Vendor import of Unbound 1.10.1.vendor/unbound/1.10.1

Security:	CVE-2020-12662, CVE-2020-12663

144 files changed, 13096 insertions, 6849 deletions

diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 000000000000..ecee84aa4132
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,12 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+custom: ['https://nlnetlabs.nl/funding/']
diff --git a/.gitignore b/.gitignore
index 22fedf0d7615..c1e2649db25d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,6 +42,7 @@
 /contrib/libunbound.pc
 /contrib/unbound.service
 /contrib/unbound.socket
+/contrib/unbound_portable.service
 /dnstap/dnstap.pb-c.c
 /dnstap/dnstap.pb-c.h
 /libunbound/python/libunbound_wrap.c
diff --git a/Makefile.in b/Makefile.in
index 1a2e2c548169..a20058cc23c6 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -110,6 +110,7 @@ iterator/iter_delegpt.c iterator/iter_donotq.c iterator/iter_fwd.c \
 iterator/iter_hints.c iterator/iter_priv.c iterator/iter_resptype.c \
 iterator/iter_scrub.c iterator/iter_utils.c services/listen_dnsport.c \
 services/localzone.c services/mesh.c services/modstack.c services/view.c \
+services/rpz.c \
 services/outbound_list.c services/outside_network.c util/alloc.c \
 util/config_file.c util/configlexer.c util/configparser.c \
 util/shm_side/shm_main.c services/authzone.c \
@@ -135,7 +136,7 @@ outbound_list.lo alloc.lo config_file.lo configlexer.lo configparser.lo \
 fptr_wlist.lo edns.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \
 random.lo rbtree.lo regional.lo rtt.lo dnstree.lo lookup3.lo lruhash.lo \
 slabhash.lo tcp_conn_limit.lo timehist.lo tube.lo winsock_event.lo \
-autotrust.lo val_anchor.lo \
+autotrust.lo val_anchor.lo rpz.lo \
 validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
 val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo redis.lo authzone.lo \
 $(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
@@ -642,6 +643,9 @@ depend:
 	fi
 	rm -f $(DEPEND_TMP) $(DEPEND_TMP2)
 
+# build rules
+ipset.lo ipset.o: $(srcdir)/ipset/ipset.c
+
 # Dependencies
 dns.lo dns.o: $(srcdir)/services/cache/dns.c config.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
  $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h $(srcdir)/validator/val_nsec.h \
@@ -654,9 +658,9 @@ infra.lo infra.o: $(srcdir)/services/cache/infra.c config.h $(srcdir)/sldns/rrde
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lookup3.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h \
+  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h
 rrset.lo rrset.o: $(srcdir)/services/cache/rrset.c config.h $(srcdir)/services/cache/rrset.h \
@@ -681,11 +685,14 @@ msgparse.lo msgparse.o: $(srcdir)/util/data/msgparse.c config.h $(srcdir)/util/d
 msgreply.lo msgreply.o: $(srcdir)/util/data/msgreply.c config.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/util/module.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
+  $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/module.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/respip/respip.h
 packed_rrset.lo packed_rrset.o: $(srcdir)/util/data/packed_rrset.c config.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
@@ -699,11 +706,12 @@ iterator.lo iterator.o: $(srcdir)/iterator/iterator.c config.h $(srcdir)/iterato
  $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_scrub.h $(srcdir)/iterator/iter_priv.h \
  $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/services/authzone.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
+  $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/random.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
- $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/util/random.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h
 iter_delegpt.lo iter_delegpt.o: $(srcdir)/iterator/iter_delegpt.c config.h $(srcdir)/iterator/iter_delegpt.h \
  $(srcdir)/util/log.h $(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h \
@@ -745,88 +753,106 @@ iter_utils.lo iter_utils.o: $(srcdir)/iterator/iter_utils.c config.h $(srcdir)/i
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/iterator/iter_donotq.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_priv.h \
  $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/random.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
+  $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/str2wire.h
+ $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/str2wire.h
 listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h  \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
+  $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/services/modstack.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
 localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h \
  $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/net_help.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/as112.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/as112.h
 mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/dns.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/tube.h $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/util/edns.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/services/view.h $(srcdir)/util/data/dname.h $(srcdir)/respip/respip.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/edns.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/data/dname.h \
  $(srcdir)/services/listen_dnsport.h
 modstack.lo modstack.o: $(srcdir)/services/modstack.c config.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/respip/respip.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
- $(srcdir)/ipset/ipset.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h
 view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h
+rpz.lo rpz.o: $(srcdir)/services/rpz.c config.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h
 outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h 
+ 
 outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/locks.h $(srcdir)/util/log.h  $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/dnstap/dnstap.h \
- 
+ $(srcdir)/dnscrypt/dnscrypt.h   \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+ $(srcdir)/dnstap/dnstap.h
 alloc.lo alloc.o: $(srcdir)/util/alloc.c config.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
+  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/configyyrename.h $(srcdir)/util/config_file.h util/configparser.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/iana_ports.inc
 configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
  $(srcdir)/util/config_file.h util/configparser.h
@@ -837,71 +863,83 @@ shm_main.lo shm_main.o: $(srcdir)/util/shm_side/shm_main.c config.h $(srcdir)/ut
  $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
   $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
  $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
+ $(srcdir)/util/rbtree.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/rtt.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h
 authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/services/authzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/util/random.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/data/msgencode.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
  $(srcdir)/services/cache/dns.h $(srcdir)/services/outside_network.h  \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_secalgo.h
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h $(srcdir)/validator/val_nsec3.h \
+ $(srcdir)/validator/val_secalgo.h
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
- $(srcdir)/services/outside_network.h  $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_nsec3.h \
- $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
- $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h \
- $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/respip/respip.h \
- $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/net_help.h \
- $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/ipset/ipset.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/outside_network.h  $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
+ $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h \
+ $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h \
+ $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound-event.h \
+ $(srcdir)/libunbound/worker.h
 locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
-mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h
+mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 module.lo module.o: $(srcdir)/util/module.c config.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h $(srcdir)/util/tcp_conn_limit.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/dnstap/dnstap.h  \
- $(srcdir)/services/listen_dnsport.h \
- 
+  $(srcdir)/util/ub_event.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/services/listen_dnsport.h
 net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
- $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
- 
+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
 random.lo random.o: $(srcdir)/util/random.c config.h $(srcdir)/util/random.h $(srcdir)/util/log.h
 rbtree.lo rbtree.o: $(srcdir)/util/rbtree.c config.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 regional.lo regional.o: $(srcdir)/util/regional.c config.h $(srcdir)/util/log.h $(srcdir)/util/regional.h
 rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h $(srcdir)/iterator/iterator.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
@@ -909,19 +947,22 @@ rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h $(srcdir)/itera
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
 edns.lo edns.o: $(srcdir)/util/edns.c config.h $(srcdir)/util/edns.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/regional.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h
+ $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h
 dnstree.lo dnstree.o: $(srcdir)/util/storage/dnstree.c config.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/net_help.h
 lookup3.lo lookup3.o: $(srcdir)/util/storage/lookup3.c config.h $(srcdir)/util/storage/lookup3.h
 lruhash.lo lruhash.o: $(srcdir)/util/storage/lruhash.c config.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 slabhash.lo slabhash.o: $(srcdir)/util/storage/slabhash.c config.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 tcp_conn_limit.lo tcp_conn_limit.o: $(srcdir)/util/tcp_conn_limit.c config.h $(srcdir)/util/regional.h \
@@ -929,26 +970,30 @@ tcp_conn_limit.lo tcp_conn_limit.o: $(srcdir)/util/tcp_conn_limit.c config.h $(s
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
 timehist.lo timehist.o: $(srcdir)/util/timehist.c config.h $(srcdir)/util/timehist.h $(srcdir)/util/log.h
 tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/ub_event.h
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/ub_event.h
 ub_event.lo ub_event.o: $(srcdir)/util/ub_event.c config.h $(srcdir)/util/ub_event.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/tube.h \
- 
+ $(srcdir)/util/tube.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 ub_event_pluggable.lo ub_event_pluggable.o: $(srcdir)/util/ub_event_pluggable.c config.h $(srcdir)/util/ub_event.h \
  $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h \
- 
+  $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 winsock_event.lo winsock_event.o: $(srcdir)/util/winsock_event.c config.h
 autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/validator/autotrust.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
@@ -957,10 +1002,11 @@ autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/val
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/services/mesh.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/services/modstack.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/validator/val_kcache.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h \
- 
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/respip/respip.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/validator/val_kcache.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h
 val_anchor.lo val_anchor.o: $(srcdir)/validator/val_anchor.c config.h $(srcdir)/validator/val_anchor.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_sigcrypt.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h \
@@ -977,8 +1023,11 @@ validator.lo validator.o: $(srcdir)/validator/validator.c config.h $(srcdir)/val
  $(srcdir)/validator/autotrust.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
+  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/validator/val_kcache.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/validator/val_kentry.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
@@ -987,13 +1036,11 @@ val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/
 val_kentry.lo val_kentry.o: $(srcdir)/validator/val_kentry.c config.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
- 
-val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h \
- $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
- $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h
+val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/rbtree.h $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/cache/dns.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
 val_nsec3.lo val_nsec3.o: $(srcdir)/validator/val_nsec3.c config.h $(srcdir)/validator/val_nsec3.h \
@@ -1011,17 +1058,15 @@ val_nsec.lo val_nsec.o: $(srcdir)/validator/val_nsec.c config.h $(srcdir)/valida
 val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/sldns/sbuffer.h \
- 
+ $(srcdir)/sldns/sbuffer.h
 val_sigcrypt.lo val_sigcrypt.o: $(srcdir)/validator/val_sigcrypt.c config.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/val_secalgo.h \
  $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/rbtree.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
- $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
- 
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/wire2str.h
 val_utils.lo val_utils.o: $(srcdir)/validator/val_utils.c config.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
@@ -1037,9 +1082,11 @@ dns64.lo dns64.o: $(srcdir)/dns64/dns64.c config.h $(srcdir)/dns64/dns64.h $(src
  $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
 edns-subnet.lo edns-subnet.o: $(srcdir)/edns-subnet/edns-subnet.c config.h
 subnetmod.lo subnetmod.o: $(srcdir)/edns-subnet/subnetmod.c config.h
 addrtree.lo addrtree.o: $(srcdir)/edns-subnet/addrtree.c config.h $(srcdir)/util/log.h \
@@ -1053,36 +1100,16 @@ respip.lo respip.o: $(srcdir)/respip/respip.c config.h $(srcdir)/services/localz
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/respip/respip.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/regional.h
 checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/checklocks.h
-dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/locks.h $(srcdir)/dnstap/dnstap.h \
- dnstap/dnstap.pb-c.h
-dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h \
- 
-dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/storage/lookup3.h
 ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h
-ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h \
- $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h \
- $(srcdir)/ipsecmod/ipsecmod-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/regional.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
-ipset.lo ipset.o: $(srcdir)/ipset/ipset.c config.h $(srcdir)/ipset/ipset.h $(srcdir)/util/module.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h
+ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h
 unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h
@@ -1091,16 +1118,15 @@ unitdname.lo unitdname.o: $(srcdir)/testcode/unitdname.c config.h $(srcdir)/util
  $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 unitlruhash.lo unitlruhash.o: $(srcdir)/testcode/unitlruhash.c config.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h
-unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
  $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/rtt.h $(srcdir)/util/timehist.h $(srcdir)/iterator/iterator.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/libunbound/unbound.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/random.h $(srcdir)/respip/respip.h \
- $(srcdir)/services/localzone.h $(srcdir)/services/view.h
+  $(srcdir)/util/random.h $(srcdir)/respip/respip.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h
 unitmsgparse.lo unitmsgparse.o: $(srcdir)/testcode/unitmsgparse.c config.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/unitmain.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
@@ -1134,59 +1160,59 @@ unitldns.lo unitldns.o: $(srcdir)/testcode/unitldns.c config.h $(srcdir)/util/lo
 unitecs.lo unitecs.o: $(srcdir)/testcode/unitecs.c config.h
 unitauth.lo unitauth.o: $(srcdir)/testcode/unitauth.c config.h $(srcdir)/services/authzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/services/modstack.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/testcode/unitmain.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/sldns/wire2str.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
  $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
-cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h \
- $(srcdir)/daemon/cachedump.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h  $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/regional.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
+cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h $(srcdir)/daemon/cachedump.h \
+ $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
  $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
  $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
-daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
-   $(srcdir)/daemon/worker.h \
+daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
+  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
+ $(srcdir)/sldns/keyraw.h
+remote.lo remote.o: $(srcdir)/daemon/remote.c config.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h \
  $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/random.h \
- $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h $(srcdir)/respip/respip.h
-remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
- $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
-  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/alloc.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
  $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
@@ -1197,56 +1223,59 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
  $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
-  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/authzone.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h \
- 
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
+ $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
 unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
  $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
-  $(srcdir)/daemon/remote.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
+  $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/ub_event.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
-  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/localzone.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
- $(srcdir)/respip/respip.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h \
+ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h \
+ $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
  $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h
 testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/daemon/remote.h \
- $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/daemon/daemon.h \
- $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
+  $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h \
+ $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c \
+ $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
+  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
@@ -1254,77 +1283,79 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
  $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
-  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/localzone.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
- $(srcdir)/respip/respip.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h \
+ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h \
+ $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
  $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
  $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
-daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
-   $(srcdir)/daemon/worker.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/random.h \
- $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h $(srcdir)/respip/respip.h
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
+daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
+  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
+ $(srcdir)/sldns/keyraw.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
-  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/authzone.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h \
- 
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
+ $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
 replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
- $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h \
- $(srcdir)/sldns/rrdef.h
+  $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/testcode/fake_event.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h  \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
- $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/util/rbtree.h  $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 lock_verify.lo lock_verify.o: $(srcdir)/testcode/lock_verify.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
+  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 pktview.lo pktview.o: $(srcdir)/testcode/pktview.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/testcode/readhex.h $(srcdir)/sldns/sbuffer.h \
@@ -1333,10 +1364,13 @@ readhex.lo readhex.o: $(srcdir)/testcode/readhex.c config.h $(srcdir)/testcode/r
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
 memstats.lo memstats.o: $(srcdir)/testcode/memstats.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
+  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
@@ -1344,27 +1378,31 @@ unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/view.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/services/modstack.h $(srcdir)/respip/respip.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 worker_cb.lo worker_cb.o: $(srcdir)/smallapp/worker_cb.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h
+  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
 context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/services/authzone.h \
- $(srcdir)/services/mesh.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
 libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
@@ -1373,70 +1411,70 @@ libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbou
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h \
  $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/util/ub_event.h \
  $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
- $(srcdir)/sldns/sbuffer.h
-libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h \
- $(srcdir)/libunbound/libworker.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h  $(srcdir)/services/mesh.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/authzone.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
+libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/libunbound/libworker.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/outside_network.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h   \
+ $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
  $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
  $(srcdir)/sldns/str2wire.h
 unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h \
- 
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/rrdef.h \
- 
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/rrdef.h
 streamtcp.lo streamtcp.o: $(srcdir)/testcode/streamtcp.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
- 
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 delayer.lo delayer.o: $(srcdir)/testcode/delayer.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
-unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h \
- $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/shm_side/shm_main.h $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/pkthdr.h
+unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h $(srcdir)/util/log.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h $(srcdir)/util/shm_side/shm_main.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/services/modstack.h $(srcdir)/respip/respip.h
 unbound-anchor.lo unbound-anchor.o: $(srcdir)/smallapp/unbound-anchor.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h \
- 
-petal.lo petal.o: $(srcdir)/testcode/petal.c config.h \
- 
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h
+petal.lo petal.o: $(srcdir)/testcode/petal.c config.h
 pythonmod_utils.lo pythonmod_utils.o: $(srcdir)/pythonmod/pythonmod_utils.c config.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/net_help.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/util/regional.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h
+  $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h
 win_svc.lo win_svc.o: $(srcdir)/winrc/win_svc.c config.h $(srcdir)/winrc/win_svc.h $(srcdir)/winrc/w_inst.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
    $(srcdir)/daemon/worker.h \
  $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h $(srcdir)/util/ub_event.h \
+ $(srcdir)/util/net_help.h
 w_inst.lo w_inst.o: $(srcdir)/winrc/w_inst.c config.h $(srcdir)/winrc/w_inst.h $(srcdir)/winrc/win_svc.h
 unbound-service-install.lo unbound-service-install.o: $(srcdir)/winrc/unbound-service-install.c config.h \
  $(srcdir)/winrc/w_inst.h
@@ -1444,14 +1482,12 @@ unbound-service-remove.lo unbound-service-remove.o: $(srcdir)/winrc/unbound-serv
  $(srcdir)/winrc/w_inst.h
 anchor-update.lo anchor-update.o: $(srcdir)/winrc/anchor-update.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/wire2str.h
-keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/sldns/rrdef.h \
- 
+keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h $(srcdir)/sldns/rrdef.h
 sbuffer.lo sbuffer.o: $(srcdir)/sldns/sbuffer.c config.h $(srcdir)/sldns/sbuffer.h
 wire2str.lo wire2str.o: $(srcdir)/sldns/wire2str.c config.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/keyraw.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
+ $(srcdir)/sldns/keyraw.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h
 parse.lo parse.o: $(srcdir)/sldns/parse.c config.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h \
  $(srcdir)/sldns/sbuffer.h
 parseutil.lo parseutil.o: $(srcdir)/sldns/parseutil.c config.h $(srcdir)/sldns/parseutil.h
@@ -1472,11 +1508,9 @@ strlcat.lo strlcat.o: $(srcdir)/compat/strlcat.c config.h
 strlcpy.lo strlcpy.o: $(srcdir)/compat/strlcpy.c config.h
 strptime.lo strptime.o: $(srcdir)/compat/strptime.c config.h
 getentropy_freebsd.lo getentropy_freebsd.o: $(srcdir)/compat/getentropy_freebsd.c
-getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h \
- 
+getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h
 getentropy_osx.lo getentropy_osx.o: $(srcdir)/compat/getentropy_osx.c
-getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h \
- 
+getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h
 getentropy_win.lo getentropy_win.o: $(srcdir)/compat/getentropy_win.c
 explicit_bzero.lo explicit_bzero.o: $(srcdir)/compat/explicit_bzero.c config.h
 arc4random.lo arc4random.o: $(srcdir)/compat/arc4random.c config.h $(srcdir)/compat/chacha_private.h
diff --git a/README.md b/README.md
index ee6e4f4885a8..7120d486f732 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Unbound is a validating, recursive, caching DNS resolver. It is designed to be
 fast and lean and incorporates modern features based on open standards. If you
 have any feedback, we would love to hear from you. Don’t hesitate to
 [create an issue on Github](https://github.com/NLnetLabs/unbound/issues/new)
-or post a message on the [Unbound mailing list](https://nlnetlabs.nl/mailman/listinfo/unbound-users).
+or post a message on the [Unbound mailing list](https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users).
 You can lean more about Unbound by reading our
 [documentation](https://nlnetlabs.nl/documentation/unbound/).
 
diff --git a/aclocal.m4 b/aclocal.m4
index 181e25817a7e..dd1b8658c7b8 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.15.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
 
-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -736,6 +736,7 @@ _LT_CONFIG_SAVE_COMMANDS([
     cat <<_LT_EOF >> "$cfgfile"
 #! $SHELL
 # Generated automatically by $as_me ($PACKAGE) $VERSION
+# Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`:
 # NOTE: Changes made to this file will be lost: look at ltmain.sh.
 
 # Provide generalized library-building support services.
@@ -2872,6 +2873,9 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   # before this can be enabled.
   hardcode_into_libs=yes
 
+  # Add ABI-specific directories to the system library path.
+  sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib"
+
   # Ideally, we could use ldconfig to report *all* directores which are
   # searched for libraries, however this is still not possible.  Aside from not
   # being certain /sbin/ldconfig is available, command
@@ -2880,7 +2884,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   # appending ld.so.conf contents (and includes) to the search path.
   if test -f /etc/ld.so.conf; then
     lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \[$]2)); skip = 1; } { if (!skip) print \[$]0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[	 ]*hwcap[	 ]/d;s/[:,	]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '`
-    sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra"
+    sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra"
   fi
 
   # We used to test for /lib/ld.so.1 and disable shared libraries on
@@ -2892,18 +2896,6 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   dynamic_linker='GNU/Linux ld.so'
   ;;
 
-netbsdelf*-gnu)
-  version_type=linux
-  need_lib_prefix=no
-  need_version=no
-  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
-  soname_spec='${libname}${release}${shared_ext}$major'
-  shlibpath_var=LD_LIBRARY_PATH
-  shlibpath_overrides_runpath=no
-  hardcode_into_libs=yes
-  dynamic_linker='NetBSD ld.elf_so'
-  ;;
-
 netbsd*)
   version_type=sunos
   need_lib_prefix=no
@@ -3563,7 +3555,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-netbsd* | netbsdelf*-gnu)
+netbsd*)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$'
   else
@@ -4441,7 +4433,7 @@ m4_if([$1], [CXX], [
 	    ;;
 	esac
 	;;
-      netbsd* | netbsdelf*-gnu)
+      netbsd*)
 	;;
       *qnx* | *nto*)
         # QNX uses GNU C++, but need to define -shared option too, otherwise
@@ -4953,9 +4945,6 @@ m4_if([$1], [CXX], [
       ;;
     esac
     ;;
-  linux* | k*bsd*-gnu | gnu*)
-    _LT_TAGVAR(link_all_deplibs, $1)=no
-    ;;
   *)
     _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols'
     ;;
@@ -5018,9 +5007,6 @@ dnl Note also adjust exclude_expsyms for C++ above.
   openbsd* | bitrig*)
     with_gnu_ld=no
     ;;
-  linux* | k*bsd*-gnu | gnu*)
-    _LT_TAGVAR(link_all_deplibs, $1)=no
-    ;;
   esac
 
   _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -5275,7 +5261,7 @@ _LT_EOF
       fi
       ;;
 
-    netbsd* | netbsdelf*-gnu)
+    netbsd*)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -5796,7 +5782,6 @@ _LT_EOF
 	if test yes = "$lt_cv_irix_exported_symbol"; then
           _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
-	_LT_TAGVAR(link_all_deplibs, $1)=no
       else
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
 	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
@@ -5818,7 +5803,7 @@ _LT_EOF
       esac
       ;;
 
-    netbsd* | netbsdelf*-gnu)
+    netbsd*)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
       else
@@ -9059,9 +9044,9 @@ m4_ifndef([_LT_PROG_F77],		[AC_DEFUN([_LT_PROG_F77])])
 m4_ifndef([_LT_PROG_FC],		[AC_DEFUN([_LT_PROG_FC])])
 m4_ifndef([_LT_PROG_CXX],		[AC_DEFUN([_LT_PROG_CXX])])
 
-dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-dnl serial 11 (pkg-config-0.29.1)
-dnl
+# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+# serial 11 (pkg-config-0.29.1)
+
 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
 dnl
@@ -9335,9 +9320,77 @@ AS_VAR_COPY([$1], [pkg_cv_][$1])
 AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 
+dnl PKG_WITH_MODULES(VARIABLE-PREFIX, MODULES,
+dnl   [ACTION-IF-FOUND],[ACTION-IF-NOT-FOUND],
+dnl   [DESCRIPTION], [DEFAULT])
+dnl ------------------------------------------
+dnl
+dnl Prepare a "--with-" configure option using the lowercase
+dnl [VARIABLE-PREFIX] name, merging the behaviour of AC_ARG_WITH and
+dnl PKG_CHECK_MODULES in a single macro.
+AC_DEFUN([PKG_WITH_MODULES],
+[
+m4_pushdef([with_arg], m4_tolower([$1]))
+
+m4_pushdef([description],
+           [m4_default([$5], [build with ]with_arg[ support])])
+
+m4_pushdef([def_arg], [m4_default([$6], [auto])])
+m4_pushdef([def_action_if_found], [AS_TR_SH([with_]with_arg)=yes])
+m4_pushdef([def_action_if_not_found], [AS_TR_SH([with_]with_arg)=no])
+
+m4_case(def_arg,
+            [yes],[m4_pushdef([with_without], [--without-]with_arg)],
+            [m4_pushdef([with_without],[--with-]with_arg)])
+
+AC_ARG_WITH(with_arg,
+     AS_HELP_STRING(with_without, description[ @<:@default=]def_arg[@:>@]),,
+    [AS_TR_SH([with_]with_arg)=def_arg])
+
+AS_CASE([$AS_TR_SH([with_]with_arg)],
+            [yes],[PKG_CHECK_MODULES([$1],[$2],$3,$4)],
+            [auto],[PKG_CHECK_MODULES([$1],[$2],
+                                        [m4_n([def_action_if_found]) $3],
+                                        [m4_n([def_action_if_not_found]) $4])])
+
+m4_popdef([with_arg])
+m4_popdef([description])
+m4_popdef([def_arg])
+
+])dnl PKG_WITH_MODULES
+
+dnl PKG_HAVE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
+dnl   [DESCRIPTION], [DEFAULT])
+dnl -----------------------------------------------
+dnl
+dnl Convenience macro to trigger AM_CONDITIONAL after PKG_WITH_MODULES
+dnl check._[VARIABLE-PREFIX] is exported as make variable.
+AC_DEFUN([PKG_HAVE_WITH_MODULES],
+[
+PKG_WITH_MODULES([$1],[$2],,,[$3],[$4])
+
+AM_CONDITIONAL([HAVE_][$1],
+               [test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"])
+])dnl PKG_HAVE_WITH_MODULES
+
+dnl PKG_HAVE_DEFINE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
+dnl   [DESCRIPTION], [DEFAULT])
+dnl ------------------------------------------------------
+dnl
+dnl Convenience macro to run AM_CONDITIONAL and AC_DEFINE after
+dnl PKG_WITH_MODULES check. HAVE_[VARIABLE-PREFIX] is exported as make
+dnl and preprocessor variable.
+AC_DEFUN([PKG_HAVE_DEFINE_WITH_MODULES],
+[
+PKG_HAVE_WITH_MODULES([$1],[$2],[$3],[$4])
+
+AS_IF([test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"],
+        [AC_DEFINE([HAVE_][$1], 1, [Enable ]m4_tolower([$1])[ support])])
+])dnl PKG_HAVE_DEFINE_WITH_MODULES
+
 # AM_CONDITIONAL                                            -*- Autoconf -*-
 
-# Copyright (C) 1997-2017 Free Software Foundation, Inc.
+# Copyright (C) 1997-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -9368,7 +9421,7 @@ AC_CONFIG_COMMANDS_PRE(
 Usually this means the macro was only invoked conditionally.]])
 fi])])
 
-# Copyright (C) 2006-2017 Free Software Foundation, Inc.
+# Copyright (C) 2006-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
diff --git a/cachedb/cachedb.c b/cachedb/cachedb.c
index d5cd8dc553b8..c5be516225f9 100644
--- a/cachedb/cachedb.c
+++ b/cachedb/cachedb.c
@@ -64,26 +64,26 @@
 #ifdef HAVE_SYS_ENDIAN_H
 #  include <sys/endian.h>
 #endif
-#ifdef HAVE_LIBKERN_OSBYTEORDER_H
-/* In practice this is specific to MacOS X.  We assume it doesn't have
-* htobe64/be64toh but has alternatives with a different name. */
-#  include <libkern/OSByteOrder.h>
-#  define htobe64(x) OSSwapHostToBigInt64(x)
-#  define be64toh(x) OSSwapBigToHostInt64(x)
-#endif
 
-/* Some compilers do not define __BYTE_ORDER__, like IBM XLC on AIX */
-#ifndef be64toh
-#if defined(__sun) || defined(_AIX)
-#  if __BIG_ENDIAN__
-#    define be64toh(n) (n)
-#    define htobe64(n) (n)
+#ifndef HAVE_HTOBE64
+#  ifdef HAVE_LIBKERN_OSBYTEORDER_H
+     /* In practice this is specific to MacOS X.  We assume it doesn't have
+      * htobe64/be64toh but has alternatives with a different name. */
+#    include <libkern/OSByteOrder.h>
+#    define htobe64(x) OSSwapHostToBigInt64(x)
+#    define be64toh(x) OSSwapBigToHostInt64(x)
 #  else
-#    define be64toh(n) (((uint64_t)htonl((n) & 0xFFFFFFFF) << 32) | htonl((n) >> 32))
-#    define htobe64(n) (((uint64_t)htonl((n) & 0xFFFFFFFF) << 32) | htonl((n) >> 32))
-#  endif
-#endif
-#endif /* be64toh */
+     /* not OSX */
+     /* Some compilers do not define __BYTE_ORDER__, like IBM XLC on AIX */
+#    if __BIG_ENDIAN__
+#      define be64toh(n) (n)
+#      define htobe64(n) (n)
+#    else
+#      define be64toh(n) (((uint64_t)htonl((n) & 0xFFFFFFFF) << 32) | htonl((n) >> 32))
+#      define htobe64(n) (((uint64_t)htonl((n) & 0xFFFFFFFF) << 32) | htonl((n) >> 32))
+#    endif /* _ENDIAN */
+#  endif /* HAVE_LIBKERN_OSBYTEORDER_H */
+#endif /* HAVE_BE64TOH */
 
 /** the unit test testframe for cachedb, its module state contains
  * a cache for a couple queries (in memory). */
@@ -218,10 +218,6 @@ static int
 cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
 {
 	const char* backend_str = cfg->cachedb_backend;
-
-	/* If unspecified we use the in-memory test DB. */
-	if(!backend_str)
-		backend_str = "testframe";
 	cachedb_env->backend = cachedb_find_backend(backend_str);
 	if(!cachedb_env->backend) {
 		log_err("cachedb: cannot find backend name '%s'", backend_str);
@@ -259,6 +255,15 @@ cachedb_init(struct module_env* env, int id)
 		return 0;
 	}
 	cachedb_env->enabled = 1;
+	if(env->cfg->serve_expired_reply_ttl)
+		log_warn(
+			"cachedb: serve-expired-reply-ttl is set but not working for data "
+			"originating from the external cache; 0 TLL is used for those.");
+	if(env->cfg->serve_expired_client_timeout)
+		log_warn(
+			"cachedb: serve-expired-client-timeout is set but not working for "
+			"data originating from the external cache; expired data are used "
+			"in the reply without first trying to refresh the data.");
 	return 1;
 }
 
@@ -329,8 +334,7 @@ calc_hash(struct module_qstate* qstate, char* buf, size_t len)
 	size_t clen = 0;
 	uint8_t hash[CACHEDB_HASHSIZE/8];
 	const char* hex = "0123456789ABCDEF";
-	const char* secret = qstate->env->cfg->cachedb_secret ?
-		qstate->env->cfg->cachedb_secret : "default";
+	const char* secret = qstate->env->cfg->cachedb_secret;
 	size_t i;
 
 	/* copy the hash info into the clear buffer */
@@ -433,8 +437,14 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 		&expiry, sizeof(expiry));
 	expiry = be64toh(expiry);
 
+	/* Check if we are allowed to return expired entries:
+	 * - serve_expired needs to be set
+	 * - if SERVE_EXPIRED_TTL is set make sure that the record is not older
+	 *   than that. */
 	if((time_t)expiry < *qstate->env->now &&
-		!qstate->env->cfg->serve_expired)
+		(!qstate->env->cfg->serve_expired ||
+			(SERVE_EXPIRED_TTL &&
+			*qstate->env->now - (time_t)expiry > SERVE_EXPIRED_TTL)))
 		return 0;
 
 	return 1;
@@ -445,15 +455,15 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 static void
 packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
 {
-        size_t i;
-        size_t total = data->count + data->rrsig_count;
+	size_t i;
+	size_t total = data->count + data->rrsig_count;
 	if(subtract >= 0 && data->ttl > subtract)
 		data->ttl -= subtract;
 	else	data->ttl = 0;
-        for(i=0; i<total; i++) {
+	for(i=0; i<total; i++) {
 		if(subtract >= 0 && data->rr_ttl[i] > subtract)
-                	data->rr_ttl[i] -= subtract;
-                else	data->rr_ttl[i] = 0;
+			data->rr_ttl[i] -= subtract;
+		else	data->rr_ttl[i] = 0;
 	}
 }
 
@@ -465,7 +475,8 @@ adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
 	size_t i;
 	if(adjust >= 0 && msg->rep->ttl > adjust)
 		msg->rep->ttl -= adjust;
-	else	msg->rep->ttl = 0;
+	else
+		msg->rep->ttl = 0;
 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
 
@@ -673,7 +684,8 @@ cachedb_handle_query(struct module_qstate* qstate,
 		return;
 	}
 
-	/* lookup inside unbound's internal cache */
+	/* lookup inside unbound's internal cache.
+	 * This does not look for expired entries. */
 	if(cachedb_intcache_lookup(qstate)) {
 		if(verbosity >= VERB_ALGO) {
 			if(qstate->return_msg->rep)
@@ -681,8 +693,9 @@ cachedb_handle_query(struct module_qstate* qstate,
 					&qstate->return_msg->qinfo,
 					qstate->return_msg->rep);
 			else log_info("cachedb internal cache lookup: rcode %s",
-				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)?
-				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)->name:"??");
+				sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)
+				?sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)->name
+				:"??");
 		}
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
@@ -697,6 +710,19 @@ cachedb_handle_query(struct module_qstate* qstate,
 				qstate->return_msg->rep);
 		/* store this result in internal cache */
 		cachedb_intcache_store(qstate);
+		/* In case we have expired data but there is a client timer for expired
+		 * answers, pass execution to next module in order to try updating the
+		 * data first.
+		 * TODO: this needs revisit. The expired data stored from cachedb has
+		 * 0 TTL which is picked up by iterator later when looking in the cache.
+		 * Document that ext cachedb does not work properly with
+		 * serve_stale_reply_ttl yet. */
+		if(qstate->need_refetch && qstate->serve_expired_data &&
+			qstate->serve_expired_data->timer) {
+				qstate->return_msg = NULL;
+				qstate->ext_state[id] = module_wait_module;
+				return;
+		}
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
 		return;
diff --git a/compat/getentropy_solaris.c b/compat/getentropy_solaris.c
index 0a03046d4681..5e3b1cbbbd30 100644
--- a/compat/getentropy_solaris.c
+++ b/compat/getentropy_solaris.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: getentropy_solaris.c,v 1.13 2018/11/20 08:04:28 deraadt Exp $	*/
+/*	$OpenBSD: getentropy_solaris.c,v 1.4 2014/07/12 20:41:47 wouter Exp $	*/
 
 /*
  * Copyright (c) 2014 Theo de Raadt <deraadt@openbsd.org>
@@ -15,12 +15,9 @@
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * Emulation of getentropy(2) as documented at:
- * http://man.openbsd.org/getentropy.2
  */
-
 #include "config.h"
+
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/ioctl.h>
@@ -37,7 +34,6 @@
 #include <stdint.h>
 #endif
 #include <stdio.h>
-#include <link.h>
 #include <termios.h>
 #include <fcntl.h>
 #include <signal.h>
@@ -71,14 +67,17 @@
 
 #define HR(x, l) (SHA512_Update(&ctx, (char *)(x), (l)))
 #define HD(x)	 (SHA512_Update(&ctx, (char *)&(x), sizeof (x)))
-#define HF(x)    (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))
+#define HF(x)	 (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))
 
 int	getentropy(void *buf, size_t len);
 
+#ifdef CAN_REFERENCE_MAIN
+extern int main(int, char *argv[]);
+#endif
+static int gotdata(char *buf, size_t len);
 static int getentropy_urandom(void *buf, size_t len, const char *path,
     int devfscheck);
 static int getentropy_fallback(void *buf, size_t len);
-static int getentropy_phdr(struct dl_phdr_info *info, size_t size, void *data);
 
 int
 getentropy(void *buf, size_t len)
@@ -87,7 +86,7 @@ getentropy(void *buf, size_t len)
 
 	if (len > 256) {
 		errno = EIO;
-		return (-1);
+		return -1;
 	}
 
 	/*
@@ -154,6 +153,22 @@ getentropy(void *buf, size_t len)
 	return (ret);
 }
 
+/*
+ * Basic sanity checking; wish we could do better.
+ */
+static int
+gotdata(char *buf, size_t len)
+{
+	char	any_set = 0;
+	size_t	i;
+
+	for (i = 0; i < len; ++i)
+		any_set |= buf[i];
+	if (any_set == 0)
+		return -1;
+	return 0;
+}
+
 static int
 getentropy_urandom(void *buf, size_t len, const char *path, int devfscheck)
 {
@@ -200,11 +215,13 @@ start:
 		i += ret;
 	}
 	close(fd);
-	errno = save_errno;
-	return (0);		/* satisfied */
+	if (gotdata(buf, len) == 0) {
+		errno = save_errno;
+		return 0;		/* satisfied */
+	}
 nodevrandom:
 	errno = EIO;
-	return (-1);
+	return -1;
 }
 
 static const int cl[] = {
@@ -233,15 +250,6 @@ static const int cl[] = {
 };
 
 static int
-getentropy_phdr(struct dl_phdr_info *info, size_t size, void *data)
-{
-	SHA512_CTX *ctx = data;
-
-	SHA512_Update(ctx, &info->dlpi_addr, sizeof (info->dlpi_addr));
-	return (0);
-}
-
-static int
 getentropy_fallback(void *buf, size_t len)
 {
 	uint8_t results[SHA512_DIGEST_LENGTH];
@@ -278,8 +286,6 @@ getentropy_fallback(void *buf, size_t len)
 				cnt += (int)tv.tv_usec;
 			}
 
-			dl_iterate_phdr(getentropy_phdr, &ctx);
-
 			for (ii = 0; ii < sizeof(cl)/sizeof(cl[0]); ii++)
 				HX(clock_gettime(cl[ii], &ts) == -1, ts);
 
@@ -300,6 +306,9 @@ getentropy_fallback(void *buf, size_t len)
 			HX(sigprocmask(SIG_BLOCK, NULL, &sigset) == -1,
 			    sigset);
 
+#ifdef CAN_REFERENCE_MAIN
+			HF(main);		/* an addr in program */
+#endif
 			HF(getentropy);	/* an addr in this library */
 			HF(printf);		/* an addr in libc */
 			p = (char *)&p;
@@ -422,8 +431,11 @@ getentropy_fallback(void *buf, size_t len)
 		memcpy((char *)buf + i, results, min(sizeof(results), len - i));
 		i += min(sizeof(results), len - i);
 	}
-	explicit_bzero(&ctx, sizeof ctx);
-	explicit_bzero(results, sizeof results);
-	errno = save_errno;
-	return (0);		/* satisfied */
+	memset(results, 0, sizeof results);
+	if (gotdata(buf, len) == 0) {
+		errno = save_errno;
+		return 0;		/* satisfied */
+	}
+	errno = EIO;
+	return -1;
 }
diff --git a/config.guess b/config.guess
index f50dcdb6de2a..7ea49fadcd8b 100755
--- a/config.guess
+++ b/config.guess
@@ -1,8 +1,8 @@
-#! /bin/sh
+#!/usr/bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright 1992-2018 Free Software Foundation, Inc.
+#   Copyright 1992-2016 Free Software Foundation, Inc.
 
-timestamp='2018-02-24'
+timestamp='2016-10-02'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@ timestamp='2018-02-24'
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <https://www.gnu.org/licenses/>.
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -27,7 +27,7 @@ timestamp='2018-02-24'
 # Originally written by Per Bothner; maintained since 2000 by Ben Elliston.
 #
 # You can get the latest version of this script from:
-# https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
 #
 # Please send patches to <config-patches@gnu.org>.
 
@@ -39,7 +39,7 @@ Usage: $0 [OPTION]
 
 Output the configuration name of the system \`$me' is run on.
 
-Options:
+Operation modes:
   -h, --help         print this help, then exit
   -t, --time-stamp   print date of last modification, then exit
   -v, --version      print version number, then exit
@@ -50,7 +50,7 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright 1992-2018 Free Software Foundation, Inc.
+Copyright 1992-2016 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -107,9 +107,9 @@ trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ;
 dummy=$tmp/dummy ;
 tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ;
 case $CC_FOR_BUILD,$HOST_CC,$CC in
- ,,)    echo "int x;" > "$dummy.c" ;
+ ,,)    echo "int x;" > $dummy.c ;
 	for c in cc gcc c89 c99 ; do
-	  if ($c -c -o "$dummy.o" "$dummy.c") >/dev/null 2>&1 ; then
+	  if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then
 	     CC_FOR_BUILD="$c"; break ;
 	  fi ;
 	done ;
@@ -132,14 +132,14 @@ UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
 UNAME_SYSTEM=`(uname -s) 2>/dev/null`  || UNAME_SYSTEM=unknown
 UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
 
-case "$UNAME_SYSTEM" in
+case "${UNAME_SYSTEM}" in
 Linux|GNU|GNU/*)
 	# If the system lacks a compiler, then just pick glibc.
 	# We could probably try harder.
 	LIBC=gnu
 
-	eval "$set_cc_for_build"
-	cat <<-EOF > "$dummy.c"
+	eval $set_cc_for_build
+	cat <<-EOF > $dummy.c
 	#include <features.h>
 	#if defined(__UCLIBC__)
 	LIBC=uclibc
@@ -149,20 +149,13 @@ Linux|GNU|GNU/*)
 	LIBC=gnu
 	#endif
 	EOF
-	eval "`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`"
-
-	# If ldd exists, use it to detect musl libc.
-	if command -v ldd >/dev/null && \
-		ldd --version 2>&1 | grep -q ^musl
-	then
-	    LIBC=musl
-	fi
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
 	;;
 esac
 
 # Note: order is significant - the case branches are not exclusive.
 
-case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
+case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     *:NetBSD:*:*)
 	# NetBSD (nbsd) targets should (where applicable) match one or
 	# more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*,
@@ -176,30 +169,30 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
 	# portion of the name.  We always set it to "unknown".
 	sysctl="sysctl -n hw.machine_arch"
 	UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \
-	    "/sbin/$sysctl" 2>/dev/null || \
-	    "/usr/sbin/$sysctl" 2>/dev/null || \
+	    /sbin/$sysctl 2>/dev/null || \
+	    /usr/sbin/$sysctl 2>/dev/null || \
 	    echo unknown)`
-	case "$UNAME_MACHINE_ARCH" in
+	case "${UNAME_MACHINE_ARCH}" in
 	    armeb) machine=armeb-unknown ;;
 	    arm*) machine=arm-unknown ;;
 	    sh3el) machine=shl-unknown ;;
 	    sh3eb) machine=sh-unknown ;;
 	    sh5el) machine=sh5le-unknown ;;
 	    earmv*)
-		arch=`echo "$UNAME_MACHINE_ARCH" | sed -e 's,^e\(armv[0-9]\).*$,\1,'`
-		endian=`echo "$UNAME_MACHINE_ARCH" | sed -ne 's,^.*\(eb\)$,\1,p'`
-		machine="${arch}${endian}"-unknown
+		arch=`echo ${UNAME_MACHINE_ARCH} | sed -e 's,^e\(armv[0-9]\).*$,\1,'`
+		endian=`echo ${UNAME_MACHINE_ARCH} | sed -ne 's,^.*\(eb\)$,\1,p'`
+		machine=${arch}${endian}-unknown
 		;;
-	    *) machine="$UNAME_MACHINE_ARCH"-unknown ;;
+	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
 	# to ELF recently (or will in the future) and ABI.
-	case "$UNAME_MACHINE_ARCH" in
+	case "${UNAME_MACHINE_ARCH}" in
 	    earm*)
 		os=netbsdelf
 		;;
 	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
-		eval "$set_cc_for_build"
+		eval $set_cc_for_build
 		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
 			| grep -q __ELF__
 		then
@@ -215,10 +208,10 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
 		;;
 	esac
 	# Determine ABI tags.
-	case "$UNAME_MACHINE_ARCH" in
+	case "${UNAME_MACHINE_ARCH}" in
 	    earm*)
 		expr='s/^earmv[0-9]/-eabi/;s/eb$//'
-		abi=`echo "$UNAME_MACHINE_ARCH" | sed -e "$expr"`
+		abi=`echo ${UNAME_MACHINE_ARCH} | sed -e "$expr"`
 		;;
 	esac
 	# The OS release
@@ -226,55 +219,46 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
 	# thus, need a distinct triplet. However, they do not need
 	# kernel version information, so it can be replaced with a
 	# suitable tag, in the style of linux-gnu.
-	case "$UNAME_VERSION" in
+	case "${UNAME_VERSION}" in
 	    Debian*)
 		release='-gnu'
 		;;
 	    *)
-		release=`echo "$UNAME_RELEASE" | sed -e 's/[-_].*//' | cut -d. -f1,2`
+		release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2`
 		;;
 	esac
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
 	# contains redundant information, the shorter form:
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
-	echo "$machine-${os}${release}${abi}"
+	echo "${machine}-${os}${release}${abi}"
 	exit ;;
     *:Bitrig:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'`
-	echo "$UNAME_MACHINE_ARCH"-unknown-bitrig"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE}
 	exit ;;
     *:OpenBSD:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
-	echo "$UNAME_MACHINE_ARCH"-unknown-openbsd"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
 	exit ;;
     *:LibertyBSD:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'`
-	echo "$UNAME_MACHINE_ARCH"-unknown-libertybsd"$UNAME_RELEASE"
-	exit ;;
-    *:MidnightBSD:*:*)
-	echo "$UNAME_MACHINE"-unknown-midnightbsd"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE_ARCH}-unknown-libertybsd${UNAME_RELEASE}
 	exit ;;
     *:ekkoBSD:*:*)
-	echo "$UNAME_MACHINE"-unknown-ekkobsd"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
 	exit ;;
     *:SolidBSD:*:*)
-	echo "$UNAME_MACHINE"-unknown-solidbsd"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE}
 	exit ;;
     macppc:MirBSD:*:*)
-	echo powerpc-unknown-mirbsd"$UNAME_RELEASE"
+	echo powerpc-unknown-mirbsd${UNAME_RELEASE}
 	exit ;;
     *:MirBSD:*:*)
-	echo "$UNAME_MACHINE"-unknown-mirbsd"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
 	exit ;;
     *:Sortix:*:*)
-	echo "$UNAME_MACHINE"-unknown-sortix
+	echo ${UNAME_MACHINE}-unknown-sortix
 	exit ;;
-    *:Redox:*:*)
-	echo "$UNAME_MACHINE"-unknown-redox
-	exit ;;
-    mips:OSF1:*.*)
-        echo mips-dec-osf1
-        exit ;;
     alpha:OSF1:*:*)
 	case $UNAME_RELEASE in
 	*4.0)
@@ -326,19 +310,28 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
 	# A Tn.n version is a released field test version.
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
-	echo "$UNAME_MACHINE"-dec-osf"`echo "$UNAME_RELEASE" | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`"
+	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
 	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
 	exitcode=$?
 	trap '' 0
 	exit $exitcode ;;
+    Alpha\ *:Windows_NT*:*)
+	# How do we know it's Interix rather than the generic POSIX subsystem?
+	# Should we change UNAME_MACHINE based on the output of uname instead
+	# of the specific Alpha model?
+	echo alpha-pc-interix
+	exit ;;
+    21064:Windows_NT:50:3)
+	echo alpha-dec-winnt3.5
+	exit ;;
     Amiga*:UNIX_System_V:4.0:*)
 	echo m68k-unknown-sysv4
 	exit ;;
     *:[Aa]miga[Oo][Ss]:*:*)
-	echo "$UNAME_MACHINE"-unknown-amigaos
+	echo ${UNAME_MACHINE}-unknown-amigaos
 	exit ;;
     *:[Mm]orph[Oo][Ss]:*:*)
-	echo "$UNAME_MACHINE"-unknown-morphos
+	echo ${UNAME_MACHINE}-unknown-morphos
 	exit ;;
     *:OS/390:*:*)
 	echo i370-ibm-openedition
@@ -350,7 +343,7 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
 	echo powerpc-ibm-os400
 	exit ;;
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
-	echo arm-acorn-riscix"$UNAME_RELEASE"
+	echo arm-acorn-riscix${UNAME_RELEASE}
 	exit ;;
     arm*:riscos:*:*|arm*:RISCOS:*:*)
 	echo arm-unknown-riscos
@@ -377,19 +370,19 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
 	    sparc) echo sparc-icl-nx7; exit ;;
 	esac ;;
     s390x:SunOS:*:*)
-	echo "$UNAME_MACHINE"-ibm-solaris2"`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'`"
+	echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
     sun4H:SunOS:5.*:*)
-	echo sparc-hal-solaris2"`echo "$UNAME_RELEASE"|sed -e 's/[^.]*//'`"
+	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
-	echo sparc-sun-solaris2"`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'`"
+	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
     i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*)
-	echo i386-pc-auroraux"$UNAME_RELEASE"
+	echo i386-pc-auroraux${UNAME_RELEASE}
 	exit ;;
     i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
-	eval "$set_cc_for_build"
+	eval $set_cc_for_build
 	SUN_ARCH=i386
 	# If there is a compiler, see if it is configured for 64-bit objects.
 	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
@@ -402,13 +395,13 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
 		SUN_ARCH=x86_64
 	    fi
 	fi
-	echo "$SUN_ARCH"-pc-solaris2"`echo "$UNAME_RELEASE"|sed -e 's/[^.]*//'`"
+	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
     sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
 	# SunOS6.  Hard to guess exactly what SunOS6 will be like, but
 	# it's likely to be more like Solaris than SunOS4.
-	echo sparc-sun-solaris3"`echo "$UNAME_RELEASE"|sed -e 's/[^.]*//'`"
+	echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
     sun4*:SunOS:*:*)
 	case "`/usr/bin/arch -k`" in
@@ -417,25 +410,25 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
 		;;
 	esac
 	# Japanese Language versions have a version number like `4.1.3-JL'.
-	echo sparc-sun-sunos"`echo "$UNAME_RELEASE"|sed -e 's/-/_/'`"
+	echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
 	exit ;;
     sun3*:SunOS:*:*)
-	echo m68k-sun-sunos"$UNAME_RELEASE"
+	echo m68k-sun-sunos${UNAME_RELEASE}
 	exit ;;
     sun*:*:4.2BSD:*)
 	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
-	test "x$UNAME_RELEASE" = x && UNAME_RELEASE=3
+	test "x${UNAME_RELEASE}" = x && UNAME_RELEASE=3
 	case "`/bin/arch`" in
 	    sun3)
-		echo m68k-sun-sunos"$UNAME_RELEASE"
+		echo m68k-sun-sunos${UNAME_RELEASE}
 		;;
 	    sun4)
-		echo sparc-sun-sunos"$UNAME_RELEASE"
+		echo sparc-sun-sunos${UNAME_RELEASE}
 		;;
 	esac
 	exit ;;
     aushp:SunOS:*:*)
-	echo sparc-auspex-sunos"$UNAME_RELEASE"
+	echo sparc-auspex-sunos${UNAME_RELEASE}
 	exit ;;
     # The situation for MiNT is a little confusing.  The machine name
     # can be virtually everything (everything which is not
@@ -446,44 +439,44 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
     # MiNT.  But MiNT is downward compatible to TOS, so this should
     # be no problem.
     atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
-	echo m68k-atari-mint"$UNAME_RELEASE"
+	echo m68k-atari-mint${UNAME_RELEASE}
 	exit ;;
     atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
-	echo m68k-atari-mint"$UNAME_RELEASE"
+	echo m68k-atari-mint${UNAME_RELEASE}
 	exit ;;
     *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
-	echo m68k-atari-mint"$UNAME_RELEASE"
+	echo m68k-atari-mint${UNAME_RELEASE}
 	exit ;;
     milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
-	echo m68k-milan-mint"$UNAME_RELEASE"
+	echo m68k-milan-mint${UNAME_RELEASE}
 	exit ;;
     hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
-	echo m68k-hades-mint"$UNAME_RELEASE"
+	echo m68k-hades-mint${UNAME_RELEASE}
 	exit ;;
     *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
-	echo m68k-unknown-mint"$UNAME_RELEASE"
+	echo m68k-unknown-mint${UNAME_RELEASE}
 	exit ;;
     m68k:machten:*:*)
-	echo m68k-apple-machten"$UNAME_RELEASE"
+	echo m68k-apple-machten${UNAME_RELEASE}
 	exit ;;
     powerpc:machten:*:*)
-	echo powerpc-apple-machten"$UNAME_RELEASE"
+	echo powerpc-apple-machten${UNAME_RELEASE}
 	exit ;;
     RISC*:Mach:*:*)
 	echo mips-dec-mach_bsd4.3
 	exit ;;
     RISC*:ULTRIX:*:*)
-	echo mips-dec-ultrix"$UNAME_RELEASE"
+	echo mips-dec-ultrix${UNAME_RELEASE}
 	exit ;;
     VAX*:ULTRIX*:*:*)
-	echo vax-dec-ultrix"$UNAME_RELEASE"
+	echo vax-dec-ultrix${UNAME_RELEASE}
 	exit ;;
     2020:CLIX:*:* | 2430:CLIX:*:*)
-	echo clipper-intergraph-clix"$UNAME_RELEASE"
+	echo clipper-intergraph-clix${UNAME_RELEASE}
 	exit ;;
     mips:*:*:UMIPS | mips:*:*:RISCos)
-	eval "$set_cc_for_build"
-	sed 's/^	//' << EOF > "$dummy.c"
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
 #ifdef __cplusplus
 #include <stdio.h>  /* for printf() prototype */
 	int main (int argc, char *argv[]) {
@@ -492,23 +485,23 @@ case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
 #endif
 	#if defined (host_mips) && defined (MIPSEB)
 	#if defined (SYSTYPE_SYSV)
-	  printf ("mips-mips-riscos%ssysv\\n", argv[1]); exit (0);
+	  printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0);
 	#endif
 	#if defined (SYSTYPE_SVR4)
-	  printf ("mips-mips-riscos%ssvr4\\n", argv[1]); exit (0);
+	  printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0);
 	#endif
 	#if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD)
-	  printf ("mips-mips-riscos%sbsd\\n", argv[1]); exit (0);
+	  printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0);
 	#endif
 	#endif
 	  exit (-1);
 	}
 EOF
-	$CC_FOR_BUILD -o "$dummy" "$dummy.c" &&
-	  dummyarg=`echo "$UNAME_RELEASE" | sed -n 's/\([0-9]*\).*/\1/p'` &&
-	  SYSTEM_NAME=`"$dummy" "$dummyarg"` &&
+	$CC_FOR_BUILD -o $dummy $dummy.c &&
+	  dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` &&
+	  SYSTEM_NAME=`$dummy $dummyarg` &&
 	    { echo "$SYSTEM_NAME"; exit; }
-	echo mips-mips-riscos"$UNAME_RELEASE"
+	echo mips-mips-riscos${UNAME_RELEASE}
 	exit ;;
     Motorola:PowerMAX_OS:*:*)
 	echo powerpc-motorola-powermax
@@ -534,17 +527,17 @@ EOF
     AViiON:dgux:*:*)
 	# DG/UX returns AViiON for all architectures
 	UNAME_PROCESSOR=`/usr/bin/uname -p`
-	if [ "$UNAME_PROCESSOR" = mc88100 ] || [ "$UNAME_PROCESSOR" = mc88110 ]
+	if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ]
 	then
-	    if [ "$TARGET_BINARY_INTERFACE"x = m88kdguxelfx ] || \
-	       [ "$TARGET_BINARY_INTERFACE"x = x ]
+	    if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \
+	       [ ${TARGET_BINARY_INTERFACE}x = x ]
 	    then
-		echo m88k-dg-dgux"$UNAME_RELEASE"
+		echo m88k-dg-dgux${UNAME_RELEASE}
 	    else
-		echo m88k-dg-dguxbcs"$UNAME_RELEASE"
+		echo m88k-dg-dguxbcs${UNAME_RELEASE}
 	    fi
 	else
-	    echo i586-dg-dgux"$UNAME_RELEASE"
+	    echo i586-dg-dgux${UNAME_RELEASE}
 	fi
 	exit ;;
     M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
@@ -561,7 +554,7 @@ EOF
 	echo m68k-tektronix-bsd
 	exit ;;
     *:IRIX*:*:*)
-	echo mips-sgi-irix"`echo "$UNAME_RELEASE"|sed -e 's/-/_/g'`"
+	echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
 	exit ;;
     ????????:AIX?:[12].1:2)   # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
 	echo romp-ibm-aix     # uname -m gives an 8 hex-code CPU id
@@ -573,14 +566,14 @@ EOF
 	if [ -x /usr/bin/oslevel ] ; then
 		IBM_REV=`/usr/bin/oslevel`
 	else
-		IBM_REV="$UNAME_VERSION.$UNAME_RELEASE"
+		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
-	echo "$UNAME_MACHINE"-ibm-aix"$IBM_REV"
+	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
 	exit ;;
     *:AIX:2:3)
 	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
-		eval "$set_cc_for_build"
-		sed 's/^		//' << EOF > "$dummy.c"
+		eval $set_cc_for_build
+		sed 's/^		//' << EOF >$dummy.c
 		#include <sys/systemcfg.h>
 
 		main()
@@ -591,7 +584,7 @@ EOF
 			exit(0);
 			}
 EOF
-		if $CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"`
+		if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
 		then
 			echo "$SYSTEM_NAME"
 		else
@@ -605,7 +598,7 @@ EOF
 	exit ;;
     *:AIX:*:[4567])
 	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
-	if /usr/sbin/lsattr -El "$IBM_CPU_ID" | grep ' POWER' >/dev/null 2>&1; then
+	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
 	else
 		IBM_ARCH=powerpc
@@ -614,18 +607,18 @@ EOF
 		IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc |
 			   awk -F: '{ print $3 }' | sed s/[0-9]*$/0/`
 	else
-		IBM_REV="$UNAME_VERSION.$UNAME_RELEASE"
+		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
-	echo "$IBM_ARCH"-ibm-aix"$IBM_REV"
+	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
 	exit ;;
     *:AIX:*:*)
 	echo rs6000-ibm-aix
 	exit ;;
-    ibmrt:4.4BSD:*|romp-ibm:4.4BSD:*)
+    ibmrt:4.4BSD:*|romp-ibm:BSD:*)
 	echo romp-ibm-bsd4.4
 	exit ;;
     ibmrt:*BSD:*|romp-ibm:BSD:*)            # covers RT/PC BSD and
-	echo romp-ibm-bsd"$UNAME_RELEASE"   # 4.3 with uname added to
+	echo romp-ibm-bsd${UNAME_RELEASE}   # 4.3 with uname added to
 	exit ;;                             # report: romp-ibm BSD 4.3
     *:BOSX:*:*)
 	echo rs6000-bull-bosx
@@ -640,28 +633,28 @@ EOF
 	echo m68k-hp-bsd4.4
 	exit ;;
     9000/[34678]??:HP-UX:*:*)
-	HPUX_REV=`echo "$UNAME_RELEASE"|sed -e 's/[^.]*.[0B]*//'`
-	case "$UNAME_MACHINE" in
-	    9000/31?)            HP_ARCH=m68000 ;;
-	    9000/[34]??)         HP_ARCH=m68k ;;
+	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
+	case "${UNAME_MACHINE}" in
+	    9000/31? )            HP_ARCH=m68000 ;;
+	    9000/[34]?? )         HP_ARCH=m68k ;;
 	    9000/[678][0-9][0-9])
 		if [ -x /usr/bin/getconf ]; then
 		    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
 		    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
-		    case "$sc_cpu_version" in
+		    case "${sc_cpu_version}" in
 		      523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0
 		      528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1
 		      532)                      # CPU_PA_RISC2_0
-			case "$sc_kernel_bits" in
+			case "${sc_kernel_bits}" in
 			  32) HP_ARCH=hppa2.0n ;;
 			  64) HP_ARCH=hppa2.0w ;;
 			  '') HP_ARCH=hppa2.0 ;;   # HP-UX 10.20
 			esac ;;
 		    esac
 		fi
-		if [ "$HP_ARCH" = "" ]; then
-		    eval "$set_cc_for_build"
-		    sed 's/^		//' << EOF > "$dummy.c"
+		if [ "${HP_ARCH}" = "" ]; then
+		    eval $set_cc_for_build
+		    sed 's/^		//' << EOF >$dummy.c
 
 		#define _HPUX_SOURCE
 		#include <stdlib.h>
@@ -694,13 +687,13 @@ EOF
 		    exit (0);
 		}
 EOF
-		    (CCOPTS="" $CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null) && HP_ARCH=`"$dummy"`
+		    (CCOPTS="" $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
 		    test -z "$HP_ARCH" && HP_ARCH=hppa
 		fi ;;
 	esac
-	if [ "$HP_ARCH" = hppa2.0w ]
+	if [ ${HP_ARCH} = hppa2.0w ]
 	then
-	    eval "$set_cc_for_build"
+	    eval $set_cc_for_build
 
 	    # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
 	    # 32-bit code.  hppa64-hp-hpux* has the same kernel and a compiler
@@ -719,15 +712,15 @@ EOF
 		HP_ARCH=hppa64
 	    fi
 	fi
-	echo "$HP_ARCH"-hp-hpux"$HPUX_REV"
+	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
 	exit ;;
     ia64:HP-UX:*:*)
-	HPUX_REV=`echo "$UNAME_RELEASE"|sed -e 's/[^.]*.[0B]*//'`
-	echo ia64-hp-hpux"$HPUX_REV"
+	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
+	echo ia64-hp-hpux${HPUX_REV}
 	exit ;;
     3050*:HI-UX:*:*)
-	eval "$set_cc_for_build"
-	sed 's/^	//' << EOF > "$dummy.c"
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
 	#include <unistd.h>
 	int
 	main ()
@@ -752,11 +745,11 @@ EOF
 	  exit (0);
 	}
 EOF
-	$CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"` &&
+	$CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
 		{ echo "$SYSTEM_NAME"; exit; }
 	echo unknown-hitachi-hiuxwe2
 	exit ;;
-    9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:*)
+    9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* )
 	echo hppa1.1-hp-bsd
 	exit ;;
     9000/8??:4.3bsd:*:*)
@@ -765,7 +758,7 @@ EOF
     *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
 	echo hppa1.0-hp-mpeix
 	exit ;;
-    hp7??:OSF1:*:* | hp8?[79]:OSF1:*:*)
+    hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* )
 	echo hppa1.1-hp-osf
 	exit ;;
     hp8??:OSF1:*:*)
@@ -773,9 +766,9 @@ EOF
 	exit ;;
     i*86:OSF1:*:*)
 	if [ -x /usr/sbin/sysversion ] ; then
-	    echo "$UNAME_MACHINE"-unknown-osf1mk
+	    echo ${UNAME_MACHINE}-unknown-osf1mk
 	else
-	    echo "$UNAME_MACHINE"-unknown-osf1
+	    echo ${UNAME_MACHINE}-unknown-osf1
 	fi
 	exit ;;
     parisc*:Lites*:*:*)
@@ -800,109 +793,127 @@ EOF
 	echo c4-convex-bsd
 	exit ;;
     CRAY*Y-MP:*:*:*)
-	echo ymp-cray-unicos"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'
+	echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit ;;
     CRAY*[A-Z]90:*:*:*)
-	echo "$UNAME_MACHINE"-cray-unicos"$UNAME_RELEASE" \
+	echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
 	| sed -e 's/CRAY.*\([A-Z]90\)/\1/' \
 	      -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
 	      -e 's/\.[^.]*$/.X/'
 	exit ;;
     CRAY*TS:*:*:*)
-	echo t90-cray-unicos"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'
+	echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit ;;
     CRAY*T3E:*:*:*)
-	echo alphaev5-cray-unicosmk"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'
+	echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit ;;
     CRAY*SV1:*:*:*)
-	echo sv1-cray-unicos"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'
+	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit ;;
     *:UNICOS/mp:*:*)
-	echo craynv-cray-unicosmp"$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'
+	echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit ;;
     F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
 	FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
 	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
-	FUJITSU_REL=`echo "$UNAME_RELEASE" | sed -e 's/ /_/'`
+	FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
 	echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
 	exit ;;
     5000:UNIX_System_V:4.*:*)
 	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
-	FUJITSU_REL=`echo "$UNAME_RELEASE" | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
+	FUJITSU_REL=`echo ${UNAME_RELEASE} | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
 	echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
 	exit ;;
     i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
-	echo "$UNAME_MACHINE"-pc-bsdi"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
 	exit ;;
     sparc*:BSD/OS:*:*)
-	echo sparc-unknown-bsdi"$UNAME_RELEASE"
+	echo sparc-unknown-bsdi${UNAME_RELEASE}
 	exit ;;
     *:BSD/OS:*:*)
-	echo "$UNAME_MACHINE"-unknown-bsdi"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
 	exit ;;
     *:FreeBSD:*:*)
 	UNAME_PROCESSOR=`/usr/bin/uname -p`
-	case "$UNAME_PROCESSOR" in
+	case ${UNAME_PROCESSOR} in
 	    amd64)
-		UNAME_PROCESSOR=x86_64 ;;
-	    i386)
-		UNAME_PROCESSOR=i586 ;;
+		echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+	    *)
+		echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
 	esac
-	echo "$UNAME_PROCESSOR"-unknown-freebsd"`echo "$UNAME_RELEASE"|sed -e 's/[-(].*//'`"
 	exit ;;
     i*:CYGWIN*:*)
-	echo "$UNAME_MACHINE"-pc-cygwin
+	echo ${UNAME_MACHINE}-pc-cygwin
 	exit ;;
     *:MINGW64*:*)
-	echo "$UNAME_MACHINE"-pc-mingw64
+	echo ${UNAME_MACHINE}-pc-mingw64
 	exit ;;
     *:MINGW*:*)
-	echo "$UNAME_MACHINE"-pc-mingw32
+	echo ${UNAME_MACHINE}-pc-mingw32
 	exit ;;
     *:MSYS*:*)
-	echo "$UNAME_MACHINE"-pc-msys
+	echo ${UNAME_MACHINE}-pc-msys
+	exit ;;
+    i*:windows32*:*)
+	# uname -m includes "-pc" on this system.
+	echo ${UNAME_MACHINE}-mingw32
 	exit ;;
     i*:PW*:*)
-	echo "$UNAME_MACHINE"-pc-pw32
+	echo ${UNAME_MACHINE}-pc-pw32
 	exit ;;
     *:Interix*:*)
-	case "$UNAME_MACHINE" in
+	case ${UNAME_MACHINE} in
 	    x86)
-		echo i586-pc-interix"$UNAME_RELEASE"
+		echo i586-pc-interix${UNAME_RELEASE}
 		exit ;;
 	    authenticamd | genuineintel | EM64T)
-		echo x86_64-unknown-interix"$UNAME_RELEASE"
+		echo x86_64-unknown-interix${UNAME_RELEASE}
 		exit ;;
 	    IA64)
-		echo ia64-unknown-interix"$UNAME_RELEASE"
+		echo ia64-unknown-interix${UNAME_RELEASE}
 		exit ;;
 	esac ;;
+    [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
+	echo i${UNAME_MACHINE}-pc-mks
+	exit ;;
+    8664:Windows_NT:*)
+	echo x86_64-pc-mks
+	exit ;;
+    i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
+	# How do we know it's Interix rather than the generic POSIX subsystem?
+	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
+	# UNAME_MACHINE based on the output of uname instead of i386?
+	echo i586-pc-interix
+	exit ;;
     i*:UWIN*:*)
-	echo "$UNAME_MACHINE"-pc-uwin
+	echo ${UNAME_MACHINE}-pc-uwin
 	exit ;;
     amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*)
 	echo x86_64-unknown-cygwin
 	exit ;;
+    p*:CYGWIN*:*)
+	echo powerpcle-unknown-cygwin
+	exit ;;
     prep*:SunOS:5.*:*)
-	echo powerpcle-unknown-solaris2"`echo "$UNAME_RELEASE"|sed -e 's/[^.]*//'`"
+	echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
     *:GNU:*:*)
 	# the GNU system
-	echo "`echo "$UNAME_MACHINE"|sed -e 's,[-/].*$,,'`-unknown-$LIBC`echo "$UNAME_RELEASE"|sed -e 's,/.*$,,'`"
+	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
 	exit ;;
     *:GNU/*:*:*)
 	# other systems with GNU libc and userland
-	echo "$UNAME_MACHINE-unknown-`echo "$UNAME_SYSTEM" | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"``echo "$UNAME_RELEASE"|sed -e 's/[-(].*//'`-$LIBC"
+	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
 	exit ;;
     i*86:Minix:*:*)
-	echo "$UNAME_MACHINE"-pc-minix
+	echo ${UNAME_MACHINE}-pc-minix
 	exit ;;
     aarch64:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     aarch64_be:Linux:*:*)
 	UNAME_MACHINE=aarch64_be
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     alpha:Linux:*:*)
 	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
@@ -916,63 +927,63 @@ EOF
 	esac
 	objdump --private-headers /bin/sh | grep -q ld.so.1
 	if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     arc:Linux:*:* | arceb:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     arm*:Linux:*:*)
-	eval "$set_cc_for_build"
+	eval $set_cc_for_build
 	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
 	    | grep -q __ARM_EABI__
 	then
-	    echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	    echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	else
 	    if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
 		| grep -q __ARM_PCS_VFP
 	    then
-		echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"eabi
+		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi
 	    else
-		echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"eabihf
+		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf
 	    fi
 	fi
 	exit ;;
     avr32*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     cris:Linux:*:*)
-	echo "$UNAME_MACHINE"-axis-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
 	exit ;;
     crisv32:Linux:*:*)
-	echo "$UNAME_MACHINE"-axis-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
 	exit ;;
     e2k:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     frv:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     hexagon:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     i*86:Linux:*:*)
-	echo "$UNAME_MACHINE"-pc-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
 	exit ;;
     ia64:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     k1om:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     m32r*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     m68*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     mips:Linux:*:* | mips64:Linux:*:*)
-	eval "$set_cc_for_build"
-	sed 's/^	//' << EOF > "$dummy.c"
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
 	#undef CPU
 	#undef ${UNAME_MACHINE}
 	#undef ${UNAME_MACHINE}el
@@ -986,74 +997,70 @@ EOF
 	#endif
 	#endif
 EOF
-	eval "`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^CPU'`"
-	test "x$CPU" != x && { echo "$CPU-unknown-linux-$LIBC"; exit; }
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
+	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
 	;;
     mips64el:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     openrisc*:Linux:*:*)
-	echo or1k-unknown-linux-"$LIBC"
+	echo or1k-unknown-linux-${LIBC}
 	exit ;;
     or32:Linux:*:* | or1k*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     padre:Linux:*:*)
-	echo sparc-unknown-linux-"$LIBC"
+	echo sparc-unknown-linux-${LIBC}
 	exit ;;
     parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-"$LIBC"
+	echo hppa64-unknown-linux-${LIBC}
 	exit ;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
-	  PA7*) echo hppa1.1-unknown-linux-"$LIBC" ;;
-	  PA8*) echo hppa2.0-unknown-linux-"$LIBC" ;;
-	  *)    echo hppa-unknown-linux-"$LIBC" ;;
+	  PA7*) echo hppa1.1-unknown-linux-${LIBC} ;;
+	  PA8*) echo hppa2.0-unknown-linux-${LIBC} ;;
+	  *)    echo hppa-unknown-linux-${LIBC} ;;
 	esac
 	exit ;;
     ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-"$LIBC"
+	echo powerpc64-unknown-linux-${LIBC}
 	exit ;;
     ppc:Linux:*:*)
-	echo powerpc-unknown-linux-"$LIBC"
+	echo powerpc-unknown-linux-${LIBC}
 	exit ;;
     ppc64le:Linux:*:*)
-	echo powerpc64le-unknown-linux-"$LIBC"
+	echo powerpc64le-unknown-linux-${LIBC}
 	exit ;;
     ppcle:Linux:*:*)
-	echo powerpcle-unknown-linux-"$LIBC"
+	echo powerpcle-unknown-linux-${LIBC}
 	exit ;;
     riscv32:Linux:*:* | riscv64:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
-	echo "$UNAME_MACHINE"-ibm-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
 	exit ;;
     sh64*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     sh*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     sparc:Linux:*:* | sparc64:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     tile*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     vax:Linux:*:*)
-	echo "$UNAME_MACHINE"-dec-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-dec-linux-${LIBC}
 	exit ;;
     x86_64:Linux:*:*)
-	if objdump -f /bin/sh | grep -q elf32-x86-64; then
-	    echo "$UNAME_MACHINE"-pc-linux-"$LIBC"x32
-	else
-	    echo "$UNAME_MACHINE"-pc-linux-"$LIBC"
-	fi
+	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
 	exit ;;
     xtensa*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
@@ -1067,34 +1074,34 @@ EOF
 	# I am not positive that other SVR4 systems won't match this,
 	# I just have to hope.  -- rms.
 	# Use sysv4.2uw... so that sysv4* matches it.
-	echo "$UNAME_MACHINE"-pc-sysv4.2uw"$UNAME_VERSION"
+	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
 	exit ;;
     i*86:OS/2:*:*)
 	# If we were able to find `uname', then EMX Unix compatibility
 	# is probably installed.
-	echo "$UNAME_MACHINE"-pc-os2-emx
+	echo ${UNAME_MACHINE}-pc-os2-emx
 	exit ;;
     i*86:XTS-300:*:STOP)
-	echo "$UNAME_MACHINE"-unknown-stop
+	echo ${UNAME_MACHINE}-unknown-stop
 	exit ;;
     i*86:atheos:*:*)
-	echo "$UNAME_MACHINE"-unknown-atheos
+	echo ${UNAME_MACHINE}-unknown-atheos
 	exit ;;
     i*86:syllable:*:*)
-	echo "$UNAME_MACHINE"-pc-syllable
+	echo ${UNAME_MACHINE}-pc-syllable
 	exit ;;
     i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*)
-	echo i386-unknown-lynxos"$UNAME_RELEASE"
+	echo i386-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
     i*86:*DOS:*:*)
-	echo "$UNAME_MACHINE"-pc-msdosdjgpp
+	echo ${UNAME_MACHINE}-pc-msdosdjgpp
 	exit ;;
-    i*86:*:4.*:*)
-	UNAME_REL=`echo "$UNAME_RELEASE" | sed 's/\/MP$//'`
+    i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
+	UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
 	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
-		echo "$UNAME_MACHINE"-univel-sysv"$UNAME_REL"
+		echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL}
 	else
-		echo "$UNAME_MACHINE"-pc-sysv"$UNAME_REL"
+		echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
 	fi
 	exit ;;
     i*86:*:5:[678]*)
@@ -1104,12 +1111,12 @@ EOF
 	    *Pentium)	     UNAME_MACHINE=i586 ;;
 	    *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
 	esac
-	echo "$UNAME_MACHINE-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}{$UNAME_VERSION}"
+	echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
 	exit ;;
     i*86:*:3.2:*)
 	if test -f /usr/options/cb.name; then
 		UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
-		echo "$UNAME_MACHINE"-pc-isc"$UNAME_REL"
+		echo ${UNAME_MACHINE}-pc-isc$UNAME_REL
 	elif /bin/uname -X 2>/dev/null >/dev/null ; then
 		UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
 		(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
@@ -1119,9 +1126,9 @@ EOF
 			&& UNAME_MACHINE=i686
 		(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
 			&& UNAME_MACHINE=i686
-		echo "$UNAME_MACHINE"-pc-sco"$UNAME_REL"
+		echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
 	else
-		echo "$UNAME_MACHINE"-pc-sysv32
+		echo ${UNAME_MACHINE}-pc-sysv32
 	fi
 	exit ;;
     pc:*:*:*)
@@ -1141,9 +1148,9 @@ EOF
 	exit ;;
     i860:*:4.*:*) # i860-SVR4
 	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
-	  echo i860-stardent-sysv"$UNAME_RELEASE" # Stardent Vistra i860-SVR4
+	  echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
 	else # Add other i860-SVR4 vendors below as they are discovered.
-	  echo i860-unknown-sysv"$UNAME_RELEASE"  # Unknown i860-SVR4
+	  echo i860-unknown-sysv${UNAME_RELEASE}  # Unknown i860-SVR4
 	fi
 	exit ;;
     mini*:CTIX:SYS*5:*)
@@ -1163,9 +1170,9 @@ EOF
 	test -r /etc/.relid \
 	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	  && { echo i486-ncr-sysv4.3"$OS_REL"; exit; }
+	  && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	  && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;;
+	  && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
 	  && { echo i486-ncr-sysv4; exit; } ;;
@@ -1174,28 +1181,28 @@ EOF
 	test -r /etc/.relid \
 	    && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	    && { echo i486-ncr-sysv4.3"$OS_REL"; exit; }
+	    && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	    && { echo i586-ncr-sysv4.3"$OS_REL"; exit; }
+	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \
-	    && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;;
+	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
-	echo m68k-unknown-lynxos"$UNAME_RELEASE"
+	echo m68k-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
     mc68030:UNIX_System_V:4.*:*)
 	echo m68k-atari-sysv4
 	exit ;;
     TSUNAMI:LynxOS:2.*:*)
-	echo sparc-unknown-lynxos"$UNAME_RELEASE"
+	echo sparc-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
     rs6000:LynxOS:2.*:*)
-	echo rs6000-unknown-lynxos"$UNAME_RELEASE"
+	echo rs6000-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
     PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*)
-	echo powerpc-unknown-lynxos"$UNAME_RELEASE"
+	echo powerpc-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
     SM[BE]S:UNIX_SV:*:*)
-	echo mips-dde-sysv"$UNAME_RELEASE"
+	echo mips-dde-sysv${UNAME_RELEASE}
 	exit ;;
     RM*:ReliantUNIX-*:*:*)
 	echo mips-sni-sysv4
@@ -1206,7 +1213,7 @@ EOF
     *:SINIX-*:*:*)
 	if uname -p 2>/dev/null >/dev/null ; then
 		UNAME_MACHINE=`(uname -p) 2>/dev/null`
-		echo "$UNAME_MACHINE"-sni-sysv4
+		echo ${UNAME_MACHINE}-sni-sysv4
 	else
 		echo ns32k-sni-sysv
 	fi
@@ -1226,23 +1233,23 @@ EOF
 	exit ;;
     i*86:VOS:*:*)
 	# From Paul.Green@stratus.com.
-	echo "$UNAME_MACHINE"-stratus-vos
+	echo ${UNAME_MACHINE}-stratus-vos
 	exit ;;
     *:VOS:*:*)
 	# From Paul.Green@stratus.com.
 	echo hppa1.1-stratus-vos
 	exit ;;
     mc68*:A/UX:*:*)
-	echo m68k-apple-aux"$UNAME_RELEASE"
+	echo m68k-apple-aux${UNAME_RELEASE}
 	exit ;;
     news*:NEWS-OS:6*:*)
 	echo mips-sony-newsos6
 	exit ;;
     R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
 	if [ -d /usr/nec ]; then
-		echo mips-nec-sysv"$UNAME_RELEASE"
+		echo mips-nec-sysv${UNAME_RELEASE}
 	else
-		echo mips-unknown-sysv"$UNAME_RELEASE"
+		echo mips-unknown-sysv${UNAME_RELEASE}
 	fi
 	exit ;;
     BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
@@ -1261,56 +1268,49 @@ EOF
 	echo x86_64-unknown-haiku
 	exit ;;
     SX-4:SUPER-UX:*:*)
-	echo sx4-nec-superux"$UNAME_RELEASE"
+	echo sx4-nec-superux${UNAME_RELEASE}
 	exit ;;
     SX-5:SUPER-UX:*:*)
-	echo sx5-nec-superux"$UNAME_RELEASE"
+	echo sx5-nec-superux${UNAME_RELEASE}
 	exit ;;
     SX-6:SUPER-UX:*:*)
-	echo sx6-nec-superux"$UNAME_RELEASE"
+	echo sx6-nec-superux${UNAME_RELEASE}
 	exit ;;
     SX-7:SUPER-UX:*:*)
-	echo sx7-nec-superux"$UNAME_RELEASE"
+	echo sx7-nec-superux${UNAME_RELEASE}
 	exit ;;
     SX-8:SUPER-UX:*:*)
-	echo sx8-nec-superux"$UNAME_RELEASE"
+	echo sx8-nec-superux${UNAME_RELEASE}
 	exit ;;
     SX-8R:SUPER-UX:*:*)
-	echo sx8r-nec-superux"$UNAME_RELEASE"
+	echo sx8r-nec-superux${UNAME_RELEASE}
 	exit ;;
     SX-ACE:SUPER-UX:*:*)
-	echo sxace-nec-superux"$UNAME_RELEASE"
+	echo sxace-nec-superux${UNAME_RELEASE}
 	exit ;;
     Power*:Rhapsody:*:*)
-	echo powerpc-apple-rhapsody"$UNAME_RELEASE"
+	echo powerpc-apple-rhapsody${UNAME_RELEASE}
 	exit ;;
     *:Rhapsody:*:*)
-	echo "$UNAME_MACHINE"-apple-rhapsody"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
 	exit ;;
     *:Darwin:*:*)
 	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
-	eval "$set_cc_for_build"
+	eval $set_cc_for_build
 	if test "$UNAME_PROCESSOR" = unknown ; then
 	    UNAME_PROCESSOR=powerpc
 	fi
-	if test "`echo "$UNAME_RELEASE" | sed -e 's/\..*//'`" -le 10 ; then
+	if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
 	    if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
 		if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
-		       (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
-		       grep IS_64BIT_ARCH >/dev/null
+		    (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
+		    grep IS_64BIT_ARCH >/dev/null
 		then
 		    case $UNAME_PROCESSOR in
 			i386) UNAME_PROCESSOR=x86_64 ;;
 			powerpc) UNAME_PROCESSOR=powerpc64 ;;
 		    esac
 		fi
-		# On 10.4-10.6 one might compile for PowerPC via gcc -arch ppc
-		if (echo '#ifdef __POWERPC__'; echo IS_PPC; echo '#endif') | \
-		       (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
-		       grep IS_PPC >/dev/null
-		then
-		    UNAME_PROCESSOR=powerpc
-		fi
 	    fi
 	elif test "$UNAME_PROCESSOR" = i386 ; then
 	    # Avoid executing cc on OS X 10.9, as it ships with a stub
@@ -1321,7 +1321,7 @@ EOF
 	    # that Apple uses in portable devices.
 	    UNAME_PROCESSOR=x86_64
 	fi
-	echo "$UNAME_PROCESSOR"-apple-darwin"$UNAME_RELEASE"
+	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
 	exit ;;
     *:procnto*:*:* | *:QNX:[0123456789]*:*)
 	UNAME_PROCESSOR=`uname -p`
@@ -1329,25 +1329,19 @@ EOF
 		UNAME_PROCESSOR=i386
 		UNAME_MACHINE=pc
 	fi
-	echo "$UNAME_PROCESSOR"-"$UNAME_MACHINE"-nto-qnx"$UNAME_RELEASE"
+	echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
 	exit ;;
     *:QNX:*:4*)
 	echo i386-pc-qnx
 	exit ;;
-    NEO-*:NONSTOP_KERNEL:*:*)
-	echo neo-tandem-nsk"$UNAME_RELEASE"
+    NEO-?:NONSTOP_KERNEL:*:*)
+	echo neo-tandem-nsk${UNAME_RELEASE}
 	exit ;;
     NSE-*:NONSTOP_KERNEL:*:*)
-	echo nse-tandem-nsk"$UNAME_RELEASE"
-	exit ;;
-    NSR-*:NONSTOP_KERNEL:*:*)
-	echo nsr-tandem-nsk"$UNAME_RELEASE"
-	exit ;;
-    NSV-*:NONSTOP_KERNEL:*:*)
-	echo nsv-tandem-nsk"$UNAME_RELEASE"
+	echo nse-tandem-nsk${UNAME_RELEASE}
 	exit ;;
-    NSX-*:NONSTOP_KERNEL:*:*)
-	echo nsx-tandem-nsk"$UNAME_RELEASE"
+    NSR-?:NONSTOP_KERNEL:*:*)
+	echo nsr-tandem-nsk${UNAME_RELEASE}
 	exit ;;
     *:NonStop-UX:*:*)
 	echo mips-compaq-nonstopux
@@ -1356,7 +1350,7 @@ EOF
 	echo bs2000-siemens-sysv
 	exit ;;
     DS/*:UNIX_System_V:*:*)
-	echo "$UNAME_MACHINE"-"$UNAME_SYSTEM"-"$UNAME_RELEASE"
+	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
 	exit ;;
     *:Plan9:*:*)
 	# "uname -m" is not consistent, so use $cputype instead. 386
@@ -1367,7 +1361,7 @@ EOF
 	else
 	    UNAME_MACHINE="$cputype"
 	fi
-	echo "$UNAME_MACHINE"-unknown-plan9
+	echo ${UNAME_MACHINE}-unknown-plan9
 	exit ;;
     *:TOPS-10:*:*)
 	echo pdp10-unknown-tops10
@@ -1388,14 +1382,14 @@ EOF
 	echo pdp10-unknown-its
 	exit ;;
     SEI:*:*:SEIUX)
-	echo mips-sei-seiux"$UNAME_RELEASE"
+	echo mips-sei-seiux${UNAME_RELEASE}
 	exit ;;
     *:DragonFly:*:*)
-	echo "$UNAME_MACHINE"-unknown-dragonfly"`echo "$UNAME_RELEASE"|sed -e 's/[-(].*//'`"
+	echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
 	exit ;;
     *:*VMS:*:*)
 	UNAME_MACHINE=`(uname -p) 2>/dev/null`
-	case "$UNAME_MACHINE" in
+	case "${UNAME_MACHINE}" in
 	    A*) echo alpha-dec-vms ; exit ;;
 	    I*) echo ia64-dec-vms ; exit ;;
 	    V*) echo vax-dec-vms ; exit ;;
@@ -1404,44 +1398,32 @@ EOF
 	echo i386-pc-xenix
 	exit ;;
     i*86:skyos:*:*)
-	echo "$UNAME_MACHINE"-pc-skyos"`echo "$UNAME_RELEASE" | sed -e 's/ .*$//'`"
+	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE} | sed -e 's/ .*$//'`
 	exit ;;
     i*86:rdos:*:*)
-	echo "$UNAME_MACHINE"-pc-rdos
+	echo ${UNAME_MACHINE}-pc-rdos
 	exit ;;
     i*86:AROS:*:*)
-	echo "$UNAME_MACHINE"-pc-aros
+	echo ${UNAME_MACHINE}-pc-aros
 	exit ;;
     x86_64:VMkernel:*:*)
-	echo "$UNAME_MACHINE"-unknown-esx
+	echo ${UNAME_MACHINE}-unknown-esx
 	exit ;;
     amd64:Isilon\ OneFS:*:*)
 	echo x86_64-unknown-onefs
 	exit ;;
 esac
 
-echo "$0: unable to guess system type" >&2
-
-case "$UNAME_MACHINE:$UNAME_SYSTEM" in
-    mips:Linux | mips64:Linux)
-	# If we got here on MIPS GNU/Linux, output extra information.
-	cat >&2 <<EOF
-
-NOTE: MIPS GNU/Linux systems require a C compiler to fully recognize
-the system type. Please install a C compiler and try again.
-EOF
-	;;
-esac
-
 cat >&2 <<EOF
+$0: unable to guess system type
 
 This script (version $timestamp), has failed to recognize the
-operating system you are using. If your script is old, overwrite *all*
-copies of config.guess and config.sub with the latest versions from:
+operating system you are using. If your script is old, overwrite
+config.guess and config.sub with the latest versions from:
 
-  https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
 and
-  https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
 
 If $0 has already been updated, send the following data and any
 information you think might be pertinent to config-patches@gnu.org to
@@ -1464,16 +1446,16 @@ hostinfo               = `(hostinfo) 2>/dev/null`
 /usr/bin/oslevel       = `(/usr/bin/oslevel) 2>/dev/null`
 /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null`
 
-UNAME_MACHINE = "$UNAME_MACHINE"
-UNAME_RELEASE = "$UNAME_RELEASE"
-UNAME_SYSTEM  = "$UNAME_SYSTEM"
-UNAME_VERSION = "$UNAME_VERSION"
+UNAME_MACHINE = ${UNAME_MACHINE}
+UNAME_RELEASE = ${UNAME_RELEASE}
+UNAME_SYSTEM  = ${UNAME_SYSTEM}
+UNAME_VERSION = ${UNAME_VERSION}
 EOF
 
 exit 1
 
 # Local variables:
-# eval: (add-hook 'write-file-functions 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
diff --git a/config.h.in b/config.h.in
index 8c2aa3b94aee..78d47fedc139 100644
--- a/config.h.in
+++ b/config.h.in
@@ -63,6 +63,15 @@
 /* Whether the C compiler accepts the "weak" attribute */
 #undef HAVE_ATTR_WEAK
 
+/* If we have be64toh */
+#undef HAVE_BE64TOH
+
+/* Define to 1 if you have the <bsd/stdlib.h> header file. */
+#undef HAVE_BSD_STDLIB_H
+
+/* Define to 1 if you have the <bsd/string.h> header file. */
+#undef HAVE_BSD_STRING_H
+
 /* Define to 1 if you have the `chown' function. */
 #undef HAVE_CHOWN
 
@@ -284,6 +293,9 @@
 /* If you have HMAC_Update */
 #undef HAVE_HMAC_UPDATE
 
+/* If we have htobe64 */
+#undef HAVE_HTOBE64
+
 /* Define to 1 if you have the `inet_aton' function. */
 #undef HAVE_INET_ATON
 
@@ -311,6 +323,9 @@
 /* Define to 1 if you have the `kill' function. */
 #undef HAVE_KILL
 
+/* Use portable libbsd functions */
+#undef HAVE_LIBBSD
+
 /* Define to 1 if you have the <libkern/OSByteOrder.h> header file. */
 #undef HAVE_LIBKERN_OSBYTEORDER_H
 
@@ -1231,6 +1246,11 @@ char *strptime(const char *s, const char *format, struct tm *tm);
 void *reallocarray(void *ptr, size_t nmemb, size_t size);
 #endif
 
+#ifdef HAVE_LIBBSD
+#include <bsd/string.h>
+#include <bsd/stdlib.h>
+#endif
+
 #ifdef HAVE_LIBRESSL
 #  if !HAVE_DECL_STRLCPY
 size_t strlcpy(char *dst, const char *src, size_t siz);
diff --git a/config.sub b/config.sub
index 1d8e98bcee23..ba15a57a5cf3 100755
--- a/config.sub
+++ b/config.sub
@@ -1,8 +1,8 @@
-#! /bin/sh
+#!/usr/bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2018 Free Software Foundation, Inc.
+#   Copyright 1992-2016 Free Software Foundation, Inc.
 
-timestamp='2018-02-22'
+timestamp='2016-09-05'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@ timestamp='2018-02-22'
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <https://www.gnu.org/licenses/>.
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -33,7 +33,7 @@ timestamp='2018-02-22'
 # Otherwise, we print the canonical config type on stdout and succeed.
 
 # You can get the latest version of this script from:
-# https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
 
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
@@ -57,7 +57,7 @@ Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS
 
 Canonicalize a configuration name.
 
-Options:
+Operation modes:
   -h, --help         print this help, then exit
   -t, --time-stamp   print date of last modification, then exit
   -v, --version      print version number, then exit
@@ -67,7 +67,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright 1992-2018 Free Software Foundation, Inc.
+Copyright 1992-2016 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -94,7 +94,7 @@ while test $# -gt 0 ; do
 
     *local*)
        # First pass through any local machine types.
-       echo "$1"
+       echo $1
        exit ;;
 
     * )
@@ -112,7 +112,7 @@ esac
 
 # Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any).
 # Here we must recognize all the valid KERNEL-OS combinations.
-maybe_os=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
+maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
   nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
   linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
@@ -120,16 +120,16 @@ case $maybe_os in
   kopensolaris*-gnu* | cloudabi*-eabi* | \
   storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
-    basic_machine=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
+    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
     ;;
   android-linux)
     os=-linux-android
-    basic_machine=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
+    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
     ;;
   *)
-    basic_machine=`echo "$1" | sed 's/-[^-]*$//'`
-    if [ "$basic_machine" != "$1" ]
-    then os=`echo "$1" | sed 's/.*-/-/'`
+    basic_machine=`echo $1 | sed 's/-[^-]*$//'`
+    if [ $basic_machine != $1 ]
+    then os=`echo $1 | sed 's/.*-/-/'`
     else os=; fi
     ;;
 esac
@@ -178,44 +178,44 @@ case $os in
 		;;
 	-sco6)
 		os=-sco5v6
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco5)
 		os=-sco3.2v5
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco4)
 		os=-sco3.2v4
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco3.2.[4-9]*)
 		os=`echo $os | sed -e 's/sco3.2./sco3.2v/'`
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco3.2v[4-9]*)
 		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco5v6*)
 		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco*)
 		os=-sco3.2v2
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-udk*)
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-isc)
 		os=-isc2.2
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-clix*)
 		basic_machine=clipper-intergraph
 		;;
 	-isc*)
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-lynx*178)
 		os=-lynxos178
@@ -227,7 +227,10 @@ case $os in
 		os=-lynxos
 		;;
 	-ptx*)
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-sequent/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'`
+		;;
+	-windowsnt*)
+		os=`echo $os | sed -e 's/windowsnt/winnt/'`
 		;;
 	-psos*)
 		os=-psos
@@ -260,7 +263,7 @@ case $basic_machine in
 	| fido | fr30 | frv | ft32 \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| hexagon \
-	| i370 | i860 | i960 | ia16 | ia64 \
+	| i370 | i860 | i960 | ia64 \
 	| ip2k | iq2000 \
 	| k1om \
 	| le32 | le64 \
@@ -296,9 +299,8 @@ case $basic_machine in
 	| nios | nios2 | nios2eb | nios2el \
 	| ns16k | ns32k \
 	| open8 | or1k | or1knd | or32 \
-	| pdp10 | pj | pjl \
+	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle \
-	| pru \
 	| pyramid \
 	| riscv32 | riscv64 \
 	| rl78 | rx \
@@ -312,7 +314,7 @@ case $basic_machine in
 	| ubicom32 \
 	| v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \
 	| visium \
-	| wasm32 \
+	| we32k \
 	| x86 | xc16x | xstormy16 | xtensa \
 	| z8k | z80)
 		basic_machine=$basic_machine-unknown
@@ -333,7 +335,7 @@ case $basic_machine in
 		basic_machine=$basic_machine-unknown
 		os=-none
 		;;
-	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65)
+	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
 		;;
 	ms1)
 		basic_machine=mt-unknown
@@ -362,7 +364,7 @@ case $basic_machine in
 	  ;;
 	# Object if more than one company name word.
 	*-*-*)
-		echo Invalid configuration \`"$1"\': machine \`"$basic_machine"\' not recognized 1>&2
+		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
 		exit 1
 		;;
 	# Recognize the basic CPU types with company name.
@@ -385,7 +387,7 @@ case $basic_machine in
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
 	| hexagon-* \
-	| i*86-* | i860-* | i960-* | ia16-* | ia64-* \
+	| i*86-* | i860-* | i960-* | ia64-* \
 	| ip2k-* | iq2000-* \
 	| k1om-* \
 	| le32-* | le64-* \
@@ -426,7 +428,6 @@ case $basic_machine in
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
-	| pru-* \
 	| pyramid-* \
 	| riscv32-* | riscv64-* \
 	| rl78-* | romp-* | rs6000-* | rx-* \
@@ -443,7 +444,6 @@ case $basic_machine in
 	| v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \
 	| vax-* \
 	| visium-* \
-	| wasm32-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* \
 	| xstormy16-* | xtensa*-* \
@@ -457,7 +457,7 @@ case $basic_machine in
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
 	386bsd)
-		basic_machine=i386-pc
+		basic_machine=i386-unknown
 		os=-bsd
 		;;
 	3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc)
@@ -491,7 +491,7 @@ case $basic_machine in
 		basic_machine=x86_64-pc
 		;;
 	amd64-*)
-		basic_machine=x86_64-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	amdahl)
 		basic_machine=580-amdahl
@@ -536,7 +536,7 @@ case $basic_machine in
 		os=-linux
 		;;
 	blackfin-*)
-		basic_machine=bfin-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
 	bluegene*)
@@ -544,13 +544,13 @@ case $basic_machine in
 		os=-cnk
 		;;
 	c54x-*)
-		basic_machine=tic54x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	c55x-*)
-		basic_machine=tic55x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	c6x-*)
-		basic_machine=tic6x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	c90)
 		basic_machine=c90-cray
@@ -639,7 +639,7 @@ case $basic_machine in
 		basic_machine=rs6000-bull
 		os=-bosx
 		;;
-	dpx2*)
+	dpx2* | dpx2*-bull)
 		basic_machine=m68k-bull
 		os=-sysv3
 		;;
@@ -648,7 +648,7 @@ case $basic_machine in
 		os=$os"spe"
 		;;
 	e500v[12]-*)
-		basic_machine=powerpc-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=$os"spe"
 		;;
 	ebmon29k)
@@ -740,6 +740,9 @@ case $basic_machine in
 	hp9k8[0-9][0-9] | hp8[0-9][0-9])
 		basic_machine=hppa1.0-hp
 		;;
+	hppa-next)
+		os=-nextstep3
+		;;
 	hppaosf)
 		basic_machine=hppa1.1-hp
 		os=-osf
@@ -752,26 +755,26 @@ case $basic_machine in
 		basic_machine=i370-ibm
 		;;
 	i*86v32)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv32
 		;;
 	i*86v4*)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv4
 		;;
 	i*86v)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv
 		;;
 	i*86sol2)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-solaris2
 		;;
 	i386mach)
 		basic_machine=i386-mach
 		os=-mach
 		;;
-	vsta)
+	i386-vsta | vsta)
 		basic_machine=i386-unknown
 		os=-vsta
 		;;
@@ -790,16 +793,19 @@ case $basic_machine in
 		os=-sysv
 		;;
 	leon-*|leon[3-9]-*)
-		basic_machine=sparc-`echo "$basic_machine" | sed 's/-.*//'`
+		basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'`
 		;;
 	m68knommu)
 		basic_machine=m68k-unknown
 		os=-linux
 		;;
 	m68knommu-*)
-		basic_machine=m68k-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
+	m88k-omron*)
+		basic_machine=m88k-omron
+		;;
 	magnum | m3230)
 		basic_machine=mips-mips
 		os=-sysv
@@ -831,10 +837,10 @@ case $basic_machine in
 		os=-mint
 		;;
 	mips3*-*)
-		basic_machine=`echo "$basic_machine" | sed -e 's/mips3/mips64/'`
+		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
 		;;
 	mips3*)
-		basic_machine=`echo "$basic_machine" | sed -e 's/mips3/mips64/'`-unknown
+		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
 		;;
 	monitor)
 		basic_machine=m68k-rom68k
@@ -853,7 +859,7 @@ case $basic_machine in
 		os=-msdos
 		;;
 	ms1-*)
-		basic_machine=`echo "$basic_machine" | sed -e 's/ms1-/mt-/'`
+		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
 		;;
 	msys)
 		basic_machine=i686-pc
@@ -895,7 +901,7 @@ case $basic_machine in
 		basic_machine=v70-nec
 		os=-sysv
 		;;
-	next | m*-next)
+	next | m*-next )
 		basic_machine=m68k-next
 		case $os in
 		    -nextstep* )
@@ -940,12 +946,6 @@ case $basic_machine in
 	nsr-tandem)
 		basic_machine=nsr-tandem
 		;;
-	nsv-tandem)
-		basic_machine=nsv-tandem
-		;;
-	nsx-tandem)
-		basic_machine=nsx-tandem
-		;;
 	op50n-* | op60c-*)
 		basic_machine=hppa1.1-oki
 		os=-proelf
@@ -978,7 +978,7 @@ case $basic_machine in
 		os=-linux
 		;;
 	parisc-*)
-		basic_machine=hppa-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
 	pbd)
@@ -994,7 +994,7 @@ case $basic_machine in
 		basic_machine=i386-pc
 		;;
 	pc98-*)
-		basic_machine=i386-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentium | p5 | k5 | k6 | nexgen | viac3)
 		basic_machine=i586-pc
@@ -1009,16 +1009,16 @@ case $basic_machine in
 		basic_machine=i786-pc
 		;;
 	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
-		basic_machine=i586-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumpro-* | p6-* | 6x86-* | athlon-*)
-		basic_machine=i686-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
-		basic_machine=i686-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentium4-*)
-		basic_machine=i786-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pn)
 		basic_machine=pn-gould
@@ -1028,23 +1028,23 @@ case $basic_machine in
 	ppc | ppcbe)	basic_machine=powerpc-unknown
 		;;
 	ppc-* | ppcbe-*)
-		basic_machine=powerpc-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppcle | powerpclittle)
 		basic_machine=powerpcle-unknown
 		;;
 	ppcle-* | powerpclittle-*)
-		basic_machine=powerpcle-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64)	basic_machine=powerpc64-unknown
 		;;
-	ppc64-*) basic_machine=powerpc64-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64le | powerpc64little)
 		basic_machine=powerpc64le-unknown
 		;;
 	ppc64le-* | powerpc64little-*)
-		basic_machine=powerpc64le-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ps2)
 		basic_machine=i386-ibm
@@ -1098,10 +1098,17 @@ case $basic_machine in
 	sequent)
 		basic_machine=i386-sequent
 		;;
+	sh)
+		basic_machine=sh-hitachi
+		os=-hms
+		;;
 	sh5el)
 		basic_machine=sh5le-unknown
 		;;
-	simso-wrs)
+	sh64)
+		basic_machine=sh64-unknown
+		;;
+	sparclite-wrs | simso-wrs)
 		basic_machine=sparclite-wrs
 		os=-vxworks
 		;;
@@ -1120,7 +1127,7 @@ case $basic_machine in
 		os=-sysv4
 		;;
 	strongarm-* | thumb-*)
-		basic_machine=arm-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	sun2)
 		basic_machine=m68000-sun
@@ -1242,9 +1249,6 @@ case $basic_machine in
 		basic_machine=hppa1.1-winbond
 		os=-proelf
 		;;
-	x64)
-		basic_machine=x86_64-pc
-		;;
 	xbox)
 		basic_machine=i686-pc
 		os=-mingw32
@@ -1253,12 +1257,20 @@ case $basic_machine in
 		basic_machine=xps100-honeywell
 		;;
 	xscale-* | xscalee[bl]-*)
-		basic_machine=`echo "$basic_machine" | sed 's/^xscale/arm/'`
+		basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'`
 		;;
 	ymp)
 		basic_machine=ymp-cray
 		os=-unicos
 		;;
+	z8k-*-coff)
+		basic_machine=z8k-unknown
+		os=-sim
+		;;
+	z80-*-coff)
+		basic_machine=z80-unknown
+		os=-sim
+		;;
 	none)
 		basic_machine=none-none
 		os=-none
@@ -1287,6 +1299,10 @@ case $basic_machine in
 	vax)
 		basic_machine=vax-dec
 		;;
+	pdp10)
+		# there are many clones, so DEC is not a safe bet
+		basic_machine=pdp10-unknown
+		;;
 	pdp11)
 		basic_machine=pdp11-dec
 		;;
@@ -1296,6 +1312,9 @@ case $basic_machine in
 	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
+	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
+		basic_machine=sparc-sun
+		;;
 	cydra)
 		basic_machine=cydra-cydrome
 		;;
@@ -1315,7 +1334,7 @@ case $basic_machine in
 		# Make sure to match an already-canonicalized machine name.
 		;;
 	*)
-		echo Invalid configuration \`"$1"\': machine \`"$basic_machine"\' not recognized 1>&2
+		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
 		exit 1
 		;;
 esac
@@ -1323,10 +1342,10 @@ esac
 # Here we canonicalize certain aliases for manufacturers.
 case $basic_machine in
 	*-digital*)
-		basic_machine=`echo "$basic_machine" | sed 's/digital.*/dec/'`
+		basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'`
 		;;
 	*-commodore*)
-		basic_machine=`echo "$basic_machine" | sed 's/commodore.*/cbm/'`
+		basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'`
 		;;
 	*)
 		;;
@@ -1337,8 +1356,8 @@ esac
 if [ x"$os" != x"" ]
 then
 case $os in
-	# First match some system type aliases that might get confused
-	# with valid system types.
+	# First match some system type aliases
+	# that might get confused with valid system types.
 	# -solaris* is a basic system type, with this one exception.
 	-auroraux)
 		os=-auroraux
@@ -1349,19 +1368,18 @@ case $os in
 	-solaris)
 		os=-solaris2
 		;;
+	-svr4*)
+		os=-sysv4
+		;;
 	-unixware*)
 		os=-sysv4.2uw
 		;;
 	-gnu/linux*)
 		os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'`
 		;;
-	# es1800 is here to avoid being matched by es* (a different OS)
-	-es1800*)
-		os=-ose
-		;;
-	# Now accept the basic system types.
+	# First accept the basic system types.
 	# The portable systems comes first.
-	# Each alternative MUST end in a * to match a version number.
+	# Each alternative MUST END IN A *, to match a version number.
 	# -sysv* is not here because it comes later, after sysvr4.
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
 	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
@@ -1371,26 +1389,25 @@ case $os in
 	      | -aos* | -aros* | -cloudabi* | -sortix* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	      | -hiux* | -knetbsd* | -mirbsd* | -netbsd* \
+	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
 	      | -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
 	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* | -cegcc* | -glidix* \
+	      | -chorusos* | -chorusrdb* | -cegcc* \
 	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
 	      | -midipix* | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
 	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
-	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* \
+	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
 	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
-	      | -morphos* | -superux* | -rtmk* | -windiss* \
+	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
 	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
-	      | -onefs* | -tirtos* | -phoenix* | -fuchsia* | -redox* | -bme* \
-	      | -midnightbsd*)
+	      | -onefs* | -tirtos* | -phoenix*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1407,12 +1424,12 @@ case $os in
 	-nto*)
 		os=`echo $os | sed -e 's|nto|nto-qnx|'`
 		;;
-	-sim | -xray | -os68k* | -v88r* \
-	      | -windows* | -osx | -abug | -netware* | -os9* \
+	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
+	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
 	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
 		;;
 	-mac*)
-		os=`echo "$os" | sed -e 's|mac|macos|'`
+		os=`echo $os | sed -e 's|mac|macos|'`
 		;;
 	-linux-dietlibc)
 		os=-linux-dietlibc
@@ -1421,10 +1438,10 @@ case $os in
 		os=`echo $os | sed -e 's|linux|linux-gnu|'`
 		;;
 	-sunos5*)
-		os=`echo "$os" | sed -e 's|sunos5|solaris2|'`
+		os=`echo $os | sed -e 's|sunos5|solaris2|'`
 		;;
 	-sunos6*)
-		os=`echo "$os" | sed -e 's|sunos6|solaris3|'`
+		os=`echo $os | sed -e 's|sunos6|solaris3|'`
 		;;
 	-opened*)
 		os=-openedition
@@ -1435,6 +1452,12 @@ case $os in
 	-wince*)
 		os=-wince
 		;;
+	-osfrose*)
+		os=-osfrose
+		;;
+	-osf*)
+		os=-osf
+		;;
 	-utek*)
 		os=-bsd
 		;;
@@ -1459,7 +1482,7 @@ case $os in
 	-nova*)
 		os=-rtmk-nova
 		;;
-	-ns2)
+	-ns2 )
 		os=-nextstep2
 		;;
 	-nsk*)
@@ -1481,7 +1504,7 @@ case $os in
 	-oss*)
 		os=-sysv3
 		;;
-	-svr4*)
+	-svr4)
 		os=-sysv4
 		;;
 	-svr3)
@@ -1496,28 +1519,24 @@ case $os in
 	-ose*)
 		os=-ose
 		;;
+	-es1800*)
+		os=-ose
+		;;
+	-xenix)
+		os=-xenix
+		;;
 	-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
 		os=-mint
 		;;
+	-aros*)
+		os=-aros
+		;;
 	-zvmoe)
 		os=-zvmoe
 		;;
 	-dicos*)
 		os=-dicos
 		;;
-	-pikeos*)
-		# Until real need of OS specific support for
-		# particular features comes up, bare metal
-		# configurations are quite functional.
-		case $basic_machine in
-		    arm*)
-			os=-eabi
-			;;
-		    *)
-			os=-elf
-			;;
-		esac
-		;;
 	-nacl*)
 		;;
 	-ios)
@@ -1527,7 +1546,7 @@ case $os in
 	*)
 		# Get rid of the `-' at the beginning of $os.
 		os=`echo $os | sed 's/[^-]*-//'`
-		echo Invalid configuration \`"$1"\': system \`"$os"\' not recognized 1>&2
+		echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2
 		exit 1
 		;;
 esac
@@ -1617,12 +1636,12 @@ case $basic_machine in
 	sparc-* | *-sun)
 		os=-sunos4.1.1
 		;;
-	pru-*)
-		os=-elf
-		;;
 	*-be)
 		os=-beos
 		;;
+	*-haiku)
+		os=-haiku
+		;;
 	*-ibm)
 		os=-aix
 		;;
@@ -1662,7 +1681,7 @@ case $basic_machine in
 	m88k-omron*)
 		os=-luna
 		;;
-	*-next)
+	*-next )
 		os=-nextstep
 		;;
 	*-sequent)
@@ -1677,6 +1696,9 @@ case $basic_machine in
 	i370-*)
 		os=-mvs
 		;;
+	*-next)
+		os=-nextstep3
+		;;
 	*-gould)
 		os=-sysv
 		;;
@@ -1786,15 +1808,15 @@ case $basic_machine in
 				vendor=stratus
 				;;
 		esac
-		basic_machine=`echo "$basic_machine" | sed "s/unknown/$vendor/"`
+		basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"`
 		;;
 esac
 
-echo "$basic_machine$os"
+echo $basic_machine$os
 exit
 
 # Local variables:
-# eval: (add-hook 'write-file-functions 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
diff --git a/configure b/configure
index d140a1f538ee..bdec1f0024c7 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.9.6.
+# Generated by GNU Autoconf 2.69 for unbound 1.10.1.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -591,8 +591,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.9.6'
-PACKAGE_STRING='unbound 1.9.6'
+PACKAGE_VERSION='1.10.1'
+PACKAGE_STRING='unbound 1.10.1'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''
 
@@ -673,8 +673,10 @@ UNBOUND_EVENT_UNINSTALL
 UNBOUND_EVENT_INSTALL
 SUBNET_HEADER
 SUBNET_OBJ
+PC_LIBBSD_DEPENDENCY
 SSLLIB
 HAVE_SSL
+PC_CRYPTO_DEPENDENCY
 CONFIG_DATE
 NETBSD_LINTFLAGS
 PYUNBOUND_UNINSTALL
@@ -801,7 +803,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -860,6 +861,7 @@ enable_swig_version_check
 with_nss
 with_nettle
 with_ssl
+with_libbsd
 enable_sha1
 enable_sha2
 enable_subnet
@@ -948,7 +950,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1201,15 +1202,6 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1347,7 +1339,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1460,7 +1452,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.9.6 to adapt to many kinds of systems.
+\`configure' configures unbound 1.10.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1500,7 +1492,6 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -1526,7 +1517,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.9.6:";;
+     short | recursive ) echo "Configuration of unbound 1.10.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1632,6 +1623,7 @@ Optional Packages:
   --with-ssl=pathname     enable SSL (will check /usr/local/ssl /usr/lib/ssl
                           /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw
                           /usr)
+  --with-libbsd           Use portable libbsd functions
   --with-libevent=pathname
                           use libevent (will check /usr/local /opt/local
                           /usr/lib /usr/pkg /usr/sfw /usr or you can specify
@@ -1748,7 +1740,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.9.6
+unbound configure 1.10.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2457,7 +2449,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.9.6, which was
+It was created by unbound $as_me 1.10.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2807,13 +2799,13 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 UNBOUND_VERSION_MAJOR=1
 
-UNBOUND_VERSION_MINOR=9
+UNBOUND_VERSION_MINOR=10
 
-UNBOUND_VERSION_MICRO=6
+UNBOUND_VERSION_MICRO=1
 
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=6
+LIBUNBOUND_REVISION=8
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2887,6 +2879,8 @@ LIBUNBOUND_AGE=1
 # 1.9.4 had 9:4:1
 # 1.9.5 had 9:5:1
 # 1.9.6 had 9:6:1
+# 1.10.0 had 9:7:1
+# 1.10.1 had 9:8:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -8061,7 +8055,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-netbsd* | netbsdelf*-gnu)
+netbsd*)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|_pic\.a)$'
   else
@@ -11526,9 +11520,6 @@ $as_echo_n "checking whether the $compiler linker ($LD) supports shared librarie
   openbsd* | bitrig*)
     with_gnu_ld=no
     ;;
-  linux* | k*bsd*-gnu | gnu*)
-    link_all_deplibs=no
-    ;;
   esac
 
   ld_shlibs=yes
@@ -11783,7 +11774,7 @@ _LT_EOF
       fi
       ;;
 
-    netbsd* | netbsdelf*-gnu)
+    netbsd*)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	archive_cmds='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -12453,7 +12444,6 @@ $as_echo "$lt_cv_irix_exported_symbol" >&6; }
 	if test yes = "$lt_cv_irix_exported_symbol"; then
           archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
-	link_all_deplibs=no
       else
 	archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
 	archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
@@ -12475,7 +12465,7 @@ $as_echo "$lt_cv_irix_exported_symbol" >&6; }
       esac
       ;;
 
-    netbsd* | netbsdelf*-gnu)
+    netbsd*)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
       else
@@ -13570,6 +13560,9 @@ fi
   # before this can be enabled.
   hardcode_into_libs=yes
 
+  # Add ABI-specific directories to the system library path.
+  sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib"
+
   # Ideally, we could use ldconfig to report *all* directores which are
   # searched for libraries, however this is still not possible.  Aside from not
   # being certain /sbin/ldconfig is available, command
@@ -13578,7 +13571,7 @@ fi
   # appending ld.so.conf contents (and includes) to the search path.
   if test -f /etc/ld.so.conf; then
     lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \$2)); skip = 1; } { if (!skip) print \$0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[	 ]*hwcap[	 ]/d;s/[:,	]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '`
-    sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra"
+    sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra"
   fi
 
   # We used to test for /lib/ld.so.1 and disable shared libraries on
@@ -13590,18 +13583,6 @@ fi
   dynamic_linker='GNU/Linux ld.so'
   ;;
 
-netbsdelf*-gnu)
-  version_type=linux
-  need_lib_prefix=no
-  need_version=no
-  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
-  soname_spec='${libname}${release}${shared_ext}$major'
-  shlibpath_var=LD_LIBRARY_PATH
-  shlibpath_overrides_runpath=no
-  hardcode_into_libs=yes
-  dynamic_linker='NetBSD ld.elf_so'
-  ;;
-
 netbsd*)
   version_type=sunos
   need_lib_prefix=no
@@ -15668,7 +15649,7 @@ else
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -15714,7 +15695,7 @@ else
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -15738,7 +15719,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -15783,7 +15764,7 @@ else
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -15807,7 +15788,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -17783,6 +17764,8 @@ $as_echo "#define HAVE_NSS 1" >>confdefs.h
 	fi
         LIBS="$LIBS -lnss3 -lnspr4"
 	SSLLIB=""
+	PC_CRYPTO_DEPENDENCY="nss nspr"
+
 
 
 fi
@@ -17826,6 +17809,8 @@ done
 	fi
         LIBS="$LIBS -lhogweed -lnettle -lgmp"
 	SSLLIB=""
+	PC_CRYPTO_DEPENDENCY="hogweed nettle"
+
 
 
 fi
@@ -18176,6 +18161,9 @@ rm -f core conftest.err conftest.$ac_objext \
     conftest$ac_exeext conftest.$ac_ext
 SSLLIB="-lssl"
 
+PC_CRYPTO_DEPENDENCY="libcrypto libssl"
+
+
 # check if -lcrypt32 is needed because CAPIENG needs that. (on windows)
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
@@ -18466,6 +18454,96 @@ fi
 fi
 
 
+# libbsd
+
+# Check whether --with-libbsd was given.
+if test "${with_libbsd+set}" = set; then :
+  withval=$with_libbsd;
+	for ac_header in bsd/string.h bsd/stdlib.h
+do :
+  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
+"
+if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+
+done
+
+	if test "x$ac_cv_header_bsd_string_h" = xyes -a "x$ac_cv_header_bsd_stdlib_h" = xyes; then
+		for func in strlcpy strlcat arc4random arc4random_uniform reallocarray; do
+			as_ac_Search=`$as_echo "ac_cv_search_$func" | $as_tr_sh`
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing $func" >&5
+$as_echo_n "checking for library containing $func... " >&6; }
+if eval \${$as_ac_Search+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $func ();
+int
+main ()
+{
+return $func ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' bsd; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  eval "$as_ac_Search=\$ac_res"
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if eval \${$as_ac_Search+:} false; then :
+  break
+fi
+done
+if eval \${$as_ac_Search+:} false; then :
+
+else
+  eval "$as_ac_Search=no"
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+eval ac_res=\$$as_ac_Search
+	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+$as_echo "$ac_res" >&6; }
+eval ac_res=\$$as_ac_Search
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+
+$as_echo "#define HAVE_LIBBSD 1" >>confdefs.h
+
+				PC_LIBBSD_DEPENDENCY=libbsd
+
+
+fi
+
+		done
+	fi
+
+fi
+
 
 # Check whether --enable-sha1 was given.
 if test "${enable_sha1+set}" = set; then :
@@ -18769,9 +18847,7 @@ fi
 
 use_dsa="no"
 case "$enable_dsa" in
-    no)
-      ;;
-    *)
+    yes)
       # detect if DSA is supported, and turn it off if not.
       if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
       ac_fn_c_check_func "$LINENO" "DSA_SIG_new" "ac_cv_func_DSA_SIG_new"
@@ -18824,6 +18900,10 @@ _ACEOF
 
       fi
       ;;
+    *)
+      # disable dsa by default, RFC 8624 section 3.1, validators MUST NOT
+      # support DSA for DNSSEC Validation.
+      ;;
 esac
 
 # Check whether --enable-ed25519 was given.
@@ -19948,6 +20028,75 @@ _ACEOF
 
 fi
 
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for htobe64" >&5
+$as_echo_n "checking for htobe64... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <stdio.h>
+#ifdef HAVE_ENDIAN_H
+#  include <endian.h>
+#endif
+#ifdef HAVE_SYS_ENDIAN_H
+#  include <sys/endian.h>
+#endif
+
+int
+main ()
+{
+unsigned long long x = htobe64(0); printf("%u", (unsigned)x);
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define HAVE_HTOBE64 1" >>confdefs.h
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for be64toh" >&5
+$as_echo_n "checking for be64toh... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <stdio.h>
+#ifdef HAVE_ENDIAN_H
+#  include <endian.h>
+#endif
+#ifdef HAVE_SYS_ENDIAN_H
+#  include <sys/endian.h>
+#endif
+
+int
+main ()
+{
+unsigned long long x = be64toh(0); printf("%u", (unsigned)x);
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define HAVE_BE64TOH 1" >>confdefs.h
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing setusercontext" >&5
 $as_echo_n "checking for library containing setusercontext... " >&6; }
 if ${ac_cv_search_setusercontext+:} false; then :
@@ -21450,12 +21599,12 @@ _ACEOF
 
 
 
-version=1.9.6
+version=1.10.1
 
 date=`date +'%b %e, %Y'`
 
 
-ac_config_files="$ac_config_files Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service"
+ac_config_files="$ac_config_files Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service"
 
 ac_config_headers="$ac_config_headers config.h"
 
@@ -21969,7 +22118,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.9.6, which was
+This file was extended by unbound $as_me 1.10.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -22035,7 +22184,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.9.6
+unbound config.status 1.10.1
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -22461,6 +22610,7 @@ do
     "contrib/libunbound.pc") CONFIG_FILES="$CONFIG_FILES contrib/libunbound.pc" ;;
     "contrib/unbound.socket") CONFIG_FILES="$CONFIG_FILES contrib/unbound.socket" ;;
     "contrib/unbound.service") CONFIG_FILES="$CONFIG_FILES contrib/unbound.service" ;;
+    "contrib/unbound_portable.service") CONFIG_FILES="$CONFIG_FILES contrib/unbound_portable.service" ;;
     "config.h") CONFIG_HEADERS="$CONFIG_HEADERS config.h" ;;
 
   *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
@@ -23027,6 +23177,7 @@ $as_echo "$as_me: executing $ac_file commands" >&6;}
     cat <<_LT_EOF >> "$cfgfile"
 #! $SHELL
 # Generated automatically by $as_me ($PACKAGE) $VERSION
+# Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`:
 # NOTE: Changes made to this file will be lost: look at ltmain.sh.
 
 # Provide generalized library-building support services.
diff --git a/configure.ac b/configure.ac
index 5276d441620e..3e00c999c803 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10,15 +10,15 @@ sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[9])
-m4_define([VERSION_MICRO],[6])
+m4_define([VERSION_MINOR],[10])
+m4_define([VERSION_MICRO],[1])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=6
+LIBUNBOUND_REVISION=8
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -92,6 +92,8 @@ LIBUNBOUND_AGE=1
 # 1.9.4 had 9:4:1
 # 1.9.5 had 9:5:1
 # 1.9.6 had 9:6:1
+# 1.10.0 had 9:7:1
+# 1.10.1 had 9:8:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -760,6 +762,8 @@ AC_ARG_WITH([nss], AC_HELP_STRING([--with-nss=path],
 	fi
         LIBS="$LIBS -lnss3 -lnspr4"
 	SSLLIB=""
+	PC_CRYPTO_DEPENDENCY="nss nspr"
+	AC_SUBST(PC_CRYPTO_DEPENDENCY)
 	]
 )
 
@@ -780,6 +784,8 @@ AC_ARG_WITH([nettle], AC_HELP_STRING([--with-nettle=path],
 	fi
         LIBS="$LIBS -lhogweed -lnettle -lgmp"
 	SSLLIB=""
+	PC_CRYPTO_DEPENDENCY="hogweed nettle"
+	AC_SUBST(PC_CRYPTO_DEPENDENCY)
 	]
 )
 
@@ -789,6 +795,9 @@ ACX_WITH_SSL
 ACX_LIB_SSL
 SSLLIB="-lssl"
 
+PC_CRYPTO_DEPENDENCY="libcrypto libssl"
+AC_SUBST(PC_CRYPTO_DEPENDENCY)
+
 # check if -lcrypt32 is needed because CAPIENG needs that. (on windows)
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
@@ -880,6 +889,19 @@ fi
 fi
 AC_SUBST(SSLLIB)
 
+# libbsd
+AC_ARG_WITH([libbsd], AC_HELP_STRING([--with-libbsd], [Use portable libbsd functions]), [
+	AC_CHECK_HEADERS([bsd/string.h bsd/stdlib.h],,, [AC_INCLUDES_DEFAULT])
+	if test "x$ac_cv_header_bsd_string_h" = xyes -a "x$ac_cv_header_bsd_stdlib_h" = xyes; then
+		for func in strlcpy strlcat arc4random arc4random_uniform reallocarray; do
+			AC_SEARCH_LIBS([$func], [bsd], [
+				AC_DEFINE(HAVE_LIBBSD, 1, [Use portable libbsd functions])
+				PC_LIBBSD_DEPENDENCY=libbsd
+				AC_SUBST(PC_LIBBSD_DEPENDENCY)
+			])
+		done
+	fi
+])
 
 AC_ARG_ENABLE(sha1, AC_HELP_STRING([--disable-sha1], [Disable SHA1 RRSIG support, does not disable nsec3 support]))
 case "$enable_sha1" in
@@ -1064,9 +1086,7 @@ esac
 AC_ARG_ENABLE(dsa, AC_HELP_STRING([--disable-dsa], [Disable DSA support]))
 use_dsa="no"
 case "$enable_dsa" in
-    no)
-      ;;
-    *)
+    yes)
       # detect if DSA is supported, and turn it off if not.
       if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
       AC_CHECK_FUNC(DSA_SIG_new, [
@@ -1097,6 +1117,10 @@ AC_INCLUDES_DEFAULT
       AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
       fi
       ;;
+    *)
+      # disable dsa by default, RFC 8624 section 3.1, validators MUST NOT
+      # support DSA for DNSSEC Validation.
+      ;;
 esac
 
 AC_ARG_ENABLE(ed25519, AC_HELP_STRING([--disable-ed25519], [Disable ED25519 support]))
@@ -1467,6 +1491,35 @@ AC_INCLUDES_DEFAULT
 #include <ws2tcpip.h>
 #endif
 ])
+
+AC_MSG_CHECKING([for htobe64])
+AC_LINK_IFELSE([AC_LANG_PROGRAM([
+#include <stdio.h>
+#ifdef HAVE_ENDIAN_H
+#  include <endian.h>
+#endif
+#ifdef HAVE_SYS_ENDIAN_H
+#  include <sys/endian.h>
+#endif
+], [unsigned long long x = htobe64(0); printf("%u", (unsigned)x);])],
+  AC_MSG_RESULT(yes)
+  AC_DEFINE(HAVE_HTOBE64, 1, [If we have htobe64]),
+  AC_MSG_RESULT(no))
+
+AC_MSG_CHECKING([for be64toh])
+AC_LINK_IFELSE([AC_LANG_PROGRAM([
+#include <stdio.h>
+#ifdef HAVE_ENDIAN_H
+#  include <endian.h>
+#endif
+#ifdef HAVE_SYS_ENDIAN_H
+#  include <sys/endian.h>
+#endif
+], [unsigned long long x = be64toh(0); printf("%u", (unsigned)x);])],
+  AC_MSG_RESULT(yes)
+  AC_DEFINE(HAVE_BE64TOH, 1, [If we have be64toh]),
+  AC_MSG_RESULT(no))
+
 AC_SEARCH_LIBS([setusercontext], [util])
 AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget accept4])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
@@ -1945,6 +1998,11 @@ char *strptime(const char *s, const char *format, struct tm *tm);
 void *reallocarray(void *ptr, size_t nmemb, size_t size);
 #endif
 
+#ifdef HAVE_LIBBSD
+#include <bsd/string.h>
+#include <bsd/stdlib.h>
+#endif
+
 #ifdef HAVE_LIBRESSL
 #  if !HAVE_DECL_STRLCPY
 size_t strlcpy(char *dst, const char *src, size_t siz);
@@ -2046,6 +2104,6 @@ dnl if this is a distro tarball, that was already done by makedist.sh
 AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AC_SUBST(date, [`date +'%b %e, %Y'`])
 
-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
 AC_CONFIG_HEADER([config.h])
 AC_OUTPUT
diff --git a/contrib/README b/contrib/README
index f12e52f2554b..9db078e5617c 100644
--- a/contrib/README
+++ b/contrib/README
@@ -27,10 +27,12 @@ distribution but may be helpful.
   works like the BIND feature (removes AAAA records unless AAAA-only domain).
   Useful for certain 'broken IPv6 default route' scenarios.
   Patch from Stephane Lapie for ASAHI Net.
-* unbound_smf22.tar.gz: Solaris SMF installation/removal scripts.
+* unbound_smf23.tar.gz: Solaris SMF installation/removal scripts.
   Contributed by Yuri Voinov.
 * unbound.socket and unbound.service: systemd files for unbound, install them
   in /usr/lib/systemd/system.  Contributed by Sami Kerola and Pavel Odintsov.
+* unbound_portable.service.in: systemd file for use unbound as portable service,
+  see comments in the file. Contributed by Frzk.
 * redirect-bogus.patch: Return configured address for bogus A and AAAA answers,
   instead of SERVFAIL. Contributed by SIDN.
 * fastrpz.patch: fastrpz support from Farsight Security.
@@ -49,3 +51,5 @@ distribution but may be helpful.
   compile.  From Saksham Manchanda (Secure64).  Please note that we think
   this will drop DNSKEY and DS lookups for tlds and hence break DNSSEC
   lookups for downstream clients.
+* drop2rpz: perl script that converts the Spamhaus DROP-List in RPZ-Format,
+  contributed by Andreas Schulze.
diff --git a/contrib/drop2rpz b/contrib/drop2rpz
new file mode 100644
index 000000000000..01602f651166
--- /dev/null
+++ b/contrib/drop2rpz
@@ -0,0 +1,39 @@
+#!/usr/bin/perl
+
+# usage: curl --silent https://www.spamhaus.org/drop/drop.txt | $0 > /path/to/spamhaus-drop.rpz.local
+#
+# unbound.conf:
+#  rpz:
+#    name: "spamhaus-drop.rpz.local."
+#    zonefile: "/path/tp/spamhaus-drop.rpz.local"
+#    rpz-log: yes
+#    rpz-log-name: "spamhaus-drop"
+#
+
+use strict;
+use vars qw{$o1 $o2 $o3 $o4 $m};
+
+# trailing dots required
+my $origin = 'drop.spamhaus.org.rpz.local.';
+my $mname  = 'localhost.';
+my $rname  = 'root.localhost.';
+my $ns     = $mname;
+
+my  $rpz_action = '.';         # return NXDOMAIN
+#my $rpz_action = '*.';        # return NODATA
+#my $rpz_action = 'rpz-drop.'; # drop the query
+
+print "$origin SOA $mname $rname 1 43200 7200 2419200 3600\n";
+print "$origin NS  $ns\n";
+while(<>) {
+  if(($o1, $o2, $o3, $o4, $m) = m{(\d+)\.(\d+)\.(\d+)\.(\d+)/(\d+)}) {
+    print "$m.$o4.$o3.$o2.$o1.rpz-ip.$origin CNAME $rpz_action\n";
+  } else {
+    print "$_";
+  }
+}
+
+# add a testpoint: ask for "dns.google"
+# print "32.8.8.8.8.rpz-ip.$origin CNAME $rpz_action\n";
+
+exit;
diff --git a/contrib/fastrpz.patch b/contrib/fastrpz.patch
index c38ac22b984f..aacd5ab826b8 100644
--- a/contrib/fastrpz.patch
+++ b/contrib/fastrpz.patch
@@ -2,7 +2,7 @@ Description: based on the included patch contrib/fastrpz.patch
 Author: fastrpz@farsightsecurity.com
 ---
 diff --git a/Makefile.in b/Makefile.in
-index 721c01b6..56bfb560 100644
+index a20058cc..495779cc 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -23,6 +23,8 @@ CHECKLOCK_SRC=testcode/checklocks.c
@@ -14,7 +14,7 @@ index 721c01b6..56bfb560 100644
  DNSCRYPT_SRC=@DNSCRYPT_SRC@
  DNSCRYPT_OBJ=@DNSCRYPT_OBJ@
  WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
-@@ -126,7 +128,7 @@ validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c \
+@@ -127,7 +129,7 @@ validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c \
  edns-subnet/edns-subnet.c edns-subnet/subnetmod.c \
  edns-subnet/addrtree.c edns-subnet/subnet-whitelist.c \
  cachedb/cachedb.c cachedb/redis.c respip/respip.c $(CHECKLOCK_SRC) \
@@ -23,7 +23,7 @@ index 721c01b6..56bfb560 100644
  COMMON_OBJ_WITHOUT_NETCALL=dns.lo infra.lo rrset.lo dname.lo msgencode.lo \
  as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
  iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
-@@ -139,7 +141,7 @@ autotrust.lo val_anchor.lo \
+@@ -140,7 +142,7 @@ autotrust.lo val_anchor.lo rpz.lo \
  validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
  val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo redis.lo authzone.lo \
  $(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
@@ -32,7 +32,7 @@ index 721c01b6..56bfb560 100644
  COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
  outside_network.lo
  COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
-@@ -409,6 +411,11 @@ dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
+@@ -410,6 +412,11 @@ dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
  	$(srcdir)/util/config_file.h $(srcdir)/util/log.h \
  	$(srcdir)/util/netevent.h
  
@@ -45,10 +45,10 @@ index 721c01b6..56bfb560 100644
  pythonmod.lo pythonmod.o: $(srcdir)/pythonmod/pythonmod.c config.h \
  	pythonmod/interface.h \
 diff --git a/config.h.in b/config.h.in
-index 8c2aa3b9..efaf6450 100644
+index 78d47fed..e33073e4 100644
 --- a/config.h.in
 +++ b/config.h.in
-@@ -1325,4 +1325,11 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
+@@ -1345,4 +1345,11 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
  /** the version of unbound-control that this software implements */
  #define UNBOUND_CONTROL_VERSION 1
  
@@ -62,7 +62,7 @@ index 8c2aa3b9..efaf6450 100644
 +/** turn on fastrpz response policy zones */
 +#undef ENABLE_FASTRPZ
 diff --git a/configure.ac b/configure.ac
-index 5276d441..9d74592e 100644
+index 2b91dd3c..e6063d17 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -6,6 +6,7 @@ sinclude(ax_pthread.m4)
@@ -73,7 +73,7 @@ index 5276d441..9d74592e 100644
  sinclude(dnscrypt/dnscrypt.m4)
  
  # must be numbers. ac_defun because of later processing
-@@ -1726,6 +1727,9 @@ case "$enable_ipset" in
+@@ -1778,6 +1779,9 @@ case "$enable_ipset" in
  		;;
  esac
  
@@ -84,7 +84,7 @@ index 5276d441..9d74592e 100644
  # on openBSD, the implicit rule make $< work.
  # on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
 diff --git a/daemon/daemon.c b/daemon/daemon.c
-index 0b1200a2..5857c18b 100644
+index 8b0fc348..7ffb9221 100644
 --- a/daemon/daemon.c
 +++ b/daemon/daemon.c
 @@ -91,6 +91,9 @@
@@ -112,7 +112,7 @@ index 0b1200a2..5857c18b 100644
  #endif
  	}
  	for(i=0; i<daemon->num; i++) {
-@@ -724,6 +735,9 @@ daemon_cleanup(struct daemon* daemon)
+@@ -731,6 +742,9 @@ daemon_cleanup(struct daemon* daemon)
  #ifdef USE_DNSCRYPT
  	dnsc_delete(daemon->dnscenv);
  	daemon->dnscenv = NULL;
@@ -123,10 +123,10 @@ index 0b1200a2..5857c18b 100644
  	daemon->cfg = NULL;
  }
 diff --git a/daemon/daemon.h b/daemon/daemon.h
-index 5749dbef..64ce230f 100644
+index 3effbafb..4d4c34da 100644
 --- a/daemon/daemon.h
 +++ b/daemon/daemon.h
-@@ -136,6 +136,11 @@ struct daemon {
+@@ -138,6 +138,11 @@ struct daemon {
  	/** the dnscrypt environment */
  	struct dnsc_env* dnscenv;
  #endif
@@ -139,10 +139,10 @@ index 5749dbef..64ce230f 100644
  
  /**
 diff --git a/daemon/worker.c b/daemon/worker.c
-index e2ce0e87..f031c656 100644
+index eb7fdf2f..1982228d 100644
 --- a/daemon/worker.c
 +++ b/daemon/worker.c
-@@ -75,6 +75,9 @@
+@@ -76,6 +76,9 @@
  #include "libunbound/context.h"
  #include "libunbound/libworker.h"
  #include "sldns/sbuffer.h"
@@ -152,7 +152,7 @@ index e2ce0e87..f031c656 100644
  #include "sldns/wire2str.h"
  #include "util/shm_side/shm_main.h"
  #include "dnscrypt/dnscrypt.h"
-@@ -533,8 +536,27 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
+@@ -534,8 +537,27 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
  			/* not secure */
  			secure = 0;
  			break;
@@ -180,10 +180,10 @@ index e2ce0e87..f031c656 100644
  	/* return this delegation from the cache */
  	edns_bak = *edns;
  	edns->edns_version = EDNS_ADVERTISED_VERSION;
-@@ -699,6 +721,23 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
- 			secure = 0;
+@@ -710,6 +732,23 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
+ 			*is_secure_answer = 0;
  		}
- 	} else	secure = 0;
+ 	} else *is_secure_answer = 0;
 +#ifdef ENABLE_FASTRPZ
 +	if(repinfo->rpz) {
 +		/* Scan the cached answer for RPZ hits.
@@ -204,7 +204,7 @@ index e2ce0e87..f031c656 100644
  
  	edns_bak = *edns;
  	edns->edns_version = EDNS_ADVERTISED_VERSION;
-@@ -1410,6 +1449,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
+@@ -1435,6 +1474,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
  		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
  			&repinfo->addr, repinfo->addrlen);
  		goto send_reply;
@@ -220,14 +220,14 @@ index e2ce0e87..f031c656 100644
  	}
  
  	/* If we've found a local alias, replace the qname with the alias
-@@ -1458,12 +1506,21 @@ lookup_cache:
+@@ -1485,12 +1533,21 @@ lookup_cache:
  		h = query_info_hash(lookup_qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
  		if((e=slabhash_lookup(worker->env.msg_cache, h, lookup_qinfo, 0))) {
  			/* answer from cache - we have acquired a readlock on it */
 -			if(answer_from_cache(worker, &qinfo,
 +			ret = answer_from_cache(worker, &qinfo,
- 				cinfo, &need_drop, &alias_rrset, &partial_rep,
- 				(struct reply_info*)e->data,
+ 				cinfo, &need_drop, &is_expired_answer, &is_secure_answer,
+ 				&alias_rrset, &partial_rep, (struct reply_info*)e->data,
  				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
  				sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
 -				&edns)) {
@@ -244,7 +244,7 @@ index e2ce0e87..f031c656 100644
  				/* prefetch it if the prefetch TTL expired.
  				 * Note that if there is more than one pass
  				 * its qname must be that used for cache
-@@ -1518,11 +1575,19 @@ lookup_cache:
+@@ -1547,11 +1604,19 @@ lookup_cache:
  			lock_rw_unlock(&e->lock);
  		}
  		if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
@@ -267,10 +267,10 @@ index e2ce0e87..f031c656 100644
  			}
  			verbose(VERB_ALGO, "answer norec from cache -- "
 diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
-index 4bdfcd56..69e70627 100644
+index 38c2d298..3b07f392 100644
 --- a/doc/unbound.conf.5.in
 +++ b/doc/unbound.conf.5.in
-@@ -1801,6 +1801,81 @@ List domain for which the AAAA records are ignored and the A record is
+@@ -1828,6 +1828,81 @@ List domain for which the AAAA records are ignored and the A record is
  used by dns64 processing instead.  Can be entered multiple times, list a
  new domain for which it applies, one per line.  Applies also to names
  underneath the name given.
@@ -3106,10 +3106,10 @@ index a2f1b570..e1e4a738 100644
  	 * Count number of time-outs. Used to prevent resolving failures when
  	 * the QNAME minimisation QTYPE is blocked. */
 diff --git a/services/cache/dns.c b/services/cache/dns.c
-index aa4efec7..5dd3412e 100644
+index 2a5bca4a..6de8863a 100644
 --- a/services/cache/dns.c
 +++ b/services/cache/dns.c
-@@ -945,6 +945,14 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
+@@ -967,6 +967,14 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
  	struct regional* region, uint32_t flags)
  {
  	struct reply_info* rep = NULL;
@@ -3125,10 +3125,10 @@ index aa4efec7..5dd3412e 100644
  	rep = reply_info_copy(msgrep, env->alloc, NULL);
  	if(!rep)
 diff --git a/services/mesh.c b/services/mesh.c
-index d4f814d5..624a9d95 100644
+index 9114ef4c..3dc518e5 100644
 --- a/services/mesh.c
 +++ b/services/mesh.c
-@@ -60,6 +60,9 @@
+@@ -61,6 +61,9 @@
  #include "sldns/wire2str.h"
  #include "services/localzone.h"
  #include "util/data/dname.h"
@@ -3138,7 +3138,7 @@ index d4f814d5..624a9d95 100644
  #include "respip/respip.h"
  #include "services/listen_dnsport.h"
  
-@@ -1076,6 +1079,13 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
+@@ -1195,6 +1198,13 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
  	else	secure = 0;
  	if(!rep && rcode == LDNS_RCODE_NOERROR)
  		rcode = LDNS_RCODE_SERVFAIL;
@@ -3152,7 +3152,7 @@ index d4f814d5..624a9d95 100644
  	/* send the reply */
  	/* We don't reuse the encoded answer if either the previous or current
  	 * response has a local alias.  We could compare the alias records
-@@ -1255,6 +1265,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
+@@ -1415,6 +1425,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
  	key.s.is_valrec = valrec;
  	key.s.qinfo = *qinfo;
  	key.s.query_flags = qflags;
@@ -3160,7 +3160,7 @@ index d4f814d5..624a9d95 100644
  	/* We are searching for a similar mesh state when we DO want to
  	 * aggregate the state. Thus unique is set to NULL. (default when we
  	 * desire aggregation).*/
-@@ -1301,6 +1312,10 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
+@@ -1461,6 +1472,10 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
  	if(!r)
  		return 0;
  	r->query_reply = *rep;
@@ -3172,10 +3172,10 @@ index d4f814d5..624a9d95 100644
  	if(edns->opt_list) {
  		r->edns.opt_list = edns_opt_copy_region(edns->opt_list,
 diff --git a/util/config_file.c b/util/config_file.c
-index 119b2223..ce43a234 100644
+index 52ca5a18..0660248f 100644
 --- a/util/config_file.c
 +++ b/util/config_file.c
-@@ -1434,6 +1434,8 @@ config_delete(struct config_file* cfg)
+@@ -1460,6 +1460,8 @@ config_delete(struct config_file* cfg)
  	free(cfg->dnstap_socket_path);
  	free(cfg->dnstap_identity);
  	free(cfg->dnstap_version);
@@ -3185,10 +3185,10 @@ index 119b2223..ce43a234 100644
  	config_deldblstrlist(cfg->ratelimit_below_domain);
  	config_delstrlist(cfg->python_script);
 diff --git a/util/config_file.h b/util/config_file.h
-index b3ef930a..56173b80 100644
+index 8739ca2a..a2dcf215 100644
 --- a/util/config_file.h
 +++ b/util/config_file.h
-@@ -494,6 +494,11 @@ struct config_file {
+@@ -499,6 +499,11 @@ struct config_file {
  	/** true to disable DNSSEC lameness check in iterator */
  	int disable_dnssec_lame_check;
  
@@ -3201,10 +3201,10 @@ index b3ef930a..56173b80 100644
  	int ip_ratelimit;
  	/** number of slabs for ip_ratelimit cache */
 diff --git a/util/configlexer.lex b/util/configlexer.lex
-index a86ddf55..b56bcfb4 100644
+index deedffa5..301458a3 100644
 --- a/util/configlexer.lex
 +++ b/util/configlexer.lex
-@@ -438,6 +438,10 @@ dnstap-log-forwarder-query-messages{COLON}	{
+@@ -446,6 +446,10 @@ dnstap-log-forwarder-query-messages{COLON}	{
  		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
  dnstap-log-forwarder-response-messages{COLON}	{
  		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
@@ -3216,7 +3216,7 @@ index a86ddf55..b56bcfb4 100644
  ip-ratelimit{COLON}		{ YDVAR(1, VAR_IP_RATELIMIT) }
  ratelimit{COLON}		{ YDVAR(1, VAR_RATELIMIT) }
 diff --git a/util/configparser.y b/util/configparser.y
-index 10227a2f..cdbcf7cd 100644
+index d471babe..cb6b1d63 100644
 --- a/util/configparser.y
 +++ b/util/configparser.y
 @@ -125,6 +125,7 @@ extern struct config_parser_state* cfg_parser;
@@ -3227,7 +3227,7 @@ index 10227a2f..cdbcf7cd 100644
  %token VAR_RESPONSE_IP_TAG VAR_RESPONSE_IP VAR_RESPONSE_IP_DATA
  %token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
  %token VAR_DISABLE_DNSSEC_LAME_CHECK
-@@ -171,7 +172,7 @@ extern struct config_parser_state* cfg_parser;
+@@ -173,7 +174,7 @@ extern struct config_parser_state* cfg_parser;
  
  %%
  toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -3236,7 +3236,7 @@ index 10227a2f..cdbcf7cd 100644
  	forwardstart contents_forward | pythonstart contents_py | 
  	rcstart contents_rc | dtstart contents_dt | viewstart contents_view |
  	dnscstart contents_dnsc | cachedbstart contents_cachedb |
-@@ -2726,6 +2727,50 @@ dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MES
+@@ -2837,6 +2838,50 @@ dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MES
  		free($2);
  	}
  	;
@@ -3288,10 +3288,10 @@ index 10227a2f..cdbcf7cd 100644
  	{ 
  		OUTYY(("\nP(python:)\n")); 
 diff --git a/util/data/msgencode.c b/util/data/msgencode.c
-index a51a4b9b..475dfce9 100644
+index be69f628..f10773aa 100644
 --- a/util/data/msgencode.c
 +++ b/util/data/msgencode.c
-@@ -590,6 +590,35 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
+@@ -592,6 +592,35 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
  	return RETVAL_OK;
  }
  
