,   449,
+     450,   451,     8,   452,   453,   454,   455,   456,   457,   458,
+     459,   460,   461,   462,   463,   464,   465,   466,   467,   468,
+     469,   470,   471,   472,   473,   474,   475,   476,   477,   478,
+     479,   480,   481,   482,   483,   484,   485,   486,   487,   488,
+     489,   490,   491,   492,   493,   494,   495,   496,   497,   498,
+     499,   500,   501,   502,   503,   504,   505,   506,   507,   508,
+     509,   510,   511,   512,   513,   514,   515,   516
 };
 
-static const yytype_uint8 yycheck[] =
+static const yytype_int16 yycheck[] =
 {
       12,    13,    14,    15,    16,    17,    18,    19,    20,    21,
       22,    23,    24,    25,    26,    27,    28,    29,    30,    31,
-      32,    33,    34,    35,    36,    37,    38,   107,    10,    10,
-      10,    43,    44,    45,    10,    10,    10,    49,    50,    51,
+      32,    33,    34,    35,    36,    37,    38,    39,   108,    10,
+      10,    10,    44,    45,    46,    10,    10,    10,    50,    51,
       52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
       62,    63,    64,    65,    66,    67,    68,    69,    70,    71,
       72,    73,    74,    75,    76,    77,    78,    79,    80,    81,
-      82,    83,    84,    85,    86,    87,    88,    89,    39,    10,
-      41,    42,    10,    10,    10,    10,    39,    99,   100,   101,
-      10,   103,   104,   105,    47,    48,   108,   109,   110,   111,
+      82,    83,    84,    85,    86,    87,    88,    89,    90,    92,
+      93,    94,    95,    96,    97,    98,    99,    40,   100,   101,
+     102,    10,   104,   105,   106,    48,    49,   109,   110,   111,
      112,   113,   114,   115,   116,   117,   118,   119,   120,   121,
-     122,   123,   124,   125,   126,   127,   128,   129,     0,    10,
-     132,   133,   134,   135,   136,   137,   138,   139,   140,    11,
-      10,    91,    92,    93,    94,    95,    96,    97,    98,    10,
-      10,   102,   154,   155,   156,   157,   158,   159,   160,   161,
-     162,   163,   164,   165,   166,   167,   168,   169,    40,    10,
-      10,    10,    10,    10,    46,    10,    10,    10,    10,    10,
-     131,    10,    10,    10,    10,    10,    10,   130,   142,   143,
+     122,   123,   124,   125,   126,   127,   128,   129,   130,    10,
+      10,   133,   134,   135,   136,   137,   138,   139,   140,   141,
+       0,    40,    10,    42,    43,    10,    10,    10,    10,    10,
+      -1,    11,    10,   155,   156,   157,   158,   159,   160,   161,
+     162,   163,   164,   165,   166,   167,   168,   169,   170,   171,
+     172,   173,   174,    10,    10,    10,    10,    10,    10,    10,
+      10,    41,    10,    10,    10,    10,    10,    47,   131,   143,
      144,   145,   146,   147,   148,   149,   150,   151,   152,   153,
+     154,    10,    10,    10,   103,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    90,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,   106,    10,    10,    10,    10,    10,
+      10,    91,    10,   132,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,   107,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,   141,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,   142,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,    10
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10
 };
 
   /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
      symbol of state STATE-NUM.  */
 static const yytype_uint16 yystos[] =
 {
-       0,   171,     0,    11,    40,    46,    90,   106,   141,   172,
-     173,   176,   179,   314,   325,   340,   174,   177,   180,   315,
-     326,   341,    12,    13,    14,    15,    16,    17,    18,    19,
+       0,   176,     0,    11,    41,    47,    91,   107,   142,   177,
+     178,   181,   184,   324,   335,   350,   179,   182,   185,   325,
+     336,   351,    12,    13,    14,    15,    16,    17,    18,    19,
       20,    21,    22,    23,    24,    25,    26,    27,    28,    29,
-      30,    31,    32,    33,    34,    35,    36,    37,    38,    43,
-      44,    45,    49,    50,    51,    52,    53,    54,    55,    56,
+      30,    31,    32,    33,    34,    35,    36,    37,    38,    39,
+      44,    45,    46,    50,    51,    52,    53,    54,    55,    56,
       57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
       67,    68,    69,    70,    71,    72,    73,    74,    75,    76,
       77,    78,    79,    80,    81,    82,    83,    84,    85,    86,
-      87,    88,    89,    99,   100,   101,   103,   104,   105,   108,
+      87,    88,    89,    90,   100,   101,   102,   104,   105,   106,
      109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
      119,   120,   121,   122,   123,   124,   125,   126,   127,   128,
-     129,   132,   133,   134,   135,   136,   137,   138,   139,   140,
-     154,   155,   156,   157,   158,   159,   160,   161,   162,   163,
-     164,   165,   166,   167,   168,   169,   175,   182,   183,   184,
-     185,   186,   187,   188,   189,   190,   191,   192,   193,   194,
+     129,   130,   133,   134,   135,   136,   137,   138,   139,   140,
+     141,   155,   156,   157,   158,   159,   160,   161,   162,   163,
+     164,   165,   166,   167,   168,   169,   170,   171,   172,   173,
+     174,   180,   187,   188,   189,   190,   191,   192,   193,   194,
      195,   196,   197,   198,   199,   200,   201,   202,   203,   204,
      205,   206,   207,   208,   209,   210,   211,   212,   213,   214,
      215,   216,   217,   218,   219,   220,   221,   222,   223,   224,
@@ -1277,13 +1301,15 @@ static const yytype_uint16 yystos[] =
      275,   276,   277,   278,   279,   280,   281,   282,   283,   284,
      285,   286,   287,   288,   289,   290,   291,   292,   293,   294,
      295,   296,   297,   298,   299,   300,   301,   302,   303,   304,
-     344,    39,    41,    42,   102,   131,   178,   305,   306,   307,
-     308,   309,    39,    47,    48,   130,   181,   310,   311,   312,
-     313,    91,    92,    93,    94,    95,    96,    97,    98,   316,
-     317,   318,   319,   320,   321,   322,   323,   324,   142,   143,
-     144,   145,   146,   147,   148,   149,   150,   151,   152,   153,
-     327,   328,   329,   330,   331,   332,   333,   334,   335,   336,
-     337,   338,   339,   107,   342,   343,    10,    10,    10,    10,
+     305,   306,   307,   308,   309,   310,   311,   312,   313,   314,
+     354,    40,    42,    43,   103,   132,   183,   315,   316,   317,
+     318,   319,    40,    48,    49,   131,   186,   320,   321,   322,
+     323,    92,    93,    94,    95,    96,    97,    98,    99,   326,
+     327,   328,   329,   330,   331,   332,   333,   334,   143,   144,
+     145,   146,   147,   148,   149,   150,   151,   152,   153,   154,
+     337,   338,   339,   340,   341,   342,   343,   344,   345,   346,
+     347,   348,   349,   108,   352,   353,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
@@ -1299,28 +1325,28 @@ static const yytype_uint16 yystos[] =
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10
+      10,    10,    10,    10,    10,    10,    10
 };
 
   /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_uint16 yyr1[] =
 {
-       0,   170,   171,   171,   172,   172,   172,   172,   172,   172,
-     173,   174,   174,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   175,   175,   175,
-     175,   175,   175,   175,   175,   175,   175,   176,   177,   177,
-     178,   178,   178,   178,   178,   179,   180,   180,   181,   181,
-     181,   181,   182,   183,   184,   185,   186,   187,   188,   189,
+       0,   175,   176,   176,   177,   177,   177,   177,   177,   177,
+     178,   179,   179,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   180,   180,   180,   180,   180,   180,   180,   180,
+     180,   180,   181,   182,   182,   183,   183,   183,   183,   183,
+     184,   185,   185,   186,   186,   186,   186,   187,   188,   189,
      190,   191,   192,   193,   194,   195,   196,   197,   198,   199,
      200,   201,   202,   203,   204,   205,   206,   207,   208,   209,
      210,   211,   212,   213,   214,   215,   216,   217,   218,   219,
@@ -1333,12 +1359,13 @@ static const yytype_uint16 yyr1[] =
      280,   281,   282,   283,   284,   285,   286,   287,   288,   289,
      290,   291,   292,   293,   294,   295,   296,   297,   298,   299,
      300,   301,   302,   303,   304,   305,   306,   307,   308,   309,
-     310,   311,   312,   313,   314,   315,   315,   316,   316,   316,
-     316,   316,   316,   316,   316,   317,   318,   319,   320,   321,
-     322,   323,   324,   325,   326,   326,   327,   327,   327,   327,
-     327,   327,   327,   327,   327,   327,   327,   327,   328,   329,
-     330,   331,   332,   333,   334,   335,   336,   337,   338,   339,
-     340,   341,   341,   342,   343,   344
+     310,   311,   312,   313,   314,   315,   316,   317,   318,   319,
+     320,   321,   322,   323,   324,   325,   325,   326,   326,   326,
+     326,   326,   326,   326,   326,   327,   328,   329,   330,   331,
+     332,   333,   334,   335,   336,   336,   337,   337,   337,   337,
+     337,   337,   337,   337,   337,   337,   337,   337,   338,   339,
+     340,   341,   342,   343,   344,   345,   346,   347,   348,   349,
+     350,   351,   351,   352,   353,   354
 };
 