@@ -3327,7 +3327,7 @@ index a51a4b9b..475dfce9 100644
  /** store query section in wireformat buffer, return RETVAL */
  static int
  insert_query(struct query_info* qinfo, struct compress_tree_node** tree, 
-@@ -777,6 +806,19 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep,
+@@ -779,6 +808,19 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep,
  			}
  			sldns_buffer_write_u16_at(buffer, 10, arcount);
  		}
@@ -3348,10 +3348,10 @@ index a51a4b9b..475dfce9 100644
  	sldns_buffer_flip(buffer);
  	return 1;
 diff --git a/util/data/packed_rrset.c b/util/data/packed_rrset.c
-index 7b9d5494..e44b2ce5 100644
+index 4b0294f9..3b3838f6 100644
 --- a/util/data/packed_rrset.c
 +++ b/util/data/packed_rrset.c
-@@ -255,6 +255,10 @@ sec_status_to_string(enum sec_status s)
+@@ -256,6 +256,10 @@ sec_status_to_string(enum sec_status s)
  	case sec_status_insecure: 	return "sec_status_insecure";
  	case sec_status_secure_sentinel_fail: 	return "sec_status_secure_sentinel_fail";
  	case sec_status_secure: 	return "sec_status_secure";
@@ -3363,7 +3363,7 @@ index 7b9d5494..e44b2ce5 100644
  	return "unknown_sec_status_value";
  }
 diff --git a/util/data/packed_rrset.h b/util/data/packed_rrset.h
-index 3a5335dd..20113217 100644
+index 729877ba..ccd1a0c2 100644
 --- a/util/data/packed_rrset.h
 +++ b/util/data/packed_rrset.h
 @@ -193,7 +193,15 @@ enum sec_status {
@@ -3384,7 +3384,7 @@ index 3a5335dd..20113217 100644
  
  /**
 diff --git a/util/netevent.c b/util/netevent.c
-index 980bb8be..d537d288 100644
+index 9fe5da2d..037e70d1 100644
 --- a/util/netevent.c
 +++ b/util/netevent.c
 @@ -57,6 +57,9 @@
@@ -3427,7 +3427,7 @@ index 980bb8be..d537d288 100644
  		if(!rep.c || rep.c->fd != fd) /* commpoint closed to -1 or reused for
  		another UDP port. Note rep.c cannot be reused with TCP fd. */
  			break;
-@@ -3184,6 +3196,9 @@ comm_point_send_reply(struct comm_reply *repinfo)
+@@ -3192,6 +3204,9 @@ comm_point_send_reply(struct comm_reply *repinfo)
  				repinfo->c->tcp_timeout_msec);
  		}
  	}
@@ -3437,7 +3437,7 @@ index 980bb8be..d537d288 100644
  }
  
  void 
-@@ -3193,6 +3208,9 @@ comm_point_drop_reply(struct comm_reply* repinfo)
+@@ -3201,6 +3216,9 @@ comm_point_drop_reply(struct comm_reply* repinfo)
  		return;
  	log_assert(repinfo->c);
  	log_assert(repinfo->c->type != comm_tcp_accept);
@@ -3447,7 +3447,7 @@ index 980bb8be..d537d288 100644
  	if(repinfo->c->type == comm_udp)
  		return;
  	if(repinfo->c->tcp_req_info)
-@@ -3214,6 +3232,9 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
+@@ -3222,6 +3240,9 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
  {
  	verbose(VERB_ALGO, "comm point start listening %d (%d msec)", 
  		c->fd==-1?newfd:c->fd, msec);
@@ -3473,10 +3473,10 @@ index d80c72b3..0233292f 100644
  	uint8_t client_nonce[crypto_box_HALF_NONCEBYTES];
  	uint8_t nmkey[crypto_box_BEFORENMBYTES];
 diff --git a/validator/validator.c b/validator/validator.c
-index 4c560a8e..71de3760 100644
+index c3ca0a27..15251988 100644
 --- a/validator/validator.c
 +++ b/validator/validator.c
-@@ -2755,6 +2755,12 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
+@@ -2761,6 +2761,12 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
  			default:
  				/* NSEC proof did not work, try next */
  				break;
@@ -3489,7 +3489,7 @@ index 4c560a8e..71de3760 100644
  		}
  
  		sec = nsec3_prove_nods(qstate->env, ve, 
-@@ -2788,6 +2794,12 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
+@@ -2794,6 +2800,12 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
  			default:
  				/* NSEC3 proof did not work */
  				break;
diff --git a/contrib/libunbound.pc.in b/contrib/libunbound.pc.in
index 810c571343a4..1442ed523adc 100644
--- a/contrib/libunbound.pc.in
+++ b/contrib/libunbound.pc.in
@@ -7,8 +7,8 @@ Name: unbound
 Description: Library with validating, recursive, and caching DNS resolver
 URL: http://www.unbound.net
 Version: @PACKAGE_VERSION@
-Requires: libcrypto libssl @PC_LIBEVENT_DEPENDENCY@
-Requires.private: @PC_PY_DEPENDENCY@
-Libs: -L${libdir} -lunbound -lssl -lcrypto
+Requires: @PC_CRYPTO_DEPENDENCY@ @PC_LIBEVENT_DEPENDENCY@
+Requires.private: @PC_PY_DEPENDENCY@ @PC_LIBBSD_DEPENDENCY@
+Libs: -L${libdir} -lunbound
 Libs.private: @SSLLIB@ @LIBS@
-Cflags: -I${includedir} 
+Cflags: -I${includedir}
diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
index 6eb2d0c3fe40..8c51bcbbef78 100644
--- a/contrib/unbound.service.in
+++ b/contrib/unbound.service.in
@@ -1,3 +1,44 @@
+; For further details about the directives used in this unit file, including
+; the below, please refer to systemd's official documentation, available at
+; https://www.freedesktop.org/software/systemd/man/systemd.exec.html.
+;
+;
+;   - `ProtectSystem=strict` implies we mount the entire file system hierarchy
+;     read-only for the processes invoked by the unit except for the API file
+;     system subtrees /dev, /proc and /sys (which are protected by
+;     PrivateDevices=, ProtectKernelTunables=, ProtectControlGroups=).
+;
+;   - `PrivateTmp=yes` secures access to temporary files of the process, and
+;     makes sharing between processes via /tmp or /var/tmp impossible.
+;
+;   - `ProtectHome=yes` makes the directories /home, /root, and /run/user
+;     inaccessible and empty for processes invoked by the unit.
+;
+;   - `ProtectControlGroups=yes` makes the Linux Control Groups hierarchies
+;     (accessible through /sys/fs/cgroup) read-only to all processes invoked by
+;     the unit. It also implies `MountAPIVFS=yes`.
+;
+;   - `RuntimeDirectory=unbound` creates a /run/unbound directory, owned by the
+;     unit User and Group with read-write permissions (0755) as soon as the
+;     unit starts. This allows unbound to store its pidfile. The directory and
+;     its content are automatically removed by systemd when the unit stops.
+;
+;   - `NoNewPrivileges=yes` ensures that the service process and all its
+;     children can never gain new privileges through execve().
+;
+;   - `RestrictSUIDSGID=yes` ensures that any attempts to set the set-user-ID
+;     (SUID) or set-group-ID (SGID) bits on files or directories will be denied.
+;
+;   - `RestrictRealTime=yes` ensures that any attempts to enable realtime
+;     scheduling in a process invoked by the unit will be denied.
+;
+;   - `RestrictNamespaces=yes` ensures that access to any kind of namespacing
+;     is prohibited.
+;
+;   - `LockPersonality=yes` locks down the personality system call so that the
+;     kernel execution domain may not be changed from the default.
+;
+;
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
@@ -10,10 +51,10 @@ WantedBy=multi-user.target
 
 [Service]
 ExecReload=+/bin/kill -HUP $MAINPID
-ExecStart=@UNBOUND_SBIN_DIR@/unbound -d
+ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -22,13 +63,9 @@ ProtectHome=true
 ProtectControlGroups=true
 ProtectKernelModules=true
 ProtectSystem=strict
-ReadWritePaths=/run @UNBOUND_RUN_DIR@ @UNBOUND_CHROOT_DIR@
-TemporaryFileSystem=@UNBOUND_CHROOT_DIR@/dev:ro
-TemporaryFileSystem=@UNBOUND_CHROOT_DIR@/run:ro
-BindReadOnlyPaths=-/run/systemd/notify:@UNBOUND_CHROOT_DIR@/run/systemd/notify
-BindPaths=-@UNBOUND_PIDFILE@:@UNBOUND_CHROOT_DIR@@UNBOUND_PIDFILE@
-BindReadOnlyPaths=-/dev/urandom:@UNBOUND_CHROOT_DIR@/dev/urandom
-BindPaths=-/dev/log:@UNBOUND_CHROOT_DIR@/dev/log
+RuntimeDirectory=unbound
+ConfigurationDirectory=unbound
+StateDirectory=unbound
 RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
 RestrictRealtime=true
 SystemCallArchitectures=native
@@ -36,3 +73,12 @@ SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete
 RestrictNamespaces=yes
 LockPersonality=yes
 RestrictSUIDSGID=yes
+ReadWritePaths=@UNBOUND_RUN_DIR@ @UNBOUND_CHROOT_DIR@
+
+# Below rules are needed when chroot is enabled (usually it's enabled by default).
+# If chroot is disabled like chrooot: "" then they may be safely removed.
+TemporaryFileSystem=@UNBOUND_CHROOT_DIR@/dev:ro
+TemporaryFileSystem=@UNBOUND_CHROOT_DIR@/run:ro
+BindReadOnlyPaths=-/run/systemd/notify:@UNBOUND_CHROOT_DIR@/run/systemd/notify
+BindReadOnlyPaths=-/dev/urandom:@UNBOUND_CHROOT_DIR@/dev/urandom
+BindPaths=-/dev/log:@UNBOUND_CHROOT_DIR@/dev/log
diff --git a/contrib/unbound_munin_ b/contrib/unbound_munin_
index 5d3dff8e813e..2839cd8b5365 100755
--- a/contrib/unbound_munin_
+++ b/contrib/unbound_munin_
@@ -242,6 +242,8 @@ if test "$1" = "config" ; then
 		p_config "total.num.prefetch" "cache prefetch" "ABSOLUTE"
 		p_config "num.query.tcp" "TCP queries" "ABSOLUTE"
 		p_config "num.query.tcpout" "TCP out queries" "ABSOLUTE"
+		p_config "num.query.tls" "TLS queries" "ABSOLUTE"
+		p_config "num.query.tls.resume" "TLS resumes" "ABSOLUTE"
 		p_config "num.query.ipv6" "IPv6 queries" "ABSOLUTE"
 		p_config "unwanted.queries" "queries that failed acl" "ABSOLUTE"
 		p_config "unwanted.replies" "unwanted or unsolicited replies" "ABSOLUTE"
@@ -443,7 +445,8 @@ hits)
 	for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
 		sed -e 's/=.*//'` total.num.queries \
 		total.num.cachehits total.num.prefetch num.query.tcp \
-		num.query.tcpout num.query.ipv6 unwanted.queries \
+		num.query.tcpout num.query.tls num.query.tls.resume \
+		num.query.ipv6 unwanted.queries \
 		unwanted.replies; do
 		if grep "^"$x"=" $state >/dev/null 2>&1; then
 			print_value $x
diff --git a/contrib/unbound_portable.service.in b/contrib/unbound_portable.service.in
new file mode 100644
index 000000000000..998b66dec999
--- /dev/null
+++ b/contrib/unbound_portable.service.in
@@ -0,0 +1,49 @@
+; This unit file is provided to run unbound as portable service.
+; https://systemd.io/PORTABLE_SERVICES/
+;
+; To use this unit file, please make sure you either compile unbound with the
+; following options:
+;
+;  - --with-chroot-dir=""
+;
+; Or put the following options in your unbound configuration file:
+;
+;  - chroot: ""
+;
+;
+[Unit]
+Description=Validating, recursive, and caching DNS resolver
+Documentation=man:unbound(8)
+After=network.target
+Before=network-online.target nss-lookup.target
+Wants=nss-lookup.target
+
+[Install]
+WantedBy=multi-user.target
+
+[Service]
+ExecReload=+/bin/kill -HUP $MAINPID
+ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
+NotifyAccess=main
+Type=notify
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectHome=true
+ProtectControlGroups=true
+ProtectKernelModules=true
+ProtectSystem=strict
+RuntimeDirectory=unbound
+ConfigurationDirectory=unbound
+StateDirectory=unbound
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictRealtime=true
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
+RestrictNamespaces=yes
+LockPersonality=yes
+RestrictSUIDSGID=yes
+BindPaths=/run/systemd/notify
+BindReadOnlyPaths=/dev/log /run/systemd/journal/socket /run/systemd/journal/stdout
diff --git a/contrib/unbound_smf22.tar.gz b/contrib/unbound_smf22.tar.gz
deleted file mode 100644
index e4c51c3dc6c1..000000000000
--- a/contrib/unbound_smf22.tar.gz
+++ /dev/null
diff --git a/contrib/unbound_smf23.tar.gz b/contrib/unbound_smf23.tar.gz
new file mode 100644
index 000000000000..96a671920ef3
--- /dev/null
+++ b/contrib/unbound_smf23.tar.gz
diff --git a/daemon/daemon.c b/daemon/daemon.c
index 0b1200a2e00a..8b0fc3483ab7 100644
--- a/daemon/daemon.c
+++ b/daemon/daemon.c
@@ -617,7 +617,8 @@ daemon_fork(struct daemon* daemon)
 		have_view_respip_cfg;
 	
 	/* read auth zonefiles */
-	if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1))
+	if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1,
+		&daemon->use_rpz))
 		fatal_exit("auth_zones could not be setup");
 
 	/* setup modules */
@@ -629,6 +630,12 @@ daemon_fork(struct daemon* daemon)
 	if(daemon->use_response_ip &&
 		modstack_find(&daemon->mods, "respip") < 0)
 		fatal_exit("response-ip options require respip module");
+	/* RPZ response ip triggers don't work as expected without the respip
+	 * module.  To avoid run-time operational surprise we reject such
+	 * configuration. */
+	if(daemon->use_rpz &&
+		modstack_find(&daemon->mods, "respip") < 0)
+		fatal_exit("RPZ requires the respip module");
 
 	/* first create all the worker structures, so we can pass
 	 * them to the newly created threads. 
diff --git a/daemon/daemon.h b/daemon/daemon.h
index 5749dbef8fbf..3effbafb7918 100644
--- a/daemon/daemon.h
+++ b/daemon/daemon.h
@@ -132,6 +132,8 @@ struct daemon {
 	struct respip_set* respip_set;
 	/** some response-ip tags or actions are configured if true */
 	int use_response_ip;
+	/** some RPZ policies are configured */
+	int use_rpz;
 #ifdef USE_DNSCRYPT
 	/** the dnscrypt environment */
 	struct dnsc_env* dnscenv;
diff --git a/daemon/remote.c b/daemon/remote.c
index 25547f5705d9..1782a39cad7c 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -69,6 +69,7 @@
 #include "services/mesh.h"
 #include "services/localzone.h"
 #include "services/authzone.h"
+#include "services/rpz.h"
 #include "util/storage/slabhash.h"
 #include "util/fptr_wlist.h"
 #include "util/data/dname.h"
@@ -719,8 +720,8 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
 		(unsigned long)s->svr.num_queries_missed_cache)) return 0;
 	if(!ssl_printf(ssl, "%s.num.prefetch"SQ"%lu\n", nm, 
 		(unsigned long)s->svr.num_queries_prefetch)) return 0;
-	if(!ssl_printf(ssl, "%s.num.zero_ttl"SQ"%lu\n", nm,
-		(unsigned long)s->svr.zero_ttl_responses)) return 0;
+	if(!ssl_printf(ssl, "%s.num.expired"SQ"%lu\n", nm,
+		(unsigned long)s->svr.ans_expired)) return 0;
 	if(!ssl_printf(ssl, "%s.num.recursivereplies"SQ"%lu\n", nm, 
 		(unsigned long)s->mesh_replies_sent)) return 0;
 #ifdef USE_DNSCRYPT
@@ -1045,6 +1046,16 @@ print_ext(RES* ssl, struct ub_stats_info* s)
 		(unsigned)s->svr.infra_cache_count)) return 0;
 	if(!ssl_printf(ssl, "key.cache.count"SQ"%u\n",
 		(unsigned)s->svr.key_cache_count)) return 0;
+	/* applied RPZ actions */
+	for(i=0; i<UB_STATS_RPZ_ACTION_NUM; i++) {
+		if(i == RPZ_NO_OVERRIDE_ACTION)
+			continue;
+		if(inhibit_zero && s->svr.rpz_action[i] == 0)
+			continue;
+		if(!ssl_printf(ssl, "num.rpz.action.%s"SQ"%lu\n",
+			rpz_action_to_string(i),
+			(unsigned long)s->svr.rpz_action[i])) return 0;
+	}
 #ifdef USE_DNSCRYPT
 	if(!ssl_printf(ssl, "dnscrypt_shared_secret.cache.count"SQ"%u\n",
 		(unsigned)s->svr.shared_secret_cache_count)) return 0;
@@ -1479,6 +1490,27 @@ do_view_data_remove(RES* ssl, struct worker* worker, char* arg)
 	lock_rw_unlock(&v->lock);
 }
 
+/** Remove RR data from stdin from view */
+static void
+do_view_datas_remove(RES* ssl, struct worker* worker, char* arg)
+{
+	struct view* v;
+	v = views_find_view(worker->daemon->views,
+		arg, 1 /* get write lock*/);
+	if(!v) {
+		ssl_printf(ssl,"no view with name: %s\n", arg);
+		return;
+	}
+	if(!v->local_zones){
+		lock_rw_unlock(&v->lock);
+		ssl_printf(ssl, "removed 0 datas\n");
+		return;
+	}
+
+	do_datas_remove(ssl, v->local_zones);
+	lock_rw_unlock(&v->lock);
+}
+
 /** cache lookup of nameservers */
 static void
 do_lookup(RES* ssl, struct worker* worker, char* arg)
@@ -2506,8 +2538,10 @@ do_auth_zone_transfer(RES* ssl, struct worker* worker, char* arg)
 	if(!az || !auth_zones_startprobesequence(az, &worker->env, nm, nmlen,
 		LDNS_RR_CLASS_IN)) {
 		(void)ssl_printf(ssl, "error zone xfr task not found %s\n", arg);
+		free(nm);
 		return;
 	}
+	free(nm);
 	send_ok(ssl);
 }
 	
@@ -2989,6 +3023,8 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 		do_view_zone_add(ssl, worker, skipwhite(p+15));
 	} else if(cmdcmp(p, "view_local_data_remove", 22)) {
 		do_view_data_remove(ssl, worker, skipwhite(p+22));
+	} else if(cmdcmp(p, "view_local_datas_remove", 23)){
+		do_view_datas_remove(ssl, worker, skipwhite(p+23));
 	} else if(cmdcmp(p, "view_local_data", 15)) {
 		do_view_data_add(ssl, worker, skipwhite(p+15));
 	} else if(cmdcmp(p, "view_local_datas", 16)) {
diff --git a/daemon/stats.c b/daemon/stats.c
index a01fb6d342ca..a568ba070a57 100644
--- a/daemon/stats.c
+++ b/daemon/stats.c
@@ -271,8 +271,10 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr.ans_secure += (long long)worker->env.mesh->ans_secure;
 	s->svr.ans_bogus += (long long)worker->env.mesh->ans_bogus;
 	s->svr.ans_rcode_nodata += (long long)worker->env.mesh->ans_nodata;
-	for(i=0; i<16; i++)
+	for(i=0; i<UB_STATS_RCODE_NUM; i++)
 		s->svr.ans_rcode[i] += (long long)worker->env.mesh->ans_rcode[i];
+	for(i=0; i<UB_STATS_RPZ_ACTION_NUM; i++)
+		s->svr.rpz_action[i] += (long long)worker->env.mesh->rpz_action[i];
 	timehist_export(worker->env.mesh->histogram, s->svr.hist, 
 		NUM_BUCKETS_HIST);
 	/* values from outside network */
@@ -398,6 +400,7 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
 	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
 	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
+	total->svr.ans_expired += a->svr.ans_expired;
 #ifdef USE_DNSCRYPT
 	total->svr.num_query_dnscrypt_crypted += a->svr.num_query_dnscrypt_crypted;
 	total->svr.num_query_dnscrypt_cert += a->svr.num_query_dnscrypt_cert;
@@ -430,7 +433,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.qEDNS += a->svr.qEDNS;
 		total->svr.qEDNS_DO += a->svr.qEDNS_DO;
 		total->svr.ans_rcode_nodata += a->svr.ans_rcode_nodata;
-		total->svr.zero_ttl_responses += a->svr.zero_ttl_responses;
 		total->svr.ans_secure += a->svr.ans_secure;
 		total->svr.ans_bogus += a->svr.ans_bogus;
 		total->svr.unwanted_replies += a->svr.unwanted_replies;
@@ -446,6 +448,8 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 			total->svr.ans_rcode[i] += a->svr.ans_rcode[i];
 		for(i=0; i<NUM_BUCKETS_HIST; i++)
 			total->svr.hist[i] += a->svr.hist[i];
+		for(i=0; i<UB_STATS_RPZ_ACTION_NUM; i++)
+			total->svr.rpz_action[i] += a->svr.rpz_action[i];
 	}
 
 	total->mesh_num_states += a->mesh_num_states;
diff --git a/daemon/unbound.c b/daemon/unbound.c
index beffb57005fa..af76fc84fe51 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -259,21 +259,10 @@ checkrlimits(struct config_file* cfg)
 #endif /* S_SPLINT_S */
 }
 
-/** set default logfile identity based on value from argv[0] at startup **/
-static void
-log_ident_set_fromdefault(struct config_file* cfg,
-	const char *log_default_identity)
-{
-	if(cfg->log_identity == NULL || cfg->log_identity[0] == 0)
-		log_ident_set(log_default_identity);
-	else
-		log_ident_set(cfg->log_identity);
-}
-
 /** set verbosity, check rlimits, cache settings */
 static void
-apply_settings(struct daemon* daemon, struct config_file* cfg, 
-	int cmdline_verbose, int debug_mode, const char* log_default_identity)
+apply_settings(struct daemon* daemon, struct config_file* cfg,
+	int cmdline_verbose, int debug_mode)
 {
 	/* apply if they have changed */
 	verbosity = cmdline_verbose + cfg->verbosity;
@@ -289,7 +278,7 @@ apply_settings(struct daemon* daemon, struct config_file* cfg,
 		log_warn("use-systemd and do-daemonize should not be enabled at the same time");
 	}
 
-	log_ident_set_fromdefault(cfg, log_default_identity);
+	log_ident_set_or_default(cfg->log_identity);
 }
 
 #ifdef HAVE_KILL
@@ -639,11 +628,10 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
  * @param cmdline_verbose: verbosity resulting from commandline -v.
  *    These increase verbosity as specified in the config file.
  * @param debug_mode: if set, do not daemonize.
- * @param log_default_identity: Default identity to report in logs
  * @param need_pidfile: if false, no pidfile is checked or created.
  */
 static void 
-run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char* log_default_identity, int need_pidfile)
+run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, int need_pidfile)
 {
 	struct config_file* cfg = NULL;
 	struct daemon* daemon = NULL;
@@ -667,7 +655,7 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char*
 					"or unbound-checkconf", cfgfile);
 			log_warn("Continuing with default config settings");
 		}
-		apply_settings(daemon, cfg, cmdline_verbose, debug_mode, log_default_identity);
+		apply_settings(daemon, cfg, cmdline_verbose, debug_mode);
 		if(!done_setup)
 			config_lookup_uid(cfg);
 	
@@ -733,6 +721,7 @@ main(int argc, char* argv[])
 
 	log_init(NULL, 0, NULL);
 	log_ident_default = strrchr(argv[0],'/')?strrchr(argv[0],'/')+1:argv[0];
+	log_ident_set_default(log_ident_default);
 	log_ident_set(log_ident_default);
 	/* parse the options */
 	while( (c=getopt(argc, argv, "c:dhpvw:V")) != -1) {
@@ -783,7 +772,7 @@ main(int argc, char* argv[])
 		return 1;
 	}
 
-	run_daemon(cfgfile, cmdline_verbose, debug_mode, log_ident_default, need_pidfile);
+	run_daemon(cfgfile, cmdline_verbose, debug_mode, need_pidfile);
 	log_init(NULL, 0, NULL); /* close logfile */
 #ifndef unbound_testbound
 	if(log_get_lock()) {
diff --git a/daemon/worker.c b/daemon/worker.c
index e2ce0e87009b..eb7fdf2f576d 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -61,6 +61,7 @@
 #include "services/authzone.h"
 #include "services/mesh.h"
 #include "services/localzone.h"
+#include "services/rpz.h"
 #include "util/data/msgparse.h"
 #include "util/data/msgencode.h"
 #include "util/data/dname.h"
@@ -572,9 +573,10 @@ static int
 apply_respip_action(struct worker* worker, const struct query_info* qinfo,
 	struct respip_client_info* cinfo, struct reply_info* rep,
 	struct comm_reply* repinfo, struct ub_packed_rrset_key** alias_rrset,
-	struct reply_info** encode_repp)
+	struct reply_info** encode_repp, struct auth_zones* az)
 {
-	struct respip_action_info actinfo = {respip_none, NULL};
+	struct respip_action_info actinfo = {0};
+	actinfo.action = respip_none;
 
 	if(qinfo->qtype != LDNS_RR_TYPE_A &&
 		qinfo->qtype != LDNS_RR_TYPE_AAAA &&
@@ -582,7 +584,7 @@ apply_respip_action(struct worker* worker, const struct query_info* qinfo,
 		return 1;
 
 	if(!respip_rewrite_reply(qinfo, cinfo, rep, encode_repp, &actinfo,
-		alias_rrset, 0, worker->scratchpad))
+		alias_rrset, 0, worker->scratchpad, az))
 		return 0;
 
 	/* xxx_deny actions mean dropping the reply, unless the original reply
@@ -595,9 +597,19 @@ apply_respip_action(struct worker* worker, const struct query_info* qinfo,
 	/* If address info is returned, it means the action should be an
 	 * 'inform' variant and the information should be logged. */
 	if(actinfo.addrinfo) {
-		respip_inform_print(actinfo.addrinfo, qinfo->qname,
+		respip_inform_print(&actinfo, qinfo->qname,
 			qinfo->qtype, qinfo->qclass, qinfo->local_alias,
 			repinfo);
+
+		if(worker->stats.extended && actinfo.rpz_used) {
+			if(actinfo.rpz_disabled)
+				worker->stats.rpz_action[RPZ_DISABLED_ACTION]++;
+			if(actinfo.rpz_cname_override)
+				worker->stats.rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
+			else
+				worker->stats.rpz_action[
+					respip_action_to_rpz_action(actinfo.action)]++;
+		}
 	}
 
 	return 1;
@@ -613,10 +625,10 @@ apply_respip_action(struct worker* worker, const struct query_info* qinfo,
  * be completely dropped, '*need_drop' will be set to 1. */
 static int
 answer_from_cache(struct worker* worker, struct query_info* qinfo,
-	struct respip_client_info* cinfo, int* need_drop,
-	struct ub_packed_rrset_key** alias_rrset,
+	struct respip_client_info* cinfo, int* need_drop, int* is_expired_answer,
+	int* is_secure_answer, struct ub_packed_rrset_key** alias_rrset,
 	struct reply_info** partial_repp,
-	struct reply_info* rep, uint16_t id, uint16_t flags, 
+	struct reply_info* rep, uint16_t id, uint16_t flags,
 	struct comm_reply* repinfo, struct edns_data* edns)
 {
 	struct edns_data edns_bak;
@@ -624,38 +636,37 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	uint16_t udpsize = edns->udp_size;
 	struct reply_info* encode_rep = rep;
 	struct reply_info* partial_rep = *partial_repp;
-	int secure;
 	int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd)
 		&& worker->env.need_to_validate;
-	*partial_repp = NULL;	/* avoid accidental further pass */
-	if(worker->env.cfg->serve_expired) {
-		if(worker->env.cfg->serve_expired_ttl &&
-			rep->serve_expired_ttl < timenow)
-			return 0;
-		if(!rrset_array_lock(rep->ref, rep->rrset_count, 0))
-			return 0;
-		/* below, rrsets with ttl before timenow become TTL 0 in
-		 * the response */
-		/* This response was served with zero TTL */
-		if (timenow >= rep->ttl) {
-			worker->stats.zero_ttl_responses++;
-		}
-	} else {
-		/* see if it is possible */
-		if(rep->ttl < timenow) {
+	*partial_repp = NULL;  /* avoid accidental further pass */
+
+	/* Check TTL */
+	if(rep->ttl < timenow) {
+		/* Check if we need to serve expired now */
+		if(worker->env.cfg->serve_expired &&
+			!worker->env.cfg->serve_expired_client_timeout) {
+				if(worker->env.cfg->serve_expired_ttl &&
+					rep->serve_expired_ttl < timenow)
+					return 0;
+				if(!rrset_array_lock(rep->ref, rep->rrset_count, 0))
+					return 0;
+				*is_expired_answer = 1;
+		} else {
 			/* the rrsets may have been updated in the meantime.
 			 * we will refetch the message format from the
-			 * authoritative server 
+			 * authoritative server
 			 */
 			return 0;
 		}
+	} else {
 		if(!rrset_array_lock(rep->ref, rep->rrset_count, timenow))
 			return 0;
-		/* locked and ids and ttls are OK. */
 	}
+	/* locked and ids and ttls are OK. */
+
 	/* check CNAME chain (if any) */
-	if(rep->an_numrrsets > 0 && (rep->rrsets[0]->rk.type == 
-		htons(LDNS_RR_TYPE_CNAME) || rep->rrsets[0]->rk.type == 
+	if(rep->an_numrrsets > 0 && (rep->rrsets[0]->rk.type ==
+		htons(LDNS_RR_TYPE_CNAME) || rep->rrsets[0]->rk.type ==
 		htons(LDNS_RR_TYPE_DNAME))) {
 		if(!reply_check_cname_chain(qinfo, rep)) {
 			/* cname chain invalid, redo iterator steps */
@@ -674,31 +685,31 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, rep,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
 			goto bail_out;
-		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
+		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
 			qinfo, id, flags, edns);
-		rrset_array_unlock_touch(worker->env.rrset_cache, 
+		rrset_array_unlock_touch(worker->env.rrset_cache,
 			worker->scratchpad, rep->ref, rep->rrset_count);
 		if(worker->stats.extended) {
 			worker->stats.ans_bogus ++;
 			worker->stats.ans_rcode[LDNS_RCODE_SERVFAIL] ++;
 		}
 		return 1;
-	} else if( rep->security == sec_status_unchecked && must_validate) {
+	} else if(rep->security == sec_status_unchecked && must_validate) {
 		verbose(VERB_ALGO, "Cache reply: unchecked entry needs "
 			"validation");
 		goto bail_out; /* need to validate cache entry first */
 	} else if(rep->security == sec_status_secure) {
-		if(reply_all_rrsets_secure(rep))
-			secure = 1;
-		else	{
+		if(reply_all_rrsets_secure(rep)) {
+			*is_secure_answer = 1;
+		} else {
 			if(must_validate) {
 				verbose(VERB_ALGO, "Cache reply: secure entry"
 					" changed status");
 				goto bail_out; /* rrset changed, re-verify */
 			}
-			secure = 0;
+			*is_secure_answer = 0;
 		}
-	} else	secure = 0;
+	} else *is_secure_answer = 0;
 
 	edns_bak = *edns;
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
@@ -709,17 +720,21 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad))
 		goto bail_out;
 	*alias_rrset = NULL; /* avoid confusion if caller set it to non-NULL */
-	if(worker->daemon->use_response_ip && !partial_rep &&
-	   !apply_respip_action(worker, qinfo, cinfo, rep, repinfo, alias_rrset,
-			&encode_rep)) {
+	if((worker->daemon->use_response_ip || worker->daemon->use_rpz) &&
+		!partial_rep && !apply_respip_action(worker, qinfo, cinfo, rep,
+		repinfo, alias_rrset,
+		&encode_rep, worker->env.auth_zones)) {
 		goto bail_out;
 	} else if(partial_rep &&
 		!respip_merge_cname(partial_rep, qinfo, rep, cinfo,
-		must_validate, &encode_rep, worker->scratchpad)) {
+		must_validate, &encode_rep, worker->scratchpad,
+		worker->env.auth_zones)) {
 		goto bail_out;
 	}
-	if(encode_rep != rep)
-		secure = 0; /* if rewritten, it can't be considered "secure" */
+	if(encode_rep != rep) {
+		/* if rewritten, it can't be considered "secure" */
+		*is_secure_answer = 0;
+	}
 	if(!encode_rep || *alias_rrset) {
 		if(!encode_rep)
 			*need_drop = 1;
@@ -736,7 +751,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		repinfo->c, worker->scratchpad) ||
 		!reply_info_answer_encode(qinfo, encode_rep, id, flags,
 		repinfo->c->buffer, timenow, 1, worker->scratchpad,
-		udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
+		udpsize, edns, (int)(edns->bits & EDNS_DO), *is_secure_answer)) {
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
 				edns->opt_list = NULL;
@@ -747,10 +762,6 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	 * is bad while holding locks. */
 	rrset_array_unlock_touch(worker->env.rrset_cache, worker->scratchpad,
 		rep->ref, rep->rrset_count);
-	if(worker->stats.extended) {
-		if(secure) worker->stats.ans_secure++;
-		server_stats_insrcode(&worker->stats, repinfo->c->buffer);
-	}
 	/* go and return this buffer to the client */
 	return 1;
 
@@ -1085,6 +1096,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct acl_addr* acladdr;
 	int rc = 0;
 	int need_drop = 0;
+	int is_expired_answer = 0;
+	int is_secure_answer = 0;
 	/* We might have to chase a CNAME chain internally, in which case
 	 * we'll have up to two replies and combine them to build a complete
 	 * answer.  These variables control this case. */
@@ -1365,6 +1378,18 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		goto send_reply;
 	}
 	if(worker->env.auth_zones &&
+		rpz_apply_qname_trigger(worker->env.auth_zones,
+		&worker->env, &qinfo, &edns, c->buffer, worker->scratchpad,
+		repinfo, acladdr->taglist, acladdr->taglen, &worker->stats)) {
+		regional_free_all(worker->scratchpad);
+		if(sldns_buffer_limit(c->buffer) == 0) {
+			comm_point_drop_reply(repinfo);
+			return 0;
+		}
+		server_stats_insrcode(&worker->stats, c->buffer);
+		goto send_reply;
+	}
+	if(worker->env.auth_zones &&
 		auth_zones_answer(worker->env.auth_zones, &worker->env,
 		&qinfo, &edns, repinfo, c->buffer, worker->scratchpad)) {
 		regional_free_all(worker->scratchpad);
@@ -1434,7 +1459,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	/* If we may apply IP-based actions to the answer, build the client
 	 * information.  As this can be expensive, skip it if there is
 	 * absolutely no possibility of it. */
-	if(worker->daemon->use_response_ip &&
+	if((worker->daemon->use_response_ip || worker->daemon->use_rpz) &&
 		(qinfo.qtype == LDNS_RR_TYPE_A ||
 		qinfo.qtype == LDNS_RR_TYPE_AAAA ||
 		qinfo.qtype == LDNS_RR_TYPE_ANY)) {
@@ -1455,12 +1480,14 @@ lookup_cache:
 	 * each pass.  We should still pass the original qinfo to
 	 * answer_from_cache(), however, since it's used to build the reply. */
 	if(!edns_bypass_cache_stage(edns.opt_list, &worker->env)) {
+		is_expired_answer = 0;
+		is_secure_answer = 0;
 		h = query_info_hash(lookup_qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
 		if((e=slabhash_lookup(worker->env.msg_cache, h, lookup_qinfo, 0))) {
 			/* answer from cache - we have acquired a readlock on it */
 			if(answer_from_cache(worker, &qinfo,
-				cinfo, &need_drop, &alias_rrset, &partial_rep,
-				(struct reply_info*)e->data,
+				cinfo, &need_drop, &is_expired_answer, &is_secure_answer,
+				&alias_rrset, &partial_rep, (struct reply_info*)e->data,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 				sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
 				&edns)) {
@@ -1468,9 +1495,11 @@ lookup_cache:
 				 * Note that if there is more than one pass
 				 * its qname must be that used for cache
 				 * lookup. */
-				if((worker->env.cfg->prefetch || worker->env.cfg->serve_expired)
-					&& *worker->env.now >=
-					((struct reply_info*)e->data)->prefetch_ttl) {
+				if((worker->env.cfg->prefetch && *worker->env.now >=
+							((struct reply_info*)e->data)->prefetch_ttl) ||
+						(worker->env.cfg->serve_expired &&
+						*worker->env.now >= ((struct reply_info*)e->data)->ttl)) {
+
 					time_t leeway = ((struct reply_info*)e->
 						data)->ttl - *worker->env.now;
 					if(((struct reply_info*)e->data)->ttl
@@ -1555,6 +1584,13 @@ send_reply_rc:
 		comm_point_drop_reply(repinfo);
 		return 0;
 	}
+	if(is_expired_answer) {
+		worker->stats.ans_expired++;
+	}
+	if(worker->stats.extended) {
+		if(is_secure_answer) worker->stats.ans_secure++;
+		server_stats_insrcode(&worker->stats, repinfo->c->buffer);
+	}
 #ifdef USE_DNSTAP
 	if(worker->dtenv.log_client_response_messages)
 		dt_msg_send_client_response(&worker->dtenv, &repinfo->addr,
@@ -1830,6 +1866,10 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		return 0;
 	}
 	worker->env.mesh = mesh_create(&worker->daemon->mods, &worker->env);
+	/* Pass on daemon variables that we would need in the mesh area */
+	worker->env.mesh->use_response_ip = worker->daemon->use_response_ip;
+	worker->env.mesh->use_rpz = worker->daemon->use_rpz;
+
 	worker->env.detach_subs = &mesh_detach_subs;
 	worker->env.attach_sub = &mesh_attach_sub;
 	worker->env.add_sub = &mesh_add_sub;
diff --git a/doc/Changelog b/doc/Changelog
index 1fca26b643fd..725b82ac64b4 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,175 @@
+20 February 2020: Wouter
+	- Updated contrib/unbound_smf23.tar.gz with Solaris SMF service for
+	  Unbound from Yuri Voinov.
+
+17 February 2020: Ralph
+	- Add respip to supported module-config options in unbound-checkconf.
+
+17 February 2020: George
+	- Remove unused variable.
+
+17 February 2020: Wouter
+	- contrib/drop2rpz: perl script that converts the Spamhaus DROP-List
+	  in RPZ-Format, contributed by Andreas Schulze.
+
+14 February 2020: Wouter
+	- Fix spelling in unbound.conf.5.in.
+	- Stop unbound-checkconf from insisting that auth-zone and rpz
+	  zonefiles have to exist.  They can not exist, and download later.
+
+13 February 2020: Wouter
+	- tag for 1.10.0rc1 release.
+
+12 February 2020: Wouter
+	- Fix with libnettle make test with dsa disabled.
+	- Fix contrib/fastrpz.patch to apply cleanly.  Fix for serve-stale
+	  fixes, but it does not compile, conflicts with new rpz code.
+	- Fix to clean memory leak of respip_addr.lock when ip_tree deleted.
+	- Fix compile warning when threads disabled.
+	- updated version number to 1.10.0.
+
+10 February 2020: George
+	- Document 'ub_result.was_ratelimited' in libunbound.
+	- Fix use after free on log-identity after a reload; Fixes #163.
+
+6 February 2020: George
+	- Fix num_reply_states and num_detached_states counting with
+	  serve_expired_callback.
+	- Cleaner code in mesh_serve_expired_lookup.
+	- Document in unbound.conf manpage that configuration clauses can be
+	  repeated in the configuration file.
+
+6 February 2020: Wouter
+	- Fix num_reply_addr counting in mesh and tcp drop due to size
+	  after serve_stale commit.
+	- Fix to create and destroy rpz_lock in auth_zones structure.
+	- Fix to lock zone before adding rpz qname trigger.
+	- Fix to lock and release once in mesh_serve_expired_lookup.
+	- Fix to put braces around empty if body when threading is disabled.
+
+5 February 2020: George
+	- Added serve-stale functionality as described in
+	  draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used
+	  to configure the behavior.
+	- Updated cachedb to honor `serve-expired-ttl`; Fixes #107.
+	- Renamed statistic `num.zero_ttl` to `num.expired` as expired replies
+	  come with a configurable TTL value (`serve-expired-reply-ttl`).
+	- Fixed stats when replying with cached, cname-aliased records.
+	- Added missing default values for redis cachedb backend.
+
+3 February 2020: Ralph
+	- Add assertion to please static analyzer
+
+31 January 2020: Wouter
+	- Fix fclose on error in TLS session ticket code.
+
+30 January 2020: Ralph
+	- Fix memory leak in error condition remote.c
+	- Fix double free in error condition view.c
+	- Fix memory leak in do_auth_zone_transfer on success
+	- Merge RPZ support into master. Only QNAME and Response IP triggers are
+	  supported.
+	- Stop working on socket when socket() call returns an error.
+	- Check malloc return values in TLS session ticket code
+
+30 January 2020: Wouter
+	- Fix subnet tests for disabled DSA algorithm by default.
+	- Update contrib/fastrpz.patch for clean diff with current code.
+	- Merge PR#151: Fixes for systemd units, by Maryse47, Edmonds
+	  and Frzk.  Updates the unbound.service systemd file and adds
+	  a portable systemd service file.
+	- updated .gitignore for added contrib file.
+	- Add build rule for ipset to Makefile
+	- Add getentropy_freebsd.o to Makefile dependencies.
+
+29 January 2020: Ralph
+	- Merge PR#156 from Alexander Berkes; Added unbound-control
+	  view_local_datas_remove command.
+
+29 January 2020: Wouter
+	- Fix #157: undefined reference to `htobe64'.
+
+28 January 2020: Ralph
+	- Merge PR#147; change rfc reference for reserved top level dns names.
+
+28 January 2020: Wouter
+	- iana portlist updated.
+	- Fix to silence the tls handshake errors for broken pipe and reset
+	  by peer, unless verbosity is set to 2 or higher.
+
+27 January 2020: Ralph
+	- Merge PR#154; Allow use of libbsd functions with configure option
+	  --with-libbsd. By Robert Edmonds and Steven Chamberlain.
+	- Merge PR#148; Add some TLS stats to unbound_munin_. By Fredrik Pettai.
+
+27 January 2020: Wouter
+	- Merge PR#155 from Robert Edmonds: contrib/libunbound.pc.in: Fixes
+	  to Libs/Requires for crypto library dependencies.
+	- Fix #153: Disable validation for DSA algorithms.  RFC 8624
+	  compliance.
+
+23 January 2020: Wouter
+	- Merge PR#150 from Frzk: Systemd unit without chroot.  It add
+	  contrib/unbound_nochroot.service.in, a systemd file for use with
+	  chroot: "", see comments in the file, it uses systemd protections
+	  instead.
+
+14 January 2020: Wouter
+	- Removed the dnscrypt_queries and dnscrypt_queries_chacha tests,
+	  because dnscrypt-proxy (2.0.36) does not support the test setup
+	  any more, and also the config file format does not seem to have
+	  the appropriate keys to recreate that setup.
+	- Fix crash after reload where a stats lookup could reference old key
+	  cache and neg cache structures.
+	- Fix for memory leak when edns subnet config options are read when
+	  compiled without edns subnet support.
+	- Fix auth zone support for NSEC3 records without salt.
+
+10 January 2020: Wouter
+	- Fix the relationship between serve-expired and prefetch options,
+	  patch from Saksham Manchanda from Secure64.
+	- Fix unreachable code in ssl set options code.
+
+8 January 2020: Ralph
+	- Fix #138: stop binding pidfile inside chroot dir in systemd service
+	  file.
+
+8 January 2020: Wouter
+	- Fix 'make test' to work for --disable-sha1 configure option.
+	- Fix out-of-bounds null-byte write in sldns_bget_token_par while
+	  parsing type WKS, reported by Luis Merino from X41 D-Sec.
+	- Updated sldns_bget_token_par fix for also space for the zero
+	  delimiter after the character.  And update for more spare space.
+
+6 January 2020: George
+	- Downgrade compat/getentropy_solaris.c to version 1.4 from OpenBSD.
+	  The dl_iterate_phdr() function introduced in newer versions raises
+	  compilation errors on solaris 10.
+	- Changes to compat/getentropy_solaris.c for,
+	  ifdef stdint.h inclusion for older systems.
+	  ifdef sha2.h inclusion for older systems.
+
+6 January 2020: Wouter
+	- Merge #135 from Florian Obser: Use passed in neg and key cache
+	  if non-NULL.
+	- Fix #140: Document slave not downloading new zonefile upon update.
+
+16 December 2019: George
+	- Update mailing list URL.
+
+12 December 2019: Ralph
+	- Master is 1.9.7 in development.
+	- Fix typo to let serve-expired-ttl work with ub_ctx_set_option(), by
+	  Florian Obser
+
+10 December 2019: Wouter
+	- Fix to make auth zone IXFR to fallback to AXFR if a single
+	  response RR is received over TCP with the SOA in it.
+
 6 December 2019: Wouter
 	- Fix ipsecmod compile.
 	- Fix Makefile.in for ipset module compile, from Adi Prasaja.
+	- release-1.9.6 tag, which became the 1.9.6 release
 
 5 December 2019: Wouter
 	- unbound-fuzzers.tar.bz2: three programs for fuzzing, that are 1:1
diff --git a/doc/README b/doc/README
index 334624575491..6bd34bbed956 100644
--- a/doc/README
+++ b/doc/README
@@ -1,4 +1,4 @@
-README for Unbound 1.9.6
+README for Unbound 1.10.1
 Copyright 2007 NLnet Labs
 http://unbound.net
 
diff --git a/doc/example.conf.in b/doc/example.conf.in
index 0a8c179f971d..d9fe9c60b3d0 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.9.6.
+# See unbound.conf(5) man page, version 1.10.1.
 #
 # this is a comment.
 
@@ -558,8 +558,8 @@ server:
 	# that set CD but cannot validate themselves.
 	# ignore-cd-flag: no
 
-	# Serve expired responses from cache, with TTL 0 in the response,
-	# and then attempt to fetch the data afresh.
+	# Serve expired responses from cache, with serve-expired-reply-ttl in
+	# the response, and then attempt to fetch the data afresh.
 	# serve-expired: no
 	#
 	# Limit serving of expired responses to configured seconds after
@@ -571,6 +571,16 @@ server:
 	# that the expired records will be served as long as there are queries
 	# for it.
 	# serve-expired-ttl-reset: no
+	#
+	# TTL value to use when replying with expired data.
+	# serve-expired-reply-ttl: 30
+	#
+	# Time in milliseconds before replying to the client with expired data.
+	# This essentially enables the serve-stale behavior as specified in
+	# draft-ietf-dnsop-serve-stale-10 that first tries to resolve before
+	# immediately responding with expired data.  0 disables this behavior.
+	# A recommended value is 1800.
+	# serve-expired-client-timeout: 0
 
 	# Have the validator log failed validations for your diagnosis.
 	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
@@ -1006,3 +1016,20 @@ remote-control:
 #     name-v6: "list-v6"
 #
 
+# Response Policy Zones
+# RPZ policies. Applied in order of configuration. QNAME and Response IP
+# Address trigger are the only supported triggers. Supported actions are:
+# NXDOMAIN, NODATA, PASSTHRU, DROP and Local Data. Policies can be loaded from
+# file, using zone transfer, or using HTTP. The respip module needs to be added
+# to the module-config, e.g.: module-config: "respip validator iterator".
+# rpz:
+#     name: "rpz.example.com"
+#     zonefile: "rpz.example.com"
+#     master: 192.0.2.0
+#     allow-notify: 192.0.2.0/32
+#     url: http://www.example.com/rpz.example.org.zone
+#     rpz-action-override: cname
+#     rpz-cname-override: www.example.org
+#     rpz-log: yes
+#     rpz-log-name: "example policy"
+#     tags: "example"
diff --git a/doc/libunbound.3.in b/doc/libunbound.3.in
index 19ef40236897..69c201116246 100644
--- a/doc/libunbound.3.in
+++ b/doc/libunbound.3.in
@@ -1,4 +1,4 @@
-.TH "libunbound" "3" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6"
+.TH "libunbound" "3" "May 19, 2020" "NLnet Labs" "unbound 1.10.1"
 .\"
 .\" libunbound.3 -- unbound library functions manual
 .\"
@@ -44,7 +44,7 @@
 .B ub_ctx_zone_remove,
 .B ub_ctx_data_add,
 .B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.9.6 functions.
+\- Unbound DNS validating resolver 1.10.1 functions.
 .SH "SYNOPSIS"
 .B #include <unbound.h>
 .LP
@@ -396,12 +396,13 @@ The result of the DNS resolution and validation is returned as
 		char* canonname; /* canonical name of result */
 		int rcode;   /* additional error code in case of no data */
 		void* answer_packet; /* full network format answer packet */
-		int answer_len; /* length of packet in octets */
+		int answer_len;  /* length of packet in octets */
 		int havedata; /* true if there is data */
 		int nxdomain; /* true if nodata because name does not exist */
-		int secure;  /* true if result is secure */
-		int bogus;   /* true if a security failure happened */
+		int secure;   /* true if result is secure */
+		int bogus;    /* true if a security failure happened */
 		char* why_bogus; /* string with error if bogus */
+		int was_ratelimited; /* true if the query was ratelimited (SERVFAIL) by unbound */
 		int ttl;     /* number of seconds the result is valid */
 	};
 .fi
diff --git a/doc/unbound-anchor.8.in b/doc/unbound-anchor.8.in
index dc1c10cf5034..680066a75072 100644
--- a/doc/unbound-anchor.8.in
+++ b/doc/unbound-anchor.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6"
+.TH "unbound-anchor" "8" "May 19, 2020" "NLnet Labs" "unbound 1.10.1"
 .\"
 .\" unbound-anchor.8 -- unbound anchor maintenance utility manual
 .\"
diff --git a/doc/unbound-checkconf.8.in b/doc/unbound-checkconf.8.in
index 30d53f4bec13..8fb18410dfdd 100644
--- a/doc/unbound-checkconf.8.in
+++ b/doc/unbound-checkconf.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6"
+.TH "unbound-checkconf" "8" "May 19, 2020" "NLnet Labs" "unbound 1.10.1"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
diff --git a/doc/unbound-control.8.in b/doc/unbound-control.8.in
index 754fdf987aac..3747b1fa670e 100644
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6"
+.TH "unbound-control" "8" "May 19, 2020" "NLnet Labs" "unbound 1.10.1"
 .\"
 .\" unbound-control.8 -- unbound remote control manual
 .\"
@@ -323,6 +323,9 @@ serial check).  And then the zone is transferred for a newer zone version.
 .B view_local_data_remove \fIview\fR \fIname
 \fIlocal_data_remove\fR for given view.
 .TP
+.B view_local_datas_remove \fIview\fR
+Remove a list of \fIlocal_data\fR for given view from stdin. Like local_datas_remove.
+.TP
 .B view_local_datas \fIview\fR
 Add a list of \fIlocal_data\fR for given view from stdin.  Like local_datas.
 .SH "EXIT CODE"
@@ -379,8 +382,8 @@ and resulted in recursive processing, taking a slot in the requestlist.
 Not part of the recursivereplies (or the histogram thereof) or cachemiss,
 as a cache response was sent.
 .TP
-.I threadX.num.zero_ttl
-number of replies with ttl zero, because they served an expired cache entry.
+.I threadX.num.expired
+number of replies that served an expired cache entry.
 .TP
 .I threadX.num.recursivereplies
 The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
@@ -443,7 +446,7 @@ summed over threads.
 .I total.num.prefetch
 summed over threads.
 .TP
-.I total.num.zero_ttl
+.I total.num.expired
 summed over threads.
 .TP
 .I total.num.recursivereplies
@@ -660,6 +663,11 @@ Number of queries that got an answer that contained EDNS client subnet data.
 Number of queries answered from the edns client subnet cache.  These are
 counted as cachemiss by the main counters, but hit the client subnet
 specific cache, after getting processed by the edns client subnet module.
+.TP
+.I num.rpz.action.<rpz_action>
+Number of queries answered using configured RPZ policy, per RPZ action type.
+Possible actions are: nxdomain, nodata, passthru, drop, local_data, disabled,
+and cname_override.
 .SH "FILES"
 .TP
 .I @ub_conf_file@
diff --git a/doc/unbound-host.1.in b/doc/unbound-host.1.in
index ac8be5bff5f5..e2dcc4a9b0ee 100644
--- a/doc/unbound-host.1.in
+++ b/doc/unbound-host.1.in
@@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6"
+.TH "unbound\-host" "1" "May 19, 2020" "NLnet Labs" "unbound 1.10.1"
 .\"
 .\" unbound-host.1 -- unbound DNS lookup utility
 .\"
diff --git a/doc/unbound.8.in b/doc/unbound.8.in
index 145620b73c9d..74c900ebcc0d 100644
--- a/doc/unbound.8.in
+++ b/doc/unbound.8.in
@@ -1,4 +1,4 @@
-.TH "unbound" "8" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6"
+.TH "unbound" "8" "May 19, 2020" "NLnet Labs" "unbound 1.10.1"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -9,7 +9,7 @@
 .\"
 .SH "NAME"
 .B unbound
-\- Unbound DNS validating resolver 1.9.6.
+\- Unbound DNS validating resolver 1.10.1.
 .SH "SYNOPSIS"
 .B unbound
 .RB [ \-h ]
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index d6352bcd983a..ffdbf8caa65b 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6"
+.TH "unbound.conf" "5" "May 19, 2020" "NLnet Labs" "unbound 1.10.1"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
@@ -63,8 +63,10 @@ server:
 	access\-control: 2001:DB8::/64 allow
 .fi
 .SH "FILE FORMAT"
-There must be whitespace between keywords. Attribute keywords end with a colon ':'.
-An attribute is followed by its containing attributes, or a value.
+There must be whitespace between keywords.  Attribute keywords end with a
+colon ':'.  An attribute is followed by a value, or its containing attributes
+in which case it is referred to as a clause.  Clauses can be repeated throughout
+the file (or included files) to group attributes under the same clause.
 .P
 Files can be included using the
 .B include:
@@ -1070,20 +1072,35 @@ The default value is "no".
 .TP
 .B serve\-expired: \fI<yes or no>
 If enabled, unbound attempts to serve old responses from cache with a
-TTL of 0 in the response without waiting for the actual resolution to finish.
-The actual resolution answer ends up in the cache later on.  Default is "no".
+TTL of \fBserve\-expired\-reply\-ttl\fR in the response without waiting for the
+actual resolution to finish.  The actual resolution answer ends up in the cache
+later on.  Default is "no".
 .TP
 .B serve\-expired\-ttl: \fI<seconds>
 Limit serving of expired responses to configured seconds after expiration. 0
-disables the limit. This option only applies when \fBserve\-expired\fR is
-enabled. The default is 0.
+disables the limit.  This option only applies when \fBserve\-expired\fR is
+enabled.  A suggested value per draft-ietf-dnsop-serve-stale-10 is between
+86400 (1 day) and 259200 (3 days).  The default is 0.
 .TP
 .B serve\-expired\-ttl\-reset: \fI<yes or no>
 Set the TTL of expired records to the \fBserve\-expired\-ttl\fR value after a
-failed attempt to retrieve the record from upstream. This makes sure that the
-expired records will be served as long as there are queries for it. Default is
+failed attempt to retrieve the record from upstream.  This makes sure that the
+expired records will be served as long as there are queries for it.  Default is
 "no".
 .TP
+.B serve\-expired\-reply\-ttl: \fI<seconds>
+TTL value to use when replying with expired data.  If
+\fBserve\-expired\-client\-timeout\fR is also used then it is RECOMMENDED to
+use 30 as the value (draft-ietf-dnsop-serve-stale-10).  The default is 30.
+.TP
+.B serve\-expired\-client\-timeout: \fI<msec>
+Time in milliseconds before replying to the client with expired data.  This
+essentially enables the serve-stale behavior as specified in
+draft-ietf-dnsop-serve-stale-10 that first tries to resolve before immediately
+responding with expired data.  A recommended value per
+draft-ietf-dnsop-serve-stale-10 is 1800.  Setting this to 0 will disable this
+behavior.  Default is 0.
+.TP
 .B val\-nsec3\-keysize\-iterations: \fI<"list of values">
 List of keysize and iteration count values, separated by spaces, surrounded
 by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
@@ -1296,7 +1313,7 @@ local\-data: "onion. 10800 IN
     SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
 .fi
 .TP 10
-\h'5'\fItest (RFC 2606)\fR
+\h'5'\fItest (RFC 6761)\fR
 Default content:
 .nf
 local\-zone: "test." static
@@ -1305,7 +1322,7 @@ local\-data: "test. 10800 IN
     SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
 .fi
 .TP 10
-\h'5'\fIinvalid (RFC 2606)\fR
+\h'5'\fIinvalid (RFC 6761)\fR
 Default content:
 .nf
 local\-zone: "invalid." static
@@ -1680,6 +1697,12 @@ Name of the authority zone.
 Where to download a copy of the zone from, with AXFR and IXFR.  Multiple
 masters can be specified.  They are all tried if one fails.
 With the "ip#name" notation a AXFR over TLS can be used.
+If you point it at another Unbound instance, it would not work because
+that does not support AXFR/IXFR for the zone, but if you used \fBurl:\fR to download
+the zonefile as a text file from a webserver that would work.
+If you specify the hostname, you cannot use the domain from the zonefile,
+because it may not have that when retrieving that data, instead use a plain
+IP address to avoid a circular dependency on retrieving that IP address.
 .TP
 .B url: \fI<url to zonefile>
 Where to download a zonefile for the zone.  With http or https.  An example
@@ -1691,6 +1714,10 @@ see if the SOA serial number has changed, reducing the number of downloads.
 If none of the urls work, the masters are tried with IXFR and AXFR.
 For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used
 to authenticate the connection.
+If you specify a hostname in the URL, you cannot use the domain from the
+zonefile, because it may not have that when retrieving that data, instead
+use a plain IP address to avoid a circular dependency on retrieving that IP
+address.  Avoid dependencies on name lookups by using a notation like "http://192.0.2.1/unbound-master/example.com.zone", with an explicit IP address.
 .TP
 .B allow\-notify: \fI<IP address or host name or netblockIP/prefix>
 With allow\-notify you can specify additional sources of notifies.
@@ -2014,6 +2041,13 @@ to the query without performing iterative DNS resolution.
 If Unbound cannot even find an answer in the backend, it resolves the
 query as usual, and stores the answer in the backend.
 .P
+This module interacts with the \fBserve\-expired\-*\fR options and will reply
+with expired data if unbound is configured for that.  Currently the use
+of \fBserve\-expired\-client\-timeout:\fR and
+\fBserve\-expired\-reply\-ttl:\fR is not consistent for data originating from
+the external cache as these will result in a reply with 0 TTL without trying to
+update the data first, ignoring the configured values.
+.P
 If Unbound was built with
 \fB\-\-with\-libhiredis\fR
 on a system that has installed the hiredis C client library of Redis,
@@ -2080,6 +2114,70 @@ If this timeout expires Unbound closes the connection, treats it as
 if the Redis server does not have the requested data, and will try to
 re-establish a new connection later.
 This option defaults to 100 milliseconds.
+.SS Response Policy Zone Options
+.LP
+Response Policy Zones are configured with \fBrpz:\fR, and each one must have a
+\fBname:\fR. There can be multiple ones, by listing multiple rpz clauses, each
+with a different name. RPZ clauses are applied in order of configuration. The
+\fBrespip\fR module needs to be added to the \fBmodule-config\fR, e.g.:
+\fBmodule-config: "respip validator iterator"\fR.
+.P
+Only the QNAME and Response IP Address triggers are supported. The supported RPZ
+actions are: NXDOMAIN, NODATA, PASSTHRU, DROP and Local Data. RPZ QNAME triggers
+are applied after
+\fBlocal-zones\fR and before \fBauth-zones\fR.
+.TP
+.B name: \fI<zone name>
+Name of the authority zone.
+.TP
+.B master: \fI<IP address or host name>
+Where to download a copy of the zone from, with AXFR and IXFR.  Multiple
+masters can be specified.  They are all tried if one fails.
+.TP
+.B url: \fI<url to zonefile>
+Where to download a zonefile for the zone.  With http or https.  An example
+for the url is "http://www.example.com/example.org.zone".  Multiple url
+statements can be given, they are tried in turn.  If only urls are given
+the SOA refresh timer is used to wait for making new downloads.  If also
+masters are listed, the masters are first probed with UDP SOA queries to
+see if the SOA serial number has changed, reducing the number of downloads.
+If none of the urls work, the masters are tried with IXFR and AXFR.
+For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used
+to authenticate the connection.
+.TP
+.B allow\-notify: \fI<IP address or host name or netblockIP/prefix>
+With allow\-notify you can specify additional sources of notifies.
+When notified, the server attempts to first probe and then zone transfer.
+If the notify is from a master, it first attempts that master.  Otherwise
+other masters are attempted.  If there are no masters, but only urls, the
+file is downloaded when notified.  The masters from master: statements are
+allowed notify by default.
+.TP
+.B zonefile: \fI<filename>
+The filename where the zone is stored.  If not given then no zonefile is used.
+If the file does not exist or is empty, unbound will attempt to fetch zone
+data (eg. from the master servers).
+.TP
+.B rpz\-action\-override: \fI<action>
+Always use this RPZ action for matching triggers from this zone. Possible action
+are: nxdomain, nodata, passthru, drop, disabled and cname.
+.TP
+.B rpz\-cname\-override: \fI<domain>
+The CNAME target domain to use if the cname action is configured for
+\fBrpz\-action\-override\fR.
+.TP
+.B rpz\-log: \fI<yes or no>
+Log all applied RPZ actions for this RPZ zone. Default is no.
+.TP
+.B rpz\-log\-name: \fI<name>
+Specify a string to be part of the log line, for easy referencing.
+.TP
+.B tags: \fI<list of tags>
+Limit the policies from this RPZ clause to clients with a matching tag. Tags
+need to be defined in \fBdefine\-tag\fR and can be assigned to client addresses
+using \fBaccess\-control\-tag\fR. Enclose list of tags in quotes ("") and put
+spaces between tags. If no tags are specified the policies from this clause will
+be applied for all clients.
 .SH "MEMORY CONTROL EXAMPLE"
 In the example config settings below memory usage is reduced. Some service
 levels are lower, notable very large data and a high TCP load are no longer
diff --git a/edns-subnet/subnetmod.c b/edns-subnet/subnetmod.c
index 907f40d5859d..37dc550cd69c 100644
--- a/edns-subnet/subnetmod.c
+++ b/edns-subnet/subnetmod.c
@@ -431,7 +431,7 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 	}
 
 	qstate->return_msg = tomsg(NULL, &qstate->qinfo,
-		(struct reply_info *)node->elem, qstate->region, *env->now,
+		(struct reply_info *)node->elem, qstate->region, *env->now, 0,
 		env->scratch);
 	scope = (uint8_t)node->scope;
 	lock_rw_unlock(&e->lock);
diff --git a/install-sh b/install-sh
index 59990a104926..ea4c8234c41a 100755
--- a/install-sh
+++ b/install-sh
@@ -1,7 +1,7 @@
-#!/bin/sh
+#!/usr/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2014-09-12.12; # UTC
+scriptversion=2013-12-25.23; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -324,41 +324,34 @@ do
             # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
             ;;
           *)
-            # $RANDOM is not portable (e.g. dash);  use it when possible to
-            # lower collision chance
             tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-            trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null; exit $ret' 0
+            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
 
-            # As "mkdir -p" follows symlinks and we work in /tmp possibly;  so
-            # create the $tmpdir first (and fail if unsuccessful) to make sure
-            # that nobody tries to guess the $tmpdir name.
             if (umask $mkdir_umask &&
-                $mkdirprog $mkdir_mode "$tmpdir" &&
-                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
+                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
             then
               if test -z "$dir_arg" || {
                    # Check for POSIX incompatibilities with -m.
                    # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
                    # other-writable bit of parent directory when it shouldn't.
                    # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-                   test_tmpdir="$tmpdir/a"
-                   ls_ld_tmpdir=`ls -ld "$test_tmpdir"`
+                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
                    case $ls_ld_tmpdir in
                      d????-?r-*) different_mode=700;;
                      d????-?--*) different_mode=755;;
                      *) false;;
                    esac &&
-                   $mkdirprog -m$different_mode -p -- "$test_tmpdir" && {
-                     ls_ld_tmpdir_1=`ls -ld "$test_tmpdir"`
+                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
+                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
                      test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
                    }
                  }
               then posix_mkdir=:
               fi
-              rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir"
+              rmdir "$tmpdir/d" "$tmpdir"
             else
               # Remove any dirs left behind by ancient mkdir implementations.
-              rmdir ./$mkdir_mode ./-p ./-- "$tmpdir" 2>/dev/null
+              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
             fi
             trap '' 0;;
         esac;;
diff --git a/iterator/iter_delegpt.c b/iterator/iter_delegpt.c
index f88b3e115db3..9a672b0af39d 100644
--- a/iterator/iter_delegpt.c
+++ b/iterator/iter_delegpt.c
@@ -84,7 +84,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
 		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, 
-			a->bogus, a->lame, a->tls_auth_name))
+			a->bogus, a->lame, a->tls_auth_name, NULL))
 			return NULL;
 	}
 	return copy;
@@ -161,7 +161,7 @@ delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr,
 int 
 delegpt_add_target(struct delegpt* dp, struct regional* region, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, uint8_t bogus, uint8_t lame)
+	socklen_t addrlen, uint8_t bogus, uint8_t lame, int* additions)
 {
 	struct delegpt_ns* ns = delegpt_find_ns(dp, name, namelen);
 	log_assert(!dp->dp_type_mlc);
@@ -176,13 +176,14 @@ delegpt_add_target(struct delegpt* dp, struct regional* region,
 		if(ns->got4 && ns->got6)
 			ns->resolved = 1;
 	}
-	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, NULL);
+	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, NULL,
+		additions);
 }
 
 int 
 delegpt_add_addr(struct delegpt* dp, struct regional* region, 
 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus, 
-	uint8_t lame, char* tls_auth_name)
+	uint8_t lame, char* tls_auth_name, int* additions)
 {
 	struct delegpt_addr* a;
 	log_assert(!dp->dp_type_mlc);
@@ -194,6 +195,8 @@ delegpt_add_addr(struct delegpt* dp, struct regional* region,
 			a->lame = 0;
 		return 1;
 	}
+	if(additions)
+		*additions = 1;
 
 	a = (struct delegpt_addr*)regional_alloc(region,
 		sizeof(struct delegpt_addr));
@@ -382,10 +385,10 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 			continue;
 
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_A) {
-			if(!delegpt_add_rrset_A(dp, region, s, 0))
+			if(!delegpt_add_rrset_A(dp, region, s, 0, NULL))
 				return NULL;
 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_AAAA) {
-			if(!delegpt_add_rrset_AAAA(dp, region, s, 0))
+			if(!delegpt_add_rrset_AAAA(dp, region, s, 0, NULL))
 				return NULL;
 		}
 	}
@@ -416,7 +419,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, uint8_t lame)
+	struct ub_packed_rrset_key* ak, uint8_t lame, int* additions)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -432,7 +435,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin_addr, d->rr_data[i]+2, INET_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), lame))
+                        len, (d->security==sec_status_bogus), lame, additions))
                         return 0;
         }
         return 1;
@@ -440,7 +443,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, uint8_t lame)
+	struct ub_packed_rrset_key* ak, uint8_t lame, int* additions)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -456,7 +459,7 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin6_addr, d->rr_data[i]+2, INET6_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), lame))
+                        len, (d->security==sec_status_bogus), lame, additions))
                         return 0;
         }
         return 1;
@@ -464,20 +467,33 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset(struct delegpt* dp, struct regional* region,
-        struct ub_packed_rrset_key* rrset, uint8_t lame)
+        struct ub_packed_rrset_key* rrset, uint8_t lame, int* additions)
 {
 	if(!rrset)
 		return 1;
 	if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS)
 		return delegpt_rrset_add_ns(dp, region, rrset, lame);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A)
-		return delegpt_add_rrset_A(dp, region, rrset, lame);
+		return delegpt_add_rrset_A(dp, region, rrset, lame, additions);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA)
-		return delegpt_add_rrset_AAAA(dp, region, rrset, lame);
+		return delegpt_add_rrset_AAAA(dp, region, rrset, lame,
+			additions);
 	log_warn("Unknown rrset type added to delegpt");
 	return 1;
 }
 
+void delegpt_mark_neg(struct delegpt_ns* ns, uint16_t qtype)
+{
+	if(ns) {
+		if(qtype == LDNS_RR_TYPE_A)
+			ns->got4 = 2;
+		else if(qtype == LDNS_RR_TYPE_AAAA)
+			ns->got6 = 2;
+		if(ns->got4 && ns->got6)
+			ns->resolved = 1;
+	}
+}
+
 void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg)
 {
 	struct reply_info* rep = (struct reply_info*)msg->entry.data;
@@ -487,14 +503,7 @@ void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg)
 	if(FLAGS_GET_RCODE(rep->flags) != 0 || rep->an_numrrsets == 0) {
 		struct delegpt_ns* ns = delegpt_find_ns(dp, msg->key.qname, 
 			msg->key.qname_len);
-		if(ns) {
-			if(msg->key.qtype == LDNS_RR_TYPE_A)
-				ns->got4 = 1;
-			else if(msg->key.qtype == LDNS_RR_TYPE_AAAA)
-				ns->got6 = 1;
-			if(ns->got4 && ns->got6)
-				ns->resolved = 1;
-		}
+		delegpt_mark_neg(ns, msg->key.qtype);
 	}
 }
 
diff --git a/iterator/iter_delegpt.h b/iterator/iter_delegpt.h
index 6c088264588f..138eb6e1b60a 100644
--- a/iterator/iter_delegpt.h
+++ b/iterator/iter_delegpt.h
@@ -106,9 +106,10 @@ struct delegpt_ns {
 	 * and marked true if got4 and got6 are both true.
 	 */
 	int resolved;
-	/** if the ipv4 address is in the delegpt */
+	/** if the ipv4 address is in the delegpt, 0=not, 1=yes 2=negative,
+	 * negative means it was done, but no content. */
 	uint8_t got4;
-	/** if the ipv6 address is in the delegpt */
+	/** if the ipv6 address is in the delegpt, 0=not, 1=yes 2=negative */
 	uint8_t got6;
 	/**
 	 * If the name is parent-side only and thus dispreferred.
@@ -215,11 +216,12 @@ int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
  * @param addrlen: the length of addr.
  * @param bogus: security status for the address, pass true if bogus.
  * @param lame: address is lame.
+ * @param additions: will be set to 1 if a new address is added
  * @return false on error.
  */
 int delegpt_add_target(struct delegpt* dp, struct regional* regional, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, uint8_t bogus, uint8_t lame);
+	socklen_t addrlen, uint8_t bogus, uint8_t lame, int* additions);
 
 /**
  * Add A RRset to delegpt.
@@ -227,10 +229,11 @@ int delegpt_add_target(struct delegpt* dp, struct regional* regional,
  * @param regional: where to allocate the info.
  * @param rrset: RRset A to add.
  * @param lame: rrset is lame, disprefer it.
+ * @param additions: will be set to 1 if a new address is added
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, uint8_t lame);
+	struct ub_packed_rrset_key* rrset, uint8_t lame, int* additions);
 
 /**
  * Add AAAA RRset to delegpt.
@@ -238,10 +241,11 @@ int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional,
  * @param regional: where to allocate the info.
  * @param rrset: RRset AAAA to add.
  * @param lame: rrset is lame, disprefer it.
+ * @param additions: will be set to 1 if a new address is added
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, uint8_t lame);
+	struct ub_packed_rrset_key* rrset, uint8_t lame, int* additions);
 
 /**
  * Add any RRset to delegpt.
@@ -250,10 +254,11 @@ int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional,
  * @param regional: where to allocate the info.
  * @param rrset: RRset to add, NS, A, AAAA.
  * @param lame: rrset is lame, disprefer it.
+ * @param additions: will be set to 1 if a new address is added
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, uint8_t lame);
+	struct ub_packed_rrset_key* rrset, uint8_t lame, int* additions);
 
 /**
  * Add address to the delegation point. No servername is associated or checked.
@@ -264,11 +269,12 @@ int delegpt_add_rrset(struct delegpt* dp, struct regional* regional,
  * @param bogus: if address is bogus.
  * @param lame: if address is lame.
  * @param tls_auth_name: TLS authentication name (or NULL).
+ * @param additions: will be set to 1 if a new address is added
  * @return false on error.
  */
 int delegpt_add_addr(struct delegpt* dp, struct regional* regional, 
 	struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t bogus, uint8_t lame, char* tls_auth_name);
+	uint8_t bogus, uint8_t lame, char* tls_auth_name, int* additions);
 
 /** 
  * Find NS record in name list of delegation point.
@@ -342,6 +348,14 @@ struct delegpt* delegpt_from_message(struct dns_msg* msg,
 	struct regional* regional);
 
 /**
+ * Mark negative return in delegation point for specific nameserver.
+ * sets the got4 or got6 to negative, updates the ns->resolved.
+ * @param ns: the nameserver in the delegpt.
+ * @param qtype: A or AAAA (host order).
+ */
+void delegpt_mark_neg(struct delegpt_ns* ns, uint16_t qtype);
+
+/**
  * Add negative message to delegation point.
  * @param dp: delegation point.
  * @param msg: the message added, marks off A or AAAA from an NS entry.
diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
index cceec3d5677a..aae934dd44fe 100644
--- a/iterator/iter_scrub.c
+++ b/iterator/iter_scrub.c
@@ -185,8 +185,9 @@ mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg,
 /** Get target name of a CNAME */
 static int
 parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname, 
-	size_t* snamelen)
+	size_t* snamelen, sldns_buffer* pkt)
 {
+	size_t oldpos, dlen;
 	if(rrset->rr_count != 1) {
 		struct rr_parse* sig;
 		verbose(VERB_ALGO, "Found CNAME rrset with "
@@ -204,6 +205,19 @@ parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
 	*sname = rrset->rr_first->ttl_data + sizeof(uint32_t)
 		+ sizeof(uint16_t); /* skip ttl, rdatalen */
 	*snamelen = rrset->rr_first->size - sizeof(uint16_t);
+
+	if(rrset->rr_first->outside_packet) {
+		if(!dname_valid(*sname, *snamelen))
+			return 0;
+		return 1;
+	}
+	oldpos = sldns_buffer_position(pkt);
+	sldns_buffer_set_position(pkt, (size_t)(*sname - sldns_buffer_begin(pkt)));
+	dlen = pkt_dname_len(pkt);
+	sldns_buffer_set_position(pkt, oldpos);
+	if(dlen == 0)
+		return 0; /* parse fail on the rdata name */
+	*snamelen = dlen;
 	return 1;
 }
 
@@ -215,7 +229,7 @@ synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,
 	/* we already know that sname is a strict subdomain of DNAME owner */
 	uint8_t* dtarg = NULL;
 	size_t dtarglen;
-	if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen))
+	if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen, pkt))
 		return 0; 
 	if(qnamelen <= dname_rrset->dname_len)
 		return 0;
@@ -388,7 +402,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				/* check next cname */
 				uint8_t* t = NULL;
 				size_t tlen = 0;
-				if(!parse_get_cname_target(nx, &t, &tlen))
+				if(!parse_get_cname_target(nx, &t, &tlen, pkt))
 					return 0;
 				if(dname_pkt_compare(pkt, alias, t) == 0) {
 					/* it's OK and better capitalized */
@@ -439,7 +453,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				size_t tlen = 0;
 				if(synth_cname(sname, snamelen, nx, alias,
 					&aliaslen, pkt) &&
-					parse_get_cname_target(rrset, &t, &tlen) &&
+					parse_get_cname_target(rrset, &t, &tlen, pkt) &&
 			   		dname_pkt_compare(pkt, alias, t) == 0) {
 					/* the synthesized CNAME equals the
 					 * current CNAME.  This CNAME is the
@@ -460,7 +474,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			}
 
 			/* move to next name in CNAME chain */
-			if(!parse_get_cname_target(rrset, &sname, &snamelen))
+			if(!parse_get_cname_target(rrset, &sname, &snamelen, pkt))
 				return 0;
 			prev = rrset;
 			rrset = rrset->rrset_all_next;
diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
index 2ab55ceb4977..3c14de86e7b4 100644
--- a/iterator/iter_utils.c
+++ b/iterator/iter_utils.c
@@ -1142,7 +1142,7 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env,
 			log_rrset_key(VERB_ALGO, "found parent-side", akey);
 			ns->done_pside4 = 1;
 			/* a negative-cache-element has no addresses it adds */
-			if(!delegpt_add_rrset_A(dp, region, akey, 1))
+			if(!delegpt_add_rrset_A(dp, region, akey, 1, NULL))
 				log_err("malloc failure in lookup_parent_glue");
 			lock_rw_unlock(&akey->entry.lock);
 		}
@@ -1154,7 +1154,7 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env,
 			log_rrset_key(VERB_ALGO, "found parent-side", akey);
 			ns->done_pside6 = 1;
 			/* a negative-cache-element has no addresses it adds */
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1))
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, NULL))
 				log_err("malloc failure in lookup_parent_glue");
 			lock_rw_unlock(&akey->entry.lock);
 		}
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 1e0113a8740f..9d36660c0b18 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -72,6 +72,8 @@
 /* in msec */
 int UNKNOWN_SERVER_NICENESS = 376;
 
+static void target_count_increase_nx(struct iter_qstate* iq, int num);
+
 int 
 iter_init(struct module_env* env, int id)
 {
@@ -150,6 +152,7 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->sent_count = 0;
 	iq->ratelimit_ok = 0;
 	iq->target_count = NULL;
+	iq->dp_target_count = 0;
 	iq->wait_priming_stub = 0;
 	iq->refetch_glue = 0;
 	iq->dnssec_expected = 0;
@@ -221,6 +224,7 @@ final_state(struct iter_qstate* iq)
 static void
 error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 {
+	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
 	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
 
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
@@ -246,7 +250,11 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 				super->region, super_iq->dp))
 				log_err("out of memory adding missing");
 		}
+		delegpt_mark_neg(dpns, qstate->qinfo.qtype);
 		dpns->resolved = 1; /* mark as failed */
+		if((dpns->got4 == 2 || !ie->supports_ipv4) &&
+			(dpns->got6 == 2 || !ie->supports_ipv6))
+			target_count_increase_nx(super_iq, 1);
 	}
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) {
 		/* prime failed to get delegation */
@@ -621,7 +629,7 @@ static void
 target_count_create(struct iter_qstate* iq)
 {
 	if(!iq->target_count) {
-		iq->target_count = (int*)calloc(2, sizeof(int));
+		iq->target_count = (int*)calloc(3, sizeof(int));
 		/* if calloc fails we simply do not track this number */
 		if(iq->target_count)
 			iq->target_count[0] = 1;
@@ -634,6 +642,15 @@ target_count_increase(struct iter_qstate* iq, int num)
 	target_count_create(iq);
 	if(iq->target_count)
 		iq->target_count[1] += num;
+	iq->dp_target_count++;
+}
+
+static void
+target_count_increase_nx(struct iter_qstate* iq, int num)
+{
+	target_count_create(iq);
+	if(iq->target_count)
+		iq->target_count[2] += num;
 }
 
 /**
@@ -656,13 +673,15 @@ target_count_increase(struct iter_qstate* iq, int num)
  * @param subq_ret: if newly allocated, the subquerystate, or NULL if it does
  * 	not need initialisation.
  * @param v: if true, validation is done on the subquery.
+ * @param detached: true if this qstate should not attach to the subquery
  * @return false on error (malloc).
  */
 static int
 generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype, 
 	uint16_t qclass, struct module_qstate* qstate, int id,
 	struct iter_qstate* iq, enum iter_state initial_state, 
-	enum iter_state finalstate, struct module_qstate** subq_ret, int v)
+	enum iter_state finalstate, struct module_qstate** subq_ret, int v,
+	int detached)
 {
 	struct module_qstate* subq = NULL;
 	struct iter_qstate* subiq = NULL;
@@ -689,11 +708,23 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		valrec = 1;
 	}
 	
-	/* attach subquery, lookup existing or make a new one */
-	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, valrec,
-		&subq)) {
-		return 0;
+	if(detached) {
+		struct mesh_state* sub = NULL;
+		fptr_ok(fptr_whitelist_modenv_add_sub(
+			qstate->env->add_sub));
+		if(!(*qstate->env->add_sub)(qstate, &qinf,
+			qflags, prime, valrec, &subq, &sub)){
+			return 0;
+		}
+	}
+	else {
+		/* attach subquery, lookup existing or make a new one */
+		fptr_ok(fptr_whitelist_modenv_attach_sub(
+			qstate->env->attach_sub));
+		if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime,
+			valrec, &subq)) {
+			return 0;
+		}
 	}
 	*subq_ret = subq;
 	if(subq) {
@@ -716,6 +747,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq->target_count = iq->target_count;
 		if(iq->target_count)
 			iq->target_count[0] ++; /* extra reference */
+		subiq->dp_target_count = 0;
 		subiq->num_current_queries = 0;
 		subiq->depth = iq->depth+1;
 		outbound_list_init(&subiq->outlist);
@@ -759,7 +791,7 @@ prime_root(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 	 * the normal INIT state logic (which would cause an infloop). */
 	if(!generate_sub_request((uint8_t*)"\000", 1, LDNS_RR_TYPE_NS, 
 		qclass, qstate, id, iq, QUERYTARGETS_STATE, PRIME_RESP_STATE,
-		&subq, 0)) {
+		&subq, 0, 0)) {
 		verbose(VERB_ALGO, "could not prime root");
 		return 0;
 	}
@@ -850,7 +882,7 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 	 * redundant INIT state processing. */
 	if(!generate_sub_request(stub_dp->name, stub_dp->namelen, 
 		LDNS_RR_TYPE_NS, qclass, qstate, id, iq,
-		QUERYTARGETS_STATE, PRIME_RESP_STATE, &subq, 0)) {
+		QUERYTARGETS_STATE, PRIME_RESP_STATE, &subq, 0, 0)) {
 		verbose(VERB_ALGO, "could not prime stub");
 		errinf(qstate, "could not generate lookup for stub prime");
 		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -1025,7 +1057,7 @@ generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(!generate_sub_request(s->rk.dname, s->rk.dname_len, 
 			ntohs(s->rk.type), ntohs(s->rk.rrset_class),
 			qstate, id, iq,
-			INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
+			INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) {
 			verbose(VERB_ALGO, "could not generate addr check");
 			return;
 		}
@@ -1069,7 +1101,7 @@ generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 		iq->dp->name, LDNS_RR_TYPE_NS, iq->qchase.qclass);
 	if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 
 		LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq,
-		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
+		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) {
 		verbose(VERB_ALGO, "could not generate ns check");
 		return;
 	}
@@ -1126,7 +1158,7 @@ generate_dnskey_prefetch(struct module_qstate* qstate,
 		iq->dp->name, LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass);
 	if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 
 		LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass, qstate, id, iq,
-		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) {
+		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0)) {
 		/* we'll be slower, but it'll work */
 		verbose(VERB_ALGO, "could not generate dnskey prefetch");
 		return;
@@ -1315,6 +1347,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->refetch_glue = 0;
 			iq->query_restart_count++;
 			iq->sent_count = 0;
+			iq->dp_target_count = 0;
 			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
 			if(qstate->env->cfg->qname_minimisation)
 				iq->minimisation_state = INIT_MINIMISE_STATE;
@@ -1693,7 +1726,7 @@ generate_parentside_target_query(struct module_qstate* qstate,
 {
 	struct module_qstate* subq;
 	if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 
-		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0))
+		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0))
 		return 0;
 	if(subq) {
 		struct iter_qstate* subiq = 
@@ -1744,7 +1777,7 @@ generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq,
 {
 	struct module_qstate* subq;
 	if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 
-		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0))
+		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0))
 		return 0;
 	log_nametypeclass(VERB_QUERY, "new target", name, qtype, qclass);
 	return 1;
@@ -1783,6 +1816,14 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			"number of glue fetches %d", s, iq->target_count[1]);
 		return 0;
 	}
+	if(iq->dp_target_count > MAX_DP_TARGET_COUNT) {
+		char s[LDNS_MAX_DOMAINLEN+1];
+		dname_str(qstate->qinfo.qname, s);
+		verbose(VERB_QUERY, "request %s has exceeded the maximum "
+			"number of glue fetches %d to a single delegation point",
+			s, iq->dp_target_count);
+		return 0;
+	}
 
 	iter_mark_cycle_targets(qstate, iq->dp);
 	missing = (int)delegpt_count_missing_targets(iq->dp);
@@ -1896,7 +1937,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			for(a = p->target_list; a; a=a->next_target) {
 				(void)delegpt_add_addr(iq->dp, qstate->region,
 					&a->addr, a->addrlen, a->bogus,
-					a->lame, a->tls_auth_name);
+					a->lame, a->tls_auth_name, NULL);
 			}
 		}
 		iq->dp->has_parent_side_NS = 1;
@@ -1913,6 +1954,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->refetch_glue = 1;
 			iq->query_restart_count++;
 			iq->sent_count = 0;
+			iq->dp_target_count = 0;
 			if(qstate->env->cfg->qname_minimisation)
 				iq->minimisation_state = INIT_MINIMISE_STATE;
 			return next_state(iq, INIT_REQUEST_STATE);
@@ -2078,7 +2120,7 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 		iq->dsns_point, LDNS_RR_TYPE_NS, iq->qchase.qclass);
 	if(!generate_sub_request(iq->dsns_point, iq->dsns_point_len, 
 		LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq,
-		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) {
+		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0)) {
 		errinf_dname(qstate, "for DS query parent-child nameserver search, could not generate NS lookup for", iq->dsns_point);
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
@@ -2136,6 +2178,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		errinf(qstate, "exceeded the maximum number of sends");
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
+	if(iq->target_count && iq->target_count[2] > MAX_TARGET_NX) {
+		verbose(VERB_QUERY, "request has exceeded the maximum "
+			" number of nxdomain nameserver lookups with %d",
+			iq->target_count[2]);
+		errinf(qstate, "exceeded the maximum nameserver nxdomains");
+		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+	}
 	
 	/* Make sure we have a delegation point, otherwise priming failed
 	 * or another failure occurred */
@@ -2240,12 +2289,41 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 				iq->qinfo_out.qtype, iq->qinfo_out.qclass, 
 				qstate->query_flags, qstate->region, 
 				qstate->env->scratch, 0);
-			if(msg && msg->rep->an_numrrsets == 0
-				&& FLAGS_GET_RCODE(msg->rep->flags) == 
+			if(msg && FLAGS_GET_RCODE(msg->rep->flags) ==
 				LDNS_RCODE_NOERROR)
 				/* no need to send query if it is already 
-				 * cached as NOERROR/NODATA */
+				 * cached as NOERROR */
 				return 1;
+			if(msg && FLAGS_GET_RCODE(msg->rep->flags) ==
+				LDNS_RCODE_NXDOMAIN &&
+				qstate->env->need_to_validate &&
+				qstate->env->cfg->harden_below_nxdomain) {
+				if(msg->rep->security == sec_status_secure) {
+					iq->response = msg;
+					return final_state(iq);
+				}
+				if(msg->rep->security == sec_status_unchecked) {
+					struct module_qstate* subq = NULL;
+					if(!generate_sub_request(
+						iq->qinfo_out.qname,
+						iq->qinfo_out.qname_len,
+						iq->qinfo_out.qtype,
+						iq->qinfo_out.qclass,
+						qstate, id, iq,
+						INIT_REQUEST_STATE,
+						FINISHED_STATE, &subq, 1, 1))
+						verbose(VERB_ALGO,
+						"could not validate NXDOMAIN "
+						"response");
+				}
+			}
+			if(msg && FLAGS_GET_RCODE(msg->rep->flags) ==
+				LDNS_RCODE_NXDOMAIN) {
+				/* return and add a label in the next
+				 * minimisation iteration.
+				 */
+				return 1;
+			}
 		}
 	}
 	if(iq->minimisation_state == SKIP_MINIMISE_STATE) {
@@ -2321,6 +2399,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	 * generated query will immediately be discarded due to depth and
 	 * that servfail is cached, which is not good as opportunism goes. */
 	if(iq->depth < ie->max_dependency_depth
+		&& iq->num_target_queries == 0
+		&& (!iq->target_count || iq->target_count[2]==0)
 		&& iq->sent_count < TARGET_FETCH_STOP) {
 		tf_policy = ie->target_fetch_policy[iq->depth];
 	}
@@ -2366,6 +2446,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->num_current_queries++; /* RespState decrements it*/
 			iq->referral_count++; /* make sure we don't loop */
 			iq->sent_count = 0;
+			iq->dp_target_count = 0;
 			iq->state = QUERY_RESP_STATE;
 			return 1;
 		}
@@ -2453,6 +2534,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 					iq->num_current_queries++; /* RespState decrements it*/
 					iq->referral_count++; /* make sure we don't loop */
 					iq->sent_count = 0;
+					iq->dp_target_count = 0;
 					iq->state = QUERY_RESP_STATE;
 					return 1;
 				}
@@ -2747,7 +2829,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				/* Make subrequest to validate intermediate
 				 * NXDOMAIN if harden-below-nxdomain is
 				 * enabled. */
-				if(qstate->env->cfg->harden_below_nxdomain) {
+				if(qstate->env->cfg->harden_below_nxdomain &&
+					qstate->env->need_to_validate) {
 					struct module_qstate* subq = NULL;
 					log_query_info(VERB_QUERY,
 						"schedule NXDOMAIN validation:",
@@ -2759,16 +2842,10 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 						iq->response->qinfo.qclass,
 						qstate, id, iq,
 						INIT_REQUEST_STATE,
-						FINISHED_STATE, &subq, 1))
+						FINISHED_STATE, &subq, 1, 1))
 						verbose(VERB_ALGO,
 						"could not validate NXDOMAIN "
 						"response");
-					outbound_list_clear(&iq->outlist);
-					iq->num_current_queries = 0;
-					fptr_ok(fptr_whitelist_modenv_detach_subs(
-						qstate->env->detach_subs));
-					(*qstate->env->detach_subs)(qstate);
-					iq->num_target_queries = 0;
 				}
 			}
 			return next_state(iq, QUERYTARGETS_STATE);
@@ -2852,6 +2929,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* Count this as a referral. */
 		iq->referral_count++;
 		iq->sent_count = 0;
+		iq->dp_target_count = 0;
 		/* see if the next dp is a trust anchor, or a DS was sent
 		 * along, indicating dnssec is expected for next zone */
 		iq->dnssec_expected = iter_indicates_dnssec(qstate->env, 
@@ -2928,6 +3006,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->dsns_point = NULL;
 		iq->auth_zone_response = 0;
 		iq->sent_count = 0;
+		iq->dp_target_count = 0;
 		if(iq->minimisation_state != MINIMISE_STATE)
 			/* Only count as query restart when it is not an extra
 			 * query as result of qname minimisation. */
@@ -3120,7 +3199,7 @@ processPrimeResponse(struct module_qstate* qstate, int id)
 		if(!generate_sub_request(qstate->qinfo.qname, 
 			qstate->qinfo.qname_len, qstate->qinfo.qtype,
 			qstate->qinfo.qclass, qstate, id, iq,
-			INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
+			INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) {
 			verbose(VERB_ALGO, "could not generate prime check");
 		}
 		generate_a_aaaa_check(qstate, iq, id);
@@ -3148,6 +3227,7 @@ static void
 processTargetResponse(struct module_qstate* qstate, int id,
 	struct module_qstate* forq)
 {
+	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
 	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
 	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
 	struct ub_packed_rrset_key* rrset;
@@ -3185,7 +3265,7 @@ processTargetResponse(struct module_qstate* qstate, int id,
 		log_rrset_key(VERB_ALGO, "add parentside glue to dp", 
 			iq->pside_glue);
 		if(!delegpt_add_rrset(foriq->dp, forq->region, 
-			iq->pside_glue, 1))
+			iq->pside_glue, 1, NULL))
 			log_err("out of memory adding pside glue");
 	}
 
@@ -3196,6 +3276,7 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	 * response type was ANSWER. */
 	rrset = reply_find_answer_rrset(&iq->qchase, qstate->return_msg->rep);
 	if(rrset) {
+		int additions = 0;
 		/* if CNAMEs have been followed - add new NS to delegpt. */
 		/* BTW. RFC 1918 says NS should not have got CNAMEs. Robust. */
 		if(!delegpt_find_ns(foriq->dp, rrset->rk.dname, 
@@ -3207,13 +3288,23 @@ processTargetResponse(struct module_qstate* qstate, int id,
 		}
 		/* if dpns->lame then set the address(es) lame too */
 		if(!delegpt_add_rrset(foriq->dp, forq->region, rrset, 
-			dpns->lame))
+			dpns->lame, &additions))
 			log_err("out of memory adding targets");
+		if(!additions) {
+			/* no new addresses, increase the nxns counter, like
+			 * this could be a list of wildcards with no new
+			 * addresses */
+			target_count_increase_nx(foriq, 1);
+		}
 		verbose(VERB_ALGO, "added target response");
 		delegpt_log(VERB_ALGO, foriq->dp);
 	} else {
 		verbose(VERB_ALGO, "iterator TargetResponse failed");
+		delegpt_mark_neg(dpns, qstate->qinfo.qtype);
 		dpns->resolved = 1; /* fail the target */
+		if((dpns->got4 == 2 || !ie->supports_ipv4) &&
+			(dpns->got6 == 2 || !ie->supports_ipv6))
+			target_count_increase_nx(foriq, 1);
 	}
 }
 
@@ -3387,7 +3478,7 @@ processCollectClass(struct module_qstate* qstate, int id)
 				qstate->qinfo.qname_len, qstate->qinfo.qtype,
 				c, qstate, id, iq, INIT_REQUEST_STATE,
 				FINISHED_STATE, &subq, 
-				(int)!(qstate->query_flags&BIT_CD))) {
+				(int)!(qstate->query_flags&BIT_CD), 0)) {
 				errinf(qstate, "could not generate class ANY"
 					" lookup query");
 				return error_response(qstate, id, 
diff --git a/iterator/iterator.h b/iterator/iterator.h
index a2f1b5705e70..53dcab3b18b2 100644
--- a/iterator/iterator.h
+++ b/iterator/iterator.h
@@ -55,6 +55,11 @@ struct rbtree_type;
 
 /** max number of targets spawned for a query and its subqueries */
 #define MAX_TARGET_COUNT	64
+/** max number of target lookups per qstate, per delegation point */
+#define MAX_DP_TARGET_COUNT	16
+/** max number of nxdomains allowed for target lookups for a query and
+ * its subqueries */
+#define MAX_TARGET_NX		5
 /** max number of query restarts. Determines max number of CNAME chain. */
 #define MAX_RESTART_COUNT       8
 /** max number of referrals. Makes sure resolver does not run away */
@@ -305,9 +310,14 @@ struct iter_qstate {
 	int sent_count;
 	
 	/** number of target queries spawned in [1], for this query and its
-	 * subqueries, the malloced-array is shared, [0] refcount. */
+	 * subqueries, the malloced-array is shared, [0] refcount.
+	 * in [2] the number of nxdomains is counted. */
 	int* target_count;
 
+	/** number of target lookups per delegation point. Reset to 0 after
+	 * receiving referral answer. Not shared with subqueries. */
+	int dp_target_count;
+
 	/** if true, already tested for ratelimiting and passed the test */
 	int ratelimit_ok;
 
diff --git a/libunbound/context.c b/libunbound/context.c
index b8fe87d2e580..6d62e32b50fd 100644
--- a/libunbound/context.c
+++ b/libunbound/context.c
@@ -55,6 +55,7 @@
 int 
 context_finalize(struct ub_ctx* ctx)
 {
+	int is_rpz = 0;
 	struct config_file* cfg = ctx->env->cfg;
 	verbosity = cfg->verbosity;
 	if(ctx_logfile_overridden && !ctx->logfile_override) {
@@ -76,7 +77,7 @@ context_finalize(struct ub_ctx* ctx)
 		return UB_NOMEM;
 	if(!local_zones_apply_cfg(ctx->local_zones, cfg))
 		return UB_INITFAIL;
-	if(!auth_zones_apply_cfg(ctx->env->auth_zones, cfg, 1))
+	if(!auth_zones_apply_cfg(ctx->env->auth_zones, cfg, 1, &is_rpz))
 		return UB_INITFAIL;
 	if(!slabhash_is_size(ctx->env->msg_cache, cfg->msg_cache_size,
 		cfg->msg_cache_slabs)) {
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index 5c62017a0fc2..6cb97ff1fd4a 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -561,7 +561,6 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	if(!qinfo->qname) {
 		return 0;
 	}
-	qinfo->local_alias = NULL;
 	edns->edns_present = 1;
 	edns->ext_rcode = 0;
 	edns->edns_version = 0;
diff --git a/libunbound/unbound.h b/libunbound/unbound.h
index 682ba55308c6..ca9592d62d52 100644
--- a/libunbound/unbound.h
+++ b/libunbound/unbound.h
@@ -204,8 +204,9 @@ struct ub_result {
 	char* why_bogus;
 
 	/**
-	 * If the query or one of its subqueries was ratelimited. Useful if
-	 * ratelimiting is enabled and answer is SERVFAIL.
+	 * If the query or one of its subqueries was ratelimited.  Useful if
+	 * ratelimiting is enabled and answer to the client is SERVFAIL as a
+	 * result.
 	 */
 	int was_ratelimited;
 
@@ -654,6 +655,8 @@ struct ub_shm_stat_info {
 #define UB_STATS_OPCODE_NUM 16
 /** number of histogram buckets */
 #define UB_STATS_BUCKET_NUM 40
+/** number of RPZ actions */
+#define UB_STATS_RPZ_ACTION_NUM 10
 
 /** per worker statistics. */
 struct ub_server_stats {
@@ -733,8 +736,8 @@ struct ub_server_stats {
 	long long unwanted_queries;
 	/** usage of tcp accept list */
 	long long tcp_accept_usage;
-	/** answers served from expired cache */
-	long long zero_ttl_responses;
+	/** expired answers served from cache */
+	long long ans_expired;
 	/** histogram data exported to array 
 	 * if the array is the same size, no data is lost, and
 	 * if all histograms are same size (is so by default) then
@@ -785,6 +788,8 @@ struct ub_server_stats {
 	long long mem_stream_wait;
 	/** number of TLS connection resume */
 	long long qtls_resume;
+	/** RPZ action stats */
+	long long rpz_action[UB_STATS_RPZ_ACTION_NUM];
 };
 
 /** 
diff --git a/respip/respip.c b/respip/respip.c
index 632a9df64756..f504f55791ac 100644
--- a/respip/respip.c
+++ b/respip/respip.c
@@ -12,6 +12,7 @@
 #include "config.h"
 
 #include "services/localzone.h"
+#include "services/authzone.h"
 #include "services/cache/dns.h"
 #include "sldns/str2wire.h"
 #include "util/config_file.h"
@@ -25,30 +26,6 @@
 #include "services/view.h"
 #include "sldns/rrdef.h"
 
-/**
- * Conceptual set of IP addresses for response AAAA or A records that should
- * trigger special actions.
- */
-struct respip_set {
-	struct regional* region;
-	struct rbtree_type ip_tree;
-	char* const* tagname;	/* shallow copy of tag names, for logging */
-	int num_tags;		/* number of tagname entries */
-};
-
-/** An address span with response control information */
-struct resp_addr {
-	/** node in address tree */
-	struct addr_tree_node node;
-	/** tag bitlist */
-	uint8_t* taglist;
-	/** length of the taglist (in bytes) */
-	size_t taglen;
-	/** action for this address span */
-	enum respip_action action;
-        /** "local data" for this node */
-	struct ub_packed_rrset_key* data;
-};
 
 /** Subset of resp_addr.node, used for inform-variant logging */
 struct respip_addr_info {
@@ -88,14 +65,28 @@ respip_set_create(void)
 		return NULL;
 	}
 	addr_tree_init(&set->ip_tree);
+	lock_rw_init(&set->lock);
 	return set;
 }
 
+/** helper traverse to delete resp_addr nodes */
+static void
+resp_addr_del(rbnode_type* n, void* ATTR_UNUSED(arg))
+{
+	struct resp_addr* r = (struct resp_addr*)n->key;
+	lock_rw_destroy(&r->lock);
+#ifdef THREADS_DISABLED
+	(void)r;
+#endif
+}
+
 void
 respip_set_delete(struct respip_set* set)
 {
 	if(!set)
 		return;
+	lock_rw_destroy(&set->lock);
+	traverse_postorder(&set->ip_tree, resp_addr_del, NULL);
 	regional_destroy(set->region);
 	free(set);
 }
@@ -108,29 +99,21 @@ respip_set_get_tree(struct respip_set* set)
 	return &set->ip_tree;
 }
 
-/** returns the node in the address tree for the specified netblock string;
- * non-existent node will be created if 'create' is true */
-static struct resp_addr*
-respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
+struct resp_addr*
+respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage* addr,
+		socklen_t addrlen, int net, int create, const char* ipstr)
 {
 	struct resp_addr* node;
-	struct sockaddr_storage addr;
-	int net;
-	socklen_t addrlen;
-
-	if(!netblockstrtoaddr(ipstr, 0, &addr, &addrlen, &net)) {
-		log_err("cannot parse netblock: '%s'", ipstr);
-		return NULL;
-	}
-	node = (struct resp_addr*)addr_tree_find(&set->ip_tree, &addr, addrlen, net);
+	node = (struct resp_addr*)addr_tree_find(&set->ip_tree, addr, addrlen, net);
 	if(!node && create) {
 		node = regional_alloc_zero(set->region, sizeof(*node));
 		if(!node) {
 			log_err("out of memory");
 			return NULL;
 		}
+		lock_rw_init(&node->lock);
 		node->action = respip_none;
-		if(!addr_tree_insert(&set->ip_tree, &node->node, &addr,
+		if(!addr_tree_insert(&set->ip_tree, &node->node, addr,
 			addrlen, net)) {
 			/* We know we didn't find it, so this should be
 			 * impossible. */
@@ -140,6 +123,37 @@ respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
 	return node;
 }
 
+void
+respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node)
+{
+	struct resp_addr* prev;
+	prev = (struct resp_addr*)rbtree_previous((struct rbnode_type*)node);	
+	lock_rw_destroy(&node->lock);
+	rbtree_delete(&set->ip_tree, node);
+	/* no free'ing, all allocated in region */
+	if(!prev)
+		addr_tree_init_parents((rbtree_type*)set);
+	else
+		addr_tree_init_parents_node(&prev->node);
+}
+
+/** returns the node in the address tree for the specified netblock string;
+ * non-existent node will be created if 'create' is true */
+static struct resp_addr*
+respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
+{
+	struct sockaddr_storage addr;
+	int net;
+	socklen_t addrlen;
+
+	if(!netblockstrtoaddr(ipstr, 0, &addr, &addrlen, &net)) {
+		log_err("cannot parse netblock: '%s'", ipstr);
+		return NULL;
+	}
+	return respip_sockaddr_find_or_create(set, &addr, addrlen, net, create,
+		ipstr);
+}
+
 static int
 respip_tag_cfg(struct respip_set* set, const char* ipstr,
 	const uint8_t* taglist, size_t taglen)
@@ -191,6 +205,10 @@ respip_action_cfg(struct respip_set* set, const char* ipstr,
                 action = respip_always_refuse;
         else if(strcmp(actnstr, "always_nxdomain") == 0)
                 action = respip_always_nxdomain;
+        else if(strcmp(actnstr, "always_nodata") == 0)
+                action = respip_always_nodata;
+        else if(strcmp(actnstr, "always_deny") == 0)
+                action = respip_always_deny;
         else {
                 log_err("unknown response-ip action %s", actnstr);
                 return 0;
@@ -232,8 +250,43 @@ new_rrset(struct regional* region, uint16_t rrtype, uint16_t rrclass)
 }
 
 /** enter local data as resource records into a response-ip node */
-static int
+
+int
 respip_enter_rr(struct regional* region, struct resp_addr* raddr,
+	uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata,
+	size_t rdata_len, const char* rrstr, const char* netblockstr)
+{
+	struct packed_rrset_data* pd;
+	struct sockaddr* sa;
+	sa = (struct sockaddr*)&raddr->node.addr;
+	if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data) {
+		log_err("CNAME response-ip data (%s) can not co-exist with other "
+			"response-ip data for netblock %s", rrstr, netblockstr);
+		return 0;
+	} else if (raddr->data &&
+		raddr->data->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
+		log_err("response-ip data (%s) can not be added; CNAME response-ip "
+			"data already in place for netblock %s", rrstr, netblockstr);
+		return 0;
+	} else if((rrtype != LDNS_RR_TYPE_CNAME) &&
+		((sa->sa_family == AF_INET && rrtype != LDNS_RR_TYPE_A) ||
+		(sa->sa_family == AF_INET6 && rrtype != LDNS_RR_TYPE_AAAA))) {
+		log_err("response-ip data %s record type does not correspond "
+			"to netblock %s address family", rrstr, netblockstr);
+		return 0;
+	}
+
+	if(!raddr->data) {
+		raddr->data = new_rrset(region, rrtype, rrclass);
+		if(!raddr->data)
+			return 0;
+	}
+	pd = raddr->data->entry.data;
+	return rrset_insert_rr(region, pd, rdata, rdata_len, ttl, rrstr);
+}
+
+static int
+respip_enter_rrstr(struct regional* region, struct resp_addr* raddr,
 		const char* rrstr, const char* netblock)
 {
 	uint8_t* nm;
@@ -244,8 +297,6 @@ respip_enter_rr(struct regional* region, struct resp_addr* raddr,
 	size_t rdata_len = 0;
 	char buf[65536];
 	char bufshort[64];
-	struct packed_rrset_data* pd;
-	struct sockaddr* sa;
 	int ret;
 	if(raddr->action != respip_redirect
 		&& raddr->action != respip_inform_redirect) {
@@ -265,31 +316,8 @@ respip_enter_rr(struct regional* region, struct resp_addr* raddr,
 		return 0;
 	}
 	free(nm);
-	sa = (struct sockaddr*)&raddr->node.addr;
-	if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data) {
-		log_err("CNAME response-ip data (%s) can not co-exist with other "
-			"response-ip data for netblock %s", rrstr, netblock);
-		return 0;
-	} else if (raddr->data &&
-		raddr->data->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
-		log_err("response-ip data (%s) can not be added; CNAME response-ip "
-			"data already in place for netblock %s", rrstr, netblock);
-		return 0;
-	} else if((rrtype != LDNS_RR_TYPE_CNAME) &&
-		((sa->sa_family == AF_INET && rrtype != LDNS_RR_TYPE_A) ||
-		(sa->sa_family == AF_INET6 && rrtype != LDNS_RR_TYPE_AAAA))) {
-		log_err("response-ip data %s record type does not correspond "
-			"to netblock %s address family", rrstr, netblock);
-		return 0;
-	}
-
-	if(!raddr->data) {
-		raddr->data = new_rrset(region, rrtype, rrclass);
-		if(!raddr->data)
-			return 0;
-	}
-	pd = raddr->data->entry.data;
-	return rrset_insert_rr(region, pd, rdata, rdata_len, ttl, rrstr);
+	return respip_enter_rr(region, raddr, rrtype, rrclass, ttl, rdata,
+		rdata_len, rrstr, netblock);
 }
 
 static int
@@ -303,7 +331,7 @@ respip_data_cfg(struct respip_set* set, const char* ipstr, const char* rrstr)
 			"response-ip node for %s not found", rrstr, ipstr);
 		return 0;
 	}
-	return respip_enter_rr(set->region, node, rrstr, ipstr);
+	return respip_enter_rrstr(set->region, node, rrstr, ipstr);
 }
 
 static int
@@ -564,9 +592,10 @@ rdata2sockaddr(const struct packed_rrset_data* rd, uint16_t rtype, size_t i,
  * rep->rrsets for the RRset that contains the matching IP address record
  * (the index is normally 0, but can be larger than that if this is a CNAME
  * chain or type-ANY response).
+ * Returns resp_addr holding read lock.
  */
-static const struct resp_addr*
-respip_addr_lookup(const struct reply_info *rep, struct rbtree_type* iptree,
+static struct resp_addr*
+respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs,
 	size_t* rrset_id)
 {
 	size_t i;
@@ -574,6 +603,7 @@ respip_addr_lookup(const struct reply_info *rep, struct rbtree_type* iptree,
 	struct sockaddr_storage ss;
 	socklen_t addrlen;
 
+	lock_rw_rdlock(&rs->lock);
 	for(i=0; i<rep->an_numrrsets; i++) {
 		size_t j;
 		const struct packed_rrset_data* rd;
@@ -585,15 +615,17 @@ respip_addr_lookup(const struct reply_info *rep, struct rbtree_type* iptree,
 		for(j = 0; j < rd->count; j++) {
 			if(!rdata2sockaddr(rd, rtype, j, &ss, &addrlen))
 				continue;
-			ra = (struct resp_addr*)addr_tree_lookup(iptree, &ss,
-				addrlen);
+			ra = (struct resp_addr*)addr_tree_lookup(&rs->ip_tree,
+				&ss, addrlen);
 			if(ra) {
 				*rrset_id = i;
+				lock_rw_rdlock(&ra->lock);
+				lock_rw_unlock(&rs->lock);
 				return ra;
 			}
 		}
 	}
-
+	lock_rw_unlock(&rs->lock);
 	return NULL;
 }
 
@@ -642,8 +674,8 @@ make_new_reply_info(const struct reply_info* rep, struct regional* region,
  * Note that this function distinguishes error conditions from "success but
  * not overridden".  This is because we want to avoid accidentally applying
  * the "no data" action in case of error.
- * @param raddr: address span that requires an action
  * @param action: action to apply
+ * @param data: RRset to use for override
  * @param qtype: original query type
  * @param rep: original reply message
  * @param rrset_id: the rrset ID in 'rep' to which the action should apply
@@ -658,14 +690,15 @@ make_new_reply_info(const struct reply_info* rep, struct regional* region,
  * @return 1 if overridden, 0 if not overridden, -1 on error.
  */
 static int
-respip_data_answer(const struct resp_addr* raddr, enum respip_action action,
+respip_data_answer(enum respip_action action,
+	struct ub_packed_rrset_key* data,
 	uint16_t qtype, const struct reply_info* rep,
 	size_t rrset_id, struct reply_info** new_repp, int tag,
 	struct config_strlist** tag_datas, size_t tag_datas_size,
 	char* const* tagname, int num_tags,
 	struct ub_packed_rrset_key** redirect_rrsetp, struct regional* region)
 {
-	struct ub_packed_rrset_key* rp = raddr->data;
+	struct ub_packed_rrset_key* rp = data;
 	struct reply_info* new_rep;
 	*redirect_rrsetp = NULL;
 
@@ -703,7 +736,7 @@ respip_data_answer(const struct resp_addr* raddr, enum respip_action action,
 	 * to replace the rrset's dname.  Note that, unlike local data, we
 	 * rename the dname for other actions than redirect.  This is because
 	 * response-ip-data isn't associated to any specific name. */
-	if(rp == raddr->data) {
+	if(rp == data) {
 		rp = copy_rrset(rp, region);
 		if(!rp)
 			return -1;
@@ -761,6 +794,7 @@ respip_nodata_answer(uint16_t qtype, enum respip_action action,
 		return 1;
 	} else if(action == respip_static || action == respip_redirect ||
 		action == respip_always_nxdomain ||
+		action == respip_always_nodata ||
 		action == respip_inform_redirect) {
 		/* Since we don't know about other types of the owner name,
 		 * we generally return NOERROR/NODATA unless an NXDOMAIN action
@@ -794,16 +828,22 @@ populate_action_info(struct respip_action_info* actinfo,
 	enum respip_action action, const struct resp_addr* raddr,
 	const struct ub_packed_rrset_key* ATTR_UNUSED(rrset),
 	int ATTR_UNUSED(tag), const struct respip_set* ATTR_UNUSED(ipset),
-	int ATTR_UNUSED(action_only), struct regional* region)
+	int ATTR_UNUSED(action_only), struct regional* region, int rpz_used,
+	int rpz_log, char* log_name, int rpz_cname_override)
 {
 	if(action == respip_none || !raddr)
 		return 1;
 	actinfo->action = action;
+	actinfo->rpz_used = rpz_used;
+	actinfo->rpz_log = rpz_log;
+	actinfo->log_name = log_name;
+	actinfo->rpz_cname_override = rpz_cname_override;
 
 	/* for inform variants, make a copy of the matched address block for
 	 * later logging.  We make a copy to proactively avoid disruption if
 	 *  and when we allow a dynamic update to the respip tree. */
-	if(action == respip_inform || action == respip_inform_deny) {
+	if(action == respip_inform || action == respip_inform_deny ||
+		rpz_used) {
 		struct respip_addr_info* a =
 			regional_alloc_zero(region, sizeof(*a));
 		if(!a) {
@@ -819,12 +859,39 @@ populate_action_info(struct respip_action_info* actinfo,
 	return 1;
 }
 
+static int
+respip_use_rpz(struct resp_addr* raddr, struct rpz* r,
+	enum respip_action* action,
+	struct ub_packed_rrset_key** data, int* rpz_log, char** log_name,
+	int* rpz_cname_override, struct regional* region, int* is_rpz)
+{
+	if(r->action_override == RPZ_DISABLED_ACTION) {
+		*is_rpz = 0;
+		return 1;
+	}
+	else if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
+		*action = raddr->action;
+	else
+		*action = rpz_action_to_respip_action(r->action_override);
+	if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION &&
+		r->cname_override) {
+		*data = r->cname_override;
+		*rpz_cname_override = 1;
+	}
+	*rpz_log = r->log;
+	if(r->log_name)
+		if(!(*log_name = regional_strdup(region, r->log_name)))
+			return 0;
+	*is_rpz = 1;
+	return 1;
+}
+
 int
 respip_rewrite_reply(const struct query_info* qinfo,
 	const struct respip_client_info* cinfo, const struct reply_info* rep,
 	struct reply_info** new_repp, struct respip_action_info* actinfo,
 	struct ub_packed_rrset_key** alias_rrset, int search_only,
-	struct regional* region)
+	struct regional* region, struct auth_zones* az)
 {
 	const uint8_t* ctaglist;
 	size_t ctaglen;
@@ -837,9 +904,15 @@ respip_rewrite_reply(const struct query_info* qinfo,
 	size_t rrset_id = 0;
 	enum respip_action action = respip_none;
 	int tag = -1;
-	const struct resp_addr* raddr = NULL;
+	struct resp_addr* raddr = NULL;
 	int ret = 1;
 	struct ub_packed_rrset_key* redirect_rrset = NULL;
+	struct rpz* r;
+	struct ub_packed_rrset_key* data = NULL;
+	int rpz_used = 0;
+	int rpz_log = 0;
+	int rpz_cname_override = 0;
+	char* log_name = NULL;
 
 	if(!cinfo)
 		goto done;
@@ -852,6 +925,8 @@ respip_rewrite_reply(const struct query_info* qinfo,
 	view = cinfo->view;
 	ipset = cinfo->respip_set;
 
+	log_assert(ipset);
+
 	/** Try to use response-ip config from the view first; use
 	  * global response-ip config if we don't have the view or we don't
 	  * have the matching per-view config (and the view allows the use
@@ -866,7 +941,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 		lock_rw_rdlock(&view->lock);
 		if(view->respip_set) {
 			if((raddr = respip_addr_lookup(rep,
-				&view->respip_set->ip_tree, &rrset_id))) {
+				view->respip_set, &rrset_id))) {
 				/** for per-view respip directives the action
 				 * can only be direct (i.e. not tag-based) */
 				action = raddr->action;
@@ -875,7 +950,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 		if(!raddr && !view->isfirst)
 			goto done;
 	}
-	if(!raddr && ipset && (raddr = respip_addr_lookup(rep, &ipset->ip_tree,
+	if(!raddr && (raddr = respip_addr_lookup(rep, ipset,
 		&rrset_id))) {
 		action = (enum respip_action)local_data_find_tag_action(
 			raddr->taglist, raddr->taglen, ctaglist, ctaglen,
@@ -883,6 +958,29 @@ respip_rewrite_reply(const struct query_info* qinfo,
 			(enum localzone_type)raddr->action, &tag,
 			ipset->tagname, ipset->num_tags);
 	}
+	lock_rw_rdlock(&az->rpz_lock);
+	for(r = az->rpz_first; r && !raddr; r = r->next) {
+		if(!r->taglist || taglist_intersect(r->taglist, 
+			r->taglistlen, ctaglist, ctaglen)) {
+			if((raddr = respip_addr_lookup(rep,
+				r->respip_set, &rrset_id))) {
+				if(!respip_use_rpz(raddr, r, &action, &data,
+					&rpz_log, &log_name, &rpz_cname_override,
+					region, &rpz_used)) {
+					log_err("out of memory");
+					lock_rw_unlock(&raddr->lock);
+					lock_rw_unlock(&az->rpz_lock);
+					return 0;
+				}
+				if(!rpz_used) {
+					lock_rw_unlock(&raddr->lock);
+					raddr = NULL;
+					actinfo->rpz_disabled++;
+				}
+			}
+		}	
+	}
+	lock_rw_unlock(&az->rpz_lock);
 	if(raddr && !search_only) {
 		int result = 0;
 
@@ -891,10 +989,13 @@ respip_rewrite_reply(const struct query_info* qinfo,
 		if(action != respip_always_refuse
 			&& action != respip_always_transparent
 			&& action != respip_always_nxdomain
-			&& (result = respip_data_answer(raddr, action,
-			qinfo->qtype, rep, rrset_id, new_repp, tag, tag_datas,
-			tag_datas_size, ipset->tagname, ipset->num_tags,
-			&redirect_rrset, region)) < 0) {
+			&& action != respip_always_nodata
+			&& action != respip_always_deny
+			&& (result = respip_data_answer(action,
+			(data) ? data : raddr->data, qinfo->qtype, rep,
+			rrset_id, new_repp, tag, tag_datas, tag_datas_size,
+			ipset->tagname, ipset->num_tags, &redirect_rrset,
+			region)) < 0) {
 			ret = 0;
 			goto done;
 		}
@@ -925,7 +1026,11 @@ respip_rewrite_reply(const struct query_info* qinfo,
 			*alias_rrset = redirect_rrset;
 		/* on success, populate respip result structure */
 		ret = populate_action_info(actinfo, action, raddr,
-			redirect_rrset, tag, ipset, search_only, region);
+			redirect_rrset, tag, ipset, search_only, region,
+				rpz_used, rpz_log, log_name, rpz_cname_override);
+	}
+	if(raddr) {
+		lock_rw_unlock(&raddr->lock);
 	}
 	return ret;
 }
@@ -981,14 +1086,15 @@ respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA ||
 			qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) &&
 			qstate->return_msg && qstate->return_msg->rep) {
-			struct respip_action_info actinfo = {respip_none, NULL};
 			struct reply_info* new_rep = qstate->return_msg->rep;
 			struct ub_packed_rrset_key* alias_rrset = NULL;
+			struct respip_action_info actinfo = {0};
+			actinfo.action = respip_none;
 
 			if(!respip_rewrite_reply(&qstate->qinfo,
 				qstate->client_info, qstate->return_msg->rep,
 				&new_rep, &actinfo, &alias_rrset, 0,
-				qstate->region)) {
+				qstate->region, qstate->env->auth_zones)) {
 				goto servfail;
 			}
 			if(actinfo.action != respip_none) {
@@ -1004,9 +1110,10 @@ respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			} else {
 				qstate->respip_action_info = NULL;
 			}
-			if (new_rep == qstate->return_msg->rep &&
+			if (actinfo.action == respip_always_deny ||
+				(new_rep == qstate->return_msg->rep &&
 				(actinfo.action == respip_deny ||
-				actinfo.action == respip_inform_deny)) {
+				actinfo.action == respip_inform_deny))) {
 				/* for deny-variant actions (unless response-ip
 				 * data is applied), mark the query state so
 				 * the response will be dropped for all
@@ -1034,14 +1141,16 @@ int
 respip_merge_cname(struct reply_info* base_rep,
 	const struct query_info* qinfo, const struct reply_info* tgt_rep,
 	const struct respip_client_info* cinfo, int must_validate,
-	struct reply_info** new_repp, struct regional* region)
+	struct reply_info** new_repp, struct regional* region,
+	struct auth_zones* az)
 {
 	struct reply_info* new_rep;
 	struct reply_info* tmp_rep = NULL; /* just a placeholder */
 	struct ub_packed_rrset_key* alias_rrset = NULL; /* ditto */
 	uint16_t tgt_rcode;
 	size_t i, j;
-	struct respip_action_info actinfo = {respip_none, NULL};
+	struct respip_action_info actinfo = {0};
+	actinfo.action = respip_none;
 
 	/* If the query for the CNAME target would result in an unusual rcode,
 	 * we generally translate it as a failure for the base query
@@ -1060,7 +1169,7 @@ respip_merge_cname(struct reply_info* base_rep,
 
 	/* see if the target reply would be subject to a response-ip action. */
 	if(!respip_rewrite_reply(qinfo, cinfo, tgt_rep, &tmp_rep, &actinfo,
-		&alias_rrset, 1, region))
+		&alias_rrset, 1, region, az))
 		return 0;
 	if(actinfo.action != respip_none) {
 		log_info("CNAME target of redirect response-ip action would "
@@ -1112,7 +1221,8 @@ respip_inform_super(struct module_qstate* qstate, int id,
 
 	if(!respip_merge_cname(super->return_msg->rep, &qstate->qinfo,
 		qstate->return_msg->rep, super->client_info,
-		super->env->need_to_validate, &new_rep, super->region))
+		super->env->need_to_validate, &new_rep, super->region,
+		qstate->env->auth_zones))
 		goto fail;
 	super->return_msg->rep = new_rep;
 	return;
@@ -1171,12 +1281,15 @@ respip_set_is_empty(const struct respip_set* set)
 }
 
 void
-respip_inform_print(struct respip_addr_info* respip_addr, uint8_t* qname,
+respip_inform_print(struct respip_action_info* respip_actinfo, uint8_t* qname,
 	uint16_t qtype, uint16_t qclass, struct local_rrset* local_alias,
 	struct comm_reply* repinfo)
 {
 	char srcip[128], respip[128], txt[512];
 	unsigned port;
+	struct respip_addr_info* respip_addr = respip_actinfo->addrinfo;
+	size_t txtlen = 0;
+	const char* actionstr = NULL;
 
 	if(local_alias)
 		qname = local_alias->rrset->rk.dname;
@@ -1186,7 +1299,23 @@ respip_inform_print(struct respip_addr_info* respip_addr, uint8_t* qname,
 	addr_to_str(&repinfo->addr, repinfo->addrlen, srcip, sizeof(srcip));
 	addr_to_str(&respip_addr->addr, respip_addr->addrlen,
 		respip, sizeof(respip));
-	snprintf(txt, sizeof(txt), "%s/%d inform %s@%u", respip,
-		respip_addr->net, srcip, port);
+	if(respip_actinfo->rpz_log) {
+		txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen, "%s",
+			"RPZ applied ");
+		if(respip_actinfo->rpz_cname_override)
+			actionstr = rpz_action_to_string(
+				RPZ_CNAME_OVERRIDE_ACTION);
+		else
+			actionstr = rpz_action_to_string(
+				respip_action_to_rpz_action(
+					respip_actinfo->action));
+	}
+	if(respip_actinfo->log_name) {
+		txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen,
+			"[%s] ", respip_actinfo->log_name);
+	}
+	snprintf(txt+txtlen, sizeof(txt)-txtlen,
+		"%s/%d %s %s@%u", respip, respip_addr->net,
+		(actionstr) ? actionstr : "inform", srcip, port);
 	log_nametypeclass(NO_VERBOSE, txt, qname, qtype, qclass);
 }
diff --git a/respip/respip.h b/respip/respip.h
index 01309caece51..bbd471421c1e 100644
--- a/respip/respip.h
+++ b/respip/respip.h
@@ -14,23 +14,42 @@
 
 #include "util/module.h"
 #include "services/localzone.h"
+#include "util/locks.h"
 
 /**
- * Set of response IP addresses with associated actions and tags. 
- * Forward declaration only here.  Actual definition is hidden within the
- * module.
+ * Conceptual set of IP addresses for response AAAA or A records that should
+ * trigger special actions.
  */
-struct respip_set;
+struct respip_set {
+	struct regional* region;
+	struct rbtree_type ip_tree;
+	lock_rw_type lock;	/* lock on the respip tree */
+	char* const* tagname;	/* shallow copy of tag names, for logging */
+	int num_tags;		/* number of tagname entries */
+};
+
+
+/** An address span with response control information */
+struct resp_addr {
+	/** node in address tree */
+	struct addr_tree_node node;
+	/** lock on the node item */
+	lock_rw_type lock;
+	/** tag bitlist */
+	uint8_t* taglist;
+	/** length of the taglist (in bytes) */
+	size_t taglen;
+	/** action for this address span */
+	enum respip_action action;
+        /** "local data" for this node */
+	struct ub_packed_rrset_key* data;
+};
 
-/**
- * Forward declaration for the structure that represents a node in the
- * respip_set address tree
- */
-struct resp_addr;
 
 /**
  * Forward declaration for the structure that represents a tree of view data.
  */
+
 struct views;
 
 struct respip_addr_info;
@@ -60,6 +79,11 @@ struct respip_client_info {
  */
 struct respip_action_info {
 	enum respip_action action;
+	int rpz_used;
+	int rpz_log;
+	int rpz_disabled;
+	char* log_name;
+	int rpz_cname_override;
 	struct respip_addr_info* addrinfo; /* set only for inform variants */
 };
 
@@ -124,12 +148,14 @@ int respip_views_apply_cfg(struct views* vs, struct config_file* cfg,
  * @param new_repp: pointer placeholder for the merged reply.  will be intact
  *   on error.
  * @param region: allocator to build *new_repp.
+ * @param az: auth zones containing RPZ information.
  * @return 1 on success, 0 on error.
  */
 int respip_merge_cname(struct reply_info* base_rep,
 	const struct query_info* qinfo, const struct reply_info* tgt_rep,
 	const struct respip_client_info* cinfo, int must_validate,
-	struct reply_info** new_repp, struct regional* region);
+	struct reply_info** new_repp, struct regional* region,
+	struct auth_zones* az);
 
 /**
  * See if any IP-based action should apply to any IP address of AAAA/A answer
@@ -148,6 +174,7 @@ int respip_merge_cname(struct reply_info* base_rep,
  * @param alias_rrset: must not be NULL.
  * @param search_only: if true, only check if an action would apply.  actionp
  *   will be set (or intact) accordingly but the modified reply won't be built.
+ * @param az: auth zones containing RPZ information.
  * @param region: allocator to build *new_repp.
  * @return 1 on success, 0 on error.
  */
@@ -156,7 +183,7 @@ int respip_rewrite_reply(const struct query_info* qinfo,
 	const struct reply_info *rep, struct reply_info** new_repp,
 	struct respip_action_info* actinfo,
 	struct ub_packed_rrset_key** alias_rrset,
-	int search_only, struct regional* region);
+	int search_only, struct regional* region, struct auth_zones* az);
 
 /**
  * Get the response-ip function block.
@@ -213,7 +240,7 @@ int respip_set_is_empty(const struct respip_set* set);
 /**
  * print log information for a query subject to an inform or inform-deny
  * response-ip action.
- * @param respip_addr: response-ip information that causes the action
+ * @param respip_actinfo: response-ip information that causes the action
  * @param qname: query name in the context, will be ignored if local_alias is
  *   non-NULL.
  * @param qtype: query type, in host byte order.
@@ -223,8 +250,48 @@ int respip_set_is_empty(const struct respip_set* set);
  *  query name.
  * @param repinfo: reply info containing the client's source address and port.
  */
-void respip_inform_print(struct respip_addr_info* respip_addr, uint8_t* qname,
-	uint16_t qtype, uint16_t qclass, struct local_rrset* local_alias,
-	struct comm_reply* repinfo);
+void respip_inform_print(struct respip_action_info* respip_actinfo,
+	uint8_t* qname, uint16_t qtype, uint16_t qclass,
+	struct local_rrset* local_alias, struct comm_reply* repinfo);
 
+/**
+ * Find resp_addr in tree, create and add to tree if it does not exist.
+ * @param set: struct containing the tree and region to alloc new node on.
+ * 	should hold write lock.
+ * @param addr: address to look up.
+ * @param addrlen: length of addr.
+ * @param net: netblock to lookup.
+ * @param create: create node if it does not exist when 1.
+ * @param ipstr: human redable ip string, for logging.
+ * @return newly created of found node, not holding lock.
+ */
+struct resp_addr*
+respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage* addr,
+		socklen_t addrlen, int net, int create, const char* ipstr);
+
+/**
+ * Add RR to resp_addr's RRset. Create RRset if not existing.
+ * @param region: region to alloc RR(set).
+ * @param raddr: resp_addr containing RRset. Must hold write lock.
+ * @param rrtype: RR type.
+ * @param rrclass: RR class.
+ * @param ttl: TTL.
+ * @param rdata: RDATA.
+ * @param rdata_len: length of rdata.
+ * @param rrstr: RR as string, for logging
+ * @param netblockstr: netblock as string, for logging
+ * @return 0 on error
+ */
+int
+respip_enter_rr(struct regional* region, struct resp_addr* raddr,
+	uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata,
+	size_t rdata_len, const char* rrstr, const char* netblockstr);
+
+/**
+ * Delete resp_addr node from tree.
+ * @param set: struct containing tree. Must hold write lock.
+ * @param node: node to delete. Not locked.
+ */
+void
+respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node);
 #endif	/* RESPIP_RESPIP_H */
diff --git a/services/authzone.c b/services/authzone.c
index 7d806d9d59d0..34170abaf4a2 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -299,6 +299,8 @@ struct auth_zones* auth_zones_create(void)
 	lock_protect(&az->lock, &az->ztree, sizeof(az->ztree));
 	lock_protect(&az->lock, &az->xtree, sizeof(az->xtree));
 	/* also lock protects the rbnode's in struct auth_zone, auth_xfer */
+	lock_rw_init(&az->rpz_lock);
+	lock_protect(&az->rpz_lock, &az->rpz_first, sizeof(az->rpz_first));
 	return az;
 }
 
@@ -381,11 +383,25 @@ auth_data_del(rbnode_type* n, void* ATTR_UNUSED(arg))
 
 /** delete an auth zone structure (tree remove must be done elsewhere) */
 static void
-auth_zone_delete(struct auth_zone* z)
+auth_zone_delete(struct auth_zone* z, struct auth_zones* az)
 {
 	if(!z) return;
 	lock_rw_destroy(&z->lock);
 	traverse_postorder(&z->data, auth_data_del, NULL);
+
+	if(az && z->rpz) {
+		/* keep RPZ linked list intact */
+		lock_rw_wrlock(&az->rpz_lock);
+		if(z->rpz->prev)
+			z->rpz->prev->next = z->rpz->next;
+		else
+			az->rpz_first = z->rpz->next;
+		if(z->rpz->next)
+			z->rpz->next->prev = z->rpz->prev;
+		lock_rw_unlock(&az->rpz_lock);
+	}
+	if(z->rpz)
+		rpz_delete(z->rpz);
 	free(z->name);
 	free(z->zonefile);
 	free(z);
@@ -415,7 +431,7 @@ auth_zone_create(struct auth_zones* az, uint8_t* nm, size_t nmlen,
 	/* z lock protects all, except rbtree itself, which is az->lock */
 	if(!rbtree_insert(&az->ztree, &z->node)) {
 		lock_rw_unlock(&z->lock);
-		auth_zone_delete(z);
+		auth_zone_delete(z, NULL);
 		log_warn("duplicate auth zone");
 		return NULL;
 	}
@@ -660,23 +676,6 @@ domain_remove_rrset(struct auth_data* node, uint16_t rr_type)
 	}
 }
 
-/** find an rr index in the rrset.  returns true if found */
-static int
-az_rrset_find_rr(struct packed_rrset_data* d, uint8_t* rdata, size_t len,
-	size_t* index)
-{
-	size_t i;
-	for(i=0; i<d->count; i++) {
-		if(d->rr_len[i] != len)
-			continue;
-		if(memcmp(d->rr_data[i], rdata, len) == 0) {
-			*index = i;
-			return 1;
-		}
-	}
-	return 0;
-}
-
 /** find an rrsig index in the rrset.  returns true if found */
 static int
 az_rrset_find_rrsig(struct packed_rrset_data* d, uint8_t* rdata, size_t len,
@@ -1178,6 +1177,12 @@ az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
 		log_err("cannot add RR to domain");
 		return 0;
 	}
+	if(z->rpz) {
+		if(!(rpz_insert_rr(z->rpz, z->namelen, dname, dname_len, 
+			rr_type, rr_class, rr_ttl, rdata, rdatalen, rr,
+			rr_len)))
+			return 0;
+	}
 	return 1;
 }
 
@@ -1192,7 +1197,7 @@ az_domain_remove_rr(struct auth_data* node, uint16_t rr_type,
 
 	/* find the plain RR of the given type */
 	if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
-		if(az_rrset_find_rr(rrset->data, rdata, rdatalen, &index)) {
+		if(packed_rrset_find_rr(rrset->data, rdata, rdatalen, &index)) {
 			if(rrset->data->count == 1 &&
 				rrset->data->rrsig_count == 0) {
 				/* last RR, delete the rrset */
@@ -1293,6 +1298,10 @@ az_remove_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
 		(void)rbtree_delete(&z->data, node);
 		auth_data_delete(node);
 	}
+	if(z->rpz) {
+		rpz_remove_rr(z->rpz, z->namelen, dname, dname_len, rr_type,
+			rr_class, rdata, rdatalen);
+	}
 	return 1;
 }
 
@@ -1585,6 +1594,9 @@ auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 	/* clear the data tree */
 	traverse_postorder(&z->data, auth_data_del, NULL);
 	rbtree_init(&z->data, &auth_data_cmp);
+	/* clear the RPZ policies */
+	if(z->rpz)
+		rpz_clear(z->rpz);
 
 	memset(&state, 0, sizeof(state));
 	/* default TTL to 3600 */
@@ -1604,6 +1616,9 @@ auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 		return 0;
 	}
 	fclose(in);
+
+	if(z->rpz)
+		rpz_finish_config(z->rpz);
 	return 1;
 }
 
@@ -1877,6 +1892,18 @@ auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
 	z->for_downstream = c->for_downstream;
 	z->for_upstream = c->for_upstream;
 	z->fallback_enabled = c->fallback_enabled;
+	if(c->isrpz && !z->rpz){
+		if(!(z->rpz = rpz_create(c))){
+			fatal_exit("Could not setup RPZ zones");
+			return 0;
+		}
+		lock_rw_wrlock(&az->rpz_lock);
+		z->rpz->next = az->rpz_first;
+		if(az->rpz_first)
+			az->rpz_first->prev = z->rpz;
+		az->rpz_first = z->rpz;
+		lock_rw_unlock(&az->rpz_lock);
+	}
 
 	/* xfer zone */
 	if(x) {
@@ -1947,14 +1974,14 @@ az_delete_deleted_zones(struct auth_zones* az)
 			auth_xfer_delete(xfr);
 		}
 		(void)rbtree_delete(&az->ztree, &z->node);
-		auth_zone_delete(z);
+		auth_zone_delete(z, az);
 		z = next;
 	}
 	lock_rw_unlock(&az->lock);
 }
 
 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
-	int setup)
+	int setup, int* is_rpz)
 {
 	struct config_auth* p;
 	az_setall_deleted(az);
@@ -1963,6 +1990,7 @@ int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 			log_warn("auth-zone without a name, skipped");
 			continue;
 		}
+		*is_rpz = (*is_rpz || p->isrpz);
 		if(!auth_zones_cfg(az, p)) {
 			log_err("cannot config auth zone %s", p->name);
 			return 0;
@@ -2063,7 +2091,7 @@ static void
 auth_zone_del(rbnode_type* n, void* ATTR_UNUSED(arg))
 {
 	struct auth_zone* z = (struct auth_zone*)n->key;
-	auth_zone_delete(z);
+	auth_zone_delete(z, NULL);
 }
 
 /** helper traverse to delete xfer zones */
@@ -2078,6 +2106,7 @@ void auth_zones_delete(struct auth_zones* az)
 {
 	if(!az) return;
 	lock_rw_destroy(&az->lock);
+	lock_rw_destroy(&az->rpz_lock);
 	traverse_postorder(&az->ztree, auth_zone_del, NULL);
 	traverse_postorder(&az->xtree, auth_xfer_del, NULL);
 	free(az);
@@ -2586,12 +2615,14 @@ az_nsec3_hash(uint8_t* buf, size_t buflen, uint8_t* nm, size_t nmlen,
 	/* hashfunc(name, salt) */
 	memmove(p, nm, nmlen);
 	query_dname_tolower(p);
-	memmove(p+nmlen, salt, saltlen);
+	if(salt && saltlen > 0)
+		memmove(p+nmlen, salt, saltlen);
 	(void)secalgo_nsec3_hash(algo, p, nmlen+saltlen, (unsigned char*)buf);
 	for(i=0; i<iter; i++) {
 		/* hashfunc(hash, salt) */
 		memmove(p, buf, hlen);
-		memmove(p+hlen, salt, saltlen);
+		if(salt && saltlen > 0)
+			memmove(p+hlen, salt, saltlen);
 		(void)secalgo_nsec3_hash(algo, p, hlen+saltlen,
 			(unsigned char*)buf);
 	}
@@ -4688,6 +4719,10 @@ apply_axfr(struct auth_xfer* xfr, struct auth_zone* z,
 	/* clear the data tree */
 	traverse_postorder(&z->data, auth_data_del, NULL);
 	rbtree_init(&z->data, &auth_data_cmp);
+	/* clear the RPZ policies */
+	if(z->rpz)
+		rpz_clear(z->rpz);
+
 	xfr->have_zone = 0;
 	xfr->serial = 0;
 
@@ -4784,6 +4819,10 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 	/* clear the data tree */
 	traverse_postorder(&z->data, auth_data_del, NULL);
 	rbtree_init(&z->data, &auth_data_cmp);
+	/* clear the RPZ policies */
+	if(z->rpz)
+		rpz_clear(z->rpz);
+
 	xfr->have_zone = 0;
 	xfr->serial = 0;
 
@@ -4969,6 +5008,9 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
 	if(xfr->have_zone)
 		xfr->lease_time = *env->now;
 
+	if(z->rpz)
+		rpz_finish_config(z->rpz);
+
 	/* unlock */
 	lock_rw_unlock(&z->lock);
 
@@ -5530,9 +5572,12 @@ check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
 				xfr->task_transfer->rr_scan_num == 0 &&
 				LDNS_ANCOUNT(wire)==1) {
 				verbose(VERB_ALGO, "xfr to %s ended, "
-					"IXFR reply that zone has serial %u",
+					"IXFR reply that zone has serial %u,"
+					" fallback from IXFR to AXFR",
 					xfr->task_transfer->master->host,
 					(unsigned)serial);
+				xfr->task_transfer->ixfr_fail = 1;
+				*gonextonfail = 0;
 				return 0;
 			}
 
diff --git a/services/authzone.h b/services/authzone.h
index a695bd029b56..9bb131ad8b39 100644
--- a/services/authzone.h
+++ b/services/authzone.h
@@ -46,6 +46,7 @@
 #include "util/rbtree.h"
 #include "util/locks.h"
 #include "services/mesh.h"
+#include "services/rpz.h"
 struct ub_packed_rrset_key;
 struct regional;
 struct config_file;
@@ -81,6 +82,11 @@ struct auth_zones {
 	size_t num_query_up;
 	/** number of queries downstream */
 	size_t num_query_down;
+	/** first rpz item in linked list */
+	struct rpz* rpz_first;
+	/** rw lock for rpz linked list, needed when iterating or editing linked
+	 * list. */
+	lock_rw_type rpz_lock;
 };
 
 /**
@@ -126,6 +132,8 @@ struct auth_zone {
 	/** for upstream: this zone answers queries that unbound intends to
 	 * send upstream. */
 	int for_upstream;
+	/** RPZ zones */
+	struct rpz* rpz;
 	/** zone has been deleted */
 	int zone_deleted;
 	/** deletelist pointer, unused normally except during delete */
@@ -460,10 +468,11 @@ struct auth_zones* auth_zones_create(void);
  * @param az: auth zones structure
  * @param cfg: config to apply.
  * @param setup: if true, also sets up values in the auth zones structure
+ * @param is_rpz: set to 1 if at least one RPZ zone is configured.
  * @return false on failure.
  */
 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
-	int setup);
+	int setup, int* is_rpz);
 
 /** initial pick up of worker timeouts, ties events to worker event loop
  * @param az: auth zones structure
diff --git a/services/cache/dns.c b/services/cache/dns.c
index aa4efec73f41..7b6e142c9915 100644
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -45,6 +45,7 @@
 #include "validator/val_utils.h"
 #include "services/cache/dns.h"
 #include "services/cache/rrset.h"
+#include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
 #include "util/data/packed_rrset.h"
 #include "util/data/dname.h"
@@ -73,15 +74,15 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 	time_t leeway, int pside, struct reply_info* qrep,
 	struct regional* region)
 {
-        size_t i;
-        /* see if rrset already exists in cache, if not insert it. */
-        for(i=0; i<rep->rrset_count; i++) {
-                rep->ref[i].key = rep->rrsets[i];
-                rep->ref[i].id = rep->rrsets[i]->id;
-		/* update ref if it was in the cache */ 
+	size_t i;
+	/* see if rrset already exists in cache, if not insert it. */
+	for(i=0; i<rep->rrset_count; i++) {
+		rep->ref[i].key = rep->rrsets[i];
+		rep->ref[i].id = rep->rrsets[i]->id;
+		/* update ref if it was in the cache */
 		switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
-                        env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
-			LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
+				env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
+				LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
 		case 0: /* ref unchanged, item inserted */
 			break;
 		case 2: /* ref updated, cache is superior */
@@ -104,9 +105,9 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 			 * the fallthrough warning */
 			/* fallthrough */
 		case 1: /* ref updated, item inserted */
-                        rep->rrsets[i] = rep->ref[i].key;
+			rep->rrsets[i] = rep->ref[i].key;
 		}
-        }
+	}
 }
 
 /** delete message from message cache */
@@ -272,7 +273,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 0)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -292,7 +293,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -326,7 +327,8 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, ns->lame)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, ns->lame,
+				NULL)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -346,7 +348,8 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame,
+				NULL)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -532,31 +535,51 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 }
 
 struct dns_msg*
-tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, 
-	struct regional* region, time_t now, struct regional* scratch)
+tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
+	struct regional* region, time_t now, int allow_expired,
+	struct regional* scratch)
 {
 	struct dns_msg* msg;
 	size_t i;
-	if(now > r->ttl)
-		return NULL;
+	int is_expired = 0;
+	time_t now_control = now;
+	if(now > r->ttl) {
+		/* Check if we are allowed to serve expired */
+		if(allow_expired) {
+			if(env->cfg->serve_expired_ttl &&
+				r->serve_expired_ttl < now) {
+				return NULL;
+			}
+		} else {
+			return NULL;
+		}
+		/* Change the current time so we can pass the below TTL checks when
+		 * serving expired data. */
+		now_control = r->ttl - env->cfg->serve_expired_reply_ttl;
+		is_expired = 1;
+	}
+
 	msg = gen_dns_msg(region, q, r->rrset_count);
-	if(!msg)
-		return NULL;
+	if(!msg) return NULL;
 	msg->rep->flags = r->flags;
 	msg->rep->qdcount = r->qdcount;
-	msg->rep->ttl = r->ttl - now;
+	msg->rep->ttl = is_expired
+		?SERVE_EXPIRED_REPLY_TTL
+		:r->ttl - now;
 	if(r->prefetch_ttl > now)
 		msg->rep->prefetch_ttl = r->prefetch_ttl - now;
-	else	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
+	else
+		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
 	msg->rep->security = r->security;
 	msg->rep->an_numrrsets = r->an_numrrsets;
 	msg->rep->ns_numrrsets = r->ns_numrrsets;
 	msg->rep->ar_numrrsets = r->ar_numrrsets;
 	msg->rep->rrset_count = r->rrset_count;
-        msg->rep->authoritative = r->authoritative;
-	if(!rrset_array_lock(r->ref, r->rrset_count, now))
+	msg->rep->authoritative = r->authoritative;
+	if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) {
 		return NULL;
+	}
 	if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
 		LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
 		LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) {
@@ -570,7 +593,7 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 		return NULL;
 	}
 	for(i=0; i<msg->rep->rrset_count; i++) {
-		msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i], 
+		msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
 			region, now);
 		if(!msg->rep->rrsets[i]) {
 			rrset_array_unlock(r->ref, r->rrset_count);
@@ -797,7 +820,7 @@ dns_cache_lookup(struct module_env* env,
 	if(e) {
 		struct msgreply_entry* key = (struct msgreply_entry*)e->key;
 		struct reply_info* data = (struct reply_info*)e->data;
-		struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 
+		struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 0,
 			scratch);
 		if(msg) {
 			lock_rw_unlock(&e->lock);
@@ -899,37 +922,38 @@ dns_cache_lookup(struct module_env* env,
 	 * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
 	 * means bla.foo also does not exist.  The DNSSEC proofs are
 	 * the same.  We search upwards for NXDOMAINs. */
-	if(env->cfg->harden_below_nxdomain)
-	    while(!dname_is_root(k.qname)) {
-		dname_remove_label(&k.qname, &k.qname_len);
-		h = query_info_hash(&k, flags);
-		e = slabhash_lookup(env->msg_cache, h, &k, 0);
-		if(!e && k.qtype != LDNS_RR_TYPE_A &&
-			env->cfg->qname_minimisation) {
-			k.qtype = LDNS_RR_TYPE_A;
+	if(env->cfg->harden_below_nxdomain) {
+		while(!dname_is_root(k.qname)) {
+			dname_remove_label(&k.qname, &k.qname_len);
 			h = query_info_hash(&k, flags);
 			e = slabhash_lookup(env->msg_cache, h, &k, 0);
-		}
-		if(e) {
-			struct reply_info* data = (struct reply_info*)e->data;
-			struct dns_msg* msg;
-			if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
-			  && data->security == sec_status_secure
-			  && (data->an_numrrsets == 0 ||
-				ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME)
-			  && (msg=tomsg(env, &k, data, region, now, scratch))){
+			if(!e && k.qtype != LDNS_RR_TYPE_A &&
+				env->cfg->qname_minimisation) {
+				k.qtype = LDNS_RR_TYPE_A;
+				h = query_info_hash(&k, flags);
+				e = slabhash_lookup(env->msg_cache, h, &k, 0);
+			}
+			if(e) {
+				struct reply_info* data = (struct reply_info*)e->data;
+				struct dns_msg* msg;
+				if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
+					&& data->security == sec_status_secure
+					&& (data->an_numrrsets == 0 ||
+						ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME)
+					&& (msg=tomsg(env, &k, data, region, now, 0, scratch))) {
+					lock_rw_unlock(&e->lock);
+					msg->qinfo.qname=qname;
+					msg->qinfo.qname_len=qnamelen;
+					/* check that DNSSEC really works out */
+					msg->rep->security = sec_status_unchecked;
+					iter_scrub_nxdomain(msg);
+					return msg;
+				}
 				lock_rw_unlock(&e->lock);
-				msg->qinfo.qname=qname;
-				msg->qinfo.qname_len=qnamelen;
-				/* check that DNSSEC really works out */
-				msg->rep->security = sec_status_unchecked;
-				iter_scrub_nxdomain(msg);
-				return msg;
 			}
-			lock_rw_unlock(&e->lock);
+			k.qtype = qtype;
 		}
-		k.qtype = qtype;
-	    }
+	}
 
 	/* fill common RR types for ANY response to avoid requery */
 	if(qtype == LDNS_RR_TYPE_ANY) {
diff --git a/services/cache/dns.h b/services/cache/dns.h
index 19d0d9f992d1..f1b77fb36c00 100644
--- a/services/cache/dns.h
+++ b/services/cache/dns.h
@@ -143,11 +143,14 @@ struct delegpt* dns_cache_find_delegation(struct module_env* env,
  * @param r: reply info that, together with qname, will make up the dns message.
  * @param region: where to allocate dns message.
  * @param now: the time now, for check if TTL on cache entry is ok.
+ * @param allow_expired: if true and serve-expired is enabled, it will allow
+ *	for expired dns_msg to be generated based on the configured serve-expired
+ *	logic.
  * @param scratch: where to allocate temporary data.
  * */
 struct dns_msg* tomsg(struct module_env* env, struct query_info* q,
 	struct reply_info* r, struct regional* region, time_t now,
-	struct regional* scratch);
+	int allow_expired, struct regional* scratch);
 
 /** 
  * Find cached message 
@@ -160,7 +163,7 @@ struct dns_msg* tomsg(struct module_env* env, struct query_info* q,
  * @param region: where to allocate result.
  * @param scratch: where to allocate temporary data.
  * @param no_partial: if true, only complete messages and not a partial
- *   one (with only the start of the CNAME chain and not the rest).
+ *	one (with only the start of the CNAME chain and not the rest).
  * @return new response message (alloced in region, rrsets do not have IDs).
  * 	or NULL on error or if not found in cache.
  *	TTLs are made relative to the current time.
diff --git a/services/localzone.c b/services/localzone.c
index 492bb83042c1..18407832ff41 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -41,7 +41,6 @@
 #include "config.h"
 #include "services/localzone.h"
 #include "sldns/str2wire.h"
-#include "sldns/sbuffer.h"
 #include "util/regional.h"
 #include "util/config_file.h"
 #include "util/data/dname.h"
@@ -395,9 +394,30 @@ rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
 	return 1;
 }
 
-/** find a data node by exact name */
-static struct local_data* 
-lz_find_node(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs)
+/** Delete RR from local-zone RRset, wastes memory as the deleted RRs cannot be
+ * free'd (regionally alloc'd) */
+int
+local_rrset_remove_rr(struct packed_rrset_data* pd, size_t index)
+{
+	log_assert(pd->count > 0);
+	if(index >= pd->count) {
+		log_warn("Trying to remove RR with out of bound index");
+		return 0;
+	}
+	if(index + 1 < pd->count) {
+		/* not removing last element */
+		size_t nexti = index + 1;
+		size_t num = pd->count - nexti;
+		memmove(pd->rr_len+index, pd->rr_len+nexti, sizeof(*pd->rr_len)*num);
+		memmove(pd->rr_ttl+index, pd->rr_ttl+nexti, sizeof(*pd->rr_ttl)*num);
+		memmove(pd->rr_data+index, pd->rr_data+nexti, sizeof(*pd->rr_data)*num);
+	}
+	pd->count--;
+	return 1;
+}
+
+struct local_data* 
+local_zone_find_data(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs)
 {
 	struct local_data key;
 	key.node.key = &key;
@@ -412,7 +432,7 @@ static int
 lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen, 
 	int nmlabs, struct local_data** res)
 {
-	struct local_data* ld = lz_find_node(z, nm, nmlen, nmlabs);
+	struct local_data* ld = local_zone_find_data(z, nm, nmlen, nmlabs);
 	if(!ld) {
 		/* create a domain name to store rr. */
 		ld = (struct local_data*)regional_alloc_zero(z->region,
@@ -443,42 +463,19 @@ lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen,
 	return 1;
 }
 
-/** enter data RR into auth zone */
-static int
-lz_enter_rr_into_zone(struct local_zone* z, const char* rrstr)
+int
+local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
+	int nmlabs, uint16_t rrtype, uint16_t rrclass, time_t ttl,
+	uint8_t* rdata, size_t rdata_len, const char* rrstr)
 {
-	uint8_t* nm;
-	size_t nmlen;
-	int nmlabs;
 	struct local_data* node;
 	struct local_rrset* rrset;
 	struct packed_rrset_data* pd;
-	uint16_t rrtype = 0, rrclass = 0;
-	time_t ttl = 0;
-	uint8_t rr[LDNS_RR_BUF_SIZE];
-	uint8_t* rdata;
-	size_t rdata_len;
-	if(!rrstr_get_rr_content(rrstr, &nm, &rrtype, &rrclass, &ttl, rr,
-		sizeof(rr), &rdata, &rdata_len)) {
-		log_err("bad local-data: %s", rrstr);
-		return 0;
-	}
-	log_assert(z->dclass == rrclass);
-	if((z->type == local_zone_redirect ||
-		z->type == local_zone_inform_redirect) &&
-		query_dname_compare(z->name, nm) != 0) {
-		log_err("local-data in redirect zone must reside at top of zone"
-			", not at %s", rrstr);
-		free(nm);
-		return 0;
-	}
-	nmlabs = dname_count_size_labels(nm, &nmlen);
+
 	if(!lz_find_create_node(z, nm, nmlen, nmlabs, &node)) {
-		free(nm);
 		return 0;
 	}
 	log_assert(node);
-	free(nm);
 
 	/* Reject it if we would end up having CNAME and other data (including
 	 * another CNAME) for a redirect zone. */
@@ -520,6 +517,39 @@ lz_enter_rr_into_zone(struct local_zone* z, const char* rrstr)
 	return rrset_insert_rr(z->region, pd, rdata, rdata_len, ttl, rrstr);
 }
 
+/** enter data RR into auth zone */
+int
+lz_enter_rr_into_zone(struct local_zone* z, const char* rrstr)
+{
+	uint8_t* nm;
+	size_t nmlen;
+	int nmlabs, ret;
+	uint16_t rrtype = 0, rrclass = 0;
+	time_t ttl = 0;
+	uint8_t rr[LDNS_RR_BUF_SIZE];
+	uint8_t* rdata;
+	size_t rdata_len;
+	if(!rrstr_get_rr_content(rrstr, &nm, &rrtype, &rrclass, &ttl, rr,
+		sizeof(rr), &rdata, &rdata_len)) {
+		log_err("bad local-data: %s", rrstr);
+		return 0;
+	}
+	log_assert(z->dclass == rrclass);
+	if((z->type == local_zone_redirect ||
+		z->type == local_zone_inform_redirect) &&
+		query_dname_compare(z->name, nm) != 0) {
+		log_err("local-data in redirect zone must reside at top of zone"
+			", not at %s", rrstr);
+		free(nm);
+		return 0;
+	}
+	nmlabs = dname_count_size_labels(nm, &nmlen);
+	ret = local_zone_enter_rr(z, nm, nmlen, nmlabs, rrtype, rrclass, ttl,
+		rdata, rdata_len, rrstr);
+	free(nm);
+	return ret;
+}
+
 /** enter a data RR into auth data; a zone for it must exist */
 static int
 lz_enter_rr_str(struct local_zones* zones, const char* rr)
@@ -823,12 +853,12 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
 		log_err("out of memory adding default zone");
 		return 0;
 	}
-	/* test. zone (RFC 7686) */
+	/* test. zone (RFC 6761) */
 	if(!add_empty_default(zones, cfg, "test.")) {
 		log_err("out of memory adding default zone");
 		return 0;
 	}
-	/* invalid. zone (RFC 7686) */
+	/* invalid. zone (RFC 6761) */
 	if(!add_empty_default(zones, cfg, "invalid.")) {
 		log_err("out of memory adding default zone");
 		return 0;
@@ -1113,6 +1143,22 @@ local_zones_find(struct local_zones* zones,
 	return (struct local_zone*)rbtree_search(&zones->ztree, &key);
 }
 
+struct local_zone*
+local_zones_find_le(struct local_zones* zones,
+        uint8_t* name, size_t len, int labs, uint16_t dclass,
+	int* exact)
+{
+	struct local_zone key;
+	rbnode_type *node;
+	key.node.key = &key;
+	key.dclass = dclass;
+	key.name = name;
+	key.namelen = len;
+	key.namelabs = labs;
+	*exact = rbtree_find_less_equal(&zones->ztree, &key, &node);
+	return (struct local_zone*)node;
+}
+
 /** print all RRsets in local zone */
 static void 
 local_zone_out(struct local_zone* z)
@@ -1309,8 +1355,7 @@ find_tag_datas(struct query_info* qinfo, struct config_strlist* list,
 	return result;
 }
 
-/** answer local data match */
-static int
+int
 local_data_answer(struct local_zone* z, struct module_env* env,
 	struct query_info* qinfo, struct edns_data* edns,
 	struct comm_reply* repinfo, sldns_buffer* buf,
@@ -1362,16 +1407,69 @@ local_data_answer(struct local_zone* z, struct module_env* env,
 		lz_type == local_zone_inform_redirect) &&
 		qinfo->qtype != LDNS_RR_TYPE_CNAME &&
 		lr->rrset->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
+		uint8_t* ctarget;
+		size_t ctargetlen = 0;
+
 		qinfo->local_alias =
 			regional_alloc_zero(temp, sizeof(struct local_rrset));
 		if(!qinfo->local_alias)
 			return 0; /* out of memory */
-		qinfo->local_alias->rrset =
-			regional_alloc_init(temp, lr->rrset, sizeof(*lr->rrset));
+		qinfo->local_alias->rrset = regional_alloc_init(
+			temp, lr->rrset, sizeof(*lr->rrset));
 		if(!qinfo->local_alias->rrset)
 			return 0; /* out of memory */
 		qinfo->local_alias->rrset->rk.dname = qinfo->qname;
 		qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
+		get_cname_target(lr->rrset, &ctarget, &ctargetlen);
+		if(!ctargetlen)
+			return 0; /* invalid cname */
+		if(dname_is_wild(ctarget)) {
+			/* synthesize cname target */
+			struct packed_rrset_data* d;
+			/* -3 for wildcard label and root label from qname */
+			size_t newtargetlen = qinfo->qname_len + ctargetlen - 3;
+
+			log_assert(ctargetlen >= 3);
+			log_assert(qinfo->qname_len >= 1);
+
+			if(newtargetlen > LDNS_MAX_DOMAINLEN) {
+				qinfo->local_alias = NULL;
+				local_error_encode(qinfo, env, edns, repinfo,
+					buf, temp, LDNS_RCODE_YXDOMAIN,
+					(LDNS_RCODE_YXDOMAIN|BIT_AA));
+				return 1;
+			}
+			memset(&qinfo->local_alias->rrset->entry, 0,
+				sizeof(qinfo->local_alias->rrset->entry));
+			qinfo->local_alias->rrset->entry.key =
+				qinfo->local_alias->rrset;
+			qinfo->local_alias->rrset->entry.hash =
+				rrset_key_hash(&qinfo->local_alias->rrset->rk);
+			d = (struct packed_rrset_data*)regional_alloc_zero(temp,
+				sizeof(struct packed_rrset_data) + sizeof(size_t) +
+				sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
+				+ newtargetlen);
+			if(!d)
+				return 0; /* out of memory */
+			qinfo->local_alias->rrset->entry.data = d;
+			d->ttl = 0; /* 0 for synthesized CNAME TTL */
+			d->count = 1;
+			d->rrsig_count = 0;
+			d->trust = rrset_trust_ans_noAA;
+			d->rr_len = (size_t*)((uint8_t*)d +
+				sizeof(struct packed_rrset_data));
+			d->rr_len[0] = newtargetlen + sizeof(uint16_t);
+			packed_rrset_ptr_fixup(d);
+			d->rr_ttl[0] = d->ttl;
+			sldns_write_uint16(d->rr_data[0], newtargetlen);
+			/* write qname */
+			memmove(d->rr_data[0] + sizeof(uint16_t), qinfo->qname,
+				qinfo->qname_len - 1);
+			/* write cname target wilcard wildcard label */
+			memmove(d->rr_data[0] + sizeof(uint16_t) +
+				qinfo->qname_len - 1, ctarget + 2,
+				ctargetlen - 2);
+		}
 		return 1;
 	}
 	if(lz_type == local_zone_redirect ||
@@ -1416,26 +1514,15 @@ local_zone_does_not_cover(struct local_zone* z, struct query_info* qinfo,
 	return (lr == NULL);
 }
 
-/** 
- * Answer in case where no exact match is found.
- * @param z: zone for query.
- * @param env: module environment.
- * @param qinfo: query.
- * @param edns: edns from query.
- * @param repinfo: source address for checks. may be NULL.
- * @param buf: buffer for answer.
- * @param temp: temp region for encoding.
- * @param ld: local data, if NULL, no such name exists in localdata.
- * @param lz_type: type of the local zone.
- * @return 1 if a reply is to be sent, 0 if not.
- */
-static int
-lz_zone_answer(struct local_zone* z, struct module_env* env,
+int
+local_zones_zone_answer(struct local_zone* z, struct module_env* env,
 	struct query_info* qinfo, struct edns_data* edns,
 	struct comm_reply* repinfo, sldns_buffer* buf, struct regional* temp,
 	struct local_data* ld, enum localzone_type lz_type)
 {
-	if(lz_type == local_zone_deny || lz_type == local_zone_inform_deny) {
+	if(lz_type == local_zone_deny ||
+		lz_type == local_zone_always_deny ||
+		lz_type == local_zone_inform_deny) {
 		/** no reply at all, signal caller by clearing buffer. */
 		sldns_buffer_clear(buf);
 		sldns_buffer_flip(buf);
@@ -1448,7 +1535,8 @@ lz_zone_answer(struct local_zone* z, struct module_env* env,
 	} else if(lz_type == local_zone_static ||
 		lz_type == local_zone_redirect ||
 		lz_type == local_zone_inform_redirect ||
-		lz_type == local_zone_always_nxdomain) {
+		lz_type == local_zone_always_nxdomain ||
+		lz_type == local_zone_always_nodata) {
 		/* for static, reply nodata or nxdomain
 		 * for redirect, reply nodata */
 		/* no additional section processing,
@@ -1457,7 +1545,8 @@ lz_zone_answer(struct local_zone* z, struct module_env* env,
 		 * or using closest match for returning delegation downwards
 		 */
 		int rcode = (ld || lz_type == local_zone_redirect ||
-			lz_type == local_zone_inform_redirect)?
+			lz_type == local_zone_inform_redirect ||
+			lz_type == local_zone_always_nodata)?
 			LDNS_RCODE_NOERROR:LDNS_RCODE_NXDOMAIN;
 		if(z->soa)
 			return local_encode(qinfo, env, edns, repinfo, buf, temp,
@@ -1640,6 +1729,8 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 	if(lzt != local_zone_always_refuse
 		&& lzt != local_zone_always_transparent
 		&& lzt != local_zone_always_nxdomain
+		&& lzt != local_zone_always_nodata
+		&& lzt != local_zone_always_deny
 		&& local_data_answer(z, env, qinfo, edns, repinfo, buf, temp, labs,
 			&ld, lzt, tag, tag_datas, tag_datas_size, tagname, num_tags)) {
 		lock_rw_unlock(&z->lock);
@@ -1647,7 +1738,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		 * a local alias. */
 		return !qinfo->local_alias;
 	}
-	r = lz_zone_answer(z, env, qinfo, edns, repinfo, buf, temp, ld, lzt);
+	r = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp, ld, lzt);
 	lock_rw_unlock(&z->lock);
 	return r && !qinfo->local_alias; /* see above */
 }
@@ -1669,7 +1760,10 @@ const char* local_zone_type2str(enum localzone_type t)
 		case local_zone_always_transparent: return "always_transparent";
 		case local_zone_always_refuse: return "always_refuse";
 		case local_zone_always_nxdomain: return "always_nxdomain";
+		case local_zone_always_nodata: return "always_nodata";
+		case local_zone_always_deny: return "always_deny";
 		case local_zone_noview: return "noview";
+		case local_zone_invalid: return "invalid";
 	}
 	return "badtyped"; 
 }
@@ -1700,6 +1794,10 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
 		*t = local_zone_always_refuse;
 	else if(strcmp(type, "always_nxdomain") == 0)
 		*t = local_zone_always_nxdomain;
+	else if(strcmp(type, "always_nodata") == 0)
+		*t = local_zone_always_nodata;
+	else if(strcmp(type, "always_deny") == 0)
+		*t = local_zone_always_deny;
 	else if(strcmp(type, "noview") == 0)
 		*t = local_zone_noview;
 	else if(strcmp(type, "nodefault") == 0)
@@ -1843,7 +1941,7 @@ del_empty_term(struct local_zone* z, struct local_data* d,
 			return;
 		dname_remove_label(&name, &len);
 		labs--;
-		d = lz_find_node(z, name, len, labs);
+		d = local_zone_find_data(z, name, len, labs);
 	}
 }
 
@@ -1876,7 +1974,7 @@ void local_zones_del_data(struct local_zones* zones,
 	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS);
 	if(z) {
 		lock_rw_wrlock(&z->lock);
-		d = lz_find_node(z, name, len, labs);
+		d = local_zone_find_data(z, name, len, labs);
 		if(d) {
 			del_local_rrset(d, LDNS_RR_TYPE_DS);
 			del_empty_term(z, d, name, len, labs);
@@ -1897,7 +1995,7 @@ void local_zones_del_data(struct local_zones* zones,
 	lock_rw_unlock(&zones->lock);
 
 	/* find the domain */
-	d = lz_find_node(z, name, len, labs);
+	d = local_zone_find_data(z, name, len, labs);
 	if(d) {
 		/* no memory recycling for zone deletions ... */
 		d->rrsets = NULL;
diff --git a/services/localzone.h b/services/localzone.h
index 1d6caeff2c74..bb35939366a7 100644
--- a/services/localzone.h
+++ b/services/localzone.h
@@ -46,6 +46,7 @@
 #include "util/storage/dnstree.h"
 #include "util/module.h"
 #include "services/view.h"
+#include "sldns/sbuffer.h"
 struct packed_rrset_data;
 struct ub_packed_rrset_key;
 struct regional;
@@ -91,8 +92,14 @@ enum localzone_type {
 	local_zone_always_refuse,
 	/** answer with nxdomain, even when there is local data */
 	local_zone_always_nxdomain,
+	/** answer with noerror/nodata, even when there is local data */
+	local_zone_always_nodata,
+	/** drop query, even when there is local data */
+	local_zone_always_deny,
 	/** answer not from the view, but global or no-answer */
-	local_zone_noview
+	local_zone_noview,
+	/** Invalid type, cannot be used to generate answer */
+	local_zone_invalid
 };
 
 /**
@@ -310,6 +317,25 @@ int local_zones_answer(struct local_zones* zones, struct module_env* env,
 	struct config_strlist** tag_datas, size_t tag_datas_size,
 	char** tagname, int num_tags, struct view* view);
 
+/** 
+ * Answer using the local zone only (not local data used).
+ * @param z: zone for query.
+ * @param env: module environment.
+ * @param qinfo: query.
+ * @param edns: edns from query.
+ * @param repinfo: source address for checks. may be NULL.
+ * @param buf: buffer for answer.
+ * @param temp: temp region for encoding.
+ * @param ld: local data, if NULL, no such name exists in localdata.
+ * @param lz_type: type of the local zone.
+ * @return 1 if a reply is to be sent, 0 if not.
+ */
+int
+local_zones_zone_answer(struct local_zone* z, struct module_env* env,
+	struct query_info* qinfo, struct edns_data* edns,
+	struct comm_reply* repinfo, sldns_buffer* buf, struct regional* temp,
+	struct local_data* ld, enum localzone_type lz_type);
+
 /**
  * Parse the string into localzone type.
  *
@@ -341,6 +367,22 @@ struct local_zone* local_zones_find(struct local_zones* zones,
 	uint8_t* name, size_t len, int labs, uint16_t dclass);
 
 /**
+ * Find zone that with exactly or smaller name/class
+ * User must lock the tree or result zone.
+ * @param zones: the zones tree
+ * @param name: dname to lookup
+ * @param len: length of name.
+ * @param labs: labelcount of name.
+ * @param dclass: class to lookup.
+ * @param exact: 1 on return is this is an exact match.
+ * @return the exact or smaller local_zone or NULL.
+ */
+struct local_zone*
+local_zones_find_le(struct local_zones* zones,
+        uint8_t* name, size_t len, int labs, uint16_t dclass,
+	int* exact);
+
+/**
  * Add a new zone. Caller must hold the zones lock.
  * Adjusts the other zones as well (parent pointers) after insertion.
  * The zone must NOT exist (returns NULL and logs error).
@@ -474,6 +516,15 @@ int rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
 	uint8_t* rdata, size_t rdata_len, time_t ttl, const char* rrstr);
 
 /**
+ * Remove RR from rrset that is created using localzone's rrset_insert_rr.
+ * @param pd: the RRset containing the RR to remove
+ * @param index: index of RR to remove
+ * @return: 1 on success; 0 otherwise.
+ */
+int
+local_rrset_remove_rr(struct packed_rrset_data* pd, size_t index);
+
+/**
   * Valid response ip actions for the IP-response-driven-action feature;
   * defined here instead of in the respip module to enable sharing of enum
   * values with the localzone_type enum.
@@ -501,6 +552,10 @@ enum respip_action {
 	respip_always_refuse = local_zone_always_refuse,
         /** answer with 'no such domain' response */
 	respip_always_nxdomain = local_zone_always_nxdomain,
+        /** answer with nodata response */
+	respip_always_nodata = local_zone_always_nodata,
+        /** answer with nodata response */
+	respip_always_deny = local_zone_always_deny,
 
 	/* The rest of the values are only possible as
 	 * access-control-tag-action */
@@ -513,6 +568,64 @@ enum respip_action {
 	respip_transparent = local_zone_transparent,
 	/** gives response data (if any), else nodata answer. */
 	respip_typetransparent = local_zone_typetransparent,
+	/** type invalid */
+	respip_invalid = local_zone_invalid,
 };
 
+/**
+ * Get local data from local zone and encode answer.
+ * @param z: local zone to use
+ * @param env: module env
+ * @param qinfo: qinfo
+ * @param edns: edns data, for message encoding
+ * @param repinfo: reply info, for message encoding
+ * @param buf: commpoint buffer
+ * @param temp: scratchpad region
+ * @param labs: number of labels in qname
+ * @param ldp: where to store local data
+ * @param lz_type: type of local zone
+ * @param tag: matching tag index
+ * @param tag_datas: alc specific tag data list
+ * @param tag_datas_size: size of tag_datas
+ * @param tagname: list of names of tags, for logging purpose
+ * @param num_tags: number of tags
+ * @return 1 on success
+ */
+int
+local_data_answer(struct local_zone* z, struct module_env* env,
+	struct query_info* qinfo, struct edns_data* edns,
+	struct comm_reply* repinfo, sldns_buffer* buf,
+	struct regional* temp, int labs, struct local_data** ldp,
+	enum localzone_type lz_type, int tag, struct config_strlist** tag_datas,
+	size_t tag_datas_size, char** tagname, int num_tags);
+
+/**
+ * Add RR to local zone.
+ * @param z: local zone to add RR to
+ * @param nm: dname of RR
+ * @param nmlen: length of nm
+ * @param nmlabs: number of labels of nm
+ * @param rrtype: RR type
+ * @param rrclass: RR class
+ * @param ttl: TTL of RR to add
+ * @param rdata: RDATA of RR to add
+ * @param rdata_len: length of rdata
+ * @param rrstr: RR in string format, for logging
+ * @return: 1 on success
+ */
+int
+local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
+	int nmlabs, uint16_t rrtype, uint16_t rrclass, time_t ttl,
+	uint8_t* rdata, size_t rdata_len, const char* rrstr);
+
+/**
+ * Find a data node by exact name for a local zone
+ * @param z: local_zone containing data tree
+ * @param nm: name of local-data element to find
+ * @param nmlen: length of nm
+ * @param nmlabs: labs of nm
+ * @return local_data on exact match, NULL otherwise.
+ */
+struct local_data* 
+local_zone_find_data(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs);
 #endif /* SERVICES_LOCALZONE_H */
diff --git a/services/mesh.c b/services/mesh.c
index d4f814d5a925..9114ef4c4e2d 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -46,6 +46,7 @@
 #include "services/mesh.h"
 #include "services/outbound_list.h"
 #include "services/cache/dns.h"
+#include "services/cache/rrset.h"
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/module.h"
@@ -127,7 +128,7 @@ timeval_smaller(const struct timeval* x, const struct timeval* y)
 #endif
 }
 
-/*
+/**
  * Compare two response-ip client info entries for the purpose of mesh state
  * compare.  It returns 0 if ci_a and ci_b are considered equal; otherwise
  * 1 or -1 (they mean 'ci_a is larger/smaller than ci_b', respectively, but
@@ -250,6 +251,7 @@ mesh_create(struct module_stack* stack, struct module_env* env)
 	mesh->num_forever_states = 0;
 	mesh->stats_jostled = 0;
 	mesh->stats_dropped = 0;
+	mesh->ans_expired = 0;
 	mesh->max_reply_states = env->cfg->num_queries_per_thread;
 	mesh->max_forever_states = (mesh->max_reply_states+1)/2;
 #ifndef S_SPLINT_S
@@ -345,6 +347,97 @@ int mesh_make_new_space(struct mesh_area* mesh, sldns_buffer* qbuf)
 	return 0;
 }
 
+struct dns_msg*
+mesh_serve_expired_lookup(struct module_qstate* qstate,
+	struct query_info* lookup_qinfo)
+{
+	hashvalue_type h;
+	struct lruhash_entry* e;
+	struct dns_msg* msg;
+	struct reply_info* data;
+	struct msgreply_entry* key;
+	time_t timenow = *qstate->env->now;
+	int must_validate = (!(qstate->query_flags&BIT_CD)
+		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
+	/* Lookup cache */
+	h = query_info_hash(lookup_qinfo, qstate->query_flags);
+	e = slabhash_lookup(qstate->env->msg_cache, h, lookup_qinfo, 0);
+	if(!e) return NULL;
+
+	key = (struct msgreply_entry*)e->key;
+	data = (struct reply_info*)e->data;
+	msg = tomsg(qstate->env, &key->key, data, qstate->region, timenow,
+		qstate->env->cfg->serve_expired, qstate->env->scratch);
+	if(!msg)
+		goto bail_out;
+
+	/* Check CNAME chain (if any)
+	 * This is part of tomsg above; no need to check now. */
+
+	/* Check security status of the cached answer.
+	 * tomsg above has a subset of these checks, so we are leaving
+	 * these as is.
+	 * In case of bogus or revalidation we don't care to reply here. */
+	if(must_validate && (msg->rep->security == sec_status_bogus ||
+		msg->rep->security == sec_status_secure_sentinel_fail)) {
+		verbose(VERB_ALGO, "Serve expired: bogus answer found in cache");
+		goto bail_out;
+	} else if(msg->rep->security == sec_status_unchecked && must_validate) {
+		verbose(VERB_ALGO, "Serve expired: unchecked entry needs "
+			"validation");
+		goto bail_out; /* need to validate cache entry first */
+	} else if(msg->rep->security == sec_status_secure &&
+		!reply_all_rrsets_secure(msg->rep) && must_validate) {
+			verbose(VERB_ALGO, "Serve expired: secure entry"
+				" changed status");
+			goto bail_out; /* rrset changed, re-verify */
+	}
+
+	lock_rw_unlock(&e->lock);
+	return msg;
+
+bail_out:
+	lock_rw_unlock(&e->lock);
+	return NULL;
+}
+
+
+/** Init the serve expired data structure */
+static int
+mesh_serve_expired_init(struct mesh_state* mstate, int timeout)
+{
+	struct timeval t;
+
+	/* Create serve_expired_data if not there yet */
+	if(!mstate->s.serve_expired_data) {
+		mstate->s.serve_expired_data = (struct serve_expired_data*)
+			regional_alloc_zero(
+				mstate->s.region, sizeof(struct serve_expired_data));
+		if(!mstate->s.serve_expired_data)
+			return 0;
+	}
+
+	/* Don't overwrite the function if already set */
+	mstate->s.serve_expired_data->get_cached_answer =
+		mstate->s.serve_expired_data->get_cached_answer?
+		mstate->s.serve_expired_data->get_cached_answer:
+		mesh_serve_expired_lookup;
+
+	/* In case this timer already popped, start it again */
+	if(!mstate->s.serve_expired_data->timer) {
+		mstate->s.serve_expired_data->timer = comm_timer_create(
+			mstate->s.env->worker_base, mesh_serve_expired_callback, mstate);
+		if(!mstate->s.serve_expired_data->timer)
+			return 0;
+#ifndef S_SPLINT_S
+		t.tv_sec = timeout/1000;
+		t.tv_usec = (timeout%1000)*1000;
+#endif
+		comm_timer_set(mstate->s.serve_expired_data->timer, &t);
+	}
+	return 1;
+}
+
 void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	struct respip_client_info* cinfo, uint16_t qflags,
 	struct edns_data* edns, struct comm_reply* rep, uint16_t qid)
@@ -354,6 +447,8 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
+	int timeout = mesh->env->cfg->serve_expired?
+		mesh->env->cfg->serve_expired_client_timeout:0;
 	struct sldns_buffer* r_buffer = rep->c->buffer;
 	if(rep->c->tcp_req_info) {
 		r_buffer = rep->c->tcp_req_info->spool_buffer;
@@ -366,7 +461,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 			verbose(VERB_ALGO, "Too many queries. dropping "
 				"incoming query.");
 			comm_point_drop_reply(rep);
-			mesh->stats_dropped ++;
+			mesh->stats_dropped++;
 			return;
 		}
 		/* for this new reply state, the reply address is free,
@@ -376,8 +471,8 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(mesh->num_reply_addrs > mesh->max_reply_states*16) {
 			verbose(VERB_ALGO, "Too many requests queued. "
 				"dropping incoming query.");
-			mesh->stats_dropped++;
 			comm_point_drop_reply(rep);
+			mesh->stats_dropped++;
 			return;
 		}
 	}
@@ -427,23 +522,16 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		mesh->num_detached_states++;
 		added = 1;
 	}
-	if(!s->reply_list && !s->cb_list && s->super_set.count == 0)
-		was_detached = 1;
-	if(!s->reply_list && !s->cb_list)
+	if(!s->reply_list && !s->cb_list) {
 		was_noreply = 1;
+		if(s->super_set.count == 0) {
+			was_detached = 1;
+		}
+	}
 	/* add reply to s */
 	if(!mesh_state_add_reply(s, edns, rep, qid, qflags, qinfo)) {
-			log_err("mesh_new_client: out of memory; SERVFAIL");
-		servfail_mem:
-			if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, &s->s,
-				NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch))
-					edns->opt_list = NULL;
-			error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
-				qinfo, qid, qflags, edns);
-			comm_point_send_reply(rep);
-			if(added)
-				mesh_state_delete(&s->s);
-			return;
+		log_err("mesh_new_client: out of memory; SERVFAIL");
+		goto servfail_mem;
 	}
 	if(rep->c->tcp_req_info) {
 		if(!tcp_req_info_add_meshstate(rep->c->tcp_req_info, mesh, s)) {
@@ -451,6 +539,11 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 			goto servfail_mem;
 		}
 	}
+	/* add serve expired timer if required and not already there */
+	if(timeout && !mesh_serve_expired_init(s, timeout)) {
+		log_err("mesh_new_client: out of memory initializing serve expired");
+		goto servfail_mem;
+	}
 	/* update statistics */
 	if(was_detached) {
 		log_assert(mesh->num_detached_states > 0);
@@ -475,6 +568,18 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	}
 	if(added)
 		mesh_run(mesh, s, module_event_new, NULL);
+	return;
+
+servfail_mem:
+	if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, &s->s,
+		NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch))
+			edns->opt_list = NULL;
+	error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
+		qinfo, qid, qflags, edns);
+	comm_point_send_reply(rep);
+	if(added)
+		mesh_state_delete(&s->s);
+	return;
 }
 
 int 
@@ -484,6 +589,8 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 {
 	struct mesh_state* s = NULL;
 	int unique = unique_mesh_state(edns->opt_list, mesh->env);
+	int timeout = mesh->env->cfg->serve_expired?
+		mesh->env->cfg->serve_expired_client_timeout:0;
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -522,15 +629,21 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 		mesh->num_detached_states++;
 		added = 1;
 	}
-	if(!s->reply_list && !s->cb_list && s->super_set.count == 0)
-		was_detached = 1;
-	if(!s->reply_list && !s->cb_list)
+	if(!s->reply_list && !s->cb_list) {
 		was_noreply = 1;
+		if(s->super_set.count == 0) {
+			was_detached = 1;
+		}
+	}
 	/* add reply to s */
 	if(!mesh_state_add_cb(s, edns, buf, cb, cb_arg, qid, qflags)) {
-			if(added)
-				mesh_state_delete(&s->s);
-			return 0;
+		if(added)
+			mesh_state_delete(&s->s);
+		return 0;
+	}
+	/* add serve expired timer if not already there */
+	if(timeout && !mesh_serve_expired_init(s, timeout)) {
+		return 0;
 	}
 	/* update statistics */
 	if(was_detached) {
@@ -546,15 +659,6 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	return 1;
 }
 
-static void mesh_schedule_prefetch(struct mesh_area* mesh,
-	struct query_info* qinfo, uint16_t qflags, time_t leeway, int run);
-
-void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
-        uint16_t qflags, time_t leeway)
-{
-	mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1);
-}
-
 /* Internal backend routine of mesh_new_prefetch().  It takes one additional
  * parameter, 'run', which controls whether to run the prefetch state
  * immediately.  When this function is called internally 'run' could be
@@ -631,6 +735,12 @@ static void mesh_schedule_prefetch(struct mesh_area* mesh,
 	mesh_run(mesh, s, module_event_new, NULL);
 }
 
+void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
+        uint16_t qflags, time_t leeway)
+{
+	mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1);
+}
+
 void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
         struct comm_reply* reply, int what)
 {
@@ -703,6 +813,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	mstate->s.env = env;
 	mstate->s.mesh_info = mstate;
 	mstate->s.prefetch_leeway = 0;
+	mstate->s.serve_expired_data = NULL;
 	mstate->s.no_cache_lookup = 0;
 	mstate->s.no_cache_store = 0;
 	mstate->s.need_refetch = 0;
@@ -742,6 +853,11 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	if(!mstate)
 		return;
 	mesh = mstate->s.env->mesh;
+	/* Stop and delete the serve expired timer */
+	if(mstate->s.serve_expired_data && mstate->s.serve_expired_data->timer) {
+		comm_timer_delete(mstate->s.serve_expired_data->timer);
+		mstate->s.serve_expired_data->timer = NULL;
+	}
 	/* drop unsent replies */
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep = mstate->reply_list;
@@ -752,6 +868,7 @@ mesh_state_cleanup(struct mesh_state* mstate)
 		mstate->reply_list = NULL;
 		for(; rep; rep=rep->next) {
 			comm_point_drop_reply(&rep->query_reply);
+			log_assert(mesh->num_reply_addrs > 0);
 			mesh->num_reply_addrs--;
 		}
 		while((cb = mstate->cb_list)!=NULL) {
@@ -759,6 +876,7 @@ mesh_state_cleanup(struct mesh_state* mstate)
 			fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
 			(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
 				sec_status_unchecked, NULL, 0);
+			log_assert(mesh->num_reply_addrs > 0);
 			mesh->num_reply_addrs--;
 		}
 	}
@@ -826,7 +944,7 @@ find_in_subsub(struct mesh_state* m, struct mesh_state* tofind, size_t *c)
 }
 
 /** find cycle for already looked up mesh_state */
-static int 
+static int
 mesh_detect_cycle_found(struct module_qstate* qstate, struct mesh_state* dep_m)
 {
 	struct mesh_state* cyc_m = qstate->mesh_info;
@@ -1038,6 +1156,7 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 		}
 	}
 	free(reason);
+	log_assert(m->s.env->mesh->num_reply_addrs > 0);
 	m->s.env->mesh->num_reply_addrs--;
 }
 
@@ -1139,6 +1258,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		comm_point_send_reply(&r->query_reply);
 	}
 	/* account */
+	log_assert(m->s.env->mesh->num_reply_addrs > 0);
 	m->s.env->mesh->num_reply_addrs--;
 	end_time = *m->s.env->now_tv;
 	timeval_subtract(&duration, &end_time, &r->start_time);
@@ -1164,37 +1284,76 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 
 void mesh_query_done(struct mesh_state* mstate)
 {
-	struct mesh_reply* r;
+	struct mesh_reply* r, *reply_list = NULL;
 	struct mesh_reply* prev = NULL;
 	struct sldns_buffer* prev_buffer = NULL;
 	struct mesh_cb* c;
 	struct reply_info* rep = (mstate->s.return_msg?
 		mstate->s.return_msg->rep:NULL);
-	if((mstate->s.return_rcode == LDNS_RCODE_SERVFAIL ||
-		(rep && FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_SERVFAIL))
+	/* No need for the serve expired timer anymore; we are going to reply. */
+	if(mstate->s.serve_expired_data) {
+		comm_timer_delete(mstate->s.serve_expired_data->timer);
+		mstate->s.serve_expired_data->timer = NULL;
+	}
+	if(mstate->s.return_rcode == LDNS_RCODE_SERVFAIL ||
+		(rep && FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_SERVFAIL)) {
+		/* we are SERVFAILing; check for expired asnwer here */
+		mesh_serve_expired_callback(mstate);
+		if((mstate->reply_list || mstate->cb_list)
 		&& mstate->s.env->cfg->log_servfail
 		&& !mstate->s.env->cfg->val_log_squelch) {
-		char* err = errinf_to_str_servfail(&mstate->s);
-		if(err)
-			log_err("%s", err);
-		free(err);
+			char* err = errinf_to_str_servfail(&mstate->s);
+			if(err)
+				log_err("%s", err);
+			free(err);
+		}
 	}
-	for(r = mstate->reply_list; r; r = r->next) {
+	if(mstate->reply_list) {
+		/* set the reply_list to NULL during the mesh_query_done
+		 * processing, so that calls back into the mesh from
+		 * tcp_req_info (deciding to drop the reply and thus
+		 * unregister the mesh_reply from the mstate) are stopped
+		 * because the list is empty.
+		 * The mstate is then likely not a reply_state, and maybe
+		 * also a detached_state.
+		 */
+		reply_list = mstate->reply_list;
+		mstate->reply_list = NULL;
+		if(!mstate->reply_list && !mstate->cb_list) {
+			/* was a reply state, not anymore */
+			log_assert(mstate->s.env->mesh->num_reply_states > 0);
+			mstate->s.env->mesh->num_reply_states--;
+		}
+		if(!mstate->reply_list && !mstate->cb_list &&
+			mstate->super_set.count == 0)
+			mstate->s.env->mesh->num_detached_states++;
+	}
+	for(r = reply_list; r; r = r->next) {
 		/* if a response-ip address block has been stored the
 		 *  information should be logged for each client. */
 		if(mstate->s.respip_action_info &&
 			mstate->s.respip_action_info->addrinfo) {
-			respip_inform_print(mstate->s.respip_action_info->addrinfo,
+			respip_inform_print(mstate->s.respip_action_info,
 				r->qname, mstate->s.qinfo.qtype,
 				mstate->s.qinfo.qclass, r->local_alias,
 				&r->query_reply);
+			if(mstate->s.env->cfg->stat_extended &&
+				mstate->s.respip_action_info->rpz_used) {
+				if(mstate->s.respip_action_info->rpz_disabled)
+					mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION]++;
+				if(mstate->s.respip_action_info->rpz_cname_override)
+					mstate->s.env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
+				else
+					mstate->s.env->mesh->rpz_action[respip_action_to_rpz_action(
+						mstate->s.respip_action_info->action)]++;
+			}
 		}
 
 		/* if this query is determined to be dropped during the
 		 * mesh processing, this is the point to take that action. */
-		if(mstate->s.is_drop)
+		if(mstate->s.is_drop) {
 			comm_point_drop_reply(&r->query_reply);
-		else {
+		} else {
 			struct sldns_buffer* r_buffer = r->query_reply.c->buffer;
 			if(r->query_reply.c->tcp_req_info) {
 				r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
@@ -1216,6 +1375,7 @@ void mesh_query_done(struct mesh_state* mstate)
 		 * changed, eg. by adds from the callback routine */
 		if(!mstate->reply_list && mstate->cb_list && !c->next) {
 			/* was a reply state, not anymore */
+			log_assert(mstate->s.env->mesh->num_reply_states > 0);
 			mstate->s.env->mesh->num_reply_states--;
 		}
 		mstate->cb_list = c->next;
@@ -1581,7 +1741,9 @@ mesh_stats_clear(struct mesh_area* mesh)
 	timehist_clear(mesh->histogram);
 	mesh->ans_secure = 0;
 	mesh->ans_bogus = 0;
-	memset(&mesh->ans_rcode[0], 0, sizeof(size_t)*16);
+	mesh->ans_expired = 0;
+	memset(&mesh->ans_rcode[0], 0, sizeof(size_t)*UB_STATS_RCODE_NUM);
+	memset(&mesh->rpz_action[0], 0, sizeof(size_t)*UB_STATS_RPZ_ACTION_NUM);
 	mesh->ans_nodata = 0;
 }
 
@@ -1647,6 +1809,7 @@ void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
 			if(prev) prev->next = n->next;
 			else m->reply_list = n->next;
 			/* delete it, but allocated in m region */
+			log_assert(mesh->num_reply_addrs > 0);
 			mesh->num_reply_addrs--;
 
 			/* prev = prev; */
@@ -1667,3 +1830,176 @@ void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
 		mesh->num_reply_states--;
 	}
 }
+
+
+static int
+apply_respip_action(struct module_qstate* qstate,
+	const struct query_info* qinfo, struct respip_client_info* cinfo,
+	struct respip_action_info* actinfo, struct reply_info* rep,
+	struct ub_packed_rrset_key** alias_rrset,
+	struct reply_info** encode_repp, struct auth_zones* az)
+{
+	if(qinfo->qtype != LDNS_RR_TYPE_A &&
+		qinfo->qtype != LDNS_RR_TYPE_AAAA &&
+		qinfo->qtype != LDNS_RR_TYPE_ANY)
+		return 1;
+
+	if(!respip_rewrite_reply(qinfo, cinfo, rep, encode_repp, actinfo,
+		alias_rrset, 0, qstate->region, az))
+		return 0;
+
+	/* xxx_deny actions mean dropping the reply, unless the original reply
+	 * was redirected to response-ip data. */
+	if((actinfo->action == respip_deny ||
+		actinfo->action == respip_inform_deny) &&
+		*encode_repp == rep)
+		*encode_repp = NULL;
+
+	return 1;
+}
+
+void
+mesh_serve_expired_callback(void* arg)
+{
+	struct mesh_state* mstate = (struct mesh_state*) arg;
+	struct module_qstate* qstate = &mstate->s;
+	struct mesh_reply* r;
+	struct mesh_area* mesh = qstate->env->mesh;
+	struct dns_msg* msg;
+	struct mesh_cb* c;
+	struct mesh_reply* prev = NULL;
+	struct sldns_buffer* prev_buffer = NULL;
+	struct sldns_buffer* r_buffer = NULL;
+	struct reply_info* partial_rep = NULL;
+	struct ub_packed_rrset_key* alias_rrset = NULL;
+	struct reply_info* encode_rep = NULL;
+	struct respip_action_info actinfo;
+	struct query_info* lookup_qinfo = &qstate->qinfo;
+	struct query_info qinfo_tmp;
+	int must_validate = (!(qstate->query_flags&BIT_CD)
+		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
+	if(!qstate->serve_expired_data) return;
+	verbose(VERB_ALGO, "Serve expired: Trying to reply with expired data");
+	comm_timer_delete(qstate->serve_expired_data->timer);
+	qstate->serve_expired_data->timer = NULL;
+	if(qstate->blacklist || qstate->no_cache_lookup || qstate->is_drop) {
+		verbose(VERB_ALGO,
+			"Serve expired: Not allowed to look into cache for stale");
+		return;
+	}
+	/* The following while is used instead of the `goto lookup_cache`
+	 * like in the worker. */
+	while(1) {
+		fptr_ok(fptr_whitelist_serve_expired_lookup(
+			qstate->serve_expired_data->get_cached_answer));
+		msg = qstate->serve_expired_data->get_cached_answer(qstate,
+			lookup_qinfo);
+		if(!msg)
+			return;
+		/* Reset these in case we pass a second time from here. */
+		encode_rep = msg->rep;
+		memset(&actinfo, 0, sizeof(actinfo));
+		actinfo.action = respip_none;
+		alias_rrset = NULL;
+		if((mesh->use_response_ip || mesh->use_rpz) &&
+			!partial_rep && !apply_respip_action(qstate, &qstate->qinfo,
+			qstate->client_info, &actinfo, msg->rep, &alias_rrset, &encode_rep,
+			qstate->env->auth_zones)) {
+			return;
+		} else if(partial_rep &&
+			!respip_merge_cname(partial_rep, &qstate->qinfo, msg->rep,
+			qstate->client_info, must_validate, &encode_rep, qstate->region,
+			qstate->env->auth_zones)) {
+			return;
+		}
+		if(!encode_rep || alias_rrset) {
+			if(!encode_rep) {
+				/* Needs drop */
+				return;
+			} else {
+				/* A partial CNAME chain is found. */
+				partial_rep = encode_rep;
+			}
+		}
+		/* We've found a partial reply ending with an
+		* alias.  Replace the lookup qinfo for the
+		* alias target and lookup the cache again to
+		* (possibly) complete the reply.  As we're
+		* passing the "base" reply, there will be no
+		* more alias chasing. */
+		if(partial_rep) {
+			memset(&qinfo_tmp, 0, sizeof(qinfo_tmp));
+			get_cname_target(alias_rrset, &qinfo_tmp.qname,
+				&qinfo_tmp.qname_len);
+			if(!qinfo_tmp.qname) {
+				log_err("Serve expired: unexpected: invalid answer alias");
+				return;
+			}
+			qinfo_tmp.qtype = qstate->qinfo.qtype;
+			qinfo_tmp.qclass = qstate->qinfo.qclass;
+			lookup_qinfo = &qinfo_tmp;
+			continue;
+		}
+		break;
+	}
+
+	if(verbosity >= VERB_ALGO)
+		log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);
+
+	r = mstate->reply_list;
+	mstate->reply_list = NULL;
+	if(!mstate->reply_list && !mstate->cb_list) {
+		log_assert(mesh->num_reply_states > 0);
+		mesh->num_reply_states--;
+		if(mstate->super_set.count == 0) {
+			mesh->num_detached_states++;
+		}
+	}
+	for(; r; r = r->next) {
+		/* If address info is returned, it means the action should be an
+		* 'inform' variant and the information should be logged. */
+		if(actinfo.addrinfo) {
+			respip_inform_print(&actinfo, r->qname,
+				qstate->qinfo.qtype, qstate->qinfo.qclass,
+				r->local_alias, &r->query_reply);
+
+			if(qstate->env->cfg->stat_extended && actinfo.rpz_used) {
+				if(actinfo.rpz_disabled)
+					qstate->env->mesh->rpz_action[RPZ_DISABLED_ACTION]++;
+				if(actinfo.rpz_cname_override)
+					qstate->env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
+				else
+					qstate->env->mesh->rpz_action[
+						respip_action_to_rpz_action(actinfo.action)]++;
+			}
+		}
+
+		r_buffer = r->query_reply.c->buffer;
+		if(r->query_reply.c->tcp_req_info)
+			r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
+		mesh_send_reply(mstate, LDNS_RCODE_NOERROR, msg->rep,
+			r, r_buffer, prev, prev_buffer);
+		if(r->query_reply.c->tcp_req_info)
+			tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
+		prev = r;
+		prev_buffer = r_buffer;
+
+		/* Account for each reply sent. */
+		mesh->ans_expired++;
+
+	}
+	while((c = mstate->cb_list) != NULL) {
+		/* take this cb off the list; so that the list can be
+		 * changed, eg. by adds from the callback routine */
+		if(!mstate->reply_list && mstate->cb_list && !c->next) {
+			/* was a reply state, not anymore */
+			log_assert(qstate->env->mesh->num_reply_states > 0);
+			qstate->env->mesh->num_reply_states--;
+		}
+		mstate->cb_list = c->next;
+		if(!mstate->reply_list && !mstate->cb_list &&
+			mstate->super_set.count == 0)
+			qstate->env->mesh->num_detached_states++;
+		mesh_do_callback(mstate, LDNS_RCODE_NOERROR, msg->rep, c);
+	}
+}
diff --git a/services/mesh.h b/services/mesh.h
index a2622844bbf0..df2972ac3306 100644
--- a/services/mesh.h
+++ b/services/mesh.h
@@ -51,6 +51,8 @@
 #include "util/data/msgparse.h"
 #include "util/module.h"
 #include "services/modstack.h"
+#include "services/rpz.h"
+#include "libunbound/unbound.h"
 struct sldns_buffer;
 struct mesh_state;
 struct mesh_reply;
@@ -110,6 +112,8 @@ struct mesh_area {
 	size_t stats_jostled;
 	/** stats, cumulative number of incoming client msgs dropped */
 	size_t stats_dropped;
+	/** stats, number of expired replies sent */
+	size_t ans_expired;
 	/** number of replies sent */
 	size_t replies_sent;
 	/** sum of waiting times for the replies */
@@ -121,9 +125,11 @@ struct mesh_area {
 	/** (extended stats) bogus replies */
 	size_t ans_bogus;
 	/** (extended stats) rcodes in replies */
-	size_t ans_rcode[16];
+	size_t ans_rcode[UB_STATS_RCODE_NUM];
 	/** (extended stats) rcode nodata in replies */
 	size_t ans_nodata;
+	/** (extended stats) type of applied RPZ action */
+	size_t rpz_action[UB_STATS_RPZ_ACTION_NUM];
 
 	/** backup of query if other operations recurse and need the
 	 * network buffers */
@@ -142,6 +148,11 @@ struct mesh_area {
 	struct mesh_state* jostle_last;
 	/** timeout for jostling. if age is lower, it does not get jostled. */
 	struct timeval jostle_max;
+
+	/** If we need to use response ip (value passed from daemon)*/
+	int use_response_ip;
+	/** If we need to use RPZ (value passed from daemon) */
+	int use_rpz;
 };
 
 /**
@@ -643,4 +654,22 @@ void mesh_list_remove(struct mesh_state* m, struct mesh_state** fp,
 void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
 	struct comm_point* cp);
 
+/** Callback for when the serve expired client timer has run out.  Tries to
+ * find an expired answer in the cache and reply that to the client.
+ * @param arg: the argument passed to the callback.
+ */
+void mesh_serve_expired_callback(void* arg);
+
+/**
+ * Try to get a (expired) cached answer.
+ * This needs to behave like the worker's answer_from_cache() in order to have
+ * the same behavior as when replying from cache.
+ * @param qstate: the module qstate.
+ * @param lookup_qinfo: the query info to look for in the cache.
+ * @return dns_msg if a cached answer was found, otherwise NULL.
+ */
+struct dns_msg*
+mesh_serve_expired_lookup(struct module_qstate* qstate,
+	struct query_info* lookup_qinfo);
+
 #endif /* SERVICES_MESH_H */
diff --git a/services/outside_network.c b/services/outside_network.c
index f865f13c1390..80b1f12454d6 100644
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -293,6 +293,9 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
 	/* open socket */
 	s = outnet_get_tcp_fd(&w->addr, w->addrlen, w->outnet->tcp_mss);
 
+	if(s == -1)
+		return 0;
+
 	if(!pick_outgoing_tcp(w, s))
 		return 0;
 
@@ -1971,7 +1974,6 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 
 	sq->pending = NULL; /* removed after callback */
 	if(error == NETEVENT_TIMEOUT) {
-		int rto = 0;
 		if(sq->status == serviced_query_UDP_EDNS && sq->last_rtt < 5000) {
 			/* fallback to 1480/1280 */
 			sq->status = serviced_query_UDP_EDNS_FRAG;
@@ -1987,9 +1989,9 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			sq->status = serviced_query_UDP_EDNS;
 		}
 		sq->retry++;
-		if(!(rto=infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen,
+		if(!infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen,
 			sq->zone, sq->zonelen, sq->qtype, -1, sq->last_rtt,
-			(time_t)now.tv_sec)))
+			(time_t)now.tv_sec))
 			log_err("out of memory in UDP exponential backoff");
 		if(sq->retry < OUTBOUND_UDP_RETRY) {
 			log_name_addr(VERB_ALGO, "retry query", sq->qbuf+10,
diff --git a/services/rpz.c b/services/rpz.c
new file mode 100644
index 000000000000..643b20c91d20
--- /dev/null
+++ b/services/rpz.c
@@ -0,0 +1,1015 @@
+/*
+ * services/rpz.c - rpz service
+ *
+ * Copyright (c) 2019, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains functions to enable RPZ service.
+ */
+
+#include "config.h"
+#include "services/rpz.h"
+#include "util/config_file.h"
+#include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
+#include "util/data/dname.h"
+#include "util/net_help.h"
+#include "util/log.h"
+#include "util/data/dname.h"
+#include "util/locks.h"
+#include "util/regional.h"
+
+/** string for RPZ action enum */
+const char*
+rpz_action_to_string(enum rpz_action a)
+{
+	switch(a) {
+	case RPZ_NXDOMAIN_ACTION:	return "nxdomain";
+	case RPZ_NODATA_ACTION:		return "nodata";
+	case RPZ_PASSTHRU_ACTION:	return "passthru";
+	case RPZ_DROP_ACTION:		return "drop";
+	case RPZ_TCP_ONLY_ACTION:	return "tcp_only";
+	case RPZ_INVALID_ACTION:	return "invalid";
+	case RPZ_LOCAL_DATA_ACTION:	return "local_data";
+	case RPZ_DISABLED_ACTION:	return "disabled";
+	case RPZ_CNAME_OVERRIDE_ACTION:	return "cname_override";
+	case RPZ_NO_OVERRIDE_ACTION:	return "no_override";
+	}
+	return "unknown";
+}
+
+/** RPZ action enum for config string */
+static enum rpz_action
+rpz_config_to_action(char* a)
+{
+	if(strcmp(a, "nxdomain") == 0)
+		return RPZ_NXDOMAIN_ACTION;
+	else if(strcmp(a, "nodata") == 0)
+		return RPZ_NODATA_ACTION;
+	else if(strcmp(a, "passthru") == 0)
+		return RPZ_PASSTHRU_ACTION;
+	else if(strcmp(a, "drop") == 0)
+		return RPZ_DROP_ACTION;
+	else if(strcmp(a, "tcp_only") == 0)
+		return RPZ_TCP_ONLY_ACTION;
+	else if(strcmp(a, "cname") == 0)
+		return RPZ_CNAME_OVERRIDE_ACTION;
+	else if(strcmp(a, "disabled") == 0)
+		return RPZ_DISABLED_ACTION;
+	return RPZ_INVALID_ACTION;
+}
+
+/** string for RPZ trigger enum */
+static const char*
+rpz_trigger_to_string(enum rpz_trigger r)
+{
+	switch(r) {
+	case RPZ_QNAME_TRIGGER:		return "qname";
+	case RPZ_CLIENT_IP_TRIGGER:	return "client_ip";
+	case RPZ_RESPONSE_IP_TRIGGER:	return "response_ip";
+	case RPZ_NSDNAME_TRIGGER:	return "nsdname";
+	case RPZ_NSIP_TRIGGER:		return "nsip";
+	case RPZ_INVALID_TRIGGER:	return "invalid";
+	}
+	return "unknown";
+}
+
+/**
+ * Get the label that is just before the root label.
+ * @param dname: dname to work on
+ * @param maxdnamelen: maximum length of the dname
+ * @return: pointer to TLD label, NULL if not found or invalid dname
+ */
+static uint8_t*
+get_tld_label(uint8_t* dname, size_t maxdnamelen)
+{
+	uint8_t* prevlab = dname;
+	size_t dnamelen = 0;
+
+	/* one byte needed for label length */
+	if(dnamelen+1 > maxdnamelen)
+		return NULL;
+
+	/* only root label */
+	if(*dname == 0)
+		return NULL;
+
+	while(*dname) {
+		dnamelen += ((size_t)*dname)+1;
+		if(dnamelen+1 > maxdnamelen)
+			return NULL;
+		dname = dname+((size_t)*dname)+1;
+		if(*dname != 0)
+			prevlab = dname;
+	}
+	return prevlab;
+}
+
+/**
+ * Classify RPZ action for RR type/rdata
+ * @param rr_type: the RR type
+ * @param rdatawl: RDATA with 2 bytes length
+ * @param rdatalen: the length of rdatawl (including its 2 bytes length)
+ * @return: the RPZ action
+ */
+static enum rpz_action
+rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
+{
+	char* endptr;
+	uint8_t* rdata;
+	int rdatalabs;
+	uint8_t* tldlab = NULL;
+
+	switch(rr_type) {
+		case LDNS_RR_TYPE_SOA:
+		case LDNS_RR_TYPE_NS:
+		case LDNS_RR_TYPE_DNAME:
+		/* all DNSSEC-related RRs must be ignored */
+		case LDNS_RR_TYPE_DNSKEY:
+		case LDNS_RR_TYPE_DS:
+		case LDNS_RR_TYPE_RRSIG:
+		case LDNS_RR_TYPE_NSEC:
+		case LDNS_RR_TYPE_NSEC3:
+			return RPZ_INVALID_ACTION;
+		case LDNS_RR_TYPE_CNAME:
+			break;
+		default:
+			return RPZ_LOCAL_DATA_ACTION;
+	}
+
+	/* use CNAME target to determine RPZ action */
+	log_assert(rr_type == LDNS_RR_TYPE_CNAME);
+	if(rdatalen < 3)
+		return RPZ_INVALID_ACTION;
+
+	rdata = rdatawl + 2; /* 2 bytes of rdata length */
+	if(dname_valid(rdata, rdatalen-2) != rdatalen-2)
+		return RPZ_INVALID_ACTION;
+
+	rdatalabs = dname_count_labels(rdata);
+	if(rdatalabs == 1)
+		return RPZ_NXDOMAIN_ACTION;
+	else if(rdatalabs == 2) {
+		if(dname_subdomain_c(rdata, (uint8_t*)&"\001*\000"))
+			return RPZ_NODATA_ACTION;
+		else if(dname_subdomain_c(rdata,
+			(uint8_t*)&"\014rpz-passthru\000"))
+			return RPZ_PASSTHRU_ACTION;
+		else if(dname_subdomain_c(rdata, (uint8_t*)&"\010rpz-drop\000"))
+			return RPZ_DROP_ACTION;
+		else if(dname_subdomain_c(rdata,
+			(uint8_t*)&"\014rpz-tcp-only\000"))
+			return RPZ_TCP_ONLY_ACTION;
+	}
+
+	/* all other TLDs starting with "rpz-" are invalid */
+	tldlab = get_tld_label(rdata, rdatalen-2);
+	if(tldlab && dname_lab_startswith(tldlab, "rpz-", &endptr))
+		return RPZ_INVALID_ACTION;
+
+	/* no special label found */
+	return RPZ_LOCAL_DATA_ACTION;
+}
+
+static enum localzone_type 
+rpz_action_to_localzone_type(enum rpz_action a)
+{
+	switch(a) {
+	case RPZ_NXDOMAIN_ACTION:	return local_zone_always_nxdomain;
+	case RPZ_NODATA_ACTION:		return local_zone_always_nodata;
+	case RPZ_DROP_ACTION:		return local_zone_always_deny;
+	case RPZ_PASSTHRU_ACTION:	return local_zone_always_transparent;
+	case RPZ_LOCAL_DATA_ACTION:	/* fallthrough */
+	case RPZ_CNAME_OVERRIDE_ACTION: return local_zone_redirect;
+	case RPZ_INVALID_ACTION: 	/* fallthrough */
+	case RPZ_TCP_ONLY_ACTION:	/* fallthrough */
+	default:			return local_zone_invalid;
+	}
+}
+
+enum respip_action
+rpz_action_to_respip_action(enum rpz_action a)
+{
+	switch(a) {
+	case RPZ_NXDOMAIN_ACTION:	return respip_always_nxdomain;
+	case RPZ_NODATA_ACTION:		return respip_always_nodata;
+	case RPZ_DROP_ACTION:		return respip_always_deny;
+	case RPZ_PASSTHRU_ACTION:	return respip_always_transparent;
+	case RPZ_LOCAL_DATA_ACTION:	/* fallthrough */
+	case RPZ_CNAME_OVERRIDE_ACTION: return respip_redirect;
+	case RPZ_INVALID_ACTION:	/* fallthrough */
+	case RPZ_TCP_ONLY_ACTION:	/* fallthrough */
+	default:			return respip_invalid;
+	}
+}
+
+static enum rpz_action
+localzone_type_to_rpz_action(enum localzone_type lzt)
+{
+	switch(lzt) {
+	case local_zone_always_nxdomain:	return RPZ_NXDOMAIN_ACTION;
+	case local_zone_always_nodata:		return RPZ_NODATA_ACTION;
+	case local_zone_always_deny:		return RPZ_DROP_ACTION;
+	case local_zone_always_transparent:	return RPZ_PASSTHRU_ACTION;
+	case local_zone_redirect:		return RPZ_LOCAL_DATA_ACTION;
+	case local_zone_invalid:
+	default:
+		return RPZ_INVALID_ACTION;
+	}
+}
+
+enum rpz_action
+respip_action_to_rpz_action(enum respip_action a)
+{
+	switch(a) {
+	case respip_always_nxdomain:	return RPZ_NXDOMAIN_ACTION;
+	case respip_always_nodata:	return RPZ_NODATA_ACTION;
+	case respip_always_deny:	return RPZ_DROP_ACTION;
+	case respip_always_transparent:	return RPZ_PASSTHRU_ACTION;
+	case respip_redirect:		return RPZ_LOCAL_DATA_ACTION;
+	case respip_invalid:
+	default:
+		return RPZ_INVALID_ACTION;
+	}
+}
+
+/**
+ * Get RPZ trigger for dname
+ * @param dname: dname containing RPZ trigger
+ * @param dname_len: length of the dname
+ * @return: RPZ trigger enum
+ */
+static enum rpz_trigger
+rpz_dname_to_trigger(uint8_t* dname, size_t dname_len)
+{
+	uint8_t* tldlab;
+	char* endptr;
+
+	if(dname_valid(dname, dname_len) != dname_len)
+		return RPZ_INVALID_TRIGGER;
+
+	tldlab = get_tld_label(dname, dname_len);
+	if(!tldlab || !dname_lab_startswith(tldlab, "rpz-", &endptr))
+		return RPZ_QNAME_TRIGGER;
+
+	if(dname_subdomain_c(tldlab,
+		(uint8_t*)&"\015rpz-client-ip\000"))
+		return RPZ_CLIENT_IP_TRIGGER;
+	else if(dname_subdomain_c(tldlab, (uint8_t*)&"\006rpz-ip\000"))
+		return RPZ_RESPONSE_IP_TRIGGER;
+	else if(dname_subdomain_c(tldlab, (uint8_t*)&"\013rpz-nsdname\000"))
+		return RPZ_NSDNAME_TRIGGER;
+	else if(dname_subdomain_c(tldlab, (uint8_t*)&"\010rpz-nsip\000"))
+		return RPZ_NSIP_TRIGGER;
+
+	return RPZ_QNAME_TRIGGER;
+}
+
+void rpz_delete(struct rpz* r)
+{
+	if(!r)
+		return;
+	local_zones_delete(r->local_zones);
+	respip_set_delete(r->respip_set);
+	regional_destroy(r->region);
+	free(r->taglist);
+	free(r->log_name);
+	free(r);
+}
+
+int
+rpz_clear(struct rpz* r)
+{
+	/* must hold write lock on auth_zone */
+	local_zones_delete(r->local_zones);
+	respip_set_delete(r->respip_set);
+	if(!(r->local_zones = local_zones_create())){
+		return 0;
+	}
+	if(!(r->respip_set = respip_set_create())) {
+		return 0;
+	}
+	return 1;
+}
+
+void
+rpz_finish_config(struct rpz* r)
+{
+	lock_rw_wrlock(&r->respip_set->lock);
+	addr_tree_init_parents(&r->respip_set->ip_tree);
+	lock_rw_unlock(&r->respip_set->lock);
+}
+
+/** new rrset containing CNAME override, does not yet contain a dname */
+static struct ub_packed_rrset_key*
+new_cname_override(struct regional* region, uint8_t* ct, size_t ctlen)
+{
+	struct ub_packed_rrset_key* rrset;
+	struct packed_rrset_data* pd;
+	uint16_t rdlength = htons(ctlen);
+	rrset = (struct ub_packed_rrset_key*)regional_alloc_zero(region,
+		sizeof(*rrset));
+	if(!rrset) {
+		log_err("out of memory");
+		return NULL;
+	}
+	rrset->entry.key = rrset;
+	pd = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*pd));
+	if(!pd) {
+		log_err("out of memory");
+		return NULL;
+	}
+	pd->trust = rrset_trust_prim_noglue;
+	pd->security = sec_status_insecure;
+
+	pd->count = 1;
+	pd->rr_len = regional_alloc_zero(region, sizeof(*pd->rr_len));
+	pd->rr_ttl = regional_alloc_zero(region, sizeof(*pd->rr_ttl));
+	pd->rr_data = regional_alloc_zero(region, sizeof(*pd->rr_data));
+	if(!pd->rr_len || !pd->rr_ttl || !pd->rr_data) {
+		log_err("out of memory");
+		return NULL;
+	}
+	pd->rr_len[0] = ctlen+2;
+	pd->rr_ttl[0] = 3600;
+	pd->rr_data[0] = regional_alloc_zero(region, 2 /* rdlength */ + ctlen);
+	if(!pd->rr_data[0]) {
+		log_err("out of memory");
+		return NULL;
+	}
+	memmove(pd->rr_data[0], &rdlength, 2);
+	memmove(pd->rr_data[0]+2, ct, ctlen);
+
+	rrset->entry.data = pd;
+	rrset->rk.type = htons(LDNS_RR_TYPE_CNAME);
+	rrset->rk.rrset_class = htons(LDNS_RR_CLASS_IN);
+	return rrset;
+}
+
+struct rpz*
+rpz_create(struct config_auth* p)
+{
+	struct rpz* r = calloc(1, sizeof(*r));
+	if(!r)
+		goto err;
+
+	r->region = regional_create_custom(sizeof(struct regional));
+	if(!r->region) {
+		goto err;
+	}
+
+	if(!(r->local_zones = local_zones_create())){
+		goto err;
+	}
+	if(!(r->respip_set = respip_set_create())) {
+		goto err;
+	}
+	r->taglistlen = p->rpz_taglistlen;
+	r->taglist = memdup(p->rpz_taglist, r->taglistlen);
+	if(p->rpz_action_override) {
+		r->action_override = rpz_config_to_action(p->rpz_action_override);
+	}
+	else
+		r->action_override = RPZ_NO_OVERRIDE_ACTION;
+
+	if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
+		uint8_t nm[LDNS_MAX_DOMAINLEN+1];
+		size_t nmlen = sizeof(nm);
+
+		if(!p->rpz_cname) {
+			log_err("RPZ override with cname action found, but no "
+				"rpz-cname-override configured");
+			goto err;
+		}
+
+		if(sldns_str2wire_dname_buf(p->rpz_cname, nm, &nmlen) != 0) {
+			log_err("cannot parse RPZ cname override: %s",
+				p->rpz_cname);
+			goto err;
+		}
+		r->cname_override = new_cname_override(r->region, nm, nmlen);
+		if(!r->cname_override) {
+			goto err;
+		}
+	}
+	r->log = p->rpz_log;
+	if(p->rpz_log_name) {
+		if(!(r->log_name = strdup(p->rpz_log_name))) {
+			log_err("malloc failure on RPZ log_name strdup");
+			goto err;
+		}
+	}
+	return r;
+err:
+	if(r) {
+		if(r->local_zones)
+			local_zones_delete(r->local_zones);
+		if(r->respip_set)
+			respip_set_delete(r->respip_set);
+		if(r->taglist)
+			free(r->taglist);
+		free(r);
+	}
+	return NULL;
+}
+
+/**
+ * Remove RPZ zone name from dname
+ * Copy dname to newdname, without the originlen number of trailing bytes
+ */
+static size_t
+strip_dname_origin(uint8_t* dname, size_t dnamelen, size_t originlen,
+	uint8_t* newdname, size_t maxnewdnamelen)
+{
+	size_t newdnamelen;
+	if(dnamelen < originlen)
+		return 0;
+	newdnamelen = dnamelen - originlen;
+	if(newdnamelen+1 > maxnewdnamelen)
+		return 0;
+	memmove(newdname, dname, newdnamelen);
+	newdname[newdnamelen] = 0;
+	return newdnamelen + 1;	/* + 1 for root label */
+}
+
+/** Insert RR into RPZ's local-zone */
+static void
+rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+	enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
+	uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+{
+	struct local_zone* z;
+	enum localzone_type tp = local_zone_always_transparent;
+	int dnamelabs = dname_count_labels(dname);
+	char* rrstr;
+	int newzone = 0;
+
+	if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION) {
+		verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
+			rpz_action_to_string(a));
+		free(dname);
+		return;
+	}
+
+	lock_rw_wrlock(&r->local_zones->lock);
+	/* exact match */
+	z = local_zones_find(r->local_zones, dname, dnamelen, dnamelabs,
+		LDNS_RR_CLASS_IN);
+	if(z && a != RPZ_LOCAL_DATA_ACTION) {
+		rrstr = sldns_wire2str_rr(rr, rr_len);
+		if(!rrstr) {
+			log_err("malloc error while inserting RPZ qname "
+				"trigger");
+			free(dname);
+			lock_rw_unlock(&r->local_zones->lock);
+			return;
+		}
+		verbose(VERB_ALGO, "RPZ: skipping duplicate record: '%s'",
+			rrstr);
+		free(rrstr);
+		free(dname);
+		lock_rw_unlock(&r->local_zones->lock);
+		return;
+	}
+	if(!z) {
+		tp = rpz_action_to_localzone_type(a);
+		if(!(z = local_zones_add_zone(r->local_zones, dname, dnamelen,
+			dnamelabs, rrclass, tp))) {
+			log_warn("RPZ create failed");
+			lock_rw_unlock(&r->local_zones->lock);
+			/* dname will be free'd in failed local_zone_create() */
+			return;
+		}
+		newzone = 1;
+	}
+	if(a == RPZ_LOCAL_DATA_ACTION) {
+		rrstr = sldns_wire2str_rr(rr, rr_len);
+		if(!rrstr) {
+			log_err("malloc error while inserting RPZ qname "
+				"trigger");
+			free(dname);
+			lock_rw_unlock(&r->local_zones->lock);
+			return;
+		}
+		lock_rw_wrlock(&z->lock);
+		local_zone_enter_rr(z, dname, dnamelen, dnamelabs,
+			rrtype, rrclass, ttl, rdata, rdata_len, rrstr);
+		lock_rw_unlock(&z->lock);
+		free(rrstr);
+	}
+	if(!newzone)
+		free(dname);
+	lock_rw_unlock(&r->local_zones->lock);
+	return;
+}
+
+/** Insert RR into RPZ's respip_set */
+static int
+rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+	enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
+	uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+{
+	struct resp_addr* node;
+	struct sockaddr_storage addr;
+	socklen_t addrlen;
+	int net, af;
+	char* rrstr;
+	enum respip_action respa = rpz_action_to_respip_action(a);
+
+	if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION ||
+		respa == respip_invalid) {
+		verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
+			rpz_action_to_string(a));
+		return 0;
+	}
+
+	if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
+		return 0;
+
+	lock_rw_wrlock(&r->respip_set->lock);
+	rrstr = sldns_wire2str_rr(rr, rr_len);
+	if(!rrstr) {
+		log_err("malloc error while inserting RPZ respip trigger");
+		lock_rw_unlock(&r->respip_set->lock);
+		return 0;
+	}
+	if(!(node=respip_sockaddr_find_or_create(r->respip_set, &addr, addrlen,
+		net, 1, rrstr))) {
+		lock_rw_unlock(&r->respip_set->lock);
+		free(rrstr);
+		return 0;
+	}
+
+	lock_rw_wrlock(&node->lock);
+	lock_rw_unlock(&r->respip_set->lock);
+	node->action = respa;
+
+	if(a == RPZ_LOCAL_DATA_ACTION) {
+		respip_enter_rr(r->respip_set->region, node, rrtype,
+			rrclass, ttl, rdata, rdata_len, rrstr, "");
+	}
+	lock_rw_unlock(&node->lock);
+	free(rrstr);
+	return 1;
+}
+
+int
+rpz_insert_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
+	size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
+	uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len)
+{
+	size_t policydnamelen;
+	/* name is free'd in local_zone delete */
+	enum rpz_trigger t;
+	enum rpz_action a;
+	uint8_t* policydname;
+
+	log_assert(dnamelen >= aznamelen);
+	if(!(policydname = calloc(1, (dnamelen-aznamelen)+1)))
+		return 0;
+
+	a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
+	if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
+		policydname, (dnamelen-aznamelen)+1))) {
+		free(policydname);
+		return 0;
+	}
+	t = rpz_dname_to_trigger(policydname, policydnamelen);
+	if(t == RPZ_INVALID_TRIGGER) {
+		free(policydname);
+		verbose(VERB_ALGO, "RPZ: skipping invalid trigger");
+		return 1;
+	}
+	if(t == RPZ_QNAME_TRIGGER) {
+		rpz_insert_qname_trigger(r, policydname, policydnamelen,
+			a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
+			rr_len);
+	}
+	else if(t == RPZ_RESPONSE_IP_TRIGGER) {
+		rpz_insert_response_ip_trigger(r, policydname, policydnamelen,
+			a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
+			rr_len);
+		free(policydname);
+	}
+	else {
+		free(policydname);
+		verbose(VERB_ALGO, "RPZ: skipping unsupported trigger: %s",
+			rpz_trigger_to_string(t));
+	}
+	return 1;
+}
+
+/**
+ * Find RPZ local-zone by qname.
+ * @param r: rpz containing local-zone tree
+ * @param qname: qname
+ * @param qname_len: length of qname
+ * @param qclass: qclass
+ * @param only_exact: if 1 only excact (non wildcard) matches are returned
+ * @param wr: get write lock for local-zone if 1, read lock if 0
+ * @param zones_keep_lock: if set do not release the r->local_zones lock, this
+ * 	  makes the caller of this function responsible for releasing the lock.
+ * @return: NULL or local-zone holding rd or wr lock
+ */
+static struct local_zone*
+rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
+	int only_exact, int wr, int zones_keep_lock)
+{
+	uint8_t* ce;
+	size_t ce_len, ce_labs;
+	uint8_t wc[LDNS_MAX_DOMAINLEN+1];
+	int exact;
+	struct local_zone* z = NULL;
+	if(wr) {
+		lock_rw_wrlock(&r->local_zones->lock);
+	} else {
+		lock_rw_rdlock(&r->local_zones->lock);
+	}
+	z = local_zones_find_le(r->local_zones, qname, qname_len,
+		dname_count_labels(qname),
+		LDNS_RR_CLASS_IN, &exact);
+	if(!z || (only_exact && !exact)) {
+		lock_rw_unlock(&r->local_zones->lock);
+		return NULL;
+	}
+	if(wr) {
+		lock_rw_wrlock(&z->lock);
+	} else {
+		lock_rw_rdlock(&z->lock);
+	}
+	if(!zones_keep_lock) {
+		lock_rw_unlock(&r->local_zones->lock);
+	}
+
+	if(exact)
+		return z;
+
+	/* No exact match found, lookup wildcard. closest encloser must
+	 * be the shared parent between the qname and the best local
+	 * zone match, append '*' to that and do another lookup. */
+
+	ce = dname_get_shared_topdomain(z->name, qname);
+	if(!ce /* should not happen */ || !*ce /* root */) {
+		lock_rw_unlock(&z->lock);
+		if(zones_keep_lock) {
+			lock_rw_unlock(&r->local_zones->lock);
+		}
+		return NULL;
+	}
+	ce_labs = dname_count_size_labels(ce, &ce_len);
+	if(ce_len+2 > sizeof(wc)) {
+		lock_rw_unlock(&z->lock);
+		if(zones_keep_lock) {
+			lock_rw_unlock(&r->local_zones->lock);
+		}
+		return NULL;
+	}
+	wc[0] = 1; /* length of wildcard label */
+	wc[1] = (uint8_t)'*'; /* wildcard label */
+	memmove(wc+2, ce, ce_len);
+	lock_rw_unlock(&z->lock);
+
+	if(!zones_keep_lock) {
+		if(wr) {
+			lock_rw_wrlock(&r->local_zones->lock);
+		} else {
+			lock_rw_rdlock(&r->local_zones->lock);
+		}
+	}
+	z = local_zones_find_le(r->local_zones, wc,
+		ce_len+2, ce_labs+1, qclass, &exact);
+	if(!z || !exact) {
+		lock_rw_unlock(&r->local_zones->lock);
+		return NULL;
+	}
+	if(wr) {
+		lock_rw_wrlock(&z->lock);
+	} else {
+		lock_rw_rdlock(&z->lock);
+	}
+	if(!zones_keep_lock) {
+		lock_rw_unlock(&r->local_zones->lock);
+	}
+	return z;
+}
+
+/**
+ * Remove RR from RPZ's local-data
+ * @param z: local-zone for RPZ, holding write lock
+ * @param policydname: dname of RR to remove
+ * @param policydnamelen: lenth of policydname
+ * @param rr_type: RR type of RR to remove
+ * @param rdata: rdata of RR to remove
+ * @param rdatalen: length of rdata
+ * @return: 1 if zone must be removed after RR deletion
+ */
+static int
+rpz_data_delete_rr(struct local_zone* z, uint8_t* policydname,
+	size_t policydnamelen, uint16_t rr_type, uint8_t* rdata,
+	size_t rdatalen)
+{
+	struct local_data* ld;
+	struct packed_rrset_data* d;
+	size_t index;
+	ld = local_zone_find_data(z, policydname, policydnamelen,
+		dname_count_labels(policydname));
+	if(ld) {
+		struct local_rrset* prev=NULL, *p=ld->rrsets;
+		while(p && ntohs(p->rrset->rk.type) != rr_type) {
+			prev = p;
+			p = p->next;
+		}
+		if(!p)
+			return 0;
+		d = (struct packed_rrset_data*)p->rrset->entry.data;
+		if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
+			if(d->count == 1) {
+				/* no memory recycling for zone deletions ... */
+				if(prev) prev->next = p->next;
+				else ld->rrsets = p->next;
+			}
+			if(d->count > 1) {
+				if(!local_rrset_remove_rr(d, index))
+					return 0;
+			}
+		}
+	}
+	if(ld && ld->rrsets)
+		return 0;
+	return 1;
+}
+
+/**
+ * Remove RR from RPZ's respip set
+ * @param raddr: respip node
+ * @param rr_type: RR type of RR to remove
+ * @param rdata: rdata of RR to remove
+ * @param rdatalen: length of rdata
+ * @return: 1 if zone must be removed after RR deletion
+ */
+static int
+rpz_rrset_delete_rr(struct resp_addr* raddr, uint16_t rr_type, uint8_t* rdata,
+	size_t rdatalen)
+{
+	size_t index;
+	struct packed_rrset_data* d;
+	if(!raddr->data)
+		return 1;
+	d = raddr->data->entry.data;
+	if(ntohs(raddr->data->rk.type) != rr_type) {
+		return 0;
+	}
+	if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
+		if(d->count == 1) {
+			/* regional alloc'd */
+			raddr->data->entry.data = NULL; 
+			raddr->data = NULL;
+			return 1;
+		}
+		if(d->count > 1) {
+			if(!local_rrset_remove_rr(d, index))
+				return 0;
+		}
+	}
+	return 0;
+
+}
+
+/** Remove RR from RPZ's local-zone */
+static void
+rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+	enum rpz_action a, uint16_t rr_type, uint16_t rr_class,
+	uint8_t* rdatawl, size_t rdatalen)
+{
+	struct local_zone* z;
+	int delete_zone = 1;
+	z = rpz_find_zone(r, dname, dnamelen, rr_class,
+		1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/);
+	if(!z) {
+		verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
+			"RPZ domain not found");
+		return;
+	}
+	if(a == RPZ_LOCAL_DATA_ACTION)
+		delete_zone = rpz_data_delete_rr(z, dname,
+			dnamelen, rr_type, rdatawl, rdatalen);
+	else if(a != localzone_type_to_rpz_action(z->type)) {
+		return;
+	}
+	lock_rw_unlock(&z->lock); 
+	if(delete_zone) {
+		local_zones_del_zone(r->local_zones, z);
+	}
+	lock_rw_unlock(&r->local_zones->lock); 
+	return;
+}
+
+static void
+rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+	enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
+{
+	struct resp_addr* node;
+	struct sockaddr_storage addr;
+	socklen_t addrlen;
+	int net, af;
+	int delete_respip = 1;
+
+	if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
+		return;
+
+	lock_rw_wrlock(&r->respip_set->lock);
+	if(!(node = (struct resp_addr*)addr_tree_find(
+		&r->respip_set->ip_tree, &addr, addrlen, net))) {
+		verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
+			"RPZ domain not found");
+		lock_rw_unlock(&r->respip_set->lock);
+		return;
+	}
+
+	lock_rw_wrlock(&node->lock);
+	if(a == RPZ_LOCAL_DATA_ACTION) {
+		/* remove RR, signal whether RR can be removed */
+		delete_respip = rpz_rrset_delete_rr(node, rr_type, rdatawl, 
+			rdatalen);
+	}
+	lock_rw_unlock(&node->lock);
+	if(delete_respip)
+		respip_sockaddr_delete(r->respip_set, node);
+	lock_rw_unlock(&r->respip_set->lock);
+}
+
+void
+rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen,
+	uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen)
+{
+	size_t policydnamelen;
+	enum rpz_trigger t;
+	enum rpz_action a;
+	uint8_t* policydname;
+
+	if(!(policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1)))
+		return;
+
+	a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
+	if(a == RPZ_INVALID_ACTION) {
+		free(policydname);
+		return;
+	}
+	if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
+		policydname, LDNS_MAX_DOMAINLEN + 1))) {
+		free(policydname);
+		return;
+	}
+	t = rpz_dname_to_trigger(policydname, policydnamelen);
+	if(t == RPZ_QNAME_TRIGGER) {
+		rpz_remove_qname_trigger(r, policydname, policydnamelen, a,
+			rr_type, rr_class, rdatawl, rdatalen);
+	} else if(t == RPZ_RESPONSE_IP_TRIGGER) {
+		rpz_remove_response_ip_trigger(r, policydname, policydnamelen,
+			a, rr_type, rdatawl, rdatalen);
+	}
+	free(policydname);
+}
+
+/** print log information for an applied RPZ policy. Based on local-zone's
+ * lz_inform_print().
+ */
+static void
+log_rpz_apply(uint8_t* dname, enum rpz_action a, struct query_info* qinfo,
+	struct comm_reply* repinfo, char* log_name)
+{
+	char ip[128], txt[512];
+	char dnamestr[LDNS_MAX_DOMAINLEN+1];
+	uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
+	dname_str(dname, dnamestr);
+	addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
+	if(log_name)
+		snprintf(txt, sizeof(txt), "RPZ applied [%s] %s %s %s@%u",
+			log_name, dnamestr, rpz_action_to_string(a), ip,
+			(unsigned)port);
+	else
+		snprintf(txt, sizeof(txt), "RPZ applied %s %s %s@%u",
+			dnamestr, rpz_action_to_string(a), ip, (unsigned)port);
+	log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
+}
+
+int
+rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
+	struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
+	struct regional* temp, struct comm_reply* repinfo,
+	uint8_t* taglist, size_t taglen, struct ub_server_stats* stats)
+{
+	struct rpz* r;
+	int ret;
+	enum localzone_type lzt;
+	struct local_zone* z = NULL;
+	struct local_data* ld = NULL;
+	lock_rw_rdlock(&az->rpz_lock);
+	for(r = az->rpz_first; r; r = r->next) {
+		if(!r->taglist || taglist_intersect(r->taglist, 
+			r->taglistlen, taglist, taglen)) {
+			z = rpz_find_zone(r, qinfo->qname, qinfo->qname_len,
+				qinfo->qclass, 0, 0, 0);
+			if(z && r->action_override == RPZ_DISABLED_ACTION) {
+				if(r->log)
+					log_rpz_apply(z->name,
+						r->action_override,
+						qinfo, repinfo, r->log_name);
+				/* TODO only register stats when stats_extended?
+				 * */
+				stats->rpz_action[r->action_override]++;
+				lock_rw_unlock(&z->lock);
+				z = NULL;
+			}
+			if(z)
+				break;
+		}	
+	}
+	lock_rw_unlock(&az->rpz_lock);
+	if(!z)
+		return 0;
+
+	
+	if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
+		lzt = z->type;
+	else
+		lzt = rpz_action_to_localzone_type(r->action_override);
+
+	if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
+		qinfo->local_alias =
+			regional_alloc_zero(temp, sizeof(struct local_rrset));
+		if(!qinfo->local_alias) {
+			lock_rw_unlock(&z->lock);
+			return 0; /* out of memory */
+		}
+		qinfo->local_alias->rrset =
+			regional_alloc_init(temp, r->cname_override,
+				sizeof(*r->cname_override));
+		if(!qinfo->local_alias->rrset) {
+			lock_rw_unlock(&z->lock);
+			return 0; /* out of memory */
+		}
+		qinfo->local_alias->rrset->rk.dname = qinfo->qname;
+		qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
+		if(r->log)
+			log_rpz_apply(z->name, RPZ_CNAME_OVERRIDE_ACTION, 
+				qinfo, repinfo, r->log_name);
+		stats->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
+		lock_rw_unlock(&z->lock);
+		return 0;
+	}
+
+	if(lzt == local_zone_redirect && local_data_answer(z, env, qinfo,
+		edns, repinfo, buf, temp, dname_count_labels(qinfo->qname),
+		&ld, lzt, -1, NULL, 0, NULL, 0)) {
+		if(r->log)
+			log_rpz_apply(z->name,
+				localzone_type_to_rpz_action(lzt), qinfo,
+				repinfo, r->log_name);
+		stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
+		lock_rw_unlock(&z->lock);
+		return !qinfo->local_alias;
+	}
+
+	ret = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp,
+		0 /* no local data used */, lzt);
+	if(r->log)
+		log_rpz_apply(z->name, localzone_type_to_rpz_action(lzt),
+			qinfo, repinfo, r->log_name);
+	stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
+	lock_rw_unlock(&z->lock);
+
+	return ret;
+}
diff --git a/services/rpz.h b/services/rpz.h
new file mode 100644
index 000000000000..676a4f2a8406
--- /dev/null
+++ b/services/rpz.h
@@ -0,0 +1,201 @@
+/*
+ * services/rpz.h - rpz service
+ *
+ * Copyright (c) 2019, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains functions to enable RPZ service.
+ */
+
+#ifndef SERVICES_RPZ_H
+#define SERVICES_RPZ_H
+
+#include "services/localzone.h"
+#include "util/locks.h"
+#include "util/log.h"
+#include "util/config_file.h"
+#include "services/authzone.h"
+#include "sldns/sbuffer.h"
+#include "daemon/stats.h"
+#include "respip/respip.h"
+
+/**
+ * RPZ triggers, only the QNAME trigger is currently supported in Unbound.
+ */
+enum rpz_trigger {
+	RPZ_QNAME_TRIGGER = 0,
+	/* unsupported triggers */
+	RPZ_CLIENT_IP_TRIGGER,	 /* rpz-client-ip */
+	RPZ_RESPONSE_IP_TRIGGER, /* rpz-ip */
+	RPZ_NSDNAME_TRIGGER,	 /* rpz-nsdname */
+	RPZ_NSIP_TRIGGER,	 /* rpz-nsip */
+	RPZ_INVALID_TRIGGER, 	 /* dname does not contain valid trigger */
+};
+
+/**
+ * RPZ actions.
+ */
+enum rpz_action {
+	RPZ_NXDOMAIN_ACTION = 0,/* CNAME . */
+	RPZ_NODATA_ACTION,	/* CNAME *. */
+	RPZ_PASSTHRU_ACTION,	/* CNAME rpz-passthru. */
+	RPZ_DROP_ACTION,	/* CNAME rpz-drop. */
+	RPZ_TCP_ONLY_ACTION,	/* CNAME rpz-tcp-only. */
+	RPZ_INVALID_ACTION,	/* CNAME with (child of) TLD starting with
+				   "rpz-" in target, SOA, NS, DNAME and
+				   DNSSEC-related records. */
+	RPZ_LOCAL_DATA_ACTION,	/* anything else */
+	/* RPZ override actions */
+	RPZ_DISABLED_ACTION,    /* RPZ action disabled using override */
+	RPZ_NO_OVERRIDE_ACTION, /* RPZ action no override*/
+	RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/
+};
+
+/**
+ * RPZ containing policies. Pointed to from corresponding auth-zone. Part of a
+ * linked list to keep configuration order. Iterating or changing the linked
+ * list requires the rpz_lock from struct auth_zones.
+ */
+struct rpz {
+	struct local_zones* local_zones;
+	struct respip_set* respip_set;
+	uint8_t* taglist;
+	size_t taglistlen;
+	enum rpz_action action_override;
+	struct ub_packed_rrset_key* cname_override;
+	int log;
+	char* log_name;
+	struct rpz* next;
+	struct rpz* prev;
+	struct regional* region;
+};
+
+/**
+ * Create policy from RR and add to this RPZ.
+ * @param r: the rpz to add the policy to.
+ * @param aznamelen: the length of the auth-zone name
+ * @param dname: dname of the RR
+ * @param dnamelen: length of the dname
+ * @param rr_type: RR type of the RR
+ * @param rr_class: RR class of the RR
+ * @param rr_ttl: TTL of the RR
+ * @param rdatawl: rdata of the RR, prepended with the rdata size
+ * @param rdatalen: length if the RR, including the prepended rdata size
+ * @param rr: the complete RR, for logging purposes
+ * @param rr_len: the length of the complete RR
+ * @return: 0 on error
+ */
+int rpz_insert_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
+	size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
+	uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len);
+
+/**
+ * Delete policy matching RR, used for IXFR.
+ * @param r: the rpz to add the policy to.
+ * @param aznamelen: the length of the auth-zone name
+ * @param dname: dname of the RR
+ * @param dnamelen: length of the dname
+ * @param rr_type: RR type of the RR
+ * @param rr_class: RR class of the RR
+ * @param rdatawl: rdata of the RR, prepended with the rdata size
+ * @param rdatalen: length if the RR, including the prepended rdata size
+ */
+void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
+	size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl,
+	size_t rdatalen);
+
+/**
+ * Walk over the RPZ zones to find and apply a QNAME trigger policy.
+ * @param az: auth_zones struct, containing first RPZ item and RPZ lock
+ * @param env: module env
+ * @param qinfo: qinfo containing qname and qtype
+ * @param edns: edns data
+ * @param buf: buffer to write answer to
+ * @param temp: scratchpad
+ * @param repinfo: reply info
+ * @param taglist: taglist to lookup.
+ * @param taglen: lenth of taglist.
+ * @param stats: worker stats struct
+ * @return: 1 if client answer is ready, 0 to continue resolving
+ */
+int rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
+	struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
+	struct regional* temp, struct comm_reply* repinfo,
+	uint8_t* taglist, size_t taglen, struct ub_server_stats* stats);
+
+/**
+ * Delete RPZ
+ * @param r: RPZ struct to delete
+ */
+void rpz_delete(struct rpz* r);
+
+/**
+ * Clear local-zones and respip data in RPZ, used after reloading file or
+ * AXFR/HTTP transfer.
+ * @param r: RPZ to use
+ */
+int rpz_clear(struct rpz* r);
+
+/**
+ * Create RPZ. RPZ must be added to linked list after creation.
+ * @return: the newly created RPZ
+ */
+struct rpz* rpz_create(struct config_auth* p);
+
+/**
+ * String for RPZ action enum
+ * @param a: RPZ action to get string for
+ * @return: string for RPZ action
+ */
+const char* rpz_action_to_string(enum rpz_action a);
+
+enum rpz_action
+respip_action_to_rpz_action(enum respip_action a);
+
+/**
+ * Prepare RPZ after procesing feed content.
+ * @param r: RPZ to use
+ */
+void rpz_finish_config(struct rpz* r);
+
+/**
+ * Classify respip action for RPZ action
+ * @param a: RPZ action
+ * @return: the respip action
+ */
+enum respip_action
+rpz_action_to_respip_action(enum rpz_action a);
+
+#endif /* SERVICES_RPZ_H */
diff --git a/services/view.c b/services/view.c
index c6709e58fd6a..db48ae9545f8 100644
--- a/services/view.c
+++ b/services/view.c
@@ -198,8 +198,6 @@ views_apply_cfg(struct views* vs, struct config_file* cfg)
 						log_err("failed to insert "
 							"default zones into "
 							"local-zone list");
-						free(nd_str);
-						free(nd_type);
 						lock_rw_unlock(&v->lock);
 						return 0;
 					}
diff --git a/sldns/parse.c b/sldns/parse.c
index b30264e88e79..f4de8602fd69 100644
--- a/sldns/parse.c
+++ b/sldns/parse.c
@@ -120,7 +120,7 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
 			if (line_nr) {
 				*line_nr = *line_nr + 1;
 			}
-			if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
+			if (limit > 0 && (i+1 >= limit || (size_t)(t-token)+1 >= limit)) {
 				*t = '\0';
 				return -1;
 			}
@@ -141,7 +141,8 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
 		if (c != '\0' && c != '\n') {
 			i++;
 		}
-		if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
+		/* is there space for the character and the zero after it */
+		if (limit > 0 && (i+1 >= limit || (size_t)(t-token)+1 >= limit)) {
 			*t = '\0';
 			return -1;
 		}
@@ -326,8 +327,8 @@ sldns_bget_token_par(sldns_buffer *b, char *token, const char *delim,
 			/* in parentheses */
 			/* do not write ' ' if we want to skip spaces */
 			if(!(skipw && (strchr(skipw, c)||strchr(skipw, ' ')))) {
-				/* check for space for the space character */
-				if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
+				/* check for space for the space character and a zero delimiter after that. */
+				if (limit > 0 && (i+1 >= limit || (size_t)(t-token)+1 >= limit)) {
 					*t = '\0';
 					return -1;
 				}
@@ -354,7 +355,7 @@ sldns_bget_token_par(sldns_buffer *b, char *token, const char *delim,
 		}
 
 		i++;
-		if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
+		if (limit > 0 && (i+1 >= limit || (size_t)(t-token)+1 >= limit)) {
 			*t = '\0';
 			return -1;
 		}
diff --git a/sldns/str2wire.c b/sldns/str2wire.c
index 358e45345e65..977cda28a2da 100644
--- a/sldns/str2wire.c
+++ b/sldns/str2wire.c
@@ -80,7 +80,7 @@ static int sldns_str2wire_dname_buf_rel(const char* str, uint8_t* buf,
 	for (s = str; *s; s++, q++) {
 		if (q >= buf + *olen)
 			return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL, q-buf);
-		if (q > buf + LDNS_MAX_DOMAINLEN)
+		if (q >= buf + LDNS_MAX_DOMAINLEN)
 			return RET_ERR(LDNS_WIREPARSE_ERR_DOMAINNAME_OVERFLOW, q-buf);
 		switch (*s) {
 		case '.':
@@ -117,7 +117,7 @@ static int sldns_str2wire_dname_buf_rel(const char* str, uint8_t* buf,
 		if(rel) *rel = 1;
 		if (q >= buf + *olen)
 			return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL, q-buf);
-		if (q > buf + LDNS_MAX_DOMAINLEN) {
+		if (q >= buf + LDNS_MAX_DOMAINLEN) {
 			return RET_ERR(LDNS_WIREPARSE_ERR_DOMAINNAME_OVERFLOW, q-buf);
 		}
                 if (label_len > LDNS_MAX_LABELLEN) {
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index 1a66609cdd14..c46d41215ba3 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -548,10 +548,7 @@ morechecks(struct config_file* cfg)
 	/* check that the modules listed in module_conf exist */
 	check_modules_exist(cfg->module_conf);
 
-	/* There should be no reason for 'respip' module not to work with
-	 * dns64, but it's not explicitly confirmed,  so the combination is
-	 * excluded below.   It's simply unknown yet for the combination of
-	 * respip and other modules. */
+	/* Respip is known to *not* work with dns64. */
 	if(strcmp(cfg->module_conf, "iterator") != 0
 		&& strcmp(cfg->module_conf, "validator iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 validator iterator") != 0
@@ -560,7 +557,9 @@ morechecks(struct config_file* cfg)
 		&& strcmp(cfg->module_conf, "respip validator iterator") != 0
 #ifdef WITH_PYTHONMODULE
 		&& strcmp(cfg->module_conf, "python iterator") != 0
+		&& strcmp(cfg->module_conf, "python respip iterator") != 0
 		&& strcmp(cfg->module_conf, "python validator iterator") != 0
+		&& strcmp(cfg->module_conf, "python respip validator iterator") != 0
 		&& strcmp(cfg->module_conf, "validator python iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 python iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 python validator iterator") != 0
@@ -570,7 +569,9 @@ morechecks(struct config_file* cfg)
 #endif
 #ifdef USE_CACHEDB
 		&& strcmp(cfg->module_conf, "validator cachedb iterator") != 0
+		&& strcmp(cfg->module_conf, "respip validator cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "cachedb iterator") != 0
+		&& strcmp(cfg->module_conf, "respip cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 validator cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 cachedb iterator") != 0
 #endif
@@ -580,39 +581,61 @@ morechecks(struct config_file* cfg)
 		&& strcmp(cfg->module_conf, "dns64 python cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 python validator cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "python cachedb iterator") != 0
+		&& strcmp(cfg->module_conf, "python respip cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "python validator cachedb iterator") != 0
+		&& strcmp(cfg->module_conf, "python respip validator cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "cachedb python iterator") != 0
+		&& strcmp(cfg->module_conf, "respip cachedb python iterator") != 0
 		&& strcmp(cfg->module_conf, "validator cachedb python iterator") != 0
+		&& strcmp(cfg->module_conf, "respip validator cachedb python iterator") != 0
 		&& strcmp(cfg->module_conf, "validator python cachedb iterator") != 0
+		&& strcmp(cfg->module_conf, "respip validator python cachedb iterator") != 0
 #endif
 #ifdef CLIENT_SUBNET
 		&& strcmp(cfg->module_conf, "subnetcache iterator") != 0
+		&& strcmp(cfg->module_conf, "respip subnetcache iterator") != 0
 		&& strcmp(cfg->module_conf, "subnetcache validator iterator") != 0
+		&& strcmp(cfg->module_conf, "respip subnetcache validator iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 subnetcache iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 subnetcache validator iterator") != 0
 #endif
 #if defined(WITH_PYTHONMODULE) && defined(CLIENT_SUBNET)
 		&& strcmp(cfg->module_conf, "python subnetcache iterator") != 0
+		&& strcmp(cfg->module_conf, "python respip subnetcache iterator") != 0
 		&& strcmp(cfg->module_conf, "subnetcache python iterator") != 0
+		&& strcmp(cfg->module_conf, "respip subnetcache python iterator") != 0
 		&& strcmp(cfg->module_conf, "python subnetcache validator iterator") != 0
+		&& strcmp(cfg->module_conf, "python respip subnetcache validator iterator") != 0
 		&& strcmp(cfg->module_conf, "subnetcache python validator iterator") != 0
+		&& strcmp(cfg->module_conf, "respip subnetcache python validator iterator") != 0
 		&& strcmp(cfg->module_conf, "subnetcache validator python iterator") != 0
+		&& strcmp(cfg->module_conf, "respip subnetcache validator python iterator") != 0
 #endif
 #ifdef USE_IPSECMOD
 		&& strcmp(cfg->module_conf, "ipsecmod iterator") != 0
+		&& strcmp(cfg->module_conf, "ipsecmod respip iterator") != 0
 		&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
+		&& strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
 #endif
 #if defined(WITH_PYTHONMODULE) && defined(USE_IPSECMOD)
 		&& strcmp(cfg->module_conf, "python ipsecmod iterator") != 0
+		&& strcmp(cfg->module_conf, "python ipsecmod respip iterator") != 0
 		&& strcmp(cfg->module_conf, "ipsecmod python iterator") != 0
+		&& strcmp(cfg->module_conf, "ipsecmod python respip iterator") != 0
 		&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
+		&& strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
 		&& strcmp(cfg->module_conf, "python ipsecmod validator iterator") != 0
+		&& strcmp(cfg->module_conf, "python ipsecmod respip validator iterator") != 0
 		&& strcmp(cfg->module_conf, "ipsecmod python validator iterator") != 0
+		&& strcmp(cfg->module_conf, "ipsecmod python respip validator iterator") != 0
 		&& strcmp(cfg->module_conf, "ipsecmod validator python iterator") != 0
+		&& strcmp(cfg->module_conf, "ipsecmod respip validator python iterator") != 0
 #endif
 #ifdef USE_IPSET
 		&& strcmp(cfg->module_conf, "validator ipset iterator") != 0
+		&& strcmp(cfg->module_conf, "validator ipset respip iterator") != 0
 		&& strcmp(cfg->module_conf, "ipset iterator") != 0
+		&& strcmp(cfg->module_conf, "ipset respip iterator") != 0
 #endif
 		) {
 		fatal_exit("module conf '%s' is not known to work",
@@ -676,8 +699,9 @@ check_hints(struct config_file* cfg)
 static void
 check_auth(struct config_file* cfg)
 {
+	int is_rpz = 0;
 	struct auth_zones* az = auth_zones_create();
-	if(!az || !auth_zones_apply_cfg(az, cfg, 0)) {
+	if(!az || !auth_zones_apply_cfg(az, cfg, 0i, &is_rpz)) {
 		fatal_exit("Could not setup authority zones");
 	}
 	auth_zones_delete(az);
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index ed8bad1e9719..4843a9b3112b 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -62,6 +62,7 @@
 #include "daemon/stats.h"
 #include "sldns/wire2str.h"
 #include "sldns/pkthdr.h"
+#include "services/rpz.h"
 
 #ifdef HAVE_SYS_IPC_H
 #include "sys/ipc.h"
@@ -157,6 +158,8 @@ usage(void)
 	printf("  view_local_datas view 		add list of local-data to view\n");
 	printf("  					one entry per line read from stdin\n");
 	printf("  view_local_data_remove view name  	remove local-data in view\n");
+	printf("  view_local_datas_remove view 		remove list of local-data from view\n");
+	printf("  					one entry per line read from stdin\n");
 	printf("Version %s\n", PACKAGE_VERSION);
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
@@ -208,7 +211,7 @@ static void pr_stats(const char* nm, struct ub_stats_info* s)
 		s->svr.num_queries - s->svr.num_queries_missed_cache);
 	PR_UL_NM("num.cachemiss", s->svr.num_queries_missed_cache);
 	PR_UL_NM("num.prefetch", s->svr.num_queries_prefetch);
-	PR_UL_NM("num.zero_ttl", s->svr.zero_ttl_responses);
+	PR_UL_NM("num.expired", s->svr.ans_expired);
 	PR_UL_NM("num.recursivereplies", s->mesh_replies_sent);
 #ifdef USE_DNSCRYPT
     PR_UL_NM("num.dnscrypt.crypted", s->svr.num_query_dnscrypt_crypted);
@@ -372,6 +375,14 @@ static void print_extended(struct ub_stats_info* s)
 	PR_UL("rrset.cache.count", s->svr.rrset_cache_count);
 	PR_UL("infra.cache.count", s->svr.infra_cache_count);
 	PR_UL("key.cache.count", s->svr.key_cache_count);
+	/* applied RPZ actions */
+	for(i=0; i<UB_STATS_RPZ_ACTION_NUM; i++) {
+		if(i == RPZ_NO_OVERRIDE_ACTION)
+			continue;
+		if(inhibit_zero && s->svr.rpz_action[i] == 0)
+			continue;
+		PR_UL_SUB("num.rpz.action", rpz_action_to_string(i), s->svr.rpz_action[i]);
+	}
 #ifdef USE_DNSCRYPT
 	PR_UL("dnscrypt_shared_secret.cache.count",
 			 s->svr.shared_secret_cache_count);
@@ -493,9 +504,11 @@ setup_ctx(struct config_file* cfg)
 	ctx = SSL_CTX_new(SSLv23_client_method());
 	if(!ctx)
 		ssl_err("could not allocate SSL_CTX pointer");
+#if SSL_OP_NO_SSLv2 != 0
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
 		!= SSL_OP_NO_SSLv2)
 		ssl_err("could not set SSL_OP_NO_SSLv2");
+#endif
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
 		!= SSL_OP_NO_SSLv3)
 		ssl_err("could not set SSL_OP_NO_SSLv3");
@@ -704,7 +717,8 @@ check_args_for_listcmd(int argc, char* argv[])
 		fatal_exit("too many arguments for command '%s', "
 			"content is piped in from stdin", argv[0]);
 	}
-	if(argc >= 1 && strcmp(argv[0], "view_local_datas") == 0 &&
+	if(argc >= 1 && (strcmp(argv[0], "view_local_datas") == 0 ||
+		strcmp(argv[0], "view_local_datas_remove") == 0) &&
 		argc >= 3) {
 		fatal_exit("too many arguments for command '%s', "
 			"content is piped in from stdin", argv[0]);
@@ -753,7 +767,8 @@ go_cmd(SSL* ssl, int fd, int quiet, int argc, char* argv[])
 		strcmp(argv[0], "local_zones_remove") == 0 ||
 		strcmp(argv[0], "local_datas") == 0 ||
 		strcmp(argv[0], "view_local_datas") == 0 ||
-		strcmp(argv[0], "local_datas_remove") == 0)) {
+		strcmp(argv[0], "local_datas_remove") == 0 ||
+		strcmp(argv[0], "view_local_datas_remove") == 0)) {
 		send_file(ssl, fd, stdin, buf, sizeof(buf));
 		send_eof(ssl, fd);
 	}
diff --git a/testcode/petal.c b/testcode/petal.c
index dcc31fdc5d99..123684aab52d 100644
--- a/testcode/petal.c
+++ b/testcode/petal.c
@@ -234,7 +234,9 @@ setup_ctx(char* key, char* cert)
 {
 	SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method());
 	if(!ctx) print_exit("out of memory");
+#if SSL_OP_NO_SSLv2 != 0
 	(void)SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
+#endif
 	(void)SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3);
 	if(!SSL_CTX_use_certificate_chain_file(ctx, cert))
 		print_exit("cannot read cert");
diff --git a/testcode/replay.h b/testcode/replay.h
index 0cce0b490105..5132cdacbd47 100644
--- a/testcode/replay.h
+++ b/testcode/replay.h
@@ -74,18 +74,18 @@
  *	o CHECK_ANSWER - followed by entry
  *	o CHECK_OUT_QUERY - followed by entry (if copy-id it is also reply).
  *	o REPLY - followed by entry
- *      o TIMEOUT
- *      o TIME_PASSES ELAPSE [seconds] - increase 'now' time counter, can be 
- *      			a floating point number.
- *        TIME_PASSES EVAL [macro] - expanded for seconds to move time.
- *      o TRAFFIC - like CHECK_ANSWER, causes traffic to flow.
+ *	o TIMEOUT
+ *	o TIME_PASSES ELAPSE [seconds] - increase 'now' time counter, can be
+ *		a floating point number.
+ *	  TIME_PASSES EVAL [macro] - expanded for seconds to move time.
+ *	o TRAFFIC - like CHECK_ANSWER, causes traffic to flow.
  *		actually the traffic flows before this step is taken.
  *		the step waits for traffic to stop.
- *      o CHECK_AUTOTRUST [id] - followed by FILE_BEGIN [to match] FILE_END.
- *      	The file contents is macro expanded before match.
- *      o CHECK_TEMPFILE [fname] - followed by FILE_BEGIN [to match] FILE_END
- *      o INFRA_RTT [ip] [dp] [rtt] - update infra cache entry with rtt.
- *      o ERROR
+ *	o CHECK_AUTOTRUST [id] - followed by FILE_BEGIN [to match] FILE_END.
+ *		The file contents is macro expanded before match.
+ *	o CHECK_TEMPFILE [fname] - followed by FILE_BEGIN [to match] FILE_END
+ *	o INFRA_RTT [ip] [dp] [rtt] - update infra cache entry with rtt.
+ *	o ERROR
  * ; following entry starts on the next line, ENTRY_BEGIN.
  * ; more STEP items
  * SCENARIO_END
diff --git a/testcode/unitdname.c b/testcode/unitdname.c
index 238c3edf7ade..6769127b9349 100644
--- a/testcode/unitdname.c
+++ b/testcode/unitdname.c
@@ -794,6 +794,34 @@ dname_test_valid(void)
 		, 4096) == 0);
 }
 
+/** Test dname_has_label */
+static void
+dname_test_has_label(void)
+{
+	unit_show_func("util/data/dname.c", "dname_has_label");
+	/* label past root label */
+	unit_assert(dname_has_label((uint8_t*)"\01a\0\01c", 5, (uint8_t*)"\01c") == 0);
+	/* label not found */
+	unit_assert(dname_has_label((uint8_t*)"\02ab\01c\0", 6, (uint8_t*)"\01e") == 0);
+	/* buffer too short */
+	unit_assert(dname_has_label((uint8_t*)"\02ab\01c\0", 5, (uint8_t*)"\0") == 0);
+	unit_assert(dname_has_label((uint8_t*)"\1a\0", 2, (uint8_t*)"\0") == 0);
+	unit_assert(dname_has_label((uint8_t*)"\0", 0, (uint8_t*)"\0") == 0);
+	unit_assert(dname_has_label((uint8_t*)"\02ab\01c", 4, (uint8_t*)"\01c") == 0);
+	unit_assert(dname_has_label((uint8_t*)"\02ab\03qwe\06oqieur\03def\01c\0", 19, (uint8_t*)"\01c") == 0);
+
+	/* positive cases  */
+	unit_assert(dname_has_label((uint8_t*)"\0", 1, (uint8_t*)"\0") == 1);
+	unit_assert(dname_has_label((uint8_t*)"\1a\0", 3, (uint8_t*)"\0") == 1);
+	unit_assert(dname_has_label((uint8_t*)"\01a\0\01c", 5, (uint8_t*)"\0") == 1);
+	unit_assert(dname_has_label((uint8_t*)"\02ab\01c", 5, (uint8_t*)"\01c") == 1);
+	unit_assert(dname_has_label((uint8_t*)"\02ab\01c\0", 10, (uint8_t*)"\0") == 1);
+	unit_assert(dname_has_label((uint8_t*)"\02ab\01c\0", 7, (uint8_t*)"\0") == 1);
+	unit_assert(dname_has_label((uint8_t*)"\02ab\03qwe\06oqieur\03def\01c\0", 22, (uint8_t*)"\03def") == 1);
+	unit_assert(dname_has_label((uint8_t*)"\02ab\03qwe\06oqieur\03def\01c\0", 22, (uint8_t*)"\02ab") == 1);
+	unit_assert(dname_has_label((uint8_t*)"\02ab\03qwe\06oqieur\03def\01c\0", 22, (uint8_t*)"\01c") == 1);
+}
+
 /** test pkt_dname_tolower */
 static void
 dname_test_pdtl(sldns_buffer* loopbuf, sldns_buffer* boundbuf)
@@ -855,6 +883,7 @@ void dname_test(void)
 	dname_test_canoncmp();
 	dname_test_topdomain();
 	dname_test_valid();
+	dname_test_has_label();
 	sldns_buffer_free(buff);
 	sldns_buffer_free(loopbuf);
 	sldns_buffer_free(boundbuf);
diff --git a/testdata/auth_zonefile_dnssec_fail.rpl b/testdata/auth_zonefile_dnssec_fail.rpl
index 49da19993a63..7e4e51de5cd4 100644
--- a/testdata/auth_zonefile_dnssec_fail.rpl
+++ b/testdata/auth_zonefile_dnssec_fail.rpl
@@ -47,7 +47,9 @@ ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752
 ; this RR is edited to create the failure
 ;www.example.com. IN A   10.20.30.40
 www.example.com. IN A   127.0.0.1
-www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+; also edits the signature to fail, without needing crypto checks.
+;www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 28540 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
 
 TEMPFILE_END
 
diff --git a/testdata/dnscrypt_queries.tdir/1.cert b/testdata/dnscrypt_queries.tdir/1.cert
deleted file mode 100644
index fbc529bfa3ab..000000000000
--- a/testdata/dnscrypt_queries.tdir/1.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries.tdir/1.key b/testdata/dnscrypt_queries.tdir/1.key
deleted file mode 100644
index 165262c86e53..000000000000
--- a/testdata/dnscrypt_queries.tdir/1.key
+++ /dev/null
@@ -1 +0,0 @@
-®öÝìK¬‡#‘€4ùsŽ	pèÖôÁæÀx!¹»AŠ"mM
\ No newline at end of file
diff --git a/testdata/dnscrypt_queries.tdir/1_chacha.cert b/testdata/dnscrypt_queries.tdir/1_chacha.cert
deleted file mode 100644
index 3da5c612d060..000000000000
--- a/testdata/dnscrypt_queries.tdir/1_chacha.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries.tdir/1_salsa.cert b/testdata/dnscrypt_queries.tdir/1_salsa.cert
deleted file mode 100644
index 17e447fc339b..000000000000
--- a/testdata/dnscrypt_queries.tdir/1_salsa.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries.tdir/2.cert b/testdata/dnscrypt_queries.tdir/2.cert
deleted file mode 100644
index ebf8ac108d14..000000000000
--- a/testdata/dnscrypt_queries.tdir/2.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries.tdir/2.key b/testdata/dnscrypt_queries.tdir/2.key
deleted file mode 100644
index c299f550ae95..000000000000
--- a/testdata/dnscrypt_queries.tdir/2.key
+++ /dev/null
@@ -1 +0,0 @@
-m7Ÿñâƒx;‘%׸õ�é*•ÜR¯äÓ¯¹mDªñ
\ No newline at end of file
diff --git a/testdata/dnscrypt_queries.tdir/2_chacha.cert b/testdata/dnscrypt_queries.tdir/2_chacha.cert
deleted file mode 100644
index ed4ec26065a6..000000000000
--- a/testdata/dnscrypt_queries.tdir/2_chacha.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries.tdir/2_salsa.cert b/testdata/dnscrypt_queries.tdir/2_salsa.cert
deleted file mode 100644
index 6e71fe97864d..000000000000
--- a/testdata/dnscrypt_queries.tdir/2_salsa.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.conf b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.conf
deleted file mode 100644
index 355d4ff13595..000000000000
--- a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.conf
+++ /dev/null
@@ -1,26 +0,0 @@
-server:
-	verbosity: 2
-	# num-threads: 1
-	port: @PORT@
-    interface: 0.0.0.0
-    interface: 0.0.0.0@@DNSCRYPT_PORT@
-	use-syslog: no
-	directory: .
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-
-forward-zone:
-	name: "."
-	forward-addr: "127.0.0.1@@TOPORT@"
-
-dnscrypt:
-    dnscrypt-enable: yes
-    dnscrypt-port: @DNSCRYPT_PORT@
-    dnscrypt-provider: 2.dnscrypt-cert.example.com.
-    dnscrypt-secret-key: 1.key
-    dnscrypt-secret-key: 2.key
-    dnscrypt-provider-cert: 1_salsa.cert
-    dnscrypt-provider-cert: 2_salsa.cert
-
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.dsc b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.dsc
deleted file mode 100644
index e1e653e57117..000000000000
--- a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.dsc
+++ /dev/null
@@ -1,16 +0,0 @@
-BaseName: dnscrypt_queries
-Version: 1.0
-Description: dnscrypt queries.
-CreationDate: Fri Mar 03 10:08:08 CEST 2017
-Maintainer: Emmanuel Bretelle
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: dnscrypt_queries.pre
-Post: dnscrypt_queries.post
-Test: dnscrypt_queries.test
-AuxFiles: 
-Passed:
-Failure:
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.post b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.post
deleted file mode 100644
index b61480616892..000000000000
--- a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.post
+++ /dev/null
@@ -1,20 +0,0 @@
-# #-- dnscrypt_queries.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-PRE="../.."
-. ../common.sh
-# if no dnscrypt; exit
-if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
-        echo "have dnscrypt"
-else
-        echo "no dnscrypt"
-        exit 0
-fi
-
-kill_pid $FWD_PID
-kill_pid $UNBOUND_PID
-kill_pid $PROXY_PID
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.pre b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.pre
deleted file mode 100644
index 288a66541a34..000000000000
--- a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.pre
+++ /dev/null
@@ -1,53 +0,0 @@
-# #-- dnscrypt_queries.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-# if no dnscrypt; exit
-if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
-        echo "have dnscrypt"
-else
-        echo "no dnscrypt"
-        exit 0
-fi
-
-get_random_port 4
-UNBOUND_PORT=$RND_PORT
-FWD_PORT=$(($RND_PORT + 1))
-DNSCRYPT_PORT=$(($RND_PORT + 2))
-PROXY_PORT=$(($RND_PORT + 3))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
-echo "DNSCRYPT_PORT=$DNSCRYPT_PORT" >> .tpkg.var.test
-echo "PROXY_PORT=$PROXY_PORT" >> .tpkg.var.test
-
-# start forwarder
-get_ldns_testns
-$LDNS_TESTNS -p $FWD_PORT dnscrypt_queries.testns >fwd.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-
-dnscrypt-proxy --local-address=127.0.0.1:${PROXY_PORT} \
-    --resolver-address=127.0.0.1:${DNSCRYPT_PORT} \
-    --provider-name=2.dnscrypt-cert.example.com \
-    --provider-key=B85F:41A1:4F23:F7DB:C866:F397:CC6F:44B6:5F9D:65C5:B629:7C27:5403:A6E9:DCF2:4F9D \
-    -m 32 \
-    >dnscryptproxy.log 2>&1 &
-PROXY_PID=$!
-echo "PROXY_PID=$PROXY_PID" >> .tpkg.var.test
-
-# make config file
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' \
-    -e 's/@DNSCRYPT_PORT\@/'$DNSCRYPT_PORT'/' < dnscrypt_queries.conf > ub.conf
-# start unbound in the background
-$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_ldns_testns_up fwd.log
-wait_unbound_up unbound.log
-wait_server_up dnscryptproxy.log "Proxying from"
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.test b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.test
deleted file mode 100644
index 5614a444da05..000000000000
--- a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.test
+++ /dev/null
@@ -1,107 +0,0 @@
-# #-- dnscrypt_queries.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-# if no dnscrypt; exit
-if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
-        echo "have dnscrypt"
-else
-        echo "no dnscrypt"
-        exit 0
-fi
-
-
-# do the test
-for opt in '' '+tcp'
-do
-    echo "> do queries ${opt}"
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www1.example.com. >outfile1 &
-    digpid1=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www2.example.com. >outfile2 &
-    digpid2=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www3.example.com. >outfile3 &
-    digpid3=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www4.example.com. >outfile4 &
-    digpid4=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www5.example.com. >outfile5 &
-    digpid5=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www6.example.com. >outfile6 &
-    digpid6=$!
-    sleep 1
-    kill -9 $digpid1
-    kill -9 $digpid2
-    kill -9 $digpid3
-    kill -9 $digpid4
-    kill -9 $digpid5
-    kill -9 $digpid6
-
-    echo "> cat outfile1"
-    cat outfile1 
-    echo "> cat outfile2"
-    cat outfile2 
-    echo "> cat outfile3"
-    cat outfile3
-    echo "> cat outfile4"
-    cat outfile4
-    echo "> cat outfile5"
-    cat outfile5
-    echo "> cat outfile6"
-    cat outfile6
-    echo "> cat logfiles"
-    cat fwd.log 
-    cat unbound.log
-
-    echo "> check for ID bit collisions"
-    grep "pending reply" unbound.log > ids
-    numsend=`cat ids | wc -l`
-    cat ids | awk '{print $8};' | sort -u > ids2
-    numuniq=`cat ids2 | wc -l`
-    if test $numuniq -ne $numsend; then
-        echo "got a ID number clash. could not do test, sorry"
-        exit 0
-    fi
-
-    echo "> check answers for queries"
-    if grep "10.20.30.40" outfile1; then
-        echo "1 is OK"
-    else
-        echo "1 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.50" outfile2; then
-        echo "2 is OK"
-    else
-        echo "2 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.60" outfile3; then
-        echo "3 is OK"
-    else
-        echo "3 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.70" outfile4; then
-        echo "4 is OK"
-    else
-        echo "4 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.80" outfile5; then
-        echo "5 is OK"
-    else
-        echo "5 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.90" outfile6; then
-        echo "6 is OK"
-    else
-        echo "6 is not OK"
-        exit 1
-    fi
-done
-
-exit 0
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.testns b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.testns
deleted file mode 100644
index f03c15f764ca..000000000000
--- a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.testns
+++ /dev/null
@@ -1,63 +0,0 @@
-; nameserver test file
-$ORIGIN example.com.
-$TTL 3600
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www1	IN	A
-SECTION ANSWER
-www1	IN	A	10.20.30.40
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www2	IN	A
-SECTION ANSWER
-www2	IN	A	10.20.30.50
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www3	IN	A
-SECTION ANSWER
-www3	IN	A	10.20.30.60
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www4	IN	A
-SECTION ANSWER
-www4	IN	A	10.20.30.70
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www5	IN	A
-SECTION ANSWER
-www5	IN	A	10.20.30.80
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www6	IN	A
-SECTION ANSWER
-www6	IN	A	10.20.30.90
-ENTRY_END
diff --git a/testdata/dnscrypt_queries_chacha.tdir/1.key b/testdata/dnscrypt_queries_chacha.tdir/1.key
deleted file mode 100644
index 165262c86e53..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/1.key
+++ /dev/null
@@ -1 +0,0 @@
-®öÝìK¬‡#‘€4ùsŽ	pèÖôÁæÀx!¹»AŠ"mM
\ No newline at end of file
diff --git a/testdata/dnscrypt_queries_chacha.tdir/1_chacha.cert b/testdata/dnscrypt_queries_chacha.tdir/1_chacha.cert
deleted file mode 100644
index 3da5c612d060..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/1_chacha.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries_chacha.tdir/1_salsa.cert b/testdata/dnscrypt_queries_chacha.tdir/1_salsa.cert
deleted file mode 100644
index 17e447fc339b..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/1_salsa.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries_chacha.tdir/2.key b/testdata/dnscrypt_queries_chacha.tdir/2.key
deleted file mode 100644
index c299f550ae95..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/2.key
+++ /dev/null
@@ -1 +0,0 @@
-m7Ÿñâƒx;‘%׸õ�é*•ÜR¯äÓ¯¹mDªñ
\ No newline at end of file
diff --git a/testdata/dnscrypt_queries_chacha.tdir/2_chacha.cert b/testdata/dnscrypt_queries_chacha.tdir/2_chacha.cert
deleted file mode 100644
index ed4ec26065a6..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/2_chacha.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries_chacha.tdir/2_salsa.cert b/testdata/dnscrypt_queries_chacha.tdir/2_salsa.cert
deleted file mode 100644
index 6e71fe97864d..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/2_salsa.cert
+++ /dev/null
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.conf b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.conf
deleted file mode 100644
index 9e269ba60ce3..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.conf
+++ /dev/null
@@ -1,24 +0,0 @@
-server:
-	verbosity: 2
-	# num-threads: 1
-	port: @PORT@
-    interface: 0.0.0.0
-    interface: 0.0.0.0@@DNSCRYPT_PORT@
-	use-syslog: no
-	directory: .
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-
-forward-zone:
-	name: "."
-	forward-addr: "127.0.0.1@@TOPORT@"
-
-dnscrypt:
-    dnscrypt-enable: yes
-    dnscrypt-port: @DNSCRYPT_PORT@
-    dnscrypt-provider: 2.dnscrypt-cert.example.com.
-    dnscrypt-secret-key: 2.key
-    dnscrypt-provider-cert: 2_salsa.cert
-    dnscrypt-provider-cert: 2_chacha.cert
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.dsc b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.dsc
deleted file mode 100644
index 372126bc3e41..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.dsc
+++ /dev/null
@@ -1,16 +0,0 @@
-BaseName: dnscrypt_queries_chacha
-Version: 1.0
-Description: dnscrypt queries using xchacha
-CreationDate: Thu Jun 01 10:08:08 CEST 2017
-Maintainer: Emmanuel Bretelle
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: dnscrypt_queries_chacha.pre
-Post: dnscrypt_queries_chacha.post
-Test: dnscrypt_queries_chacha.test
-AuxFiles: 
-Passed:
-Failure:
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.post b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.post
deleted file mode 100644
index 1ca6a7e3f1de..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.post
+++ /dev/null
@@ -1,17 +0,0 @@
-# #-- dnscrypt_queries_chacha.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-PRE="../.."
-. ../common.sh
-
-# Check if we can run the test.
-. ./precheck.sh
-
-
-kill_pid $FWD_PID
-kill_pid $UNBOUND_PID
-kill_pid $PROXY_PID
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.pre b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.pre
deleted file mode 100644
index 6474c540dd6e..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.pre
+++ /dev/null
@@ -1,52 +0,0 @@
-# #-- dnscrypt_queries_chacha.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-# Check if we can run the test.
-. ./precheck.sh
-
-get_random_port 4
-UNBOUND_PORT=$RND_PORT
-FWD_PORT=$(($RND_PORT + 1))
-DNSCRYPT_PORT=$(($RND_PORT + 2))
-PROXY_PORT=$(($RND_PORT + 3))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
-echo "DNSCRYPT_PORT=$DNSCRYPT_PORT" >> .tpkg.var.test
-echo "PROXY_PORT=$PROXY_PORT" >> .tpkg.var.test
-
-# start forwarder
-get_ldns_testns
-$LDNS_TESTNS -p $FWD_PORT dnscrypt_queries_chacha.testns >fwd.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-
-dnscrypt-proxy --local-address=127.0.0.1:${PROXY_PORT} \
-    --resolver-address=127.0.0.1:${DNSCRYPT_PORT} \
-    --provider-name=2.dnscrypt-cert.example.com \
-    --provider-key=C352:1F20:F2D2:FD65:B5F4:7BF6:6C1A:88C1:4BCB:80CE:1E3A:3572:5CB1:7D4B:12D3:E783 \
-    -m 32 \
-    >dnscryptproxy.log 2>&1 &
-PROXY_PID=$!
-echo "PROXY_PID=$PROXY_PID" >> .tpkg.var.test
-
-# make config file
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' \
-    -e 's/@DNSCRYPT_PORT\@/'$DNSCRYPT_PORT'/' < dnscrypt_queries_chacha.conf > ub.conf
-# start unbound in the background
-$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_ldns_testns_up fwd.log
-wait_unbound_up unbound.log
-wait_server_up dnscryptproxy.log "Proxying from"
-if ! grep 'Using version 2.0 of the DNSCrypt protocol' dnscryptproxy.log; then
-    echo "Failed to select xchacha cert"
-    exit 1
-fi
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.test b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.test
deleted file mode 100644
index 455c506a0d49..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.test
+++ /dev/null
@@ -1,101 +0,0 @@
-# #-- dnscrypt_queries_chacha.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-# Check if we can run the test.
-. ./precheck.sh
-
-# do the test
-for opt in '' '+tcp'
-do
-    echo "> do queries ${opt}"
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www1.example.com. >outfile1 &
-    digpid1=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www2.example.com. >outfile2 &
-    digpid2=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www3.example.com. >outfile3 &
-    digpid3=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www4.example.com. >outfile4 &
-    digpid4=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www5.example.com. >outfile5 &
-    digpid5=$!
-    dig @127.0.0.1 ${opt} -p $PROXY_PORT www6.example.com. >outfile6 &
-    digpid6=$!
-    sleep 1
-    kill -9 $digpid1
-    kill -9 $digpid2
-    kill -9 $digpid3
-    kill -9 $digpid4
-    kill -9 $digpid5
-    kill -9 $digpid6
-
-    echo "> cat outfile1"
-    cat outfile1 
-    echo "> cat outfile2"
-    cat outfile2 
-    echo "> cat outfile3"
-    cat outfile3
-    echo "> cat outfile4"
-    cat outfile4
-    echo "> cat outfile5"
-    cat outfile5
-    echo "> cat outfile6"
-    cat outfile6
-    echo "> cat logfiles"
-    cat fwd.log 
-    cat unbound.log
-
-    echo "> check for ID bit collisions"
-    grep "pending reply" unbound.log > ids
-    numsend=`cat ids | wc -l`
-    cat ids | awk '{print $8};' | sort -u > ids2
-    numuniq=`cat ids2 | wc -l`
-    if test $numuniq -ne $numsend; then
-        echo "got a ID number clash. could not do test, sorry"
-        exit 0
-    fi
-
-    echo "> check answers for queries"
-    if grep "10.20.30.40" outfile1; then
-        echo "1 is OK"
-    else
-        echo "1 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.50" outfile2; then
-        echo "2 is OK"
-    else
-        echo "2 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.60" outfile3; then
-        echo "3 is OK"
-    else
-        echo "3 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.70" outfile4; then
-        echo "4 is OK"
-    else
-        echo "4 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.80" outfile5; then
-        echo "5 is OK"
-    else
-        echo "5 is not OK"
-        exit 1
-    fi
-    if grep "10.20.30.90" outfile6; then
-        echo "6 is OK"
-    else
-        echo "6 is not OK"
-        exit 1
-    fi
-done
-
-exit 0
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.testns b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.testns
deleted file mode 100644
index f03c15f764ca..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.testns
+++ /dev/null
@@ -1,63 +0,0 @@
-; nameserver test file
-$ORIGIN example.com.
-$TTL 3600
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www1	IN	A
-SECTION ANSWER
-www1	IN	A	10.20.30.40
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www2	IN	A
-SECTION ANSWER
-www2	IN	A	10.20.30.50
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www3	IN	A
-SECTION ANSWER
-www3	IN	A	10.20.30.60
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www4	IN	A
-SECTION ANSWER
-www4	IN	A	10.20.30.70
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www5	IN	A
-SECTION ANSWER
-www5	IN	A	10.20.30.80
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www6	IN	A
-SECTION ANSWER
-www6	IN	A	10.20.30.90
-ENTRY_END
diff --git a/testdata/dnscrypt_queries_chacha.tdir/precheck.sh b/testdata/dnscrypt_queries_chacha.tdir/precheck.sh
deleted file mode 100644
index 8288d9516eb1..000000000000
--- a/testdata/dnscrypt_queries_chacha.tdir/precheck.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-# dnscrypt precheck.sh
-
-# if no dnscrypt; exit
-if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
-        echo "have dnscrypt"
-else
-        echo "no dnscrypt"
-        exit 0
-fi
-
-# if no xchacha20 support in unbound; exit
-if grep "define USE_DNSCRYPT_XCHACHA20 1" $PRE/config.h; then
-        echo "have xchacha20"
-        xchacha20=1
-else
-        echo "no xchacha20"
-        xchacha20=0
-        exit 0
-fi
-
-# if dnscrypt-proxy does not support xchacha20; exit
-if (dnscrypt-proxy -h 2>&1 | grep -q 'XChaCha20-Poly1305 cipher: present'); then
-		echo "dnscrypt-proxy has xchacha20"
-else
-		echo "dnscrypt-proxy does not have xchacha20"
-		exit 0
-fi
diff --git a/testdata/remote-threaded.tdir/remote-threaded.test b/testdata/remote-threaded.tdir/remote-threaded.test
index 7392fa9097ca..e2f6b2783aaa 100644
--- a/testdata/remote-threaded.tdir/remote-threaded.test
+++ b/testdata/remote-threaded.tdir/remote-threaded.test
@@ -25,7 +25,7 @@ if grep "10.20.30.40" outfile; then
 	echo "OK"
 else
 	echo "> cat logfiles"
-	cat fwd.log 
+	cat fwd.log
 	cat unbound.log
 	echo "Not OK"
 	exit 1
@@ -37,7 +37,7 @@ $PRE/unbound-control -c ub.conf blablargh
 if test $? -ne 1; then
 	echo "wrong exit value on error."
 	echo "> cat logfiles"
-	cat fwd.log 
+	cat fwd.log
 	cat unbound.log
 	exit 1
 else
@@ -61,7 +61,7 @@ if grep "5.6.7.8" outfile; then
 	echo "OK"
 else
 	echo "> cat logfiles"
-	cat fwd.log 
+	cat fwd.log
 	cat unbound.log
 	echo "Not OK"
 	exit 1
@@ -72,6 +72,8 @@ echo "$PRE/unbound-control -c ub.conf stats"
 $PRE/unbound-control -c ub.conf stats > tmp.$$
 if test $? -ne 0; then
 	echo "wrong exit value after success"
+	cat fwd.log
+	cat unbound.log
 	exit 1
 fi
 if grep "^total.num.queries=[1-9][0-9]*$" tmp.$$; then
@@ -90,7 +92,7 @@ if test $? -ne 0; then
 	exit 1
 fi
 
-# check syntax error in parse 
+# check syntax error in parse
 echo "$PRE/unbound-control -c ub.conf verbosity jkdf"
 $PRE/unbound-control -c ub.conf verbosity jkdf
 if test $? -ne 1; then
@@ -135,7 +137,7 @@ if grep "192.0.2.1" outfile; then
 	echo "OK"
 else
 	echo "> cat logfiles"
-	cat fwd.log 
+	cat fwd.log
 	cat unbound.log
 	echo "Not OK"
 	exit 1
@@ -149,7 +151,7 @@ if grep "NXDOMAIN" outfile; then
 	echo "OK"
 else
 	echo "> cat logfiles"
-	cat fwd.log 
+	cat fwd.log
 	cat unbound.log
 	echo "Not OK"
 	exit 1
@@ -169,7 +171,7 @@ if grep "NXDOMAIN" outfile; then
 	echo "OK"
 else
 	echo "> cat logfiles"
-	cat fwd.log 
+	cat fwd.log
 	cat unbound.log
 	echo "Not OK"
 	exit 1
@@ -189,7 +191,7 @@ if grep "SERVFAIL" outfile; then
 	echo "OK"
 else
 	echo "> cat logfiles"
-	cat fwd.log 
+	cat fwd.log
 	cat unbound.log
 	echo "Not OK"
 	exit 1
@@ -216,7 +218,7 @@ else
 	exit 1
 fi
 