   /* YYR2[YYN] -- Number of symbols on the right hand side of rule YYN.  */
@@ -1357,9 +1384,9 @@ static const yytype_uint8 yyr2[] =
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     2,     0,
-       1,     1,     1,     1,     1,     1,     2,     0,     1,     1,
-       1,     1,     2,     2,     2,     2,     2,     2,     2,     2,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     2,     0,     1,     1,     1,     1,     1,
+       1,     2,     0,     1,     1,     1,     1,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
@@ -1367,10 +1394,11 @@ static const yytype_uint8 yyr2[] =
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     3,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     3,     2,
-       2,     2,     2,     2,     2,     2,     2,     3,     2,     2,
+       2,     2,     2,     3,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     3,     2,     2,     2,     2,     2,
+       2,     2,     2,     3,     3,     4,     4,     4,     2,     2,
        2,     3,     3,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     1,     2,     0,     1,     1,     1,
        1,     1,     1,     1,     1,     2,     2,     2,     2,     2,
@@ -2054,15 +2082,15 @@ yyreduce:
   switch (yyn)
     {
         case 10:
-#line 139 "util/configparser.y" /* yacc.c:1646  */
+#line 141 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("\nP(server:)\n")); 
 	}
-#line 2062 "util/configparser.c" /* yacc.c:1646  */
+#line 2090 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 137:
-#line 200 "util/configparser.y" /* yacc.c:1646  */
+  case 142:
+#line 205 "util/configparser.y" /* yacc.c:1646  */
     {
 		struct config_stub* s;
 		OUTYY(("\nP(stub_zone:)\n")); 
@@ -2073,11 +2101,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2077 "util/configparser.c" /* yacc.c:1646  */
+#line 2105 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 145:
-#line 216 "util/configparser.y" /* yacc.c:1646  */
+  case 150:
+#line 221 "util/configparser.y" /* yacc.c:1646  */
     {
 		struct config_stub* s;
 		OUTYY(("\nP(forward_zone:)\n")); 
@@ -2088,11 +2116,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2092 "util/configparser.c" /* yacc.c:1646  */
+#line 2120 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 152:
-#line 232 "util/configparser.y" /* yacc.c:1646  */
+  case 157:
+#line 237 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_num_threads:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2100,11 +2128,11 @@ yyreduce:
 		else cfg_parser->cfg->num_threads = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2104 "util/configparser.c" /* yacc.c:1646  */
+#line 2132 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 153:
-#line 241 "util/configparser.y" /* yacc.c:1646  */
+  case 158:
+#line 246 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_verbosity:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2112,11 +2140,11 @@ yyreduce:
 		else cfg_parser->cfg->verbosity = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2116 "util/configparser.c" /* yacc.c:1646  */
+#line 2144 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 154:
-#line 250 "util/configparser.y" /* yacc.c:1646  */
+  case 159:
+#line 255 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_statistics_interval:%s)\n", (yyvsp[0].str))); 
 		if(strcmp((yyvsp[0].str), "") == 0 || strcmp((yyvsp[0].str), "0") == 0)
@@ -2126,11 +2154,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_interval = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2130 "util/configparser.c" /* yacc.c:1646  */
+#line 2158 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 155:
-#line 261 "util/configparser.y" /* yacc.c:1646  */
+  case 160:
+#line 266 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_statistics_cumulative:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2138,11 +2166,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_cumulative = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2142 "util/configparser.c" /* yacc.c:1646  */
+#line 2170 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 156:
-#line 270 "util/configparser.y" /* yacc.c:1646  */
+  case 161:
+#line 275 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_extended_statistics:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2150,11 +2178,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_extended = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2154 "util/configparser.c" /* yacc.c:1646  */
+#line 2182 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 157:
-#line 279 "util/configparser.y" /* yacc.c:1646  */
+  case 162:
+#line 284 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2162,11 +2190,11 @@ yyreduce:
 		else cfg_parser->cfg->port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2166 "util/configparser.c" /* yacc.c:1646  */
+#line 2194 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 158:
-#line 288 "util/configparser.y" /* yacc.c:1646  */
+  case 163:
+#line 293 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_interface:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->num_ifs == 0)
@@ -2178,11 +2206,11 @@ yyreduce:
 		else
 			cfg_parser->cfg->ifs[cfg_parser->cfg->num_ifs++] = (yyvsp[0].str);
 	}
-#line 2182 "util/configparser.c" /* yacc.c:1646  */
+#line 2210 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 159:
-#line 301 "util/configparser.y" /* yacc.c:1646  */
+  case 164:
+#line 306 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_interface:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->num_out_ifs == 0)
@@ -2196,11 +2224,11 @@ yyreduce:
 			cfg_parser->cfg->out_ifs[
 				cfg_parser->cfg->num_out_ifs++] = (yyvsp[0].str);
 	}
-#line 2200 "util/configparser.c" /* yacc.c:1646  */
+#line 2228 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 160:
-#line 316 "util/configparser.y" /* yacc.c:1646  */
+  case 165:
+#line 321 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_range:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2208,11 +2236,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_num_ports = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2212 "util/configparser.c" /* yacc.c:1646  */
+#line 2240 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 161:
-#line 325 "util/configparser.y" /* yacc.c:1646  */
+  case 166:
+#line 330 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_port_permit:%s)\n", (yyvsp[0].str)));
 		if(!cfg_mark_ports((yyvsp[0].str), 1, 
@@ -2220,11 +2248,11 @@ yyreduce:
 			yyerror("port number or range (\"low-high\") expected");
 		free((yyvsp[0].str));
 	}
-#line 2224 "util/configparser.c" /* yacc.c:1646  */
+#line 2252 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 162:
-#line 334 "util/configparser.y" /* yacc.c:1646  */
+  case 167:
+#line 339 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_port_avoid:%s)\n", (yyvsp[0].str)));
 		if(!cfg_mark_ports((yyvsp[0].str), 0, 
@@ -2232,11 +2260,11 @@ yyreduce:
 			yyerror("port number or range (\"low-high\") expected");
 		free((yyvsp[0].str));
 	}
-#line 2236 "util/configparser.c" /* yacc.c:1646  */
+#line 2264 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 163:
-#line 343 "util/configparser.y" /* yacc.c:1646  */
+  case 168:
+#line 348 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_num_tcp:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2244,11 +2272,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_num_tcp = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2248 "util/configparser.c" /* yacc.c:1646  */
+#line 2276 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 164:
-#line 352 "util/configparser.y" /* yacc.c:1646  */
+  case 169:
+#line 357 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_incoming_num_tcp:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2256,11 +2284,11 @@ yyreduce:
 		else cfg_parser->cfg->incoming_num_tcp = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2260 "util/configparser.c" /* yacc.c:1646  */
+#line 2288 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 165:
-#line 361 "util/configparser.y" /* yacc.c:1646  */
+  case 170:
+#line 366 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_interface_automatic:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2268,11 +2296,11 @@ yyreduce:
 		else cfg_parser->cfg->if_automatic = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2272 "util/configparser.c" /* yacc.c:1646  */
+#line 2300 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 166:
-#line 370 "util/configparser.y" /* yacc.c:1646  */
+  case 171:
+#line 375 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_ip4:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2280,11 +2308,11 @@ yyreduce:
 		else cfg_parser->cfg->do_ip4 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2284 "util/configparser.c" /* yacc.c:1646  */
+#line 2312 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 167:
-#line 379 "util/configparser.y" /* yacc.c:1646  */
+  case 172:
+#line 384 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_ip6:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2292,11 +2320,11 @@ yyreduce:
 		else cfg_parser->cfg->do_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2296 "util/configparser.c" /* yacc.c:1646  */
+#line 2324 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 168:
-#line 388 "util/configparser.y" /* yacc.c:1646  */
+  case 173:
+#line 393 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_udp:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2304,11 +2332,11 @@ yyreduce:
 		else cfg_parser->cfg->do_udp = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2308 "util/configparser.c" /* yacc.c:1646  */
+#line 2336 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 169:
-#line 397 "util/configparser.y" /* yacc.c:1646  */
+  case 174:
+#line 402 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_tcp:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2316,11 +2344,23 @@ yyreduce:
 		else cfg_parser->cfg->do_tcp = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2320 "util/configparser.c" /* yacc.c:1646  */
+#line 2348 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 170:
-#line 406 "util/configparser.y" /* yacc.c:1646  */
+  case 175:
+#line 411 "util/configparser.y" /* yacc.c:1646  */
+    {
+		OUTYY(("P(server_prefer_ip6:%s)\n", (yyvsp[0].str)));
+		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->prefer_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
+		free((yyvsp[0].str));
+	}
+#line 2360 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 176:
+#line 420 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_tcp_mss:%s)\n", (yyvsp[0].str)));
                 if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2328,11 +2368,11 @@ yyreduce:
                 else cfg_parser->cfg->tcp_mss = atoi((yyvsp[0].str));
                 free((yyvsp[0].str));
 	}
-#line 2332 "util/configparser.c" /* yacc.c:1646  */
+#line 2372 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 171:
-#line 415 "util/configparser.y" /* yacc.c:1646  */
+  case 177:
+#line 429 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_tcp_mss:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2340,11 +2380,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_tcp_mss = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2344 "util/configparser.c" /* yacc.c:1646  */
+#line 2384 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 172:
-#line 424 "util/configparser.y" /* yacc.c:1646  */
+  case 178:
+#line 438 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_tcp_upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2352,11 +2392,11 @@ yyreduce:
 		else cfg_parser->cfg->tcp_upstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2356 "util/configparser.c" /* yacc.c:1646  */
+#line 2396 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 173:
-#line 433 "util/configparser.y" /* yacc.c:1646  */
+  case 179:
+#line 447 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ssl_upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2364,31 +2404,31 @@ yyreduce:
 		else cfg_parser->cfg->ssl_upstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2368 "util/configparser.c" /* yacc.c:1646  */
+#line 2408 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 174:
-#line 442 "util/configparser.y" /* yacc.c:1646  */
+  case 180:
+#line 456 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ssl_service_key:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->ssl_service_key);
 		cfg_parser->cfg->ssl_service_key = (yyvsp[0].str);
 	}
-#line 2378 "util/configparser.c" /* yacc.c:1646  */
+#line 2418 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 175:
-#line 449 "util/configparser.y" /* yacc.c:1646  */
+  case 181:
+#line 463 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ssl_service_pem:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->ssl_service_pem);
 		cfg_parser->cfg->ssl_service_pem = (yyvsp[0].str);
 	}
-#line 2388 "util/configparser.c" /* yacc.c:1646  */
+#line 2428 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 176:
-#line 456 "util/configparser.y" /* yacc.c:1646  */
+  case 182:
+#line 470 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ssl_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2396,11 +2436,11 @@ yyreduce:
 		else cfg_parser->cfg->ssl_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2400 "util/configparser.c" /* yacc.c:1646  */
+#line 2440 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 177:
-#line 465 "util/configparser.y" /* yacc.c:1646  */
+  case 183:
+#line 479 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_daemonize:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2408,11 +2448,11 @@ yyreduce:
 		else cfg_parser->cfg->do_daemonize = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2412 "util/configparser.c" /* yacc.c:1646  */
+#line 2452 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 178:
-#line 474 "util/configparser.y" /* yacc.c:1646  */
+  case 184:
+#line 488 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_use_syslog:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2425,11 +2465,11 @@ yyreduce:
 #endif
 		free((yyvsp[0].str));
 	}
-#line 2429 "util/configparser.c" /* yacc.c:1646  */
+#line 2469 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 179:
-#line 488 "util/configparser.y" /* yacc.c:1646  */
+  case 185:
+#line 502 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_log_time_ascii:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2437,11 +2477,11 @@ yyreduce:
 		else cfg_parser->cfg->log_time_ascii = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2441 "util/configparser.c" /* yacc.c:1646  */
+#line 2481 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 180:
-#line 497 "util/configparser.y" /* yacc.c:1646  */
+  case 186:
+#line 511 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_log_queries:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2449,145 +2489,162 @@ yyreduce:
 		else cfg_parser->cfg->log_queries = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2453 "util/configparser.c" /* yacc.c:1646  */
+#line 2493 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 181:
-#line 506 "util/configparser.y" /* yacc.c:1646  */
+  case 187:
+#line 520 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_chroot:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->chrootdir);
 		cfg_parser->cfg->chrootdir = (yyvsp[0].str);
 	}
-#line 2463 "util/configparser.c" /* yacc.c:1646  */
+#line 2503 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 182:
-#line 513 "util/configparser.y" /* yacc.c:1646  */
+  case 188:
+#line 527 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_username:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->username);
 		cfg_parser->cfg->username = (yyvsp[0].str);
 	}
-#line 2473 "util/configparser.c" /* yacc.c:1646  */
+#line 2513 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 183:
-#line 520 "util/configparser.y" /* yacc.c:1646  */
+  case 189:
+#line 534 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_directory:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->directory);
 		cfg_parser->cfg->directory = (yyvsp[0].str);
+		/* change there right away for includes relative to this */
+		if((yyvsp[0].str)[0]) {
+			char* d;
+#ifdef UB_ON_WINDOWS
+			w_config_adjust_directory(cfg_parser->cfg);
+#endif
+			d = cfg_parser->cfg->directory;
+			/* adjust directory if we have already chroot,
+			 * like, we reread after sighup */
+			if(cfg_parser->chroot && cfg_parser->chroot[0] &&
+				strncmp(d, cfg_parser->chroot, strlen(
+				cfg_parser->chroot)) == 0)
+				d += strlen(cfg_parser->chroot);
+			if(chdir(d))
+				log_err("cannot chdir to directory: %s (%s)",
+					d, strerror(errno));
+		}
 	}
-#line 2483 "util/configparser.c" /* yacc.c:1646  */
+#line 2540 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 184:
-#line 527 "util/configparser.y" /* yacc.c:1646  */
+  case 190:
+#line 558 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_logfile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->logfile);
 		cfg_parser->cfg->logfile = (yyvsp[0].str);
 		cfg_parser->cfg->use_syslog = 0;
 	}
-#line 2494 "util/configparser.c" /* yacc.c:1646  */
+#line 2551 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 185:
-#line 535 "util/configparser.y" /* yacc.c:1646  */
+  case 191:
+#line 566 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_pidfile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->pidfile);
 		cfg_parser->cfg->pidfile = (yyvsp[0].str);
 	}
-#line 2504 "util/configparser.c" /* yacc.c:1646  */
+#line 2561 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 186:
-#line 542 "util/configparser.y" /* yacc.c:1646  */
+  case 192:
+#line 573 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_root_hints:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->root_hints, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 2514 "util/configparser.c" /* yacc.c:1646  */
+#line 2571 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 187:
-#line 549 "util/configparser.y" /* yacc.c:1646  */
+  case 193:
+#line 580 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_dlv_anchor_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dlv_anchor_file);
 		cfg_parser->cfg->dlv_anchor_file = (yyvsp[0].str);
 	}
-#line 2524 "util/configparser.c" /* yacc.c:1646  */
+#line 2581 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 188:
-#line 556 "util/configparser.y" /* yacc.c:1646  */
+  case 194:
+#line 587 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_dlv_anchor:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 2534 "util/configparser.c" /* yacc.c:1646  */
+#line 2591 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 189:
-#line 563 "util/configparser.y" /* yacc.c:1646  */
+  case 195:
+#line 594 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_auto_trust_anchor_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			auto_trust_anchor_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 2545 "util/configparser.c" /* yacc.c:1646  */
+#line 2602 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 190:
-#line 571 "util/configparser.y" /* yacc.c:1646  */
+  case 196:
+#line 602 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_trust_anchor_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			trust_anchor_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 2556 "util/configparser.c" /* yacc.c:1646  */
+#line 2613 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 191:
-#line 579 "util/configparser.y" /* yacc.c:1646  */
+  case 197:
+#line 610 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_trusted_keys_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			trusted_keys_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 2567 "util/configparser.c" /* yacc.c:1646  */
+#line 2624 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 192:
-#line 587 "util/configparser.y" /* yacc.c:1646  */
+  case 198:
+#line 618 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_trust_anchor:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->trust_anchor_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 2577 "util/configparser.c" /* yacc.c:1646  */
+#line 2634 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 193:
-#line 594 "util/configparser.y" /* yacc.c:1646  */
+  case 199:
+#line 625 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_domain_insecure:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->domain_insecure, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 2587 "util/configparser.c" /* yacc.c:1646  */
+#line 2644 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 194:
-#line 601 "util/configparser.y" /* yacc.c:1646  */
+  case 200:
+#line 632 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_hide_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2595,11 +2652,11 @@ yyreduce:
 		else cfg_parser->cfg->hide_identity = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2599 "util/configparser.c" /* yacc.c:1646  */
+#line 2656 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 195:
-#line 610 "util/configparser.y" /* yacc.c:1646  */
+  case 201:
+#line 641 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_hide_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2607,53 +2664,53 @@ yyreduce:
 		else cfg_parser->cfg->hide_version = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2611 "util/configparser.c" /* yacc.c:1646  */
+#line 2668 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 196:
-#line 619 "util/configparser.y" /* yacc.c:1646  */
+  case 202:
+#line 650 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->identity);
 		cfg_parser->cfg->identity = (yyvsp[0].str);
 	}
-#line 2621 "util/configparser.c" /* yacc.c:1646  */
+#line 2678 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 197:
-#line 626 "util/configparser.y" /* yacc.c:1646  */
+  case 203:
+#line 657 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->version);
 		cfg_parser->cfg->version = (yyvsp[0].str);
 	}
-#line 2631 "util/configparser.c" /* yacc.c:1646  */
+#line 2688 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 198:
-#line 633 "util/configparser.y" /* yacc.c:1646  */
+  case 204:
+#line 664 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_so_rcvbuf:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_rcvbuf))
 			yyerror("buffer size expected");
 		free((yyvsp[0].str));
 	}
-#line 2642 "util/configparser.c" /* yacc.c:1646  */
+#line 2699 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 199:
-#line 641 "util/configparser.y" /* yacc.c:1646  */
+  case 205:
+#line 672 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_so_sndbuf:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_sndbuf))
 			yyerror("buffer size expected");
 		free((yyvsp[0].str));
 	}
-#line 2653 "util/configparser.c" /* yacc.c:1646  */
+#line 2710 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 200:
-#line 649 "util/configparser.y" /* yacc.c:1646  */
+  case 206:
+#line 680 "util/configparser.y" /* yacc.c:1646  */
     {
         OUTYY(("P(server_so_reuseport:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2662,11 +2719,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 2666 "util/configparser.c" /* yacc.c:1646  */
+#line 2723 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 201:
-#line 659 "util/configparser.y" /* yacc.c:1646  */
+  case 207:
+#line 690 "util/configparser.y" /* yacc.c:1646  */
     {
         OUTYY(("P(server_ip_transparent:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2675,11 +2732,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 2679 "util/configparser.c" /* yacc.c:1646  */
+#line 2736 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 202:
-#line 669 "util/configparser.y" /* yacc.c:1646  */
+  case 208:
+#line 700 "util/configparser.y" /* yacc.c:1646  */
     {
         OUTYY(("P(server_ip_freebind:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2688,11 +2745,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 2692 "util/configparser.c" /* yacc.c:1646  */
+#line 2749 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 203:
-#line 679 "util/configparser.y" /* yacc.c:1646  */
+  case 209:
+#line 710 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_edns_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2704,11 +2761,11 @@ yyreduce:
 		else cfg_parser->cfg->edns_buffer_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2708 "util/configparser.c" /* yacc.c:1646  */
+#line 2765 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 204:
-#line 692 "util/configparser.y" /* yacc.c:1646  */
+  case 210:
+#line 723 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_msg_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2718,22 +2775,22 @@ yyreduce:
 		else cfg_parser->cfg->msg_buffer_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2722 "util/configparser.c" /* yacc.c:1646  */
+#line 2779 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 205:
-#line 703 "util/configparser.y" /* yacc.c:1646  */
+  case 211:
+#line 734 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_msg_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->msg_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 2733 "util/configparser.c" /* yacc.c:1646  */
+#line 2790 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 206:
-#line 711 "util/configparser.y" /* yacc.c:1646  */
+  case 212:
+#line 742 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_msg_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2745,11 +2802,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 2749 "util/configparser.c" /* yacc.c:1646  */
+#line 2806 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 207:
-#line 724 "util/configparser.y" /* yacc.c:1646  */
+  case 213:
+#line 755 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_num_queries_per_thread:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2757,11 +2814,11 @@ yyreduce:
 		else cfg_parser->cfg->num_queries_per_thread = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2761 "util/configparser.c" /* yacc.c:1646  */
+#line 2818 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 208:
-#line 733 "util/configparser.y" /* yacc.c:1646  */
+  case 214:
+#line 764 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_jostle_timeout:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2769,11 +2826,11 @@ yyreduce:
 		else cfg_parser->cfg->jostle_time = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2773 "util/configparser.c" /* yacc.c:1646  */
+#line 2830 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 209:
-#line 742 "util/configparser.y" /* yacc.c:1646  */
+  case 215:
+#line 773 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_delay_close:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2781,11 +2838,11 @@ yyreduce:
 		else cfg_parser->cfg->delay_close = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2785 "util/configparser.c" /* yacc.c:1646  */
+#line 2842 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 210:
-#line 751 "util/configparser.y" /* yacc.c:1646  */
+  case 216:
+#line 782 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_unblock_lan_zones:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2794,11 +2851,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2798 "util/configparser.c" /* yacc.c:1646  */
+#line 2855 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 211:
-#line 761 "util/configparser.y" /* yacc.c:1646  */
+  case 217:
+#line 792 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_insecure_lan_zones:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2807,22 +2864,22 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2811 "util/configparser.c" /* yacc.c:1646  */
+#line 2868 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 212:
-#line 771 "util/configparser.y" /* yacc.c:1646  */
+  case 218:
+#line 802 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_rrset_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->rrset_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 2822 "util/configparser.c" /* yacc.c:1646  */
+#line 2879 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 213:
-#line 779 "util/configparser.y" /* yacc.c:1646  */
+  case 219:
+#line 810 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_rrset_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2834,11 +2891,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 2838 "util/configparser.c" /* yacc.c:1646  */
+#line 2895 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 214:
-#line 792 "util/configparser.y" /* yacc.c:1646  */
+  case 220:
+#line 823 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_host_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2846,22 +2903,22 @@ yyreduce:
 		else cfg_parser->cfg->host_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2850 "util/configparser.c" /* yacc.c:1646  */
+#line 2907 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 215:
-#line 801 "util/configparser.y" /* yacc.c:1646  */
+  case 221:
+#line 832 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_lame_ttl:%s)\n", (yyvsp[0].str)));
 		verbose(VERB_DETAIL, "ignored infra-lame-ttl: %s (option "
 			"removed, use infra-host-ttl)", (yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2861 "util/configparser.c" /* yacc.c:1646  */
+#line 2918 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 216:
-#line 809 "util/configparser.y" /* yacc.c:1646  */
+  case 222:
+#line 840 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_cache_numhosts:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2869,22 +2926,22 @@ yyreduce:
 		else cfg_parser->cfg->infra_cache_numhosts = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2873 "util/configparser.c" /* yacc.c:1646  */
+#line 2930 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 217:
-#line 818 "util/configparser.y" /* yacc.c:1646  */
+  case 223:
+#line 849 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_cache_lame_size:%s)\n", (yyvsp[0].str)));
 		verbose(VERB_DETAIL, "ignored infra-cache-lame-size: %s "
 			"(option removed, use infra-cache-numhosts)", (yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2884 "util/configparser.c" /* yacc.c:1646  */
+#line 2941 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 218:
-#line 826 "util/configparser.y" /* yacc.c:1646  */
+  case 224:
+#line 857 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2896,11 +2953,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 2900 "util/configparser.c" /* yacc.c:1646  */
+#line 2957 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 219:
-#line 839 "util/configparser.y" /* yacc.c:1646  */
+  case 225:
+#line 870 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2908,21 +2965,21 @@ yyreduce:
 		else cfg_parser->cfg->infra_cache_min_rtt = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2912 "util/configparser.c" /* yacc.c:1646  */
+#line 2969 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 220:
-#line 848 "util/configparser.y" /* yacc.c:1646  */
+  case 226:
+#line 879 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_target_fetch_policy:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->target_fetch_policy);
 		cfg_parser->cfg->target_fetch_policy = (yyvsp[0].str);
 	}
-#line 2922 "util/configparser.c" /* yacc.c:1646  */
+#line 2979 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 221:
-#line 855 "util/configparser.y" /* yacc.c:1646  */
+  case 227:
+#line 886 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_short_bufsize:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2931,11 +2988,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2935 "util/configparser.c" /* yacc.c:1646  */
+#line 2992 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 222:
-#line 865 "util/configparser.y" /* yacc.c:1646  */
+  case 228:
+#line 896 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_large_queries:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2944,11 +3001,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2948 "util/configparser.c" /* yacc.c:1646  */
+#line 3005 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 223:
-#line 875 "util/configparser.y" /* yacc.c:1646  */
+  case 229:
+#line 906 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_glue:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2957,11 +3014,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2961 "util/configparser.c" /* yacc.c:1646  */
+#line 3018 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 224:
-#line 885 "util/configparser.y" /* yacc.c:1646  */
+  case 230:
+#line 916 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_dnssec_stripped:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2970,11 +3027,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2974 "util/configparser.c" /* yacc.c:1646  */
+#line 3031 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 225:
-#line 895 "util/configparser.y" /* yacc.c:1646  */
+  case 231:
+#line 926 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_below_nxdomain:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2983,11 +3040,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2987 "util/configparser.c" /* yacc.c:1646  */
+#line 3044 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 226:
-#line 905 "util/configparser.y" /* yacc.c:1646  */
+  case 232:
+#line 936 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_referral_path:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2996,11 +3053,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3000 "util/configparser.c" /* yacc.c:1646  */
+#line 3057 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 227:
-#line 915 "util/configparser.y" /* yacc.c:1646  */
+  case 233:
+#line 946 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_algo_downgrade:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3009,11 +3066,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3013 "util/configparser.c" /* yacc.c:1646  */
+#line 3070 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 228:
-#line 925 "util/configparser.y" /* yacc.c:1646  */
+  case 234:
+#line 956 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_use_caps_for_id:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3022,41 +3079,41 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3026 "util/configparser.c" /* yacc.c:1646  */
+#line 3083 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 229:
-#line 935 "util/configparser.y" /* yacc.c:1646  */
+  case 235:
+#line 966 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_caps_whitelist:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3036 "util/configparser.c" /* yacc.c:1646  */
+#line 3093 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 230:
-#line 942 "util/configparser.y" /* yacc.c:1646  */
+  case 236:
+#line 973 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_private_address:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_address, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3046 "util/configparser.c" /* yacc.c:1646  */
+#line 3103 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 231:
-#line 949 "util/configparser.y" /* yacc.c:1646  */
+  case 237:
+#line 980 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_private_domain:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_domain, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3056 "util/configparser.c" /* yacc.c:1646  */
+#line 3113 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 232:
-#line 956 "util/configparser.y" /* yacc.c:1646  */
+  case 238:
+#line 987 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_prefetch:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3064,11 +3121,11 @@ yyreduce:
 		else cfg_parser->cfg->prefetch = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3068 "util/configparser.c" /* yacc.c:1646  */
+#line 3125 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 233:
-#line 965 "util/configparser.y" /* yacc.c:1646  */
+  case 239:
+#line 996 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_prefetch_key:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3076,11 +3133,11 @@ yyreduce:
 		else cfg_parser->cfg->prefetch_key = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3080 "util/configparser.c" /* yacc.c:1646  */
+#line 3137 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 234:
-#line 974 "util/configparser.y" /* yacc.c:1646  */
+  case 240:
+#line 1005 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_unwanted_reply_threshold:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3088,21 +3145,21 @@ yyreduce:
 		else cfg_parser->cfg->unwanted_threshold = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3092 "util/configparser.c" /* yacc.c:1646  */
+#line 3149 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 235:
-#line 983 "util/configparser.y" /* yacc.c:1646  */
+  case 241:
+#line 1014 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_not_query_address:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->donotqueryaddrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3102 "util/configparser.c" /* yacc.c:1646  */
+#line 3159 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 236:
-#line 990 "util/configparser.y" /* yacc.c:1646  */
+  case 242:
+#line 1021 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_not_query_localhost:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3111,11 +3168,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3115 "util/configparser.c" /* yacc.c:1646  */
+#line 3172 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 237:
-#line 1000 "util/configparser.y" /* yacc.c:1646  */
+  case 243:
+#line 1031 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_access_control:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "deny")!=0 && strcmp((yyvsp[0].str), "refuse")!=0 &&
@@ -3131,21 +3188,21 @@ yyreduce:
 				fatal_exit("out of memory adding acl");
 		}
 	}
-#line 3135 "util/configparser.c" /* yacc.c:1646  */
+#line 3192 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 238:
-#line 1017 "util/configparser.y" /* yacc.c:1646  */
+  case 244:
+#line 1048 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_module_conf:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->module_conf);
 		cfg_parser->cfg->module_conf = (yyvsp[0].str);
 	}
-#line 3145 "util/configparser.c" /* yacc.c:1646  */
+#line 3202 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 239:
-#line 1024 "util/configparser.y" /* yacc.c:1646  */
+  case 245:
+#line 1055 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_override_date:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -3162,11 +3219,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3166 "util/configparser.c" /* yacc.c:1646  */
+#line 3223 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 240:
-#line 1042 "util/configparser.y" /* yacc.c:1646  */
+  case 246:
+#line 1073 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_sig_skew_min:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -3178,11 +3235,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3182 "util/configparser.c" /* yacc.c:1646  */
+#line 3239 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 241:
-#line 1055 "util/configparser.y" /* yacc.c:1646  */
+  case 247:
+#line 1086 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_sig_skew_max:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -3194,11 +3251,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3198 "util/configparser.c" /* yacc.c:1646  */
+#line 3255 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 242:
-#line 1068 "util/configparser.y" /* yacc.c:1646  */
+  case 248:
+#line 1099 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_cache_max_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3206,11 +3263,11 @@ yyreduce:
 		else cfg_parser->cfg->max_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3210 "util/configparser.c" /* yacc.c:1646  */
+#line 3267 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 243:
-#line 1077 "util/configparser.y" /* yacc.c:1646  */
+  case 249:
+#line 1108 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_cache_max_negative_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3218,11 +3275,11 @@ yyreduce:
 		else cfg_parser->cfg->max_negative_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3222 "util/configparser.c" /* yacc.c:1646  */
+#line 3279 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 244:
-#line 1086 "util/configparser.y" /* yacc.c:1646  */
+  case 250:
+#line 1117 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_cache_min_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3230,11 +3287,11 @@ yyreduce:
 		else cfg_parser->cfg->min_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3234 "util/configparser.c" /* yacc.c:1646  */
+#line 3291 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 245:
-#line 1095 "util/configparser.y" /* yacc.c:1646  */
+  case 251:
+#line 1126 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_bogus_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3242,11 +3299,11 @@ yyreduce:
 		else cfg_parser->cfg->bogus_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3246 "util/configparser.c" /* yacc.c:1646  */
+#line 3303 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 246:
-#line 1104 "util/configparser.y" /* yacc.c:1646  */
+  case 252:
+#line 1135 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_clean_additional:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3255,11 +3312,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3259 "util/configparser.c" /* yacc.c:1646  */
+#line 3316 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 247:
-#line 1114 "util/configparser.y" /* yacc.c:1646  */
+  case 253:
+#line 1145 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_permissive_mode:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3268,11 +3325,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3272 "util/configparser.c" /* yacc.c:1646  */
+#line 3329 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 248:
-#line 1124 "util/configparser.y" /* yacc.c:1646  */
+  case 254:
+#line 1155 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ignore_cd_flag:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3280,11 +3337,11 @@ yyreduce:
 		else cfg_parser->cfg->ignore_cd = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3284 "util/configparser.c" /* yacc.c:1646  */
+#line 3341 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 249:
-#line 1133 "util/configparser.y" /* yacc.c:1646  */
+  case 255:
+#line 1164 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_log_level:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3292,21 +3349,21 @@ yyreduce:
 		else cfg_parser->cfg->val_log_level = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3296 "util/configparser.c" /* yacc.c:1646  */
+#line 3353 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 250:
-#line 1142 "util/configparser.y" /* yacc.c:1646  */
+  case 256:
+#line 1173 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->val_nsec3_key_iterations);
 		cfg_parser->cfg->val_nsec3_key_iterations = (yyvsp[0].str);
 	}
-#line 3306 "util/configparser.c" /* yacc.c:1646  */
+#line 3363 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 251:
-#line 1149 "util/configparser.y" /* yacc.c:1646  */
+  case 257:
+#line 1180 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_add_holddown:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3314,11 +3371,11 @@ yyreduce:
 		else cfg_parser->cfg->add_holddown = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3318 "util/configparser.c" /* yacc.c:1646  */
+#line 3375 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 252:
-#line 1158 "util/configparser.y" /* yacc.c:1646  */
+  case 258:
+#line 1189 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_del_holddown:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3326,11 +3383,11 @@ yyreduce:
 		else cfg_parser->cfg->del_holddown = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3330 "util/configparser.c" /* yacc.c:1646  */
+#line 3387 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 253:
-#line 1167 "util/configparser.y" /* yacc.c:1646  */
+  case 259:
+#line 1198 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_keep_missing:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3338,11 +3395,11 @@ yyreduce:
 		else cfg_parser->cfg->keep_missing = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3342 "util/configparser.c" /* yacc.c:1646  */
+#line 3399 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 254:
-#line 1176 "util/configparser.y" /* yacc.c:1646  */
+  case 260:
+#line 1207 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_permit_small_holddown:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3351,22 +3408,22 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3355 "util/configparser.c" /* yacc.c:1646  */
+#line 3412 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 255:
-#line 1185 "util/configparser.y" /* yacc.c:1646  */
+  case 261:
+#line 1216 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_key_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->key_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3366 "util/configparser.c" /* yacc.c:1646  */
+#line 3423 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 256:
-#line 1193 "util/configparser.y" /* yacc.c:1646  */
+  case 262:
+#line 1224 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_key_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3378,33 +3435,37 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3382 "util/configparser.c" /* yacc.c:1646  */
+#line 3439 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 257:
-#line 1206 "util/configparser.y" /* yacc.c:1646  */
+  case 263:
+#line 1237 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_neg_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->neg_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3393 "util/configparser.c" /* yacc.c:1646  */
+#line 3450 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 258:
-#line 1214 "util/configparser.y" /* yacc.c:1646  */
+  case 264:
+#line 1245 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
 		   strcmp((yyvsp[0].str), "refuse")!=0 && strcmp((yyvsp[0].str), "redirect")!=0 &&
 		   strcmp((yyvsp[0].str), "transparent")!=0 && strcmp((yyvsp[0].str), "nodefault")!=0
-		   && strcmp((yyvsp[0].str), "typetransparent")!=0 &&
-		   strcmp((yyvsp[0].str), "inform")!=0 && strcmp((yyvsp[0].str), "inform_deny")!=0)
+		   && strcmp((yyvsp[0].str), "typetransparent")!=0
+		   && strcmp((yyvsp[0].str), "always_transparent")!=0
+		   && strcmp((yyvsp[0].str), "always_refuse")!=0
+		   && strcmp((yyvsp[0].str), "always_nxdomain")!=0
+		   && strcmp((yyvsp[0].str), "inform")!=0 && strcmp((yyvsp[0].str), "inform_deny")!=0)
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
-				"typetransparent, inform, inform_deny "
-				"or nodefault");
+				"typetransparent, inform, inform_deny, "
+				"always_transparent, always_refuse, "
+				"always_nxdomain or nodefault");
 		else if(strcmp((yyvsp[0].str), "nodefault")==0) {
 			if(!cfg_strlist_insert(&cfg_parser->cfg->
 				local_zones_nodefault, (yyvsp[-1].str)))
@@ -3416,21 +3477,21 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 3420 "util/configparser.c" /* yacc.c:1646  */
+#line 3481 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 259:
-#line 1238 "util/configparser.y" /* yacc.c:1646  */
+  case 265:
+#line 1273 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[0].str)))
 			fatal_exit("out of memory adding local-data");
 	}
-#line 3430 "util/configparser.c" /* yacc.c:1646  */
+#line 3491 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 260:
-#line 1245 "util/configparser.y" /* yacc.c:1646  */
+  case 266:
+#line 1280 "util/configparser.y" /* yacc.c:1646  */
     {
 		char* ptr;
 		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -3444,11 +3505,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 3448 "util/configparser.c" /* yacc.c:1646  */
+#line 3509 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 261:
-#line 1260 "util/configparser.y" /* yacc.c:1646  */
+  case 267:
+#line 1295 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3457,11 +3518,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3461 "util/configparser.c" /* yacc.c:1646  */
+#line 3522 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 262:
-#line 1270 "util/configparser.y" /* yacc.c:1646  */
+  case 268:
+#line 1305 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3470,31 +3531,31 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3474 "util/configparser.c" /* yacc.c:1646  */
+#line 3535 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 263:
-#line 1280 "util/configparser.y" /* yacc.c:1646  */
+  case 269:
+#line 1315 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->max_udp_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3484 "util/configparser.c" /* yacc.c:1646  */
+#line 3545 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 264:
-#line 1287 "util/configparser.y" /* yacc.c:1646  */
+  case 270:
+#line 1322 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dns64_prefix);
 		cfg_parser->cfg->dns64_prefix = (yyvsp[0].str);
 	}
-#line 3494 "util/configparser.c" /* yacc.c:1646  */
+#line 3555 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 265:
-#line 1294 "util/configparser.y" /* yacc.c:1646  */
+  case 271:
+#line 1329 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3502,11 +3563,11 @@ yyreduce:
 		else cfg_parser->cfg->dns64_synthall = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3506 "util/configparser.c" /* yacc.c:1646  */
+#line 3567 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 266:
-#line 1303 "util/configparser.y" /* yacc.c:1646  */
+  case 272:
+#line 1338 "util/configparser.y" /* yacc.c:1646  */
     {
 		char* p, *s = (yyvsp[0].str);
 		OUTYY(("P(server_define_tag:%s)\n", (yyvsp[0].str)));
@@ -3519,11 +3580,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3523 "util/configparser.c" /* yacc.c:1646  */
+#line 3584 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 267:
-#line 1317 "util/configparser.y" /* yacc.c:1646  */
+  case 273:
+#line 1352 "util/configparser.y" /* yacc.c:1646  */
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -3541,11 +3602,78 @@ yyreduce:
 			}
 		}
 	}
-#line 3545 "util/configparser.c" /* yacc.c:1646  */
+#line 3606 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 268:
-#line 1336 "util/configparser.y" /* yacc.c:1646  */
+  case 274:
+#line 1371 "util/configparser.y" /* yacc.c:1646  */
+    {
+		size_t len = 0;
+		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
+			&len);
+		free((yyvsp[0].str));
+		OUTYY(("P(server_access_control_tag:%s)\n", (yyvsp[-1].str)));
+		if(!bitlist)
+			yyerror("could not parse tags, (define-tag them first)");
+		if(bitlist) {
+			if(!cfg_strbytelist_insert(
+				&cfg_parser->cfg->acl_tags,
+				(yyvsp[-1].str), bitlist, len)) {
+				yyerror("out of memory");
+				free((yyvsp[-1].str));
+			}
+		}
+	}
+#line 3628 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 275:
+#line 1390 "util/configparser.y" /* yacc.c:1646  */
+    {
+		OUTYY(("P(server_access_control_tag_action:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
+		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_actions,
+			(yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str))) {
+			yyerror("out of memory");
+			free((yyvsp[-2].str));
+			free((yyvsp[-1].str));
+			free((yyvsp[0].str));
+		}
+	}
+#line 3643 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 276:
+#line 1402 "util/configparser.y" /* yacc.c:1646  */
+    {
+		OUTYY(("P(server_access_control_tag_data:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
+		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_datas,
+			(yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str))) {
+			yyerror("out of memory");
+			free((yyvsp[-2].str));
+			free((yyvsp[-1].str));
+			free((yyvsp[0].str));
+		}
+	}
+#line 3658 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 277:
+#line 1414 "util/configparser.y" /* yacc.c:1646  */
+    {
+		OUTYY(("P(server_local_zone_override:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
+		if(!cfg_str3list_insert(&cfg_parser->cfg->local_zone_overrides,
+			(yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str))) {
+			yyerror("out of memory");
+			free((yyvsp[-2].str));
+			free((yyvsp[-1].str));
+			free((yyvsp[0].str));
+		}
+	}
+#line 3673 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 278:
+#line 1426 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3553,22 +3681,22 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3557 "util/configparser.c" /* yacc.c:1646  */
+#line 3685 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 269:
-#line 1345 "util/configparser.y" /* yacc.c:1646  */
+  case 279:
+#line 1435 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ratelimit_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ratelimit_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3568 "util/configparser.c" /* yacc.c:1646  */
+#line 3696 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 270:
-#line 1353 "util/configparser.y" /* yacc.c:1646  */
+  case 280:
+#line 1443 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3580,11 +3708,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3584 "util/configparser.c" /* yacc.c:1646  */
+#line 3712 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 271:
-#line 1366 "util/configparser.y" /* yacc.c:1646  */
+  case 281:
+#line 1456 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -3596,11 +3724,11 @@ yyreduce:
 					"ratelimit-for-domain");
 		}
 	}
-#line 3600 "util/configparser.c" /* yacc.c:1646  */
+#line 3728 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 272:
-#line 1379 "util/configparser.y" /* yacc.c:1646  */
+  case 282:
+#line 1469 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -3612,11 +3740,11 @@ yyreduce:
 					"ratelimit-below-domain");
 		}
 	}
-#line 3616 "util/configparser.c" /* yacc.c:1646  */
+#line 3744 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 273:
-#line 1392 "util/configparser.y" /* yacc.c:1646  */
+  case 283:
+#line 1482 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3624,11 +3752,11 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit_factor = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3628 "util/configparser.c" /* yacc.c:1646  */
+#line 3756 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 274:
-#line 1401 "util/configparser.y" /* yacc.c:1646  */
+  case 284:
+#line 1491 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_qname_minimisation:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3637,11 +3765,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3641 "util/configparser.c" /* yacc.c:1646  */
+#line 3769 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 275:
-#line 1411 "util/configparser.y" /* yacc.c:1646  */
+  case 285:
+#line 1501 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->stubs->name)
@@ -3650,31 +3778,31 @@ yyreduce:
 		free(cfg_parser->cfg->stubs->name);
 		cfg_parser->cfg->stubs->name = (yyvsp[0].str);
 	}
-#line 3654 "util/configparser.c" /* yacc.c:1646  */
+#line 3782 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 276:
-#line 1421 "util/configparser.y" /* yacc.c:1646  */
+  case 286:
+#line 1511 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3664 "util/configparser.c" /* yacc.c:1646  */
+#line 3792 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 277:
-#line 1428 "util/configparser.y" /* yacc.c:1646  */
+  case 287:
+#line 1518 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3674 "util/configparser.c" /* yacc.c:1646  */
+#line 3802 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 278:
-#line 1435 "util/configparser.y" /* yacc.c:1646  */
+  case 288:
+#line 1525 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(stub-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3682,11 +3810,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3686 "util/configparser.c" /* yacc.c:1646  */
+#line 3814 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 279:
-#line 1444 "util/configparser.y" /* yacc.c:1646  */
+  case 289:
+#line 1534 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3695,11 +3823,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3699 "util/configparser.c" /* yacc.c:1646  */
+#line 3827 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 280:
-#line 1454 "util/configparser.y" /* yacc.c:1646  */
+  case 290:
+#line 1544 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->forwards->name)
@@ -3708,31 +3836,31 @@ yyreduce:
 		free(cfg_parser->cfg->forwards->name);
 		cfg_parser->cfg->forwards->name = (yyvsp[0].str);
 	}
-#line 3712 "util/configparser.c" /* yacc.c:1646  */
+#line 3840 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 281:
-#line 1464 "util/configparser.y" /* yacc.c:1646  */
+  case 291:
+#line 1554 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3722 "util/configparser.c" /* yacc.c:1646  */
+#line 3850 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 282:
-#line 1471 "util/configparser.y" /* yacc.c:1646  */
+  case 292:
+#line 1561 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3732 "util/configparser.c" /* yacc.c:1646  */
+#line 3860 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 283:
-#line 1478 "util/configparser.y" /* yacc.c:1646  */
+  case 293:
+#line 1568 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(forward-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3740,19 +3868,19 @@ yyreduce:
 		else cfg_parser->cfg->forwards->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3744 "util/configparser.c" /* yacc.c:1646  */
+#line 3872 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 284:
-#line 1487 "util/configparser.y" /* yacc.c:1646  */
+  case 294:
+#line 1577 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
-#line 3752 "util/configparser.c" /* yacc.c:1646  */
+#line 3880 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 295:
-#line 1498 "util/configparser.y" /* yacc.c:1646  */
+  case 305:
+#line 1588 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3761,11 +3889,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3765 "util/configparser.c" /* yacc.c:1646  */
+#line 3893 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 296:
-#line 1508 "util/configparser.y" /* yacc.c:1646  */
+  case 306:
+#line 1598 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3773,21 +3901,21 @@ yyreduce:
 		else cfg_parser->cfg->control_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3777 "util/configparser.c" /* yacc.c:1646  */
+#line 3905 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 297:
-#line 1517 "util/configparser.y" /* yacc.c:1646  */
+  case 307:
+#line 1607 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->control_ifs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3787 "util/configparser.c" /* yacc.c:1646  */
+#line 3915 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 298:
-#line 1524 "util/configparser.y" /* yacc.c:1646  */
+  case 308:
+#line 1614 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3796,122 +3924,122 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3800 "util/configparser.c" /* yacc.c:1646  */
+#line 3928 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 299:
-#line 1534 "util/configparser.y" /* yacc.c:1646  */
+  case 309:
+#line 1624 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_key_file);
 		cfg_parser->cfg->server_key_file = (yyvsp[0].str);
 	}
-#line 3810 "util/configparser.c" /* yacc.c:1646  */
+#line 3938 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 300:
-#line 1541 "util/configparser.y" /* yacc.c:1646  */
+  case 310:
+#line 1631 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_cert_file);
 		cfg_parser->cfg->server_cert_file = (yyvsp[0].str);
 	}
-#line 3820 "util/configparser.c" /* yacc.c:1646  */
+#line 3948 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 301:
-#line 1548 "util/configparser.y" /* yacc.c:1646  */
+  case 311:
+#line 1638 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_key_file);
 		cfg_parser->cfg->control_key_file = (yyvsp[0].str);
 	}
-#line 3830 "util/configparser.c" /* yacc.c:1646  */
+#line 3958 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 302:
-#line 1555 "util/configparser.y" /* yacc.c:1646  */
+  case 312:
+#line 1645 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_cert_file);
 		cfg_parser->cfg->control_cert_file = (yyvsp[0].str);
 	}
-#line 3840 "util/configparser.c" /* yacc.c:1646  */
+#line 3968 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 303:
-#line 1562 "util/configparser.y" /* yacc.c:1646  */
+  case 313:
+#line 1652 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("\nP(dnstap:)\n"));
 	}
-#line 3848 "util/configparser.c" /* yacc.c:1646  */
+#line 3976 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 318:
-#line 1579 "util/configparser.y" /* yacc.c:1646  */
+  case 328:
+#line 1669 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
 			yyerror("expected yes or no.");
 		else cfg_parser->cfg->dnstap = (strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 3859 "util/configparser.c" /* yacc.c:1646  */
+#line 3987 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 319:
-#line 1587 "util/configparser.y" /* yacc.c:1646  */
+  case 329:
+#line 1677 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_socket_path);
 		cfg_parser->cfg->dnstap_socket_path = (yyvsp[0].str);
 	}
-#line 3869 "util/configparser.c" /* yacc.c:1646  */
+#line 3997 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 320:
-#line 1594 "util/configparser.y" /* yacc.c:1646  */
+  case 330:
+#line 1684 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
 			yyerror("expected yes or no.");
 		else cfg_parser->cfg->dnstap_send_identity = (strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 3880 "util/configparser.c" /* yacc.c:1646  */
+#line 4008 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 321:
-#line 1602 "util/configparser.y" /* yacc.c:1646  */
+  case 331:
+#line 1692 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
 			yyerror("expected yes or no.");
 		else cfg_parser->cfg->dnstap_send_version = (strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 3891 "util/configparser.c" /* yacc.c:1646  */
+#line 4019 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 322:
-#line 1610 "util/configparser.y" /* yacc.c:1646  */
+  case 332:
+#line 1700 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_identity);
 		cfg_parser->cfg->dnstap_identity = (yyvsp[0].str);
 	}
-#line 3901 "util/configparser.c" /* yacc.c:1646  */
+#line 4029 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 323:
-#line 1617 "util/configparser.y" /* yacc.c:1646  */
+  case 333:
+#line 1707 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_version);
 		cfg_parser->cfg->dnstap_version = (yyvsp[0].str);
 	}
-#line 3911 "util/configparser.c" /* yacc.c:1646  */
+#line 4039 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 324:
-#line 1624 "util/configparser.y" /* yacc.c:1646  */
+  case 334:
+#line 1714 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3919,11 +4047,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_resolver_query_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 3923 "util/configparser.c" /* yacc.c:1646  */
+#line 4051 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 325:
-#line 1633 "util/configparser.y" /* yacc.c:1646  */
+  case 335:
+#line 1723 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3931,11 +4059,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_resolver_response_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 3935 "util/configparser.c" /* yacc.c:1646  */
+#line 4063 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 326:
-#line 1642 "util/configparser.y" /* yacc.c:1646  */
+  case 336:
+#line 1732 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3943,11 +4071,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_client_query_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 3947 "util/configparser.c" /* yacc.c:1646  */
+#line 4075 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 327:
-#line 1651 "util/configparser.y" /* yacc.c:1646  */
+  case 337:
+#line 1741 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3955,11 +4083,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_client_response_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 3959 "util/configparser.c" /* yacc.c:1646  */
+#line 4087 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 328:
-#line 1660 "util/configparser.y" /* yacc.c:1646  */
+  case 338:
+#line 1750 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3967,11 +4095,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_forwarder_query_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 3971 "util/configparser.c" /* yacc.c:1646  */
+#line 4099 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 329:
-#line 1669 "util/configparser.y" /* yacc.c:1646  */
+  case 339:
+#line 1759 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3979,29 +4107,29 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_forwarder_response_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 3983 "util/configparser.c" /* yacc.c:1646  */
+#line 4111 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 330:
-#line 1678 "util/configparser.y" /* yacc.c:1646  */
+  case 340:
+#line 1768 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("\nP(python:)\n")); 
 	}
-#line 3991 "util/configparser.c" /* yacc.c:1646  */
+#line 4119 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 334:
-#line 1687 "util/configparser.y" /* yacc.c:1646  */
+  case 344:
+#line 1777 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->python_script);
 		cfg_parser->cfg->python_script = (yyvsp[0].str);
 	}
-#line 4001 "util/configparser.c" /* yacc.c:1646  */
+#line 4129 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 335:
-#line 1693 "util/configparser.y" /* yacc.c:1646  */
+  case 345:
+#line 1783 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(disable_dnssec_lame_check:%s)\n", (yyvsp[0].str)));
 		if (strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4010,11 +4138,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4014 "util/configparser.c" /* yacc.c:1646  */
+#line 4142 "util/configparser.c" /* yacc.c:1646  */
     break;
 
 
-#line 4018 "util/configparser.c" /* yacc.c:1646  */
+#line 4146 "util/configparser.c" /* yacc.c:1646  */
       default: break;
     }
   /* User semantic actions sometimes alter yychar, and that requires
@@ -4242,7 +4370,7 @@ yyreturn:
 #endif
   return yyresult;
 }
-#line 1701 "util/configparser.y" /* yacc.c:1906  */
+#line 1791 "util/configparser.y" /* yacc.c:1906  */
 
 
 /* parse helper routines could be here */
diff --git a/util/configparser.h b/util/configparser.h
index 135e4449a6ab..8e6df7a0de0a 100644
--- a/util/configparser.h
+++ b/util/configparser.h
@@ -61,157 +61,162 @@ extern int yydebug;
     VAR_INTERFACE = 271,
     VAR_DO_IP4 = 272,
     VAR_DO_IP6 = 273,
-    VAR_DO_UDP = 274,
-    VAR_DO_TCP = 275,
-    VAR_TCP_MSS = 276,
-    VAR_OUTGOING_TCP_MSS = 277,
-    VAR_CHROOT = 278,
-    VAR_USERNAME = 279,
-    VAR_DIRECTORY = 280,
-    VAR_LOGFILE = 281,
-    VAR_PIDFILE = 282,
-    VAR_MSG_CACHE_SIZE = 283,
-    VAR_MSG_CACHE_SLABS = 284,
-    VAR_NUM_QUERIES_PER_THREAD = 285,
-    VAR_RRSET_CACHE_SIZE = 286,
-    VAR_RRSET_CACHE_SLABS = 287,
-    VAR_OUTGOING_NUM_TCP = 288,
-    VAR_INFRA_HOST_TTL = 289,
-    VAR_INFRA_LAME_TTL = 290,
-    VAR_INFRA_CACHE_SLABS = 291,
-    VAR_INFRA_CACHE_NUMHOSTS = 292,
-    VAR_INFRA_CACHE_LAME_SIZE = 293,
-    VAR_NAME = 294,
-    VAR_STUB_ZONE = 295,
-    VAR_STUB_HOST = 296,
-    VAR_STUB_ADDR = 297,
-    VAR_TARGET_FETCH_POLICY = 298,
-    VAR_HARDEN_SHORT_BUFSIZE = 299,
-    VAR_HARDEN_LARGE_QUERIES = 300,
-    VAR_FORWARD_ZONE = 301,
-    VAR_FORWARD_HOST = 302,
-    VAR_FORWARD_ADDR = 303,
-    VAR_DO_NOT_QUERY_ADDRESS = 304,
-    VAR_HIDE_IDENTITY = 305,
-    VAR_HIDE_VERSION = 306,
-    VAR_IDENTITY = 307,
-    VAR_VERSION = 308,
-    VAR_HARDEN_GLUE = 309,
-    VAR_MODULE_CONF = 310,
-    VAR_TRUST_ANCHOR_FILE = 311,
-    VAR_TRUST_ANCHOR = 312,
-    VAR_VAL_OVERRIDE_DATE = 313,
-    VAR_BOGUS_TTL = 314,
-    VAR_VAL_CLEAN_ADDITIONAL = 315,
-    VAR_VAL_PERMISSIVE_MODE = 316,
-    VAR_INCOMING_NUM_TCP = 317,
-    VAR_MSG_BUFFER_SIZE = 318,
-    VAR_KEY_CACHE_SIZE = 319,
-    VAR_KEY_CACHE_SLABS = 320,
-    VAR_TRUSTED_KEYS_FILE = 321,
-    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 322,
-    VAR_USE_SYSLOG = 323,
-    VAR_OUTGOING_INTERFACE = 324,
-    VAR_ROOT_HINTS = 325,
-    VAR_DO_NOT_QUERY_LOCALHOST = 326,
-    VAR_CACHE_MAX_TTL = 327,
-    VAR_HARDEN_DNSSEC_STRIPPED = 328,
-    VAR_ACCESS_CONTROL = 329,
-    VAR_LOCAL_ZONE = 330,
-    VAR_LOCAL_DATA = 331,
-    VAR_INTERFACE_AUTOMATIC = 332,
-    VAR_STATISTICS_INTERVAL = 333,
-    VAR_DO_DAEMONIZE = 334,
-    VAR_USE_CAPS_FOR_ID = 335,
-    VAR_STATISTICS_CUMULATIVE = 336,
-    VAR_OUTGOING_PORT_PERMIT = 337,
-    VAR_OUTGOING_PORT_AVOID = 338,
-    VAR_DLV_ANCHOR_FILE = 339,
-    VAR_DLV_ANCHOR = 340,
-    VAR_NEG_CACHE_SIZE = 341,
-    VAR_HARDEN_REFERRAL_PATH = 342,
-    VAR_PRIVATE_ADDRESS = 343,
-    VAR_PRIVATE_DOMAIN = 344,
-    VAR_REMOTE_CONTROL = 345,
-    VAR_CONTROL_ENABLE = 346,
-    VAR_CONTROL_INTERFACE = 347,
-    VAR_CONTROL_PORT = 348,
-    VAR_SERVER_KEY_FILE = 349,
-    VAR_SERVER_CERT_FILE = 350,
-    VAR_CONTROL_KEY_FILE = 351,
-    VAR_CONTROL_CERT_FILE = 352,
-    VAR_CONTROL_USE_CERT = 353,
-    VAR_EXTENDED_STATISTICS = 354,
-    VAR_LOCAL_DATA_PTR = 355,
-    VAR_JOSTLE_TIMEOUT = 356,
-    VAR_STUB_PRIME = 357,
-    VAR_UNWANTED_REPLY_THRESHOLD = 358,
-    VAR_LOG_TIME_ASCII = 359,
-    VAR_DOMAIN_INSECURE = 360,
-    VAR_PYTHON = 361,
-    VAR_PYTHON_SCRIPT = 362,
-    VAR_VAL_SIG_SKEW_MIN = 363,
-    VAR_VAL_SIG_SKEW_MAX = 364,
-    VAR_CACHE_MIN_TTL = 365,
-    VAR_VAL_LOG_LEVEL = 366,
-    VAR_AUTO_TRUST_ANCHOR_FILE = 367,
-    VAR_KEEP_MISSING = 368,
-    VAR_ADD_HOLDDOWN = 369,
-    VAR_DEL_HOLDDOWN = 370,
-    VAR_SO_RCVBUF = 371,
-    VAR_EDNS_BUFFER_SIZE = 372,
-    VAR_PREFETCH = 373,
-    VAR_PREFETCH_KEY = 374,
-    VAR_SO_SNDBUF = 375,
-    VAR_SO_REUSEPORT = 376,
-    VAR_HARDEN_BELOW_NXDOMAIN = 377,
-    VAR_IGNORE_CD_FLAG = 378,
-    VAR_LOG_QUERIES = 379,
-    VAR_TCP_UPSTREAM = 380,
-    VAR_SSL_UPSTREAM = 381,
-    VAR_SSL_SERVICE_KEY = 382,
-    VAR_SSL_SERVICE_PEM = 383,
-    VAR_SSL_PORT = 384,
-    VAR_FORWARD_FIRST = 385,
-    VAR_STUB_FIRST = 386,
-    VAR_MINIMAL_RESPONSES = 387,
-    VAR_RRSET_ROUNDROBIN = 388,
-    VAR_MAX_UDP_SIZE = 389,
-    VAR_DELAY_CLOSE = 390,
-    VAR_UNBLOCK_LAN_ZONES = 391,
-    VAR_INSECURE_LAN_ZONES = 392,
-    VAR_INFRA_CACHE_MIN_RTT = 393,
-    VAR_DNS64_PREFIX = 394,
-    VAR_DNS64_SYNTHALL = 395,
-    VAR_DNSTAP = 396,
-    VAR_DNSTAP_ENABLE = 397,
-    VAR_DNSTAP_SOCKET_PATH = 398,
-    VAR_DNSTAP_SEND_IDENTITY = 399,
-    VAR_DNSTAP_SEND_VERSION = 400,
-    VAR_DNSTAP_IDENTITY = 401,
-    VAR_DNSTAP_VERSION = 402,
-    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 403,
-    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 404,
-    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 405,
-    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 406,
-    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 407,
-    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 408,
-    VAR_HARDEN_ALGO_DOWNGRADE = 409,
-    VAR_IP_TRANSPARENT = 410,
-    VAR_DISABLE_DNSSEC_LAME_CHECK = 411,
-    VAR_RATELIMIT = 412,
-    VAR_RATELIMIT_SLABS = 413,
-    VAR_RATELIMIT_SIZE = 414,
-    VAR_RATELIMIT_FOR_DOMAIN = 415,
-    VAR_RATELIMIT_BELOW_DOMAIN = 416,
-    VAR_RATELIMIT_FACTOR = 417,
-    VAR_CAPS_WHITELIST = 418,
-    VAR_CACHE_MAX_NEGATIVE_TTL = 419,
-    VAR_PERMIT_SMALL_HOLDDOWN = 420,
-    VAR_QNAME_MINIMISATION = 421,
-    VAR_IP_FREEBIND = 422,
-    VAR_DEFINE_TAG = 423,
-    VAR_LOCAL_ZONE_TAG = 424
+    VAR_PREFER_IP6 = 274,
+    VAR_DO_UDP = 275,
+    VAR_DO_TCP = 276,
+    VAR_TCP_MSS = 277,
+    VAR_OUTGOING_TCP_MSS = 278,
+    VAR_CHROOT = 279,
+    VAR_USERNAME = 280,
+    VAR_DIRECTORY = 281,
+    VAR_LOGFILE = 282,
+    VAR_PIDFILE = 283,
+    VAR_MSG_CACHE_SIZE = 284,
+    VAR_MSG_CACHE_SLABS = 285,
+    VAR_NUM_QUERIES_PER_THREAD = 286,
+    VAR_RRSET_CACHE_SIZE = 287,
+    VAR_RRSET_CACHE_SLABS = 288,
+    VAR_OUTGOING_NUM_TCP = 289,
+    VAR_INFRA_HOST_TTL = 290,
+    VAR_INFRA_LAME_TTL = 291,
+    VAR_INFRA_CACHE_SLABS = 292,
+    VAR_INFRA_CACHE_NUMHOSTS = 293,
+    VAR_INFRA_CACHE_LAME_SIZE = 294,
+    VAR_NAME = 295,
+    VAR_STUB_ZONE = 296,
+    VAR_STUB_HOST = 297,
+    VAR_STUB_ADDR = 298,
+    VAR_TARGET_FETCH_POLICY = 299,
+    VAR_HARDEN_SHORT_BUFSIZE = 300,
+    VAR_HARDEN_LARGE_QUERIES = 301,
+    VAR_FORWARD_ZONE = 302,
+    VAR_FORWARD_HOST = 303,
+    VAR_FORWARD_ADDR = 304,
+    VAR_DO_NOT_QUERY_ADDRESS = 305,
+    VAR_HIDE_IDENTITY = 306,
+    VAR_HIDE_VERSION = 307,
+    VAR_IDENTITY = 308,
+    VAR_VERSION = 309,
+    VAR_HARDEN_GLUE = 310,
+    VAR_MODULE_CONF = 311,
+    VAR_TRUST_ANCHOR_FILE = 312,
+    VAR_TRUST_ANCHOR = 313,
+    VAR_VAL_OVERRIDE_DATE = 314,
+    VAR_BOGUS_TTL = 315,
+    VAR_VAL_CLEAN_ADDITIONAL = 316,
+    VAR_VAL_PERMISSIVE_MODE = 317,
+    VAR_INCOMING_NUM_TCP = 318,
+    VAR_MSG_BUFFER_SIZE = 319,
+    VAR_KEY_CACHE_SIZE = 320,
+    VAR_KEY_CACHE_SLABS = 321,
+    VAR_TRUSTED_KEYS_FILE = 322,
+    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 323,
+    VAR_USE_SYSLOG = 324,
+    VAR_OUTGOING_INTERFACE = 325,
+    VAR_ROOT_HINTS = 326,
+    VAR_DO_NOT_QUERY_LOCALHOST = 327,
+    VAR_CACHE_MAX_TTL = 328,
+    VAR_HARDEN_DNSSEC_STRIPPED = 329,
+    VAR_ACCESS_CONTROL = 330,
+    VAR_LOCAL_ZONE = 331,
+    VAR_LOCAL_DATA = 332,
+    VAR_INTERFACE_AUTOMATIC = 333,
+    VAR_STATISTICS_INTERVAL = 334,
+    VAR_DO_DAEMONIZE = 335,
+    VAR_USE_CAPS_FOR_ID = 336,
+    VAR_STATISTICS_CUMULATIVE = 337,
+    VAR_OUTGOING_PORT_PERMIT = 338,
+    VAR_OUTGOING_PORT_AVOID = 339,
+    VAR_DLV_ANCHOR_FILE = 340,
+    VAR_DLV_ANCHOR = 341,
+    VAR_NEG_CACHE_SIZE = 342,
+    VAR_HARDEN_REFERRAL_PATH = 343,
+    VAR_PRIVATE_ADDRESS = 344,
+    VAR_PRIVATE_DOMAIN = 345,
+    VAR_REMOTE_CONTROL = 346,
+    VAR_CONTROL_ENABLE = 347,
+    VAR_CONTROL_INTERFACE = 348,
+    VAR_CONTROL_PORT = 349,
+    VAR_SERVER_KEY_FILE = 350,
+    VAR_SERVER_CERT_FILE = 351,
+    VAR_CONTROL_KEY_FILE = 352,
+    VAR_CONTROL_CERT_FILE = 353,
+    VAR_CONTROL_USE_CERT = 354,
+    VAR_EXTENDED_STATISTICS = 355,
+    VAR_LOCAL_DATA_PTR = 356,
+    VAR_JOSTLE_TIMEOUT = 357,
+    VAR_STUB_PRIME = 358,
+    VAR_UNWANTED_REPLY_THRESHOLD = 359,
+    VAR_LOG_TIME_ASCII = 360,
+    VAR_DOMAIN_INSECURE = 361,
+    VAR_PYTHON = 362,
+    VAR_PYTHON_SCRIPT = 363,
+    VAR_VAL_SIG_SKEW_MIN = 364,
+    VAR_VAL_SIG_SKEW_MAX = 365,
+    VAR_CACHE_MIN_TTL = 366,
+    VAR_VAL_LOG_LEVEL = 367,
+    VAR_AUTO_TRUST_ANCHOR_FILE = 368,
+    VAR_KEEP_MISSING = 369,
+    VAR_ADD_HOLDDOWN = 370,
+    VAR_DEL_HOLDDOWN = 371,
+    VAR_SO_RCVBUF = 372,
+    VAR_EDNS_BUFFER_SIZE = 373,
+    VAR_PREFETCH = 374,
+    VAR_PREFETCH_KEY = 375,
+    VAR_SO_SNDBUF = 376,
+    VAR_SO_REUSEPORT = 377,
+    VAR_HARDEN_BELOW_NXDOMAIN = 378,
+    VAR_IGNORE_CD_FLAG = 379,
+    VAR_LOG_QUERIES = 380,
+    VAR_TCP_UPSTREAM = 381,
+    VAR_SSL_UPSTREAM = 382,
+    VAR_SSL_SERVICE_KEY = 383,
+    VAR_SSL_SERVICE_PEM = 384,
+    VAR_SSL_PORT = 385,
+    VAR_FORWARD_FIRST = 386,
+    VAR_STUB_FIRST = 387,
+    VAR_MINIMAL_RESPONSES = 388,
+    VAR_RRSET_ROUNDROBIN = 389,
+    VAR_MAX_UDP_SIZE = 390,
+    VAR_DELAY_CLOSE = 391,
+    VAR_UNBLOCK_LAN_ZONES = 392,
+    VAR_INSECURE_LAN_ZONES = 393,
+    VAR_INFRA_CACHE_MIN_RTT = 394,
+    VAR_DNS64_PREFIX = 395,
+    VAR_DNS64_SYNTHALL = 396,
+    VAR_DNSTAP = 397,
+    VAR_DNSTAP_ENABLE = 398,
+    VAR_DNSTAP_SOCKET_PATH = 399,
+    VAR_DNSTAP_SEND_IDENTITY = 400,
+    VAR_DNSTAP_SEND_VERSION = 401,
+    VAR_DNSTAP_IDENTITY = 402,
+    VAR_DNSTAP_VERSION = 403,
+    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 404,
+    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 405,
+    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 406,
+    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 407,
+    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 408,
+    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 409,
+    VAR_HARDEN_ALGO_DOWNGRADE = 410,
+    VAR_IP_TRANSPARENT = 411,
+    VAR_DISABLE_DNSSEC_LAME_CHECK = 412,
+    VAR_RATELIMIT = 413,
+    VAR_RATELIMIT_SLABS = 414,
+    VAR_RATELIMIT_SIZE = 415,
+    VAR_RATELIMIT_FOR_DOMAIN = 416,
+    VAR_RATELIMIT_BELOW_DOMAIN = 417,
+    VAR_RATELIMIT_FACTOR = 418,
+    VAR_CAPS_WHITELIST = 419,
+    VAR_CACHE_MAX_NEGATIVE_TTL = 420,
+    VAR_PERMIT_SMALL_HOLDDOWN = 421,
+    VAR_QNAME_MINIMISATION = 422,
+    VAR_IP_FREEBIND = 423,
+    VAR_DEFINE_TAG = 424,
+    VAR_LOCAL_ZONE_TAG = 425,
+    VAR_ACCESS_CONTROL_TAG = 426,
+    VAR_LOCAL_ZONE_OVERRIDE = 427,
+    VAR_ACCESS_CONTROL_TAG_ACTION = 428,
+    VAR_ACCESS_CONTROL_TAG_DATA = 429
   };
 #endif
 /* Tokens.  */
@@ -231,157 +236,162 @@ extern int yydebug;
 #define VAR_INTERFACE 271
 #define VAR_DO_IP4 272
 #define VAR_DO_IP6 273
-#define VAR_DO_UDP 274
-#define VAR_DO_TCP 275
-#define VAR_TCP_MSS 276
-#define VAR_OUTGOING_TCP_MSS 277
-#define VAR_CHROOT 278
-#define VAR_USERNAME 279
-#define VAR_DIRECTORY 280
-#define VAR_LOGFILE 281
-#define VAR_PIDFILE 282
-#define VAR_MSG_CACHE_SIZE 283
-#define VAR_MSG_CACHE_SLABS 284
-#define VAR_NUM_QUERIES_PER_THREAD 285
-#define VAR_RRSET_CACHE_SIZE 286
-#define VAR_RRSET_CACHE_SLABS 287
-#define VAR_OUTGOING_NUM_TCP 288
-#define VAR_INFRA_HOST_TTL 289
-#define VAR_INFRA_LAME_TTL 290
-#define VAR_INFRA_CACHE_SLABS 291
-#define VAR_INFRA_CACHE_NUMHOSTS 292
-#define VAR_INFRA_CACHE_LAME_SIZE 293
-#define VAR_NAME 294
-#define VAR_STUB_ZONE 295
-#define VAR_STUB_HOST 296
-#define VAR_STUB_ADDR 297
-#define VAR_TARGET_FETCH_POLICY 298
-#define VAR_HARDEN_SHORT_BUFSIZE 299
-#define VAR_HARDEN_LARGE_QUERIES 300
-#define VAR_FORWARD_ZONE 301
-#define VAR_FORWARD_HOST 302
-#define VAR_FORWARD_ADDR 303
-#define VAR_DO_NOT_QUERY_ADDRESS 304
-#define VAR_HIDE_IDENTITY 305
-#define VAR_HIDE_VERSION 306
-#define VAR_IDENTITY 307
-#define VAR_VERSION 308
-#define VAR_HARDEN_GLUE 309
-#define VAR_MODULE_CONF 310
-#define VAR_TRUST_ANCHOR_FILE 311
-#define VAR_TRUST_ANCHOR 312
-#define VAR_VAL_OVERRIDE_DATE 313
-#define VAR_BOGUS_TTL 314
-#define VAR_VAL_CLEAN_ADDITIONAL 315
-#define VAR_VAL_PERMISSIVE_MODE 316
-#define VAR_INCOMING_NUM_TCP 317
-#define VAR_MSG_BUFFER_SIZE 318
-#define VAR_KEY_CACHE_SIZE 319
-#define VAR_KEY_CACHE_SLABS 320
-#define VAR_TRUSTED_KEYS_FILE 321
-#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 322
-#define VAR_USE_SYSLOG 323
-#define VAR_OUTGOING_INTERFACE 324
-#define VAR_ROOT_HINTS 325
-#define VAR_DO_NOT_QUERY_LOCALHOST 326
-#define VAR_CACHE_MAX_TTL 327
-#define VAR_HARDEN_DNSSEC_STRIPPED 328
-#define VAR_ACCESS_CONTROL 329
-#define VAR_LOCAL_ZONE 330
-#define VAR_LOCAL_DATA 331
-#define VAR_INTERFACE_AUTOMATIC 332
-#define VAR_STATISTICS_INTERVAL 333
-#define VAR_DO_DAEMONIZE 334
-#define VAR_USE_CAPS_FOR_ID 335
-#define VAR_STATISTICS_CUMULATIVE 336
-#define VAR_OUTGOING_PORT_PERMIT 337
-#define VAR_OUTGOING_PORT_AVOID 338
-#define VAR_DLV_ANCHOR_FILE 339
-#define VAR_DLV_ANCHOR 340
-#define VAR_NEG_CACHE_SIZE 341
-#define VAR_HARDEN_REFERRAL_PATH 342
-#define VAR_PRIVATE_ADDRESS 343
-#define VAR_PRIVATE_DOMAIN 344
-#define VAR_REMOTE_CONTROL 345
-#define VAR_CONTROL_ENABLE 346
-#define VAR_CONTROL_INTERFACE 347
-#define VAR_CONTROL_PORT 348
-#define VAR_SERVER_KEY_FILE 349
-#define VAR_SERVER_CERT_FILE 350
-#define VAR_CONTROL_KEY_FILE 351
-#define VAR_CONTROL_CERT_FILE 352
-#define VAR_CONTROL_USE_CERT 353
-#define VAR_EXTENDED_STATISTICS 354
-#define VAR_LOCAL_DATA_PTR 355
-#define VAR_JOSTLE_TIMEOUT 356
-#define VAR_STUB_PRIME 357
-#define VAR_UNWANTED_REPLY_THRESHOLD 358
-#define VAR_LOG_TIME_ASCII 359
-#define VAR_DOMAIN_INSECURE 360
-#define VAR_PYTHON 361
-#define VAR_PYTHON_SCRIPT 362
-#define VAR_VAL_SIG_SKEW_MIN 363
-#define VAR_VAL_SIG_SKEW_MAX 364
-#define VAR_CACHE_MIN_TTL 365
-#define VAR_VAL_LOG_LEVEL 366
-#define VAR_AUTO_TRUST_ANCHOR_FILE 367
-#define VAR_KEEP_MISSING 368
-#define VAR_ADD_HOLDDOWN 369
-#define VAR_DEL_HOLDDOWN 370
-#define VAR_SO_RCVBUF 371
-#define VAR_EDNS_BUFFER_SIZE 372
-#define VAR_PREFETCH 373
-#define VAR_PREFETCH_KEY 374
-#define VAR_SO_SNDBUF 375
-#define VAR_SO_REUSEPORT 376
-#define VAR_HARDEN_BELOW_NXDOMAIN 377
-#define VAR_IGNORE_CD_FLAG 378
-#define VAR_LOG_QUERIES 379
-#define VAR_TCP_UPSTREAM 380
-#define VAR_SSL_UPSTREAM 381
-#define VAR_SSL_SERVICE_KEY 382
-#define VAR_SSL_SERVICE_PEM 383
-#define VAR_SSL_PORT 384
-#define VAR_FORWARD_FIRST 385
-#define VAR_STUB_FIRST 386
-#define VAR_MINIMAL_RESPONSES 387
-#define VAR_RRSET_ROUNDROBIN 388
-#define VAR_MAX_UDP_SIZE 389
-#define VAR_DELAY_CLOSE 390
-#define VAR_UNBLOCK_LAN_ZONES 391
-#define VAR_INSECURE_LAN_ZONES 392
-#define VAR_INFRA_CACHE_MIN_RTT 393
-#define VAR_DNS64_PREFIX 394
-#define VAR_DNS64_SYNTHALL 395
-#define VAR_DNSTAP 396
-#define VAR_DNSTAP_ENABLE 397
-#define VAR_DNSTAP_SOCKET_PATH 398
-#define VAR_DNSTAP_SEND_IDENTITY 399
-#define VAR_DNSTAP_SEND_VERSION 400
-#define VAR_DNSTAP_IDENTITY 401
-#define VAR_DNSTAP_VERSION 402
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 403
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 404
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 405
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 406
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 407
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 408
-#define VAR_HARDEN_ALGO_DOWNGRADE 409
-#define VAR_IP_TRANSPARENT 410
-#define VAR_DISABLE_DNSSEC_LAME_CHECK 411
-#define VAR_RATELIMIT 412
-#define VAR_RATELIMIT_SLABS 413
-#define VAR_RATELIMIT_SIZE 414
-#define VAR_RATELIMIT_FOR_DOMAIN 415
-#define VAR_RATELIMIT_BELOW_DOMAIN 416
-#define VAR_RATELIMIT_FACTOR 417
-#define VAR_CAPS_WHITELIST 418
-#define VAR_CACHE_MAX_NEGATIVE_TTL 419
-#define VAR_PERMIT_SMALL_HOLDDOWN 420
-#define VAR_QNAME_MINIMISATION 421
-#define VAR_IP_FREEBIND 422
-#define VAR_DEFINE_TAG 423
-#define VAR_LOCAL_ZONE_TAG 424
+#define VAR_PREFER_IP6 274
+#define VAR_DO_UDP 275
+#define VAR_DO_TCP 276
+#define VAR_TCP_MSS 277
+#define VAR_OUTGOING_TCP_MSS 278
+#define VAR_CHROOT 279
+#define VAR_USERNAME 280
+#define VAR_DIRECTORY 281
+#define VAR_LOGFILE 282
+#define VAR_PIDFILE 283
+#define VAR_MSG_CACHE_SIZE 284
+#define VAR_MSG_CACHE_SLABS 285
+#define VAR_NUM_QUERIES_PER_THREAD 286
+#define VAR_RRSET_CACHE_SIZE 287
+#define VAR_RRSET_CACHE_SLABS 288
+#define VAR_OUTGOING_NUM_TCP 289
+#define VAR_INFRA_HOST_TTL 290
+#define VAR_INFRA_LAME_TTL 291
+#define VAR_INFRA_CACHE_SLABS 292
+#define VAR_INFRA_CACHE_NUMHOSTS 293
+#define VAR_INFRA_CACHE_LAME_SIZE 294
+#define VAR_NAME 295
+#define VAR_STUB_ZONE 296
+#define VAR_STUB_HOST 297
+#define VAR_STUB_ADDR 298
+#define VAR_TARGET_FETCH_POLICY 299
+#define VAR_HARDEN_SHORT_BUFSIZE 300
+#define VAR_HARDEN_LARGE_QUERIES 301
+#define VAR_FORWARD_ZONE 302
+#define VAR_FORWARD_HOST 303
+#define VAR_FORWARD_ADDR 304
+#define VAR_DO_NOT_QUERY_ADDRESS 305
+#define VAR_HIDE_IDENTITY 306
+#define VAR_HIDE_VERSION 307
+#define VAR_IDENTITY 308
+#define VAR_VERSION 309
+#define VAR_HARDEN_GLUE 310
+#define VAR_MODULE_CONF 311
+#define VAR_TRUST_ANCHOR_FILE 312
+#define VAR_TRUST_ANCHOR 313
+#define VAR_VAL_OVERRIDE_DATE 314
+#define VAR_BOGUS_TTL 315
+#define VAR_VAL_CLEAN_ADDITIONAL 316
+#define VAR_VAL_PERMISSIVE_MODE 317
+#define VAR_INCOMING_NUM_TCP 318
+#define VAR_MSG_BUFFER_SIZE 319
+#define VAR_KEY_CACHE_SIZE 320
+#define VAR_KEY_CACHE_SLABS 321
+#define VAR_TRUSTED_KEYS_FILE 322
+#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 323
+#define VAR_USE_SYSLOG 324
+#define VAR_OUTGOING_INTERFACE 325
+#define VAR_ROOT_HINTS 326
+#define VAR_DO_NOT_QUERY_LOCALHOST 327
+#define VAR_CACHE_MAX_TTL 328
+#define VAR_HARDEN_DNSSEC_STRIPPED 329
+#define VAR_ACCESS_CONTROL 330
+#define VAR_LOCAL_ZONE 331
+#define VAR_LOCAL_DATA 332
+#define VAR_INTERFACE_AUTOMATIC 333
+#define VAR_STATISTICS_INTERVAL 334
+#define VAR_DO_DAEMONIZE 335
+#define VAR_USE_CAPS_FOR_ID 336
+#define VAR_STATISTICS_CUMULATIVE 337
+#define VAR_OUTGOING_PORT_PERMIT 338
+#define VAR_OUTGOING_PORT_AVOID 339
+#define VAR_DLV_ANCHOR_FILE 340
+#define VAR_DLV_ANCHOR 341
+#define VAR_NEG_CACHE_SIZE 342
+#define VAR_HARDEN_REFERRAL_PATH 343
+#define VAR_PRIVATE_ADDRESS 344
+#define VAR_PRIVATE_DOMAIN 345
+#define VAR_REMOTE_CONTROL 346
+#define VAR_CONTROL_ENABLE 347
+#define VAR_CONTROL_INTERFACE 348
+#define VAR_CONTROL_PORT 349
+#define VAR_SERVER_KEY_FILE 350
+#define VAR_SERVER_CERT_FILE 351
+#define VAR_CONTROL_KEY_FILE 352
+#define VAR_CONTROL_CERT_FILE 353
+#define VAR_CONTROL_USE_CERT 354
+#define VAR_EXTENDED_STATISTICS 355
+#define VAR_LOCAL_DATA_PTR 356
+#define VAR_JOSTLE_TIMEOUT 357
+#define VAR_STUB_PRIME 358
+#define VAR_UNWANTED_REPLY_THRESHOLD 359
+#define VAR_LOG_TIME_ASCII 360
+#define VAR_DOMAIN_INSECURE 361
+#define VAR_PYTHON 362
+#define VAR_PYTHON_SCRIPT 363
+#define VAR_VAL_SIG_SKEW_MIN 364
+#define VAR_VAL_SIG_SKEW_MAX 365
+#define VAR_CACHE_MIN_TTL 366
+#define VAR_VAL_LOG_LEVEL 367
+#define VAR_AUTO_TRUST_ANCHOR_FILE 368
+#define VAR_KEEP_MISSING 369
+#define VAR_ADD_HOLDDOWN 370
+#define VAR_DEL_HOLDDOWN 371
+#define VAR_SO_RCVBUF 372
+#define VAR_EDNS_BUFFER_SIZE 373
+#define VAR_PREFETCH 374
+#define VAR_PREFETCH_KEY 375
+#define VAR_SO_SNDBUF 376
+#define VAR_SO_REUSEPORT 377
+#define VAR_HARDEN_BELOW_NXDOMAIN 378
+#define VAR_IGNORE_CD_FLAG 379
+#define VAR_LOG_QUERIES 380
+#define VAR_TCP_UPSTREAM 381
+#define VAR_SSL_UPSTREAM 382
+#define VAR_SSL_SERVICE_KEY 383
+#define VAR_SSL_SERVICE_PEM 384
+#define VAR_SSL_PORT 385
+#define VAR_FORWARD_FIRST 386
+#define VAR_STUB_FIRST 387
+#define VAR_MINIMAL_RESPONSES 388
+#define VAR_RRSET_ROUNDROBIN 389
+#define VAR_MAX_UDP_SIZE 390
+#define VAR_DELAY_CLOSE 391
+#define VAR_UNBLOCK_LAN_ZONES 392
+#define VAR_INSECURE_LAN_ZONES 393
+#define VAR_INFRA_CACHE_MIN_RTT 394
+#define VAR_DNS64_PREFIX 395
+#define VAR_DNS64_SYNTHALL 396
+#define VAR_DNSTAP 397
+#define VAR_DNSTAP_ENABLE 398
+#define VAR_DNSTAP_SOCKET_PATH 399
+#define VAR_DNSTAP_SEND_IDENTITY 400
+#define VAR_DNSTAP_SEND_VERSION 401
+#define VAR_DNSTAP_IDENTITY 402
+#define VAR_DNSTAP_VERSION 403
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 404
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 405
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 406
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 407
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 408
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 409
+#define VAR_HARDEN_ALGO_DOWNGRADE 410
+#define VAR_IP_TRANSPARENT 411
+#define VAR_DISABLE_DNSSEC_LAME_CHECK 412
+#define VAR_RATELIMIT 413
+#define VAR_RATELIMIT_SLABS 414
+#define VAR_RATELIMIT_SIZE 415
+#define VAR_RATELIMIT_FOR_DOMAIN 416
+#define VAR_RATELIMIT_BELOW_DOMAIN 417
+#define VAR_RATELIMIT_FACTOR 418
+#define VAR_CAPS_WHITELIST 419
+#define VAR_CACHE_MAX_NEGATIVE_TTL 420
+#define VAR_PERMIT_SMALL_HOLDDOWN 421
+#define VAR_QNAME_MINIMISATION 422
+#define VAR_IP_FREEBIND 423
+#define VAR_DEFINE_TAG 424
+#define VAR_LOCAL_ZONE_TAG 425
+#define VAR_ACCESS_CONTROL_TAG 426
+#define VAR_LOCAL_ZONE_OVERRIDE 427
+#define VAR_ACCESS_CONTROL_TAG_ACTION 428
+#define VAR_ACCESS_CONTROL_TAG_DATA 429
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -392,7 +402,7 @@ union YYSTYPE
 