-# test lookup 
+# test lookup
 echo "$PRE/unbound-control -c ub.conf lookup www.example.com"
 $PRE/unbound-control -c ub.conf lookup www.example.com
 if test $? -ne 0; then
@@ -282,7 +284,7 @@ done
 if kill -0 $UNBOUND_PID; then
 	echo "still up!"
 	echo "> cat logfiles"
-	cat fwd.log 
+	cat fwd.log
 	cat unbound.log
 	echo "not stopped, failure"
 	exit 1
@@ -294,7 +296,7 @@ else
 			echo "lock-verify test worked."
 		else
 			echo "lock-verify test failed."
-			cat fwd.log 
+			cat fwd.log
 			cat unbound.log
 			exit 1
 		fi
@@ -302,7 +304,7 @@ else
 fi
 
 echo "> cat logfiles"
-cat fwd.log 
+cat fwd.log
 cat unbound.log
 echo "> OK"
 exit 0
diff --git a/testdata/rpz_axfr.rpl b/testdata/rpz_axfr.rpl
new file mode 100644
index 000000000000..b5b84bfd3af9
--- /dev/null
+++ b/testdata/rpz_axfr.rpl
@@ -0,0 +1,362 @@
+; config options
+server:
+	module-config: "respip validator iterator"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+
+rpz:
+	name: "rpz.example.com."
+	master: 10.20.30.40
+	zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+$ORIGIN rpz.example.com.
+a	IN	CNAME *.
+c	IN	TXT	"hello from initial RPZ"
+c	IN	TXT	"another hello from initial RPZ"
+d	IN	CNAME .
+32.1.123.0.10.rpz-ip	CNAME *.
+32.3.123.0.10.rpz-ip	A 10.66.0.3
+32.3.123.0.10.rpz-ip	A 10.66.0.4
+32.4.123.0.10.rpz-ip	CNAME .
+TEMPFILE_END
+
+stub-zone:
+	name: "."
+	stub-addr: 10.20.30.40
+
+CONFIG_END
+
+SCENARIO_BEGIN Test RPZ QNAME trigger, loaded using AXFR
+
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.40
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+.	IN	NS
+SECTION ANSWER
+.	IN	NS	ns.
+SECTION ADDITIONAL
+ns.	IN	NS	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+b.	IN	TXT
+SECTION ANSWER
+b.	TXT	"hello from upstream"
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+d.	IN	TXT
+SECTION ANSWER
+d.	TXT	"hello from upstream"
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+a.rpz-ip.	IN	A
+SECTION ANSWER
+a.rpz-ip.	IN	A	10.0.123.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+c.rpz-ip.	IN	A
+SECTION ANSWER
+c.rpz-ip.	IN	A	10.0.123.3
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+d.rpz-ip.	IN	A
+SECTION ANSWER
+d.rpz-ip.	IN	A	10.0.123.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN SOA
+SECTION ANSWER
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 1 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN AXFR
+SECTION ANSWER
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 1 3600 900 86400 3600
+b.rpz.example.com. TXT "hello from RPZ"
+c.rpz.example.com. TXT "hello from RPZ"
+a.rpz.example.com. CNAME .
+32.1.123.0.10.rpz-ip.rpz.example.com.	CNAME .
+32.3.123.0.10.rpz-ip.rpz.example.com.	A 10.66.0.5
+32.3.123.0.10.rpz-ip.rpz.example.com.	A 10.66.0.6
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 1 3600 900 86400 3600
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.	IN	TXT
+ENTRY_END
+
+STEP 2 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+b.	IN	TXT
+SECTION ANSWER
+b.	IN	TXT	"hello from upstream"
+ENTRY_END
+
+STEP 3 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.	IN	TXT
+ENTRY_END
+
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+a.	IN	TXT
+SECTION ANSWER
+ENTRY_END
+
+STEP 5 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 6 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+a.rpz-ip.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 7 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.	IN	TXT
+ENTRY_END
+
+STEP 8 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+c.	IN	TXT
+SECTION ANSWER
+c.	IN	TXT "another hello from initial RPZ"
+c.	IN	TXT "hello from initial RPZ"
+ENTRY_END
+
+STEP 9 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.rpz-ip.	IN A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+c.rpz-ip.	IN	A
+SECTION ANSWER
+c.rpz-ip.	IN	A 10.66.0.4
+c.rpz-ip.	IN	A 10.66.0.3
+ENTRY_END
+
+STEP 11 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.	IN	TXT
+ENTRY_END
+
+STEP 12 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NXDOMAIN
+SECTION QUESTION
+d.	IN	TXT
+ENTRY_END
+
+STEP 13 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 14 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+d.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 30 TIME_PASSES ELAPSE 10
+STEP 40 TRAFFIC
+
+STEP 50 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.	IN	TXT
+ENTRY_END
+
+STEP 51 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+b.	IN	TXT
+SECTION ANSWER
+b.	IN	TXT	"hello from RPZ"
+ENTRY_END
+
+STEP 52 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.	IN	TXT
+ENTRY_END
+
+STEP 53 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NXDOMAIN
+SECTION QUESTION
+a.	IN	TXT
+SECTION ANSWER
+ENTRY_END
+
+STEP 54 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 55 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+a.rpz-ip.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 56 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.	IN	TXT
+ENTRY_END
+
+STEP 57 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+c.	IN	TXT
+SECTION ANSWER
+c.	IN	TXT "hello from RPZ"
+ENTRY_END
+
+STEP 58 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 59 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+c.rpz-ip.	IN	A
+SECTION ANSWER
+c.rpz-ip.	IN	A 10.66.0.6
+c.rpz-ip.	IN	A 10.66.0.5
+ENTRY_END
+
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.	IN	TXT
+ENTRY_END
+
+STEP 61 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+d.	IN	TXT
+SECTION ANSWER
+d.	IN	TXT "hello from upstream"
+ENTRY_END
+
+STEP 62 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 63 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+d.rpz-ip.	IN	A
+SECTION ANSWER
+d.rpz-ip.	IN	A 10.0.123.4
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/rpz_ixfr.rpl b/testdata/rpz_ixfr.rpl
new file mode 100644
index 000000000000..3f7cb3d3561e
--- /dev/null
+++ b/testdata/rpz_ixfr.rpl
@@ -0,0 +1,378 @@
+; config options
+server:
+	module-config: "respip validator iterator"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+
+rpz:
+	name: "rpz.example.com."
+	master: 10.20.30.40
+	zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+rpz.example.com. 3600 IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 1 3600 900 86400 3600
+rpz.example.com.	3600	IN	NS	ns.rpz.example.net.
+a.rpz.example.com.	IN	CNAME *.
+c.rpz.example.com.	IN	TXT	"hello from initial RPZ"
+c.rpz.example.com.	IN	TXT	"another hello from initial RPZ"
+c.rpz.example.com.	IN	TXT	"yet another hello from initial RPZ"
+d.rpz.example.com.	IN	CNAME .
+32.1.123.0.10.rpz-ip.rpz.example.com.	CNAME *.
+32.3.123.0.10.rpz-ip.rpz.example.com.	A 10.66.0.3
+32.3.123.0.10.rpz-ip.rpz.example.com.	A 10.66.0.4
+32.4.123.0.10.rpz-ip.rpz.example.com.	CNAME .
+TEMPFILE_END
+
+stub-zone:
+	name: "."
+	stub-addr: 10.20.30.40
+
+CONFIG_END
+
+SCENARIO_BEGIN Test RPZ QNAME trigger, loaded using IXFR
+
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.40
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+.	IN	NS
+SECTION ANSWER
+.	IN	NS	ns.
+SECTION ADDITIONAL
+ns.	IN	NS	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+b.	IN	TXT
+SECTION ANSWER
+b.	TXT	"hello from upstream"
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+d.	IN	TXT
+SECTION ANSWER
+d.	TXT	"hello from upstream"
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+a.rpz-ip.	IN	A
+SECTION ANSWER
+a.rpz-ip.	IN	A	10.0.123.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+c.rpz-ip.	IN	A
+SECTION ANSWER
+c.rpz-ip.	IN	A	10.0.123.3
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+d.rpz-ip.	IN	A
+SECTION ANSWER
+d.rpz-ip.	IN	A	10.0.123.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN SOA
+SECTION ANSWER
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 2 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN IXFR
+SECTION ANSWER
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 2 3600 900 86400 3600
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 1 3600 900 86400 3600
+a.rpz.example.com.	IN	CNAME *.
+c.rpz.example.com.	IN	TXT	"hello from initial RPZ"
+c.rpz.example.com.	IN	TXT	"another hello from initial RPZ"
+d.rpz.example.com.	IN	CNAME .
+32.1.123.0.10.rpz-ip.rpz.example.com.	CNAME *.
+32.3.123.0.10.rpz-ip.rpz.example.com.	A 10.66.0.3
+32.3.123.0.10.rpz-ip.rpz.example.com.	A 10.66.0.4
+32.4.123.0.10.rpz-ip.rpz.example.com.	CNAME .
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 2 3600 900 86400 3600
+b.rpz.example.com. TXT "hello from RPZ"
+c.rpz.example.com. TXT "hello from RPZ"
+a.rpz.example.com. CNAME .
+32.1.123.0.10.rpz-ip.rpz.example.com.	CNAME .
+32.3.123.0.10.rpz-ip.rpz.example.com.	A 10.66.0.5
+32.3.123.0.10.rpz-ip.rpz.example.com.	A 10.66.0.6
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 2 3600 900 86400 3600
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.	IN	TXT
+ENTRY_END
+
+STEP 2 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+b.	IN	TXT
+SECTION ANSWER
+b.	IN	TXT	"hello from upstream"
+ENTRY_END
+
+STEP 3 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.	IN	TXT
+ENTRY_END
+
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+a.	IN	TXT
+SECTION ANSWER
+ENTRY_END
+
+STEP 5 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 6 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+a.rpz-ip.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 7 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.	IN	TXT
+ENTRY_END
+
+STEP 8 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+c.	IN	TXT
+SECTION ANSWER
+c.	IN	TXT "yet another hello from initial RPZ"
+c.	IN	TXT "another hello from initial RPZ"
+c.	IN	TXT "hello from initial RPZ"
+ENTRY_END
+
+STEP 9 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.rpz-ip.	IN A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+c.rpz-ip.	IN	A
+SECTION ANSWER
+c.rpz-ip.	IN	A 10.66.0.4
+c.rpz-ip.	IN	A 10.66.0.3
+ENTRY_END
+
+STEP 11 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.	IN	TXT
+ENTRY_END
+
+STEP 12 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NXDOMAIN
+SECTION QUESTION
+d.	IN	TXT
+ENTRY_END
+
+STEP 13 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.rpz-ip.	IN	A
+ENTRY_END
+
+
+STEP 15 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+d.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 16 TIME_PASSES ELAPSE 1
+STEP 30 TIME_PASSES ELAPSE 3600
+STEP 40 TRAFFIC
+
+STEP 50 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.	IN	TXT
+ENTRY_END
+
+STEP 51 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+b.	IN	TXT
+SECTION ANSWER
+b.	IN	TXT	"hello from RPZ"
+ENTRY_END
+
+STEP 52 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.	IN	TXT
+ENTRY_END
+
+STEP 53 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NXDOMAIN
+SECTION QUESTION
+a.	IN	TXT
+SECTION ANSWER
+ENTRY_END
+
+STEP 54 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 55 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+a.rpz-ip.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 56 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.	IN	TXT
+ENTRY_END
+
+STEP 57 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+c.	IN	TXT
+SECTION ANSWER
+c.	IN	TXT "hello from RPZ"
+c.	IN	TXT "yet another hello from initial RPZ"
+ENTRY_END
+
+STEP 58 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 59 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+c.rpz-ip.	IN	A
+SECTION ANSWER
+c.rpz-ip.	IN	A 10.66.0.6
+c.rpz-ip.	IN	A 10.66.0.5
+ENTRY_END
+
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.	IN	TXT
+ENTRY_END
+
+STEP 61 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+d.	IN	TXT
+SECTION ANSWER
+d.	IN	TXT "hello from upstream"
+ENTRY_END
+
+STEP 62 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.rpz-ip.	IN	A
+ENTRY_END
+
+STEP 63 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+d.rpz-ip.	IN	A
+SECTION ANSWER
+d.rpz-ip.	IN	A 10.0.123.4
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/rpz_qname.rpl b/testdata/rpz_qname.rpl
new file mode 100644
index 000000000000..7940e93926a8
--- /dev/null
+++ b/testdata/rpz_qname.rpl
@@ -0,0 +1,304 @@
+; config options
+server:
+	module-config: "respip validator iterator"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+
+rpz:
+	name: "rpz.example.com."
+	zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+$ORIGIN example.com.
+rpz	3600	IN	SOA	ns1.rpz.example.com. hostmaster.rpz.example.com. (
+		1379078166 28800 7200 604800 7200 )
+	3600	IN	NS	ns1.rpz.example.com.
+	3600	IN	NS	ns2.rpz.example.com.
+$ORIGIN rpz.example.com.
+a	CNAME 	.
+a	CNAME 	*. ; duplicate CNAME here on purpose
+*.a	TXT	"wildcard local data"
+b.a	CNAME 	*.
+c.a	CNAME	rpz-passthru.
+TEMPFILE_END
+
+rpz:
+	name: "rpz2.example.com."
+	zonefile:
+TEMPFILE_NAME rpz2.example.com
+TEMPFILE_CONTENTS rpz2.example.com
+$ORIGIN example.com.
+rpz2	3600	IN	SOA	ns1.rpz.example.com. hostmaster.rpz.example.com. (
+		1379078166 28800 7200 604800 7200 )
+	3600	IN	NS	ns1.rpz.example.com.
+	3600	IN	NS	ns2.rpz.example.com.
+$ORIGIN rpz2.example.com.
+a	TXT	"local data 2nd zone"
+d	TXT	"local data 2nd zone"
+e	CNAME	*.a.example.
+*.e	CNAME	*.b.example.
+drop	CNAME	rpz-drop.
+TEMPFILE_END
+
+stub-zone:
+	name: "a."
+	stub-addr: 10.20.30.40
+stub-zone:
+	name: "example."
+	stub-addr: 10.20.30.50
+CONFIG_END
+
+SCENARIO_BEGIN Test all support RPZ action for QNAME trigger
+
+; a.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.40
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+a. IN NS
+SECTION ANSWER
+a. IN NS ns.a.
+SECTION ADDITIONAL
+ns.a IN A 10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+c.a. IN TXT
+SECTION ANSWER
+c.a. IN TXT "answer from upstream ns"
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+x.b.a. IN TXT
+SECTION ANSWER
+x.b.a. IN TXT "answer from upstream ns"
+ENTRY_END
+
+RANGE_END
+
+; example.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.50
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example. IN NS
+SECTION ANSWER
+example. IN NS ns.example.
+SECTION ADDITIONAL
+ns.example IN A 10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+e.a.example. IN TXT
+SECTION ANSWER
+e.a.example. IN TXT "e.a.example. answer from upstream ns"
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+something.e.b.example. IN TXT
+SECTION ANSWER
+something.e.b.example. IN TXT "*.b.example. answer from upstream ns"
+ENTRY_END
+
+RANGE_END
+
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.	IN	TXT
+ENTRY_END
+
+STEP 11 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NXDOMAIN
+SECTION QUESTION
+a.	IN	TXT
+SECTION ANSWER
+ENTRY_END
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.a.	IN	TXT
+ENTRY_END
+
+STEP 21 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+a.a.	IN	TXT
+SECTION ANSWER
+a.a.	IN	TXT	"wildcard local data"
+ENTRY_END
+
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.a.	IN	TXT
+ENTRY_END
+
+STEP 31 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+b.a.	IN	TXT
+SECTION ANSWER
+ENTRY_END
+
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+x.a.	IN	TXT
+ENTRY_END
+
+STEP 41 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+x.a.	IN	TXT
+SECTION ANSWER
+x.a.	IN	TXT	"wildcard local data"
+ENTRY_END
+
+STEP 50 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+x.a.a.	IN	TXT
+ENTRY_END
+
+STEP 51 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+x.a.a.	IN	TXT
+SECTION ANSWER
+x.a.a.	IN	TXT	"wildcard local data"
+ENTRY_END
+
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.a.	IN	TXT
+ENTRY_END
+
+STEP 61 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+c.a.	IN	TXT
+SECTION ANSWER
+c.a.	IN	TXT	"answer from upstream ns"
+ENTRY_END
+
+STEP 70 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+x.b.a.	IN	TXT
+ENTRY_END
+
+STEP 71 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+x.b.a.	IN	TXT
+SECTION ANSWER
+x.b.a.	IN	TXT	"answer from upstream ns"
+ENTRY_END
+
+STEP 80 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.	IN	TXT
+ENTRY_END
+
+STEP 81 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+d.	IN	TXT
+SECTION ANSWER
+d.	IN	TXT	"local data 2nd zone"
+ENTRY_END
+
+STEP 82 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+e.	IN	TXT
+ENTRY_END
+
+STEP 83 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+e.	IN	TXT
+SECTION ANSWER
+e.	IN	CNAME	e.a.example.
+e.a.example.	IN	TXT	"e.a.example. answer from upstream ns"
+ENTRY_END
+
+STEP 84 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+something.e.	IN	TXT
+ENTRY_END
+
+STEP 85 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+something.e.	IN	TXT
+SECTION ANSWER
+something.e.	IN	CNAME	something.e.b.example.
+something.e.b.example.	IN	TXT	"*.b.example. answer from upstream ns"
+ENTRY_END
+
+; deny zone
+STEP 90 QUERY
+ENTRY_BEGIN
+SECTION QUESTION
+drop. IN TXT
+ENTRY_END
+; no answer is checked at exit of testbound.
+SCENARIO_END
diff --git a/testdata/rpz_qname_override.rpl b/testdata/rpz_qname_override.rpl
new file mode 100644
index 000000000000..b2608e251002
--- /dev/null
+++ b/testdata/rpz_qname_override.rpl
@@ -0,0 +1,197 @@
+; config options
+server:
+	module-config: "respip validator iterator"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+
+rpz:
+	name: "rpz.example.com."
+	rpz-action-override: disabled
+	zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+$ORIGIN rpz.example.com.
+a	TXT	"record zone rpz.example.com"
+TEMPFILE_END
+
+rpz:
+	name: "rpz2.example.com."
+	zonefile:
+TEMPFILE_NAME rpz2.example.com
+TEMPFILE_CONTENTS rpz2.example.com
+$ORIGIN rpz2.example.com.
+a	TXT	"record zone rpz2.example.com"
+TEMPFILE_END
+
+rpz:
+	name: "rpz3.example.com."
+	rpz-action-override: nodata
+	zonefile:
+TEMPFILE_NAME rpz3.example.com
+TEMPFILE_CONTENTS rpz3.example.com
+$ORIGIN rpz3.example.com.
+b	CNAME .
+TEMPFILE_END
+
+rpz:
+	name: "rpz4.example.com."
+	rpz-action-override: nxdomain
+	zonefile:
+TEMPFILE_NAME rpz4.example.com
+TEMPFILE_CONTENTS rpz4.example.com
+$ORIGIN rpz4.example.com.
+c	CNAME *.
+TEMPFILE_END
+
+rpz:
+	name: "rpz5.example.com."
+	rpz-action-override: passthru
+	zonefile:
+TEMPFILE_NAME rpz5.example.com
+TEMPFILE_CONTENTS rpz5.example.com
+$ORIGIN rpz5.example.com.
+d	TXT "should be override by passthru"
+TEMPFILE_END
+
+rpz:
+	name: "rpz6.example.com."
+	rpz-action-override: cname
+	rpz-cname-override: "d."
+	zonefile:
+TEMPFILE_NAME rpz6.example.com
+TEMPFILE_CONTENTS rpz6.example.com
+$ORIGIN rpz6.example.com.
+e	TXT "should be override by cname"
+TEMPFILE_END
+
+rpz:
+	name: "rpz7.example.com."
+	rpz-action-override: drop
+	zonefile:
+TEMPFILE_NAME rpz7.example.com
+TEMPFILE_CONTENTS rpz7.example.com
+$ORIGIN rpz7.example.com.
+f	TXT "should be override by drop policy"
+TEMPFILE_END
+
+stub-zone:
+	name: "d."
+	stub-addr: 10.20.30.40
+CONFIG_END
+
+SCENARIO_BEGIN Test RPZ action overrides for QNAME trigger
+
+; d.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.40
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+d. IN TXT
+SECTION ANSWER
+d. IN TXT "answer from upstream ns"
+ENTRY_END
+
+RANGE_END
+
+; check disabled override, should be answered using next policy zone
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.	IN	TXT
+ENTRY_END
+
+STEP 11 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+a.	IN	TXT
+SECTION ANSWER
+a	TXT	"record zone rpz2.example.com"
+ENTRY_END
+
+; check nodata override, would be NXDOMAIN without override 
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.	IN	TXT
+ENTRY_END
+
+STEP 21 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+b.	IN	TXT
+SECTION ANSWER
+ENTRY_END
+
+; check nxdomain override, would be NODATA without override 
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.	IN	TXT
+ENTRY_END
+
+STEP 31 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NXDOMAIN
+SECTION QUESTION
+c.	IN	TXT
+SECTION ANSWER
+ENTRY_END
+
+; check passthru override, would be localdata without override 
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.	IN	TXT
+ENTRY_END
+
+STEP 41 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+d.	IN	TXT
+SECTION ANSWER
+d. IN TXT "answer from upstream ns"
+ENTRY_END
+
+; check cname override, would be localdata without override 
+STEP 50 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+e.	IN	TXT
+ENTRY_END
+
+STEP 51 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+e.	IN	TXT
+SECTION ANSWER
+e. IN CNAME d.
+d. IN TXT "answer from upstream ns"
+ENTRY_END
+
+; check drop override, would be localdata without override
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+f.	IN	TXT
+ENTRY_END
+; no answer is checked at exit of testbound.
+
+SCENARIO_END
diff --git a/testdata/rpz_respip.rpl b/testdata/rpz_respip.rpl
new file mode 100644
index 000000000000..94f998be66a4
--- /dev/null
+++ b/testdata/rpz_respip.rpl
@@ -0,0 +1,449 @@
+; config options
+server:
+	module-config: "respip validator iterator"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+
+
+rpz:
+	name: "rpz.example.com."
+	zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+$ORIGIN example.com.
+rpz	3600	IN	SOA	ns1.rpz.example.com. hostmaster.rpz.example.com. (
+		1379078166 28800 7200 604800 7200 )
+	3600	IN	NS	ns1.rpz.example.com.
+	3600	IN	NS	ns2.rpz.example.com.
+$ORIGIN rpz.example.com.
+8.0.0.0.10.rpz-ip CNAME	*.
+16.0.0.10.10.rpz-ip CNAME .
+24.0.10.10.10.rpz-ip CNAME rpz-drop.
+32.10.10.10.10.rpz-ip CNAME rpz-passthru.
+32.zz.db8.2001.rpz-ip CNAME *.
+48.zz.aa.db8.2001.rpz-ip CNAME .
+64.zz.bb.aa.db8.2001.rpz-ip CNAME rpz-drop.
+128.1.zz.cc.bb.aa.db8.2001.rpz-ip CNAME rpz-passthru.
+128.123.zz.cc.bb.aa.db8.2001.rpz-ip AAAA 2001:db8::123
+128.124.0.0.cc.bb.aa.db8.2001.rpz-ip AAAA 2001:db8::124
+
+TEMPFILE_END
+
+rpz:
+	name: "rpz2.example.com."
+	zonefile:
+TEMPFILE_NAME rpz2.example.com
+TEMPFILE_CONTENTS rpz2.example.com
+$ORIGIN example.com.
+rpz2	3600	IN	SOA	ns1.rpz2.example.com. hostmaster.rpz2.example.com. (
+		1379078166 28800 7200 604800 7200 )
+	3600	IN	NS	ns1.rpz2.example.com.
+	3600	IN	NS	ns2.rpz2.example.com.
+$ORIGIN rpz2.example.com.
+32.10.10.10.10.rpz-ip A	203.0.113.123
+32.123.2.0.192.rpz-ip A	203.0.113.123
+128.1.zz.cc.bb.aa.db8.2001.rpz-ip AAAA 2001:db1::123
+TEMPFILE_END
+
+stub-zone:
+	name: "."
+	stub-addr: 10.20.30.40
+CONFIG_END
+
+SCENARIO_BEGIN Test all supported RPZ action for response IP address trigger
+
+; c.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.40
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS ns.
+SECTION ADDITIONAL
+ns. IN A 10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+a. IN A
+SECTION ANSWER
+a. IN A 10.0.0.123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+a. IN AAAA
+SECTION ANSWER
+a. IN AAAA 2001:db8::123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+b. IN A
+SECTION ANSWER
+b. IN A 10.1.0.123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+b. IN AAAA
+SECTION ANSWER
+b. IN AAAA 2001:db8:1::123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+c. IN A
+SECTION ANSWER
+c. IN A 10.11.0.123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+c. IN AAAA
+SECTION ANSWER
+c. IN AAAA 2001:db8:ff::123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+d. IN A
+SECTION ANSWER
+d. IN A 10.10.0.123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+d. IN AAAA
+SECTION ANSWER
+d. IN AAAA 2001:db8:aa::123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+e. IN A
+SECTION ANSWER
+e. IN A 10.10.10.123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+e. IN AAAA
+SECTION ANSWER
+e. IN AAAA 2001:db8:aa:bb::123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+f. IN A
+SECTION ANSWER
+f. IN A 10.10.10.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+f. IN AAAA
+SECTION ANSWER
+f. IN AAAA 2001:db8:aa:bb:cc::1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+g. IN A
+SECTION ANSWER
+g. IN A 192.0.2.123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+g. IN AAAA
+SECTION ANSWER
+g. IN AAAA 2001:db8:aa:bb:cc::123
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+h. IN AAAA
+SECTION ANSWER
+h. IN AAAA 2001:db8:aa:bb:cc::124
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.	IN	A
+ENTRY_END
+
+STEP 2 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+a.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 3 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.	IN	AAAA
+ENTRY_END
+
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+a.	IN	AAAA
+SECTION ANSWER
+ENTRY_END
+
+STEP 5 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.	IN	A
+ENTRY_END
+
+STEP 6 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+b.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 7 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.	IN	AAAA
+ENTRY_END
+
+STEP 8 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+b.	IN	AAAA
+SECTION ANSWER
+ENTRY_END
+
+STEP 9 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.	IN	A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+c.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 11 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.	IN	AAAA
+ENTRY_END
+
+STEP 12 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+c.	IN	AAAA
+SECTION ANSWER
+ENTRY_END
+
+STEP 13 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.	IN	A
+ENTRY_END
+
+STEP 14 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+d.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 15 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.	IN	AAAA
+ENTRY_END
+
+STEP 16 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+d.	IN	AAAA
+SECTION ANSWER
+ENTRY_END
+
+STEP 17 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+f.	IN	A
+ENTRY_END
+
+STEP 18 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+f.	IN	A
+SECTION ANSWER
+f.	IN	A 10.10.10.10
+ENTRY_END
+
+STEP 19 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+f.	IN	AAAA
+ENTRY_END
+
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+f.	IN	AAAA
+SECTION ANSWER
+f.	IN	AAAA 2001:db8:aa:bb:cc::1
+ENTRY_END
+
+STEP 21 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+g.	IN	A
+ENTRY_END
+
+STEP 22 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+g.	IN	A
+SECTION ANSWER
+g.	IN	A 203.0.113.123
+ENTRY_END
+
+STEP 23 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+g.	IN	AAAA
+ENTRY_END
+
+STEP 24 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+g.	IN	AAAA
+SECTION ANSWER
+g.	IN	AAAA 2001:db8::123
+ENTRY_END
+
+STEP 25 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+h.	IN	AAAA
+ENTRY_END
+
+STEP 26 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+h.	IN	AAAA
+SECTION ANSWER
+h.	IN	AAAA 2001:db8::124
+ENTRY_END
+
+; should be dropped
+STEP 27 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+e.	IN	A
+ENTRY_END
+STEP 28 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+e.	IN	AAAA
+ENTRY_END
+STEP 29 TIME_PASSES ELAPSE 12
+SCENARIO_END
diff --git a/testdata/rpz_respip_override.rpl b/testdata/rpz_respip_override.rpl
new file mode 100644
index 000000000000..16d91378a29a
--- /dev/null
+++ b/testdata/rpz_respip_override.rpl
@@ -0,0 +1,265 @@
+; config options
+server:
+	module-config: "respip validator iterator"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+
+rpz:
+	name: "rpz.example.com."
+	rpz-action-override: disabled
+	zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+$ORIGIN rpz.example.com.
+32.1.113.0.203.rpz-ip A 192.0.2.1
+TEMPFILE_END
+
+rpz:
+	name: "rpz2.example.com."
+	zonefile:
+TEMPFILE_NAME rpz2.example.com
+TEMPFILE_CONTENTS rpz2.example.com
+$ORIGIN rpz2.example.com.
+32.1.113.0.203.rpz-ip A 192.0.2.2
+TEMPFILE_END
+
+rpz:
+	name: "rpz3.example.com."
+	rpz-action-override: nodata
+	zonefile:
+TEMPFILE_NAME rpz3.example.com
+TEMPFILE_CONTENTS rpz3.example.com
+$ORIGIN rpz3.example.com.
+32.3.113.0.203.rpz-ip CNAME .
+TEMPFILE_END
+
+rpz:
+	name: "rpz4.example.com."
+	rpz-action-override: nxdomain
+	zonefile:
+TEMPFILE_NAME rpz4.example.com
+TEMPFILE_CONTENTS rpz4.example.com
+$ORIGIN rpz4.example.com.
+32.4.113.0.203.rpz-ip CNAME *.
+TEMPFILE_END
+
+rpz:
+	name: "rpz5.example.com."
+	rpz-action-override: passthru
+	zonefile:
+TEMPFILE_NAME rpz5.example.com
+TEMPFILE_CONTENTS rpz5.example.com
+$ORIGIN rpz5.example.com.
+32.5.113.0.203.rpz-ip A 192.0.2.5
+TEMPFILE_END
+
+rpz:
+	name: "rpz6.example.com."
+	rpz-action-override: cname
+	rpz-cname-override: ns.
+	zonefile:
+TEMPFILE_NAME rpz6.example.com
+TEMPFILE_CONTENTS rpz6.example.com
+$ORIGIN rpz6.example.com.
+32.6.113.0.203.rpz-ip A 192.0.2.6
+TEMPFILE_END
+
+rpz:
+	name: "rpz7.example.com."
+	rpz-action-override: drop
+	zonefile:
+TEMPFILE_NAME rpz7.example.com
+TEMPFILE_CONTENTS rpz7.example.com
+$ORIGIN rpz7.example.com.
+32.7.113.0.203.rpz-ip A 192.0.2.7
+TEMPFILE_END
+
+stub-zone:
+	name: "."
+	stub-addr: 10.20.30.40
+CONFIG_END
+
+SCENARIO_BEGIN Test all supported RPZ action for response IP address trigger
+
+; c.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.40
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS ns.
+SECTION ADDITIONAL
+ns. IN A 10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns. IN A
+SECTION ANSWER
+ns. IN A 10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+a. IN A
+SECTION ANSWER
+a. IN A 203.0.113.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+b. IN A
+SECTION ANSWER
+b. IN A 203.0.113.3
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+c. IN A
+SECTION ANSWER
+c. IN A 203.0.113.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+d. IN A
+SECTION ANSWER
+d. IN A 203.0.113.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+e. IN A
+SECTION ANSWER
+e. IN A 203.0.113.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+f. IN A
+SECTION ANSWER
+f. IN A 203.0.113.7
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.	IN	A
+ENTRY_END
+
+STEP 2 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+a.	IN	A
+SECTION ANSWER
+a.	IN	A 192.0.2.2
+ENTRY_END
+
+STEP 3 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.	IN	A
+ENTRY_END
+
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+b.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 5 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.	IN	A
+ENTRY_END
+
+STEP 6 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+c.	IN	A
+SECTION ANSWER
+ENTRY_END
+
+STEP 7 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.	IN	A
+ENTRY_END
+
+STEP 8 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+d.	IN	A
+SECTION ANSWER
+d.	IN	A 203.0.113.5
+ENTRY_END
+
+STEP 9 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+e.	IN	A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+e.	IN	A
+SECTION ANSWER
+e.	IN	CNAME ns.
+ns.	IN	A 10.20.30.40
+ENTRY_END
+
+STEP 11 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+f.	IN	A
+ENTRY_END
+; no answer is checked at exit of testbound.
+
+STEP 12 TIME_PASSES ELAPSE 10
+
+SCENARIO_END
diff --git a/testdata/serve_expired.rpl b/testdata/serve_expired.rpl
new file mode 100644
index 000000000000..167470335212
--- /dev/null
+++ b/testdata/serve_expired.rpl
@@ -0,0 +1,122 @@
+; config options
+server:
+	module-config: "validator iterator"
+	qname-minimisation: "no"
+	minimal-responses: no
+	serve-expired: yes
+	access-control: 127.0.0.1/32 allow_snoop
+
+stub-zone:
+	name: "example.com"
+	stub-addr: 1.2.3.4
+CONFIG_END
+
+SCENARIO_BEGIN Test serve-expired
+; Scenario overview:
+; - query for example.com. IN A
+; - check that we get an answer for example.com. IN A with the correct TTL
+; - query again (without the RD bit) right after the TTL expired
+; - check that we get the expired cached answer (this should trigger prefetching)
+; - query with RD bit and check that the cached record was updated
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN NS
+		SECTION ANSWER
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN A
+		SECTION ANSWER
+			example.com. 10 IN A 5.6.7.8
+		SECTION AUTHORITY
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+; Query with RD flag
+STEP 1 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got the correct answer (should be cached)
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com. 10 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+; Wait for the TTL to expire
+STEP 11 TIME_PASSES ELAPSE 3601
+
+; Query again without RD bit
+STEP 30 QUERY
+ENTRY_BEGIN
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got a stale answer
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com.  30 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. 30 IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 30 IN A 1.2.3.4
+ENTRY_END
+
+; Query with RD bit (the record should have been prefetched)
+STEP 50 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com.  10 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/serve_expired_client_timeout.rpl b/testdata/serve_expired_client_timeout.rpl
new file mode 100644
index 000000000000..3f3163afb823
--- /dev/null
+++ b/testdata/serve_expired_client_timeout.rpl
@@ -0,0 +1,127 @@
+; config options
+server:
+	module-config: "validator iterator"
+	qname-minimisation: "no"
+	minimal-responses: no
+	serve-expired: yes
+	serve-expired-client-timeout: 1
+	serve-expired-reply-ttl: 123
+
+stub-zone:
+	name: "example.com"
+	stub-addr: 1.2.3.4
+CONFIG_END
+
+SCENARIO_BEGIN Test serve-expired with client-timeout and reply-ttl
+; Scenario overview:
+; - query for example.com. IN A
+; - check that we get an answer for example.com. IN A with the correct TTL
+; - query again right after the TTL expired
+; - check that we get the expired cached answer with the configured reply ttl
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN NS
+		SECTION ANSWER
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 20
+	ADDRESS 1.2.3.4
+	; response to A query
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN A
+		SECTION ANSWER
+			example.com. 10 IN A 5.6.7.8
+		SECTION AUTHORITY
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+; Query with RD flag
+STEP 1 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got the correct answer (should be cached)
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com. 10 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+; Wait for the TTL to expire
+STEP 11 TIME_PASSES ELAPSE 3600
+
+; Query again
+STEP 30 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Allow the client timer to expire
+STEP 31 TIME_PASSES ELAPSE 1
+
+; Check that we got a stale answer
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com.  123 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. 123 IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 123 IN A 1.2.3.4
+ENTRY_END
+
+; Reply to the outstanding query so that the test doesn't fail with
+; pending messages.
+STEP 41 REPLY
+ENTRY_BEGIN
+	MATCH opcode qtype qname
+	ADJUST copy_id
+	; authoritative answer
+	REPLY QR AA RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com.  3600 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. 3600 IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 3600 IN A 1.2.3.4
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/serve_expired_reply_ttl.rpl b/testdata/serve_expired_reply_ttl.rpl
new file mode 100644
index 000000000000..c45b8383e390
--- /dev/null
+++ b/testdata/serve_expired_reply_ttl.rpl
@@ -0,0 +1,103 @@
+; config options
+server:
+	module-config: "validator iterator"
+	qname-minimisation: "no"
+	minimal-responses: no
+	serve-expired: yes
+	serve-expired-reply-ttl: 123
+
+stub-zone:
+	name: "example.com"
+	stub-addr: 1.2.3.4
+CONFIG_END
+
+SCENARIO_BEGIN Test serve-expired with reply-ttl
+; Scenario overview:
+; - query for example.com. IN A
+; - check that we get an answer for example.com. IN A with the correct TTL
+; - query again right after the TTL expired
+; - check that we get the expired cached answer with the configured TTL
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN NS
+		SECTION ANSWER
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN A
+		SECTION ANSWER
+			example.com. 10 IN A 5.6.7.8
+		SECTION AUTHORITY
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+; Query with RD flag
+STEP 1 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got the correct answer (should be cached)
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com. 10 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+; Wait for the TTL to expire
+STEP 11 TIME_PASSES ELAPSE 3601
+
+; Query again
+STEP 30 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got a stale answer
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com.  123 A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. 123 NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 123 A 1.2.3.4
+ENTRY_END
+
+; Give time for the pending query to get answered
+STEP 41 TRAFFIC
+
+SCENARIO_END
diff --git a/testdata/serve_expired_servfail.rpl b/testdata/serve_expired_servfail.rpl
new file mode 100644
index 000000000000..80ffcde74666
--- /dev/null
+++ b/testdata/serve_expired_servfail.rpl
@@ -0,0 +1,117 @@
+; config options
+server:
+	module-config: "validator iterator"
+	qname-minimisation: "no"
+	minimal-responses: no
+	serve-expired: yes
+	serve-expired-client-timeout: 1800
+	serve-expired-reply-ttl: 123
+	log-servfail: yes
+
+
+stub-zone:
+	name: "example.com"
+	stub-addr: 1.2.3.4
+CONFIG_END
+
+SCENARIO_BEGIN Test serve-expired with client-timeout and a SERVFAIL upstream reply
+; Scenario overview:
+; - query for example.com. IN A
+; - check that we get an answer for example.com. IN A with the correct TTL
+; - query again right after the TTL expired
+; - answer from upstream is servfail
+; - check that we get the expired cached answer instead
+
+; ns.example.com.
+RANGE_BEGIN 0 20
+	ADDRESS 1.2.3.4
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN NS
+		SECTION ANSWER
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN A
+		SECTION ANSWER
+			example.com. 10 IN A 5.6.7.8
+		SECTION AUTHORITY
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 30 100
+	ADDRESS 1.2.3.4
+	; response to A query
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR AA SERVFAIL
+		SECTION QUESTION
+			example.com. IN A
+	ENTRY_END
+RANGE_END
+
+; Query with RD flag
+STEP 1 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got the correct answer (should be cached)
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com. 10 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+; Wait for the TTL to expire
+STEP 11 TIME_PASSES ELAPSE 3601
+
+; Query again
+STEP 30 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got a stale answer
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com.  123 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. 123 IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 123 IN A 1.2.3.4
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/serve_expired_ttl.rpl b/testdata/serve_expired_ttl.rpl
new file mode 100644
index 000000000000..df4ecb89d48a
--- /dev/null
+++ b/testdata/serve_expired_ttl.rpl
@@ -0,0 +1,100 @@
+; config options
+server:
+	module-config: "validator iterator"
+	qname-minimisation: "no"
+	minimal-responses: no
+	serve-expired: yes
+	serve-expired-ttl: 10
+
+stub-zone:
+	name: "example.com"
+	stub-addr: 1.2.3.4
+CONFIG_END
+
+SCENARIO_BEGIN Test serve-expired
+; Scenario overview:
+; - query for example.com. IN A
+; - check that we get an answer for example.com. IN A with the correct TTL
+; - query again right after the TTL expired + serve-expired-ttl
+; - check that we get an updated answer and not the cached one
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN NS
+		SECTION ANSWER
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN A
+		SECTION ANSWER
+			example.com. IN A 5.6.7.8
+		SECTION AUTHORITY
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+; Query with RD flag
+STEP 1 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got the correct answer (should be cached)
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com. IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+; Wait for the TTL to expire + serve-expired-ttl
+STEP 11 TIME_PASSES ELAPSE 3611
+
+; Query again
+STEP 30 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got an updated answer
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com.  IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/serve_expired_ttl_client_timeout.rpl b/testdata/serve_expired_ttl_client_timeout.rpl
new file mode 100644
index 000000000000..169d070ead14
--- /dev/null
+++ b/testdata/serve_expired_ttl_client_timeout.rpl
@@ -0,0 +1,128 @@
+; config options
+server:
+	module-config: "validator iterator"
+	qname-minimisation: "no"
+	minimal-responses: no
+	serve-expired: yes
+	serve-expired-ttl: 10
+	serve-expired-client-timeout: 1
+
+stub-zone:
+	name: "example.com"
+	stub-addr: 1.2.3.4
+CONFIG_END
+
+SCENARIO_BEGIN Test serve-expired
+; Scenario overview:
+; - query for example.com. IN A
+; - check that we get an answer for example.com. IN A with the correct TTL
+; - query again right after the TTL expired + serve-expired-ttl
+; - check that we get an updated answer and not the cached one
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN NS
+		SECTION ANSWER
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 20
+	ADDRESS 1.2.3.4
+	; response to A query
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN A
+		SECTION ANSWER
+			example.com. IN A 5.6.7.8
+		SECTION AUTHORITY
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+; Query with RD flag
+STEP 1 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got the correct answer (should be cached)
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com. IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+; Wait for the TTL to expire + serve-expired-ttl
+STEP 11 TIME_PASSES ELAPSE 3611
+
+; Query again
+STEP 30 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Allow the client timer to expire
+STEP 31 TIME_PASSES ELAPSE 1
+
+; We shouldn't get a reply here.
+; There is cached data but serve-expired-ttl has passed.
+
+STEP 40 REPLY
+ENTRY_BEGIN
+	MATCH opcode qtype qname
+	ADJUST copy_id
+	; authoritative answer
+	REPLY QR AA RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com.  3600 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. 3600 IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 3600 IN A 1.2.3.4
+ENTRY_END
+
+; Check that we got the updated answer
+STEP 41 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com.  IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/serve_expired_zerottl.rpl b/testdata/serve_expired_zerottl.rpl
new file mode 100644
index 000000000000..846435f3841c
--- /dev/null
+++ b/testdata/serve_expired_zerottl.rpl
@@ -0,0 +1,154 @@
+; config options
+server:
+	module-config: "validator iterator"
+	qname-minimisation: "no"
+	minimal-responses: no
+	serve-expired: yes
+	serve-expired-reply-ttl: 123
+
+stub-zone:
+	name: "example.com"
+	stub-addr: 1.2.3.4
+CONFIG_END
+
+SCENARIO_BEGIN Test 0 TLL with serve-expired
+; Scenario overview:
+; - query for example.com. IN A
+; - check that we get an answer for example.com. IN A with the correct 0 TTL
+; - query again; this time the answer has >0 TTL
+; - check the answer
+; - query one last time after expiration
+; - check that the configured reply ttl is used
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN NS
+		SECTION ANSWER
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+RANGE_BEGIN 0 10
+	ADDRESS 1.2.3.4
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN A
+		SECTION ANSWER
+			example.com. 0 IN A 5.6.7.8
+		SECTION AUTHORITY
+			example.com. 0 IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. 0 IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+RANGE_BEGIN 11 100
+	ADDRESS 1.2.3.4
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			example.com. IN A
+		SECTION ANSWER
+			example.com. 10 IN A 5.6.7.8
+		SECTION AUTHORITY
+			example.com. 10 IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. 10 IN A 1.2.3.4
+	ENTRY_END
+RANGE_END
+
+; Let some time to pass so that timenow > 0
+STEP 1 TIME_PASSES ELAPSE 3600
+
+; Query with RD flag
+STEP 2 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got the correct answer with 0 TTL
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com. 0 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com.  0 IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 0 IN A 1.2.3.4
+ENTRY_END
+
+; Let some time to pass
+STEP 11 TIME_PASSES ELAPSE 1
+
+; Query with RD flag
+STEP 20 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got the correct answer
+STEP 29 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com. 10 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. 10 IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 10 IN A 1.2.3.4
+ENTRY_END
+
+; Wait for the TTL to expire
+STEP 30 TIME_PASSES ELAPSE 11
+
+; Query with RD flag
+STEP 40 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+ENTRY_END
+
+; Check that we got the correct answer
+STEP 49 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ANSWER
+		example.com. 123 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. 123 IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 123 IN A 1.2.3.4
+ENTRY_END
+
+; Give time for the pending query to get answered
+STEP 50 TRAFFIC
+
+SCENARIO_END
diff --git a/testdata/subnet_cached.crpl b/testdata/subnet_cached.crpl
index a0d89af51c1e..209831335b8a 100644
--- a/testdata/subnet_cached.crpl
+++ b/testdata/subnet_cached.crpl
@@ -10,6 +10,8 @@ server:
 	max-client-subnet-ipv4: 17
 	module-config: "subnetcache validator iterator"
 	verbosity: 3
+	fake-sha1: yes
+	fake-dsa: yes
 	access-control: 127.0.0.1 allow_snoop
 	qname-minimisation: "no"
 	minimal-responses: no
diff --git a/testdata/subnet_val_positive.crpl b/testdata/subnet_val_positive.crpl
index afec59933d91..01456e58b89a 100644
--- a/testdata/subnet_val_positive.crpl
+++ b/testdata/subnet_val_positive.crpl
@@ -9,6 +9,8 @@ server:
 	max-client-subnet-ipv4: 17
 	module-config: "subnetcache validator iterator"
 	verbosity: 3
+	fake-sha1: yes
+	fake-dsa: yes
 	qname-minimisation: "no"
 	minimal-responses: no
 
diff --git a/testdata/subnet_val_positive_client.crpl b/testdata/subnet_val_positive_client.crpl
index e631a64e6a29..b573742b7067 100644
--- a/testdata/subnet_val_positive_client.crpl
+++ b/testdata/subnet_val_positive_client.crpl
@@ -10,6 +10,8 @@ server:
 	max-client-subnet-ipv4: 17
 	module-config: "subnetcache validator iterator"
 	verbosity: 3
+	fake-sha1: yes
+	fake-dsa: yes
 	qname-minimisation: "no"
 	minimal-responses: no
 
diff --git a/testdata/tcp_req_size.tdir/tcp_req_size.test b/testdata/tcp_req_size.tdir/tcp_req_size.test
index 0260b2117ff3..4417771563a2 100644
--- a/testdata/tcp_req_size.tdir/tcp_req_size.test
+++ b/testdata/tcp_req_size.tdir/tcp_req_size.test
@@ -95,6 +95,33 @@ else
 	echo "result contents not OK"
 	exit 1
 fi
+echo "OK"
+
+# check that the server is still up
+echo ""
+echo "> query www1.example.net. (again check if server up)"
+$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT www1.example.net. A IN >outfile 2>&1
+cat outfile
+if test "$?" -ne 0; then
+	echo "exit status not OK"
+	echo "> cat logfiles"
+	cat outfile
+	cat fwd.log
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www1.example.net" outfile | grep "1.2.3.1"; then
+	echo "content OK"
+else
+	echo "result contents not OK"
+	echo "> cat logfiles"
+	cat outfile
+	cat fwd.log
+	cat unbound.log
+	echo "result contents not OK"
+	exit 1
+fi
 
 echo "OK"
 exit 0
diff --git a/util/config_file.c b/util/config_file.c
index 119b22238443..52ca5a184618 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -246,6 +246,8 @@ config_create(void)
 	cfg->serve_expired = 0;
 	cfg->serve_expired_ttl = 0;
 	cfg->serve_expired_ttl_reset = 0;
+	cfg->serve_expired_reply_ttl = 30;
+	cfg->serve_expired_client_timeout = 0;
 	cfg->add_holddown = 30*24*3600;
 	cfg->del_holddown = 30*24*3600;
 	cfg->keep_missing = 366*24*3600; /* one year plus a little leeway */
@@ -327,9 +329,14 @@ config_create(void)
 	cfg->ipsecmod_strict = 0;
 #endif
 #ifdef USE_CACHEDB
-	cfg->cachedb_backend = NULL;
-	cfg->cachedb_secret = NULL;
-#endif
+	if(!(cfg->cachedb_backend = strdup("testframe"))) goto error_exit;
+	if(!(cfg->cachedb_secret = strdup("default"))) goto error_exit;
+#ifdef USE_REDIS
+	if(!(cfg->redis_server_host = strdup("127.0.0.1"))) goto error_exit;
+	cfg->redis_timeout = 100;
+	cfg->redis_server_port = 6379;
+#endif  /* USE_REDIS */
+#endif  /* USE_CACHEDB */
 #ifdef USE_IPSET
 	cfg->ipset_name_v4 = NULL;
 	cfg->ipset_name_v6 = NULL;
@@ -581,10 +588,15 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("val-permissive-mode:", val_permissive_mode)
 	else S_YNO("aggressive-nsec:", aggressive_nsec)
 	else S_YNO("ignore-cd-flag:", ignore_cd)
-	else S_YNO("serve-expired:", serve_expired)
-	else if(strcmp(opt, "serve_expired_ttl:") == 0)
+	else if(strcmp(opt, "serve-expired:") == 0)
+	{ IS_YES_OR_NO; cfg->serve_expired = (strcmp(val, "yes") == 0);
+	  SERVE_EXPIRED = cfg->serve_expired; }
+	else if(strcmp(opt, "serve-expired-ttl:") == 0)
 	{ IS_NUMBER_OR_ZERO; cfg->serve_expired_ttl = atoi(val); SERVE_EXPIRED_TTL=(time_t)cfg->serve_expired_ttl;}
 	else S_YNO("serve-expired-ttl-reset:", serve_expired_ttl_reset)
+	else if(strcmp(opt, "serve-expired-reply-ttl:") == 0)
+	{ IS_NUMBER_OR_ZERO; cfg->serve_expired_reply_ttl = atoi(val); SERVE_EXPIRED_REPLY_TTL=(time_t)cfg->serve_expired_reply_ttl;}
+	else S_NUMBER_OR_ZERO("serve-expired-client-timeout:", serve_expired_client_timeout)
 	else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
 	else S_UNSIGNED_OR_ZERO("add-holddown:", add_holddown)
 	else S_UNSIGNED_OR_ZERO("del-holddown:", del_holddown)
@@ -977,6 +989,8 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "serve-expired", serve_expired)
 	else O_DEC(opt, "serve-expired-ttl", serve_expired_ttl)
 	else O_YNO(opt, "serve-expired-ttl-reset", serve_expired_ttl_reset)
+	else O_DEC(opt, "serve-expired-reply-ttl", serve_expired_reply_ttl)
+	else O_DEC(opt, "serve-expired-client-timeout", serve_expired_client_timeout)
 	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
 	else O_UNS(opt, "add-holddown", add_holddown)
 	else O_UNS(opt, "del-holddown", del_holddown)
@@ -1098,7 +1112,12 @@ config_get_option(struct config_file* cfg, const char* opt,
 #ifdef USE_CACHEDB
 	else O_STR(opt, "backend", cachedb_backend)
 	else O_STR(opt, "secret-seed", cachedb_secret)
-#endif
+#ifdef USE_REDIS
+	else O_STR(opt, "redis-server-host", redis_server_host)
+	else O_DEC(opt, "redis-server-port", redis_server_port)
+	else O_DEC(opt, "redis-timeout", redis_timeout)
+#endif  /* USE_REDIS */
+#endif  /* USE_CACHEDB */
 #ifdef USE_IPSET
 	else O_STR(opt, "name-v4", ipset_name_v4)
 	else O_STR(opt, "name-v6", ipset_name_v6)
@@ -1279,6 +1298,10 @@ config_delauth(struct config_auth* p)
 	config_delstrlist(p->urls);
 	config_delstrlist(p->allow_notify);
 	free(p->zonefile);
+	free(p->rpz_taglist);
+	free(p->rpz_action_override);
+	free(p->rpz_cname);
+	free(p->rpz_log_name);
 	free(p);
 }
 
@@ -1381,7 +1404,10 @@ config_delete(struct config_file* cfg)
 	config_delstrlist(cfg->tls_session_ticket_keys.first);
 	free(cfg->tls_ciphers);
 	free(cfg->tls_ciphersuites);
-	free(cfg->log_identity);
+	if(cfg->log_identity) {
+		log_ident_revert_to_default();
+		free(cfg->log_identity);
+	}
 	config_del_strarray(cfg->ifs, cfg->num_ifs);
 	config_del_strarray(cfg->out_ifs, cfg->num_out_ifs);
 	config_delstubs(cfg->stubs);
@@ -1444,7 +1470,10 @@ config_delete(struct config_file* cfg)
 #ifdef USE_CACHEDB
 	free(cfg->cachedb_backend);
 	free(cfg->cachedb_secret);
-#endif
+#ifdef USE_REDIS
+	free(cfg->redis_server_host);
+#endif  /* USE_REDIS */
+#endif  /* USE_CACHEDB */
 #ifdef USE_IPSET
 	free(cfg->ipset_name_v4);
 	free(cfg->ipset_name_v6);
@@ -1942,7 +1971,7 @@ char* config_taglist2str(struct config_file* cfg, uint8_t* taglist,
 	return strdup(buf);
 }
 
-int taglist_intersect(uint8_t* list1, size_t list1len, uint8_t* list2,
+int taglist_intersect(uint8_t* list1, size_t list1len, const uint8_t* list2,
 	size_t list2len)
 {
 	size_t i;
@@ -1960,7 +1989,9 @@ config_apply(struct config_file* config)
 {
 	MAX_TTL = (time_t)config->max_ttl;
 	MIN_TTL = (time_t)config->min_ttl;
+	SERVE_EXPIRED = config->serve_expired;
 	SERVE_EXPIRED_TTL = (time_t)config->serve_expired_ttl;
+	SERVE_EXPIRED_REPLY_TTL = (time_t)config->serve_expired_reply_ttl;
 	MAX_NEG_TTL = (time_t)config->max_negative_ttl;
 	RTT_MIN_TIMEOUT = config->infra_cache_min_rtt;
 	EDNS_ADVERTISED_SIZE = (uint16_t)config->edns_buffer_size;
diff --git a/util/config_file.h b/util/config_file.h
index b3ef930a0f16..8739ca2ae1e8 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -362,6 +362,11 @@ struct config_file {
 	int serve_expired_ttl;
 	/** reset serve expired TTL after failed update attempt */
 	int serve_expired_ttl_reset;
+	/** TTL for the serve expired replies */
+	int serve_expired_reply_ttl;
+	/** serve expired entries only after trying to update the entries and this
+	 *  timeout (in milliseconds) is reached */
+	int serve_expired_client_timeout;
 	/** nsec3 maximum iterations per key size, string */
 	char* val_nsec3_key_iterations;
 	/** autotrust add holddown time, in seconds */
@@ -641,6 +646,21 @@ struct config_auth {
 	/** fallback to recursion to authorities if zone expired and other
 	 * reasons perhaps (like, query bogus) */
 	int fallback_enabled;
+	/** this zone is used to create local-zone policies */
+	int isrpz;
+	/** rpz tags (or NULL) */
+	uint8_t* rpz_taglist;
+	/** length of the taglist (in bytes) */
+	size_t rpz_taglistlen;
+	/** Override RPZ action for this zone, regardless of zone content */
+	char* rpz_action_override;
+	/** Log when this RPZ policy is applied */
+	int rpz_log;
+	/** Display this name in the log when RPZ policy is applied */
+	char* rpz_log_name;
+	/** Always reply with this CNAME target if the cname override action is
+	 * used */
+	char* rpz_cname;
 };
 
 /**
@@ -1043,7 +1063,7 @@ char* config_taglist2str(struct config_file* cfg, uint8_t* taglist,
  * @param list2len: length in bytes of second list.
  * @return true if there are tags in common, 0 if not.
  */
-int taglist_intersect(uint8_t* list1, size_t list1len, uint8_t* list2,
+int taglist_intersect(uint8_t* list1, size_t list1len, const uint8_t* list2,
 	size_t list2len);
 
 /**
diff --git a/util/configlexer.c b/util/configlexer.c
index 61525741f66b..7178eb5d0099 100644
--- a/util/configlexer.c
+++ b/util/configlexer.c
@@ -1,7 +1,7 @@
 #include "config.h"
 #include "util/configyyrename.h"
 
-#line 3 "<stdout>"
+#line 2 "<stdout>"
 
 #define  YY_INT_ALIGNED short int
 
@@ -354,8 +354,8 @@ static void yynoreturn yy_fatal_error ( const char* msg  );
 	(yy_hold_char) = *yy_cp; \
 	*yy_cp = '\0'; \
 	(yy_c_buf_p) = yy_cp;
-#define YY_NUM_RULES 294
-#define YY_END_OF_BUFFER 295
+#define YY_NUM_RULES 302
+#define YY_END_OF_BUFFER 303
 /* This struct is not used in this scanner,
    but its presence is necessary. */
 struct yy_trans_info
@@ -363,329 +363,336 @@ struct yy_trans_info
 	flex_int32_t yy_verify;
 	flex_int32_t yy_nxt;
 	};
-static const flex_int16_t yy_accept[2913] =
+static const flex_int16_t yy_accept[2986] =
     {   0,
-        1,    1,  276,  276,  280,  280,  284,  284,  288,  288,
-        1,    1,  295,  292,    1,  274,  274,  293,    2,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  293,  276,  277,  277,  278,  293,  280,  281,  281,
-      282,  293,  287,  284,  285,  285,  286,  293,  288,  289,
-      289,  290,  293,  291,  275,    2,  279,  291,  293,  292,
-        0,    1,    2,    2,    2,    2,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  276,
-        0,  280,    0,  287,    0,  284,  288,    0,  291,    0,
-        2,    2,  291,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      291,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  114,
-      292,  292,  292,  292,  292,  292,  292,  291,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,   96,  292,  292,  292,  292,  292,  292,    8,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  119,  292,  291,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  269,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  291,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,   54,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  214,  292,
-       14,   15,  292,   18,   17,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  113,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  198,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,    3,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  291,  292,  292,
-      292,  292,  292,  292,  292,  264,  292,  292,  263,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  283,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,   57,  292,  238,
-      292,  292,  292,  292,  292,  292,  292,  292,  270,  271,
-
-      292,  292,  292,  292,  292,   58,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  187,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,   20,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  138,  292,  292,  283,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,   94,
-
-      292,  292,  292,  292,  292,  292,  292,  246,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      159,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  137,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,   93,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,   31,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,   32,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,   55,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  112,  292,  292,  292,  292,  292,  111,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,   56,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  160,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,   45,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  229,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,   49,  292,
-       50,  292,  292,  292,  292,  292,   97,  292,   98,  292,
-
-      292,  292,  292,   95,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,    7,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      207,  292,  292,  292,  292,  140,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,   46,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  179,
-      292,  178,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,   16,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,   59,  292,  292,  292,  292,  292,  292,  292,  292,
-      186,  292,  292,  292,  292,  292,  292,  100,  292,   99,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      170,  292,  292,  292,  292,  292,  292,  292,  292,  120,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,   78,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,   82,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,   53,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  173,  174,  292,  292,  292,  240,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,    6,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      244,  292,  292,  292,  265,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,   41,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,   43,  292,
-      292,  292,  292,  292,  292,  292,  292,  166,  292,  292,
-      292,  115,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  191,  292,  167,  292,  292,  292,  204,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,   44,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  117,  105,  292,  106,  292,
-      292,  292,  104,  292,  292,  292,  292,  292,  292,  292,
-      292,  135,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  228,  292,  292,  292,  292,  292,  292,
-      292,  292,  168,  292,  292,  292,  292,  292,  171,  292,
-      177,  292,  292,  292,  292,  292,  203,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,   92,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,   51,  292,  292,  292,   25,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,   19,  292,  292,
-      292,  292,  292,  292,   26,   35,  292,  145,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,   67,   69,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  248,  292,  292,  292,  215,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  107,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  134,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  259,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      139,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  197,  292,  292,  292,  292,  292,
-      292,  292,  292,  268,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  156,  292,  292,  292,  292,  292,  292,
-      292,  292,  101,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  151,  292,  161,  292,  292,  292,  292,  292,
-      123,  292,  292,  292,  292,  292,   88,  292,  292,  292,
-      292,  189,  292,  292,  292,  292,  292,  292,  205,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  220,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  116,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  155,  292,  292,  292,  292,  292,   70,   71,
-      292,  292,  292,  292,  292,   52,  292,  292,  292,  292,
-      292,   77,  162,  292,  180,  292,  208,  292,  292,  172,
-
-      241,  292,  292,  292,  292,  292,   63,  292,  164,  292,
-      292,  292,  292,  292,    9,  292,  292,  292,   91,  292,
-      292,  292,  292,  233,  292,  292,  292,  188,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  154,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  141,  292,  247,  292,  292,  292,
-      292,  219,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      199,  292,  292,  292,  292,  239,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      262,  292,  163,  292,  292,  292,  292,  292,  292,  292,
-       62,   64,  292,  292,  292,  292,  292,  292,  292,   90,
-      292,  292,  292,  292,  231,  292,  292,  292,  243,  292,
-      292,  292,  292,  292,  292,  292,  193,   33,   27,   29,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,   34,
-      292,   28,   30,  292,  292,  292,  292,  292,  292,  292,
-      292,   87,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  195,
-      192,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,   61,  292,  292,  118,  292,
-      108,  292,  292,  292,  292,  292,  292,  292,  292,  136,
-       13,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      257,  292,  260,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,   12,  292,  292,   21,  292,  292,  292,
-      237,  292,  292,  292,  245,  292,   65,  292,  201,  292,
-      292,  194,  292,  292,   60,  292,  292,  292,  292,   22,
-      292,   42,  292,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,  292,  292,  150,  149,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  196,  190,  292,  206,  292,
-      292,  249,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,   72,  292,  292,  292,
-      232,  292,  292,  292,  292,  176,  292,  292,  292,  292,
-      200,  292,  292,  292,  292,  292,  292,  292,  292,  266,
-      267,  147,   66,  292,  292,  157,  292,  292,  102,  103,
-      292,  292,  292,  292,  142,  292,  144,  292,  181,  292,
-      292,  292,  292,  148,  292,  292,  209,  292,  292,  292,
-
-      292,  292,  292,  292,  125,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  216,  292,  292,  292,
-       23,  292,  242,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  182,  292,  292,  230,  292,  261,
-      292,  175,  292,  292,  292,  292,   47,  292,  292,  292,
-      292,    4,  292,  292,  124,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  212,   36,   37,  292,  292,  292,  292,  292,  292,
-      292,  250,  292,  292,  292,  292,  292,  292,  218,  292,
-      292,  292,  185,  292,  292,  292,  292,  292,  292,  292,
-
-      292,  292,   75,  292,   48,  236,  292,  213,  292,  292,
-      292,  292,   11,  292,  292,  292,  292,  292,  292,  292,
-      183,   79,  292,   39,  292,  292,  292,  292,  292,  292,
-      292,  292,  153,  292,  292,  292,  292,  292,  127,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  217,  121,
-      292,  292,  109,  110,  292,  292,  292,   81,   85,   80,
-      292,   73,  292,  292,  292,  292,  292,   10,  292,  292,
-      292,  234,  292,  292,  273,   38,  292,  292,  292,  292,
-      292,  152,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-
-       86,   84,  292,   74,  258,  292,  292,  292,  292,  292,
-      292,  292,  169,  292,  292,  292,  184,  292,  292,  292,
-      292,  292,  292,  292,  292,  143,   68,  292,  292,  292,
-      292,  292,  251,  292,  292,  292,  292,  292,  292,  292,
-      122,  292,   83,  128,  129,  132,  133,  130,  131,   76,
-      292,  235,  292,  292,  146,  292,  292,  292,  292,  292,
-      211,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  158,   40,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,   89,  292,
-
-      210,  292,  227,  255,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,    5,  292,  202,  292,  292,  256,
-      292,  292,  292,  292,  292,  292,  292,  292,   24,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  126,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  165,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  252,  292,  292,  292,  292,  292,  292,  292,
-      292,  292,  292,  292,  292,  292,  292,  292,  292,  292,
-      272,  292,  292,  223,  292,  292,  292,  292,  292,  253,
-      292,  292,  292,  292,  292,  292,  254,  292,  292,  292,
-
-      221,  292,  224,  225,  292,  292,  292,  292,  292,  222,
-      226,    0
+        1,    1,  284,  284,  288,  288,  292,  292,  296,  296,
+        1,    1,  303,  300,    1,  282,  282,  301,    2,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  301,  284,  285,  285,  286,  301,  288,  289,  289,
+      290,  301,  295,  292,  293,  293,  294,  301,  296,  297,
+      297,  298,  301,  299,  283,    2,  287,  299,  301,  300,
+        0,    1,    2,    2,    2,    2,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      284,    0,  288,    0,  295,    0,  292,  296,    0,  299,
+        0,    2,    2,  299,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  299,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  112,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  120,  300,  300,  300,  300,
+      300,  300,  300,  299,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,   96,  300,
+      300,  300,  300,  300,  300,    8,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  113,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  125,  300,  299,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  277,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  299,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,   54,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  222,  300,   14,   15,  300,   18,   17,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  119,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  206,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+        3,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  299,  300,  300,  300,  300,  300,  300,
+      300,  272,  300,  300,  271,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  291,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,   57,  300,  246,  300,  300,  300,  300,
+      300,  300,  300,  300,  278,  279,  300,  300,  300,  300,
+      300,   58,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  116,  300,  300,
+      300,  300,  300,  300,  300,  300,  195,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,   20,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  144,  300,  300,  291,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,   94,
+      300,  300,  300,  300,  300,  300,  300,  254,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      167,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  143,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,   93,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,   31,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,   32,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,   55,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  118,  300,  300,  300,  300,
+      300,  111,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,   56,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  168,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,   45,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  237,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,   49,  300,   50,  300,  300,  300,
+      300,  300,   97,  300,   98,  300,  300,  300,  300,   95,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,    7,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  215,  300,  300,  300,
+      300,  146,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,   46,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  187,  300,  186,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,   16,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,   59,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  194,
+
+      300,  300,  300,  300,  300,  300,  100,  300,   99,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  178,
+      300,  300,  300,  300,  300,  300,  300,  300,  126,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,   78,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,   82,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,   53,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      181,  182,  300,  300,  300,  248,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,    6,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  252,
+      300,  300,  300,  300,  300,  300,  273,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,   41,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+       43,  300,  300,  300,  300,  300,  300,  300,  300,  174,
+      300,  300,  300,  121,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  199,  300,  175,  300,  300,  300,
+      212,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,   44,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  123,  105,  300,
+      106,  300,  300,  300,  104,  300,  300,  300,  300,  300,
+      300,  300,  300,  141,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  236,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  176,  300,  300,  300,  300,  300,
+      179,  300,  185,  300,  300,  300,  300,  300,  211,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,   92,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  117,  300,  300,  300,  300,  300,  300,   51,  300,
+      300,  300,   25,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,   19,  300,  300,  300,  300,  300,  300,   26,
+       35,  300,  151,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,   67,   69,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  256,  300,  300,
+      300,  223,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      107,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      140,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  267,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  145,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  205,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  276,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      162,  300,  300,  300,  300,  300,  300,  300,  300,  101,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  157,
+      300,  169,  300,  300,  300,  300,  300,  129,  300,  300,
+      300,  300,  300,   88,  300,  300,  300,  300,  197,  300,
+      300,  300,  300,  300,  300,  213,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  228,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  122,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  161,
+      300,  300,  300,  300,  300,   70,   71,  300,  300,  300,
+      300,  300,   52,  300,  300,  300,  300,  300,   77,  170,
+      300,  188,  300,  216,  300,  300,  180,  249,  300,  300,
+      300,  300,  300,   63,  300,  172,  300,  300,  300,  300,
+      300,    9,  300,  300,  300,   91,  300,  300,  300,  300,
+      241,  300,  300,  300,  196,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  160,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  147,  300,  255,  300,  300,
+      300,  300,  227,  300,  300,  300,  300,  300,  300,  300,
+      300,  207,  300,  300,  300,  300,  247,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  270,  300,  171,  300,  300,  300,  300,  300,  300,
+      300,   62,   64,  300,  300,  300,  300,  300,  300,  300,
+       90,  300,  300,  300,  300,  239,  300,  300,  300,  251,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  201,   33,   27,   29,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,   34,  300,   28,   30,  300,  300,
+      300,  300,  300,  300,  300,  300,   87,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  203,  200,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+       61,  300,  300,  124,  300,  108,  300,  300,  300,  300,
+      300,  300,  300,  300,  142,   13,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  265,  300,  268,  300,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,   12,  300,
+      300,   21,  300,  300,  300,  245,  300,  300,  300,  253,
+      300,  300,  300,   65,  300,  209,  300,  300,  300,  300,
+      202,  300,  300,   60,  300,  300,  300,  300,   22,  300,
+       42,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  156,  155,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  204,  198,  300,  214,  300,  300,
+      257,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,   72,  300,  300,  300,  240,
+
+      300,  300,  300,  300,  184,  300,  300,  300,  300,  208,
+      300,  300,  300,  300,  300,  300,  300,  300,  274,  275,
+      153,  300,  300,   66,  300,  300,  300,  300,  163,  300,
+      300,  102,  103,  300,  300,  300,  300,  148,  300,  150,
+      300,  189,  300,  300,  300,  300,  154,  300,  300,  217,
+      300,  300,  300,  300,  300,  300,  300,  131,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  224,
+      300,  300,  300,   23,  300,  250,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  190,  300,  300,
+      238,  300,  269,  300,  183,  300,  300,  300,  300,   47,
+
+      300,  300,  300,  300,    4,  300,  300,  300,  115,  130,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  220,   36,
+       37,  300,  300,  300,  300,  300,  300,  300,  258,  300,
+      300,  300,  300,  300,  300,  226,  300,  300,  300,  193,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,   75,
+      300,   48,  244,  300,  221,  300,  300,  300,  300,   11,
+      300,  300,  300,  300,  300,  114,  300,  300,  300,  300,
+      191,   79,  300,   39,  300,  300,  300,  300,  300,  300,
+      300,  300,  159,  300,  300,  300,  300,  300,  133,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  225,  127,
+      300,  300,  109,  110,  300,  300,  300,   81,   85,   80,
+      300,   73,  300,  300,  300,  300,  300,   10,  300,  300,
+      300,  242,  300,  300,  300,  300,  281,   38,  300,  300,
+      300,  300,  300,  158,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,   86,   84,  300,   74,  266,  300,  300,  300,
+      300,  300,  300,  300,  177,  300,  300,  300,  300,  300,
+      192,  300,  300,  300,  300,  300,  300,  300,  300,  149,
+       68,  300,  300,  300,  300,  300,  259,  300,  300,  300,
+
+      300,  300,  300,  300,  128,  300,   83,  134,  135,  138,
+      139,  136,  137,   76,  300,  243,  300,  300,  300,  300,
+      152,  300,  300,  300,  300,  300,  219,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  165,  164,   40,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,   89,  300,  218,
+      300,  235,  263,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,    5,  300,  300,  210,  300,  300,  264,
+      300,  300,  300,  300,  300,  300,  300,  300,   24,  300,
+
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  300,  132,  300,  300,  300,  300,  300,
+      300,  300,  300,  166,  300,  173,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  260,  300,  300,  300,  300,
+      300,  300,  300,  300,  300,  300,  300,  300,  300,  300,
+      300,  300,  300,  280,  300,  300,  231,  300,  300,  300,
+      300,  300,  261,  300,  300,  300,  300,  300,  300,  262,
+      300,  300,  300,  229,  300,  232,  233,  300,  300,  300,
+      300,  300,  230,  234,    0
     } ;
 
 static const YY_CHAR yy_ec[256] =
@@ -731,659 +738,675 @@ static const YY_CHAR yy_meta[67] =
         1,    1,    1,    1,    1,    1
     } ;
 
-static const flex_int16_t yy_base[2927] =
+static const flex_int16_t yy_base[3000] =
     {   0,
         0,    0,   64,   67,   70,   72,   78,   84,   89,   92,
-      131,  137,  352,  307,   96, 8310, 8310, 8310,  109,  171,
+      131,  137,  508,  418,   96, 8475, 8475, 8475,  109,  171,
        85,  142,  215,   83,  117,  152,  207,   50,  110,   75,
-      167,  231,  112,  275,  121,  259,  323,  243,  291,  320,
-      170,  368,  289, 8310, 8310, 8310,  104,  288, 8310, 8310,
-     8310,  147,  286,  289, 8310, 8310, 8310,  305,  239, 8310,
-     8310, 8310,  160,  210, 8310,  372, 8310,  177,  382,  201,
-      386,  115,    0,  390,    0,    0,  160,  162,  199,  204,
-      188,  169,  303,  222,  256,  248,  377,  369,  254,  226,
-      313,  271,  365,  382,  296,  327,  396,  392,  381,  423,
-
-      411,  386,  420,  428,  417,  419,  444,  317,  427,  432,
-      452,  453,  456,  457,  458,  472,  462,  463,  466,  483,
-      479,  478,  504,  485,  212,  499,  514,  501,  500,  517,
-      512,  521,  545,  528,  525,  538,  543,  546,  539,  190,
-      164,  138,  231,  122,  590,  158,   79,  277,   66,  598,
-      602,    0,  572,  571,  591,  579,  586,  596,  594,  599,
-      589,  595,  609,  592,  606,  645,  618,  620,  629,  340,
-      651,  695,  647,  634,  650,  657,  637,  638,  656,  659,
-      661,  544,  676,  685,  642,  687,  696,  719,  702,  713,
-      678,  407,  729,  743,  718,  721,  740,  756,  723,  758,
-
-      727,  760,  763,  754,  759,  767,  742,  768,  753,  769,
-      766,  786,  788,  783,  787,  785,  802,  790,  812,  799,
-      814,  801,  827,  811,  818,  834,  826,  832,  842,  825,
-      845,  837,  841,  850,  617,  847,  861,  860,  843,  868,
-      863,  864,  859,  876,  880,  874,  886,  889,  893,  894,
-      909,  890,  900,  901,  904,  903,  908,  913,  912,  920,
-      928,  173,  916,  936,  943,  932,  935,  949,  947,  945,
-      958,  953,  962,  963,  971,  978,  968,  979,  973,  966,
-      970,  980,  989,  990, 1000,  992, 1004,  994, 1013, 1005,
-     1022, 1021, 1009, 1017, 1026, 1061, 1036, 1016, 1019, 1063,
-
-     1055, 1049, 1044, 1072, 1059, 1064, 1092, 1083, 1087, 1094,
-      668, 1099, 1114, 1101, 1108, 1105, 1110, 1100, 1107, 1060,
-     1118, 1119, 1123, 1128, 1143, 1156, 1139, 1155, 1160, 1151,
-     1162, 1163, 1191, 1239, 1164, 1172, 1182, 1187, 1178, 8310,
-     1203, 1196, 1288, 1201, 1198, 1241, 1211, 1205, 1227, 1230,
-     1238, 1229, 1256, 1244, 1188, 1236, 1257, 1269, 1259, 1274,
-     1266, 1293, 1284, 1283, 1308, 1285, 1301, 1310, 1319, 1314,
-     1306, 1311, 1346, 1327, 1326, 1332, 1336, 1356, 1351, 1353,
-     1359, 1343, 1337, 1365, 1370, 1377, 1385, 1384, 1363, 1392,
-     1389, 1406, 1379, 1403, 1410, 1397, 1408, 1412, 1404,  784,
-
-     1421, 1425, 1441, 1427, 1439, 1430, 1429, 1444, 1446, 1458,
-     1435, 1455, 1461, 1468, 1457, 1477, 1471, 1462, 1486, 1472,
-     1495, 1470, 8310, 1499, 1482, 1497, 1502, 1494, 1489, 8310,
-     1513, 1515, 1498, 1520, 1525, 1522, 1532, 1529, 1540, 1541,
-     1526, 1542, 1559, 1530, 1558, 1552, 1555, 1561, 1575, 1566,
-     1578, 1568, 1570, 1585, 1625, 1567, 1594, 1592, 1572, 1597,
-     1611, 1623, 1607, 1630, 1621, 1620, 1668, 1627, 1658, 1642,
-     1647, 1674, 1652, 1679, 1666, 1664, 1669, 1663, 1683, 1692,
-     1689, 1693, 1672, 1707, 8310, 1706, 1714, 1694, 1710, 1702,
-     1704, 1716, 1711, 1709, 1724, 1733, 1745, 1740, 1600, 1757,
-
-     1744, 1763, 1749, 1732, 1750, 1751, 1760, 1767, 1780, 1752,
-     1785, 1773, 1781, 1782, 1774, 1798, 1802, 1808, 1783, 1803,
-     1800, 1792, 1807, 1814, 1813, 1797, 1809, 1833, 1819, 1835,
-     1825, 1844, 1830, 1826, 1846, 1834, 1855, 1838, 1853, 1841,
-     1864, 1874, 1870, 1872, 8310, 1877, 1880, 1885, 1891, 1893,
-     1897, 1903, 1876, 1905, 1902, 1913, 1916, 1911, 1910, 1919,
-     1914, 1918, 1930, 1935, 1954, 1936, 1948, 1966, 1949, 1962,
-     1941, 1956, 1961, 1968, 1976, 1969, 1975, 1982, 1971, 1974,
-     1985, 1990, 1989, 1983, 1986, 2003, 1995, 2011, 2010, 2025,
-     2026, 1999, 2032, 2009, 2037, 2022, 2029, 2042, 2038, 2043,
-
-     2046, 2041, 2035, 2061, 2062, 2064, 2056, 2066, 2065, 2084,
-     2067, 2073, 2079, 2091, 2092, 2068, 2099, 2102, 2103, 2097,
-     2087, 2126, 2113, 2112, 2123, 2118, 2128, 2119, 2137, 2125,
-     2144, 2136, 2150, 2161, 2162, 2152, 2165, 2160, 2159, 2171,
-     2163, 2176, 2179, 2187, 2190, 2186, 2196, 2198, 2189, 2174,
-     2218, 2205, 2206, 8310, 2201, 2226, 2209, 2230, 2223, 2199,
-     2222, 2246, 2236, 2241, 2225, 2233, 2239, 2282, 8310, 2250,
-     8310, 8310, 2252, 8310, 8310, 2263, 2249, 2262, 2276, 2283,
-     2292, 2270, 2288, 2286, 2275, 2303, 2333, 2311, 2296, 2314,
-     2321, 2309, 2326, 2322, 2341, 2339, 2349, 2353, 2344, 2360,
-
-     2355, 2363, 2364, 2366, 2368, 2367, 2381, 2395, 2384, 2387,
-     2397, 2382, 2391, 2385, 2409, 2412, 2405, 2438, 8310, 2414,
-     2425, 2426, 2424, 2436, 2432, 2431, 2434, 2440, 2443, 2439,
-     2427, 2444, 2441, 2454, 2450, 2451, 2471, 2462, 2461, 8310,
-     2474, 2475, 2477, 2476, 2487, 2481, 2478, 2466, 2493, 2500,
-     2497, 2513, 2472, 2523, 8310, 2527, 2525, 2509, 2528, 2510,
-     2512, 2518, 2519, 2524, 2539, 2540, 2543, 2546, 2550, 2567,
-     2570, 2560, 2557, 2566, 2575, 2568, 2573, 2583, 2565, 2577,
-     2591, 2590, 2594, 2593, 2597, 2599, 2606, 2608, 2628, 2607,
-     2633, 2634, 2626, 2612, 2620, 2639, 2624, 2635, 2642, 2647,
-
-     2638, 2651, 2653, 2648, 2652, 2655, 2665, 2676, 2666, 2680,
-     2685, 2667, 2678, 2682, 2669, 8310, 2675, 2690, 8310, 2700,
-     2697, 2745, 2705, 2715, 2695, 2701, 2711, 2726, 2725, 2735,
-     2738, 2737, 2744, 2741, 2765, 2758, 2774, 2775, 2770, 2777,
-     2772, 2781, 2763, 2764, 2794, 1268, 2800, 2783, 2790, 2785,
-     2836, 2806, 2814, 2808, 2812, 2825, 2833, 2832, 2820, 2839,
-     2849, 2843, 2853, 8310, 2859, 2845, 2854, 2861, 2883, 2882,
-     2871, 2870, 2884, 2875, 2897, 2885, 2877, 2898, 2888, 2899,
-     2902, 2904, 2910, 2918, 2901, 2915, 2938, 8310, 2920, 8310,
-     2925, 2921, 2931, 2930, 2933, 2940, 2948, 2956, 8310, 8310,
-
-     2957, 2960, 2963, 2943, 2959, 8310, 2958, 2981, 2991, 2970,
-     2979, 2978, 2976, 2989, 2996, 3009, 2987, 3014, 3010, 3003,
-     3012, 3021, 3015, 3022, 3023, 3020, 8310, 3029, 3030, 3037,
-     3038, 3045, 3051, 3034, 3063, 3067, 3053, 3050, 3054, 3072,
-     3070, 3081, 3087, 3079, 3080, 3086, 3093, 8310, 3082, 3095,
-     3094, 3098, 3092, 3096, 3107, 3099, 3101, 3121, 3118, 3119,
-     3123, 3114, 3141, 3143, 3125, 3134, 3147, 3130, 3144, 3142,
-      410, 3145, 3146, 3156, 3152, 8310, 3159, 3153,   61, 3170,
-     3172, 3176, 3186, 3180, 3165, 3173, 3199, 3200, 3196, 3204,
-     3203, 3195, 3198, 3205, 3202, 3215, 3214, 3223, 3224, 8310,
-
-     3219, 3226, 3227, 3232, 3246, 3229, 3250, 8310, 3256, 3253,
-     3261, 3248, 3260, 3274, 3272, 3273, 3267, 3293, 3291, 3284,
-     8310, 3297, 3299, 3301, 3287, 3305, 3308, 3300, 3323, 3325,
-     3296, 3329, 3328, 3337, 3333, 3327, 3326, 3330, 3352, 3334,
-     3339, 3342, 3354, 8310, 3356, 3364, 3369, 3360, 3379, 3370,
-     3393, 3373, 3381, 3385, 3400, 3424, 3386, 3394, 3407, 3413,
-     3412, 3409, 3415, 3426, 3430, 3422, 3425, 3453, 3458, 3428,
-     3449, 3456, 3451, 3464, 3452, 3450, 3477, 3487, 3479, 3482,
-     3506, 3500, 1065, 3478, 8310, 3498, 3492, 3485, 3508, 3523,
-     3509, 3505, 3525, 3529, 3521, 3527, 3533, 3543, 3550, 3545,
-
-     3552, 3544, 3549, 3558, 3564, 3554, 3575, 3576, 8310, 3577,
-     3582, 3573, 3584, 3583, 3579, 3594, 3596, 3590, 3591, 3604,
-     3608, 3607, 3610, 3609, 3611, 3606, 3626, 3614, 8310, 3641,
-     3630, 3642, 3643, 3638, 3653, 3655, 3649, 3656, 3663, 3672,
-     3657, 3666, 8310, 3603, 3667, 3684, 3668, 3677, 3673, 3685,
-     3697, 3682, 8310, 3683, 3691, 3671, 3706, 3701, 8310, 3720,
-     3711, 3712, 3709, 3708, 3699, 3726, 3723, 3715, 3719, 3746,
-     3745, 3733, 3750, 8310, 3738, 3766, 3744, 3754, 3760, 3761,
-     3759, 3776, 3792, 3777, 3771, 3781, 3765, 3788, 3786, 3783,
-     3789, 3806, 3796, 3812, 3802, 8310, 3816, 3810, 3813, 3819,
-
-     3821, 3824, 3826, 3840, 3838, 3835, 3846, 3841, 3844, 3847,
-     3858, 3857, 3865, 3861, 3867, 3874, 3880, 3872, 3877, 3884,
-     3885, 3887, 3899, 3907, 8310, 3896, 3905, 3901, 3897, 3903,
-     3904, 3906, 3920, 3918, 3931, 3924, 3927, 3930, 3955, 3964,
-     3933, 3942, 3944, 3948, 3952, 3957, 3954, 3958, 3956, 3925,
-     3972, 3960, 3997, 3976, 3987, 4001, 3979, 3983, 3988, 3989,
-     4003, 3991, 3994, 4010, 4016, 4014, 4023, 4022, 4028, 4018,
-     4024, 4029, 4046, 8310, 4035, 4049, 4041, 4047, 4057, 4066,
-     4067, 4073, 4074, 4060, 4068, 4062, 4075, 4081, 8310, 4079,
-     8310, 4089, 4091, 4084, 4088, 4094, 8310, 4103, 8310, 4116,
-
-     4117, 4104, 4106, 8310, 4123, 4105, 4118, 4128, 4121, 4113,
-     4132, 4130, 4144, 4137, 4142, 4152, 4141, 4169, 4159, 4154,
-     4171, 4162, 4174, 4178, 4163, 4179, 4186, 4164, 4184, 4193,
-     4187, 8310, 4195, 4198, 4203, 4204, 4207, 4201, 4228, 4213,
-     4222, 4227, 4232, 4231, 4237, 4244, 4233, 4266, 4250, 4267,
-     8310, 4258, 4252, 4256, 4274, 8310, 4271, 4254, 4281, 4285,
-     4273, 4277, 4291, 4289, 4309, 4284, 4297, 4322, 4293, 4316,
-     4318, 4324, 4305, 4312, 4331, 4333, 4334, 4345, 4336, 4342,
-     4337, 4341, 4351, 4355, 4363, 4358, 4376, 4374, 4381, 4357,
-     4378, 4387, 4384, 4373, 4368, 4372, 4382, 4390, 4386, 4399,
-
-     4425, 4401, 4402, 4410, 4406, 8310, 4430, 4414, 4431, 4437,
-     4417, 4426, 4418, 4428, 4441, 4420, 4449, 4462, 4454, 8310,
-     4460, 8310, 4457, 4463, 4472, 4478, 4467, 4468, 4485, 4491,
-     4483, 4473, 4498, 4499, 4489, 4495, 4505, 4501, 4512, 4518,
-     4490, 4529, 4513, 4523, 4516, 4528, 4530, 4525, 8310, 4540,
-     4526, 4548, 4543, 4553, 4561, 4557, 4569, 4550, 4570, 4556,
-     4587, 8310, 4576, 4584, 4580, 4594, 4605, 4597, 4609, 4600,
-     8310, 4592, 4596, 4614, 4603, 4617, 4618, 8310, 4607, 8310,
-     4619, 4621, 4623, 4642, 4622, 4639, 4641, 4643, 4654, 4633,
-     4661, 4646, 4644, 4645, 4658, 4667, 4666, 4665, 4673, 4656,
-
-     8310, 4676, 4678, 4691, 4692, 4694, 4701, 4700, 4685, 8310,
-     4696, 4710, 4712, 4703, 4713, 4717, 4720, 4722, 4733, 4736,
-     4724, 4726, 4725, 4738, 4737, 4735, 4754, 4763, 4757, 8310,
-     4762, 4760, 4776, 4774, 4768, 4777, 4775, 4765, 4761, 4773,
-     4781, 4792, 4789, 4801, 4794, 4806, 4805, 4795, 4802, 4820,
-     4828, 4810, 4816, 4818, 4819, 4846, 4836, 4829, 4849, 4851,
-     4833, 4859, 4863, 4844, 4847, 4867, 4866, 4874, 4869, 8310,
-     4886, 4871, 4887, 4858, 4881, 4888, 4899, 4892, 4890, 4885,
-     4898, 4911, 4901, 8310, 4939, 4906, 4922, 4926, 4908, 4927,
-     4931, 4932, 4934, 4941, 4916, 4943, 4936, 4935, 4945, 4960,
-
-     4954, 8310, 8310, 4965, 4950, 4967, 8310, 4969, 4959, 4990,
-     4988, 4968, 4982, 4984, 4995, 4972, 4992, 4986, 4994, 8310,
-     5001, 5005, 5003, 5007, 5013, 5031, 5027, 5024, 5026, 5016,
-     5019, 5030, 5041, 5034, 5021, 5048, 5050, 5039, 5040, 5060,
-     8310, 5058, 5054, 5057, 8310, 5069, 5066, 5077, 5081, 5089,
-     5091, 5087, 5092, 5085, 5097, 5075, 5096, 5093, 5107, 5114,
-     5116, 5121, 5129, 5134, 5128, 8310, 5130, 5133, 5125, 5136,
-     5137, 5147, 5151, 5155, 5141, 5160, 5157, 5156, 8310, 5158,
-     5171, 5161, 5152, 5185, 5159, 5194, 5178, 8310, 5179, 5174,
-     5198, 8310, 5192, 5206, 5199, 5209, 5196, 5215, 5205, 5208,
-
-     5218, 5219, 8310, 5222, 8310, 5226, 5225, 5230, 8310, 5232,
-     5235, 5234, 5214, 5241, 5243, 5255, 5263, 5245, 5258, 5251,
-     5254, 5272, 5274, 5285, 5270, 8310, 5290, 5268, 5280, 5282,
-     5295, 5281, 5294, 5300, 5301, 8310, 8310, 5298, 8310, 5316,
-     5307, 5308, 8310, 5311, 5322, 5335, 5320, 5332, 5338, 5339,
-     5344, 8310, 5341, 5334, 5355, 5349, 5351, 5357, 5361, 5362,
-     5360, 5365, 5371, 8310, 5375, 5379, 5370, 5376, 5385, 5406,
-     5388, 5396, 8310, 5403, 5412, 5392, 5419, 5404, 8310, 5417,
-     8310, 5407, 5418, 5428, 5445, 5423, 8310, 5446, 5435, 5429,
-     5431, 5454, 5458, 5456, 5463, 5452, 5444, 5471, 5472, 5465,
-
-     5474, 8310, 5475, 5466, 5489, 5495, 5485, 5483, 5511, 5508,
-     5512, 5509, 5515, 5506, 5519, 5523, 5522, 5544, 5530, 5507,
-     5548, 5545, 5549, 8310, 5550, 5555, 5558, 8310, 5551, 5546,
-     5559, 5565, 5552, 5576, 5580, 5584, 5585, 8310, 5587, 5589,
-     5582, 5603, 5605, 5595, 8310, 8310, 5614, 8310, 5607, 5592,
-     5609, 5621, 5618, 5629, 5617, 5637, 5649, 5631, 5648, 5654,
-     5640, 5662, 5542, 5579, 5658, 5647, 5651, 8310, 8310, 5663,
-     5668, 5675, 5672, 5686, 5679, 5674, 5673, 5688, 5696, 5703,
-     5699, 5710, 8310, 5705, 5702, 5708, 8310, 5700, 5711, 5717,
-     5718, 5723, 5724, 5730, 5707, 5737, 5732, 5743, 5727, 5744,
-
-     5739, 5757, 5750, 5754, 5761, 8310, 5768, 5759, 5760, 5769,
-     5767, 5774, 5777, 5770, 5781, 8310, 5785, 5807, 5808, 5797,
-     5799, 5801, 5815, 5817, 5821, 5818, 5809, 5829, 5838, 5831,
-     5827, 8310, 5834, 5826, 5835, 5840, 5851, 5863, 5845, 5868,
-     5853, 5869, 5860, 5865, 5876, 5881, 5872, 5874, 5879, 5885,
-     8310, 5884, 5888, 5890, 5894, 5887, 5901, 5897, 5917, 5919,
-     5903, 5908, 5910, 5925, 8310, 5920, 5915, 5924, 5937, 5926,
-     5935, 5928, 5942, 8310, 5948, 5951, 5952, 5947, 5946, 5962,
-     5949, 5975, 5960, 8310, 5970, 5978, 5986, 5967, 5987, 5974,
-     5988, 5985, 8310, 5998, 6001, 5981, 6021, 6005, 6022, 6019,
-
-     6029, 6010, 6018, 6033, 6030, 6032, 6038, 6043, 6028, 6045,
-     6048, 6040, 8310, 6053, 8310, 6055, 6049, 6059, 6080, 6063,
-     8310, 6068, 6071, 6078, 6077, 6079, 8310, 6082, 6086, 6103,
-     6105, 8310, 6093, 6119, 6106, 6110, 6101, 6130, 8310, 6125,
-     6132, 6129, 6141, 6143, 6127, 6128, 6138, 6136, 6133, 6145,
-     6149, 8310, 6163, 6168, 6173, 6174, 6169, 6160, 6177, 6182,
-     6170, 8310, 6184, 6165, 6166, 6188, 6195, 6194, 6198, 6193,
-     6211, 6200, 8310, 6207, 6219, 6233, 6227, 6229, 8310, 8310,
-     6222, 6238, 6234, 6206, 6241, 8310, 6243, 6245, 6240, 6248,
-     6244, 8310, 8310, 6255, 8310, 6258, 8310, 6259, 6261, 8310,
-
-     8310, 6278, 6263, 6279, 6282, 6281, 8310, 6291, 8310, 6297,
-     6292, 6280, 6272, 6290, 8310, 6306, 6300, 6301, 8310, 6304,
-     6302, 6308, 6315, 8310, 6332, 6317, 6316, 8310, 6337, 6341,
-     6340, 6342, 6344, 6335, 6352, 6328, 6351, 6350, 6354, 6358,
-     6360, 6368, 6364, 6365, 6383, 6385, 6376, 6377, 6374, 6390,
-     6396, 6381, 6398, 6399, 6391, 6393, 6407, 6410, 6404, 6423,
-     6415, 6416, 6419, 6421, 6412, 6420, 6431, 6429, 6445, 6451,
-     6455, 6439, 6446, 8310, 6442, 6448, 6462, 6465, 6463, 6469,
-     6471, 6483, 6484, 6492, 8310, 6498, 8310, 6501, 6482, 6494,
-     6487, 8310, 6488, 6489, 6491, 6497, 6514, 6510, 6504, 6535,
-
-     8310, 6538, 6520, 6534, 6539, 8310, 6537, 6545, 6533, 6540,
-     6541, 6544, 6556, 6561, 6560, 6562, 6553, 6555, 6557, 6572,
-     6577, 6575, 6586, 6573, 6578, 6602, 6595, 6596, 6608, 6609,
-     8310, 6611, 8310, 6605, 6612, 6615, 6606, 6623, 6620, 6624,
-     8310, 8310, 6625, 6641, 6646, 6633, 6638, 6649, 6655, 8310,
-     6647, 6657, 6663, 6651, 8310, 6660, 6665, 6666, 8310, 6667,
-     6669, 6676, 6677, 6692, 6686, 6681, 8310, 8310, 8310, 8310,
-     6699, 6683, 6701, 6689, 6696, 6706, 6708, 6711, 6703, 8310,
-     6714, 8310, 8310, 6716, 6726, 6720, 6732, 6738, 6730, 6741,
-     6743, 8310, 6725, 6755, 6757, 6739, 6756, 6763, 6764, 6767,
-
-     6761, 6768, 6774, 6770, 6784, 6765, 6788, 6796, 6800, 8310,
-     8310, 6790, 6804, 6802, 6814, 6811, 6813, 6815, 6817, 6819,
-     6799, 6807, 6820, 6831, 6825, 8310, 6834, 6830, 8310, 6838,
-     8310, 6848, 6849, 6841, 6843, 6858, 6860, 6861, 6863, 8310,
-     8310, 6852, 6864, 6855, 6873, 6876, 6883, 6878, 6897, 6885,
-     8310, 6887, 8310, 6886, 6903, 6908, 6890, 6914, 6921, 6923,
-     6925, 6918, 6922, 8310, 6919, 6924, 8310, 6932, 6929, 6942,
-     8310, 6938, 6940, 6944, 8310, 6947, 8310, 6958, 8310, 6941,
-     6977, 8310, 6953, 6959, 8310, 6962, 6975, 6976, 6965, 8310,
-     6963, 8310, 6971, 6982, 6992, 6983, 6980, 6994, 6984, 6996,
-
-     6985, 7001, 7013, 7011, 8310, 8310, 7030, 7004, 7009, 7012,
-     7010, 7006, 7019, 7031, 7034, 8310, 8310, 7040, 8310, 7039,
-     7046, 8310, 7023, 7050, 7051, 7055, 7052, 7061, 7071, 7063,
-     7064, 7057, 7094, 7074, 7086, 7098, 7101, 7103, 7105, 7084,
-     7109, 7095, 7090, 7110, 7118, 7120, 8310, 7107, 7121, 7117,
-     8310, 7123, 7132, 7149, 7147, 8310, 7153, 7145, 7146, 7148,
-     8310, 7142, 7156, 7159, 7161, 7162, 7196, 7158, 7183, 8310,
-     8310, 8310, 8310, 7168, 7175, 8310, 7185, 7187, 8310, 8310,
-     7176, 7191, 7186, 7210, 8310, 7195, 8310, 7188, 8310, 7203,
-     7211, 7223, 7220, 8310, 7212, 7241, 8310, 7225, 7231, 7232,
-
-     7237, 7228, 7230, 7235, 8310, 7258, 7255, 7256, 7254, 7247,
-     7250, 7273, 7252, 7268, 7259, 7266, 8310, 7272, 7274, 7276,
-     8310, 7280, 8310, 7277, 7281, 7298, 7297, 7293, 7295, 7304,
-     7305, 7300, 7313, 7311, 8310, 7315, 7319, 8310, 7307, 8310,
-     7335, 8310, 7327, 7329, 7331, 7339, 8310, 7348, 7332, 7337,
-     7342, 8310, 7349, 7351, 8310, 7358, 7346, 7367, 7380, 7362,
-     7381, 7372, 7375, 7366, 7396, 7378, 7389, 7392, 7398, 7403,
-     7413, 8310, 8310, 8310, 7405, 7395, 7408, 7404, 7418, 7423,
-     7402, 8310, 7429, 7431, 7419, 7442, 7435, 7443, 8310, 7449,
-     7432, 7445, 8310, 7455, 7457, 7459, 7446, 7461, 7467, 7468,
-
-     7471, 7469, 8310, 7475, 8310, 8310, 7458, 8310, 7470, 7478,
-     7481, 7482, 8310, 7489, 7485, 7486, 7498, 7490, 7495, 7510,
-     8310, 8310, 7511, 8310, 7518, 7516, 7509, 7525, 7512, 7520,
-     7529, 7526, 8310, 7534, 7537, 7535, 7532, 7543, 8310, 7538,
-     7541, 7552, 7555, 7551, 7547, 7568, 7556, 7561, 8310, 8310,
-     7571, 7567, 8310, 8310, 7589, 7592, 7593, 8310, 8310, 8310,
-     7600, 8310, 7601, 7607, 7610, 7612, 7599, 8310, 7614, 7604,
-     7609, 8310, 7616, 7615, 8310, 8310, 7608, 7618, 7613, 7620,
-     7631, 8310, 7635, 7642, 7637, 7632, 7654, 7640, 7652, 7659,
-     7666, 7675, 7647, 7648, 7656, 7680, 7682, 7669, 7676, 7684,
-
-     8310, 8310, 7691, 8310, 8310, 7692, 7694, 7697, 7700, 7701,
-     7705, 7706, 8310, 7699, 7710, 7693, 8310, 7698, 7722, 7714,
-     7718, 7711, 7733, 7715, 7736, 8310, 8310, 7721, 7740, 7720,
-     7750, 7735, 8310, 7749, 7759, 7741, 7760, 7745, 7756, 7768,
-     8310, 7754, 8310, 8310, 8310, 8310, 8310, 8310, 8310, 8310,
-     7772, 8310, 7771, 7785, 8310, 7766, 7779, 7786, 7777, 7780,
-     8310, 7782, 7792, 7795, 7806, 7799, 7809, 7807, 7804, 7811,
-     7812, 7815, 7830, 7822, 7824, 8310, 8310, 7832, 7833, 7825,
-     7839, 7854, 7857, 7861, 7862, 7849, 7859, 7860, 7864, 7872,
-     7867, 7878, 7870, 7884, 7880, 7874, 7883, 7882, 8310, 7888,
-
-     8310, 7890, 8310, 8310, 7912, 7913, 7910, 7897, 7926, 7927,
-     7909, 7915, 7919, 7931, 8310, 7924, 8310, 7920, 7929, 8310,
-     7932, 7943, 7930, 7950, 7951, 7947, 7957, 7967, 8310, 7955,
-     7961, 7968, 7976, 7974, 7982, 7987, 7991, 7993, 7978, 7990,
-     7999, 7986, 8310, 8002, 8003, 8005, 8008, 8009, 8007, 8018,
-     8025, 8014, 8310, 8016, 8035, 8041, 8021, 8031, 8043, 8052,
-     8054, 8048, 8310, 8058, 8062, 8068, 8065, 8071, 8064, 8075,
-     8078, 8051, 8089, 8074, 8100, 8099, 8101, 8085, 8102, 8091,
-     8310, 8113, 8096, 8310, 8112, 8114, 8103, 8124, 8131, 8310,
-     8120, 8126, 8129, 8135, 8125, 8147, 8310, 8138, 8150, 8153,
-
-     8310, 8152, 8310, 8310, 8156, 8149, 8159, 8155, 8164, 8310,
-     8310, 8310, 8218, 8225, 8232, 8239, 8246,   83, 8253, 8260,
-     8267, 8274, 8281, 8288, 8295, 8302
+      167,  231,  112,  275,  121,  327,  368,  243,  258,  259,
+      170,  321,  382, 8475, 8475, 8475,  104,  341, 8475, 8475,
+     8475,  147,  337,  362, 8475, 8475, 8475,  342,  295, 8475,
+     8475, 8475,  160,  291, 8475,  355, 8475,  177,  346,  201,
+      371,  115,    0,  386,    0,    0,  160,  162,  199,  204,
+      188,  169,  323,  222,  256,  267,  378,  278,  292,  279,
+      366,  367,  369,  409,  340,  380,  325,  397,  377,  424,
+
+      404,  407,  433,  439,  413,  408,  370,  434,  226,  445,
+      450,  447,  457,  472,  460,  477,  461,  479,  471,  497,
+      485,  248,  492,  512,  504,  242,  502,  531,  527,  519,
+      521,  529,  520,  558,  539,  559,  543,  547,  563,  557,
+      180,  164,  138,  231,  122,  531,  158,   79,  501,   66,
+      608,  612,    0,  580,  584,  321,  587,  594,  607,  602,
+      585,  598,  603,  614,  604,  626,  632,  623,  638,  627,
+      599,  653,  697,  636,  639,  642,  652,  649,  651,  672,
+      677,  682,  675,  678,  698,  676,  702,  714,  729,  721,
+      712,  715,  696,  742,  755,  741,  740,  756,  757,  744,
+
+      759,  758,  769,  777,  768,  767,  406,  771,  772,  779,
+      773,  776,  792,  800,  795,  796,  793,  826,  806,  807,
+      827,  808,  819,  823,  820,  824,  838,  846,  836,  822,
+      837,  850,  840,  865,  849,  852,  871,  456,  867,  879,
+      876,  857,  882,  869,  864,  889,  884,  896,  890,  894,
+      905,  910,  914,  907,  903,  906,  908,  911,  921,  924,
+      932,  933,  937,  942,  173,  940,  953,  956,  928,  935,
+      962,  964,  952,  977,  959,  979,  976,  980,  989,  981,
+      985,  992,  974,  984,  997,  986,  995, 1011, 1007, 1023,
+     1012, 1031, 1015, 1041, 1016, 1020, 1037, 1024, 1080, 1026,
+
+     1038, 1043, 1074, 1046, 1053, 1057, 1083, 1087, 1075, 1091,
+     1088, 1112, 1114, 1090, 1104, 1119, 1113, 1124, 1122, 1118,
+     1132, 1127, 1138, 1159, 8475, 1143, 1148, 1149, 1161, 1167,
+     1179, 1154, 1194, 1164, 1176, 1190, 1174, 1187, 1199, 1247,
+     1196, 1201, 1203, 1217, 1211, 8475, 1252, 1219, 1297, 1238,
+     1242, 1261, 1256, 1237, 1257, 1277, 1245, 1275, 1246, 1279,
+     1281, 1293, 1319, 1295, 1290, 1315, 1314, 1320, 1333, 1336,
+     1343, 1331, 1337, 1339, 1338, 1330, 1345, 1354, 1288, 1347,
+     1352, 1357, 1363, 1381, 1365, 1387, 1384, 1370, 1378, 1382,
+     1395, 1388, 1410, 1390, 1416, 1420, 1414, 1408, 1415, 1425,
+
+     1434, 1422, 1433, 1443, 1442, 1207, 1440, 1449, 1463, 1412,
+     1452, 1451, 1447, 1470, 1472, 1483, 1461, 1467, 1478, 1474,
+     1482, 1494, 1491, 1480, 1501, 1495, 1514, 1502, 8475, 1519,
+     1505, 1509, 1518, 1511, 1522, 8475, 1530, 1532, 1541, 1540,
+     1547, 1542, 1557, 1546, 1570, 1536, 1558, 1549, 1575, 1566,
+     1568, 1585, 1574, 1587, 1582, 1569, 1596, 1589, 1591, 1602,
+     1595, 1601, 1597, 1647, 8475, 1605, 1627, 1631, 1622, 1629,
+     1656, 1672, 1644, 1638, 1662, 1670, 1690, 1675, 1689, 1680,
+     1637, 1697, 1684, 1700, 1699, 1708, 1706, 1696, 1707, 1705,
+     1704, 1719, 1724, 1737, 8475, 1735, 1741, 1649, 1740, 1734,
+
+     1731, 1746, 1742, 1736, 1751, 1761, 1773, 1772, 1759, 1758,
+     1771, 1794, 1778, 1788, 1779, 1777, 1798, 1805, 1807, 1795,
+     1814, 1800, 1797, 1812, 1801, 1829, 1831, 1838, 1815, 1834,
+     1839, 1827, 1840, 1842, 1847, 1828, 1830, 1855, 1865, 1858,
+     1850, 1875, 1861, 1888, 1879, 1873, 1891, 1878, 1889, 1883,
+     1892, 1893, 1895, 1912, 8475, 1917, 1904, 1926, 1931, 1928,
+     1934, 1936, 1916, 1920, 1939, 1954, 1943, 1922, 1945, 1962,
+     1955, 1960, 1968, 1966, 1956, 1973, 1982, 1992, 1983, 1975,
+     1970, 1994, 1997, 1991, 2004, 2011, 2012, 2016, 2007, 2009,
+     2006, 2032, 2010, 2019, 2035, 2030, 2041, 2038, 2048, 2037,
+
+     2046, 2049, 2079, 2059, 2036, 2068, 2063, 2069, 2062, 2065,
+     2073, 2075, 2081, 2089, 2095, 2096, 2088, 2097, 2086, 2092,
+     2102, 2110, 2122, 2106, 2115, 2116, 2117, 2130, 2128, 2124,
+     2132, 2147, 2126, 2142, 2157, 2144, 2141, 2153, 2162, 2173,
+     2154, 2163, 2175, 2172, 2181, 2187, 2190, 2191, 2180, 2197,
+     2192, 2202, 2203, 2199, 2205, 2217, 2223, 2219, 2225, 2221,
+     2226, 2214, 2242, 2248, 2245, 2246, 8475, 2232, 2261, 2238,
+     2260, 2254, 2243, 2253, 2279, 2269, 2276, 2272, 2267, 2280,
+     2323, 8475, 2274, 8475, 8475, 2285, 8475, 8475, 2288, 2303,
+     2295, 2310, 2312, 2319, 2322, 2307, 2317, 2334, 2291, 2381,
+
+     2316, 2330, 2346, 2338, 2350, 2367, 2368, 2369, 2359, 2378,
+     2371, 2384, 2402, 2390, 2377, 2394, 2414, 2403, 2405, 2417,
+     2421, 2416, 2419, 2427, 2420, 2430, 2434, 2440, 2432, 2436,
+     2471, 8475, 2448, 2467, 2473, 2465, 2477, 2475, 2468, 2476,
+     2479, 2481, 2480, 2464, 2485, 2486, 2491, 2487, 2507, 2511,
+     2494, 2503, 8475, 2514, 2515, 2520, 2517, 2528, 2527, 2521,
+     2536, 2530, 2543, 2533, 2544, 2549, 2546, 2558, 2550, 2575,
+     8475, 2566, 2569, 2560, 2577, 2563, 2579, 2580, 2576, 2590,
+     2588, 2589, 2614, 2601, 2602, 2625, 2613, 2611, 2615, 2616,
+     2626, 2617, 2628, 2635, 2627, 2642, 2636, 2657, 2644, 2645,
+
+     2649, 2646, 2675, 2663, 2680, 2659, 2685, 2686, 2678, 2669,
+     2691, 2692, 2687, 2698, 2690, 2707, 2671, 2709, 2705, 2700,
+     2701, 2713, 2716, 2723, 2714, 2735, 2732, 2724, 2725, 2737,
+     2734, 8475, 2730, 2741, 8475, 2743, 2744, 2790, 2775, 2773,
+     2752, 2778, 2758, 2782, 2781, 2798, 2792, 2800, 2789, 2804,
+     2803, 2817, 2831, 2810, 2821, 2822, 2826, 2823, 2852, 2856,
+     2854,  282, 2857, 2833, 2842, 2847, 2892, 2860, 2859, 2862,
+     2863, 2867, 2896, 2869, 2883, 2886, 2888, 2908, 2910, 8475,
+     2890, 2913, 2902, 2909, 2931, 2925, 2923, 2935, 2937, 2938,
+     2936, 2947, 2932, 2948, 2940, 2941, 2950, 2949, 2957, 2963,
+
+     2973, 2968, 2991, 8475, 2976, 8475, 2975, 2974, 2977, 2984,
+     2987, 2993, 3002, 3004, 8475, 8475, 3010, 3013, 3016, 3018,
+     3011, 8475, 3012, 3046, 3026, 3044, 3034, 3032, 3038, 3037,
+     3043, 3065, 3042, 3068, 3051, 3067, 3070, 8475, 3073, 3059,
+     3077, 3083, 3071, 3085, 3086, 3069, 8475, 3095, 3089, 3096,
+     3111, 3119, 3112, 3106, 3117, 3125, 3109, 3115, 3110, 3128,
+     3122, 3145, 3146, 3138, 3151, 3154, 3150, 8475, 3142, 3144,
+     3155, 3158, 3166, 3165, 3167, 3157, 3177, 3185, 3168, 3171,
+     3184, 3178, 3172, 3173, 3193, 3204, 3210, 3194, 3200, 3205,
+      641, 3201, 3216, 3199, 3222, 8475, 3211, 3229,   61, 3228,
+
+     3224, 3221, 3245, 3244, 3234, 3238, 3227, 3264, 3257, 3261,
+     3265, 3254, 3259, 3271, 3252, 3256, 3280, 3278, 3277, 8475,
+     3282, 3285, 3283, 3291, 3302, 3295, 3311, 8475, 3312, 3314,
+     3310, 3307, 3328, 3318, 3323, 3342, 3334, 3344, 3340, 3337,
+     8475, 3360, 3357, 3361, 3345, 3363, 3369, 3370, 3367, 3371,
+     3358, 3387, 3376, 3374, 3390, 3388, 3384, 3392, 3406, 3401,
+     3400, 3403, 3413, 8475, 3426, 3411, 3427, 3404, 3431, 3429,
+     3460, 3438, 3432, 3448, 3443, 3484, 3451, 3458, 3447, 3468,
+     3472, 3473, 3453, 3474, 3478, 3485, 3481, 3513, 3512, 3498,
+     3504, 3519, 3506, 3516, 3509, 3520, 3471, 3532, 3530, 3533,
+
+     3557, 3551,  218, 3543, 8475, 3559, 3541, 3540, 3560, 3594,
+     3570, 3583, 3568, 3590, 3584, 3586, 3587, 3579, 3606, 3600,
+     3598, 3611, 3604, 3613, 3602, 3617, 3619, 3445, 3621, 3623,
+     3635, 8475, 3638, 3647, 3634, 3645, 3655, 3639, 3656, 3657,
+     3662, 3649, 3650, 3660, 3668, 3672, 3673, 3685, 3669, 3689,
+     3674, 8475, 3700, 3694, 3699, 3701, 3702, 3708, 3717, 3723,
+     3720, 3696, 3705, 3727, 3726, 8475, 3747, 3748, 3740, 3751,
+     3746, 3737, 3749, 3757, 3738, 8475, 3742, 3736, 3753, 3773,
+     3764, 8475, 3776, 3774, 3772, 3769, 3763, 3775, 3778, 3787,
+     3784, 3795, 3805, 3798, 3789, 3818, 8475, 3808, 3829, 3799,
+
+     3819, 3822, 3824, 3816, 3844, 3855, 3839, 3834, 3847, 3849,
+     3856, 3845, 3843, 3861, 3868, 3866, 3872, 3858, 8475, 3883,
+     3874, 3880, 3901, 3899, 3890, 3893, 3886, 3904, 3895, 3907,
+     3900, 3917, 3918, 3928, 3929, 3935, 3920, 3941, 3945, 3934,
+     3947, 3930, 3961, 3957, 3959, 3968, 3970, 8475, 3958, 3975,
+     3972, 3964, 3973, 3974, 3976, 3991, 3984, 3986, 3985, 3993,
+     3996, 4027, 4029, 4005, 4032, 4009, 4011, 4017, 4034, 4016,
+     4020, 4019, 4046, 4043, 4023, 4050, 4044, 4045, 4070, 4055,
+     4060, 4061, 4062, 4069, 4064, 4071, 4067, 4089, 4072, 4093,
+     4095, 4098, 4090, 4096, 4091, 4122, 8475, 4110, 4094, 4106,
+
+     4118, 4135, 4133, 4119, 4125, 4130, 4139, 4146, 4152, 4127,
+     4145, 4149, 4153, 4158, 8475, 4157, 8475, 4160, 4159, 4177,
+     4187, 4168, 8475, 4189, 8475, 4190, 4192, 4182, 4183, 8475,
+     4191, 4180, 4197, 4202, 4186, 4210, 4213, 4207, 4208, 4235,
+     4220, 4226, 4217, 4244, 4229, 4228, 4247, 4233, 4223, 4250,
+     4237, 4260, 4256, 4255, 4263, 4270, 4271, 8475, 4280, 4268,
+     4277, 4281, 4282, 4285, 4298, 4287, 4295, 4297, 4293, 4306,
+     4312, 4319, 4325, 4336, 4314, 4340, 8475, 4329, 4345, 4328,
+     4344, 8475, 4346, 4338, 4348, 4352, 4354, 4342, 4367, 4361,
+     4357, 4371, 4366, 4393, 4395, 4387, 4388, 4398, 4375, 4401,
+
+     4406, 4402, 4415, 4417, 4410, 4427, 4408, 4422, 4420, 4426,
+     4433, 4455, 4456, 4447, 4460, 4434, 4453, 4441, 4459, 4444,
+     4445, 4449, 4461, 4463, 4466, 4468, 4499, 4480, 4483, 4484,
+     4485, 8475, 4470, 4489, 4496, 4512, 4502, 4504, 4495, 4497,
+     4505, 4520, 4527, 4539, 4522, 8475, 4537, 8475, 4528, 4540,
+     4550, 4556, 4546, 4541, 4560, 4569, 4561, 4562, 4566, 4567,
+     4573, 4575, 4586, 4578, 4594, 4598, 4587, 4604, 4589, 4599,
+     4593, 4596, 4601, 4615, 8475, 4616, 4622, 4628, 4619, 4623,
+     4642, 4650, 4636, 4634, 4637, 4639, 4676, 8475, 4646, 4655,
+     4659, 4675, 4688, 4671, 4690, 4693, 4686, 4698, 4694, 8475,
+
+     4679, 4682, 4706, 4692, 4701, 4716, 8475, 4687, 8475, 4711,
+     4715, 4721, 4726, 4723, 4727, 4725, 4731, 4744, 4746, 4751,
+     4742, 4748, 4752, 4757, 4747, 4754, 4737, 4761, 4762, 8475,
+     4724, 4763, 4781, 4786, 4788, 4789, 4787, 4775, 8475, 4784,
+     4800, 4782, 4805, 4803, 4806, 4810, 4812, 4823, 4826, 4815,
+     4809, 4836, 4828, 4825, 4839, 4841, 4844, 4848, 8475, 4849,
+     4850, 4862, 4858, 4852, 4867, 4857, 4853, 4856, 4870, 4872,
+     4877, 4883, 4881, 4880, 4896, 4889, 4886, 4887, 4903, 4917,
+     4897, 4907, 4905, 4915, 4925, 4923, 4930, 4936, 4940, 4929,
+     4941, 4942, 4934, 4938, 4946, 4947, 4952, 4957, 8475, 4976,
+
+     4954, 4980, 4958, 4974, 4988, 4989, 4985, 4979, 4975, 4994,
+     4999, 5003, 8475, 5005, 4997, 5006, 5002, 5012, 5001, 5022,
+     5016, 5021, 5034, 5018, 5045, 5032, 5029, 5054, 5037, 5033,
+     8475, 8475, 5047, 5040, 5048, 8475, 5059, 5049, 5067, 5066,
+     5056, 5072, 5078, 5079, 5063, 5090, 5074, 5080, 8475, 5093,
+     5107, 5083, 5101, 5114, 5116, 5113, 5117, 5110, 5104, 5102,
+     5120, 5123, 5115, 5112, 5135, 5150, 5134, 5137, 5151, 8475,
+     5146, 5145, 5153, 5156, 5149, 5142, 8475, 5169, 5170, 5180,
+     5178, 5175, 5185, 5192, 5190, 5179, 5177, 5201, 5194, 5202,
+     5204, 5214, 5196, 5205, 5225, 5232, 5230, 8475, 5227, 5228,
+
+     5223, 5240, 5242, 5253, 5250, 5251, 5238, 5257, 5246, 5261,
+     8475, 5256, 5270, 5260, 5254, 5280, 5271, 5281, 5278, 8475,
+     5282, 5273, 5291, 8475, 5283, 5301, 5303, 5304, 5295, 5287,
+     5305, 5307, 5310, 5317, 8475, 5319, 8475, 5322, 5321, 5334,
+     8475, 5328, 5329, 5331, 5327, 5338, 5345, 5352, 5359, 5344,
+     5360, 5348, 5351, 5372, 5368, 5385, 5367, 8475, 5389, 5365,
+     5379, 5397, 5393, 5392, 5384, 5408, 5394, 8475, 8475, 5382,
+     8475, 5411, 5406, 5410, 8475, 5403, 5409, 5432, 5425, 5438,
+     5441, 5444, 5440, 8475, 5447, 5431, 5445, 5452, 5435, 5464,
+     5465, 5468, 5437, 5467, 5478, 8475, 5466, 5473, 5460, 5471,
+
+     5479, 5493, 5503, 5490, 8475, 5509, 5500, 5501, 5513, 5515,
+     8475, 5512, 8475, 5507, 5523, 5526, 5529, 5524, 8475, 5542,
+     5533, 5554, 5535, 5550, 5562, 5552, 5558, 5548, 5553, 5506,
+     5567, 5565, 5560, 8475, 5577, 5583, 5576, 5585, 5587, 5581,
+     5588, 5593, 5604, 5603, 5607, 5605, 5608, 5615, 5612, 5613,
+     5623, 8475, 5640, 5624, 5633, 5661, 5628, 5635, 8475, 5645,
+     5653, 5660, 8475, 5646, 5643, 5662, 5666, 5651, 5664, 5667,
+     5681, 5684, 8475, 5685, 5688, 5686, 5696, 5698, 5693, 8475,
+     8475, 5712, 8475, 5708, 5694, 5692, 5719, 5711, 5723, 5677,
+     5733, 5716, 5721, 5743, 5744, 5738, 5757, 5758, 5759, 5752,
+
+     5748, 5741, 8475, 8475, 5762, 5765, 5763, 5773, 5776, 5769,
+     5779, 5792, 5789, 5800, 5795, 5793, 5807, 8475, 5805, 5790,
+     5808, 8475, 5786, 5818, 5803, 5814, 5828, 5813, 5827, 5815,
+     5840, 5832, 5841, 5822, 5839, 5838, 5856, 5849, 5845, 5852,
+     8475, 5869, 5866, 5867, 5864, 5868, 5878, 5879, 5889, 5881,
+     8475, 5883, 5880, 5896, 5890, 5895, 5905, 5910, 5915, 5920,
+     5906, 5922, 5930, 5932, 5934, 5938, 8475, 5945, 5919, 5933,
+     5928, 5951, 5952, 5937, 5954, 5955, 5963, 5959, 5964, 5975,
+     5976, 5970, 5978, 5971, 5980, 8475, 5983, 5989, 5990, 5992,
+     5977, 6000, 5991, 6007, 5993, 6005, 5998, 6010, 6028, 8475,
+
+     6011, 6016, 6015, 6037, 6044, 6026, 6032, 6033, 8475, 6046,
+     6034, 6042, 6038, 6059, 6060, 6036, 6066, 6061, 6080, 6081,
+     8475, 6071, 6085, 6086, 6075, 6079, 6093, 6098, 6069, 8475,
+     6110, 6111, 6106, 6128, 6108, 6136, 6119, 6127, 6109, 6126,
+     6137, 6135, 6138, 6141, 6143, 6131, 6154, 6162, 6156, 8475,
+     6149, 8475, 6164, 6174, 6183, 6179, 6170, 8475, 6166, 6168,
+     6185, 6171, 6194, 8475, 6187, 6189, 6193, 6206, 8475, 6201,
+     6217, 6207, 6211, 6224, 6228, 8475, 6225, 6233, 6232, 6244,
+     6245, 6241, 6234, 6242, 6235, 6239, 6238, 6266, 8475, 6254,
+     6270, 6276, 6272, 6269, 6259, 6283, 6282, 6275, 8475, 6284,
+
+     6271, 6281, 6293, 6286, 6292, 6316, 6297, 6317, 6304, 8475,
+     6309, 6324, 6300, 6318, 6328, 8475, 8475, 6319, 6331, 6334,
+     6314, 6341, 8475, 6343, 6359, 6350, 6338, 6354, 8475, 8475,
+     6366, 8475, 6353, 8475, 6358, 6357, 8475, 8475, 6370, 6352,
+     6377, 6383, 6376, 8475, 6387, 8475, 6396, 6391, 6379, 6385,
+     6389, 8475, 6398, 6399, 6401, 8475, 6404, 6425, 6406, 6412,
+     8475, 6408, 6410, 6414, 8475, 6435, 6430, 6437, 6428, 6434,
+     6440, 6447, 6439, 6444, 6438, 6455, 6448, 6473, 6479, 6481,
+     6483, 6484, 6474, 6470, 6485, 6491, 6493, 6477, 6487, 6476,
+     6482, 6502, 6503, 6507, 6524, 6516, 6519, 6521, 6520, 6513,
+
+     6530, 6517, 6518, 6536, 6541, 6526, 6546, 6529, 6543, 6547,
+     6570, 6563, 6560, 6565, 8475, 6558, 6556, 6559, 6581, 6577,
+     6590, 6596, 6589, 6600, 6605, 8475, 6609, 8475, 6611, 6597,
+     6602, 6607, 8475, 6594, 6617, 6598, 6623, 6621, 6625, 6628,
+     6648, 8475, 6631, 6629, 6650, 6654, 8475, 6652, 6660, 6647,
+     6653, 6656, 6667, 6666, 6673, 6669, 6670, 6668, 6699, 6674,
+     6686, 6687, 6688, 6698, 6690, 6700, 6701, 6717, 6705, 6721,
+     6708, 8475, 6722, 8475, 6715, 6726, 6727, 6716, 6733, 6732,
+     6737, 8475, 8475, 6735, 6754, 6740, 6743, 6751, 6761, 6767,
+     8475, 6759, 6772, 6773, 6762, 8475, 6760, 6770, 6777, 8475,
+
+     6779, 6783, 6789, 6795, 6786, 6808, 6804, 6802, 6796, 6803,
+     6814, 8475, 8475, 8475, 8475, 6820, 6806, 6824, 6813, 6830,
+     6818, 6825, 6837, 6829, 8475, 6846, 8475, 8475, 6845, 6853,
+     6835, 6854, 6852, 6847, 6856, 6855, 8475, 6869, 6862, 6870,
+     6873, 6868, 6878, 6891, 6894, 6883, 6885, 6896, 6902, 6905,
+     6889, 6908, 6909, 6914, 8475, 8475, 6911, 6917, 6916, 6927,
+     6915, 6932, 6944, 6941, 6943, 6940, 6935, 6947, 6951, 6946,
+     8475, 6952, 6960, 8475, 6953, 8475, 6961, 6964, 6968, 6976,
+     6972, 6985, 6996, 6991, 8475, 8475, 6979, 6982, 6988, 7001,
+     6992, 6995, 6990, 7010, 7014, 8475, 7015, 8475, 7016, 7022,
+
+     7020, 7019, 7040, 7045, 7050, 7039, 7043, 7047, 8475, 7046,
+     7035, 8475, 7054, 7042, 7049, 8475, 7060, 7059, 7065, 8475,
+     7068, 7076, 7079, 8475, 7089, 8475, 7070, 7088, 7082, 7101,
+     8475, 7078, 7099, 8475, 7102, 7104, 7105, 7097, 8475, 7095,
+     8475, 7092, 7114, 7117, 7123, 7115, 7133, 7121, 7120, 7122,
+     7148, 7146, 7147, 8475, 8475, 7158, 7129, 7135, 7139, 7161,
+     7169, 7143, 7150, 7171, 8475, 8475, 7175, 8475, 7164, 7173,
+     8475, 7162, 7181, 7188, 7185, 7165, 7177, 7195, 7193, 7194,
+     7208, 7223, 7200, 7201, 7224, 7228, 7230, 7233, 7210, 7236,
+     7218, 7221, 7235, 7222, 7239, 8475, 7254, 7261, 7249, 8475,
+
+     7270, 7265, 7273, 7274, 8475, 7275, 7268, 7269, 7271, 8475,
+     7266, 7282, 7281, 7294, 7295, 7318, 7301, 7306, 8475, 8475,
+     8475, 7311, 7290, 8475, 7319, 7309, 7299, 7302, 8475, 7322,
+     7313, 8475, 8475, 7307, 7326, 7328, 7344, 8475, 7342, 8475,
+     7336, 8475, 7351, 7355, 7363, 7352, 8475, 7362, 7369, 8475,
+     7365, 7366, 7368, 7371, 7379, 7358, 7381, 8475, 7349, 7396,
+     7397, 7403, 7387, 7388, 7406, 7392, 7417, 7391, 7420, 8475,
+     7408, 7407, 7419, 8475, 7421, 8475, 7418, 7428, 7436, 7433,
+     7434, 7432, 7444, 7448, 7430, 7462, 7445, 8475, 7465, 7470,
+     8475, 7455, 8475, 7473, 8475, 7458, 7468, 7471, 7481, 8475,
+
+     7488, 7479, 7467, 7477, 8475, 7492, 7491, 7502, 8475, 8475,
+     7489, 7512, 7516, 7500, 7510, 7524, 7508, 7525, 7519, 7529,
+     7513, 7536, 7515, 7535, 7539, 7541, 7542, 7549, 8475, 8475,
+     8475, 7546, 7555, 7569, 7553, 7551, 7572, 7552, 8475, 7578,
+     7579, 7568, 7593, 7573, 7589, 8475, 7592, 7582, 7585, 8475,
+     7598, 7603, 7599, 7608, 7602, 7613, 7615, 7623, 7619, 8475,
+     7627, 8475, 8475, 7614, 8475, 7610, 7616, 7617, 7635, 8475,
+     7645, 7634, 7637, 7643, 7647, 8475, 7658, 7649, 7654, 7650,
+     8475, 8475, 7656, 8475, 7667, 7663, 7664, 7676, 7674, 7672,
+     7687, 7683, 8475, 7677, 7682, 7684, 7681, 7692, 8475, 7704,
+
+     7699, 7701, 7703, 7709, 7690, 7717, 7711, 7736, 8475, 8475,
+     7720, 7724, 8475, 8475, 7722, 7742, 7739, 8475, 8475, 8475,
+     7746, 8475, 7752, 7757, 7759, 7773, 7749, 8475, 7760, 7747,
+     7761, 8475, 7758, 7762, 7772, 7781, 8475, 8475, 7766, 7776,
+     7786, 7785, 7780, 8475, 7779, 7787, 7800, 7798, 7811, 7804,
+     7810, 7817, 7835, 7821, 7807, 7818, 7820, 7831, 7834, 7824,
+     7840, 7844, 8475, 8475, 7850, 8475, 8475, 7852, 7854, 7855,
+     7857, 7864, 7865, 7869, 8475, 7863, 7873, 7866, 7862, 7858,
+     8475, 7861, 7883, 7871, 7881, 7885, 7902, 7889, 7887, 8475,
+     8475, 7888, 7892, 7891, 7908, 7893, 8475, 7920, 7930, 7912,
+
+     7922, 7913, 7910, 7918, 8475, 7931, 8475, 8475, 8475, 8475,
+     8475, 8475, 8475, 8475, 7938, 8475, 7929, 7943, 7948, 7951,
+     8475, 7937, 7953, 7959, 7947, 7952, 8475, 7949, 7970, 7977,
+     7969, 7968, 7984, 7975, 7973, 7987, 7990, 7976, 7998, 7995,
+     8000, 8002, 8475, 8475, 8475, 8004, 8003, 8021, 8015, 8026,
+     8034, 8036, 8037, 8019, 8029, 8041, 8047, 8050, 8014, 8042,
+     7957, 8040, 8053, 8058, 8045, 8051, 8059, 8475, 8068, 8475,
+     8071, 8475, 8475, 8075, 8087, 8082, 8072, 8097, 8098, 8080,
+     8092, 8077, 8101, 8475, 8085, 8093, 8475, 8108, 8099, 8475,
+     8107, 8124, 8112, 8123, 8125, 8118, 8139, 8141, 8475, 8128,
+
+     8135, 8140, 8142, 8152, 8116, 8160, 8165, 8167, 8169, 8158,
+     8181, 8178, 8184, 8182, 8475, 8179, 8171, 8186, 8176, 8188,
+     8196, 8199, 8187, 8475, 8201, 8475, 8212, 8221, 8214, 8205,
+     8216, 8223, 8237, 8220, 8227, 8475, 8229, 8241, 8234, 8243,
+     8248, 8254, 8251, 8247, 8272, 8268, 8275, 8279, 8276, 8280,
+     8265, 8285, 8269, 8475, 8289, 8278, 8475, 8286, 8293, 8282,
+     8300, 8307, 8475, 8294, 8303, 8304, 8325, 8329, 8330, 8475,
+     8332, 8333, 8331, 8475, 8334, 8475, 8475, 8335, 8317, 8324,
+     8341, 8342, 8475, 8475, 8475, 8383, 8390, 8397, 8404, 8411,
+       83, 8418, 8425, 8432, 8439, 8446, 8453, 8460, 8467
+
     } ;
 
-static const flex_int16_t yy_def[2927] =
+static const flex_int16_t yy_def[3000] =
     {   0,
-     2912,    1, 2913, 2913, 2914, 2914, 2915, 2915, 2916, 2916,
-     2917, 2917, 2912, 2918, 2912, 2912, 2912, 2912, 2919, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2920, 2912, 2912, 2912, 2920, 2921, 2912, 2912,
-     2912, 2921, 2922, 2912, 2912, 2912, 2912, 2922, 2923, 2912,
-     2912, 2912, 2923, 2924, 2912, 2925, 2912, 2924, 2924, 2918,
-     2918, 2912, 2926, 2919, 2926, 2919, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2920,
-     2920, 2921, 2921, 2922, 2922, 2912, 2923, 2923, 2924, 2924,
-     2925, 2925, 2924, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2924, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2924, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2924, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2924, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2912, 2912, 2918, 2912, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2924, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2912,
-
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2924, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2912, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2912, 2918,
-
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2912, 2912, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2912, 2918, 2912, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2912, 2918, 2912, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2912, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2912, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2912, 2918, 2912, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2912, 2912,
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2918, 2912, 2912, 2918, 2912, 2918, 2912, 2918, 2918, 2912,
-
-     2912, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2912, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2912, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2912, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2912, 2912, 2912, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2912, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2912, 2918,
-     2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2912, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2912, 2918, 2912, 2918, 2912, 2918,
-     2918, 2912, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2912,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2912, 2912, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2912, 2918, 2912, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912,
-     2912, 2912, 2912, 2918, 2918, 2912, 2918, 2918, 2912, 2912,
-     2918, 2918, 2918, 2918, 2912, 2918, 2912, 2918, 2912, 2918,
-     2918, 2918, 2918, 2912, 2918, 2918, 2912, 2918, 2918, 2918,
-
-     2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-     2912, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2918, 2912, 2918, 2912,
-     2918, 2912, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2912, 2912, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2918, 2918, 2912, 2918, 2912, 2912, 2918, 2912, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2912, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2912,
-     2918, 2918, 2912, 2912, 2918, 2918, 2918, 2912, 2912, 2912,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918,
-     2918, 2912, 2918, 2918, 2912, 2912, 2918, 2918, 2918, 2918,
-     2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-
-     2912, 2912, 2918, 2912, 2912, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2912, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2918, 2912, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2912, 2912, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-
-     2912, 2918, 2912, 2912, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2912, 2918, 2912, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918, 2918,
-     2912, 2918, 2918, 2912, 2918, 2918, 2918, 2918, 2918, 2912,
-     2918, 2918, 2918, 2918, 2918, 2918, 2912, 2918, 2918, 2918,
-
-     2912, 2918, 2912, 2912, 2918, 2918, 2918, 2918, 2918, 2912,
-     2912,    0, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912
+     2985,    1, 2986, 2986, 2987, 2987, 2988, 2988, 2989, 2989,
+     2990, 2990, 2985, 2991, 2985, 2985, 2985, 2985, 2992, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2993, 2985, 2985, 2985, 2993, 2994, 2985, 2985,
+     2985, 2994, 2995, 2985, 2985, 2985, 2985, 2995, 2996, 2985,
+     2985, 2985, 2996, 2997, 2985, 2998, 2985, 2997, 2997, 2991,
+     2991, 2985, 2999, 2992, 2999, 2992, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2993, 2993, 2994, 2994, 2995, 2995, 2985, 2996, 2996, 2997,
+     2997, 2998, 2998, 2997, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2997, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2997, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2997, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2997, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2985, 2985, 2991, 2985, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2997, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2985, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2997, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991, 2991,
+     2991, 2991, 2985, 2991, 2985, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2985, 2985, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2985, 2991,
+     2985, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2985, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2985, 2985, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2985, 2985, 2991, 2991, 2991,
+     2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2985, 2985,
+     2991, 2985, 2991, 2985, 2991, 2991, 2985, 2985, 2991, 2991,
+     2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991,
+     2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2985,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2985, 2985, 2985, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2985, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2985, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2985, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2985, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2985, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2985, 2991, 2985, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2985,
+
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2985,
+     2985, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2985, 2985, 2991, 2991, 2991, 2991, 2985, 2991, 2985,
+     2991, 2985, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2985, 2991, 2985, 2991, 2985, 2991, 2991, 2991, 2991, 2985,
+
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2985, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2985,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2985, 2985, 2991, 2985, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2985, 2985, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2985,
+     2991, 2991, 2985, 2985, 2991, 2991, 2991, 2985, 2985, 2985,
+     2991, 2985, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991,
+     2991, 2985, 2991, 2991, 2991, 2991, 2985, 2985, 2991, 2991,
+     2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2985, 2985, 2991, 2985, 2985, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2985, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+
+     2991, 2991, 2991, 2991, 2985, 2991, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2991, 2985, 2991, 2991, 2991, 2991,
+     2985, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2985, 2985, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991, 2985,
+     2991, 2985, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2985, 2991, 2991, 2985, 2991, 2991, 2985,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2985, 2991,
+
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2985, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2985, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991, 2991,
+     2991, 2991, 2991, 2985, 2991, 2991, 2985, 2991, 2991, 2991,
+     2991, 2991, 2985, 2991, 2991, 2991, 2991, 2991, 2991, 2985,
+     2991, 2991, 2991, 2985, 2991, 2985, 2985, 2991, 2991, 2991,
+     2991, 2991, 2985, 2985,    0, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985
+
     } ;
 
-static const flex_int16_t yy_nxt[8377] =
+static const flex_int16_t yy_nxt[8542] =
     {   0,
        14,   15,   16,   17,   18,   19,   18,   14,   14,   14,
        14,   14,   18,   20,   21,   22,   23,   24,   25,   14,
@@ -1396,919 +1419,938 @@ static const flex_int16_t yy_nxt[8377] =
        55,   56,   57,   70,   18,   54,   55,   56,   57,   71,
        18,   60,   61,   62,   60,   61,   62,   72,   82,   92,
 