 	char*	str;
 
-#line 396 "util/configparser.h" /* yacc.c:1909  */
+#line 406 "util/configparser.h" /* yacc.c:1909  */
 };
 
 typedef union YYSTYPE YYSTYPE;
diff --git a/util/configparser.y b/util/configparser.y
index 4ff18f0ce5c7..7240ee4bdd00 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -69,7 +69,7 @@ extern struct config_parser_state* cfg_parser;
 %token <str> STRING_ARG
 %token VAR_SERVER VAR_VERBOSITY VAR_NUM_THREADS VAR_PORT
 %token VAR_OUTGOING_RANGE VAR_INTERFACE
-%token VAR_DO_IP4 VAR_DO_IP6 VAR_DO_UDP VAR_DO_TCP 
+%token VAR_DO_IP4 VAR_DO_IP6 VAR_PREFER_IP6 VAR_DO_UDP VAR_DO_TCP
 %token VAR_TCP_MSS VAR_OUTGOING_TCP_MSS
 %token VAR_CHROOT VAR_USERNAME VAR_DIRECTORY VAR_LOGFILE VAR_PIDFILE
 %token VAR_MSG_CACHE_SIZE VAR_MSG_CACHE_SLABS VAR_NUM_QUERIES_PER_THREAD
@@ -126,6 +126,8 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_RATELIMIT_FOR_DOMAIN VAR_RATELIMIT_BELOW_DOMAIN VAR_RATELIMIT_FACTOR
 %token VAR_CAPS_WHITELIST VAR_CACHE_MAX_NEGATIVE_TTL VAR_PERMIT_SMALL_HOLDDOWN
 %token VAR_QNAME_MINIMISATION VAR_IP_FREEBIND VAR_DEFINE_TAG VAR_LOCAL_ZONE_TAG
+%token VAR_ACCESS_CONTROL_TAG VAR_LOCAL_ZONE_OVERRIDE
+%token VAR_ACCESS_CONTROL_TAG_ACTION VAR_ACCESS_CONTROL_TAG_DATA
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -144,7 +146,8 @@ contents_server: contents_server content_server
 	| ;
 content_server: server_num_threads | server_verbosity | server_port |
 	server_outgoing_range | server_do_ip4 |
-	server_do_ip6 | server_do_udp | server_do_tcp | 
+	server_do_ip6 | server_prefer_ip6 |
+	server_do_udp | server_do_tcp |
 	server_tcp_mss | server_outgoing_tcp_mss |
 	server_interface | server_chroot | server_username | 
 	server_directory | server_logfile | server_pidfile |
@@ -194,7 +197,9 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_caps_whitelist | server_cache_max_negative_ttl |
 	server_permit_small_holddown | server_qname_minimisation |
 	server_ip_freebind | server_define_tag | server_local_zone_tag |
-	server_disable_dnssec_lame_check
+	server_disable_dnssec_lame_check | server_access_control_tag |
+	server_local_zone_override | server_access_control_tag_action |
+	server_access_control_tag_data
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -402,6 +407,15 @@ server_do_tcp: VAR_DO_TCP STRING_ARG
 		free($2);
 	}
 	;
+server_prefer_ip6: VAR_PREFER_IP6 STRING_ARG
+	{
+		OUTYY(("P(server_prefer_ip6:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->prefer_ip6 = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_tcp_mss: VAR_TCP_MSS STRING_ARG
 	{
 		OUTYY(("P(server_tcp_mss:%s)\n", $2));
@@ -521,6 +535,23 @@ server_directory: VAR_DIRECTORY STRING_ARG
 		OUTYY(("P(server_directory:%s)\n", $2));
 		free(cfg_parser->cfg->directory);
 		cfg_parser->cfg->directory = $2;
+		/* change there right away for includes relative to this */
+		if($2[0]) {
+			char* d;
+#ifdef UB_ON_WINDOWS
+			w_config_adjust_directory(cfg_parser->cfg);
+#endif
+			d = cfg_parser->cfg->directory;
+			/* adjust directory if we have already chroot,
+			 * like, we reread after sighup */
+			if(cfg_parser->chroot && cfg_parser->chroot[0] &&
+				strncmp(d, cfg_parser->chroot, strlen(
+				cfg_parser->chroot)) == 0)
+				d += strlen(cfg_parser->chroot);
+			if(chdir(d))
+				log_err("cannot chdir to directory: %s (%s)",
+					d, strerror(errno));
+		}
 	}
 	;
 server_logfile: VAR_LOGFILE STRING_ARG
@@ -1216,12 +1247,16 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 		if(strcmp($3, "static")!=0 && strcmp($3, "deny")!=0 &&
 		   strcmp($3, "refuse")!=0 && strcmp($3, "redirect")!=0 &&
 		   strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
-		   && strcmp($3, "typetransparent")!=0 &&
-		   strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0)
+		   && strcmp($3, "typetransparent")!=0
+		   && strcmp($3, "always_transparent")!=0
+		   && strcmp($3, "always_refuse")!=0
+		   && strcmp($3, "always_nxdomain")!=0
+		   && strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0)
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
-				"typetransparent, inform, inform_deny "
-				"or nodefault");
+				"typetransparent, inform, inform_deny, "
+				"always_transparent, always_refuse, "
+				"always_nxdomain or nodefault");
 		else if(strcmp($3, "nodefault")==0) {
 			if(!cfg_strlist_insert(&cfg_parser->cfg->
 				local_zones_nodefault, $2))
@@ -1332,6 +1367,61 @@ server_local_zone_tag: VAR_LOCAL_ZONE_TAG STRING_ARG STRING_ARG
 		}
 	}
 	;
+server_access_control_tag: VAR_ACCESS_CONTROL_TAG STRING_ARG STRING_ARG
+	{
+		size_t len = 0;
+		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, $3,
+			&len);
+		free($3);
+		OUTYY(("P(server_access_control_tag:%s)\n", $2));
+		if(!bitlist)
+			yyerror("could not parse tags, (define-tag them first)");
+		if(bitlist) {
+			if(!cfg_strbytelist_insert(
+				&cfg_parser->cfg->acl_tags,
+				$2, bitlist, len)) {
+				yyerror("out of memory");
+				free($2);
+			}
+		}
+	}
+	;
+server_access_control_tag_action: VAR_ACCESS_CONTROL_TAG_ACTION STRING_ARG STRING_ARG STRING_ARG
+	{
+		OUTYY(("P(server_access_control_tag_action:%s %s %s)\n", $2, $3, $4));
+		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_actions,
+			$2, $3, $4)) {
+			yyerror("out of memory");
+			free($2);
+			free($3);
+			free($4);
+		}
+	}
+	;
+server_access_control_tag_data: VAR_ACCESS_CONTROL_TAG_DATA STRING_ARG STRING_ARG STRING_ARG
+	{
+		OUTYY(("P(server_access_control_tag_data:%s %s %s)\n", $2, $3, $4));
+		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_datas,
+			$2, $3, $4)) {
+			yyerror("out of memory");
+			free($2);
+			free($3);
+			free($4);
+		}
+	}
+	;
+server_local_zone_override: VAR_LOCAL_ZONE_OVERRIDE STRING_ARG STRING_ARG STRING_ARG
+	{
+		OUTYY(("P(server_local_zone_override:%s %s %s)\n", $2, $3, $4));
+		if(!cfg_str3list_insert(&cfg_parser->cfg->local_zone_overrides,
+			$2, $3, $4)) {
+			yyerror("out of memory");
+			free($2);
+			free($3);
+			free($4);
+		}
+	}
+	;
 server_ratelimit: VAR_RATELIMIT STRING_ARG 
 	{ 
 		OUTYY(("P(server_ratelimit:%s)\n", $2)); 
diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index 3856488ba347..0ac3efb68954 100644
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -1186,6 +1186,7 @@
 1525,
 1526,
 1527,
+1528,
 1529,
 1530,
 1531,
@@ -4526,7 +4527,6 @@
 6786,
 6787,
 6788,
-6789,
 6790,
 6791,
 6801,
@@ -5425,6 +5425,7 @@
 44900,
 45000,
 45054,
+45514,
 45678,
 45825,
 45966,
diff --git a/util/net_help.c b/util/net_help.c
index 5d6c033d6597..248598918b8e 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -783,7 +783,7 @@ void* outgoing_ssl_fd(void* sslctx, int fd)
 #endif
 }
 
-#if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) && defined(CRYPTO_LOCK)
+#if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) && defined(CRYPTO_LOCK) && OPENSSL_VERSION_NUMBER < 0x10100000L
 /** global lock list for openssl locks */
 static lock_basic_t *ub_openssl_locks = NULL;
 
@@ -808,7 +808,7 @@ ub_crypto_lock_cb(int mode, int type, const char *ATTR_UNUSED(file),
 
 int ub_openssl_lock_init(void)
 {
-#if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) && defined(CRYPTO_LOCK)
+#if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) && defined(CRYPTO_LOCK) && OPENSSL_VERSION_NUMBER < 0x10100000L
 	int i;
 	ub_openssl_locks = (lock_basic_t*)reallocarray(
 		NULL, (size_t)CRYPTO_num_locks(), sizeof(lock_basic_t));
@@ -825,7 +825,7 @@ int ub_openssl_lock_init(void)
 
 void ub_openssl_lock_delete(void)
 {
-#if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) && defined(CRYPTO_LOCK)
+#if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) && defined(CRYPTO_LOCK) && OPENSSL_VERSION_NUMBER < 0x10100000L
 	int i;
 	if(!ub_openssl_locks)
 		return;
diff --git a/util/netevent.c b/util/netevent.c
index bdb35739327b..8960b362c78d 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -80,8 +80,10 @@
 #  endif
 #endif
 
-/** The TCP reading or writing query timeout in seconds */
-#define TCP_QUERY_TIMEOUT 120 
+/** The TCP reading or writing query timeout in milliseconds */
+#define TCP_QUERY_TIMEOUT 120000
+/** The TCP timeout in msec for fast queries, above half are used */
+#define TCP_QUERY_TIMEOUT_FAST 200
 
 #ifndef NONBLOCKING_IS_BROKEN
 /** number of UDP reads to perform per read indication from select */
@@ -710,14 +712,20 @@ comm_point_udp_callback(int fd, short event, void* arg)
 
 /** Use a new tcp handler for new query fd, set to read query */
 static void
-setup_tcp_handler(struct comm_point* c, int fd) 
+setup_tcp_handler(struct comm_point* c, int fd, int cur, int max) 
 {
 	log_assert(c->type == comm_tcp);
 	log_assert(c->fd == -1);
 	sldns_buffer_clear(c->buffer);
 	c->tcp_is_reading = 1;
 	c->tcp_byte_count = 0;
-	comm_point_start_listening(c, fd, TCP_QUERY_TIMEOUT);
+	c->tcp_timeout_msec = TCP_QUERY_TIMEOUT;
+	/* if more than half the tcp handlers are in use, use a shorter
+	 * timeout for this TCP connection, we need to make space for
+	 * other connections to be able to get attention */
+	if(cur > max/2)
+		c->tcp_timeout_msec = TCP_QUERY_TIMEOUT_FAST;
+	comm_point_start_listening(c, fd, c->tcp_timeout_msec);
 }
 
 void comm_base_handle_slow_accept(int ATTR_UNUSED(fd),
@@ -769,7 +777,7 @@ int comm_point_perform_accept(struct comm_point* c,
 				(*b->stop_accept)(b->cb_arg);
 				/* set timeout, no mallocs */
 				tv.tv_sec = NETEVENT_SLOW_ACCEPT_TIME/1000;
-				tv.tv_usec = NETEVENT_SLOW_ACCEPT_TIME%1000;
+				tv.tv_usec = (NETEVENT_SLOW_ACCEPT_TIME%1000)*1000;
 				b->eb->slow_accept = ub_event_new(b->eb->base,
 					-1, UB_EV_TIMEOUT,
 					comm_base_handle_slow_accept, b);
@@ -862,6 +870,7 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
 	/* accept incoming connection. */
 	c_hdl = c->tcp_free;
 	log_assert(fd != -1);
+	(void)fd;
 	new_fd = comm_point_perform_accept(c, &c_hdl->repinfo.addr,
 		&c_hdl->repinfo.addrlen);
 	if(new_fd == -1)
@@ -886,7 +895,7 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
 		/* stop accepting incoming queries for now. */
 		comm_point_stop_listening(c);
 	}
-	setup_tcp_handler(c_hdl, new_fd);
+	setup_tcp_handler(c_hdl, new_fd, c->cur_tcp_count, c->max_tcp_count);
 }
 
 /** Make tcp handler free for next assignment */
@@ -940,7 +949,7 @@ tcp_callback_reader(struct comm_point* c)
 		comm_point_stop_listening(c);
 	fptr_ok(fptr_whitelist_comm_point(c->callback));
 	if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo) ) {
-		comm_point_start_listening(c, -1, TCP_QUERY_TIMEOUT);
+		comm_point_start_listening(c, -1, c->tcp_timeout_msec);
 	}
 }
 
@@ -1348,6 +1357,59 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 	if(c->ssl)
 		return ssl_handle_it(c);
 
+#ifdef USE_MSG_FASTOPEN
+	/* Only try this on first use of a connection that uses tfo, 
+	   otherwise fall through to normal write */
+	/* Also, TFO support on WINDOWS not implemented at the moment */
+	if(c->tcp_do_fastopen == 1) {
+		/* this form of sendmsg() does both a connect() and send() so need to
+		   look for various flavours of error*/
+		uint16_t len = htons(sldns_buffer_limit(c->buffer));
+		struct msghdr msg;
+		struct iovec iov[2];
+		c->tcp_do_fastopen = 0;
+		memset(&msg, 0, sizeof(msg));
+		iov[0].iov_base = (uint8_t*)&len + c->tcp_byte_count;
+		iov[0].iov_len = sizeof(uint16_t) - c->tcp_byte_count;
+		iov[1].iov_base = sldns_buffer_begin(c->buffer);
+		iov[1].iov_len = sldns_buffer_limit(c->buffer);
+		log_assert(iov[0].iov_len > 0);
+		log_assert(iov[1].iov_len > 0);
+		msg.msg_name = &c->repinfo.addr;
+		msg.msg_namelen = c->repinfo.addrlen;
+		msg.msg_iov = iov;
+		msg.msg_iovlen = 2;
+		r = sendmsg(fd, &msg, MSG_FASTOPEN);
+		if (r == -1) {
+#if defined(EINPROGRESS) && defined(EWOULDBLOCK)
+			/* Handshake is underway, maybe because no TFO cookie available.
+			   Come back to write the messsage*/
+			if(errno == EINPROGRESS || errno == EWOULDBLOCK)
+				return 1;
+#endif
+			if(errno == EINTR || errno == EAGAIN)
+				return 1;
+			/* Not handling EISCONN here as shouldn't ever hit that case.*/
+			if(errno != 0 && verbosity < 2)
+				return 0; /* silence lots of chatter in the logs */
+			else if(errno != 0) 
+				log_err_addr("tcp sendmsg", strerror(errno),
+					&c->repinfo.addr, c->repinfo.addrlen);
+			return 0;
+		} else {
+			c->tcp_byte_count += r;
+			if(c->tcp_byte_count < sizeof(uint16_t))
+				return 1;
+			sldns_buffer_set_position(c->buffer, c->tcp_byte_count - 
+				sizeof(uint16_t));
+			if(sldns_buffer_remaining(c->buffer) == 0) {
+				tcp_callback_writer(c);
+				return 1;
+			}
+		}
+	}
+#endif /* USE_MSG_FASTOPEN */
+
 	if(c->tcp_byte_count < sizeof(uint16_t)) {
 		uint16_t len = htons(sldns_buffer_limit(c->buffer));
 #ifdef HAVE_WRITEV
@@ -1540,6 +1602,9 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
 	c->do_not_close = 0;
 	c->tcp_do_toggle_rw = 0;
 	c->tcp_check_nb_connect = 0;
+#ifdef USE_MSG_FASTOPEN
+	c->tcp_do_fastopen = 0;
+#endif
 	c->inuse = 0;
 	c->callback = callback;
 	c->cb_arg = callback_arg;
@@ -1593,6 +1658,9 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 	c->inuse = 0;
 	c->tcp_do_toggle_rw = 0;
 	c->tcp_check_nb_connect = 0;
+#ifdef USE_MSG_FASTOPEN
+	c->tcp_do_fastopen = 0;
+#endif
 	c->callback = callback;
 	c->cb_arg = callback_arg;
 	evbits = UB_EV_READ | UB_EV_PERSIST;
@@ -1655,6 +1723,9 @@ comm_point_create_tcp_handler(struct comm_base *base,
 	c->do_not_close = 0;
 	c->tcp_do_toggle_rw = 1;
 	c->tcp_check_nb_connect = 0;
+#ifdef USE_MSG_FASTOPEN
+	c->tcp_do_fastopen = 0;
+#endif
 	c->repinfo.c = c;
 	c->callback = callback;
 	c->cb_arg = callback_arg;
@@ -1715,6 +1786,9 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num, size_t bufsize,
 	c->do_not_close = 0;
 	c->tcp_do_toggle_rw = 0;
 	c->tcp_check_nb_connect = 0;
+#ifdef USE_MSG_FASTOPEN
+	c->tcp_do_fastopen = 0;
+#endif
 	c->callback = NULL;
 	c->cb_arg = NULL;
 	evbits = UB_EV_READ | UB_EV_PERSIST;
@@ -1780,6 +1854,9 @@ comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
 	c->do_not_close = 0;
 	c->tcp_do_toggle_rw = 1;
 	c->tcp_check_nb_connect = 1;
+#ifdef USE_MSG_FASTOPEN
+	c->tcp_do_fastopen = 1;
+#endif
 	c->repinfo.c = c;
 	c->callback = callback;
 	c->cb_arg = callback_arg;
@@ -1834,6 +1911,9 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
 	c->do_not_close = 1;
 	c->tcp_do_toggle_rw = 0;
 	c->tcp_check_nb_connect = 0;
+#ifdef USE_MSG_FASTOPEN
+	c->tcp_do_fastopen = 0;
+#endif
 	c->callback = callback;
 	c->cb_arg = callback_arg;
 	/* ub_event stuff */
@@ -1887,6 +1967,9 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing,
 	c->do_not_close = 1;
 	c->tcp_do_toggle_rw = 0;
 	c->tcp_check_nb_connect = 0;
+#ifdef USE_MSG_FASTOPEN
+	c->tcp_do_fastopen = 0;
+#endif
 	c->callback = callback;
 	c->cb_arg = callback_arg;
 	/* ub_event stuff */
@@ -1983,7 +2066,8 @@ comm_point_send_reply(struct comm_reply *repinfo)
 			dt_msg_send_client_response(repinfo->c->tcp_parent->dtenv,
 			&repinfo->addr, repinfo->c->type, repinfo->c->buffer);
 #endif
-		comm_point_start_listening(repinfo->c, -1, TCP_QUERY_TIMEOUT);
+		comm_point_start_listening(repinfo->c, -1,
+			repinfo->c->tcp_timeout_msec);
 	}
 }
 
@@ -2009,7 +2093,7 @@ comm_point_stop_listening(struct comm_point* c)
 }
 
 void 
-comm_point_start_listening(struct comm_point* c, int newfd, int sec)
+comm_point_start_listening(struct comm_point* c, int newfd, int msec)
 {
 	verbose(VERB_ALGO, "comm point start listening %d", 
 		c->fd==-1?newfd:c->fd);
@@ -2017,7 +2101,7 @@ comm_point_start_listening(struct comm_point* c, int newfd, int sec)
 		/* no use to start listening no free slots. */
 		return;
 	}
-	if(sec != -1 && sec != 0) {
+	if(msec != -1 && msec != 0) {
 		if(!c->timeout) {
 			c->timeout = (struct timeval*)malloc(sizeof(
 				struct timeval));
@@ -2028,8 +2112,8 @@ comm_point_start_listening(struct comm_point* c, int newfd, int sec)
 		}
 		ub_event_add_bits(c->ev->ev, UB_EV_TIMEOUT);
 #ifndef S_SPLINT_S /* splint fails on struct timeval. */
-		c->timeout->tv_sec = sec;
-		c->timeout->tv_usec = 0;
+		c->timeout->tv_sec = msec/1000;
+		c->timeout->tv_usec = (msec%1000)*1000;
 #endif /* S_SPLINT_S */
 	}
 	if(c->type == comm_tcp) {
@@ -2049,7 +2133,7 @@ comm_point_start_listening(struct comm_point* c, int newfd, int sec)
 		c->fd = newfd;
 		ub_event_set_fd(c->ev->ev, c->fd);
 	}
-	if(ub_event_add(c->ev->ev, sec==0?NULL:c->timeout) != 0) {
+	if(ub_event_add(c->ev->ev, msec==0?NULL:c->timeout) != 0) {
 		log_err("event_add failed. in cpsl.");
 	}
 }
diff --git a/util/netevent.h b/util/netevent.h
index bdcddd848bd0..1d7ac0bc118b 100644
--- a/util/netevent.h
+++ b/util/netevent.h
@@ -225,9 +225,17 @@ struct comm_point {
 	    So that when that is done the callback is called. */
 	int tcp_do_toggle_rw;
 
+	/** timeout in msec for TCP wait times for this connection */
+	int tcp_timeout_msec;
+
 	/** if set, checks for pending error from nonblocking connect() call.*/
 	int tcp_check_nb_connect;
 
+#ifdef USE_MSG_FASTOPEN
+	/** used to track if the sendto() call should be done when using TFO. */
+	int tcp_do_fastopen;
+#endif
+
 	/** number of queries outstanding on this socket, used by
 	 * outside network for udp ports */
 	int inuse;
@@ -496,9 +504,10 @@ void comm_point_stop_listening(struct comm_point* c);
  * Start listening again for input on the comm point.
  * @param c: commpoint to enable again.
  * @param newfd: new fd, or -1 to leave fd be.
- * @param sec: timeout in seconds, or -1 for no (change to the) timeout.
+ * @param msec: timeout in milliseconds, or -1 for no (change to the) timeout.
+ *	So seconds*1000.
  */
-void comm_point_start_listening(struct comm_point* c, int newfd, int sec);
+void comm_point_start_listening(struct comm_point* c, int newfd, int msec);
 
 /**
  * Stop listening and start listening again for reading or writing.
diff --git a/util/storage/dnstree.c b/util/storage/dnstree.c
index 0df490ee5566..7664c479d47a 100644
--- a/util/storage/dnstree.c
+++ b/util/storage/dnstree.c
@@ -231,6 +231,19 @@ struct addr_tree_node* addr_tree_lookup(rbtree_t* tree,
         return result;
 }
 
+struct addr_tree_node* addr_tree_find(rbtree_t* tree,
+        struct sockaddr_storage* addr, socklen_t addrlen, int net)
+{
+        rbnode_t* res = NULL;
+        struct addr_tree_node key;
+        key.node.key = &key;
+        memcpy(&key.addr, addr, addrlen);
+        key.addrlen = addrlen;
+        key.net = net;
+	res = rbtree_search(tree, &key);
+	return (struct addr_tree_node*)res;
+}
+
 int
 name_tree_next_root(rbtree_t* tree, uint16_t* dclass)
 {
diff --git a/util/storage/dnstree.h b/util/storage/dnstree.h
index ec8189100f9e..b4595e19ee0f 100644
--- a/util/storage/dnstree.h
+++ b/util/storage/dnstree.h
@@ -183,6 +183,17 @@ void addr_tree_init_parents(rbtree_t* tree);
 struct addr_tree_node* addr_tree_lookup(rbtree_t* tree, 
 	struct sockaddr_storage* addr, socklen_t addrlen);
 
+/**
+ * Find element in addr tree.  (search a netblock, not a match for an address)
+ * @param tree: addr tree
+ * @param addr: netblock to lookup.
+ * @param addrlen: length of addr
+ * @param net: size of subnet
+ * @return addr tree element, or NULL if not found.
+ */
+struct addr_tree_node* addr_tree_find(rbtree_t* tree, 
+	struct sockaddr_storage* addr, socklen_t addrlen, int net);
+
 /** compare name tree nodes */
 int name_tree_compare(const void* k1, const void* k2);
 
diff --git a/util/storage/lookup3.c b/util/storage/lookup3.c
index ddcb56e7470f..e9b05af37e31 100644
--- a/util/storage/lookup3.c
+++ b/util/storage/lookup3.c
@@ -820,7 +820,7 @@ uint32_t hashbig( const void *key, size_t length, uint32_t initval)
 #ifdef SELF_TEST
 
 /* used for timings */
-void driver1()
+void driver1(void)
 {
   uint8_t buf[256];
   uint32_t i;
@@ -842,7 +842,7 @@ void driver1()
 #define HASHLEN   1
 #define MAXPAIR 60
 #define MAXLEN  70
-void driver2()
+void driver2(void)
 {
   uint8_t qa[MAXLEN+1], qb[MAXLEN+2], *a = &qa[0], *b = &qb[1];
   uint32_t c[HASHSTATE], d[HASHSTATE], i=0, j=0, k, l, m=0, z;
@@ -912,7 +912,7 @@ void driver2()
 }
 
 /* Check for reading beyond the end of the buffer and alignment problems */
-void driver3()
+void driver3(void)
 {
   uint8_t buf[MAXLEN+20], *b;
   uint32_t len;
@@ -1003,7 +1003,7 @@ void driver3()
 }
 
 /* check for problems with nulls */
- void driver4()
+ void driver4(void)
 {
   uint8_t buf[1];
   uint32_t h,i,state[HASHSTATE];
@@ -1020,7 +1020,7 @@ void driver3()
 }
 