-      150,   73,  104,   47,  102,  150,   47,  140,  140,   52,
-       75,   52,   75,   75,   71,   75,   72,   58,  148,   93,
+      151,   73,  104,   47,  102,  151,   47,  141,  141,   52,
+       75,   52,   75,   75,   71,   75,   72,   58,  149,   93,
        73,   75,   71,   58,   71,   82,   92,  103,   63,  104,
        94,   63,   15,   16,   17,   65,   66,   67,   15,   16,
        17,   65,   66,   67,   95,  112,   93,  118,   76,   71,
-      142,   71,   68,  142,  103,   83,   71,   94,   68,  146,
-       71,  145,   84,  147,  147,   96,   85,  140,  140,   86,
-       69,   95,  112,   97,  118,  154,   69,  143,  155,   68,
-      105,   71,   83,  369,  159,   68,   77,   78,  106,   84,
-       79,   71,   96,   85,  107,   80,   86,  139,  108,   71,
-
-       97,   71,  154,  153,   81,  155,   71,  105,   71,   71,
-       71,  159,   71,   77,   78,  106,  150,   79,  156,  222,
-      158,  107,   80,   98,  139,  108,   99,   71,  157,  141,
-      153,   81,   87,  100,  142,  101,   88,  142,   71,   89,
-       71,   90,   91,   71,  109,  156,   71,  158,  110,  150,
-       98,   71,  162,   99,   71,  157,  128,  171,  129,   87,
-      100,   71,  101,   88,  111,   71,   89,  130,   90,   91,
-       71,  109,  119,  131,  164,  110,  120,  163,  148,  162,
-      147,  147,   71,  128,  171,  129,  121,   71,  170,  122,
-      146,  111,  113,   71,  130,   71,  114,  174,   71,  119,
-
-      131,  164,  115,  120,  163,  116,  144,  132,  144,  144,
-       71,  144,  117,  121,   71,  170,  122,  133,  160,  113,
-      172,  134,  135,  114,  174,  145,  179,  143,  141,  115,
-       71,  161,  116,  136,  132,   71,  200,  137,  173,  117,
-      123,  138,   71,  124,  133,  160,   71,  261,  134,  135,
-      125, 2912,   71,  179,  126,  127,   71,  180,  161,   71,
-      136, 2912,   71,  200,  137,  173,   71,  123,  138,   70,
-      124,   70,   70,   75,   70,   75,   75,  125,   75,   71,
-       70,  126,  127,  149,  180,  149,  149,   70,  149,   70,
-       70,   75,   70,   75,   75,  165,   75,  175,   70,  168,
-
-      169,  166,   75,  167,   71,  176,  177,  183,   71,  182,
-     2912,  152,  181,  178,  294, 2912,   71,  190,  188, 1147,
-       71,   71,  165, 2912,  175,   71,  168,  169,  166,   76,
-      167,   71,  176,  177,  183,   71,  182,  191,  184,  181,
-      178,  185,  189,  193,  190,  198,   71,  194,  196,   71,
-       71,  202,  201,  197,  186,  187,   71,  192,   71,   71,
-      199, 2912,   71,  195,  191,  184,   71,   71,  185,  189,
-      193,   71,  198,  206,  194,  196,  211,  203,  202,  201,
-      197,  186,  187,   71,  192,  204,  205,  199,  207,  208,
-      195,   71,   71,  209,  210,   71,   71,   71,  212,  213,
-
-      206,   71,   71,  211,  203,   71,  216, 2912,  214,  217,
-      221,   71,  204,  205,  215,  207,  208,   71,   71,  218,
-      209,  210,   71,  223,   71,  212,  213,  224,  228, 2912,
-      219,  227, 2912,  216,  220,  214,  217,  221,   71,   71,
-       71,  215,  236,   71,  225,  230,  218,  226,  229,  231,
-      223,   71,  235,   71,  224,  228,   71,  219,  227,  232,
-       71,  220,  237,  239,   71,  240, 2912,   71,  233,  236,
-      280,  225,  230,  238,  226,  229,  231,   71,   71,  235,
-      234, 2912,   71,   71,   71,   71,  232,  241,  242,  237,
-      239,  144,  240,  144,  144,  233,  144,  280,  243,  149,
-
-      238,  149,  149,   75,  149,   75,   75,  234,   75,  245,
-       71,  150,  244,  246,  241,  242,  247,  249,   71,  250,
-      251, 2912,  252,  248,  254,   71,  253,  255,   71,  340,
-       71,   71, 2912,   71,   71,   71,  245,  259,   71,  244,
-      246,  152,  260,  247,  249,   71,  250,  251,   71,  252,
-      248,  254,  256,  253,  255,  258,   71,   71,  257,   71,
-      270,  274,  262,  276,  259,  271,  263,  272,   71,  260,
-      275, 2912,  284,   71,  273,  278,   71,   71,  279, 2912,
-      430,   71,  258,  264,   71,  257,   71,  270,  274,   71,
-       71,  277,  271,  263,  272,   71,   71,  275,   71,  284,
-
-       71,  273,  278,  281,  285,  279,  293,   71, 2912,  282,
-      264,  265,  283,  286, 2912,   71,  266,   71,  277,  291,
-     2912,  267, 2912, 2912,   71,  298,   71,  268,  269, 2912,
-      281,  285,  287,  293,   71,   71,  282,  288,  265,  283,
-      286,   71,  295,  266,  305,  292,  291,  300,  267,  289,
-      296,  290,   71,  299,  268,  269,  303,   71,   71,  287,
-       71,  297,   71,  301,  288,  304,   71,  306,   71,  295,
-      307,  305,  292,  308,  311, 2912,  289,  302,  290,   71,
-      299,   71,   71,  303,  309,  310,  312,  313,  297,  314,
-     2912,  315,   71,   71, 2912,   71,  545,   71,   71,   71,
-
-      308,  311,   71,  316,  302,   71,   71,   71,   71,  317,
-      318,  309,  310,  312,  313,  319,  314,  320,  315,  321,
-      322,  325,   71,   71,   71,   71,   71,   71,  323,   71,
-      316,  326,  327,  324,  328,  330,  317,  318,   71,  333,
-       71,   71,  319,  329,  320,  332,  321,  322,  331,  334,
-       71,   71,  336,   71,  341,  323,  335,   71,  326,  327,
-      324,  337,  330,  339,   71,   71,   71,  338,  343, 2912,
-      329,   71,  332,   71,  344,  331,   71,  342,  346,  350,
-       71,   71,   71,  335,   71,  347,   71,  348,  337,   71,
-      339,  345, 2912,  354,  338,  349,  355,  352,   71,   71,
-
-       71,  344,  150,   71,  342,  346,  350,   71,  351,  353,
-      356,  357,  347,   71,  348,   71,  358,  359,  345,   71,
-      365, 2912,  349,  363,  352,   71,  360,  366,   71,   71,
-      362,  361,   71,   71,  367,  351,  353,  356,  357,   71,
-       71,  368,   71,   71,  359,  364,  370,   71,   71,  371,
-      363,   71,   71,  360,  366,   71,  372,  362,  361,   71,
-      373,  367,  374,  376,  375,  378,  377,   71,  368,  380,
-     2912,   71,  364,  370,   71,   71,  371,  381,  382,  379,
-      387,  385,   71,  372,   71, 2912,   71,  373,   71,  374,
-      376,  375,   71,  377,  383, 2912,  386,   71,  388, 2912,
-
-      389,   71,   71,  392,  381,   71,  379,   71,  385,   71,
-       71,  384,   71,  390,  391,  393,  402,   71,   71,   71,
-      395,  383,  394,  386,  396,  388,  397,  389,   71,   71,
-      392,   71,  403,   71, 2912,  398,  413,  399,  384,   71,
-      390,  391,  393,   71,   71,  401,  412,  395,   71,  394,
-      404,  396,   71,  397,  400,   71,   71,  411,   71,  403,
-       71,   71,  398,  413,  399,   71,  422,  439,  419, 2912,
-      417,  423,  401,  412,  418,   71, 1267,  404,  414,  424,
-      415,  400,  405,   71,  411,  406,  420,  421,   71, 2912,
-      407,  408,  409,  410,   71,  419,  416,  417,   71,   71,
-
-       71,  418,   71,   71,   71,  414,  424,  415,  428,  405,
-      427,   71,  406,  420,  421,  429,  431,  407,  408,  409,
-      410,  425,   71,  416,  426,  434,   71,  432,  433,  435,
-      442,   71,  437,   71,  438,  428,  441,  427,   71,   71,
-       71,  436,  429,  431,   71,  443,   71,   71,  425,   71,
-      440,  426,  434,   71,  432,  433,  435,   71,   71,  437,
-      444,  438,   71,  441,  454,  448,  445,   71,  436,  455,
-      449,  446,  443,  447, 2912, 2912, 2912,  440,   71, 2912,
-      456,  453,   71,  450, 2912, 2912,  451,  444,  452, 2912,
-       71,  454,  448,  445,   71,   71,  467,  449,  446,   71,
-
-      447,   71,   71,   71,  471,  468,  457,  456,  453,  469,
-      450,   71,  458,  451,  470,  452,  459,   71,  472,  483,
-      494,   71,  474,  467,  460, 2912,   71,   71,  482,  486,
-       71,  471,  468,  457,  473,   71,  469,   71,  487,  458,
-       71,  470,   71,  459,  150,  472,  483,  494,  484,  474,
-       71,  460,  461,  485,  462,  482,  486,  489,  488,  490,
-      491,  473,  495,  492,  496,  487,   71,  463,   71,   71,
-      464, 2912,  465,  497,  466,   71, 1022,   71,   71,  461,
-       71,  462,  493,   71,  489,  488,  490,  491, 2912,  495,
-      504,  499, 2912,  501,  463,   71,   71,  464,   71,  465,
-
-      497,  466,  475,  476,  498,   71,  500,   71,   71,  493,
-      502,  503,  477,   71,  478,  479,  480,  506,  499,  481,
-      501,  505,   71,   71,   71,  507,  509,   71,  512,  475,
-      476,  498,   71,  500,  511, 2912,  508,  502,  503,  477,
-       71,  478,  479,  480,  506,   71,  481,   71,  505,   71,
-       71,  510,  507,   71,  516,  512,  513,  514,   71,  515,
-      517,  511,  518,  508,  526,   71,   71,  521, 2912,  522,
-      519,   71,  524, 2912,  525,   71,   71, 2912,  510, 2912,
-      534,  516,   71, 2912,  523,   71,  515,  517,  520,  518,
-       71,  526,   71,  527,  521,   71,  522,  519,   71,  524,
-
-      528,  525,   71,  529,   71,  533,  530,  534,  535,   71,
-      536,  523,  538,  537,  541,  520,   71,  531,   71,  532,
-      527,  539, 2912,   71,   71,  543,  540,  528,   71,  544,
-      529,   71,  533,  530,  549,  535,   71,  536,  546,  538,
-      542,  541,   71,   71,  531,   71,  532,   71,  539,   71,
-      547,   71,  543,  540,  548,  550,  544,  551, 2912,  557,
-       71,  553,  552,  554,   71,  546,   71,  542,   71,   71,
-     2912,  555,  561, 2912,   71,  564, 2912,  547,   71,  556,
-       71,  548,  550,   71,  551,   71,  557,  558,  553,  552,
-      554,  559,  560,  562,   71,  563,   71,   71,  555,  561,
-
-       71,   71,  564,  565,  568,  566,  556,   71,  567,   71,
-       71,   71,  569,  574,  558,  570,   71,  571,  559,  560,
-      562,   71,  563,  572,  578,   71,  573,  579,   71,  581,
-      565,  568,  566,   71,   71,  567,   71,   71,   71,  569,
-      574,   71,  570,  575,  571,  576,  580,  577,  586,  582,
-      572,  578,   71,  573,   71,  583,  591,  588,  587,   71,
-      584,   71, 2912,  585,   71,   71,  589, 2912,   71,   71,
-      575,   71,  576,  580,  577,  592,  582,  595, 2912,   71,
-       71,   71,  583,  591,  588,  587,  593,  584,  594,  590,
-      585,   71,  596,  597,   71,  598,  599,   71,   71,  610,
-
-       71,  600,  592,  613,  595,   71,   71,   71,  612,   71,
-      601,   71,  654,  593,   71,  594,  590,   71, 2912,  596,
-      597,  611,  598,  599,   71,  614,  610,  615,  600, 2912,
-      613,   71, 2912,   71,  618,  612,   71,  601,  602,   71,
-      616,  621, 2912,  603,  617,  604,   71,  619,  611,  620,
-       71,  605,  614,  606,  615,  624,  607,  608, 2912,   71,
-       71,  618,   71,  609,   71,  602,   71,  616,  621,   71,
-      603,  617,  604,  625,  619,  622,  620,  626,  605,  627,
-      606,   71,  624,  607,  608,  623,   71,  628,  632,  629,
-      609,   71,  630,  631,  634, 2912,  633,   71, 2912,  639,
-
-      625,  643,   71,   71,  626,   71,  627,   71,   71,  636,
-      637,   71,  623,   71,  628,  632,  629,  635,   71,  630,
-      631,  634,   71,  633,  638,  640,  639,  641,   71,  645,
-      642,   71,   71,   71,  644,  646,  636,  637,  648,  649,
-      650,   71,  647,   71,  635,   71,   71,  659,   71,   71,
-       71,  638,  640,  150,  641,   71,  645,  642,  651,  652,
-      653,  644,  646,   71,  655,  648,  649,  650,  656,  647,
-      657,   71,   71,  658,  659, 2912,  660,  662,  661,   71,
-      667,  673,  663,   71,   71,  651,  652,  653,   71,   71,
-       71,   71,  668,  671,  672,  656,   71,  669,  670,   71,
-
-      658,  664,   71,  660,  662,  661,   71,  667,  665,  663,
-      674,  666,   71,   71,  675,  676,  677,  679,  678,   71,
-       71,   71,   71,  680,   71,  670,  687,  681,  664,  682,
-      683,   71,  684,  692, 2912,  665,   71,   71,  666,   71,
-      685,   71,   71,  677,  679,  678,   71,   71,   71,  686,
-      680,  688,   71,   71,  681,  689,  682,  683,   71,  684,
-      694,  690,  691,  693,   71,   71,  699,  685,  698,   71,
-      695,  700,   71,   71,   71,  696,  686,   71,  688,  697,
-       71,  701,  689,   71,  705,   71, 2912,  694,  690,  691,
-      693,  702,   71,  699,   71,  698,  703,  695,  700,  704,
-
-      707,  706,  696,   71,  713, 2912,  697,  708,  701,   71,
-      710,   71,  711,   71, 2912,   71,   71, 2912,  702,   71,
-      712,  715,  719,  703,   71, 2912,  704,  707,  706,  709,
-       71,  713,   71,  717,  708,  714,   71,  710,  716,  711,
-      720,   71,   71,  718,   71,  721,  722,  712,  715,   71,
-       71,  723,   71,   71,  726,   71,  709,   71,   71,  724,
-      717,  725,  714,  727,  730,  716, 2912,  720,  734,   71,
-      718,  732,  721,  722,   71,   71,  728,  729,  723,  731,
-       71,  726,  733,  736,  737,  735,  724,   71,   71,  739,
-      727,  730,  738,   71,  740,   71,  741,  745,  732,  742,
-
-       71,   71,  751,  748,  747,   71,  731,   71,   71,  733,
-       71,  737,  735,   71,   71,   71,  743,  744,  749,  738,
-      746,   71,   71,  741,   71,   71,  742,  753,   71,   71,
-      748,  747,  754,  750,   71,  752,  757,  755,   71,  756,
-      759, 2912,   71,  743,  744,  749,  758,  746,   71,   71,
-       71,  760,  761,  766,  753, 2912,  768,  767, 2912,  762,
-      750,   71,  752,  757,   71,   71,  756,  759,   71,  764,
-     2912,   71,  763,  758,   71,  765,   71,   71,  760,  761,
-       71,   71,   71,  768,  767,   71,  762,  772,  769,  770,
-      773,  775,  774,  776,  771,   71,  764,  777,  781,  763,
-
-       71,   71,  765,   71,   71,   71,   71,   71,  780, 2912,
-      778, 2912,   71,  787,  772,  769,  770,  773,   71,  774,
-      776,  771,  779,   71,  777,  781,   71,  782,  786,  789,
-       71,   71,  783,  784,  785,  780,   71,  778,   71,  788,
-      787,   71,   71,  790,  792,  793,  791,  794, 2912,  779,
-      796,   71,   71,  798,  782,  786,  789,   71,   71,  783,
-      784,  785,   71,  797,   71,   71,  788,   71,  795,  799,
-      790,  792,  793,  791,  794,   71,   71,  796,  800,  801,
-      798,  804,  802,   71,  803,  805,  816,  807, 2912,   71,
-      797,   71,  806,  808,  809,  795,  799, 2912,   71,   71,
-
-       71,   71,   71,  810,   71,  800,  801,  812,  804,  802,
-       71,  803,  805,   71,  807,  150,  811,  819,   71,  806,
-      808,  809,  815,  813,  814,   71,   71,  820,   71,   71,
-      810,  817,  821,  822,  812,   71,  826,   71,   71,  818,
-       71,  823, 2912,  811,   71,   71,  824,  825,   71,  815,
-      813,  814,  827,  828,  820,  831,  829,   71,  817,  821,
-      830,   71,   71,  826,   71,   71,  818,  842,  823,   71,
-      832,  833,   71,  824,  825,   71, 2912,  839,   71,  827,
-       71,  840,  831,  829,  841,   71, 2912,  830,   71,   71,
-      843,   71,  844,  847,  842, 2912,  845,  832,  833,  834,
-
-     2912,   71,   71,  835,  839,  846,  836,  850,  840,   71,
-      851,  841,  849,  837,   71,   71,  838,  843,  848,  844,
-      847,   71,   71,  845,  863,   71,  834,   71,  859,  860,
-      835,   71,  846,  836,  850,   71, 2912, 2912,  864,  849,
-      837,  865,   71,  838,  861,  848,  852,  853,   71,  854,
-       71,  863,  855,   71,  866,  859,  860,  856,  862,  870,
-       71,   71,  868,  857,  858,   71,  867, 2912,  865,  872,
-      869,  861,   71,  852,  853, 2912,  854,  871,   71,  855,
-       71,  866,  875,   71,  856,  862,  870,  873,   71,  868,
-      857,  858,   71,  867,   71,  874,  872,  869,  877,   71,
-
-      876,  878,   71,   71,  871,   71,   71,   71,  879,  875,
-      882,  880,  883,  881,  873,  884,  886,  888, 2912,  885,
-       71,   71,  874,   71,   71,  877,   71,  876,  878,  887,
-       71,  891,  892,  893,   71,  879,   71,  882,  880,  883,
-      881,  894,  884,  895,   71,  889,  885,  896,   71,  897,
-      890,   71,  899,   71,  898,  900,  887,  902,  891,  901,
-      904,  903,  906,   71,   71,   71,   71, 2912,  894,  909,
-       71,   71,  907,   71,  896,   71,  897,   71,   71,   71,
-       71,  898,   71,   71,  902,  905,  901,  904,  903,   71,
-       71,  908,  910,   71,  913,  911,  912,  914,  916,  907,
-
-       71,   71,  915,  918,  917,   71,  919, 2912,  923, 2912,
-       71,   71,  905,   71,   71,   71,   71,   71,  908,  910,
-       71,  913,  911,  912,  914,  916,   71,  920,  921,  915,
-      918,  917,   71,  919,  922,  923,   71,  927,  924,   71,
-     2912,  926,  928,  930,  931,  929,  925, 2912,   71,   71,
-      932,   71,   71,  933,  920,  921,  934,   71,   71,  937,
-      935,  922,   71,   71,   71,  924,   71,   71,  926,  928,
-      930,  931,  929,  925,  940,  936,  938,  932,   71,   71,
-      933,  939,   71,  934,  942,   71,  937,  935,  943,   71,
-      947,  941,  944,  945,  946,  948,   71,  949,  950,   71,
-
-     2912, 2912,  936,  938,   71,   71,   71,   71,  939,   71,
-      952,  942,   71,  957,   71,  943,   71,  947,  941,  944,
-      945,  946,   71,  951,  949,  950,  953,  954,  955,   71,
-       71,  956,   71,   71,  958,  959,   71,  952,   71,  960,
-      961,  962,  963,  964,  965,   71,   71,   71,  969,  970,
-      951,   71,  966,  953,  954,  955,  967,  968,  956,   71,
-      974,  958,  971,   71,  976,   71,  960,   71,  972,  963,
-      964,  965,   71,   71,   71,  969,  973,   71,   71,  966,
-      975,   71,  978,  967,  968,  977,   71,   71,  979,  971,
-       71,   71,   71,  980,   71,  972,  981, 2912,  982,  985,
-
-      986,  983, 2912,  973,   71,   71,   71,  975,   71,  978,
-      984,  987,  977, 1000,   71,  150,  988,   71,  997,   71,
-      980,   71,  999,  981,   71,  982,  985,  986,  983,   71,
-      990,  998,  989, 2912,   71, 2912,   71,  984,  987,   71,
-       71, 2912, 1002,  988,   71,  997, 2912, 2912, 1001,  999,
-       71, 1007, 1003, 2912,   71, 1005, 1008,  990,  998,  989,
-      991, 1004,  992, 1006,   71,   71,  993, 1009,  994, 1002,
-     1019, 1020, 2912,  995,   71, 1001,   71,   71,  996, 1003,
-       71, 1010, 1005,   71,   71, 1011, 2912,  991, 1004,  992,
-     1006, 1012, 1014,  993, 1009,  994, 1015,   71, 1017, 1018,
-
-      995, 1013,   71,   71,   71,  996, 1021, 1023, 1010,   71,
-     1016,   71, 1011,   71,   71, 1026,   71, 1024, 1012, 1014,
-       71, 1025,   71, 1015,   71, 1017, 1018, 2912, 1013,   71,
-     1034, 1035, 2912,   71, 1036, 2912, 1037, 1016, 1038,   71,
-     2912, 2912, 1026, 2912, 1024,   71, 1041,   71, 1025, 1027,
-     1039,   71, 1040,   71, 1028, 1044, 1029, 1034, 1035,   71,
-     1047, 1036, 1030, 1037,   71, 1038, 1046, 1031, 1032, 1045,
-     1042,   71,   71, 1041, 1033,   71, 1027, 1039,   71, 1040,
-     1043, 1028,   71, 1029,   71, 1048, 1049, 1047,   71, 1030,
-     1050, 1053,   71,   71, 1031, 1032, 1045, 1042,   71, 1051,
-
-       71, 1033, 1052, 1055, 1056, 1054, 1057, 1043, 1058,   71,
-       71, 2912, 1048, 1049,   71, 1059,   71, 2912, 1053, 1066,
-     1060,   71,   71,   71,   71, 1061, 1051,   71, 1063, 1052,
-     1055, 1064, 1054, 1057, 1062, 1058,   71,   71,   71, 1065,
-       71,   71, 1059,   71, 1067, 1068, 1066, 1060, 1069,   71,
-     1081, 1070, 1061, 1071,   71, 1063, 1073,   71, 1064,   71,
-       71, 1062, 1072, 1074,   71, 1076, 1065, 1075, 2912,   71,
-       71, 1067,   71, 1077, 1078, 1069, 1080,   71, 1070,   71,
-     1071, 1079,   71, 1073, 1082, 1088, 1083,   71, 1084, 1072,
-     1074, 2912, 1076, 1085, 1075,   71,   71,   71,   71,   71,
-
-     1077, 1078,   71, 1080, 1086, 1089, 1091, 1087, 1079,   71,
-     1090, 1082, 1088, 1083, 1092,   71, 1094,   71,   71, 1095,
-       71, 1096, 2912, 1093, 2912, 1097,   71, 2912,   71, 1099,
-       71, 1086, 1089, 1091, 1087,   71, 1098, 1090, 1100, 1102,
-     1103, 1092,   71, 1101, 1104, 1108, 1095, 1105,   71,   71,
-     1093,   71, 1097,   71,   71, 1107, 1099, 1109, 1106,   71,
-       71,   71,   71, 1098, 1111, 1100, 1102, 1103,   71,   71,
-     1101, 1104, 1110,   71, 1105, 2912,   71,   71, 1112, 2912,
-     1113, 1115, 1107, 1114,   71, 1106, 1116, 1117, 1119,   71,
-       71, 1111,   71,   71, 1120, 1118, 1121, 1122, 2912, 1110,
-
-     1124, 1127,   71, 1123, 1129, 1112,   71, 1113, 1115,   71,
-     1114,   71, 1125, 1116, 1117, 1128, 1133, 1130,   71,   71,
-       71,   71, 1118, 1121, 1122,   71,   71, 1126, 1131, 1132,
-     1123,   71,   71,   71,   71,   71, 1134,   71,   71, 1125,
-       71, 1135, 1128, 1133, 1130, 1138,   71, 1137, 1139, 1136,
-     1140, 1142, 1141,   71, 1126, 1131, 1132,   71,   71, 1143,
-       71, 1144,   71, 1134,   71, 1153, 1146, 1149, 1135,   71,
-     1145, 2912, 1138,   71, 1137, 1148, 1136, 1159, 1142, 1141,
-       71,   71,   71,   71,   71,   71,   71, 1150, 1144, 1151,
-     1152,   71,   71, 1146, 1149,   71, 1154, 1145,   71, 1155,
-
-     1156, 1158, 1148, 1157,   71, 1160, 1161, 1162, 2912,   71,
-     2912,   71,   71, 1163, 1150,   71, 1151, 1152, 1164,   71,
-     1165, 1166, 1168, 1154, 1167,   71, 1155, 1156, 1158, 1169,
-     1157, 1174, 1160, 1171,   71,   71, 2912,   71,   71,   71,
-     1163,   71,   71,   71,   71, 1164, 1170, 1165, 1166, 1168,
-     1172, 1167, 1175,   71,   71, 1173, 1169, 1176,   71, 1177,
-     1171, 1179,   71,   71, 1178,   71,   71, 1180,   71, 1184,
-     1185,   71, 2912, 1170, 1187, 1188, 1181, 1172, 1182, 1175,
-     1186, 1183, 1173, 2912, 1176,   71, 1177,   71, 1179,   71,
-     1191, 1178,   71, 1190, 1180,   71, 1184, 1185, 1192,   71,
-
-       71, 1187, 1188, 1181, 1189, 1182,   71, 1186, 1183, 1196,
-     1193,   71,   71,   71, 1194, 1195, 1197, 1191, 1198, 1199,
-     1190, 1202, 1200,   71, 1201, 1192,   71, 1205, 2912, 2912,
-       71, 1189,   71, 2912, 2912,   71,   71, 1193,   71,   71,
-       71, 1194, 1195, 1197,   71, 1198, 1199,   71, 1202, 1200,
-     1203, 1201, 1204, 1206, 1205, 1207, 1208, 1209, 1210, 1211,
-     1212, 1214,   71, 1218,   71,   71,   71,   71,   71,   71,
-     1213, 1215,   71,   71, 1216, 1217,   71, 1203,   71, 1204,
-     1206,   71, 1207, 1208, 1209, 1210, 1211, 1212, 1214, 1220,
-     1219,   71, 1221,   71, 1223,   71, 1222, 1213, 1215,   71,
-
-     1224, 1216, 1217,   71, 1226, 1225, 2912, 1227,   71,   71,
-     1228, 1236,   71, 1229, 1238, 1237, 1220, 1219,   71, 1221,
-       71, 1223, 1242, 1222,   71,   71, 1239, 2912, 2912, 1240,
-     1241, 1226,   71,   71, 1227, 1245, 2912, 1228, 1236,   71,
-     1229, 1230, 1237, 1243, 1231, 1232,   71, 1244,   71, 1233,
-     2912,   71,   71, 1239,   71, 1234, 1240, 1241, 1246, 1235,
-     1250,   71, 1245,   71,   71,   71, 1247,   71, 1230,   71,
-     1243, 1231, 1232, 1248, 1244, 1249, 1233, 1252, 1255, 1251,
-     1256, 1254, 1234, 1253, 1257, 1246, 1235, 1250,   71,   71,
-       71,   71,   71, 1247, 1258,   71, 1259,   71, 1260, 2912,
-
-     1248, 1268, 1249,   71, 1252, 1255, 1251, 1256, 1254, 2912,
-     1253, 2912, 2912, 1266, 1269, 1271,   71,   71,   71, 1270,
-     2912,   71, 1276, 1259,   71, 1260,   71, 1261, 1268, 1272,
-     1273,   71, 1262, 2912, 1263, 1274, 1264,   71, 1265,   71,
-     1266, 1269, 1271, 1275,   71,   71, 1270,   71,   71, 1276,
-     1278, 1277, 1279, 1281, 1261, 2912, 1272, 2912, 1280, 1262,
-       71, 1263,   71, 1264,   71, 1265,   71, 1283,   71, 1282,
-     1275, 1284,   71, 1285, 1286, 1288, 1289, 1278, 1277, 1279,
-     1281, 1290,   71,   71,   71, 1280, 1287, 1291,   71,   71,
-     1292,   71, 1293,   71, 1283, 1297, 1282,   71, 1284, 1294,
-
-     1285, 1286, 1288,   71, 1295, 1296, 1299, 1301, 1290, 1300,
-     1325, 1298,   71, 1287,   71,   71,   71, 1292,   71, 1293,
-     1304,   71,   71,   71, 1302, 1306, 1294, 1309, 1308,   71,
-       71, 1295, 1296,   71, 1301,   71, 1300, 1303, 1298, 1305,
-     1310, 1307,   71,   71, 1311,   71,   71,   71,   71,   71,
-       71, 1302, 1306,   71, 1309, 1308, 1312, 1313, 1316, 1314,
-     1315, 2912, 1319, 2912, 1303,   71, 1305, 1310, 1307,   71,
-     1317, 1311, 1318, 1320, 1326, 1328, 1323,   71, 1336, 2912,
-       71,   71,   71, 1312, 1313, 1316, 1314, 1315,   71, 1319,
-     1322, 1324,   71, 1321,   71,   71,   71, 1317, 1329, 1318,
-
-     1320, 1327,   71, 1323, 1330,   71,   71,   71, 1331, 1332,
-       71,   71,   71, 1337, 1333, 1334,   71, 1322, 1324, 1338,
-     1321,   71,   71,   71,   71, 1329, 1335, 1339, 1327, 1345,
-       71, 1330, 2912, 1343, 1344, 1331,   71, 1340,   71, 1346,
-       71, 1333, 1334, 1341, 1342,   71, 1338,   71,   71, 1349,
-       71,   71, 1348, 1335,   71, 1347, 1345, 1351,   71,   71,
-     1343, 1344,   71, 1350, 1340,   71, 1346, 1353, 1352, 1354,
-     1341, 1342,   71, 1355, 1357, 1358, 1349,   71, 1356, 1348,
-     1359, 1369, 1347,   71,   71,   71, 1361, 1360, 1368,   71,
-     1350, 1366, 2912,   71, 1353, 1352, 1354, 1367,   71,   71,
-
-       71, 1357, 1358, 1362,   71,   71, 1363, 1359, 1369, 1364,
-       71, 1370, 1365, 1361, 1360,   71,   71, 1371, 1366, 1373,
-       71, 1372,   71, 1374, 1367,   71, 1375,   71,   71, 1376,
-     1362,   71, 1381, 1363, 1377,   71, 1364, 1382, 1370, 1365,
-     1379,   71, 1378, 1380, 1371,   71, 1373, 1385, 1372,   71,
-     1374,   71,   71, 1375, 1383,   71, 1376, 1384,   71, 1381,
-       71, 1377, 1386,   71, 1382,   71, 1387, 1379, 1389, 1378,
-     1380, 1390, 1388, 2912,   71, 1392, 1393,   71, 1391,   71,
-       71, 1383, 1394,   71, 1384,   71,   71, 1397, 1396, 1386,
-     1399, 1395, 1402, 1387, 1403, 1389,   71,   71, 1390, 1388,
-
-       71, 1401, 1392, 1393,   71, 1391,   71, 1398, 1406, 1394,
-     1400,   71, 1404,   71, 1397, 1396,   71, 1399, 1395,   71,
-     1405, 1407, 1408,   71,   71, 1412,   71, 1409, 1401, 1410,
-     2912, 1411, 1432, 1413, 1398,   71,   71, 1400,   71, 1404,
-       71, 1416,   71,   71,   71,   71,   71, 1405, 1407, 1408,
-     1414, 1415, 1412, 1417, 1409, 1424, 1410,   71, 1411,   71,
-     1413, 1418, 1419,   71,   71, 1423,   71, 1420, 1416,   71,
-       71, 1421,   71, 1427, 1428, 1425, 1422, 1414, 1415, 1426,
-     1417,   71, 1424,   71, 2912, 1429, 1431,   71, 1418, 1433,
-     1430,   71, 1423,   71,   71,   71,   71,   71, 1434,   71,
-
-     1427, 1428, 1425,   71, 1435, 1437, 1426, 1436, 1438, 2912,
-     1439,   71, 1429, 1431, 1440,   71, 1433, 1430,   71, 1441,
-     1442, 1445,   71, 1446, 1444, 1434,   71,   71,   71, 1443,
-       71, 1447, 1437,   71, 1436, 1449,   71, 1439, 1448, 1450,
-       71, 1440,   71, 1452, 1451, 1453, 1441, 1442, 1445,   71,
-     1446, 1444, 1458,   71, 1454,   71, 1443,   71, 1447, 2912,
-     1455,   71,   71,   71, 1456, 1448, 1450,   71,   71, 1462,
-     1452, 1451, 1453, 1460,   71, 1461, 1459, 1457, 2912, 1458,
-       71, 1454, 1470, 1463, 1464,   71,   71, 1455,   71, 1465,
-     1466, 1456, 1467, 1471, 1469, 1476,   71, 1475, 1468,   71,
-
-     1460,   71, 1461, 1459, 1457,   71,   71,   71, 1474, 1472,
-     1463, 1464,   71,   71,   71, 1478, 1465, 1466,   71, 1467,
-       71, 1469, 1473,   71, 1475, 1468, 1477,   71,   71, 1480,
-       71, 1479, 1481,   71, 1482, 1474, 1472, 1484, 1483, 1485,
-     2912, 1486,   71,   71,   71,   71, 1488, 1490, 1487, 1473,
-     1492, 2912,   71, 1477, 2912,   71,   71,   71, 1479, 1481,
-       71, 1482,   71, 1489, 1484, 1483, 1485,   71, 1486,   71,
-     1491,   71, 1493, 1488, 1490, 1487,   71, 1492, 1495, 1494,
-       71,   71, 1496,   71, 1498, 1497, 1501, 1506, 1499, 1500,
-     1489,   71, 1504,   71, 1502, 1503, 2912, 1491,   71, 1493,
-
-     1507,   71,   71,   71, 1509, 1495, 1494, 1510,   71, 1496,
-       71, 1498, 1497,   71, 1506, 1499, 1500,   71,   71, 1504,
-     1505, 1502, 1503,   71, 1508,   71,   71, 1507, 1511, 1512,
-     1518, 1509,   71, 1515,   71, 1513, 1514,   71, 1516, 2912,
-       71, 1517,   71,   71, 2912, 2912,   71, 1505, 1522, 2912,
-     1525, 1508,   71, 1521, 1519, 1511, 1512, 1518, 1524, 1520,
-     1515,   71, 1513, 1514, 1530, 1516,   71,   71, 1517, 1523,
-       71,   71,   71, 1526, 1528, 1522,   71, 1525, 2912, 2912,
-     1521, 1519, 1527,   71, 1529, 1524, 1520, 1531, 1533,   71,
-     1534,   71, 1532,   71, 1535,   71, 1523,   71, 1536, 1537,
-
-     1547, 2912, 2912, 2912, 1540,   71,   71, 1538, 1542, 1527,
-       71, 1529,   71,   71, 1531, 1533,   71, 1534, 1539, 1532,
-       71, 1535, 1541,   71,   71, 1536, 1537, 1552,   71, 1543,
-       71, 1540,   71, 1548, 1538, 1542,   71, 1544, 1553, 1549,
-     1545, 1550, 1551, 1557,   71, 1539, 2912, 1555,   71, 1541,
-     1554,   71, 1546, 2912, 1552,   71, 1543,   71, 1556, 1558,
-     1548,   71, 1559,   71, 1544, 1564, 1549, 1545, 1550, 1551,
-       71, 1560,   71,   71, 1555,   71,   71, 1554, 1563, 1546,
-       71,   71, 1561, 1565,   71, 1556, 1558, 1562, 1567, 1559,
-       71, 1566, 1568, 2912,   71, 1569,   71,   71, 1560, 1570,
-
-     1573, 1571,   71, 1572, 1574, 1563, 2912,   71, 1575, 1561,
-     1577,   71,   71,   71, 1562,   71, 1576,   71, 1566, 1568,
-       71,   71, 1569,   71, 1578,   71,   71, 1573, 1571,   71,
-     1572, 1574, 1579, 1580, 1581, 1575, 1582, 1577,   71, 1583,
-       71,   71, 1584, 1576, 1588,   71, 1585, 1593, 1586,   71,
-     1587, 1578, 1589,   71, 1590, 2912,   71,   71, 1591,   71,
-     1580, 1581, 1592, 1582,   71,   71, 1583,   71, 1594,   71,
-       71, 1588, 2912, 1585, 1593, 1586,   71, 1587, 1601, 1589,
-       71, 1590, 1597, 1595, 1602, 1591, 1596, 1598,   71, 1592,
-     1603, 1604, 1599,   71, 1600, 1594,   71, 1619, 1605,   71,
-
-     1606,   71,   71, 1607, 1609, 1601,   71,   71, 1608, 1597,
-     1595,   71,   71, 1596, 1598, 1610, 1611,   71, 1604, 1599,
-     1612, 1600,   71, 1613,   71, 1605, 1614, 1606,   71,   71,
-       71, 1609, 1615, 1616,   71, 1608, 1617,   71,   71, 1618,
-       71, 1620, 1610, 1611,   71, 1621, 1623, 1612, 1622, 1626,
-     1613,   71,   71, 1614, 1624,   71, 1628,   71, 1625, 1615,
-     1616, 1629,   71, 1617,   71,   71, 1618,   71,   71,   71,
-     1633, 1630, 1621, 1623, 1631, 1622, 1626, 1627, 1632,   71,
-     1637, 1624,   71, 1628, 1634, 1625, 1639,   71, 1629,   71,
-     1635, 1643,   71, 1636, 1640,   71,   71, 1633, 1630, 1641,
-
-       71, 1631, 1642, 1638, 1627, 1632, 1645, 1637,   71,   71,
-     1644, 1634, 1646, 1639, 1647,   71, 1648, 1635, 1649,   71,
-     1636, 1652, 1651,   71, 1650, 1656,   71, 1657, 1653, 1642,
-     1638,   71, 1654,   71, 2912,   71,   71, 1644, 1655,   71,
-     1668, 1647,   71, 1660,   71, 1649,   71, 1662,   71, 1651,
-     1658, 1650, 1659,   71, 1657, 1653,   71,   71,   71, 1654,
-       71,   71,   71, 1661, 1663, 1655, 1666, 1664, 1669, 1665,
-     1660, 1670,   71, 1675, 1662, 1672, 1671, 1658,   71, 1659,
-       71,   71,   71,   71,   71,   71, 1678, 1667, 1679, 1673,
-     1661, 1663, 1674,   71, 1664,   71, 1665,   71, 1670, 1676,
-
-       71, 1677, 1672, 1671,   71,   71,   71, 1681, 2912, 1682,
-     1680, 1683,   71, 1678, 1667,   71, 1673,   71, 1684, 1674,
-     1686, 1685, 1688, 1687,   71, 2912, 1676, 1690, 1677, 1692,
-       71,   71, 1699,   71, 1681,   71, 1682, 1680, 1683,   71,
-       71, 1694,   71, 1689, 1691, 1684, 1693, 1686, 1685,   71,
-     1687,   71,   71, 1702, 1690, 1697,   71, 1695, 1698,   71,
-     1696,   71, 1700,   71,   71,   71, 1703, 1701, 1694, 1705,
-     1689, 1691,   71, 1693,   71,   71,   71,   71, 1704, 1706,
-     1702, 1707, 1697, 1708, 1695, 1698, 1709, 1696, 2912, 1700,
-     1712, 1711, 1710,   71, 1701, 1714,   71, 1713, 2912,   71,
-
-       71,   71,   71, 1715,   71, 1704, 1706,   71, 1707, 1717,
-     1718, 1716,   71,   71,   71,   71,   71, 1712, 1711, 1710,
-       71, 1720, 1714, 1721, 1713, 1719, 1722, 1724,   71, 1725,
-     1715,   71, 1726,   71,   71, 1727, 1717, 1718, 1716, 1723,
-       71,   71, 1735, 1728,   71,   71, 1730, 1729, 1720,   71,
-     1721, 1731, 1719, 1722, 1724,   71, 1725,   71,   71,   71,
-     1732, 1736, 1733, 1737, 1734, 1738, 1723,   71,   71, 1735,
-     1728, 1739,   71, 1730, 1729,   71, 1740, 1741, 1731, 1743,
-     1742, 1745, 1744,   71, 1746,   71,   71, 1732,   71, 1733,
-       71, 1734, 1738, 1747, 1749, 1750, 1751,   71,   71, 1754,
-
-     1752, 1748,   71, 1740, 1741,   71,   71, 1742,   71, 1744,
-       71, 1746, 1753,   71, 1755, 1756, 1757, 1759, 1761, 2912,
-       71, 1758, 1750, 1751,   71,   71,   71,   71, 1748,   71,
-     1760,   71, 1765, 1762, 1769, 1768, 1766,   71,   71, 1753,
-       71, 1755, 1756, 1757, 1759,   71, 1763,   71, 1758, 1767,
-       71, 1764, 1770, 1773, 1774,   71, 1775, 1760, 1778, 1765,
-     1762,   71, 1768, 1766, 1771,   71,   71, 1772, 1776, 1777,
-       71,   71, 1779,   71,   71,   71, 1767, 1781,   71, 1770,
-       71, 1774,   71, 1775,   71, 1778, 1780, 1782, 1783,   71,
-     1784, 1771, 1785,   71, 1772, 1776, 1777, 1786,   71,   71,
-
-     1787, 1788, 2912, 1790,   71, 1793,   71,   71,   71, 1789,
-     1792,   71, 1797, 1780, 1782, 1783, 1791, 1784, 1796, 1785,
-     1800,   71, 1795,   71, 1794,   71, 1799,   71, 1788,   71,
-     1790,   71, 1793,   71,   71, 1798, 1789, 1792, 1801, 1802,
-       71, 1803,   71, 1791,   71, 1796,   71, 1804, 1805, 1795,
-     1806, 1794,   71, 1799, 1807,   71, 1808, 1812,   71, 1810,
-       71, 1811, 1798,   71, 1809,   71,   71, 1814, 1803,   71,
-       71, 1813, 2912,   71, 1804, 1805, 1815, 1806,   71,   71,
-       71, 1807, 1821, 1808, 1819, 1818, 1810,   71, 1811,   71,
-     1817, 1809, 1816,   71, 1814, 1822,   71,   71, 1813,   71,
-
-     1820, 1824, 1823, 1815, 1828,   71, 1831, 1825,   71, 1821,
-     1826, 1819, 1818, 1832,   71, 1827,   71, 1817, 1829, 1816,
-       71, 1835, 1822, 1830,   71, 1833,   71, 1820,   71, 1823,
-       71,   71,   71, 1831, 1825,   71,   71, 1826, 1837, 1834,
-     1832, 1838, 1827, 1836, 1840, 1829,   71, 1839, 1845, 1846,
-     1830, 1841, 1833,   71, 1847,   71, 1842, 1844, 1849, 1848,
-       71, 1843, 1850, 1854,   71, 1837, 1834,   71,   71,   71,
-     1836, 1840,   71,   71, 1839,   71,   71, 1852, 1841, 1851,
-       71, 1853, 1855, 1842, 1844, 1857,   71, 1856, 1843, 1858,
-       71,   71, 1859, 1860,   71,   71,   71,   71,   71,   71,
-
-       71, 1861, 1862, 1863, 1852, 1864, 1851, 1866, 1853, 1855,
-       71, 1868, 1857,   71, 1856, 1865, 1858,   71,   71, 1867,
-     1860, 1869, 1871, 1872,   71, 1873, 1883, 2912, 1870, 1862,
-     1863,   71, 1864,   71, 1866,   71, 1874,   71,   71, 1876,
-     1875, 1877, 1865, 1879,   71,   71, 1867,   71,   71, 1878,
-     1872, 1882, 1873,   71,   71, 1870, 1880,   71,   71, 1881,
-     1885,   71, 1884, 1874,   71,   71, 1876, 1875, 1877,   71,
-     1879,   71, 1886,   71,   71, 1887, 1878, 1888, 1882, 1889,
-       71, 1890,   71, 1880,   71, 1891, 1881, 1885, 1892, 1884,
-       71, 1893, 1894,   71,   71, 1900, 1895,   71, 1898, 1886,
-
-     2912, 1899,   71, 1896, 1888, 1902, 1889,   71, 1890,   71,
-     1906,   71, 1891,   71, 1897, 1892, 1901, 1904, 1893,   71,
-       71,   71, 1900, 1895,   71, 1898, 1905, 1903, 1899,   71,
-     1896, 1907, 1902,   71,   71, 1908, 1909,   71, 1910,   71,
-       71, 1897, 1912, 1901, 1904, 1914,   71,   71, 1911, 1913,
-       71, 1916, 1915, 1905, 1903,   71, 2912, 2912, 1907,   71,
-     1918,   71, 1908, 1909, 1917, 1910, 1919, 2912, 1920, 2912,
-     1921,   71, 1914,   71,   71, 1911, 1913,   71,   71, 1915,
-       71, 1923, 1932,   71, 1922, 1924, 1925, 1918,   71, 1928,
-       71, 1917, 1927, 1919,   71, 1920,   71, 1921, 1926,   71,
-
-       71,   71, 1929, 1931,   71, 1936, 1933, 1930, 1923,   71,
-       71, 1922, 1924, 1925,   71,   71, 1928, 1934,   71, 1927,
-     1938, 1935, 1940, 1942,   71, 1926, 1939,   71, 1937, 1929,
-     1931,   71, 1936, 1933, 1930,   71, 1941, 1944, 1943, 1945,
-     2912, 1951,   71,   71, 1934,   71,   71, 1938, 1935, 1940,
-     1942,   71, 1946, 1939, 1948, 1937,   71,   71,   71, 1947,
-     1949, 1950,   71, 1941, 1944, 1943, 1945,   71,   71, 1952,
-       71, 1953, 1954, 1955,   71, 2912, 1958, 2912, 1959, 1946,
-     1956, 1948, 1957,   71,   71,   71, 1947, 1949, 1950, 1960,
-     1961,   71, 1964,   71, 1962,   71, 1952,   71, 1953, 1954,
-
-     1955, 1965,   71, 1958,   71,   71, 1963, 1956, 1966, 1957,
-       71,   71, 1967,   71,   71, 1968, 1960, 1961, 1969, 1964,
-     2912, 1962,   71, 2912,   71, 1970, 1971, 1974,   71, 1972,
-     1975, 2912, 1976, 1963,   71, 1966, 1977, 1973, 2912, 1967,
-     1982, 2912, 1968, 1978, 1981,   71,   71,   71,   71, 2022,
-       71,   71, 1970, 1971,   71, 1983, 1972, 1975,   71, 1976,
-     1984,   71,   71, 1977, 1973, 1979, 1985, 1982, 1980,   71,
-     1978, 1981, 1988, 1986, 1987, 1989, 1990, 1993, 1991, 2912,
-     1992,   71, 1994,   71,   71,   71, 2023,   71,   71,   71,
-       71,   71, 1979, 1985,   71, 1980, 2912,   71,   71, 1988,
-
-     1986, 1987, 1989, 1990,   71, 1991, 1995, 1992, 1996, 1994,
-     1997, 1999, 1998, 2000, 2001,   71, 2004, 2912,   71,   71,
-     2002,   71, 2003,   71,   71, 2007,   71, 2008,   71, 2013,
-     2912,   71, 2005, 1995,   71, 1996, 2009, 1997, 1999, 1998,
-     2000, 2001,   71, 2004,   71, 2006,   71, 2002,   71, 2003,
-     2012, 2010, 2007,   71, 2008, 2011,   71,   71, 2014, 2005,
-       71, 2015, 2016, 2009, 2017, 2019, 2912, 2025,   71, 2020,
-       71, 2018, 2006, 2024, 2021, 2027,   71, 2012, 2010,   71,
-     2036, 2028, 2011, 2026, 2032, 2014,   71,   71,   71, 2016,
-       71, 2017, 2019,   71, 2025, 2029, 2031,   71, 2018, 2033,
-
-     2024,   71,   71, 2034, 2035, 2037, 2030,   71, 2028, 2038,
-     2026,   71,   71,   71,   71, 2039, 2040, 2041,   71, 2052,
-     2912, 2042, 2029, 2031, 2044,   71, 2033,   71, 2046, 2912,
-     2034, 2035, 2037, 2030, 2043,   71, 2038, 2045,   71,   71,
-     2049,   71,   71, 2040,   71, 2048,   71,   71, 2042,   71,
-       71, 2044, 2047, 2053, 2050, 2046,   71,   71, 2051, 2054,
-     2055, 2043,   71,   71, 2045, 2056,   71, 2049, 2057,   71,
-     2058,   71, 2048, 2062, 2059, 2060,   71, 2912,   71, 2047,
-     2053, 2050,   71,   71, 2061, 2051, 2054, 2055, 2063,   71,
-     2064, 2065, 2056,   71, 2070, 2057,   71, 2058,   71,   71,
-
-       71, 2059, 2060, 2067, 2066, 2068,   71,   71,   71,   71,
-     2069, 2061, 2072,   71, 2071, 2063,   71, 2064, 2065, 2073,
-       71, 2070, 2075, 2074,   71, 2076, 2077, 2912, 2078, 2079,
-     2067, 2066, 2068, 2080, 2082, 2912,   71, 2069,   71, 2072,
-       71, 2071, 2083, 2086, 2087, 2081,   71,   71,   71, 2075,
-     2074, 2088, 2076, 2077,   71, 2078,   71,   71, 2089, 2084,
-       71, 2082, 2085, 2092, 2091,   71,   71, 2090,   71, 2083,
-       71, 2087, 2081,   71,   71, 2093, 2094,   71, 2088,   71,
-     2095, 2097, 2099, 2096,   71, 2089, 2084, 2098, 2100, 2085,
-       71, 2091,   71, 2101, 2090, 2103, 2912, 2912, 2102,   71,
-
-     2107, 2106,   71, 2094,   71, 2104, 2109,   71,   71, 2099,
-     2096,   71, 2112,   71, 2098,   71, 2105, 2110,   71, 2111,
-       71, 2108, 2103,   71,   71, 2102,   71,   71, 2106,   71,
-     2113, 2115, 2104,   71, 2116, 2117,   71, 2119, 2124, 2112,
-       71, 2118,   71, 2105, 2110, 2114, 2111,   71, 2108,   71,
-     2121, 2122, 2120, 2123,   71, 2126,   71, 2113,   71,   71,
-     2128, 2116, 2117,   71,   71,   71, 2125,   71, 2118, 2127,
-     2134, 2130, 2114, 2131,   71, 2133,   71, 2121, 2122, 2120,
-     2123,   71, 2126, 2129, 2132,   71,   71,   71,   71, 2135,
-       71,   71, 2136, 2125, 2137, 2138, 2127, 2134, 2130,   71,
-
-     2131,   71, 2133, 2139, 2140, 2143,   71, 2142, 2147,   71,
-     2129, 2132, 2141,   71,   71, 2145, 2135,   71, 2146, 2136,
-       71, 2137, 2138, 2144,   71,   71,   71,   71, 2148, 2150,
-     2139, 2140, 2143, 2912, 2142, 2147, 2151,   71, 2149, 2141,
-       71, 2912, 2145, 2154,   71, 2146, 2152, 2153, 2155,   71,
-     2144, 2156, 2161, 2157, 2160, 2162, 2163,   71,   71, 2158,
-       71,   71, 2166, 2151, 2159, 2149, 2167,   71,   71,   71,
-     2154,   71,   71, 2152, 2153, 2155, 2165,   71, 2156,   71,
-     2157, 2160,   71, 2163,   71, 2164, 2158,   71,   71, 2166,
-     2174, 2159,   71, 2168,   71, 2170, 2172, 2171,   71, 2173,
-
-     2176, 2169,   71, 2165, 2175, 2912, 2177,   71, 2181, 2912,
-       71, 2912, 2164, 2185, 2178, 2912,   71,   71,   71,   71,
-     2168,   71, 2170, 2172, 2171,   71, 2173, 2176, 2169, 2180,
-     2179, 2175,   71, 2177, 2184, 2181, 2182, 2187, 2183, 2192,
-       71, 2178,   71, 2186,   71,   71, 2189, 2188, 2190,   71,
-     2191, 2194, 2912, 2912, 2193, 2912, 2180, 2179,   71, 2196,
-     2195, 2184, 2198, 2182,   71, 2183,   71,   71,   71,   71,
-     2186,   71,   71, 2189, 2188,   71, 2197,   71, 2194, 2199,
-       71, 2193,   71, 2200,   71, 2201, 2196, 2195,   71, 2198,
-     2203, 2202, 2204, 2205, 2206, 2207, 2912, 2209, 2210,   71,
-
-     2215, 2208,   71, 2197,   71,   71, 2199,   71,   71,   71,
-     2200, 2212,   71,   71, 2211, 2214,   71, 2203, 2202, 2204,
-     2205,   71, 2207,   71, 2209, 2210, 2213,   71, 2208, 2216,
-     2217, 2912,   71,   71,   71, 2218, 2219,   71, 2212,   71,
-     2220, 2211, 2214, 2222, 2226,   71,   71, 2221, 2223, 2225,
-       71, 2224, 2229, 2213, 2227, 2912, 2216, 2217,   71, 2228,
-     2231,   71, 2218, 2219, 2230, 2232,   71, 2233,   71, 2912,
-     2222, 2226,   71,   71, 2221, 2223, 2225,   71, 2224,   71,
-       71, 2227,   71,   71,   71, 2235, 2228,   71, 2234, 2236,
-     2912, 2230, 2232, 2241,   71, 2237, 2239,   71,   71, 2240,
-
-       71, 2238,   71, 2242, 2243, 2244, 2246, 2247, 2245, 2252,
-     2912,   71, 2235, 2250, 2912, 2234, 2236,   71,   71,   71,
-       71,   71, 2237, 2239, 2249, 2251, 2240, 2912, 2238,   71,
-       71,   71, 2244, 2246, 2247, 2245,   71, 2248, 2253,   71,
-       71,   71, 2254,   71, 2255,   71, 2257,   71, 2256, 2912,
-     2258, 2249, 2251, 2259,   71,   71,   71, 2260, 2262, 2261,
-     2265, 2263, 2267, 2912, 2248, 2253, 2268,   71, 2266, 2254,
-     2269,   71, 2270, 2257,   71, 2256,   71, 2258, 2264,   71,
-       71,   71, 2273,   71, 2260, 2262, 2261, 2265, 2263,   71,
-       71,   71, 2271,   71, 2272, 2266, 2274,   71, 2275,   71,
-
-     2276, 2277, 2912,   71,   71, 2264, 2278,   71, 2280, 2273,
-     2282, 2283, 2281,   71, 2284,   71,   71, 2285, 2279, 2271,
-       71, 2272,   71, 2274,   71, 2275, 2286, 2276, 2277,   71,
-       71, 2292,   71, 2278, 2287,   71, 2288,   71,   71, 2281,
-     2289, 2284, 2293,   71, 2285, 2279,   71, 2290, 2291,   71,
-     2294,   71, 2295, 2286,   71,   71, 2296, 2912,   71,   71,
-       71, 2287,   71, 2288, 2299, 2297, 2301, 2289,   71, 2293,
-       71, 2298, 2303, 2302, 2290, 2291, 2300, 2294,   71, 2295,
-     2306,   71, 2304, 2296,   71,   71, 2308,   71, 2309, 2307,
-       71, 2299, 2297, 2301,   71, 2310, 2311, 2305, 2298, 2303,
-
-     2302,   71,   71, 2300,   71, 2312, 2912, 2306,   71, 2304,
-       71, 2313, 2315, 2308, 2314, 2309, 2307, 2316, 2317, 2319,
-     2318,   71,   71,   71, 2305, 2320,   71,   71,   71, 2321,
-       71,   71, 2312,   71, 2324, 2322,   71,   71, 2313, 2315,
-       71, 2314, 2323,   71, 2316, 2317, 2319, 2318, 2325,   71,
-     2326, 2329, 2320,   71, 2327, 2328, 2321, 2331, 2330,   71,
-     2334, 2324, 2322, 2332, 2342, 2340, 2912, 2341, 2912, 2323,
-     2333, 2335,   71,   71,   71, 2325,   71,   71,   71,   71,
-       71, 2327, 2328,   71,   71, 2330, 2336, 2334, 2338, 2912,
-     2332, 2337,   71, 2339,   71,   71,   71, 2333, 2335,   71,
-
-       71,   71, 2343, 2346, 2344, 2347, 2345, 2912, 2351, 2350,
-     2348,   71,   71, 2336,   71, 2338,   71,   71, 2337, 2349,
-     2339, 2353, 2352, 2912, 2912,   71, 2355, 2912, 2912, 2343,
-     2346, 2344, 2347, 2345,   71,   71, 2350, 2348, 2358, 2357,
-     2359,   71, 2354, 2356,   71,   71, 2349,   71,   71, 2352,
-       71,   71, 2360, 2355,   71, 2361, 2363, 2362, 2364,   71,
-     2365, 2367,   71,   71,   71, 2358, 2357, 2359, 2366, 2354,
-     2356, 2368,   71, 2370, 2369, 2371, 2372,   71, 2375, 2360,
-       71, 2377, 2361, 2363, 2362,   71,   71, 2365,   71, 2379,
-       71, 2376, 2373, 2382,   71, 2366,   71, 2374, 2368,   71,
-
-     2370, 2369,   71, 2372,   71,   71,   71, 2378,   71, 2380,
-     2381, 2912, 2383, 2385, 2386,   71,   71, 2384, 2376, 2373,
-       71, 2387,   71, 2390, 2374,   71, 2392, 2388,   71, 2389,
-     2391,   71, 2912, 2393, 2378,   71, 2380, 2381,   71, 2383,
-       71, 2386,   71, 2394, 2384,   71, 2395,   71, 2387, 2396,
-       71, 2912, 2401,   71, 2388,   71, 2389, 2391, 2397,   71,
-     2393, 2398, 2399, 2400,   71,   71, 2404, 2912, 2405,   71,
-     2394,   71, 2402, 2395, 2403, 2406, 2396,   71,   71, 2401,
-       71, 2411,   71, 2407, 2408, 2397, 2912, 2412, 2398, 2399,
-     2400, 2409, 2414, 2404,   71,   71,   71, 2413, 2410, 2402,
-
-       71, 2403,   71,   71,   71, 2415,   71,   71, 2416,   71,
-     2407, 2408, 2417,   71, 2412, 2418, 2419, 2420, 2409, 2414,
-     2428, 2421, 2425,   71, 2413, 2410, 2422,   71, 2423,   71,
-     2424, 2912, 2415, 2426, 2429,   71, 2427, 2912,   71,   71,
-     2430,   71, 2418,   71, 2420, 2434,   71, 2428, 2431, 2432,
-       71, 2433,   71,   71,   71, 2423,   71, 2424,   71,   71,
-     2426, 2429, 2435, 2427,   71, 2436, 2437, 2430, 2439,   71,
-       71, 2438, 2434,   71, 2442, 2431, 2432,   71, 2433, 2440,
-       71, 2441,   71, 2444, 2443, 2447, 2446,   71,   71, 2435,
-     2912,   71, 2436, 2437,   71, 2439, 2445,   71, 2438,   71,
-
-       71, 2442,   71,   71, 2449, 2450, 2440, 2448, 2441, 2451,
-     2444, 2443,   71, 2446, 2453,   71, 2452,   71, 2454, 2455,
-     2456, 2458,   71, 2445,   71,   71,   71, 2457, 2459,   71,
-     2460, 2449, 2450, 2912, 2448, 2912,   71, 2461, 2462, 2463,
-     2464, 2453,   71, 2452, 2912, 2454, 2455,   71, 2466, 2465,
-     2912, 2469, 2470,   71, 2457, 2467, 2471,   71,   71, 2472,
-       71,   71,   71,   71,   71, 2462, 2463, 2464,   71, 2468,
-     2473,   71, 2478, 2474, 2479, 2466, 2465,   71, 2469,   71,
-       71,   71, 2467,   71, 2475, 2477,   71, 2480, 2912, 2476,
-     2482, 2481,   71, 2483, 2485, 2487, 2468,   71,   71, 2478,
-
-     2474,   71,   71, 2484,   71, 2486, 2489, 2488, 2493, 2490,
-       71, 2492, 2477, 2502,   71,   71,   71, 2482, 2481,   71,
-     2483,   71,   71,   71,   71, 2494, 2491, 2495, 2501, 2912,
-     2484,   71, 2486,   71, 2488,   71, 2490, 2496, 2492, 2498,
-       71, 2499, 2497,   71, 2500,   71, 2505, 2504,   71,   71,
-       71,   71,   71, 2491, 2495, 2501, 2503, 2506,   71, 2507,
-     2509, 2508,   71, 2912, 2912, 2510, 2498, 2912, 2499,   71,
-       71, 2500, 2513,   71, 2504, 2517, 2912, 2519,   71,   71,
-     2511, 2512, 2514, 2503, 2506,   71, 2507, 2509, 2508,   71,
-       71,   71, 2510, 2515,   71, 2518,   71, 2516, 2523, 2513,
-
-       71, 2520,   71,   71, 2519, 2522, 2521, 2511, 2512, 2514,
-       71, 2524, 2528,   71, 2525, 2912, 2526, 2912, 2527, 2535,
-     2515, 2912, 2518,   71, 2516,   71, 2529, 2530, 2531,   71,
-     2912, 2532, 2522,   71,   71, 2538, 2536,   71, 2524, 2528,
-       71, 2525,   71, 2526,   71, 2527,   71, 2537,   71,   71,
-     2533, 2539, 2534, 2529, 2530, 2531,   71,   71, 2532,   71,
-       71, 2540,   71, 2536, 2541, 2542, 2543, 2544, 2547, 2545,
-     2912,   71, 2546, 2912, 2537, 2548, 2912, 2533, 2539, 2534,
-     2555,   71, 2549, 2553,   71,   71,   71,   71,   71, 2550,
-     2912, 2541,   71, 2543, 2544,   71, 2545,   71,   71, 2546,
-
-       71,   71, 2548, 2551, 2554, 2556, 2557,   71, 2552, 2549,
-     2553, 2558, 2560, 2559,   71,   71, 2550, 2562, 2561, 2563,
-     2565, 2564,   71, 2912,   71,   71,   71,   71, 2566, 2569,
-       71, 2554, 2556, 2557,   71,   71, 2567, 2572, 2558, 2560,
-     2559, 2568,   71, 2573, 2574, 2561, 2563, 2565, 2564,   71,
-       71,   71, 2578, 2912, 2570, 2566, 2569, 2571, 2575,   71,
-     2576, 2577,   71, 2567,   71, 2579, 2582,   71, 2568,   71,
-       71,   71, 2580, 2581,   71, 2587,   71, 2583, 2589, 2578,
-       71, 2570, 2586, 2584, 2571, 2575,   71, 2576, 2577,   71,
-     2585,   71, 2593,   71,   71,   71, 2588,   71,   71, 2580,
-
-     2581, 2591, 2594, 2590, 2583,   71, 2595,   71, 2592, 2586,
-     2584,   71,   71,   71, 2596,   71,   71, 2585, 2597,   71,
-       71, 2598, 2601, 2588, 2600, 2603, 2599, 2605, 2591, 2594,
-     2590, 2606,   71, 2595,   71, 2592,   71,   71, 2602,   71,
-     2607, 2596, 2604,   71,   71, 2597,   71, 2608, 2598, 2601,
-       71, 2600,   71, 2599,   71, 2609, 2612, 2610,   71, 2611,
-     2613, 2912, 2617, 2912, 2614, 2602,   71, 2607,   71, 2604,
-       71,   71, 2615, 2616,   71, 2619,   71, 2618,   71, 2621,
-     2620,   71, 2609, 2612, 2610,   71, 2611,   71,   71, 2617,
-       71, 2614, 2622, 2624, 2623, 2626, 2627,   71, 2628, 2615,
-
-     2616,   71, 2619, 2629, 2618,   71,   71, 2620, 2912, 2630,
-     2633,   71, 2625, 2631,   71, 2638, 2639,   71, 2634,   71,
-       71, 2623, 2626, 2627, 2632, 2628, 2635, 2637,   71, 2636,
-     2641,   71, 2642, 2640,   71,   71, 2630,   71, 2912, 2625,
-     2631,   71,   71,   71,   71, 2634, 2643,   71, 2644, 2646,
-     2645, 2632,   71, 2635, 2637, 2649, 2636,   71,   71, 2642,
-     2640, 2650,   71, 2651, 2647, 2648, 2652, 2653,   71, 2654,
-       71,   71, 2656, 2643,   71, 2644, 2655, 2645, 2657, 2658,
-     2659,   71,   71, 2660,   71,   71, 2661, 2662,   71, 2663,
-     2651, 2647, 2648, 2652,   71, 2667,   71,   71,   71, 2656,
-
-       71, 2668, 2672, 2655, 2664, 2657,   71,   71,   71,   71,
-       71, 2669, 2665, 2661,   71, 2666, 2663,   71, 2670, 2671,
-       71,   71, 2667, 2675,   71,   71, 2673, 2674,   71,   71,
-     2676, 2664, 2679, 2677,   71, 2678, 2680,   71, 2669, 2665,
-     2681, 2682, 2666, 2683, 2912, 2670, 2671, 2912,   71,   71,
-       71,   71, 2686, 2673, 2674,   71, 2687,   71, 2689,   71,
-     2677, 2688, 2678, 2680,   71,   71, 2684, 2681,   71, 2685,
-     2683,   71, 2690,   71,   71, 2694,   71,   71, 2698, 2686,
-       71, 2693,   71, 2687, 2691, 2689,   71, 2692, 2688, 2697,
-       71,   71, 2700, 2684,   71,   71, 2685, 2695, 2696, 2690,
-
-       71, 2701, 2694, 2699, 2702, 2698,   71,   71, 2693, 2703,
-       71, 2691, 2704, 2705, 2692, 2712, 2697, 2706, 2707, 2700,
-     2708, 2709, 2710, 2711, 2695, 2696, 2713, 2717,   71, 2720,
-     2699,   71,   71, 2716, 2714, 2715, 2703, 2719,   71,   71,
-       71, 2721, 2712,   71, 2726, 2718,   71,   71,   71,   71,
-     2725,   71,   71,   71,   71,   71, 2720,   71, 2722,   71,
-     2716, 2714, 2715, 2724, 2719, 2723, 2727, 2728, 2721, 2729,
-       71,   71, 2718, 2732,   71, 2736,   71, 2725, 2733,   71,
-     2730,   71, 2734, 2731, 2735, 2722,   71,   71, 2741, 2737,
-     2724,   71, 2723,   71, 2728,   71, 2729, 2738,   71, 2739,
-
-     2740, 2742, 2736, 2743, 2744,   71, 2745, 2730,   71, 2746,
-     2731, 2735, 2747, 2748,   71,   71, 2737, 2749, 2750,   71,
-     2751,   71, 2752,   71, 2738, 2753, 2739, 2740, 2742, 2754,
-       71,   71,   71,   71, 2755, 2758,   71,   71,   71,   71,
-       71, 2756, 2760, 2757,   71,   71, 2759, 2751, 2761,   71,
-       71, 2762, 2753,   71,   71, 2763, 2754,   71, 2764,   71,
-       71,   71, 2758, 2765, 2767, 2766, 2768, 2769, 2756, 2760,
-     2757, 2912,   71, 2759,   71,   71, 2771, 2770, 2762,   71,
-       71, 2774, 2763, 2776,   71, 2764, 2772, 2775,   71,   71,
-     2765, 2767, 2766,   71, 2769,   71, 2773, 2777,   71,   71,
-
-     2779, 2778, 2780, 2771, 2770,   71, 2782,   71, 2774, 2781,
-       71,   71, 2785, 2772, 2775, 2784,   71, 2783,   71,   71,
-     2786,   71, 2788, 2773,   71,   71, 2787, 2779, 2778, 2780,
-     2912,   71, 2789, 2782,   71, 2790, 2781, 2799,   71, 2785,
-     2792, 2791, 2784,   71, 2783,   71,   71, 2786,   71, 2788,
-       71,   71, 2793, 2787,   71, 2795, 2796, 2794, 2797, 2789,
-     2800,   71, 2790,   71,   71, 2798, 2801, 2792, 2791,   71,
-     2802,   71,   71, 2803, 2804, 2807, 2912, 2812,   71, 2793,
-     2805, 2808, 2795, 2796, 2794, 2797, 2815, 2800,   71, 2809,
-     2912, 2806, 2798,   71, 2817, 2912,   71, 2802,   71,   71,
-
-       71,   71, 2807,   71, 2810, 2811,   71, 2805, 2808,   71,
-     2813,   71, 2814,   71, 2816, 2818, 2809,   71, 2806,   71,
-     2819,   71,   71,   71, 2820, 2912, 2821,   71, 2823,   71,
-     2822, 2810, 2811, 2824, 2825, 2826,   71, 2813, 2912, 2814,
-     2827, 2816, 2818, 2829, 2912, 2832, 2831, 2819,   71,   71,
-     2828,   71,   71, 2821,   71, 2823, 2830, 2822,   71,   71,
-     2834, 2835, 2826,   71, 2833,   71,   71, 2827,   71,   71,
-       71,   71, 2832, 2831, 2839, 2836, 2837, 2828, 2838, 2912,
-     2843, 2845,   71, 2830, 2840, 2841,   71, 2834, 2835,   71,
-       71, 2833, 2842, 2844,   71, 2846,   71, 2851, 2853, 2912,
-
-       71, 2839, 2836, 2837, 2847, 2838,   71,   71, 2848, 2850,
-     2849, 2840, 2841,   71, 2859,   71, 2852,   71, 2854, 2842,
-     2844,   71, 2846, 2912, 2856,   71,   71, 2862, 2863,   71,
-       71, 2847,   71, 2912, 2855, 2848, 2850, 2849,   71, 2857,
-     2858,   71,   71, 2852,   71, 2854,   71,   71,   71, 2860,
-     2861, 2856, 2867,   71, 2862,   71, 2864,   71, 2866, 2865,
-       71, 2855, 2868, 2881,   71, 2870, 2857, 2858, 2869, 2912,
-       71, 2871, 2912, 2872,   71, 2874, 2860, 2861, 2876, 2867,
-       71, 2878,   71, 2864, 2877, 2866, 2865,   71, 2883, 2868,
-       71,   71, 2870,   71, 2879, 2869, 2873,   71, 2871, 2875,
-
-     2872,   71, 2874,   71,   71, 2876, 2882,   71, 2878, 2880,
-       71, 2877, 2884,   71,   71, 2883, 2887,   71, 2885, 2888,
-     2886, 2879, 2889, 2873,   71, 2890, 2875, 2891,   71, 2892,
-       71, 2893, 2897, 2882, 2894,   71, 2880, 2901,   71,   71,
-       71,   71,   71, 2887, 2896, 2885, 2888, 2886, 2900, 2889,
-     2903,   71,   71,   71, 2891, 2895, 2892, 2898, 2893,   71,
-     2899, 2894, 2904,   71,   71,   71, 2902, 2910,   71, 2906,
-       71, 2896, 2905, 2907,   71, 2900, 2911,   71, 2912, 2912,
-     2908, 2912, 2895, 2912, 2898, 2912,   71, 2899,   71,   71,
-     2909,   71,   71, 2902,   71,   71, 2906, 2912,   71, 2905,
-
-     2907, 2912, 2912,   71, 2912, 2912, 2912, 2908, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2909,   43,   43,
-       43,   43,   43,   43,   43,   48,   48,   48,   48,   48,
-       48,   48,   53,   53,   53,   53,   53,   53,   53,   59,
-       59,   59,   59,   59,   59,   59,   64,   64,   64,   64,
-       64,   64,   64,   74,   74, 2912,   74,   74,   74,   74,
-      140,  140, 2912, 2912, 2912,  140,  140,  142,  142, 2912,
-     2912,  142, 2912,  142,  144, 2912, 2912, 2912, 2912, 2912,
-      144,  147,  147, 2912, 2912, 2912,  147,  147,  149, 2912,
-     2912, 2912, 2912, 2912,  149,  151,  151, 2912,  151,  151,
-
-      151,  151,   75,   75, 2912,   75,   75,   75,   75,   13,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912
+      143,   71,   68,  143,  103,   83,   71,   94,   68,  147,
+       71,  146,   84,  148,  148,   96,   85,  141,  141,   86,
+       69,   95,  112,   97,  118,  155,   69,  144,  156,   68,
+      105,   71,   83,  375,  160,   68,   77,   78,  106,   84,
+       79,   71,   96,   85,  107,   80,   86,  140,  108,   71,
+
+       97,   71,  155,  154,   81,  156,   71,  105,   71,   71,
+       71,  160,   71,   77,   78,  106,  151,   79,  157,  142,
+      159,  107,   80,   98,  140,  108,   99,   71,  158, 1290,
+      154,   81,   87,  100,  143,  101,   88,  143,   71,   89,
+       71,   90,   91,   71,  109,  157,   71,  159,  110,  224,
+       98,  202,  163,   99,   71,  158,  129,   71,  130,   87,
+      100,   71,  101,   88,  111,   71,   89,  131,   90,   91,
+       71,  109,  137,  132,  133,  110,  138,  164,  202,  163,
+      139,   71,   71,  129,  134,  130,  218,   71,  135,  136,
+     1042,  111,  113,  165,  131,   71,  114,   71,   71,  137,
+
+      132,  133,  115,  138,  164,  116,   71,  139,  169,  170,
+      172,  134,  117,  218,   71,  135,  136,   71,   71,  113,
+      165,   71,   70,  114,   70,   70,  171,   70,  246,  115,
+      151,   71,  116,   70,  149,  169,  170,  172,  161,  117,
+      119,  182,  247,  145,  120,  145,  145,  150,  145,  150,
+      150,  162,  150,  171,  121,  122,   75,  123,   75,   75,
+       71,   75,   71,  147,   71,  161,   71,  119,  182,  247,
+      180,  120,   70,  173,   70,   70,  146,   70,  162,   71,
+      144,  121,  122,   70,  123,  124,  200,   75,  125,   75,
+       75,  174,   75,  175,  153,  126,  166,  180,   75,  127,
+
+      128,  176,  167,  184,  168,   71,   71,   71,   71,   71,
+      181,  189,  124,  200,  183,  125,   71,   71,  174,   71,
+      175,  142,  126,  166,  313,   76,  127,  128,  176,  167,
+      184,  168,  177,  178,  199,  190,   71,  181,  191,  185,
+      179,  183,  186,   71,  197,   71,   71,   71,   71,  198,
+      192,  313,   71,  201,  194,  187,  188,   71,  195,  177,
+      178,  199,  190,   71,  203,  191,  185,  179,  346,  186,
+      193,  197,   71,   71,  196,  204,  198,  192,   71,  205,
+      201,  194,  187,  188,   71,  195,   71,  206,  207,   71,
+      208,  203,  212,  211,  209,   71,   71,  193,  210,   71,
+
+       71,  196,  204,  213,  148,  148,  205, 2985, 2985, 2985,
+       71,   71,  217,  214,  206,  207,   71,  208,   71,  212,
+      211,  209,  215,  219,   71,  210,  225,  220,  216,  223,
+      213,   71,  145, 2985,  145,  145,   71,  145,  221,  217,
+      214,   71,  222,   71,  226, 2985,  229,  231,  234,  215,
+      219,   71,  232,  225,  220,  216,  223,  230,   71,   71,
+       71,  227,  233,  238,  228,  221,   71,  240,   71,  222,
+       71,  226,  235,  229,  231,  234,  239,  241,   71,  232,
+      242,  236,   71,  243,  230, 2985,   71, 2985,  227,  233,
+      238,  228, 2985,  237,  240,  244,   71,   71,   71,  235,
+
+     2985,  245,   71,  239,  241,  253,  264,  242,  236,  150,
+      243,  150,  150,   75,  150,   75,   75,  248,   75,  151,
+      237,  249,  244,   71,   71,  252,   71,  250,  245,  254,
+      255,  256,  253,   71,  251, 2985,  257,   71,   71,  259,
+      263,   71,   71,   71,  248,  260,   71,  258,  249,  273,
+     1170,  153,  252,   71,  250,  262,  254,  255,  256,  275,
+      261,  251,   71,  257,  265,   71,   71,  263,  266,  276,
+      274,   71,  260,  277,  258,   71,  273,   71,   71,  279,
+       71,   71,  262,  278, 2985,  267,  275,  261,   71, 2985,
+       71,   71,   71,  281, 2985,  266,  276,  274, 2985,  282,
+
+      277,  283, 2985,  297, 2985,  284,  287,  280, 2985, 2985,
+      278,   71,  267,  268,   71,   71,   71,   71,  269,  288,
+      281,   71,  285,  270, 2985,  286,  282, 2985,  283,  271,
+      272,  289,  284,  287,  280,   71,   71,   71,  294, 2985,
+      268,   71,  290,  296,  295,  269,  288,  291,  301,  285,
+      270,   71,  286,   71,   71,  298,  271,  272,  289,  292,
+       71,  293,  299,  303,  304,  294,  307, 2985,   71,  290,
+      296,  295,  302,  300,  291,  308,  309,  306,  305,   71,
+       71,   71,  298,   71,  310, 2985,  292,  311,  293, 2985,
+      315, 2985,  312,  317,   71,   71,   71,   71,   71,  302,
+
+      300,  318,  308,  314,  306,  305,   71,   71,   71,  319,
+       71,   71,   71,  316,  311,   71,   71,  315,   71,  312,
+      317,  320,  321,  326,  322,  323,  330,  333,  318, 2985,
+      314,   71,   71,  324,   71,   71,  319,  327,  325,   71,
+      316,  338,  329,  328,  339,   71,   71,   71,  320,  321,
+      326,  322,  323,  331,  332,  335,  334,  340,   71,   71,
+      336,   71,   71,   71,  327,   71,   71,  337,  338,  329,
+      328,  341,  342,  343,  347,   71,   71,   71,  344,   71,
+      331,  332,  335,  334,  345,   71,  349,  336,   71,   71,
+      350,   71,  352,  354,  337,  355,   71,  348,  341,  353,
+
+      343,  360, 2985,   71,   71,  344,   71,  351,  151,  356,
+       71,  345,  361,  358,  364,   71,  357,  350,   71,  352,
+      354,   71,  355,   71,  348,  359,  353,  362,   71,   71,
+      365,  363,  366,   71,  351,   71,  356,  368,  367,  371,
+      358,  369,   71,  357,   71,   71,   71,   71,  372,   71,
+       71,  373,  359,   71,  362,  374,  379,  365,  363,  366,
+       71,  370,  380,   71,  368,  367,  377,   71,  369,  378,
+      376,   71,   71,  383,   71,  372,   71,  381,  373,   71,
+      382,   71,  374,  379,  384,  385,  386,  388,  370,  380,
+      387,   71,   71,  377,  391,   71,  378,  376,   71,  393,
+
+      383,   71,  392,   71,  381,  389,  394,  382,  398, 2985,
+     2985,  397,  385,   71,  395,   71,   71,  387,   71,   71,
+       71,  391,  390,   71,   71,   71,  399,  408,   71,  392,
+      396,   71,  389,  394,   71,  398,   71,  400,  397,  401,
+      407,  395,  402, 2985,  403,  404,   71,  417,  410,  390,
+       71,   71,  409,  399,   71,   71,  405,  396, 2985,   71,
+      419,  423,   71,   71,  400,   71,  401,  407,  418,  402,
+       71,  403,  404,  406,  417,  410,   71,   71,  424,  409,
+       71,  425,   71,  405, 2985,   71, 2985,  419,  423,  420,
+      430,  421,   71, 2985,  428,  418,   71,  426,  427,  429,
+
+      406,  411,  436, 2985,  412,  424, 2985,  422,  425,  413,
+      414,  415,  416,   71,   71,  433,  420,  430,  421,   71,
+      431,  437,   71,  432,  426,  427,   71,   71,  411,   71,
+       71,  412,  438,  434,  422,  435,  413,  414,  415,  416,
+      439,  440,  433,   71, 2985,  445,  441,  431,  437,  442,
+      432,   71,   71,   71,  444, 2985,  451,   71,   71,  438,
+      434,   71,  435,   71,  443,  450,   71,  439,  440, 2985,
+     2985,   71,  446,  441,  447,  449,  442,   71,  452, 2985,
+      457,  444,   71,  448,  453,  462,  465,   71,   71,  463,
+      454,  443,  450,   71,  455, 2985,  456,  464,   71,  446,
+
+       71,  447,  449,   71,  466,  452,   71,  457, 2985,  458,
+      448,  453,  462,   71,  467,   71,  463,  454,   71,  555,
+      468,  455,  459,  456,  469,  460,   71,  461,  477,   71,
+      479,  466,  470,   71,  478,   71,  458,  481,   71, 2985,
+       71,  467,   71, 2985,  480,  484,   71,  468, 2985,  459,
+       71,  469,  460,  502,  461,  477,   71,  479,   71,  470,
+      471,  478,  472,  493,  481,  492,  500,  482,  494, 2985,
+      497,  480,  484,  495,  496,  473,  151,   71,  474, 2985,
+      475,   71,  476,  483,   71,   71,   71,  471,  498,  472,
+      493,   71,  492,  500,  482,   71,   71,  497,  523,  524,
+
+       71,  496,  473, 2985,  499,  474,  501,  475, 2985,  476,
+      483,  485,  486,  504,   71,  498,   71,  503,   71,  505,
+       71,  487,  509,  488,  489,  490,  506,   71,  491,   71,
+      508,  499,   71,  501,   71,  507,   71,  512,  485,  486,
+      504,  511, 2985,  514,  503,  519,  505,  510,  487,  509,
+      488,  489,  490,   71,   71,  491,  515,  508,   71,   71,
+      513,  517,  507,  516,  512,  518, 2985,  520,  511,   71,
+       71,  522,   71,  521,  510,   71,   71,   71,   71,  525,
+      526,  531,   71,  515,   71,  527,   71,  513,  517,  528,
+      516,   71,  518,   71,  520,  529,   71,  534,  522, 2985,
+
+      521,  535,   71,  532,   71,  536,  525,  526,  531,   71,
+      537,  543,  527,  530,  539,  547,  528,   71,  533,  559,
+       71,   71,  529,   71,  534,  538,   71,   71,  535,   71,
+      532,  540,  536,  544,   71,  546,  545,  537,  543,  551,
+      530,  539,  541,  549,  542,  533, 2985,   71,  548,   71,
+      550,   71,  538,   71,   71,   71,  553,  556,  540,   71,
+      544,   71,  546,  545,   71,  552,  551,  554,  560,  541,
+      549,  542,   71,   71,  557,  548,  558,  550,  561,   71,
+      562,   71,   71,  553,  556,  567,   71,  563,   71,  564,
+       71,   71,  552,  574,  554,  560,  565,  571,  570,  568,
+
+       71,  557,   71,  558,  566,  561,   71,  562,  569,   71,
+      572,   71,  567,   71,  563,  573,  564,   71,  575,   71,
+      574,   71,   71,  565,  571,  570,  568,  577,  576,  581,
+       71,  566,  579,   71,   71,  569,  578,  572,  580,  582,
+       71,   71,  573,  583,   71,  575,  584,  589,   71,  591,
+       71,  596, 2985,   71,  577,  576,  581,   71,   71,  579,
+      585,   71,  586,  578,  587,  580,  582,  588,  590,   71,
+      583,   71,  593,  584,  592,   71,  598, 2985,  596,   71,
+       71,   71,  599,  601,  597,   71,   71,  585,   71,  586,
+      594,  587,  602,  595,  588,  590,   71,   71,  600,  593,
+
+      604,  592,  607,  598,  605,   71,  609,   71,   71,   71,
+      601,  597,  608,   71,   71,  603,  606,  594,  610,  611,
+      595,   71,  614,  612,   71,  600,   71,  604,   71,  607,
+       71,  605,  613,  609,   71,   71,   71,  623, 2985,  608,
+       71,   71,  603,  606,   71,  610,  611,  625, 2985,  614,
+      612, 2985, 2985,  626,  624,  632,  656,  627, 2985,  613,
+      615,   71, 2985, 2985,  623,  616,   71,  617,   71,  640,
+       71,  631,  628,  618,  625,  619,   71,   71,  620,  621,
+      626,  624,  632,   71,  627,  622,   71,  615,   71,  629,
+      633,  634,  616,  630,  617,   71,  640,  635,  631,  628,
+
+      618,   71,  619,  637,  638,  620,  621,  636, 2985,   71,
+      641,   71,  622,  643,   71,  639,  629,  633,  634,   71,
+      630,  642,  649,   71, 2985,  650,  644,  647,   71,   71,
+      637,  638,  645,  646,  636,   71,   71,  641,   71,   71,
+      643,  648,  639,   71,   71,   71,   71,   71,  642,  649,
+      651,  652,  650,  644,  647,  653,  654,  655,   71,  645,
+      646,  658,  659,   71,  657,  668,  662,  663,  648,  661,
+       71,  667,  660,   71,   71,   71,   71,  651,  652,   71,
+      151,   71,  653,  654,  655,   71,  664,  665,  658,  659,
+       71,  657,  666,  662,  663,  669,  661,   71,   71,  660,
+
+       71,  670,  671,  672,  674,  673, 2985, 2985,  686,  684,
+       71,   71,   71,  664,  665,  675,   71,   71,   71,  666,
+      676,  681,  669,  680,  685,  683,  682,   71,  677,  671,
+      672,  674,  673,   71,   71,  678,   71,   71,  679,   71,
+       71,  687,  675,  688,   71,  689,   71,  676,  690,  691,
+      680,   71,  683,   71,   71,  677,  692,  695,  693, 2985,
+      694,  698,  678,  697,  696,  679,   71,   71,   71,   71,
+       71,  699,  700,   71,  701,  690,  691,   71,   71,   71,
+      702,   71, 2985,  692,  695,  693,   71,  694,  698,   71,
+      697,  696,  703,  704,   71,  705,  706,   71,  699,  707,
+
+       71,  701,  712, 2985,   71, 2985,  708,  702,  711,  714,
+      715,  709,   71,  713,   71,  710, 2985,   71,   71,  703,
+      704,  716,   71,  706,  718,  719,  707,   71,   71,  712,
+       71,   71,   71,  708,   71,  711,  714,  715,  709,  717,
+      713,  720,  710,   71,  726,  723, 2985,  721,  716,  724,
+      727,   71,  719,  725,  731,   71,   71,  732,  728,   71,
+      730,   71, 2985,  738, 2985,   71,  717,   71,  720,  722,
+       71,  726,  723,   71,  721,   71,  724,  727,   71,  729,
+      725,  731,   71,  733,   71,  728,  734,  730,  735,  736,
+      737,  739,  744,   71,   71,   71,  722,  740,  743,   71,
+
+      745,   71,  741,  742,  747,   71,  729,   71,  748,   71,
+      733,  749,   71,  734,   71,  735,  736,  737,  739,  744,
+      746,   71,   71,  752,  740,  743,  750,  745,  753,  751,
+       71,   71,  754,   71,  755,  748,   71,  756,  757,  758,
+      760,  759, 2985,   71,  767,   71,   71,  746,   71,   71,
+       71,   71,  761,  750,  763,   71,  751,  764,   71,  754,
+     2985,  755,  762,  765,  756,  757,  769,  760,  759,   71,
+      768,   71,  772,  773,   71,   71,   71,   71,  766,  761,
+       71,  763,  774,  776,  764,   71,  770,   71,   71,  762,
+      765,  771,  777,  769,  775,  778,  782,  768,   71,  772,
+
+      773,   71,   71,  779,   71,  766,  780,   71,   71,  774,
+      776,  783,   71,  781,   71,  785,  787,  784,   71,  777,
+       71,  775,  778,  788,  786,   71,  789,   71,   71,  791,
+      779,   71,  792,  780,   71,   71,   71,  790,  783,  793,
+      781,   71,  785,  787,  784,   71,  796,  794,  795,   71,
+      788,  786,  798,  789,   71,   71,   71,  802,  797,  792,
+      805,   71,  799,   71,  790,   71,  793,   71,  803,   71,
+      804,   71,  806,  796,  794,  795,  807,  800,  801,  798,
+       71,   71,  810,   71,  802,  797,   71,  805,  808,  799,
+      809,  813,   71,   71,  811,  803,   71,  804,  814,  806,
+
+      812,   71,   71,  807,  800,  801,  815,  816,  817,  810,
+      818,   71,   71,  820,   71,  808,  819,  809,  813,   71,
+       71,  811,  824,  823,  822,  814,   71,  812,  821,   71,
+       71,   71,  825,  815,  816,  817,   71,  818,   71,  826,
+      820,   71,   71,  819,  151,  827,  828,  831,  829,  824,
+      823,  822,  830,   71,  832,  821,   71,  835,   71,  825,
+       71,  833,   71,  837,   71,   71,  826,  836,  838,  834,
+      839,   71,  827,  828,  831,  829,  840,   71,  841,  830,
+      842,   71,   71,  843,   71,   71,  844,   71,  833,  845,
+      837, 2985,   71,   71,  836,  846,  834,  839,  867,   71,
+
+       71,  855,  847,  840,  848,  841,   71,  842,   71,  857,
+      843,   71,  849,   71,  856,   71,  845, 2985,   71,   71,
+     2985,  858,  846,  859,   71,  861,  860,   71,  855,  847,
+       71,  848,  862,  875,   71, 2985,  857,  864, 2985,  849,
+      850,  856,   71,  865,  851,  863,   71,  852,  858,   71,
+      859,   71,  861,  860,  853,   71,   71,  854,   71,  862,
+      875,   71,   71,  876,  864,  879,  866,  850, 2985,   71,
+      865,  851,  863,   71,  852,  878,  877,   71, 2985,  880,
+     2985,  853,  882, 2985,  854,   71,  883,  881,  885,   71,
+      876,  884,  879,  866,  868,  869, 2985,  870,   71,  886,
+
+      871,  889,  878,  877,  888,  872,   71,   71,   71,  882,
+       71,  873,  874,  883,  881,  885,   71,   71,  884,  887,
+       71,  868,  869,   71,  870,  890,  886,  871,  889,   71,
+      891,  888,  872,   71,  895,  892,  893,  894,  873,  874,
+      898,   71,   71,  896,   71,  897,  887,  902,  904,  903,
+      899, 2985,  890,   71,  900,   71,   71,  891,   71,   71,
+       71,  895,  892,  893,  894,  907,   71,  898,  901,   71,
+      896,   71,  897,   71,  908,   71,  903,  899,  905,   71,
+      909,  900,  910,  906,  911, 2985,  913,   71, 2985, 2985,
+      912,  915,  907,  916,  918,  901,  914, 2985, 2985,  922,
+
+      917,  925,  919,   71,   71,  920,   71,   71, 2985,  910,
+       71, 2985,   71,  913,   71,   71,   71,  912,   71,   71,
+       71,  918,  921,  914,   71,   71,   71,  917,  923,  919,
+       71,  924,  920,   71,  926,  927,  928,  929,  930, 2985,
+      937, 2985,   71,  931,  932,  938,   71,  933, 2985,  921,
+       71,  935, 2985,   71,   71,  923,   71,  939,  924,   71,
+       71,  926,  927,  928,  929,  930,   71,   71,  936,   71,
+      931,  932,   71,  934,  933,   71,  940,  941,  935,  942,
+      946,  947,   71,   71,  939,   71,  943, 2985,   71,   71,
+      944, 2985, 2985,  948,  949,  936,  950,   71,  945,   71,
+
+      934, 2985,   71,  940,  941,   71,  942,  946,   71,  955,
+      953,  951,  952,  943,   71,   71,   71,  944,   71,   71,
+      948,  949,  954,  950,  956,  945, 2985,   71,   71,   71,
+      957,  958,  960,  959,  961,  962,  955,  953,  951,  952,
+       71,   71,  964,  966,  965,  967,  963,  968, 2985,  954,
+       71,  956,   71,   71,   71,   71,   71,  957,  958,  969,
+      959,  961,  962,  970,   71,   71,   71,   71,  971,  964,
+      966,  965,  967,  963,   71,   71,  973,  972,  976,  974,
+      975,   71,  977,   71,   71,   71,  969,  979,   71,  978,
+      970,  980,  981,  982,  983,  971,   71,  990,   71, 2985,
+
+      984,  992,   71,  973,  972,  976,  974,  975,   71,  987,
+       71,  989,  994,  996,   71,  985,  978,   71,  980,   71,
+      988,  983,  991,  986,   71,   71,   71,  984,  992,   71,
+       71,   71,  995,  998,  993,  999,  987,   71,  989,   71,
+       71, 1000,  985,  997,   71, 1002,   71,  988,   71,  991,
+      986, 1001,   71,   71, 1005,   71, 2985, 1004, 1003,  995,
+      998,  993,  151,   71,   71, 1006, 1007, 1008, 1000,   71,
+      997,   71, 1002,   71,   71, 1009,   71, 1010, 1001, 1019,
+       71, 1005,   71,   71, 1004, 1003, 2985, 2985, 1017, 1018,
+     1020,   71, 1006, 1007, 1008, 1021, 1027,   71, 1022, 2985,
+
+     2985, 1028, 1009, 2985, 1010, 1011, 1019, 1012, 1023, 1025,
+     2985, 1013,   71, 1014,   71, 1017, 1018,   71, 1015, 1030,
+       71,   71, 1021, 1016, 1024, 1022, 1026, 1034,   71,   71,
+     1029,   71, 1011, 2985, 1012, 1023, 1025,   71, 1013,   71,
+     1014, 1038,   71,   71, 1031, 1015, 1030, 1035, 1032,   71,
+     1016, 1024, 1037, 1026, 1034, 1036,   71, 1029, 1033, 1039,
+       71,   71,   71, 1040, 1043,   71, 1041, 1044, 1038, 2985,
+       71, 1031,   71, 1045, 1035, 1032, 1055, 1046, 2985, 1037,
+     1058,   71, 1036, 2985, 1054, 1033,   71, 1057, 1056, 1060,
+     2985,   71, 2985,   71, 1044,   71,   71, 1066,   71,   71,
+
+     1045,   71,   71, 1055, 1046, 1047,   71, 1058,   71, 1061,
+     1048, 1054, 1049, 1059, 1057, 1056, 1060, 1062, 1050, 1063,
+     1064, 2985,   71, 1051, 1052,   71, 1065,   71, 1067,   71,
+     1053,   71, 1047, 1068, 1069,   71, 1061, 1048, 1070, 1049,
+     1059,   71, 1071, 1076, 1062, 1050, 1063,   71,   71,   71,
+     1051, 1052,   71, 1065, 1072, 1067, 1073, 1053, 1074, 2985,
+     1068, 1069,   71, 1078,   71, 1079, 1075, 1081, 1077, 1071,
+       71,   71, 1080, 1083,   71,   71,   71,   71, 1084,   71,
+       71, 1072, 1082, 1073, 1085, 1074,   71,   71,   71,   71,
+     1078, 1086, 1079, 1075, 1081, 1077,   71, 1087, 1088, 1080,
+
+     1083, 1090,   71, 2985, 1089, 1084, 1091,   71, 1092, 1082,
+     1093, 1085,   71,   71,   71,   71,   71, 1094, 1086, 1096,
+     1095, 1097, 2985,   71, 1087, 1101,   71, 1098, 1090, 1100,
+       71, 1089,   71, 1091, 1099, 1092, 1102, 1093, 2985, 1106,
+     1103,   71, 1107,   71, 1094, 2985, 1096, 1095, 1097,   71,
+       71,   71,   71, 1104, 1098,   71, 1100,   71, 1105, 1108,
+     1109, 1099, 1112, 1102, 1110,   71, 1106, 1103, 1111, 1107,
+     1113,   71, 1114,   71, 1115, 1116,   71,   71, 1117, 2985,
+     2985,   71,   71,   71, 1118,   71, 1108, 1109, 1120, 1112,
+       71, 1110, 1121, 1127, 1122, 1111, 1119, 1113,   71, 1124,
+
+     1123, 1115, 1125, 1126,   71, 1117,   71,   71,   71,   71,
+       71, 1118,   71, 1128, 1130, 1120,   71, 1129, 1131, 1121,
+     1127, 1122,   71, 1119,   71,   71, 1124, 1123,   71, 1125,
+     1126, 1132, 1135, 1133,   71,   71, 1134, 2985, 1136, 1137,
+     1128, 1130, 1139, 1140, 1129,   71, 1138, 1141,   71,   71,
+       71,   71, 1142, 1143,   71, 1144,   71, 1147,   71, 1135,
+     1133,   71, 1150, 1134,   71, 1136, 1137,   71, 1145, 1139,
+     1140, 1146, 1148, 1138, 1141, 1151, 1149,   71, 1152, 1162,
+     1163,   71, 1144,   71,   71,   71, 1153, 1155, 1154,   71,
+       71, 1158, 1156,   71,   71, 1145,   71,   71, 1146, 1148,
+
+     1157, 1159, 1151, 1149,   71,   71,   71,   71, 1160, 1161,
+       71,   71,   71, 1153, 1155, 1154,   71,   71, 1158, 1156,
+     1164, 1165, 1166,   71,   71, 1167, 1168, 1157, 1159, 1169,
+     1173, 1171,   71,   71, 1184, 1160, 1161, 1172,   71,   71,
+       71, 1176, 1175,   71,   71, 1179, 1182, 1164, 1165,   71,
+       71, 1178, 1167, 1168, 1177,   71, 1169, 1173, 1171, 1174,
+       71,   71, 1180,   71, 1172, 1181,   71,   71,   71, 1175,
+     1183, 1185, 1179,   71, 1186, 1187, 2985,   71, 1178, 1192,
+     1189, 1177, 1188,   71,   71, 1190, 1174, 1193, 1191, 1180,
+     2985,   71, 1181,   71, 1197,   71,   71, 1183,   71, 1194,
+
+       71, 1186, 1187,   71,   71, 1195, 1192, 1189, 1196, 1188,
+       71, 1198, 1190, 1199, 1193, 1191,   71,   71, 1200,   71,
+     1201,   71,   71, 2985,   71, 1207, 1194, 1202, 1203, 1209,
+       71, 1208, 1195, 1210,   71, 1196, 2985, 1204, 1198, 1205,
+     1199,   71, 1206, 1211, 1213, 1200,   71, 1201, 1212,   71,
+       71,   71, 1207,   71, 1202, 1203, 1209,   71, 1208, 1214,
+     1210, 1216,   71, 1217, 1204, 1215, 1205,   71, 1218, 1206,
+     1211, 1213, 1219,   71, 1220, 1212,   71, 1222, 1221,   71,
+     1223,   71, 2985,   71,   71, 1224, 1214, 2985, 1216, 1228,
+     1217, 1225, 1215, 1231, 1226, 1218,   71,   71, 1227,   71,
+
+       71, 1220,   71, 1230, 1222, 1221,   71, 1223,   71,   71,
+       71, 1229, 1224,   71, 1232,   71, 1228, 1234, 1225, 1233,
+     1231, 1226, 1235,   71, 1236, 1227,   71,   71, 1237,   71,
+     1230,   71, 1238, 1241, 1240, 1239, 1244, 1242, 1229,   71,
+       71, 1232,   71,   71, 1234,   71, 1233, 1243, 1245, 1235,
+       71, 1236,   71, 1246, 1261, 1237, 1252, 1315, 1250, 1238,
+     1265, 1240, 1239, 1244, 1242,   71,   71, 1247,   71, 1249,
+       71,   71, 1248, 1251, 1243, 1245, 1259,   71, 1280, 1260,
+     1246, 1262,   71, 1252,   71, 1250,   71,   71, 2985, 1263,
+       71, 1266,   71, 2985, 1264, 1267, 1249,   71, 1268,   71,
+
+     1251, 1253, 2985, 1259, 1254, 1255, 1260,   71, 1262, 1256,
+       71,   71,   71,   71, 1269, 1257, 1263,   71, 1266, 1258,
+       71, 1264, 1267,   71,   71, 1268, 1270, 1271, 1253, 1272,
+     1273, 1254, 1255, 1277, 1274, 1278, 1256,   71, 1276, 1281,
+     1275, 1269, 1257,   71, 2985,   71, 1258, 1282,   71, 1283,
+     1279,   71,   71, 1270, 1271,   71, 1272, 1273,   71,   71,
+     1277, 1274, 1278, 2985, 1289, 1276, 1291, 1275, 1293,   71,
+     1294,   71,   71, 2985, 1282, 1292, 1283, 1279, 1284,   71,
+       71, 1295,   71, 1285, 2985, 1286, 1305, 1287, 2985, 1288,
+       71, 1289, 2985, 1291, 1300, 1293,   71, 1294,   71,   71,
+
+     1299, 1296, 1292, 2985, 1298, 1284, 1297,   71, 1295,   71,
+     1285, 1301, 1286, 1304, 1287, 1302, 1288, 1303,   71, 1306,
+     1307, 1300,   71,   71, 1308,   71,   71, 1299, 1309,   71,
+     1310, 1298, 1312,   71, 1311, 1317, 1314,   71, 1301,   71,
+     1304,   71, 1302,   71, 1303,   71, 1306, 1307, 1316, 1318,
+       71, 1308,   71, 1319, 1313, 1309,   71, 1310,   71, 1312,
+       71, 1311,   71, 1314, 1320, 1321, 1322, 1323, 1325, 2985,
+     1326, 1324, 1330,   71,   71, 1316, 1318,   71,   71, 1327,
+     1319, 1313, 1328, 1329,   71, 2985,   71, 1332,   71,   71,
+     1335, 1320, 1321, 1322,   71,   71,   71, 1326, 1324,   71,
+
+     1331,   71, 1334, 1336, 1337, 1333, 1327,   71,   71, 1328,
+     1329,   71,   71,   71, 1332, 1338, 1340, 1335, 1341, 2985,
+     2985, 1339, 1342, 1348,   71, 1343, 1347, 1331,   71, 1334,
+     1336, 1337, 1333,   71, 1344,   71, 1345, 1346,   71,   71,
+       71,   71, 1338, 1340,   71, 1341, 1349,   71, 1339, 1342,
+     1348, 1350, 1343, 1347, 1351, 1352,   71, 1353, 1354,   71,
+     1362, 1344,   71, 1345, 1346,   71,   71, 1355, 1356, 1358,
+     1359, 1361, 1357, 1349, 1360,   71,   71,   71, 1350,   71,
+     1363,   71, 1364, 1365, 1353,   71,   71,   71,   71, 1370,
+       71, 1372,   71, 1369, 1355, 1356,   71, 1359, 1361, 1357,
+
+     1366, 1360,   71,   71, 1368, 1371, 1367, 2985,   71, 1364,
+     1377,   71,   71,   71,   71,   71, 1370,   71, 1372, 1373,
+     1369, 1374, 1376,   71, 1378, 1375,   71, 1366,   71, 1383,
+     2985, 1368, 1371, 1367,   71, 1379, 1381,   71,   71, 1380,
+     1384, 1382, 1385, 1387,   71, 2985, 1373,   71, 1374, 1376,
+     1386, 1378, 1375, 1392, 1394,   71, 1383,   71,   71, 2985,
+     1393,   71, 1379,   71, 2985, 1395, 1380, 1384,   71, 1385,
+     1387, 1388, 1390,   71, 1389, 1391, 1397, 1386,   71, 1396,
+     1392, 1398,   71,   71,   71, 1400,   71, 1393,   71, 1402,
+     1403, 1399, 1395, 1411,   71,   71, 1401,   71, 1388, 1390,
+
+       71, 1389, 1391, 1397, 1405,   71, 1396,   71, 1398, 1404,
+     1406,   71, 1400,   71, 1407, 1408, 1402, 1403, 1399,   71,
+     1409, 2985,   71, 1401, 1410,   71, 1413, 1415, 1412,   71,
+     2985, 1405,   71, 1414,   71, 2985, 1404, 1406,   71,   71,
+       71, 1407, 1408,   71, 1416, 1418,   71, 1409, 1419, 1417,
+     1421, 1410, 1420, 1413, 1415, 1412,   71,   71, 1423,   71,
+     1414, 1424, 1422, 1426, 1428, 1425, 1429,   71,   71,   71,
+     1432, 1416, 1418,   71,   71, 1419, 1417, 1421, 1427, 1420,
+       71, 1430, 2985, 1431,   71, 1423,   71, 2985, 1424, 1422,
+     1426, 1433, 1425, 1434, 1435, 1438,   71,   71,   71, 1436,
+
+       71, 1437, 1442,   71, 1439, 1427, 1441,   71, 1430,   71,
+     1431,   71,   71,   71,   71,   71, 1440, 2985, 1433, 1443,
+     1434, 1435, 1438,   71,   71,   71, 1436, 1444, 1437, 1442,
+       71, 1439,   71, 1441, 1445,   71, 1447, 1449, 1453, 1446,
+     1451, 1448, 1452, 1440,   71, 1450, 1443, 1455,   71, 1457,
+       71, 1454, 1456, 1458, 1444,   71,   71, 1461,   71,   71,
+     1459, 1460,   71, 1463, 1449, 1453,   71, 1451,   71, 1452,
+     2985,   71, 1450,   71, 1455, 1462, 1457, 1464, 1454, 1456,
+     1472, 2985,   71,   71,   71,   71, 1465, 1459, 1460,   71,
+     1463, 1466, 1467, 1468,   71, 1469, 1474, 1470, 1471,   71,
+
+       71,   71, 1462,   71, 1473, 1475,   71, 1472,   71,   71,
+       71,   71, 1476, 1465, 1477, 1478, 1480, 1479, 1466, 1467,
+     1468, 1485, 1469, 1474, 1470, 1471, 1490, 1484,   71,   71,
+       71, 1473,   71,   71,   71,   71, 1481,   71, 1486, 1476,
+     1482, 1477, 1478, 1480, 1479,   71, 1487, 1488, 1485,   71,
+     1489, 2985, 1491, 1483, 1484, 1492, 1493,   71,   71, 1496,
+     1499,   71, 1494, 1481,   71, 1486,   71, 1482, 1495,   71,
+     1500, 2985,   71, 1487,   71, 1497, 1503, 1489,   71, 1491,
+     1483, 1498, 1492, 1493,   71,   71, 1496, 1501,   71, 1494,
+     1504,   71,   71, 1502, 1505, 1495,   71,   71,   71,   71,
+
+     1506, 1507, 1497, 1503, 1509, 1508, 1512,   71, 1498, 2985,
+     1510, 1511, 1513, 1516, 1501, 1515,   71, 1504, 1514,   71,
+     1502,   71,   71, 2985, 1519,   71,   71, 1506,   71,   71,
+       71,   71, 1508, 1512, 1520, 1530,   71, 1510, 1511, 1513,
+     1516,   71, 1515, 1517, 1518, 1514,   71,   71, 1521,   71,
+     1522, 1519,   71, 1523, 1524, 1526,   71, 1525, 1527,   71,
+     1529, 1520,   71, 2985, 1528,   71, 1531,   71,   71, 1532,
+     1517, 1518,   71, 1533,   71, 1521,   71, 1522, 1535, 1536,
+     1523, 1524, 1526,   71, 1525, 1527,   71, 1529, 1538,   71,
+     1534, 1528, 1539, 1531,   71,   71, 1532, 2985, 1540,   71,
+
+     1533, 1537,   71, 1541, 1547, 1535, 1536,   71, 1544,   71,
+       71, 1546, 1542, 1543, 1550, 1538,   71, 1534, 2985,   71,
+       71,   71, 1545, 1551,   71, 1540,   71, 1548, 1537, 1549,
+     1541, 1547,   71, 1553,   71, 1544,   71,   71, 1546, 1542,
+     1543, 1550, 1554, 1555, 1552,   71, 1556, 1557, 2985, 1545,
+     1551,   71, 2985,   71, 1548, 1558, 1549, 1559,   71, 1560,
+     1553, 1564, 1561, 1562,   71, 1565, 2985,   71,   71, 1554,
+     1570, 1552, 1567, 1556, 1563,   71, 1569,   71, 2985,   71,
+     1566,   71, 1558,   71,   71,   71, 1560,   71, 1564, 1561,
+     1562,   71, 1565,   71, 1568, 1571,   71, 1570, 1572, 1567,
+
+       71, 1563, 1576, 1569, 1577,   71,   71, 1566, 1573, 1578,
+       71, 1574, 1580, 1582,   71, 1579, 1581, 1586, 2985, 1583,
+     2985, 1568, 1571, 1575, 2985, 1572,   71,   71, 1584, 2985,
+     1585, 1577,   71, 1588,   71, 1573, 1578,   71, 1574, 1580,
+       71,   71, 1579, 1581, 1587,   71, 1583,   71, 1592,   71,
+     1575, 1590, 1589, 1599,   71, 1584,   71, 1585, 1591,   71,
+     1588,   71, 1593, 1594, 1595,   71,   71, 1596, 2985, 1597,
+     1598, 1587,   71,   71, 1601, 1592, 1600, 1602, 1590, 1589,
+       71, 1603, 1613,   71,   71, 1591,   71, 1604,   71, 1605,
+     1606, 1595,   71, 1607,   71,   71, 1597, 1598,   71,   71,
+
+       71, 1601,   71, 1600, 1602,   71, 1608,   71, 1603,   71,
+     1611, 2985, 1609, 1615, 1604, 1610, 1605, 1606, 1612,   71,
+     1607, 1614,   71,   71,   71, 1616, 1621, 1620,   71, 1617,
+     1618, 1619, 2985, 2985,   71,   71,   71, 1611,   71, 1609,
+     1615,   71, 1610,   71,   71, 1612, 1623, 1622, 1614, 2985,
+     1626,   71, 1616, 1621, 1620, 1630, 1617, 1618, 1619,   71,
+     1624,   71, 1631, 1625, 1627, 1629,   71,   71, 1632, 1628,
+     1633, 1634, 2985, 1623, 1622, 1635,   71, 1626,   71,   71,
+       71, 1636, 1630, 1639, 1640,   71, 1637, 1624, 2985,   71,
+     1625, 1627, 1629, 1638, 1648,   71, 1628, 1633, 1634,   71,
+
+       71,   71, 1635, 1642, 1641,   71,   71, 1643,   71, 1644,
+     1639, 1640,   71, 1637,   71, 1645, 1649,   71, 1646, 1647,
+     1638, 1650, 1653, 1652, 1651,   71,   71, 2985,   71, 1654,
+     1642, 1641,   71,   71, 1643,   71, 1644,   71,   71, 1655,
+       71, 1658, 1645,   71, 1660, 1646, 1647, 1659, 1650, 1653,
+     1652, 1651, 1657, 1656,   71,   71, 1654, 1664,   71, 1661,
+     1665,   71,   71, 1662, 1666, 2985, 1655,   71, 1658, 1668,
+     1667, 1660, 1671,   71, 1659,   71,   71, 1663,   71, 1657,
+     1656,   71, 1672, 1669, 1664,   71, 1661, 1665, 1670,   71,
+     1662, 1666, 1674, 1673,   71, 1675, 1668, 1667,   71, 1671,
+
+     1678, 1676, 1677, 1679, 1663, 1680, 2985, 1689, 1683, 1672,
+       71, 1682, 1681, 1684,   71,   71, 1686, 1685,   71, 1674,
+     1673,   71, 1687, 1688, 2985,   71,   71,   71, 1676,   71,
+     1679,   71,   71,   71, 1689, 1683, 1711,   71, 1682, 1681,
+       71, 1692, 1690, 1686, 1685,   71, 1691, 1693, 1694, 1687,
+       71, 1696, 1695, 1700,   71,   71, 1698, 1697, 1701, 2985,
+       71, 1707,   71,   71,   71,   71,   71, 1702, 1692, 1690,
+       71, 1708, 1706, 1691, 1693, 1694,   71, 1699, 1696, 1695,
+     1703,   71, 1704,   71, 1697,   71,   71,   71, 1705, 1709,
+       71,   71, 1710,   71, 1702, 1712,   71, 1713, 1708, 1706,
+
+       71,   71,   71, 1714, 1699, 1715, 1716, 1703, 1717, 1704,
+     1718, 1719, 1720, 1721,   71, 1705, 1709, 2985, 1724, 1710,
+       71,   71, 1712,   71, 1713,   71,   71,   71,   71, 1722,
+     1714, 1726, 1715, 1716, 1723, 1717, 1725, 1718, 1719,   71,
+     1721, 1730,   71, 1731,   71,   71, 1729, 1727,   71,   71,
+     1728,   71, 1732, 1735,   71, 1733, 1722, 1734, 1726, 1736,
+     1737, 1723,   71, 1725,   71,   71, 1738,   71, 1730, 1740,
+     1741, 1739, 1744, 1729, 1727,   71, 1742, 1728,   71, 1732,
+       71, 1743, 1733,   71, 1734, 1745, 1736,   71,   71,   71,
+     1746,   71,   71, 1738, 1749,   71,   71,   71, 1739, 1744,
+
+     1747,   71, 1748, 1742, 1750, 1751,   71, 1752, 1743,   71,
+     1754,   71, 1745, 1753, 1757, 1758,   71, 1746, 1756,   71,
+       71, 1749,   71, 1755, 1759,   71,   71, 1747,   71, 1748,
+     1760, 1750, 1751, 1762, 1752,   71,   71, 1754, 1761, 1764,
+     1753, 1757,   71, 1767,   71, 1756,   71, 1763, 1768, 1765,
+     1755, 1766, 1769, 1771,   71, 1772,   71, 1760, 1775, 1777,
+     1762, 1770,   71, 1776,   71, 1761, 1764, 1773,   71,   71,
+     1767, 1774, 1778,   71, 1763,   71, 1765,   71, 1766,   71,
+       71,   71, 1772, 1779, 1780,   71,   71, 1781, 1770, 1783,
+     1776,   71, 1786,   71, 1773, 1782,   71,   71, 1774, 1778,
+
+     1784, 2985, 1785, 1787, 1788, 1789, 1793, 1791, 1801, 2985,
+     1790, 1780, 1795,   71,   71,   71, 1783, 1796,   71,   71,
+     1798, 2985, 1782, 1797,   71, 1799, 1792,   71,   71, 1785,
+     1787, 1788, 1789,   71, 1791, 1794,   71, 1790,   71, 1800,
+       71,   71,   71, 1802,   71,   71, 1805, 1798, 1803, 1811,
+     1797,   71, 1799, 1792, 1804,   71, 1806,   71, 1807, 1813,
+       71,   71, 1794, 1809, 1808, 1812, 1800, 1810,   71, 1815,
+     1802,   71,   71,   71, 1818, 1803,   71, 1814, 1819,   71,
+     1816, 1804, 1817, 1806,   71, 1807,   71,   71,   71, 1820,
+     1809, 1808, 1812,   71, 1810,   71, 1815, 1822,   71, 1821,
+
+     1823, 1824,   71, 1825, 1814,   71,   71, 1816, 1827, 1817,
+     1828,   71, 1826,   71, 1829, 1830, 1820,   71,   71,   71,
+     1831, 1832,   71, 1833, 1822, 1834, 1821, 1823, 1824,   71,
+     1825, 1836,   71, 1838, 1835, 1827, 1837, 1828, 1840, 1826,
+       71,   71, 1830,   71, 1839, 1841,   71, 1831, 1843,   71,
+     1842,   71,   71,   71,   71,   71,   71, 1844, 1836,   71,
+     1838, 1835,   71, 1837, 1846, 1840, 1845, 1847, 1852, 1854,
+     1851, 1839, 1841,   71,   71, 1843,   71, 1842, 1849, 1850,
+     1853,   71, 2985, 1848,   71,   71, 1856, 1859,   71,   71,
+       71, 1846,   71, 1845, 1847,   71, 1854, 1851, 1857, 1858,
+
+     1855, 1860, 1863, 1865, 2985, 1849, 1850, 1853,   71,   71,
+     1848, 1867, 1864, 1856,   71, 1861,   71,   71,   71,   71,
+     1862, 1870, 1872, 1871,   71, 1857, 1858, 1855, 1860,   71,
+     1865,   71, 1866,   71, 1868,   71, 1869, 1873, 1867, 1864,
+       71,   71, 1861,   71,   71, 1874, 1875, 1862, 1876, 1872,
+     1871, 1877, 1880,   71, 1881, 1879, 1878, 1884, 1885, 1866,
+     1882, 1868,   71, 1869,   71, 1883,   71,   71, 1889,   71,
+     1888,   71, 1874, 1875, 1887, 1876, 1886,   71, 1877,   71,
+     1890,   71, 1879, 1878, 1892,   71, 1891, 1894, 1896,   71,
+       71, 1893,   71,   71, 1906,   71,   71, 1888, 1901,   71,
+
+       71, 1887, 1897, 1886, 1899, 1895, 1898, 1890, 1900,   71,
+       71, 1892,   71, 1891, 1902, 1903, 1904,   71, 1893,   71,
+       71,   71,   71, 1907, 1908, 1901,   71, 1905, 1909, 1897,
+       71, 1899, 1895, 1898,   71, 1900, 1911, 1912, 1910, 1918,
+       71, 1902,   71,   71,   71, 1913,   71, 1914, 1917,   71,
+     1907, 1908, 1915, 1916, 1905, 1909,   71, 2985,   71, 1919,
+       71,   71, 1920, 1911, 1912, 1910,   71,   71,   71, 1921,
+       71, 1922, 1913,   71, 1914, 1917, 1923,   71, 1925, 1915,
+     1916, 1924, 1926,   71,   71, 1928, 1919,   71, 1927, 1920,
+       71,   71, 1929, 1930, 1941, 1933, 1921, 2985,   71,   71,
+
+     1934, 2985, 1931, 1923,   71, 1925,   71,   71, 1924, 1926,
+     1935,   71, 1928, 1932, 1936, 1927, 1937, 1938,   71, 1940,
+     1930,   71, 1933,   71,   71, 1939, 1942, 1934,   71, 1931,
+     1945,   71,   71,   71, 1943, 1946,   71, 1935, 1944, 1947,
+     1932, 1936,   71, 1937, 1938,   71, 1940,   71,   71,   71,
+       71, 1949, 1939, 1942, 1948, 1950, 1951, 1945, 1955, 2985,
+     1952, 1943, 1946, 1954,   71, 1944, 1953, 2985, 1957, 2985,
+       71,   71, 1967, 1956,   71, 1961,   71,   71, 1949,   71,
+       71, 1948, 1950,   71,   71, 1955,   71, 1952, 1958, 1959,
+     1954,   71, 1960, 1953, 1962, 1957, 1963, 1966, 1965,   71,
+
+     1956, 1968, 1961,   71,   71,   71,   71,   71, 1970, 1964,
+       71, 1969,   71, 1994, 1974, 1958, 1959,   71,   71, 1960,
+     1971, 1962, 1972, 1963, 1966, 1965, 1973, 2985, 1968,   71,
+     1976, 1975,   71, 1978, 1977, 1970, 1964, 1979, 1969,   71,
+       71, 1974,   71, 1982, 1980,   71,   71, 1971,   71, 1972,
+     1981,   71,   71, 1973,   71, 1983, 1984, 1976, 1975, 1985,
+     1978, 1977,   71,   71, 1979,   71, 1986, 1988,   71, 1990,
+     1982, 1980,   71, 1987,   71, 1991, 1989, 1981, 1992, 2985,
+     1997,   71, 1983, 1984, 1995, 1993, 1985,   71, 2000,   71,
+     1996,   71,   71,   71, 1988, 2004, 1990,   71, 2001,   71,
+
+     1987,   71, 1991, 1989,   71, 1992,   71, 1997, 1998, 1999,
+     2005, 1995, 1993, 2003, 2002,   71,   71, 1996, 2006, 2009,
+       71, 2011,   71, 2007,   71, 2001,   71,   71, 2012, 2010,
+     2014, 2008,   71, 2013, 2985, 1998, 1999, 2005, 2018, 2985,
+     2003, 2002,   71,   71,   71, 2006,   71,   71, 2011, 2022,
+     2007,   71,   71, 2015,   71, 2012, 2010, 2014, 2008, 2023,
+     2013, 2016,   71,   71, 2017, 2018, 2019,   71, 2020, 2024,
+     2025, 2027,   71, 2021,   71, 2028, 2022, 2026, 2030,   71,
+     2015, 2031,   71, 2029,   71,   71, 2023, 2985, 2016, 2050,
+       71, 2017,   71, 2019, 2032, 2033, 2024, 2025, 2027,   71,
+
+       71,   71, 2028,   71, 2026,   71,   71, 2034, 2031, 2036,
+     2029, 2035, 2037, 2039, 2041, 2040,   71, 2985, 2038, 2046,
+       71, 2032, 2033,   71,   71,   71, 2044,   71, 2052, 2045,
+     2042,   71,   71,   71, 2034,   71, 2036,   71, 2035, 2037,
+     2039, 2041, 2040, 2043, 2049, 2038, 2046,   71, 2048, 2047,
+       71,   71, 2053, 2044, 2051,   71, 2045, 2042,   71, 2054,
+       71, 2055,   71, 2056, 2057, 2059, 2060, 2061, 2062, 2058,
+     2043, 2049,   71, 2063, 2064, 2048, 2047,   71, 2065, 2053,
+       71, 2051,   71,   71, 2068, 2069, 2054,   71, 2055, 2070,
+     2056,   71, 2066, 2071, 2061, 2062,   71,   71,   71, 2073,
+
+     2063,   71,   71, 2067,   71, 2065, 2074, 2076,   71, 2072,
+     2077, 2068,   71, 2075, 2078,   71, 2070, 2985,   71, 2066,
+     2071, 2079, 2080, 2082, 2081,   71, 2985, 2089,   71,   71,
+     2067,   71,   71, 2074,   71, 2083, 2072, 2077, 2084,   71,
+     2075, 2085,   71, 2087,   71, 2086,   71,   71, 2079, 2080,
+     2082, 2081,   71,   71,   71, 2088, 2090,   71, 2092, 2091,
+     2093,   71, 2083, 2094, 2099, 2084,   71,   71, 2085, 2095,
+     2087,   71, 2086, 2096, 2097, 2098, 2985,   71,   71,   71,
+       71, 2985, 2088, 2090,   71, 2092, 2091, 2093,   71, 2100,
+     2094,   71, 2110, 2985, 2985,   71, 2095, 2101, 2102, 2103,
+
+     2096, 2097, 2098,   71, 2104,   71,   71,   71,   71, 2105,
+     2109, 2111, 2106, 2107, 2108, 2112, 2100,   71,   71,   71,
+       71, 2113,   71, 2115, 2101, 2102, 2103, 2116,   71,   71,
+     2114, 2104, 2117, 2118,   71,   71, 2105, 2109, 2111, 2106,
+     2107, 2108, 2112, 2120,   71,   71, 2123, 2119, 2113,   71,
+     2115, 2126, 2128, 2121,   71, 2124, 2122, 2114,   71,   71,
+     2118,   71, 2125, 2129, 2130, 2127, 2132,   71, 2131,   71,
+     2120,   71,   71,   71, 2119, 2134,   71,   71, 2126, 2128,
+     2121, 2136, 2124, 2122,   71, 2133, 2135, 2137, 2138, 2125,
+       71,   71, 2127,   71,   71, 2131, 2139, 2141,   71, 2140,
+
+     2143, 2144,   71,   71, 2146, 2152, 2149, 2147, 2136,   71,
+       71, 2142, 2133, 2135,   71,   71,   71,   71, 2148,   71,
+     2150, 2145,   71, 2139, 2141, 2154, 2140, 2143,   71,   71,
+       71,   71,   71, 2149, 2147, 2151, 2153,   71, 2142,   71,
+     2156, 2155, 2159, 2157,   71, 2148,   71, 2150, 2145,   71,
+       71, 2158, 2154, 2160,   71,   71, 2161, 2162, 2165, 2163,
+     2164, 2167, 2151, 2153, 2168,   71, 2166,   71, 2155, 2159,
+     2157,   71,   71,   71, 2171,   71,   71,   71, 2158, 2172,
+     2160,   71, 2173,   71, 2162,   71, 2163, 2164, 2167, 2169,
+     2170, 2168, 2985, 2166, 2174, 2178, 2175, 2985,   71,   71,
+
+       71, 2171, 2179, 2180, 2182,   71, 2172, 2185,   71, 2173,
+       71, 2176, 2181, 2177,   71, 2184, 2169, 2170,   71,   71,
+       71, 2174, 2178, 2175,   71,   71, 2183, 2186, 2187, 2179,
+     2180, 2182,   71, 2188, 2185, 2189, 2192,   71, 2176, 2181,
+     2177, 2190, 2184, 2191, 2193,   71, 2194,   71,   71,   71,
+       71, 2195, 2196, 2183, 2186, 2187, 2197, 2201,   71, 2198,
+     2188, 2202, 2199, 2192, 2200,   71,   71,   71, 2190, 2203,
+       71, 2193, 2204, 2194,   71,   71,   71,   71, 2195, 2196,
+       71, 2205,   71, 2197, 2201, 2206, 2198, 2207,   71, 2199,
+     2208, 2200, 2209,   71, 2213,   71, 2214, 2215, 2216, 2204,
+
+     2210,   71, 2211,   71, 2212,   71, 2985,   71, 2205,   71,
+       71, 2218, 2206,   71, 2207, 2217, 2222, 2219,   71, 2209,
+     2220, 2213,   71, 2214,   71, 2216,   71, 2210,   71, 2211,
+     2221, 2212,   71,   71, 2223, 2225, 2226, 2228, 2218, 2224,
+       71, 2227, 2217, 2222, 2219,   71,   71, 2220, 2229, 2230,
+       71, 2231, 2232, 2233, 2985, 2235,   71, 2221, 2985, 2236,
+     2234, 2223, 2225,   71,   71, 2237, 2224,   71, 2227, 2238,
+     2240,   71,   71,   71,   71, 2229, 2230,   71,   71, 2239,
+       71,   71, 2235,   71,   71, 2241, 2236, 2234, 2242, 2243,
+     2244, 2245, 2237,   71, 2247, 2985, 2238, 2240,   71, 2246,
+
+     2248, 2249, 2253, 2250, 2256,   71, 2239, 2261,   71,   71,
+       71,   71, 2241, 2251,   71,   71, 2243, 2244, 2245, 2252,
+       71,   71,   71,   71, 2254,   71, 2246, 2248, 2249, 2253,
+     2250,   71,   71, 2255, 2258, 2257,   71, 2259, 2262,   71,
+     2251, 2260, 2263,   71, 2265, 2264, 2252, 2985,   71, 2266,
+     2272, 2254, 2267,   71, 2268,   71,   71,   71,   71, 2269,
+     2255, 2258, 2257,   71, 2259, 2262, 2270,   71, 2260, 2263,
+       71, 2265, 2264,   71, 2271, 2273, 2266,   71, 2274, 2267,
+       71, 2268,   71, 2275, 2276, 2277, 2269, 2278, 2282,   71,
+     2279,   71,   71,   71, 2280, 2985,   71,   71,   71, 2283,
+
+     2281, 2271, 2273, 2284, 2285,   71, 2288, 2286, 2985,   71,
+     2275, 2276, 2277, 2291, 2278,   71,   71, 2279,   71, 2287,
+     2296, 2280,   71, 2290,   71, 2292,   71, 2281,   71, 2289,
+       71, 2285, 2293, 2288, 2286,   71, 2294,   71,   71, 2295,
+       71, 2297, 2300,   71, 2298,   71, 2287,   71, 2299,   71,
+     2290,   71, 2292,   71, 2301, 2303, 2289, 2304, 2302, 2985,
+     2985, 2305, 2308, 2294,   71, 2306, 2295,   71, 2297,   71,
+     2307, 2298, 2309,   71,   71, 2299,   71,   71,   71,   71,
+     2310, 2301, 2303,   71, 2304, 2302,   71,   71, 2305, 2308,
+     2311, 2312, 2306, 2313,   71, 2314, 2315, 2307, 2316, 2309,
+
+     2317, 2321, 2318, 2985, 2319, 2985, 2320, 2310, 2323,   71,
+     2324, 2322,   71,   71, 2325,   71,   71, 2311,   71, 2327,
+       71,   71,   71,   71,   71, 2316,   71, 2317, 2321, 2318,
+       71, 2319,   71, 2320, 2326, 2323, 2328, 2324, 2322, 2329,
+     2331,   71,   71, 2330, 2332, 2333,   71, 2334, 2337, 2335,
+     2336, 2985,   71, 2985, 2341,   71,   71,   71,   71,   71,
+       71, 2326, 2338,   71, 2339,   71, 2329, 2331,   71,   71,
+     2330, 2332, 2333, 2343, 2334,   71, 2335, 2336, 2340, 2342,
+       71, 2341,   71, 2344, 2345,   71,   71, 2346, 2348, 2338,
+     2349, 2339, 2347, 2985, 2350,   71, 2351,   71,   71,   71,
+
+     2343, 2355,   71, 2352,   71, 2340, 2342, 2353, 2985,   71,
+     2344, 2345, 2356, 2354, 2346, 2348,   71, 2349, 2357, 2347,
+       71, 2350, 2358, 2351, 2359, 2361, 2363, 2360,   71,   71,
+     2352, 2985, 2365,   71, 2353,   71,   71,   71, 2362,   71,
+     2354,   71, 2367, 2371,   71, 2357,   71, 2364,   71, 2358,
+       71, 2359, 2361, 2363, 2360, 2366,   71, 2368, 2369, 2365,
+       71, 2370,   71, 2372,   71, 2362, 2374,   71,   71, 2367,
+       71, 2373, 2376, 2375, 2364, 2379, 2985, 2377, 2985, 2985,
+     2385, 2387, 2366, 2378, 2368, 2369,   71,   71, 2370,   71,
+     2372,   71,   71,   71, 2380,   71, 2381, 2383, 2373,   71,
+
+     2375, 2384, 2379, 2382, 2377,   71,   71,   71,   71,   71,
+     2378, 2386,   71,   71, 2389, 2391, 2388, 2396, 2394, 2390,
+     2398, 2380, 2392, 2381, 2383,   71,   71,   71, 2384,   71,
+     2382, 2395, 2393, 2985, 2985, 2397, 2400,   71,   71,   71,
+       71, 2389, 2391, 2388,   71, 2394, 2390,   71, 2403, 2392,
+     2404, 2402, 2409, 2399,   71,   71,   71, 2401, 2395, 2393,
+       71,   71, 2397, 2400, 2405,   71,   71, 2407, 2406, 2408,
+     2410,   71,   71, 2412,   71, 2403,   71, 2404, 2402,   71,
+     2399, 2411,   71, 2413, 2401, 2416, 2414, 2417, 2415, 2420,
+       71, 2405, 2418,   71, 2407, 2406, 2408, 2410,   71,   71,
+
+       71,   71, 2419, 2421, 2422, 2423,   71, 2424, 2411,   71,
+     2413,   71,   71, 2414, 2417, 2415,   71, 2425,   71, 2418,
+     2426, 2427,   71, 2428, 2429,   71, 2431, 2430,   71, 2419,
+     2421, 2422, 2423, 2432,   71,   71, 2434, 2985, 2435, 2437,
+     2433,   71,   71,   71, 2425,   71, 2438,   71, 2427, 2439,
+     2428, 2429,   71,   71, 2430, 2436, 2440,   71, 2441,   71,
+     2432, 2444, 2442,   71,   71, 2435, 2437, 2433,   71,   71,
+     2443, 2445, 2446, 2438,   71, 2449,   71, 2448, 2447, 2451,
+     2454, 2985, 2436, 2440,   71,   71,   71, 2452, 2444, 2442,
+     2455,   71,   71,   71,   71,   71, 2450, 2443, 2445, 2446,
+
+     2453,   71, 2449, 2460, 2448, 2447, 2451,   71,   71,   71,
+     2456, 2457,   71, 2458, 2452, 2459, 2463,   71, 2462, 2461,
+     2985, 2465,   71, 2450,   71, 2464, 2466, 2453,   71, 2468,
+       71, 2469, 2472,   71, 2470,   71, 2467, 2456, 2457, 2471,
+     2458,   71, 2459, 2463,   71, 2462, 2461,   71,   71, 2473,
+       71, 2474, 2464,   71,   71,   71,   71, 2475, 2469, 2472,
+     2476, 2477, 2478, 2467, 2985, 2985,   71, 2479, 2480, 2482,
+     2481,   71, 2985, 2985,   71, 2483, 2473, 2484, 2485,   71,
+       71, 2486,   71,   71, 2475,   71,   71, 2476, 2477, 2478,
+       71,   71,   71, 2489, 2479, 2480, 2482, 2481, 2487,   71,
+
+       71, 2488, 2483,   71, 2484, 2485, 2490,   71, 2486, 2491,
+     2493,   71, 2492, 2496, 2494,   71, 2498, 2499,   71, 2495,
+     2489,   71, 2500, 2497,   71, 2487, 2985,   71, 2488,   71,
+       71,   71, 2505, 2490,   71,   71, 2491, 2493, 2504, 2492,
+       71, 2494, 2502, 2498, 2499, 2501, 2495, 2507, 2503,   71,
+     2497, 2510, 2508,   71,   71,   71, 2506, 2509,   71,   71,
+     2514,   71, 2985, 2511, 2512, 2504, 2985, 2513, 2516, 2502,
+     2515, 2519, 2501, 2518,   71, 2503, 2517, 2520,   71,   71,
+     2521,   71,   71, 2506,   71,   71,   71, 2514,   71,   71,
+     2511, 2512, 2522,   71, 2513, 2516, 2523, 2515,   71,   71,
+
+     2518, 2524, 2525, 2517,   71, 2526, 2527,   71, 2528,   71,
+     2530, 2985, 2531, 2529, 2532,   71, 2533,   71,   71, 2522,
+     2534,   71, 2535, 2523, 2537, 2536, 2538,   71,   71, 2525,
+     2539,   71, 2526, 2527,   71, 2540,   71, 2530,   71, 2531,
+       71,   71, 2541,   71,   71, 2542, 2543, 2534, 2545, 2535,
+     2544, 2537, 2536,   71,   71, 2546,   71, 2539, 2547,   71,
+       71,   71,   71, 2548, 2551, 2549, 2557, 2552,   71, 2541,
+     2550, 2553,   71, 2543,   71, 2545, 2555, 2544,   71, 2554,
+     2556, 2985,   71, 2558, 2560,   71,   71,   71, 2561,   71,
+     2548, 2551, 2559, 2557, 2552, 2567, 2563,   71, 2553, 2562,
+
+       71,   71, 2566,   71,   71, 2570, 2554, 2556,   71, 2568,
+       71, 2560,   71, 2576,   71, 2561,   71, 2564, 2565, 2559,
+       71, 2569, 2567, 2563,   71, 2571, 2562,   71, 2572, 2566,
+     2573, 2575,   71,   71,   71, 2574, 2568, 2577, 2581,   71,
+       71, 2578, 2985, 2579, 2564, 2565, 2580,   71, 2569,   71,
+     2583, 2985, 2571, 2582, 2586, 2572, 2585,   71, 2575, 2584,
+       71,   71,   71,   71, 2577, 2581, 2588,   71, 2578,   71,
+     2579, 2587,   71, 2580,   71,   71, 2589, 2583,   71, 2590,
+     2582, 2586, 2591, 2585, 2592, 2593, 2584, 2595,   71, 2596,
+     2597, 2594, 2598,   71, 2600, 2985, 2599, 2601, 2587, 2985,
+
+       71, 2985, 2609, 2589,   71,   71, 2590,   71,   71,   71,
+       71, 2592,   71,   71,   71, 2602, 2596, 2597, 2594, 2598,
+       71,   71, 2603, 2599, 2601, 2604, 2606, 2607, 2608,   71,
+     2605, 2610, 2613,   71,   71, 2611, 2612, 2615,   71, 2985,
+       71,   71, 2602, 2614, 2616,   71,   71, 2617,   71, 2603,
+       71, 2619,   71, 2606, 2607, 2608, 2636,   71,   71, 2613,
+     2618,   71, 2611, 2612, 2615,   71, 2620,   71, 2622, 2621,
+     2614, 2616, 2623, 2625, 2617,   71, 2624, 2629, 2630, 2626,
+     2631,   71, 2627,   71, 2985, 2628, 2985, 2618,   71, 2634,
+       71,   71, 2632, 2620,   71, 2622, 2621,   71, 2635, 2623,
+
+     2625,   71,   71, 2624,   71,   71, 2626,   71,   71, 2627,
+       71, 2633, 2628, 2637, 2638, 2639, 2634, 2640,   71, 2632,
+       71, 2641, 2643, 2642, 2644, 2635,   71,   71, 2645, 2985,
+       71,   71, 2646, 2650, 2648,   71,   71, 2985, 2633, 2647,
+     2637, 2638,   71, 2651, 2640,   71,   71,   71, 2641, 2643,
+     2642, 2649, 2653, 2652, 2654, 2645,   71,   71,   71,   71,
+       71, 2648, 2655, 2656, 2657, 2658, 2647,   71, 2659,   71,
+     2651,   71,   71,   71, 2660,   71, 2661, 2662, 2649, 2653,
+     2652, 2654, 2663,   71,   71, 2665, 2666,   71, 2664, 2655,
+     2656, 2657, 2658, 2985,   71, 2659, 2667,   71, 2669, 2668,
+
+     2670,   71, 2672, 2661,   71, 2674,   71,   71, 2673,   71,
+       71, 2671,   71, 2666, 2676, 2664,   71, 2675,   71, 2678,
+       71, 2677, 2681, 2667, 2985, 2669, 2668,   71,   71, 2672,
+       71,   71, 2674, 2679, 2680, 2673, 2682, 2684, 2671,   71,
+     2683,   71, 2686, 2689, 2675, 2688, 2690,   71, 2677,   71,
+     2687,   71,   71, 2693,   71,   71, 2685, 2694,   71, 2691,
+     2679, 2680, 2695,   71,   71, 2699, 2700, 2683,   71, 2686,
+     2696, 2692, 2688, 2690,   71,   71, 2698, 2687,   71, 2701,
+       71,   71, 2702, 2685, 2694,   71, 2691, 2697,   71, 2695,
+       71,   71,   71, 2700,   71, 2703, 2704, 2696, 2692, 2705,
+
+     2706, 2709, 2707, 2708, 2710, 2985, 2712,   71,   71, 2702,
+     2713,   71,   71, 2711, 2697, 2714, 2715,   71,   71, 2717,
+     2985,   71, 2703, 2704,   71, 2718, 2705, 2719,   71, 2707,
+     2708,   71,   71, 2712, 2716, 2720, 2721,   71,   71, 2722,
+     2711,   71,   71, 2715, 2724, 2723, 2717,   71, 2727,   71,
+     2725, 2726,   71,   71,   71,   71,   71, 2728,   71, 2732,
+     2729, 2716,   71, 2721, 2731, 2733,   71, 2736, 2737, 2730,
+     2985, 2724, 2723,   71,   71, 2727,   71, 2725, 2726, 2738,
+     2739, 2734,   71, 2741,   71, 2735,   71, 2729,   71,   71,
+     2740, 2731, 2743,   71, 2736,   71, 2730,   71, 2742, 2744,
+
+     2745, 2748,   71,   71, 2985, 2749,   71, 2739, 2734, 2746,
+     2750,   71, 2735,   71, 2747,   71,   71, 2740, 2756, 2743,
+       71,   71,   71,   71, 2751, 2742,   71, 2745, 2748,   71,
+     2752,   71, 2749, 2753, 2763, 2754, 2746, 2750,   71, 2755,
+       71, 2747,   71,   71, 2759, 2756, 2757, 2758,   71, 2762,
+       71, 2751, 2761, 2760, 2764, 2765,   71, 2752, 2766,   71,
+     2753,   71, 2754,   71, 2767, 2774, 2755, 2768, 2769, 2770,
+     2771, 2759, 2775, 2757, 2758,   71, 2762, 2776,   71, 2761,
+     2760,   71, 2765, 2772, 2773,   71,   71, 2777,   71, 2780,
+     2778,   71, 2774, 2781, 2779, 2783,   71,   71,   71,   71,
+
+       71,   71, 2784, 2782, 2776,   71, 2785, 2786, 2788, 2787,
+     2790,   71,   71, 2789, 2777,   71, 2780, 2778,   71,   71,
+       71, 2779, 2783, 2791,   71,   71,   71, 2793, 2798, 2784,
+     2782, 2792, 2985, 2785, 2786, 2788, 2787,   71, 2794,   71,
+     2789, 2795, 2796,   71, 2799, 2800,   71, 2797, 2802,   71,
+       71, 2803, 2805, 2801, 2793, 2804,   71,   71, 2792,   71,
+       71, 2806, 2807,   71, 2808, 2794, 2809, 2810, 2795, 2811,
+       71, 2799, 2800,   71,   71, 2802, 2812, 2813, 2803,   71,
+     2801, 2814, 2804,   71, 2815, 2816, 2818, 2817, 2806,   71,
+     2819,   71, 2820,   71,   71, 2821,   71,   71, 2822, 2827,
+
+       71,   71,   71,   71,   71,   71, 2823, 2829,   71, 2824,
+       71, 2815,   71, 2818, 2817, 2825, 2826, 2819, 2828, 2820,
+       71, 2831,   71, 2832,   71, 2822,   71,   71,   71, 2830,
+       71,   71,   71, 2823, 2829, 2833, 2824, 2834, 2835, 2836,
+     2838,   71, 2825, 2826, 2837, 2828, 2839,   71, 2831,   71,
+     2832,   71,   71, 2841, 2842, 2843, 2830,   71, 2840,   71,
+     2844,   71, 2833, 2845, 2881, 2835, 2836, 2838,   71,   71,
+       71, 2837, 2846, 2839, 2847, 2848,   71,   71, 2850, 2849,
+     2841, 2842,   71, 2854, 2851, 2840,   71,   71,   71, 2985,
+       71,   71,   71, 2852, 2853, 2855,   71, 2856,   71, 2846,
+
+     2857, 2847, 2848, 2985, 2858, 2850, 2849,   71,   71,   71,
+     2854, 2851,   71, 2861,   71,   71,   71, 2859, 2860, 2865,
+     2852, 2853, 2855,   71, 2856, 2862,   71, 2857, 2863,   71,
+     2866, 2858, 2864, 2868,   71, 2867, 2869,   71, 2870,   71,
+     2861,   71,   71,   71, 2859, 2860, 2865, 2871, 2872, 2873,
+     2874, 2879, 2862,   71,   71, 2863, 2876, 2866,   71, 2864,
+       71, 2875, 2867, 2869, 2877,   71, 2882, 2878,   71, 2880,
+     2884, 2887, 2885,   71, 2871,   71,   71, 2874, 2879,   71,
+       71,   71, 2886, 2876,   71, 2883,   71, 2890, 2875,   71,
+       71, 2877,   71, 2882, 2878, 2888, 2880,   71,   71, 2885,
+
+     2891, 2889, 2892, 2893, 2894, 2895, 2896,   71, 2898, 2886,
+       71,   71, 2883, 2899,   71, 2903,   71, 2897, 2900,   71,
+     2985,   71, 2888, 2917,   71, 2901,   71, 2891, 2889, 2892,
+     2893,   71,   71, 2896, 2902, 2898,   71,   71,   71, 2904,
+       71, 2905, 2903, 2906, 2897, 2900,   71,   71, 2907, 2909,
+     2908,   71, 2901, 2985, 2915,   71, 2910,   71, 2911, 2985,
+     2912, 2902,   71,   71,   71, 2913, 2904,   71, 2905, 2916,
+     2906, 2914, 2985, 2918,   71, 2907, 2909, 2908,   71,   71,
+       71,   71, 2919, 2910, 2920, 2911, 2921, 2912, 2923, 2922,
+     2924,   71, 2913, 2985, 2926, 2927, 2916,   71, 2914,   71,
+
+     2918, 2925, 2928, 2932,   71, 2929,   71, 2930,   71, 2919,
+       71, 2920, 2934, 2921, 2935,   71, 2922,   71,   71, 2931,
+       71,   71, 2927,   71, 2936,   71,   71,   71, 2925, 2928,
+     2933, 2939, 2929, 2985, 2930,   71, 2940, 2944,   71, 2934,
+       71, 2935, 2937, 2985,   71, 2938, 2931, 2941, 2942, 2985,
+     2943,   71, 2945,   71, 2947,   71, 2949, 2933, 2939,   71,
+       71, 2950,   71, 2940, 2944, 2948,   71, 2946,   71, 2937,
+     2952, 2951, 2938,   71, 2941, 2942,   71, 2943, 2953, 2945,
+       71, 2947,   71, 2949, 2954, 2955,   71,   71, 2950, 2956,
+       71, 2957, 2948,   71, 2946, 2958, 2960, 2952, 2951, 2959,
+
+     2962, 2963, 2961, 2965,   71, 2953, 2970,   71,   71, 2964,
+     2966,   71, 2955, 2967,   71,   71, 2956,   71,   71,   71,
+     2969,   71, 2958, 2960,   71,   71, 2959, 2962,   71, 2961,
+     2965, 2968,   71,   71, 2971, 2972, 2964, 2966, 2973,   71,
+     2967, 2974,   71,   71, 2976, 2977,   71, 2969, 2981, 2975,
+     2978, 2979, 2980, 2983, 2984, 2982,   71, 2985, 2968, 2985,
+     2985, 2971, 2972,   71,   71, 2973, 2985, 2985,   71,   71,
+       71,   71,   71,   71,   71, 2981, 2975, 2978, 2979, 2980,
+       71,   71, 2982,   43,   43,   43,   43,   43,   43,   43,
+       48,   48,   48,   48,   48,   48,   48,   53,   53,   53,
+
+       53,   53,   53,   53,   59,   59,   59,   59,   59,   59,
+       59,   64,   64,   64,   64,   64,   64,   64,   74,   74,
+     2985,   74,   74,   74,   74,  141,  141, 2985, 2985, 2985,
+      141,  141,  143,  143, 2985, 2985,  143, 2985,  143,  145,
+     2985, 2985, 2985, 2985, 2985,  145,  148,  148, 2985, 2985,
+     2985,  148,  148,  150, 2985, 2985, 2985, 2985, 2985,  150,
+      152,  152, 2985,  152,  152,  152,  152,   75,   75, 2985,
+       75,   75,   75,   75,   13, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985
     } ;
 
-static const flex_int16_t yy_chk[8377] =
+static const flex_int16_t yy_chk[8542] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -2318,919 +2360,938 @@ static const flex_int16_t yy_chk[8377] =
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    3,    3,    3,    4,
         4,    4,    5,    5,    6,    6,    5,   28,    6,    7,
-        7,    7,    7, 2918,    7,    8,    8,    8,    8,   28,
+        7,    7,    7, 2991,    7,    8,    8,    8,    8,   28,
         8,    9,    9,    9,   10,   10,   10,   15,   21,   24,
 
-      979,   15,   30,    3,   28,  149,    4,   47,   47,    5,
-       19,    6,   19,   19,   30,   19,   72,    7,  147,   24,
+      999,   15,   30,    3,   28,  150,    4,   47,   47,    5,
+       19,    6,   19,   19,   30,   19,   72,    7,  148,   24,
        72,   19,   24,    8,   21,   21,   24,   29,    9,   30,
        25,   10,   11,   11,   11,   11,   11,   11,   12,   12,
        12,   12,   12,   12,   25,   33,   24,   35,   19,   29,
-       52,   33,   11,   52,   29,   22,   25,   25,   12,  146,
-       35,  144,   22,   63,   63,   26,   22,  141,  141,   22,
-       11,   25,   33,   26,   35,   77,   12,  142,   78,   11,
-       31,   22,   22,  262,   82,   12,   20,   20,   31,   22,
+       52,   33,   11,   52,   29,   22,   25,   25,   12,  147,
+       35,  145,   22,   63,   63,   26,   22,  142,  142,   22,
+       11,   25,   33,   26,   35,   77,   12,  143,   78,   11,
+       31,   22,   22,  265,   82,   12,   20,   20,   31,   22,
        20,   26,   26,   22,   31,   20,   22,   41,   31,   77,
 
        26,   78,   77,   68,   20,   78,   31,   31,   82,   41,
-       20,   82,  262,   20,   20,   31,   68,   20,   79,  125,
-       81,   31,   20,   27,   41,   31,   27,   81,   80,  140,
-       68,   20,   23,   27,  143,   27,   23,  143,   79,   23,
-       70,   23,   23,   80,   32,   79,   27,   81,   32,   64,
-       27,  125,   84,   27,   23,   80,   38,   90,   38,   23,
-       27,   84,   27,   23,   32,   90,   23,   38,   23,   23,
-       32,   32,   36,   38,   86,   32,   36,   85,   59,   84,
-      148,  148,   38,   38,   90,   38,   36,   86,   89,   36,
-       54,   32,   34,   89,   38,   85,   34,   92,   36,   36,
-
-       38,   86,   34,   36,   85,   34,   58,   39,   58,   58,
-       92,   58,   34,   36,   34,   89,   36,   39,   83,   34,
-       91,   39,   39,   34,   92,   53,   95,   48,   43,   34,
-       39,   83,   34,   40,   39,   95,  108,   40,   91,   34,
-       37,   40,   83,   37,   39,   83,   14,  170,   39,   39,
-       37,   13,   91,   95,   37,   37,  108,   96,   83,   40,
-       40,    0,   37,  108,   40,   91,   96,   37,   40,   42,
-       37,   42,   42,   66,   42,   66,   66,   37,   66,  170,
-       42,   37,   37,   69,   96,   69,   69,   71,   69,   71,
-       71,   74,   71,   74,   74,   87,   74,   93,   71,   88,
-
-       88,   87,   74,   87,   93,   94,   94,   99,   88,   98,
-        0,   66,   97,   94,  192,    0,   87,  102,  101,  971,
-       99,   94,   87,    0,   93,  102,   88,   88,   87,   74,
-       87,   98,   94,   94,   99,   97,   98,  103,  100,   97,
-       94,  100,  101,  104,  102,  106,  192,  104,  105,  971,
-      101,  110,  109,  105,  100,  100,  105,  103,  106,  103,
-      107,    0,  100,  104,  103,  100,  109,  104,  100,  101,
-      104,  110,  106,  114,  104,  105,  118,  111,  110,  109,
-      105,  100,  100,  107,  103,  112,  113,  107,  115,  116,
-      104,  111,  112,  116,  117,  113,  114,  115,  119,  120,
-
-      114,  117,  118,  118,  111,  119,  121,    0,  120,  122,
-      124,  116,  112,  113,  120,  115,  116,  122,  121,  123,
-      116,  117,  120,  126,  124,  119,  120,  127,  129,    0,
-      123,  128,    0,  121,  123,  120,  122,  124,  126,  129,
-      128,  120,  135,  123,  127,  131,  123,  127,  130,  132,
-      126,  131,  134,  127,  127,  129,  130,  123,  128,  133,
-      132,  123,  136,  138,  135,  139,    0,  134,  133,  135,
-      182,  127,  131,  137,  127,  130,  132,  136,  139,  134,
-      133,    0,  137,  182,  133,  138,  133,  153,  154,  136,
-      138,  145,  139,  145,  145,  133,  145,  182,  155,  150,
-
-      137,  150,  150,  151,  150,  151,  151,  133,  151,  156,
-      154,  153,  155,  157,  153,  154,  158,  159,  156,  160,
-      161,    0,  162,  158,  164,  157,  163,  165,  161,  235,
-      155,  164,    0,  159,  162,  158,  156,  168,  160,  155,
-      157,  151,  169,  158,  159,  165,  160,  161,  163,  162,
-      158,  164,  166,  163,  165,  167,  235,  167,  166,  168,
-      173,  177,  171,  179,  168,  174,  171,  175,  169,  169,
-      178,    0,  185,  174,  176,  180,  177,  178,  181,    0,
-      311,  185,  167,  171,  166,  166,  173,  173,  177,  175,
-      171,  179,  174,  171,  175,  179,  176,  178,  180,  185,
-
-      181,  176,  180,  183,  186,  181,  191,  311,    0,  184,
-      171,  172,  184,  187,    0,  183,  172,  191,  179,  189,
-        0,  172,    0,    0,  184,  195,  186,  172,  172,    0,
-      183,  186,  188,  191,  172,  187,  184,  188,  172,  184,
-      187,  189,  193,  172,  201,  190,  189,  197,  172,  188,
-      194,  188,  190,  196,  172,  172,  199,  195,  188,  188,
-      196,  194,  199,  198,  188,  200,  201,  202,  193,  193,
-      203,  201,  190,  204,  207,    0,  188,  198,  188,  197,
-      196,  207,  194,  199,  205,  206,  208,  209,  194,  210,
-        0,  211,  209,  204,    0,  198,  400,  200,  205,  202,
-
-      204,  207,  203,  212,  198,  211,  206,  208,  210,  213,
-      214,  205,  206,  208,  209,  215,  210,  216,  211,  217,
-      218,  221,  214,  400,  216,  212,  215,  213,  219,  218,
-      212,  222,  222,  220,  223,  225,  213,  214,  220,  228,
-      222,  217,  215,  224,  216,  227,  217,  218,  226,  229,
-      224,  219,  231,  221,  236,  219,  230,  225,  222,  222,
-      220,  232,  225,  234,  230,  227,  223,  233,  237,    0,
-      224,  228,  227,  226,  238,  226,  232,  236,  239,  243,
-      233,  229,  239,  230,  231,  240,  236,  241,  232,  234,
-      234,  238,    0,  247,  233,  242,  248,  245,  243,  238,
-
-      237,  238,  241,  242,  236,  239,  243,  240,  244,  246,
-      249,  250,  240,  246,  241,  244,  251,  252,  238,  245,
-      258,    0,  242,  256,  245,  247,  253,  259,  248,  252,
-      255,  254,  249,  250,  260,  244,  246,  249,  250,  253,
-      254,  261,  256,  255,  252,  257,  263,  257,  251,  264,
-      256,  259,  258,  253,  259,  263,  265,  255,  254,  260,
-      266,  260,  267,  269,  268,  271,  270,  261,  261,  273,
-        0,  266,  257,  263,  267,  264,  264,  274,  275,  272,
-      279,  277,  265,  265,  270,    0,  269,  266,  268,  267,
-      269,  268,  272,  270,  276,    0,  278,  271,  280,    0,
-
-      281,  273,  274,  284,  274,  280,  272,  277,  277,  281,
-      275,  276,  279,  282,  283,  285,  293,  276,  278,  282,
-      287,  276,  286,  278,  288,  280,  289,  281,  283,  284,
-      284,  286,  294,  288,    0,  290,  299,  291,  276,  285,
-      282,  283,  285,  287,  290,  292,  298,  287,  293,  286,
-      295,  288,  289,  289,  291,  298,  294,  297,  299,  294,
-      292,  291,  290,  299,  291,  295,  305,  320,  303,    0,
-      301,  305,  292,  298,  302,  297, 1083,  295,  300,  306,
-      300,  291,  296,  303,  297,  296,  304,  304,  302,    0,
-      296,  296,  296,  296,  301,  303,  300,  301,  305,  320,
-
-      296,  302,  300,  306, 1083,  300,  306,  300,  309,  296,
-      308,  304,  296,  304,  304,  310,  312,  296,  296,  296,
-      296,  307,  308,  300,  307,  315,  309,  313,  314,  316,
-      323,  307,  318,  310,  319,  309,  322,  308,  312,  318,
-      314,  317,  310,  312,  316,  324,  319,  315,  307,  317,
-      321,  307,  315,  313,  313,  314,  316,  321,  322,  318,
-      325,  319,  323,  322,  330,  327,  325,  324,  317,  331,
-      328,  326,  324,  326,    0,    0,    0,  321,  327,    0,
-      332,  329,  325,  328,    0,    0,  328,  325,  328,    0,
-      330,  330,  327,  325,  328,  326,  335,  328,  326,  329,
-
-      326,  331,  332,  335,  339,  336,  333,  332,  329,  337,
-      328,  336,  333,  328,  338,  328,  333,  339,  341,  345,
-      355,  337,  342,  335,  333,    0,  338,  355,  344,  347,
-      333,  339,  336,  333,  341,  342,  337,  345,  348,  333,
-      344,  338,  341,  333,  348,  341,  345,  355,  346,  342,
-      347,  333,  334,  346,  334,  344,  347,  350,  349,  351,
-      352,  341,  356,  353,  357,  348,  349,  334,  352,  350,
-      334,    0,  334,  357,  334,  356,  846,  351,  334,  334,
-      346,  334,  354,  354,  350,  349,  351,  352,    0,  356,
-      364,  359,    0,  361,  334,  353,  357,  334,  359,  334,
-
-      357,  334,  343,  343,  358,  361,  360,  846,  358,  354,
-      362,  363,  343,  360,  343,  343,  343,  366,  359,  343,
-      361,  365,  364,  363,  366,  367,  369,  343,  372,  343,
-      343,  358,  362,  360,  371,    0,  368,  362,  363,  343,
-      367,  343,  343,  343,  366,  371,  343,  365,  365,  368,
-      372,  370,  367,  370,  375,  372,  373,  373,  369,  374,
-      376,  371,  377,  368,  383,  375,  374,  379,    0,  380,
-      378,  376,  381,    0,  382,  377,  383,    0,  370,    0,
-      389,  375,  382,    0,  380,  373,  374,  376,  378,  377,
-      379,  383,  380,  384,  379,  378,  380,  378,  381,  381,
-
-      385,  382,  389,  386,  384,  388,  387,  389,  390,  385,
-      391,  380,  393,  392,  396,  378,  386,  387,  393,  387,
-      384,  394,    0,  388,  387,  398,  395,  385,  391,  399,
-      386,  390,  388,  387,  404,  390,  396,  391,  401,  393,
-      397,  396,  394,  399,  387,  392,  387,  397,  394,  395,
-      402,  398,  398,  395,  403,  405,  399,  406,    0,  411,
-      401,  408,  407,  409,  402,  401,  404,  397,  407,  406,
-        0,  410,  415,    0,  411,  418,    0,  402,  405,  410,
-      403,  403,  405,  408,  406,  409,  411,  412,  408,  407,
-      409,  413,  414,  416,  412,  417,  415,  410,  410,  415,
-
-      413,  418,  418,  419,  422,  420,  410,  414,  421,  422,
-      417,  420,  424,  429,  412,  425,  416,  426,  413,  414,
-      416,  425,  417,  427,  433,  419,  428,  434,  429,  436,
-      419,  422,  420,  428,  421,  421,  426,  433,  424,  424,
-      429,  427,  425,  431,  426,  431,  435,  432,  440,  437,
-      427,  433,  431,  428,  432,  438,  444,  442,  441,  434,
-      439,  436,    0,  439,  435,  441,  443,    0,  438,  444,
-      431,  437,  431,  435,  432,  445,  437,  448,    0,  439,
-      440,  442,  438,  444,  442,  441,  446,  439,  447,  443,
-      439,  446,  449,  450,  447,  451,  452,  445,  443,  456,
-
-      448,  453,  445,  459,  448,  450,  456,  452,  458,  453,
-      454,  459,  499,  446,  449,  447,  443,  451,    0,  449,
-      450,  457,  451,  452,  454,  460,  456,  461,  453,    0,
-      459,  458,    0,  457,  463,  458,  460,  454,  455,  499,
-      462,  466,    0,  455,  462,  455,  463,  464,  457,  465,
-      461,  455,  460,  455,  461,  468,  455,  455,    0,  466,
-      465,  463,  462,  455,  455,  455,  468,  462,  466,  464,
-      455,  462,  455,  469,  464,  467,  465,  470,  455,  471,
-      455,  470,  468,  455,  455,  467,  471,  472,  476,  473,
-      455,  473,  474,  475,  478,    0,  477,  469,    0,  483,
-
-      469,  488,  478,  476,  470,  475,  471,  467,  477,  480,
-      481,  483,  467,  472,  472,  476,  473,  479,  474,  474,
-      475,  478,  479,  477,  482,  484,  483,  486,  481,  490,
-      487,  480,  482,  488,  489,  491,  480,  481,  493,  494,
-      495,  490,  492,  491,  479,  486,  484,  504,  494,  489,
-      493,  482,  484,  487,  486,  492,  490,  487,  496,  497,
-      498,  489,  491,  495,  500,  493,  494,  495,  501,  492,
-      502,  504,  496,  503,  504,    0,  505,  507,  506,  498,
-      510,  515,  508,  501,  497,  496,  497,  498,  503,  505,
-      506,  510,  511,  513,  514,  501,  500,  511,  512,  507,
-
-      503,  509,  502,  505,  507,  506,  508,  510,  509,  508,
-      516,  509,  512,  515,  517,  518,  519,  521,  520,  509,
-      513,  514,  519,  522,  511,  512,  529,  523,  509,  524,
-      525,  522,  526,  534,    0,  509,  526,  516,  509,  521,
-      527,  517,  520,  519,  521,  520,  523,  518,  527,  528,
-      522,  530,  525,  524,  523,  531,  524,  525,  529,  526,
-      536,  532,  533,  535,  531,  534,  539,  527,  538,  533,
-      537,  540,  528,  536,  530,  537,  528,  538,  530,  537,
-      540,  541,  531,  532,  546,  535,    0,  536,  532,  533,
-      535,  542,  539,  539,  537,  538,  543,  537,  540,  544,
-
-      548,  547,  537,  541,  553,    0,  537,  549,  541,  543,
-      550,  544,  551,  542,    0,  553,  546,    0,  542,  547,
-      552,  555,  559,  543,  548,    0,  544,  548,  547,  549,
-      549,  553,  550,  557,  549,  554,  551,  550,  556,  551,
-      560,  555,  552,  558,  554,  561,  562,  552,  555,  559,
-      558,  563,  556,  561,  566,  557,  549,  562,  560,  564,
-      557,  565,  554,  567,  569,  556,    0,  560,  573,  563,
-      558,  571,  561,  562,  564,  566,  568,  568,  563,  570,
-      571,  566,  572,  575,  576,  574,  564,  567,  569,  578,
-      567,  569,  577,  565,  578,  572,  579,  582,  571,  580,
-
-      573,  570,  587,  585,  584,  568,  570,  574,  576,  572,
-      579,  576,  574,  580,  577,  575,  581,  581,  586,  577,
-      583,  578,  584,  579,  581,  585,  580,  589,  583,  582,
-      585,  584,  590,  586,  587,  588,  592,  590,  592,  591,
-      594,    0,  586,  581,  581,  586,  593,  583,  594,  589,
-      588,  595,  596,  601,  589,    0,  603,  602,    0,  597,
-      586,  596,  588,  592,  590,  591,  591,  594,  597,  599,
-        0,  593,  598,  593,  603,  600,  595,  599,  595,  596,
-      602,  598,  600,  603,  602,  601,  597,  607,  604,  605,
-      608,  610,  609,  611,  606,  607,  599,  612,  616,  598,
-
-      604,  605,  600,  606,  609,  608,  611,  616,  615,    0,
-      613,    0,  612,  621,  607,  604,  605,  608,  613,  609,
-      611,  606,  614,  610,  612,  616,  621,  617,  620,  623,
-      614,  615,  618,  619,  619,  615,  620,  613,  617,  622,
-      621,  618,  619,  624,  626,  627,  625,  628,    0,  614,
-      630,  624,  623,  632,  617,  620,  623,  626,  628,  618,
-      619,  619,  625,  631,  630,  622,  622,  627,  629,  633,
-      624,  626,  627,  625,  628,  632,  629,  630,  634,  635,
-      632,  638,  636,  631,  637,  639,  650,  641,    0,  633,
-      631,  636,  640,  642,  643,  629,  633,    0,  639,  638,
-
-      634,  635,  641,  644,  637,  634,  635,  646,  638,  636,
-      640,  637,  639,  650,  641,  642,  645,  652,  643,  640,
-      642,  643,  649,  647,  648,  646,  644,  653,  649,  645,
-      644,  651,  655,  656,  646,  647,  660,  648,  660,  651,
-      655,  657,    0,  645,  652,  653,  658,  659,  657,  649,
-      647,  648,  661,  662,  653,  665,  663,  651,  651,  655,
-      664,  661,  659,  660,  665,  656,  651,  677,  657,  658,
-      666,  667,  666,  658,  659,  663,    0,  670,  667,  661,
-      664,  673,  665,  663,  676,  662,    0,  664,  677,  670,
-      678,  673,  679,  682,  677,    0,  680,  666,  667,  668,
-
-        0,  678,  676,  668,  670,  681,  668,  685,  673,  682,
-      686,  676,  684,  668,  685,  679,  668,  678,  683,  679,
-      682,  668,  680,  680,  692,  684,  668,  683,  688,  689,
-      668,  681,  681,  668,  685,  689,    0,    0,  693,  684,
-      668,  694,  686,  668,  690,  683,  687,  687,  692,  687,
-      688,  692,  687,  690,  695,  688,  689,  687,  691,  699,
-      691,  694,  697,  687,  687,  693,  696,    0,  694,  701,
-      698,  690,  687,  687,  687,    0,  687,  700,  696,  687,
-      695,  695,  704,  699,  687,  691,  699,  702,  697,  697,
-      687,  687,  698,  696,  701,  703,  701,  698,  706,  700,
-
-      705,  707,  702,  703,  700,  704,  706,  705,  708,  704,
-      711,  709,  712,  710,  702,  713,  715,  717,    0,  714,
-      707,  712,  703,  709,  714,  706,  710,  705,  707,  716,
-      713,  720,  721,  722,  708,  708,  711,  711,  709,  712,
-      710,  723,  713,  724,  717,  718,  714,  725,  715,  726,
-      718,  716,  728,  720,  727,  729,  716,  731,  720,  730,
-      733,  732,  735,  723,  721,  722,  731,    0,  723,  738,
-      726,  725,  736,  727,  725,  724,  726,  718,  730,  728,
-      733,  727,  729,  732,  731,  734,  730,  733,  732,  735,
-      736,  737,  739,  734,  743,  741,  742,  744,  746,  736,
-
-      739,  738,  745,  748,  747,  748,  749,    0,  753,    0,
-      737,  753,  734,  741,  742,  744,  743,  747,  737,  739,
-      746,  743,  741,  742,  744,  746,  745,  750,  751,  745,
-      748,  747,  749,  749,  752,  753,  751,  757,  754,  750,
-        0,  756,  758,  760,  761,  759,  754,    0,  758,  760,
-      762,  761,  752,  763,  750,  751,  764,  762,  763,  767,
-      765,  752,  754,  764,  757,  754,  756,  759,  756,  758,
-      760,  761,  759,  754,  770,  766,  768,  762,  765,  766,
-      763,  769,  767,  764,  772,  768,  767,  765,  773,  769,
-      777,  771,  774,  775,  776,  778,  773,  779,  780,  772,
-
-        0,    0,  766,  768,  779,  774,  770,  776,  769,  771,
-      782,  772,  777,  787,  775,  773,  780,  777,  771,  774,
-      775,  776,  778,  781,  779,  780,  783,  784,  785,  782,
-      781,  786,  784,  783,  788,  789,  785,  782,  786,  790,
-      791,  792,  793,  794,  795,  787,  790,  788,  798,  799,
-      781,  794,  795,  783,  784,  785,  796,  797,  786,  795,
-      803,  788,  800,  797,  805,  793,  790,  789,  801,  793,
-      794,  795,  791,  792,  798,  798,  802,  801,  796,  795,
-      804,  799,  807,  796,  797,  806,  800,  804,  808,  800,
-      802,  805,  803,  809,  806,  801,  810,    0,  811,  814,
-
-      815,  812,    0,  802,  807,  809,  812,  804,  815,  807,
-      813,  817,  806,  826,  817,  808,  818,  813,  823,  810,
-      809,  814,  825,  810,  811,  811,  814,  815,  812,  818,
-      821,  824,  820,    0,  825,    0,  821,  813,  817,  820,
-      826,    0,  828,  818,  823,  823,    0,    0,  827,  825,
-      827,  833,  829,    0,  824,  831,  833,  821,  824,  820,
-      822,  830,  822,  832,  829,  828,  822,  834,  822,  828,
-      843,  844,    0,  822,  830,  827,  832,  831,  822,  829,
-      834,  835,  831,  833,  822,  836,    0,  822,  830,  822,
-      832,  837,  838,  822,  834,  822,  839,  836,  841,  842,
-
-      822,  837,  843,  844,  835,  822,  845,  847,  835,  839,
-      840,  841,  836,  837,  838,  850,  840,  848,  837,  838,
-      842,  849,  848,  839,  850,  841,  842,    0,  837,  849,
-      852,  853,    0,  845,  854,    0,  855,  840,  856,  847,
-        0,    0,  850,    0,  848,  852,  859,  854,  849,  851,
-      857,  855,  858,  853,  851,  862,  851,  852,  853,  859,
-      866,  854,  851,  855,  856,  856,  865,  851,  851,  863,
-      860,  858,  857,  859,  851,  851,  851,  857,  860,  858,
-      861,  851,  862,  851,  866,  867,  868,  866,  861,  851,
-      869,  872,  863,  867,  851,  851,  863,  860,  865,  870,
-
-      868,  851,  871,  874,  875,  873,  876,  861,  877,  872,
-      871,    0,  867,  868,  874,  878,  877,    0,  872,  885,
-      879,  870,  869,  873,  876,  880,  870,  879,  882,  871,
-      874,  883,  873,  876,  881,  877,  875,  878,  880,  884,
-      885,  881,  878,  882,  886,  887,  885,  879,  889,  883,
-      904,  891,  880,  892,  886,  882,  894,  884,  883,  889,
-      892,  881,  893,  895,  891,  897,  884,  896,    0,  894,
-      893,  886,  895,  898,  901,  889,  903,  887,  891,  896,
-      892,  902,  904,  894,  905,  910,  907,  897,  908,  893,
-      895,    0,  897,  908,  896,  898,  901,  907,  905,  902,
-
-      898,  901,  903,  903,  909,  911,  913,  909,  902,  910,
-      912,  905,  910,  907,  914,  913,  916,  912,  911,  917,
-      908,  918,    0,  915,    0,  919,  917,    0,  914,  921,
-      909,  909,  911,  913,  909,  915,  920,  912,  922,  924,
-      925,  914,  920,  923,  926,  931,  917,  928,  916,  919,
-      915,  921,  919,  918,  923,  930,  921,  932,  929,  926,
-      922,  924,  925,  920,  934,  922,  924,  925,  928,  929,
-      923,  926,  933,  934,  928,    0,  930,  931,  935,    0,
-      936,  938,  930,  937,  932,  929,  939,  940,  942,  938,
-      933,  934,  937,  939,  943,  941,  944,  945,    0,  933,
-
-      947,  951,  935,  946,  953,  935,  936,  936,  938,  941,
-      937,  940,  949,  939,  940,  952,  957,  954,  944,  945,
-      942,  949,  941,  944,  945,  946,  943,  950,  955,  956,
-      946,  953,  947,  951,  950,  954,  958,  952,  956,  949,
-      957,  959,  952,  957,  954,  962,  955,  961,  963,  960,
-      964,  966,  965,  962,  950,  955,  956,  959,  960,  967,
-      958,  968,  961,  958,  965,  978,  970,  973,  959,  968,
-      969,    0,  962,  966,  961,  972,  960,  985,  966,  965,
-      963,  970,  964,  969,  972,  973,  967,  974,  968,  975,
-      977,  975,  978,  970,  973,  974,  980,  969,  977,  981,
-
-      982,  984,  972,  983,  985,  986,  987,  988,    0,  980,
-        0,  981,  986,  989,  974,  982,  975,  977,  990,  984,
-      991,  992,  994,  980,  993,  983,  981,  982,  984,  995,
-      983, 1001,  986,  997,  992,  989,    0,  993,  987,  988,
-      989,  995,  991,  990,  994,  990,  996,  991,  992,  994,
-      998,  993, 1002,  997,  996,  999,  995, 1003, 1001, 1004,
-      997, 1006,  998,  999, 1005, 1002, 1003, 1007, 1006, 1009,
-     1010, 1004,    0,  996, 1012, 1013, 1007,  998, 1007, 1002,
-     1011, 1007,  999,    0, 1003, 1005, 1004, 1012, 1006, 1007,
-     1016, 1005, 1010, 1015, 1007, 1009, 1009, 1010, 1017, 1013,
-
-     1011, 1012, 1013, 1007, 1014, 1007, 1017, 1011, 1007, 1022,
-     1018, 1015, 1016, 1014, 1019, 1020, 1023, 1016, 1024, 1025,
-     1015, 1028, 1026, 1020, 1027, 1017, 1025, 1031,    0,    0,
-     1019, 1014, 1018,    0,    0, 1031, 1022, 1018, 1023, 1028,
-     1024, 1019, 1020, 1023, 1026, 1024, 1025, 1027, 1028, 1026,
-     1029, 1027, 1030, 1032, 1031, 1033, 1034, 1035, 1036, 1037,
-     1038, 1040, 1029, 1045, 1030, 1037, 1036, 1033, 1032, 1038,
-     1039, 1041, 1035, 1040, 1042, 1043, 1034, 1029, 1041, 1030,
-     1032, 1042, 1033, 1034, 1035, 1036, 1037, 1038, 1040, 1047,
-     1046, 1039, 1048, 1043, 1050, 1045, 1049, 1039, 1041, 1048,
-
-     1051, 1042, 1043, 1046, 1052, 1051,    0, 1053, 1047, 1050,
-     1054, 1057, 1052, 1055, 1059, 1058, 1047, 1046, 1049, 1048,
-     1053, 1050, 1063, 1049, 1054, 1057, 1060,    0,    0, 1061,
-     1062, 1052, 1051, 1058, 1053, 1066,    0, 1054, 1057, 1055,
-     1055, 1056, 1058, 1064, 1056, 1056, 1059, 1065, 1062, 1056,
-        0, 1061, 1060, 1060, 1063, 1056, 1061, 1062, 1067, 1056,
-     1070, 1066, 1066, 1056, 1067, 1064, 1068, 1070, 1056, 1065,
-     1064, 1056, 1056, 1069, 1065, 1069, 1056, 1072, 1075, 1071,
-     1076, 1074, 1056, 1073, 1077, 1067, 1056, 1070, 1071, 1076,
-     1073, 1075, 1068, 1068, 1078, 1072, 1079, 1069, 1080,    0,
-
-     1069, 1084, 1069, 1074, 1072, 1075, 1071, 1076, 1074,    0,
-     1073,    0,    0, 1082, 1086, 1088, 1077, 1084, 1079, 1087,
-        0, 1080, 1092, 1079, 1088, 1080, 1078, 1081, 1084, 1089,
-     1090, 1087, 1081,    0, 1081, 1090, 1081, 1086, 1081, 1082,
-     1082, 1086, 1088, 1091, 1092, 1081, 1087, 1089, 1091, 1092,
-     1094, 1093, 1095, 1097, 1081,    0, 1089,    0, 1096, 1081,
-     1095, 1081, 1090, 1081, 1093, 1081, 1096, 1099, 1094, 1098,
-     1091, 1100, 1097, 1101, 1102, 1104, 1105, 1094, 1093, 1095,
-     1097, 1106, 1098, 1102, 1100, 1096, 1103, 1107, 1103, 1099,
-     1108, 1101, 1110, 1106, 1099, 1114, 1098, 1104, 1100, 1111,
-
-     1101, 1102, 1104, 1105, 1112, 1113, 1116, 1118, 1106, 1117,
-     1144, 1115, 1112, 1103, 1107, 1108, 1110, 1108, 1115, 1110,
-     1121, 1111, 1114, 1113, 1119, 1123, 1111, 1126, 1125, 1118,
-     1119, 1112, 1113, 1116, 1118, 1117, 1117, 1120, 1115, 1122,
-     1127, 1124, 1144, 1120, 1128, 1126, 1122, 1121, 1124, 1123,
-     1125, 1119, 1123, 1128, 1126, 1125, 1130, 1131, 1134, 1132,
-     1133,    0, 1137,    0, 1120, 1127, 1122, 1127, 1124, 1131,
-     1135, 1128, 1136, 1138, 1145, 1147, 1141, 1134, 1156,    0,
-     1130, 1132, 1133, 1130, 1131, 1134, 1132, 1133, 1137, 1137,
-     1140, 1142, 1135, 1139, 1136, 1138, 1141, 1135, 1148, 1136,
-
-     1138, 1146, 1139, 1141, 1149, 1142, 1145, 1147, 1150, 1151,
-     1156, 1140, 1149, 1157, 1152, 1154, 1148, 1140, 1142, 1158,
-     1139, 1152, 1154, 1146, 1150, 1148, 1155, 1160, 1146, 1165,
-     1155, 1149,    0, 1163, 1164, 1150, 1151, 1161, 1165, 1166,
-     1158, 1152, 1154, 1161, 1162, 1157, 1158, 1164, 1163, 1169,
-     1161, 1162, 1168, 1155, 1168, 1167, 1165, 1171, 1169, 1160,
-     1163, 1164, 1167, 1170, 1161, 1166, 1166, 1173, 1172, 1175,
-     1161, 1162, 1172, 1176, 1177, 1178, 1169, 1175, 1176, 1168,
-     1179, 1187, 1167, 1177, 1171, 1170, 1181, 1180, 1186, 1173,
-     1170, 1184,    0, 1178, 1173, 1172, 1175, 1185, 1181, 1179,
-
-     1180, 1177, 1178, 1182, 1187, 1176, 1182, 1179, 1187, 1183,
-     1185, 1188, 1183, 1181, 1180, 1182, 1184, 1189, 1184, 1191,
-     1186, 1190, 1190, 1192, 1185, 1189, 1193, 1188, 1191, 1194,
-     1182, 1183, 1200, 1182, 1195, 1193, 1183, 1201, 1188, 1183,
-     1198, 1195, 1197, 1199, 1189, 1192, 1191, 1204, 1190, 1198,
-     1192, 1194, 1199, 1193, 1202, 1197, 1194, 1203, 1200, 1200,
-     1201, 1195, 1205, 1202, 1201, 1203, 1206, 1198, 1208, 1197,
-     1199, 1209, 1207,    0, 1206, 1211, 1212, 1205, 1210, 1204,
-     1208, 1202, 1213, 1209, 1203, 1207, 1210, 1216, 1215, 1205,
-     1218, 1214, 1221, 1206, 1222, 1208, 1212, 1211, 1209, 1207,
-
-     1214, 1220, 1211, 1212, 1213, 1210, 1215, 1217, 1226, 1213,
-     1219, 1218, 1223, 1216, 1216, 1215, 1219, 1218, 1214, 1217,
-     1224, 1227, 1228, 1220, 1221, 1232, 1222, 1229, 1220, 1230,
-        0, 1231, 1250, 1233, 1217, 1226, 1229, 1219, 1223, 1223,
-     1228, 1236, 1230, 1231, 1227, 1232, 1224, 1224, 1227, 1228,
-     1234, 1235, 1232, 1237, 1229, 1242, 1230, 1234, 1231, 1233,
-     1233, 1238, 1239, 1236, 1250, 1241, 1237, 1239, 1236, 1238,
-     1235, 1240, 1241, 1245, 1246, 1243, 1240, 1234, 1235, 1244,
-     1237, 1242, 1242, 1243,    0, 1247, 1249, 1244, 1238, 1251,
-     1248, 1245, 1241, 1247, 1239, 1249, 1246, 1248, 1252, 1252,
-
-     1245, 1246, 1243, 1240, 1253, 1255, 1244, 1254, 1256,    0,
-     1257, 1251, 1247, 1249, 1258, 1254, 1251, 1248, 1257, 1259,
-     1260, 1263, 1258, 1264, 1262, 1252, 1255, 1259, 1260, 1261,
-     1262, 1265, 1255, 1263, 1254, 1267, 1253, 1257, 1266, 1268,
-     1256, 1258, 1261, 1270, 1269, 1271, 1259, 1260, 1263, 1264,
-     1264, 1262, 1275, 1266, 1272, 1265, 1261, 1270, 1265,    0,
-     1273, 1268, 1267, 1271, 1273, 1266, 1268, 1269, 1272, 1279,
-     1270, 1269, 1271, 1277, 1275, 1278, 1276, 1273,    0, 1275,
-     1277, 1272, 1287, 1280, 1281, 1273, 1278, 1273, 1276, 1282,
-     1283, 1273, 1284, 1288, 1286, 1295, 1279, 1294, 1285, 1284,
-
-     1277, 1286, 1278, 1276, 1273, 1280, 1281, 1285, 1293, 1290,
-     1280, 1281, 1282, 1283, 1287, 1298, 1282, 1283, 1290, 1284,
-     1288, 1286, 1292, 1294, 1294, 1285, 1296, 1295, 1292, 1301,
-     1293, 1300, 1302, 1296, 1303, 1293, 1290, 1306, 1305, 1307,
-        0, 1308, 1298, 1302, 1306, 1303, 1310, 1312, 1309, 1292,
-     1314,    0, 1310, 1296,    0, 1300, 1301, 1307, 1300, 1302,
-     1309, 1303, 1305, 1311, 1306, 1305, 1307, 1308, 1308, 1312,
-     1313, 1311, 1315, 1310, 1312, 1309, 1314, 1314, 1317, 1316,
-     1317, 1315, 1318, 1313, 1320, 1319, 1323, 1328, 1321, 1322,
-     1311, 1316, 1326, 1320, 1324, 1325,    0, 1313, 1319, 1315,
-
-     1329, 1322, 1325, 1328, 1331, 1317, 1316, 1333, 1318, 1318,
-     1321, 1320, 1319, 1323, 1328, 1321, 1322, 1324, 1326, 1326,
-     1327, 1324, 1325, 1329, 1330, 1327, 1331, 1329, 1334, 1335,
-     1340, 1331, 1330, 1337, 1333, 1336, 1336, 1334, 1338,    0,
-     1338, 1339, 1335, 1336,    0,    0, 1337, 1327, 1344,    0,
-     1347, 1330, 1340, 1343, 1341, 1334, 1335, 1340, 1346, 1342,
-     1337, 1341, 1336, 1336, 1353, 1338, 1342, 1339, 1339, 1345,
-     1344, 1343, 1347, 1348, 1350, 1344, 1345, 1347,    0,    0,
-     1343, 1341, 1349, 1346, 1352, 1346, 1342, 1354, 1357, 1349,
-     1358, 1353, 1355, 1358, 1359, 1354, 1345, 1352, 1360, 1361,
-
-     1369,    0,    0,    0, 1364, 1348, 1350, 1362, 1366, 1349,
-     1357, 1352, 1361, 1355, 1354, 1357, 1362, 1358, 1363, 1355,
-     1359, 1359, 1365, 1366, 1360, 1360, 1361, 1374, 1364, 1367,
-     1363, 1364, 1369, 1370, 1362, 1366, 1367, 1368, 1375, 1371,
-     1368, 1372, 1373, 1379, 1373, 1363,    0, 1377, 1365, 1365,
-     1376, 1374, 1368,    0, 1374, 1370, 1367, 1371, 1378, 1380,
-     1370, 1368, 1381, 1372, 1368, 1386, 1371, 1368, 1372, 1373,
-     1375, 1382, 1376, 1377, 1377, 1379, 1381, 1376, 1385, 1368,
-     1382, 1380, 1383, 1387, 1378, 1378, 1380, 1384, 1389, 1381,
-     1383, 1388, 1390,    0, 1384, 1391, 1390, 1386, 1382, 1392,
-
-     1395, 1393, 1385, 1394, 1396, 1385,    0, 1395, 1397, 1383,
-     1399, 1396, 1394, 1388, 1384, 1387, 1398, 1391, 1388, 1390,
-     1389, 1397, 1391, 1393, 1400, 1399, 1392, 1395, 1393, 1398,
-     1394, 1396, 1401, 1402, 1403, 1397, 1404, 1399, 1400, 1405,
-     1402, 1403, 1407, 1398, 1411, 1405, 1408, 1416, 1409, 1404,
-     1410, 1400, 1412, 1408, 1413,    0, 1411, 1413, 1414, 1416,
-     1402, 1403, 1415, 1404, 1401, 1412, 1405, 1414, 1417, 1407,
-     1409, 1411,    0, 1408, 1416, 1409, 1410, 1410, 1424, 1412,
-     1415, 1413, 1419, 1418, 1425, 1414, 1418, 1421, 1417, 1415,
-     1426, 1427, 1421, 1419, 1423, 1417, 1423, 1441, 1428, 1421,
-
-     1429, 1418, 1424, 1430, 1432, 1424, 1427, 1428, 1431, 1419,
-     1418, 1425, 1432, 1418, 1421, 1433, 1434, 1426, 1427, 1421,
-     1435, 1423, 1431, 1436, 1429, 1428, 1437, 1429, 1435, 1441,
-     1430, 1432, 1438, 1439, 1436, 1431, 1439, 1433, 1434, 1440,
-     1438, 1442, 1433, 1434, 1437, 1443, 1445, 1435, 1444, 1448,
-     1436, 1439, 1443, 1437, 1446, 1445, 1451, 1440, 1447, 1438,
-     1439, 1452, 1444, 1439, 1448, 1451, 1440, 1446, 1442, 1447,
-     1456, 1453, 1443, 1445, 1454, 1444, 1448, 1450, 1455, 1450,
-     1458, 1446, 1453, 1451, 1456, 1447, 1460, 1452, 1452, 1458,
-     1457, 1464, 1454, 1457, 1461, 1460, 1456, 1456, 1453, 1461,
-
-     1455, 1454, 1463, 1459, 1450, 1455, 1466, 1458, 1457, 1459,
-     1465, 1456, 1467, 1460, 1468, 1463, 1469, 1457, 1470, 1465,
-     1457, 1474, 1473, 1464, 1472, 1477, 1461, 1479, 1475, 1463,
-     1459, 1472, 1476, 1466,    0, 1473, 1468, 1465, 1476, 1470,
-     1490, 1468, 1475, 1483, 1467, 1470, 1479, 1485, 1469, 1473,
-     1481, 1472, 1482, 1474, 1479, 1475, 1476, 1477, 1481, 1476,
-     1482, 1485, 1483, 1484, 1486, 1476, 1489, 1487, 1491, 1488,
-     1483, 1492, 1490, 1497, 1485, 1494, 1493, 1481, 1486, 1482,
-     1487, 1484, 1488, 1493, 1494, 1492, 1500, 1489, 1502, 1495,
-     1484, 1486, 1496, 1489, 1487, 1500, 1488, 1495, 1492, 1498,
-
-     1491, 1499, 1494, 1493, 1498, 1497, 1496, 1504,    0, 1505,
-     1503, 1506, 1499, 1500, 1489, 1502, 1495, 1503, 1507, 1496,
-     1509, 1508, 1512, 1511, 1509,    0, 1498, 1514, 1499, 1516,
-     1504, 1505, 1523, 1506, 1504, 1511, 1505, 1503, 1506, 1508,
-     1507, 1518, 1514, 1513, 1515, 1507, 1517, 1509, 1508, 1512,
-     1511, 1513, 1515, 1526, 1514, 1521, 1516, 1519, 1522, 1517,
-     1520, 1518, 1524, 1521, 1523, 1522, 1527, 1525, 1518, 1529,
-     1513, 1515, 1519, 1517, 1526, 1520, 1525, 1524, 1528, 1531,
-     1526, 1532, 1521, 1533, 1519, 1522, 1534, 1520,    0, 1524,
-     1537, 1536, 1535, 1527, 1525, 1539, 1529, 1538,    0, 1532,
-
-     1539, 1531, 1528, 1540, 1538, 1528, 1531, 1535, 1532, 1542,
-     1543, 1541, 1540, 1534, 1537, 1533, 1536, 1537, 1536, 1535,
-     1541, 1545, 1539, 1546, 1538, 1544, 1547, 1548, 1543, 1549,
-     1540, 1542, 1550, 1545, 1548, 1551, 1542, 1543, 1541, 1547,
-     1544, 1549, 1558, 1552, 1547, 1546, 1554, 1553, 1545, 1552,
-     1546, 1555, 1544, 1547, 1548, 1553, 1549, 1554, 1555, 1550,
-     1556, 1559, 1557, 1560, 1557, 1561, 1547, 1551, 1558, 1558,
-     1552, 1562, 1561, 1554, 1553, 1557, 1563, 1564, 1555, 1566,
-     1565, 1568, 1567, 1564, 1569, 1556, 1565, 1556, 1559, 1557,
-     1560, 1557, 1561, 1571, 1573, 1574, 1575, 1574, 1562, 1578,
-
-     1576, 1572, 1563, 1563, 1564, 1567, 1566, 1565, 1569, 1567,
-     1572, 1569, 1577, 1568, 1579, 1579, 1579, 1580, 1582,    0,
-     1575, 1579, 1574, 1575, 1580, 1571, 1573, 1576, 1572, 1579,
-     1581, 1578, 1586, 1583, 1590, 1589, 1587, 1581, 1577, 1577,
-     1583, 1579, 1579, 1579, 1580, 1586, 1585, 1589, 1579, 1588,
-     1582, 1585, 1591, 1594, 1595, 1595, 1596, 1581, 1599, 1586,
-     1583, 1587, 1589, 1587, 1592, 1588, 1590, 1593, 1597, 1598,
-     1591, 1592, 1600, 1593, 1598, 1597, 1588, 1604, 1585, 1591,
-     1594, 1595, 1596, 1596, 1599, 1599, 1601, 1605, 1606, 1605,
-     1608, 1592, 1609, 1601, 1593, 1597, 1598, 1610, 1609, 1600,
-
-     1611, 1612,    0, 1614, 1604, 1617, 1606, 1612, 1608, 1613,
-     1616, 1616, 1622, 1601, 1605, 1606, 1615, 1608, 1621, 1609,
-     1625, 1613, 1619, 1614, 1618, 1618, 1624, 1611, 1612, 1610,
-     1614, 1617, 1617, 1619, 1615, 1623, 1613, 1616, 1626, 1627,
-     1621, 1628, 1623, 1615, 1622, 1621, 1624, 1629, 1630, 1619,
-     1631, 1618, 1625, 1624, 1632, 1630, 1633, 1637, 1631, 1635,
-     1635, 1636, 1623, 1628, 1634, 1629, 1627, 1639, 1628, 1632,
-     1626, 1638,    0, 1634, 1629, 1630, 1640, 1631, 1638, 1639,
-     1633, 1632, 1647, 1633, 1644, 1643, 1635, 1636, 1636, 1637,
-     1642, 1634, 1640, 1643, 1639, 1648, 1644, 1642, 1638, 1640,
-
-     1646, 1650, 1649, 1640, 1653, 1647, 1656, 1651, 1646, 1647,
-     1652, 1644, 1643, 1657, 1656, 1652, 1648, 1642, 1654, 1640,
-     1649, 1660, 1648, 1655, 1654, 1658, 1652, 1646, 1650, 1649,
-     1651, 1653, 1658, 1656, 1651, 1657, 1655, 1652, 1662, 1659,
-     1657, 1663, 1652, 1661, 1665, 1654, 1659, 1664, 1670, 1671,
-     1655, 1667, 1658, 1660, 1672, 1661, 1668, 1669, 1673, 1672,
-     1662, 1668, 1674, 1678, 1669, 1662, 1659, 1665, 1663, 1667,
-     1661, 1665, 1668, 1664, 1664, 1670, 1671, 1676, 1667, 1675,
-     1675, 1677, 1680, 1668, 1669, 1682, 1672, 1681, 1668, 1683,
-     1673, 1683, 1684, 1685, 1674, 1678, 1677, 1680, 1685, 1676,
-
-     1682, 1686, 1687, 1689, 1676, 1690, 1675, 1693, 1677, 1680,
-     1681, 1695, 1682, 1690, 1681, 1691, 1683, 1687, 1689, 1694,
-     1685, 1696, 1698, 1699, 1684, 1700, 1713,    0, 1697, 1687,
-     1689, 1693, 1690, 1686, 1693, 1697, 1701, 1691, 1695, 1704,
-     1702, 1706, 1691, 1708, 1699, 1694, 1694, 1700, 1696, 1707,
-     1699, 1712, 1700, 1713, 1698, 1697, 1710, 1701, 1702, 1711,
-     1715, 1704, 1714, 1701, 1707, 1706, 1704, 1702, 1706, 1708,
-     1708, 1710, 1716, 1712, 1711, 1717, 1707, 1718, 1712, 1719,
-     1714, 1720, 1715, 1710, 1718, 1721, 1711, 1715, 1722, 1714,
-     1720, 1723, 1724, 1721, 1716, 1730, 1725, 1719, 1728, 1716,
-
-        0, 1729, 1717, 1727, 1718, 1732, 1719, 1728, 1720, 1725,
-     1738, 1722, 1721, 1723, 1727, 1722, 1731, 1734, 1723, 1729,
-     1732, 1730, 1730, 1725, 1724, 1728, 1735, 1733, 1729, 1727,
-     1727, 1740, 1732, 1733, 1731, 1741, 1742, 1738, 1744, 1734,
-     1735, 1727, 1746, 1731, 1734, 1748, 1741, 1742, 1745, 1747,
-     1744, 1750, 1749, 1735, 1733, 1740,    0,    0, 1740, 1747,
-     1753, 1745, 1741, 1742, 1751, 1744, 1754,    0, 1755,    0,
-     1756, 1748, 1748, 1754, 1746, 1745, 1747, 1749, 1750, 1749,
-     1753, 1758, 1767, 1751, 1757, 1759, 1760, 1753, 1756, 1763,
-     1757, 1751, 1762, 1754, 1755, 1755, 1758, 1756, 1761, 1761,
-
-     1759, 1760, 1763, 1766, 1762, 1771, 1768, 1765, 1758, 1767,
-     1763, 1757, 1759, 1760, 1765, 1768, 1763, 1769, 1766, 1762,
-     1774, 1770, 1776, 1778, 1769, 1761, 1775, 1771, 1772, 1763,
-     1766, 1776, 1771, 1768, 1765, 1772, 1777, 1782, 1780, 1783,
-        0, 1790, 1774, 1778, 1769, 1770, 1782, 1774, 1770, 1776,
-     1778, 1775, 1784, 1775, 1786, 1772, 1780, 1783, 1777, 1785,
-     1788, 1789, 1786, 1777, 1782, 1780, 1783, 1784, 1790, 1791,
-     1791, 1792, 1793, 1794, 1789,    0, 1797,    0, 1798, 1784,
-     1795, 1786, 1796, 1797, 1785, 1788, 1785, 1788, 1789, 1799,
-     1800, 1796, 1804, 1792, 1801, 1794, 1791, 1793, 1792, 1793,
-
-     1794, 1805, 1795, 1797, 1800, 1804, 1803, 1795, 1806, 1796,
-     1798, 1799, 1807, 1801, 1803, 1808, 1799, 1800, 1809, 1804,
-        0, 1801, 1808,    0, 1807, 1810, 1811, 1813, 1805, 1812,
-     1814,    0, 1815, 1803, 1806, 1806, 1816, 1812,    0, 1807,
-     1820,    0, 1808, 1817, 1819, 1814, 1820, 1810, 1812, 1863,
-     1809, 1811, 1810, 1811, 1813, 1821, 1812, 1814, 1815, 1815,
-     1821, 1817, 1816, 1816, 1812, 1818, 1822, 1820, 1818, 1819,
-     1817, 1819, 1826, 1823, 1825, 1827, 1829, 1832, 1830,    0,
-     1831, 1863, 1833, 1818, 1822, 1830, 1864, 1821, 1823, 1825,
-     1829, 1833, 1818, 1822, 1826, 1818,    0, 1827, 1831, 1826,
-
-     1823, 1825, 1827, 1829, 1832, 1830, 1834, 1831, 1835, 1833,
-     1836, 1839, 1837, 1840, 1841, 1834, 1844,    0, 1864, 1835,
-     1842, 1841, 1843, 1836, 1837, 1849, 1839, 1850, 1840, 1855,
-        0, 1850, 1847, 1834, 1844, 1835, 1851, 1836, 1839, 1837,
-     1840, 1841, 1842, 1844, 1843, 1847, 1849, 1842, 1851, 1843,
-     1854, 1852, 1849, 1847, 1850, 1853, 1855, 1853, 1856, 1847,
-     1852, 1857, 1858, 1851, 1859, 1861,    0, 1866, 1854, 1862,
-     1858, 1860, 1847, 1865, 1862, 1870, 1856, 1854, 1852, 1861,
-     1877, 1871, 1853, 1867, 1873, 1856, 1866, 1859, 1857, 1858,
-     1867, 1859, 1861, 1860, 1866, 1871, 1872, 1865, 1860, 1874,
-
-     1865, 1862, 1870, 1875, 1876, 1878, 1871, 1871, 1871, 1879,
-     1867, 1873, 1877, 1876, 1872, 1880, 1881, 1882, 1875, 1895,
-        0, 1884, 1871, 1872, 1886, 1874, 1874, 1878, 1889,    0,
-     1875, 1876, 1878, 1871, 1885, 1879, 1879, 1888, 1881, 1888,
-     1892, 1885, 1880, 1881, 1884, 1891, 1895, 1886, 1884, 1882,
-     1889, 1886, 1890, 1896, 1893, 1889, 1890, 1891, 1894, 1897,
-     1898, 1885, 1892, 1893, 1888, 1899, 1899, 1892, 1900, 1894,
-     1901, 1897, 1891, 1905, 1902, 1903, 1896,    0, 1901, 1890,
-     1896, 1893, 1898, 1900, 1904, 1894, 1897, 1898, 1907, 1903,
-     1908, 1909, 1899, 1904, 1914, 1900, 1902, 1901, 1908, 1909,
-
-     1905, 1902, 1903, 1911, 1910, 1912, 1911, 1907, 1910, 1914,
-     1913, 1904, 1917, 1912, 1915, 1907, 1913, 1908, 1909, 1918,
-     1915, 1914, 1920, 1919, 1917, 1921, 1922,    0, 1923, 1924,
-     1911, 1910, 1912, 1925, 1927,    0, 1920, 1913, 1921, 1917,
-     1922, 1915, 1928, 1930, 1931, 1926, 1918, 1919, 1927, 1920,
-     1919, 1933, 1921, 1922, 1923, 1923, 1924, 1926, 1934, 1929,
-     1925, 1927, 1929, 1937, 1936, 1934, 1931, 1935, 1928, 1928,
-     1930, 1931, 1926, 1933, 1935, 1938, 1939, 1929, 1933, 1936,
-     1940, 1942, 1944, 1941, 1939, 1934, 1929, 1943, 1945, 1929,
-     1937, 1936, 1941, 1946, 1935, 1948,    0,    0, 1947, 1943,
-
-     1953, 1952, 1938, 1939, 1944, 1949, 1955, 1940, 1942, 1944,
-     1941, 1947, 1958, 1948, 1943, 1945, 1950, 1956, 1949, 1957,
-     1946, 1954, 1948, 1952, 1950, 1947, 1956, 1953, 1952, 1954,
-     1959, 1960, 1949, 1955, 1961, 1962, 1958, 1964, 1970, 1958,
-     1957, 1963, 1961, 1950, 1956, 1959, 1957, 1962, 1954, 1963,
-     1967, 1968, 1966, 1969, 1967, 1972, 1959, 1959, 1960, 1966,
-     1975, 1961, 1962, 1968, 1964, 1970, 1971, 1972, 1963, 1973,
-     1981, 1977, 1959, 1978, 1971, 1980, 1969, 1967, 1968, 1966,
-     1969, 1973, 1972, 1976, 1979, 1979, 1978, 1975, 1981, 1982,
-     1976, 1977, 1983, 1971, 1985, 1986, 1973, 1981, 1977, 1983,
-
-     1978, 1980, 1980, 1987, 1988, 1991, 1988, 1990, 1996, 1985,
-     1976, 1979, 1989, 1990, 1982, 1994, 1982, 1986, 1995, 1983,
-     1996, 1985, 1986, 1992, 1992, 1987, 1989, 1991, 1997, 1999,
-     1987, 1988, 1991,    0, 1990, 1996, 2000, 1994, 1998, 1989,
-     1995,    0, 1994, 2003, 1998, 1995, 2001, 2002, 2004, 2002,
-     1992, 2005, 2010, 2006, 2009, 2011, 2012, 2003, 2000, 2007,
-     1997, 1999, 2017, 2000, 2008, 1998, 2018, 2009, 2001, 2005,
-     2003, 2006, 2004, 2001, 2002, 2004, 2016, 2007, 2005, 2012,
-     2006, 2009, 2008, 2012, 2010, 2014, 2007, 2011, 2017, 2017,
-     2024, 2008, 2014, 2019, 2016, 2020, 2022, 2020, 2018, 2023,
-
-     2026, 2019, 2020, 2016, 2025,    0, 2028, 2022, 2033,    0,
-     2023,    0, 2014, 2037, 2029,    0, 2025, 2024, 2026, 2019,
-     2019, 2028, 2020, 2022, 2020, 2029, 2023, 2026, 2019, 2031,
-     2030, 2025, 2033, 2028, 2036, 2033, 2034, 2040, 2035, 2045,
-     2037, 2029, 2030, 2038, 2031, 2035, 2042, 2041, 2043, 2036,
-     2044, 2047,    0,    0, 2046,    0, 2031, 2030, 2034, 2049,
-     2048, 2036, 2051, 2034, 2040, 2035, 2045, 2046, 2042, 2038,
-     2038, 2041, 2049, 2042, 2041, 2048, 2050, 2047, 2047, 2053,
-     2043, 2046, 2044, 2054, 2050, 2055, 2049, 2048, 2051, 2051,
-     2057, 2056, 2058, 2059, 2060, 2061,    0, 2064, 2065, 2058,
-
-     2070, 2063, 2053, 2050, 2064, 2065, 2053, 2054, 2057, 2061,
-     2054, 2067, 2055, 2056, 2066, 2069, 2059, 2057, 2056, 2058,
-     2059, 2060, 2061, 2063, 2064, 2065, 2068, 2066, 2063, 2071,
-     2072,    0, 2070, 2068, 2067, 2074, 2075, 2069, 2067, 2072,
-     2076, 2066, 2069, 2078, 2084, 2084, 2074, 2077, 2081, 2083,
-     2071, 2082, 2088, 2068, 2085,    0, 2071, 2072, 2075, 2087,
-     2090, 2081, 2074, 2075, 2089, 2091, 2077, 2094, 2078,    0,
-     2078, 2084, 2076, 2083, 2077, 2081, 2083, 2082, 2082, 2089,
-     2085, 2085, 2087, 2091, 2088, 2098, 2087, 2090, 2096, 2099,
-        0, 2089, 2091, 2106, 2094, 2102, 2104, 2096, 2098, 2105,
-
-     2099, 2103, 2103, 2108, 2110, 2111, 2113, 2114, 2112, 2121,
-        0, 2113, 2098, 2118,    0, 2096, 2099, 2102, 2104, 2112,
-     2106, 2105, 2102, 2104, 2117, 2120, 2105,    0, 2103, 2114,
-     2108, 2111, 2111, 2113, 2114, 2112, 2110, 2116, 2122, 2117,
-     2118, 2121, 2123, 2120, 2125, 2116, 2127, 2122, 2126,    0,
-     2129, 2117, 2120, 2130, 2123, 2127, 2126, 2131, 2133, 2132,
-     2136, 2134, 2138,    0, 2116, 2122, 2139, 2136, 2137, 2123,
-     2140, 2125, 2141, 2127, 2134, 2126, 2129, 2129, 2135, 2131,
-     2130, 2132, 2144, 2133, 2131, 2133, 2132, 2136, 2134, 2138,
-     2137, 2135, 2142, 2139, 2143, 2137, 2145, 2140, 2146, 2141,
-
-     2147, 2148,    0, 2143, 2144, 2135, 2149, 2142, 2151, 2144,
-     2153, 2154, 2152, 2149, 2155, 2147, 2148, 2156, 2150, 2142,
-     2152, 2143, 2145, 2145, 2146, 2146, 2157, 2147, 2148, 2150,
-     2155, 2163, 2156, 2149, 2158, 2151, 2159, 2153, 2154, 2152,
-     2160, 2155, 2164, 2159, 2156, 2150, 2157, 2161, 2162, 2158,
-     2165, 2165, 2166, 2157, 2161, 2162, 2167,    0, 2163, 2166,
-     2164, 2158, 2160, 2159, 2170, 2168, 2172, 2160, 2168, 2164,
-     2167, 2169, 2175, 2173, 2161, 2162, 2171, 2165, 2172, 2166,
-     2178, 2175, 2176, 2167, 2169, 2173, 2180, 2176, 2181, 2179,
-     2170, 2170, 2168, 2172, 2171, 2182, 2183, 2177, 2169, 2175,
-
-     2173, 2177, 2179, 2171, 2178, 2184,    0, 2178, 2180, 2176,
-     2181, 2186, 2189, 2180, 2188, 2181, 2179, 2190, 2191, 2194,
-     2193, 2189, 2182, 2183, 2177, 2195, 2191, 2193, 2194, 2196,
-     2195, 2184, 2184, 2190, 2199, 2197, 2196, 2186, 2186, 2189,
-     2188, 2188, 2198, 2199, 2190, 2191, 2194, 2193, 2200, 2198,
-     2202, 2205, 2195, 2197, 2203, 2204, 2196, 2208, 2207, 2203,
-     2211, 2199, 2197, 2209, 2219, 2217,    0, 2218,    0, 2198,
-     2210, 2212, 2209, 2204, 2200, 2200, 2207, 2202, 2205, 2210,
-     2211, 2203, 2204, 2212, 2208, 2207, 2213, 2211, 2215,    0,
-     2209, 2214, 2217, 2216, 2218, 2213, 2219, 2210, 2212, 2215,
-
-     2214, 2216, 2220, 2223, 2221, 2224, 2222,    0, 2228, 2227,
-     2225, 2220, 2224, 2213, 2222, 2215, 2221, 2225, 2214, 2226,
-     2216, 2230, 2229,    0,    0, 2223, 2234,    0,    0, 2220,
-     2223, 2221, 2224, 2222, 2227, 2228, 2227, 2225, 2237, 2236,
-     2238, 2226, 2232, 2235, 2234, 2237, 2226, 2229, 2230, 2229,
-     2232, 2235, 2239, 2234, 2236, 2240, 2244, 2243, 2245, 2239,
-     2246, 2248, 2238, 2240, 2243, 2237, 2236, 2238, 2247, 2232,
-     2235, 2249, 2246, 2252, 2251, 2253, 2254, 2247, 2258, 2239,
-     2244, 2261, 2240, 2244, 2243, 2245, 2251, 2246, 2248, 2263,
-     2254, 2260, 2256, 2266, 2249, 2247, 2252, 2257, 2249, 2256,
-
-     2252, 2251, 2253, 2254, 2257, 2258, 2260, 2262, 2261, 2264,
-     2265,    0, 2271, 2273, 2274, 2262, 2263, 2272, 2260, 2256,
-     2266, 2275, 2272, 2278, 2257, 2265, 2281, 2276, 2274, 2277,
-     2279, 2264,    0, 2284, 2262, 2275, 2264, 2265, 2271, 2271,
-     2273, 2274, 2279, 2285, 2272, 2276, 2286, 2277, 2275, 2287,
-     2278,    0, 2293, 2281, 2276, 2284, 2277, 2279, 2288, 2286,
-     2284, 2289, 2290, 2291, 2293, 2285, 2296,    0, 2297, 2289,
-     2285, 2287, 2294, 2286, 2295, 2298, 2287, 2288, 2296, 2293,
-     2290, 2303, 2291, 2299, 2300, 2288,    0, 2304, 2289, 2290,
-     2291, 2301, 2306, 2296, 2294, 2297, 2295, 2305, 2302, 2294,
-
-     2301, 2295, 2298, 2299, 2306, 2307, 2300, 2302, 2308, 2304,
-     2299, 2300, 2309, 2303, 2304, 2312, 2313, 2314, 2301, 2306,
-     2321, 2315, 2318, 2305, 2305, 2302, 2315, 2307, 2316, 2312,
-     2317,    0, 2307, 2319, 2322, 2308, 2320,    0, 2321, 2309,
-     2323, 2314, 2312, 2313, 2314, 2328, 2322, 2321, 2324, 2325,
-     2316, 2327, 2317, 2315, 2318, 2316, 2319, 2317, 2320, 2323,
-     2319, 2322, 2330, 2320, 2325, 2332, 2333, 2323, 2335, 2328,
-     2324, 2334, 2328, 2327, 2338, 2324, 2325, 2330, 2327, 2336,
-     2334, 2337, 2335, 2342, 2339, 2345, 2344, 2332, 2333, 2330,
-        0, 2342, 2332, 2333, 2344, 2335, 2343, 2336, 2334, 2337,
-
-     2338, 2338, 2339, 2343, 2347, 2348, 2336, 2346, 2337, 2349,
-     2342, 2339, 2345, 2344, 2352, 2346, 2350, 2348, 2354, 2355,
-     2356, 2358, 2347, 2343, 2350, 2354, 2352, 2357, 2359, 2357,
-     2360, 2347, 2348,    0, 2346,    0, 2349, 2361, 2362, 2363,
-     2365, 2352, 2355, 2350,    0, 2354, 2355, 2356, 2368, 2366,
-        0, 2372, 2373, 2358, 2357, 2369, 2374, 2362, 2365, 2376,
-     2359, 2363, 2360, 2366, 2361, 2362, 2363, 2365, 2369, 2370,
-     2378, 2368, 2384, 2380, 2386, 2368, 2366, 2372, 2372, 2373,
-     2380, 2370, 2369, 2374, 2381, 2383, 2376, 2387,    0, 2381,
-     2389, 2388, 2383, 2391, 2394, 2396, 2370, 2378, 2384, 2384,
-
-     2380, 2386, 2391, 2393, 2389, 2395, 2398, 2397, 2402, 2399,
-     2393, 2401, 2383, 2412, 2387, 2388, 2381, 2389, 2388, 2397,
-     2391, 2394, 2396, 2399, 2401, 2403, 2400, 2404, 2411,    0,
-     2393, 2395, 2395, 2398, 2397, 2400, 2399, 2407, 2401, 2408,
-     2402, 2409, 2407, 2408, 2410, 2412, 2415, 2414, 2409, 2411,
-     2404, 2410, 2403, 2400, 2404, 2411, 2413, 2418, 2413, 2420,
-     2423, 2421, 2423,    0,    0, 2424, 2408,    0, 2409, 2407,
-     2414, 2410, 2426, 2415, 2414, 2430,    0, 2432, 2420, 2418,
-     2425, 2425, 2427, 2413, 2418, 2421, 2420, 2423, 2421, 2424,
-     2425, 2427, 2424, 2428, 2426, 2431, 2432, 2429, 2435, 2426,
-
-     2428, 2433, 2430, 2431, 2432, 2434, 2433, 2425, 2425, 2427,
-     2429, 2436, 2440, 2434, 2437,    0, 2438,    0, 2439, 2448,
-     2428,    0, 2431, 2440, 2429, 2435, 2441, 2442, 2443, 2443,
-        0, 2444, 2434, 2433, 2442, 2452, 2449, 2436, 2436, 2440,
-     2437, 2437, 2438, 2438, 2439, 2439, 2448, 2450, 2441, 2444,
-     2445, 2453, 2446, 2441, 2442, 2443, 2450, 2445, 2444, 2446,
-     2449, 2454, 2452, 2449, 2455, 2457, 2458, 2459, 2463, 2460,
-        0, 2453, 2462,    0, 2450, 2464,    0, 2445, 2453, 2446,
-     2474, 2462, 2465, 2468, 2458, 2459, 2455, 2460, 2454, 2466,
-        0, 2455, 2457, 2458, 2459, 2463, 2460, 2468, 2464, 2462,
-
-     2465, 2466, 2464, 2467, 2469, 2475, 2477, 2474, 2467, 2465,
-     2468, 2478, 2482, 2481, 2475, 2481, 2466, 2484, 2483, 2486,
-     2490, 2488, 2469,    0, 2477, 2483, 2478, 2488, 2491, 2495,
-     2482, 2469, 2475, 2477, 2486, 2467, 2492, 2498, 2478, 2482,
-     2481, 2493, 2490, 2499, 2500, 2483, 2486, 2490, 2488, 2484,
-     2491, 2495, 2504,    0, 2496, 2491, 2495, 2496, 2501, 2493,
-     2502, 2503, 2492, 2492, 2498, 2506, 2509, 2502, 2493, 2503,
-     2499, 2500, 2507, 2508, 2504, 2514, 2501, 2510, 2516, 2504,
-     2496, 2496, 2513, 2511, 2496, 2501, 2510, 2502, 2503, 2511,
-     2512, 2513, 2522, 2509, 2507, 2508, 2515, 2506, 2515, 2507,
-
-     2508, 2519, 2524, 2518, 2510, 2516, 2525, 2514, 2520, 2513,
-     2511, 2518, 2512, 2519, 2526, 2520, 2524, 2512, 2527, 2522,
-     2525, 2528, 2531, 2515, 2530, 2533, 2529, 2536, 2519, 2524,
-     2518, 2537, 2528, 2525, 2529, 2520, 2527, 2526, 2532, 2532,
-     2539, 2526, 2534, 2530, 2531, 2527, 2539, 2541, 2528, 2531,
-     2534, 2530, 2533, 2529, 2536, 2543, 2546, 2544, 2537, 2545,
-     2548,    0, 2553,    0, 2549, 2532, 2543, 2539, 2544, 2534,
-     2545, 2549, 2550, 2551, 2541, 2556, 2550, 2554, 2546, 2558,
-     2557, 2551, 2543, 2546, 2544, 2557, 2545, 2548, 2553, 2553,
-     2554, 2549, 2559, 2561, 2560, 2562, 2563, 2556, 2564, 2550,
-
-     2551, 2560, 2556, 2565, 2554, 2564, 2558, 2557,    0, 2566,
-     2569, 2562, 2561, 2567, 2563, 2577, 2578, 2566, 2570, 2559,
-     2561, 2560, 2562, 2563, 2568, 2564, 2571, 2576, 2567, 2575,
-     2580, 2568, 2581, 2579, 2576, 2565, 2566, 2569,    0, 2561,
-     2567, 2581, 2570, 2578, 2575, 2570, 2583, 2577, 2584, 2586,
-     2585, 2568, 2571, 2571, 2576, 2588, 2575, 2579, 2585, 2581,
-     2579, 2590, 2580, 2591, 2587, 2587, 2592, 2594, 2583, 2595,
-     2584, 2591, 2597, 2583, 2587, 2584, 2596, 2585, 2598, 2599,
-     2600, 2586, 2588, 2601, 2592, 2597, 2602, 2604, 2590, 2607,
-     2591, 2587, 2587, 2592, 2594, 2612, 2595, 2607, 2596, 2597,
-
-     2598, 2614, 2618, 2596, 2609, 2598, 2599, 2600, 2602, 2609,
-     2601, 2615, 2610, 2602, 2604, 2611, 2607, 2610, 2616, 2617,
-     2611, 2612, 2612, 2623, 2615, 2616, 2619, 2620, 2614, 2618,
-     2625, 2609, 2628, 2626, 2619, 2627, 2629, 2617, 2615, 2610,
-     2630, 2631, 2611, 2632,    0, 2616, 2617,    0, 2627, 2620,
-     2623, 2629, 2636, 2619, 2620, 2626, 2637, 2625, 2640, 2630,
-     2626, 2638, 2627, 2629, 2628, 2632, 2634, 2630, 2631, 2635,
-     2632, 2637, 2641, 2634, 2636, 2645, 2635, 2640, 2648, 2636,
-     2641, 2644, 2638, 2637, 2642, 2640, 2645, 2643, 2638, 2647,
-     2644, 2642, 2652, 2634, 2643, 2647, 2635, 2646, 2646, 2641,
-
-     2648, 2655, 2645, 2651, 2656, 2648, 2652, 2646, 2644, 2657,
-     2651, 2642, 2661, 2663, 2643, 2667, 2647, 2664, 2664, 2652,
-     2665, 2665, 2666, 2666, 2646, 2646, 2669, 2674, 2655, 2679,
-     2651, 2656, 2657, 2673, 2670, 2671, 2657, 2678, 2667, 2661,
-     2663, 2680, 2667, 2670, 2686, 2677, 2664, 2677, 2671, 2665,
-     2685, 2666, 2679, 2669, 2674, 2673, 2679, 2678, 2681, 2680,
-     2673, 2670, 2671, 2684, 2678, 2683, 2687, 2688, 2680, 2689,
-     2681, 2686, 2677, 2691, 2683, 2694, 2685, 2685, 2691, 2688,
-     2690, 2684, 2692, 2690, 2693, 2681, 2693, 2694, 2699, 2695,
-     2684, 2689, 2683, 2687, 2688, 2695, 2689, 2696, 2690, 2697,
-
-     2698, 2700, 2694, 2703, 2706, 2691, 2707, 2690, 2698, 2708,
-     2690, 2693, 2709, 2710, 2692, 2699, 2695, 2711, 2712, 2696,
-     2714, 2697, 2715, 2700, 2696, 2716, 2697, 2698, 2700, 2718,
-     2703, 2706, 2716, 2707, 2719, 2722, 2708, 2718, 2714, 2709,
-     2710, 2720, 2724, 2721, 2711, 2712, 2723, 2714, 2725, 2715,
-     2722, 2728, 2716, 2720, 2724, 2729, 2718, 2721, 2730, 2730,
-     2728, 2719, 2722, 2731, 2734, 2732, 2735, 2736, 2720, 2724,
-     2721,    0, 2723, 2723, 2732, 2725, 2738, 2737, 2728, 2729,
-     2736, 2742, 2729, 2753, 2738, 2730, 2739, 2751, 2734, 2731,
-     2731, 2734, 2732, 2742, 2736, 2739, 2740, 2754, 2735, 2737,
-
-     2757, 2756, 2758, 2738, 2737, 2756, 2760, 2740, 2742, 2759,
-     2753, 2751, 2764, 2739, 2751, 2763, 2759, 2762, 2757, 2760,
-     2765, 2762, 2767, 2740, 2754, 2758, 2766, 2757, 2756, 2758,
-        0, 2763, 2768, 2760, 2764, 2769, 2759, 2780, 2766, 2764,
-     2771, 2770, 2763, 2769, 2762, 2765, 2768, 2765, 2767, 2767,
-     2770, 2771, 2772, 2766, 2772, 2774, 2775, 2773, 2778, 2768,
-     2781, 2774, 2769, 2775, 2780, 2779, 2782, 2771, 2770, 2773,
-     2783, 2778, 2779, 2784, 2785, 2788,    0, 2793, 2781, 2772,
-     2786, 2789, 2774, 2775, 2773, 2778, 2796, 2781, 2786, 2790,
-        0, 2787, 2779, 2782, 2798,    0, 2783, 2783, 2787, 2788,
-
-     2784, 2785, 2788, 2789, 2791, 2792, 2791, 2786, 2789, 2793,
-     2794, 2790, 2795, 2796, 2797, 2800, 2790, 2792, 2787, 2795,
-     2802, 2798, 2797, 2794, 2805,    0, 2806, 2800, 2808, 2802,
-     2807, 2791, 2792, 2809, 2810, 2811, 2808, 2794,    0, 2795,
-     2812, 2797, 2800, 2814,    0, 2819, 2818, 2802, 2811, 2807,
-     2813, 2805, 2806, 2806, 2812, 2808, 2816, 2807, 2813, 2818,
-     2822, 2823, 2811, 2816, 2821, 2809, 2810, 2812, 2819, 2823,
-     2814, 2821, 2819, 2818, 2827, 2824, 2825, 2813, 2826,    0,
-     2832, 2834, 2822, 2816, 2828, 2830, 2826, 2822, 2823, 2824,
-     2825, 2821, 2831, 2833, 2830, 2835, 2827, 2840, 2842,    0,
-
-     2831, 2827, 2824, 2825, 2836, 2826, 2828, 2832, 2837, 2839,
-     2838, 2828, 2830, 2834, 2849, 2833, 2841, 2839, 2844, 2831,
-     2833, 2835, 2835,    0, 2846, 2842, 2836, 2852, 2854, 2840,
-     2837, 2836, 2838,    0, 2845, 2837, 2839, 2838, 2841, 2847,
-     2848, 2844, 2845, 2841, 2846, 2844, 2849, 2847, 2848, 2850,
-     2851, 2846, 2857, 2852, 2852, 2854, 2855, 2850, 2856, 2855,
-     2857, 2845, 2858, 2872, 2851, 2860, 2847, 2848, 2859,    0,
-     2858, 2861,    0, 2862, 2855, 2865, 2850, 2851, 2867, 2857,
-     2856, 2869, 2859, 2855, 2868, 2856, 2855, 2862, 2874, 2858,
-     2872, 2860, 2860, 2861, 2870, 2859, 2864, 2864, 2861, 2866,
-
-     2862, 2865, 2865, 2869, 2867, 2867, 2873, 2866, 2869, 2871,
-     2868, 2868, 2875, 2874, 2870, 2874, 2878, 2871, 2876, 2879,
-     2877, 2870, 2880, 2864, 2878, 2882, 2866, 2883, 2873, 2885,
-     2880, 2886, 2891, 2873, 2887, 2883, 2871, 2895, 2876, 2875,
-     2877, 2879, 2887, 2878, 2889, 2876, 2879, 2877, 2894, 2880,
-     2898, 2885, 2882, 2886, 2883, 2888, 2885, 2892, 2886, 2891,
-     2893, 2887, 2899, 2888, 2895, 2892, 2896, 2908, 2893, 2902,
-     2889, 2889, 2900, 2905, 2894, 2894, 2909, 2898,    0,    0,
-     2906,    0, 2888,    0, 2892,    0, 2896, 2893, 2906, 2899,
-     2907, 2902, 2900, 2896, 2908, 2905, 2902,    0, 2907, 2900,
-
-     2905,    0,    0, 2909,    0,    0,    0, 2906,    0,    0,
-        0,    0,    0,    0,    0,    0,    0, 2907, 2913, 2913,
-     2913, 2913, 2913, 2913, 2913, 2914, 2914, 2914, 2914, 2914,
-     2914, 2914, 2915, 2915, 2915, 2915, 2915, 2915, 2915, 2916,
-     2916, 2916, 2916, 2916, 2916, 2916, 2917, 2917, 2917, 2917,
-     2917, 2917, 2917, 2919, 2919,    0, 2919, 2919, 2919, 2919,
-     2920, 2920,    0,    0,    0, 2920, 2920, 2921, 2921,    0,
-        0, 2921,    0, 2921, 2922,    0,    0,    0,    0,    0,
-     2922, 2923, 2923,    0,    0,    0, 2923, 2923, 2924,    0,
-        0,    0,    0,    0, 2924, 2925, 2925,    0, 2925, 2925,
-
-     2925, 2925, 2926, 2926,    0, 2926, 2926, 2926, 2926, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912, 2912,
-     2912, 2912, 2912, 2912, 2912, 2912
+       20,   82,  265,   20,   20,   31,   68,   20,   79,  141,
+       81,   31,   20,   27,   41,   31,   27,   81,   80, 1103,
+       68,   20,   23,   27,  144,   27,   23,  144,   79,   23,
+       70,   23,   23,   80,   32,   79,   27,   81,   32,  126,
+       27,  109,   84,   27,   23,   80,   38, 1103,   38,   23,
+       27,   84,   27,   23,   32,  109,   23,   38,   23,   23,
+       32,   32,   40,   38,   39,   32,   40,   85,  109,   84,
+       40,  126,   38,   38,   39,   38,  122,  122,   39,   39,
+      862,   32,   34,   86,   38,   85,   34,   39,   40,   40,
+
+       38,   39,   34,   40,   85,   34,   86,   40,   88,   88,
+       90,   39,   34,  122,   34,   39,   39,   88,   90,   34,
+       86,  862,   42,   34,   42,   42,   89,   42,  156,   34,
+       64,   89,   34,   42,   59,   88,   88,   90,   83,   34,
+       36,   97,  156,   58,   36,   58,   58,   69,   58,   69,
+       69,   83,   69,   89,   36,   36,   66,   36,   66,   66,
+      156,   66,   83,   54,   97,   83,   36,   36,   97,  156,
+       95,   36,   71,   91,   71,   71,   53,   71,   83,   95,
+       48,   36,   36,   71,   36,   37,  107,   74,   37,   74,
+       74,   91,   74,   92,   66,   37,   87,   95,   74,   37,
+
+       37,   93,   87,   99,   87,   91,   92,   37,   93,  107,
+       96,  101,   37,  107,   98,   37,   99,   87,   91,   96,
+       92,   43,   37,   87,  207,   74,   37,   37,   93,   87,
+       99,   87,   94,   94,  106,  101,   98,   96,  102,  100,
+       94,   98,  100,  101,  105,  207,  102,  106,   94,  105,
+      103,  207,  105,  108,  104,  100,  100,   14,  104,   94,
+       94,  106,  101,  100,  110,  102,  100,   94,  238,  100,
+      103,  105,  103,  108,  104,  111,  105,  103,  104,  112,
+      108,  104,  100,  100,  110,  104,  112,  113,  114,  111,
+      115,  110,  118,  117,  116,  238,  113,  103,  116,  115,
+
+      117,  104,  111,  119,  149,  149,  112,   13,    0,    0,
+      119,  114,  121,  120,  113,  114,  116,  115,  118,  118,
+      117,  116,  120,  123,  121,  116,  127,  124,  120,  125,
+      119,  123,  146,    0,  146,  146,  120,  146,  124,  121,
+      120,  127,  124,  125,  128,    0,  129,  130,  133,  120,
+      123,  124,  131,  127,  124,  120,  125,  129,  130,  133,
+      131,  128,  132,  135,  128,  124,  129,  137,  132,  124,
+      128,  128,  134,  129,  130,  133,  136,  138,  135,  131,
+      139,  134,  137,  140,  129,    0,  138,    0,  128,  132,
+      135,  128,    0,  134,  137,  154,  140,  134,  136,  134,
+
+        0,  155,  139,  136,  138,  161,  171,  139,  134,  151,
+      140,  151,  151,  152,  151,  152,  152,  157,  152,  154,
+      134,  158,  154,  155,  161,  160,  157,  159,  155,  162,
+      163,  164,  161,  158,  159,    0,  165,  162,  171,  167,
+      170,  160,  163,  165,  157,  167,  159,  166,  158,  174,
+      991,  152,  160,  164,  159,  169,  162,  163,  164,  176,
+      168,  159,  168,  165,  172,  166,  170,  170,  172,  177,
+      175,  167,  167,  178,  166,  174,  174,  169,  175,  180,
+      991,  176,  169,  179,    0,  172,  176,  168,  178,    0,
+      179,  177,  172,  181,    0,  172,  177,  175,    0,  182,
+
+      178,  183,    0,  193,    0,  184,  186,  180,    0,    0,
+      179,  180,  172,  173,  183,  186,  181,  184,  173,  187,
+      181,  182,  185,  173,    0,  185,  182,    0,  183,  173,
+      173,  188,  184,  186,  180,  193,  173,  185,  190,    0,
+      173,  187,  189,  192,  191,  173,  187,  189,  196,  185,
+      173,  191,  185,  188,  192,  194,  173,  173,  188,  189,
+      190,  189,  195,  198,  199,  190,  201,    0,  189,  189,
+      192,  191,  197,  195,  189,  202,  203,  200,  199,  197,
+      196,  194,  194,  200,  204,    0,  189,  205,  189,    0,
+      209,    0,  206,  211,  195,  198,  199,  202,  201,  197,
+
+      195,  212,  202,  208,  200,  199,  206,  205,  203,  213,
+      208,  209,  211,  210,  205,  212,  204,  209,  210,  206,
+      211,  214,  215,  219,  216,  217,  223,  225,  212,    0,
+      208,  213,  217,  218,  215,  216,  213,  220,  218,  214,
+      210,  230,  222,  221,  231,  219,  220,  222,  214,  215,
+      219,  216,  217,  224,  224,  227,  226,  232,  223,  225,
+      228,  230,  224,  226,  220,  218,  221,  229,  230,  222,
+      221,  233,  234,  235,  239,  229,  231,  227,  236,  233,
+      224,  224,  227,  226,  237,  228,  240,  228,  235,  232,
+      241,  236,  242,  244,  229,  245,  242,  239,  233,  243,
+
+      235,  250,    0,  245,  234,  236,  239,  241,  244,  246,
+      237,  237,  251,  248,  254,  241,  247,  241,  240,  242,
+      244,  243,  245,  247,  239,  249,  243,  252,  246,  249,
+      255,  253,  256,  250,  241,  248,  246,  258,  257,  261,
+      248,  259,  255,  247,  251,  256,  254,  257,  262,  252,
+      258,  263,  249,  253,  252,  264,  269,  255,  253,  256,
+      259,  260,  270,  260,  258,  257,  267,  269,  259,  268,
+      266,  261,  262,  273,  270,  262,  263,  271,  263,  266,
+      272,  264,  264,  269,  274,  275,  276,  278,  260,  270,
+      277,  273,  267,  267,  280,  268,  268,  266,  275,  282,
+
+      273,  271,  281,  272,  271,  279,  283,  272,  287,    0,
+        0,  286,  275,  283,  284,  277,  274,  277,  276,  278,
+      280,  280,  279,  284,  281,  286,  288,  296,  279,  281,
+      285,  282,  279,  283,  287,  287,  285,  289,  286,  290,
+      295,  284,  291,    0,  292,  293,  289,  300,  298,  279,
+      288,  291,  297,  288,  293,  295,  294,  285,    0,  296,
+      302,  304,  290,  298,  289,  300,  290,  295,  301,  291,
+      292,  292,  293,  294,  300,  298,  297,  301,  305,  297,
+      294,  306,  302,  294,    0,  304,    0,  302,  304,  303,
+      309,  303,  305,    0,  308,  301,  306,  307,  307,  308,
+
+      294,  299,  314,    0,  299,  305,    0,  303,  306,  299,
+      299,  299,  299,  303,  309,  311,  303,  309,  303,  299,
+      310,  315,  307,  310,  307,  307,  308,  311,  299,  314,
+      310,  299,  316,  312,  303,  313,  299,  299,  299,  299,
+      317,  318,  311,  315,    0,  323,  319,  310,  315,  320,
+      310,  312,  317,  313,  322,    0,  328,  320,  316,  316,
+      312,  319,  313,  318,  321,  327,  322,  317,  318,    0,
+        0,  321,  324,  319,  324,  326,  320,  323,  329,    0,
+      332,  322,  326,  324,  330,  334,  337,  327,  328,  335,
+      330,  321,  327,  332,  331,    0,  331,  336,  324,  324,
+
+      329,  324,  326,  334,  338,  329,  330,  332,    0,  333,
+      324,  330,  334,  337,  339,  335,  335,  330,  331,  406,
+      339,  331,  333,  331,  339,  333,  338,  333,  341,  336,
+      343,  338,  339,  333,  342,  341,  333,  345,  339,    0,
+      342,  339,  343,    0,  344,  348,  406,  339,    0,  333,
+      345,  339,  333,  359,  333,  341,  344,  343,  348,  339,
+      340,  342,  340,  351,  345,  350,  357,  347,  352,    0,
+      354,  344,  348,  352,  353,  340,  354,  350,  340,    0,
+      340,  351,  340,  347,  357,  359,  340,  340,  355,  340,
+      351,  347,  350,  357,  347,  353,  355,  354,  379,  379,
+
+      352,  353,  340,    0,  356,  340,  358,  340,    0,  340,
+      347,  349,  349,  361,  358,  355,  356,  360,  360,  362,
+      361,  349,  365,  349,  349,  349,  363,  379,  349,  365,
+      364,  356,  362,  358,  364,  363,  349,  368,  349,  349,
+      361,  367,    0,  370,  360,  375,  362,  366,  349,  365,
+      349,  349,  349,  367,  366,  349,  371,  364,  363,  368,
+      369,  373,  363,  372,  368,  374,    0,  376,  367,  376,
+      372,  378,  369,  377,  366,  370,  373,  375,  374,  380,
+      381,  385,  371,  371,  377,  382,  380,  369,  373,  383,
+      372,  381,  374,  378,  376,  384,  382,  387,  378,    0,
+
+      377,  388,  383,  386,  385,  389,  380,  381,  385,  388,
+      390,  394,  382,  384,  392,  398,  383,  389,  386,  410,
+      384,  390,  384,  387,  387,  391,  386,  392,  388,  394,
+      386,  393,  389,  395,  391,  397,  396,  390,  394,  402,
+      384,  392,  393,  400,  393,  386,    0,  398,  399,  393,
+      401,  410,  391,  397,  399,  395,  404,  407,  393,  396,
+      395,  402,  397,  396,  400,  403,  402,  405,  411,  393,
+      400,  393,  403,  401,  408,  399,  409,  401,  412,  407,
+      413,  405,  404,  404,  407,  417,  413,  414,  408,  415,
+      412,  411,  403,  424,  405,  411,  416,  421,  420,  418,
+
+      417,  408,  409,  409,  416,  412,  418,  413,  419,  414,
+      422,  415,  417,  420,  414,  423,  415,  419,  425,  424,
+      424,  421,  416,  416,  421,  420,  418,  427,  426,  432,
+      423,  416,  430,  422,  426,  419,  428,  422,  431,  433,
+      425,  428,  423,  434,  431,  425,  435,  440,  432,  442,
+      434,  446,    0,  427,  427,  426,  432,  433,  430,  430,
+      437,  435,  437,  428,  438,  431,  433,  439,  441,  437,
+      434,  438,  444,  435,  443,  446,  448,    0,  446,  440,
+      439,  442,  449,  451,  447,  444,  441,  437,  448,  437,
+      445,  438,  452,  445,  439,  441,  443,  447,  450,  444,
+
+      453,  443,  456,  448,  454,  450,  458,  451,  456,  445,
+      451,  447,  457,  453,  449,  452,  455,  445,  459,  460,
+      445,  455,  463,  461,  452,  450,  454,  453,  458,  456,
+      459,  454,  462,  458,  461,  457,  463,  466,    0,  457,
+      462,  460,  452,  455,  466,  459,  460,  468,    0,  463,
+      461,    0,    0,  469,  467,  474,  498,  470,    0,  462,
+      464,  469,    0,    0,  466,  464,  467,  464,  470,  481,
+      468,  473,  471,  464,  468,  464,  481,  474,  464,  464,
+      469,  467,  474,  473,  470,  464,  464,  464,  498,  472,
+      475,  476,  464,  472,  464,  471,  481,  477,  473,  471,
+
+      464,  475,  464,  478,  479,  464,  464,  477,    0,  476,
+      482,  472,  464,  484,  478,  480,  472,  475,  476,  480,
+      472,  483,  490,  483,    0,  491,  485,  488,  479,  477,
+      478,  479,  486,  487,  477,  488,  482,  482,  485,  484,
+      484,  489,  480,  491,  490,  487,  489,  486,  483,  490,
+      492,  493,  491,  485,  488,  494,  496,  497,  492,  486,
+      487,  500,  501,  493,  499,  510,  504,  505,  489,  503,
+      501,  509,  502,  500,  496,  504,  494,  492,  493,  499,
+      497,  503,  494,  496,  497,  502,  506,  507,  500,  501,
+      505,  499,  508,  504,  505,  511,  503,  510,  509,  502,
+
+      506,  512,  513,  514,  516,  515,    0,    0,  525,  523,
+      511,  508,  507,  506,  507,  517,  516,  513,  515,  508,
+      518,  521,  511,  520,  524,  522,  521,  514,  519,  513,
+      514,  516,  515,  512,  520,  519,  523,  517,  519,  522,
+      525,  526,  517,  527,  518,  528,  519,  518,  529,  530,
+      520,  524,  522,  521,  529,  519,  531,  534,  532,    0,
+      533,  537,  519,  536,  535,  519,  532,  536,  526,  537,
+      527,  538,  539,  530,  540,  529,  530,  528,  531,  533,
+      541,  534,    0,  531,  534,  532,  535,  533,  537,  541,
+      536,  535,  542,  543,  538,  544,  545,  540,  538,  546,
+
+      543,  540,  549,    0,  539,    0,  547,  541,  548,  551,
+      552,  547,  546,  550,  542,  547,    0,  548,  545,  542,
+      543,  553,  550,  545,  556,  557,  546,  544,  549,  549,
+      547,  551,  552,  547,  553,  548,  551,  552,  547,  554,
+      550,  558,  547,  557,  563,  560,    0,  559,  553,  561,
+      564,  554,  557,  562,  568,  563,  556,  569,  565,  564,
+      567,  568,    0,  575,    0,  558,  554,  560,  558,  559,
+      559,  563,  560,  561,  559,  562,  561,  564,  565,  566,
+      562,  568,  567,  570,  569,  565,  571,  567,  572,  573,
+      574,  576,  580,  566,  571,  575,  559,  577,  579,  572,
+
+      581,  570,  578,  578,  583,  574,  566,  573,  584,  581,
+      570,  585,  576,  571,  580,  572,  573,  574,  576,  580,
+      582,  577,  579,  588,  577,  579,  586,  581,  588,  587,
+      584,  578,  589,  582,  590,  584,  583,  591,  591,  592,
+      594,  593,    0,  585,  600,  591,  589,  582,  590,  593,
+      586,  587,  595,  586,  597,  588,  587,  598,  594,  589,
+        0,  590,  596,  599,  591,  591,  602,  594,  593,  596,
+      601,  592,  604,  605,  595,  605,  600,  598,  599,  595,
+      597,  597,  606,  608,  598,  601,  603,  599,  602,  596,
+      599,  603,  609,  602,  607,  610,  614,  601,  604,  604,
+
+      605,  609,  607,  611,  610,  599,  612,  606,  608,  606,
+      608,  615,  611,  613,  612,  617,  619,  616,  603,  609,
+      613,  607,  610,  620,  618,  619,  621,  617,  614,  623,
+      611,  620,  624,  612,  615,  616,  618,  622,  615,  625,
+      613,  621,  617,  619,  616,  624,  628,  626,  627,  622,
+      620,  618,  630,  621,  625,  626,  627,  633,  629,  624,
+      636,  623,  631,  630,  622,  633,  625,  629,  634,  628,
+      635,  631,  637,  628,  626,  627,  638,  632,  632,  630,
+      637,  634,  641,  636,  633,  629,  632,  636,  639,  631,
+      640,  644,  638,  641,  642,  634,  635,  635,  645,  637,
+
+      643,  639,  642,  638,  632,  632,  646,  647,  648,  641,
+      649,  644,  640,  651,  643,  639,  650,  640,  644,  649,
+      645,  642,  655,  654,  653,  645,  646,  643,  652,  647,
+      648,  651,  656,  646,  647,  648,  650,  649,  654,  657,
+      651,  652,  653,  650,  655,  658,  659,  662,  660,  655,
+      654,  653,  661,  662,  663,  652,  656,  665,  658,  656,
+      660,  664,  657,  668,  659,  661,  657,  666,  669,  664,
+      670,  668,  658,  659,  662,  660,  671,  670,  672,  661,
+      673,  663,  673,  674,  665,  666,  675,  664,  664,  676,
+      668,    0,  674,  672,  666,  677,  664,  670,  699,  671,
+
+      669,  683,  678,  671,  679,  672,  679,  673,  676,  689,
+      674,  678,  680,  683,  686,  677,  676,    0,  675,  680,
+        0,  690,  677,  691,  686,  693,  692,  689,  683,  678,
+      699,  679,  694,  701,  691,    0,  689,  696,    0,  680,
+      681,  686,  690,  697,  681,  695,  696,  681,  690,  692,
+      691,  693,  693,  692,  681,  701,  697,  681,  694,  694,
+      701,  695,  681,  702,  696,  705,  698,  681,    0,  702,
+      697,  681,  695,  698,  681,  704,  703,  704,    0,  706,
+        0,  681,  708,    0,  681,  703,  709,  707,  711,  705,
+      702,  710,  705,  698,  700,  700,    0,  700,  709,  712,
+
+      700,  715,  704,  703,  714,  700,  706,  707,  708,  708,
+      711,  700,  700,  709,  707,  711,  715,  710,  710,  713,
+      700,  700,  700,  712,  700,  716,  712,  700,  715,  714,
+      717,  714,  700,  716,  721,  718,  719,  720,  700,  700,
+      724,  713,  718,  722,  719,  723,  713,  728,  730,  729,
+      725,    0,  716,  717,  726,  722,  720,  717,  723,  725,
+      721,  721,  718,  719,  720,  733,  724,  724,  727,  726,
+      722,  729,  723,  727,  734,  730,  729,  725,  731,  728,
+      735,  726,  736,  731,  737,    0,  739,  733,    0,    0,
+      738,  741,  733,  742,  744,  727,  740,    0,    0,  748,
+
+      743,  751,  745,  744,  736,  746,  734,  739,    0,  736,
+      731,    0,  735,  739,  738,  740,  737,  738,  741,  743,
+      742,  744,  747,  740,  745,  746,  748,  743,  749,  745,
+      747,  750,  746,  751,  752,  754,  755,  756,  757,    0,
+      764,    0,  752,  758,  759,  764,  749,  760,    0,  747,
+      750,  762,    0,  754,  755,  749,  757,  765,  750,  756,
+      760,  752,  754,  755,  756,  757,  759,  758,  763,  762,
+      758,  759,  764,  761,  760,  761,  766,  767,  762,  768,
+      772,  773,  763,  765,  765,  767,  769,    0,  766,  769,
+      770,    0,    0,  774,  775,  763,  776,  768,  770,  774,
+
+      761,    0,  776,  766,  767,  772,  768,  772,  773,  781,
+      779,  777,  778,  769,  770,  779,  775,  770,  777,  778,
+      774,  775,  780,  776,  782,  770,    0,  781,  782,  780,
+      783,  784,  786,  785,  787,  788,  781,  779,  777,  778,
+      784,  785,  790,  792,  791,  793,  789,  794,    0,  780,
+      788,  782,  787,  783,  789,  790,  792,  783,  784,  795,
+      785,  787,  788,  796,  786,  791,  795,  793,  797,  790,
+      792,  791,  793,  789,  794,  797,  799,  798,  802,  800,
+      801,  796,  803,  799,  800,  802,  795,  805,  801,  804,
+      796,  806,  807,  808,  809,  797,  798,  815,  806,    0,
+
+      810,  817,  804,  799,  798,  802,  800,  801,  810,  812,
+      817,  814,  819,  821,  803,  811,  804,  809,  806,  805,
+      813,  809,  816,  811,  807,  808,  813,  810,  817,  815,
+      811,  812,  820,  823,  818,  824,  812,  814,  814,  820,
+      821,  825,  811,  822,  819,  827,  816,  813,  818,  816,
+      811,  826,  822,  825,  830,  823,    0,  829,  828,  820,
+      823,  818,  824,  828,  829,  831,  833,  834,  825,  833,
+      822,  827,  827,  831,  826,  836,  830,  837,  826,  841,
+      834,  830,  836,  837,  829,  828,    0,    0,  839,  840,
+      842,  841,  831,  833,  834,  843,  849,  843,  844,    0,
+
+        0,  849,  836,    0,  837,  838,  841,  838,  845,  847,
+        0,  838,  840,  838,  839,  839,  840,  842,  838,  851,
+      845,  844,  843,  838,  846,  844,  848,  854,  849,  838,
+      850,  847,  838,    0,  838,  845,  847,  846,  838,  848,
+      838,  858,  851,  850,  852,  838,  851,  855,  853,  854,
+      838,  846,  857,  848,  854,  856,  852,  850,  853,  859,
+      855,  856,  858,  860,  863,  857,  861,  864,  858,    0,
+      853,  852,  864,  865,  855,  853,  869,  866,    0,  857,
+      872,  865,  856,    0,  868,  853,  866,  871,  870,  874,
+        0,  859,    0,  861,  864,  860,  863,  881,  869,  868,
+
+      865,  870,  871,  869,  866,  867,  872,  872,  874,  875,
+      867,  868,  867,  873,  871,  870,  874,  876,  867,  877,
+      878,    0,  875,  867,  867,  876,  879,  877,  882,  881,
+      867,  867,  867,  883,  884,  873,  875,  867,  885,  867,
+      873,  883,  886,  891,  876,  867,  877,  878,  884,  879,
+      867,  867,  882,  879,  887,  882,  888,  867,  889,    0,
+      883,  884,  887,  893,  886,  894,  890,  896,  892,  886,
+      885,  893,  895,  898,  888,  891,  889,  890,  899,  895,
+      896,  887,  897,  888,  900,  889,  892,  894,  898,  897,
+      893,  901,  894,  890,  896,  892,  899,  902,  903,  895,
+
+      898,  907,  900,    0,  905,  899,  908,  902,  909,  897,
+      910,  900,  901,  908,  907,  905,  909,  911,  901,  913,
+      912,  914,    0,  910,  902,  920,  911,  917,  907,  919,
+      903,  905,  912,  908,  918,  909,  921,  910,    0,  925,
+      923,  913,  925,  914,  911,    0,  913,  912,  914,  917,
+      921,  923,  918,  924,  917,  919,  919,  920,  924,  926,
+      927,  918,  930,  921,  928,  925,  925,  923,  929,  925,
+      931,  928,  932,  927,  933,  934,  930,  929,  935,    0,
+        0,  933,  931,  926,  936,  924,  926,  927,  939,  930,
+      935,  928,  940,  946,  941,  929,  937,  931,  940,  943,
+
+      942,  933,  944,  945,  932,  935,  936,  934,  946,  937,
+      943,  936,  939,  948,  950,  939,  941,  949,  951,  940,
+      946,  941,  942,  937,  944,  945,  943,  942,  949,  944,
+      945,  952,  955,  953,  948,  950,  954,    0,  956,  957,
+      948,  950,  959,  960,  949,  954,  958,  961,  957,  959,
+      951,  953,  962,  963,  958,  964,  955,  967,  952,  955,
+      953,  961,  971,  954,  956,  956,  957,  960,  965,  959,
+      960,  966,  969,  958,  961,  972,  970,  964,  973,  983,
+      984,  969,  964,  970,  962,  963,  974,  976,  975,  967,
+      965,  979,  977,  966,  971,  965,  976,  972,  966,  969,
+
+      978,  980,  972,  970,  974,  973,  975,  979,  981,  982,
+      980,  983,  984,  974,  976,  975,  977,  982,  979,  977,
+      985,  986,  987,  981,  978,  988,  989,  978,  980,  990,
+      994,  992,  985,  988, 1007,  981,  982,  993,  994,  989,
+      992,  998,  997,  986,  990, 1002, 1005,  985,  986,  987,
+      997, 1001,  988,  989, 1000,  993,  990,  994,  992,  995,
+     1002,  995, 1003, 1001,  993, 1004, 1007, 1000,  998,  997,
+     1006, 1008, 1002, 1005, 1009, 1010,    0, 1006, 1001, 1015,
+     1012, 1000, 1011, 1004, 1003, 1013,  995, 1016, 1014, 1003,
+        0, 1015, 1004, 1012, 1021, 1016, 1009, 1006, 1013, 1017,
+
+     1010, 1009, 1010, 1008, 1011, 1018, 1015, 1012, 1019, 1011,
+     1014, 1022, 1013, 1023, 1016, 1014, 1019, 1018, 1024, 1017,
+     1025, 1021, 1023,    0, 1022, 1029, 1017, 1026, 1027, 1031,
+     1024, 1030, 1018, 1032, 1026, 1019,    0, 1027, 1022, 1027,
+     1023, 1025, 1027, 1033, 1035, 1024, 1032, 1025, 1034, 1031,
+     1027, 1029, 1029, 1030, 1026, 1027, 1031, 1034, 1030, 1036,
+     1032, 1038, 1035, 1039, 1027, 1037, 1027, 1033, 1040, 1027,
+     1033, 1035, 1042, 1037, 1043, 1034, 1040, 1045, 1044, 1039,
+     1046, 1036,    0, 1038, 1045, 1047, 1036,    0, 1038, 1051,
+     1039, 1048, 1037, 1054, 1049, 1040, 1043, 1051, 1050, 1042,
+
+     1044, 1043, 1046, 1053, 1045, 1044, 1049, 1046, 1047, 1048,
+     1050, 1052, 1047, 1054, 1055, 1053, 1051, 1057, 1048, 1056,
+     1054, 1049, 1058, 1057, 1059, 1050, 1052, 1056, 1060, 1055,
+     1053, 1058, 1061, 1065, 1063, 1062, 1068, 1066, 1052, 1061,
+     1060, 1055, 1062, 1068, 1057, 1059, 1056, 1067, 1069, 1058,
+     1066, 1059, 1063, 1070, 1079, 1060, 1075, 1128, 1073, 1061,
+     1083, 1063, 1062, 1068, 1066, 1065, 1067, 1071, 1070, 1072,
+     1069, 1073, 1071, 1074, 1067, 1069, 1077, 1072, 1097, 1078,
+     1070, 1080, 1075, 1075, 1128, 1073, 1079, 1074,    0, 1081,
+     1077, 1084, 1083,    0, 1082, 1085, 1072, 1078, 1086, 1071,
+
+     1074, 1076,    0, 1077, 1076, 1076, 1078, 1080, 1080, 1076,
+     1097, 1081, 1082, 1084, 1087, 1076, 1081, 1085, 1084, 1076,
+     1087, 1082, 1085, 1076, 1086, 1086, 1088, 1089, 1076, 1089,
+     1090, 1076, 1076, 1094, 1091, 1095, 1076, 1090, 1093, 1098,
+     1092, 1087, 1076, 1091,    0, 1093, 1076, 1099, 1095, 1100,
+     1096, 1089, 1088, 1088, 1089, 1094, 1089, 1090, 1092, 1096,
+     1094, 1091, 1095,    0, 1102, 1093, 1104, 1092, 1107, 1099,
+     1108, 1098, 1100,    0, 1099, 1106, 1100, 1096, 1101, 1108,
+     1107, 1109, 1104, 1101,    0, 1101, 1118, 1101,    0, 1101,
+     1102, 1102,    0, 1104, 1113, 1107, 1101, 1108, 1106, 1109,
+
+     1112, 1110, 1106,    0, 1111, 1101, 1110, 1113, 1109, 1111,
+     1101, 1114, 1101, 1117, 1101, 1115, 1101, 1116, 1118, 1119,
+     1120, 1113, 1112, 1115, 1121, 1116, 1117, 1112, 1122, 1114,
+     1123, 1111, 1125, 1110, 1124, 1130, 1127, 1121, 1114, 1120,
+     1117, 1125, 1115, 1123, 1116, 1119, 1119, 1120, 1129, 1131,
+     1122, 1121, 1124, 1133, 1126, 1122, 1126, 1123, 1127, 1125,
+     1129, 1124, 1130, 1127, 1134, 1135, 1136, 1137, 1139,    0,
+     1140, 1138, 1144, 1135, 1131, 1129, 1131, 1133, 1138, 1141,
+     1133, 1126, 1142, 1143, 1136,    0, 1134, 1146, 1142, 1143,
+     1149, 1134, 1135, 1136, 1137, 1139, 1140, 1140, 1138, 1144,
+
+     1145, 1141, 1148, 1150, 1151, 1147, 1141, 1145, 1149, 1142,
+     1143, 1146, 1147, 1151, 1146, 1153, 1155, 1149, 1156,    0,
+        0, 1154, 1157, 1163, 1148, 1158, 1162, 1145, 1150, 1148,
+     1150, 1151, 1147, 1154, 1159, 1162, 1160, 1161, 1155, 1153,
+     1156, 1157, 1153, 1155, 1163, 1156, 1164, 1158, 1154, 1157,
+     1163, 1165, 1158, 1162, 1167, 1168, 1159, 1169, 1170, 1161,
+     1179, 1159, 1160, 1160, 1161, 1165, 1164, 1171, 1172, 1174,
+     1175, 1178, 1173, 1164, 1177, 1178, 1172, 1175, 1165, 1169,
+     1180, 1177, 1181, 1183, 1169, 1171, 1167, 1168, 1173, 1187,
+     1170, 1189, 1179, 1186, 1171, 1172, 1174, 1175, 1178, 1173,
+
+     1184, 1177, 1187, 1181, 1185, 1188, 1184,    0, 1186, 1181,
+     1194, 1185, 1180, 1184, 1188, 1183, 1187, 1189, 1189, 1190,
+     1186, 1191, 1193, 1191, 1195, 1192, 1190, 1184, 1195, 1200,
+        0, 1185, 1188, 1184, 1192, 1196, 1199, 1194, 1200, 1198,
+     1201, 1199, 1202, 1204, 1193,    0, 1190, 1198, 1191, 1193,
+     1203, 1195, 1192, 1207, 1209, 1204, 1200, 1196, 1201,    0,
+     1208, 1202, 1196, 1203,    0, 1210, 1198, 1201, 1199, 1202,
+     1204, 1205, 1206, 1208, 1205, 1206, 1212, 1203, 1207, 1211,
+     1207, 1213, 1213, 1205, 1212, 1215, 1209, 1208, 1210, 1217,
+     1218, 1214, 1210, 1227, 1206, 1211, 1216, 1218, 1205, 1206,
+
+     1214, 1205, 1206, 1212, 1221, 1216, 1211, 1215, 1213, 1220,
+     1222, 1217, 1215, 1221, 1223, 1224, 1217, 1218, 1214, 1222,
+     1225,    0, 1220, 1216, 1226, 1227, 1229, 1231, 1228, 1225,
+        0, 1221, 1226, 1230, 1229,    0, 1220, 1222, 1224, 1231,
+     1223, 1223, 1224, 1228, 1232, 1234, 1230, 1225, 1235, 1233,
+     1237, 1226, 1236, 1229, 1231, 1228, 1232, 1233, 1239, 1237,
+     1230, 1240, 1238, 1242, 1244, 1241, 1245, 1234, 1235, 1242,
+     1249, 1232, 1234, 1240, 1236, 1235, 1233, 1237, 1243, 1236,
+     1238, 1246,    0, 1247, 1239, 1239, 1241,    0, 1240, 1238,
+     1242, 1250, 1241, 1251, 1252, 1255, 1244, 1249, 1245, 1253,
+
+     1243, 1254, 1259, 1252, 1256, 1243, 1258, 1246, 1246, 1247,
+     1247, 1251, 1253, 1254, 1250, 1255, 1257,    0, 1250, 1260,
+     1251, 1252, 1255, 1257, 1259, 1258, 1253, 1261, 1254, 1259,
+     1256, 1256, 1260, 1258, 1262, 1261, 1263, 1264, 1268, 1262,
+     1266, 1263, 1267, 1257, 1264, 1265, 1260, 1270, 1266, 1272,
+     1267, 1269, 1271, 1273, 1261, 1270, 1268, 1276, 1272, 1271,
+     1274, 1275, 1275, 1278, 1264, 1268, 1262, 1266, 1263, 1267,
+        0, 1265, 1265, 1269, 1270, 1277, 1272, 1279, 1269, 1271,
+     1287,    0, 1274, 1277, 1278, 1273, 1280, 1274, 1275, 1276,
+     1278, 1281, 1282, 1283, 1280, 1284, 1289, 1285, 1286, 1281,
+
+     1282, 1283, 1277, 1285, 1288, 1290, 1287, 1287, 1284, 1279,
+     1286, 1289, 1291, 1280, 1292, 1293, 1295, 1294, 1281, 1282,
+     1283, 1299, 1284, 1289, 1285, 1286, 1304, 1298, 1288, 1293,
+     1295, 1288, 1290, 1299, 1291, 1294, 1296, 1292, 1300, 1291,
+     1296, 1292, 1293, 1295, 1294, 1300, 1301, 1302, 1299, 1298,
+     1303,    0, 1305, 1296, 1298, 1306, 1307, 1301, 1304, 1310,
+     1313, 1296, 1308, 1296, 1305, 1300, 1310, 1296, 1309, 1306,
+     1314,    0, 1303, 1301, 1302, 1311, 1319, 1303, 1307, 1305,
+     1296, 1312, 1306, 1307, 1311, 1308, 1310, 1316, 1312, 1308,
+     1320, 1309, 1313, 1318, 1321, 1309, 1316, 1314, 1319, 1318,
+
+     1322, 1324, 1311, 1319, 1327, 1326, 1331, 1322, 1312,    0,
+     1328, 1329, 1332, 1335, 1316, 1334, 1320, 1320, 1333, 1332,
+     1318, 1328, 1329,    0, 1338, 1335, 1321, 1322, 1324, 1326,
+     1331, 1327, 1326, 1331, 1339, 1349, 1333, 1328, 1329, 1332,
+     1335, 1334, 1334, 1336, 1337, 1333, 1338, 1339, 1340, 1336,
+     1341, 1338, 1337, 1342, 1343, 1345, 1343, 1344, 1346, 1341,
+     1348, 1339, 1349,    0, 1347, 1342, 1350, 1346, 1345, 1351,
+     1336, 1337, 1348, 1352, 1340, 1340, 1351, 1341, 1354, 1355,
+     1342, 1343, 1345, 1344, 1344, 1346, 1347, 1348, 1357, 1350,
+     1353, 1347, 1359, 1350, 1354, 1353, 1351,    0, 1360, 1352,
+
+     1352, 1356, 1355, 1361, 1366, 1354, 1355, 1360, 1363, 1356,
+     1357, 1365, 1362, 1362, 1369, 1357, 1361, 1353,    0, 1359,
+     1362, 1363, 1364, 1370, 1364, 1360, 1366, 1367, 1356, 1368,
+     1361, 1366, 1369, 1372, 1367, 1363, 1368, 1365, 1365, 1362,
+     1362, 1369, 1373, 1374, 1371, 1370, 1375, 1376,    0, 1364,
+     1370, 1371,    0, 1375, 1367, 1378, 1368, 1379, 1372, 1380,
+     1372, 1385, 1381, 1383, 1373, 1386,    0, 1380, 1378, 1373,
+     1391, 1371, 1388, 1375, 1384, 1374, 1390, 1384,    0, 1376,
+     1387, 1388, 1378, 1381, 1379, 1383, 1380, 1385, 1385, 1381,
+     1383, 1386, 1386, 1387, 1389, 1392, 1391, 1391, 1393, 1388,
+
+     1390, 1384, 1395, 1390, 1396, 1393, 1389, 1387, 1394, 1397,
+     1392, 1394, 1399, 1401, 1399, 1398, 1400, 1405,    0, 1402,
+        0, 1389, 1392, 1394,    0, 1393, 1396, 1397, 1403,    0,
+     1404, 1396, 1394, 1407, 1395, 1394, 1397, 1398, 1394, 1399,
+     1400, 1402, 1398, 1400, 1406, 1401, 1402, 1407, 1411, 1405,
+     1394, 1409, 1408, 1418, 1403, 1403, 1404, 1404, 1410, 1409,
+     1407, 1408, 1412, 1413, 1414, 1410, 1406, 1415,    0, 1416,
+     1417, 1406, 1411, 1416, 1420, 1411, 1419, 1421, 1409, 1408,
+     1418, 1422, 1433, 1420, 1421, 1410, 1414, 1423, 1422, 1424,
+     1425, 1414, 1417, 1426, 1412, 1413, 1416, 1417, 1419, 1415,
+
+     1423, 1420, 1424, 1419, 1421, 1425, 1427, 1426, 1422, 1433,
+     1430,    0, 1428, 1435, 1423, 1429, 1424, 1425, 1431, 1428,
+     1426, 1434, 1429, 1430, 1431, 1436, 1441, 1440, 1434, 1437,
+     1438, 1439,    0,    0, 1439, 1435, 1440, 1430, 1427, 1428,
+     1435, 1437, 1429, 1438, 1441, 1431, 1443, 1442, 1434,    0,
+     1445, 1436, 1436, 1441, 1440, 1450, 1437, 1438, 1439, 1442,
+     1444, 1445, 1451, 1444, 1447, 1449, 1443, 1449, 1452, 1447,
+     1453, 1454,    0, 1443, 1442, 1455, 1447, 1445, 1444, 1450,
+     1454, 1456, 1450, 1459, 1460, 1453, 1457, 1444,    0, 1451,
+     1444, 1447, 1449, 1458, 1467, 1452, 1447, 1453, 1454, 1455,
+
+     1457, 1458, 1455, 1462, 1461, 1459, 1460, 1463, 1456, 1464,
+     1459, 1460, 1461, 1457, 1462, 1465, 1468, 1464, 1465, 1466,
+     1458, 1469, 1472, 1471, 1470, 1463, 1467,    0, 1469, 1473,
+     1462, 1461, 1471, 1465, 1463, 1472, 1464, 1466, 1470, 1474,
+     1473, 1478, 1465, 1468, 1480, 1465, 1466, 1479, 1469, 1472,
+     1471, 1470, 1477, 1476, 1474, 1476, 1473, 1483, 1479, 1481,
+     1483, 1477, 1480, 1482, 1484,    0, 1474, 1478, 1478, 1486,
+     1485, 1480, 1489, 1484, 1479, 1483, 1485, 1482, 1486, 1477,
+     1476, 1481, 1490, 1487, 1483, 1489, 1481, 1483, 1487, 1482,
+     1482, 1484, 1492, 1491, 1490, 1493, 1486, 1485, 1491, 1489,
+
+     1496, 1494, 1495, 1497, 1482, 1498,    0, 1508, 1502, 1490,
+     1494, 1501, 1499, 1503, 1492, 1487, 1505, 1504, 1501, 1492,
+     1491, 1502, 1505, 1506,    0, 1497, 1508, 1493, 1494, 1495,
+     1497, 1504, 1496, 1499, 1508, 1502, 1531, 1498, 1501, 1499,
+     1505, 1512, 1510, 1505, 1504, 1503, 1511, 1513, 1514, 1505,
+     1510, 1516, 1515, 1519, 1511, 1506, 1518, 1517, 1520,    0,
+     1512, 1526, 1514, 1531, 1516, 1513, 1515, 1521, 1512, 1510,
+     1517, 1527, 1525, 1511, 1513, 1514, 1527, 1518, 1516, 1515,
+     1522, 1521, 1523, 1518, 1517, 1519, 1525, 1522, 1524, 1528,
+     1520, 1523, 1529, 1526, 1521, 1532, 1524, 1533, 1527, 1525,
+
+     1528, 1529, 1532, 1534, 1518, 1535, 1536, 1522, 1537, 1523,
+     1538, 1540, 1541, 1542, 1538, 1524, 1528,    0, 1545, 1529,
+     1533, 1542, 1532, 1540, 1533, 1534, 1537, 1535, 1536, 1543,
+     1534, 1547, 1535, 1536, 1544, 1537, 1546, 1538, 1540, 1541,
+     1542, 1551, 1544, 1552, 1543, 1545, 1550, 1548, 1551, 1546,
+     1549, 1547, 1553, 1556, 1550, 1554, 1543, 1555, 1547, 1557,
+     1558, 1544, 1548, 1546, 1554, 1549, 1560, 1553, 1551, 1562,
+     1563, 1561, 1566, 1550, 1548, 1552, 1564, 1549, 1555, 1553,
+     1556, 1565, 1554, 1557, 1555, 1567, 1557, 1558, 1560, 1561,
+     1568, 1564, 1567, 1560, 1571, 1568, 1566, 1563, 1561, 1566,
+
+     1569, 1562, 1570, 1564, 1572, 1573, 1565, 1574, 1565, 1569,
+     1576, 1570, 1567, 1575, 1578, 1579, 1571, 1568, 1577, 1574,
+     1573, 1571, 1572, 1576, 1580, 1577, 1578, 1569, 1576, 1570,
+     1581, 1572, 1573, 1583, 1574, 1575, 1581, 1576, 1582, 1585,
+     1575, 1578, 1579, 1587, 1583, 1577, 1582, 1584, 1588, 1586,
+     1576, 1586, 1589, 1591, 1584, 1592, 1580, 1581, 1595, 1597,
+     1583, 1590, 1586, 1596, 1585, 1582, 1585, 1593, 1590, 1587,
+     1587, 1594, 1598, 1593, 1584, 1588, 1586, 1594, 1586, 1589,
+     1591, 1592, 1592, 1600, 1601, 1595, 1596, 1602, 1590, 1604,
+     1596, 1597, 1607, 1601, 1593, 1603, 1598, 1603, 1594, 1598,
+
+     1605,    0, 1606, 1608, 1608, 1608, 1611, 1609, 1619,    0,
+     1608, 1601, 1614, 1604, 1609, 1600, 1604, 1614, 1608, 1602,
+     1616,    0, 1603, 1615, 1607, 1617, 1610, 1605, 1606, 1606,
+     1608, 1608, 1608, 1610, 1609, 1612, 1615, 1608, 1611, 1618,
+     1619, 1617, 1612, 1620, 1614, 1616, 1623, 1616, 1621, 1629,
+     1615, 1618, 1617, 1610, 1622, 1621, 1624, 1624, 1625, 1633,
+     1622, 1620, 1612, 1627, 1626, 1630, 1618, 1628, 1627, 1635,
+     1620, 1626, 1630, 1623, 1639, 1621, 1629, 1634, 1640, 1634,
+     1637, 1622, 1638, 1624, 1625, 1625, 1633, 1635, 1638, 1641,
+     1627, 1626, 1630, 1628, 1628, 1641, 1635, 1643, 1637, 1642,
+
+     1644, 1645, 1645, 1646, 1634, 1640, 1639, 1637, 1648, 1638,
+     1650, 1642, 1647, 1647, 1651, 1652, 1641, 1643, 1644, 1648,
+     1653, 1654, 1652, 1655, 1643, 1656, 1642, 1644, 1645, 1646,
+     1646, 1658, 1650, 1660, 1657, 1648, 1659, 1650, 1662, 1647,
+     1653, 1660, 1652, 1659, 1661, 1663, 1651, 1653, 1665, 1658,
+     1664, 1664, 1656, 1654, 1663, 1655, 1657, 1666, 1658, 1661,
+     1660, 1657, 1662, 1659, 1668, 1662, 1667, 1669, 1674, 1676,
+     1673, 1661, 1663, 1667, 1665, 1665, 1668, 1664, 1671, 1672,
+     1675, 1676,    0, 1669, 1672, 1671, 1679, 1682, 1675, 1666,
+     1669, 1668, 1673, 1667, 1669, 1674, 1676, 1673, 1680, 1681,
+
+     1678, 1683, 1685, 1687,    0, 1671, 1672, 1675, 1678, 1679,
+     1669, 1689, 1686, 1679, 1682, 1684, 1687, 1681, 1686, 1680,
+     1684, 1692, 1694, 1693, 1683, 1680, 1681, 1678, 1683, 1685,
+     1687, 1684, 1688, 1689, 1690, 1693, 1691, 1695, 1689, 1686,
+     1688, 1690, 1684, 1691, 1694, 1696, 1697, 1684, 1699, 1694,
+     1693, 1700, 1702, 1692, 1703, 1701, 1700, 1705, 1706, 1688,
+     1704, 1690, 1701, 1691, 1695, 1704, 1699, 1700, 1710, 1697,
+     1709, 1696, 1696, 1697, 1708, 1699, 1707, 1707, 1700, 1702,
+     1712, 1703, 1701, 1700, 1714, 1709, 1713, 1716, 1718, 1705,
+     1706, 1715, 1704, 1715, 1730, 1712, 1708, 1709, 1725, 1714,
+
+     1710, 1708, 1719, 1707, 1722, 1717, 1721, 1712, 1723, 1713,
+     1717, 1714, 1722, 1713, 1726, 1727, 1728, 1719, 1715, 1716,
+     1718, 1721, 1725, 1731, 1732, 1725, 1730, 1729, 1733, 1719,
+     1723, 1722, 1717, 1721, 1729, 1723, 1736, 1738, 1734, 1745,
+     1726, 1726, 1727, 1728, 1731, 1739, 1732, 1740, 1744, 1733,
+     1731, 1732, 1742, 1743, 1729, 1733, 1734,    0, 1736, 1746,
+     1739, 1738, 1747, 1736, 1738, 1734, 1745, 1742, 1743, 1748,
+     1744, 1749, 1739, 1740, 1740, 1744, 1750, 1746, 1752, 1742,
+     1743, 1751, 1753, 1750, 1747, 1755, 1746, 1752, 1754, 1747,
+     1753, 1748, 1756, 1757, 1770, 1760, 1748,    0, 1749, 1751,
+
+     1761,    0, 1759, 1750, 1760, 1752, 1757, 1755, 1751, 1753,
+     1762, 1754, 1755, 1759, 1763, 1754, 1764, 1765, 1761, 1767,
+     1757, 1770, 1760, 1765, 1756, 1766, 1772, 1761, 1759, 1759,
+     1776, 1764, 1763, 1767, 1773, 1777, 1762, 1762, 1774, 1778,
+     1759, 1763, 1776, 1764, 1765, 1773, 1767, 1766, 1777, 1774,
+     1772, 1780, 1766, 1772, 1779, 1781, 1782, 1776, 1787,    0,
+     1783, 1773, 1777, 1786, 1779, 1774, 1785,    0, 1789,    0,
+     1786, 1778, 1799, 1788, 1789, 1793, 1793, 1780, 1780, 1783,
+     1781, 1779, 1781, 1782, 1787, 1787, 1785, 1783, 1790, 1791,
+     1786, 1788, 1792, 1785, 1794, 1789, 1795, 1798, 1797, 1799,
+
+     1788, 1800, 1793, 1790, 1791, 1797, 1794, 1792, 1802, 1795,
+     1800, 1801, 1798, 1830, 1807, 1790, 1791, 1795, 1801, 1792,
+     1803, 1794, 1804, 1795, 1798, 1797, 1806,    0, 1800, 1804,
+     1809, 1808, 1802, 1812, 1810, 1802, 1795, 1814, 1801, 1807,
+     1808, 1807, 1803, 1817, 1815, 1830, 1814, 1803, 1806, 1804,
+     1816, 1812, 1809, 1806, 1810, 1818, 1820, 1809, 1808, 1821,
+     1812, 1810, 1815, 1818, 1814, 1816, 1822, 1824, 1817, 1826,
+     1817, 1815, 1821, 1823, 1823, 1827, 1825, 1816, 1828,    0,
+     1833, 1820, 1818, 1820, 1831, 1829, 1821, 1828, 1837, 1824,
+     1832, 1826, 1829, 1822, 1824, 1841, 1826, 1827, 1838, 1833,
+
+     1823, 1825, 1827, 1825, 1832, 1828, 1831, 1833, 1835, 1836,
+     1842, 1831, 1829, 1840, 1839, 1837, 1835, 1832, 1843, 1845,
+     1840, 1847, 1836, 1844, 1838, 1838, 1839, 1841, 1848, 1846,
+     1850, 1844, 1842, 1849,    0, 1835, 1836, 1842, 1854,    0,
+     1840, 1839, 1844, 1843, 1846, 1843, 1845, 1847, 1847, 1857,
+     1844, 1849, 1850, 1851, 1848, 1848, 1846, 1850, 1844, 1858,
+     1849, 1853, 1851, 1854, 1853, 1854, 1855, 1857, 1856, 1860,
+     1861, 1864, 1855, 1856, 1858, 1865, 1857, 1862, 1867, 1853,
+     1851, 1868, 1865, 1866, 1860, 1864, 1858,    0, 1853, 1890,
+     1868, 1853, 1861, 1855, 1869, 1870, 1860, 1861, 1864, 1862,
+
+     1856, 1866, 1865, 1869, 1862, 1867, 1870, 1871, 1868, 1874,
+     1866, 1872, 1875, 1877, 1879, 1878, 1890,    0, 1876, 1886,
+     1871, 1869, 1870, 1872, 1874, 1876, 1884, 1875, 1892, 1885,
+     1882, 1886, 1879, 1885, 1871, 1877, 1874, 1878, 1872, 1875,
+     1877, 1879, 1878, 1882, 1889, 1876, 1886, 1884, 1888, 1887,
+     1888, 1882, 1893, 1884, 1891, 1892, 1885, 1882, 1887, 1894,
+     1893, 1895, 1889, 1896, 1897, 1898, 1899, 1900, 1901, 1897,
+     1882, 1889, 1891, 1902, 1905, 1888, 1887, 1896, 1906, 1893,
+     1902, 1891, 1894, 1895, 1907, 1908, 1894, 1901, 1895, 1909,
+     1896, 1900, 1906, 1910, 1900, 1901, 1897, 1898, 1899, 1912,
+
+     1902, 1905, 1907, 1906, 1906, 1906, 1913, 1915, 1910, 1911,
+     1916, 1907, 1908, 1914, 1917, 1909, 1909,    0, 1911, 1906,
+     1910, 1919, 1920, 1923, 1921, 1923,    0, 1930, 1913, 1920,
+     1906, 1912, 1916, 1913, 1915, 1924, 1911, 1916, 1925, 1914,
+     1914, 1926, 1925, 1928, 1919, 1927, 1917, 1921, 1919, 1920,
+     1923, 1921, 1928, 1926, 1930, 1929, 1931, 1924, 1933, 1932,
+     1934, 1934, 1924, 1935, 1940, 1925, 1929, 1927, 1926, 1936,
+     1928, 1932, 1927, 1937, 1938, 1939,    0, 1936, 1935, 1931,
+     1933,    0, 1929, 1931, 1939, 1933, 1932, 1934, 1938, 1942,
+     1935, 1940, 1953,    0,    0, 1937, 1936, 1943, 1944, 1945,
+
+     1937, 1938, 1939, 1945, 1946, 1943, 1944, 1946, 1942, 1947,
+     1952, 1954, 1948, 1949, 1950, 1955, 1942, 1947, 1948, 1953,
+     1950, 1956, 1952, 1958, 1943, 1944, 1945, 1959, 1949, 1955,
+     1957, 1946, 1960, 1961, 1956, 1954, 1947, 1952, 1954, 1948,
+     1949, 1950, 1955, 1963, 1957, 1961, 1965, 1962, 1956, 1958,
+     1958, 1969, 1971, 1964, 1959, 1966, 1964, 1957, 1969, 1960,
+     1961, 1962, 1968, 1972, 1973, 1970, 1975, 1971, 1974, 1963,
+     1963, 1964, 1970, 1965, 1962, 1977, 1974, 1966, 1969, 1971,
+     1964, 1979, 1966, 1964, 1968, 1976, 1978, 1980, 1981, 1968,
+     1972, 1973, 1970, 1975, 1976, 1974, 1982, 1984, 1978, 1983,
+
+     1987, 1988, 1977, 1979, 1990, 1995, 1993, 1991, 1979, 1982,
+     1984, 1985, 1976, 1978, 1980, 1981, 1991, 1983, 1992, 1985,
+     1994, 1989, 1987, 1982, 1984, 1997, 1983, 1987, 1988, 1989,
+     1993, 1990, 1995, 1993, 1991, 1994, 1996, 1997, 1985, 1992,
+     1999, 1998, 2003, 2001, 1996, 1992, 1994, 1994, 1989, 1998,
+     2001, 2002, 1997, 2004, 2003, 2002, 2005, 2006, 2010, 2007,
+     2008, 2012, 1994, 1996, 2013, 2006, 2011, 1999, 1998, 2003,
+     2001, 2007, 2008, 2011, 2016, 2016, 2004, 2013, 2002, 2017,
+     2004, 2012, 2018, 2005, 2006, 2010, 2007, 2008, 2012, 2014,
+     2015, 2013,    0, 2011, 2019, 2022, 2020,    0, 2014, 2015,
+
+     2018, 2016, 2023, 2024, 2026, 2017, 2017, 2029, 2029, 2018,
+     2022, 2020, 2025, 2020, 2025, 2028, 2014, 2015, 2026, 2019,
+     2020, 2019, 2022, 2020, 2023, 2024, 2027, 2031, 2032, 2023,
+     2024, 2026, 2027, 2033, 2029, 2034, 2037, 2028, 2020, 2025,
+     2020, 2035, 2028, 2036, 2038, 2033, 2039, 2035, 2039, 2031,
+     2032, 2040, 2041, 2027, 2031, 2032, 2042, 2046, 2037, 2043,
+     2033, 2047, 2044, 2037, 2045, 2040, 2038, 2034, 2035, 2048,
+     2046, 2038, 2049, 2039, 2042, 2036, 2041, 2043, 2040, 2041,
+     2044, 2051, 2045, 2042, 2046, 2053, 2043, 2054, 2051, 2044,
+     2055, 2045, 2056, 2047, 2059, 2049, 2060, 2061, 2062, 2049,
+
+     2056, 2048, 2057, 2053, 2057, 2059,    0, 2060, 2051, 2057,
+     2062, 2065, 2053, 2054, 2054, 2063, 2070, 2066, 2056, 2056,
+     2067, 2059, 2055, 2060, 2061, 2062, 2065, 2056, 2066, 2057,
+     2068, 2057, 2067, 2063, 2071, 2073, 2074, 2077, 2065, 2072,
+     2070, 2075, 2063, 2070, 2066, 2068, 2072, 2067, 2078, 2079,
+     2073, 2080, 2081, 2082,    0, 2084, 2071, 2068,    0, 2085,
+     2083, 2071, 2073, 2074, 2077, 2086, 2072, 2075, 2075, 2087,
+     2090, 2079, 2078, 2083, 2085, 2078, 2079, 2087, 2086, 2088,
+     2082, 2084, 2084, 2080, 2081, 2091, 2085, 2083, 2092, 2093,
+     2094, 2095, 2086, 2090, 2097,    0, 2087, 2090, 2095, 2096,
+
+     2098, 2100, 2104, 2101, 2107, 2088, 2088, 2113, 2094, 2091,
+     2101, 2093, 2091, 2102, 2098, 2092, 2093, 2094, 2095, 2103,
+     2102, 2097, 2096, 2100, 2105, 2104, 2096, 2098, 2100, 2104,
+     2101, 2105, 2103, 2106, 2109, 2108, 2107, 2111, 2114, 2113,
+     2102, 2112, 2115, 2109, 2119, 2118, 2103,    0, 2111, 2120,
+     2127, 2105, 2121, 2121, 2122, 2106, 2108, 2114, 2118, 2124,
+     2106, 2109, 2108, 2112, 2111, 2114, 2125, 2115, 2112, 2115,
+     2119, 2119, 2118, 2120, 2126, 2128, 2120, 2127, 2131, 2121,
+     2122, 2122, 2124, 2133, 2135, 2136, 2124, 2139, 2143, 2126,
+     2140, 2140, 2133, 2128, 2141,    0, 2136, 2135, 2125, 2145,
+
+     2142, 2126, 2128, 2147, 2148, 2131, 2151, 2149,    0, 2139,
+     2133, 2135, 2136, 2155, 2139, 2143, 2141, 2140, 2149, 2150,
+     2162, 2141, 2142, 2154, 2150, 2157, 2145, 2142, 2151, 2153,
+     2148, 2148, 2158, 2151, 2149, 2147, 2159, 2153, 2154, 2160,
+     2155, 2163, 2167, 2157, 2164, 2159, 2150, 2162, 2166, 2163,
+     2154, 2160, 2157, 2164, 2168, 2170, 2153, 2171, 2169,    0,
+        0, 2172, 2175, 2159, 2158, 2173, 2160, 2169, 2163, 2167,
+     2174, 2164, 2176, 2170, 2166, 2166, 2168, 2175, 2173, 2171,
+     2177, 2168, 2170, 2174, 2171, 2169, 2172, 2177, 2172, 2175,
+     2178, 2179, 2173, 2180, 2176, 2181, 2182, 2174, 2183, 2176,
+
+     2184, 2188, 2185,    0, 2186,    0, 2187, 2177, 2190, 2184,
+     2191, 2189, 2178, 2183, 2192, 2190, 2188, 2178, 2179, 2194,
+     2180, 2191, 2181, 2182, 2185, 2183, 2189, 2184, 2188, 2185,
+     2186, 2186, 2187, 2187, 2193, 2190, 2195, 2191, 2189, 2196,
+     2198, 2192, 2193, 2197, 2199, 2200, 2194, 2201, 2204, 2202,
+     2203,    0, 2200,    0, 2208, 2196, 2202, 2203, 2197, 2199,
+     2198, 2193, 2205, 2195, 2206, 2206, 2196, 2198, 2208, 2201,
+     2197, 2199, 2200, 2210, 2201, 2204, 2202, 2203, 2207, 2209,
+     2205, 2208, 2209, 2211, 2212, 2207, 2210, 2213, 2216, 2205,
+     2217, 2206, 2214,    0, 2218, 2217, 2219, 2216, 2218, 2213,
+
+     2210, 2223, 2212, 2220, 2214, 2207, 2209, 2221,    0, 2211,
+     2211, 2212, 2224, 2222, 2213, 2216, 2220, 2217, 2225, 2214,
+     2219, 2218, 2227, 2219, 2229, 2231, 2234, 2230, 2223, 2221,
+     2220,    0, 2236, 2234, 2221, 2222, 2230, 2236, 2232, 2224,
+     2222, 2231, 2238, 2243, 2225, 2225, 2232, 2235, 2227, 2227,
+     2229, 2229, 2231, 2234, 2230, 2237, 2235, 2239, 2240, 2236,
+     2238, 2241, 2237, 2244, 2239, 2232, 2246, 2240, 2244, 2238,
+     2243, 2245, 2249, 2248, 2235, 2252,    0, 2250,    0,    0,
+     2258, 2260, 2237, 2251, 2239, 2240, 2250, 2241, 2241, 2245,
+     2244, 2248, 2251, 2246, 2253, 2252, 2254, 2256, 2245, 2249,
+
+     2248, 2257, 2252, 2255, 2250, 2254, 2253, 2258, 2256, 2257,
+     2251, 2259, 2255, 2260, 2262, 2264, 2261, 2269, 2267, 2263,
+     2271, 2253, 2265, 2254, 2256, 2261, 2262, 2263, 2257, 2265,
+     2255, 2268, 2266,    0,    0, 2270, 2275, 2264, 2259, 2266,
+     2267, 2262, 2264, 2261, 2269, 2267, 2263, 2271, 2278, 2265,
+     2279, 2277, 2286, 2273, 2275, 2278, 2268, 2276, 2268, 2266,
+     2270, 2273, 2270, 2275, 2280, 2276, 2277, 2284, 2281, 2285,
+     2287, 2280, 2279, 2289, 2284, 2278, 2281, 2279, 2277, 2286,
+     2273, 2288, 2287, 2290, 2276, 2294, 2292, 2295, 2293, 2299,
+     2288, 2280, 2297, 2285, 2284, 2281, 2285, 2287, 2292, 2297,
+
+     2289, 2295, 2298, 2301, 2302, 2303, 2290, 2304, 2288, 2298,
+     2290, 2293, 2294, 2292, 2295, 2293, 2299, 2305, 2301, 2297,
+     2306, 2307, 2302, 2308, 2309, 2305, 2311, 2310, 2303, 2298,
+     2301, 2302, 2303, 2316, 2304, 2309, 2318,    0, 2319, 2321,
+     2317, 2308, 2310, 2307, 2305, 2317, 2322, 2306, 2307, 2323,
+     2308, 2309, 2319, 2311, 2310, 2320, 2324, 2321, 2326, 2316,
+     2316, 2331, 2329, 2318, 2322, 2319, 2321, 2317, 2324, 2320,
+     2330, 2332, 2333, 2322, 2331, 2336, 2323, 2335, 2334, 2339,
+     2342,    0, 2320, 2324, 2329, 2326, 2334, 2340, 2331, 2329,
+     2343, 2333, 2330, 2332, 2336, 2335, 2338, 2330, 2332, 2333,
+
+     2341, 2339, 2336, 2348, 2335, 2334, 2339, 2342, 2338, 2340,
+     2344, 2345, 2341, 2346, 2340, 2347, 2351, 2343, 2350, 2349,
+        0, 2353, 2346, 2338, 2347, 2352, 2354, 2341, 2351, 2358,
+     2344, 2359, 2361, 2345, 2360, 2348, 2357, 2344, 2345, 2360,
+     2346, 2349, 2347, 2351, 2350, 2350, 2349, 2352, 2353, 2362,
+     2357, 2363, 2352, 2354, 2361, 2359, 2358, 2364, 2359, 2361,
+     2365, 2366, 2367, 2357,    0,    0, 2360, 2368, 2369, 2372,
+     2370, 2362,    0,    0, 2367, 2373, 2362, 2375, 2377, 2366,
+     2364, 2378, 2365, 2363, 2364, 2370, 2368, 2365, 2366, 2367,
+     2369, 2372, 2375, 2381, 2368, 2369, 2372, 2370, 2379, 2373,
+
+     2377, 2380, 2373, 2378, 2375, 2377, 2382, 2379, 2378, 2383,
+     2387, 2381, 2384, 2390, 2388, 2380, 2392, 2393, 2387, 2389,
+     2381, 2388, 2394, 2391, 2382, 2379,    0, 2389, 2380, 2393,
+     2384, 2391, 2401, 2382, 2392, 2383, 2383, 2387, 2400, 2384,
+     2390, 2388, 2397, 2392, 2393, 2395, 2389, 2403, 2399, 2394,
+     2391, 2406, 2404, 2395, 2397, 2399, 2402, 2405, 2402, 2401,
+     2411, 2400,    0, 2407, 2408, 2400,    0, 2410, 2414, 2397,
+     2413, 2418, 2395, 2417, 2411, 2399, 2415, 2419, 2406, 2403,
+     2421, 2414, 2407, 2402, 2404, 2410, 2408, 2411, 2415, 2405,
+     2407, 2408, 2422, 2413, 2410, 2414, 2423, 2413, 2418, 2417,
+
+     2417, 2425, 2427, 2415, 2419, 2428, 2429, 2421, 2430, 2427,
+     2432,    0, 2433, 2430, 2435, 2422, 2436, 2432, 2423, 2422,
+     2437, 2429, 2438, 2423, 2442, 2440, 2443, 2428, 2425, 2427,
+     2444, 2442, 2428, 2429, 2440, 2445, 2438, 2432, 2433, 2433,
+     2430, 2435, 2446, 2436, 2437, 2447, 2448, 2437, 2450, 2438,
+     2449, 2442, 2440, 2443, 2446, 2451, 2444, 2444, 2452, 2449,
+     2448, 2450, 2445, 2453, 2457, 2456, 2463, 2458, 2457, 2446,
+     2456, 2459, 2447, 2448, 2458, 2450, 2461, 2449, 2459, 2460,
+     2462,    0, 2462, 2464, 2469, 2452, 2453, 2451, 2470, 2463,
+     2453, 2457, 2467, 2463, 2458, 2476, 2473, 2456, 2459, 2472,
+
+     2460, 2472, 2475, 2469, 2476, 2479, 2460, 2462, 2461, 2477,
+     2464, 2469, 2470, 2484, 2467, 2470, 2477, 2474, 2474, 2467,
+     2473, 2478, 2476, 2473, 2475, 2480, 2472, 2474, 2481, 2475,
+     2482, 2483, 2479, 2480, 2478, 2482, 2477, 2485, 2489, 2483,
+     2484, 2486,    0, 2487, 2474, 2474, 2488, 2481, 2478, 2489,
+     2491,    0, 2480, 2490, 2494, 2481, 2493, 2491, 2483, 2492,
+     2492, 2494, 2482, 2485, 2485, 2489, 2497, 2486, 2486, 2487,
+     2487, 2495, 2488, 2488, 2493, 2490, 2498, 2491, 2495, 2499,
+     2490, 2494, 2501, 2493, 2502, 2503, 2492, 2506, 2499, 2507,
+     2508, 2504, 2509, 2497, 2512,    0, 2511, 2513, 2495,    0,
+
+     2498,    0, 2523, 2498, 2502, 2511, 2499, 2507, 2508, 2501,
+     2509, 2502, 2503, 2504, 2506, 2514, 2507, 2508, 2504, 2509,
+     2513, 2512, 2515, 2511, 2513, 2516, 2517, 2518, 2522, 2523,
+     2516, 2525, 2528, 2514, 2515, 2526, 2527, 2531, 2527,    0,
+     2517, 2528, 2514, 2530, 2534, 2518, 2534, 2535, 2526, 2515,
+     2522, 2537, 2531, 2517, 2518, 2522, 2559, 2516, 2525, 2528,
+     2536, 2530, 2526, 2527, 2531, 2535, 2539, 2536, 2543, 2541,
+     2530, 2534, 2544, 2546, 2535, 2541, 2545, 2551, 2552, 2548,
+     2553, 2539, 2549, 2537,    0, 2549,    0, 2536, 2559, 2556,
+     2543, 2546, 2554, 2539, 2544, 2543, 2541, 2556, 2557, 2544,
+
+     2546, 2548, 2545, 2545, 2551, 2552, 2548, 2553, 2549, 2549,
+     2554, 2555, 2549, 2560, 2561, 2562, 2556, 2563, 2555, 2554,
+     2557, 2564, 2566, 2565, 2567, 2557, 2563, 2564, 2568,    0,
+     2568, 2566, 2569, 2575, 2572, 2560, 2561,    0, 2555, 2571,
+     2560, 2561, 2562, 2577, 2563, 2565, 2572, 2571, 2564, 2566,
+     2565, 2573, 2579, 2578, 2580, 2568, 2567, 2577, 2573, 2569,
+     2575, 2572, 2581, 2582, 2583, 2584, 2571, 2578, 2585, 2585,
+     2577, 2582, 2580, 2581, 2586, 2579, 2587, 2589, 2573, 2579,
+     2578, 2580, 2590, 2583, 2587, 2594, 2596, 2584, 2592, 2581,
+     2582, 2583, 2584,    0, 2592, 2585, 2597, 2596, 2599, 2598,
+
+     2601, 2586, 2603, 2587, 2589, 2606, 2603, 2597, 2604, 2590,
+     2598, 2602, 2594, 2596, 2608, 2592, 2604, 2607, 2602, 2612,
+     2599, 2611, 2615, 2597,    0, 2599, 2598, 2601, 2611, 2603,
+     2607, 2606, 2606, 2613, 2614, 2604, 2616, 2618, 2602, 2614,
+     2617, 2608, 2619, 2622, 2607, 2621, 2623, 2617, 2611, 2615,
+     2620, 2612, 2621, 2626, 2623, 2613, 2618, 2627, 2619, 2624,
+     2613, 2614, 2628, 2616, 2618, 2635, 2636, 2617, 2620, 2619,
+     2632, 2625, 2621, 2623, 2624, 2622, 2634, 2620, 2625, 2637,
+     2626, 2627, 2638, 2618, 2627, 2632, 2624, 2633, 2628, 2628,
+     2636, 2638, 2635, 2636, 2633, 2640, 2641, 2632, 2625, 2642,
+
+     2643, 2645, 2644, 2644, 2647,    0, 2649, 2642, 2634, 2638,
+     2651, 2637, 2644, 2648, 2633, 2652, 2653, 2640, 2641, 2655,
+        0, 2648, 2640, 2641, 2649, 2656, 2642, 2657, 2645, 2644,
+     2644, 2647, 2643, 2649, 2654, 2658, 2659, 2651, 2653, 2661,
+     2648, 2655, 2652, 2653, 2666, 2664, 2655, 2654, 2669, 2666,
+     2667, 2668, 2656, 2664, 2657, 2667, 2668, 2671, 2659, 2675,
+     2672, 2654, 2658, 2659, 2674, 2677, 2661, 2680, 2683, 2673,
+        0, 2666, 2664, 2672, 2669, 2669, 2673, 2667, 2668, 2685,
+     2686, 2678, 2674, 2688, 2671, 2679, 2675, 2672, 2678, 2680,
+     2687, 2674, 2690, 2679, 2680, 2683, 2673, 2677, 2689, 2691,
+
+     2692, 2696, 2686, 2687,    0, 2697, 2685, 2686, 2678, 2694,
+     2698, 2690, 2679, 2689, 2695, 2688, 2694, 2687, 2705, 2690,
+     2697, 2695, 2692, 2696, 2700, 2689, 2691, 2692, 2696, 2705,
+     2701, 2698, 2697, 2702, 2715, 2703, 2694, 2698, 2701, 2704,
+     2702, 2695, 2703, 2700, 2707, 2705, 2706, 2706, 2704, 2712,
+     2707, 2700, 2711, 2708, 2716, 2717, 2706, 2701, 2721, 2711,
+     2702, 2715, 2703, 2712, 2723, 2727, 2704, 2724, 2724, 2725,
+     2725, 2707, 2729, 2706, 2706, 2708, 2712, 2730, 2717, 2711,
+     2708, 2716, 2717, 2726, 2726, 2721, 2730, 2731, 2727, 2735,
+     2733, 2723, 2727, 2736, 2734, 2740, 2724, 2733, 2725, 2729,
+
+     2731, 2734, 2741, 2739, 2730, 2739, 2742, 2743, 2746, 2745,
+     2748, 2735, 2726, 2747, 2731, 2740, 2735, 2733, 2745, 2743,
+     2736, 2734, 2740, 2749, 2742, 2741, 2746, 2751, 2754, 2741,
+     2739, 2750,    0, 2742, 2743, 2746, 2745, 2748, 2752, 2747,
+     2747, 2752, 2753, 2750, 2755, 2756, 2755, 2753, 2758, 2751,
+     2749, 2759, 2761, 2757, 2751, 2760, 2752, 2756, 2750, 2757,
+     2754, 2762, 2765, 2760, 2768, 2752, 2769, 2770, 2752, 2771,
+     2758, 2755, 2756, 2759, 2753, 2758, 2772, 2773, 2759, 2761,
+     2757, 2774, 2760, 2762, 2776, 2777, 2779, 2778, 2762, 2765,
+     2780, 2768, 2782, 2769, 2770, 2783, 2771, 2780, 2784, 2789,
+
+     2782, 2779, 2776, 2772, 2773, 2778, 2785, 2793, 2774, 2786,
+     2784, 2776, 2777, 2779, 2778, 2787, 2788, 2780, 2792, 2782,
+     2785, 2795, 2783, 2796, 2786, 2784, 2789, 2792, 2788, 2794,
+     2794, 2793, 2796, 2785, 2793, 2798, 2786, 2799, 2800, 2801,
+     2803, 2787, 2787, 2788, 2802, 2792, 2804, 2795, 2795, 2803,
+     2796, 2800, 2802, 2815, 2817, 2818, 2794, 2804, 2806, 2798,
+     2819, 2801, 2798, 2820, 2861, 2800, 2801, 2803, 2817, 2799,
+     2806, 2802, 2822, 2804, 2823, 2824, 2822, 2815, 2826, 2825,
+     2815, 2817, 2818, 2831, 2828, 2806, 2825, 2819, 2828,    0,
+     2820, 2826, 2823, 2829, 2830, 2832, 2861, 2833, 2824, 2822,
+
+     2834, 2823, 2824,    0, 2835, 2826, 2825, 2832, 2831, 2829,
+     2831, 2828, 2835, 2838, 2834, 2838, 2830, 2836, 2837, 2842,
+     2829, 2830, 2832, 2833, 2833, 2839, 2836, 2834, 2840, 2837,
+     2846, 2835, 2841, 2848, 2840, 2847, 2849, 2839, 2850, 2841,
+     2838, 2842, 2847, 2846, 2836, 2837, 2842, 2851, 2852, 2853,
+     2854, 2859, 2839, 2859, 2849, 2840, 2856, 2846, 2854, 2841,
+     2848, 2855, 2847, 2849, 2857, 2850, 2862, 2858, 2855, 2860,
+     2864, 2867, 2865, 2851, 2851, 2852, 2853, 2854, 2859, 2862,
+     2856, 2860, 2866, 2856, 2865, 2863, 2857, 2874, 2855, 2858,
+     2866, 2857, 2863, 2862, 2858, 2869, 2860, 2864, 2867, 2865,
+
+     2875, 2871, 2876, 2877, 2878, 2879, 2880, 2869, 2882, 2866,
+     2871, 2877, 2863, 2883, 2874, 2889, 2882, 2881, 2885, 2880,
+        0, 2876, 2869, 2905, 2885, 2886, 2875, 2875, 2871, 2876,
+     2877, 2881, 2886, 2880, 2888, 2882, 2878, 2879, 2889, 2891,
+     2883, 2892, 2889, 2893, 2881, 2885, 2891, 2888, 2894, 2896,
+     2895, 2893, 2886,    0, 2903, 2905, 2897, 2896, 2898,    0,
+     2900, 2888, 2894, 2892, 2895, 2901, 2891, 2900, 2892, 2904,
+     2893, 2902,    0, 2906, 2901, 2894, 2896, 2895, 2897, 2902,
+     2898, 2903, 2907, 2897, 2908, 2898, 2909, 2900, 2911, 2910,
+     2912, 2904, 2901,    0, 2914, 2916, 2904, 2910, 2902, 2906,
+
+     2906, 2913, 2917, 2921, 2907, 2918, 2908, 2919, 2909, 2907,
+     2917, 2908, 2923, 2909, 2925, 2919, 2910, 2912, 2916, 2920,
+     2911, 2914, 2916, 2913, 2927, 2918, 2923, 2920, 2913, 2917,
+     2922, 2929, 2918,    0, 2919, 2921, 2930, 2934, 2922, 2923,
+     2925, 2925, 2928,    0, 2930, 2928, 2920, 2931, 2932,    0,
+     2933, 2927, 2935, 2929, 2938, 2931, 2940, 2922, 2929, 2934,
+     2928, 2941, 2932, 2930, 2934, 2939, 2935, 2937, 2937, 2928,
+     2943, 2942, 2928, 2939, 2931, 2932, 2933, 2933, 2944, 2935,
+     2938, 2938, 2940, 2940, 2945, 2946, 2944, 2941, 2941, 2947,
+     2943, 2948, 2939, 2942, 2937, 2949, 2951, 2943, 2942, 2950,
+
+     2953, 2955, 2952, 2958, 2951, 2944, 2964, 2946, 2953, 2956,
+     2959, 2945, 2946, 2960, 2947, 2949, 2947, 2956, 2948, 2950,
+     2962, 2960, 2949, 2951, 2952, 2958, 2950, 2953, 2955, 2952,
+     2958, 2961, 2959, 2964, 2965, 2966, 2956, 2959, 2967, 2961,
+     2960, 2968, 2965, 2966, 2971, 2972, 2962, 2962, 2979, 2969,
+     2973, 2975, 2978, 2981, 2982, 2980, 2979,    0, 2961,    0,
+        0, 2965, 2966, 2980, 2967, 2967,    0,    0, 2968, 2969,
+     2973, 2971, 2972, 2975, 2978, 2979, 2969, 2973, 2975, 2978,
+     2981, 2982, 2980, 2986, 2986, 2986, 2986, 2986, 2986, 2986,
+     2987, 2987, 2987, 2987, 2987, 2987, 2987, 2988, 2988, 2988,
+
+     2988, 2988, 2988, 2988, 2989, 2989, 2989, 2989, 2989, 2989,
+     2989, 2990, 2990, 2990, 2990, 2990, 2990, 2990, 2992, 2992,
+        0, 2992, 2992, 2992, 2992, 2993, 2993,    0,    0,    0,
+     2993, 2993, 2994, 2994,    0,    0, 2994,    0, 2994, 2995,
+        0,    0,    0,    0,    0, 2995, 2996, 2996,    0,    0,
+        0, 2996, 2996, 2997,    0,    0,    0,    0,    0, 2997,
+     2998, 2998,    0, 2998, 2998, 2998, 2998, 2999, 2999,    0,
+     2999, 2999, 2999, 2999, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985, 2985,
+     2985
     } ;
 
 static yy_state_type yy_last_accepting_state;
@@ -3429,7 +3490,7 @@ static void config_end_include(void)
         }
 #endif
 
-#line 3431 "<stdout>"
+#line 3491 "<stdout>"
 #define YY_NO_INPUT 1
 #line 184 "util/configlexer.lex"
 #ifndef YY_NO_UNPUT
@@ -3438,9 +3499,9 @@ static void config_end_include(void)
 #ifndef YY_NO_INPUT
 #define YY_NO_INPUT 1
 #endif
-#line 3440 "<stdout>"
+#line 3500 "<stdout>"
 
-#line 3442 "<stdout>"
+#line 3502 "<stdout>"
 
 #define INITIAL 0
 #define quotedstring 1
@@ -3662,7 +3723,7 @@ YY_DECL
 	{
 #line 204 "util/configlexer.lex"
 