 
-int main()
+int main(void)
 {
   driver1();   /* test that the key is hashed: used for timings */
   driver2();   /* test that whole key is hashed thoroughly */
diff --git a/util/ub_event.c b/util/ub_event.c
index af2a18ea0fc8..3b92be1a3025 100644
--- a/util/ub_event.c
+++ b/util/ub_event.c
@@ -132,16 +132,12 @@ static void (*NATIVE_BITS_CB(void (*cb)(int, short, void*)))(int, short, void*)
 #define EVFLAG_AUTO 0
 #endif
 
-#define AS_EVENT_BASE(x) \
-	(((union {struct ub_event_base* a; struct event_base* b;})x).b)
-#define AS_UB_EVENT_BASE(x) \
-	(((union {struct event_base* a; struct ub_event_base* b;})x).b)
-#define AS_EVENT(x) \
-	(((union {struct ub_event* a; struct event* b;})x).b)
-#define AS_UB_EVENT(x) \
-	(((union {struct event* a; struct ub_event* b;})x).b)
-
-const char* ub_event_get_version()
+#define AS_EVENT_BASE(x) ((struct event_base*)x)
+#define AS_UB_EVENT_BASE(x) ((struct ub_event_base*)x)
+#define AS_EVENT(x) ((struct event*)x)
+#define AS_UB_EVENT(x) ((struct ub_event*)x)
+
+const char* ub_event_get_version(void)
 {
 	return event_get_version();
 }
diff --git a/util/ub_event.h b/util/ub_event.h
index cb42e7a7d23b..9739e6d833ee 100644
--- a/util/ub_event.h
+++ b/util/ub_event.h
@@ -63,7 +63,7 @@ struct event_base;
  * daemon compile, and will be "pluggable-event<PACKAGE_VERSION>" for 
  * libunbound.
  */
-const char* ub_event_get_version();
+const char* ub_event_get_version(void);
 /** Return the name, system and method for the pluggable event base */
 void ub_get_event_sys(struct ub_event_base*, const char** n, const char** s,
 	const char** m);
diff --git a/util/ub_event_pluggable.c b/util/ub_event_pluggable.c
index 5c517555e71b..4a9451263b7c 100644
--- a/util/ub_event_pluggable.c
+++ b/util/ub_event_pluggable.c
@@ -144,12 +144,10 @@ struct my_event {
 	struct event ev;
 };
 
-#define AS_MY_EVENT_BASE(x) \
-	(((union {struct ub_event_base* a; struct my_event_base* b;})x).b)
-#define AS_MY_EVENT(x) \
-	(((union {struct ub_event* a; struct my_event* b;})x).b)
+#define AS_MY_EVENT_BASE(x) ((struct my_event_base*)x)
+#define AS_MY_EVENT(x) ((struct my_event*)x)
 
-const char* ub_event_get_version()
+const char* ub_event_get_version(void)
 {
 	return "pluggable-event"PACKAGE_VERSION;
 }
@@ -597,7 +595,7 @@ ub_event_add(struct ub_event* ev, struct timeval* tv)
 int
 ub_event_del(struct ub_event* ev)
 {
-	if (ev->magic == UB_EVENT_MAGIC) {
+	if (ev && ev->magic == UB_EVENT_MAGIC) {
 		fptr_ok(ev->vmt != &default_event_vmt ||
 			ev->vmt->del == my_event_del);
 		return (*ev->vmt->del)(ev);
@@ -620,7 +618,7 @@ ub_timer_add(struct ub_event* ev, struct ub_event_base* base,
 int
 ub_timer_del(struct ub_event* ev)
 {
-	if (ev->magic == UB_EVENT_MAGIC) {
+	if (ev && ev->magic == UB_EVENT_MAGIC) {
 		fptr_ok(ev->vmt != &default_event_vmt ||
 			ev->vmt->del_timer == my_timer_del);
 		return (*ev->vmt->del_timer)(ev);
@@ -642,7 +640,7 @@ ub_signal_add(struct ub_event* ev, struct timeval* tv)
 int
 ub_signal_del(struct ub_event* ev)
 {
-	if (ev->magic == UB_EVENT_MAGIC) {
+	if (ev && ev->magic == UB_EVENT_MAGIC) {
 		fptr_ok(ev->vmt != &default_event_vmt ||
 			ev->vmt->del_signal == my_signal_del);
 		return (*ev->vmt->del_signal)(ev);
@@ -653,7 +651,7 @@ ub_signal_del(struct ub_event* ev)
 void
 ub_winsock_unregister_wsaevent(struct ub_event* ev)
 {
-	if (ev->magic == UB_EVENT_MAGIC) {
+	if (ev && ev->magic == UB_EVENT_MAGIC) {
 		fptr_ok(ev->vmt != &default_event_vmt ||
 			ev->vmt->winsock_unregister_wsaevent ==
 			my_winsock_unregister_wsaevent);
diff --git a/util/winsock_event.c b/util/winsock_event.c
index 40b79821a478..9aad27edc0bc 100644
--- a/util/winsock_event.c
+++ b/util/winsock_event.c
@@ -262,8 +262,9 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 			break; /* sanity check */
 	}
 	log_assert(numwait <= WSA_MAXIMUM_WAIT_EVENTS);
-	verbose(VERB_CLIENT, "winsock_event bmax=%d numwait=%d wait=%x "
-		"timeout=%d", base->max, numwait, (int)wait, (int)timeout);
+	verbose(VERB_CLIENT, "winsock_event bmax=%d numwait=%d wait=%s "
+		"timeout=%d", base->max, numwait, (wait?"<wait>":"<null>"),
+		(int)timeout);
 
 	/* do the wait */
 	if(numwait == 0) {
diff --git a/validator/autotrust.c b/validator/autotrust.c
index 232397c31069..da8829cebf25 100644
--- a/validator/autotrust.c
+++ b/validator/autotrust.c
@@ -430,6 +430,8 @@ find_add_tp(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 	}
 	tp = autr_tp_create(anchors, rr, dname_len, sldns_wirerr_get_class(rr,
 		rr_len, dname_len));
+	if(!tp)	
+		return NULL;
 	lock_basic_lock(&tp->lock);
 	return tp;
 }
@@ -1201,7 +1203,7 @@ void autr_write_file(struct module_env* env, struct trust_anchor* tp)
 	if(fsync(fileno(out)) != 0)
 		log_err("could not fsync(%s): %s", fname, strerror(errno));
 #else
-	FlushFileBuffers((HANDLE)_fileno(out));
+	FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
 #endif
 	if(fclose(out) != 0) {
 		fatal_exit("could not complete write: %s: %s",
diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
index 11c8cd16e8f9..e3a1555257f6 100644
--- a/validator/val_secalgo.c
+++ b/validator/val_secalgo.c
@@ -350,6 +350,23 @@ i	 * the '44' is the total remaining length.
 }
 #endif /* USE_ECDSA */
 
+#ifdef USE_ECDSA_EVP_WORKAROUND
+static EVP_MD ecdsa_evp_256_md;
+static EVP_MD ecdsa_evp_384_md;
+void ecdsa_evp_workaround_init(void)
+{
+	/* openssl before 1.0.0 fixes RSA with the SHA256
+	 * hash in EVP.  We create one for ecdsa_sha256 */
+	ecdsa_evp_256_md = *EVP_sha256();
+	ecdsa_evp_256_md.required_pkey_type[0] = EVP_PKEY_EC;
+	ecdsa_evp_256_md.verify = (void*)ECDSA_verify;
+
+	ecdsa_evp_384_md = *EVP_sha384();
+	ecdsa_evp_384_md.required_pkey_type[0] = EVP_PKEY_EC;
+	ecdsa_evp_384_md.verify = (void*)ECDSA_verify;
+}
+#endif /* USE_ECDSA_EVP_WORKAROUND */
+
 /**
  * Setup key and digest for verification. Adjust sig if necessary.
  *
@@ -478,20 +495,7 @@ setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
 				return 0;
 			}
 #ifdef USE_ECDSA_EVP_WORKAROUND
-			/* openssl before 1.0.0 fixes RSA with the SHA256
-			 * hash in EVP.  We create one for ecdsa_sha256 */
-			{
-				static int md_ecdsa_256_done = 0;
-				static EVP_MD md;
-				if(!md_ecdsa_256_done) {
-					EVP_MD m = *EVP_sha256();
-					md_ecdsa_256_done = 1;
-					m.required_pkey_type[0] = (*evp_key)->type;
-					m.verify = (void*)ECDSA_verify;
-					md = m;
-				}
-				*digest_type = &md;
-			}
+			*digest_type = &ecdsa_evp_256_md;
 #else
 			*digest_type = EVP_sha256();
 #endif
@@ -505,20 +509,7 @@ setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
 				return 0;
 			}
 #ifdef USE_ECDSA_EVP_WORKAROUND
-			/* openssl before 1.0.0 fixes RSA with the SHA384
-			 * hash in EVP.  We create one for ecdsa_sha384 */
-			{
-				static int md_ecdsa_384_done = 0;
-				static EVP_MD md;
-				if(!md_ecdsa_384_done) {
-					EVP_MD m = *EVP_sha384();
-					md_ecdsa_384_done = 1;
-					m.required_pkey_type[0] = (*evp_key)->type;
-					m.verify = (void*)ECDSA_verify;
-					md = m;
-				}
-				*digest_type = &md;
-			}
+			*digest_type = &ecdsa_evp_384_md;
 #else
 			*digest_type = EVP_sha384();
 #endif
@@ -601,7 +592,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 		log_err("EVP_MD_CTX_new: malloc failure");
 		EVP_PKEY_free(evp_key);
 		if(dofree) free(sigblock);
-		else if(docrypto_free) CRYPTO_free(sigblock);
+		else if(docrypto_free) OPENSSL_free(sigblock);
 		return sec_status_unchecked;
 	}
 	if(EVP_VerifyInit(ctx, digest_type) == 0) {
@@ -609,7 +600,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 		EVP_MD_CTX_destroy(ctx);
 		EVP_PKEY_free(evp_key);
 		if(dofree) free(sigblock);
-		else if(docrypto_free) CRYPTO_free(sigblock);
+		else if(docrypto_free) OPENSSL_free(sigblock);
 		return sec_status_unchecked;
 	}
 	if(EVP_VerifyUpdate(ctx, (unsigned char*)sldns_buffer_begin(buf), 
@@ -618,7 +609,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 		EVP_MD_CTX_destroy(ctx);
 		EVP_PKEY_free(evp_key);
 		if(dofree) free(sigblock);
-		else if(docrypto_free) CRYPTO_free(sigblock);
+		else if(docrypto_free) OPENSSL_free(sigblock);
 		return sec_status_unchecked;
 	}
 
@@ -632,7 +623,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 	EVP_PKEY_free(evp_key);
 
 	if(dofree) free(sigblock);
-	else if(docrypto_free) CRYPTO_free(sigblock);
+	else if(docrypto_free) OPENSSL_free(sigblock);
 
 	if(res == 1) {
 		return sec_status_secure;
@@ -1207,6 +1198,9 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 #include "macros.h"
 #include "rsa.h"
 #include "dsa.h"
+#ifdef HAVE_NETTLE_DSA_COMPAT_H
+#include "dsa-compat.h"
+#endif
 #include "asn1.h"
 #ifdef USE_ECDSA
 #include "ecdsa.h"
@@ -1367,6 +1361,7 @@ dnskey_algo_id_is_supported(int id)
 	}
 }
 
+#ifdef USE_DSA
 static char *
 _verify_nettle_dsa(sldns_buffer* buf, unsigned char* sigblock,
 	unsigned int sigblock_len, unsigned char* key, unsigned int keylen)
@@ -1454,6 +1449,7 @@ _verify_nettle_dsa(sldns_buffer* buf, unsigned char* sigblock,
 	else
 		return NULL;
 }
+#endif /* USE_DSA */
 
 static char *
 _verify_nettle_rsa(sldns_buffer* buf, unsigned int digest_size, char* sigblock,
diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
index 1dd07b420bd5..e60f3f9369c6 100644
--- a/validator/val_sigcrypt.c
+++ b/validator/val_sigcrypt.c
@@ -1283,15 +1283,23 @@ adjust_ttl(struct val_env* ve, uint32_t unow,
 	/* so now:
 	 * d->ttl: rrset ttl read from message or cache. May be reduced
 	 * origttl: original TTL from signature, authoritative TTL max.
+	 * MIN_TTL: minimum TTL from config.
 	 * expittl: TTL until the signature expires.
 	 *
-	 * Use the smallest of these.
+	 * Use the smallest of these, but don't let origttl set the TTL
+	 * below the minimum.
 	 */
-	if(d->ttl > (time_t)origttl) {
-		verbose(VERB_QUERY, "rrset TTL larger than original TTL,"
-			" adjusting TTL downwards");
+	if(MIN_TTL > (time_t)origttl && d->ttl > MIN_TTL) {
+		verbose(VERB_QUERY, "rrset TTL larger than original and minimum"
+			" TTL, adjusting TTL downwards to mimimum ttl");
+		d->ttl = MIN_TTL;
+	}
+	else if(MIN_TTL <= origttl && d->ttl > (time_t)origttl) {
+		verbose(VERB_QUERY, "rrset TTL larger than original TTL, "
+		"adjusting TTL downwards to original ttl");
 		d->ttl = origttl;
 	}
+
 	if(expittl > 0 && d->ttl > (time_t)expittl) {
 		verbose(VERB_ALGO, "rrset TTL larger than sig expiration ttl,"
 			" adjusting TTL downwards");
diff --git a/validator/validator.c b/validator/validator.c
index db4383bedcdc..f9b6a986ec9e 100644
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -156,6 +156,9 @@ val_apply_cfg(struct module_env* env, struct val_env* val_env,
 	return 1;
 }
 
+#ifdef USE_ECDSA_EVP_WORKAROUND
+void ecdsa_evp_workaround_init(void);
+#endif
 int
 val_init(struct module_env* env, int id)
 {
@@ -171,6 +174,9 @@ val_init(struct module_env* env, int id)
 	lock_basic_init(&val_env->bogus_lock);
 	lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus,
 		sizeof(val_env->num_rrset_bogus));
+#ifdef USE_ECDSA_EVP_WORKAROUND
+	ecdsa_evp_workaround_init();
+#endif
 	if(!val_apply_cfg(env, val_env, env->cfg)) {
 		log_err("validator: could not apply configuration settings.");
 		return 0;
diff --git a/winrc/setup.nsi b/winrc/setup.nsi
index 513b30015b85..d70c56b659e3 100644
--- a/winrc/setup.nsi
+++ b/winrc/setup.nsi
@@ -92,10 +92,18 @@ section "-hidden.postinstall"
 	File "..\anchor-update.exe"
 	File "unbound-control-setup.cmd"
 	File "unbound-website.url"
-	File "service.conf"
 	File "..\doc\example.conf"
 	File "..\doc\Changelog"
 
+	# Does service.conf already exist?
+	IfFileExists "$INSTDIR\service.conf" 0 service_conf_not_found
+	# if so, leave it be and place the shipped file under another name
+	File /oname=service.conf.shipped "service.conf"
+	goto end_service_conf_not_found
+	# or, it is not there, place it and fill it.
+	service_conf_not_found:
+	File "service.conf"
+
 	# Store Root Key choice
 	SectionGetFlags ${SectionRootKey} $R0
 	IntOp $R0 $R0 & ${SF_SELECTED}
@@ -111,6 +119,7 @@ section "-hidden.postinstall"
 	${Else}
 		WriteRegStr HKLM "Software\Unbound" "RootAnchor" ""
 	${EndIf}
+	end_service_conf_not_found:
 
 	# store installation folder
 	WriteRegStr HKLM "Software\Unbound" "InstallLocation" "$INSTDIR"
@@ -179,7 +188,9 @@ section "un.Unbound"
 	Delete "$INSTDIR\anchor-update.exe"
 	Delete "$INSTDIR\unbound-control-setup.cmd"
 	Delete "$INSTDIR\unbound-website.url"
-	Delete "$INSTDIR\service.conf"
+	# keep the service.conf with potential local modifications
+	#Delete "$INSTDIR\service.conf"
+	Delete "$INSTDIR\service.conf.shipped"
 	Delete "$INSTDIR\example.conf"
 	Delete "$INSTDIR\Changelog"
 	Delete "$INSTDIR\root.key"
diff --git a/winrc/w_inst.c b/winrc/w_inst.c
index a9f1defa1100..023490631a37 100644
--- a/winrc/w_inst.c
+++ b/winrc/w_inst.c
@@ -231,8 +231,8 @@ wsvc_install(FILE* out, const char* rename)
                 NULL, /* no load ordering group */
                 NULL, /* no tag identifier */
                 NULL, /* no deps */
-		(LPCTSTR)"NT AUTHORITY\\NetworkService", /* network service account with restricted rights */
-                "" /* no password (must be an empty string) */
+		NULL, /* on LocalSystem */
+		NULL /* no password */
                 );
         if(!sv) {
                 CloseServiceHandle(scm);
diff --git a/winrc/win_svc.c b/winrc/win_svc.c
index 74ace69fb19e..ac97ef68beae 100644
--- a/winrc/win_svc.c
+++ b/winrc/win_svc.c
@@ -565,7 +565,7 @@ win_do_cron(void* ATTR_UNUSED(arg))
 
 /** Set the timer for cron for the next wake up */
 static void
-set_cron_timer()
+set_cron_timer(void)
 {
 	struct timeval tv;
 	int crontime;