-#line 3664 "<stdout>"
+#line 3724 "<stdout>"
 
 	while ( /*CONSTCOND*/1 )		/* loops until end-of-file is reached */
 		{
@@ -3695,13 +3756,13 @@ yy_match:
 			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 				{
 				yy_current_state = (int) yy_def[yy_current_state];
-				if ( yy_current_state >= 2913 )
+				if ( yy_current_state >= 2986 )
 					yy_c = yy_meta[yy_c];
 				}
 			yy_current_state = yy_nxt[yy_base[yy_current_state] + yy_c];
 			++yy_cp;
 			}
-		while ( yy_base[yy_current_state] != 8310 );
+		while ( yy_base[yy_current_state] != 8475 );
 
 yy_find_action:
 		yy_act = yy_accept[yy_current_state];
@@ -4286,857 +4347,897 @@ YY_RULE_SETUP
 case 112:
 YY_RULE_SETUP
 #line 319 "util/configlexer.lex"
-{ YDVAR(1, VAR_ZONEFILE) }
+{ YDVAR(0, VAR_RPZ) }
 	YY_BREAK
 case 113:
 YY_RULE_SETUP
 #line 320 "util/configlexer.lex"
-{ YDVAR(1, VAR_MASTER) }
+{ YDVAR(1, VAR_TAGS) }
 	YY_BREAK
 case 114:
 YY_RULE_SETUP
 #line 321 "util/configlexer.lex"
-{ YDVAR(1, VAR_URL) }
+{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) }
 	YY_BREAK
 case 115:
 YY_RULE_SETUP
 #line 322 "util/configlexer.lex"
-{ YDVAR(1, VAR_ALLOW_NOTIFY) }
+{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) }
 	YY_BREAK
 case 116:
 YY_RULE_SETUP
 #line 323 "util/configlexer.lex"
-{ YDVAR(1, VAR_FOR_DOWNSTREAM) }
+{ YDVAR(1, VAR_RPZ_LOG) }
 	YY_BREAK
 case 117:
 YY_RULE_SETUP
 #line 324 "util/configlexer.lex"
-{ YDVAR(1, VAR_FOR_UPSTREAM) }
+{ YDVAR(1, VAR_RPZ_LOG_NAME) }
 	YY_BREAK
 case 118:
 YY_RULE_SETUP
 #line 325 "util/configlexer.lex"
-{ YDVAR(1, VAR_FALLBACK_ENABLED) }
+{ YDVAR(1, VAR_ZONEFILE) }
 	YY_BREAK
 case 119:
 YY_RULE_SETUP
 #line 326 "util/configlexer.lex"
-{ YDVAR(0, VAR_VIEW) }
+{ YDVAR(1, VAR_MASTER) }
 	YY_BREAK
 case 120:
 YY_RULE_SETUP
 #line 327 "util/configlexer.lex"
-{ YDVAR(1, VAR_VIEW_FIRST) }
+{ YDVAR(1, VAR_URL) }
 	YY_BREAK
 case 121:
 YY_RULE_SETUP
 #line 328 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
+{ YDVAR(1, VAR_ALLOW_NOTIFY) }
 	YY_BREAK
 case 122:
 YY_RULE_SETUP
 #line 329 "util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
+{ YDVAR(1, VAR_FOR_DOWNSTREAM) }
 	YY_BREAK
 case 123:
 YY_RULE_SETUP
 #line 330 "util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL) }
+{ YDVAR(1, VAR_FOR_UPSTREAM) }
 	YY_BREAK
 case 124:
 YY_RULE_SETUP
 #line 331 "util/configlexer.lex"
-{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
+{ YDVAR(1, VAR_FALLBACK_ENABLED) }
 	YY_BREAK
 case 125:
 YY_RULE_SETUP
 #line 332 "util/configlexer.lex"
-{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
+{ YDVAR(0, VAR_VIEW) }
 	YY_BREAK
 case 126:
 YY_RULE_SETUP
 #line 333 "util/configlexer.lex"
-{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
+{ YDVAR(1, VAR_VIEW_FIRST) }
 	YY_BREAK
 case 127:
 YY_RULE_SETUP
 #line 334 "util/configlexer.lex"
-{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
 	YY_BREAK
 case 128:
 YY_RULE_SETUP
 #line 335 "util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
 	YY_BREAK
 case 129:
 YY_RULE_SETUP
 #line 336 "util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
+{ YDVAR(2, VAR_ACCESS_CONTROL) }
 	YY_BREAK
 case 130:
 YY_RULE_SETUP
 #line 337 "util/configlexer.lex"
-{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
+{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
 	YY_BREAK
 case 131:
 YY_RULE_SETUP
 #line 338 "util/configlexer.lex"
-{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
+{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
 	YY_BREAK
 case 132:
 YY_RULE_SETUP
 #line 339 "util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
+{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
 	YY_BREAK
 case 133:
 YY_RULE_SETUP
 #line 340 "util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
+{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
 	YY_BREAK
 case 134:
 YY_RULE_SETUP
 #line 341 "util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_IDENTITY) }
+{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
 	YY_BREAK
 case 135:
 YY_RULE_SETUP
 #line 342 "util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_VERSION) }
+{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
 	YY_BREAK
 case 136:
 YY_RULE_SETUP
 #line 343 "util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
+{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
 	YY_BREAK
 case 137:
 YY_RULE_SETUP
 #line 344 "util/configlexer.lex"
-{ YDVAR(1, VAR_IDENTITY) }
+{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
 	YY_BREAK
 case 138:
 YY_RULE_SETUP
 #line 345 "util/configlexer.lex"
-{ YDVAR(1, VAR_VERSION) }
+{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
 	YY_BREAK
 case 139:
 YY_RULE_SETUP
 #line 346 "util/configlexer.lex"
-{ YDVAR(1, VAR_MODULE_CONF) }
+{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
 	YY_BREAK
 case 140:
 YY_RULE_SETUP
 #line 347 "util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR) }
+{ YDVAR(1, VAR_HIDE_IDENTITY) }
 	YY_BREAK
 case 141:
 YY_RULE_SETUP
 #line 348 "util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
+{ YDVAR(1, VAR_HIDE_VERSION) }
 	YY_BREAK
 case 142:
 YY_RULE_SETUP
 #line 349 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
 	YY_BREAK
 case 143:
 YY_RULE_SETUP
 #line 350 "util/configlexer.lex"
-{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_IDENTITY) }
 	YY_BREAK
 case 144:
 YY_RULE_SETUP
 #line 351 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
+{ YDVAR(1, VAR_VERSION) }
 	YY_BREAK
 case 145:
 YY_RULE_SETUP
 #line 352 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR) }
+{ YDVAR(1, VAR_MODULE_CONF) }
 	YY_BREAK
 case 146:
 YY_RULE_SETUP
 #line 353 "util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
+{ YDVAR(1, VAR_DLV_ANCHOR) }
 	YY_BREAK
 case 147:
 YY_RULE_SETUP
 #line 354 "util/configlexer.lex"
-{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
+{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
 	YY_BREAK
 case 148:
 YY_RULE_SETUP
 #line 355 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
+{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 149:
 YY_RULE_SETUP
 #line 356 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
+{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 150:
 YY_RULE_SETUP
 #line 357 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
+{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
 	YY_BREAK
 case 151:
 YY_RULE_SETUP
 #line 358 "util/configlexer.lex"
-{ YDVAR(1, VAR_BOGUS_TTL) }
+{ YDVAR(1, VAR_TRUST_ANCHOR) }
 	YY_BREAK
 case 152:
 YY_RULE_SETUP
 #line 359 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
+{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
 	YY_BREAK
 case 153:
 YY_RULE_SETUP
 #line 360 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
 	YY_BREAK
 case 154:
 YY_RULE_SETUP
 #line 361 "util/configlexer.lex"
-{ YDVAR(1, VAR_AGGRESSIVE_NSEC) }
+{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
 	YY_BREAK
 case 155:
 YY_RULE_SETUP
 #line 362 "util/configlexer.lex"
-{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
 	YY_BREAK
 case 156:
 YY_RULE_SETUP
 #line 363 "util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 	YY_BREAK
 case 157:
 YY_RULE_SETUP
 #line 364 "util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
+{ YDVAR(1, VAR_BOGUS_TTL) }
 	YY_BREAK
 case 158:
 YY_RULE_SETUP
 #line 365 "util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
+{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 	YY_BREAK
 case 159:
 YY_RULE_SETUP
 #line 366 "util/configlexer.lex"
-{ YDVAR(1, VAR_FAKE_DSA) }
+{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
 	YY_BREAK
 case 160:
 YY_RULE_SETUP
 #line 367 "util/configlexer.lex"
-{ YDVAR(1, VAR_FAKE_SHA1) }
+{ YDVAR(1, VAR_AGGRESSIVE_NSEC) }
 	YY_BREAK
 case 161:
 YY_RULE_SETUP
 #line 368 "util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
+{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
 	YY_BREAK
 case 162:
 YY_RULE_SETUP
 #line 369 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
+{ YDVAR(1, VAR_SERVE_EXPIRED) }
 	YY_BREAK
 case 163:
 YY_RULE_SETUP
 #line 370 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
 	YY_BREAK
 case 164:
 YY_RULE_SETUP
 #line 371 "util/configlexer.lex"
-{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
 	YY_BREAK
 case 165:
 YY_RULE_SETUP
 #line 372 "util/configlexer.lex"
-{ 
-				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) }
 	YY_BREAK
 case 166:
 YY_RULE_SETUP
-#line 374 "util/configlexer.lex"
-{ YDVAR(1, VAR_ADD_HOLDDOWN) }
+#line 373 "util/configlexer.lex"
+{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) }
 	YY_BREAK
 case 167:
 YY_RULE_SETUP
-#line 375 "util/configlexer.lex"
-{ YDVAR(1, VAR_DEL_HOLDDOWN) }
+#line 374 "util/configlexer.lex"
+{ YDVAR(1, VAR_FAKE_DSA) }
 	YY_BREAK
 case 168:
 YY_RULE_SETUP
-#line 376 "util/configlexer.lex"
-{ YDVAR(1, VAR_KEEP_MISSING) }
+#line 375 "util/configlexer.lex"
+{ YDVAR(1, VAR_FAKE_SHA1) }
 	YY_BREAK
 case 169:
 YY_RULE_SETUP
-#line 377 "util/configlexer.lex"
-{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
+#line 376 "util/configlexer.lex"
+{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 	YY_BREAK
 case 170:
 YY_RULE_SETUP
-#line 378 "util/configlexer.lex"
-{ YDVAR(1, VAR_USE_SYSLOG) }
+#line 377 "util/configlexer.lex"
+{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 	YY_BREAK
 case 171:
 YY_RULE_SETUP
-#line 379 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_IDENTITY) }
+#line 378 "util/configlexer.lex"
+{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 	YY_BREAK
 case 172:
 YY_RULE_SETUP
-#line 380 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_TIME_ASCII) }
+#line 379 "util/configlexer.lex"
+{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
 	YY_BREAK
 case 173:
 YY_RULE_SETUP
-#line 381 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_QUERIES) }
+#line 380 "util/configlexer.lex"
+{ 
+				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 	YY_BREAK
 case 174:
 YY_RULE_SETUP
 #line 382 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_REPLIES) }
+{ YDVAR(1, VAR_ADD_HOLDDOWN) }
 	YY_BREAK
 case 175:
 YY_RULE_SETUP
 #line 383 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
+{ YDVAR(1, VAR_DEL_HOLDDOWN) }
 	YY_BREAK
 case 176:
 YY_RULE_SETUP
 #line 384 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
+{ YDVAR(1, VAR_KEEP_MISSING) }
 	YY_BREAK
 case 177:
 YY_RULE_SETUP
 #line 385 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_SERVFAIL) }
+{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
 	YY_BREAK
 case 178:
 YY_RULE_SETUP
 #line 386 "util/configlexer.lex"
-{ YDVAR(2, VAR_LOCAL_ZONE) }
+{ YDVAR(1, VAR_USE_SYSLOG) }
 	YY_BREAK
 case 179:
 YY_RULE_SETUP
 #line 387 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA) }
+{ YDVAR(1, VAR_LOG_IDENTITY) }
 	YY_BREAK
 case 180:
 YY_RULE_SETUP
 #line 388 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
+{ YDVAR(1, VAR_LOG_TIME_ASCII) }
 	YY_BREAK
 case 181:
 YY_RULE_SETUP
 #line 389 "util/configlexer.lex"
-{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
+{ YDVAR(1, VAR_LOG_QUERIES) }
 	YY_BREAK
 case 182:
 YY_RULE_SETUP
 #line 390 "util/configlexer.lex"
-{ YDVAR(1, VAR_INSECURE_LAN_ZONES) }
+{ YDVAR(1, VAR_LOG_REPLIES) }
 	YY_BREAK
 case 183:
 YY_RULE_SETUP
 #line 391 "util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
+{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
 	YY_BREAK
 case 184:
 YY_RULE_SETUP
 #line 392 "util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
+{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
 	YY_BREAK
 case 185:
 YY_RULE_SETUP
 #line 393 "util/configlexer.lex"
-{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
+{ YDVAR(1, VAR_LOG_SERVFAIL) }
 	YY_BREAK
 case 186:
 YY_RULE_SETUP
 #line 394 "util/configlexer.lex"
-{ YDVAR(1, VAR_SHM_ENABLE) }
+{ YDVAR(2, VAR_LOCAL_ZONE) }
 	YY_BREAK
 case 187:
 YY_RULE_SETUP
 #line 395 "util/configlexer.lex"
-{ YDVAR(1, VAR_SHM_KEY) }
+{ YDVAR(1, VAR_LOCAL_DATA) }
 	YY_BREAK
 case 188:
 YY_RULE_SETUP
 #line 396 "util/configlexer.lex"
-{ YDVAR(0, VAR_REMOTE_CONTROL) }
+{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
 	YY_BREAK
 case 189:
 YY_RULE_SETUP
 #line 397 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_ENABLE) }
+{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
 	YY_BREAK
 case 190:
 YY_RULE_SETUP
 #line 398 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_INTERFACE) }
+{ YDVAR(1, VAR_INSECURE_LAN_ZONES) }
 	YY_BREAK
 case 191:
 YY_RULE_SETUP
 #line 399 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_PORT) }
+{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
 	YY_BREAK
 case 192:
 YY_RULE_SETUP
 #line 400 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_USE_CERT) }
+{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
 	YY_BREAK
 case 193:
 YY_RULE_SETUP
 #line 401 "util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_KEY_FILE) }
+{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
 	YY_BREAK
 case 194:
 YY_RULE_SETUP
 #line 402 "util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_CERT_FILE) }
+{ YDVAR(1, VAR_SHM_ENABLE) }
 	YY_BREAK
 case 195:
 YY_RULE_SETUP
 #line 403 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
+{ YDVAR(1, VAR_SHM_KEY) }
 	YY_BREAK
 case 196:
 YY_RULE_SETUP
 #line 404 "util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
+{ YDVAR(0, VAR_REMOTE_CONTROL) }
 	YY_BREAK
 case 197:
 YY_RULE_SETUP
 #line 405 "util/configlexer.lex"
-{ YDVAR(1, VAR_PYTHON_SCRIPT) }
+{ YDVAR(1, VAR_CONTROL_ENABLE) }
 	YY_BREAK
 case 198:
 YY_RULE_SETUP
 #line 406 "util/configlexer.lex"
-{ YDVAR(0, VAR_PYTHON) }
+{ YDVAR(1, VAR_CONTROL_INTERFACE) }
 	YY_BREAK
 case 199:
 YY_RULE_SETUP
 #line 407 "util/configlexer.lex"
-{ YDVAR(1, VAR_DOMAIN_INSECURE) }
+{ YDVAR(1, VAR_CONTROL_PORT) }
 	YY_BREAK
 case 200:
 YY_RULE_SETUP
 #line 408 "util/configlexer.lex"
-{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
+{ YDVAR(1, VAR_CONTROL_USE_CERT) }
 	YY_BREAK
 case 201:
 YY_RULE_SETUP
 #line 409 "util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
+{ YDVAR(1, VAR_SERVER_KEY_FILE) }
 	YY_BREAK
 case 202:
 YY_RULE_SETUP
 #line 410 "util/configlexer.lex"
-{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
+{ YDVAR(1, VAR_SERVER_CERT_FILE) }
 	YY_BREAK
 case 203:
 YY_RULE_SETUP
 #line 411 "util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_UDP_SIZE) }
+{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
 	YY_BREAK
 case 204:
 YY_RULE_SETUP
 #line 412 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_PREFIX) }
+{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
 	YY_BREAK
 case 205:
 YY_RULE_SETUP
 #line 413 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_SYNTHALL) }
+{ YDVAR(1, VAR_PYTHON_SCRIPT) }
 	YY_BREAK
 case 206:
 YY_RULE_SETUP
 #line 414 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
+{ YDVAR(0, VAR_PYTHON) }
 	YY_BREAK
 case 207:
 YY_RULE_SETUP
 #line 415 "util/configlexer.lex"
-{ YDVAR(1, VAR_DEFINE_TAG) }
+{ YDVAR(1, VAR_DOMAIN_INSECURE) }
 	YY_BREAK
 case 208:
 YY_RULE_SETUP
 #line 416 "util/configlexer.lex"
-{ YDVAR(2, VAR_LOCAL_ZONE_TAG) }
+{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
 	YY_BREAK
 case 209:
 YY_RULE_SETUP
 #line 417 "util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
+{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
 	YY_BREAK
 case 210:
 YY_RULE_SETUP
 #line 418 "util/configlexer.lex"
-{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
+{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
 	YY_BREAK
 case 211:
 YY_RULE_SETUP
 #line 419 "util/configlexer.lex"
-{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
+{ YDVAR(1, VAR_MAX_UDP_SIZE) }
 	YY_BREAK
 case 212:
 YY_RULE_SETUP
 #line 420 "util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
+{ YDVAR(1, VAR_DNS64_PREFIX) }
 	YY_BREAK
 case 213:
 YY_RULE_SETUP
 #line 421 "util/configlexer.lex"
-{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
+{ YDVAR(1, VAR_DNS64_SYNTHALL) }
 	YY_BREAK
 case 214:
 YY_RULE_SETUP
 #line 422 "util/configlexer.lex"
-{ YDVAR(0, VAR_DNSTAP) }
+{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
 	YY_BREAK
 case 215:
 YY_RULE_SETUP
 #line 423 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_ENABLE) }
+{ YDVAR(1, VAR_DEFINE_TAG) }
 	YY_BREAK
 case 216:
 YY_RULE_SETUP
 #line 424 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
+{ YDVAR(2, VAR_LOCAL_ZONE_TAG) }
 	YY_BREAK
 case 217:
 YY_RULE_SETUP
 #line 425 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
+{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
 	YY_BREAK
 case 218:
 YY_RULE_SETUP
 #line 426 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
+{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
 	YY_BREAK
 case 219:
 YY_RULE_SETUP
 #line 427 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
+{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
 	YY_BREAK
 case 220:
 YY_RULE_SETUP
 #line 428 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_VERSION) }
+{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
 	YY_BREAK
 case 221:
 YY_RULE_SETUP
 #line 429 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
+{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
 	YY_BREAK
 case 222:
 YY_RULE_SETUP
-#line 431 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
+#line 430 "util/configlexer.lex"
+{ YDVAR(0, VAR_DNSTAP) }
 	YY_BREAK
 case 223:
 YY_RULE_SETUP
-#line 433 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
+#line 431 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_ENABLE) }
 	YY_BREAK
 case 224:
 YY_RULE_SETUP
-#line 435 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+#line 432 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
 	YY_BREAK
 case 225:
 YY_RULE_SETUP
-#line 437 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+#line 433 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
 	YY_BREAK
 case 226:
 YY_RULE_SETUP
-#line 439 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
+#line 434 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
 	YY_BREAK
 case 227:
 YY_RULE_SETUP
-#line 441 "util/configlexer.lex"
-{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
+#line 435 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
 	YY_BREAK
 case 228:
 YY_RULE_SETUP
-#line 442 "util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT) }
+#line 436 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_VERSION) }
 	YY_BREAK
 case 229:
 YY_RULE_SETUP
-#line 443 "util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT) }
+#line 437 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
 	YY_BREAK
 case 230:
 YY_RULE_SETUP
-#line 444 "util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
+#line 439 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
 	YY_BREAK
 case 231:
 YY_RULE_SETUP
-#line 445 "util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_SLABS) }
+#line 441 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
 	YY_BREAK
 case 232:
 YY_RULE_SETUP
-#line 446 "util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
+#line 443 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
 	YY_BREAK
 case 233:
 YY_RULE_SETUP
-#line 447 "util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_SIZE) }
+#line 445 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
 	YY_BREAK
 case 234:
 YY_RULE_SETUP
-#line 448 "util/configlexer.lex"
-{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
+#line 447 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
 	YY_BREAK
 case 235:
 YY_RULE_SETUP
 #line 449 "util/configlexer.lex"
-{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
+{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
 	YY_BREAK
 case 236:
 YY_RULE_SETUP
 #line 450 "util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
+{ YDVAR(1, VAR_IP_RATELIMIT) }
 	YY_BREAK
 case 237:
 YY_RULE_SETUP
 #line 451 "util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
+{ YDVAR(1, VAR_RATELIMIT) }
 	YY_BREAK
 case 238:
 YY_RULE_SETUP
 #line 452 "util/configlexer.lex"
-{ YDVAR(1, VAR_LOW_RTT) }
+{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
 	YY_BREAK
 case 239:
 YY_RULE_SETUP
 #line 453 "util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_NUM) }
+{ YDVAR(1, VAR_RATELIMIT_SLABS) }
 	YY_BREAK
 case 240:
 YY_RULE_SETUP
 #line 454 "util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
 	YY_BREAK
 case 241:
 YY_RULE_SETUP
 #line 455 "util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+{ YDVAR(1, VAR_RATELIMIT_SIZE) }
 	YY_BREAK
 case 242:
 YY_RULE_SETUP
 #line 456 "util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
 	YY_BREAK
 case 243:
 YY_RULE_SETUP
 #line 457 "util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
+{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
 	YY_BREAK
 case 244:
 YY_RULE_SETUP
 #line 458 "util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP) }
+{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
 	YY_BREAK
 case 245:
 YY_RULE_SETUP
 #line 459 "util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
+{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
 	YY_BREAK
 case 246:
 YY_RULE_SETUP
 #line 460 "util/configlexer.lex"
-{ YDVAR(0, VAR_DNSCRYPT) }
+{ YDVAR(1, VAR_LOW_RTT) }
 	YY_BREAK
 case 247:
 YY_RULE_SETUP
 #line 461 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
+{ YDVAR(1, VAR_FAST_SERVER_NUM) }
 	YY_BREAK
 case 248:
 YY_RULE_SETUP
 #line 462 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PORT) }
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 	YY_BREAK
 case 249:
 YY_RULE_SETUP
 #line 463 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 	YY_BREAK
 case 250:
 YY_RULE_SETUP
 #line 464 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 	YY_BREAK
 case 251:
 YY_RULE_SETUP
 #line 465 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
+{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
 	YY_BREAK
 case 252:
 YY_RULE_SETUP
 #line 466 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
+{ YDVAR(2, VAR_RESPONSE_IP) }
 	YY_BREAK
 case 253:
 YY_RULE_SETUP
 #line 467 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
+{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
 	YY_BREAK
 case 254:
 YY_RULE_SETUP
-#line 469 "util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
+#line 468 "util/configlexer.lex"
+{ YDVAR(0, VAR_DNSCRYPT) }
 	YY_BREAK
 case 255:
 YY_RULE_SETUP
-#line 471 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
+#line 469 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
 	YY_BREAK
 case 256:
 YY_RULE_SETUP
-#line 472 "util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
+#line 470 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PORT) }
 	YY_BREAK
 case 257:
 YY_RULE_SETUP
-#line 473 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
+#line 471 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
 	YY_BREAK
 case 258:
 YY_RULE_SETUP
-#line 474 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
+#line 472 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
 	YY_BREAK
 case 259:
 YY_RULE_SETUP
-#line 475 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_HOOK) }
+#line 473 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
 	YY_BREAK
 case 260:
 YY_RULE_SETUP
-#line 476 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
+#line 474 "util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
 	YY_BREAK
 case 261:
 YY_RULE_SETUP
-#line 477 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
+#line 475 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
 	YY_BREAK
 case 262:
 YY_RULE_SETUP
-#line 478 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_STRICT) }
+#line 477 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
 	YY_BREAK
 case 263:
 YY_RULE_SETUP
 #line 479 "util/configlexer.lex"
-{ YDVAR(0, VAR_CACHEDB) }
+{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
 	YY_BREAK
 case 264:
 YY_RULE_SETUP
 #line 480 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_BACKEND) }
+{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
 	YY_BREAK
 case 265:
 YY_RULE_SETUP
 #line 481 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
+{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
 	YY_BREAK
 case 266:
 YY_RULE_SETUP
 #line 482 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
+{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
 	YY_BREAK
 case 267:
 YY_RULE_SETUP
 #line 483 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
+{ YDVAR(1, VAR_IPSECMOD_HOOK) }
 	YY_BREAK
 case 268:
 YY_RULE_SETUP
 #line 484 "util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
+{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
 	YY_BREAK
 case 269:
 YY_RULE_SETUP
 #line 485 "util/configlexer.lex"
-{ YDVAR(0, VAR_IPSET) }
+{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
 	YY_BREAK
 case 270:
 YY_RULE_SETUP
 #line 486 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSET_NAME_V4) }
+{ YDVAR(1, VAR_IPSECMOD_STRICT) }
 	YY_BREAK
 case 271:
 YY_RULE_SETUP
 #line 487 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSET_NAME_V6) }
+{ YDVAR(0, VAR_CACHEDB) }
 	YY_BREAK
 case 272:
 YY_RULE_SETUP
 #line 488 "util/configlexer.lex"
-{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
+{ YDVAR(1, VAR_CACHEDB_BACKEND) }
 	YY_BREAK
 case 273:
 YY_RULE_SETUP
 #line 489 "util/configlexer.lex"
-{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
 	YY_BREAK
 case 274:
-/* rule 274 can match eol */
 YY_RULE_SETUP
 #line 490 "util/configlexer.lex"
-{ LEXOUT(("NL\n")); cfg_parser->line++; }
+{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
 	YY_BREAK
-/* Quoted strings. Strip leading and ending quotes */
 case 275:
 YY_RULE_SETUP
+#line 491 "util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
+	YY_BREAK
+case 276:
+YY_RULE_SETUP
+#line 492 "util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
+	YY_BREAK
+case 277:
+YY_RULE_SETUP
 #line 493 "util/configlexer.lex"
+{ YDVAR(0, VAR_IPSET) }
+	YY_BREAK
+case 278:
+YY_RULE_SETUP
+#line 494 "util/configlexer.lex"
+{ YDVAR(1, VAR_IPSET_NAME_V4) }
+	YY_BREAK
+case 279:
+YY_RULE_SETUP
+#line 495 "util/configlexer.lex"
+{ YDVAR(1, VAR_IPSET_NAME_V6) }
+	YY_BREAK
+case 280:
+YY_RULE_SETUP
+#line 496 "util/configlexer.lex"
+{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
+	YY_BREAK
+case 281:
+YY_RULE_SETUP
+#line 497 "util/configlexer.lex"
+{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+	YY_BREAK
+case 282:
+/* rule 282 can match eol */
+YY_RULE_SETUP
+#line 498 "util/configlexer.lex"
+{ LEXOUT(("NL\n")); cfg_parser->line++; }
+	YY_BREAK
+/* Quoted strings. Strip leading and ending quotes */
+case 283:
+YY_RULE_SETUP
+#line 501 "util/configlexer.lex"
 { BEGIN(quotedstring); LEXOUT(("QS ")); }
 	YY_BREAK
 case YY_STATE_EOF(quotedstring):
-#line 494 "util/configlexer.lex"
+#line 502 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 276:
+case 284:
 YY_RULE_SETUP
-#line 499 "util/configlexer.lex"
+#line 507 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 277:
-/* rule 277 can match eol */
+case 285:
+/* rule 285 can match eol */
 YY_RULE_SETUP
-#line 500 "util/configlexer.lex"
+#line 508 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end \""); 
 			  cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 278:
+case 286:
 YY_RULE_SETUP
-#line 502 "util/configlexer.lex"
+#line 510 "util/configlexer.lex"
 {
         LEXOUT(("QE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -5149,34 +5250,34 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* Single Quoted strings. Strip leading and ending quotes */
-case 279:
+case 287:
 YY_RULE_SETUP
-#line 514 "util/configlexer.lex"
+#line 522 "util/configlexer.lex"
 { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
 	YY_BREAK
 case YY_STATE_EOF(singlequotedstr):
-#line 515 "util/configlexer.lex"
+#line 523 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 280:
+case 288:
 YY_RULE_SETUP
-#line 520 "util/configlexer.lex"
+#line 528 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 281:
-/* rule 281 can match eol */
+case 289:
+/* rule 289 can match eol */
 YY_RULE_SETUP
-#line 521 "util/configlexer.lex"
+#line 529 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end '"); 
 			     cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 282:
+case 290:
 YY_RULE_SETUP
-#line 523 "util/configlexer.lex"
+#line 531 "util/configlexer.lex"
 {
         LEXOUT(("SQE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -5189,38 +5290,38 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* include: directive */
-case 283:
+case 291:
 YY_RULE_SETUP
-#line 535 "util/configlexer.lex"
+#line 543 "util/configlexer.lex"
 { 
 	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
 	YY_BREAK
 case YY_STATE_EOF(include):
-#line 537 "util/configlexer.lex"
+#line 545 "util/configlexer.lex"
 {
         yyerror("EOF inside include directive");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 284:
+case 292:
 YY_RULE_SETUP
-#line 541 "util/configlexer.lex"
+#line 549 "util/configlexer.lex"
 { LEXOUT(("ISP ")); /* ignore */ }
 	YY_BREAK
-case 285:
-/* rule 285 can match eol */
+case 293:
+/* rule 293 can match eol */
 YY_RULE_SETUP
-#line 542 "util/configlexer.lex"
+#line 550 "util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++;}
 	YY_BREAK
-case 286:
+case 294:
 YY_RULE_SETUP
-#line 543 "util/configlexer.lex"
+#line 551 "util/configlexer.lex"
 { LEXOUT(("IQS ")); BEGIN(include_quoted); }
 	YY_BREAK
-case 287:
+case 295:
 YY_RULE_SETUP
-#line 544 "util/configlexer.lex"
+#line 552 "util/configlexer.lex"
 {
 	LEXOUT(("Iunquotedstr(%s) ", yytext));
 	config_start_include_glob(yytext);
@@ -5228,27 +5329,27 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 case YY_STATE_EOF(include_quoted):
-#line 549 "util/configlexer.lex"
+#line 557 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 288:
+case 296:
 YY_RULE_SETUP
-#line 553 "util/configlexer.lex"
+#line 561 "util/configlexer.lex"
 { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 289:
-/* rule 289 can match eol */
+case 297:
+/* rule 297 can match eol */
 YY_RULE_SETUP
-#line 554 "util/configlexer.lex"
+#line 562 "util/configlexer.lex"
 { yyerror("newline before \" in include name"); 
 				  cfg_parser->line++; BEGIN(inc_prev); }
 	YY_BREAK
-case 290:
+case 298:
 YY_RULE_SETUP
-#line 556 "util/configlexer.lex"
+#line 564 "util/configlexer.lex"
 {
 	LEXOUT(("IQE "));
 	yytext[yyleng - 1] = '\0';
@@ -5258,7 +5359,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case YY_STATE_EOF(INITIAL):
 case YY_STATE_EOF(val):
-#line 562 "util/configlexer.lex"
+#line 570 "util/configlexer.lex"
 {
 	LEXOUT(("LEXEOF "));
 	yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
@@ -5270,33 +5371,33 @@ case YY_STATE_EOF(val):
 	}
 }
 	YY_BREAK
-case 291:
+case 299:
 YY_RULE_SETUP
-#line 573 "util/configlexer.lex"
+#line 581 "util/configlexer.lex"
 { LEXOUT(("unquotedstr(%s) ", yytext)); 
 			if(--num_args == 0) { BEGIN(INITIAL); }
 			yylval.str = strdup(yytext); return STRING_ARG; }
 	YY_BREAK
-case 292:
+case 300:
 YY_RULE_SETUP
-#line 577 "util/configlexer.lex"
+#line 585 "util/configlexer.lex"
 {
 	ub_c_error_msg("unknown keyword '%s'", yytext);
 	}
 	YY_BREAK
-case 293:
+case 301:
 YY_RULE_SETUP
-#line 581 "util/configlexer.lex"
+#line 589 "util/configlexer.lex"
 {
 	ub_c_error_msg("stray '%s'", yytext);
 	}
 	YY_BREAK
-case 294:
+case 302:
 YY_RULE_SETUP
-#line 585 "util/configlexer.lex"
+#line 593 "util/configlexer.lex"
 ECHO;
 	YY_BREAK
-#line 5298 "<stdout>"
+#line 5398 "<stdout>"
 
 	case YY_END_OF_BUFFER:
 		{
@@ -5591,7 +5692,7 @@ static int yy_get_next_buffer (void)
 		while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 			{
 			yy_current_state = (int) yy_def[yy_current_state];
-			if ( yy_current_state >= 2913 )
+			if ( yy_current_state >= 2986 )
 				yy_c = yy_meta[yy_c];
 			}
 		yy_current_state = yy_nxt[yy_base[yy_current_state] + yy_c];
@@ -5619,11 +5720,11 @@ static int yy_get_next_buffer (void)
 	while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 		{
 		yy_current_state = (int) yy_def[yy_current_state];
-		if ( yy_current_state >= 2913 )
+		if ( yy_current_state >= 2986 )
 			yy_c = yy_meta[yy_c];
 		}
 	yy_current_state = yy_nxt[yy_base[yy_current_state] + yy_c];
-	yy_is_jam = (yy_current_state == 2912);
+	yy_is_jam = (yy_current_state == 2985);
 
 		return yy_is_jam ? 0 : yy_current_state;
 }
@@ -6262,6 +6363,6 @@ void yyfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 585 "util/configlexer.lex"
+#line 593 "util/configlexer.lex"
 
 
diff --git a/util/configlexer.lex b/util/configlexer.lex
index a86ddf55d9be..deedffa58da4 100644
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -316,6 +316,12 @@ forward-no-cache{COLON}		{ YDVAR(1, VAR_FORWARD_NO_CACHE) }
 forward-ssl-upstream{COLON}	{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
 forward-tls-upstream{COLON}	{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
 auth-zone{COLON}		{ YDVAR(0, VAR_AUTH_ZONE) }
+rpz{COLON}			{ YDVAR(0, VAR_RPZ) }
+tags{COLON}			{ YDVAR(1, VAR_TAGS) }
+rpz-action-override{COLON}	{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) }
+rpz-cname-override{COLON}	{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) }
+rpz-log{COLON}			{ YDVAR(1, VAR_RPZ_LOG) }
+rpz-log-name{COLON}		{ YDVAR(1, VAR_RPZ_LOG_NAME) }
 zonefile{COLON}			{ YDVAR(1, VAR_ZONEFILE) }
 master{COLON}			{ YDVAR(1, VAR_MASTER) }
 url{COLON}			{ YDVAR(1, VAR_URL) }
@@ -363,6 +369,8 @@ ignore-cd-flag{COLON}		{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
 serve-expired{COLON}		{ YDVAR(1, VAR_SERVE_EXPIRED) }
 serve-expired-ttl{COLON}	{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
 serve-expired-ttl-reset{COLON}	{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
+serve-expired-reply-ttl{COLON}	{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) }
+serve-expired-client-timeout{COLON}	{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) }
 fake-dsa{COLON}			{ YDVAR(1, VAR_FAKE_DSA) }
 fake-sha1{COLON}		{ YDVAR(1, VAR_FAKE_SHA1) }
 val-log-level{COLON}		{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
diff --git a/util/configparser.c b/util/configparser.c
index 432ad48948c3..6ddfaca1d7b4 100644
--- a/util/configparser.c
+++ b/util/configparser.c
@@ -1,8 +1,9 @@
-/* A Bison parser, made by GNU Bison 3.0.4.  */
+/* A Bison parser, made by GNU Bison 3.4.1.  */
 
 /* Bison implementation for Yacc-like parsers in C
 
-   Copyright (C) 1984, 1989-1990, 2000-2015 Free Software Foundation, Inc.
+   Copyright (C) 1984, 1989-1990, 2000-2015, 2018-2019 Free Software Foundation,
+   Inc.
 
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -40,11 +41,14 @@
    define necessary library symbols; they are noted "INFRINGES ON
    USER NAME SPACE" below.  */
 
+/* Undocumented macros, especially those whose name start with YY_,
+   are private implementation details.  Do not rely on them.  */
+
 /* Identify Bison output.  */
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "3.0.4"
+#define YYBISON_VERSION "3.4.1"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -61,8 +65,8 @@
 
 
 
-/* Copy the first part of user declarations.  */
-#line 38 "util/configparser.y" /* yacc.c:339  */
+/* First part of user prologue.  */
+#line 38 "util/configparser.y"
 
 #include "config.h"
 
@@ -91,13 +95,17 @@ extern struct config_parser_state* cfg_parser;
 #endif
 
 
-#line 95 "util/configparser.c" /* yacc.c:339  */
+#line 99 "util/configparser.c"
 
 # ifndef YY_NULLPTR
-#  if defined __cplusplus && 201103L <= __cplusplus
-#   define YY_NULLPTR nullptr
+#  if defined __cplusplus
+#   if 201103L <= __cplusplus
+#    define YY_NULLPTR nullptr
+#   else
+#    define YY_NULLPTR 0
+#   endif
 #  else
-#   define YY_NULLPTR 0
+#   define YY_NULLPTR ((void*)0)
 #  endif
 # endif
 
@@ -109,8 +117,8 @@ extern struct config_parser_state* cfg_parser;
 # define YYERROR_VERBOSE 0
 #endif
 
-/* In a future release of Bison, this section will be replaced
-   by #include "configparser.h".  */
+/* Use api.header.include to #include this header
+   instead of duplicating it here.  */
 #ifndef YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
 # define YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
 /* Debug traces.  */
@@ -331,68 +339,76 @@ extern int yydebug;
     VAR_SERVE_EXPIRED = 460,
     VAR_SERVE_EXPIRED_TTL = 461,
     VAR_SERVE_EXPIRED_TTL_RESET = 462,
-    VAR_FAKE_DSA = 463,
-    VAR_FAKE_SHA1 = 464,
-    VAR_LOG_IDENTITY = 465,
-    VAR_HIDE_TRUSTANCHOR = 466,
-    VAR_TRUST_ANCHOR_SIGNALING = 467,
-    VAR_AGGRESSIVE_NSEC = 468,
-    VAR_USE_SYSTEMD = 469,
-    VAR_SHM_ENABLE = 470,
-    VAR_SHM_KEY = 471,
-    VAR_ROOT_KEY_SENTINEL = 472,
-    VAR_DNSCRYPT = 473,
-    VAR_DNSCRYPT_ENABLE = 474,
-    VAR_DNSCRYPT_PORT = 475,
-    VAR_DNSCRYPT_PROVIDER = 476,
-    VAR_DNSCRYPT_SECRET_KEY = 477,
-    VAR_DNSCRYPT_PROVIDER_CERT = 478,
-    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 479,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 480,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 481,
-    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 482,
-    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 483,
-    VAR_IPSECMOD_ENABLED = 484,
-    VAR_IPSECMOD_HOOK = 485,
-    VAR_IPSECMOD_IGNORE_BOGUS = 486,
-    VAR_IPSECMOD_MAX_TTL = 487,
-    VAR_IPSECMOD_WHITELIST = 488,
-    VAR_IPSECMOD_STRICT = 489,
-    VAR_CACHEDB = 490,
-    VAR_CACHEDB_BACKEND = 491,
-    VAR_CACHEDB_SECRETSEED = 492,
-    VAR_CACHEDB_REDISHOST = 493,
-    VAR_CACHEDB_REDISPORT = 494,
-    VAR_CACHEDB_REDISTIMEOUT = 495,
-    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 496,
-    VAR_FOR_UPSTREAM = 497,
-    VAR_AUTH_ZONE = 498,
-    VAR_ZONEFILE = 499,
-    VAR_MASTER = 500,
-    VAR_URL = 501,
-    VAR_FOR_DOWNSTREAM = 502,
-    VAR_FALLBACK_ENABLED = 503,
-    VAR_TLS_ADDITIONAL_PORT = 504,
-    VAR_LOW_RTT = 505,
-    VAR_LOW_RTT_PERMIL = 506,
-    VAR_FAST_SERVER_PERMIL = 507,
-    VAR_FAST_SERVER_NUM = 508,
-    VAR_ALLOW_NOTIFY = 509,
-    VAR_TLS_WIN_CERT = 510,
-    VAR_TCP_CONNECTION_LIMIT = 511,
-    VAR_FORWARD_NO_CACHE = 512,
-    VAR_STUB_NO_CACHE = 513,
-    VAR_LOG_SERVFAIL = 514,
-    VAR_DENY_ANY = 515,
-    VAR_UNKNOWN_SERVER_TIME_LIMIT = 516,
-    VAR_LOG_TAG_QUERYREPLY = 517,
-    VAR_STREAM_WAIT_SIZE = 518,
-    VAR_TLS_CIPHERS = 519,
-    VAR_TLS_CIPHERSUITES = 520,
-    VAR_TLS_SESSION_TICKET_KEYS = 521,
-    VAR_IPSET = 522,
-    VAR_IPSET_NAME_V4 = 523,
-    VAR_IPSET_NAME_V6 = 524
+    VAR_SERVE_EXPIRED_REPLY_TTL = 463,
+    VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 464,
+    VAR_FAKE_DSA = 465,
+    VAR_FAKE_SHA1 = 466,
+    VAR_LOG_IDENTITY = 467,
+    VAR_HIDE_TRUSTANCHOR = 468,
+    VAR_TRUST_ANCHOR_SIGNALING = 469,
+    VAR_AGGRESSIVE_NSEC = 470,
+    VAR_USE_SYSTEMD = 471,
+    VAR_SHM_ENABLE = 472,
+    VAR_SHM_KEY = 473,
+    VAR_ROOT_KEY_SENTINEL = 474,
+    VAR_DNSCRYPT = 475,
+    VAR_DNSCRYPT_ENABLE = 476,
+    VAR_DNSCRYPT_PORT = 477,
+    VAR_DNSCRYPT_PROVIDER = 478,
+    VAR_DNSCRYPT_SECRET_KEY = 479,
+    VAR_DNSCRYPT_PROVIDER_CERT = 480,
+    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 481,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 482,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 483,
+    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 484,
+    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 485,
+    VAR_IPSECMOD_ENABLED = 486,
+    VAR_IPSECMOD_HOOK = 487,
+    VAR_IPSECMOD_IGNORE_BOGUS = 488,
+    VAR_IPSECMOD_MAX_TTL = 489,
+    VAR_IPSECMOD_WHITELIST = 490,
+    VAR_IPSECMOD_STRICT = 491,
+    VAR_CACHEDB = 492,
+    VAR_CACHEDB_BACKEND = 493,
+    VAR_CACHEDB_SECRETSEED = 494,
+    VAR_CACHEDB_REDISHOST = 495,
+    VAR_CACHEDB_REDISPORT = 496,
+    VAR_CACHEDB_REDISTIMEOUT = 497,
+    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 498,
+    VAR_FOR_UPSTREAM = 499,
+    VAR_AUTH_ZONE = 500,
+    VAR_ZONEFILE = 501,
+    VAR_MASTER = 502,
+    VAR_URL = 503,
+    VAR_FOR_DOWNSTREAM = 504,
+    VAR_FALLBACK_ENABLED = 505,
+    VAR_TLS_ADDITIONAL_PORT = 506,
+    VAR_LOW_RTT = 507,
+    VAR_LOW_RTT_PERMIL = 508,
+    VAR_FAST_SERVER_PERMIL = 509,
+    VAR_FAST_SERVER_NUM = 510,
+    VAR_ALLOW_NOTIFY = 511,
+    VAR_TLS_WIN_CERT = 512,
+    VAR_TCP_CONNECTION_LIMIT = 513,
+    VAR_FORWARD_NO_CACHE = 514,
+    VAR_STUB_NO_CACHE = 515,
+    VAR_LOG_SERVFAIL = 516,
+    VAR_DENY_ANY = 517,
+    VAR_UNKNOWN_SERVER_TIME_LIMIT = 518,
+    VAR_LOG_TAG_QUERYREPLY = 519,
+    VAR_STREAM_WAIT_SIZE = 520,
+    VAR_TLS_CIPHERS = 521,
+    VAR_TLS_CIPHERSUITES = 522,
+    VAR_IPSET = 523,
+    VAR_IPSET_NAME_V4 = 524,
+    VAR_IPSET_NAME_V6 = 525,
+    VAR_TLS_SESSION_TICKET_KEYS = 526,
+    VAR_RPZ = 527,
+    VAR_TAGS = 528,
+    VAR_RPZ_ACTION_OVERRIDE = 529,
+    VAR_RPZ_CNAME_OVERRIDE = 530,
+    VAR_RPZ_LOG = 531,
+    VAR_RPZ_LOG_NAME = 532
   };
 #endif
 /* Tokens.  */
@@ -601,81 +617,88 @@ extern int yydebug;
 #define VAR_SERVE_EXPIRED 460
 #define VAR_SERVE_EXPIRED_TTL 461
 #define VAR_SERVE_EXPIRED_TTL_RESET 462
-#define VAR_FAKE_DSA 463
-#define VAR_FAKE_SHA1 464
-#define VAR_LOG_IDENTITY 465
-#define VAR_HIDE_TRUSTANCHOR 466
-#define VAR_TRUST_ANCHOR_SIGNALING 467
-#define VAR_AGGRESSIVE_NSEC 468
-#define VAR_USE_SYSTEMD 469
-#define VAR_SHM_ENABLE 470
-#define VAR_SHM_KEY 471
-#define VAR_ROOT_KEY_SENTINEL 472
-#define VAR_DNSCRYPT 473
-#define VAR_DNSCRYPT_ENABLE 474
-#define VAR_DNSCRYPT_PORT 475
-#define VAR_DNSCRYPT_PROVIDER 476
-#define VAR_DNSCRYPT_SECRET_KEY 477
-#define VAR_DNSCRYPT_PROVIDER_CERT 478
-#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 479
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 480
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 481
-#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 482
-#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 483
-#define VAR_IPSECMOD_ENABLED 484
-#define VAR_IPSECMOD_HOOK 485
-#define VAR_IPSECMOD_IGNORE_BOGUS 486
-#define VAR_IPSECMOD_MAX_TTL 487
-#define VAR_IPSECMOD_WHITELIST 488
-#define VAR_IPSECMOD_STRICT 489
-#define VAR_CACHEDB 490
-#define VAR_CACHEDB_BACKEND 491
-#define VAR_CACHEDB_SECRETSEED 492
-#define VAR_CACHEDB_REDISHOST 493
-#define VAR_CACHEDB_REDISPORT 494
-#define VAR_CACHEDB_REDISTIMEOUT 495
-#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 496
-#define VAR_FOR_UPSTREAM 497
-#define VAR_AUTH_ZONE 498
-#define VAR_ZONEFILE 499
-#define VAR_MASTER 500
-#define VAR_URL 501
-#define VAR_FOR_DOWNSTREAM 502
-#define VAR_FALLBACK_ENABLED 503
-#define VAR_TLS_ADDITIONAL_PORT 504
-#define VAR_LOW_RTT 505
-#define VAR_LOW_RTT_PERMIL 506
-#define VAR_FAST_SERVER_PERMIL 507
-#define VAR_FAST_SERVER_NUM 508
-#define VAR_ALLOW_NOTIFY 509
-#define VAR_TLS_WIN_CERT 510
-#define VAR_TCP_CONNECTION_LIMIT 511
-#define VAR_FORWARD_NO_CACHE 512
-#define VAR_STUB_NO_CACHE 513
-#define VAR_LOG_SERVFAIL 514
-#define VAR_DENY_ANY 515
-#define VAR_UNKNOWN_SERVER_TIME_LIMIT 516
-#define VAR_LOG_TAG_QUERYREPLY 517
-#define VAR_STREAM_WAIT_SIZE 518
-#define VAR_TLS_CIPHERS 519
-#define VAR_TLS_CIPHERSUITES 520
-#define VAR_TLS_SESSION_TICKET_KEYS 521
-#define VAR_IPSET 522
-#define VAR_IPSET_NAME_V4 523
-#define VAR_IPSET_NAME_V6 524
+#define VAR_SERVE_EXPIRED_REPLY_TTL 463
+#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 464
+#define VAR_FAKE_DSA 465
+#define VAR_FAKE_SHA1 466
+#define VAR_LOG_IDENTITY 467
+#define VAR_HIDE_TRUSTANCHOR 468
+#define VAR_TRUST_ANCHOR_SIGNALING 469
+#define VAR_AGGRESSIVE_NSEC 470
+#define VAR_USE_SYSTEMD 471
+#define VAR_SHM_ENABLE 472
+#define VAR_SHM_KEY 473
+#define VAR_ROOT_KEY_SENTINEL 474
+#define VAR_DNSCRYPT 475
+#define VAR_DNSCRYPT_ENABLE 476
+#define VAR_DNSCRYPT_PORT 477
+#define VAR_DNSCRYPT_PROVIDER 478
+#define VAR_DNSCRYPT_SECRET_KEY 479
+#define VAR_DNSCRYPT_PROVIDER_CERT 480
+#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 481
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 482
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 483
+#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 484
+#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 485
+#define VAR_IPSECMOD_ENABLED 486
+#define VAR_IPSECMOD_HOOK 487
+#define VAR_IPSECMOD_IGNORE_BOGUS 488
+#define VAR_IPSECMOD_MAX_TTL 489
+#define VAR_IPSECMOD_WHITELIST 490
+#define VAR_IPSECMOD_STRICT 491
+#define VAR_CACHEDB 492
+#define VAR_CACHEDB_BACKEND 493
+#define VAR_CACHEDB_SECRETSEED 494
+#define VAR_CACHEDB_REDISHOST 495
+#define VAR_CACHEDB_REDISPORT 496
+#define VAR_CACHEDB_REDISTIMEOUT 497
+#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 498
+#define VAR_FOR_UPSTREAM 499
+#define VAR_AUTH_ZONE 500
+#define VAR_ZONEFILE 501
+#define VAR_MASTER 502
+#define VAR_URL 503
+#define VAR_FOR_DOWNSTREAM 504
+#define VAR_FALLBACK_ENABLED 505
+#define VAR_TLS_ADDITIONAL_PORT 506
+#define VAR_LOW_RTT 507
+#define VAR_LOW_RTT_PERMIL 508
+#define VAR_FAST_SERVER_PERMIL 509
+#define VAR_FAST_SERVER_NUM 510
+#define VAR_ALLOW_NOTIFY 511
+#define VAR_TLS_WIN_CERT 512
+#define VAR_TCP_CONNECTION_LIMIT 513
+#define VAR_FORWARD_NO_CACHE 514
+#define VAR_STUB_NO_CACHE 515
+#define VAR_LOG_SERVFAIL 516
+#define VAR_DENY_ANY 517
+#define VAR_UNKNOWN_SERVER_TIME_LIMIT 518
+#define VAR_LOG_TAG_QUERYREPLY 519
+#define VAR_STREAM_WAIT_SIZE 520
+#define VAR_TLS_CIPHERS 521
+#define VAR_TLS_CIPHERSUITES 522
+#define VAR_IPSET 523
+#define VAR_IPSET_NAME_V4 524
+#define VAR_IPSET_NAME_V6 525
+#define VAR_TLS_SESSION_TICKET_KEYS 526
+#define VAR_RPZ 527
+#define VAR_TAGS 528
+#define VAR_RPZ_ACTION_OVERRIDE 529
+#define VAR_RPZ_CNAME_OVERRIDE 530
+#define VAR_RPZ_LOG 531
+#define VAR_RPZ_LOG_NAME 532
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-
 union YYSTYPE
 {
-#line 66 "util/configparser.y" /* yacc.c:355  */
+#line 66 "util/configparser.y"
 
 	char*	str;
 
-#line 677 "util/configparser.c" /* yacc.c:355  */
-};
+#line 700 "util/configparser.c"
 
+};
 typedef union YYSTYPE YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define YYSTYPE_IS_DECLARED 1
@@ -688,9 +711,7 @@ int yyparse (void);
 
 #endif /* !YY_YY_UTIL_CONFIGPARSER_H_INCLUDED  */
 
-/* Copy the second part of user declarations.  */
 
-#line 694 "util/configparser.c" /* yacc.c:358  */
 
 #ifdef short
 # undef short
@@ -711,13 +732,13 @@ typedef signed char yytype_int8;
 #ifdef YYTYPE_UINT16
 typedef YYTYPE_UINT16 yytype_uint16;
 #else
-typedef unsigned short int yytype_uint16;
+typedef unsigned short yytype_uint16;
 #endif
 
 #ifdef YYTYPE_INT16
 typedef YYTYPE_INT16 yytype_int16;
 #else
-typedef short int yytype_int16;
+typedef short yytype_int16;
 #endif
 
 #ifndef YYSIZE_T
@@ -729,7 +750,7 @@ typedef short int yytype_int16;
 #  include <stddef.h> /* INFRINGES ON USER NAME SPACE */
 #  define YYSIZE_T size_t
 # else
-#  define YYSIZE_T unsigned int
+#  define YYSIZE_T unsigned
 # endif
 #endif
 
@@ -765,15 +786,6 @@ typedef short int yytype_int16;
 # define YY_ATTRIBUTE_UNUSED YY_ATTRIBUTE ((__unused__))
 #endif
 
-#if !defined _Noreturn \
-     && (!defined __STDC_VERSION__ || __STDC_VERSION__ < 201112)
-# if defined _MSC_VER && 1200 <= _MSC_VER
-#  define _Noreturn __declspec (noreturn)
-# else
-#  define _Noreturn YY_ATTRIBUTE ((__noreturn__))
-# endif
-#endif
-
 /* Suppress unused-variable warnings by "using" E.  */
 #if ! defined lint || defined __GNUC__
 # define YYUSE(E) ((void) (E))
@@ -781,7 +793,7 @@ typedef short int yytype_int16;
 # define YYUSE(E) /* empty */
 #endif
 
-#if defined __GNUC__ && 407 <= __GNUC__ * 100 + __GNUC_MINOR__
+#if defined __GNUC__ && ! defined __ICC && 407 <= __GNUC__ * 100 + __GNUC_MINOR__
 /* Suppress an incorrect diagnostic about yylval being uninitialized.  */
 # define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN \
     _Pragma ("GCC diagnostic push") \
@@ -801,6 +813,8 @@ typedef short int yytype_int16;
 #endif
 
 
+#define YY_ASSERT(E) ((void) (0 && (E)))
+
 #if ! defined yyoverflow || YYERROR_VERBOSE
 
 /* The parser invokes alloca or malloc; define the necessary symbols.  */
@@ -932,27 +946,27 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  2
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   543
+#define YYLAST   590
 
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  270
+#define YYNTOKENS  278
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  291
+#define YYNNTS  301
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  557
+#define YYNRULES  580
 /* YYNSTATES -- Number of states.  */
-#define YYNSTATES  833
+#define YYNSTATES  863
 
-/* YYTRANSLATE[YYX] -- Symbol number corresponding to YYX as returned
-   by yylex, with out-of-bounds checking.  */
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   524
+#define YYMAXUTOK   532
 
+/* YYTRANSLATE(TOKEN-NUM) -- Symbol number corresponding to TOKEN-NUM
+   as returned by yylex, with out-of-bounds checking.  */
 #define YYTRANSLATE(YYX)                                                \
-  ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
+  ((unsigned) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
 
 /* YYTRANSLATE[TOKEN-NUM] -- Symbol number corresponding to TOKEN-NUM
-   as returned by yylex, without out-of-bounds checking.  */
+   as returned by yylex.  */
 static const yytype_uint16 yytranslate[] =
 {
        0,     2,     2,     2,     2,     2,     2,     2,     2,     2,
@@ -1007,69 +1021,73 @@ static const yytype_uint16 yytranslate[] =
      235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
      245,   246,   247,   248,   249,   250,   251,   252,   253,   254,
      255,   256,   257,   258,   259,   260,   261,   262,   263,   264,
-     265,   266,   267,   268,   269
+     265,   266,   267,   268,   269,   270,   271,   272,   273,   274,
+     275,   276,   277
 };
 
 #if YYDEBUG
   /* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   173,   173,   173,   174,   174,   175,   175,   176,   176,
-     176,   177,   177,   178,   178,   182,   187,   188,   189,   189,
-     189,   190,   190,   191,   191,   192,   192,   193,   193,   193,
-     194,   194,   195,   195,   195,   196,   196,   196,   197,   197,
-     198,   198,   199,   199,   200,   200,   201,   201,   202,   202,
-     203,   203,   204,   204,   205,   205,   205,   206,   206,   206,
-     207,   207,   207,   208,   208,   209,   209,   210,   210,   211,
-     211,   212,   212,   212,   213,   213,   214,   214,   215,   215,
-     215,   216,   216,   217,   217,   218,   218,   219,   219,   219,
-     220,   220,   221,   221,   222,   222,   223,   223,   224,   224,
-     225,   225,   225,   226,   226,   227,   227,   227,   228,   228,
-     228,   229,   229,   229,   230,   230,   230,   230,   231,   232,
-     232,   232,   233,   233,   233,   234,   234,   235,   235,   236,
-     236,   236,   237,   237,   238,   238,   238,   239,   239,   240,
-     240,   241,   242,   242,   243,   243,   244,   244,   245,   246,
-     246,   247,   247,   248,   248,   249,   249,   250,   250,   251,
-     251,   251,   252,   252,   253,   253,   254,   254,   255,   255,
-     256,   256,   257,   257,   257,   258,   258,   258,   259,   259,
-     259,   260,   260,   261,   262,   262,   263,   263,   264,   264,
-     265,   265,   266,   266,   266,   267,   267,   267,   268,   268,
-     268,   269,   269,   270,   270,   271,   271,   273,   285,   286,
-     287,   287,   287,   287,   287,   288,   288,   290,   302,   303,
-     304,   304,   304,   304,   305,   305,   307,   321,   322,   323,
-     323,   323,   323,   324,   324,   324,   326,   342,   343,   344,
-     344,   344,   344,   345,   345,   345,   346,   348,   357,   366,
-     377,   386,   395,   404,   415,   424,   435,   448,   463,   474,
-     491,   508,   525,   542,   557,   572,   585,   600,   609,   618,
-     627,   636,   645,   654,   663,   672,   681,   690,   699,   708,
-     717,   730,   739,   752,   761,   770,   779,   786,   793,   802,
-     809,   818,   826,   833,   840,   848,   857,   866,   880,   889,
-     898,   907,   916,   925,   934,   941,   948,   974,   982,   989,
-     996,  1003,  1010,  1018,  1026,  1034,  1041,  1052,  1063,  1070,
-    1079,  1088,  1097,  1104,  1111,  1119,  1127,  1137,  1147,  1157,
-    1165,  1178,  1189,  1197,  1210,  1219,  1228,  1237,  1247,  1257,
-    1265,  1278,  1287,  1295,  1304,  1312,  1325,  1334,  1341,  1351,
-    1361,  1371,  1381,  1391,  1401,  1411,  1421,  1428,  1435,  1442,
-    1451,  1460,  1469,  1478,  1485,  1495,  1515,  1522,  1540,  1553,
-    1566,  1575,  1584,  1593,  1602,  1612,  1622,  1633,  1642,  1651,
-    1660,  1669,  1682,  1695,  1704,  1711,  1720,  1729,  1738,  1747,
-    1755,  1768,  1776,  1817,  1824,  1839,  1849,  1859,  1866,  1873,
-    1880,  1889,  1897,  1911,  1932,  1953,  1965,  1977,  1989,  1998,
-    2019,  2029,  2038,  2046,  2054,  2067,  2080,  2095,  2110,  2119,
-    2128,  2134,  2143,  2152,  2162,  2172,  2185,  2198,  2210,  2224,
-    2236,  2250,  2260,  2267,  2274,  2283,  2292,  2302,  2312,  2322,
-    2329,  2336,  2345,  2354,  2364,  2374,  2381,  2388,  2395,  2403,
-    2413,  2423,  2433,  2443,  2482,  2492,  2500,  2508,  2523,  2532,
-    2537,  2538,  2539,  2539,  2539,  2540,  2540,  2540,  2541,  2541,
-    2543,  2553,  2562,  2569,  2576,  2583,  2590,  2597,  2604,  2609,
-    2610,  2611,  2611,  2612,  2612,  2613,  2613,  2614,  2615,  2616,
-    2617,  2618,  2619,  2621,  2630,  2637,  2646,  2655,  2662,  2669,
-    2679,  2689,  2699,  2709,  2719,  2729,  2734,  2735,  2736,  2738,
-    2744,  2754,  2761,  2770,  2778,  2783,  2784,  2786,  2786,  2786,
-    2787,  2787,  2788,  2789,  2790,  2791,  2792,  2794,  2804,  2813,
-    2820,  2829,  2836,  2845,  2853,  2866,  2874,  2887,  2892,  2893,
-    2894,  2894,  2895,  2895,  2895,  2897,  2912,  2927,  2939,  2954,
-    2967,  2978,  2983,  2984,  2985,  2985,  2987,  3002
+       0,   175,   175,   175,   176,   176,   177,   177,   178,   178,
+     178,   179,   179,   180,   180,   181,   185,   190,   191,   192,
+     192,   192,   193,   193,   194,   194,   195,   195,   196,   196,
+     196,   197,   197,   198,   198,   198,   199,   199,   199,   200,
+     200,   201,   201,   202,   202,   203,   203,   204,   204,   205,
+     205,   206,   206,   207,   207,   208,   208,   208,   209,   209,
+     209,   210,   210,   210,   211,   211,   212,   212,   213,   213,
+     214,   214,   215,   215,   215,   216,   216,   217,   217,   218,
+     218,   218,   219,   219,   220,   220,   221,   221,   222,   222,
+     222,   223,   223,   224,   224,   225,   225,   226,   226,   227,
+     227,   228,   228,   228,   229,   229,   230,   230,   230,   231,
+     231,   231,   232,   232,   232,   233,   233,   233,   233,   234,
+     235,   235,   235,   236,   236,   236,   237,   237,   238,   238,
+     239,   239,   239,   240,   240,   241,   241,   241,   242,   242,
+     243,   243,   244,   245,   245,   246,   246,   247,   247,   248,
+     249,   249,   250,   250,   251,   251,   252,   252,   253,   253,
+     254,   254,   254,   255,   255,   256,   256,   257,   257,   258,
+     258,   259,   259,   260,   260,   261,   261,   261,   262,   262,
+     262,   263,   263,   263,   264,   264,   265,   266,   266,   267,
+     267,   268,   268,   269,   269,   270,   270,   270,   271,   271,
+     271,   272,   272,   272,   273,   273,   274,   274,   275,   275,
+     277,   289,   290,   291,   291,   291,   291,   291,   292,   292,
+     294,   306,   307,   308,   308,   308,   308,   309,   309,   311,
+     325,   326,   327,   327,   327,   327,   328,   328,   328,   330,
+     347,   348,   349,   349,   349,   349,   350,   350,   350,   351,
+     354,   373,   390,   398,   408,   416,   433,   434,   435,   435,
+     435,   435,   435,   436,   436,   436,   437,   437,   439,   448,
+     457,   468,   477,   486,   495,   506,   515,   527,   541,   556,
+     567,   584,   601,   618,   635,   650,   665,   678,   693,   702,
+     711,   720,   729,   738,   747,   756,   765,   774,   783,   792,
+     801,   810,   823,   832,   845,   854,   863,   872,   879,   886,
+     895,   902,   911,   919,   926,   933,   941,   950,   959,   973,
+     982,   991,  1000,  1009,  1018,  1027,  1034,  1041,  1067,  1075,
+    1082,  1089,  1096,  1103,  1111,  1119,  1127,  1134,  1145,  1156,
+    1163,  1172,  1181,  1190,  1197,  1204,  1212,  1220,  1230,  1240,
+    1250,  1258,  1271,  1282,  1290,  1303,  1312,  1321,  1330,  1340,
+    1350,  1358,  1371,  1380,  1388,  1397,  1405,  1418,  1427,  1434,
+    1444,  1454,  1464,  1474,  1484,  1494,  1504,  1514,  1521,  1528,
+    1535,  1544,  1553,  1562,  1571,  1578,  1588,  1608,  1615,  1633,
+    1646,  1659,  1668,  1677,  1686,  1695,  1705,  1715,  1726,  1735,
+    1744,  1753,  1762,  1771,  1780,  1793,  1806,  1815,  1822,  1831,
+    1840,  1849,  1858,  1866,  1879,  1887,  1928,  1935,  1950,  1960,
+    1970,  1977,  1984,  1991,  2000,  2008,  2022,  2043,  2064,  2076,
+    2088,  2100,  2109,  2130,  2140,  2149,  2157,  2165,  2178,  2191,
+    2206,  2221,  2230,  2239,  2245,  2254,  2263,  2273,  2283,  2296,
+    2309,  2321,  2335,  2347,  2361,  2371,  2378,  2385,  2394,  2403,
+    2413,  2423,  2433,  2440,  2447,  2456,  2465,  2475,  2485,  2492,
+    2499,  2506,  2514,  2524,  2534,  2544,  2554,  2593,  2603,  2611,
+    2619,  2634,  2643,  2648,  2649,  2650,  2650,  2650,  2651,  2651,
+    2651,  2652,  2652,  2654,  2664,  2673,  2680,  2687,  2694,  2701,
+    2708,  2715,  2720,  2721,  2722,  2722,  2723,  2723,  2724,  2724,
+    2725,  2726,  2727,  2728,  2729,  2730,  2732,  2741,  2748,  2757,
+    2766,  2773,  2780,  2790,  2800,  2810,  2820,  2830,  2840,  2845,
+    2846,  2847,  2849,  2855,  2865,  2872,  2881,  2889,  2894,  2895,
+    2897,  2897,  2897,  2898,  2898,  2899,  2900,  2901,  2902,  2903,
+    2905,  2915,  2924,  2931,  2940,  2947,  2956,  2964,  2977,  2985,
+    2998,  3003,  3004,  3005,  3005,  3006,  3006,  3006,  3008,  3020,
+    3032,  3044,  3059,  3072,  3083,  3088,  3089,  3090,  3090,  3092,
+    3107
 };
 #endif
 
@@ -1153,7 +1171,8 @@ static const char *const yytname[] =
   "VAR_LOCAL_ZONE_OVERRIDE", "VAR_ACCESS_CONTROL_TAG_ACTION",
   "VAR_ACCESS_CONTROL_TAG_DATA", "VAR_VIEW", "VAR_ACCESS_CONTROL_VIEW",
   "VAR_VIEW_FIRST", "VAR_SERVE_EXPIRED", "VAR_SERVE_EXPIRED_TTL",
-  "VAR_SERVE_EXPIRED_TTL_RESET", "VAR_FAKE_DSA", "VAR_FAKE_SHA1",
+  "VAR_SERVE_EXPIRED_TTL_RESET", "VAR_SERVE_EXPIRED_REPLY_TTL",
+  "VAR_SERVE_EXPIRED_CLIENT_TIMEOUT", "VAR_FAKE_DSA", "VAR_FAKE_SHA1",
   "VAR_LOG_IDENTITY", "VAR_HIDE_TRUSTANCHOR", "VAR_TRUST_ANCHOR_SIGNALING",
   "VAR_AGGRESSIVE_NSEC", "VAR_USE_SYSTEMD", "VAR_SHM_ENABLE",
   "VAR_SHM_KEY", "VAR_ROOT_KEY_SENTINEL", "VAR_DNSCRYPT",
@@ -1176,12 +1195,16 @@ static const char *const yytname[] =
   "VAR_STUB_NO_CACHE", "VAR_LOG_SERVFAIL", "VAR_DENY_ANY",
   "VAR_UNKNOWN_SERVER_TIME_LIMIT", "VAR_LOG_TAG_QUERYREPLY",
   "VAR_STREAM_WAIT_SIZE", "VAR_TLS_CIPHERS", "VAR_TLS_CIPHERSUITES",
-  "VAR_TLS_SESSION_TICKET_KEYS", "VAR_IPSET", "VAR_IPSET_NAME_V4",
-  "VAR_IPSET_NAME_V6", "$accept", "toplevelvars", "toplevelvar",
+  "VAR_IPSET", "VAR_IPSET_NAME_V4", "VAR_IPSET_NAME_V6",
+  "VAR_TLS_SESSION_TICKET_KEYS", "VAR_RPZ", "VAR_TAGS",
+  "VAR_RPZ_ACTION_OVERRIDE", "VAR_RPZ_CNAME_OVERRIDE", "VAR_RPZ_LOG",
+  "VAR_RPZ_LOG_NAME", "$accept", "toplevelvars", "toplevelvar",
   "serverstart", "contents_server", "content_server", "stubstart",
   "contents_stub", "content_stub", "forwardstart", "contents_forward",
   "content_forward", "viewstart", "contents_view", "content_view",
-  "authstart", "contents_auth", "content_auth", "server_num_threads",
+  "authstart", "contents_auth", "content_auth", "rpz_tag",
+  "rpz_action_override", "rpz_cname_override", "rpz_log", "rpz_log_name",
+  "rpzstart", "contents_rpz", "content_rpz", "server_num_threads",
   "server_verbosity", "server_statistics_interval",
   "server_statistics_cumulative", "server_extended_statistics",
   "server_shm_enable", "server_shm_key", "server_port",
@@ -1241,6 +1264,7 @@ static const char *const yytname[] =
   "server_val_permissive_mode", "server_aggressive_nsec",
   "server_ignore_cd_flag", "server_serve_expired",
   "server_serve_expired_ttl", "server_serve_expired_ttl_reset",
+  "server_serve_expired_reply_ttl", "server_serve_expired_client_timeout",
   "server_fake_dsa", "server_fake_sha1", "server_val_log_level",
   "server_val_nsec3_keysize_iterations", "server_add_holddown",
   "server_del_holddown", "server_keep_missing",
@@ -1330,7 +1354,8 @@ static const yytype_uint16 yytoknum[] =
      485,   486,   487,   488,   489,   490,   491,   492,   493,   494,
      495,   496,   497,   498,   499,   500,   501,   502,   503,   504,
      505,   506,   507,   508,   509,   510,   511,   512,   513,   514,
-     515,   516,   517,   518,   519,   520,   521,   522,   523,   524
+     515,   516,   517,   518,   519,   520,   521,   522,   523,   524,
+     525,   526,   527,   528,   529,   530,   531,   532
 };
 # endif
 
@@ -1350,27 +1375,29 @@ static const yytype_int16 yypact[] =
 {
     -262,     0,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,  -262,  -262,   256,   -42,   -37,   -38,
-     -41,   -44,  -136,  -102,  -191,  -177,  -261,     2,     3,    28,
-      29,    30,    33,    35,    36,    37,    38,    39,    55,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      68,    69,    70,    71,    72,    73,    74,    75,    76,    77,
-      78,    79,    80,    81,    82,    83,    86,    87,    90,    92,
-      93,    94,    95,    96,    97,    98,    99,   101,   102,   103,
-     104,   105,   106,   107,   108,   109,   110,   111,   112,   113,
-     114,   115,   116,   119,   120,   121,   122,   123,   124,   125,
-     126,   127,   128,   129,   130,   131,   132,   133,   134,   135,
-     136,   137,   138,   139,   140,   142,   143,   144,   145,   146,
-     147,   148,   149,   150,   151,   152,   153,   154,   155,   157,
-     158,   159,   160,   161,   162,   163,   164,   165,   166,   167,
-     168,   169,   170,   171,   172,   173,   174,   175,   176,   177,
-     178,   179,   180,   181,   182,   183,   184,   185,   186,   187,
-     188,   189,   190,   198,   199,   200,   201,   202,   204,   205,
-     207,   209,   211,   212,   213,   214,   215,   216,   217,   218,
-     219,   220,   221,   222,   223,   224,   226,   227,   228,   229,
-     230,   231,   232,   234,   235,   236,   237,   238,   239,   240,
-     241,   242,   243,   244,   245,   246,   247,   248,   249,   250,
-     251,   252,   253,   254,   255,   289,  -262,  -262,  -262,  -262,
+    -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,   261,   -41,
+     -36,   -40,   -20,   -42,   -29,  -128,  -105,  -170,  -221,  -261,
+       2,     3,     4,    12,    26,    27,    28,    31,    32,    33,
+      35,    36,    37,    38,    39,    51,    52,    53,    64,    65,
+      66,    67,    68,    69,    70,    71,    72,    73,    74,    75,
+      76,    77,    78,    79,    80,    81,    82,    83,    85,    87,
+      88,    91,    93,    94,    95,    96,    97,    98,    99,   101,
+     102,   103,   104,   105,   106,   107,   108,   109,   110,   111,
+     112,   113,   114,   117,   118,   119,   120,   121,   122,   123,
+     124,   125,   126,   127,   128,   129,   130,   131,   132,   133,
+     134,   135,   136,   137,   138,   139,   140,   142,   143,   144,
+     145,   146,   147,   148,   149,   150,   151,   152,   153,   155,
+     156,   157,   158,   159,   160,   161,   162,   163,   164,   165,
+     166,   167,   168,   169,   170,   171,   172,   173,   174,   175,
+     176,   177,   178,   179,   180,   181,   182,   183,   184,   185,
+     186,   187,   188,   189,   190,   191,   193,   197,   198,   199,
+     200,   201,   202,   203,   205,   206,   207,   208,   211,   212,
+     215,   228,   229,   230,   231,   232,   233,   234,   236,   237,
+     238,   239,   240,   241,   242,   243,   244,   245,   246,   247,
+     248,   249,   250,   251,   252,   253,   254,   255,   256,   257,
+     259,   260,   294,   295,   296,   297,   301,   302,   303,   345,
+     346,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
+    -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
@@ -1388,49 +1415,50 @@ static const yytype_int16 yypact[] =
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
+    -262,  -262,  -262,   347,   348,   349,   350,   351,   352,   353,
+    -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,   357,   361,
+     362,   387,   388,   389,  -262,  -262,  -262,  -262,  -262,  -262,
+    -262,   391,   402,   403,   404,   405,   406,   407,  -262,  -262,
+    -262,  -262,  -262,  -262,  -262,  -262,   408,   409,   410,   411,
+     412,   413,   414,   453,  -262,  -262,  -262,  -262,  -262,  -262,
+    -262,  -262,  -262,   455,   471,   472,   473,   474,  -262,  -262,
+    -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,   475,
+     476,   477,   478,   479,   480,   481,   488,  -262,  -262,  -262,
+    -262,  -262,  -262,  -262,  -262,  -262,   489,   490,   491,   492,
+     493,   495,   496,   497,   498,   499,   500,   501,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,  -262,  -262,   290,   291,   292,   296,
-     297,   298,   340,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,   341,   342,   343,   344,   345,   346,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,   347,   348,   352,   356,   357,   382,
-     383,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,   384,
-     386,   397,   398,   399,   400,   401,   402,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,  -262,  -262,   403,   404,   405,   406,
-     407,   408,   409,   448,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,  -262,   450,   464,   465,   466,   467,   468,   469,
-     470,   471,   472,   473,   474,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,   481,  -262,
-    -262,   482,   483,   484,   485,   486,   488,   489,   490,   491,
-     492,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,   493,   494,   497,   500,   503,  -262,  -262,  -262,
-    -262,  -262,  -262,   504,   513,  -262,  -262,  -262,  -262,  -262,
+    -262,   504,  -262,  -262,   507,   510,   511,   519,   520,   521,
+     523,   524,   525,   526,  -262,  -262,  -262,  -262,  -262,  -262,
+    -262,  -262,  -262,  -262,  -262,   527,   528,   529,   530,   531,
+    -262,  -262,  -262,  -262,  -262,  -262,   532,   533,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,  -262,  -262,  -262,   514,   515,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
+     534,   535,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,   516,   517,   518,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,  -262,  -262,   519,   520,  -262,  -262,
+    -262,  -262,  -262,  -262,  -262,  -262,  -262,   536,   537,   538,
+    -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,   539,
+     540,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,  -262,  -262,  -262,   521,   522,   523,
-     524,   525,   526,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
+     541,   542,   543,   544,   545,   546,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,   527,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
+    -262,  -262,  -262,   547,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,   528,  -262,  -262,   529,   530,  -262,  -262,  -262,  -262,
+    -262,  -262,  -262,  -262,  -262,  -262,   548,  -262,  -262,   549,
+     550,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
-    -262,  -262,   531,   532,   533,  -262,  -262,  -262,  -262,  -262,
+    -262,  -262,   551,   552,   553,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262
 };
 
@@ -1439,10 +1467,10 @@ static const yytype_int16 yypact[] =
      means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-       2,     0,     1,    15,   207,   217,   459,   505,   478,   226,
-     514,   537,   236,   551,     3,    17,   209,   219,   228,   238,
-     461,   480,   507,   516,   539,   553,     4,     5,     6,    10,
-      14,     8,     9,     7,    11,    12,    13,     0,     0,     0,
+       2,     0,     1,    16,   210,   220,   482,   528,   501,   229,
+     537,   560,   239,   574,   255,     3,    18,   212,   222,   231,
+     241,   257,   484,   503,   530,   539,   562,   576,     4,     5,
+       6,    10,    14,    15,     8,     9,     7,    11,    12,    13,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
@@ -1461,68 +1489,71 @@ static const yytype_uint16 yydefact[] =
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,    16,    18,    19,    81,
-      84,    93,   178,   179,    20,   145,   146,   147,   148,   149,
-     150,   151,   152,   153,   154,    32,    72,    21,    85,    86,
-      43,    65,    80,    22,    23,    25,    26,    24,    27,    28,
-      29,    30,    31,   116,   190,   117,   119,   120,   121,   192,
-     197,   193,   204,   205,   206,   174,    82,    71,    97,   114,
-     115,   202,   199,   118,    33,    34,    35,    36,    37,    73,
-      87,    88,   103,    59,    69,    60,   182,   183,    98,    53,
-      54,   181,    55,    56,   107,   111,   125,   134,   159,   203,
-     108,    66,    38,    39,    40,    95,   126,   127,   128,    41,
-      42,    44,    45,    47,    48,    46,   132,    49,    50,    51,
-      57,    76,   112,    90,   133,    83,   155,    91,    92,   109,
-     110,   200,    96,    52,    74,    77,    58,    61,    99,   100,
-      75,   156,   101,    62,    63,    64,   191,   113,   169,   170,
-     171,   172,   180,   102,    70,   104,   105,   106,   157,    67,
-      68,    89,    78,    79,    94,   122,   123,   201,   124,   129,
-     130,   131,   160,   161,   163,   165,   166,   164,   167,   175,
-     135,   136,   139,   140,   137,   138,   141,   142,   144,   143,
-     194,   196,   195,   158,   168,   184,   186,   185,   187,   188,
-     189,   162,   173,   176,   177,   198,     0,     0,     0,     0,
-       0,     0,     0,   208,   210,   211,   212,   214,   215,   216,
-     213,     0,     0,     0,     0,     0,     0,   218,   220,   221,
-     222,   223,   224,   225,     0,     0,     0,     0,     0,     0,
-       0,   227,   229,   230,   233,   234,   231,   235,   232,     0,
-       0,     0,     0,     0,     0,     0,     0,   237,   239,   240,
-     241,   242,   246,   243,   244,   245,     0,     0,     0,     0,
-       0,     0,     0,     0,   460,   462,   464,   463,   469,   465,
-     466,   467,   468,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,   479,   481,   482,   483,   484,
-     485,   486,   487,   488,   489,   490,   491,   492,     0,   506,
-     508,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,   515,   517,   518,   519,   521,   522,   520,   523,   524,
-     525,   526,     0,     0,     0,     0,     0,   538,   540,   541,
-     542,   543,   544,     0,     0,   552,   554,   555,   248,   247,
-     254,   267,   265,   273,   274,   277,   275,   276,   278,   279,
-     280,   281,   282,   304,   305,   306,   307,   308,   332,   333,
-     334,   339,   340,   270,   341,   342,   345,   343,   344,   347,
-     348,   349,   363,   319,   320,   322,   323,   350,   366,   313,
-     315,   367,   373,   374,   375,   271,   331,   389,   390,   314,
-     384,   297,   266,   309,   364,   370,   351,     0,     0,   393,
-     272,   249,   296,   355,   250,   268,   269,   310,   311,   391,
-     353,   357,   358,   251,   394,   335,   362,   298,   318,   368,
-     369,   372,   383,   312,   387,   385,   386,   324,   330,   359,
-     360,   325,   326,   352,   377,   299,   300,   303,   283,   285,
-     286,   287,   288,   289,   395,   396,   398,   336,   337,   338,
-     346,   399,   400,   401,     0,     0,     0,   354,   327,   510,
-     410,   414,   412,   411,   415,   413,     0,     0,   418,   419,
-     255,   256,   257,   258,   259,   260,   261,   262,   263,   264,
-     356,   371,   388,   423,   424,   328,   402,     0,     0,     0,
-       0,     0,     0,   378,   379,   380,   381,   382,   511,   321,
-     316,   376,   295,   252,   253,   317,   425,   427,   426,   428,
-     429,   430,   284,   291,   420,   422,   421,   290,     0,   302,
-     361,   397,   301,   329,   292,   293,   294,   431,   432,   433,
-     437,   436,   434,   435,   438,   439,   440,   441,   443,   442,
-     452,     0,   456,   457,     0,     0,   458,   444,   450,   445,
-     446,   447,   449,   451,   448,   470,   472,   471,   474,   475,
-     476,   477,   473,   493,   494,   495,   496,   497,   498,   499,
-     500,   501,   502,   503,   504,   509,   527,   528,   529,   532,
-     530,   531,   533,   534,   535,   536,   545,   546,   547,   548,
-     549,   556,   557,   365,   392,   409,   512,   513,   416,   417,
-     403,   404,     0,     0,     0,   408,   550,   453,   454,   455,
-     407,   405,   406
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,    17,    19,    20,    82,    85,    94,   181,   182,    21,
+     146,   147,   148,   149,   150,   151,   152,   153,   154,   155,
+      33,    73,    22,    86,    87,    44,    66,    81,    23,    24,
+      26,    27,    25,    28,    29,    30,    31,    32,   117,   193,
+     118,   120,   121,   122,   195,   200,   196,   207,   208,   209,
+     177,    83,    72,    98,   115,   116,   205,   202,   119,    34,
+      35,    36,    37,    38,    74,    88,    89,   104,    60,    70,
+      61,   185,   186,    99,    54,    55,   184,    56,    57,   108,
+     112,   126,   135,   160,   206,   109,    67,    39,    40,    41,
+      96,   127,   128,   129,    42,    43,    45,    46,    48,    49,
+      47,   133,    50,    51,    52,    58,    77,   113,    91,   134,
+      84,   156,    92,    93,   110,   111,   203,    97,    53,    75,
+      78,    59,    62,   100,   101,    76,   157,   102,    63,    64,
+      65,   194,   114,   170,   171,   172,   173,   174,   175,   183,
+     103,    71,   105,   106,   107,   158,    68,    69,    90,    79,
+      80,    95,   123,   124,   204,   125,   130,   131,   132,   161,
+     162,   164,   166,   167,   165,   168,   178,   136,   137,   140,
+     141,   138,   139,   142,   143,   145,   144,   197,   199,   198,
+     159,   169,   187,   189,   188,   190,   191,   192,   163,   176,
+     179,   180,   201,     0,     0,     0,     0,     0,     0,     0,
+     211,   213,   214,   215,   217,   218,   219,   216,     0,     0,
+       0,     0,     0,     0,   221,   223,   224,   225,   226,   227,
+     228,     0,     0,     0,     0,     0,     0,     0,   230,   232,
+     233,   236,   237,   234,   238,   235,     0,     0,     0,     0,
+       0,     0,     0,     0,   240,   242,   243,   244,   245,   249,
+     246,   247,   248,     0,     0,     0,     0,     0,   260,   264,
+     265,   266,   267,   256,   258,   259,   261,   262,   263,     0,
+       0,     0,     0,     0,     0,     0,     0,   483,   485,   487,
+     486,   492,   488,   489,   490,   491,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,   502,   504,
+     505,   506,   507,   508,   509,   510,   511,   512,   513,   514,
+     515,     0,   529,   531,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,   538,   540,   541,   542,   544,   545,
+     543,   546,   547,   548,   549,     0,     0,     0,     0,     0,
+     561,   563,   564,   565,   566,   567,     0,     0,   575,   577,
+     578,   269,   268,   275,   288,   286,   294,   295,   298,   296,
+     297,   299,   300,   301,   302,   303,   325,   326,   327,   328,
+     329,   353,   354,   355,   360,   361,   291,   362,   363,   366,
+     364,   365,   368,   369,   370,   384,   340,   341,   343,   344,
+     371,   387,   334,   336,   388,   394,   395,   396,   292,   352,
+     412,   413,   335,   407,   318,   287,   330,   385,   391,   372,
+       0,     0,   416,   293,   270,   317,   376,   271,   289,   290,
+     331,   332,   414,   374,   378,   379,   272,   417,   356,   383,
+     319,   339,   389,   390,   393,   406,   333,   410,   408,   409,
+     345,   351,   380,   381,   346,   347,   373,   398,   320,   321,
+     324,   304,   306,   307,   308,   309,   310,   418,   419,   421,
+     357,   358,   359,   367,   422,   423,   424,     0,     0,     0,
+     375,   348,   533,   433,   437,   435,   434,   438,   436,     0,
+       0,   441,   442,   276,   277,   278,   279,   280,   281,   282,
+     283,   284,   285,   377,   392,   411,   446,   447,   349,   425,
+       0,     0,     0,     0,     0,     0,   399,   400,   401,   402,
+     403,   404,   405,   534,   342,   337,   397,   316,   273,   274,
+     338,   448,   450,   449,   451,   452,   453,   305,   312,   443,
+     445,   444,   311,     0,   323,   382,   420,   322,   350,   313,
+     314,   315,   454,   455,   456,   460,   459,   457,   458,   461,
+     462,   463,   464,   466,   465,   475,     0,   479,   480,     0,
+       0,   481,   467,   473,   468,   469,   470,   472,   474,   471,
+     250,   251,   252,   253,   254,   493,   495,   494,   497,   498,
+     499,   500,   496,   516,   517,   518,   519,   520,   521,   522,
+     523,   524,   525,   526,   527,   532,   550,   551,   552,   555,
+     553,   554,   556,   557,   558,   559,   568,   569,   570,   571,
+     572,   579,   580,   386,   415,   432,   535,   536,   439,   440,
+     426,   427,     0,     0,     0,   431,   573,   476,   477,   478,
+     430,   428,   429
 };
 
   /* YYPGOTO[NTERM-NUM].  */
@@ -1550,6 +1581,7 @@ static const yytype_int16 yypgoto[] =
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
+    -262,  -262,  -262,  -262,  -262,   -23,   554,   555,   556,   557,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
     -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,  -262,
@@ -1563,36 +1595,37 @@ static const yytype_int16 yypgoto[] =
   /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     1,    14,    15,    26,   226,    16,    27,   423,    17,
-      28,   437,    18,    29,   451,    19,    30,   467,   227,   228,
-     229,   230,   231,   232,   233,   234,   235,   236,   237,   238,
-     239,   240,   241,   242,   243,   244,   245,   246,   247,   248,
-     249,   250,   251,   252,   253,   254,   255,   256,   257,   258,
-     259,   260,   261,   262,   263,   264,   265,   266,   267,   268,
-     269,   270,   271,   272,   273,   274,   275,   276,   277,   278,
-     279,   280,   281,   282,   283,   284,   285,   286,   287,   288,
-     289,   290,   291,   292,   293,   294,   295,   296,   297,   298,
-     299,   300,   301,   302,   303,   304,   305,   306,   307,   308,
-     309,   310,   311,   312,   313,   314,   315,   316,   317,   318,
-     319,   320,   321,   322,   323,   324,   325,   326,   327,   328,
-     329,   330,   331,   332,   333,   334,   335,   336,   337,   338,
-     339,   340,   341,   342,   343,   344,   345,   346,   347,   348,
-     349,   350,   351,   352,   353,   354,   355,   356,   357,   358,
-     359,   360,   361,   362,   363,   364,   365,   366,   367,   368,
-     369,   370,   371,   372,   373,   374,   375,   376,   377,   378,
-     379,   380,   381,   382,   383,   384,   385,   386,   387,   388,
-     389,   390,   391,   392,   393,   394,   395,   396,   397,   398,
-     399,   400,   401,   402,   403,   404,   405,   406,   407,   408,
-     409,   410,   424,   425,   426,   427,   428,   429,   430,   438,
-     439,   440,   441,   442,   443,   468,   469,   470,   471,   472,
-     473,   474,   475,   452,   453,   454,   455,   456,   457,   458,
-      20,    31,   484,   485,   486,   487,   488,   489,   490,   491,
-     492,    21,    32,   505,   506,   507,   508,   509,   510,   511,
-     512,   513,   514,   515,   516,   517,    22,    33,   519,   520,
-     411,   412,   413,   414,    23,    34,   531,   532,   533,   534,
-     535,   536,   537,   538,   539,   540,   541,    24,    35,   547,
-     548,   549,   550,   551,   552,   415,    25,    36,   555,   556,
-     557
+      -1,     1,    15,    16,    28,   231,    17,    29,   430,    18,
+      30,   444,    19,    31,   458,    20,    32,   474,   488,   489,
+     490,   491,   492,    21,    33,   493,   232,   233,   234,   235,
+     236,   237,   238,   239,   240,   241,   242,   243,   244,   245,
+     246,   247,   248,   249,   250,   251,   252,   253,   254,   255,
+     256,   257,   258,   259,   260,   261,   262,   263,   264,   265,
+     266,   267,   268,   269,   270,   271,   272,   273,   274,   275,
+     276,   277,   278,   279,   280,   281,   282,   283,   284,   285,
+     286,   287,   288,   289,   290,   291,   292,   293,   294,   295,
+     296,   297,   298,   299,   300,   301,   302,   303,   304,   305,
+     306,   307,   308,   309,   310,   311,   312,   313,   314,   315,
+     316,   317,   318,   319,   320,   321,   322,   323,   324,   325,
+     326,   327,   328,   329,   330,   331,   332,   333,   334,   335,
+     336,   337,   338,   339,   340,   341,   342,   343,   344,   345,
+     346,   347,   348,   349,   350,   351,   352,   353,   354,   355,
+     356,   357,   358,   359,   360,   361,   362,   363,   364,   365,
+     366,   367,   368,   369,   370,   371,   372,   373,   374,   375,
+     376,   377,   378,   379,   380,   381,   382,   383,   384,   385,
+     386,   387,   388,   389,   390,   391,   392,   393,   394,   395,
+     396,   397,   398,   399,   400,   401,   402,   403,   404,   405,
+     406,   407,   408,   409,   410,   411,   412,   413,   414,   415,
+     416,   417,   431,   432,   433,   434,   435,   436,   437,   445,
+     446,   447,   448,   449,   450,   475,   476,   477,   478,   479,
+     480,   481,   482,   459,   460,   461,   462,   463,   464,   465,
+      22,    34,   507,   508,   509,   510,   511,   512,   513,   514,
+     515,    23,    35,   528,   529,   530,   531,   532,   533,   534,
+     535,   536,   537,   538,   539,   540,    24,    36,   542,   543,
+     418,   419,   420,   421,    25,    37,   554,   555,   556,   557,
+     558,   559,   560,   561,   562,   563,   564,    26,    38,   570,
+     571,   572,   573,   574,   575,   422,    27,    39,   578,   579,
+     580
 };
 
   /* YYTABLE[YYPACT[STATE-NUM]] -- What to do in state STATE-NUM.  If
@@ -1600,182 +1633,195 @@ static const yytype_int16 yydefgoto[] =
      number is the opposite.  If YYTABLE_NINF, syntax error.  */
 static const yytype_uint16 yytable[] =
 {
-       2,   416,   459,   417,   418,   444,   431,   553,   554,   518,
-       0,     3,   558,   559,   432,   433,   493,   494,   495,   496,
-     497,   498,   499,   500,   501,   502,   503,   504,   521,   522,
-     523,   524,   525,   526,   527,   528,   529,   530,   560,   561,
-     562,   445,   446,   563,     4,   564,   565,   566,   567,   568,
-       5,   476,   477,   478,   479,   480,   481,   482,   483,   542,
-     543,   544,   545,   546,   419,   569,   447,   570,   571,   572,
-     573,   574,   575,   576,   577,   578,   579,   580,   581,   582,
-     583,   584,   585,   586,   587,   588,   589,   590,   591,   592,
-     593,   594,   595,   596,     6,   420,   597,   598,   421,   434,
-     599,   435,   600,   601,   602,   603,   604,   605,   606,   607,
-       7,   608,   609,   610,   611,   612,   613,   614,   615,   616,
-     617,   618,   619,   620,   621,   622,   623,   448,   449,   624,
-     625,   626,   627,   628,   629,   630,   631,   632,   633,   634,
-     635,   636,   637,   638,   639,   640,   641,   642,   643,   644,
-     645,     8,   646,   647,   648,   649,   650,   651,   652,   653,
-     654,   655,   656,   657,   658,   659,   450,   660,   661,   662,
-     663,   664,   665,   666,   667,   668,   669,   670,   671,   672,
-     673,   674,   675,   676,   677,   678,   679,   680,   681,   682,
-     683,   684,   685,   686,   687,   688,   689,   690,   691,   692,
-     693,   460,     9,   461,   462,   463,   464,   465,   694,   695,
-     696,   697,   698,   466,   699,   700,   422,   701,    10,   702,
-     436,   703,   704,   705,   706,   707,   708,   709,   710,   711,
-     712,   713,   714,   715,   716,    11,   717,   718,   719,   720,
-     721,   722,   723,    12,   724,   725,   726,   727,   728,   729,
-     730,   731,   732,   733,   734,   735,   736,   737,   738,   739,
-     740,   741,   742,   743,   744,   745,     0,    13,    37,    38,
-      39,    40,    41,    42,    43,    44,    45,    46,    47,    48,
-      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
-      59,    60,    61,    62,    63,    64,    65,    66,    67,   746,
-     747,   748,   749,    68,    69,    70,   750,   751,   752,    71,
-      72,    73,    74,    75,    76,    77,    78,    79,    80,    81,
-      82,    83,    84,    85,    86,    87,    88,    89,    90,    91,
-      92,    93,    94,    95,    96,    97,    98,    99,   100,   101,
-     102,   103,   104,   105,   106,   107,   108,   109,   110,   111,
-     753,   754,   755,   756,   757,   758,   759,   760,   761,   112,
-     113,   114,   762,   115,   116,   117,   763,   764,   118,   119,
-     120,   121,   122,   123,   124,   125,   126,   127,   128,   129,
-     130,   131,   132,   133,   134,   135,   136,   137,   138,   139,
-     140,   141,   765,   766,   767,   142,   768,   143,   144,   145,
-     146,   147,   148,   149,   150,   151,   152,   769,   770,   771,
-     772,   773,   774,   775,   776,   777,   778,   779,   780,   781,
-     153,   154,   155,   156,   157,   158,   159,   160,   161,   162,
-     163,   164,   165,   166,   167,   168,   169,   170,   171,   172,
-     173,   174,   175,   176,   177,   178,   179,   180,   181,   182,
-     183,   184,   185,   186,   187,   188,   189,   190,   782,   191,
-     783,   192,   193,   194,   195,   196,   197,   198,   199,   200,
-     201,   202,   203,   204,   784,   785,   786,   787,   788,   789,
-     790,   791,   792,   793,   794,   205,   206,   207,   208,   209,
-     210,   795,   796,   797,   798,   799,   800,   211,   801,   802,
-     803,   804,   805,   806,   807,   212,   213,   808,   214,   215,
-     809,   216,   217,   810,   811,   218,   219,   220,   221,   222,
-     223,   224,   225,   812,   813,   814,   815,   816,   817,   818,
-     819,   820,   821,   822,   823,   824,   825,   826,   827,   828,
-     829,   830,   831,   832
+       2,   466,   423,   451,   424,   425,   541,   438,   576,   577,
+     494,     3,   581,   582,   583,   439,   440,   565,   566,   567,
+     568,   569,   584,   466,   516,   517,   518,   519,   520,   521,
+     522,   523,   524,   525,   526,   527,   585,   586,   587,   452,
+     453,   588,   589,   590,     4,   591,   592,   593,   594,   595,
+       5,   544,   545,   546,   547,   548,   549,   550,   551,   552,
+     553,   596,   597,   598,   454,   426,   499,   500,   501,   502,
+     503,   504,   505,   506,   599,   600,   601,   602,   603,   604,
+     605,   606,   607,   608,   609,   610,   611,   612,   613,   614,
+     615,   616,   617,   618,     6,   619,   427,   620,   621,   428,
+     441,   622,   442,   623,   624,   625,   626,   627,   628,   629,
+       7,   630,   631,   632,   633,   634,   635,   636,   637,   638,
+     639,   640,   641,   642,   643,   455,   456,   644,   645,   646,
+     647,   648,   649,   650,   651,   652,   653,   654,   655,   656,
+     657,   658,   659,   660,   661,   662,   663,   664,   665,   666,
+     667,     8,   668,   669,   670,   671,   672,   673,   674,   675,
+     676,   677,   678,   679,   457,   680,   681,   682,   683,   684,
+     685,   686,   687,   688,   689,   690,   691,   692,   693,   694,
+     695,   696,   697,   698,   699,   700,   701,   702,   703,   704,
+     705,   706,   707,   708,   709,   710,   711,   712,   713,   714,
+     715,   716,     9,   717,   468,   469,   470,   718,   719,   720,
+     721,   722,   723,   724,   473,   725,   726,   727,   728,   429,
+      10,   729,   730,   443,   467,   731,   468,   469,   470,   471,
+     472,   483,   484,   485,   486,   487,   473,    11,   732,   733,
+     734,   735,   736,   737,   738,    12,   739,   740,   741,   742,
+     743,   744,   745,   746,   747,   748,   749,   750,   751,   752,
+     753,   754,   755,   756,   757,   758,   759,   760,    13,   761,
+     762,     0,    14,    40,    41,    42,    43,    44,    45,    46,
+      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
+      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
+      67,    68,    69,    70,   763,   764,   765,   766,    71,    72,
+      73,   767,   768,   769,    74,    75,    76,    77,    78,    79,
+      80,    81,    82,    83,    84,    85,    86,    87,    88,    89,
+      90,    91,    92,    93,    94,    95,    96,    97,    98,    99,
+     100,   101,   102,   103,   104,   105,   106,   107,   108,   109,
+     110,   111,   112,   113,   114,   770,   771,   772,   773,   774,
+     775,   776,   777,   778,   115,   116,   117,   779,   118,   119,
+     120,   780,   781,   121,   122,   123,   124,   125,   126,   127,
+     128,   129,   130,   131,   132,   133,   134,   135,   136,   137,
+     138,   139,   140,   141,   142,   143,   144,   782,   783,   784,
+     145,   785,   146,   147,   148,   149,   150,   151,   152,   153,
+     154,   155,   786,   787,   788,   789,   790,   791,   792,   793,
+     794,   795,   796,   797,   798,   156,   157,   158,   159,   160,
+     161,   162,   163,   164,   165,   166,   167,   168,   169,   170,
+     171,   172,   173,   174,   175,   176,   177,   178,   179,   180,
+     181,   182,   183,   184,   185,   186,   187,   188,   189,   190,
+     191,   192,   193,   799,   194,   800,   195,   196,   197,   198,
+     199,   200,   201,   202,   203,   204,   205,   206,   207,   208,
+     209,   801,   802,   803,   804,   805,   806,   807,   808,   809,
+     810,   811,   210,   211,   212,   213,   214,   215,   812,   813,
+     814,   815,   816,   817,   216,   818,   819,   820,   821,   822,
+     823,   824,   217,   218,   825,   219,   220,   826,   221,   222,
+     827,   828,   223,   224,   225,   226,   227,   228,   229,   829,
+     830,   831,   230,   832,   833,   834,   835,   836,   837,   838,
+     839,   840,   841,   842,   843,   844,   845,   846,   847,   848,
+     849,   850,   851,   852,   853,   854,   855,   856,   857,   858,
+     859,   860,   861,   862,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,   495,   496,   497,
+     498
 };
 
 static const yytype_int16 yycheck[] =
 {
-       0,    43,    43,    45,    46,    43,    43,   268,   269,   111,
-      -1,    11,    10,    10,    51,    52,   152,   153,   154,   155,
-     156,   157,   158,   159,   160,   161,   162,   163,   219,   220,
-     221,   222,   223,   224,   225,   226,   227,   228,    10,    10,
-      10,    79,    80,    10,    44,    10,    10,    10,    10,    10,
-      50,    95,    96,    97,    98,    99,   100,   101,   102,   236,
-     237,   238,   239,   240,   106,    10,   104,    10,    10,    10,
+       0,    43,    43,    43,    45,    46,   111,    43,   269,   270,
+      33,    11,    10,    10,    10,    51,    52,   238,   239,   240,
+     241,   242,    10,    43,   152,   153,   154,   155,   156,   157,
+     158,   159,   160,   161,   162,   163,    10,    10,    10,    79,
+      80,    10,    10,    10,    44,    10,    10,    10,    10,    10,
+      50,   221,   222,   223,   224,   225,   226,   227,   228,   229,
+     230,    10,    10,    10,   104,   106,    95,    96,    97,    98,
+      99,   100,   101,   102,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    94,   137,    10,    10,   140,   136,
-      10,   138,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    94,    10,   137,    10,    10,   140,
+     136,    10,   138,    10,    10,    10,    10,    10,    10,    10,
      110,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,   165,   166,    10,
+      10,    10,    10,    10,    10,   165,   166,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,   151,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,   204,    10,    10,    10,
+      10,    10,    10,    10,   204,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,   242,   202,   244,   245,   246,   247,   248,    10,    10,
-      10,    10,    10,   254,    10,    10,   258,    10,   218,    10,
-     257,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,   235,    10,    10,    10,    10,
-      10,    10,    10,   243,    10,    10,    10,    10,    10,    10,
+      10,    10,   202,    10,   246,   247,   248,    10,    10,    10,
+      10,    10,    10,    10,   256,    10,    10,    10,    10,   260,
+     220,    10,    10,   259,   244,    10,   246,   247,   248,   249,
+     250,   273,   274,   275,   276,   277,   256,   237,    10,    10,
+      10,    10,    10,    10,    10,   245,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    -1,   267,    12,    13,
-      14,    15,    16,    17,    18,    19,    20,    21,    22,    23,
-      24,    25,    26,    27,    28,    29,    30,    31,    32,    33,
-      34,    35,    36,    37,    38,    39,    40,    41,    42,    10,
-      10,    10,    10,    47,    48,    49,    10,    10,    10,    53,
-      54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
-      64,    65,    66,    67,    68,    69,    70,    71,    72,    73,
-      74,    75,    76,    77,    78,    79,    80,    81,    82,    83,
-      84,    85,    86,    87,    88,    89,    90,    91,    92,    93,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,   103,
-     104,   105,    10,   107,   108,   109,    10,    10,   112,   113,
-     114,   115,   116,   117,   118,   119,   120,   121,   122,   123,
-     124,   125,   126,   127,   128,   129,   130,   131,   132,   133,
-     134,   135,    10,    10,    10,   139,    10,   141,   142,   143,
-     144,   145,   146,   147,   148,   149,   150,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,   268,    10,
+      10,    -1,   272,    12,    13,    14,    15,    16,    17,    18,
+      19,    20,    21,    22,    23,    24,    25,    26,    27,    28,
+      29,    30,    31,    32,    33,    34,    35,    36,    37,    38,
+      39,    40,    41,    42,    10,    10,    10,    10,    47,    48,
+      49,    10,    10,    10,    53,    54,    55,    56,    57,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    67,    68,
+      69,    70,    71,    72,    73,    74,    75,    76,    77,    78,
+      79,    80,    81,    82,    83,    84,    85,    86,    87,    88,
+      89,    90,    91,    92,    93,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,   103,   104,   105,    10,   107,   108,
+     109,    10,    10,   112,   113,   114,   115,   116,   117,   118,
+     119,   120,   121,   122,   123,   124,   125,   126,   127,   128,
+     129,   130,   131,   132,   133,   134,   135,    10,    10,    10,
+     139,    10,   141,   142,   143,   144,   145,   146,   147,   148,
+     149,   150,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,   164,   165,   166,   167,   168,
+     169,   170,   171,   172,   173,   174,   175,   176,   177,   178,
+     179,   180,   181,   182,   183,   184,   185,   186,   187,   188,
+     189,   190,   191,   192,   193,   194,   195,   196,   197,   198,
+     199,   200,   201,    10,   203,    10,   205,   206,   207,   208,
+     209,   210,   211,   212,   213,   214,   215,   216,   217,   218,
+     219,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,   231,   232,   233,   234,   235,   236,    10,    10,
+      10,    10,    10,    10,   243,    10,    10,    10,    10,    10,
+      10,    10,   251,   252,    10,   254,   255,    10,   257,   258,
+      10,    10,   261,   262,   263,   264,   265,   266,   267,    10,
+      10,    10,   271,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-     164,   165,   166,   167,   168,   169,   170,   171,   172,   173,
-     174,   175,   176,   177,   178,   179,   180,   181,   182,   183,
-     184,   185,   186,   187,   188,   189,   190,   191,   192,   193,
-     194,   195,   196,   197,   198,   199,   200,   201,    10,   203,
-      10,   205,   206,   207,   208,   209,   210,   211,   212,   213,
-     214,   215,   216,   217,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,   229,   230,   231,   232,   233,
-     234,    10,    10,    10,    10,    10,    10,   241,    10,    10,
-      10,    10,    10,    10,    10,   249,   250,    10,   252,   253,
-      10,   255,   256,    10,    10,   259,   260,   261,   262,   263,
-     264,   265,   266,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10
+      10,    10,    10,    10,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    33,    33,    33,
+      33
 };
 
   /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
      symbol of state STATE-NUM.  */
 static const yytype_uint16 yystos[] =
 {
-       0,   271,     0,    11,    44,    50,    94,   110,   151,   202,
-     218,   235,   243,   267,   272,   273,   276,   279,   282,   285,
-     500,   511,   526,   534,   547,   556,   274,   277,   280,   283,
-     286,   501,   512,   527,   535,   548,   557,    12,    13,    14,
-      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
-      25,    26,    27,    28,    29,    30,    31,    32,    33,    34,
-      35,    36,    37,    38,    39,    40,    41,    42,    47,    48,
-      49,    53,    54,    55,    56,    57,    58,    59,    60,    61,
-      62,    63,    64,    65,    66,    67,    68,    69,    70,    71,
-      72,    73,    74,    75,    76,    77,    78,    79,    80,    81,
-      82,    83,    84,    85,    86,    87,    88,    89,    90,    91,
-      92,    93,   103,   104,   105,   107,   108,   109,   112,   113,
-     114,   115,   116,   117,   118,   119,   120,   121,   122,   123,
-     124,   125,   126,   127,   128,   129,   130,   131,   132,   133,
-     134,   135,   139,   141,   142,   143,   144,   145,   146,   147,
-     148,   149,   150,   164,   165,   166,   167,   168,   169,   170,
-     171,   172,   173,   174,   175,   176,   177,   178,   179,   180,
-     181,   182,   183,   184,   185,   186,   187,   188,   189,   190,
-     191,   192,   193,   194,   195,   196,   197,   198,   199,   200,
-     201,   203,   205,   206,   207,   208,   209,   210,   211,   212,
-     213,   214,   215,   216,   217,   229,   230,   231,   232,   233,
-     234,   241,   249,   250,   252,   253,   255,   256,   259,   260,
-     261,   262,   263,   264,   265,   266,   275,   288,   289,   290,
-     291,   292,   293,   294,   295,   296,   297,   298,   299,   300,
-     301,   302,   303,   304,   305,   306,   307,   308,   309,   310,
-     311,   312,   313,   314,   315,   316,   317,   318,   319,   320,
-     321,   322,   323,   324,   325,   326,   327,   328,   329,   330,
-     331,   332,   333,   334,   335,   336,   337,   338,   339,   340,
-     341,   342,   343,   344,   345,   346,   347,   348,   349,   350,
-     351,   352,   353,   354,   355,   356,   357,   358,   359,   360,
-     361,   362,   363,   364,   365,   366,   367,   368,   369,   370,
-     371,   372,   373,   374,   375,   376,   377,   378,   379,   380,
-     381,   382,   383,   384,   385,   386,   387,   388,   389,   390,
-     391,   392,   393,   394,   395,   396,   397,   398,   399,   400,
-     401,   402,   403,   404,   405,   406,   407,   408,   409,   410,
-     411,   412,   413,   414,   415,   416,   417,   418,   419,   420,
-     421,   422,   423,   424,   425,   426,   427,   428,   429,   430,
-     431,   432,   433,   434,   435,   436,   437,   438,   439,   440,
-     441,   442,   443,   444,   445,   446,   447,   448,   449,   450,
-     451,   452,   453,   454,   455,   456,   457,   458,   459,   460,
-     461,   462,   463,   464,   465,   466,   467,   468,   469,   470,
-     471,   530,   531,   532,   533,   555,    43,    45,    46,   106,
-     137,   140,   258,   278,   472,   473,   474,   475,   476,   477,
-     478,    43,    51,    52,   136,   138,   257,   281,   479,   480,
-     481,   482,   483,   484,    43,    79,    80,   104,   165,   166,
-     204,   284,   493,   494,   495,   496,   497,   498,   499,    43,
-     242,   244,   245,   246,   247,   248,   254,   287,   485,   486,
-     487,   488,   489,   490,   491,   492,    95,    96,    97,    98,
-      99,   100,   101,   102,   502,   503,   504,   505,   506,   507,
-     508,   509,   510,   152,   153,   154,   155,   156,   157,   158,
-     159,   160,   161,   162,   163,   513,   514,   515,   516,   517,
-     518,   519,   520,   521,   522,   523,   524,   525,   111,   528,
-     529,   219,   220,   221,   222,   223,   224,   225,   226,   227,
-     228,   536,   537,   538,   539,   540,   541,   542,   543,   544,
-     545,   546,   236,   237,   238,   239,   240,   549,   550,   551,
-     552,   553,   554,   268,   269,   558,   559,   560,    10,    10,
+       0,   279,     0,    11,    44,    50,    94,   110,   151,   202,
+     220,   237,   245,   268,   272,   280,   281,   284,   287,   290,
+     293,   301,   518,   529,   544,   552,   565,   574,   282,   285,
+     288,   291,   294,   302,   519,   530,   545,   553,   566,   575,
+      12,    13,    14,    15,    16,    17,    18,    19,    20,    21,
+      22,    23,    24,    25,    26,    27,    28,    29,    30,    31,
+      32,    33,    34,    35,    36,    37,    38,    39,    40,    41,
+      42,    47,    48,    49,    53,    54,    55,    56,    57,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    67,    68,
+      69,    70,    71,    72,    73,    74,    75,    76,    77,    78,
+      79,    80,    81,    82,    83,    84,    85,    86,    87,    88,
+      89,    90,    91,    92,    93,   103,   104,   105,   107,   108,
+     109,   112,   113,   114,   115,   116,   117,   118,   119,   120,
+     121,   122,   123,   124,   125,   126,   127,   128,   129,   130,
+     131,   132,   133,   134,   135,   139,   141,   142,   143,   144,
+     145,   146,   147,   148,   149,   150,   164,   165,   166,   167,
+     168,   169,   170,   171,   172,   173,   174,   175,   176,   177,
+     178,   179,   180,   181,   182,   183,   184,   185,   186,   187,
+     188,   189,   190,   191,   192,   193,   194,   195,   196,   197,
+     198,   199,   200,   201,   203,   205,   206,   207,   208,   209,
+     210,   211,   212,   213,   214,   215,   216,   217,   218,   219,
+     231,   232,   233,   234,   235,   236,   243,   251,   252,   254,
+     255,   257,   258,   261,   262,   263,   264,   265,   266,   267,
+     271,   283,   304,   305,   306,   307,   308,   309,   310,   311,
+     312,   313,   314,   315,   316,   317,   318,   319,   320,   321,
+     322,   323,   324,   325,   326,   327,   328,   329,   330,   331,
+     332,   333,   334,   335,   336,   337,   338,   339,   340,   341,
+     342,   343,   344,   345,   346,   347,   348,   349,   350,   351,
+     352,   353,   354,   355,   356,   357,   358,   359,   360,   361,
+     362,   363,   364,   365,   366,   367,   368,   369,   370,   371,
+     372,   373,   374,   375,   376,   377,   378,   379,   380,   381,
+     382,   383,   384,   385,   386,   387,   388,   389,   390,   391,
+     392,   393,   394,   395,   396,   397,   398,   399,   400,   401,
+     402,   403,   404,   405,   406,   407,   408,   409,   410,   411,
+     412,   413,   414,   415,   416,   417,   418,   419,   420,   421,
+     422,   423,   424,   425,   426,   427,   428,   429,   430,   431,
+     432,   433,   434,   435,   436,   437,   438,   439,   440,   441,
+     442,   443,   444,   445,   446,   447,   448,   449,   450,   451,
+     452,   453,   454,   455,   456,   457,   458,   459,   460,   461,
+     462,   463,   464,   465,   466,   467,   468,   469,   470,   471,
+     472,   473,   474,   475,   476,   477,   478,   479,   480,   481,
+     482,   483,   484,   485,   486,   487,   488,   489,   548,   549,
+     550,   551,   573,    43,    45,    46,   106,   137,   140,   260,
+     286,   490,   491,   492,   493,   494,   495,   496,    43,    51,
+      52,   136,   138,   259,   289,   497,   498,   499,   500,   501,
+     502,    43,    79,    80,   104,   165,   166,   204,   292,   511,
+     512,   513,   514,   515,   516,   517,    43,   244,   246,   247,
+     248,   249,   250,   256,   295,   503,   504,   505,   506,   507,
+     508,   509,   510,   273,   274,   275,   276,   277,   296,   297,
+     298,   299,   300,   303,   503,   504,   505,   506,   507,    95,
+      96,    97,    98,    99,   100,   101,   102,   520,   521,   522,
+     523,   524,   525,   526,   527,   528,   152,   153,   154,   155,
+     156,   157,   158,   159,   160,   161,   162,   163,   531,   532,
+     533,   534,   535,   536,   537,   538,   539,   540,   541,   542,
+     543,   111,   546,   547,   221,   222,   223,   224,   225,   226,
+     227,   228,   229,   230,   554,   555,   556,   557,   558,   559,
+     560,   561,   562,   563,   564,   238,   239,   240,   241,   242,
+     567,   568,   569,   570,   571,   572,   269,   270,   576,   577,
+     578,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
@@ -1809,69 +1855,72 @@ static const yytype_uint16 yystos[] =
   /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_uint16 yyr1[] =
 {
-       0,   270,   271,   271,   272,   272,   272,   272,   272,   272,
-     272,   272,   272,   272,   272,   273,   274,   274,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   275,   275,   275,
-     275,   275,   275,   275,   275,   275,   275,   276,   277,   277,
-     278,   278,   278,   278,   278,   278,   278,   279,   280,   280,
-     281,   281,   281,   281,   281,   281,   282,   283,   283,   284,
-     284,   284,   284,   284,   284,   284,   285,   286,   286,   287,
-     287,   287,   287,   287,   287,   287,   287,   288,   289,   290,
-     291,   292,   293,   294,   295,   296,   297,   298,   299,   300,
-     301,   302,   303,   304,   305,   306,   307,   308,   309,   310,
-     311,   312,   313,   314,   315,   316,   317,   318,   319,   320,
-     321,   322,   323,   324,   325,   326,   327,   328,   329,   330,
-     331,   332,   333,   334,   335,   336,   337,   338,   339,   340,
-     341,   342,   343,   344,   345,   346,   347,   348,   349,   350,
-     351,   352,   353,   354,   355,   356,   357,   358,   359,   360,
-     361,   362,   363,   364,   365,   366,   367,   368,   369,   370,
-     371,   372,   373,   374,   375,   376,   377,   378,   379,   380,
-     381,   382,   383,   384,   385,   386,   387,   388,   389,   390,
-     391,   392,   393,   394,   395,   396,   397,   398,   399,   400,
-     401,   402,   403,   404,   405,   406,   407,   408,   409,   410,
-     411,   412,   413,   414,   415,   416,   417,   418,   419,   420,
-     421,   422,   423,   424,   425,   426,   427,   428,   429,   430,
-     431,   432,   433,   434,   435,   436,   437,   438,   439,   440,
-     441,   442,   443,   444,   445,   446,   447,   448,   449,   450,
-     451,   452,   453,   454,   455,   456,   457,   458,   459,   460,
-     461,   462,   463,   464,   465,   466,   467,   468,   469,   470,
-     471,   472,   473,   474,   475,   476,   477,   478,   479,   480,
-     481,   482,   483,   484,   485,   486,   487,   488,   489,   490,
-     491,   492,   493,   494,   495,   496,   497,   498,   499,   500,
-     501,   501,   502,   502,   502,   502,   502,   502,   502,   502,
-     503,   504,   505,   506,   507,   508,   509,   510,   511,   512,
-     512,   513,   513,   513,   513,   513,   513,   513,   513,   513,
-     513,   513,   513,   514,   515,   516,   517,   518,   519,   520,
-     521,   522,   523,   524,   525,   526,   527,   527,   528,   529,
-     530,   531,   532,   533,   534,   535,   535,   536,   536,   536,
-     536,   536,   536,   536,   536,   536,   536,   537,   538,   539,
-     540,   541,   542,   543,   544,   545,   546,   547,   548,   548,
-     549,   549,   549,   549,   549,   550,   551,   552,   553,   554,
-     555,   556,   557,   557,   558,   558,   559,   560
+       0,   278,   279,   279,   280,   280,   280,   280,   280,   280,
+     280,   280,   280,   280,   280,   280,   281,   282,   282,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     283,   283,   283,   283,   283,   283,   283,   283,   283,   283,
+     284,   285,   285,   286,   286,   286,   286,   286,   286,   286,
+     287,   288,   288,   289,   289,   289,   289,   289,   289,   290,
+     291,   291,   292,   292,   292,   292,   292,   292,   292,   293,
+     294,   294,   295,   295,   295,   295,   295,   295,   295,   295,
+     296,   297,   298,   299,   300,   301,   302,   302,   303,   303,
+     303,   303,   303,   303,   303,   303,   303,   303,   304,   305,
+     306,   307,   308,   309,   310,   311,   312,   313,   314,   315,
+     316,   317,   318,   319,   320,   321,   322,   323,   324,   325,
+     326,   327,   328,   329,   330,   331,   332,   333,   334,   335,
+     336,   337,   338,   339,   340,   341,   342,   343,   344,   345,
+     346,   347,   348,   349,   350,   351,   352,   353,   354,   355,
+     356,   357,   358,   359,   360,   361,   362,   363,   364,   365,
+     366,   367,   368,   369,   370,   371,   372,   373,   374,   375,
+     376,   377,   378,   379,   380,   381,   382,   383,   384,   385,
+     386,   387,   388,   389,   390,   391,   392,   393,   394,   395,
+     396,   397,   398,   399,   400,   401,   402,   403,   404,   405,
+     406,   407,   408,   409,   410,   411,   412,   413,   414,   415,
+     416,   417,   418,   419,   420,   421,   422,   423,   424,   425,
+     426,   427,   428,   429,   430,   431,   432,   433,   434,   435,
+     436,   437,   438,   439,   440,   441,   442,   443,   444,   445,
+     446,   447,   448,   449,   450,   451,   452,   453,   454,   455,
+     456,   457,   458,   459,   460,   461,   462,   463,   464,   465,
+     466,   467,   468,   469,   470,   471,   472,   473,   474,   475,
+     476,   477,   478,   479,   480,   481,   482,   483,   484,   485,
+     486,   487,   488,   489,   490,   491,   492,   493,   494,   495,
+     496,   497,   498,   499,   500,   501,   502,   503,   504,   505,
+     506,   507,   508,   509,   510,   511,   512,   513,   514,   515,
+     516,   517,   518,   519,   519,   520,   520,   520,   520,   520,
+     520,   520,   520,   521,   522,   523,   524,   525,   526,   527,
+     528,   529,   530,   530,   531,   531,   531,   531,   531,   531,
+     531,   531,   531,   531,   531,   531,   532,   533,   534,   535,
+     536,   537,   538,   539,   540,   541,   542,   543,   544,   545,
+     545,   546,   547,   548,   549,   550,   551,   552,   553,   553,
+     554,   554,   554,   554,   554,   554,   554,   554,   554,   554,
+     555,   556,   557,   558,   559,   560,   561,   562,   563,   564,
+     565,   566,   566,   567,   567,   567,   567,   567,   568,   569,
+     570,   571,   572,   573,   574,   575,   575,   576,   576,   577,
+     578
 };
 
   /* YYR2[YYN] -- Number of symbols on the right hand side of rule YYN.  */
 static const yytype_uint8 yyr2[] =
 {
        0,     2,     0,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     1,     2,     0,     1,     1,
+       2,     2,     2,     2,     2,     2,     1,     2,     0,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
@@ -1890,12 +1939,13 @@ static const yytype_uint8 yyr2[] =
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     2,     0,
-       1,     1,     1,     1,     1,     1,     1,     1,     2,     0,
-       1,     1,     1,     1,     1,     1,     1,     2,     0,     1,
-       1,     1,     1,     1,     1,     1,     1,     2,     0,     1,
-       1,     1,     1,     1,     1,     1,     1,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     2,     0,     1,     1,     1,     1,     1,     1,     1,
+       1,     2,     0,     1,     1,     1,     1,     1,     1,     1,
+       2,     0,     1,     1,     1,     1,     1,     1,     1,     1,
+       2,     0,     1,     1,     1,     1,     1,     1,     1,     1,
+       2,     2,     2,     2,     2,     1,     2,     0,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
@@ -1906,26 +1956,28 @@ static const yytype_uint8 yyr2[] =
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     3,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     3,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     3,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     3,     3,     4,     4,     4,     3,     3,
-       2,     2,     2,     2,     2,     2,     3,     3,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     3,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     3,     3,     4,     4,
+       4,     3,     3,     2,     2,     2,     2,     2,     2,     3,
+       3,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     3,     3,     3,     2,     2,     2,     1,
-       2,     0,     1,     1,     1,     1,     1,     1,     1,     1,
-       2,     2,     2,     2,     2,     2,     2,     2,     1,     2,
-       0,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       2,     2,     2,     2,     2,     2,     3,     3,     3,     2,
+       2,     2,     1,     2,     0,     1,     1,     1,     1,     1,
        1,     1,     1,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     1,     2,     0,     1,     2,
-       2,     2,     3,     3,     1,     2,     0,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     1,     2,     0,
-       1,     1,     1,     1,     1,     2,     2,     2,     2,     2,
-       3,     1,     2,     0,     1,     1,     2,     2
+       2,     1,     2,     0,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     1,     2,
+       0,     1,     2,     2,     2,     3,     3,     1,     2,     0,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       1,     2,     0,     1,     1,     1,     1,     1,     2,     2,
+       2,     2,     2,     3,     1,     2,     0,     1,     1,     2,
+       2
 };
 
 
@@ -1941,22 +1993,22 @@ static const yytype_uint8 yyr2[] =
 
 #define YYRECOVERING()  (!!yyerrstatus)
 
-#define YYBACKUP(Token, Value)                                  \
-do                                                              \
-  if (yychar == YYEMPTY)                                        \
-    {                                                           \
-      yychar = (Token);                                         \
-      yylval = (Value);                                         \
-      YYPOPSTACK (yylen);                                       \
-      yystate = *yyssp;                                         \
-      goto yybackup;                                            \
-    }                                                           \
-  else                                                          \
-    {                                                           \
-      yyerror (YY_("syntax error: cannot back up")); \
-      YYERROR;                                                  \
-    }                                                           \
-while (0)
+#define YYBACKUP(Token, Value)                                    \
+  do                                                              \
+    if (yychar == YYEMPTY)                                        \
+      {                                                           \
+        yychar = (Token);                                         \
+        yylval = (Value);                                         \
+        YYPOPSTACK (yylen);                                       \
+        yystate = *yyssp;                                         \
+        goto yybackup;                                            \
+      }                                                           \
+    else                                                          \
+      {                                                           \
+        yyerror (YY_("syntax error: cannot back up")); \
+        YYERROR;                                                  \
+      }                                                           \
+  while (0)
 
 /* Error token number */
 #define YYTERROR        1
@@ -1996,37 +2048,37 @@ do {                                                                      \
 } while (0)
 
 
-/*----------------------------------------.
-| Print this symbol's value on YYOUTPUT.  |
-`----------------------------------------*/
+/*-----------------------------------.
+| Print this symbol's value on YYO.  |
+`-----------------------------------*/
 
 static void
-yy_symbol_value_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep)
+yy_symbol_value_print (FILE *yyo, int yytype, YYSTYPE const * const yyvaluep)
 {
-  FILE *yyo = yyoutput;
-  YYUSE (yyo);
+  FILE *yyoutput = yyo;
+  YYUSE (yyoutput);
   if (!yyvaluep)
     return;
 # ifdef YYPRINT
   if (yytype < YYNTOKENS)
-    YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep);
+    YYPRINT (yyo, yytoknum[yytype], *yyvaluep);
 # endif
   YYUSE (yytype);
 }
 
 
-/*--------------------------------.
-| Print this symbol on YYOUTPUT.  |
-`--------------------------------*/
+/*---------------------------.
+| Print this symbol on YYO.  |
+`---------------------------*/
 
 static void
-yy_symbol_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep)
+yy_symbol_print (FILE *yyo, int yytype, YYSTYPE const * const yyvaluep)
 {
-  YYFPRINTF (yyoutput, "%s %s (",
+  YYFPRINTF (yyo, "%s %s (",
              yytype < YYNTOKENS ? "token" : "nterm", yytname[yytype]);
 
-  yy_symbol_value_print (yyoutput, yytype, yyvaluep);
-  YYFPRINTF (yyoutput, ")");
+  yy_symbol_value_print (yyo, yytype, yyvaluep);
+  YYFPRINTF (yyo, ")");
 }
 
 /*------------------------------------------------------------------.
@@ -2060,7 +2112,7 @@ do {                                                            \
 static void
 yy_reduce_print (yytype_int16 *yyssp, YYSTYPE *yyvsp, int yyrule)
 {
-  unsigned long int yylno = yyrline[yyrule];
+  unsigned long yylno = yyrline[yyrule];
   int yynrhs = yyr2[yyrule];
   int yyi;
   YYFPRINTF (stderr, "Reducing stack by rule %d (line %lu):\n",
@@ -2071,7 +2123,7 @@ yy_reduce_print (yytype_int16 *yyssp, YYSTYPE *yyvsp, int yyrule)
       YYFPRINTF (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr,
                        yystos[yyssp[yyi + 1 - yynrhs]],
-                       &(yyvsp[(yyi + 1) - (yynrhs)])
+                       &yyvsp[(yyi + 1) - (yynrhs)]
                                               );
       YYFPRINTF (stderr, "\n");
     }
@@ -2175,7 +2227,10 @@ yytnamerr (char *yyres, const char *yystr)
           case '\\':
             if (*++yyp != '\\')
               goto do_not_strip_quotes;
-            /* Fall through.  */
+            else
+              goto append;
+
+          append:
           default:
             if (yyres)
               yyres[yyn] = *yyp;
@@ -2193,7 +2248,7 @@ yytnamerr (char *yyres, const char *yystr)
   if (! yyres)
     return yystrlen (yystr);
 
-  return yystpcpy (yyres, yystr) - yyres;
+  return (YYSIZE_T) (yystpcpy (yyres, yystr) - yyres);
 }
 # endif
 
@@ -2271,10 +2326,10 @@ yysyntax_error (YYSIZE_T *yymsg_alloc, char **yymsg,
                 yyarg[yycount++] = yytname[yyx];
                 {
                   YYSIZE_T yysize1 = yysize + yytnamerr (YY_NULLPTR, yytname[yyx]);
-                  if (! (yysize <= yysize1
-                         && yysize1 <= YYSTACK_ALLOC_MAXIMUM))
+                  if (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)
+                    yysize = yysize1;
+                  else
                     return 2;
-                  yysize = yysize1;
                 }
               }
         }
@@ -2286,6 +2341,7 @@ yysyntax_error (YYSIZE_T *yymsg_alloc, char **yymsg,
       case N:                               \
         yyformat = S;                       \
       break
+    default: /* Avoid compiler warnings. */
       YYCASE_(0, YY_("syntax error"));
       YYCASE_(1, YY_("syntax error, unexpected %s"));
       YYCASE_(2, YY_("syntax error, unexpected %s, expecting %s"));
@@ -2297,9 +2353,10 @@ yysyntax_error (YYSIZE_T *yymsg_alloc, char **yymsg,
 
   {
     YYSIZE_T yysize1 = yysize + yystrlen (yyformat);
-    if (! (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM))
+    if (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)
+      yysize = yysize1;
+    else
       return 2;
-    yysize = yysize1;
   }
 
   if (*yymsg_alloc < yysize)
@@ -2425,23 +2482,33 @@ yyparse (void)
   yychar = YYEMPTY; /* Cause a token to be read.  */
   goto yysetstate;
 
+
 /*------------------------------------------------------------.
-| yynewstate -- Push a new state, which is found in yystate.  |
+| yynewstate -- push a new state, which is found in yystate.  |
 `------------------------------------------------------------*/
- yynewstate:
+yynewstate:
   /* In all cases, when you get here, the value and location stacks
      have just been pushed.  So pushing a state here evens the stacks.  */
   yyssp++;
 
- yysetstate:
-  *yyssp = yystate;
+
+/*--------------------------------------------------------------------.
+| yynewstate -- set current state (the top of the stack) to yystate.  |
+`--------------------------------------------------------------------*/
+yysetstate:
+  YYDPRINTF ((stderr, "Entering state %d\n", yystate));
+  YY_ASSERT (0 <= yystate && yystate < YYNSTATES);
+  *yyssp = (yytype_int16) yystate;
 
   if (yyss + yystacksize - 1 <= yyssp)
+#if !defined yyoverflow && !defined YYSTACK_RELOCATE
+    goto yyexhaustedlab;
+#else
     {
       /* Get the current used size of the three stacks, in elements.  */
-      YYSIZE_T yysize = yyssp - yyss + 1;
+      YYSIZE_T yysize = (YYSIZE_T) (yyssp - yyss + 1);
 
-#ifdef yyoverflow
+# if defined yyoverflow
       {
         /* Give user a chance to reallocate the stack.  Use copies of
            these so that the &'s don't force the real ones into
@@ -2457,14 +2524,10 @@ yyparse (void)
                     &yyss1, yysize * sizeof (*yyssp),
                     &yyvs1, yysize * sizeof (*yyvsp),
                     &yystacksize);
-
         yyss = yyss1;
         yyvs = yyvs1;
       }
-#else /* no yyoverflow */
-# ifndef YYSTACK_RELOCATE
-      goto yyexhaustedlab;
-# else
+# else /* defined YYSTACK_RELOCATE */
       /* Extend the stack our own way.  */
       if (YYMAXDEPTH <= yystacksize)
         goto yyexhaustedlab;
@@ -2480,35 +2543,33 @@ yyparse (void)
           goto yyexhaustedlab;
         YYSTACK_RELOCATE (yyss_alloc, yyss);
         YYSTACK_RELOCATE (yyvs_alloc, yyvs);
-#  undef YYSTACK_RELOCATE
+# undef YYSTACK_RELOCATE
         if (yyss1 != yyssa)
           YYSTACK_FREE (yyss1);
       }
 # endif
-#endif /* no yyoverflow */
 
       yyssp = yyss + yysize - 1;
       yyvsp = yyvs + yysize - 1;
 
       YYDPRINTF ((stderr, "Stack size increased to %lu\n",
-                  (unsigned long int) yystacksize));
+                  (unsigned long) yystacksize));
 
       if (yyss + yystacksize - 1 <= yyssp)
         YYABORT;
     }
-
-  YYDPRINTF ((stderr, "Entering state %d\n", yystate));
+#endif /* !defined yyoverflow && !defined YYSTACK_RELOCATE */
 
   if (yystate == YYFINAL)
     YYACCEPT;
 
   goto yybackup;
 
+
 /*-----------.
 | yybackup.  |
 `-----------*/
 yybackup:
-
   /* Do appropriate processing given the current state.  Read a
      lookahead token if we need one and don't already have one.  */
 
@@ -2566,7 +2627,6 @@ yybackup:
   YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
   *++yyvsp = yylval;
   YY_IGNORE_MAYBE_UNINITIALIZED_END
-
   goto yynewstate;
 
 
@@ -2581,7 +2641,7 @@ yydefault:
 
 
 /*-----------------------------.
-| yyreduce -- Do a reduction.  |
+| yyreduce -- do a reduction.  |
 `-----------------------------*/
 yyreduce:
   /* yyn is the number of a rule to reduce with.  */
@@ -2601,16 +2661,16 @@ yyreduce:
   YY_REDUCE_PRINT (yyn);
   switch (yyn)
     {
-        case 15:
-#line 183 "util/configparser.y" /* yacc.c:1646  */
+  case 16:
+#line 186 "util/configparser.y"
     { 
 		OUTYY(("\nP(server:)\n")); 
 	}
-#line 2610 "util/configparser.c" /* yacc.c:1646  */
+#line 2670 "util/configparser.c"
     break;
 
-  case 207:
-#line 274 "util/configparser.y" /* yacc.c:1646  */
+  case 210:
+#line 278 "util/configparser.y"
     {
 		struct config_stub* s;
 		OUTYY(("\nP(stub_zone:)\n")); 
@@ -2621,11 +2681,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2625 "util/configparser.c" /* yacc.c:1646  */
+#line 2685 "util/configparser.c"
     break;
 
-  case 217:
-#line 291 "util/configparser.y" /* yacc.c:1646  */
+  case 220:
+#line 295 "util/configparser.y"
     {
 		struct config_stub* s;
 		OUTYY(("\nP(forward_zone:)\n")); 
@@ -2636,11 +2696,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2640 "util/configparser.c" /* yacc.c:1646  */
+#line 2700 "util/configparser.c"
     break;
 
-  case 226:
-#line 308 "util/configparser.y" /* yacc.c:1646  */
+  case 229:
+#line 312 "util/configparser.y"
     {
 		struct config_view* s;
 		OUTYY(("\nP(view:)\n")); 
@@ -2653,11 +2713,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2657 "util/configparser.c" /* yacc.c:1646  */
+#line 2717 "util/configparser.c"
     break;
 
-  case 236:
-#line 327 "util/configparser.y" /* yacc.c:1646  */
+  case 239:
+#line 331 "util/configparser.y"
     {
 		struct config_auth* s;
 		OUTYY(("\nP(auth_zone:)\n")); 
@@ -2669,14 +2729,107 @@ yyreduce:
 			s->for_downstream = 1;
 			s->for_upstream = 1;
 			s->fallback_enabled = 0;
+			s->isrpz = 0;
+		} else 
+			yyerror("out of memory");
+	}
+#line 2737 "util/configparser.c"
+    break;
+
+  case 250:
+#line 355 "util/configparser.y"
+    {
+		uint8_t* bitlist;
+		size_t len = 0;
+		OUTYY(("P(server_local_zone_tag:%s)\n", (yyvsp[0].str)));
+		bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
+			&len);
+		free((yyvsp[0].str));
+		if(!bitlist) {
+			yyerror("could not parse tags, (define-tag them first)");
+		}
+		if(bitlist) {
+			cfg_parser->cfg->auths->rpz_taglist = bitlist;
+			cfg_parser->cfg->auths->rpz_taglistlen = len;
+
+		}
+	}
+#line 2758 "util/configparser.c"
+    break;
+
+  case 251:
+#line 374 "util/configparser.y"
+    {
+		OUTYY(("P(rpz_action_override:%s)\n", (yyvsp[0].str)));
+		if(strcmp((yyvsp[0].str), "nxdomain")!=0 && strcmp((yyvsp[0].str), "nodata")!=0 &&
+		   strcmp((yyvsp[0].str), "passthru")!=0 && strcmp((yyvsp[0].str), "drop")!=0 &&
+		   strcmp((yyvsp[0].str), "cname")!=0 && strcmp((yyvsp[0].str), "disabled")!=0) {
+			yyerror("rpz-action-override action: expected nxdomain, "
+				"nodata, passthru, drop, cname or disabled");
+			free((yyvsp[0].str));
+			cfg_parser->cfg->auths->rpz_action_override = NULL;
+		}
+		else {
+			cfg_parser->cfg->auths->rpz_action_override = (yyvsp[0].str);
+		}
+	}
+#line 2777 "util/configparser.c"
+    break;
+
+  case 252:
+#line 391 "util/configparser.y"
+    {
+		OUTYY(("P(rpz_cname_override:%s)\n", (yyvsp[0].str)));
+		free(cfg_parser->cfg->auths->rpz_cname);
+		cfg_parser->cfg->auths->rpz_cname = (yyvsp[0].str);
+	}
+#line 2787 "util/configparser.c"
+    break;
+
+  case 253:
+#line 399 "util/configparser.y"
+    {
+		OUTYY(("P(rpz_log:%s)\n", (yyvsp[0].str)));
+		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->auths->rpz_log = (strcmp((yyvsp[0].str), "yes")==0);
+		free((yyvsp[0].str));
+	}
+#line 2799 "util/configparser.c"
+    break;
+
+  case 254:
+#line 409 "util/configparser.y"
+    {
+		OUTYY(("P(rpz_log_name:%s)\n", (yyvsp[0].str)));
+		free(cfg_parser->cfg->auths->rpz_log_name);
+		cfg_parser->cfg->auths->rpz_log_name = (yyvsp[0].str);
+	}
+#line 2809 "util/configparser.c"
+    break;
+
+  case 255:
+#line 417 "util/configparser.y"
+    {
+		struct config_auth* s;
+		OUTYY(("\nP(rpz:)\n")); 
+		s = (struct config_auth*)calloc(1, sizeof(struct config_auth));
+		if(s) {
+			s->next = cfg_parser->cfg->auths;
+			cfg_parser->cfg->auths = s;
+			/* defaults for RPZ auth zone */
+			s->for_downstream = 0;
+			s->for_upstream = 0;
+			s->fallback_enabled = 0;
+			s->isrpz = 1;
 		} else 
 			yyerror("out of memory");
 	}
-#line 2676 "util/configparser.c" /* yacc.c:1646  */
+#line 2829 "util/configparser.c"
     break;
 
-  case 247:
-#line 349 "util/configparser.y" /* yacc.c:1646  */
+  case 268:
+#line 440 "util/configparser.y"
     { 
 		OUTYY(("P(server_num_threads:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2684,11 +2837,11 @@ yyreduce:
 		else cfg_parser->cfg->num_threads = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2688 "util/configparser.c" /* yacc.c:1646  */
+#line 2841 "util/configparser.c"
     break;
 
-  case 248:
-#line 358 "util/configparser.y" /* yacc.c:1646  */
+  case 269:
+#line 449 "util/configparser.y"
     { 
 		OUTYY(("P(server_verbosity:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2696,11 +2849,11 @@ yyreduce:
 		else cfg_parser->cfg->verbosity = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2700 "util/configparser.c" /* yacc.c:1646  */
+#line 2853 "util/configparser.c"
     break;
 
-  case 249:
-#line 367 "util/configparser.y" /* yacc.c:1646  */
+  case 270:
+#line 458 "util/configparser.y"
     { 
 		OUTYY(("P(server_statistics_interval:%s)\n", (yyvsp[0].str))); 
 		if(strcmp((yyvsp[0].str), "") == 0 || strcmp((yyvsp[0].str), "0") == 0)
@@ -2710,11 +2863,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_interval = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2714 "util/configparser.c" /* yacc.c:1646  */
+#line 2867 "util/configparser.c"
     break;
 
-  case 250:
-#line 378 "util/configparser.y" /* yacc.c:1646  */
+  case 271:
+#line 469 "util/configparser.y"
     {
 		OUTYY(("P(server_statistics_cumulative:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2722,11 +2875,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_cumulative = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2726 "util/configparser.c" /* yacc.c:1646  */
+#line 2879 "util/configparser.c"
     break;
 
-  case 251:
-#line 387 "util/configparser.y" /* yacc.c:1646  */
+  case 272:
+#line 478 "util/configparser.y"
     {
 		OUTYY(("P(server_extended_statistics:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2734,11 +2887,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_extended = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2738 "util/configparser.c" /* yacc.c:1646  */
+#line 2891 "util/configparser.c"
     break;
 
-  case 252:
-#line 396 "util/configparser.y" /* yacc.c:1646  */
+  case 273:
+#line 487 "util/configparser.y"
     {
 		OUTYY(("P(server_shm_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2746,11 +2899,11 @@ yyreduce:
 		else cfg_parser->cfg->shm_enable = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2750 "util/configparser.c" /* yacc.c:1646  */
+#line 2903 "util/configparser.c"
     break;
 
-  case 253:
-#line 405 "util/configparser.y" /* yacc.c:1646  */
+  case 274:
+#line 496 "util/configparser.y"
     { 
 		OUTYY(("P(server_shm_key:%s)\n", (yyvsp[0].str))); 
 		if(strcmp((yyvsp[0].str), "") == 0 || strcmp((yyvsp[0].str), "0") == 0)
@@ -2760,11 +2913,11 @@ yyreduce:
 		else cfg_parser->cfg->shm_key = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2764 "util/configparser.c" /* yacc.c:1646  */
+#line 2917 "util/configparser.c"
     break;
 
-  case 254:
-#line 416 "util/configparser.y" /* yacc.c:1646  */
+  case 275:
+#line 507 "util/configparser.y"
     {
 		OUTYY(("P(server_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2772,11 +2925,11 @@ yyreduce:
 		else cfg_parser->cfg->port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2776 "util/configparser.c" /* yacc.c:1646  */
+#line 2929 "util/configparser.c"
     break;
 
-  case 255:
-#line 425 "util/configparser.y" /* yacc.c:1646  */
+  case 276:
+#line 516 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(server_send_client_subnet:%s)\n", (yyvsp[0].str)));
@@ -2784,13 +2937,14 @@ yyreduce:
 			fatal_exit("out of memory adding client-subnet");
 	#else
 		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+		free((yyvsp[0].str));
 	#endif
 	}
-#line 2790 "util/configparser.c" /* yacc.c:1646  */
+#line 2944 "util/configparser.c"
     break;
 
-  case 256:
-#line 436 "util/configparser.y" /* yacc.c:1646  */
+  case 277:
+#line 528 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(server_client_subnet_zone:%s)\n", (yyvsp[0].str)));
@@ -2799,13 +2953,14 @@ yyreduce:
 			fatal_exit("out of memory adding client-subnet-zone");
 	#else
 		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+		free((yyvsp[0].str));
 	#endif
 	}
-#line 2805 "util/configparser.c" /* yacc.c:1646  */
+#line 2960 "util/configparser.c"
     break;
 
-  case 257:
-#line 449 "util/configparser.y" /* yacc.c:1646  */
+  case 278:
+#line 542 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(server_client_subnet_always_forward:%s)\n", (yyvsp[0].str)));
@@ -2819,11 +2974,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2823 "util/configparser.c" /* yacc.c:1646  */
+#line 2978 "util/configparser.c"
     break;
 
-  case 258:
-#line 464 "util/configparser.y" /* yacc.c:1646  */
+  case 279:
+#line 557 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(client_subnet_opcode:%s)\n", (yyvsp[0].str)));
@@ -2833,11 +2988,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2837 "util/configparser.c" /* yacc.c:1646  */
+#line 2992 "util/configparser.c"
     break;
 
-  case 259:
-#line 475 "util/configparser.y" /* yacc.c:1646  */
+  case 280:
+#line 568 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_client_subnet_ipv4:%s)\n", (yyvsp[0].str)));
@@ -2853,11 +3008,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2857 "util/configparser.c" /* yacc.c:1646  */
+#line 3012 "util/configparser.c"
     break;
 
-  case 260:
-#line 492 "util/configparser.y" /* yacc.c:1646  */
+  case 281:
+#line 585 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_client_subnet_ipv6:%s)\n", (yyvsp[0].str)));
@@ -2873,11 +3028,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2877 "util/configparser.c" /* yacc.c:1646  */
+#line 3032 "util/configparser.c"
     break;
 
-  case 261:
-#line 509 "util/configparser.y" /* yacc.c:1646  */
+  case 282:
+#line 602 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(min_client_subnet_ipv4:%s)\n", (yyvsp[0].str)));
@@ -2893,11 +3048,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2897 "util/configparser.c" /* yacc.c:1646  */
+#line 3052 "util/configparser.c"
     break;
 
-  case 262:
-#line 526 "util/configparser.y" /* yacc.c:1646  */
+  case 283:
+#line 619 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(min_client_subnet_ipv6:%s)\n", (yyvsp[0].str)));
@@ -2913,11 +3068,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2917 "util/configparser.c" /* yacc.c:1646  */
+#line 3072 "util/configparser.c"
     break;
 
-  case 263:
-#line 543 "util/configparser.y" /* yacc.c:1646  */
+  case 284:
+#line 636 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_ecs_tree_size_ipv4:%s)\n", (yyvsp[0].str)));
@@ -2931,11 +3086,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2935 "util/configparser.c" /* yacc.c:1646  */
+#line 3090 "util/configparser.c"
     break;
 
-  case 264:
-#line 558 "util/configparser.y" /* yacc.c:1646  */
+  case 285:
+#line 651 "util/configparser.y"
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_ecs_tree_size_ipv6:%s)\n", (yyvsp[0].str)));
@@ -2949,11 +3104,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2953 "util/configparser.c" /* yacc.c:1646  */
+#line 3108 "util/configparser.c"
     break;
 
-  case 265:
-#line 573 "util/configparser.y" /* yacc.c:1646  */
+  case 286:
+#line 666 "util/configparser.y"
     {
 		OUTYY(("P(server_interface:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->num_ifs == 0)
@@ -2965,11 +3120,11 @@ yyreduce:
 		else
 			cfg_parser->cfg->ifs[cfg_parser->cfg->num_ifs++] = (yyvsp[0].str);
 	}
-#line 2969 "util/configparser.c" /* yacc.c:1646  */
+#line 3124 "util/configparser.c"
     break;
 
-  case 266:
-#line 586 "util/configparser.y" /* yacc.c:1646  */
+  case 287:
+#line 679 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_interface:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->num_out_ifs == 0)
@@ -2983,11 +3138,11 @@ yyreduce:
 			cfg_parser->cfg->out_ifs[
 				cfg_parser->cfg->num_out_ifs++] = (yyvsp[0].str);
 	}
-#line 2987 "util/configparser.c" /* yacc.c:1646  */
+#line 3142 "util/configparser.c"
     break;
 
-  case 267:
-#line 601 "util/configparser.y" /* yacc.c:1646  */
+  case 288:
+#line 694 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_range:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2995,11 +3150,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_num_ports = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2999 "util/configparser.c" /* yacc.c:1646  */
+#line 3154 "util/configparser.c"
     break;
 
-  case 268:
-#line 610 "util/configparser.y" /* yacc.c:1646  */
+  case 289:
+#line 703 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_port_permit:%s)\n", (yyvsp[0].str)));
 		if(!cfg_mark_ports((yyvsp[0].str), 1, 
@@ -3007,11 +3162,11 @@ yyreduce:
 			yyerror("port number or range (\"low-high\") expected");
 		free((yyvsp[0].str));
 	}
-#line 3011 "util/configparser.c" /* yacc.c:1646  */
+#line 3166 "util/configparser.c"
     break;
 
-  case 269:
-#line 619 "util/configparser.y" /* yacc.c:1646  */
+  case 290:
+#line 712 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_port_avoid:%s)\n", (yyvsp[0].str)));
 		if(!cfg_mark_ports((yyvsp[0].str), 0, 
@@ -3019,11 +3174,11 @@ yyreduce:
 			yyerror("port number or range (\"low-high\") expected");
 		free((yyvsp[0].str));
 	}
-#line 3023 "util/configparser.c" /* yacc.c:1646  */
+#line 3178 "util/configparser.c"
     break;
 
-  case 270:
-#line 628 "util/configparser.y" /* yacc.c:1646  */
+  case 291:
+#line 721 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_num_tcp:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3031,11 +3186,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_num_tcp = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3035 "util/configparser.c" /* yacc.c:1646  */
+#line 3190 "util/configparser.c"
     break;
 
-  case 271:
-#line 637 "util/configparser.y" /* yacc.c:1646  */
+  case 292:
+#line 730 "util/configparser.y"
     {
 		OUTYY(("P(server_incoming_num_tcp:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3043,11 +3198,11 @@ yyreduce:
 		else cfg_parser->cfg->incoming_num_tcp = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3047 "util/configparser.c" /* yacc.c:1646  */
+#line 3202 "util/configparser.c"
     break;
 
-  case 272:
-#line 646 "util/configparser.y" /* yacc.c:1646  */
+  case 293:
+#line 739 "util/configparser.y"
     {
 		OUTYY(("P(server_interface_automatic:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3055,11 +3210,11 @@ yyreduce:
 		else cfg_parser->cfg->if_automatic = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3059 "util/configparser.c" /* yacc.c:1646  */
+#line 3214 "util/configparser.c"
     break;
 
-  case 273:
-#line 655 "util/configparser.y" /* yacc.c:1646  */
+  case 294:
+#line 748 "util/configparser.y"
     {
 		OUTYY(("P(server_do_ip4:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3067,11 +3222,11 @@ yyreduce:
 		else cfg_parser->cfg->do_ip4 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3071 "util/configparser.c" /* yacc.c:1646  */
+#line 3226 "util/configparser.c"
     break;
 
-  case 274:
-#line 664 "util/configparser.y" /* yacc.c:1646  */
+  case 295:
+#line 757 "util/configparser.y"
     {
 		OUTYY(("P(server_do_ip6:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3079,11 +3234,11 @@ yyreduce:
 		else cfg_parser->cfg->do_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3083 "util/configparser.c" /* yacc.c:1646  */
+#line 3238 "util/configparser.c"
     break;
 
-  case 275:
-#line 673 "util/configparser.y" /* yacc.c:1646  */
+  case 296:
+#line 766 "util/configparser.y"
     {
 		OUTYY(("P(server_do_udp:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3091,11 +3246,11 @@ yyreduce:
 		else cfg_parser->cfg->do_udp = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3095 "util/configparser.c" /* yacc.c:1646  */
+#line 3250 "util/configparser.c"
     break;
 
-  case 276:
-#line 682 "util/configparser.y" /* yacc.c:1646  */
+  case 297:
+#line 775 "util/configparser.y"
     {
 		OUTYY(("P(server_do_tcp:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3103,11 +3258,11 @@ yyreduce:
 		else cfg_parser->cfg->do_tcp = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3107 "util/configparser.c" /* yacc.c:1646  */
+#line 3262 "util/configparser.c"
     break;
 
-  case 277:
-#line 691 "util/configparser.y" /* yacc.c:1646  */
+  case 298:
+#line 784 "util/configparser.y"
     {
 		OUTYY(("P(server_prefer_ip6:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3115,11 +3270,11 @@ yyreduce:
 		else cfg_parser->cfg->prefer_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3119 "util/configparser.c" /* yacc.c:1646  */
+#line 3274 "util/configparser.c"
     break;
 
-  case 278:
-#line 700 "util/configparser.y" /* yacc.c:1646  */
+  case 299:
+#line 793 "util/configparser.y"
     {
 		OUTYY(("P(server_tcp_mss:%s)\n", (yyvsp[0].str)));
                 if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3127,11 +3282,11 @@ yyreduce:
                 else cfg_parser->cfg->tcp_mss = atoi((yyvsp[0].str));
                 free((yyvsp[0].str));
 	}
-#line 3131 "util/configparser.c" /* yacc.c:1646  */
+#line 3286 "util/configparser.c"
     break;
 
-  case 279:
-#line 709 "util/configparser.y" /* yacc.c:1646  */
+  case 300:
+#line 802 "util/configparser.y"
     {
 		OUTYY(("P(server_outgoing_tcp_mss:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3139,11 +3294,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_tcp_mss = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3143 "util/configparser.c" /* yacc.c:1646  */
+#line 3298 "util/configparser.c"
     break;
 
-  case 280:
-#line 718 "util/configparser.y" /* yacc.c:1646  */
+  case 301:
+#line 811 "util/configparser.y"
     {
 		OUTYY(("P(server_tcp_idle_timeout:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3155,11 +3310,11 @@ yyreduce:
 		else cfg_parser->cfg->tcp_idle_timeout = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3159 "util/configparser.c" /* yacc.c:1646  */
+#line 3314 "util/configparser.c"
     break;
 
-  case 281:
-#line 731 "util/configparser.y" /* yacc.c:1646  */
+  case 302:
+#line 824 "util/configparser.y"
     {
 		OUTYY(("P(server_tcp_keepalive:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3167,11 +3322,11 @@ yyreduce:
 		else cfg_parser->cfg->do_tcp_keepalive = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3171 "util/configparser.c" /* yacc.c:1646  */
+#line 3326 "util/configparser.c"
     break;
 
-  case 282:
-#line 740 "util/configparser.y" /* yacc.c:1646  */
+  case 303:
+#line 833 "util/configparser.y"
     {
 		OUTYY(("P(server_tcp_keepalive_timeout:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3183,11 +3338,11 @@ yyreduce:
 		else cfg_parser->cfg->tcp_keepalive_timeout = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3187 "util/configparser.c" /* yacc.c:1646  */
+#line 3342 "util/configparser.c"
     break;
 
-  case 283:
-#line 753 "util/configparser.y" /* yacc.c:1646  */
+  case 304:
+#line 846 "util/configparser.y"
     {
 		OUTYY(("P(server_tcp_upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3195,11 +3350,11 @@ yyreduce:
 		else cfg_parser->cfg->tcp_upstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3199 "util/configparser.c" /* yacc.c:1646  */
+#line 3354 "util/configparser.c"
     break;
 
-  case 284:
-#line 762 "util/configparser.y" /* yacc.c:1646  */
+  case 305:
+#line 855 "util/configparser.y"
     {
 		OUTYY(("P(server_udp_upstream_without_downstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3207,11 +3362,11 @@ yyreduce:
 		else cfg_parser->cfg->udp_upstream_without_downstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3211 "util/configparser.c" /* yacc.c:1646  */
+#line 3366 "util/configparser.c"
     break;
 
-  case 285:
-#line 771 "util/configparser.y" /* yacc.c:1646  */
+  case 306:
+#line 864 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3219,31 +3374,31 @@ yyreduce:
 		else cfg_parser->cfg->ssl_upstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3223 "util/configparser.c" /* yacc.c:1646  */
+#line 3378 "util/configparser.c"
     break;
 
-  case 286:
-#line 780 "util/configparser.y" /* yacc.c:1646  */
+  case 307:
+#line 873 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_service_key:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->ssl_service_key);
 		cfg_parser->cfg->ssl_service_key = (yyvsp[0].str);
 	}
-#line 3233 "util/configparser.c" /* yacc.c:1646  */
+#line 3388 "util/configparser.c"
     break;
 
-  case 287:
-#line 787 "util/configparser.y" /* yacc.c:1646  */
+  case 308:
+#line 880 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_service_pem:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->ssl_service_pem);
 		cfg_parser->cfg->ssl_service_pem = (yyvsp[0].str);
 	}
-#line 3243 "util/configparser.c" /* yacc.c:1646  */
+#line 3398 "util/configparser.c"
     break;
 
-  case 288:
-#line 794 "util/configparser.y" /* yacc.c:1646  */
+  case 309:
+#line 887 "util/configparser.y"
     {
 		OUTYY(("P(server_ssl_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3251,21 +3406,21 @@ yyreduce:
 		else cfg_parser->cfg->ssl_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3255 "util/configparser.c" /* yacc.c:1646  */
+#line 3410 "util/configparser.c"
     break;
 
-  case 289:
-#line 803 "util/configparser.y" /* yacc.c:1646  */
+  case 310:
+#line 896 "util/configparser.y"
     {
 		OUTYY(("P(server_tls_cert_bundle:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->tls_cert_bundle);
 		cfg_parser->cfg->tls_cert_bundle = (yyvsp[0].str);
 	}
-#line 3265 "util/configparser.c" /* yacc.c:1646  */
+#line 3420 "util/configparser.c"
     break;
 
-  case 290:
-#line 810 "util/configparser.y" /* yacc.c:1646  */
+  case 311:
+#line 903 "util/configparser.y"
     {
 		OUTYY(("P(server_tls_win_cert:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3273,53 +3428,53 @@ yyreduce:
 		else cfg_parser->cfg->tls_win_cert = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3277 "util/configparser.c" /* yacc.c:1646  */
+#line 3432 "util/configparser.c"
     break;
 
-  case 291:
-#line 819 "util/configparser.y" /* yacc.c:1646  */
+  case 312:
+#line 912 "util/configparser.y"
     {
 		OUTYY(("P(server_tls_additional_port:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->tls_additional_port,
 			(yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3288 "util/configparser.c" /* yacc.c:1646  */
+#line 3443 "util/configparser.c"
     break;
 
-  case 292:
-#line 827 "util/configparser.y" /* yacc.c:1646  */
+  case 313:
+#line 920 "util/configparser.y"
     {
 		OUTYY(("P(server_tls_ciphers:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->tls_ciphers);
 		cfg_parser->cfg->tls_ciphers = (yyvsp[0].str);
 	}
-#line 3298 "util/configparser.c" /* yacc.c:1646  */
+#line 3453 "util/configparser.c"
     break;
 
-  case 293:
-#line 834 "util/configparser.y" /* yacc.c:1646  */
+  case 314:
+#line 927 "util/configparser.y"
     {
 		OUTYY(("P(server_tls_ciphersuites:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->tls_ciphersuites);
 		cfg_parser->cfg->tls_ciphersuites = (yyvsp[0].str);
 	}
-#line 3308 "util/configparser.c" /* yacc.c:1646  */
+#line 3463 "util/configparser.c"
     break;
 
-  case 294:
-#line 841 "util/configparser.y" /* yacc.c:1646  */
+  case 315:
+#line 934 "util/configparser.y"
     {
 		OUTYY(("P(server_tls_session_ticket_keys:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append(&cfg_parser->cfg->tls_session_ticket_keys,
 			(yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3319 "util/configparser.c" /* yacc.c:1646  */
+#line 3474 "util/configparser.c"
     break;
 
-  case 295:
-#line 849 "util/configparser.y" /* yacc.c:1646  */
+  case 316:
+#line 942 "util/configparser.y"
     {
 		OUTYY(("P(server_use_systemd:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3327,11 +3482,11 @@ yyreduce:
 		else cfg_parser->cfg->use_systemd = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3331 "util/configparser.c" /* yacc.c:1646  */
+#line 3486 "util/configparser.c"
     break;
 
-  case 296:
-#line 858 "util/configparser.y" /* yacc.c:1646  */
+  case 317:
+#line 951 "util/configparser.y"
     {
 		OUTYY(("P(server_do_daemonize:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3339,11 +3494,11 @@ yyreduce:
 		else cfg_parser->cfg->do_daemonize = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3343 "util/configparser.c" /* yacc.c:1646  */
+#line 3498 "util/configparser.c"
     break;
 
-  case 297:
-#line 867 "util/configparser.y" /* yacc.c:1646  */
+  case 318:
+#line 960 "util/configparser.y"
     {
 		OUTYY(("P(server_use_syslog:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3356,11 +3511,11 @@ yyreduce:
 #endif
 		free((yyvsp[0].str));
 	}
-#line 3360 "util/configparser.c" /* yacc.c:1646  */
+#line 3515 "util/configparser.c"
     break;
 
-  case 298:
-#line 881 "util/configparser.y" /* yacc.c:1646  */
+  case 319:
+#line 974 "util/configparser.y"
     {
 		OUTYY(("P(server_log_time_ascii:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3368,11 +3523,11 @@ yyreduce:
 		else cfg_parser->cfg->log_time_ascii = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3372 "util/configparser.c" /* yacc.c:1646  */
+#line 3527 "util/configparser.c"
     break;
 
-  case 299:
-#line 890 "util/configparser.y" /* yacc.c:1646  */
+  case 320:
+#line 983 "util/configparser.y"
     {
 		OUTYY(("P(server_log_queries:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3380,11 +3535,11 @@ yyreduce:
 		else cfg_parser->cfg->log_queries = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3384 "util/configparser.c" /* yacc.c:1646  */
+#line 3539 "util/configparser.c"
     break;
 
-  case 300:
-#line 899 "util/configparser.y" /* yacc.c:1646  */
+  case 321:
+#line 992 "util/configparser.y"
     {
   	OUTYY(("P(server_log_replies:%s)\n", (yyvsp[0].str)));
   	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3392,11 +3547,11 @@ yyreduce:
   	else cfg_parser->cfg->log_replies = (strcmp((yyvsp[0].str), "yes")==0);
   	free((yyvsp[0].str));
   }
-#line 3396 "util/configparser.c" /* yacc.c:1646  */
+#line 3551 "util/configparser.c"
     break;
 
-  case 301:
-#line 908 "util/configparser.y" /* yacc.c:1646  */
+  case 322:
+#line 1001 "util/configparser.y"
     {
   	OUTYY(("P(server_log_tag_queryreply:%s)\n", (yyvsp[0].str)));
   	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3404,11 +3559,11 @@ yyreduce:
   	else cfg_parser->cfg->log_tag_queryreply = (strcmp((yyvsp[0].str), "yes")==0);
   	free((yyvsp[0].str));
   }
-#line 3408 "util/configparser.c" /* yacc.c:1646  */
+#line 3563 "util/configparser.c"
     break;
 
-  case 302:
-#line 917 "util/configparser.y" /* yacc.c:1646  */
+  case 323:
+#line 1010 "util/configparser.y"
     {
 		OUTYY(("P(server_log_servfail:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3416,11 +3571,11 @@ yyreduce:
 		else cfg_parser->cfg->log_servfail = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3420 "util/configparser.c" /* yacc.c:1646  */
+#line 3575 "util/configparser.c"
     break;
 
-  case 303:
-#line 926 "util/configparser.y" /* yacc.c:1646  */
+  case 324:
+#line 1019 "util/configparser.y"
     {
   	OUTYY(("P(server_log_local_actions:%s)\n", (yyvsp[0].str)));
   	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3428,31 +3583,31 @@ yyreduce:
   	else cfg_parser->cfg->log_local_actions = (strcmp((yyvsp[0].str), "yes")==0);
   	free((yyvsp[0].str));
   }
-#line 3432 "util/configparser.c" /* yacc.c:1646  */
+#line 3587 "util/configparser.c"
     break;
 
-  case 304:
-#line 935 "util/configparser.y" /* yacc.c:1646  */
+  case 325:
+#line 1028 "util/configparser.y"
     {
 		OUTYY(("P(server_chroot:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->chrootdir);
 		cfg_parser->cfg->chrootdir = (yyvsp[0].str);
 	}
-#line 3442 "util/configparser.c" /* yacc.c:1646  */
+#line 3597 "util/configparser.c"
     break;
 
-  case 305:
-#line 942 "util/configparser.y" /* yacc.c:1646  */
+  case 326:
+#line 1035 "util/configparser.y"
     {
 		OUTYY(("P(server_username:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->username);
 		cfg_parser->cfg->username = (yyvsp[0].str);
 	}
-#line 3452 "util/configparser.c" /* yacc.c:1646  */
+#line 3607 "util/configparser.c"
     break;
 
-  case 306:
-#line 949 "util/configparser.y" /* yacc.c:1646  */
+  case 327:
+#line 1042 "util/configparser.y"
     {
 		OUTYY(("P(server_directory:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->directory);
@@ -3477,105 +3632,105 @@ yyreduce:
 			}
 		}
 	}
-#line 3481 "util/configparser.c" /* yacc.c:1646  */
+#line 3636 "util/configparser.c"
     break;
 
-  case 307:
-#line 975 "util/configparser.y" /* yacc.c:1646  */
+  case 328:
+#line 1068 "util/configparser.y"
     {
 		OUTYY(("P(server_logfile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->logfile);
 		cfg_parser->cfg->logfile = (yyvsp[0].str);
 		cfg_parser->cfg->use_syslog = 0;
 	}
-#line 3492 "util/configparser.c" /* yacc.c:1646  */
+#line 3647 "util/configparser.c"
     break;
 
-  case 308:
-#line 983 "util/configparser.y" /* yacc.c:1646  */
+  case 329:
+#line 1076 "util/configparser.y"
     {
 		OUTYY(("P(server_pidfile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->pidfile);
 		cfg_parser->cfg->pidfile = (yyvsp[0].str);
 	}
-#line 3502 "util/configparser.c" /* yacc.c:1646  */
+#line 3657 "util/configparser.c"
     break;
 
-  case 309:
-#line 990 "util/configparser.y" /* yacc.c:1646  */
+  case 330:
+#line 1083 "util/configparser.y"
     {
 		OUTYY(("P(server_root_hints:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->root_hints, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3512 "util/configparser.c" /* yacc.c:1646  */
+#line 3667 "util/configparser.c"
     break;
 
-  case 310:
-#line 997 "util/configparser.y" /* yacc.c:1646  */
+  case 331:
+#line 1090 "util/configparser.y"
     {
 		OUTYY(("P(server_dlv_anchor_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dlv_anchor_file);
 		cfg_parser->cfg->dlv_anchor_file = (yyvsp[0].str);
 	}
-#line 3522 "util/configparser.c" /* yacc.c:1646  */
+#line 3677 "util/configparser.c"
     break;
 
-  case 311:
-#line 1004 "util/configparser.y" /* yacc.c:1646  */
+  case 332:
+#line 1097 "util/configparser.y"
     {
 		OUTYY(("P(server_dlv_anchor:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3532 "util/configparser.c" /* yacc.c:1646  */
+#line 3687 "util/configparser.c"
     break;
 
-  case 312:
-#line 1011 "util/configparser.y" /* yacc.c:1646  */
+  case 333:
+#line 1104 "util/configparser.y"
     {
 		OUTYY(("P(server_auto_trust_anchor_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			auto_trust_anchor_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3543 "util/configparser.c" /* yacc.c:1646  */
+#line 3698 "util/configparser.c"
     break;
 
-  case 313:
-#line 1019 "util/configparser.y" /* yacc.c:1646  */
+  case 334:
+#line 1112 "util/configparser.y"
     {
 		OUTYY(("P(server_trust_anchor_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			trust_anchor_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3554 "util/configparser.c" /* yacc.c:1646  */
+#line 3709 "util/configparser.c"
     break;
 
-  case 314:
-#line 1027 "util/configparser.y" /* yacc.c:1646  */
+  case 335:
+#line 1120 "util/configparser.y"
     {
 		OUTYY(("P(server_trusted_keys_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			trusted_keys_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3565 "util/configparser.c" /* yacc.c:1646  */
+#line 3720 "util/configparser.c"
     break;
 
-  case 315:
-#line 1035 "util/configparser.y" /* yacc.c:1646  */
+  case 336:
+#line 1128 "util/configparser.y"
     {
 		OUTYY(("P(server_trust_anchor:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->trust_anchor_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3575 "util/configparser.c" /* yacc.c:1646  */
+#line 3730 "util/configparser.c"
     break;
 
-  case 316:
-#line 1042 "util/configparser.y" /* yacc.c:1646  */
+  case 337:
+#line 1135 "util/configparser.y"
     {
 		OUTYY(("P(server_trust_anchor_signaling:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3585,11 +3740,11 @@ yyreduce:
 				(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3589 "util/configparser.c" /* yacc.c:1646  */
+#line 3744 "util/configparser.c"
     break;
 
-  case 317:
-#line 1053 "util/configparser.y" /* yacc.c:1646  */
+  case 338:
+#line 1146 "util/configparser.y"
     {
 		OUTYY(("P(server_root_key_sentinel:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3599,21 +3754,21 @@ yyreduce:
 				(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3603 "util/configparser.c" /* yacc.c:1646  */
+#line 3758 "util/configparser.c"
     break;
 
-  case 318:
-#line 1064 "util/configparser.y" /* yacc.c:1646  */
+  case 339:
+#line 1157 "util/configparser.y"
     {
 		OUTYY(("P(server_domain_insecure:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->domain_insecure, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3613 "util/configparser.c" /* yacc.c:1646  */
+#line 3768 "util/configparser.c"
     break;
 
-  case 319:
-#line 1071 "util/configparser.y" /* yacc.c:1646  */
+  case 340:
+#line 1164 "util/configparser.y"
     {
 		OUTYY(("P(server_hide_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3621,11 +3776,11 @@ yyreduce:
 		else cfg_parser->cfg->hide_identity = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3625 "util/configparser.c" /* yacc.c:1646  */
+#line 3780 "util/configparser.c"
     break;
 
-  case 320:
-#line 1080 "util/configparser.y" /* yacc.c:1646  */
+  case 341:
+#line 1173 "util/configparser.y"
     {
 		OUTYY(("P(server_hide_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3633,11 +3788,11 @@ yyreduce:
 		else cfg_parser->cfg->hide_version = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3637 "util/configparser.c" /* yacc.c:1646  */
+#line 3792 "util/configparser.c"
     break;
 
-  case 321:
-#line 1089 "util/configparser.y" /* yacc.c:1646  */
+  case 342:
+#line 1182 "util/configparser.y"
     {
 		OUTYY(("P(server_hide_trustanchor:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3645,53 +3800,53 @@ yyreduce:
 		else cfg_parser->cfg->hide_trustanchor = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3649 "util/configparser.c" /* yacc.c:1646  */
+#line 3804 "util/configparser.c"
     break;
 
-  case 322:
-#line 1098 "util/configparser.y" /* yacc.c:1646  */
+  case 343:
+#line 1191 "util/configparser.y"
     {
 		OUTYY(("P(server_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->identity);
 		cfg_parser->cfg->identity = (yyvsp[0].str);
 	}
-#line 3659 "util/configparser.c" /* yacc.c:1646  */
+#line 3814 "util/configparser.c"
     break;
 
-  case 323:
-#line 1105 "util/configparser.y" /* yacc.c:1646  */
+  case 344:
+#line 1198 "util/configparser.y"
     {
 		OUTYY(("P(server_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->version);
 		cfg_parser->cfg->version = (yyvsp[0].str);
 	}
-#line 3669 "util/configparser.c" /* yacc.c:1646  */
+#line 3824 "util/configparser.c"
     break;
 
-  case 324:
-#line 1112 "util/configparser.y" /* yacc.c:1646  */
+  case 345:
+#line 1205 "util/configparser.y"
     {
 		OUTYY(("P(server_so_rcvbuf:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_rcvbuf))
 			yyerror("buffer size expected");
 		free((yyvsp[0].str));
 	}
-#line 3680 "util/configparser.c" /* yacc.c:1646  */
+#line 3835 "util/configparser.c"
     break;
 
-  case 325:
-#line 1120 "util/configparser.y" /* yacc.c:1646  */
+  case 346:
+#line 1213 "util/configparser.y"
     {
 		OUTYY(("P(server_so_sndbuf:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_sndbuf))
 			yyerror("buffer size expected");
 		free((yyvsp[0].str));
 	}
-#line 3691 "util/configparser.c" /* yacc.c:1646  */
+#line 3846 "util/configparser.c"
     break;
 
-  case 326:
-#line 1128 "util/configparser.y" /* yacc.c:1646  */
+  case 347:
+#line 1221 "util/configparser.y"
     {
         OUTYY(("P(server_so_reuseport:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3700,11 +3855,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 3704 "util/configparser.c" /* yacc.c:1646  */
+#line 3859 "util/configparser.c"
     break;
 
-  case 327:
-#line 1138 "util/configparser.y" /* yacc.c:1646  */
+  case 348:
+#line 1231 "util/configparser.y"
     {
         OUTYY(("P(server_ip_transparent:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3713,11 +3868,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 3717 "util/configparser.c" /* yacc.c:1646  */
+#line 3872 "util/configparser.c"
     break;
 
-  case 328:
-#line 1148 "util/configparser.y" /* yacc.c:1646  */
+  case 349:
+#line 1241 "util/configparser.y"
     {
         OUTYY(("P(server_ip_freebind:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3726,22 +3881,22 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 3730 "util/configparser.c" /* yacc.c:1646  */
+#line 3885 "util/configparser.c"
     break;
 
-  case 329:
-#line 1158 "util/configparser.y" /* yacc.c:1646  */
+  case 350:
+#line 1251 "util/configparser.y"
     {
 		OUTYY(("P(server_stream_wait_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->stream_wait_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3741 "util/configparser.c" /* yacc.c:1646  */
+#line 3896 "util/configparser.c"
     break;
 
-  case 330:
-#line 1166 "util/configparser.y" /* yacc.c:1646  */
+  case 351:
+#line 1259 "util/configparser.y"
     {
 		OUTYY(("P(server_edns_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3753,11 +3908,11 @@ yyreduce:
 		else cfg_parser->cfg->edns_buffer_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3757 "util/configparser.c" /* yacc.c:1646  */
+#line 3912 "util/configparser.c"
     break;
 
-  case 331:
-#line 1179 "util/configparser.y" /* yacc.c:1646  */
+  case 352:
+#line 1272 "util/configparser.y"
     {
 		OUTYY(("P(server_msg_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3767,22 +3922,22 @@ yyreduce:
 		else cfg_parser->cfg->msg_buffer_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3771 "util/configparser.c" /* yacc.c:1646  */
+#line 3926 "util/configparser.c"
     break;
 
-  case 332:
-#line 1190 "util/configparser.y" /* yacc.c:1646  */
+  case 353:
+#line 1283 "util/configparser.y"
     {
 		OUTYY(("P(server_msg_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->msg_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3782 "util/configparser.c" /* yacc.c:1646  */
+#line 3937 "util/configparser.c"
     break;
 
-  case 333:
-#line 1198 "util/configparser.y" /* yacc.c:1646  */
+  case 354:
+#line 1291 "util/configparser.y"
     {
 		OUTYY(("P(server_msg_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3794,11 +3949,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3798 "util/configparser.c" /* yacc.c:1646  */
+#line 3953 "util/configparser.c"
     break;
 
-  case 334:
-#line 1211 "util/configparser.y" /* yacc.c:1646  */
+  case 355:
+#line 1304 "util/configparser.y"
     {
 		OUTYY(("P(server_num_queries_per_thread:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3806,11 +3961,11 @@ yyreduce:
 		else cfg_parser->cfg->num_queries_per_thread = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3810 "util/configparser.c" /* yacc.c:1646  */
+#line 3965 "util/configparser.c"
     break;
 
-  case 335:
-#line 1220 "util/configparser.y" /* yacc.c:1646  */
+  case 356:
+#line 1313 "util/configparser.y"
     {
 		OUTYY(("P(server_jostle_timeout:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3818,11 +3973,11 @@ yyreduce:
 		else cfg_parser->cfg->jostle_time = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3822 "util/configparser.c" /* yacc.c:1646  */
+#line 3977 "util/configparser.c"
     break;
 
-  case 336:
-#line 1229 "util/configparser.y" /* yacc.c:1646  */
+  case 357:
+#line 1322 "util/configparser.y"
     {
 		OUTYY(("P(server_delay_close:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3830,11 +3985,11 @@ yyreduce:
 		else cfg_parser->cfg->delay_close = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3834 "util/configparser.c" /* yacc.c:1646  */
+#line 3989 "util/configparser.c"
     break;
 
-  case 337:
-#line 1238 "util/configparser.y" /* yacc.c:1646  */
+  case 358:
+#line 1331 "util/configparser.y"
     {
 		OUTYY(("P(server_unblock_lan_zones:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3843,11 +3998,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3847 "util/configparser.c" /* yacc.c:1646  */
+#line 4002 "util/configparser.c"
     break;
 
-  case 338:
-#line 1248 "util/configparser.y" /* yacc.c:1646  */
+  case 359:
+#line 1341 "util/configparser.y"
     {
 		OUTYY(("P(server_insecure_lan_zones:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3856,22 +4011,22 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3860 "util/configparser.c" /* yacc.c:1646  */
+#line 4015 "util/configparser.c"
     break;
 
-  case 339:
-#line 1258 "util/configparser.y" /* yacc.c:1646  */
+  case 360:
+#line 1351 "util/configparser.y"
     {
 		OUTYY(("P(server_rrset_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->rrset_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3871 "util/configparser.c" /* yacc.c:1646  */
+#line 4026 "util/configparser.c"
     break;
 
-  case 340:
-#line 1266 "util/configparser.y" /* yacc.c:1646  */
+  case 361:
+#line 1359 "util/configparser.y"
     {
 		OUTYY(("P(server_rrset_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3883,11 +4038,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3887 "util/configparser.c" /* yacc.c:1646  */
+#line 4042 "util/configparser.c"
     break;
 
-  case 341:
-#line 1279 "util/configparser.y" /* yacc.c:1646  */
+  case 362:
+#line 1372 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_host_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3895,22 +4050,22 @@ yyreduce:
 		else cfg_parser->cfg->host_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3899 "util/configparser.c" /* yacc.c:1646  */
+#line 4054 "util/configparser.c"
     break;
 
-  case 342:
-#line 1288 "util/configparser.y" /* yacc.c:1646  */
+  case 363:
+#line 1381 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_lame_ttl:%s)\n", (yyvsp[0].str)));
 		verbose(VERB_DETAIL, "ignored infra-lame-ttl: %s (option "
 			"removed, use infra-host-ttl)", (yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3910 "util/configparser.c" /* yacc.c:1646  */
+#line 4065 "util/configparser.c"
     break;
 
-  case 343:
-#line 1296 "util/configparser.y" /* yacc.c:1646  */
+  case 364:
+#line 1389 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_numhosts:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3918,22 +4073,22 @@ yyreduce:
 		else cfg_parser->cfg->infra_cache_numhosts = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3922 "util/configparser.c" /* yacc.c:1646  */
+#line 4077 "util/configparser.c"
     break;
 
-  case 344:
-#line 1305 "util/configparser.y" /* yacc.c:1646  */
+  case 365:
+#line 1398 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_lame_size:%s)\n", (yyvsp[0].str)));
 		verbose(VERB_DETAIL, "ignored infra-cache-lame-size: %s "
 			"(option removed, use infra-cache-numhosts)", (yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3933 "util/configparser.c" /* yacc.c:1646  */
+#line 4088 "util/configparser.c"
     break;
 
-  case 345:
-#line 1313 "util/configparser.y" /* yacc.c:1646  */
+  case 366:
+#line 1406 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3945,11 +4100,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3949 "util/configparser.c" /* yacc.c:1646  */
+#line 4104 "util/configparser.c"
     break;
 
-  case 346:
-#line 1326 "util/configparser.y" /* yacc.c:1646  */
+  case 367:
+#line 1419 "util/configparser.y"
     {
 		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3957,21 +4112,21 @@ yyreduce:
 		else cfg_parser->cfg->infra_cache_min_rtt = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3961 "util/configparser.c" /* yacc.c:1646  */
+#line 4116 "util/configparser.c"
     break;
 
-  case 347:
-#line 1335 "util/configparser.y" /* yacc.c:1646  */
+  case 368:
+#line 1428 "util/configparser.y"
     {
 		OUTYY(("P(server_target_fetch_policy:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->target_fetch_policy);
 		cfg_parser->cfg->target_fetch_policy = (yyvsp[0].str);
 	}
-#line 3971 "util/configparser.c" /* yacc.c:1646  */
+#line 4126 "util/configparser.c"
     break;
 
-  case 348:
-#line 1342 "util/configparser.y" /* yacc.c:1646  */
+  case 369:
+#line 1435 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_short_bufsize:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3980,11 +4135,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3984 "util/configparser.c" /* yacc.c:1646  */
+#line 4139 "util/configparser.c"
     break;
 
-  case 349:
-#line 1352 "util/configparser.y" /* yacc.c:1646  */
+  case 370:
+#line 1445 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_large_queries:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3993,11 +4148,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3997 "util/configparser.c" /* yacc.c:1646  */
+#line 4152 "util/configparser.c"
     break;
 
-  case 350:
-#line 1362 "util/configparser.y" /* yacc.c:1646  */
+  case 371:
+#line 1455 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_glue:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4006,11 +4161,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4010 "util/configparser.c" /* yacc.c:1646  */
+#line 4165 "util/configparser.c"
     break;
 
-  case 351:
-#line 1372 "util/configparser.y" /* yacc.c:1646  */
+  case 372:
+#line 1465 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_dnssec_stripped:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4019,11 +4174,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4023 "util/configparser.c" /* yacc.c:1646  */
+#line 4178 "util/configparser.c"
     break;
 
-  case 352:
-#line 1382 "util/configparser.y" /* yacc.c:1646  */
+  case 373:
+#line 1475 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_below_nxdomain:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4032,11 +4187,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4036 "util/configparser.c" /* yacc.c:1646  */
+#line 4191 "util/configparser.c"
     break;
 
-  case 353:
-#line 1392 "util/configparser.y" /* yacc.c:1646  */
+  case 374:
+#line 1485 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_referral_path:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4045,11 +4200,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4049 "util/configparser.c" /* yacc.c:1646  */
+#line 4204 "util/configparser.c"
     break;
 
-  case 354:
-#line 1402 "util/configparser.y" /* yacc.c:1646  */
+  case 375:
+#line 1495 "util/configparser.y"
     {
 		OUTYY(("P(server_harden_algo_downgrade:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4058,11 +4213,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4062 "util/configparser.c" /* yacc.c:1646  */
+#line 4217 "util/configparser.c"
     break;
 
-  case 355:
-#line 1412 "util/configparser.y" /* yacc.c:1646  */
+  case 376:
+#line 1505 "util/configparser.y"
     {
 		OUTYY(("P(server_use_caps_for_id:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4071,41 +4226,41 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4075 "util/configparser.c" /* yacc.c:1646  */
+#line 4230 "util/configparser.c"
     break;
 
-  case 356:
-#line 1422 "util/configparser.y" /* yacc.c:1646  */
+  case 377:
+#line 1515 "util/configparser.y"
     {
 		OUTYY(("P(server_caps_whitelist:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4085 "util/configparser.c" /* yacc.c:1646  */
+#line 4240 "util/configparser.c"
     break;
 
-  case 357:
-#line 1429 "util/configparser.y" /* yacc.c:1646  */
+  case 378:
+#line 1522 "util/configparser.y"
     {
 		OUTYY(("P(server_private_address:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_address, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4095 "util/configparser.c" /* yacc.c:1646  */
+#line 4250 "util/configparser.c"
     break;
 
-  case 358:
-#line 1436 "util/configparser.y" /* yacc.c:1646  */
+  case 379:
+#line 1529 "util/configparser.y"
     {
 		OUTYY(("P(server_private_domain:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_domain, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4105 "util/configparser.c" /* yacc.c:1646  */
+#line 4260 "util/configparser.c"
     break;
 
-  case 359:
-#line 1443 "util/configparser.y" /* yacc.c:1646  */
+  case 380:
+#line 1536 "util/configparser.y"
     {
 		OUTYY(("P(server_prefetch:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4113,11 +4268,11 @@ yyreduce:
 		else cfg_parser->cfg->prefetch = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4117 "util/configparser.c" /* yacc.c:1646  */
+#line 4272 "util/configparser.c"
     break;
 
-  case 360:
-#line 1452 "util/configparser.y" /* yacc.c:1646  */
+  case 381:
+#line 1545 "util/configparser.y"
     {
 		OUTYY(("P(server_prefetch_key:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4125,11 +4280,11 @@ yyreduce:
 		else cfg_parser->cfg->prefetch_key = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4129 "util/configparser.c" /* yacc.c:1646  */
+#line 4284 "util/configparser.c"
     break;
 
-  case 361:
-#line 1461 "util/configparser.y" /* yacc.c:1646  */
+  case 382:
+#line 1554 "util/configparser.y"
     {
 		OUTYY(("P(server_deny_any:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4137,11 +4292,11 @@ yyreduce:
 		else cfg_parser->cfg->deny_any = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4141 "util/configparser.c" /* yacc.c:1646  */
+#line 4296 "util/configparser.c"
     break;
 
-  case 362:
-#line 1470 "util/configparser.y" /* yacc.c:1646  */
+  case 383:
+#line 1563 "util/configparser.y"
     {
 		OUTYY(("P(server_unwanted_reply_threshold:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4149,21 +4304,21 @@ yyreduce:
 		else cfg_parser->cfg->unwanted_threshold = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4153 "util/configparser.c" /* yacc.c:1646  */
+#line 4308 "util/configparser.c"
     break;
 
-  case 363:
-#line 1479 "util/configparser.y" /* yacc.c:1646  */
+  case 384:
+#line 1572 "util/configparser.y"
     {
 		OUTYY(("P(server_do_not_query_address:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->donotqueryaddrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4163 "util/configparser.c" /* yacc.c:1646  */
+#line 4318 "util/configparser.c"
     break;
 
-  case 364:
-#line 1486 "util/configparser.y" /* yacc.c:1646  */
+  case 385:
+#line 1579 "util/configparser.y"
     {
 		OUTYY(("P(server_do_not_query_localhost:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4172,11 +4327,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4176 "util/configparser.c" /* yacc.c:1646  */
+#line 4331 "util/configparser.c"
     break;
 
-  case 365:
-#line 1496 "util/configparser.y" /* yacc.c:1646  */
+  case 386:
+#line 1589 "util/configparser.y"
     {
 		OUTYY(("P(server_access_control:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "deny")!=0 && strcmp((yyvsp[0].str), "refuse")!=0 &&
@@ -4195,21 +4350,21 @@ yyreduce:
 				fatal_exit("out of memory adding acl");
 		}
 	}
-#line 4199 "util/configparser.c" /* yacc.c:1646  */
+#line 4354 "util/configparser.c"
     break;
 
-  case 366:
-#line 1516 "util/configparser.y" /* yacc.c:1646  */
+  case 387:
+#line 1609 "util/configparser.y"
     {
 		OUTYY(("P(server_module_conf:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->module_conf);
 		cfg_parser->cfg->module_conf = (yyvsp[0].str);
 	}
-#line 4209 "util/configparser.c" /* yacc.c:1646  */
+#line 4364 "util/configparser.c"
     break;
 
-  case 367:
-#line 1523 "util/configparser.y" /* yacc.c:1646  */
+  case 388:
+#line 1616 "util/configparser.y"
     {
 		OUTYY(("P(server_val_override_date:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -4226,11 +4381,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4230 "util/configparser.c" /* yacc.c:1646  */
+#line 4385 "util/configparser.c"
     break;
 
-  case 368:
-#line 1541 "util/configparser.y" /* yacc.c:1646  */
+  case 389:
+#line 1634 "util/configparser.y"
     {
 		OUTYY(("P(server_val_sig_skew_min:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -4242,11 +4397,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4246 "util/configparser.c" /* yacc.c:1646  */
+#line 4401 "util/configparser.c"
     break;
 
-  case 369:
-#line 1554 "util/configparser.y" /* yacc.c:1646  */
+  case 390:
+#line 1647 "util/configparser.y"
     {
 		OUTYY(("P(server_val_sig_skew_max:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -4258,11 +4413,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4262 "util/configparser.c" /* yacc.c:1646  */
+#line 4417 "util/configparser.c"
     break;
 
-  case 370:
-#line 1567 "util/configparser.y" /* yacc.c:1646  */
+  case 391:
+#line 1660 "util/configparser.y"
     {
 		OUTYY(("P(server_cache_max_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4270,11 +4425,11 @@ yyreduce:
 		else cfg_parser->cfg->max_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4274 "util/configparser.c" /* yacc.c:1646  */
+#line 4429 "util/configparser.c"
     break;
 
-  case 371:
-#line 1576 "util/configparser.y" /* yacc.c:1646  */
+  case 392:
+#line 1669 "util/configparser.y"
     {
 		OUTYY(("P(server_cache_max_negative_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4282,11 +4437,11 @@ yyreduce:
 		else cfg_parser->cfg->max_negative_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4286 "util/configparser.c" /* yacc.c:1646  */
+#line 4441 "util/configparser.c"
     break;
 
-  case 372:
-#line 1585 "util/configparser.y" /* yacc.c:1646  */
+  case 393:
+#line 1678 "util/configparser.y"
     {
 		OUTYY(("P(server_cache_min_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4294,11 +4449,11 @@ yyreduce:
 		else cfg_parser->cfg->min_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4298 "util/configparser.c" /* yacc.c:1646  */
+#line 4453 "util/configparser.c"
     break;
 
-  case 373:
-#line 1594 "util/configparser.y" /* yacc.c:1646  */
+  case 394:
+#line 1687 "util/configparser.y"
     {
 		OUTYY(("P(server_bogus_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4306,11 +4461,11 @@ yyreduce:
 		else cfg_parser->cfg->bogus_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4310 "util/configparser.c" /* yacc.c:1646  */
+#line 4465 "util/configparser.c"
     break;
 
-  case 374:
-#line 1603 "util/configparser.y" /* yacc.c:1646  */
+  case 395:
+#line 1696 "util/configparser.y"
     {
 		OUTYY(("P(server_val_clean_additional:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4319,11 +4474,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4323 "util/configparser.c" /* yacc.c:1646  */
+#line 4478 "util/configparser.c"
     break;
 
-  case 375:
-#line 1613 "util/configparser.y" /* yacc.c:1646  */
+  case 396:
+#line 1706 "util/configparser.y"
     {
 		OUTYY(("P(server_val_permissive_mode:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4332,11 +4487,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4336 "util/configparser.c" /* yacc.c:1646  */
+#line 4491 "util/configparser.c"
     break;
 
-  case 376:
-#line 1623 "util/configparser.y" /* yacc.c:1646  */
+  case 397:
+#line 1716 "util/configparser.y"
     {
 		OUTYY(("P(server_aggressive_nsec:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4346,11 +4501,11 @@ yyreduce:
 				(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4350 "util/configparser.c" /* yacc.c:1646  */
+#line 4505 "util/configparser.c"
     break;
 
-  case 377:
-#line 1634 "util/configparser.y" /* yacc.c:1646  */
+  case 398:
+#line 1727 "util/configparser.y"
     {
 		OUTYY(("P(server_ignore_cd_flag:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4358,11 +4513,11 @@ yyreduce:
 		else cfg_parser->cfg->ignore_cd = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4362 "util/configparser.c" /* yacc.c:1646  */
+#line 4517 "util/configparser.c"
     break;
 
-  case 378:
-#line 1643 "util/configparser.y" /* yacc.c:1646  */
+  case 399:
+#line 1736 "util/configparser.y"
     {
 		OUTYY(("P(server_serve_expired:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4370,11 +4525,11 @@ yyreduce:
 		else cfg_parser->cfg->serve_expired = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4374 "util/configparser.c" /* yacc.c:1646  */
+#line 4529 "util/configparser.c"
     break;
 
-  case 379:
-#line 1652 "util/configparser.y" /* yacc.c:1646  */
+  case 400:
+#line 1745 "util/configparser.y"
     {
 		OUTYY(("P(server_serve_expired_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4382,11 +4537,11 @@ yyreduce:
 		else cfg_parser->cfg->serve_expired_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4386 "util/configparser.c" /* yacc.c:1646  */
+#line 4541 "util/configparser.c"
     break;
 
-  case 380:
-#line 1661 "util/configparser.y" /* yacc.c:1646  */
+  case 401:
+#line 1754 "util/configparser.y"
     {
 		OUTYY(("P(server_serve_expired_ttl_reset:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4394,43 +4549,67 @@ yyreduce:
 		else cfg_parser->cfg->serve_expired_ttl_reset = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4398 "util/configparser.c" /* yacc.c:1646  */
+#line 4553 "util/configparser.c"
     break;
 
-  case 381:
-#line 1670 "util/configparser.y" /* yacc.c:1646  */
+  case 402:
+#line 1763 "util/configparser.y"
+    {
+		OUTYY(("P(server_serve_expired_reply_ttl:%s)\n", (yyvsp[0].str)));
+		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->serve_expired_reply_ttl = atoi((yyvsp[0].str));
+		free((yyvsp[0].str));
+	}
+#line 4565 "util/configparser.c"
+    break;
+
+  case 403:
+#line 1772 "util/configparser.y"
+    {
+		OUTYY(("P(server_serve_expired_client_timeout:%s)\n", (yyvsp[0].str)));
+		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->serve_expired_client_timeout = atoi((yyvsp[0].str));
+		free((yyvsp[0].str));
+	}
+#line 4577 "util/configparser.c"
+    break;
+
+  case 404:
+#line 1781 "util/configparser.y"
     {
 		OUTYY(("P(server_fake_dsa:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
 			yyerror("expected yes or no.");
-#ifdef HAVE_SSL
+#if defined(HAVE_SSL) || defined(HAVE_NETTLE)
 		else fake_dsa = (strcmp((yyvsp[0].str), "yes")==0);
 		if(fake_dsa)
 			log_warn("test option fake_dsa is enabled");
 #endif
 		free((yyvsp[0].str));
 	}
-#line 4414 "util/configparser.c" /* yacc.c:1646  */
+#line 4593 "util/configparser.c"
     break;
 
-  case 382:
-#line 1683 "util/configparser.y" /* yacc.c:1646  */
+  case 405:
+#line 1794 "util/configparser.y"
     {
 		OUTYY(("P(server_fake_sha1:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
 			yyerror("expected yes or no.");
-#ifdef HAVE_SSL
+#if defined(HAVE_SSL) || defined(HAVE_NETTLE)
 		else fake_sha1 = (strcmp((yyvsp[0].str), "yes")==0);
 		if(fake_sha1)
 			log_warn("test option fake_sha1 is enabled");
 #endif
 		free((yyvsp[0].str));
 	}
-#line 4430 "util/configparser.c" /* yacc.c:1646  */
+#line 4609 "util/configparser.c"
     break;
 
-  case 383:
-#line 1696 "util/configparser.y" /* yacc.c:1646  */
+  case 406:
+#line 1807 "util/configparser.y"
     {
 		OUTYY(("P(server_val_log_level:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4438,21 +4617,21 @@ yyreduce:
 		else cfg_parser->cfg->val_log_level = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4442 "util/configparser.c" /* yacc.c:1646  */
+#line 4621 "util/configparser.c"
     break;
 
-  case 384:
-#line 1705 "util/configparser.y" /* yacc.c:1646  */
+  case 407:
+#line 1816 "util/configparser.y"
     {
 		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->val_nsec3_key_iterations);
 		cfg_parser->cfg->val_nsec3_key_iterations = (yyvsp[0].str);
 	}
-#line 4452 "util/configparser.c" /* yacc.c:1646  */
+#line 4631 "util/configparser.c"
     break;
 
-  case 385:
-#line 1712 "util/configparser.y" /* yacc.c:1646  */
+  case 408:
+#line 1823 "util/configparser.y"
     {
 		OUTYY(("P(server_add_holddown:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4460,11 +4639,11 @@ yyreduce:
 		else cfg_parser->cfg->add_holddown = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4464 "util/configparser.c" /* yacc.c:1646  */
+#line 4643 "util/configparser.c"
     break;
 
-  case 386:
-#line 1721 "util/configparser.y" /* yacc.c:1646  */
+  case 409:
+#line 1832 "util/configparser.y"
     {
 		OUTYY(("P(server_del_holddown:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4472,11 +4651,11 @@ yyreduce:
 		else cfg_parser->cfg->del_holddown = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4476 "util/configparser.c" /* yacc.c:1646  */
+#line 4655 "util/configparser.c"
     break;
 
-  case 387:
-#line 1730 "util/configparser.y" /* yacc.c:1646  */
+  case 410:
+#line 1841 "util/configparser.y"
     {
 		OUTYY(("P(server_keep_missing:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4484,11 +4663,11 @@ yyreduce:
 		else cfg_parser->cfg->keep_missing = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4488 "util/configparser.c" /* yacc.c:1646  */
+#line 4667 "util/configparser.c"
     break;
 
-  case 388:
-#line 1739 "util/configparser.y" /* yacc.c:1646  */
+  case 411:
+#line 1850 "util/configparser.y"
     {
 		OUTYY(("P(server_permit_small_holddown:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4497,22 +4676,22 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4501 "util/configparser.c" /* yacc.c:1646  */
+#line 4680 "util/configparser.c"
     break;
 
-  case 389:
-#line 1748 "util/configparser.y" /* yacc.c:1646  */
+  case 412:
+#line 1859 "util/configparser.y"
     {
 		OUTYY(("P(server_key_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->key_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 4512 "util/configparser.c" /* yacc.c:1646  */
+#line 4691 "util/configparser.c"
     break;
 
-  case 390:
-#line 1756 "util/configparser.y" /* yacc.c:1646  */
+  case 413:
+#line 1867 "util/configparser.y"
     {
 		OUTYY(("P(server_key_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4524,22 +4703,22 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4528 "util/configparser.c" /* yacc.c:1646  */
+#line 4707 "util/configparser.c"
     break;
 
-  case 391:
-#line 1769 "util/configparser.y" /* yacc.c:1646  */
+  case 414:
+#line 1880 "util/configparser.y"
     {
 		OUTYY(("P(server_neg_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->neg_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 4539 "util/configparser.c" /* yacc.c:1646  */
+#line 4718 "util/configparser.c"
     break;
 
-  case 392:
-#line 1777 "util/configparser.y" /* yacc.c:1646  */
+  case 415:
+#line 1888 "util/configparser.y"
     {
 		OUTYY(("P(server_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@ -4579,21 +4758,21 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 4583 "util/configparser.c" /* yacc.c:1646  */
+#line 4762 "util/configparser.c"
     break;
 
-  case 393:
-#line 1818 "util/configparser.y" /* yacc.c:1646  */
+  case 416:
+#line 1929 "util/configparser.y"
     {
 		OUTYY(("P(server_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[0].str)))
 			fatal_exit("out of memory adding local-data");
 	}
-#line 4593 "util/configparser.c" /* yacc.c:1646  */
+#line 4772 "util/configparser.c"
     break;
 
-  case 394:
-#line 1825 "util/configparser.y" /* yacc.c:1646  */
+  case 417:
+#line 1936 "util/configparser.y"
     {
 		char* ptr;
 		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -4607,11 +4786,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 4611 "util/configparser.c" /* yacc.c:1646  */
+#line 4790 "util/configparser.c"
     break;
 
-  case 395:
-#line 1840 "util/configparser.y" /* yacc.c:1646  */
+  case 418:
+#line 1951 "util/configparser.y"
     {
 		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4620,11 +4799,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4624 "util/configparser.c" /* yacc.c:1646  */
+#line 4803 "util/configparser.c"
     break;
 
-  case 396:
-#line 1850 "util/configparser.y" /* yacc.c:1646  */
+  case 419:
+#line 1961 "util/configparser.y"
     {
 		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4633,41 +4812,41 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4637 "util/configparser.c" /* yacc.c:1646  */
+#line 4816 "util/configparser.c"
     break;
 
-  case 397:
-#line 1860 "util/configparser.y" /* yacc.c:1646  */
+  case 420:
+#line 1971 "util/configparser.y"
     {
 		OUTYY(("P(server_unknown_server_time_limit:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->unknown_server_time_limit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4647 "util/configparser.c" /* yacc.c:1646  */
+#line 4826 "util/configparser.c"
     break;
 
-  case 398:
-#line 1867 "util/configparser.y" /* yacc.c:1646  */
+  case 421:
+#line 1978 "util/configparser.y"
     {
 		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->max_udp_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4657 "util/configparser.c" /* yacc.c:1646  */
+#line 4836 "util/configparser.c"
     break;
 
-  case 399:
-#line 1874 "util/configparser.y" /* yacc.c:1646  */
+  case 422:
+#line 1985 "util/configparser.y"
     {
 		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dns64_prefix);
 		cfg_parser->cfg->dns64_prefix = (yyvsp[0].str);
 	}
-#line 4667 "util/configparser.c" /* yacc.c:1646  */
+#line 4846 "util/configparser.c"
     break;
 
-  case 400:
-#line 1881 "util/configparser.y" /* yacc.c:1646  */
+  case 423:
+#line 1992 "util/configparser.y"
     {
 		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4675,22 +4854,22 @@ yyreduce:
 		else cfg_parser->cfg->dns64_synthall = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4679 "util/configparser.c" /* yacc.c:1646  */
+#line 4858 "util/configparser.c"
     break;
 
-  case 401:
-#line 1890 "util/configparser.y" /* yacc.c:1646  */
+  case 424:
+#line 2001 "util/configparser.y"
     {
 		OUTYY(("P(dns64_ignore_aaaa:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dns64_ignore_aaaa,
 			(yyvsp[0].str)))
 			fatal_exit("out of memory adding dns64-ignore-aaaa");
 	}
-#line 4690 "util/configparser.c" /* yacc.c:1646  */
+#line 4869 "util/configparser.c"
     break;
 
-  case 402:
-#line 1898 "util/configparser.y" /* yacc.c:1646  */
+  case 425:
+#line 2009 "util/configparser.y"
     {
 		char* p, *s = (yyvsp[0].str);
 		OUTYY(("P(server_define_tag:%s)\n", (yyvsp[0].str)));
@@ -4703,11 +4882,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4707 "util/configparser.c" /* yacc.c:1646  */
+#line 4886 "util/configparser.c"
     break;
 
-  case 403:
-#line 1912 "util/configparser.y" /* yacc.c:1646  */
+  case 426:
+#line 2023 "util/configparser.y"
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -4727,11 +4906,11 @@ yyreduce:
 			}
 		}
 	}
-#line 4731 "util/configparser.c" /* yacc.c:1646  */
+#line 4910 "util/configparser.c"
     break;
 
-  case 404:
-#line 1933 "util/configparser.y" /* yacc.c:1646  */
+  case 427:
+#line 2044 "util/configparser.y"
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -4751,11 +4930,11 @@ yyreduce:
 			}
 		}
 	}
-#line 4755 "util/configparser.c" /* yacc.c:1646  */
+#line 4934 "util/configparser.c"
     break;
 
-  case 405:
-#line 1954 "util/configparser.y" /* yacc.c:1646  */
+  case 428:
+#line 2065 "util/configparser.y"
     {
 		OUTYY(("P(server_access_control_tag_action:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_actions,
@@ -4766,11 +4945,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 4770 "util/configparser.c" /* yacc.c:1646  */
+#line 4949 "util/configparser.c"
     break;
 
-  case 406:
-#line 1966 "util/configparser.y" /* yacc.c:1646  */
+  case 429:
+#line 2077 "util/configparser.y"
     {
 		OUTYY(("P(server_access_control_tag_data:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_datas,
@@ -4781,11 +4960,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 4785 "util/configparser.c" /* yacc.c:1646  */
+#line 4964 "util/configparser.c"
     break;
 
-  case 407:
-#line 1978 "util/configparser.y" /* yacc.c:1646  */
+  case 430:
+#line 2089 "util/configparser.y"
     {
 		OUTYY(("P(server_local_zone_override:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->local_zone_overrides,
@@ -4796,11 +4975,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 4800 "util/configparser.c" /* yacc.c:1646  */
+#line 4979 "util/configparser.c"
     break;
 
-  case 408:
-#line 1990 "util/configparser.y" /* yacc.c:1646  */
+  case 431:
+#line 2101 "util/configparser.y"
     {
 		OUTYY(("P(server_access_control_view:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str2list_insert(&cfg_parser->cfg->acl_view,
@@ -4808,11 +4987,11 @@ yyreduce:
 			yyerror("out of memory");
 		}
 	}
-#line 4812 "util/configparser.c" /* yacc.c:1646  */
+#line 4991 "util/configparser.c"
     break;
 
-  case 409:
-#line 1999 "util/configparser.y" /* yacc.c:1646  */
+  case 432:
+#line 2110 "util/configparser.y"
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -4832,11 +5011,11 @@ yyreduce:
 			}
 		}
 	}
-#line 4836 "util/configparser.c" /* yacc.c:1646  */
+#line 5015 "util/configparser.c"
     break;
 
-  case 410:
-#line 2020 "util/configparser.y" /* yacc.c:1646  */
+  case 433:
+#line 2131 "util/configparser.y"
     { 
 		OUTYY(("P(server_ip_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4844,11 +5023,11 @@ yyreduce:
 		else cfg_parser->cfg->ip_ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4848 "util/configparser.c" /* yacc.c:1646  */
+#line 5027 "util/configparser.c"
     break;
 
-  case 411:
-#line 2030 "util/configparser.y" /* yacc.c:1646  */
+  case 434:
+#line 2141 "util/configparser.y"
     { 
 		OUTYY(("P(server_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4856,33 +5035,33 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4860 "util/configparser.c" /* yacc.c:1646  */
+#line 5039 "util/configparser.c"
     break;
 
-  case 412:
-#line 2039 "util/configparser.y" /* yacc.c:1646  */
+  case 435:
+#line 2150 "util/configparser.y"
     {
   	OUTYY(("P(server_ip_ratelimit_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ip_ratelimit_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 4871 "util/configparser.c" /* yacc.c:1646  */
+#line 5050 "util/configparser.c"
     break;
 
-  case 413:
-#line 2047 "util/configparser.y" /* yacc.c:1646  */
+  case 436:
+#line 2158 "util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ratelimit_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 4882 "util/configparser.c" /* yacc.c:1646  */
+#line 5061 "util/configparser.c"
     break;
 
-  case 414:
-#line 2055 "util/configparser.y" /* yacc.c:1646  */
+  case 437:
+#line 2166 "util/configparser.y"
     {
   	OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -4894,11 +5073,11 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 4898 "util/configparser.c" /* yacc.c:1646  */
+#line 5077 "util/configparser.c"
     break;
 
-  case 415:
-#line 2068 "util/configparser.y" /* yacc.c:1646  */
+  case 438:
+#line 2179 "util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4910,11 +5089,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4914 "util/configparser.c" /* yacc.c:1646  */
+#line 5093 "util/configparser.c"
     break;
 
-  case 416:
-#line 2081 "util/configparser.y" /* yacc.c:1646  */
+  case 439:
+#line 2192 "util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -4928,11 +5107,11 @@ yyreduce:
 					"ratelimit-for-domain");
 		}
 	}
-#line 4932 "util/configparser.c" /* yacc.c:1646  */
+#line 5111 "util/configparser.c"
     break;
 
-  case 417:
-#line 2096 "util/configparser.y" /* yacc.c:1646  */
+  case 440:
+#line 2207 "util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -4946,11 +5125,11 @@ yyreduce:
 					"ratelimit-below-domain");
 		}
 	}
-#line 4950 "util/configparser.c" /* yacc.c:1646  */
+#line 5129 "util/configparser.c"
     break;
 
-  case 418:
-#line 2111 "util/configparser.y" /* yacc.c:1646  */
+  case 441:
+#line 2222 "util/configparser.y"
     { 
   	OUTYY(("P(server_ip_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
   	if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4958,11 +5137,11 @@ yyreduce:
   	else cfg_parser->cfg->ip_ratelimit_factor = atoi((yyvsp[0].str));
   	free((yyvsp[0].str));
 	}
-#line 4962 "util/configparser.c" /* yacc.c:1646  */
+#line 5141 "util/configparser.c"
     break;
 
-  case 419:
-#line 2120 "util/configparser.y" /* yacc.c:1646  */
+  case 442:
+#line 2231 "util/configparser.y"
     { 
 		OUTYY(("P(server_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4970,20 +5149,20 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit_factor = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4974 "util/configparser.c" /* yacc.c:1646  */
+#line 5153 "util/configparser.c"
     break;
 
-  case 420:
-#line 2129 "util/configparser.y" /* yacc.c:1646  */
+  case 443:
+#line 2240 "util/configparser.y"
     { 
 		OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n"));
 		free((yyvsp[0].str));
 	}
-#line 4983 "util/configparser.c" /* yacc.c:1646  */
+#line 5162 "util/configparser.c"
     break;
 
-  case 421:
-#line 2135 "util/configparser.y" /* yacc.c:1646  */
+  case 444:
+#line 2246 "util/configparser.y"
     { 
 		OUTYY(("P(server_fast_server_num:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) <= 0)
@@ -4991,11 +5170,11 @@ yyreduce:
 		else cfg_parser->cfg->fast_server_num = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4995 "util/configparser.c" /* yacc.c:1646  */
+#line 5174 "util/configparser.c"
     break;
 
-  case 422:
-#line 2144 "util/configparser.y" /* yacc.c:1646  */
+  case 445:
+#line 2255 "util/configparser.y"
     { 
 		OUTYY(("P(server_fast_server_permil:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5003,11 +5182,11 @@ yyreduce:
 		else cfg_parser->cfg->fast_server_permil = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5007 "util/configparser.c" /* yacc.c:1646  */
+#line 5186 "util/configparser.c"
     break;
 
-  case 423:
-#line 2153 "util/configparser.y" /* yacc.c:1646  */
+  case 446:
+#line 2264 "util/configparser.y"
     {
 		OUTYY(("P(server_qname_minimisation:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5016,11 +5195,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5020 "util/configparser.c" /* yacc.c:1646  */
+#line 5199 "util/configparser.c"
     break;
 
-  case 424:
-#line 2163 "util/configparser.y" /* yacc.c:1646  */
+  case 447:
+#line 2274 "util/configparser.y"
     {
 		OUTYY(("P(server_qname_minimisation_strict:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5029,11 +5208,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5033 "util/configparser.c" /* yacc.c:1646  */
+#line 5212 "util/configparser.c"
     break;
 
-  case 425:
-#line 2173 "util/configparser.y" /* yacc.c:1646  */
+  case 448:
+#line 2284 "util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_enabled:%s)\n", (yyvsp[0].str)));
@@ -5045,11 +5224,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 5049 "util/configparser.c" /* yacc.c:1646  */
+#line 5228 "util/configparser.c"
     break;
 
-  case 426:
-#line 2186 "util/configparser.y" /* yacc.c:1646  */
+  case 449:
+#line 2297 "util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_ignore_bogus:%s)\n", (yyvsp[0].str)));
@@ -5061,11 +5240,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 5065 "util/configparser.c" /* yacc.c:1646  */
+#line 5244 "util/configparser.c"
     break;
 
-  case 427:
-#line 2199 "util/configparser.y" /* yacc.c:1646  */
+  case 450:
+#line 2310 "util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_hook:%s)\n", (yyvsp[0].str)));
@@ -5076,11 +5255,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5080 "util/configparser.c" /* yacc.c:1646  */
+#line 5259 "util/configparser.c"
     break;
 
-  case 428:
-#line 2211 "util/configparser.y" /* yacc.c:1646  */
+  case 451:
+#line 2322 "util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_max_ttl:%s)\n", (yyvsp[0].str)));
@@ -5093,11 +5272,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5097 "util/configparser.c" /* yacc.c:1646  */
+#line 5276 "util/configparser.c"
     break;
 
-  case 429:
-#line 2225 "util/configparser.y" /* yacc.c:1646  */
+  case 452:
+#line 2336 "util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_whitelist:%s)\n", (yyvsp[0].str)));
@@ -5108,11 +5287,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5112 "util/configparser.c" /* yacc.c:1646  */
+#line 5291 "util/configparser.c"
     break;
 
-  case 430:
-#line 2237 "util/configparser.y" /* yacc.c:1646  */
+  case 453:
+#line 2348 "util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_strict:%s)\n", (yyvsp[0].str)));
@@ -5125,11 +5304,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5129 "util/configparser.c" /* yacc.c:1646  */
+#line 5308 "util/configparser.c"
     break;
 
-  case 431:
-#line 2251 "util/configparser.y" /* yacc.c:1646  */
+  case 454:
+#line 2362 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->stubs->name)
@@ -5138,31 +5317,31 @@ yyreduce:
 		free(cfg_parser->cfg->stubs->name);
 		cfg_parser->cfg->stubs->name = (yyvsp[0].str);
 	}
-#line 5142 "util/configparser.c" /* yacc.c:1646  */
+#line 5321 "util/configparser.c"
     break;
 
-  case 432:
-#line 2261 "util/configparser.y" /* yacc.c:1646  */
+  case 455:
+#line 2372 "util/configparser.y"
     {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5152 "util/configparser.c" /* yacc.c:1646  */
+#line 5331 "util/configparser.c"
     break;
 
-  case 433:
-#line 2268 "util/configparser.y" /* yacc.c:1646  */
+  case 456:
+#line 2379 "util/configparser.y"
     {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5162 "util/configparser.c" /* yacc.c:1646  */
+#line 5341 "util/configparser.c"
     break;
 
-  case 434:
-#line 2275 "util/configparser.y" /* yacc.c:1646  */
+  case 457:
+#line 2386 "util/configparser.y"
     {
 		OUTYY(("P(stub-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5170,11 +5349,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5174 "util/configparser.c" /* yacc.c:1646  */
+#line 5353 "util/configparser.c"
     break;
 
-  case 435:
-#line 2284 "util/configparser.y" /* yacc.c:1646  */
+  case 458:
+#line 2395 "util/configparser.y"
     {
 		OUTYY(("P(stub-no-cache:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5182,11 +5361,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5186 "util/configparser.c" /* yacc.c:1646  */
+#line 5365 "util/configparser.c"
     break;
 
-  case 436:
-#line 2293 "util/configparser.y" /* yacc.c:1646  */
+  case 459:
+#line 2404 "util/configparser.y"
     {
 		OUTYY(("P(stub-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5195,11 +5374,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5199 "util/configparser.c" /* yacc.c:1646  */
+#line 5378 "util/configparser.c"
     break;
 
-  case 437:
-#line 2303 "util/configparser.y" /* yacc.c:1646  */
+  case 460:
+#line 2414 "util/configparser.y"
     {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5208,11 +5387,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5212 "util/configparser.c" /* yacc.c:1646  */
+#line 5391 "util/configparser.c"
     break;
 
-  case 438:
-#line 2313 "util/configparser.y" /* yacc.c:1646  */
+  case 461:
+#line 2424 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->forwards->name)
@@ -5221,31 +5400,31 @@ yyreduce:
 		free(cfg_parser->cfg->forwards->name);
 		cfg_parser->cfg->forwards->name = (yyvsp[0].str);
 	}
-#line 5225 "util/configparser.c" /* yacc.c:1646  */
+#line 5404 "util/configparser.c"
     break;
 
-  case 439:
-#line 2323 "util/configparser.y" /* yacc.c:1646  */
+  case 462:
+#line 2434 "util/configparser.y"
     {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5235 "util/configparser.c" /* yacc.c:1646  */
+#line 5414 "util/configparser.c"
     break;
 
-  case 440:
-#line 2330 "util/configparser.y" /* yacc.c:1646  */
+  case 463:
+#line 2441 "util/configparser.y"
     {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5245 "util/configparser.c" /* yacc.c:1646  */
+#line 5424 "util/configparser.c"
     break;
 
-  case 441:
-#line 2337 "util/configparser.y" /* yacc.c:1646  */
+  case 464:
+#line 2448 "util/configparser.y"
     {
 		OUTYY(("P(forward-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5253,11 +5432,11 @@ yyreduce:
 		else cfg_parser->cfg->forwards->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5257 "util/configparser.c" /* yacc.c:1646  */
+#line 5436 "util/configparser.c"
     break;
 
-  case 442:
-#line 2346 "util/configparser.y" /* yacc.c:1646  */
+  case 465:
+#line 2457 "util/configparser.y"
     {
 		OUTYY(("P(forward-no-cache:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5265,11 +5444,11 @@ yyreduce:
 		else cfg_parser->cfg->forwards->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5269 "util/configparser.c" /* yacc.c:1646  */
+#line 5448 "util/configparser.c"
     break;
 
-  case 443:
-#line 2355 "util/configparser.y" /* yacc.c:1646  */
+  case 466:
+#line 2466 "util/configparser.y"
     {
 		OUTYY(("P(forward-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5278,11 +5457,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5282 "util/configparser.c" /* yacc.c:1646  */
+#line 5461 "util/configparser.c"
     break;
 
-  case 444:
-#line 2365 "util/configparser.y" /* yacc.c:1646  */
+  case 467:
+#line 2476 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->auths->name)
@@ -5291,52 +5470,52 @@ yyreduce:
 		free(cfg_parser->cfg->auths->name);
 		cfg_parser->cfg->auths->name = (yyvsp[0].str);
 	}
-#line 5295 "util/configparser.c" /* yacc.c:1646  */
+#line 5474 "util/configparser.c"
     break;
 
-  case 445:
-#line 2375 "util/configparser.y" /* yacc.c:1646  */
+  case 468:
+#line 2486 "util/configparser.y"
     {
 		OUTYY(("P(zonefile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->auths->zonefile);
 		cfg_parser->cfg->auths->zonefile = (yyvsp[0].str);
 	}
-#line 5305 "util/configparser.c" /* yacc.c:1646  */
+#line 5484 "util/configparser.c"
     break;
 
-  case 446:
-#line 2382 "util/configparser.y" /* yacc.c:1646  */
+  case 469:
+#line 2493 "util/configparser.y"
     {
 		OUTYY(("P(master:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->masters, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5315 "util/configparser.c" /* yacc.c:1646  */
+#line 5494 "util/configparser.c"
     break;
 
-  case 447:
-#line 2389 "util/configparser.y" /* yacc.c:1646  */
+  case 470:
+#line 2500 "util/configparser.y"
     {
 		OUTYY(("P(url:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->urls, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5325 "util/configparser.c" /* yacc.c:1646  */
+#line 5504 "util/configparser.c"
     break;
 
-  case 448:
-#line 2396 "util/configparser.y" /* yacc.c:1646  */
+  case 471:
+#line 2507 "util/configparser.y"
     {
 		OUTYY(("P(allow-notify:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->allow_notify,
 			(yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5336 "util/configparser.c" /* yacc.c:1646  */
+#line 5515 "util/configparser.c"
     break;
 
-  case 449:
-#line 2404 "util/configparser.y" /* yacc.c:1646  */
+  case 472:
+#line 2515 "util/configparser.y"
     {
 		OUTYY(("P(for-downstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5345,11 +5524,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5349 "util/configparser.c" /* yacc.c:1646  */
+#line 5528 "util/configparser.c"
     break;
 
-  case 450:
-#line 2414 "util/configparser.y" /* yacc.c:1646  */
+  case 473:
+#line 2525 "util/configparser.y"
     {
 		OUTYY(("P(for-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5358,11 +5537,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5362 "util/configparser.c" /* yacc.c:1646  */
+#line 5541 "util/configparser.c"
     break;
 
-  case 451:
-#line 2424 "util/configparser.y" /* yacc.c:1646  */
+  case 474:
+#line 2535 "util/configparser.y"
     {
 		OUTYY(("P(fallback-enabled:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5371,11 +5550,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5375 "util/configparser.c" /* yacc.c:1646  */
+#line 5554 "util/configparser.c"
     break;
 
-  case 452:
-#line 2434 "util/configparser.y" /* yacc.c:1646  */
+  case 475:
+#line 2545 "util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->views->name)
@@ -5384,11 +5563,11 @@ yyreduce:
 		free(cfg_parser->cfg->views->name);
 		cfg_parser->cfg->views->name = (yyvsp[0].str);
 	}
-#line 5388 "util/configparser.c" /* yacc.c:1646  */
+#line 5567 "util/configparser.c"
     break;
 
-  case 453:
-#line 2444 "util/configparser.y" /* yacc.c:1646  */
+  case 476:
+#line 2555 "util/configparser.y"
     {
 		OUTYY(("P(view_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@ -5426,11 +5605,11 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 5430 "util/configparser.c" /* yacc.c:1646  */
+#line 5609 "util/configparser.c"
     break;
 
-  case 454:
-#line 2483 "util/configparser.y" /* yacc.c:1646  */
+  case 477:
+#line 2594 "util/configparser.y"
     {
 		OUTYY(("P(view_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -5439,33 +5618,33 @@ yyreduce:
 			fatal_exit("out of memory adding per-view "
 				"response-ip action");
 	}
-#line 5443 "util/configparser.c" /* yacc.c:1646  */
+#line 5622 "util/configparser.c"
     break;
 
-  case 455:
-#line 2493 "util/configparser.y" /* yacc.c:1646  */
+  case 478:
+#line 2604 "util/configparser.y"
     {
 		OUTYY(("P(view_response_ip_data:%s)\n", (yyvsp[-1].str)));
 		if(!cfg_str2list_insert(
 			&cfg_parser->cfg->views->respip_data, (yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip-data");
 	}
-#line 5454 "util/configparser.c" /* yacc.c:1646  */
+#line 5633 "util/configparser.c"
     break;
 
-  case 456:
-#line 2501 "util/configparser.y" /* yacc.c:1646  */
+  case 479:
+#line 2612 "util/configparser.y"
     {
 		OUTYY(("P(view_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->views->local_data, (yyvsp[0].str))) {
 			fatal_exit("out of memory adding local-data");
 		}
 	}
-#line 5465 "util/configparser.c" /* yacc.c:1646  */
+#line 5644 "util/configparser.c"
     break;
 
-  case 457:
-#line 2509 "util/configparser.y" /* yacc.c:1646  */
+  case 480:
+#line 2620 "util/configparser.y"
     {
 		char* ptr;
 		OUTYY(("P(view_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -5479,11 +5658,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 5483 "util/configparser.c" /* yacc.c:1646  */
+#line 5662 "util/configparser.c"
     break;
 
-  case 458:
-#line 2524 "util/configparser.y" /* yacc.c:1646  */
+  case 481:
+#line 2635 "util/configparser.y"
     {
 		OUTYY(("P(view-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5491,19 +5670,19 @@ yyreduce:
 		else cfg_parser->cfg->views->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5495 "util/configparser.c" /* yacc.c:1646  */
+#line 5674 "util/configparser.c"
     break;
 
-  case 459:
-#line 2533 "util/configparser.y" /* yacc.c:1646  */
+  case 482:
+#line 2644 "util/configparser.y"
     { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
-#line 5503 "util/configparser.c" /* yacc.c:1646  */
+#line 5682 "util/configparser.c"
     break;
 
-  case 470:
-#line 2544 "util/configparser.y" /* yacc.c:1646  */
+  case 493:
+#line 2655 "util/configparser.y"
     {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5512,11 +5691,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5516 "util/configparser.c" /* yacc.c:1646  */
+#line 5695 "util/configparser.c"
     break;
 
-  case 471:
-#line 2554 "util/configparser.y" /* yacc.c:1646  */
+  case 494:
+#line 2665 "util/configparser.y"
     {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -5524,79 +5703,79 @@ yyreduce:
 		else cfg_parser->cfg->control_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5528 "util/configparser.c" /* yacc.c:1646  */
+#line 5707 "util/configparser.c"
     break;
 
-  case 472:
-#line 2563 "util/configparser.y" /* yacc.c:1646  */
+  case 495:
+#line 2674 "util/configparser.y"
     {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append(&cfg_parser->cfg->control_ifs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5538 "util/configparser.c" /* yacc.c:1646  */
+#line 5717 "util/configparser.c"
     break;
 
-  case 473:
-#line 2570 "util/configparser.y" /* yacc.c:1646  */
+  case 496:
+#line 2681 "util/configparser.y"
     {
 		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->control_use_cert = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5548 "util/configparser.c" /* yacc.c:1646  */
+#line 5727 "util/configparser.c"
     break;
 
-  case 474:
-#line 2577 "util/configparser.y" /* yacc.c:1646  */
+  case 497:
+#line 2688 "util/configparser.y"
     {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_key_file);
 		cfg_parser->cfg->server_key_file = (yyvsp[0].str);
 	}
-#line 5558 "util/configparser.c" /* yacc.c:1646  */
+#line 5737 "util/configparser.c"
     break;
 
-  case 475:
-#line 2584 "util/configparser.y" /* yacc.c:1646  */
+  case 498:
+#line 2695 "util/configparser.y"
     {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_cert_file);
 		cfg_parser->cfg->server_cert_file = (yyvsp[0].str);
 	}
-#line 5568 "util/configparser.c" /* yacc.c:1646  */
+#line 5747 "util/configparser.c"
     break;
 
-  case 476:
-#line 2591 "util/configparser.y" /* yacc.c:1646  */
+  case 499:
+#line 2702 "util/configparser.y"
     {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_key_file);
 		cfg_parser->cfg->control_key_file = (yyvsp[0].str);
 	}
-#line 5578 "util/configparser.c" /* yacc.c:1646  */
+#line 5757 "util/configparser.c"
     break;
 
-  case 477:
-#line 2598 "util/configparser.y" /* yacc.c:1646  */
+  case 500:
+#line 2709 "util/configparser.y"
     {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_cert_file);
 		cfg_parser->cfg->control_cert_file = (yyvsp[0].str);
 	}
-#line 5588 "util/configparser.c" /* yacc.c:1646  */
+#line 5767 "util/configparser.c"
     break;
 
-  case 478:
-#line 2605 "util/configparser.y" /* yacc.c:1646  */
+  case 501:
+#line 2716 "util/configparser.y"
     {
 		OUTYY(("\nP(dnstap:)\n"));
 	}
-#line 5596 "util/configparser.c" /* yacc.c:1646  */
+#line 5775 "util/configparser.c"
     break;
 
-  case 493:
-#line 2622 "util/configparser.y" /* yacc.c:1646  */
+  case 516:
+#line 2733 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5604,21 +5783,21 @@ yyreduce:
 		else cfg_parser->cfg->dnstap = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5608 "util/configparser.c" /* yacc.c:1646  */
+#line 5787 "util/configparser.c"
     break;
 
-  case 494:
-#line 2631 "util/configparser.y" /* yacc.c:1646  */
+  case 517:
+#line 2742 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_socket_path);
 		cfg_parser->cfg->dnstap_socket_path = (yyvsp[0].str);
 	}
-#line 5618 "util/configparser.c" /* yacc.c:1646  */
+#line 5797 "util/configparser.c"
     break;
 
-  case 495:
-#line 2638 "util/configparser.y" /* yacc.c:1646  */
+  case 518:
+#line 2749 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5626,11 +5805,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_send_identity = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5630 "util/configparser.c" /* yacc.c:1646  */
+#line 5809 "util/configparser.c"
     break;
 
-  case 496:
-#line 2647 "util/configparser.y" /* yacc.c:1646  */
+  case 519:
+#line 2758 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5638,31 +5817,31 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_send_version = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5642 "util/configparser.c" /* yacc.c:1646  */
+#line 5821 "util/configparser.c"
     break;
 
-  case 497:
-#line 2656 "util/configparser.y" /* yacc.c:1646  */
+  case 520:
+#line 2767 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_identity);
 		cfg_parser->cfg->dnstap_identity = (yyvsp[0].str);
 	}
-#line 5652 "util/configparser.c" /* yacc.c:1646  */
+#line 5831 "util/configparser.c"
     break;
 
-  case 498:
-#line 2663 "util/configparser.y" /* yacc.c:1646  */
+  case 521:
+#line 2774 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_version);
 		cfg_parser->cfg->dnstap_version = (yyvsp[0].str);
 	}
-#line 5662 "util/configparser.c" /* yacc.c:1646  */
+#line 5841 "util/configparser.c"
     break;
 
-  case 499:
-#line 2670 "util/configparser.y" /* yacc.c:1646  */
+  case 522:
+#line 2781 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5671,11 +5850,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5675 "util/configparser.c" /* yacc.c:1646  */
+#line 5854 "util/configparser.c"
     break;
 
-  case 500:
-#line 2680 "util/configparser.y" /* yacc.c:1646  */
+  case 523:
+#line 2791 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5684,11 +5863,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5688 "util/configparser.c" /* yacc.c:1646  */
+#line 5867 "util/configparser.c"
     break;
 
-  case 501:
-#line 2690 "util/configparser.y" /* yacc.c:1646  */
+  case 524:
+#line 2801 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5697,11 +5876,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5701 "util/configparser.c" /* yacc.c:1646  */
+#line 5880 "util/configparser.c"
     break;
 
-  case 502:
-#line 2700 "util/configparser.y" /* yacc.c:1646  */
+  case 525:
+#line 2811 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5710,11 +5889,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5714 "util/configparser.c" /* yacc.c:1646  */
+#line 5893 "util/configparser.c"
     break;
 
-  case 503:
-#line 2710 "util/configparser.y" /* yacc.c:1646  */
+  case 526:
+#line 2821 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5723,11 +5902,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5727 "util/configparser.c" /* yacc.c:1646  */
+#line 5906 "util/configparser.c"
     break;
 
-  case 504:
-#line 2720 "util/configparser.y" /* yacc.c:1646  */
+  case 527:
+#line 2831 "util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5736,29 +5915,29 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5740 "util/configparser.c" /* yacc.c:1646  */
+#line 5919 "util/configparser.c"
     break;
 
-  case 505:
-#line 2730 "util/configparser.y" /* yacc.c:1646  */
+  case 528:
+#line 2841 "util/configparser.y"
     { 
 		OUTYY(("\nP(python:)\n")); 
 	}
-#line 5748 "util/configparser.c" /* yacc.c:1646  */
+#line 5927 "util/configparser.c"
     break;
 
-  case 509:
-#line 2739 "util/configparser.y" /* yacc.c:1646  */
+  case 532:
+#line 2850 "util/configparser.y"
     {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append_ex(&cfg_parser->cfg->python_script, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5758 "util/configparser.c" /* yacc.c:1646  */
+#line 5937 "util/configparser.c"
     break;
 
-  case 510:
-#line 2745 "util/configparser.y" /* yacc.c:1646  */
+  case 533:
+#line 2856 "util/configparser.y"
     {
 		OUTYY(("P(disable_dnssec_lame_check:%s)\n", (yyvsp[0].str)));
 		if (strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5767,21 +5946,21 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5771 "util/configparser.c" /* yacc.c:1646  */
+#line 5950 "util/configparser.c"
     break;
 
-  case 511:
-#line 2755 "util/configparser.y" /* yacc.c:1646  */
+  case 534:
+#line 2866 "util/configparser.y"
     {
 		OUTYY(("P(server_log_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->log_identity);
 		cfg_parser->cfg->log_identity = (yyvsp[0].str);
 	}
-#line 5781 "util/configparser.c" /* yacc.c:1646  */
+#line 5960 "util/configparser.c"
     break;
 
-  case 512:
-#line 2762 "util/configparser.y" /* yacc.c:1646  */
+  case 535:
+#line 2873 "util/configparser.y"
     {
 		OUTYY(("P(server_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -5789,30 +5968,30 @@ yyreduce:
 			(yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip");
 	}
-#line 5793 "util/configparser.c" /* yacc.c:1646  */
+#line 5972 "util/configparser.c"
     break;
 
-  case 513:
-#line 2771 "util/configparser.y" /* yacc.c:1646  */
+  case 536:
+#line 2882 "util/configparser.y"
     {
 		OUTYY(("P(server_response_ip_data:%s)\n", (yyvsp[-1].str)));
 		if(!cfg_str2list_insert(&cfg_parser->cfg->respip_data,
 			(yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip-data");
 	}
-#line 5804 "util/configparser.c" /* yacc.c:1646  */
+#line 5983 "util/configparser.c"
     break;
 
-  case 514:
-#line 2779 "util/configparser.y" /* yacc.c:1646  */
+  case 537:
+#line 2890 "util/configparser.y"
     {
 		OUTYY(("\nP(dnscrypt:)\n"));
 	}
-#line 5812 "util/configparser.c" /* yacc.c:1646  */
+#line 5991 "util/configparser.c"
     break;
 
-  case 527:
-#line 2795 "util/configparser.y" /* yacc.c:1646  */
+  case 550:
+#line 2906 "util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5820,11 +5999,11 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5824 "util/configparser.c" /* yacc.c:1646  */
+#line 6003 "util/configparser.c"
     break;
 
-  case 528:
-#line 2805 "util/configparser.y" /* yacc.c:1646  */
+  case 551:
+#line 2916 "util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -5832,21 +6011,21 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5836 "util/configparser.c" /* yacc.c:1646  */
+#line 6015 "util/configparser.c"
     break;
 
-  case 529:
-#line 2814 "util/configparser.y" /* yacc.c:1646  */
+  case 552:
+#line 2925 "util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_provider:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnscrypt_provider);
 		cfg_parser->cfg->dnscrypt_provider = (yyvsp[0].str);
 	}
-#line 5846 "util/configparser.c" /* yacc.c:1646  */
+#line 6025 "util/configparser.c"
     break;
 
-  case 530:
-#line 2821 "util/configparser.y" /* yacc.c:1646  */
+  case 553:
+#line 2932 "util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_provider_cert:%s)\n", (yyvsp[0].str)));
 		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
@@ -5854,21 +6033,21 @@ yyreduce:
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-provider-cert");
 	}
-#line 5858 "util/configparser.c" /* yacc.c:1646  */
+#line 6037 "util/configparser.c"
     break;
 
-  case 531:
-#line 2830 "util/configparser.y" /* yacc.c:1646  */
+  case 554:
+#line 2941 "util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_provider_cert_rotated:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert_rotated, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-provider-cert-rotated");
 	}
-#line 5868 "util/configparser.c" /* yacc.c:1646  */
+#line 6047 "util/configparser.c"
     break;
 
-  case 532:
-#line 2837 "util/configparser.y" /* yacc.c:1646  */
+  case 555:
+#line 2948 "util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_secret_key:%s)\n", (yyvsp[0].str)));
 		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
@@ -5876,22 +6055,22 @@ yyreduce:
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-secret-key");
 	}
-#line 5880 "util/configparser.c" /* yacc.c:1646  */
+#line 6059 "util/configparser.c"
     break;
 
-  case 533:
-#line 2846 "util/configparser.y" /* yacc.c:1646  */
+  case 556:
+#line 2957 "util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 5891 "util/configparser.c" /* yacc.c:1646  */
+#line 6070 "util/configparser.c"
     break;
 
-  case 534:
-#line 2854 "util/configparser.y" /* yacc.c:1646  */
+  case 557:
+#line 2965 "util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -5903,22 +6082,22 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 5907 "util/configparser.c" /* yacc.c:1646  */
+#line 6086 "util/configparser.c"
     break;
 
-  case 535:
-#line 2867 "util/configparser.y" /* yacc.c:1646  */
+  case 558:
+#line 2978 "util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_nonce_cache_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 5918 "util/configparser.c" /* yacc.c:1646  */
+#line 6097 "util/configparser.c"
     break;
 
-  case 536:
-#line 2875 "util/configparser.y" /* yacc.c:1646  */
+  case 559:
+#line 2986 "util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -5930,25 +6109,22 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 5934 "util/configparser.c" /* yacc.c:1646  */
+#line 6113 "util/configparser.c"
     break;
 
-  case 537:
-#line 2888 "util/configparser.y" /* yacc.c:1646  */
+  case 560:
+#line 2999 "util/configparser.y"
     {
 		OUTYY(("\nP(cachedb:)\n"));
 	}
-#line 5942 "util/configparser.c" /* yacc.c:1646  */
+#line 6121 "util/configparser.c"
     break;
 
-  case 545:
-#line 2898 "util/configparser.y" /* yacc.c:1646  */
+  case 568:
+#line 3009 "util/configparser.y"
     {
 	#ifdef USE_CACHEDB
 		OUTYY(("P(backend:%s)\n", (yyvsp[0].str)));
-		if(cfg_parser->cfg->cachedb_backend)
-			yyerror("cachedb backend override, there must be one "
-				"backend");
 		free(cfg_parser->cfg->cachedb_backend);
 		cfg_parser->cfg->cachedb_backend = (yyvsp[0].str);
 	#else
@@ -5956,17 +6132,14 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5960 "util/configparser.c" /* yacc.c:1646  */
+#line 6136 "util/configparser.c"
     break;
 
-  case 546:
-#line 2913 "util/configparser.y" /* yacc.c:1646  */
+  case 569:
+#line 3021 "util/configparser.y"
     {
 	#ifdef USE_CACHEDB
 		OUTYY(("P(secret-seed:%s)\n", (yyvsp[0].str)));
-		if(cfg_parser->cfg->cachedb_secret)
-			yyerror("cachedb secret-seed override, there must be "
-				"only one secret");
 		free(cfg_parser->cfg->cachedb_secret);
 		cfg_parser->cfg->cachedb_secret = (yyvsp[0].str);
 	#else
@@ -5974,11 +6147,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5978 "util/configparser.c" /* yacc.c:1646  */
+#line 6151 "util/configparser.c"
     break;
 
-  case 547:
-#line 2928 "util/configparser.y" /* yacc.c:1646  */
+  case 570:
+#line 3033 "util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_server_host:%s)\n", (yyvsp[0].str)));
@@ -5989,11 +6162,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5993 "util/configparser.c" /* yacc.c:1646  */
+#line 6166 "util/configparser.c"
     break;
 
-  case 548:
-#line 2940 "util/configparser.y" /* yacc.c:1646  */
+  case 571:
+#line 3045 "util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		int port;
@@ -6007,11 +6180,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6011 "util/configparser.c" /* yacc.c:1646  */
+#line 6184 "util/configparser.c"
     break;
 
-  case 549:
-#line 2955 "util/configparser.y" /* yacc.c:1646  */
+  case 572:
+#line 3060 "util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_timeout:%s)\n", (yyvsp[0].str)));
@@ -6023,11 +6196,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6027 "util/configparser.c" /* yacc.c:1646  */
+#line 6200 "util/configparser.c"
     break;
 
-  case 550:
-#line 2968 "util/configparser.y" /* yacc.c:1646  */
+  case 573:
+#line 3073 "util/configparser.y"
     {
 		OUTYY(("P(server_tcp_connection_limit:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if (atoi((yyvsp[0].str)) < 0)
@@ -6037,19 +6210,19 @@ yyreduce:
 				fatal_exit("out of memory adding tcp connection limit");
 		}
 	}
-#line 6041 "util/configparser.c" /* yacc.c:1646  */
+#line 6214 "util/configparser.c"
     break;
 
-  case 551:
-#line 2979 "util/configparser.y" /* yacc.c:1646  */
+  case 574:
+#line 3084 "util/configparser.y"
     {
 			OUTYY(("\nP(ipset:)\n"));
 		}
-#line 6049 "util/configparser.c" /* yacc.c:1646  */
+#line 6222 "util/configparser.c"
     break;
 
-  case 556:
-#line 2988 "util/configparser.y" /* yacc.c:1646  */
+  case 579:
+#line 3093 "util/configparser.y"
     {
 		#ifdef USE_IPSET
 			OUTYY(("P(name-v4:%s)\n", (yyvsp[0].str)));
@@ -6063,11 +6236,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		#endif
 		}
-#line 6067 "util/configparser.c" /* yacc.c:1646  */
+#line 6240 "util/configparser.c"
     break;
 
-  case 557:
-#line 3003 "util/configparser.y" /* yacc.c:1646  */
+  case 580:
+#line 3108 "util/configparser.y"
     {
 		#ifdef USE_IPSET
 			OUTYY(("P(name-v6:%s)\n", (yyvsp[0].str)));
@@ -6081,11 +6254,12 @@ yyreduce:
 			free((yyvsp[0].str));
 		#endif
 		}
-#line 6085 "util/configparser.c" /* yacc.c:1646  */
+#line 6258 "util/configparser.c"
     break;
 
 
-#line 6089 "util/configparser.c" /* yacc.c:1646  */
+#line 6262 "util/configparser.c"
+
       default: break;
     }
   /* User semantic actions sometimes alter yychar, and that requires
@@ -6110,14 +6284,13 @@ yyreduce:
   /* Now 'shift' the result of the reduction.  Determine what state
      that goes to, based on the state we popped back to and the rule
      number reduced by.  */
-
-  yyn = yyr1[yyn];
-
-  yystate = yypgoto[yyn - YYNTOKENS] + *yyssp;
-  if (0 <= yystate && yystate <= YYLAST && yycheck[yystate] == *yyssp)
-    yystate = yytable[yystate];
-  else
-    yystate = yydefgoto[yyn - YYNTOKENS];
+  {
+    const int yylhs = yyr1[yyn] - YYNTOKENS;
+    const int yyi = yypgoto[yylhs] + *yyssp;
+    yystate = (0 <= yyi && yyi <= YYLAST && yycheck[yyi] == *yyssp
+               ? yytable[yyi]
+               : yydefgoto[yylhs]);
+  }
 
   goto yynewstate;
 
@@ -6200,12 +6373,10 @@ yyerrlab:
 | yyerrorlab -- error raised explicitly by YYERROR.  |
 `---------------------------------------------------*/
 yyerrorlab:
-
-  /* Pacify compilers like GCC when the user code never invokes
-     YYERROR and the label yyerrorlab therefore never appears in user
-     code.  */
-  if (/*CONSTCOND*/ 0)
-     goto yyerrorlab;
+  /* Pacify compilers when the user code never invokes YYERROR and the
+     label yyerrorlab therefore never appears in user code.  */
+  if (0)
+    YYERROR;
 
   /* Do not reclaim the symbols of the rule whose action triggered
      this YYERROR.  */
@@ -6267,6 +6438,7 @@ yyacceptlab:
   yyresult = 0;
   goto yyreturn;
 
+
 /*-----------------------------------.
 | yyabortlab -- YYABORT comes here.  |
 `-----------------------------------*/
@@ -6274,6 +6446,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
+
 #if !defined yyoverflow || YYERROR_VERBOSE
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
@@ -6284,6 +6457,10 @@ yyexhaustedlab:
   /* Fall through.  */
 #endif
 
+
+/*-----------------------------------------------------.
+| yyreturn -- parsing is finished, return the result.  |
+`-----------------------------------------------------*/
 yyreturn:
   if (yychar != YYEMPTY)
     {
@@ -6313,7 +6490,7 @@ yyreturn:
 #endif
   return yyresult;
 }
-#line 3017 "util/configparser.y" /* yacc.c:1906  */
+#line 3122 "util/configparser.y"
 
 
 /* parse helper routines could be here */
diff --git a/util/configparser.h b/util/configparser.h
index 4a883d1020b4..3e8effb5bfa4 100644
--- a/util/configparser.h
+++ b/util/configparser.h
@@ -1,8 +1,9 @@
-/* A Bison parser, made by GNU Bison 3.0.4.  */
+/* A Bison parser, made by GNU Bison 3.4.1.  */
 
 /* Bison interface for Yacc-like parsers in C
 
-   Copyright (C) 1984, 1989-1990, 2000-2015 Free Software Foundation, Inc.
+   Copyright (C) 1984, 1989-1990, 2000-2015, 2018-2019 Free Software Foundation,
+   Inc.
 
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -30,6 +31,9 @@
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
+/* Undocumented macros, especially those whose name start with YY_,
+   are private implementation details.  Do not rely on them.  */
+
 #ifndef YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
 # define YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
 /* Debug traces.  */
@@ -250,68 +254,76 @@ extern int yydebug;
     VAR_SERVE_EXPIRED = 460,
     VAR_SERVE_EXPIRED_TTL = 461,
     VAR_SERVE_EXPIRED_TTL_RESET = 462,
-    VAR_FAKE_DSA = 463,
-    VAR_FAKE_SHA1 = 464,
-    VAR_LOG_IDENTITY = 465,
-    VAR_HIDE_TRUSTANCHOR = 466,
-    VAR_TRUST_ANCHOR_SIGNALING = 467,
-    VAR_AGGRESSIVE_NSEC = 468,
-    VAR_USE_SYSTEMD = 469,
-    VAR_SHM_ENABLE = 470,
-    VAR_SHM_KEY = 471,
-    VAR_ROOT_KEY_SENTINEL = 472,
-    VAR_DNSCRYPT = 473,
-    VAR_DNSCRYPT_ENABLE = 474,
-    VAR_DNSCRYPT_PORT = 475,
-    VAR_DNSCRYPT_PROVIDER = 476,
-    VAR_DNSCRYPT_SECRET_KEY = 477,
-    VAR_DNSCRYPT_PROVIDER_CERT = 478,
-    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 479,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 480,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 481,
-    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 482,
-    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 483,
-    VAR_IPSECMOD_ENABLED = 484,
-    VAR_IPSECMOD_HOOK = 485,
-    VAR_IPSECMOD_IGNORE_BOGUS = 486,
-    VAR_IPSECMOD_MAX_TTL = 487,
-    VAR_IPSECMOD_WHITELIST = 488,
-    VAR_IPSECMOD_STRICT = 489,
-    VAR_CACHEDB = 490,
-    VAR_CACHEDB_BACKEND = 491,
-    VAR_CACHEDB_SECRETSEED = 492,
-    VAR_CACHEDB_REDISHOST = 493,
-    VAR_CACHEDB_REDISPORT = 494,
-    VAR_CACHEDB_REDISTIMEOUT = 495,
-    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 496,
-    VAR_FOR_UPSTREAM = 497,
-    VAR_AUTH_ZONE = 498,
-    VAR_ZONEFILE = 499,
-    VAR_MASTER = 500,
-    VAR_URL = 501,
-    VAR_FOR_DOWNSTREAM = 502,
-    VAR_FALLBACK_ENABLED = 503,
-    VAR_TLS_ADDITIONAL_PORT = 504,
-    VAR_LOW_RTT = 505,
-    VAR_LOW_RTT_PERMIL = 506,
-    VAR_FAST_SERVER_PERMIL = 507,
-    VAR_FAST_SERVER_NUM = 508,
-    VAR_ALLOW_NOTIFY = 509,
-    VAR_TLS_WIN_CERT = 510,
-    VAR_TCP_CONNECTION_LIMIT = 511,
-    VAR_FORWARD_NO_CACHE = 512,
-    VAR_STUB_NO_CACHE = 513,
-    VAR_LOG_SERVFAIL = 514,
-    VAR_DENY_ANY = 515,
-    VAR_UNKNOWN_SERVER_TIME_LIMIT = 516,
-    VAR_LOG_TAG_QUERYREPLY = 517,
-    VAR_STREAM_WAIT_SIZE = 518,
-    VAR_TLS_CIPHERS = 519,
-    VAR_TLS_CIPHERSUITES = 520,
-    VAR_TLS_SESSION_TICKET_KEYS = 521,
-    VAR_IPSET = 522,
-    VAR_IPSET_NAME_V4 = 523,
-    VAR_IPSET_NAME_V6 = 524
+    VAR_SERVE_EXPIRED_REPLY_TTL = 463,
+    VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 464,
+    VAR_FAKE_DSA = 465,
+    VAR_FAKE_SHA1 = 466,
+    VAR_LOG_IDENTITY = 467,
+    VAR_HIDE_TRUSTANCHOR = 468,
+    VAR_TRUST_ANCHOR_SIGNALING = 469,
+    VAR_AGGRESSIVE_NSEC = 470,
+    VAR_USE_SYSTEMD = 471,
+    VAR_SHM_ENABLE = 472,
+    VAR_SHM_KEY = 473,
+    VAR_ROOT_KEY_SENTINEL = 474,
+    VAR_DNSCRYPT = 475,
+    VAR_DNSCRYPT_ENABLE = 476,
+    VAR_DNSCRYPT_PORT = 477,
+    VAR_DNSCRYPT_PROVIDER = 478,
+    VAR_DNSCRYPT_SECRET_KEY = 479,
+    VAR_DNSCRYPT_PROVIDER_CERT = 480,
+    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 481,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 482,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 483,
+    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 484,
+    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 485,
+    VAR_IPSECMOD_ENABLED = 486,
+    VAR_IPSECMOD_HOOK = 487,
+    VAR_IPSECMOD_IGNORE_BOGUS = 488,
+    VAR_IPSECMOD_MAX_TTL = 489,
+    VAR_IPSECMOD_WHITELIST = 490,
+    VAR_IPSECMOD_STRICT = 491,
+    VAR_CACHEDB = 492,
+    VAR_CACHEDB_BACKEND = 493,
+    VAR_CACHEDB_SECRETSEED = 494,
+    VAR_CACHEDB_REDISHOST = 495,
+    VAR_CACHEDB_REDISPORT = 496,
+    VAR_CACHEDB_REDISTIMEOUT = 497,
+    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 498,
+    VAR_FOR_UPSTREAM = 499,
+    VAR_AUTH_ZONE = 500,
+    VAR_ZONEFILE = 501,
+    VAR_MASTER = 502,
+    VAR_URL = 503,
+    VAR_FOR_DOWNSTREAM = 504,
+    VAR_FALLBACK_ENABLED = 505,
+    VAR_TLS_ADDITIONAL_PORT = 506,
+    VAR_LOW_RTT = 507,
+    VAR_LOW_RTT_PERMIL = 508,
+    VAR_FAST_SERVER_PERMIL = 509,
+    VAR_FAST_SERVER_NUM = 510,
+    VAR_ALLOW_NOTIFY = 511,
+    VAR_TLS_WIN_CERT = 512,
+    VAR_TCP_CONNECTION_LIMIT = 513,
+    VAR_FORWARD_NO_CACHE = 514,
+    VAR_STUB_NO_CACHE = 515,
+    VAR_LOG_SERVFAIL = 516,
+    VAR_DENY_ANY = 517,
+    VAR_UNKNOWN_SERVER_TIME_LIMIT = 518,
+    VAR_LOG_TAG_QUERYREPLY = 519,
+    VAR_STREAM_WAIT_SIZE = 520,
+    VAR_TLS_CIPHERS = 521,
+    VAR_TLS_CIPHERSUITES = 522,
+    VAR_IPSET = 523,
+    VAR_IPSET_NAME_V4 = 524,
+    VAR_IPSET_NAME_V6 = 525,
+    VAR_TLS_SESSION_TICKET_KEYS = 526,
+    VAR_RPZ = 527,
+    VAR_TAGS = 528,
+    VAR_RPZ_ACTION_OVERRIDE = 529,
+    VAR_RPZ_CNAME_OVERRIDE = 530,
+    VAR_RPZ_LOG = 531,
+    VAR_RPZ_LOG_NAME = 532
   };
 #endif
 /* Tokens.  */
@@ -520,81 +532,88 @@ extern int yydebug;
 #define VAR_SERVE_EXPIRED 460
 #define VAR_SERVE_EXPIRED_TTL 461
 #define VAR_SERVE_EXPIRED_TTL_RESET 462
-#define VAR_FAKE_DSA 463
-#define VAR_FAKE_SHA1 464
-#define VAR_LOG_IDENTITY 465
-#define VAR_HIDE_TRUSTANCHOR 466
-#define VAR_TRUST_ANCHOR_SIGNALING 467
-#define VAR_AGGRESSIVE_NSEC 468
-#define VAR_USE_SYSTEMD 469
-#define VAR_SHM_ENABLE 470
-#define VAR_SHM_KEY 471
-#define VAR_ROOT_KEY_SENTINEL 472
-#define VAR_DNSCRYPT 473
-#define VAR_DNSCRYPT_ENABLE 474
-#define VAR_DNSCRYPT_PORT 475
-#define VAR_DNSCRYPT_PROVIDER 476
-#define VAR_DNSCRYPT_SECRET_KEY 477
-#define VAR_DNSCRYPT_PROVIDER_CERT 478
-#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 479
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 480
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 481
-#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 482
-#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 483
-#define VAR_IPSECMOD_ENABLED 484
-#define VAR_IPSECMOD_HOOK 485
-#define VAR_IPSECMOD_IGNORE_BOGUS 486
-#define VAR_IPSECMOD_MAX_TTL 487
-#define VAR_IPSECMOD_WHITELIST 488
-#define VAR_IPSECMOD_STRICT 489
-#define VAR_CACHEDB 490
-#define VAR_CACHEDB_BACKEND 491
-#define VAR_CACHEDB_SECRETSEED 492
-#define VAR_CACHEDB_REDISHOST 493
-#define VAR_CACHEDB_REDISPORT 494
-#define VAR_CACHEDB_REDISTIMEOUT 495
-#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 496
-#define VAR_FOR_UPSTREAM 497
-#define VAR_AUTH_ZONE 498
-#define VAR_ZONEFILE 499
-#define VAR_MASTER 500
-#define VAR_URL 501
-#define VAR_FOR_DOWNSTREAM 502
-#define VAR_FALLBACK_ENABLED 503
-#define VAR_TLS_ADDITIONAL_PORT 504
-#define VAR_LOW_RTT 505
-#define VAR_LOW_RTT_PERMIL 506
-#define VAR_FAST_SERVER_PERMIL 507
-#define VAR_FAST_SERVER_NUM 508
-#define VAR_ALLOW_NOTIFY 509
-#define VAR_TLS_WIN_CERT 510
-#define VAR_TCP_CONNECTION_LIMIT 511
-#define VAR_FORWARD_NO_CACHE 512
-#define VAR_STUB_NO_CACHE 513
-#define VAR_LOG_SERVFAIL 514
-#define VAR_DENY_ANY 515
-#define VAR_UNKNOWN_SERVER_TIME_LIMIT 516
-#define VAR_LOG_TAG_QUERYREPLY 517
-#define VAR_STREAM_WAIT_SIZE 518
-#define VAR_TLS_CIPHERS 519
-#define VAR_TLS_CIPHERSUITES 520
-#define VAR_TLS_SESSION_TICKET_KEYS 521
-#define VAR_IPSET 522
-#define VAR_IPSET_NAME_V4 523
-#define VAR_IPSET_NAME_V6 524
+#define VAR_SERVE_EXPIRED_REPLY_TTL 463
+#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 464
+#define VAR_FAKE_DSA 465
+#define VAR_FAKE_SHA1 466
+#define VAR_LOG_IDENTITY 467
+#define VAR_HIDE_TRUSTANCHOR 468
+#define VAR_TRUST_ANCHOR_SIGNALING 469
+#define VAR_AGGRESSIVE_NSEC 470
+#define VAR_USE_SYSTEMD 471
+#define VAR_SHM_ENABLE 472
+#define VAR_SHM_KEY 473
+#define VAR_ROOT_KEY_SENTINEL 474
+#define VAR_DNSCRYPT 475
+#define VAR_DNSCRYPT_ENABLE 476
+#define VAR_DNSCRYPT_PORT 477
+#define VAR_DNSCRYPT_PROVIDER 478
+#define VAR_DNSCRYPT_SECRET_KEY 479
+#define VAR_DNSCRYPT_PROVIDER_CERT 480
+#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 481
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 482
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 483
+#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 484
+#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 485
+#define VAR_IPSECMOD_ENABLED 486
+#define VAR_IPSECMOD_HOOK 487
+#define VAR_IPSECMOD_IGNORE_BOGUS 488
+#define VAR_IPSECMOD_MAX_TTL 489
+#define VAR_IPSECMOD_WHITELIST 490
+#define VAR_IPSECMOD_STRICT 491
+#define VAR_CACHEDB 492
+#define VAR_CACHEDB_BACKEND 493
+#define VAR_CACHEDB_SECRETSEED 494
+#define VAR_CACHEDB_REDISHOST 495
+#define VAR_CACHEDB_REDISPORT 496
+#define VAR_CACHEDB_REDISTIMEOUT 497
+#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 498
+#define VAR_FOR_UPSTREAM 499
+#define VAR_AUTH_ZONE 500
+#define VAR_ZONEFILE 501
+#define VAR_MASTER 502
+#define VAR_URL 503
+#define VAR_FOR_DOWNSTREAM 504
+#define VAR_FALLBACK_ENABLED 505
+#define VAR_TLS_ADDITIONAL_PORT 506
+#define VAR_LOW_RTT 507
+#define VAR_LOW_RTT_PERMIL 508
+#define VAR_FAST_SERVER_PERMIL 509
+#define VAR_FAST_SERVER_NUM 510
+#define VAR_ALLOW_NOTIFY 511
+#define VAR_TLS_WIN_CERT 512
+#define VAR_TCP_CONNECTION_LIMIT 513
+#define VAR_FORWARD_NO_CACHE 514
+#define VAR_STUB_NO_CACHE 515
+#define VAR_LOG_SERVFAIL 516
+#define VAR_DENY_ANY 517
+#define VAR_UNKNOWN_SERVER_TIME_LIMIT 518
+#define VAR_LOG_TAG_QUERYREPLY 519
+#define VAR_STREAM_WAIT_SIZE 520
+#define VAR_TLS_CIPHERS 521
+#define VAR_TLS_CIPHERSUITES 522
+#define VAR_IPSET 523
+#define VAR_IPSET_NAME_V4 524
+#define VAR_IPSET_NAME_V6 525
+#define VAR_TLS_SESSION_TICKET_KEYS 526
+#define VAR_RPZ 527
+#define VAR_TAGS 528
+#define VAR_RPZ_ACTION_OVERRIDE 529
+#define VAR_RPZ_CNAME_OVERRIDE 530
+#define VAR_RPZ_LOG 531
+#define VAR_RPZ_LOG_NAME 532
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-
 union YYSTYPE
 {
-#line 66 "util/configparser.y" /* yacc.c:1909  */
+#line 66 "util/configparser.y"
 
 	char*	str;
 
-#line 596 "util/configparser.h" /* yacc.c:1909  */
-};
+#line 615 "util/configparser.h"
 
+};
 typedef union YYSTYPE YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define YYSTYPE_IS_DECLARED 1
diff --git a/util/configparser.y b/util/configparser.y
index 10227a2ff7ff..798f4a972fd8 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -143,10 +143,11 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_LOCAL_ZONE_OVERRIDE VAR_ACCESS_CONTROL_TAG_ACTION
 %token VAR_ACCESS_CONTROL_TAG_DATA VAR_VIEW VAR_ACCESS_CONTROL_VIEW
 %token VAR_VIEW_FIRST VAR_SERVE_EXPIRED VAR_SERVE_EXPIRED_TTL
-%token VAR_SERVE_EXPIRED_TTL_RESET VAR_FAKE_DSA VAR_FAKE_SHA1
-%token VAR_LOG_IDENTITY VAR_HIDE_TRUSTANCHOR VAR_TRUST_ANCHOR_SIGNALING
-%token VAR_AGGRESSIVE_NSEC VAR_USE_SYSTEMD VAR_SHM_ENABLE VAR_SHM_KEY
-%token VAR_ROOT_KEY_SENTINEL
+%token VAR_SERVE_EXPIRED_TTL_RESET VAR_SERVE_EXPIRED_REPLY_TTL
+%token VAR_SERVE_EXPIRED_CLIENT_TIMEOUT VAR_FAKE_DSA
+%token VAR_FAKE_SHA1 VAR_LOG_IDENTITY VAR_HIDE_TRUSTANCHOR
+%token VAR_TRUST_ANCHOR_SIGNALING VAR_AGGRESSIVE_NSEC VAR_USE_SYSTEMD
+%token VAR_SHM_ENABLE VAR_SHM_KEY VAR_ROOT_KEY_SENTINEL
 %token VAR_DNSCRYPT VAR_DNSCRYPT_ENABLE VAR_DNSCRYPT_PORT VAR_DNSCRYPT_PROVIDER
 %token VAR_DNSCRYPT_SECRET_KEY VAR_DNSCRYPT_PROVIDER_CERT
 %token VAR_DNSCRYPT_PROVIDER_CERT_ROTATED
@@ -166,8 +167,9 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL VAR_DENY_ANY
 %token VAR_UNKNOWN_SERVER_TIME_LIMIT VAR_LOG_TAG_QUERYREPLY
 %token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES
-%token VAR_TLS_SESSION_TICKET_KEYS
 %token VAR_IPSET VAR_IPSET_NAME_V4 VAR_IPSET_NAME_V6
+%token VAR_TLS_SESSION_TICKET_KEYS VAR_RPZ VAR_TAGS VAR_RPZ_ACTION_OVERRIDE
+%token VAR_RPZ_CNAME_OVERRIDE VAR_RPZ_LOG VAR_RPZ_LOG_NAME
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -175,7 +177,8 @@ toplevelvar: serverstart contents_server | stubstart contents_stub |
 	forwardstart contents_forward | pythonstart contents_py | 
 	rcstart contents_rc | dtstart contents_dt | viewstart contents_view |
 	dnscstart contents_dnsc | cachedbstart contents_cachedb |
-	ipsetstart contents_ipset | authstart contents_auth
+	ipsetstart contents_ipset | authstart contents_auth |
+	rpzstart contents_rpz
 	;
 
 /* server: declaration */
@@ -254,6 +257,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_access_control_tag_data | server_access_control_view |
 	server_qname_minimisation_strict | server_serve_expired |
 	server_serve_expired_ttl | server_serve_expired_ttl_reset |
+	server_serve_expired_reply_ttl | server_serve_expired_client_timeout |
 	server_fake_dsa | server_log_identity | server_use_systemd |
 	server_response_ip_tag | server_response_ip | server_response_ip_data |
 	server_shm_enable | server_shm_key | server_fake_sha1 |
@@ -335,6 +339,7 @@ authstart: VAR_AUTH_ZONE
 			s->for_downstream = 1;
 			s->for_upstream = 1;
 			s->fallback_enabled = 0;
+			s->isrpz = 0;
 		} else 
 			yyerror("out of memory");
 	}
@@ -345,6 +350,92 @@ content_auth: auth_name | auth_zonefile | auth_master | auth_url |
 	auth_for_downstream | auth_for_upstream | auth_fallback_enabled |
 	auth_allow_notify
 	;
+
+rpz_tag: VAR_TAGS STRING_ARG
+	{
+		uint8_t* bitlist;
+		size_t len = 0;
+		OUTYY(("P(server_local_zone_tag:%s)\n", $2));
+		bitlist = config_parse_taglist(cfg_parser->cfg, $2,
+			&len);
+		free($2);
+		if(!bitlist) {
+			yyerror("could not parse tags, (define-tag them first)");
+		}
+		if(bitlist) {
+			cfg_parser->cfg->auths->rpz_taglist = bitlist;
+			cfg_parser->cfg->auths->rpz_taglistlen = len;
+
+		}
+	}
+	;
+
+rpz_action_override: VAR_RPZ_ACTION_OVERRIDE STRING_ARG
+	{
+		OUTYY(("P(rpz_action_override:%s)\n", $2));
+		if(strcmp($2, "nxdomain")!=0 && strcmp($2, "nodata")!=0 &&
+		   strcmp($2, "passthru")!=0 && strcmp($2, "drop")!=0 &&
+		   strcmp($2, "cname")!=0 && strcmp($2, "disabled")!=0) {
+			yyerror("rpz-action-override action: expected nxdomain, "
+				"nodata, passthru, drop, cname or disabled");
+			free($2);
+			cfg_parser->cfg->auths->rpz_action_override = NULL;
+		}
+		else {
+			cfg_parser->cfg->auths->rpz_action_override = $2;
+		}
+	}
+	;
+
+rpz_cname_override: VAR_RPZ_CNAME_OVERRIDE STRING_ARG
+	{
+		OUTYY(("P(rpz_cname_override:%s)\n", $2));
+		free(cfg_parser->cfg->auths->rpz_cname);
+		cfg_parser->cfg->auths->rpz_cname = $2;
+	}
+	;
+
+rpz_log: VAR_RPZ_LOG STRING_ARG
+	{
+		OUTYY(("P(rpz_log:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->auths->rpz_log = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
+
+rpz_log_name: VAR_RPZ_LOG_NAME STRING_ARG
+	{
+		OUTYY(("P(rpz_log_name:%s)\n", $2));
+		free(cfg_parser->cfg->auths->rpz_log_name);
+		cfg_parser->cfg->auths->rpz_log_name = $2;
+	}
+	;
+
+rpzstart: VAR_RPZ
+	{
+		struct config_auth* s;
+		OUTYY(("\nP(rpz:)\n")); 
+		s = (struct config_auth*)calloc(1, sizeof(struct config_auth));
+		if(s) {
+			s->next = cfg_parser->cfg->auths;
+			cfg_parser->cfg->auths = s;
+			/* defaults for RPZ auth zone */
+			s->for_downstream = 0;
+			s->for_upstream = 0;
+			s->fallback_enabled = 0;
+			s->isrpz = 1;
+		} else 
+			yyerror("out of memory");
+	}
+	;
+contents_rpz: contents_rpz content_rpz 
+	| ;
+content_rpz: auth_name | auth_zonefile | rpz_tag | auth_master | auth_url |
+	   auth_allow_notify | rpz_action_override | rpz_cname_override |
+	   rpz_log | rpz_log_name
+	;
 server_num_threads: VAR_NUM_THREADS STRING_ARG 
 	{ 
 		OUTYY(("P(server_num_threads:%s)\n", $2)); 
@@ -429,6 +520,7 @@ server_send_client_subnet: VAR_SEND_CLIENT_SUBNET STRING_ARG
 			fatal_exit("out of memory adding client-subnet");
 	#else
 		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+		free($2);
 	#endif
 	}
 	;
@@ -441,6 +533,7 @@ server_client_subnet_zone: VAR_CLIENT_SUBNET_ZONE STRING_ARG
 			fatal_exit("out of memory adding client-subnet-zone");
 	#else
 		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+		free($2);
 	#endif
 	}
 	;
@@ -1666,12 +1759,30 @@ server_serve_expired_ttl_reset: VAR_SERVE_EXPIRED_TTL_RESET STRING_ARG
 		free($2);
 	}
 	;
+server_serve_expired_reply_ttl: VAR_SERVE_EXPIRED_REPLY_TTL STRING_ARG
+	{
+		OUTYY(("P(server_serve_expired_reply_ttl:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->serve_expired_reply_ttl = atoi($2);
+		free($2);
+	}
+	;
+server_serve_expired_client_timeout: VAR_SERVE_EXPIRED_CLIENT_TIMEOUT STRING_ARG
+	{
+		OUTYY(("P(server_serve_expired_client_timeout:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->serve_expired_client_timeout = atoi($2);
+		free($2);
+	}
+	;
 server_fake_dsa: VAR_FAKE_DSA STRING_ARG
 	{
 		OUTYY(("P(server_fake_dsa:%s)\n", $2));
 		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
 			yyerror("expected yes or no.");
-#ifdef HAVE_SSL
+#if defined(HAVE_SSL) || defined(HAVE_NETTLE)
 		else fake_dsa = (strcmp($2, "yes")==0);
 		if(fake_dsa)
 			log_warn("test option fake_dsa is enabled");
@@ -1684,7 +1795,7 @@ server_fake_sha1: VAR_FAKE_SHA1 STRING_ARG
 		OUTYY(("P(server_fake_sha1:%s)\n", $2));
 		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
 			yyerror("expected yes or no.");
-#ifdef HAVE_SSL
+#if defined(HAVE_SSL) || defined(HAVE_NETTLE)
 		else fake_sha1 = (strcmp($2, "yes")==0);
 		if(fake_sha1)
 			log_warn("test option fake_sha1 is enabled");
@@ -2898,9 +3009,6 @@ cachedb_backend_name: VAR_CACHEDB_BACKEND STRING_ARG
 	{
 	#ifdef USE_CACHEDB
 		OUTYY(("P(backend:%s)\n", $2));
-		if(cfg_parser->cfg->cachedb_backend)
-			yyerror("cachedb backend override, there must be one "
-				"backend");
 		free(cfg_parser->cfg->cachedb_backend);
 		cfg_parser->cfg->cachedb_backend = $2;
 	#else
@@ -2913,9 +3021,6 @@ cachedb_secret_seed: VAR_CACHEDB_SECRETSEED STRING_ARG
 	{
 	#ifdef USE_CACHEDB
 		OUTYY(("P(secret-seed:%s)\n", $2));
-		if(cfg_parser->cfg->cachedb_secret)
-			yyerror("cachedb secret-seed override, there must be "
-				"only one secret");
 		free(cfg_parser->cfg->cachedb_secret);
 		cfg_parser->cfg->cachedb_secret = $2;
 	#else
diff --git a/util/data/dname.c b/util/data/dname.c
index 9f25e1efe204..76b2ec7d6d8a 100644
--- a/util/data/dname.c
+++ b/util/data/dname.c
@@ -233,17 +233,28 @@ int
 dname_pkt_compare(sldns_buffer* pkt, uint8_t* d1, uint8_t* d2)
 {
 	uint8_t len1, len2;
+	int count1 = 0, count2 = 0;
 	log_assert(pkt && d1 && d2);
 	len1 = *d1++;
 	len2 = *d2++;
 	while( len1 != 0 || len2 != 0 ) {
 		/* resolve ptrs */
 		if(LABEL_IS_PTR(len1)) {
+			if((size_t)PTR_OFFSET(len1, *d1)
+				>= sldns_buffer_limit(pkt))
+				return -1;
+			if(count1++ > MAX_COMPRESS_PTRS)
+				return -1;
 			d1 = sldns_buffer_at(pkt, PTR_OFFSET(len1, *d1));
 			len1 = *d1++;
 			continue;
 		}
 		if(LABEL_IS_PTR(len2)) {
+			if((size_t)PTR_OFFSET(len2, *d2)
+				>= sldns_buffer_limit(pkt))
+				return 1;
+			if(count2++ > MAX_COMPRESS_PTRS)
+				return 1;
 			d2 = sldns_buffer_at(pkt, PTR_OFFSET(len2, *d2));
 			len2 = *d2++;
 			continue;
@@ -302,12 +313,18 @@ dname_pkt_hash(sldns_buffer* pkt, uint8_t* dname, hashvalue_type h)
 	uint8_t labuf[LDNS_MAX_LABELLEN+1];
 	uint8_t lablen;
 	int i;
+	int count = 0;
 
 	/* preserve case of query, make hash label by label */
 	lablen = *dname++;
 	while(lablen) {
 		if(LABEL_IS_PTR(lablen)) {
 			/* follow pointer */
+			if((size_t)PTR_OFFSET(lablen, *dname)
+				>= sldns_buffer_limit(pkt))
+				return h;
+			if(count++ > MAX_COMPRESS_PTRS)
+				return h;
 			dname = sldns_buffer_at(pkt, PTR_OFFSET(lablen, *dname));
 			lablen = *dname++;
 			continue;
@@ -341,6 +358,9 @@ void dname_pkt_copy(sldns_buffer* pkt, uint8_t* to, uint8_t* dname)
 				return;
 			}
 			/* follow pointer */
+			if((size_t)PTR_OFFSET(lablen, *dname)
+				>= sldns_buffer_limit(pkt))
+				return;
 			dname = sldns_buffer_at(pkt, PTR_OFFSET(lablen, *dname));
 			lablen = *dname++;
 			continue;
@@ -369,6 +389,7 @@ void dname_pkt_copy(sldns_buffer* pkt, uint8_t* to, uint8_t* dname)
 void dname_print(FILE* out, struct sldns_buffer* pkt, uint8_t* dname)
 {
 	uint8_t lablen;
+	int count = 0;
 	if(!out) out = stdout;
 	if(!dname) return;
 
@@ -382,6 +403,15 @@ void dname_print(FILE* out, struct sldns_buffer* pkt, uint8_t* dname)
 				fputs("??compressionptr??", out);
 				return;
 			}
+			if((size_t)PTR_OFFSET(lablen, *dname)
+				>= sldns_buffer_limit(pkt)) {
+				fputs("??compressionptr??", out);
+				return;
+			}
+			if(count++ > MAX_COMPRESS_PTRS) {
+				fputs("??compressionptr??", out);
+				return;
+			}
 			dname = sldns_buffer_at(pkt, PTR_OFFSET(lablen, *dname));
 			lablen = *dname++;
 			continue;
@@ -558,6 +588,34 @@ dname_lab_startswith(uint8_t* label, char* prefix, char** endptr)
 	return 1;
 }
 
+int
+dname_has_label(uint8_t* dname, size_t dnamelen, uint8_t* label)
+{
+	size_t len;
+
+	/* 1 byte needed for the label length */
+	if(dnamelen < 1)
+		return 0;
+
+	len = *dname;
+	while(len <= dnamelen) {
+		if(!(*dname)) {
+			if(*dname == *label)
+				return 1; /* empty label match */
+			/* termination label found, stop iterating */
+			return 0;
+		}
+		if(*dname == *label && *label &&
+			memlowercmp(dname+1, label+1, *dname) == 0)
+			return 1;
+		len += *dname;
+		dname += *dname;
+		dname++;
+		len++;
+	}
+	return 0;
+}
+
 int 
 dname_buffer_write(sldns_buffer* pkt, uint8_t* dname)
 {
diff --git a/util/data/dname.h b/util/data/dname.h
index 53a33c689bc0..e37c11822b36 100644
--- a/util/data/dname.h
+++ b/util/data/dname.h
@@ -197,6 +197,15 @@ int dname_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, int* mlabs);
 int dname_lab_startswith(uint8_t* label, char* prefix, char** endptr);
 
 /**
+ * Check if dname contains label
+ * @param dname: dname
+ * @param dnamelen: length of dname
+ * @param label: label to be checked for presence in dname
+ * @return: 1 if dname has this label, 0 otherwise
+ */
+int dname_has_label(uint8_t* dname, size_t dnamelen, uint8_t* label);
+
+/**
  * See if domain name d1 is a strict subdomain of d2.
  * That is a subdomain, but not equal. 
  * @param d1: domain name, uncompressed wireformat
diff --git a/util/data/msgencode.c b/util/data/msgencode.c
index a51a4b9b85d8..be69f628a507 100644
--- a/util/data/msgencode.c
+++ b/util/data/msgencode.c
@@ -480,7 +480,8 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 			sldns_buffer_write(pkt, &key->rk.type, 2);
 			sldns_buffer_write(pkt, &key->rk.rrset_class, 2);
 			if(data->rr_ttl[j] < timenow)
-				sldns_buffer_write_u32(pkt, 0);
+				sldns_buffer_write_u32(pkt,
+					SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0);
 			else 	sldns_buffer_write_u32(pkt, 
 					data->rr_ttl[j]-timenow);
 			if(c) {
@@ -517,7 +518,8 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 			sldns_buffer_write_u16(pkt, LDNS_RR_TYPE_RRSIG);
 			sldns_buffer_write(pkt, &key->rk.rrset_class, 2);
 			if(data->rr_ttl[i] < timenow)
-				sldns_buffer_write_u32(pkt, 0);
+				sldns_buffer_write_u32(pkt,
+					SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0);
 			else 	sldns_buffer_write_u32(pkt, 
 					data->rr_ttl[i]-timenow);
 			/* rrsig rdata cannot be compressed, perform 100+ byte
diff --git a/util/data/msgparse.c b/util/data/msgparse.c
index fb312370366d..7c32618a3015 100644
--- a/util/data/msgparse.c
+++ b/util/data/msgparse.c
@@ -55,7 +55,11 @@ smart_compare(sldns_buffer* pkt, uint8_t* dnow,
 {
 	if(LABEL_IS_PTR(*dnow)) {
 		/* ptr points to a previous dname */
-		uint8_t* p = sldns_buffer_at(pkt, PTR_OFFSET(dnow[0], dnow[1]));
+		uint8_t* p;
+		if((size_t)PTR_OFFSET(dnow[0], dnow[1])
+			>= sldns_buffer_limit(pkt))
+			return -1;
+		p = sldns_buffer_at(pkt, PTR_OFFSET(dnow[0], dnow[1]));
 		if( p == dprfirst || p == dprlast )
 			return 0;
 		/* prev dname is also a ptr, both ptrs are the same. */
diff --git a/util/data/msgparse.h b/util/data/msgparse.h
index c0c6ff5fd09f..fd04f9f6f071 100644
--- a/util/data/msgparse.h
+++ b/util/data/msgparse.h
@@ -79,8 +79,12 @@ extern time_t MAX_TTL;
 extern time_t MIN_TTL;
 /** Maximum Negative TTL that is allowed */
 extern time_t MAX_NEG_TTL;
+/** If we serve expired entries and prefetch them */
+extern int SERVE_EXPIRED;
 /** Time to serve records after expiration */
 extern time_t SERVE_EXPIRED_TTL;
+/** TTL to use for expired records */
+extern time_t SERVE_EXPIRED_REPLY_TTL;
 /** Negative cache time (for entries without any RRs.) */
 #define NORR_TTL 5 /* seconds */
 
diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index 4320f312d6f3..927bf09a29d8 100644
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -61,8 +61,12 @@ time_t MAX_TTL = 3600 * 24 * 10; /* ten days */
 time_t MIN_TTL = 0;
 /** MAX Negative TTL, for SOA records in authority section */
 time_t MAX_NEG_TTL = 3600; /* one hour */
+/** If we serve expired entries and prefetch them */
+int SERVE_EXPIRED = 0;
 /** Time to serve records after expiration */
 time_t SERVE_EXPIRED_TTL = 0;
+/** TTL to use for expired records */
+time_t SERVE_EXPIRED_REPLY_TTL = 30;
 
 /** allocate qinfo, return 0 on error */
 static int
diff --git a/util/data/packed_rrset.c b/util/data/packed_rrset.c
index 7b9d5494d960..4b0294f9724b 100644
--- a/util/data/packed_rrset.c
+++ b/util/data/packed_rrset.c
@@ -40,6 +40,7 @@
  */
 
 #include "config.h"
+#include "util/data/msgparse.h"
 #include "util/data/packed_rrset.h"
 #include "util/data/dname.h"
 #include "util/storage/lookup3.h"
@@ -351,11 +352,11 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
 	/* make TTLs relative - once per rrset */
 	for(i=0; i<d->count + d->rrsig_count; i++) {
 		if(d->rr_ttl[i] < now)
-			d->rr_ttl[i] = 0;
+			d->rr_ttl[i] = SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0;
 		else	d->rr_ttl[i] -= now;
 	}
 	if(d->ttl < now)
-		d->ttl = 0;
+		d->ttl = SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0;
 	else	d->ttl -= now;
 	return ck;
 }
@@ -386,3 +387,19 @@ packed_rrset_copy_alloc(struct ub_packed_rrset_key* key,
 	packed_rrset_ttl_add(dd, now);
 	return dk;
 }
+
+int
+packed_rrset_find_rr(struct packed_rrset_data* d, uint8_t* rdata, size_t len,
+	size_t* index)
+{
+	size_t i;
+	for(i=0; i<d->count; i++) {
+		if(d->rr_len[i] != len)
+			continue;
+		if(memcmp(d->rr_data[i], rdata, len) == 0) {
+			*index = i;
+			return 1;
+		}
+	}
+	return 0;
+}
diff --git a/util/data/packed_rrset.h b/util/data/packed_rrset.h
index 3a5335ddfa59..729877bab5ec 100644
--- a/util/data/packed_rrset.h
+++ b/util/data/packed_rrset.h
@@ -446,4 +446,17 @@ struct ub_packed_rrset_key* packed_rrset_copy_alloc(
 	struct ub_packed_rrset_key* key, struct alloc_cache* alloc, 
 	time_t now);
 
+/**
+ * Find RR index in packed rrset
+ * Raw comparison, does not canonicalize RDATA
+ * @param d: packed rrset
+ * @param rdata: RDATA of RR to find
+ * @param len: length of rdata
+ * @param index: pointer to int to store index of found RR
+ * @return 1 if RR found, 0 otherwise
+ */
+int
+packed_rrset_find_rr(struct packed_rrset_data* d, uint8_t* rdata, size_t len,
+	size_t* index);
+
 #endif /* UTIL_DATA_PACKED_RRSET_H */
diff --git a/util/fptr_wlist.c b/util/fptr_wlist.c
index f5da501de19b..84d41cc84641 100644
--- a/util/fptr_wlist.c
+++ b/util/fptr_wlist.c
@@ -131,6 +131,7 @@ fptr_whitelist_comm_timer(void (*fptr)(void*))
 	else if(fptr == &auth_xfer_timer) return 1;
 	else if(fptr == &auth_xfer_probe_timer_callback) return 1;
 	else if(fptr == &auth_xfer_transfer_timer_callback) return 1;
+	else if(fptr == &mesh_serve_expired_callback) return 1;
 	return 0;
 }
 
@@ -619,3 +620,9 @@ int fptr_whitelist_inplace_cb_query_response(
 	return 0;
 }
 
+int fptr_whitelist_serve_expired_lookup(serve_expired_lookup_func_type* fptr)
+{
+	if(fptr == &mesh_serve_expired_lookup)
+		return 1;
+	return 0;
+}
diff --git a/util/fptr_wlist.h b/util/fptr_wlist.h
index 03c2b92b45aa..cd331febb070 100644
--- a/util/fptr_wlist.h
+++ b/util/fptr_wlist.h
@@ -377,6 +377,13 @@ int fptr_whitelist_inplace_cb_edns_back_parsed(
 int fptr_whitelist_inplace_cb_query_response(
 	inplace_cb_query_response_func_type* fptr);
 
+/**
+ * Check function pointer whitelist for serve_expired_lookup func values.
+ * @param fptr: function pointer to check.
+ * @return false if not in whitelist.
+ */
+int fptr_whitelist_serve_expired_lookup(serve_expired_lookup_func_type* fptr);
+
 /** Due to module breakage by fptr wlist, these test app declarations
  * are presented here */
 /** 
diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index 3e6f3e6be617..3b8afe54e829 100644
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -3904,6 +3904,7 @@
 4600,
 4601,
 4621,
+4646,
 4658,
 4659,
 4660,
diff --git a/util/log.c b/util/log.c
index 8499d8c0a8a7..dfbb23349944 100644
--- a/util/log.c
+++ b/util/log.c
@@ -74,6 +74,7 @@ static lock_basic_type log_lock;
 #endif
 /** the identity of this executable/process */
 static const char* ident="unbound";
+static const char* default_ident="unbound";
 #if defined(HAVE_SYSLOG_H) || defined(UB_ON_WINDOWS)
 /** are we using syslog(3) to log to */
 static int logging_to_syslog = 0;
@@ -181,6 +182,24 @@ void log_ident_set(const char* id)
 	ident = id;
 }
 
+void log_ident_set_default(const char* id)
+{
+	default_ident = id;
+}
+
+void log_ident_revert_to_default()
+{
+	ident = default_ident;
+}
+
+void log_ident_set_or_default(const char* identity)
+{
+	if(identity == NULL || identity[0] == 0)
+		log_ident_set(default_ident);
+	else
+		log_ident_set(identity);
+}
+
 void log_set_time_asc(int use_asc)
 {
 	log_time_asc = use_asc;
diff --git a/util/log.h b/util/log.h
index 81d9d837d72b..098a850a5599 100644
--- a/util/log.h
+++ b/util/log.h
@@ -107,12 +107,30 @@ void log_thread_set(int* num);
 int log_thread_get(void);
 
 /**
- * Set identity to print, default is 'unbound'. 
+ * Set identity to print, default is 'unbound'.
  * @param id: string to print. Name of executable.
  */
 void log_ident_set(const char* id);
 
 /**
+ * Set default identity to print, default is 'unbound'.
+ * @param id: string to print. Name of executable.
+ */
+void log_ident_set_default(const char* id);
+
+/**
+ * Revert identity to print, back to the recorded default value.
+ */
+void log_ident_revert_to_default();
+
+/**
+ * Set identity to print if there is an identity, otherwise
+ * set the default.
+ * @param identity: the identity to set.
+ */
+void log_ident_set_or_default(const char* identity);
+
+/**
  * Set if the time value is printed ascii or decimal in log entries.
  * @param use_asc: if true, ascii is printed, otherwise decimal.
  *	If the conversion fails or you have no time functions, 
diff --git a/util/module.h b/util/module.h
index 1b9aed216c7b..fa89c647e370 100644
--- a/util/module.h
+++ b/util/module.h
@@ -307,6 +307,17 @@ typedef int inplace_cb_query_response_func_type(struct module_qstate* qstate,
 	struct dns_msg* response, int id, void* cb_args);
 
 /**
+ * Function called when looking for (expired) cached answers during the serve
+ * expired logic.
+ * Called as func(qstate, lookup_qinfo)
+ * Where:
+ *	qstate: the query state.
+ *	lookup_qinfo: the qinfo to lookup for.
+ */
+typedef struct dns_msg* serve_expired_lookup_func_type(
+	struct module_qstate* qstate, struct query_info* lookup_qinfo);
+
+/**
  * Module environment.
  * Services and data provided to the module.
  */
@@ -572,6 +583,14 @@ struct sock_list {
 struct respip_action_info;
 
 /**
+ * Struct to hold relevant data for serve expired
+ */
+struct serve_expired_data {
+	struct comm_timer* timer;
+	serve_expired_lookup_func_type* get_cached_answer;
+};
+
+/**
  * Module state, per query.
  */
 struct module_qstate {
@@ -612,6 +631,8 @@ struct module_qstate {
 	struct mesh_state* mesh_info;
 	/** how many seconds before expiry is this prefetched (0 if not) */
 	time_t prefetch_leeway;
+	/** serve expired data */
+	struct serve_expired_data* serve_expired_data;
 
 	/** incoming edns options from the front end */
 	struct edns_option* edns_opts_front_in;
diff --git a/util/net_help.c b/util/net_help.c
index 9747b5d55a78..0869f91f954e 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -284,6 +284,113 @@ int netblockstrtoaddr(const char* str, int port, struct sockaddr_storage* addr,
 	return 1;
 }
 
+/* RPZ format address dname to network byte order address */
+static int ipdnametoaddr(uint8_t* dname, size_t dnamelen,
+	struct sockaddr_storage* addr, socklen_t* addrlen, int* af)
+{
+	uint8_t* ia;
+	size_t dnamelabs = dname_count_labels(dname);
+	uint8_t lablen;
+	char* e = NULL;
+	int z = 0;
+	size_t len = 0;
+	int i;
+	*af = AF_INET;
+
+	/* need 1 byte for label length */
+	if(dnamelen < 1)
+		return 0;
+
+	if(dnamelabs > 6 ||
+		dname_has_label(dname, dnamelen, (uint8_t*)"\002zz")) {
+		*af = AF_INET6;
+	}
+	len = *dname;
+	lablen = *dname++;
+	i = (*af == AF_INET) ? 3 : 15;
+	if(*af == AF_INET6) {
+		struct sockaddr_in6* sa = (struct sockaddr_in6*)addr;
+		*addrlen = (socklen_t)sizeof(struct sockaddr_in6);
+		memset(sa, 0, *addrlen);
+		sa->sin6_family = AF_INET6;
+		ia = (uint8_t*)&sa->sin6_addr;
+	} else { /* ip4 */
+		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
+		*addrlen = (socklen_t)sizeof(struct sockaddr_in);
+		memset(sa, 0, *addrlen);
+		sa->sin_family = AF_INET;
+		ia = (uint8_t*)&sa->sin_addr;
+	}
+	while(lablen && i >= 0 && len <= dnamelen) {
+		char buff[LDNS_MAX_LABELLEN+1];
+		uint16_t chunk; /* big enough to not overflow on IPv6 hextet */
+		if((*af == AF_INET && (lablen > 3 || dnamelabs > 6)) ||
+			(*af == AF_INET6 && (lablen > 4 || dnamelabs > 10))) {
+			return 0;
+		}
+		if(memcmp(dname, "zz", 2) == 0 && *af == AF_INET6) {
+			/* Add one or more 0 labels. Address is initialised at
+			 * 0, so just skip the zero part. */
+			int zl = 11 - dnamelabs;
+			if(z || zl < 0)
+				return 0;
+			z = 1;
+			i -= (zl*2);
+		} else {
+			memcpy(buff, dname, lablen);
+			buff[lablen] = '\0';
+			chunk = strtol(buff, &e, (*af == AF_INET) ? 10 : 16);
+			if(!e || *e != '\0' || (*af == AF_INET && chunk > 255))
+				return 0;
+			if(*af == AF_INET) {
+				log_assert(i < 4 && i >= 0);
+				ia[i] = (uint8_t)chunk;
+				i--;
+			} else {
+				log_assert(i < 16 && i >= 1);
+				/* ia in network byte order */
+				ia[i-1] = (uint8_t)(chunk >> 8);
+				ia[i] = (uint8_t)(chunk & 0x00FF);
+				i -= 2;
+			}
+		}
+		dname += lablen;
+		lablen = *dname++;
+		len += lablen;
+	}
+	if(i != -1)
+		/* input too short */
+		return 0;
+	return 1;
+}
+
+int netblockdnametoaddr(uint8_t* dname, size_t dnamelen,
+	struct sockaddr_storage* addr, socklen_t* addrlen, int* net, int* af)
+{
+	char buff[3 /* 3 digit netblock */ + 1];
+	size_t nlablen;
+	if(dnamelen < 1 || *dname > 3)
+		/* netblock invalid */
+		return 0;
+	nlablen = *dname;
+
+	if(dnamelen < 1 + nlablen)
+		return 0;
+
+	memcpy(buff, dname+1, nlablen);
+	buff[nlablen] = '\0';
+	*net = atoi(buff);
+	if(*net == 0 && strcmp(buff, "0") != 0)
+		return 0;
+	dname += nlablen;
+	dname++;
+	if(!ipdnametoaddr(dname, dnamelen-1-nlablen, addr, addrlen, af))
+		return 0;
+	if((*af == AF_INET6 && *net > 128) || (*af == AF_INET && *net > 32))
+		return 0;
+	return 1;
+}
+
 int authextstrtoaddr(char* str, struct sockaddr_storage* addr, 
 	socklen_t* addrlen, char** auth_name)
 {
@@ -728,11 +835,13 @@ listen_sslctx_setup(void* ctxt)
 #ifdef HAVE_SSL
 	SSL_CTX* ctx = (SSL_CTX*)ctxt;
 	/* no SSLv2, SSLv3 because has defects */
+#if SSL_OP_NO_SSLv2 != 0
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
 		!= SSL_OP_NO_SSLv2){
 		log_crypto_err("could not set SSL_OP_NO_SSLv2");
 		return 0;
 	}
+#endif
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
 		!= SSL_OP_NO_SSLv3){
 		log_crypto_err("could not set SSL_OP_NO_SSLv3");
@@ -968,12 +1077,14 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert)
 		log_crypto_err("could not allocate SSL_CTX pointer");
 		return NULL;
 	}
+#if SSL_OP_NO_SSLv2 != 0
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
 		!= SSL_OP_NO_SSLv2) {
 		log_crypto_err("could not set SSL_OP_NO_SSLv2");
 		SSL_CTX_free(ctx);
 		return NULL;
 	}
+#endif
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
 		!= SSL_OP_NO_SSLv3) {
 		log_crypto_err("could not set SSL_OP_NO_SSLv3");
@@ -1160,13 +1271,21 @@ int listen_sslctx_setup_ticket_keys(void* sslctx, struct config_strlist* tls_ses
 		s++;
 	}
 	keys = calloc(s, sizeof(struct tls_session_ticket_key));
+	if(!keys)
+		return 0;
 	memset(keys, 0, s*sizeof(*keys));
 	ticket_keys = keys;
 
 	for(p = tls_session_ticket_keys; p; p = p->next) {
 		size_t n;
-		unsigned char *data = (unsigned char *)malloc(80);
-		FILE *f = fopen(p->str, "r");
+		unsigned char *data;
+		FILE *f;
+
+		data = (unsigned char *)malloc(80);
+		if(!data)
+			return 0;
+
+		f = fopen(p->str, "r");
 		if(!f) {
 			log_err("could not read tls-session-ticket-key %s: %s", p->str, strerror(errno));
 			free(data);
diff --git a/util/net_help.h b/util/net_help.h
index 79e2a834931a..7a33a72035d5 100644
--- a/util/net_help.h
+++ b/util/net_help.h
@@ -471,4 +471,19 @@ int tls_session_ticket_key_cb(void *s, unsigned char* key_name,unsigned char* iv
 /** Free memory used for TLS session ticket keys */
 void listen_sslctx_delete_ticket_keys(void);
 
+/**
+ * RPZ format netblock to network byte order address and netblock
+ * example RPZ netblock format dnames:
+ *  - 24.10.100.51.198.rpz-ip -> 198.51.100.10/24
+ *  - 32.10.zz.db8.2001.rpz-ip -> 2001:db8:0:0:0:0:0:10/32
+ * @param dname: the dname containing RPZ format netblock
+ * @param dnamelen: length of dname
+ * @param addr: where to store sockaddr.
+ * @param addrlen: length of stored sockaddr is returned.
+ * @param net: where to store netmask
+ * @param af: where to store address family.
+ * @return 0 on error.
+ */
+int netblockdnametoaddr(uint8_t* dname, size_t dnamelen,
+	struct sockaddr_storage* addr, socklen_t* addrlen, int* net, int* af);
 #endif /* NET_HELP_H */
diff --git a/util/netevent.c b/util/netevent.c
index 980bb8bea972..9fe5da2d45a3 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -1120,6 +1120,14 @@ ssl_handshake(struct comm_point* c)
 			return 0; /* closed */
 		} else if(want == SSL_ERROR_SYSCALL) {
 			/* SYSCALL and errno==0 means closed uncleanly */
+#ifdef EPIPE
+			if(errno == EPIPE && verbosity < 2)
+				return 0; /* silence 'broken pipe' */
+#endif
+#ifdef ECONNRESET
+			if(errno == ECONNRESET && verbosity < 2)
+				return 0; /* silence reset by peer */
+#endif
 			if(errno != 0)
 				log_err("SSL_handshake syscall: %s",
 					strerror(errno));
diff --git a/util/random.c b/util/random.c
index bb564f2f99aa..6eb102c634b9 100644
--- a/util/random.c
+++ b/util/random.c
@@ -78,7 +78,7 @@
  */
 #define MAX_VALUE 0x7fffffff
 
-#if defined(HAVE_SSL)
+#if defined(HAVE_SSL) || defined(HAVE_LIBBSD)
 struct ub_randstate* 
 ub_initstate(struct ub_randstate* ATTR_UNUSED(from))
 {
@@ -183,10 +183,10 @@ long int ub_random(struct ub_randstate* s)
 	}
 	return x & MAX_VALUE;
 }
-#endif /* HAVE_SSL or HAVE_NSS or HAVE_NETTLE */
+#endif /* HAVE_SSL or HAVE_LIBBSD or HAVE_NSS or HAVE_NETTLE */
 
 
-#if defined(HAVE_NSS) || defined(HAVE_NETTLE)
+#if defined(HAVE_NSS) || defined(HAVE_NETTLE) && !defined(HAVE_LIBBSD)
 long int
 ub_random_max(struct ub_randstate* state, long int x)
 {
@@ -198,7 +198,7 @@ ub_random_max(struct ub_randstate* state, long int x)
 		v = ub_random(state);
 	return (v % x);
 }
-#endif /* HAVE_NSS or HAVE_NETTLE */
+#endif /* HAVE_NSS or HAVE_NETTLE and !HAVE_LIBBSD */
 
 void 
 ub_randfree(struct ub_randstate* s)
diff --git a/util/storage/dnstree.c b/util/storage/dnstree.c
index 190369d851c8..f883044afa4b 100644
--- a/util/storage/dnstree.c
+++ b/util/storage/dnstree.c
@@ -104,11 +104,12 @@ int addr_tree_insert(rbtree_type* tree, struct addr_tree_node* node,
 	return rbtree_insert(tree, &node->node) != NULL;
 }
 
-void addr_tree_init_parents(rbtree_type* tree)
+void addr_tree_init_parents_node(struct addr_tree_node* node)
 {
-        struct addr_tree_node* node, *prev = NULL, *p;
+	struct addr_tree_node* prev = NULL, *p;
         int m;
-        RBTREE_FOR(node, struct addr_tree_node*, tree) {
+	for(; (rbnode_type*)node != RBTREE_NULL;
+		node = (struct addr_tree_node*)rbtree_next((rbnode_type*)node)) {
                 node->parent = NULL;
                 if(!prev || prev->addrlen != node->addrlen) {
                         prev = node;
@@ -130,6 +131,12 @@ void addr_tree_init_parents(rbtree_type* tree)
         }
 }
 
+void addr_tree_init_parents(rbtree_type* tree)
+{
+	addr_tree_init_parents_node(
+			(struct addr_tree_node*)rbtree_first(tree));
+}
+
 void name_tree_init_parents(rbtree_type* tree)
 {
         struct name_tree_node* node, *prev = NULL, *p;
diff --git a/util/storage/dnstree.h b/util/storage/dnstree.h
index 782644b633e9..d54602fd7ddf 100644
--- a/util/storage/dnstree.h
+++ b/util/storage/dnstree.h
@@ -174,6 +174,13 @@ int addr_tree_insert(rbtree_type* tree, struct addr_tree_node* node,
 void addr_tree_init_parents(rbtree_type* tree);
 
 /**
+ * Initialize parent pointers in partial addr tree.
+ * Reinitialize pointer for part of tree, used after node deletion
+ * @param node: node to start parent pointer initialization for.
+ */
+void addr_tree_init_parents_node(struct addr_tree_node* node);
+
+/**
  * Lookup closest encloser in addr tree.
  * @param tree: addr tree
  * @param addr: to lookup.
diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
index 5e02f6bdbad2..8f17c53e86de 100644
--- a/validator/val_secalgo.c
+++ b/validator/val_secalgo.c
@@ -54,6 +54,11 @@
 #error "Need crypto library to do digital signature cryptography"
 #endif
 
+/** fake DSA support for unit tests */
+int fake_dsa = 0;
+/** fake SHA1 support for unit tests */
+int fake_sha1 = 0;
+
 /* OpenSSL implementation */
 #ifdef HAVE_SSL
 #ifdef HAVE_OPENSSL_ERR_H
@@ -72,11 +77,6 @@
 #include <openssl/engine.h>
 #endif
 
-/** fake DSA support for unit tests */
-int fake_dsa = 0;
-/** fake SHA1 support for unit tests */
-int fake_sha1 = 0;
-
 /**
  * Output a libcrypto openssl error to the logfile.
  * @param str: string to add to it.
@@ -1509,13 +1509,21 @@ dnskey_algo_id_is_supported(int id)
 {
 	/* uses libnettle */
 	switch(id) {
-#if defined(USE_DSA) && defined(USE_SHA1)
 	case LDNS_DSA:
 	case LDNS_DSA_NSEC3:
+#if defined(USE_DSA) && defined(USE_SHA1)
+		return 1;
+#else
+		if(fake_dsa || fake_sha1) return 1;
+		return 0;
 #endif
-#ifdef USE_SHA1
 	case LDNS_RSASHA1:
 	case LDNS_RSASHA1_NSEC3:
+#ifdef USE_SHA1
+		return 1;
+#else
+		if(fake_sha1) return 1;
+		return 0;
 #endif
 #ifdef USE_SHA2
 	case LDNS_RSASHA256:
@@ -1820,6 +1828,15 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 		return sec_status_bogus;
 	}
 
+#ifndef USE_DSA
+	if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) &&(fake_dsa||fake_sha1))
+		return sec_status_secure;
+#endif
+#ifndef USE_SHA1
+	if(fake_sha1 && (algo == LDNS_DSA || algo == LDNS_DSA_NSEC3 || algo == LDNS_RSASHA1 || algo == LDNS_RSASHA1_NSEC3))
+		return sec_status_secure;
+#endif
+
 	switch(algo) {
 #if defined(USE_DSA) && defined(USE_SHA1)
 	case LDNS_DSA:
diff --git a/validator/validator.c b/validator/validator.c
index 4c560a8e1de1..c3ca0a27da83 100644
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -121,6 +121,8 @@ val_apply_cfg(struct module_env* env, struct val_env* val_env,
 		log_err("out of memory");
 		return 0;
 	}
+	if (env->key_cache)
+		val_env->kcache = env->key_cache;
 	if(!val_env->kcache)
 		val_env->kcache = key_cache_create(cfg);
 	if(!val_env->kcache) {
@@ -146,6 +148,8 @@ val_apply_cfg(struct module_env* env, struct val_env* val_env,
 		log_err("validator: cannot apply nsec3 key iterations");
 		return 0;
 	}
+	if (env->neg_cache)
+		val_env->neg_cache = env->neg_cache;
 	if(!val_env->neg_cache)
 		val_env->neg_cache = val_neg_create(cfg,
 			val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]);
@@ -196,7 +200,9 @@ val_deinit(struct module_env* env, int id)
 	anchors_delete(env->anchors);
 	env->anchors = NULL;
 	key_cache_delete(val_env->kcache);
+	env->key_cache = NULL;
 	neg_cache_delete(val_env->neg_cache);
+	env->neg_cache = NULL;
 	free(val_env->nsec3_keysize);
 	free(val_env->nsec3_maxiter);
 	free(val_env);